Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probing
Authors: Jinhua Yin
Peiru Yang
Chen Yang
Huili Wang
Zhiyang Hu
Shangguang Wang
Yongfeng Huang
Tao Qi
Venue: NeurIPS 2025 poster ()
Keywords: Multi-modal Model
Membership Inference Attack
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Large vision-language models (LVLMs) derive their capabilities from extensive training on vast corpora of visual and textual data. 
Empowered by large-scale parameters, these models often exhibit strong memorization of their training data, rendering them susceptible to membership inference attacks (MIAs).
Existing MIA methods for LVLMs typically operate under white- or gray-box assumptions, by extracting likelihood-based features for the suspected data samples based on the target LVLMs. 
However, mainstream LVLMs generally only expose generated outputs while concealing internal computational features during inference, limiting the applicability of these methods.
In this work, we propose the first black-box MIA framework for LVLMs, based on a prior knowledge-calibrated memory probing mechanism. 
The core idea is to assess the model memorization of the private semantic information embedded within the suspected image data, which is unlikely to be inferred from general world knowledge alone.
We conducted extensive experiments across four LVLMs and three datasets.
Empirical results demonstrate that our method effectively identifies training data of LVLMs in a purely black-box setting and even achieves performance comparable to gray-box and white-box methods.
Further analysis reveals the robustness of our method against potential adversarial manipulations, and the effectiveness of the methodology designs.
Our code and data are available at \url{https://github.com/spmede/KCMP}.

Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probing
Jinhua Yin': Peiru Yang', Chen Yang', Huili Wang', Zhiyang Hu', Shangguang Wang', Yongfeng Huang', Tao Qi
DDpaarmeent of Electronic Engineering, Tsinghua University School of Computer Science, Beijing University of Posts and Telccommunications 'College of Computer Science and Technology. Xinjiang University taoqi. qrogmail com com
Abstract
Large vision-language models (LVLMs) derive their capabilities from extensive training vast corpora of visual and textual data. Empowered by large-scale parameters, these models often exhibit strong memorization their training data, rendering them susceptible to membership inference attacks (MIAs). Existing MIA methods for LVLMS typically operate under white- or gray-box assumptions, by extracting likelihood-based features for the suspected data samples based the target LVL.M. However, mainstream LVL.Ms generally only expose generated outputs while concealing internal computational features during inference, limiting the applicability of these methods. In this work, we propose the first black-box MIA framework for LVLMs, based a prior knowledge-calibratee mechanism. The core idea is to assess the model memorization of the private semantic information embedded within the suspected image data, which is unlikely to be inferred from general world knowledge alone. We conducted extensive experiments across four LVLMs and three datasets. Empirical results demonstrate that our method effectively identifies training data of LVL.Ms in purely black-box setting and even achieves performance comparable methods. Further analysis reveals the robustness of our method against potential adversarial manipulations, and the effecctivnness of the methodology designs. Our code and data available ht / gighub........ com/ http//spmeee/KCMM
memory probing
gray-box and white-box
Introduction
The rapid advancement of large lingunelanguage models (LVLMs) [13] has profoundly reshaped multimodal understanding, enabling significant breakthroughs in a wide array of real-world appli- cations 4 These models are typically trained on vast corpora of multimodal data comprising both textual and visual components 8 99. However, the large-scale and often indiscriminate data collection practices involved in developing LVLMS may inadvertently include sensitive information, such as personally identifiable data or proprietary visual content, thereby raising serious concerns about data right infringement [10|33] Membership inference attacks (MIAs) [14 have emerged as well-established technique in machine learning research. MIAs are designed to determine whether specific data sample was a member of the training dataset of a target machine learning model. Therefore, extending MIA methodologies to LVLMs represents promising direction for safcguarding user rights by detecting potential unauthorized use of visual data during model training.
"Equal contribution.
'Corresponding author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

In the context of language models, the majority of MIA methodologies have primarily focused on identifying textual training data. For instance, Shi al. [8] proposed a likelihood-badd based MIA approach, Min-K&, which aggregates the lowest K% of input token likelihoods as detection scores, inferring samples with high scores as members of the training set. Building upon such efforts, a limited number of studies have explored membership inference for visual data in LVLMs. For example, Li et al. [9] introduced a multimodal MIA benchmark specifically designed for LVLMs and adapted the Min-K% method to the visual domain. They prompted the target LVLM with suspected visual inputs and a fixed generation instruction (e.g., "Describe this image"), followed by the computation of Min-K scores based on the calibrated likelihoods of the generated outputs. Overall, existing MIA techniques for LVLMs usually rely on likelihood- based features extracted from the model inference process (20 22 However, many real-world AI systems adopt
aatprrattiinnaaa-seeveee paradigm, wherein internal computational details, such as input and output logits, are inaccessible to
end users [ This black-box setting, which is prevalent in practical LVLM deployments, presents significant challenges to the effectiveness and applicability of current MIA methods [24 25
Designing effective black-box MIA methods for LVLMs remains particularly challenging due to the entanglement of memorization and generalization. Specifically, the core of most MIA techniques lies in detecting overfitting behaviors indicative of memorization of the training data. The immense parameter space of LVLMs can significantly amplify their capacity to memorize such data [26]. Simultaneously, LVLMs are trained on vast amounts of visual information and usually demonstrate strong generalization capabilities to non con-training inputs, effectively encoding broad prior world knowledge [27 28). Therefore, distinguishing whether the response of an LVLM to a suspected visual input stems from memorized training data or generalized knowledge is nontrivial (29]. This ambiguity is further exacerbated in black-box settings, where only limited and indirect information is accessible through the model-generated texts. The low informativeness of these outputs severely hinder the reliability of observable MIA signals, compounding the inherent difficulty of the task.
To address this challenge, we propose a knowledge-calibratee memory probing (KCMP) framework for black-box membership inference attacks on LVLMs. KCMP enables the inference of the member- ship status of suspected visual data samples based solely on the textual outputs of the LVLM. The core idea is to construct confounding visual inference tasks that compel the model to rely memorized training data for accurate prediction, while rendering the tasks infeasible to solve using general prior knowledge alone. Specifically, we introduce semantic mask prediction task construction strategy, which selectively masks semantically meaningful content, related to object shape and color, within the visual input. To introduce confounding semantics, generate deceptive counterparts for the masked shape and color information based on the surrounding visual context, thereby constructing ambigu- ous semantic mask prediction tasks. To distinguish outputs attributable to prior knowledge rather than memorization, we further propose a prior knowledge calibration mechanism. This mechanism transforms the visual mask prediction tasks into a purely textual modality using proxy language model. which performs deep reasoning based on its general knowledge. Tasks that can be solved by the proxy model are assumed to be answerable without reliance on visual memory and are therefore excluded from detection. Finally, we prompt the target LVLM to complete the remaining calibrated semantic mask prediction tasks, and visual inputs that yield high prediction scores by the LVLM are identified as training samples. To advance research on MIA for LVLMs, we construct benchmark dataset based on the DAM model 30), comprising both positive and negative samples drawn from identical distributions. We further conduct extensive experiments on four representative LVLMs across three benchmark datasets. The results demonstrate that our proposed method can effectively identify training data in strict black-box LVLM settings, and achieves performance comparable to recent gray-box baselines. The contributions of this paper are three-fold:
To the best of our knowledge, we are the first to study the black-box MIA methods for visual language models, which can identify visual training data by only analyzing generated texts.
We propose a prior knowledge- calpb-aaaeebe memory probing framework, which address the detection noise arising from the entanglement of model memorization and generalization.
We construct a new benchmark based on a publicly released LVLM (DAM) (30], ensuring IID distribution between member and non-member data for controlled MIA evaluation.
Extensive experiments across four LVLMS and three benchmark datasets demonstrate the effectiveness of the proposed KCMP framework under practical black-box settings.
2

