T0403 — Training Data Membership & Provenance Testing

Sub-techniques

• T0403.001 — Instance-Level Membership Inference
• T0403.002 — Dataset-Level Membership & Provenance Inference

Description

Training Data Membership & Provenance Testing asks whether specific content was part of a model's training data. The literature draws a sharp reliability line the card must reflect: instance-level membership inference — deciding whether one specific record was a training member — performs close to random for most domains and is unstable at low false-positive-rate operating points, and much of the published success is attributable to distribution shift between member and non-member sets rather than genuine memorization, since blind baselines that never query the model can outperform published attacks. Dataset-level inference — aggregating many weak per-record signals across a candidate dataset — is substantially more reliable, but only where the private validation set is IID with the candidate data, was withheld from training, remains undisclosed, and the examiner has access to model loss values; aggregation only helps when some underlying membership signal exists and enough text is available. No reviewed study establishes that white-box access improves reliability over grey-box (loss/probability) access. AFIRM therefore grades instance-level and dataset-level inference separately rather than as one technique.

Notes

Split (ACTION 1 review): instance-level and dataset-level membership inference have different reliability and must be graded separately, not as one "membership inference" card.

Metadata

Claim & Validation Profile

Does establish

• instance-level (.001), under stated conditions: weak evidence that a specific record may have appeared in training — low strength, must not be overstated
• dataset-level (.002), under IID private-validation-set conditions with loss access: that a candidate dataset, or a sufficiently large collection of its documents, was very likely part of training

Does not establish

• instance-level (.001): that a specific record was in the training set — most published attacks are close to random and unreliable at low false-positive rates
• dataset-level (.002): membership for opaque production models where training data, distribution, and loss access are unknown or unverifiable

Alternative propositions & corroboration

• apparent MI success may reflect distribution shift, temporal shift, or dataset-replication bias between member and non-member sets rather than genuine memorization
• a blind baseline that never queries the model can outperform published MI attacks — a positive result must be checked against a blind baseline before being reported as attack-derived signal

Quality controls

• prefer dataset-level (aggregated) inference over a single-record decision wherever the investigative question allows it
• disclose the number of documents aggregated and the underlying per-record signal strength

Case-specific limitations & stop conditions

• do not report an individual membership-inference decision as a forensic finding absent stated control conditions and a blind-baseline comparison
• do not claim white-box access improves reliability — no reviewed study establishes this

Admissibility is not stated here — see the Evidentiary Standard Assessment (T0502) jurisdiction overlays.

References

1. Duan, Suri, Mireshghallah, Min, Shi, Zettlemoyer, Tsvetkov, Choi, Evans, Hajishirzi (2024) — Do Membership Inference Attacks Work on Large Language Models? (citation pending verification)
2. Das, Zhang, Tramèr (2024) — Blind Baselines Beat Membership Inference Attacks for Foundation Models (citation pending verification)
3. Zhang, Das, Kamath, Tramèr (2024) — Position — Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Data (citation pending verification)
4. Maini et al. (2024) — LLM Dataset Inference — Did you train on my dataset? (citation pending verification)
5. Puerto et al. (2025) — Scaling Up Membership Inference — When and How Attacks Succeed on Large Language Models (citation pending verification)
6. Hayes et al. (2025) — Exploring the limits of strong membership inference attacks on large language models (citation pending verification)

Case Applications

No published case applications yet.