{"id":"3fcd3c11-dbe8-4699-9c7d-b3eaf8207528","arxiv_id":"2505.03392","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"A temperature-calibrated scoring method, ACMIA, improves membership inference against LLMs by amplifying probability gaps between training and non-training texts without reference models.","lead":"This paper proposes a membership inference attack for large language models that rescales token probabilities with a tunable temperature before scoring, aiming to separate training data from non-training data without external reference models. Across three benchmarks and several open-weight LLMs, the method reports higher AUROC and lower false positive rates than prior attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"DerivAC's definition in Eq. 6 contradicts the paper's own derivative in Appendix B.2, so the reported AUROC may implement a different, sign-flipped score.","rationale":"The reader's weakest assumption—temperature tuning on labeled samples—is a real limitation of the 'automatic' and 'practical' framing, but it concerns how the method would transfer to an unlabeled setting and does not invalidate the reported in-benchmark comparisons. The DerivAC sign inconsistency is more fundamental: it affects the validity of one of the three headline variants as written. The paper contains a token-level definition and a sample-level definition that assign opposite score directions; at most one can correspond to the experimental results. This makes the current manuscript internally inconsistent and prevents a reader from reimplementing the attack from the text alone. Because the issue might be a fixable sign error in Eq. 6, I would not outright reject the empirical findings, but the paper cannot be verified as submitted; the verdict should move from CONDITIONAL to UNVERDICTED until the authors clarify which definition was used and provide runnable code. The temperature-tuning concern remains worth addressing in revision, but it is not the single most load-bearing issue.","tokens_in":27974,"tokens_out":7443,"duration_ms":77805,"concrete_test":"Compute DerivAC scores exactly as written in Eq. 6 on a warm-up subset of WikiMIA (e.g., 200 members and 200 non-members with Pythia-12B) and measure AUROC. If AUROC is below 0.5 while the reported DerivAC AUROC in Table 1 is 78.2, the published formula does not implement the evaluated attack. Then repeat with the Appendix C loss-difference form; a sign inversion between the two confirms the inconsistency. Also inspect the released code (github.com/Salehzz/ACMIA) for which definition of DerivAC is actually used, and note the commit hash.","verdict_should_be":"UNVERDICTED","load_bearing_attack":"Section 4.2 defines DerivAC per token as log TSP(xt|x<t, τ+δ) − log TSP(xt|x<t, τ). The paper's Appendix B.2 derives ∂ log p(x,τ)/∂τ = (µz − z)/τ², where µz is the softmax-weighted mean logit. For a token with above-average logit (z > µz), which is typical of a token the model assigns high probability to, this finite difference is negative. The text claims 'a higher derivative indicates that the sample is more likely to belong to the pre-training data' (Section 4.2), but the formula as written assigns lower scores to likely tokens and higher scores to surprising tokens—the opposite of the intended ranking. The sample-level version in Appendix C flips the sign: DerivAC = L(x;M_{τ+δ}) − L(x;M_τ), i.e., a loss difference, which is positive for likely tokens. Thus Eq. 6 and Appendix C describe opposite attacks; they cannot both be the evaluated method. The reported high AUROC for DerivAC (e.g., 81.4 on PatentMIA/Qwen1.5-32B in Table 1) is not reproducible from Eq. 6 without an additional sign flip. Since DerivAC is one of the three variants claimed to 'consistently outperform' baselines, this internal contradiction is a load-bearing correctness issue for the central claim.