{"id":"https://openalex.org/W4405181769","doi":"https://doi.org/10.1145/3658644.3690306","title":"Membership Inference Attacks Against In-Context Learning","display_name":"Membership Inference Attacks Against In-Context Learning","publication_year":2024,"publication_date":"2024-12-02","ids":{"openalex":"https://openalex.org/W4405181769","doi":"https://doi.org/10.1145/3658644.3690306"},"language":"en","primary_location":{"id":"doi:10.1145/3658644.3690306","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3690306","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690306","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690306","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5057596386","display_name":"Rui Wen","orcid":"https://orcid.org/0009-0009-0691-7569"},"institutions":[{"id":"https://openalex.org/I4210128801","display_name":"Helmholtz Center for Information Security","ror":"https://ror.org/02njgxr09","country_code":"DE","type":"facility","lineage":["https://openalex.org/I1305996414","https://openalex.org/I4210128801"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Rui Wen","raw_affiliation_strings":["CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"],"raw_orcid":"https://orcid.org/0009-0009-0691-7569","affiliations":[{"raw_affiliation_string":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany","institution_ids":["https://openalex.org/I4210128801"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101809231","display_name":"Zheng Li","orcid":"https://orcid.org/0000-0002-4466-7523"},"institutions":[{"id":"https://openalex.org/I4210128801","display_name":"Helmholtz Center for Information Security","ror":"https://ror.org/02njgxr09","country_code":"DE","type":"facility","lineage":["https://openalex.org/I1305996414","https://openalex.org/I4210128801"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Zheng Li","raw_affiliation_strings":["CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"],"raw_orcid":"https://orcid.org/0000-0002-4466-7523","affiliations":[{"raw_affiliation_string":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany","institution_ids":["https://openalex.org/I4210128801"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102730269","display_name":"Michael Backes","orcid":"https://orcid.org/0000-0002-7130-9211"},"institutions":[{"id":"https://openalex.org/I4210128801","display_name":"Helmholtz Center for Information Security","ror":"https://ror.org/02njgxr09","country_code":"DE","type":"facility","lineage":["https://openalex.org/I1305996414","https://openalex.org/I4210128801"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Michael Backes","raw_affiliation_strings":["CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"],"raw_orcid":"https://orcid.org/0000-0002-7130-9211","affiliations":[{"raw_affiliation_string":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany","institution_ids":["https://openalex.org/I4210128801"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5030605497","display_name":"Yang Zhang","orcid":"https://orcid.org/0000-0003-3612-7348"},"institutions":[{"id":"https://openalex.org/I4210128801","display_name":"Helmholtz Center for Information Security","ror":"https://ror.org/02njgxr09","country_code":"DE","type":"facility","lineage":["https://openalex.org/I1305996414","https://openalex.org/I4210128801"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Yang Zhang","raw_affiliation_strings":["CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"],"raw_orcid":"https://orcid.org/0000-0003-3612-7348","affiliations":[{"raw_affiliation_string":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany","institution_ids":["https://openalex.org/I4210128801"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210128801"],"apc_list":null,"apc_paid":null,"fwci":4.2672,"has_fulltext":true,"cited_by_count":12,"citation_normalized_percentile":{"value":0.95758024,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"3481","last_page":"3495"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9765999913215637,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9606999754905701,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7974144816398621},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.7317906618118286},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6259707808494568},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6112518906593323},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5312188863754272},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.45926108956336975},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4058524966239929}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7974144816398621},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.7317906618118286},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6259707808494568},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6112518906593323},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5312188863754272},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.45926108956336975},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4058524966239929},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3658644.3690306","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3690306","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690306","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3658644.3690306","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3690306","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3690306","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4952866186","display_name":null,"funder_award_id":"16KISAO29K","funder_id":"https://openalex.org/F4320321114","funder_display_name":"Bundesministerium