{"id":"56104b24-1b12-4bef-89aa-1a48b9be0e16","arxiv_id":"2412.17249","paper_version":1,"verdict":"REJECT","confidence":"LOW","novelty_score":2.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Feeding four standard membership-inference scores into an XGBoost classifier yields higher AUC-ROC than the individual attacks on seven datasets for LLMs from 160M to 12B parameters.","lead":"This paper combines four existing privacy-attack scoring methods and an XGBoost classifier to better detect whether a text was part of a language model's training data. The reported method claims higher detection accuracy than each scoring method alone on language models up to 12 billion parameters.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"EM-MIAs' gains rely on oracle membership labels for XGBoost training; without a label-free attack construction, the method is an audit, not an attack, leaving the central claim unsubstantiated.","rationale":"The reader's weakest assumption correctly identifies the label-access problem as the central weakness. The paper's own methodology section (II-C) explicitly trains on 'binary labels indicating membership' without explaining how an attacker obtains such labels. This is not a minor omission: it changes the epistemic status of every reported result. Without a label-free construction, EM-MIAs is a supervised classifier trained with oracle membership information, which is a privacy audit tool, not a membership inference attack. The central claim in the abstract—that the ensemble 'significantly improves AUC-ROC and accuracy compared to individual attack methods'—is therefore only established for the unrealistic oracle-label setting. Other concerns (no code/data, unrelated references, dataset-count inconsistency) compound the problem but are secondary to this threat-model gap. I agree with the reader's REJECT verdict because the paper as written cannot be checked and its attack framing is misleading. The concrete test above would settle whether the method could be salvaged as a real attack, but until then the empirical claim does not hold as stated.","tokens_in":9196,"tokens_out":4174,"duration_ms":42792,"concrete_test":"Re-run the EM-MIAs evaluation under a realistic attack scenario: train a shadow model on a disjoint dataset, compute the same four features (LOSS, Reference, Min-k, zlib) for the shadow model's known members and non-members, train XGBoost on those labeled shadow features, and then apply the trained classifier to features computed from the target model. If the ensemble AUC drops to near the individual baselines (≤0.6), the claimed gains depend on oracle membership labels and EM-MIAs is not an attack; if the AUC remains high, the method can be adapted to a label-free setting.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section II-C states the XGBoost model is trained on 'a dataset with binary labels indicating membership,' but the paper never specifies how an attacker obtains these labels for a target LLM. In a genuine membership inference attack, the adversary does not know which texts were in the training set; standard practice is to train shadow models or use other label-free heuristics. Here, the experiments appear to use oracle labels sampled directly from the target model's known training data (because the authors trained or have access to the models). This makes the evaluation a supervised audit with perfect membership knowledge, not an attack. Consequently, the reported AUC improvements from ~0.5-0.6 to 0.6-0.8 may simply reflect the XGBoost classifier learning to separate members from non-members given ground-truth labels, a setting that does not transfer to a real attacker. The paper does not acknowledge this limitation or provide a label-free variant, so the central claim of 'enhancing membership inference attacks' is unsupported. The missing details on reference model construction and data splitting further prevent verification, but the threat-model gap is the most load-bearing flaw because it determines what the experiments actually demonstrate.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes EM-MIAs, an ensemble membership inference attack for large language models that concatenates the scores of LOSS, Reference-based, Min-k%, and zlib entropy attacks into a feature vector and trains an XGBoost classifier to predict membership. The authors report AUC-ROC results over seven datasets and model parameter sizes from 160M to 12B, claiming that the ensemble consistently and 'significantly' outperforms each individual attack method. The main body describes the attack components, an XGBoost training setup with binary membership labels, and a results analysis with a single table of AUC-ROC values. The paper does not name the exact models, describe the reference-model construction, provide data splits or hyperparameters, or