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces ACMIA, a family of membership-inference attacks against LLMs that applies temperature scaling to token log-probabilities and then calibrates the resulting scores to separate pretraining members from non-members. Three variants are proposed: AC (difference between temperature-scaled and original log probabilities with a sign depending on whether τ>1), DerivAC (a finite-difference in temperature), and NormAC (a z-score over the temperature-scaled distribution). The method is evaluated on WikiMIA, MIMIR, and PatentMIA with several open-source LLMs, reporting AUROC, TPR@5%FPR, and FPR@95%TPR, and the authors claim consistent gains over score-based, calibration-based, and reference-model baselines.","tokens_in":28300,"tokens_out":10663,"duration_ms":98068,"significance":"If the results hold, ACMIA would be a useful practical MIA: it avoids external reference models, has variants for different levels of API access, and is evaluated on three benchmarks with a large model sweep. The paper ships code and provides detailed per-subset tables in the appendix; the temperature robustness ablation (Figure 3) is a useful check. However, the current version has internal inconsistencies in the definition of DerivAC, a theoretical motivation that does not support the stated claims, and headline results that depend on labeled temperature tuning; these issues must be resolved before the empirical claims can be relied upon.","major_comments":[{"comment":"The statement that 'the maximum likelihood estimation used in the LLM pre-training process can be formulated as' Eq. (2) is not correct. Eq. (2) is the implicit score matching objective of Hyvärinen and Dayan, which is a surrogate for estimating unnormalized continuous densities, not an equivalent form of MLE for autoregressive language models. Moreover, the input x is a discrete token sequence, so derivatives of log p(x) with respect to x are not defined in the usual sense. In addition, under the paper's own definition ψ′(x)=τ·ψ(x,τ), the explicit temperature coefficients in Eq. (3) cancel: the first term becomes (1/2)||ψ(x,τ)||² and the second becomes ∑∂ψ_i(x,τ)/∂x_i. The claimed role of τ as a balancing coefficient between first- and second-order terms is therefore not supported. The theoretical motivation should be corrected or explicitly reframed as a heuristic.","section":"Section 4.1, Eq. (2) and Appendix B.1"},{"comment":"The definition of DerivAC is internally contradictory. Eq. (6) defines DerivAC as the average of log TSP(τ+δ) − log TSP(τ) over first-occurrence tokens, and the text states that a higher derivative indicates membership. Appendix B.2 derives ∂ log p(x,τ)/∂τ = (µ_z − z)/τ², where µ_z is the softmax-weighted mean logit. For a token with above-average logit (z > µ_z), which is exactly a token the model considers likely, this derivative is negative, so the Eq. (6) score ranks likely tokens lower and surprising tokens higher, the opposite of the intended ranking. The sample-level version in Appendix C instead defines DerivAC(x,τ;M)=L(x;M_{τ+δ})−L(x;M_τ), i.e., the negative of the log-probability difference, which has the opposite sign. These two definitions cannot both describe the evaluated attack, and the reported AUROC for DerivAC (e.g., 81.4 on PatentMIA/Qwen1.5-32B in Table 1) is not reproducible from Eq. (6) without an additional sign flip.","section":"Section 4.2 Eq. (6), Appendix B.2, Appendix C"},{"comment":"The headline results are obtained with the optimal temperature selected on a set of labeled member and non-member samples for each benchmark and model. This makes the 'automatic' and practical claims conditional on access to membership labels that an attacker would not normally have. The paper should report AUROC with a fixed default temperature or with a temperature selected without membership labels, and should state clearly in the main text that Tables 1–3 use labeled tuning. Figure 3 shows robustness on WikiMIA and PatentMIA for two models, but it does not cover the full benchmark/model grid; without unlabeled-tuning results, the practical relevance of the reported numbers is not established.","section":"Section 5.5, Table 4"},{"comment":"The claim that the ACMIA variants 'consistently outperform baselines ... across all benchmarks and models' is too strong. In the MIMIR appendix tables, several cells show a baseline equal to or better than ACMIA. For example, in Table 5 (≤20% 7-gram overlap), GitHub 12B has DC-PDD 92.5 equal to AC and DerivAC, and Wikipedia 160M has DC-PDD 63.3 vs. AC 62.9; in Table 7 (≤80% 13-gram overlap), Wikipedia 160M has Ref 50.8 vs. AC 49.9 and DerivAC 50.2. The authors should soften the claim and discuss the settings in which calibrated baselines remain competitive.","section":"Section 6.1 vs. Appendix E"},{"comment":"The claim that AC and DerivAC 'do not require access to the full log-likelihood distribution' is inconsistent with Eq. (4), whose normalization constant requires the full vocabulary