Membership Inference Attacks against Large Vision-Language Models
Authors: Zhan Li
Yongtao Wu
Yihang Chen
Francesco Tonin
Elias Abad Rocamora
Volkan Cevher
Venue: NeurIPS 2024 poster (2024)
Keywords: Membership inference attack; Large Vision-Language Models
Primary area: privacy
TL;DR: We introduce the first membership inference attack (MIA)  benchmark for VLLMs and propose a novel MIA pipeline with a new MIA metric.

Abstract: Large vision-language models (VLLMs) exhibit promising capabilities for processing multi-modal tasks across various application scenarios. However, their emergence also raises significant data security concerns, given the potential inclusion of sensitive information, such as private photos and medical records, in their training datasets. Detecting inappropriately used data in VLLMs remains a critical and unresolved issue, mainly due to the lack of standardized datasets and suitable methodologies. In this study, we introduce the first membership inference attack (MIA) benchmark tailored for various VLLMs to facilitate training data detection. Then, we propose a novel MIA pipeline specifically designed for token-level image detection. Lastly, we present a new metric called MaxRényi-K%, which is based on the confidence of the model output and applies to both text and image data. We believe that our work can deepen the understanding and methodology of MIAs in the context of VLLMs. Our code and datasets are available at https://github.com/LIONS-EPFL/VL-MIA.

Membership Inference Attacks against Large Vision-Language Models
Zhan Li' Yongtao Wu" Yihang Chen"t
Francesco Tonin Elias Abad Rocamora Volkan Cevher
LIONS, EPFL
[first name]. [last name] @epfl.ch
Abstract
Large vision-language models (VLLMs) exhibit promising capabilities for pro- cessing multi-modal tasks across various application scenarios. However, their emergence also raises significant data security concerns, given the potential in- clusion of sensitive information, such private photos and medical records, in their training datasets. Detecting inappropriately used data in VLLMs remains a critical and unresolved issue, mainly due to the lack of standardized datasets and suitable methodologies. In this study, we introduce the first membership infer- ence attack (MIA) benchmark tailored for various VLLMS to facilitate training data detection. Then, we propose a novel MIA pipeline specifically designed for token-level image detection. Lastly, we present a new metric called MaxRényi -K%. which is based on the confidence of the model output and applies to both text and image data. We believe that our work can deepen the understanding and method- ology of MIAs in the context of VLLMs. Our code and datasets are available at http://gnhuubboom/o///////EEEEE
Introduction
The rise of large language models (LLLMs) 9
has inspired the exploration of large models across multi-modal domains, exemplified by advancements like GPT-4 [1] and Gemini [59]. These large vision-language models (VLLMs) have shown promising ability in various multi-modal tasks, such image captioning (33], image question answering [13 35), and image knowledge extraction [26]. However, the rapid advancement of VLLMs also causes user concerns about privacy and knowledge leakage. For instance, the image data used during commercial model training may contain private photographs or medical diagnostic records. This is concerning since early work has demonstrated that machine learning models memorize and leak training data [3] [56 63 To mitigate such concerns, it is essential to consider the membership inference attack (MIA) 23 53
where attackers seek detect whether a particular data record is part of the training dataset 23
The study of MIAs plays an important role in preventing test data contamination and protecting data
security, which is of great interest to both industry and academia [2 19 44
When exploring MIAs VLLMs, one main issue the absence standardized dataset designed to develop and evaluate different MIA methods, which comes from the large size [6] and multi-
modality of the training data, and the diverse VLLMs training pipelines [66] 35 18] Therefore, one
of the main goals of this work is to build an MIA benchmark tailored for VLLMs.
Beyond the need for valid benchmark, we lack efficient techniques detect single modality in VLLMMs. The closest work to ours is 30, which performs MIAs on multi-modal CLIP [46] by detecting whether an image-text pair in the training set. However, in practice, it is more common
'Equal contribution.
Corresponding author. Email: whangchen@cs..ullee ucla.edu
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Target iaage
Instruction Xs..
Target VLLM
Generated text (description X
skier descending sloop, anow-oovered slops.
Describe this image.
Target image
Gencraaion stage Inforencc stage
Describe this mege.
skier descending steep. snow covered slape.
logils
Member
MaxRinryi K%
image
Instruction
descr ption
Non-menmbe
Target text
Fosition: Rérr entropy
Fosition: Rényy entropy
An adventurous sker skillfully moved down the steep, anowy rate of speed.
Average Max- K% Rényl entropy
Sort
Member
Non-membar
13 Rony entropy of each position
select largest K% Ronyl entropy
Figure 1: MIAS against VLLMs. Top:
Our image detection pipeline: feed the image and instruction to the target model to obtain description; then during the inference stage, we input the image, instruction, and generated description to the model, and extract the logits slices to calculate metrics. Bottom: MaxRényi-BB metrie: first get the Rényi entropy of each token position, then select the largest 4% tokens and calculate the average Rényi entropy.
the generation stage, we
to detect single modality, as we care whether an individual image or text in the training set. Therefore, we aim to develop a pipeline to detect the single modality from a multi multi-modal model. Moreover, existing literature on language model MIAs, such as Min-K% K% [52] and Perplexity [62]. mostly are target-based MIAs, which use the next token as the target to compute the prediction probability. However, we can only access the image embedding instead of the image token in VLLMS, and thus only target-free MIAs [48] can be directly applied.
Therefore, we first propose cross-modal pipeline for individual image description MIAs on VLLMs, which is distinguished from traditional MIAs that only use one modality [61 622. We feed the VLLMs with customized image-instruction pair from the target image description. We show that we can perform the MIA not only by the image slice but also by the instruction and description slices of the VLLM's output logits, see Figure I Such cross-modal pipeline enables the usage of text MIA methods on image MIAs. We also introduce target-free metric that adapts to both image and text MIAs and can be further modified a target-based way.
Overall, the contributions and insights can be summarized as follows.
We release the first benchmark tailored for the detection of training data VLLMs, called Vision Language MIA (VL-MIA) (Section By leveraging Flickr and GPT-4, construct VL-MIA that contains two images MIA tasks and one text MIA task for various
VLLMs, including MiniGPT-4 (66]. LLaVA 1.5 35 and LLaMA-Adapter V2 (18).
We perform the first individual image or description MIAs on VLLMs in cross-modal manner. Specifically, we demonstrate that we can perform image MIAs by computing statistics from the image or text slices of the VLLM's output logits (Figure [ Section 5.1).
We propose target-free MIA metric, MaxRényi-Hee -%%, and its modified target- based ModRényi (Section 5.2 We demonstrate their effectiveness on open-source VLLMs and closed-source GPT-4 (Section 6). We achieve an AUC of 0.815 on GPT-4 in image MIAs.
2 Related work
Membership Inference Attack (MTA) aims to classify whether a data sample has been used in training machine learning model [53]. Keeping training data confidential is desired property for

---

machine learning models, since training data may contain private information about an individual 62 24]. Popular MIA methods can be divided into metric-based and shadow model-based MIAs
(24.
Metric-based MIAs
62
48
57 52 determine whether data sample has been used for training
by comparing metrics computed from the output of the target model with a threshold. Shadow model-based MIAs need shadow training to mimic the behavior of the target model [3 48] which is
computationally infeasible for LLMs. Therefore, we focus on the metric-based methods in this work.
MIAs have been extensively researched in various machine learning models, including classifica-
tion models [3 58
generative models (20 22 7 and embedding models [44 40]. With
the emergence of LLMs, there are also lot of work exploring MIAs in LLMs
52
41..
Nevertheless, MIAs for multi-modal models have not been fully explored. [30] 25 perform MIAs
using the similarity between the image and the ground truth text, which detects the image-tex/ pair instead of a single image or text sequence. However, detecting an individual image or text is more practical in real-world scenarios and poses additional challenges. To the best of our knowledge, we are the first to perform the individual image or text MIA on VL..Ms.
In this paper, we also consider a more difficult task, to detect the pre-training data from the fine-tuned models, that is, to detect the base LLM pertaining data from VLLMs. First, compared with detecting fine-tuning data [55] [T], pretraining data come from a much larger dataset and are used only once,
reducing the potential probability for a successful MIA 27 32). In addition, compared to the detection of pretraining data from the pre-trained models [53 [52, catastrophic forgetting [29] 28 [6]
in the fine-tuning stage also makes harder to detect the pre-training data from downstream models. To the best of our knowledge, we are the first to perform pre-training data MIAs on fine-tuned models.
Large Vision- Language Models (VLLMs) incorporate visual preprocessors into LLMs g 60 45
to manage tasks that require handling inputs from text and image modalities. A foundational approach in this area is represented by CLIP (46), which established techniques for aligning modalities between text and images. Further developments have integrated image encoders with LLMS to create enhanced VLLMs. These models are typically pre-trained on vast datasets of image-text pairs for feature alignment [33] 64, 33 [2] and are subsequently instruction-tune tuned for specific downstream tasks to refine the end ability. MiniGPT (66] 8) LLaVA [6 35), and LLaMA Adapter [65] [8] series have
demonstrated significant capabilities in understanding and inference in this area.
3 Problem setting
In this section, we introduce the main notation and problem settings for MIAs.
Notation. The token set is denoted by V. A sequence with L tokens is denoted by X (I1, I2...., IL), where 2; E V for E [4]. Let X1 1 X2 be the concatenation of sequence X1 and Xg. An image token sequence is denoted by Z. In this work, we focus on the VLLM, parameterized by 6, where the input is the image Z followed by the instruction text Xins- and the output is the description text Xuss We use Daes and Dinage to represent the description training set and image training set, respectively. Detailed notations are summarized in 5 the appendix.
Attacker's goal. In this work, the purpose of the attacker is to detect whether given data point (image Z or description X belongs to the training set. We formulate this attack as a binary classi- fication problem. Let Aimage (2:0) : {0, 1} and Ades 0) : {0, 1} be two binary classification algorithms for image and description respectively, which are implemented by comparing the metric Score(Z Xis + Xdes; 8) with some threshold X.
When detecting image Z, we feed the model with the target image with a fixed instruction prompt such "Describe this image in detail", denoted as Xins The model then generates the description text X/ The algorithm Aimage (Z; 8) is defined by
{ (Z E D Dimuge,, if Score Z + Xms ① X f) < X,
A image (2;0)
(I)
(Z M D, if Score Z @ Xims ① X 0) 2 A.
desi
When detecting description sequence X we feed the model with an all-black image, denoted as Zept. as the visual input, followed by an empty instruction Xep. The algorithm AXes(Xasst 8) is defined by
A XXaes 0) = {1 (Xass Dues), Score (Zon ① Xep + Xaes; 8) << X, (Xaes & Daws), if Score (Zen + Xex O Xassi 0) 2 A. (2)
3

---

Attacker's knowledge. We assume grey-box setting on the target model, where the attacker can query the model by a custom prompt (including an image and text) and have access the tokenizer. the output logits, and the generated text. The attacker is unaware of the training algorithm and parameters of the target model.
4 Dataset construction
We construct a general dataset: Vision Language MIA (VL-MIA), based on the training data used for popular VLLMs, which, We present a takeaway overview of VL-MIA in [ We also provide some examples in VL-MIA, see Table 16 in the appendix. The prompts we for generation can be found in Table
knowledge, is the first MIA dataset designed specifically for VLLMs.
Table 1: Overview of VL-MIA dataset: VL-MIA covers image and text modalities and can be applied for dominant open-sourced VLLMs.
Dataset
Modality
Member data
Non-member data
Application
LLaVA 1.5 MiniGPT-4
VL-MIA/DALL-E
image
LAION CCS
DALL- M-gL---gencrated images
LLaMA_adunn _ddupeer v2
LLaVA 1.5 MiniGPT-4
VL-MIA/Flickr
image
MS COCO (from Flickr)
Latest images on Flickr
LLaMA LLaMA_aduptee adupter
LLaVA 1.5
LLaVA v1.5 instruction-tuning text
GPT-generater answers
LLaMA LLaMA_adapter
VL-MIA/Text
text
MiniGPT-4 instruction-tuning lext
GPT-generated answers
MiniGPT-4
Target models. We perform MIAs open-source VLLMs, including MiniGPT-4 (66,, 1L B5
and LLaMA-Adapter V2.1 [18]. The checkpoints and training datasets of these models are provided and public. The training pipeline of VILMM encompasses several stages. Initially, an LLM undergoes pre-training using extensive text data such as ILaMA [88]. Meanwhile, a vision preprocessor, e.g., CLIP [46). is pre-trained on a large number of image-text pairs. Subsequently, a VLLM is constructed based on the LLM and the vision preprocessor and is pre-trained using image-text pairs. The final stage involves instruction-tunin the VLLM, which can be performed using either image-text pairs or image-based question-answe -nnseer data. In the instruction tuning stage of a VLLM, every data entry contains an image, a question, and the corresponding answer the image. We use the answer text as member data and GPT-4 generated answers under the same question and same image as non-member data. Specifically, for LLaVA 1.5 and ALaMA-Adapte v2, we use the answers in LLaVA 1.5's instruction tuning as member data.
VL-MIA/DALL-E, MiniGPT-4, LLaVA 1.5, and LLaMA-Adapter V2 use images from LAION 49
Conceptual Captions 3M [6] Conceptual 12M [6] and SBU captions [43] datasets (collectively referred as LAION-CCS) pre-training data. BLIP (33 provides a synthetic dataset with image- caption pairs for LAION-CCS used in MiniGPT-4 and LLaVA 1.5. We first detect the intersection of the training images used in these three VLLMs. From this intersection, a subset to serve as the member data for our benchmark. For the non-member data, we use the corresponding BLIP captions of the member images as prompts to generate images with DALL-E 2 This process yields one-to-one corresponding pairs of the generated images (non-member) and original member images. Consequently, our dataset comprises an equal number of member images from the LAION-CCS dataset and non-member images generated by DALL-E, allowing us to evaluate MIA performance comprehensively. We have 592 images in VL-MIA/DALLEE in total.
randomly select
FL-MIA/Flickr. MS COCO (34] co-occurs as a widely used dataset in the training data of the target models, so we use the images in this dataset member data. Given the fact that such member data are collected from Flick(" Fl
we filter Flickr photos by the year of upload and obtain new photos from January 1, 2024, as non-member data, which are later than the release of the target models. We additionally prepare set of corrupted versions, where the member images are deliberately corrupted
httpa://plattorrm http:////ppaffor..pp...... wtw./occc/ode/eleeeo
https://www www.kr.cccoooooo

