EXHIBIT 19 OF 24 · MODULE 5: RED TEAMING & PRIVACY
HIGH
Membership Inference & Data Memorization
Probing whether a specific private record was included in training data by analyzing token loss distributions and per-example perplexity.
INTERACTIVE EXHIBIT 19
Membership Inference & Memorization (LiRA)
MEMBERSHIP LIKELIHOOD: MEMBER (99.2%)
LIKELIHOOD RATIO ATTACK
ΔL = 1.43 nats
High ratio proves model memorized the specific private record rather than just learning general text features.
💡 Privacy Auditing: Run automated MIA probes on fine-tuned enterprise checkpoints prior to public deployment.
ARCHITECTURAL OVERVIEW
Membership Inference & Data Memorization
Membership Inference Attacks (MIAs) audit whether a specific private document, medical record, or copyrighted code file was included in a model's pre-training or fine-tuning dataset. Because models overfit subtly to training samples, training examples exhibit lower loss, lower perplexity, and distinct curvature compared to held-out data.
Perplexity & Loss Gap
Models assign higher likelihood (lower cross-entropy loss) to sequences seen during training. Comparing raw loss against a fixed threshold provides a baseline membership predictor.
Reference-Model Likelihood Ratio (LiRA)
Raw loss is confounded by sequence difficulty (e.g., common phrases always have low loss). The Likelihood Ratio Attack evaluates the ratio Loss_target(x) / Loss_reference(x) using a reference model trained on disjoint data.
Zlib Compression & Neighborhood Curvature
Comparing model cross-entropy loss against zlib compression entropy or measuring loss drop after tiny word perturbations isolates genuine memorization from intrinsic text predictability.
MATHEMATICAL FORMULATION · LIKELIHOOD RATIO MEMBERSHIP SCORE
If M(x) >> 0, the target model predicts x with significantly higher probability than an independent reference model, indicating that x was almost certainly present in the target model's training set.
REAL-WORLD PRODUCTION ENGINEERING
Deduplicate pre-training datasets rigorously using MinHash LSH: duplicated documents have 10x higher memorization risk.
Conduct automated MIA audits on proprietary fine-tuned checkpoints to verify that customer PII is not memorized.
Apply Differential Privacy (DP-SGD) during fine-tuning on sensitive enterprise datasets to provably defeat membership inference.