Pith. sign in

REVIEW 4 major objections 5 minor 63 references

An attack on retrieval-augmented generation can tell whether a given document sits in the system's hidden retrieval database, by measuring how much the 'yes' confidence drops when the query is perturbed.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-05 04:36 UTC pith:JN72IUBQ

load-bearing objection A real empirical attack with an overclaimed theory; worth refereeing, but Section 4.1 should be reframed as an empirical hypothesis, not a proof. the 4 major comments →

arxiv 2509.06026 v1 pith:JN72IUBQ submitted 2025-09-07 cs.CR cs.AIcs.LG

DCMI: A Differential Calibration Membership Inference Attack Against Retrieval-Augmented Generation

Xinyu Gao , Xiangtao Meng , Yingkai Dong , Zheng Li , Shanqing Guo This is my paper
classification cs.CR cs.AIcs.LG
keywords membership inference attackretrieval-augmented generationdifferential calibrationquery perturbationretrieval database privacyblack-box attacksensitivity gap
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims that an attacker can determine whether a specific text sits inside the hidden retrieval database of a retrieval-augmented generation (RAG) system — one that answers questions by pulling in documents from a private knowledge base. It says previous attacks fail because a query always retrieves several documents, and the similar-but-nonmatching documents drown out the signal from the exact-matching document. DCMI's fix is to ask the system twice: once with the original target as a 'yes/no' verification query, and once with key adjectives or adverbs swapped for antonyms, then subtract the second confidence score from the first. The paper argues that an exactly-matching document is uniquely sensitive to such perturbation, so the subtraction cancels out the non-member noise and leaves a membership-only signal. If it works, membership of medical, legal, or financial records in RAG databases becomes testable by anyone who can submit two queries — the attack reports up to 97.42% AUC and 94.35% accuracy in gray-box settings, and about 74% accuracy on production RAG platforms.

Core claim

The paper's central claim is the calibrated membership identity of Equation 6: subtracting the 'yes' probability for a perturbed query from the original leaves approximately I{q∈M}·p_η(d*|q)·p_θ(Yes|q,d*) — near zero for non-members, positive for members. The mechanism is a sensitivity gap: an exactly matching database document loses much of its push toward 'yes' under light perturbation, while non-member documents hold constant, so subtraction cancels their interference. It holds in gray-box, distribution-only, and black-box settings, where a 'yes'-to-'no' flip marks membership, yielding up to 97.42% AUC and 74% accuracy on real platforms.

What carries the argument

Differential calibration: the score P_rag,calibrated(Yes|q) = P_rag(Yes|q) − P_rag(Yes|q′), the subtraction of the RAG system's 'yes' probability on an adversarially perturbed query from the original. Its derivation starts from the standard factorization of RAG generation as a weighted sum over retrieved documents (Equation 1); the score collapses to Equation 6, P_rag,calibrated(Yes|q) ≈ I{q∈M}·p_η(d*|q)·p_θ(Yes|q,d*), a membership indicator times the most-similar document's retrieval weight and conditional 'yes' probability. Two assumptions carry the identity: query perturbation barely changes retrieval weights (Appendix B bounds the cosine-similarity shift by 2‖δ‖/‖q‖), and the sensitivity

Load-bearing premise

The attack assumes a sensitivity gap — a document that exactly matches the query loses much of its influence on the 'yes' answer when the query is lightly perturbed, while every similar-but-nonmatching retrieved document keeps its influence nearly unchanged — and this gap was verified only in the single-document setting; if non-member documents also respond to perturbation, or the gap shrinks when four or more documents are retrieved, the calibrated difference no longer isola

What would settle it

Measure the calibrated score P_rag(Yes|q) − P_rag(Yes|q′) on a held-out set of non-member queries in a system that retrieves four or more documents with a third-party LLM doing the perturbation. If non-member scores spread as widely as member scores — pushing AUC toward 0.5 instead of the reported ~0.75–0.97 — the sensitivity gap does not survive its ideal-case assumptions. A second check: replace antonym replacement with synonym substitution or character-level noise; if the member/non-member gap collapses, the mechanism depends on semantic-contrast perturbation specifically, not on perturbati

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Membership of a target text in a RAG retrieval database becomes testable with just two queries — original and perturbed — with no access to the database itself; Equation 6 makes the calibrated score a direct membership indicator.
  • The attack transfers to fully black-box settings: member samples flip from 'Yes' to 'No' under perturbation, non-members stay on the same side of the decision boundary, so binary responses alone leak membership.
  • The attack's accuracy holds within about 2% AUC as the number of retrieved documents grows from 2 to 6, the regime where raw-confidence baselines visibly degrade (e.g., RAG-MIA-gray drops from 66.1% to 61.8% accuracy).
  • Production RAG platforms are currently vulnerable: on Dify and MaxKB the attack keeps a 10–20% accuracy advantage over the RAG-MIA baseline, reaching 74% accuracy on MaxKB.
  • Three countermeasures reduce the attack's effectiveness — instruction-based refusal (AUC −4%), query paraphrasing (−20%), and post-retrieval conversion of documents to entity-relation triples (down to ~50% AUC) — but each trades off some generative utility.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the sensitivity gap is a property of exact-match identity rather than of language, the same two-query probe should work on any retrieval pipeline whose output averages over retrieved items — rerankers, database-backed QA, even image or genomic databases; the paper's genomic-data result (95.5% AUC by flipping one strand identifier) is evidence in that direction.
  • The real-world results suggest the practical weak point is retrieval overlap: any sample that surfaces in the top-k as an exact match leaks. A defense that guarantees no exact textual match — chunking to break document identity, hashing, or injecting controlled noise into stored vectors — would target the mechanism more directly than the tested instruction-based defense.
  • A testable hardening question follows from the perturbation design: if synonym substitution or character-level noise produces a comparable sensitivity gap, the effect is perturbation-generic and harder to defend; if only antonymic semantic contrast works, defenders can focus on detecting semantic-contrast queries.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes DCMI, a membership inference attack (MIA) against the retrieval database of retrieval-augmented generation (RAG) systems. The attack formulates a yes/no verification query from a target sample, constructs an adversarially perturbed version of that query, and subtracts the RAG system's output confidence (or binary response) for the perturbed query from that for the original query. The central theoretical claim, expressed in Eq. (6) of Section 4.1, is that this differential calibration cancels the contribution of non-member retrieved documents and leaves a signal proportional to the indicator of membership in the retrieval database. The paper evaluates the method under three progressively weaker adversary models, across two datasets, multiple generative models, retrievers, RAG frameworks, numbers of retrieved documents, and two real-world RAG platforms (Dify and MaxKB). It reports consistent improvements over prior RAG-targeted MIAs, with the strongest gray-box results reaching 97.42% AUC on a Flan-T5-based system, and 74% accuracy on MaxKB in the black-box setting. The paper also proposes three defenses and shows that they partially degrade the attack.