---

to simulate real-world settings. More results of the corrupted versions are discussed in Section 6.5 This dataset contains 600 images.
VL.-MIATTxt. We prepare text MIA datasets for the VL.LMs instruction-tuning stage. LLav 1.5 and LLaMA Adapter v2.1 both use the ALaaA-Instrucc-1500 multi-round QA conversations. We first select entries with descriptive answers of 64 words. Next, we feed the corresponding questions and images into GPT- and ask GPT-4 to generate responses of the same length, treating these generated responses as non-member text data. In addition, since MiniGPT- 4 employs long descriptions of images for instruction-tun tuning, typically beginning with "the image". we prompt GPT to generate descriptions based on the MS COCO dataset, starting with "this image" to ensure similar data distributions. We also prepare different versions of the datasets by truncating the text into different word lengths such as 16, 32, and 64, Each text dataset contains 600 samples.
35 in instraction-tuningg which consists of
VT-MIA//Sytthttic We synthesize two new MIA datasets: VI-MIA/Geoometry and VL. MIA/ IAA/asswwrrd. The image in the VL-MIA/Geommrry consists of a random 4x4 arrangement of geometrical shapes, and the image in the VL-MIA/Password consists of random 6x6 arrangement of characters and digits from MNIST [15] and EMINST (12). The associated text for each image represents its content (e.g., specific characters, colors, or shapes), ordered from left to right and top to bottom. Half of the dataset can be selected as the member set for VLLM fine-tuning, with the remainder as the non- non-member set. This partition ensures that members and non non-members are independently and identically distributed, avoiding the latent distribution shift between the members and non members in current MIA datasets [14. Our synthetic datasets are ready use, and can be applied to evaluate any VILLM MIA methods through straightforward fine-tuning. We provide some examples of this dataset in Figure the Appendix
5 Method
5.1 A cross-modal pipeline to detect image
VLLMs such as LLaVA and MiniGPT project the vision encoder's embedding of the image into the feature space of LLM. However, a major challenge for image MIA that we do not have the ground-truth image tokens. Only the embeddings of images are available, which prevents directly transferring many target-based MIA from languages images. To this end, we propose a token-level image MIA which calculates metrics based on the output logit of each token position.
This pipeline consists of two stages, as demonstrated in Figure [ In generation stage, we provide the model with an image followed by an instruction to generate a textual sequence. Subsequently, in inference stage, we feed the model with the concatenation of the same image, instruction, and generated description text. During the attack, we correspondingly slice the output logits into image, instruction, and description segments, which we use compute various metrics for MIAs. Our pipeline considers the information from the image, the instructions and the descriptions following the image. In practice, even if there no access to the logits of the image feature and instruction slice, we can still detect the member image solely from the model generation. We visually describe a prompt example with different slice notations presented in Appendix
Our pipeline operates on the principle that VLLMs' responses always follow the instruction prompt (60], where the images usually precede the instructions and then always precede the descrip- tions. For causal language models used in VLLMs that predict the probability of the next token based on the past history (45), the logits at text tokens in the sequence inherently incorporate information from the preceding image.
5.2 MaxRényi MIA
We propose our MaxRényi utilizing the Rényi entropy of the next-token probability distribution on each image or text token. The intuition behind this method is that the model has seen this data before, the model will be more confident in the next token and thus have smaller Rényi entropy.
Given probability distribution p. the Rényi entropy of order a, is defined as (a)
1 I-a log (E(D)))) ,0 a < 00, a # 1. Hp)p) is further defined lim (p) by,
1, 00, H Hp(p)
5

---

H1(p)= = - logps, (p) = log max Pj.
To be more specific, given a token sequence X ;= (01, 22,... Tt). let (-) P(-lar,.... ... ,.)) be the probability of next-token distribution at the i-th token. Let Max-K Max-K%(X. (X) be the top K% from the sequence with the largest Rényi entropies, the MaxRényi -arennyi-K score of X equals
MaxRényi-K((X) Max- K% (X)
Σ
(p))
iE (S(X)
When K = we define the MaxRényi- score to be maX Ha ()) When K = 100, the MaxRényi-K% score is the averaged Rényi entropy of the sequence X.
In our experiments, we vary a 1/2 1, and +oo; K 10, 100. As a increases, the top percentile of distribution will have more influence on (p). When a = 1, (p)p) equals the Shannon
entropy [50], and our method K 100 equivalent to the Entropy 48 When
oc, we consider the most likely next token probability [I]. In contrast, Min-K% 52 only deals with the
target next token probability. When the sequence generated by the target model deterministically:
i.e., when the model always generates the most likely next token, our MaxRényi-K? at oo is equivalent to the Min-K%.
We also extend our MaxRényi -K% to the target-based scenarios, denoted by ModRényi. We first consider linearized Rényi entropy, (p) = --a (p,)))) - -1) < a < oc, a * 1. (p) is also further defined at = 1, as H (p) = lima (p(p) = Hi (p). Assuming the next token ID is y, recall that small entropy value or a large Py value indicates membership, we want our modified entropy to be monotonically decreasing on Py and monotonically increasing on Pj.j # y. Therefore, we propose the modified Rényi entropy on given next token ID denoted by H. v):
H.(), = la aa-1 (1 (1-Pr))p py)p (1- Pp,) + Σ pj(1 p7)1 - Pj jzy
Let a + 1, we have H1 (p, v) lim H (p (p. = - - Pj log(1 pÿ) (1- Pv) log Py- which is equivalent to the Modified Entropy (58). In addition, our more general method does encounter numerical instability in Modified Entropy as + 0, a + For simplicity, we let the ModRényi score be the averaged modified Rényi entropy of the sequence.
Experiments
In this section, we conduct MIAs across three target models using various baselines, MaxRényi-KK,
and ModRényi. Experiment setup provided in Section 6. The results on text MIAs and image
MIAs are present in Section 6.2 and Section 6.3] respectively. In Section 6.4 show that the proposed MIA pipeline can also be used GPT-4. Ablation studies are present in Section 6.5 The
versions and base models of VLLMs use are listed in Table of the appendices.
6.1 Experimental setup
Evaluation metric. We evaluate different MIA methods by their AUC scores. AUC score the area under the receiver operating characteristic (ROC) curve, which measures the overall performance of a classification model in all classification thresholds The higher the AUC score, the more effective the attack is. In addition to the average-case metric AUC, also include the worst-case metric, the True Positive Rate at 5% False Positive Rate (TPR @ 5%FPR) in Appendix suggested by [5].
Baselines. We take existing metric-based MIA methods as baselines and conduct experiments on our benchmark. We use the MIA method from (37, which compares the feature vectors produced by the original image with the augmented image. We use KL-divergence to compare the logit distributions and term it Aug-KL KL in this paper. We also use Loss attack (62), which is perplexity ty in the case of language models. Furthermore, we consider ppl/zlib and hppl/lowercase [4), which compare the target perplexity to zlib compression entropy and the perplexity of lowercase texts respectively. [52) proposes Min-Ki K% method, which calculates the smallest K% probabilities corresponding the

---

ground truth token. Min-K% is currently state-of-the art method to detect pre-training data of LLMs. For both Min-K% and MaxRényi-KA we vary K 0, 10, 100. In addition. we consider K 20 for metric that can represent the extreme confidence in certain tokens by the model. That is, we subtract the second largest probability from the maximum probability in each token position and calculate the mean as metric.
Min-K% as suggested in 152 We further include the max_ _eex___rb_____
6.2 Image MIA
We first conduct MIAs on images using VL-MIA/Flickr and VL-MIA/DALL-E in three VLLMs. For the image slice, it is not possible to perform sarget-based MIAs, because of the absence of ground-truth token IDs for the image. However, our MIA pipeline presented in Figure T can still handle target-based metrics by accessing the instruction slice and description slice.
As demonstrated in Table 2 MaxRényi-K3 surpasses other baselines in most scenarios. An a value of 0.5 yields the best performance in both VL-MIA/Fliccr and VL-MIA/DALL-E. As a increases, performance becomes erratic and generally deteriorates, though it remains superior to all target-based metrics. Overall, target-free metrics outperform target-based metrics for image MIAs. Another interesting observation is that instruction slices result in unstable AUC values, sometimes falling below 0.5 in target-based MIAs. This can be partially explained by the fact the model is more familiar with the member data. As a result, after encountering the first word "Describe", the model is more inclined to generate the description directly than generating the following instruction of X i.c. "this image in detail". This is an interesting phenomenon that we leave to future research.
The performance of the image MIA model is influenced by its training pipelines. Recall that MiniGPT- 4 only updates the parameters of the image projection layer in image training, and LLaMA Adapter v2 applies parameter-efficient fine-tuning approaches. In contrast, LLaVA 1.5 training updates both the parameters of the projection layer and the LLM. The inferior performance of MIAs on MiniGPT-4 and LLaMA Adapter compared to LLaVA 1.5 is therefore consistent with 52 updates make it easier to memorize training data.
that more parameters'
We find that VL-MIA/DALL is a more challenging dataset than VL-MIA/Flickr, reflected in the AUC being closer to 0.5. In VL-MIA/DALL-E, each non-mu memmerrer image is generated based on the description of member image. Therefore, member data have one-to-one correspondence with non-member data and depict a similar topic, which makes it harder to discern.
6.3 Text MIA
Text member data might be used in different stages of VLLM train-
Table Text MIA. AUC results on LLaVA.
ing, including the base LLM model pre-training and the later VLLM instruction-tuning
VLLMM Tumnng 64
Pre-Training
Metrie
32
32
64
128
256
We hypothesize that after the last usage of the mem- ber data in its training, the more the model changes, the better the target- free MIA methods compared to target- based ones, and vice-versa. The heuristic is that if the model's param- eters have changed a lot, target-free MIA methods, which use the whole distribution to compute statistics, are more robust than target-based meth- ods, which rely on the probability at the next token ID. On the other hand, if the member data are seen in recent fine-tuning, the next token will convey more causal relations in the sequence remembered by the model, and thus target-based ones are better.
Perplexity"
0.779
0.988
0.542
0.505
0.553
0.582
Perplexity/dlb"
0.609
0.986
0.56
0.537
0.581
0.603
Perplexity/loerruse"
0.962
0.977
0.493
0.518
0.503
0.583
Min DS Prob"
0.522
0.522
0.455
0.451
0.425
0.448
Min, 10% Proh
0.461
0.883
0.468
0.487
0.526
0.534
Min Prob"
0.603
0.980
0.505
0.498
Max_ Pap
0.461
0.545
0.574
0.544
0.565
0.629
0.5
0.809
0.979
0.557
0.500
0.536
0.567
ModRényi
0.808
0.993
0.544
0.503
0.546
0.567
2
0.779
0.963
0.559
0.497
0.529
0.560
Max_ 0%
0.506
0.514
0.541
0.515
0.489
0.571
Rényi (a = 0.5)
Max. 10%
0.458
0.776
0.518
0.525
0.606
0.65
Max. 100%
0.564
0.835
0.555
0.531
0.631
Max, 0%
0.552
0.579
0.566
0.571
0.603
0.668
Rényi (a
Max_10%
0.566
0.809
0.553
0.541
0.623
0.65
Max 100%
0.554
0.750
0.544
0.523
0.588
0.621
Max. 0%
0.589
0.625
0.594
0 0.606
0.659
0.657
Rényi (or = 2)
Mix. 10%
0.607
0.787
0.583
0.556
0.629
0.663
Max. 100%
0.553
0.709
0.592
0.576
0,568
0.649
Max.
0.600
0.638
0.607
0.615
0.669
Rényi (or = ou)
Max 10%
0.618
0.763
0.586
0.548
0.627
0.667
Max. 100%
0.557
0.694
0.546
0.527
0.584
0.634