---

2 Related Work
2.1 Membership Inference Attack for Image Classification Models
The exploration of MIAs began prominently with traditional image classification models. Shokri et al. 14 introduced shadow model techniques and attack models that exploit output confidence scores to differentiate training samples from unseen data, establishing the foundational observation that models with high generalization gaps are particularly susceptible to privacy leakage. Subsequent studies expand the threat landscape by investigating attacks under varying access assumptions: white-box attacks leverage internal model signals, such as gradients and feature activations [31, gray-box attacks assume access to confidence scores other summary statistics like prediction loss [32), and black-box attacks rely solely on the predicted labels returned by the model [22]. However, the methodological design of these traditional MIA methods is specifically tailored to classification--uas models, and thus cannot be effectively generalized to large-scale generative visual models.
2.2 Membership Inference Attack for Large Language Models
MIAs on LLMs have recently garnered increasing attention due to their widespread deployment and growing concerns over potential training data leakage. Such attacks aim to determine whether a specific text sample was included the training corpus a target LLM. Most existing methods rely on model-derived features computed from the input sample for inference. Yeom et al. 332 first proposed model likelihood as a feature, which later became widely adopted under the assumption that higher likelihood values for a given input indicate that the sample was used during training. Building upon this idea, subsequent studies proposed more fine-graines features such as Min-K% [8] and its enhancement Min-K%++ [33), which utilize token-level likelihood distributions for detection. These methods follow a max min principle: computing the average of the lowest K% likelihoods for tokens within the input data, and then identifying samples with the highest resulting scores as likely members of the training dataset. Other techniques include likelihood-ratio based scoring [1], output comparisons against reference models [34,, and variance-based metrics derived from multiple generations of the same input. Recent research has also extended MIAs beyond the individual sample level more realistic settings, such dataset-level membership inference attacks (35), and aggregation-ben based methods that integrate membership signals over long text sequences or entire documents (36. In summary, these MIA methods targeting LLMS predominantly focus on the textual modality and have demonstrated effectiveness in identifying whether specific textual inputs were part of the training data for LVLMs. contrast, this work explores membership inference for visual data within LVLMs, providing a complementary perspective to existing methods.
2.3 Membership Inference Attack for Large Vision-Language Models
LVLMs pose heightened privacy risks due to their training on large-scale image-text pairs, which often include personal photos, medical data, proprietary image-caption content. The multimodal nature of LVLMs increases the likelihood of memorizing sensitive gross-modas associations, motivating recent efforts extend MIAs to this domain. Li et al. [19 introduced
MIA benchmark for LVLMs and proposed token-level image detection pipeline, along with the MaxRényi-KSt % metric to assess the risk of membership inference. Hu et al. [39] focused the instruction-tuning phase of LVLMS and designed set-level MIAs based on temperature sensitivity, revealing overfitting signals that are more pronounced when analyzing groups of samples. Other works have explored alternative strategies, such as leveraging output similarity (20), linear probes over internal activations [40], and cosine similarity in CLIP-style encoders (26). However, key limitation shared by these methods is their reliance on gray-box assumptions, i.e., access to internal model features such as logits, token likelihoods, and complete input-output probability distributions. These features are typically inaccessible in real-world deployments of LVLMs, particularly in commercial systems that follow a generation-as-a-ee service paradigm (e.g., GPT-4o). To address this limitation, we propose the first black-box membership inference attack method for LVLMSs, which infers the membership status of suspected visual data solely based on the textual outputs generated by the model, without requiring access to internal computational features.
3

---

3 Methodology
3.1 Problem Formulation
We investigate the problem of membership inference against large vision-language models (LVLMs), referred to as MIA-LVLM. An LVLM, denoted as V(.), takes a visual input X and a textual instruction Z and generates a textual output Y V(X, Z). The objective of MIA-LVLM is to determine whether a given suspected visual input X, or a set of suspected visual inputs X' = {X; i = =,2, 1.2...., .N. were included in the model's training dataset D, where X; denotes the i-th sample in the set X' and N is the total number of samples. In real-world scenarios, most LVLMs are deployed in a pnnerationnas---eevvie paradigm that does not expose their internal computational features during inference. Therefore, we adopt a black-box threat model, where the adversary has no access to model parameters or intermediate representations, and can only issue queries V and observe the generated outputs Y. This black-box setting poses substantial challenges and distinguishes our work from existing white-box or gray-box MIA methods for LVLMs.
3.2
Methodology Motivation and Overall Framework
The core idea underlying most MIA methods to capture the overconfidence behavior of target model when queried with suspected data samples. However, as discussed in the introduction, this idea faces substantial challenges for black-box MIAs against LVLMs due to the entanglement of model memorization and generalization. For instance, an image depicting the scene "sun rising from the sea" represents common and semantically rich concept in the real world. An LVLM can exhibit high confidence in generating or understanding such an image even if it was not part of the training dataset, owing to the extensive prior world knowledge encoded during pretraining. Thus, distinguishing memory-rooter
overconfidence from generalization is crucial for effective black-box MIA on LVLMs. To address this challenge, we propose evaluating model's confidence behavior at fine-grained level by decomposing visual inputs into independent semantic units (e.g., individual objects). This strategy aims to mitigate the influence of prior knowledge encoded in the model. For example, when image of a table includes masked region on its surface, plausible completions may include a cup, plate, or bowl. Without explicit memorization of the specific image, the model is unlikely to confidently predict the correct object among these alternatives.
Building on this intuition, we introduce the prior nhowlegg-ccalibatte memory probing (KCMP) framework (Fig. D. which consists of three key components. (I) Semantic mask prediction task construction. This component identifies salient semantic units within the input image and constructs prediction tasks by masking them in ways that render prior knowledge alone insufficient for accurate completion. (2) Prior knowledge calibration. To further decouple the influence of prior knowledge, this component reduces the likelihood that the model can solve the constructed tasks using general reasoning, thereby isolating signals more indicative of memorization. (3) Instruction- -baed model confidence evaluation. The target LVLM is prompted to solve the selected mask prediction tasks and extracts confidence-basee features. Samples that elicit abnormally high confidence, suggesting strong model memorization of specific semantic units, are then inferred to be part of the training data. Through this framework, we effectively disentangle memory effects from generalization behavior, enabling robust black-box membership inference for LVLMs. Next, present the details of KCMP.
3.3 Semantic Mask Prediction Task Construction
In semantic mask prediction task construction, our core idea is to identify visual objects as independent semantic units and mask their shape and color to generate semantically confounding prediction tasks. Specifically, given suspected image sample X, we first employ off-the-shelf image segmentation model (c.g.. SAM (TT) to extract the primary visual objects, denoted as {Or i = I...., MM }. where OF represents the i-th extracted object and M is the total number of identified objects. We then construct semantically confusing tasks from two perspectives for each object: shape and color.
First, we mask a selected object O in the image X with solid black patch, resulting in a masked image M, (X, Of). This masked image is then used to prompt a commercial language model (e.g.. GPT-4o) with the following instruction: "Based on the surrounding context around the musk shown in (X, Of)L generate the names of K potential alternative objects that could plausibly fill the masked region." Simultaneously, we prompt the language model to convert the visual object Of (c.g..