distribution over all V_i. The loss-only versions in Appendix C remove the FOS restriction and are not identical to Eqs. (5)–(6). The paper should clarify exactly which variant is evaluated in each table and specify the precise access requirements, including whether the model API must return full log-probabilities or only losses under modified temperatures.","section":"Section 4.2 Eq. (4), Appendix C"}],"minor_comments":[{"comment":"AUROC values are reported to one decimal place without confidence intervals or significance tests; many ACMIA-vs-baseline differences are 0.2–0.5 points, so the claimed systematic gains should be supported with repeated runs or variance estimates.","section":"Tables 1–10"},{"comment":"The optimal-temperature table covers only PatentMIA; to support the claim that optimal τ is determined by the dataset rather than the model, the same analysis should be shown for WikiMIA and MIMIR.","section":"Table 4"},{"comment":"The normalization used in Figure 2 is not described, and Appendix A's Min-K%++ score in Eq. (13) does not define how the 'min-k%' subset is selected; these details should be added for reproducibility.","section":"Figure 2 and Eq. (13)"}],"recommendation":"major_revision","confidential_remarks":"The DerivAC sign contradiction is the most serious issue: if the evaluated implementation is the Appendix C version, then Eq. (6) and the associated intuition in Section 4.2 are misleading, and the reported numbers may correspond to a different attack. I would ask for a code check or an explicit statement of which formula generated Tables 1–3. The score-matching motivation should also be substantially revised or downgraded. The empirical scope is strong, and a careful revision could make this a solid contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, what you should know. This is a solid-looking empirical paper with one load-bearing inconsistency. The authors propose temperature-scaled probability calibration for membership inference on LLMs, in three variants: AC, DerivAC, and NormAC. The empirical evaluation is broad—three benchmarks, multiple open-weight model families—and AC and NormAC appear to give real gains over baselines. But DerivAC as defined in Eq. 6 cannot be the method that produced the reported numbers. The finite difference log TSP(τ+δ)−log TSP(τ) is, by the paper's own Appendix B.2, negative for tokens with above-average log probability; the text says higher derivative means membership. Appendix C defines DerivAC instead as a loss difference, which has the opposite sign. One of these implementations is not what ran. Since DerivAC is one of the three advertised variants and is claimed to 'consistently outperform' baselines, this is a central reproducibility problem, not a minor typo.\n\nWhat is genuinely new: using a tunable temperature to reshape token probabilities before scoring, with the first-occurrence restriction and mean/variance normalization, is a reasonable adaptation of Min-K%++ and DC-PDD. The temperature-robustness ablation in Figure 3 is a nice piece of evidence that the method is not hypersensitive to τ. The paper is clearly written and the related work is handled honestly.\n\nThe other soft spot is the tuning protocol. Section 5.5 says the optimal temperature is found on labeled member/non-member samples for each benchmark and model. That is consistent with how baselines tune their hyperparameters (Min-K% tunes K), but it undercuts the 'automatic' label. If a practitioner has no labeled members at attack time, the paper does not say how to pick τ. Figure 3 suggests a wide range works, so this is a moderate issue, not fatal.\n\nThe theory in Section 4.1 is also weaker than advertised. Equation 2 is introduced as motivation, but the appendix derives softmax algebra, not the claim that temperature separation follows from score matching. I'd call that a gap, not a fatal flaw.