Have You Ever Seen Them? Entity-level Membership Inference through Interrogating Large Language Models

2026-06-22

AI Summary

This work addresses a critical limitation of existing membership inference methods, which are confined to sample-level training data leakage and cannot determine whether large language models have acquired knowledge about specific real-world entities from fragmented text. For the first time, we extend membership inference to the entity level and introduce a novel black-box task: inferring whether a target entity was present in the model’s training data solely through its generated outputs, leveraging carefully designed prompts and semantic features. Inspired by human memory mechanisms, we formalize this task and propose five query strategies that operate under limited observational cues. Experimental results on a person-entity dataset demonstrate strong performance, achieving an AUC of 0.97 and improving balanced accuracy by 6.0%–17.5% over the best baseline.

Abstract

Large Language Models (LLMs) raise growing concerns about privacy leakage and copyright compliance. Membership inference is a key tool for assessing such risks, but existing studies mainly focus on whether specific samples or sample-based data units are used for training. We argue that LLMs exhibit a human-memory-like behavior: an LLM may not memorize a specific sample verbatim, yet it can accumulate and reveal knowledge about a real-world entity from scattered mentions. This analogy motivates us to examine whether an LLM can be interrogated like a human interviewee to reveal its exposure to entity-related information. Motivated by this question, we propose entity-level membership inference, which determines whether information related to a target entity is used in LLM training. We study this task in the practical label-only black-box setting, where only generated texts are observable. We formalize the task under clue, input, and model constraints, establish the necessary and sufficient conditions for its feasibility, and instantiate five interrogation strategies based on this formalization. The strategies use limited entity clues to construct prompts, elicit entity-related responses, and infer membership from semantic features among the generated texts. We construct entity-level datasets and adapt state-of-the-art sample-level label-only methods to the entity-level setting as baselines. Experiments on person entities show that our methods achieve AUC up to 0.97 and bring gains of 6.0%--17.5% in Balanced Accuracy over the best adapted baseline.

Problem

• membership inference
• large language models
• entity-level
• privacy leakage
• black-box setting

Innovation

• entity-level membership inference
• large language models
• privacy leakage
• black-box interrogation
• semantic feature analysis