---

Semantic Prediction Task Construction
Mask
whutscokd mosoed cithe image?
Prosy VI
C. Cat
Child
Suspected Image
Anything
Brunding Ground Truth
Whereoke might INditnnedd stpect
A. Black
B. White
Ditrattion Generatioo
C. Yellow
B. Prior Knowledge Calibration
C. Model Confidence Evaluation
mage Description 7 golken retriver jesfully through wates beach.
JAart Frohee Plaaee Eannt ongiral connect of mode Kaak trode] Hone sdant
Ueeggueelluu esaen loc obekous?
Proay
A6. MMR-CCC
Manid/ollr Probe
Target Blecsbox VIM
Are complenly ipporibio??
Discard
Patch of
contorr
Rationality Y1
Relavance M,
Filter score computation f," (t,
Banking
Higher f.". better probe quality
Accuracy tff Membership Inference
Figure 1: Overview of the proposed Knowledge- Caarddra-d Memory Probing (KCMP) framework. (A) Semantic Mask Prediction Task Construction: salient objects are extracted and masked to create shape- and color-based prohes with semantically confounding alternatives. (B) Prior Knowledge Calibration: each probe is filtered using CLIP-bbsed object relevance and LLM-estimated rationality to discard tasks solvable through general knowledge along. (C) Model Confidence Evaluation: the target LVLM answers the retained probes, and its aggregated confidence scores are used for membership inference, identifying samples with abnormally high confidence as likely training members.
an image patch of "cat"" into its corresponding textual label S. (e.g., cat). The K generated object names (in textual form), denoted as {s" 1, K}, form the confusing alternatives for the target objective sf in the masked region M(X, We further construct semantically confounding mask prediction task based on the following instruction P², "Please choose the proper objects from the following ones [SS]] to fill the mask in the masked image [M(X, O,")", where S denotes the shuffled set {s() {s ). This formulation presents highly challenging task for an LVLM that relies solely on prior knowledge.
Second, we propose color-based semantic confusion task to further probe model memorization. Specifically, for each extracted object Of, we first query a widely used language model (e.g.. GPT-4o) to identify primary colors, denoted as E+ fe²t), where each e represents color observed in the object. Next, we prompt the model to generate set of plausible but unobserved colors that the object could reasonably take, forming a candidate set E {e, J. We then randomly sample true color of from E+ as the positive instance, and select negative color candidates {cT, 1 K) from the set (e I E E- E F. To prepare the visual input, we convert the original image X into grayscale version and draw a bounding box around the target object OF, resulting processed image MX, OF). We then formulate the color-based semantic mask prediction task as the following instruction PE "Please choose the correct color from the following candidates [C to fill the boxed region in the grayscale image [Me(X, I"' where C denotes shuffled set composed of the positive color and the K negative candidates, i.e., C {ct } {c]))- This task is also challenging to solve without explicit memory on the input data.
3.4 Prior Knowledge Calibration
Next, we introduce the prior knowledge calibration strategy further mitigate the influence model generalization when detecting training data membership. We begin by observing that training image may contain multiple objects, but the model might attend to only subset of these during training. Therefore, we aim to estimate the object-level importance within an image and focus on those objects that are more likely to be memorized by the model. achieve this, we first convert the input image X into corresponding textual description T, using language model. Then, for each visual object O extracted from X, we compute its semantic relevance the textual description using CLIP-based similarity: uf CLIP(Ta, OF). A higher relevance score of indicates stronger
5

---

alignment between the object and the textual description, suggesting that the object is more likely to have been emphasized, and potentially memorized, during the model's 's cross-modal training process.
Second, the visual context surrounding an object may still leak identifying information, even when the object itself is completely masked. For instance, the area around a face with masked eyes may still provide sufficient cues to infer the identity of the masked region. Moreover, due to the inherent limitations of generative language models, they may produce inappropriate alternatives (e.g., suggesting "fish" as replacement for "camel") that fail to serve as effective confounders for the target object. Such information leakage can enable LVLMS to correctly complete the mask prediction task based solely on their encoded general knowledge. To address this challenge, we propose leveraging the deep reasoning capabilities of advanced LLMs (e.g.. GPT-ol) to estimate the extent of knowledge-basee based information leakage. Specifically, we convert the masked image M(X,07 into textual description Tz.; We then prompt the L.LM to evaluate whether a candidate alternative (where E * U , is semantically appropriate to fill the masked region described in Tz.;- It is important to note that this reasoning process occurs entirely in the textual modality and is independent of any memorization of the image data, relying solely the LLM's general knowledge. By repeating this procedure multiple times for each alternative, we derive a rationality score r that reflects the plausibility of the alternative as valid completion of the masked region. We denote the rationality scores for shape- and color- based alternatives as rf, and rf.j- respectively. A lower rationality score indicates that the alternative is less justifiable based on general knowledge alone, thereby suggesting an enhanced likelihood of prior knowledge interference. Finally, for each mask prediction task, compute unified filter score f.¹ Avg ( Tig)) by averaging the task relevance score uy with the corresponding rationality scores. The constructed masked prediction tasks are then ranked according to their filter scores, and we retain only the top N tasks for subsequent model confidence evaluation. The resulting set of selected tasks is denoted as PP- = (P. -= 1.,....,NN N).
3.5
Instruction-based Model Confidence Evaluation
Finally, for each suspected visual data sample z, we query the turget M using its corresponding set of mask prediction tasks P E PP and record the prediction accuracy as a = (c)))) where a, E {0, 1} denotes whether the model prediction on task P; is correct. To account for variability, this process is independently repeated R times, and the mean prediction accuracy is computed as: 1 = R E, dt.j. Next, we aggregate these scores across all retained tasks to obtain the final detection score for the input x: to = N Σ; t where N denotes the total number of evaluated tasks for x. higher detection score 1a suggests that the LVLM exhibits stronger memorization of the sample, which we interpret as evidence of training set membership.
4 Experiment
4.1 Experimental Settings
In this section, we comprehensively evaluate our proposed KCMP on a range of target models and datasets, and we further explore the underlying factors that affect its efficacy.
Datasets. We evaluate membership inference on two image-based based benchmarks [19]. each consisting of equally sized member and non non-member subsets. VL-MIA/DALL-E consists of 592 images in total. The member set contains photographs from the LAION AIIN_CCCS subset used in VLLM pre-training. For each member image, a caption generated using BLIP and used to prompt DALL-E2, producing a visually similar but unseen counterpart as the non-member. VL-MIA/Flickr contains 600 images in total, with half drawn from MS-COCO images hosted on Flickr as members. The other half are non- non-member images from Flickr uploaded after 1 January 2024, ensuring that they postdate the public release of the target models and were therefore unavailable during training.
El
Target Models. Let fo (arime_ + denote a lasion-language model with parameters 0. We evaluate three open-source instances of fo with disclosed training data: MiniGPT-4 (1. LLaVA 1.5 2 and LLaMA Adapter v2 42). These models typically integrate a vision encoder (e.g., ViT) to extract image features and a language model to generate responses from multimodal inputs. An adapter
'ntpss//www.fickr.com