\n\nIn short: the idea is worth taking seriously, and the AC and NormAC results may hold up. But the DerivAC sign contradiction must be fixed, code with a commit hash must be released, and the tuning protocol clarified. This paper deserves a serious referee—send it to review, but the reviewer should demand those corrections. I would not cite the DerivAC numbers in their current form.","headline":"Useful temperature calibration for MIA, but DerivAC has a sign contradiction that makes its reported AUROC unreproducible; fix that and it earns a serious review.","tokens_in":28775,"tokens_out":4258,"would_cite":false,"duration_ms":38560,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A tunable temperature on a model's own output probabilities can reveal which texts were in its training data, with no reference model.","keywords":["membership inference attacks","large language models","temperature scaling","pretraining data detection","privacy auditing","calibration","MIMIR benchmark","WikiMIA"],"falsifier":"Run ACMIA on a fresh model with the temperature fixed by a label-free rule, or with one temperature held constant across all datasets; if the AUROC drops to the level of raw loss or random guessing, then the reported gain is an artifact of tuning on labeled members and non-members rather than a property of the calibration mechanism itself.","tokens_in":27808,"feed_emoji":"🎯","tokens_out":8779,"duration_ms":71736,"temperature":0.7,"pith_summary":"The paper claims that membership in a large language model's (LLM's) pretraining data can be detected by rescaling the model's own token probabilities with a tunable temperature, rather than by comparing against an external reference model. It presents three scoring variants — AC, DerivAC, and NormAC — that either compare temperature-scaled log probabilities against the raw ones, measure how the scaled probability changes as temperature moves, or normalize each token's scaled score by its mean and variance. On the WikiMIA, MIMIR, and PatentMIA benchmarks, across several open-weight models, the paper reports that all three variants outperform existing score-based, calibration-based, and reference-model baselines. If the claim is right, privacy auditors and contamination checkers gain a tool that needs only the target model's outputs.","feed_headline":"One temperature dial exposes what a language model memorized","feed_subtitle":"ACMIA recalibrates token probabilities, separating seen from unseen text without a reference model.","key_machinery":"The load-bearing object is the temperature-scaled token probability $\\mathrm{TSP}(z|x_{<t},\\tau) = \\frac{\\exp(\\log p(z|x_{<t})/\\tau)}{\\sum_{i=1}^{K} \\exp(\\log p(V_i|x_{<t})/\\tau)}$, which reshapes the model's categorical distribution without retraining. ACMIA's three scorers use this object in different ways: AC takes a sign-weighted average of the difference between the temperature-adjusted log probability and the original log probability; DerivAC measures the finite-difference derivative of the scaled log probability with respect to temperature; NormAC z-normalizes each token's scaled log probability under the scaled distribution itself, using the mean and variance defined in equations (8) and (9). Tuning $\\tau$ changes the balance between first-order and second-order terms in the maximum-likelihood score of equation (3), which the paper argues amplifies the probability gap between training and non-training texts even when both come from the same distribution.","core_discovery":"The paper's central claim is that a single tunable temperature applied to the target LLM's own output probabilities is enough to convert raw likelihood scores into calibrated membership signals: reshaping the token distribution with $\\tau$ widens the separation between member and non-member texts, and the three ACMIA variants that exploit this reshaping consistently rank above seven baselines, as measured by area under the ROC curve, on WikiMIA, MIMIR, and PatentMIA across Baichuan, Qwen1.5, OPT, Pythia, and GPT-NeoX. The authors derive the temperature adjustment from a maximum-likelihood and implicit-score-matching view of pretraining, in which training samples sit near local maxima of the likelihood landscape, and they show that ACMIA also reduces false positives at strict operating points, including the true-positive rate at a fixed 5% false-positive rate and the false-positive rate at a fixed 95% true-positive rate. They further state that AC and DerivAC need only the sample loss, so they remain applicable when only API-level access is available.","pith_inferences":["Since the optimal temperature values are reported to be stable across models trained on similar data, one could test whether a temperature tuned on one model transfers to another model trained on the same corpus; the paper does not run this transfer experiment.","A defense direction the paper leaves implicit: if temperature scaling is what exposes membership, then smoothing logits at inference