REVIEW 4 major objections 4 minor 30 references
DocMIA: Document-Level Membership Inference Attacks against DocVQA Models
T0 review · 4 major / 4 minor · reviewed 2026-08-09 · deepseek-v4-flash
Pith's one-line read A new membership-inference attack can tell whether a specific document was used to train a DocVQA model, with no auxiliary data.
desk verdict First document-level MIA for DocVQA, with a solid white-box story and a black-box evaluation that overstates transferability because the proxy is fit to the same documents it later classifies. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the optimization-based distance feature $\Delta = \|\theta_0 - \theta_*\|_2$, the L2 norm of the parameter change when the target model is fine-tuned on one question-answer pair starting from its current weights. Together with the number of optimization steps $s$ and the aggregated DocVQA utility $u$, it forms a document-level descriptor after aggregation over the document's questions. The paper implements the fine-tuning in three variants: optimizing a single layer (FL), a LoRA adapter on that layer (FLLoRA), and the document image pixels (IG). In the black-box setting the machinery is a distillation step: the target model's answers on the suspect documents are used to train a public-checkpoint proxy, and the white-box features are extracted from the proxy to recover the membership signal.
What would settle it
Run the FL attack using only the $\Delta$ feature against a DocVQA model trained with strong regularization so that the train-test score gap is near zero and no document appears more than once; if balanced accuracy does not beat the average-score baseline, the claimed optimization-distance signal is not an independent membership signal.
Extended reading notes
Core claim
The central claim is that the optimization trajectory of a model on a single document-question-answer example is a membership signal. For a member document, fine-tuning the trained model on one of its question-answer pairs converges quickly and moves the parameters a small L2 distance, while a non-member document requires a larger parameter change; the number of steps and the DocVQA utility score supply supporting signals. The attack assigns each document a feature vector built from these quantities aggregated over its questions, then uses unsupervised clustering to label the cluster with the larger parameter distance as non-members. In the black-box setting the adversary first distills the target model's predictions into a proxy model and applies the same procedure to the proxy. The reported results show the strongest variants reaching roughly 80% balanced accuracy and 82% F1, exceeding loss-based, score-based, gradient-based, and token-probability baselines on the evaluated targets.
Load-bearing premise
The attack's success depends on the premise that the L2-norm of the parameter change after fine-tuning a single question-answer pair reliably separates member from non-member documents; the paper's own ablation shows that this distance alone underperforms a simple score on some targets, so the combined features and hyperparameters tuned on the evaluation set are what carry the result.
Editorial extensions
If this is right
- A white-box adversary holding a suspect document can determine its training status with reported balanced accuracy up to about 80% and F1 up to about 82% on the evaluated models, without needing any auxiliary data.
- A black-box adversary with API access can achieve similar leakage by distilling the target's answers into a proxy model; matching proxy and target architectures helps, but cross-architecture attacks still work in the reported experiments.
- Documents with multiple question-answer pairs are exposed at the document level, so repeated exposure in training data amplifies membership leakage beyond single-example MIA.
- The reported defense of training with DP-SGD at $\varepsilon = 8$ cuts the F1 of the strongest attack to about 55%, but at the cost of roughly halving DocVQA utility, so the defense is not free.
- The attack remains partially effective when the adversary has only rephrased questions rather than the exact training questions, though all compared methods decline in that setting.
Reading between the lines
- If parameter-space distance is the real leakage channel, then any training procedure that shortens the optimization path for held-out points, such as flatter minima or stronger regularization, should reduce membership-inference success; this is a testable defense target.
- The same optimization-based recipe could transfer to other auto-regressive multimodal tasks such as general VQA or OCR-free document parsing, wherever per-sample fine-tuning is computationally feasible.
- Because the authors tune hyperparameters per target model using the evaluation set, a realistic adversary without labeled member and non-member documents would likely see lower performance; evaluating with a fixed, untuned protocol would clarify the practical threat.
