ML Security PapersMembership Inference for Contrastive Pre-training Models with Text-only PII Queries
Ruoxi Cheng 1,2, Yizhong Ding 1, Hongyi Zhang 3, Yiyan Huang 4
Published on arXiv
2603.14222
Membership Inference Attack
OWASP ML Top 10 — ML04
Key Finding
Achieves strong membership inference detection performance with sub-second auditing cost while using only text queries, avoiding direct exposure of sensitive biometric information
UMID
Novel technique introduced
Contrastive pretraining models such as CLIP and CLAP underpin many vision-language and audio-language systems, yet their reliance on web-scale data raises growing concerns about memorizing Personally Identifiable Information (PII). Auditing such models via membership inference is challenging in practice: shadow-model MIAs are computationally prohibitive for large multimodal backbones, and existing multimodal attacks typically require querying the target with paired biometric inputs, thereby directly exposing sensitive biometric information to the target model. We propose Unimodal Membership Inference Detector (UMID), a text-only auditing framework that performs text-guided cross-modal latent inversion and extracts two complementary signals, similarity (alignment to the queried text) and variability (consistency across randomized inversions). UMID compares these statistics to a lightweight non-member reference constructed from synthetic gibberish and makes decisions via an ensemble of unsupervised anomaly detectors. Comprehensive experiments across diverse CLIP and CLAP architectures demonstrate that UMID significantly improves the effectiveness and efficiency over prior MIAs, delivering strong detection performance with sub-second auditing cost while complying with realistic privacy constraints.
Key Contributions
- UMID framework performing text-only membership inference on multimodal contrastive models without exposing biometric data
- Text-guided cross-modal latent inversion extracting similarity and variability signals for membership detection
- Ensemble of unsupervised anomaly detectors using synthetic gibberish as non-member reference, achieving sub-second auditing cost
🛡️ Threat Analysis
Core contribution is a membership inference attack determining whether specific PII data points were in the training set of CLIP/CLAP models. The attack queries models with text descriptions of PII (e.g., person names) and uses cross-modal inversion with anomaly detection to infer membership, achieving this without requiring paired biometric inputs.