Significance. If the theoretical derivation were fully established, the paper would make a significant contribution to the privacy analysis of RAG systems: it identifies a RAG-specific source of interference (non-member retrieved documents), proposes a calibration mechanism to remove it, and provides an unusually broad evaluation spanning gray-box, distribution-aware, and black-box adversaries. The empirical breadth is a clear strength: the attack is tested over multiple generators, retrievers, frameworks, retrieval counts, and real-world platforms, and the ablation study consistently attributes a 6–9% AUC improvement to the differential calibration module. The code is publicly available. However, the load-bearing theoretical result in Eq. (6) is not actually proven by the arguments given; it rests on unverified assumptions about softmax-weight stability and about the sensitivity gap persisting in multi-document retrieval and in binary-response settings. These gaps matter because the paper's explanation of why the attack works is built on Eq. (6), and the black-box decision-reversal argument in Appendix C requires an additional threshold-crossing condition that is asserted rather than demonstrat

major comments (4)
  1. [Section 4.1, Eq. (5) to Eq. (6); Appendix B] The move from Eq. (5) to Eq. (6) requires p_eta(d|q) ≈ p_eta(d|q') for all retrieved documents. Appendix B only bounds |exp(s(d,q')) - exp(s(d,q))| for each document; it does not bound the normalized softmax weights p_eta(d|q) = exp(s(d,q))/Σ_j exp(s(d_j,q)). Even small per-document changes in exponent can shift softmax weights non-negligibly when scores are close, so the cancellation of the non-member terms Δε is not established. Since Eq. (6) is the foundation of the membership signal, this is a load-bearing gap. The authors should either prove a bound on the softmax weights under the stated perturbation model or explicitly reframe Eq. (6) as a heuristic assumption and validate it directly with per-document retrieval-weight measurements for k>1.
  2. [Section 4.1, Figure 3; Appendix C, Figure 20] The claimed sensitivity gap—p_θ(Yes|q,d*) ≫ p_θ(Yes|q',d*) for member documents and p_θ(Yes|q,d) ≈ p_θ(Yes|q',d) for non-member documents—is empirically verified only in the Basic RAG Setting with a single retrieved document, where p_eta(d|q)=1 by construction. In multi-document retrieval (k=4), the reported Figure 20 measures P_rag(Yes|q) before and after perturbation, which is a mixture of p_eta shifts and p_θ sensitivity, so it does not isolate the claimed gap. The derivation of Eq. (6) requires the gap to persist when multiple documents are retrieved and when the third-party LLM performs the perturbation. Please provide direct per-document measurements of p_θ for k>1, or otherwise state explicitly that the sensitivity gap is a hypothesis validated only in the k=1 case.
  3. [Section 4.1 and Appendix C (black-box decision reversal)] The black-box attack requires that for member samples the perturbation-induced drop in P_rag(Yes|q) crosses the decision boundary α, i.e., P_rag(Yes|q)>α and P_rag(Yes|q')<α. The paper only shows that the probability drops; it does not prove or quantify the crossing condition. Figure 20 displays aggregate distributions, not per-sample decision reversals, and the reported black-box accuracies (e.g., 65–75% in Table 4) imply that reversal is not universal. The deterministic statement in Appendix C that 'member samples yield a score of 1 due to decision reversal' is therefore too strong. Please provide per-sample statistics on the fraction of members exhibiting reversal, and either weaken the theoretical claim to a probabilistic statement or prove a margin condition.
  4. [Section 4.1, 'Based on the above proof'] The derivation of Eq. (6) is presented as a proof, but the two assumptions stated immediately before it are essentially the content of the conclusion. The first assumption (p_eta stability) is unverified in the relevant multi-document regime, and the second (sensitivity gap) is a hypothesis 'inspired by [39]' that is verified only in a degenerate single-document setting. Calling this a proof overstates the result. The authors should relabel Section 4.1 as 'Theoretical Motivation' or 'Derivation under Assumptions', and make the dependence on these assumptions explicit in the abstract and contributions.
minor comments (5)
  1. [Appendix C, Eq. (14)] Typo: 'defied' should be 'defined'.
  2. [Section 8.2 (and Appendix K)] The baseline is referred to as both 'RAG-MIA' and 'MIA-RAG'. Please unify the terminology.
  3. [Figure 3] The caption says 'Pre- and Post-Perturbation' but does not define whether 'pre' refers to the original query q and 'post' to the perturbed query q'. Please clarify in the caption.
  4. [Section 5.1, Eq. (8)] The calibration formula is written both as Eq. (5) and Eq. (8) with identical content. This duplication is unnecessary; one equation would suffice, or the second occurrence should reference the first.
  5. [Table 2 and Table 4] Standard deviations or confidence intervals are not reported for the accuracy/AUC numbers. Given the substantial reported advantages over baselines, a small number of repeated runs with variance estimates would strengthen the empirical claims.