---

Table 1: AUC results on VL-MIA. "inst"/"desp" denote logits from the instrrction/descriition slice. "Rouge" and "MPNet" measure text similarity in the Image Infer black-box method. Gray- Stay-highlighted rows are black-box methods (no access to generation-time logits); best in each column in bold. Other methods are gray-hox; those underperforming KCMP are underlined. KCMP outperforms Image Infer and approaches gray-box performance as K (dataset size) increases.
VI--MIA/Wlickr
LLaVA
LLaMA Adapter
MiniGPT-4
Average
Method
K=1
K=10
K=30
K=1
K=10
K=30
K=1
K=10
K=30
K=1
K=10
K=30
Pesplexity
inst
0.622
0,845
0.956
0.618
0.845
0.959
0.576
0.709
0.844
0.605
0.800
0,920
desp
0.667
0,908
0.988
0.620
0.854
0.937
0.654
0.902
0.981
0.647
0.888
0.969
Aug-KL
inst
0.528
0.598
0.658
0.578
0.766
0.869
0.559
0.633
0.802
0.555
0.666
0.776
deep
0.514
0,566
0.565
0.518
0.613
0.492
0.485
0.535
0.508
0.530
0.571
Max-Prob-Gap
inst
0.601
0.824
0.953
0.541
0.589
0.715
0,608
0.782
0.946
0.583
0.732
0,871
desp
0.650
0.892
0.986
0.622
0.791
0.962
0.607
0.778
0.926
0.626
0.820
0.958
Min-K%
inst
0.643
0.840
0.978
0.560
0.649
0.795
0.712
0.948
0.999
0.638
0.812
0,924
desp
0.669
0,930
0.992
0.582
0.762
0.891
0.591
0.743
0.898
0.614
0.812
0,927
ModRéayi
0.641
0.868
0.975
0.614
0,962
0.603
0.822
0.619
0.848
0,959
desp
0.659
0.895
0.993
0.611
0.794
0.961
0.638
0.854
0.973
0.636
0.848
0,976
MuxRényi-K%%
inst
0.689
0.945
0.994
0.539
0.647
0.704
0.641
0.864
0.980
0.623
0.819
0.893
desp
0.691
0,939
0.995
0.598
0.790
0.917
0,580
0.731
0.801
0.623
0.820
0,904
Image Infer
Rouge
0.512
0.521
0.539
0.516
0.544
0.556
0.473
0.476
0.420
0.500
0.514
0.505
MPNet
0.497
0,505
0.489
0.501
0.513
0.519
0.502
0.509
0.485
0.500
0,509
0.498
KCMP
Both
0.598
0.794
0.942
0.573
0.702
0.829
0.544
0.590
0.698
0.572
0.695
0.823
VL-MIA/DALL-E
Method
LLaVA
LLaMA Adapter
MiniGPT-4
Average
K=1
K=10
K=30
K=1
K=10
K=30
K=1
K=10
K=30
K=1
K=10
K=30
Perplexity
inst
0.638
0.896
0.991
0.500
0.474
0,510
0.652
0.879
0.978
0.597
0.750
0.826
desp
0,574
0,812
0.897
0.517
0.548
0,585
0.514
0.612
0.678
0.535
0.657
0.720
Aug-KL
inst
0,553
0.707
0.751
0.525
0.596
0.639
0.626
0.856
0.972
0.568
0.720
0.787
desp
0.529
0.526
0.601
0.540
0.652
0.767
0.547
0.648
0.734
0.539
0.609
0,702
Mux-Prob-Gap
inst
0,587
0.746
0.859
0.553
0.637
0.698
0.615
0.841
0.957
0.585
0.741
0.838
desp
0.619
0.828
0.961
0.542
0.621
0,791
0.517
0.570
0.604
0.559
0.673
0,785
Min-K%
inst
0,503
0,570
0.561
0.557
0.639
0,784
0.589
0.758
0.887
0.550
0.656
0,744
desp
0.560
0.701
0.799
0.490
0.523
0.559
0.498
0.527
0.498
0.516
0.584
0.619
ModRényi
inst
0.644
(18992
0.990
0.485
0.458
0.424
0.618
0.831
0.959
0.582
0.727
0,741
desp
0,570
0.729
0.889
0.510
0.516
0.607
0.519
0.612
0.690
0.533
0.619
0.729
MaxRényi-KS S
0.584
(1.800
0.903
0.600
0.794
0,938
0,530
0.621
0.666
0.571
0.732
0,836
desp
0.559
0,692
0.812
0.538
0.604
0.675
0.505
0.540
0.667
0.534
0.612
0
Image Infer
Rouge MPNet
0,502
0.511
0.537
0.520
0.556
0.583
01473
0.415
0.400
0.498
0.494
0.507
0,503
0.517
0.525
0.514
0.552
0,561
0.502
0.455
0,508
0.506
0.508
0.531
KCMP
Both
0.565
0.700
0.840
0.568
0.694
0.823
0.543
0.625
0.721
0.559
0.673
0.795
or projection layer bridges the two components, aligning visual embeddings with the LLM's token space, thereby enabling effective multimodal understanding through joint or instruction tuning.
Evaluation Metrics. We evaluate membership inference performance at two levels: (1) Sample-level inference is evaluated using the Area Under the Receiver Operating Characteristic Curve (AUC) following prior work [88 19), AUC summarizes the ability of the attack to distinguish members from non-members over varying thresholds, where higher values indicate stronger inference power. (2) Set-level inference is evaluated using accuracy, defined as the proportion of correctly identified training sets in a binary discrimination task over multiple candidate sets 43
Baselines. We compare KCMP with a comprehensive set of membership inference baselines cate- gorized by their access to model internals. Aug- KL assesses feature sensitivity via KL-divergence between outputs on original and augmented images [44]. The Loss attack, a standard approach, evaluates the negative log- likeliheoood of generated tokens .. Min-K% Prob [[8] identifies mem- bership by averaging the smallest K% probabilities assigned to ground-trutt tokens, while Max- ProbGap captures confidence spikes by measuring the average margin between the top-1 and top-2 token probabilities [32]. We also include Rényi antropy-based methods neehods-MMxxéánn MaxRényi-KK* % and Mod- Rényi [ which aggregate entropy values across token positions to quantify model certainty. All of these require access to the model's 's token-level outputs and are thus not applicable to closed-source systems. Under realistic black-box settings, we include the Image-only Inference baseline (39], which evaluates the stability of the model's descriptions across repeated queries on the same image.
7