- The black-box distillation result suggests the membership signal survives a prediction-only bottleneck; a useful extension would measure how much signal remains when the API returns only a top-1 answer without confidence scores.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces DocMIA, a document-level membership inference attack for DocVQA models. Two settings are considered: white-box attacks (FL, FLLoRA, IG) that fine-tune a single layer, LoRA parameters, or the document image and extract optimization-distance, step-count, and utility features; and a black-box attack that first distills a proxy model from the target model's outputs and then applies the white-box attack to the proxy. The authors report improved balanced accuracy and F1 over several score-, loss-, and gradient-based baselines across DocVQA and PFL-DocVQA and three model families, claiming state-of-the-art membership inference without auxiliary data.
Significance. If the empirical claims held, DocMIA would be a useful contribution: it is the first document-level MIA for DocVQA, it avoids shadow-training, and it addresses auto-regressive outputs in a structured way. The paper ships code, includes extensive ablations (hyperparameters, layer selection, feature ablation, rephrased questions, DP defenses), and evaluates across several models and datasets. These strengths make the work worth serious consideration. However, the evaluation protocol for the black-box setting has a transductive leak, and the white-box hyperparameters are tuned on the evaluation set; both issues undermine the strength of the reported numbers and the SOTA claim.
major comments (4)
- [§4.3, §5.2, Table 3] The black-box evaluation is transductive: Dquery is constructed from Dtest, the very same 600 documents later classified, and the proxy F_p is trained to maximize the likelihood of the target model's outputs on those documents. The proxy is therefore fit to the exact member and non-member documents it subsequently attacks; the optimization-distance feature Δ (Eq. 3) can simply encode how well the proxy memorized each document's target answers. Appendix F.3 and Figure 10(a) are consistent with this reading, as attack accuracy tracks the proxy's training loss approaching zero. To support the stated auxiliary-data-free claim, the proxy must be distilled on outputs for one set of documents and evaluated on a disjoint set of member/non-member documents.
- [Appendix C, Table 7] The hyperparameters α, τ, and layer L are selected by maximizing attack accuracy on Dtest, the same 600 documents used to report the headline numbers in Tables 2–4 and 11–16. Although the final clustering step is unsupervised, the hyperparameter search is supervised by the evaluation metric on the evaluation set. This makes the reported accuracies optimistic and the comparison to baselines (which use fixed rules, e.g., threshold at the average score) unfair. A validation split disjoint from the test documents should be used for hyperparameter selection, or the paper should report results with hyperparameters fixed a priori.
- [Table 3] The black-box DocMIA results do not consistently beat the baselines. For example, with the VT5 proxy on DVQA/VT5, FL gives −0.84 ACC and −1.10 F1 versus the best SCORE-UA baseline, and with the Donut proxy on DVQA/VT5, FL gives −4.34 ACC and −4.36 F1. The abstract's claim of outperforming state-of-the-art attacks across all models and datasets is therefore supported only for a subset of configurations (notably when the proxy architecture matches the target or when the target is Pix2Struct). Please report a clear win/loss count and a statistical comparison across seeds, or soften the claim.
- [Appendix F.1, Tables 14/15] The paper's central intuition is that the optimization-distance feature Δ is a reliable membership signal, but the feature-ablation tables show Δ alone is not discriminative on several targets: for Donut/DocVQA, AVG(Δ) gives F1 57.34 versus AVG(NLS) 76.88, and AVG(s) alone gives only 60.32. The large improvement from switching AVG to Φall (+9.24 F1 on Donut/DocVQA) indicates that the headline results are driven by feature combination and aggregation rather than by the optimization-distance premise per se. The paper should identify which features actually carry the signal and temper the narrative that optimization-based distance is the key novel ingredient.
minor comments (4)
- [Table 7] The header contains a typo: 'Hyperaremeters' should be 'Hyperparameters'.