Circularity Check

0 steps flagged

No significant circularity: the derivation rests on explicit assumptions that are empirically tested, and the attack is evaluated on held-out data against baselines.

full rationale

The paper's central derivation (Eq. 4 → Eq. 6) is a conditional argument: it assumes (i) retrieval-weight stability under perturbation, p_η(d|q) ≈ p_η(d|q′), and (ii) a sensitivity gap whereby p_θ('Yes'|q,d) is more perturbable for member-retrieved documents than for non-member ones. Both assumptions are stated explicitly — the second is even introduced as 'we hypothesize' and is verified in a controlled k=1 setting (Figure 3) where ε=0 and p_η=1. The resulting calibrated score is then not defined in terms of membership; it is defined as a difference of two observable RAG confidences, and Eq. 6 follows algebraically from the stated assumptions. The main experimental claims are evaluated on held-out test samples that are disjoint from the reference data used to tune the perturbation magnitude and threshold, so the reported AUC/accuracy numbers are not forced by construction. The Appendix B bound only addresses unnormalized exp(similarity) rather than the softmax weights p_η, which is a legitimate rigor concern about the transfer from k=1 to k=4, but it is a soundness gap, not a circularity: nothing in the derivation clandestinely assumes the target result. No load-bearing self-citation is present; the cited works on perturbation robustness and neighborhood-based MIAs are external and used only as motivation. Therefore, the paper exhibits no significant circularity under the defined criteria.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

The method introduces no new noun-like entity; its burden lies in free parameters (θ, γ) and two empirical assumptions about perturbation sensitivity.

free parameters (3)
  • perturbation magnitude θ = 0.06
    Grid-searched over 0.04-0.12 on the Adversary 1 reference dataset (Section 5.1), then fixed for Adversaries 2 and 3. Attack performance depends on this value.
  • classification threshold γ = grid 0.1-1.0 (A1); Q3 of reference non-member calibrated scores (A2); score==1 rule (A3)
    For Adversary 1, γ is chosen by grid search on the reference subset of the target database. Adversary 2 sets τ = Q3 of non-member reference calibrations. These are fitted on data, not derived from the model.
  • retrieval document count k = 4 (default)
    Set to 4 following prior work [2]; attack is tested on 2-6. Not a DCMI-specific fit, but affects interference level.
axioms (4)
  • domain assumption RAG token probabilities factor as a weighted mixture over retrieved documents (Equation 1, after Cuconasu et al. [10]).
    Basis for writing P_rag as p_η(d*|q)p_θ(...) + ε. Simplified to a yes/no binary task in Section 4.1.
  • domain assumption Query perturbation leaves retrieval similarity weights nearly unchanged, p_η(d|q) ≈ p_η(d|q').
    Appendix B proves a Lipschitz bound |Δs| ≤ 2||δ||/||q||, which bounds but does not guarantee equality; the derivation treats it as an approximation.
  • ad hoc to paper Sensitivity gap: member documents' yes-probability drops sharply under perturbation while non-member documents stay stable.
    Stated as a key hypothesis in Section 4.1 and verified empirically under a restricted one-document setting; it is the load-bearing premise of Equations 5-6 and of the black-box decision-reversal argument.
  • ad hoc to paper For the black-box case, the perturbation-induced drop crosses the 0.5 decision boundary for members but not for non-members.
    Appendix C asserts this 'crucially' without proof; Figure 20 provides empirical distributions for three models, but the claim is used as a fact to define the f_rag,calibrated classifier.

pith-pipeline@v1.3.0-alltime-deepseek · 28779 in / 13053 out tokens · 127841 ms · 2026-08-05T04:36:09.033060+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of DCMI: A Differential Calibration Membership Inference Attack Against Retrieval-Augmented Generation." pith.science (2026). https://pith.science/paper/JN72IUBQ

@misc{pith2026250906026,
  author       = {Pith},
  title        = {Pith review of: DCMI: A Differential Calibration Membership Inference Attack Against Retrieval-Augmented Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JN72IUBQ}},
  note         = {Machine review of arXiv:2509.06026}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

While Retrieval-Augmented Generation (RAG) effectively reduces hallucinations by integrating external knowledge bases, it introduces vulnerabilities to membership inference attacks (MIAs), particularly in systems handling sensitive data. Existing MIAs targeting RAG's external databases often rely on model responses but ignore the interference of non-member-retrieved documents on RAG outputs, limiting their effectiveness. To address this, we propose DCMI, a differential calibration MIA that mitigates the negative impact of non-member-retrieved documents. Specifically, DCMI leverages the sensitivity gap between member and non-member retrieved documents under query perturbation. It generates perturbed queries for calibration to isolate the contribution of member-retrieved documents while minimizing the interference from non-member-retrieved documents. Experiments under progressively relaxed assumptions show that DCMI consistently outperforms baselines--for example, achieving 97.42% AUC and 94.35% Accuracy against the RAG system with Flan-T5, exceeding the MBA baseline by over 40%. Furthermore, on real-world RAG platforms such as Dify and MaxKB, DCMI maintains a 10%-20% advantage over the baseline. These results highlight significant privacy risks in RAG systems and emphasize the need for stronger protection mechanisms. We appeal to the community's consideration of deeper investigations, like ours, against the data leakage risks in rapidly evolving RAG systems. Our code is available at https://github.com/Xinyu140203/RAG_MIA.

Figures

Figures reproduced from arXiv: 2509.06026 by Shanqing Guo, Xiangtao Meng, Xinyu Gao, Yingkai Dong, Zheng Li.