---

Table 2: Image MIA. AUC results on VL-MIA under our pipeline, "img" indicates the logits slice corresponding to image embedding, "inst" indicates the instruction slice, "desp" the generated description slice, and "inst+desp" is the concatenation of the instruction slice and description slice. We use an asterisk in superscript to indicate the target-based metric. Bold indicates the best AUC within each column and underline indicates the runner-up.
VL-MLA/Flickr
LLaVA
MiniGPT-4
LLaMA Adapter
Metric
img
inst
deap
inst+desp
img
inst
desp
inst+desp
inst
desp
inst+dosp
Perplexity"
NIA
0.378
0.667
0.559
N/A
0.414
0.649
0.497
0.380
0.661
0.425
Min_U% Prob"
N/A
0.357
N/A
0.272
0.274
0.462
0.463
Min 10% Prob"
NIA
0.357
0.669
0.390
N/A
0.272
0.603
0.265
0.437
0.591
0.438
Min 20% Prob"
N/A
0.374
0.670
N/A
0,293
0.628
0.303
0.424
Aug KL
0.596
0.539
0.492
0,508
0.462
0.458
0.438
0.435
0.428
0.422
0.427
Max_ Max_Prob_cCn
0.577
0.601
0.650
0.650
0.664
0.695
0.609
0.626
0.475
0.671
0.661
0.5
N/A
0.368
0.651
0.614
N/A
0.483
0.636
0.592
0.430
0.662
0.555
ModRényi"
NIA
0.359
0.659
0.502
N/A
0.635
0.417
0.646
0.423
2
N/
0.370
0.645
0.611
N/A
0.492
0.636
0.605
0.434
0.665
0.579
Max_ 0%
0.515
0.689
0.687
0.689
0.437
0.624
0.542
0.626
0.497
0.570
0.499
Rényi (a 0.5)
Max_ 10%
0.557
0.689
0.691
0,719
0.493
0,624
0,592
0.707
0,432
0,573
0.622
Max_ 100%
0.702
0.726
0.713
0.728
0.671
0.795
0.664
0.724
0.633
0.674
0.697
Max. 0%
0.503
0.708
0.685
0.725
0.429
0.645
0.579
0.652
0.517
0.602
0.517
Rényi (a 1)
Max_ 1ax_10% 10%
0.623
0,708
0.698
0.743
0.489
0.645
0.627
0.710
0.456
0.610
0.565
100%
0.702
0.720
0,702
0.721
0.626
0,776
0.662
0.741
0.597
0.678
0.687
Max_ 0%
0.583
0.682
0.673
0,705
0.444
0.697
0.587
0.665
0.580
0.617
0.581
Rényi (o 2)
Max Max_108 10%
0.621
0.682
0.685
0.725
0.482
0.697
0.621
0.734
0.499
0.615
0.584
Max_ 100%
0.682
0.694
0.683
0.703
0.627
0.785
0.656
0.735
0,572
0,670
0.668
0%
0.588
0.646
0,651
0.674
0.462
0,569
0.657
0.604
0.603
Rényi (a oo)
Max_ Max_10S
0.593
0.646
0.669
0.699
0,488
0.693
0.603
0.704
0.506
0.591
0.584
Max_ 100%
0.669
0.673
0.667
0.687
0.632
0.769
0.649
0.725
0.564
0.659
VL-MIA/DALL-E
Metric
LLaVA
MiniGPT-4
LLaMA Adapter
img
inst
deep
inst+desp
img
inst
desp
inst+desp
inst
deep
inst
Perplexity"
N/A
0.338
0.564
0,448
N/A
0.356
0,517
0.421
0.491
0.577
0.506
Min 0S Proh
N/A
0.482
0.559
0.482
N/A
0.422
0.494
0.421
0.448
0.554
0.448
Min_10% Prob'
N/A
0.482
0.563
0.425
N/A
0.422
0.495
0.462
0.447
0.556
0.455
_in_ Prob
N/A
0.434
0.559
0.353
N/A
0.462
0.501
0.401
0.560
0.450
0.456
Aug KI.
0.4n8
0.463
0.505
0.489
0.396
0.421
0.460
0.446
0.474
0.489
0.476
Max, Max_Prob_cce Prop
0.529
0.575
0.597
0.602
0.527
0.407
0.505
0.490
0.518
0.553
0.555
0.5
N/A
0.360
0.560
0.523
N/A
0.399
0.465
0.479
0.546
ModRényi'
a 1
N/A
0,342
0.560
0.425
N/A
0,372
0.516
0.450
0.478
0.576
0.489
N/A
0.384
0.561
0.536
N/A
0.416
0,518
0.477
0.486
0,581
0.559
Max. 0%
0.537
0.597
0.563
0.598
0.518
0.496
0.493
0..99
0.625
0.503
0.624
Rényi (a 0.5)
10%
0.622
0.597
0.563
0.648
0.563
0.504
0.482
0.516
0.573
Max_100%
0.421
0.604
0.575
0.582
0.528
0.448
0,504
0.481
0.511
0,552
0.531
Max_ Max_0%
0.549
0.569
0.551
0.576
0.523
0.477
0.497
0.486
0,598
0.522
0.597
Rényi (a 1)
Max_109 10%
0.667
0.569
0.558
0,586
0.555
0.477
0,512
0.472
0.532
0,530
0.553
Max_ 100%
0.469
0.637
0.564
0.584
0.548
0.428
0.517
0.477
0.519
0.555
0.532
Max 0%
0.591
0.549
0.545
0.558
0.524
0.401
0.489
0.445
0.504
0.529
0.503
Rényi (a 2)
10%
0.707
0,549
0.553
0.575
0,548
0.401
0.503
0.428
0.526
0.534
0.528
Max_1000 100%
0.526
0.606
0,560
0.576
0.548
0.406
0,518
0.476
0.509
0.556
0.530
Max_ 0%
0.623
0.559
0.559
0.567
0.534
0.386
0.494
0.439
0.461
0.554
0,460
Rényi (a
Max_10%:
0.699
0.559
0.563
0.580
0.555
0.386
0.495
0.416
0.510
0.556
0.515
Max_100% 100%
0.545
0.587
0.564
0.577
0.550
0.394
0,517
0.473
0.506
0.577
0.530
MIA on VLLM instruction-tuning texts We detect whether individual description texts appear in the VLLMs instruction-tuninn -tuning. We use the description text dataset VL-MIA/Text of lengths (32, 64), constructed in Section 4 We present our results in the first column of Table We observe that larget-based MIA methods are significantly better than target-free ones, confirming our hypothesis.
MIA on LLM pre-training texts. We use the WikiMIA benchmark [52], which leverages the Wikipedia timestamp to separate the early Wiki data as the member data, and recent Wiki data as the non-member data. The early Wiki data are used in various LLMs pre-training (60). We use WikiMIA of different lengths (32, 64, 128, 256), and expect the membership of longer sequences will be more easily identified. We present our results the second column of Table 3 We observe that on LLaVA, our farget-free MIA methods on large a consistently outperform target-based MIA methods, which
8

---

again confirms our hypothesis since the base LLM model of LLaVA has full parameter fine-tuning from LLaMA-2 and thus changed lot.
6.4 Image MIA on GPT-4
In this section, demonstrate the feasibility of image MIAs on the closed-source model GPT-4. Our experi- ments two image datasets: VL-MIA/Flicck and VL- MIA/DALL-E, detailed in Section 4
Table 4: Image MIA on GPT-4.
VL-MIA/ VL-MIA/
We choose GPT-4- vision-previesn API, which was trained in 2023 and likely does not see the member data in either dataset. We ran- domly select 200 images per dataset and prompt GPT-4 to describe them in 64 words. We then apply MIAs based on the generated descriptions. Since GPT-4 can only provide the top-five probabilities at each token position, we can not directly use the proposed MaxRényi -K% that requires the whole probability distribution. To address this issue, we assume the size of the entire token set is 32000 and the probability of the remaining 31995 tokens are uniformly distributed. The AUC results are present in Table 4 We omit the result of perplexity and Min-K% since they are equivalent to MaxRényi- -X% with a = oo in the greedy- generated setting, discussed in Section Surprisingly, we observe that in VL-MIA/DALL-E, the best-performed method MaxRényi-K% (a = 0.5) achieve AUC of 0.815. This indicates high level of
Metric
DALL-E
Flickr
Perplexity/ziib' Max. Pro
0.807
0.520
0,516
0.486
Max_
0.697
0.571
Rényi (a 0.5) Max 10%
0.749
0.604
Max_ Ma0__00%
0.815
0.605
Max 0%
0.688
0.572
Rényi (a.
Ma%_10%
0.747
0.591
Max Max_100% 100%
0.790
0.630
Max_0%
0.678
0.572
Rényi (a = 2)
Max 1a%_
0.723
0.574
Max_ 100%
0.786
0.595
Max. 0%
0.685
0.561
Rényi (a 00) Max. 10%
0.708
0.549
Max_ 100%
0.781
0.583
effectiveness for MIAs on GPT-4, demonstrating the potential risks of privacy leakage even with closed-source models.
6.5
Ablation study
Does the length of description affect the image MIA performance? We conduct ablation exper- iments on LLaVA 1.5 targeting the length of generated description texts with MaxRényi-10% In the generation stage, we restrict the max_new_ new_tokens parameter of the generate function to (32, 64, 128, 256) to obtain description slices of different lengths. As presented Figure 2a] when the length of the description increases, the AUC of the MIA becomes higher and enters plateau when max_new to__eeess reaches 128. This may be because a shorter text contains insufficient information about the image, and in an excessively long text, words generated later tend to be more generic and not closely related to the image, thereby contributing less to the discriminative information that helps discern the membership.
Can we still detect corrupted member images? The motivation is to detect whether sensitive images are inappropriately used in VLLM's training even when the images at hand may get corrupted. We leverage ImageNet-C (21 to generate corrupted versions of member data in VL--MA/Fllickr: Snow, Bri Brightness. JPEG, and Motion o__urrr with the parameters in Table 8 The corrupted examples and corresponding model output generations are demonstrated in Appendix take MaxRényi-K% (a 0.5) the attacker and the results of LLaVA Corrupted member images make MIAs more difficult, but can still be detected successfully. We also observe that reducing model quality (JPEG) or adding blur (Motion Bn_llurr_B)__lll degrade MIA performance more than changing the base parameter (Biigttnsss) or overlaying texture (Snow).
Table I7 and Table 18 We
presented in Figure 2b
Can we use different instructions? We conduct image MIAs on VL-MIA/Flickr with LLaVA through three different instruction texts: "Describe this image concisely.", "Please introduce this painting.", and "Tell me about this image.". We present our results in Table [4 the appendix. Our pipeline successfully detects member images on every instruction, which indicates robustness across different instruction texts.

---

0.80
Marginal
0.70
0.75
0.68
0.70
AUC
0.66
Perplexity
0.65
Rényl (a 0.5)
0.64
Rényl (e
0.60
Rényl (e
0.55
Rényl (a inf)
0.60
0.50
16
32
54
128
256
Snow
Brightness
JPEG
Motion_Bluu
max new tokens
Corruption
(a) Ablation study on max_new_tokent
(b) MaxRényi-Ke -X% on corrupted images.
Figure Ablation study (a) on max_new_ tokens with MaxRényi- Allowing VLLMs to generate longer descriptions can increase the AUC of "desp" slices, but we encounter a plateau when max_new_token equals 128. (b) on image MIAs against corrupted versions of VL-MIA/Flickr with MaxRényi-K% (a 0.5). Three levels of corruption are applied to the images: Marginal, Moderate, and Severe. The dotted line indicates the AUC on raw images without corruption.
Conclusion
In this work, take initial step towards detecting training data in VLLMs. Specifically, construct comprehensive dataset to perform MIAs on both image and text modalities. Additionally, uncover new pipeline for conducting MIA VLLMs cross-modally and propose novel method based on Rényi entropy. We believe that our work paves the way for advancing MIA techniques and, consequently, enhancing privacy protection in large foundation models.
Acknowledgements
This work was carried out when Zhan and Yihang Chen were interns in the EPFL LIONS group. This work was supported by Hasler Foundation Program: Hasler Responsible AI (project number 21043). This research was sponsored by the Army Research Office and was accomplished under Grant Number W91 191-2F--4-1 1-0048. This work supported by the Swiss National Science Foundation (SNSF) under grant number 200021 1
References
[1] Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint 2XXi:2303308874,, 2023.
[2] Jinze Bai, Shuai Bai, Shusheng Yang, Shijie Wang, Sinan Tan, Peng Wang, Junyang Lin, Chang Zhou, and Jingren Zhou. Qwen-vl: A frontier large vision-language model with versatile abilities. arXiv preprint arXiv:2308. 00..2238...966,, 2023.
[3] Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19), pages 267-284, 2019.
[4] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Vose Kather- ine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pages 2633-2650, 2021.
[5] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEFE Symposium on Security and Privacy (SP), pages 1897-1914. IEEF, 2022.
[6] Soravit Changpinyo, Piyush Sharma, Nan Ding, and Radu Soricut. Conceptual 12m: Pushing web-scale image-text pre-training recognize long-tail visual concepts. Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 3558-3566 2021.
10