---

K=10
K=220
K= K=40
K=50
08
LLAVA
0.4
DuC-s5.0 Parking Ei puC--au
Pahkrethh En HUUDHARC
Maating cocc-an.2 lrage
0.
LLaMA Adapter
0.
044
Mnp HUCHE22
Mudanysts XUK--8511
Panhtr dett 7621 reage my IncrAAC--
Madidtys- XUC-
0.
1mags MAC--2.11
iPape infer 300 $0.30
Imagi Haar MALAAAC-4S
1.6
0.8
Min/GPT-4
0.6
0.4
K-W OUC-ELL
IoW Duc--6.1 IPage Mia 200
ALC-O44
MAC-MUUI
Maskrpts HUC-123
0.8
1mage MAC--.41
Trags (A00
FPR
FPR
FPR
FPR
FPR
Figure 2: ROC curves comparing three attack methods KCMP, MaxRényi-K and Image In- fer-on three target models (LLaVA, LLaMA Adapter, MiniGPT-4) under different dataset sizes K E {10, 20, 30, 40, 503. Each subplot shows the TPR-FPR curve and corresponding AUC. As K increases, KCMP demonstrates steadily improving performance and approaches MaxRényi-K&% strong gray-box baseline. In contrast, Image Infer, as black-box method, maintains significantly lower AUC across all settings. KCMP consistently outperforms Image Infer and achieves competitive results with MaxRényi- K% on multiple configurations.
4.2 Membership Inference Attack Performance
We evaluate KCMP under both sample-level and dataset-level membership inference settings. As shown in Table and Fig. 2 KCMP consistently outperforms the black-box baseline Image Infer across all models and dataset. Notably, the performance gap is consistent and pronounced even small K: at K = 10 on VL-MIA/Flickr, KCMP achieves an average AUC of 0.794 compared to 0.514 for Image Infer (Rouge-based). On VL-MIA/DALL-E KCMP similarly outperforms Image Infer. achieving O. 700 versus 0.511. With increasing K, KCMP shows steady improvement and gradually approaches the best-perf gray-box method, MaxRényi-K%% On MiniGPT-4, KCMP improves from 0.828 at K = 10 to 0.980 at K = 50, narrowing the gap with MaxRényi- K% (0.997). A similar trend holds for LLaMA Adapter, where KCMP not only closes the gap but in some configurations even surpasses MaxRényi-K$% (e.g., at K = 30 and K = 40). These results suggest that dataset-level inference benefits significantly from evidence aggregation: while KCMP does not rely on token-level outputs, the collective signal across multiple samples is strong enough to match or exceed gray-box performance. Overall, KCMP offers a compelling trade-off between practicality and effectiveness. consistently surpasses existing black-box strategies while scaling with K to rival gray-bor methods, making it a strong candidate for auditing data exposure in real-world closed-soures systems.
4.3 DaMeb Benchmark Construction and Evaluation
We constructed a benchmark based on the publicly released DAM model 330 to enable transparent and controlled evaluation of membership inference attacks. Since DAM discloses its training corpus, we can precisely separate member and non-member samples. Specifically, 200 member images were drawn from DAM's COCOStuff training set 3 and another 200 non-member images were sampled from COCOStuff with no overlap. This design ensures that both sets are drawn from identical distributions, forming a clean and reproducible testbed for analyzing membership signals. We evaluated several representative MIA baselines this dataset (Table 2). Results show that while KCMP does not reach the accuracy of gray-box methods such as Min-K K %, it substantially exceeds the bla Image Infer baseline and attains AUC values close to those of Max-Prob-Gap.
hhtpss//hwggigggacc..oodssssssss wnwtrriieeeeannnnneeeeeeeee datasett

---

1.5
1bcl-0
KcMe-Color
Isbel (wlthout grounding!
label-1 grounding)
LLaVA
LLaMA Adapter
M-
1.0
Densioy
AUC
0.5
Recovery Accuracy
mil
wi wi Filter
(a) Recovery accuracy by region type.
(b) Ablation study on Filtering mechanism.
Figure 3: (a) Distribution of recovery accuracy across three types of region-based based probing questions: unseen regions (label = O), ungrounded regions (label = L, without grounding), and grounded regions with annotations (label = 1, with grounding). (b) AUC comparison across three target models and two filtering settings (w/o and w/ Filter) on the VL-MIA/DALL-E dataset with different KCMP strategies. The proposed filtering mechanism improves attack performance across all target models.
Table 2: Baseline AUC comparison on the DAM-based benchmark.
Perplexity
Max-Prob-Gap
Min-K %
Image Infer
Variant
Inst
Dese
Inst
Desc
Inst
Desc
Rouge
MPNet
KCMP
AUC
0.702
0.645
0.601
0.622
0.743
0.674
0.502
0.489
0.584
4.4 Investigation on the Memory Probing Effectiveness
Building upon the DAM-based benchmark described above, we further analyzed how region-level supervision influences memorization behavior under membership inference attacks. The DAM model specifically designed for localized image captioning, where user-specified regions (e.g., masks) are used to generate fine-grainee context-aware descriptions. It combines focal prompting and localized vision backbone to capture fine-graing ane-grrined details with contextual awareness. More crucially for our analysis, DAM is trained using semi- cumi-supervieed pipeline (DLC-SDP) that leverages segmentation datasets with dense region-level annotations, making it particularly sensitive to annotated regions during training. To examine whether DAM disproportionately memorizes supervised regions, categorize the probing questions in our attack according to the status of the queried region relative to the training set: (1) label (with grounding): region overlaps with a known annotated mask in training image; (2) label = 1 (without grounding): region is from a training image but not part of any annotated mask; (3) label 0: region is from image entirely outside the training set. Fig. 3a shows a clear trend: DAM achieves the highest recovery accuracy when the region was explicitly annotated during training. lower accuracy when the region is present but unannotated, and the lowest accuracy on unseen images. This behavior further validates the effectiveness of our method. The difference in recovery distributions between label and label confirms that our attack can successfully distinguish member from non-member samples based on response patterns. Moreover, the especially high recovery rate on label I (with grounding) demonstrates that our method particularly effective against models like DAM that are trained with fine-gra fine-grained, region-level supervision.
4.5 Algorithm Analysis
We analyze key components of our attack, including the knowledge calibration mechanism, task type, and task number, to understand their impact on membership inference performance. Knowledge Calibration. Fig. shows that applying our calibration mechanism consistently improves AUC across all target models and KCMP variants. By filtering noisy tasks, the mechanism enhances the signal-to-noiss to-se ratio and directs the attack toward more informative queries. Task Type. We compare using only object probes, only color probes, and a combination of both (Fig. [a)). Combining both types yields higher AUC, confirming that they capture complementary memorization signals: object probes emphasize spatial identity, whereas color probes focus on appearance-level attributes. Task Number. We rank questions by CLIP similarity between each segmented region and the model-generated caption, and then seleet the top-N tasks for evaluation. As shown in Fig. 4b), AUC

