Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probing

2025-11-03

AI Summary

Large vision-language models (LVLMs) are prone to memorizing training data, rendering them vulnerable to membership inference attacks (MIAs). Existing MIA methods predominantly rely on white-box or gray-box assumptions—requiring access to model internals such as gradients, parameters, or intermediate representations—making them inapplicable to mainstream LVLM services that expose only textual outputs. This paper proposes the first purely black-box MIA framework for LVLMs: it requires no model parameters, gradients, or internal feature representations, and instead infers membership solely from semantic anomalies in generated text. Its core innovation is a prior-knowledge calibration mechanism that effectively disentangles model memorization of private training data from general knowledge reasoning. Evaluated across four state-of-the-art LVLMs and three benchmark datasets, our method achieves performance on par with white-box and gray-box approaches while demonstrating strong robustness. Code and data are publicly released.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: (Large) Language Models
• Computer Vision: Large Vision Models

Application Category

• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Large vision-language models (LVLMs) derive their capabilities from extensive training on vast corpora of visual and textual data. Empowered by large-scale parameters, these models often exhibit strong memorization of their training data, rendering them susceptible to membership inference attacks (MIAs). Existing MIA methods for LVLMs typically operate under white- or gray-box assumptions, by extracting likelihood-based features for the suspected data samples based on the target LVLMs. However, mainstream LVLMs generally only expose generated outputs while concealing internal computational features during inference, limiting the applicability of these methods. In this work, we propose the first black-box MIA framework for LVLMs, based on a prior knowledge-calibrated memory probing mechanism. The core idea is to assess the model memorization of the private semantic information embedded within the suspected image data, which is unlikely to be inferred from general world knowledge alone. We conducted extensive experiments across four LVLMs and three datasets. Empirical results demonstrate that our method effectively identifies training data of LVLMs in a purely black-box setting and even achieves performance comparable to gray-box and white-box methods. Further analysis reveals the robustness of our method against potential adversarial manipulations, and the effectiveness of the methodology designs. Our code and data are available at https://github.com/spmede/KCMP.

Problem

• Proposes black-box membership inference attack for large vision-language models
• Assesses model memorization of private semantic information in images
• Operates without accessing internal model parameters during inference

Innovation

• Black-box membership inference attack for LVLMs
• Prior knowledge-calibrated memory probing mechanism
• Assesses model memorization of private semantic information