Figure 1
Figure 1. Figure 1: The interference from non-member-retrieved docu￾ments compromises the reliability of membership inference sig￾nals in RAG systems. For member queries, the presence of non-member-retrieved documents can degrade response quality, leading to misclassification as a non-member. For non-member queries, the retrieved non-member-retrieved documents may provide sufficient context to generate high-quality responses,… view at source ↗
Figure 2
Figure 2. Figure 2: a, using Prag(y | q) as the membership score clearly distinguishes between member and non-member samples. −0.25 0.00 0.25 0.50 0.75 1.00 1.25 Distribution of probabilities 0 2 4 6 8 10 12 14 16 Density Member Non-Member (a) One document retrieved −0.25 0.00 0.25 0.50 0.75 1.00 1.25 Distribution of probabilities 0 2 4 6 8 10 12 14 16 Density Member Non-Member (b) Four documents retrieved [PITH_FULL_IMAGE:f… view at source ↗
Figure 3
Figure 3. Figure 3: Distribution of conditional probabilities [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: The overall architecture of our proposed [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: AUC of Adversary 1 on three generative modules. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 7
Figure 7. Figure 7: AUC of Adversary 1 on three RAG frameworks. [PITH_FULL_IMAGE:figures/full_fig_p008_7.png] view at source ↗
Figure 6
Figure 6. Figure 6: AUC of Adversary 1 on two retrieval modules. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 8
Figure 8. Figure 8: AUC of Adversary 1 on different numbers of retrieved [PITH_FULL_IMAGE:figures/full_fig_p009_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Performance analysis on Adversary 1. Llama Mistral Flan−T5 0.0 0.2 0.4 0.6 0.8 1.0 Probability Member Non Member [PITH_FULL_IMAGE:figures/full_fig_p010_9.png] view at source ↗
Figure 11
Figure 11. Figure 11: Accuracy of Adversary 2 on five RAG systems. [PITH_FULL_IMAGE:figures/full_fig_p010_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: AUC of Adversary 2 on three generative modules. [PITH_FULL_IMAGE:figures/full_fig_p011_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: AUC of Adversary 2 on two retrieval modules. [PITH_FULL_IMAGE:figures/full_fig_p011_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: AUC of Adversary 2 on three RAG frameworks. [PITH_FULL_IMAGE:figures/full_fig_p011_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Performance Analysis on Adversary 2. as: frag,calibrated(q) = frag(q)− frag(q ′ ), (12) Membership Inference. During the membership inference, for a target sample x, the adversary constructs both the orig￾inal query q and its perturbed version q ′ . Both queries are then input into the target RAG system to obtain the cali￾brated numerical value frag,calibrated(q). Based on the theo￾retical insight that me… view at source ↗
Figure 16
Figure 16. Figure 16: AUC of Adversary 3 on three generative modules. [PITH_FULL_IMAGE:figures/full_fig_p012_16.png] view at source ↗
Figure 17
Figure 17. Figure 17: AUC of Adversary 3 on two retrieval modules. [PITH_FULL_IMAGE:figures/full_fig_p013_17.png] view at source ↗
Figure 18
Figure 18. Figure 18: AUC of Adversary 3 on three RAG frameworks. [PITH_FULL_IMAGE:figures/full_fig_p013_18.png] view at source ↗
Figure 19
Figure 19. Figure 19: Performance Analysis on Adversary 3. 8.2 Potential Defenses By progressively relaxing our attack assumptions, we arrive at the fully realistic black-box Adversary 3, which demon￾strates robust and efficient membership inference capabili￾ties, revealing substantial privacy risks. In this section, we explore two potential defense strategies to minimize infor￾mation leakage about the retrieval database. Setu… view at source ↗
Figure 20
Figure 20. Figure 20: Distribution of generation probabilities [PITH_FULL_IMAGE:figures/full_fig_p020_20.png] view at source ↗
Figure 22
Figure 22. Figure 22: Accuracy of Adversary 1 on three generative mod [PITH_FULL_IMAGE:figures/full_fig_p022_22.png] view at source ↗
Figure 23
Figure 23. Figure 23: Accuracy of Adversary 1 on two retrieval modules. [PITH_FULL_IMAGE:figures/full_fig_p022_23.png] view at source ↗
Figure 24
Figure 24. Figure 24: Accuracy of Adversary 1 on three RAG frameworks. [PITH_FULL_IMAGE:figures/full_fig_p022_24.png] view at source ↗
Figure 25
Figure 25. Figure 25: AUC of Adversary 2 on five RAG systems. 22 [PITH_FULL_IMAGE:figures/full_fig_p022_25.png] view at source ↗
Figure 29
Figure 29. Figure 29: Accuracy of Adversary 3 on three generative mod [PITH_FULL_IMAGE:figures/full_fig_p023_29.png] view at source ↗
Figure 30
Figure 30. Figure 30: Accuracy of Adversary 3 on two retrieval modules. [PITH_FULL_IMAGE:figures/full_fig_p023_30.png] view at source ↗
Figure 31
Figure 31. Figure 31: Accuracy of Adversary 3 on three RAG frameworks. [PITH_FULL_IMAGE:figures/full_fig_p023_31.png] view at source ↗
Figure 32
Figure 32. Figure 32: Performance analysis on Adversary 1. 2 3 4 5 6 Number of Retrieved Documents 0.55 0.65 0.75 0.85 Accuracy DCMI RAG-MIA MBA IA (a) Accuracy of Adversary 2 on different numbers of retrieved documents. 0.70 0.75 Accuracy Pre-Calibration Post-Calibration 2 3 4 5 6 Number of Retrieved Documents 0.06 0.08 ∆Accuracy +0.072 +0.069 +0.070 +0.051 +0.055 (b) Impact of differential calibration mod￾ule. 0.04 0.06 0.08… view at source ↗
Figure 33
Figure 33. Figure 33: Performance analysis on Adversary 2. 2 3 4 5 6 Number of Retrieved Documents 0.45 0.55 0.65 0.75 0.85 Accuracy DCMI RAG-MIA (a) Accuracy of Adversary 3 on different numbers of retrieved documents. 0.70 0.75 Accuracy Pre-Calibration Post-Calibration 2 3 4 5 6 Number of Retrieved Documents 0.06 0.08 ∆Accuracy +0.078 +0.065 +0.072 +0.082 +0.075 (b) Impact of differential calibration mod￾ule. 0.04 0.06 0.08 0… view at source ↗
Figure 34
Figure 34. Figure 34: Performance analysis on Adversary 3. 24 [PITH_FULL_IMAGE:figures/full_fig_p024_34.png] view at source ↗
Figure 35
Figure 35. Figure 35: Extended ablation study across different RAG components. The top row shows Adversary 1 & 2, the bottom row shows [PITH_FULL_IMAGE:figures/full_fig_p026_35.png] view at source ↗
Figure 36
Figure 36. Figure 36: Prompt robustness evaluation on adversaries before [PITH_FULL_IMAGE:figures/full_fig_p026_36.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