---

559
0.58
0.55
0.58
0.5
Sagt Anple
Sype
0.53
0.30
5.6
0.57
0.54
Suger made (1a0%
0.54
0.53
0.52
12
16
Semantic question number (N)
(a) Ablation study.
(b) Hyper-parameter analysis.
Figure 4: Ablation study on filtering, question type, and number of confidencc-evalluation tasks.
improves as N increases up to N = 12, after which the gains saturate. This suggests that focusing on moderate number of top-ranked, high-saliency regions provides the best results.
4.6 Overview of Supplementary Analysis
We include series of supplementary analyses in the Appendix complement our main results and validate the generality and efficiency of KCMP. Appendix lists the prompts used in KCMP-Objec and KCMP-Color for confidence evaluation. Appendix eBeetends our evaluation closed-soures LVLMs, confirming the feasibility of KCMP under real-world API constraints. Appendix exammines the effect of varying sampling temperatures on detection stability and Appendix D analyzes the impact of color-probe granularity on performance. Appendix TenedixEErrpone Elppoots efficiency, cost estimation, and runtime analyses, while (opendix(ppresent model simplification and ablation studies, demonstrating that lightweight KCMP variants remain competitive with reduced computational overhead.
5 Conclusion
In this work, we study the problem of membership inference attacks against large vision-language models under the black-box setting, challenging yet practically significant scenario that has received limited attention in prior research. To address this challenge, we propose a novel framework, knowledge-calibratted memory probing (KCMP), which detects the membership status of visual data solely based on the model-generated textual outputs. Our method is adaptively designed to mitigate the influence of model generalization, thereby isolating memory-specific behaviors indicative of training data inclusion. Furthermore, we introduce a new MIA benchmark against LVLMs, comprising positive and negative samples drawn from identical distributions, support systematic and robust evaluation. Extensive experiments conducted on four representative LVLMs and three benchmark datasets demonstrate that our method can even outperform certain recent gray-box methods in detecting visual training data of LVLMs, highlighting its practical utility and robustness.
Limitations. KCMP primarily designed for natural images with rich semanties and visually distinct objects. Its applicability to domains with low semantic diversity or weak structure such as medical scans document images might be constrained, constructing informative shape color probes becomes challenging. Future work could incorporate domain-specific priors or auxiliary models (e.g., saliency or organ segmentation for medical imaging, OCR-base detection for documents) to improve adaptation across specialized multimodal settings.
Acknowledgments
This work is supported by the National Natural Science Foundation of China under Grant U2336208. 62262002, and 62502044, 62032003; CCF-SANGFOR Research Fund under Grant 20240202.
10

---

References
[1] Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: En- hancing vision-language understanding with advanced large language models. arXiv preprint arXiv:2304. 10552, 2023.
[2] Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. In Neur/PS, pages 34892-3499 2023.
[3] Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. Improved baselines with visual instruction tuning. In CVPR, pages 26296-26306, 2024.
[4] Iryna Hartsock and Ghulam Rasool. Vision-language models for medical report generation and visual question answering: A review. Frontiers in Artificial Intelligence, 7:1430984, 2024.
[5] Minh-Hao Van, Prateek Verma, and Xintao Wu. On large visual language models for medical imaging analysis: An empirical study. In CHASE, pages 172-176. 2024.
[6] Che Liu, Sibo Cheng, Chen Chen, Mengyun Qiao, Weitong Zhang, Anand Shah, Wenjia Bai, and Rossella Arcucci. M-flag: Medical vision-language pre-training with frozen language models and latent space geometry optimization. In MICCAI, pages 637-647, 2023.
[7] Keisuke Shirai, Cristian Tanaka, Kento Kawaharazuka, Kazutoshi Tanaka, Yoshitaka Ushiku, and Shinsuke Mori. Vision- language interpreter for robot task planning. In ICRA, pages 2051-2058. 2024.
Masashi Hamaya, Atsushi Hashimoto, Shohei
[8] Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, et al. A survey of large language models. arXiv preprint 230..3333..22233 1(2), 2023.
[9] Jingyi Zhang, Jiaxing Huang, Sheng Jin, and Shijian Lu. Vision-languaa models for vision tasks: A survey. IEEE transactions pattern analysis and machine intelligence, 46(8): 5625-5644, 2024.
[10] Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization neural networks. In USENIX security, pages 267-284, 2019.
[11] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Vone Kather- ine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, al. Extracting training data from large language models. In USENIX Security, pages 2633 2650, 2021.
[12] Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap. Reza Shokri, and Yejin Choi. Can Ilms keep secret? testing privacy implications of language models via contextual integrity theory. In ICLR, 2023.
[13] Tao Qi, Fangzhao Wu, Chuhan Wu, Liang He, Yongfeng Huang, and Xing Xie. Differentially private knowledge transfer for federated learning. Nature Communications, 14(1):3785, 2023.
[14] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In SP, pages 3-18, 2017.
[15] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. Membership inference attacks from first principles. In SP, pages 1897-1914, 2022.
[16] Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. Enhanced membership inference attacks against machine learning models. In CCS, pages 3093-3106, 2022.
[17] Sorami Hisamoto, Matt Post, and Kevin Duh. Membership inference attacks on sequence- to-sequence models: my data in your machine translation system? Transactions of the Association for Computational Linguistics, 8:49-63, 2020.

---

[18] Weijia Shi, Anirudh Ajith. Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models, In ICLR. 2024.
[19] Zhan Li, Yongtao Wu, Yihang Chen, Francesco Tonin, Elias Abad Rocamora, and Volkan Cevher. Membership inference attacks against large vision-language models. In NewrIPS, pages 98645-98674, 2024.
[20] Pingyi Hu, Zihan Wang, Ruoxi Sun, Hu Wang. and Minhui Xue. M4i: Multi-modal models membership inference. In NeurlPS, pages 1867-1882, 2022.
[21] Iyiola E Olatunji. Wolfgang Nejdl, and Megha Khosla. Membership inference attack on graph neural networks. In TPS-ISA, pages 11-20. IEEE, 2021.
[22] Christopher A Choquette- Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label- only membership inference attacks. In JCML., pages 1964-1974, 2021.
[23] Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction (APIs). In USENIX Security, pages 601-618, 2016.
[24] Yuefeng Peng, Jaechul Roh, Subhransu Maji, and Amir Houmansadr. Oslo: one-shot label-only membership inference attacks. In NewrlPS, pages 623 62310-62333, 2024.
[25] Rui Wen, Zheng Li, Michael Backes, and Yang Zhang. Membership inference attacks against in-context learning. In CCS, pages 348 1481-3495, 2024.
[26] Myeongseob Ko, Ming Jin, Chenguang Wang, and Ruoxi Jia. Practical membership inference attacks against large-scale multi-modal models: A pilot study, In ICCV, pages 4871 1-881, 2023.
[27] Jiahua Rao, Zifei Shan, Longpo Liu, Yao Zhou, and Yuedong Yang. Retrieval-basn knowledge augmented vision language pre-training. In MM, pages $399-5409, 2023.
[28] Ziniu Hu, Ahmet Iscen, Chen Sun, Zirui Wang. Kai-Wei Chang, Yizhou Sun, Cordelia Schmid, David A. Ross, and Alireza Fathi. Reveal: Retrieval-augmented visual-language pre-training with multi-source multimodal knowledge memory. In CVPR, pages 23369-23379, 2023.
[29] Narine Kokhlikyan, Bargav Jayaraman, Florian Bordes, Chuan Guo, and Kamalika Chaudhuri. Measuring dejavu memorization efficiently. In NeurIPS, pages 30015-30040, 2024.
[30] Long Lian, Yifan Ding, Yunhao Ge, Sifei Liu, Hanzi Mao, Boyi Li, Marco Pavone, Ming- Yu Liu, Trevor Darrell, Adam Yala, et al. Describe anything: Detailed localized image and video 2025.
captioning. arXiv preprint arXiv:2504.
[31] Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In SP, pages 739-753. IEEE, 2019.
[32] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pages 268-282. IEEE, 2018.
[33] Jingyang Zhang, Jingwei Sun, Eric Yeats, Yang Ouyang, Martin Kuo, Jianyi Zhang, Hao Frank Yang, and Hai Li. Min-k%+++ Improved bascline for detecting pre-training data from large language models. arXiv preprint arXiv:2404.00995 2024.
[34] Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Membership inference attacks against fine-tuned large language models via self-prompt calibration. In NeurlPS, 2024.
[35] Yonatan Oren, Nicole Meister, Niladri Chatterji, Faisal Ladhak, and Tatsunori Hashimoto. Proving test set contamination in black-box language models. In ICLR, 2023.
12