release code or data.","tokens_in":9373,"tokens_out":3893,"duration_ms":41508,"significance":"If the claims were valid under a genuine membership-inference threat model, the paper would provide a practical way to amplify weak MIA signals on large single-epoch-trained LLMs, which is a relevant contribution to privacy auditing. A positive feature of the manuscript is that Table I shows the ensemble above all four individual attacks in every one of the 35 reported dataset-size rows, which is a consistent directional pattern rather than a few cherry-picked cells. However, the contribution is framed as an attack while the training procedure requires ground-truth membership labels, so the reported numbers describe a supervised audit, not a real-world attack. The lack of experimental specification, absence of statistical testing, and the presence of irrelevant references and a foreign XML block further prevent the results from being verified. The paper ships no code, data, or machine-checked proofs, and as an attack it is currently unsupported.","major_comments":[{"comment":"The core attack construction is not a membership inference attack as defined. Section II-C states that the XGBoost model is trained on 'a dataset with binary labels indicating membership,' but a real attacker does not know which texts were in the target model's training set and therefore cannot obtain such labels for the target model. The paper never specifies a shadow-model procedure, a label-free training scheme, or any other way an attacker could obtain training labels. Consequently, the results in Table I are the performance of a supervised audit with oracle membership knowledge, not the performance of a membership inference attack. The abstract's claim that EM-MIAs 'significantly improves' attack methods is therefore unsupported. A concrete remedy would be to retrain and evaluate the ensemble under a proper shadow-model threat model, or to explicitly reframe the contribution as a privacy-auditing method and adjust the claims accordingly.","section":"Section II-C and Section II-A"},{"comment":"The experimental setup is insufficiently specified for reproducibility. Table I lists only parameter sizes (160M to 12B) but never names the LLMs evaluated; it does not describe how the reference model for the Reference-based attack is constructed, how member and non-member sets are built, how the XGBoost training/test split is made, or how many samples are used. Section II-E says hyperparameters are tuned via grid search and 5-fold cross-validation, but no resulting hyperparameters, data splits, or validation details are given. Without these details, the numerical results cannot be independently checked or meaningfully compared with prior MIA benchmarks.","section":"Section III-A and Table I"},{"comment":"The claim of 'significant improvements' is not supported by any statistical test. Table I reports means and standard deviations over three repetitions, but the paper does not provide matched significance tests, confidence intervals, or effect sizes. Given the tiny standard deviations (0.002-0.004) relative to the reported differences, a paired test across the same data splits is needed before the word 'significantly' can be used. The absence of such tests affects the central claim of the paper, not a peripheral detail.","section":"Section III-B and Table I"},{"comment":"The manuscript contains substantial extraneous and irrelevant material. The reference list [1]-[45] is composed almost entirely of point cloud registration papers and is incompatible with the stated topic of membership inference attacks; the in-text citation brackets do not correspond to the cited works. Additionally, Section III-A contains an unrelated XML block labeled '<LLMTask>...' and the Figure 1 caption ends with the fragment '(EM-MIAs)'. These issues indicate that the manuscript was assembled carelessly and must be corrected before any further review.","section":"References and Section III-A"}],"minor_comments":[{"comment":"The LOSS attack formula is written as a C-class cross-entropy, but for the LLM setting the relevant loss is the per-token next-token log-likelihood; the formula should be aligned with the text's description of language-model training.","section":"Section II-B"},{"comment":"The Min-k% feature is described as computing the average likelihood of the lowest-k% tokens, but it is not stated whether this is an average probability or an average log-likelihood, nor how the value of k is chosen; this matters because the scale of the feature affects the XGBoost model.","section":"Section II-B and Section II-C"},{"comment":"The 'Parameter Analysis' section discusses 'thresholds' without defining what threshold is varied for each attack method; the text should specify the threshold or the operating point used to generate the AUC-ROC