63 extracted references · 40 canonical work pages · 5 internal anchors

  1. [1]

    SoK: Reducing the Vulnerability of Fine-tuned Language Models to Membership Inference Attacks

    Guy Amit, Abigail Goldsteen, and Ariel Farkash. Sok: Reducing the vulnerability of fine-tuned language mod- els to membership inference attacks.arXiv preprint arXiv:2403.08481, 2024. 1

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  2. [2]

    Is my data in your retrieval database? membership in- ference attacks against retrieval augmented generation

    Maya Anderson, Guy Amit, and Abigail Goldsteen. Is my data in your retrieval database? membership in- ference attacks against retrieval augmented generation. arXiv preprint arXiv:2405.20446, 2024. 2, 3, 4, 7, 8, 10, 12, 13, 21

    Pith/arXiv arXiv 2024

  3. [3]

    Palm 2 technical report.arXiv preprint arXiv:2305.10403, 2023

    Rohan Anil, Andrew M Dai, Orhan Firat, Melvin Johnson, Dmitry Lepikhin, Alexandre Passos, Sia- mak Shakeri, Emanuel Taropa, Paige Bailey, Zhifeng Chen, et al. Palm 2 technical report.arXiv preprint arXiv:2305.10403, 2023. 1

    Pith/arXiv arXiv 2023

  4. [4]

    Improving language models by retrieving from trillions of tokens

    Sebastian Borgeaud, Arthur Mensch, Jordan Hoffmann, Trevor Cai, Eliza Rutherford, Katie Millican, George Bm Van Den Driessche, Jean-Baptiste Lespiau, Bogdan Damoc, Aidan Clark, et al. Improving language models by retrieving from trillions of tokens. InInternational Conference on Machine Learning, pages 2206–2240. PMLR, 2022. 1

    work page 2022

  5. [5]

    Language models are few-shot learners

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-V oss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel Ziegler, Jeffrey Wu, Clemens Winter, Chris Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott G...

    work page 1901

  6. [6]

    Member- ship inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Member- ship inference attacks from first principles. In2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914. IEEE, 2022. 1, 3

    work page 1914

  7. [7]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlings- son, et al. Extracting training data from large language models. In30th USENIX Security Symposium (USENIX Security 21), pages 2633–2650, 2021. 3

    work page 2021

  8. [8]

    Label-only membership inference attacks

    Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. InInternational confer- ence on machine learning, pages 1964–1974. PMLR,

    work page 1964

  9. [9]

    Chi, Jeff Dean, Jacob Devlin, Adam Roberts, Denny Zhou, Quoc V

    Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Eric Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, Albert Web- son, Shixiang Shane Gu, Zhuyun Dai, Mirac Suzgun, Xinyun Chen, Aakanksha Chowdhery, Sharan Narang, Gaurav Mishra, Adams Yu, Vincent Zhao, Yanping Huang, Andrew Dai, Hongkun Yu, Slav Petrov, Ed H. Chi, Jeff Dea...

    work page 2022

  10. [10]

    The power of noise: Redefining retrieval for rag systems

    Florin Cuconasu, Giovanni Trappolini, Federico Si- ciliano, Simone Filice, Cesare Campagnano, Yoelle Maarek, Nicola Tonellotto, and Fabrizio Silvestri. The power of noise: Redefining retrieval for rag systems. InProceedings of the 47th International ACM SIGIR Conference on Research and Development in Informa- tion Retrieval, pages 719–729, 2024. 4

    work page 2024

  11. [11]

    Membership inference attacks against fine-tuned large language models via self-prompt calibration

    Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Membership inference attacks against fine-tuned large language models via self-prompt calibration. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems,

    work page

  12. [12]

    Transforming healthcare education: Harnessing large language models for frontline health worker ca- pacity building using retrieval-augmented generation

    Yasmina Al Ghadban, Huiqi Yvonne Lu, Uday Adavi, Ankita Sharma, Sridevi Gara, Neelanjana Das, Bhaskar Kumar, Renu John, Praveen Devarsetty, and Jane E Hirst. Transforming healthcare education: Harnessing large language models for frontline health worker ca- pacity building using retrieval-augmented generation. medRxiv, pages 2023–12, 2023. 1

    work page 2023

  13. [13]

    Logan: Evaluating information leakage of generative models using generative adver- sarial networks.arXiv preprint arXiv:1705.07663, 18,

    Jamie Hayes, Luca Melis, George Danezis, and Emil- iano De Cristofaro. Logan: Evaluating information leakage of generative models using generative adver- sarial networks.arXiv preprint arXiv:1705.07663, 18,

    Pith/arXiv arXiv

  14. [14]

    Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Models

    Xinlei He, Zheng Li, Weilin Xu, Cory Cornelius, and Yang Zhang. Membership-doctor: Comprehensive assessment of membership inference against machine learning models.arXiv preprint arXiv:2208.10445,

    work page internal anchor Pith review Pith/arXiv arXiv

  15. [15]

    [Online]

    Healthcaremagic-100k-en. [Online]. Avail- able:https://huggingface.co/datasets/ wangrongsheng/HealthCareMagic-100k-en. 7, 21

    work page

  16. [16]

    On the ro- bustness of self-attentive models

    Yu-Lun Hsieh, Minhao Cheng, Da-Cheng Juan, Wei Wei, Wen-Lian Hsu, and Cho-Jui Hsieh. On the ro- bustness of self-attentive models. InProceedings of the 57th Annual Meeting of the Association for Computa- tional Linguistics, pages 1520–1529, 2019. 5

    work page 2019

  17. [17]

