ML Security PapersMembership and Dataset Inference Attacks on Large Audio Generative Models
Jakub Proboszcz 1, Paweł Kochanski 1, Karol Korszun 1, Donato Crisostomi 2, Giorgio Strano 2, Emanuele Rodolà 2, Kamil Deja 1,3, Jan Dubinski 1,4
Published on arXiv
2512.09654
Membership Inference Attack
OWASP ML Top 10 — ML04
Key Finding
Dataset inference successfully identifies whether an artist's audio collection was used in training large generative models even when single-sample membership inference yields weak signals, requiring only a practical minimum number of samples P to reject the null hypothesis.
Dataset Inference (DI) for Audio
Novel technique introduced
Generative audio models, based on diffusion and autoregressive architectures, have advanced rapidly in both quality and expressiveness. This progress, however, raises pressing copyright concerns, as such models are often trained on vast corpora of artistic and commercial works. A central question is whether one can reliably verify if an artist's material was included in training, thereby providing a means for copyright holders to protect their content. In this work, we investigate the feasibility of such verification through membership inference attacks (MIA) on open-source generative audio models, which attempt to determine whether a specific audio sample was part of the training set. Our empirical results show that membership inference alone is of limited effectiveness at scale, as the per-sample membership signal is weak for models trained on large and diverse datasets. However, artists and media owners typically hold collections of works rather than isolated samples. Building on prior work in text and vision domains, in this work we focus on dataset inference (DI), which aggregates diverse membership evidence across multiple samples. We find that DI is successful in the audio domain, offering a more practical mechanism for assessing whether an artist's works contributed to model training. Our results suggest DI as a promising direction for copyright protection and dataset accountability in the era of large audio generative models.
Key Contributions
- Benchmarks existing MIA strategies on large audio diffusion and autoregressive models, demonstrating their limited effectiveness at scale
- Extends dataset inference (DI) methodology to the audio domain, aggregating per-sample MIA signals across artist collections
- Provides empirical evidence that DI succeeds where single-sample MIA fails, proposing it as a practical tool for copyright verification in audio generative models
🛡️ Threat Analysis
The paper's entire focus is membership inference attacks — determining whether specific audio samples were part of a model's training set. Dataset inference is an aggregated extension of MIA across a collection of samples. The paper benchmarks MIA strategies and extends DI to audio diffusion and autoregressive models.