f\u00fcr Bildung und Forschung"},{"id":"https://openalex.org/G872089326","display_name":null,"funder_award_id":"101057917","funder_id":"https://openalex.org/F4320323817","funder_display_name":"Universitas Brawijaya"}],"funders":[{"id":"https://openalex.org/F4320321114","display_name":"Bundesministerium f\u00fcr Bildung und Forschung","ror":"https://ror.org/04pz7b180"},{"id":"https://openalex.org/F4320323817","display_name":"Universitas Brawijaya","ror":"https://ror.org/01wk3d929"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4405181769.pdf","grobid_xml":"https://content.openalex.org/works/W4405181769.grobid-xml"},"referenced_works_count":44,"referenced_works":["https://openalex.org/W569478347","https://openalex.org/W2170240176","https://openalex.org/W2535690855","https://openalex.org/W2795435272","https://openalex.org/W2807096445","https://openalex.org/W2930926105","https://openalex.org/W2946363484","https://openalex.org/W2946930197","https://openalex.org/W2956128647","https://openalex.org/W2970641574","https://openalex.org/W2981852735","https://openalex.org/W3013068160","https://openalex.org/W3030163527","https://openalex.org/W3046102592","https://openalex.org/W3103245149","https://openalex.org/W3104224589","https://openalex.org/W3112689365","https://openalex.org/W3126152116","https://openalex.org/W3127447688","https://openalex.org/W3138815606","https://openalex.org/W3155551741","https://openalex.org/W3172943453","https://openalex.org/W4226079995","https://openalex.org/W4308244910","https://openalex.org/W4308410483","https://openalex.org/W4308410741","https://openalex.org/W4322718191","https://openalex.org/W4364385323","https://openalex.org/W4379470871","https://openalex.org/W4383605243","https://openalex.org/W4384390290","https://openalex.org/W4385565597","https://openalex.org/W4385571552","https://openalex.org/W4385679781","https://openalex.org/W4386977463","https://openalex.org/W4387800041","https://openalex.org/W4388652756","https://openalex.org/W4402954589","https://openalex.org/W6841867693","https://openalex.org/W6848909144","https://openalex.org/W6854691855","https://openalex.org/W6857316800","https://openalex.org/W6874517714","https://openalex.org/W6940086981"],"related_works":["https://openalex.org/W2055243143","https://openalex.org/W2095999892","https://openalex.org/W2018764758","https://openalex.org/W2383689843","https://openalex.org/W1550668881","https://openalex.org/W617913288","https://openalex.org/W2062873522","https://openalex.org/W2319323865","https://openalex.org/W2951745010","https://openalex.org/W1986418932"],"abstract_inverted_index":{"Adapting":[0],"Large":[1],"Language":[2],"Models":[3],"(LLMs)":[4],"to":[5,29,66],"specific":[6],"tasks":[7],"introduces":[8],"concerns":[9],"about":[10],"computational":[11],"efficiency,":[12],"prompting":[13],"an":[14,130],"exploration":[15],"of":[16,27,125,133],"efficient":[17],"methods":[18],"such":[19],"as":[20],"In-Context":[21],"Learning":[22],"(ICL).":[23],"However,":[24],"the":[25,43,102,123,126],"vulnerability":[26],"ICL":[28],"privacy":[30,159,164],"attacks":[31,85],"under":[32],"realistic":[33],"assumptions":[34],"remains":[35],"largely":[36],"unexplored.":[37],"In":[38],"this":[39],"work,":[40],"we":[41,116,140],"present":[42],"first":[44],"membership":[45,89],"inference":[46],"attack":[47,63,120],"tailored":[48,65],"for":[49],"ICL,":[50],"relying":[51],"solely":[52],"on":[53,74],"generated":[54],"texts":[55],"without":[56],"their":[57],"associated":[58,103],"probabilities.":[59],"We":[60],"propose":[61,117],"four":[62,75],"strategies":[64],"various":[67],"constrained":[68],"scenarios":[69],"and":[70,148,161],"conduct":[71],"extensive":[72],"experiments":[73],"popular":[76],"large":[77],"language":[78],"models.":[79],"Empirical":[80],"results":[81],"show":[82],"that":[83,101,121],"our":[84],"can":[86],"accurately":[87],"determine":[88],"status":[90],"in":[91,136],"most":[92,137],"cases,":[93],"e.g.,":[94],"95%":[95,135],"accuracy":[96,131],"advantage":[97,132],"against":[98],"LLaMA,":[99],"indicating":[100],"risks":[104],"are":[105],"much":[106],"higher":[107],"than":[108],"those":[109],"shown":[110],"by":[111],"existing":[112],"probability-based":[113],"attacks.":[114],"Additionally,":[115],"a":[118],"hybrid":[119],"synthesizes":[122],"strengths":[124],"aforementioned":[127],"strategies,":[128],"achieving":[129],"over":[134],"cases.":[138],"Furthermore,":[139],"investigate":[141],"three":[142],"potential":[143],"defenses":[144,153],"targeting":[145],"data,":[146],"instruction,":[147],"output.":[149],"Results":[150],"demonstrate":[151],"combining":[152],"from":[154],"orthogonal":[155],"dimensions":[156],"significantly":[157],"reduces":[158],"leakage":[160],"offers":[162],"enhanced":[163],"assurances.":[165]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":9}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}