    Membership in- 15 ference attacks on machine learning: A survey.ACM Computing Surveys (CSUR), 54(11s):1–37, 2022

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dob- bie, Philip S Yu, and Xuyun Zhang. Membership in- 15 ference attacks on machine learning: A survey.ACM Computing Surveys (CSUR), 54(11s):1–37, 2022. 1, 3

    work page 2022

  18. [18]

    Membership inference attacks against vision-language models.arXiv preprint arXiv:2501.18624, 2025

    Yuke Hu, Zheng Li, Zhihao Liu, Yang Zhang, Zhan Qin, Kui Ren, and Chun Chen. Membership inference attacks against vision-language models.arXiv preprint arXiv:2501.18624, 2025. 3

    Pith/arXiv arXiv 2025

  19. [19]

    Gpt-4o system card.arXiv preprint arXiv:2410.21276,

    Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-4o system card.arXiv preprint arXiv:2410.21276,

    Pith/arXiv arXiv

  20. [20]

    Mistral 7b.arXiv preprint arXiv:2310.06825, 2023

    Albert Q Jiang, Alexandre Sablayrolles, Arthur Men- sch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guil- laume Lample, Lucile Saulnier, et al. Mistral 7b.arXiv preprint arXiv:2310.06825, 2023. 7

    Pith/arXiv arXiv 2023

  21. [21]

    Rag-thief: Scalable extraction of private data from retrieval-augmented generation ap- plications with agent-based attacks.arXiv preprint arXiv:2411.14110, 2024

    Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, and Min Yang. Rag-thief: Scalable extraction of private data from retrieval-augmented generation ap- plications with agent-based attacks.arXiv preprint arXiv:2411.14110, 2024. 4

    Pith/arXiv arXiv 2024

  22. [22]

    Longllmlingua: Accelerating and enhancing llms in long context scenarios via prompt compression.arXiv preprint arXiv:2310.06839, 2023

    Huiqiang Jiang, Qianhui Wu, Xufang Luo, Dong- sheng Li, Chin-Yew Lin, Yuqing Yang, and Lili Qiu. Longllmlingua: Accelerating and enhancing llms in long context scenarios via prompt compression.arXiv preprint arXiv:2310.06839, 2023. 7, 21, 22

    Pith/arXiv arXiv 2023

  23. [23]

    Flashrag: A modular toolkit for ef- ficient retrieval-augmented generation research.arXiv preprint arXiv:2405.13576, 2024

    Jiajie Jin, Yutao Zhu, Xinyu Yang, Chenghao Zhang, and Zhicheng Dou. Flashrag: A modular toolkit for ef- ficient retrieval-augmented generation research.arXiv preprint arXiv:2405.13576, 2024. 7

    Pith/arXiv arXiv 2024

  24. [24]

    Dense passage retrieval for open-domain question answering

    Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen tau Yih. Dense passage retrieval for open-domain question answering. In2020 Conference on Empiri- cal Methods in Natural Language Processing, EMNLP 2020, pages 6769–6781. Association for Computa- tional Linguistics (ACL), 2020. 1, 2

    work page 2020

  25. [25]

    Chain of reference prompting helps llm to think like a lawyer, 2023

    Aditya Kuppa, Nikon Rasumov-Rahe, and Marc V oses. Chain of reference prompting helps llm to think like a lawyer, 2023. 1

    work page 2023

  26. [26]

    Stolen memo- ries: Leveraging model memorization for calibrated white-box membership inference

    Klas Leino and Matt Fredrikson. Stolen memo- ries: Leveraging model memorization for calibrated white-box membership inference. InUSENIX Secu- rity Symposium (USENIX Security), pages 1605–1622. USENIX, 2020. 7

    work page 2020

  27. [27]

    Retrieval-augmented generation for knowledge- intensive nlp tasks.Advances in Neural Information Processing Systems, 33:9459–9474, 2020

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Kuttler, Mike Lewis, Wen tau Yih, Tim Rocktaschel, et al. Retrieval-augmented generation for knowledge- intensive nlp tasks.Advances in Neural Information Processing Systems, 33:9459–9474, 2020. 1, 2

    work page 2020

  28. [28]

    Se- qmia: sequential-metric based membership inference attack

    Hao Li, Zheng Li, Siyuan Wu, Chengrui Hu, Yutong Ye, Min Zhang, Dengguo Feng, and Yang Zhang. Se- qmia: sequential-metric based membership inference attack. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Secu- rity, pages 3496–3510, 2024. 3

    work page 2024

  29. [29]

    En- hanced{Label-Only}membership inference attacks with fewer queries

    Hao Li, Zheng Li, Siyuan Wu, Yutong Ye, Min Zhang, Dengguo Feng, and Yang Zhang. En- hanced{Label-Only}membership inference attacks with fewer queries. In34th USENIX Security Sympo- sium (USENIX Security 25), pages 5465–5483, 2025. 3

    work page 2025

  30. [30]

    Compressing context to enhance inference efficiency of large language models.arXiv preprint arXiv:2310.06201, 2023

    Yucheng Li, Bo Dong, Chenghua Lin, and Frank Guerin. Compressing context to enhance inference efficiency of large language models.arXiv preprint arXiv:2310.06201, 2023. 7, 21, 22

    Pith/arXiv arXiv 2023

  31. [31]

    Seeing is believing: Black-box membership inference attacks against retrieval augmented generation.arXiv preprint arXiv:2406.19234, 2024

    Yuying Li, Gaoyang Liu, Yang Yang, and Chen Wang. Seeing is believing: Black-box membership inference attacks against retrieval augmented generation.arXiv preprint arXiv:2406.19234, 2024. 2, 3, 4, 7, 8, 10, 12, 21

    Pith/arXiv arXiv 2024

  32. [32]

    Membership Inference Attack Against Masked Image Modeling

    Zheng Li, Xinlei He, Ning Yu, and Yang Zhang. Mem- bership inference attack against masked image model- ing.arXiv preprint arXiv:2408.06825, 2024. 3