- [Algorithm 1] The early-stopping condition on line 8, (L(θ) − l) < τ, is described in the text as stopping when 'no further improvements is observed,' but the condition as written stops when the loss decrease is below a threshold. Please clarify the intended sign and whether the check uses the current loss or the previous loss.
- [Figure 1] The caption says 'Training:' for the first panel, which is likely a typo for 'Train' or 'Training phase'; please adjust for clarity.
- [Appendix F.3] The discussion of the proxy model training to near-zero loss should be moved or summarized in the main text, since it directly affects the interpretation of the black-box results and the transductive concern raised above.
Circularity Check
No circular derivation: DocMIA's reported gains are measured empirically against public checkpoints and fixed benchmarks; the black-box proxy design is transductive but not a definitional reduction.
full rationale
The manuscript is an empirical attack paper, not a derivation from first principles. The white-box distance feature Δ (Eq. 3) is an optimization statistic whose discriminative power is evaluated, not assumed; Appendix F.1 shows cases where Δ alone is weaker than the utility score (e.g., Donut/DocVQA F1 57.34 vs 76.88), so the method's success is not built into its own definition. The black-box construction in Sec. 4.3 trains the proxy on target outputs for Dtest and then attacks the same 600 documents (Sec. 5.3), which makes the evaluation transductive and raises a legitimate transferability concern: the proxy may have memorized target answers for exactly those documents, so the reported black-box gains may not transfer to a disjoint candidate set. However, this is not circularity under the required standard: the proxy is fit to target predictions, not to the member/non-member labels, and the attack score is a measured function of further fine-tuning, not algebraically equal to the proxy's training loss or to the membership label. Similarly, hyperparameters are tuned on the evaluation set (Sec. 5.2, App. C), which is an evaluation-integrity concern rather than a definitional reduction of the claimed result. Citations to Tito et al. (2024) anchor the public dataset, checkpoint, and one baseline; they are independent external anchors. No load-bearing step reduces by construction to its own input, so the circularity score is 0.
Assumptions & free parameters
free parameters (7)
- Early-stopping threshold tau for FL variant =
VT5: 1e-6; Donut: 5.0; Pix2Struct-B: 1e-4 (Table 7)
- Early-stopping threshold tau for IG variant =
VT5: 1e-5; Donut: not listed clearly; Pix2Struct-B: 1e-3 (Table 7)
- Learning rate alpha for FL/FLLoRA =
0.001 for all models (Table 7)
- Learning rate alpha for IG =
1.0 for VT5/Donut; 1e-4 for Pix2Struct-B (Table 7)
- Layer L to optimize =
last decoder FC layer (embedding projection layer)
- Max optimization steps S =
200
- Max questions per document M =
10
assumptions (4)
- domain assumption The adversary knows the exact training question-answer pairs for each candidate document.
- domain assumption The fine-tuning distance and step count separate member from non-member documents.
- domain assumption In the black-box setting, a proxy trained on the target model's outputs for Dtest preserves membership-indicative structure.
- domain assumption Public pre-trained checkpoints used for proxy initialization are available and are disjoint from the private training set.
Cite this review
Pith. "Pith review of DocMIA: Document-Level Membership Inference Attacks against DocVQA Models." pith.science (2026). https://pith.science/paper/LDQ3GU6H
@misc{pith2026250203692,
author = {Pith},
title = {Pith review of: DocMIA: Document-Level Membership Inference Attacks against DocVQA Models},
year = {2026},
howpublished = {\url{https://pith.science/paper/LDQ3GU6H}},
note = {Machine review of arXiv:2502.03692}
}
read the original abstract
Document Visual Question Answering (DocVQA) has introduced a new paradigm for end-to-end document understanding, and quickly became one of the standard benchmarks for multimodal LLMs. Automating document processing workflows, driven by DocVQA models, presents significant potential for many business sectors. However, documents tend to contain highly sensitive information, raising concerns about privacy risks associated with training such DocVQA models. One significant privacy vulnerability, exploited by the membership inference attack, is the possibility for an adversary to determine if a particular record was part of the model's training data. In this paper, we introduce two novel membership inference attacks tailored specifically to DocVQA models. These attacks are designed for two different adversarial scenarios: a white-box setting, where the attacker has full access to the model architecture and parameters, and a black-box setting, where only the model's outputs are available. Notably, our attacks assume the adversary lacks access to auxiliary datasets, which is more realistic in practice but also more challenging. Our unsupervised methods outperform existing state-of-the-art membership inference attacks across a variety of DocVQA models and datasets, demonstrating their effectiveness and highlighting the privacy risks in this domain.