---

[7] Dingfan Chen, Ning Yu. Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of member- ship inference attacks against generative models. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, pages 343-362, 2020.
[8] Jun Chen, Deyao Zhu, Xiaoqian Shen, Xiang Li, Zechu Liu, Pengchuan Zhang, Raghuraman Krishnamoorthi, Vikas Chandra, Yunyang Xiong, and Mohamed Elhoseiny. Minigpt-v2: large language model unified interface for vision-language multi-task learning. arXiv preprint 1rXiv:2310.094 2023.
[9] Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng. Siyuan Zhuang. Yonghao Zhuang, Joseph E Gonzalez, et Vicuna: An open-source chatbot impressing gpt-4 with 90%* * chatgpt quality. See https://vicua. Imsys. org (accessed 14 April 2023). 2,,) 2023.
[10] Christopher A Choquette- Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label- only membership inference attacks. In International conference machine learning, pages 1964-1974. PMLR, 2021.
[11] Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways. Journal of Machine Learning Research, 24(240): 1-113, 2023.
[12] Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist handwritten letters. In 2017 international joint conference neural networks (IJCNN), pages 2921-2926 IEEE, 2017.
[13] Wenliang Dai, Junnan Li, Dongxu Li, Anthony Meng Huat Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale N Fung, and Steven Hoi. Instructblip: Towards general-purpon vision-language models with instruction tuning. Advances in Neural Information Processing Systems, 36, 2024.
[14] Debeshee Das, Jie Zhang, and Florian Tramèr. Blind baselines beat membership inference attacks for foundation models. arXiv preprint (KIv::2406.62001 2024.
[15] Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 1916)14 2012.
[16] Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettle- moyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. Do membership inference attacks work on large language models? arXiv preprint arXiv:2402.0777
2024.
[17] Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Practical mem- hership inference attacks against fine-tuned large language models via self- self-prompt calibration. arXiv preprint arXiv:23 1.06062, 2023.
[18] Peng Gao, Jiaming Han, Renrui Zhang, Ziyi Lin, Shijie Geng, Aojun Zhou, Wei Zhang, Pan Lu, Conghui He, Xiangyu Yue, Hongsheng Li, and Yu Qiao. Llama-adapter v2: Parameter-efficient visual instruction model. arXiv preprint arXiv:2304. 15010, 2023.
[19] Shahriar Golchin and Mihai Surdeanu. Time travel in 1lms: Tracing data contamination in large language models. In The Twelfth International Conference on Learning Representations, 2023.
[20] Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. Logan: Membership inference attacks against generative models. arXiv preprint
2017.
[21] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. Proceedings of the International Conference on Learning Representations, 2019.
[22] Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. Monte carlo and reconstruction membership inference attacks against generative models. Proceedings on Privacy Enhancing Technologies, 2019.
[23] Nils Homer, Szaboles Szelinger, Margot Redman, David Duggan, Waibhav Tembe, Jill Muehling, John V Pearson, Dietrich A Stephan, Stanley F Nelson, and David W Craig. Resolv- ing individuals contributing trace amounts of dna to highly complex mixtures using high-density snp genotyping microarrays. PLoS genetics, 4(8) 1000167, 2008.
11

---

[24] Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. Membership inference attacks on machine learning: A survey, ACM Computing Surveys (CSUR), 54(1 14:113) 2022.
[25] Pingyi Hu, Zihan Wang, Ruoxi Sun, Hu Wang, and Minhui Xue. M M Multi-modal models membership inference. Advances in Neural Information Processing Systems, 35:1867-1882.
2022.
[26] Wenho Hu, Yifan Xu, Yi Li, Weiyue Li, Zeyuan Chen, and Zhuowen Tu. Bliva: A simple multimodal Ilm for better handling of text-rich visual questions. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 2256-2264, 2024.
[27] Nikhil Kandpal, Eric Wallace, and Colin Raffel. Deduplicating training data mitigates privacy risks in language models. In International Conference on Machine Learning, pages 10697- 10707. PMLR, 2022.
[28] Ronald Kemker, Mare McClure, Angelina Abitino, Tyler Hayes, and Christopher Kanan. Measuring catastrophic forgetting in neural networks. In Proceedings of the AAAI conference on artificial intelligence, volume 32, 2018.
[29] James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Overcoming catastrophic forgetting in neural networks. Proceedings of the national academy of sciences, 1 114(13):3521-33
et al.
2017.
[30] Myeongseob Ko, Ming Jin, Chenguang Wang, and Ruoxi Jia. Practical membership inference attacks against large- multi-modal models: A pilot study. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4871-488) 2023.
[31] Robert Konig, Renato Renner, and Christian Schaffner. The operational meaning of min-and max-entropy. IEEE Transactions on Information theory, 55(9):4337-4341 2009.
[32] Klas Leino and Matt Fredrikson. Stolen memories: Leveraging model memorization for calibrated [White-Box/ membership inference. In 29th USENIX security symposium (USENIX Security 20). pages 1605-1622, 2020.
[33] Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: 2: Bootstrapping eoguuae-immgge pre-training with frozen image encoders and large language models. In International conference on machine learning, pages 19730-19742. PMLR, 2023.
[34] Tsung-Y. Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[35] Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. Advances in neural information processing systems, 36, 2023.
[36] Haotian Liu, Chumyuan Li, Yuheng Li, Bo Li, Yuanhan Zhang, Sheng Shen, and Yong Jae Lee. Leava-next: Improved reasoning, ocr, and world knowledge, January 2024. URL https
//1lava-vl github. 1 ho/blog/ 2004 00-30-0--00000000000 llxta-next/////
[37] Hongbin Liu, Jinyuan Jia, Wenjie Qu, and Neil Zhenqiang Gong. Encodermi: Membership inference against pre-trained encoders in contrastive learning. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 2081-2095, 2021.
[38] Yunhui Long, Vincent Bindschaedler, Lei Wang, Diyue Bu, Xiaofeng Wang, Haixu Tang, Carl A Gunter, and Kai Chen. Understanding membership inferences on well-generalized learning models. arXiv preprini /0t.:::800..4.40 2018
[39] Gen Luo, Yiyi Zhou, Tianhe Ren, Shengxin Chen, Xiaoshuai Sun, and Rongrong Ji. Cheap and quick: Efficient vision-language instruction tuning for large language models. Advances in Neural Information Processing Systems, 36, 2024.
[40] Saeed Mahloujifar, Huseyin A Inan, Melissa Chase, Esha Ghosh, and Marcello Hasegawa. Membership inference on word embedding and beyond. arXiv preprint arXiv:2106.1138. 2021.
[41] Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schoelkopf, Mrinmaya Sachan, and Taylor Kirk-Kiika..iic.. Membership inference attacks against language models
12

---

via neighbourhood comparison. In Findings of the Association for Computational Linguistics: ACL 2023, pages 11330-11343, 2023.
[42] Fatemehsadat Mireshghallah, Archit Uniyal, Tianhao Wang, David K Evans, and Taylor Berg- Kirkpatrick. An empirical analysis of memorization in fine-tuned autoregressive language models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 1816-1826, 2022.
[43] Vicente Ordonez, Girish Kulkarni, and Tamara Berg. Im2text: Describing images using 1 million captioned photographs. Advances in neural information processing systems, 24, 201 1.
[44] Yonatan Oren, Nicole Meister, Niladri S. Chatterji, Faisal Ladhak, and Tatsunori Hashimoto. Proving test set contamination in black-box language models. In The Twelfth International Conference on Learning Representations, 2024. htttps://openreeeee wwtpeerrview..ee/frruuee net/forum?
Id=KS8mIvetg2
[45] Alec Radford, Karthik Narasimhan, Tim Salimans, llya Sutskever, et al. Improving language understanding by generative pre-training, OpenAl, 2018.
[46] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference machine learning, pages 8748-8763. PMLR, 2021.
[47] Alfréd Rényi. On measures of entropy and information. In Proceedings of the fourth Berkeley symposium on mathematical statistics and probability, volume 1: contributions to the theory of statistics, volume 4, pages 547-562. University of California Press, 1961.
[48]
Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. MI-leaks: Model and data independent membership inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.00 01246. 2018.
[49] Christoph Schuhmann, Richard Vencu, Romain Beaumont, Robert Kaczmarczyk, Clayton Mullis, Aarush Katta, Theo Coombes, Jenia Jitsev, and Aran Komatsuzaki. Laion-400m: Open dataset of clip-filtered 400 million image-text pairs. arXiv preprint arXiv:2111.02114 2021.
[50] Claude Elwood Shannon. A mathematical theory of communication. ACM SIGMOBILE mobile computing and communications review, 5(1):3-55, 2001.
[51] Virat Shejwalkar, Huseyin A Inan, Amir Houmansadr, and Robert Sim. Membership inference attacks against nip classification models. In NeurIPS 2021 Workshop Privacy in Machine Learning, 2021. 2021.
[52] Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. In The Twelfth International Conference on Learning Representations, 2024. URL https
//openreview wawprrrrrieee.eetoouuuiiieeeeeee wet.://orruum/i-222233330
[53] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3-18. IEEE, 2017.
[54] Congzheng Song and Ananth Raghunathan. Information leakage in embedding models. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, pages 377-390, 2020.
[55] Congzheng Song and Vitaly Shmatikov. Auditing data provenance in text-generation models. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 196-206, 2019.
[56] Congzheng Song, Thomas Ristenpart, and Vitaly Shmatikov. Machine learning models that remember much. In Proceedings of the 2017 ACM SIGSAC Conference on compuler and communications security, pages 587-601, 2017.
[57] Liwei Song and Prateck Mittal. Systematic evaluation of privacy risks of machine learning models. In 30th USENIX Security Symposium (USENIX Security 21), pages 2615-26332 2021.
[58] Liwei Song, Reza Shokri, and Prateek Mittal. Membership inference attacks against adversari- ally robust deep learning models. In 2019 IEFE Security and Privacy Workshops (SPW), pages 50-56. IEEE, 2019.
13

---

[59] Gemini Team, Rohan Anil, Sebastian Borgeaud, Yonghui Wu, lean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, et al. Gemini: family of highly capable multimodal models. arXiv preprint arXiv:2312. 1805, 2023.
[60] Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashtykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023.
[61] Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschacdler, and Reza Shokri. Enhanced membership inference attacks against machine learning models. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 3093-3106, 2022.
[62] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pages 268-282. IEEE, 2018.
[63] Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning (still) requires rethinking generalization. Communications of the ACM, 64(3):
107-115, 2021.
[64] Pan Zhang, Xiaoyi Dong Bin Wang, Yuhang Cao, Chao Xu, Linke Ouyang, Zhiyuan Zhao, Shuangrui Ding, Songyang Zhang, Haodong Duan, Hang Yan, et al. internlm-xcompost A vision-language large model for advanced text-image comprehension and composition. arXiv
preprint arXiv:2309. 150..51122 12, 2023.
[65] Renrui Zhang, Jiaming Han, Chris Liu, Peng Gao, Aojun Zhou, Xiangfei Hu, Shilin Yan, Pan Lu, Hongsheng Li, and Yu Qiao. Llama-adapter: Efficient fine-tuning of language models with zero-init attention. arXiv preprint arXiv:2303.16199 2023.
[66] Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: En- hancing vasion-language understanding with advanced large language models. In The Twelfth International Conference on Learning Representations, 2023.
14

---

Contents of the appendix
The Appendix is organized follows:
In Appendix A
provide some supplementary of the main body.
Our additional experiment results are presented in Appendix
A preview of some examples of VL-MIA can be found in Appendix C
We give broader impacts of this work in Appendix
We state the limitation of our work in Appendix
A Supplementaries to the main text
A.1 Detailed notation
We summarize the notations of this work in Table 5
Table 5: Main notations.
Notation
Meaning
The token set of VL.LM
Aimage
Membership inference attacker for image
Ades
Membership inference attacker for text
0
Model parameters
dess 7
Text description and image to detected
Xins
Text instruction, e.g., "Describe this image"
Xlss
Generated text description
Empty instruction
Zen
All-black image
P
Some probability distribution
(0))
The next-token probability distribution at position
P)
The probability corresponding the j-th token in V Rényi entropy of order a
(p)
Ha(p)
Linearized Rényi entropy order
(p.2))
Modified Rényi entropy of order with target
A.2 Explanation and visualization of slices
We give an example the different slices in the MiniGPT-4 prompt in Figure 3
Image slice
Instruction slice
Generated slice
Give the following image: <lmg= ImmggllmageConteee:/llmgg You will be able to see the image once provide it to you. Please enswer my questions, (osoonnsssss(INSSS 
]
 <lmg> Img feature </Img> Describe this image in detail, [ANST] This is an image of woman
Figure 3: Different slices in the prompt.
15