curves.","section":"Section III-C"},{"comment":"The text said the datasets include 'The Pile' but Table I lists a separate 'The Pile' row in addition to 'Pile CC'; it should be clarified whether these are overlapping or distinct subsets.","section":"Section III-A"}],"recommendation":"reject","confidential_remarks":"This manuscript has load-bearing problems beyond the presentation issues: the method as described is an audit, not an attack, and the missing label-free construction is not a small fix. The reference list being almost entirely about point cloud registration and the injected XML block suggest the submission was not prepared in accordance with normal standards. I would not invite a revision of the current version; if the authors were to resubmit a properly specified study framed as privacy auditing, with full experimental details and code, it could be reconsidered."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The ensemble beats all four base attacks in every row of Table I, so the core empirical claim is at least internally consistent. That's the most useful thing in this paper. But as submitted it is not checkable, and the attack story does not hold together.\n\nWhat's new: combining LOSS, Reference, Min-k%, and zlib features with XGBoost. That is a routine supervised ensemble; no new attack signal is introduced. The consistent improvement across eight datasets and model sizes from 160M to 12B is a reasonable sanity check, but the paper compares against no prior learned or ensemble MIA method, so it cannot claim novelty.\n\nThe soft spots are serious. Section II-C says the XGBoost model is trained on a dataset with binary labels indicating membership, but the authors never explain how an attacker gets those labels for a target LLM. Standard practice is shadow models or some label-free construction. Without that, this is an audit that assumes perfect membership knowledge, not an attack. The AUC gains from roughly 0.5-0.6 to 0.6-0.8 may just reflect a classifier learning the oracle labels. The paper doesn't acknowledge this.\n\nReproducibility is also missing: no code, no data, no model identifiers, no dataset splits, no reference model construction details, no hyperparameter values. 'Significantly' appears without any significance tests. Table I lists eight datasets although the text says seven. A stray XML block interrupts Section III. And the reference list is almost entirely about point cloud registration—none of the citations are relevant to MIA or LLM privacy. That is a citation integrity problem, and it makes the paper impossible to take seriously as a research contribution.\n\nThe idea may have some value for privacy auditing—ensembling weak signals is a known trick that can buy a few AUC points—but this manuscript doesn't establish it. It needs a proper threat model, comparison with existing learned MIAs, and full reproducibility. As is, it should be desk-rejected.","headline":"Plausible empirical trend in Table I, but oracle-label training and missing reproducibility make the attack claim unverifiable.","tokens_in":9936,"tokens_out":3908,"would_cite":false,"duration_ms":37690,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"By feeding four weak membership signals into an XGBoost classifier, EM-MIAs claims to lift membership-inference AUC from near random to 0.58–0.81 on large language models.","keywords":["large language models","membership inference attacks","ensemble modeling","XGBoost","privacy auditing","AUC-ROC","min-k attack","zlib entropy"],"falsifier":"Run the same EM-MIAs pipeline but train the XGBoost classifier only on texts whose membership the attacker could plausibly know, and evaluate on a target model with a training set that is not disclosed; if the AUC falls back to the level of the best individual signal rather than the reported 0.58–0.81, the ensemble's advantage depends on label access rather than on complementary features.","tokens_in":8960,"feed_emoji":"🔎","tokens_out":5052,"duration_ms":46103,"temperature":0.7,"pith_summary":"Membership inference attacks ask whether a given text was part of a language model's training data, and the paper argues that existing single-signal attacks—loss, reference-model loss difference, min-k token likelihood, and zlib-normalized loss—are too weak on modern large models, often near random guessing. The paper's central claim is that feeding all four signals as features into an XGBoost classifier, the EM-MIAs ensemble, raises attack quality sharply, from AUC around 0.48–0.58 for individual methods to 0.58–0.81 across seven datasets and model sizes from 160M to 12B. If true, this gives privacy auditors a more sensitive tool built from existing pieces, with no new attack principle needed.","feed_headline":"Ensemble of four MIA signals lifts LLM attack AUC to 0.81","feed_subtitle":"Combining