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  33. [33]

    Auditing membership leak- ages of multi-exit networks

    Zheng Li, Yiyong Liu, Xinlei He, Ning Yu, Michael Backes, and Yang Zhang. Auditing membership leak- ages of multi-exit networks. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communi- cations Security, pages 1917–1931, 2022. 3

    work page 2022

  34. [34]

    Membership inference attacks against ma- chine learning models via prediction sensitivity.IEEE Transactions on Dependable and Secure Computing, 20(3):2341–2347, 2022

    Lan Liu, Yi Wang, Gaoyang Liu, Kai Peng, and Chen Wang. Membership inference attacks against ma- chine learning models via prediction sensitivity.IEEE Transactions on Dependable and Secure Computing, 20(3):2341–2347, 2022. 1, 7

    work page 2022

  35. [35]

    Mask-based membership inference attacks for retrieval-augmented generation.arXiv preprint arXiv:2410.20142, 2024

    Mingrui Liu, Sixiao Zhang, and Cheng Long. Mask-based membership inference attacks for retrieval-augmented generation.arXiv preprint arXiv:2410.20142, 2024. 2, 3, 4, 7, 8, 10, 12, 21

    Pith/arXiv arXiv 2024

  36. [36]

    Understanding membership inferences on well-generalized learning models.arXiv preprint arXiv:1802.04889, 2018

    Yunhui Long, Vincent Bindschaedler, Lei Wang, Diyue Bu, Xiaofeng Wang, Haixu Tang, Carl A Gunter, and Kai Chen. Understanding membership inferences on well-generalized learning models.arXiv preprint arXiv:1802.04889, 2018. 3

    Pith/arXiv arXiv 2018

  37. [37]

    Making llms worth every penny: Resource-limited text classification in banking

    Lefteris Loukas, Ilias Stogiannidis, Odysseas Diaman- topoulos, Prodromos Malakasiotis, and Stavros Vassos. Making llms worth every penny: Resource-limited text classification in banking. InProceedings of the Fourth ACM International Conference on AI in Finance, pages 392–400, 2023. 1

    work page 2023

  38. [38]

    AutoLAW: Augmented Legal Reasoning through Legal Precedent Prediction

    Robert Zev Mahari. Autolaw: augmented legal reason- ing through legal precedent prediction.arXiv preprint arXiv:2106.16034, 2021. 1

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  39. [39]

    Membership inference attacks against language models via neighbourhood compari- son.arXiv preprint arXiv:2305.18462, 2023

    Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schölkopf, Mrinmaya Sachan, and Tay- lor Berg-Kirkpatrick. Membership inference attacks against language models via neighbourhood compari- son.arXiv preprint arXiv:2305.18462, 2023. 1, 3, 5 16

    Pith/arXiv arXiv 2023

  40. [40]

    Riddle me this! stealthy membership inference for retrieval-augmented generation.arXiv preprint arXiv:2502.00306, 2025

    Ali Naseh, Yuefeng Peng, Anshuman Suri, Harsh Chaudhari, Alina Oprea, and Amir Houmansadr. Riddle me this! stealthy membership inference for retrieval-augmented generation.arXiv preprint arXiv:2502.00306, 2025. 2, 3, 4, 8, 10, 12, 21

    Pith/arXiv arXiv 2025

  41. [41]

    Com- prehensive privacy analysis of deep learning: Passive and active white-box inference attacks against central- ized and federated learning

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Com- prehensive privacy analysis of deep learning: Passive and active white-box inference attacks against central- ized and federated learning. In2019 IEEE symposium on security and privacy (SP), pages 739–753. IEEE,

    work page

  42. [42]

    In-context retrieval-augmented language models.Transactions of the Association for Compu- tational Linguistics, 11:1316–1331, 2023

    Ori Ram, Yoav Levine, Itay Dalmedigos, Dor Muhl- gay, Amnon Shashua, Kevin Leyton-Brown, and Yoav Shoham. In-context retrieval-augmented language models.Transactions of the Association for Compu- tational Linguistics, 11:1316–1331, 2023. 1, 7, 21, 22

    work page 2023

  43. [43]

    In-context retrieval-augmented language models.Transactions of the Association for Compu- tational Linguistics, 11:1316–1331, 2023

    Ori Ram, Yoav Levine, Itay Dalmedigos, Dor Muhl- gay, Amnon Shashua, Kevin Leyton-Brown, and Yoav Shoham. In-context retrieval-augmented language models.Transactions of the Association for Compu- tational Linguistics, 11:1316–1331, 2023. 2, 3

    work page 2023

  44. [44]

    White-box vs black-box: Bayes optimal strategies for member- ship inference

    Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. White-box vs black-box: Bayes optimal strategies for member- ship inference. InInternational Conference on Machine Learning, pages 5558–5567. PMLR, 2019. 7

    work page 2019

  45. [45]

    Genomic privacy and lim- its of individual detection in a pool.Nature genetics, 41(9):965–967, 2009

    Sriram Sankararaman, Guillaume Obozinski, Michael I Jordan, and Eran Halperin. Genomic privacy and lim- its of individual detection in a pool.Nature genetics, 41(9):965–967, 2009. 7

    work page 2009

  46. [46]

    Detecting pretraining data from large language models.arXiv preprint arXiv:2310.16789, 2023

    Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models.arXiv preprint arXiv:2310.16789, 2023. 3

    Pith/arXiv arXiv 2023

  47. [47]

    Replug: Retrieval-augmented black-box language models.arXiv preprint arXiv:2301.12652,

    Weijia Shi, Sewon Min, Michihiro Yasunaga, Minjoon Seo, Rich James, Mike Lewis, Luke Zettlemoyer, and Wen-tau Yih. Replug: Retrieval-augmented black-box language models.arXiv preprint arXiv:2301.12652,

    Pith/arXiv arXiv

  48. [48]