---

There cross entropy (CE) loss here
CE loss
CE loss
CE loss
Distribution next text token
Language model
Embedding vector
Vision encoder
13
322
1352
Text token (retum by tokenizer)
There no image taken
This
image
shows
Input
Figure 4: A schematic of VLLLM.
As shown in Figure the VLLMs consist a vision encoder, a text tokenizer, and language model. The output of the vision encoder (image embedding) have the same embedding dimension d as the text token embedding.
When feeding the VLLMs with an image and the instruction, vision encoder transforms this image to hidden embeddings of dimension d, denoted by Eimage E RdxL11 The text tokenizer first tokenizes the instruction into La tokens, and then looks up the embedding matrix to get its d-dimensional embedding Ena E gdxL2 L2, The image embedding and the instruction embedding are concatenated as Fing-ius ins = (Famages F E Rdd((L which are then fed into a language model to perform next token prediction. The cross-entropy loss (CE loss) is calculated based on the predicted token and the ground truth token on the text tokens.
We can see that in this process, image embeddings are directly obtained from the vision encoder and there are no image tokens. There no causal relations between consecutive image embeddings as well. Threfore, as we stated in Section 1, target-based MIA that requires token ids cannot be directly applied.
A.3 Datasets construction prompts
We present the instruction prompts we use to construct the dataset in Section Table
Table 6: Different prompts we use for dataset construction.
Dataset
Prompt
Model
VI-MIA/DALLE
(original caption in memher data)
dall-c-2
VL-MIA/Text for MiniGPT-4
Provide a caption for this image, beginning with "The image".
gpt-4-vision
VL-MIA/TexI for LLaVA 1.5
(original question in member data)
gpt---vision-preview
16

---

A.4 Additional experimental information
The versions, base models and training datasets of target VLLMs are listed Table 7 We run experiments on single NVIDIA A100 80GB GPU, where the image MIA costs less than 2 hours for one model.
In our experiments on description text MIA, we do not detect the member text during the VLLM image-text pre-training stage (the 3rd row) because the captions used in pre-training are usually fewer than 10 words and do not contain sufficient information. Therefore, we only detect member text during the VLLM instruction tuning stage.
Table 7: Model details used in this work.
Model
Mini-GPTT
LLaVA
LLaMA Adapter v2.1
Base LLM
Llama 2 Chat BLIP2/eva_ siroovvvvvi____eeeeeee vit__ =
Vicuna v1.5 7B CLT--ViT-L BLIP ELIP_AAOON_CE
LLaMA 7B CLIP-ViT-L
Vision processor
Image-text pretraining
BLIP_LAION_C _CCS
Image- Text-Vii
GPT4LLM, LLaVA In- struct 150k, VQAv2
Instruction tuning
CC_SBU_Aigg
LLaVA v1.5 mix665)
A.5
Parameters for image corruption
We utilize the codo from ImageNet-C [21] to corrupt member images. The related analysis can be
found in Section 6.5 Here we provide the corruption parameters in the code Table
Table 8: Values for corruption parameter с in ImageNet-CC code.
Brightness
Motion_Blie
Snow
JPEG
Marginal 0.3
(60,10)
(0.3003.1.250665.4411200
10
Moderate 0.5
(90,20)
(0.400415500.11155...00)
Severe 0.7
(120,30)
(055055200995.11188..)))
2
B Additional experiments
B.1
Text MIA: Complete results
In addition to Section 6.3 present complete Text MIA results on LLaVA, MiniGPT-4, and LLaMA-Adapte in Table and Table We find that no current method can effectively detect LLM pre-training text corpus from MiniGPT-4, even the AUC 256-1ength Wiki text is only 0.6. Apart from that, we note that on the LdaptrAdapter, target-based methods perform similarly or better than target-free ones. In the following, we explain this phenomenon by examining the training pipelines of two different models.
The wiki data is used in the pre-training stage of LLaMA 7b, which is further fine-tuned LLaMA 7b Chat. The base MML of LLAVA is fine-tuned from Vicuna 7b v1.5, which is further fine-tuned from LLaMA 7b Chat. Therefore, the LLM model of LLAVA has changed lot since wiki data's 's last usage, and target-free methods are preferable here. In contrast, AAdpter is parameter-efficientl fine-tuned from LLaMA 7b, and the model's 'ss parameters have not changed much since the wiki's data last usage, and the target-based MIA methods can still retain their performance. addition, to
BLIP2/eva vit g uses MS COCO as one of pre-training datasets. A concatenation of LAION400M, COYO. MMC4, SBU, Conceptual Captions, and COCO. Including LLaVA Instruct 150k and MS COCO.
cifar_c.py
17

---

detect instruction mustruction-tuning texts in VLLMs, the model has just repeatedly seen the member data, and the target-based based ones are significantly superior target-free ones. Overall, the phenomena can be explained by our hypothesis.
Table 9: MIA on VLLM instruction-tuning texts. We present the MIA on VLLM instruction-tuning
texts with description length (32, 64). Complete results of Table
LLaVA
MiniGPT-4
LLaMA Adapter
Metric
32
64
32
64
32
64
Perplexity*
0.779
0.988
0.952
0.993
0.857
0.994
Perplexity/zlib"
0,609
0,986
0.851
0.950
0.743
0.995
Perplexity/lowerasse"
0.962
0.977
0.678
0.801
0.943
0,958
Min_0% Prob
0.522
0.522
0.726
0.771
0.630
0,672
Min 10% Prob'
0,461
0,883
0,802
0.931
0.708
0,932
Min 20% Prab*
0.603
0,980
0.881
0.991
0.782
0.988
Max Prob Gap
0.461
0,545
0.643
0.787
0.459
0,591
0.5
0.809
0.979
0.915
0.986
0,844
0,987
ModRényi*
0.808
0.993
0,952
0.994
0,876
0.996
0.779
0.963
0.892
0.978
0,815
0.976
Max_ Max_0%
0.506
0.514
0.533
0.511
0.517
0,510
Rényi (a = 0.5)
Max_ 10%
0.458
0.776
0.368
0.512
0.505
0.836
Max 100%
0.564
0.835
0.805
0.945
0.570
0,835
Max 0%
0.552
0.579
0.528
0.508
0.590
0.603
Rényí (a- = 1)
Max_
0,566
0.809
0,566
0.781
0.591
0,828
Max 100%
0.554
0.750
0.756
0.911
0.561
0.762
Max_ ___
0.589
0.625
0.648
0.690
0.615
0.635
Rényi (a 2)
Max 10%
0.607
0.787
0.681
0.843
0.610
0.795
Max 100%
0.553
0.709
0.755
0.902
0.554
0,716
Max_ 0%
0.600
0.638
0.679
0.765
0.612
0.616
Rényi (a 00)
Max 10%
0.618
0.763
0.688
0.843
0.615
0,755
Max_ 100%
0.557
0.694
0.747
0.896
0.549
0.695
Table 10: MIA on LLM pre-training texts. We evaluate on WikiMIA of lengths (32, 64, 128, 256).
Complete results of Table 3
LLaVA
MiniGPT-4
LLaMA Adapter
Metric
32
64
128
256
32
64
128
2.56
32
64
128
256
Perplexity"
0.542
0.505
0.553
0.582
0.523
0.484
0.551
0.588
0.614
0.583
0.643
0.666
Perplexity/zlih"
0.56
0.537
0.581
0.603
0.545
0.515
0.575
0.607
0.624
0.606
0.661
0.689
Perplesitylowerrsse"
0.493
0.518
0.503
0.583
0.498
0.506
0.531
0.605
0.574
0.573
0.571
0.594
Min_ Prob"
0.455
0.451
0.425
0.448
0.450
0.427
0.397
0.393
0.535
0.569
0.595
0.513
Min 10% Prob'
0.468
0.487
0.526
0.534
0.470
0.485
0.545
0.593
0.607
0.615
0.672
0.661
Max. Prob_ Gup
0.574
0.544
0.565
0.629
0.498
0.48
0.527
0,572
0.587
0.56
0.604
0.698
0.557
0.500
0.536
0.567
0.557
0.500
0.540
0.578
0.576
0.539
0.600
0.648
ModRénys"
1
0,544
0.503
0.546
0.567
0.531
0.489
0.552
0.587
0.613
0.583
0.642
0.66
0.559
0.497
0.529
0,560
0.565
0.504
0.537
0.569
0.531
0.591
Max 00
0,541
0.515
0.489
0,571
0.49
0.495
0.505
0.502
0,500
0.464
0.497
0.564
Rényi (a. 0.5)
10%
0.518
0.525
0.606
0.501
0.464
0.536
0.586
0.511
0.51
0.625
Max. 100%
0.555
0.531
0.600
0.631
0.511
0.491
0.547
0.603
0.553
0.541
0.626
0.678
Max
0.566
0.571
0.476
0.472
0.499
0.562
0.576
0.615
0.596
Rényi (a 1)
Max. 10%
0,553
0.541
0.623
0.65
0,500
0.474
0.556
0.584
0.549
0.545
0.65
0.685
Max_1OUs
0.544
0.523
0.588
0.621
0.499
0.184
0.538
0.553
0.546
0.622
Max. DS
0.594
0.606
0.659
0.657
0.498
0.485
0.568
0.600
0.590
0.590
0.636
0.627
Rényi (a-
10%
0.583
0.556
0.663
0.495
0.478
0.555
0.592
0.576
0.568
Max. 100%
0.544
0.523
0,583
0.622
0.492
0.480
0.529
0.572
0.555
0.55
0.613
0.685
Max,
0.607
0.615
0.688
0.669
0.514
0.497
0.537
0.591
0.581
0.57
0.638
0.579
Rényi (a oc)
Max. 10%
0,586
0,548
0.627
0.667
0.466
0.462
0.542
0,598
0.574
0.57
0.643
0.694
Max_ 100%
0.546
0.527
0.584
0.634
0.488
0.477
0.527
0.572
0.557
0.551
0.612
0.689
18

---

B.2 Abalation on MaxRênyi and MinRênyi
Given a sequence of entropies calculated on each position, would be natural to ask whether the higher percentile or lower percentile should be used to determine the of the whole sequence for MIA. In the main paper, we use max, which coincides with Min-K% (52) under some special cases. We provide MaxRényi X%, but consider the smallest K% entropies in the sequence X.
evidence of the advantages of
min. We define MinRényi-K%, as similar to
We conduct the pre-training text MIA LLAVA. We also use the WiKiMIA [22] benchmark of differ- ent lengths (32, 64, 128, 256). We set K = O, 10, 20, since when K 100, MaxRényi-K%, coincides with MinRényi-KK, We observe that usually MinRényi-K3 is slightly inferior to MaxRényi -K%, Therefore, we adopt MaxRênyi K% in our main paper.
Table 11: MIA on LLM pre-training texts. We evaluate on WikiMIA of lengths (32, 64, 128, 256) on LLaVA. We compare MaxRényi with MinRényi.
MaxRényl
MinRényi
Metric
32
64
128
256
32
64
128
256
0%
0.541
0.515
0,489
0.571
0.557
0.515
0.488
0.553
Rényi (a 0.5)
10%
0.518
0.525
0.606
0.65
0.569
0.525
0.605
0.647
20%
0,530
0,530
0,616
0.642
0.558
0.530
0.616
0.640
0%
0.566
0.571
0.603
0.668
0.563
0.570
0.603
0.521
Rényi (a:
10%
0.553
0.541
0,623
0.65
0,573
0.541
0.622
0.647
20%
0,548
0.527
0.611
0.630
0.564
0.527
0.611
0.631
0%
0.594
0.606
0.659
0.657
0.563
0.605
0.658
0.521
Rényi (a:
10%
0.583
0.556
0.629
0.663
0.572
0.555
0.628
0.645
20%
0.559
0.527
0.611
0.642
0.565
0.527
0.611
0.631
0%
0.607
0.615
0.688
0.669
0.563
0.687
0.520
Rényi (a o0)
10%
0.586
0.548
0.627
0.667
0.572
0.548
0.626
0.645
20%
0.552
0.527
0.608
0.651
0.565
0.527
0.608
0.531
B.3 Ablation on extended dataset
In this part, extend VL-MIA/Flickr and VL-MIA/Text size 2000, which includes 1000 members and 1000 non-members. From Table [2 and Table 13 we see similar trend with small-size (600 samples) VL-MIA. Considering this computing source, our main experiments conducted on small-size datasets.
B.4 Different instruction texts
We conduct image MIA on VL-MIA/Fllcckr with LLaVA through three different instruction texts: "Describe this image concisely.". "Please introduce this painting.", and "Tell me about this image.". We present our results in Table o4 the appendix. Our pipeline successfully detects member images on every instruction, which indicates robustness across different instruction texts.
C Dataset examples
In Table 16 we give some examples of our proposed VL-MMIA datasets. In Table 17 and Table we show the corrupted images used in the ablation stuidies (Section and the model 's descriptions of these corrupted images. In Figure we present some examples of our VL-MIA/Synthetic dataset.
D TPR 5% FPR
In this section, we provide the True Positive Rate (TPR) at 5% False Positive Rate (FPR) results as supplementary evaluation, presented in Table 15 We can see similar trend in Table
19