Figures
Figures from the paper (6 more)
Reference graph
Works this paper leans on
-
[1]
Deep learning with differential privacy
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308–318,
2016
-
[5]
Practical blind membership inference attack via differential comparisons
Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, and Yinzhi Cao. Practical blind membership inference attack via differential comparisons. arXiv preprint arXiv:2101.01341,
-
[6]
Our findings reveal thatlayers closer to the final output exhibit higher privacy leakagein terms of MI compared to (randomly selected) intermediate layers, likely due to receiving larger gradient updates. Specifically, fine-tuning the final fully connected layer alone leads to strong attack performance 17 Published as a conference paper at ICLR 2025 Model...
work page 2025
-
[7]
D M ORE ON ATTACK IMPLEMENTATION D.1 T ARGET MODEL TRAINING For all target models, whenever feasible, we utilize the public checkpoint fine-tuned on the consid- ered private dataset from Hugging Face library and adhere to the data processing guidelines, such as document resolution, as recommended by the authors. We deliberately opt for public checkpoints ...
work page 2025
-
[8]
Springer Nature Switzerland. ISBN 978-3-031-19815-1. Diederik P Kingma. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980,
-
[9]
Pix2struct: screenshot pars- ing as pretraining for visual language understanding
12 Published as a conference paper at ICLR 2025 Kenton Lee, Mandar Joshi, Iulia Turc, Hexiang Hu, Fangyu Liu, Julian Eisenschlos, Urvashi Khan- delwal, Peter Shaw, Ming-Wei Chang, and Kristina Toutanova. Pix2struct: screenshot pars- ing as pretraining for visual language understanding. In Proceedings of the 40th International Conference on Machine Learnin...
work page 2025
-
[10]
Membership leakage in label-only exposures
Zheng Li and Yang Zhang. Membership leakage in label-only exposures. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 880–895,
work page 2021
-
[12]
Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246,
Show all 30 references
-
[14]
Membership inference at- tacks against machine learning models
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3–18. IEEE,
2017
-
[15]
Privacy risks of securing machine learning models against adversarial examples
Liwei Song, Reza Shokri, and Prateek Mittal. Privacy risks of securing machine learning models against adversarial examples. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pp. 241–257,
2019
-
[16]
Privacy-aware document visual question answering
13 Published as a conference paper at ICLR 2025 Rub`en Tito, Khanh Nguyen, Marlon Tobaben, Raouf Kerkouche, Mohamed Ali Souibgui, Kangsoo Jung, Joonas J ¨alk¨o, Vincent Poulain D ´Andecy, Aurelie Joseph, Lei Kang, et al. Privacy-aware document visual question answering. In Int...
2025
-
[17]
Transformers: State-of-the-art natural language processing
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Remi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mari...
2020
-
[18]
Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri
Association for Computational Linguistics. Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. En- hanced membership inference attacks against machine learning models. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communic...
2022
-
[19]
Privacy risk in machine learn- ing: Analyzing the connection to overfitting
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learn- ing: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pp. 268–282. IEEE,
2018
-
[20]
Min-k%++: Improved baseline for detecting pre-training data from large language models
Jingyang Zhang, Jingwei Sun, Eric Yeats, Yang Ouyang, Martin Kuo, Jianyi Zhang, Hao Frank Yang, and Hai Li. Min-k%++: Improved baseline for detecting pre-training data from large language models. arXiv preprint arXiv:2404.02936,
-
[22]
This dataset is specifically designed for DocVQA tasks in a federated learning and differential privacy setup, supporting different levels of privacy granularity
A large-scale dataset of real business invoices, often containing privacy-sensitive information such as payment amounts, tax numbers, and bank account details. This dataset is specifically designed for DocVQA tasks in a federated learning and differential privacy setup, suppor...