---

[36] Haritz Puerto, Martin Gubri, Sangdoo Yun, and Seong Joon Oh. Scaling up member- ship inference: When and how attacks succeed on large language models. arXiv preprint arXiv:2411 1,00144 2024.
[37] Matthieu Meeus, Igor Shilov, Manuel Faysse, and Yves-Alexandre De Montjoye. Copyright traps for large language models. arXiv preprint arXiv:2402.09363, 2024.
[38] Matthieu Meeus, Shubham Jain, Marek Rei, and Yves-Alexandre de Montjoye. Did the neurons read your book? decument-level membership inference for large language models. In USENIX Security, pages 2369-2385, 2024.
[39] Yuke Hu, Zheng Li, Zhihao Liu, Yang Zhang, Zhan Qin, Kui Ren, and Chun Chen. Membership inference attacks against vision-language models. arXiv preprint arXiv:2501. 18624, 2025.
[40] Luis Ibanez-Lissen, Lorena Gonzalez-Manzano, Jose Maria de Fuentes, Nicolas Anciaux, and Joaquin Garcia-Alfaro. Lumia: Linear probing for unimodal and multimodal membership inference attacks leveraging internal IIm states. ESORICS, pages 186-206, 2025.
[41] Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitchead, Alexander C Berg, Wan- Wan-Yen Lo, et al. Segment anything. In ICCV, pages 4015-4026, 2023.
[42] Peng Gao, Jiaming Han, Renrui Zhang, Ziyi Lin, Shijie Geng, Aojun Zhou, Wei Zhang, Pan Lu, Conghui He, Xiangyu Yue, al. Llama-adapter v2: Parameter-efficient visual instruction model. arXiv preprint arXiv:2304. 15010, 2023.
[43] Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. Monte carlo and reconstruction membership inference attacks against generative models. Proceedings on Privacy Enhancing Technologies, 2019.
[44] Hongbin Liu, Jinyuan Jia, Wenjie Qu, and Neil Zhenqiang Gong, Encodermi: Membership inference against pre-trained encoders in contrastive learning. In CCS, pages 2081-2095, 2021.
13

---

A Prompts for Model Confidence Evaluation
We provide the prompts used in our KCMP-Object and KCMP-Color methods for evaluating model confidence, as summarized in Table 3
Table Prompts used in KCMP-based confidence evaluation.
Method
Prompt
You have seen the image your training data. Choose the option that correctly identifies the original content of the masked area. Options:
KCMP-Object
Answer:
The image is in grayscale, but you have encountered it during training. Identify the original color of the object enclosed the red box.
KCMP-Color
Options:
Answer:
B Evaluation on Closed-Source LVLMs
To further demonstrate the practical applicability of our proposed KCMP framework under real-world deployment conditions, we conducted an additional evaluation on closed-source commercial LVLMs that operate exclusively through restricted API access.
Dataset Construction. We constructed an image-based membership inference benchmark tailored for closed-source LVLMs. The dataset was curated by leveraging the knowledge cut-off dates of the target models. Specifically, we selected Flickr as the image source, as is common component of LVLM pre-training corpora. Images uploaded before July 1, 2024 were considered members (potentially seen during training), while those uploaded after this date were regarded as non-members (unlikely to have been included in training). A total of 200 images (100 members and 100 non- members) were sampled form pilot benchmark for this study. Table lists the metadata of the evaluated closed-source models.
Table 4: Release and knowledge cut-off dates of the evaluated closed-source LVLMs.
API Model
Release Date
Knowledge Cut-off Date
GPT-4o-mini
May 2024
October 2023
Gemini-1.5
February 2024
Early 2024 (estimated)
Claude-3
March 2024
August 2023
Results. We conducted experiments this curated benchmark under realistic API constraints. For each model, we applied the proposed KCMP framework using the same semantic mask-prediction pipeline described in Section 3] without any
intermediate representations or logits. Table summarizes the AUC results. Despite operating under realistic black-box constraints and limited APT queries, KCMP successfully detects membership signals in GPT-4o-mini, Gemini- 1.5 and Claude-3. These findings confirm the robustness and scalability of KCMP to commercial LVLMs, providing empirical evidence of its practical effectiveness beyond open-source environments.
Table Membership inference results (AUC) on the closed-source LVLMs.
Method
GPT-4o-mini
Gemini-1.5
Claude-3
KCMP
0.566
0.572
0.561
14

---

C Impact of the Sampling Temperatures
Al models often rely on sampling temperature to control output variability during generation, with higher values introducing greater randomness. This stochasticity poses potential challenge for detection methods that rely on consistent output behavior. To test the resilience our approach, we apply KCMP across spectrum of sampling temperatures in the target models, ranging from deterministic (0.2) to more exploratory (0.8) settings. Despite the increasing variability, KCMP exhibits stable and reliable detection performance throughout, evidenced in Supplementary Table This consistency underscores the robustness KCMP against fluctuations in generative behavior, affirming its suitability for real-worke deployment.
Table 6: Detection AUC of KCMP under different sampling temperatures on VL-MIA/Flickr.
VL-MIA/Flickr
Temperature
LLaVA
LLaMA Adapter
MiniGPT-4
0.2
0.568
0.550
0.539
0.3
0.598
0.573
0.544
0.4
0.581
0.560
0.558
0.5
0.590
0.549
0.544
0.6
0,601
0.546
0,531
0.7
0.600
0.535
0,552
0.8
0.614
0.574
0.541
Analysis on Color Probe Granularity
In our approach, adopt fine-grained probing strategy by querying the model about the color of specific objects in an image, rather than using coarse, global image-level color descriptions. This design choice is motivated by the observation that models often memorize localized visual-textual associations, particularly for salient objects, rather than global image characteristies. To evaluate the impact of this granularity, we compare two evaluation tasks: Image-Color, Color, which asks about the overall color of the image and KCMP-Color which focuses object-level color questions identified via segmentation. As shown in Table 7 KCMP-Colo consistently outperforms the Image-Coloy baseline across all model-dataset combinations. The gains are particularly notable for the LLaMA Adapter and MiniGPT-4 on the DALL-E dataset, with improvements of up to 16.4% and 11.7%, respectively. These results highlight the benefit of aligning probing granularity with the model's likely memorization focus, and support the use of object-centric questioning to enhance detection effectiveness in vision-language MIA.
Table 7: Comparison detection AUC between image-level and object-level color probing.
VL-MIA/Flickr
VL-MIA/DALL-E
Color Probing LLaVA LLaMA Adapter MiniGPT-4
LLaVA LLaMA Adapter MiniGPT-4
Image-level 0.496
0.487 0.567
0.505
0.503 0.547
0.477 0.533
0,511
Object-level 0.534
0.530
0.569
E
Detection Efficiency and Cost Analysis
We further analyze the query overhead and cost of KCMP demonstrate its practicality for real-world deployment under metered API access.
E.1 Number of Probes per Image
KCMP generates a limited number of fine-grained semantic probes for each image. Table presents the distribution of probes generated across different datasets. The average number of probes used
15