---

Table 12: Image MIA on extended VL-MIA/Fllickr. AUC results on VL-MIA/Flicck of size 2000
under our pipeline.
VL-MIA/FIickr
LLaVA
MiniGPT-
LLaMA Adapter
Metric
ing
inst
desp
inst+desp
img
inst
desp
inst+desp
inst
desp
inst+desp
Perplexity"
0.365
0.561
0.578
Min 0% Prob"
N/A
0.353
0.597
0.353
N/A
0.366
0,563
0.366
0.394
0.547
0.394
Min 10% Prob'
0.383
0.339
Min 20% 20% Prob"
NIA
0.335
0.619
0.345
N/A
0.437
0.601
0.453
0.339
0.584
0.316
Aug_
Max, Proh Gap
0.602
0.516
0.639
0.637
0.642
0.648
0.578
0.590
0.562
0.668
0.676
0.5
N/A
0.528
0.681
N/A
0.614
0.336
0.455
ModRányi
N/A
0.379
0.656
0,513
N/A
0.505
0.612
0.510
0.295
0.624
0.311
a
N/A
0.528
0.659
0,680
N/A
0.528
0.612
0.615
0.343
0.651
0.500
Max, M%
0.559
0.647
0.656
0.648
0.493
0.569
0,566
0.571
0.612
0.612
0.611
Rényi (o 0.5)
Max, Max_10S 10%
0.561
0.647
0.659
0.675
0.525
0.569
0.587
0.591
0.599
0.621
0.706
100%
0.711
0.685
0.687
0.695
0.624
0.685
0.617
0.655
0.713
0.677
0.731
Max 0%
0.534
0.641
0.620
0.645
0.482
0.563
0.568
0.578
0.609
0.606
0.608
Rényi
Max_10%
0.572
0.641
0.633
0.658
0.516
0.563
0.611
0.633
0.622
0.685
Max_100% 100%
0.709
0.620
0.679
0.678
0.599
0.673
0.619
0.668
0.699
0.680
0.740
0.563
0.599
Rényi (a 2)
Max. M0S
0.583
0.608
0.617
0.636
0.511
0.601
0.591
0.649
0.670
0.619
0.720
100%
0.690
Max. 0%
0.554
0.579
0.597
0.604
0.488
0.594
0,563
0.608
0.564
0.547
0.564
Rényi (o 0c)
0.568
0.579
0.606
0.619
0.513
0.594
0,586
0.635
0.703
Max 100%
0.676
0.568
0.665
0.660
0.604
0.682
0.616
0.668
0.661
0.645
0.720
Table 13: Text MIA on extended VL-MIA/Text. AUC results on LLaVA with 1000 members and 1000 non-members. We detect the text used in VLLM instruction tuning stage for text length equals to [32,64].
Metric
32
64
Perplexity"
0.784
0.986
Perplexity/zlib'
0.626
0.988
Perplexitylloeerase
0.965
0.983
Min_0% 1%% Prob"
0.525
0.527
Min_10% 10% Prob*
0.463
0.908
Min 20% Prob"
0.598
0.982
Max_Prob__em
0,465
0.562
= 0.5
0,809
0.977
ModRényi*
0.811
0.992
a =
0.780
0.961
Max_ 0%
0,504
0.510
Rényi (a = 0.5)
Max 10%
0.458
0.790
Max_ 100%
0.573
0.847
Max 0%
0.544
0.572
Rényi (a = 1)
Max 10%
0.557
0.804
Max. 100%
0.555
0.762
Max 0%
0.577
0.608
Rényi = 2)
Max_ Max_10% 10%
0.593
0.770
Max. 100%
0.554
0.720
Max. 0%
0.582
0.609
Rényi (a 00)
Max. 10%
0.595
0.742
Max 100%
0.555
0.703
E VLLM pipelines
In this part, we investigate the pipelines of vI..Ms, to explain why we have access the text tokens, but only have access to the image embeddings instead of image tokens.
20

---

Table 14: Image MIA. AUC results on VL-MIA/Flickr with LLaVA 1.5 when we change the instruction text. "Describe" indicates "Describe this image concisely.", "Please" introduce this painting.", and "Tell" indicates "Tell me about this image.".
"Pleeae" indicates "Please
Metric
Describe
Please
Tell
img
deep
inst:desp
img
inst
desp
inst-desp
img
inst
deep
inst-desp
Perplexity" Min 0% Prob"
N/A
0.378
0.667
0,589
N/A
0.379
0.671
0.549
N/A
0.362
0.662
0.530
N/A
0.357
0.651
0.357
N/A
0.421
0.629
0.421
N/A
0.341
0.622
0.341
Min. 10% Prob"
N/A
0.669
0.390
N/A
0.341
Min, 20% Prob"
N/A
0.374
0.670
0.370
N/A
0.411
0.561
0.381
N/A
0.356
0.650
0.360
Aug. KI.
0.596
0.539
0.492
0.508
0.6002
0.497
0.506
0.498
0.599
0,493
0,480
0.482
Max_Probb_Ga
0.577
0.650
0.650
0.577
0.462
0.652
0.649
0.543
0.661
0 0.5
N/A
0.368
0.651
0.614
N/A
0.431
0.661
0.636
N/A
0.359
0.649
0.605
ModRényi"
N/A
0.359
0.659
0.502
N/A
0.396
0.664
0.503
N/A
0.355
0.653
0.474
N/A
0.370
0.645
0,611
N/A
0.444
0.655
0.641
N/A
0.371
0.644
0.610
Max, 0%
0,515
0.689
0.687
0.689
0.315
0.683
0.651
0.683
0,515
0.700
0.663
0.701
Rényi (a 0.5)
Max_10%
0.557
0.689
0.691
0.719
0.557
0.683
0.663
0.666
0.557
0.700
0.672
0.723
Max_ 100%
0.702
0.726
0.713
0.728
0.702
0.609
0.700
0.204
0.702
0.709
0.708
0.736
Max. 0%
0.503
0,708
0.685
0.725
0,503
0.619
0.649
0.643
0.503
0.614
0.649
0.635
Rényi
Max_10%
0.623
0.698
0.743
0.623
0.619
0.614
Max_1000
0.702
0.720
0.702
0.721
0.702
0.613
0.693
0.702
0.702
0.663
0.696
0.714
Max_0%
0,583
0.682
0.673
0.705
0.583
0,584
0.637
0.669
0.585
0.585
0.630
0.619
Rényi (a- 2)
Max, 10%
0.621
0.685
0.725
0.621
0.660
0.585
Max, 100%
0.682
0.094
0.683
0.703
0.682
0.571
0.678
0.681
0.682
0.624
0.676
0.690
Max
0.588
0.646
0.651
0.674
0.588
0.636
0.629
0.666
0.588
0.578
0.622
0.603
Rényi (a oc)
Max, 10%
0.593
0.646
0.669
0.699
0.593
0.636
0.656
0.673
0.593
0.578
0.646
0.657
Max_ 100%
0.569
0.673
0.667
0,687
0.669
0.539
0.671
0.667
0.669
0.608
0.662
0.675
The VLLMs consist of a vision encoder, a text tokenizer, and a language model. The vision encoder and the text tokenizer have the same embedding dimension d. When feeding the VLLMs with an image and the instruction, a vision encoder transforms this image to L1 hidden embeddings of dimension d, denoted by Cimage RR The text tokenizer first tokenizes the instruction into L2 tokens, and then looks up the embedding matrix to get its d-dimensional embedding Cins E RR T.2 The image embedding and the instruction embedding are concatenated as Ging-ins = (Cimage: Cins) E (Lx+ which are then fed into a language model to generate a description that has Ly tokens. The cross-entropy loss (CE loss) is calculated based on the predicted token id and the ground truth token id on the instruction and description tokens.
We can see that in this process, image embeddings are directly obtained from the vision encoder and there are no image tokens. Threfore, as we stated in Section target- based MIAs that require token ids cannot be directly applied.
Furthermore, given the ouput logits of the shape (T,, + I.2 + [1g) x [V/, where the vocabulary set, we can access the logits of the image by the slice [0 I.I. the logits of instruction by the slice [L, L1 + L2], and the logits of description by the slice [L, + L2 L + I.2 + La].
F Broader impacts
In this paper, we present the first multi-modalities MIA benchmark for VLLMs, and propose a novel metric MaxRényi-K% for MIA. We recognize that our research has significant implications for the safety and ethics of VLLMS and may lead to targeted MIA defense by developers. Nevertheless, our findings provide valuable insights into data contamination, which could contribute to the training data split. Additionally, our method empowers individuals to detect their private data within the training dataset, which is essential for ensuring data security. We believe our work can raise awareness about the importance of privacy protection in multi-modal language models.
G Limitation
The first limitation of this work is that the best methods on the pre-training dataset can only achieve an AUC of 0.688. This because the detection of pre-training data will become more challenging as the VILMM are further fine-tuned. We believe increasing the performance for detecting pre-training data would be promising in the future. Secondly, the proposed MaxRényi method requires access to the full probability distribution over the predicted tokens. Although we have demonstrated the
21

---

Table 15: Image MIA. TPR 5% FPR results on VL-MIA under our pipeline. "img" indicates the logits slice corresponding to image embedding, "inst" indicates the instruction slice, "desp" the generated description slice, and "inst+desp" is the concatenation of the instruction slice and description slice. We use an asterisk in superscript to indicate the target-based metric. Bold indicates the best AUC within each column and underline indicates the runner-up.
VL-MIA/Flickr
Metric
LLaVA
MiniGPT-4
LLaMA Adapter
img
inst
deep
instidesp
img
inst
deep
inst+desp
inst
deep
inst+desp
Perplexity"
N/A
0.007
0.130
0.070
N/A
0.000
0.067
0.073
0.017
0.157
0.023
Min_U' Prob"
N/A
0.023
0.093
0.023
N/A
0.010
0.083
0.007
0.033
0.120
0.033
Min_10% 10% Prob"
N/A
0.023
0.083
0.013
N/A
0.010
0.103
0.003
0.020
0.097
0.017
Min_20% Prob
N/A
0.007
0.127
0.003
N/A
0.003
0.113
0.003
0.017
0.1
0.017
Aug KI.
0.027
0.033
0.053
0.043
0.080
0.013
0.017
0.013
0.010
0.010
0.007
Max_ Gap
0.053
0.083
0.160
0.160
0.177
0.113
0.023
0.033
0.037
0.143
127
0.5
N/A
0.003
0.117
0.110
N/A
0.043
0,080
0.110
0.000
0,147
0.040
ModRényi"
a
N/A
0.007
0.117
0.070
N/A
0.003
0.080
0.013
0.013
0.150
0.037
N/A
0.003
0.117
0.117
N/A
0.100
0.080
0.107
0.000
0.157
0.047
Max. 0%
0.047
0.203
0.083
0.200
0.033
0,053
0.133
0.053
0.063
0.053
0.063
Rényi (a 0.5)
Max_108
0.110
0.203
0.063
0.140
0.050
0.053
0,130
0.117
0.040
0.067
0.100
Max_100% 100%
0. 103
0.217
0.163
0.177
0.187
0.180
0.090
0.223
0.087
0.157
0.247
0.053
0.133
0.120
0.167
0.027
0.050
0.073
0.077
0.080
Rónyi (a 1)
Max_ 10%
0.087
0.133
0.070
0,120
0.070
0.050
0.130
0.130
0.043
0.057
0. 0.080
Max_100%
0.090
0.117
0.137
0.160
0.083
0.157
0.173
0.197
0.203
Max. 0%
0.070
0.113
0.093
0,150
0.053
0.167
0,090
0.183
0.097
0,060
0. 0.107
Rényi (a 2)
Max_
0.083
0.113
0.093
0.303
0.050
0.167
0.220
0,103
0.157
Max_100% 100%
0.090
0.093
0.173
0.197
0.120
0.200
0.073
0.177
0.090
0.197
0.140
Max_ 0%
0.097
0.097
0,093
0.170
0. 0.050
0.163
0.083
0.163
0.133
0,120
0.140
Rényi (o oc)
Max_ 10%
0.127
0.097
0.083
0.113
0.050
0.163
0,103
0.110
0.1
0.097
0. 0.117
Max_ 100%
0.087
0.113
0.130
0.167
0.123
0.170
0.067
0.150
0.073
0.157
0.190
VL-MIA/DALL-E
LLaVA
MiniGPT-4
LLaMA Adapter
Metric
img
inst
desp
inst+desp
img
inst
desp
inst+desp
inst
desp
inst+desp
Perplexity"
N/A
0.027
0.057
N/A
0.014
0.034
0.051
Min_ 0% Proh"
N/A
0.081
0.051
0.081
N/A
0.054
0.030
0.051
0.037
0.051
0.037
Min 0% Prob"
NIA
0.081
0,068
0.041
N/A
0,054
0.057
0.020
20% Prob"
N/A
0.064
0.071
0.030
A/N
0.064
0.020
0.054
0.020
0.034
0.017
Ang_KI. KL
0.020
0.081
0,087
0,051
0,014
0.044
0.030
0.037
0.030
0.034
0.027
Max. Prob Prop
0.037
0.108
0.085
0.064
0.051
0.037
0.037
0.030
0.047
0.074
0.071
0.5
N/A
0.020
0.088
0.041
N/A
0,024
0,030
0.027
0.037
0.081
0.064
ModRanyi"
NIA
0.034
0.095
0.057
N/A
0,020
0.027
0.061
0.041
0.074
0.041
o
N/A
0.024
0.088
0.054
N/A
0,037
0.030
0.030
0.034
0.068
0.061
Max_0%
0.081
0.088
0.047
0,085
0.061
0.061
0,020
0.061
0.112
0,051
0.112
Rényi (o- 0.5)
Max_ Max_10%
0.152
0.068
0.064
0.095
0.068
0.00
0.017
0.061
0.162
0.061
0.044
Max_100%
0.003
0.098
0,095
0,081
0.088
0.064
0,017
0.020
0,030
0,047
0.034
Max, 0%
0.091
0.101
0.064
0.044
0.054
0.037
0.027
0.044
0.088
0.054
0.081
Rényi (a 1)
Max_10%
0.220
0.101
0.061
0,064
0.074
0.037
0,014
0.037
0,071
0,041
0.051
Max_ 100%
0.003
0.101
0.081
0.081
0.061
0.078
0.027
0.017
0.027
0.051
0.034
Max_0%
0.118
0.091
0.051
0,054
0.051
0.030
0.030
0.027
0.051
0.054
0.047
Rényi (a 2)
Max_ 10%
0.2
0.091
0.051
0.068
0.071
0.030
0.020
0.017
0.034
0.037
0.057
Max_100%
0.017
0.101
0.101
0.098
0.088
0.054
0.027
0.014
0.030
0.051
0.061
Max_ 0%
0.128
0.112
0.051
0.068
0.068
0.027
0.044
0.014
0.047
0.051
0.047
Rényi (a
Max_ 10%
0.142
0.112
0.068
0.091
0.074
0.027
0.020
0.017
0.034
Max_ 100%
0.024
0.122
0.081
0.098
0.095
0.037
0.034
0.014
0.024
0.064
0.041
feasibility of this approach on GPT-4, where the top-5 probabilities are available, it can be challenging if only the probability of the target token is provided.
22