2018
-
[23]
A document is predicted as a member if ¯l ≤ κ and otherwise non-member, where κ is selected as the average value of ¯l across Dtest
Similar to S CORE -TA, this attack com- putes the average loss ¯l = 1 M ΣM i L(F (x, qi)). A document is predicted as a member if ¯l ≤ κ and otherwise non-member, where κ is selected as the average value of ¯l across Dtest. Unsupervised One-step Gradient Attack (GRADIENT -UA) ...
2019
-
[24]
We first study the effect of α, which controls the speed of the optimization process in our attacks
Learning Rate α. We first study the effect of α, which controls the speed of the optimization process in our attacks. This threshold τ is empirically set to be the average loss change observed when performing one optimization step after reaching the correct answer. Only the di...
-
[27]
Table 10 presents the target models’ performance across both DocVQA datasets
D.2 T ARGET MODEL PERFORMANCE ON DOCVQA To ensure the utility of the target models for our experiments, we validated that the DocVQA per- formance of each model checkpoint closely matched the results reported in the respective papers. Table 10 presents the target models’ perfo...
2022
-
[28]
total amount
This performance can be attributed to the clear separation in the loss distribution between member and non-member samples (Figure 8), which indicates overfitting behavior in these cases. F M ORE ON ANALYSIS In this section, we provide a deeper analysis of the effectiveness of ...
2025
-
[29]
The expectation is that the proxy model can capture internal decision-making patterns by following the black-box’s prediction strategies
F.3 T HE RESULTING PROXY MODEL The purpose of training the Proxy Model on Dquery, with labels generated by the black-box model, is to mimic the prediction patterns of the black-box model. The expectation is that the proxy model can capture internal decision-making patterns by ...
2016
-
[1920]
For additional details on the effects of document resolution, we refer readers to the original model’s paper(Kim et al., 2022)
in the public checkpoint provided by the original authors, which slightly reduced the model’s DocVQA performance. For additional details on the effects of document resolution, we refer readers to the original model’s paper(Kim et al., 2022). The model was trained using the Ada...
2022
-
[2015]
Lora: Low-rank adaptation of large language models
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685,
-
[2018]
Detecting pretraining data from large language models
Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. arXiv preprint arXiv:2310.16789,
-
[2019]
Mem- bership inference attacks from first principles
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Mem- bership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pp. 1897–1914. IEEE,
2022
-
[2020]
arXiv preprint arXiv:2008.08899,
2008 arXiv
-
[2021]
Mistral 7b
Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. Mistral 7b. arXiv preprint arXiv:2310.06825,
-
[2022]
Label-only membership inference attacks
Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. In International conference on machine learning, pp. 1964–1974. PMLR,
1964
-
[2023]
Ocr-free document un- derstanding transformer
Geewook Kim, Teakgyu Hong, Moonbin Yim, JeongYeon Nam, Jinyoung Park, Jinyeong Yim, Wonseok Hwang, Sangdoo Yun, Dongyoon Han, and Seunghyun Park. Ocr-free document un- derstanding transformer. In Shai Avidan, Gabriel Brostow, Moustapha Ciss ´e, Giovanni Maria Farinella, and Ta...
2022
-
[2024]
18 D.2 Target Model Performance on DocVQA
14 Published as a conference paper at ICLR 2025 APPENDIX A DocVQA Datasets 15 B Baselines 16 C Ablation Study 17 D More on Attack Implementation 18 D.1 Target Model Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 D.2 Target Model Performance on DocV...
2025
Reviewed August 9, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.