loss, reference, min-k, and zlib features in XGBoost beats every single method tested.","key_machinery":"The central object is the feature vector $f(x)=[f_{\\text{LOSS}}(x), f_{\\text{Ref}}(x), f_{\\text{Min-k}}(x), f_{\\text{zlib}}(x)]$: the model's cross-entropy loss on $x$, the loss difference against a reference model trained on a disjoint set, the average likelihood of the $k\\%$ lowest-probability tokens, and the loss divided by the text's zlib compression size. These features are fed to an XGBoost classifier trained on binary membership labels. The mechanism is that XGBoost learns nonlinear combinations and threshold interactions among weak signals, which the authors claim lets the ensemble stay above random where each individual attack fluctuates or collapses.","core_discovery":"The paper's central claim is that an ensemble of four known membership-inference signals, combined by XGBoost, detects training-data membership in large language models far better than any single signal. In the reported experiments, every individual method sits between roughly 0.48 and 0.58 AUC, while EM-MIAs reaches 0.58–0.81 AUC across Wikipedia, Github, Pile CC, PubMed Central, ArXiv, DM Math, HackerNews, and The Pile, with the largest gaps on Github and the smallest on DM Math. The authors interpret this as evidence that the four features carry complementary information that XGBoost can combine into a more robust privacy-auditing tool.","pith_inferences":["The most natural extension the paper does not test is feature ablation: removing one input at a time would show whether the gain comes from all four signals or from one dominant feature such as reference loss difference.","A stricter test would train EM-MIAs under a realistic attacker who has no membership labels at all, using surrogate data; the reported numbers likely represent an upper bound on audit power rather than a real-world attack.","If the ensemble gain persists under defenses like differentially private training or temperature scaling, ensembling remains a useful auditor of those defenses; if it collapses, the four signals are largely redundant under privacy protection."],"forward_implications":["If EM-MIAs is correct, privacy audits of large language models can be made substantially more sensitive by combining existing weak signals rather than designing a new attack from scratch.","The trend on Wikipedia and Github suggests that larger models may expose more membership signal to an ensemble, so privacy risk should be re-measured as model scale grows.","Individual MIA scores near random should not be read as evidence of low privacy risk, since the same signals can jointly support a much stronger inference.","Because the reference-based feature requires a reference model on a disjoint dataset, applying EM-MIAs to a real deployed model inherits the cost and assumptions of obtaining that reference."],"supporting_citations":[],"fun_headline_variants":["XGBoost ensemble of MIA signals boosts LLM privacy audit AUC","Combining four MIA features in XGBoost lifts LLM attack AUC to 0.81","Ensemble MIA attack on LLMs: XGBoost beats singles, hits 0.81 AUC","Four-signal ensemble improves LLM membership inference from 0.58 to 0.81","EM-MIAs: XGBoost fuses four signals for stronger LLM privacy checks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The reported attack accuracy assumes the XGBoost classifier can be trained on a dataset with correct binary membership labels for the target model, but the paper does not explain how an attacker would obtain those ground-truth labels.","fun_headline_variants_meta":{"raw":{"variants":["XGBoost ensemble of MIA signals boosts LLM privacy audit AUC","Combining four MIA features in XGBoost lifts LLM attack AUC to 0.81","Ensemble MIA attack on LLMs: XGBoost beats singles, hits 0.81 AUC","Four-signal ensemble improves LLM membership inference from 0.58 to 0.81","EM-MIAs: XGBoost fuses four signals for stronger LLM privacy checks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000722,"raw_usage":{"total_tokens":3225,"prompt_tokens":917,"completion_tokens":2308,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":533,"completion_tokens_details":{"reasoning_tokens":2186}},"tokens_in":533,"tokens_out":2308,"duration_ms":14812,"temperature":1.0,"reasoning_tokens":2186,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T05:39:27.209467+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same EM-MIAs pipeline but train the XGBoost classifier only on texts whose membership the attacker could plausibly know, and evaluate on a target model with a training set that is not disclosed; if the AUC falls back to the level of the best individual signal rather than the reported 0.58–0.81, the ensemble's advantage depends on label access rather than on complementary features.","supporting_citations":[],"review_version":1}