---

Table 16: Examples in VL-MIA/image non member data are generated by DALL-E or collected from recent Flickr websites; text non -emmber data are generated by GPT-4.
Dataset
Member data
Non-member data
VI-MIA/DALL-E
Modes
VL--MA//FlickT
SELGIUM HOUSE
VL-MIA/TexI for MiniGPT-4
The image shows bedroom with wnoden headhoard and nightstands on either side the bed. The bed made with a white comforter and pillows, and there are two lamps
The image shows bathroom with cream-colored walls. On the left, there is vanity with granite countertop and wooden cabinets below, A soap dispenser is placed on the countertop, and
This image shows blue pickup truck, which appears to he a Volkswagen Beetle, parked in a driveway in front of house. The hood of the truck is open, exposing the
The image depicts a well-used kitchen with various cooking utensils and food items scattered throughout. On the left, there is gas stove with white oven beneath it. Above the stove
VI-MMA/TTett
To enjoy the last two pieces of cake equally and fairly, suggest using knife which, according the image, already present the table, Carefully cut each the
To enjoy the remaining pieces of this delectable cake fairly, would recommend dividing the slices equally among those present, ensuring that each person gets an identical portion, or alternatively, one could
for LLaVA 1.5 and LLaMA Adapter v2
The young boy demonstrating important habit maintaining good oral hygiene by brushing his teeth. In the image, he is standing in front of a mirror holding a toothbrush. which
the image, young boy is engaging in imperative habit of brushing his teeth, which fundamental for maintaining oral hygiene, preventing dental issues like cavities and gum disease, and
23

---

K
ROOD
I
(a)
hb)
(c)
(d)
2
K
6
0 /
0 V 3 3xX7 2
2
4 4 8 6 V 3 S
9
6 7 7 FFG
4 P N
WCSS
4
4 9 2 4
/ 4X
T
p
7 8
66
5
4
20
E
1
9 5
1 3
7
8 9 3
1 w 9
6
p
5
a
K
X
8
2J
I S
0
Q
0 ooon
50T
(e)
()
(
(h)
Figure 5: Examples of new geometry datasets (top), new password datasets (bottom)..
Table 17: Examples in corrupted versions of VL-MIA/Flickr
Severity
Original image
Brightness
Motion Blur
Snow
JPEG
Marginal
Modcrate
Severe
Table 18: Model generated output of corrupted versions of VL-MIA/Flickr. Take severe severity as an example. (Max_nex_tokens tokens = 64)
Corruption
Generated output
None
The image features large, bright orange truck with black front end, parked on a dirt road. The truck has a distinctive appearance, as it equipped with massive tires, giving it monster truck-like look. The truck is positioned in the middle of
Brightness
The image features large, red four-wheel-drive truck with a black front end, parked on a dirt road. The truck is equipped with massive tires, giving it a distinctive appearance. The truck's front end is adorned with Ford logo, further
Motion_Blu Blur
The image features a large, orange four-wheel-drive truck driving down a dirt road. The truck is the main focus of the scene, occupying significant portion of the image. The truck appears to be in motion, possibly on a trail or dirt road.
Snow
The image features large, red pickup truck parked on dirt road. The truck is equipped with massive tires, giving it distinctive appearance. The truck positioned in the middle of the scene, with the front end facing the viewer.
JPEG
The image features a large, bright orange truck with a black front end, parked on a dirt road. The truck is equipped with massive tires, giving it monster- appearance. The truck is positioned in the center of the scene, with the front end facing the vie
24

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The abstract and introduction accurately state our contribution and findings.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how be expected to generalize other settings.
much the results
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations in Appendix
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
25

---

Justification:
There is no assumption or theoretical result in this work.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in the appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We disclose all the information needed to reproduce the main experimental results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
26

---

Answer: [Yes]
Justification:
We have provided open access to the data and
code
in
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips... cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to to reproduce the results. See the NeurIPS code and data submission guidelines (https
ssicnpolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We introduce the setup of our experiment in Section 6.1
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, the appendix, or as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [NA]
Justification: There is no randomness in our experiments because we set the temperature of LLM to O.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the eтror bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
27

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We state computer sssources-relatee information in Appendix A.4
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
We follow the NeurlPS Code of Ethics in every respect.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss these in Appendix F
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
28

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification:
We discuss the safeguards in Appendix
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We cite every reference and CC-BY 4.0 is applicable for our work.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
29

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We will provide the datasets on huggingface upon acceptance with comprehen- sive documentation.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/moodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper does not involve crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
30