    Replug: Retrieval-augmented black- box language models

    Weijia Shi, Sewon Min, Michihiro Yasunaga, Minjoon Seo, Richard James, Mike Lewis, Luke Zettlemoyer, and Wen tau Yih. Replug: Retrieval-augmented black- box language models. InProceedings of the 2024 Con- ference of the North American Chapter of the Associa- tion for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 836...

    work page 2024

  49. [49]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vi- taly Shmatikov. Membership inference attacks against machine learning models. In2017 IEEE Symposium on Security and Privacy (SP), pages 3–18. IEEE, 2017. 3

    work page 2017

  50. [50]

    Systematic evaluation of privacy risks of machine learning models

    Liwei Song and Prateek Mittal. Systematic evaluation of privacy risks of machine learning models. In30th USENIX Security Symposium (USENIX Security 21), pages 2615–2632, 2021. 7

    work page 2021

  51. [51]

    BEIR: A het- erogeneous benchmark for zero-shot evaluation of in- formation retrieval models

    Nandan Thakur, Nils Reimers, Andreas Rücklé, Ab- hishek Srivastava, and Iryna Gurevych. BEIR: A het- erogeneous benchmark for zero-shot evaluation of in- formation retrieval models. InThirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), 2021. 7, 21

    work page 2021

  52. [52]

    Lamda: Language models for dialog applications

    Romal Thoppilan, Daniel De Freitas, Jamie Hall, Noam Shazeer, Apoorv Kulshreshtha, Heng-Tze Cheng, Ali- cia Jin, Taylor Bos, Leslie Baker, Yu Du, et al. Lamda: Language models for dialog applications. arXiv preprint arXiv:2201.08239, 2022. 1

    Pith/arXiv arXiv 2022

  53. [53]

    Llama 2: Open foundation and fine- tuned chat models.arXiv preprint arXiv:2307.09288,

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine- tuned chat models.arXiv preprint arXiv:2307.09288,

    Pith/arXiv arXiv

  54. [54]

    Interleaving retrieval with chain-of-thought reasoning for knowledge-intensive multi-step questions.arXiv preprint arXiv:2212.10509,

    Harsh Trivedi, Niranjan Balasubramanian, Tushar Khot, and Ashish Sabharwal. Interleaving retrieval with chain-of-thought reasoning for knowledge-intensive multi-step questions.arXiv preprint arXiv:2212.10509,

    Pith/arXiv arXiv

  55. [55]

    Towards demystifying membership inference attacks.arXiv preprint arXiv:1807.09173,

    Stacey Truex, Ling Liu, Mehmet Emre Gursoy, Lei Yu, and Wenqi Wei. Towards demystifying membership inference attacks.arXiv preprint arXiv:1807.09173,

    Pith/arXiv arXiv

  56. [56]

    Adapted large lan- guage models can outperform medical experts in clini- cal text summarization.Nature Medicine, 30(4):1134– 1142, 2024

    Dave Van Veen, Cara Van Uden, Louis Blankemeier, Jean-Benoit Delbrouck, Asad Aali, Christian Blueth- gen, Anuj Pareek, Malgorzata Polacin, Eduardo Pontes Reis, Anna Seehofnerova, et al. Adapted large lan- guage models can outperform medical experts in clini- cal text summarization.Nature Medicine, 30(4):1134– 1142, 2024. 1

    work page 2024

  57. [57]

    Potential for gpt technology to optimize future clinical decision- making using retrieval-augmented generation.Annals of Biomedical Engineering, 52(5):1115–1118, 2024

    Calvin Wang, Joshua Ong, Chara Wang, Hannah Ong, Rebekah Cheng, and Dennis Ong. Potential for gpt technology to optimize future clinical decision- making using retrieval-augmented generation.Annals of Biomedical Engineering, 52(5):1115–1118, 2024. 1

    work page 2024

  58. [58]

    On the importance of difficulty cali- bration in membership inference attacks.arXiv preprint arXiv:2111.08440, 2021

    Lauren Watson, Chuan Guo, Graham Cormode, and Alex Sablayrolles. On the importance of difficulty cali- bration in membership inference attacks.arXiv preprint arXiv:2111.08440, 2021. 3

    Pith/arXiv arXiv 2021

  59. [59]

    Membership inference attacks against in-context learn- ing

    Rui Wen, Zheng Li, Michael Backes, and Yang Zhang. Membership inference attacks against in-context learn- ing. InProceedings of the 2024 on ACM SIGSAC Con- ference on Computer and Communications Security, pages 3481–3495, 2024. 14

    work page 2024

  60. [60]

    Membership inference attacks against text-to-image generation models.arXiv preprint arXiv:2210.00968, 2022

    Yixin Wu, Ning Yu, Zheng Li, Michael Backes, and Yang Zhang. Membership inference attacks against text-to-image generation models.arXiv preprint arXiv:2210.00968, 2022. 3 17

    Pith/arXiv arXiv 2022

  61. [61]

    Privacy risk in machine learn- ing: Analyzing the connection to overfitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learn- ing: Analyzing the connection to overfitting. In2018 IEEE 31st Computer Security Foundations Symposium (CSF), pages 268–282. IEEE, 2018. 3, 7

    work page 2018

  62. [62]

    One Token Can Help! Learning Scalable and Pluggable Virtual Tokens for Retrieval-Augmented Large Language Models

    Yutao Zhu, Zhaoheng Huang, Zhicheng Dou, and Ji- Rong Wen. One token can help! learning scalable and pluggable virtual tokens for retrieval-augmented large language models.arXiv preprint arXiv:2405.19670,

    work page internal anchor Pith review Pith/arXiv arXiv

  63. [2024]

    Yes”/“No

    7, 21, 22 18 A Notation of symbols Table 7: Notation of symbols in the paper. Notation Description SThe target RAG system RD The external retrieval database of RAG RThe retriever of RAG GThe generative module of RAG xA target sample for membership inference qThe user query q′ The adversarially perturbed query derived fromq Dr ={d 1,d 2, . . . ,dk}Document...

    work page arXiv