On the Effectiveness of Membership Inference in Targeted Data Extraction from Large Language Models

Large Language Models (LLMs) are prone to memorizing training data, which poses serious privacy risks. Two of the most prominent concerns are training data extraction and Membership Inference Attacks (MIAs). Prior research has shown that these threats are interconnected: adversaries can extract training data from an LLM by querying the model to generate a large volume of text and subsequently applying MIAs to verify whether a particular data point was included in the training set. In this study, we integrate multiple MIA techniques into the data extraction pipeline to systematically benchmark their effectiveness. We then compare their performance in this integrated setting against results from conventional MIA benchmarks, allowing us to evaluate their practical utility in real-world extraction scenarios.

Key Contributions

Integrates multiple MIA techniques (MIN-K%, ReCaLL, LiRa, neighborhood attacks) into a targeted training data extraction pipeline for LLMs
Systematically benchmarks MIA effectiveness in the extraction pipeline context versus conventional standalone MIA benchmarks
Evaluates the practical utility of MIAs as a verification step in real-world targeted data extraction scenarios

🛡️ Threat Analysis

Model Inversion Attack

The end goal of the studied pipeline is training data extraction — an adversary prompts the LLM to generate candidate sequences, then uses MIA to verify verbatim memorization, constituting a model inversion / memorization extraction attack.

Membership Inference Attack

Primary focus is systematically benchmarking multiple MIA techniques (MIN-K%, ReCaLL, LiRa, neighborhood attacks) to determine whether a given text sequence was part of LLM training data.