Reviews:
[{"review_id": "Z0yISR6aPi", "reviewer": "Reviewer_M6Nm", "summary": "The rise of large vision-language models (VLLMs) has significantly advanced multi-modal tasks but also brought forth concerns about data security and privacy. This paper introduces a novel membership inference attack (MIA) benchmark specifically designed for VLLMs to detect training data, addressing the lack of standardized datasets and methodologies in this domain. The authors propose a new MIA pipeline for token-level image detection and introduce the MaxRényi-K% metric for improved detection. The key contributions include the development of the first VLLM-specific MIA benchmark, a cross-modal MIA pipeline for individual image or description detection, and the new MaxRényi-K% and ModRényi metrics, which show effectiveness in experiments.", "questions": "- How to choose $K$ for the MaxRényi-K% metric?", "limitations": "The size and the diversity of the benchmark is limited.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper introduces the first benchmark specifically tailored for VLLMs in the context of MIAs.\n- The MaxRényi-K% and ModRényi metrics demonstrate significant effectiveness in detecting training data.", "weaknesses": "- **Small Evaluation Dataset**: The MIA evaluation dataset consists of around 600 images for each evaluation, which is relatively small. This limited dataset size can lead to less statistically robust results and may not fully capture the variability and challenges present in real-world scenarios. It would strengthen the paper to include evaluations on larger and more diverse datasets.\n\n- **Lack of Standard Metrics**: The paper does not consider the _TPR at low FPR_ (True Positive Rate at low False Positive Rate) metric, which is a standard for evaluating worst-case membership privacy. Including this metric would provide a more comprehensive assessment of the model's privacy risks, especially in high-stakes applications where false positives must be minimized.\n\n- **Generalizability**: While the proposed metrics and methods show effectiveness, it's important to discuss their generalizability to other types of vision-language models and datasets. Providing insights or experiments on different architectures or domains could enhance the applicability of the findings.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer M6Nm for the insightful feedback. We address the concerns below.\n\n---\n\n> **Q1:** Small Evaluation Dataset.\n\n\n**A1:**  We extend both VL-MIA/Flickr and VL-MIA/Text to 2000 samples. The results in the extended datasets can be found in [Table 2 and Table 3 of the PDF](https://openreview.net/forum?id=nv2Qt5cj1a&noteId=4ygbDFCzeE), where we can observe the same trend as our original results. We also introduce two new datasets as shown in A3 below. We will release these complete datasets in the final version.\n\n> **Q2:** Does not consider the TPR at low FPR.\n\n**A2:**  Please see TPR at 5% FPR result in [Table 1 of the PDF](https://openreview.net/forum?id=nv2Qt5cj1a&noteId=4ygbDFCzeE). We will add the results in our final version. These results are aligned with AUC results in Table 1 of the paper, and $\\alpha=0.5$ is the optimal choice for image MIA. \n\n> **Q3:** Generalizability to other types of vision-language models and datasets.\n\n**A3:** We thank the reviewer for pointing out this interesting question. To make our benchmark more comprehensive, we synthesize two new MIA datasets, see [general response](https://openreview.net/forum?id=nv2Qt5cj1a&noteId=4ygbDFCzeE) for details.\n\n---\n\n> **Q4:** How to choose $K$ for the MaxRényi-K% metric?\n\n**A4:** In short, $K$ controls the aggregation from a sequence of entropy scores to the final score for this sequence. \n\nThe parameter $K$ determines the percentage of tokens in a sequence with the highest entropy scores that are selected to compute the final score. In the experiment section of the paper, we find that different sequences have different representative parts, and therefore different $K$ may be applied. \n\nIn all, the optimal $K$ is largely determined by different data modalities and distributions. We propose this family of criteria to accommodate different possible data distributions. Therefore, similar to prior work [1], we suggest using a validation set and performing a small sweep over different $K$ and $\\alpha$ to select the optimal parameters.\n\n---\nIf the reviewer M6Nm has any remaining concerns, we are happy to clarify further.\n\n---\n\n**Refs**\n\n[1] \"Detecting Pretraining Data from Large Language Models.\" ICLR 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UrSunYG4CR", "reviewer": "Reviewer_FZ3m", "summary": "The paper introduced a benchmark for membership inference attack on VLMs, proposed a pipeline for token-level image detection, and proposed a target-free metric for image MIA detections. The pipeline relies on the fixed sequence of the VLM output to obtain the output image, instruction, and description segments of logits and use them for evaluation metrics.", "questions": "1. For the cross-modal pipeline for detecting images, how do you determine which logits are for image, instructions, or description text, during the attack phase?\n2. The proposed metrics can have different K and $\\alpha$ values. Are there any ablation studies on when should what K and $\\alpha$ values being used?", "limitations": "The authors clarified the limitations in the paper.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. Novelty: There is no existing MIA benchmark datasets for VLM. The authors also proposed a new metrics for detecting MIA in single modality, especially in images. \n2. The paper conducts extensive experiments with their proposed methods.", "weaknesses": "1. The explanation of some concepts are not clear. For example, when proposing target-free MIA metrics, the author mentioned that it's because we only have access to the image embeddings but not image tokens. How are these two terms defined here? Why do we not have access to the image tokens? Additionally, image tokens are defined again in line 95. If this is not available, why does the paper need to define the concept again? I think the authors should clarify these assumptions properly in the main text.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer FZ3m for the insightful feedback. We address the concerns below.\n\n---\n\n> **Q1:** Clarification on image embeddings but not image tokens. Why do we not have access to the image tokens?\n\n**A1:** As in the illustrative [Figure 1 of the PDF](https://openreview.net/forum?id=nv2Qt5cj1a&noteId=4ygbDFCzeE), the VLLMs consist of a vision encoder, a text tokenizer, and a language model. The output of the vision encoder (image embedding) has the same embedding dimension $d$ as the text token embedding.\n\nWhen feeding the VLLMs with an image and the instruction, a vision encoder transforms this image to $L_1$ hidden embeddings of dimension $d$, denoted by $E_{\\rm image} \\in \\mathbb{R}^{d \\times L_1}$. The text tokenizer first tokenizes the instruction into $L_2$ tokens and then looks up the embedding matrix to get its $d$-dimensional  embedding $E_{\\rm ins} \\in \\mathbb{R}^{d \\times L_2}$. The image embedding and the instruction embedding are concatenated as  $E_{\\rm img-ins} = (E_{\\rm image}, E_{\\rm ins}) \\in \\mathbb{R}^{d \\times (L_1+L_2)}$, which are then fed into a language model to perform next token prediction. The cross-entropy loss (CE loss) is calculated based on the predicted token id and the ground truth token id on the text tokens. \n\nWe can see that in this process, image embeddings are directly obtained from the vision encoder and there are no image tokens. There are no causal relations between consecutive image embeddings as well. Therefore, as we stated in Section 1, target-based MIA that requires token ids cannot be directly applied. \n\nIn the final version, we will add the detailed description as well as the illustrative figure in the appendix. \n\n---\n\n> **Q2:** For detecting images, how do you determine which logits are for image, instructions, or description text, during the attack phase?\n\n**A2:** Similarly to the figure in Q1, there is a one-to-one correspondence between the logit and input. For example, given image embedding with token length $L_1$,  instructions with length $L_2$, and description text with length $L_3$, the language model will output logits of the shape $(L_1+L_2+L_3)\\times |\\mathcal{V}|$, where $\\mathcal{V}$ is the vocabulary set, we can access the logits of the image by the slice $[0:L_1]$, the logits of instruction by the slice $[L_1:L_1+L_2]$, and the logits of description by the slice $[L_1+L_2: L_1+L_2+L_3]$. \n\n\n---\n\n\n> **Q3:** How to choose $K$ and $\\alpha$ for the MaxRényi-K% metric?\n\n**A3:** In short, $\\alpha$ controls the aggregation from the next-token distribution at some token to a single entropy score, and $K$ controls the aggregation from a sequence of entropy scores to the final score for this sequence. \n\n- The parameter $\\alpha$ controls how the entropy will represent the next token probability distribution at the current token. For example, $\\alpha=0$ treats all non-zero next-token probabilities equally and $\\alpha=\\infty$ only involves the largest next-token probability. \nIn paper main body Table 2 we find that $\\alpha = 0.5$ is the best choice in image MIA, while in paper main body Table 3, $\\alpha = \\infty$ is the best choice in text MIA.\n\n- The parameter $K$ determines the percentage of tokens in a sequence with the highest entropy scores that are selected to compute the final score. In the experiment section of the paper, we find that different sequences have different representative parts, and therefore different $K$ may be applied. \n\nIn all, the optimal $K$ and $\\alpha$ are largely determined by different data modalities and distributions. We propose this family of criteria to accommodate different possible data distributions. Therefore, similar to prior work [1], we suggest using a validation set and performing a small sweep over different $K$ and $\\alpha$ to select the optimal parameters.\n\n---\n\nIf the reviewer FZ3m has any remaining concerns, we are happy to clarify further.\n\n---\n\n**Refs**\n\n[1] \"Detecting Pretraining Data from Large Language Models.\" ICLR 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "91ce6mEtuG", "reviewer": "Reviewer_e87W", "summary": "This paper presents an interesting idea of detecting training data in large vision-language models (VLLMs) through membership inference attacks (MIAs). The authors introduce the following interesting points :\n\n- An MIA benchmark, specifically designed for VLLMs, called Vision Language MIA (VL-MIA). This benchmark includes tasks for both image and text detection across various VLLM architectures.\n- A pipeline for MIAs on VLLMs. This approach does not require both side information as in the prior work. This includes a new detection metric called MaxRényi-K%.\n- Extensive evaluation results. The authors demonstrate the effectiveness of their approach to diverse VLLMs.", "questions": "Regarding dataset generation:\nIf the member data is drawn from LAION_CCS, and non-member data is drawn from the generated dataset, is there any underlying bias caused by the nature of differences between natural and synthetic data (in VL-MIA/DALL-E)? Moreover, why did we choose instruction text for members and generated text for non-members in VT-MIA/Text?\n\nRegarding the evaluation:\nBased on Table 2, it seems that different datasets show different behaviors. For example, for VL-MIA/Flickr, Max_100% shows the best performance in most cases, and the performance gap is quite large. On the other hand, we cannot see a similar observation from VL-MIA/DALL-E. I wonder whether the authors have some insight into why it shows a clear difference between datasets. \nMoreover,  it seems that we need to vary a lot of parameters to find better performance (e.g., different alpha, and different K). How did the authors choose the hyperparameters from other baselines? Since the authors present a new benchmark, it might not be a good choice to use optimal hyperparameters from other sources.", "limitations": "The authors discuss the limitations and broader impacts in the appendix.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper is well-written and proposes an interesting approach that can be applicable to one side of information for MIA for VLLMs, which might not be well-studied in prior works.\nThe authors also provide a benchmark for evaluating MIA on VLLMs and present extensive results based on the proposed benchmark.", "weaknesses": "This paper requires further clarification regarding the proposed methods and evaluation results. Please see the following questions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer e87W for the insightful feedback. We address the concerns below.\n\n---\n\n> **Q1:** Is there any underlying bias caused by the nature of differences between natural and synthetic data (in VL-MIA/DALL-E)?\n\n**A1:** This is an interesting question and thanks for pointing it out. It is hard to make the member data and non-member data be in the same distribution. We considered different possible bias when constructing our datasets. \n\n- One bias is that the member data and non-member data might contain different identities so that the separation would be trivial. We call it the identity bias. To resolve the identity bias, we use DALL-E to generate non-member images based on the description of the member images to ensure the member image and non-member image in the same pair contain the same identity, such as a basketball. \n\n- Admittedly, as you pointed out, there might be other unresolved bias, such that the fact that member data are real (not AI generated) images and non-member data are fake (AI generated) images. We call it the reality bias. To resolve the reality bias, we provide \"VL-MIA: Flickr\", which divide member and non-member images based on release time, following the prior work [1] which uses latest wiki text as non-members. \n\nDespite our effort aforementioned to reduce the bias, we additionally produced two new datasets designed to eliminate bias using i.i.d samples from the same distribution.  We synthesize two new MIA datasets: **the Geometry dataset** and **the Password dataset**. The image in the Geometry dataset consists of a random 4x4 arrangement of geometrical shapes, and the image in the Password dataset consists of a random 6x6 arrangement of characters and digits from (E)MINST. The associated text is its corresponding content (e.g., characters, colors, shapes). We select half of the datasets, that can be considered as the member set, to finetune VLLM while the remaining part is the non-member set. This approach ensures that members and non-members are **i.i.d sampled** thus eliminating potential bias, and can be used in **any VLLM** with diversity and generalization just by simple finetuning. We provide some examples of this dataset in [Figure 2 of the PDF](https://openreview.net/forum?id=nv2Qt5cj1a&noteId=4ygbDFCzeE).\n\nWe conduct the image MIA by finetuning LLaMA Adapter v2.1 following the finetune instruction provided by the authors. The results are presented in [Table 4 of the PDF](https://openreview.net/forum?id=nv2Qt5cj1a&noteId=4ygbDFCzeE). We observe that our Modfied Rényi and Max Rényi still outperform other previous baselines.\n\n\n---\n\n> **Q2:** [why did we choose instruction text for members and generated text for non-members in VT-MIA/Text?]\n\n**A2:** Sorry for the confusion, we'll clarify in the final release. Recall that in the instruction tuning stage of a vllm, every data entry contains an image, a question, and the corresponding answer to the image. We use the answer text as member data and GPT-4 generated answers under the same question and same image as non-member data. Specifically, for LLaVA v1.5 and LLaMA_adapter v2, we use the answers in LLaVA v1.5's instruction tuning as member data. (The word \"instruction\" in paper main body Table 1 is a typo and will be corrected as \"instruction-tuning text\".) For MiniGPT-4, we use answers in MiniGPT-4's instruction tuning as member data.  We will revise the confusing content in Table 1 in the final release.\n\n---\n\n> **Q3:** Insight on the parameters $\\alpha$ and $K$. How to select these parameters?\n\n**A3:** In short, $\\alpha$ controls the aggregation from the next-token distribution at some token to a single entropy score, and $K$ controls the aggregation from a sequence of entropy scores to the final score for this sequence. \n\n- The parameter $\\alpha$ controls how the entropy will represent the next token probability distribution at the current token. For example, $\\alpha=0$ treats all non-zero next-token probabilities equally and $\\alpha=\\infty$ only involves the largest next-token probability. \nIn paper main body Table 2 we find that $\\alpha = 0.5$ is the best choice in image MIA, while in paper main body Table 3, $\\alpha = \\infty$ is the best choice in text MIA.\n\n- The parameter $K$ determines the percentage of tokens in a sequence with the highest entropy scores that are selected to compute the final score. In the experiment section of the paper, we find that different sequences have different representative parts, and therefore different $K$ may be applied. \n\nIn all, the optimal $K$ and $\\alpha$ are largely determined by different data modalities and distributions. We propose this family of criteria to accommodate different possible data distributions. Therefore, similar to prior work [1], we suggest using a validation set and performing a small sweep over different $K$ and $\\alpha$ to select the optimal parameters.\n\n---\n\nIf the reviewer e87W has any remaining concerns, we are happy to clarify further. \n\n---\n\n**Refs**\n\n[1] \"Detecting Pretraining Data from Large Language Models.\" ICLR 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GM61Ih7cAG", "reviewer": "Reviewer_rMMx", "summary": "This paper focuses on the membership inference attack (MIA) of large vision language models. It creates multiple MIA datasets and proposes a new method to identify whether an image or a text belongs to the training dataset.", "questions": "1. As illustrated in the weakness section, could you please explain the setting of MIA in the description sentence?\n2. How to set the threshold value \\lambda in the MIA process?", "limitations": "The paper has analyzed its limitations in the Appendix, which I believe is reasonable.", "rating": 5, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The authors have proposed an intriguing research problem, which focuses on the membership attack of large vision language models.\n2. The paper proposes a creative method to verify if the input is a member of the training set. It also creates a new benchmark for evaluation.\n3. The overall writing is clear and easy to follow.", "weaknesses": "The setting for detecting a description sentence is a little confusing for me. Why do you feed the model with a black image rather than others, like those generated by DALL-E? Also, why do you skip the instructions here?  It is less possible to produce the target description for the target VLM just based on a black image and an empty instruction. Why don't skip the input image?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer rMMx for the insightful feedback. We address the concerns below.\n\n---\n\n> **Q1:** [The setting for detecting a description sentence is a little confusing for me. Why do you feed the model with a black image rather than others, like those generated by DALL-E? Also, why do you skip the instructions here? It is less possible to produce the target description for the target VLM just based on a black image and an empty instruction. Why don't skip the input image? Could you please explain the setting of MIA in the description sentence?]\n\n**A1:** Note that our MIA framework is for detecting text or images solely instead of image-description pairs. This setting is more practical. For example, we want to know whether private photo or address is used for commercial training. Naturally, when detecting the text, we assume that the attacker does not have any information about image. Therefore, we can not use images generated from DALL-E. \n\nIn line 109, we assume a grey-box setting on the target model, where the attacker can query the model by a custom prompt (including an image and text) and have access to the tokenizer, the output logits, and the generated text. Therefore, we are not allowed to extract the underlying language model from a VLLM. Additionally, if we provide None or empty to VLLM such as llama_adapter v2 in image place, then an error will be raised. Also, we note that in the open source code of llama adapter, when using the text-only data for finetuning, the model is supplied with an all-zero image. For the consistence of our experimental setting that we provide image and text modals as inputs, we choose to provide an all-zero image  (black) to all models. \n\nThe reason we adopt an empty instruction is that, provided an all-zero (black) image, common instructions, such as \"Describe this image in detail\", the VLLMs have the tendency to output response that \"This image is black\". This will introduce additional bias to our task: the description text MIAs. Therefore, we use the empty instruction. \n\n\n---\n\n\n> **Q2:** [How to set the threshold value \\lambda in the MIA process?]\n\n**A2:** For the evaluation, we use the AUC score and TPR@low FPR score as the metric. The report of these scores as performance measures is standard in prior MIA works, such as [1]. Note that these two scores are threshold-independent. It's the area under ROC curve, which plots the true positive rate against the false positive rate for different threshold settings. So we don't need to select a specific $\\lambda$ when we want to compare different MIA methods (classifiers). Note that if the task is to perform MIA via a specific method instead of evaluating different MIA methods, we can perform a hyperparameter search over a small validation set to select $\\lambda$. We will add this explanation of the metric in the revised version.\n\n\n---\n\nIf the reviewer rMMx has any remaining concerns, we are happy to clarify further. \n\n---\n\n\n**Refs**\n\n[1] Shi, Weijia, et al. \"Detecting Pretraining Data from Large Language Models.\" ICLR 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Dear reviewers,

We appreciate your insightful comments. The attached PDF contains the necessary figures and tables corresponding to each individual response below.

During the rebuttal period, we expand our benchmark by incorporating new diverse datasets, as motivated by reviewers **e87W** and **M6Nm**. Specifically, in order to make our benchmark more comprehensive, we synthesize two new MIA datasets: **the Geometry dataset** and **the Password dataset**. The image in the Geometry dataset consists of a random 4x4 arrangement of geometrical shapes, and the image in the Password dataset consists of a random 6x6 arrangement of characters and digits from EMINST [1] and MNIST. The associated text is its corresponding content (e.g., characters, colors, shapes). We select half of the datasets, that can be considered as the member set, to finetune VLLM while the remaining part is the non-member set. This approach ensures that members and non-members are **i.i.d sampled** thus eliminating potential bias, and can be used in **any VLLM** with diversity and generalization just by simple finetuning. We provide some examples of this dataset in Figure 2 of the PDF.

We conduct the image MIA by finetuning LLaMA Adapter v2.1 following the finetune instruction provided by the authors. The results are presented in Table 4 of the PDF. We observe that our Modfied Rényi and Max Rényi still outperform other previous baselines.

--- 
Refs

[1] "EMNIST: Extending MNIST to handwritten letters." IJCNN, 2017.

Meta-review: The paper introduces the first benchmark specifically for MLA on LVLMs and proposes novel metrics and methods for detecting training data usage. Reviewers found the research problem significant and the approach innovative, appreciating the extensive experiments and novel benchmarks. However, concerns were raised about dataset size, the clarity of some methodological choices, and the practical applicability of the results. The authors' rebuttal provided additional datasets, expanded evaluations, and further clarifications, addressing most concerns satisfactorily. The recommendation is to accept.
Decision: Accept (poster)