time, for instance by raising the model's own temperature, might shrink the gap the attack exploits.","The label-free variant is only sketched, so an obvious extension is to replace the labeled tuning set with a heuristic such as perplexity-based or frequency-based temperature selection and measure how much detection accuracy is lost."],"forward_implications":["If ACMIA works as claimed, pre-training-data auditing no longer requires a held-out reference model or a reference corpus, since the target model's own temperature-adjusted outputs serve as the reference.","Because AC and DerivAC can be computed from sample-level loss alone, the attack carries over to API-only access where token log-probabilities are hidden.","The reported consistency across original and paraphrased WikiMIA texts implies the calibrated scores track memorization structure rather than surface lexical overlap.","The reported correlation between model size and detection accuracy means larger models are more exposed to this style of attack, which the paper frames as an urgent privacy concern."],"supporting_citations":[{"why":"Defines membership inference attacks, the problem ACMIA is built to solve.","marker":"[25]"},{"why":"Introduces the WikiMIA benchmark and the Min-K% score baseline that ACMIA is compared against.","marker":"[24]"},{"why":"Supplies the Min-K%++ baseline and the conditional-distribution scoring idea ACMIA extends.","marker":"[35]"},{"why":"Provides the MIMIR benchmark with matched member and non-member distributions, the hardest test in the evaluation.","marker":"[8]"},{"why":"Contributes the DC-PDD divergence-calibration baseline and the PatentMIA benchmark.","marker":"[37]"},{"why":"Provides the Zlib, Lowercase, and Ref baselines, including the reference-model calibration approach ACMIA avoids.","marker":"[5]"},{"why":"The implicit score matching objective that motivates the temperature-based calibration derivation.","marker":"[13]"},{"why":"Establishes the loss-based membership inference baseline that ACMIA's scores are measured against.","marker":"[34]"}],"fun_headline_variants":["One temperature dial reveals LLM memorization","No reference model needed: temperature spots training data","Calibrate temperature, unmask seen text in LLMs","ACMIA: automatic calibration boosts membership attacks","A single temperature tweak exposes what a model recalled"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The reported scores take the temperature as tuned on a labeled set of known members and non-members for each dataset and model, so the attack's performance without any labeled examples is not established.","fun_headline_variants_meta":{"raw":{"variants":["One temperature dial reveals LLM memorization","No reference model needed: temperature spots training data","Calibrate temperature, unmask seen text in LLMs","ACMIA: automatic calibration boosts membership attacks","A single temperature tweak exposes what a model recalled"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000247,"raw_usage":{"total_tokens":1546,"prompt_tokens":950,"completion_tokens":596,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":566,"completion_tokens_details":{"reasoning_tokens":523}},"tokens_in":566,"tokens_out":596,"duration_ms":5682,"temperature":1.0,"reasoning_tokens":523,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:52:05.256200+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run ACMIA on a fresh model with the temperature fixed by a label-free rule, or with one temperature held constant across all datasets; if the AUROC drops to the level of raw loss or random guessing, then the reported gain is an artifact of tuning on labeled members and non-members rather than a property of the calibration mechanism itself.","supporting_citations":[{"cited_title":"Shokri, M","cited_arxiv_id":null,"evidence_quote":"Defines membership inference attacks, the problem ACMIA is built to solve."},{"cited_title":"Carlini, F","cited_arxiv_id":null,"evidence_quote":"Provides the Zlib, Lowercase, and Ref baselines, including the reference-model calibration approach ACMIA avoids."},{"cited_title":"Hyvärinen and P","cited_arxiv_id":null,"evidence_quote":"The implicit score matching objective that motivates the temperature-based calibration derivation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Establishes the loss-based membership inference baseline that ACMIA's scores are measured against."}],"review_version":1}