---

during detection is approximately four per image, indicating that KCMP operates efficiently in practice. Figure (b) in the main paper also illustrates that approximately five probes yield optimal detection performance.
Table 8: Distribution of probes generated per image across different datasets.
Dataset
Probe
2 Probes
3 Probes
Probes
25 Probes
Avg./mmae
VL-MIA/Flickr 16.6%
13.6%
13.4%
14.1%
42.2%
4.72
VL-MIA/DALL-E
21.8%
24.0%
16.9%
12.5%
24.9%
3.22
API dataset
7.9%
11.3%
16.4%
16.4%
48.0%
4.98
E.2 Impact of Repeated Querying
In our experiment, each probe is repeated R 4 times by default. To further reduce the total number of API calls, we evaluated the impact of using fewer repetitions on the VL-MIA/Flickr dataset. Sholss shows that decreasing R from 4 2 introduces only modest decline in AUC, suggesting
Table 2 that fewer repetitions can effectively lower cost while preserving competitive detection accuracy.
Table 9: AUC results VL-MIA/Flickr under different repetition counts R.
Method
LLaVA
LLaMA Adapter
MiniGPT-4
KCMP (R=4)
0.598
0.573
0.544
KCMP (R=3)
0.579
0.558
0.536
KCMP (R-2)
0.585
0,560
0.515
KCMP (R=1)
0.548
0.531
0.519
E.3 Cost Estimation of the Attack Closed-Source LVLMS
Assuming an average of 4.12 probes per image and repetition count of four, the total number of API queries per image is approximately 17. Each query involves single 300x350 image and short textual prompt (about 60 characters). Based on current pricing for representative commercial LVLM APIs, Table 10 summarizes the estimated query cost. The total cost for detecting 1,000 images targeting Claude 3.7 is roughly $0.01, confirming the practicality and cost-efficiency of KCMP. Reducing the repetition count two halves this cost with minimal accuracy loss.
Table 10: Estimated API costs for membership inference on 1,000 images.
API Model
Image Price (S/image)
Text Price ($/IM tokens)
Query Price (S/probe)
Estimated Cost
GPT-4o
0.000638
2.5
0.00079
0.01340
Gemini-2.5
0.001315
1.25
0.00139
0.02363
Claude-3.7
0.00042
0.00060
0.01020
Overall, KCMP achieves a favorable balance between detection accuracy and query efficiency, maintaining strong performance while keeping computational and monetary overheads minimal for large-scale auditing scenarios.
F
Model Simplification and Component Ablations
F1 Analysis on Simplified KCMP
To examine whether the auxiliary components in KCMP are indispensable, we construct a simplified variant by removing three modules: (1) the CLIP-based saliency ranking used for object selection, (2) the prior-knowledge calibration module that leverages GPT-4o reasoning, and (3) the GPT-4o probe generator, which is replaced with lightweight open-source LVLM (Qwen2.5-VL-7B). This
16

---

Table 11: AUC comparison of the full and simplified KCMP variants on two datasets.
VL-MMIAFllickr
VL-MIA/DALLE
Method
LLaVA LLaMA Adapter MiniGPT-4
LLaVA
LLaMA Adapter MiniGPT-4
Image Infer (Rouge)
0.512
0.516
0,473
0.502
0.520
0.473
Image Infer (MPNet)
0,497
0,501
0,502
0,503
0,514
0,502
KCMP (full)
0.598
0,573
0.544
0.565
0,568
0.543
KCMP (simplified) 0.565
0,554
0.539
0,551
0.522
0,515
variant therefore relies only on segmentation and lightweight text generation, significantly reducing computational overhead while preserving the overall framework structure.
Table T1 reports the results on two benchmark datasets. Across both VL.-MIA/llickr and VL- MIA/DALL-E, the simplified KCMP achieves average AUC scores of approximately 0.541, only about percentage points lower than the full KCMP. This minor drop contrasts sharply with the large margin separating both KCMP variants from purely black-box baselines such Image-Infer (Rouge/MPNet), which remain below 0.52. The observation indicates that the auxiliary components, while beneficial for peak accuracy, are not strictly required for effective membership inference.
These findings demonstrate that KCMP retains most of its discriminative power even when im- plemented with lightweight components, confirming its robustness and practicality. In particular, replacing GPT-4o with (wwen2.5-VL.777 reduces inference cost substantially without introducing major degradation, suggesting that KCMP be efficiently deployed on modest hardware while maintaining strong attack performance.
F.2 Runtime Analysis
We evaluate the computational efficiency of KCMP under realistic hardware settings. All experiments were conducted on single NVIDIA RTX 5000 GPU (32 GB). Table [2 down the per-stage runtime on the VL-MIA/Fllicr dataset for both the simplified and full versions of KCMP. The simplified variant requires 8. s per image, with most time spent on probe generation. The full version, which incorporates prior-knowledge calibration and CLIP computation, increases total runtime to 21.89 per image. Although the full configuration introduces additional reasoning and filtering steps, the overall runtime remains practical offline membership inference.
Table 12: Per-stage runtime on VL--MA/Flicckr (sec/image).
Operation
KCMP (full)
KCMP (simplified)
Segmentation
1.03
1.03
Probe generation
12.39
7.16
Prior-knoue kooolknowwedge calibration
8.24
CL.IP calculation
0.23
Overall input processing time
21.89
8.19
Given that membership inference attacks are typically performed an offline analysis rather than real-time interaction, the observed runtime therefore confirms the practicality of KCMP. Moreover, modest gap between the simplified and full versions suggests that the added reasoning and calibration modules improve detection robustness without imposing prohibitive runtime cost.
E33 Lightweight Segmentation Variants
To assess the impact of segmentation model size on both accuracy and runtime, we replaced the default sam2. 1 www_hiirra_aaaa large model with smaller variants from the same family. Table 13 summarizes the results on both VL-MIA/Flicck and VL-MIA/DALL-E datasets.
As the parameter size decreases from 224M to 39M, the segmentation time per image drops by approximately 30-40% while the detection performance remains largely consistent across all target models. Specifically, even the smallest model (sam2. 1 hiera_ liihra_tiny)) achieves comparable AUCs
17

---

Table 13: Segmentation model variants on two datasets.
VL-MIA/Flickr
Segmentation Model
Params (M)
SAM (s/img)
LLaVA
LLaMA Adapter
MiniGPT-4
sam2.1 Lamerl_heera, harea_large
224.4
1.03
0.598
0.573
0.544
sam2.1 ___hirra_bee
80.8
0.89
0,583
0,575
0.535
sam2.1 __ierr_er______ hiera_small
46.0
0.77
0.575
0.562
0.537
sam2.1
1amn.1_heera_tinn _hierr_tiny
38.9
0.72
0.597
0.570
0.545
VL-MIA/DALL-E
Segmentation Model
Params (M)
SAM (s/img)
LLaVA
LLaMA Adapter MiniGPT-4
sam2. l___-_hhh_laarge
224.4
1.42
0,565
0.568
0.543
sam2.1 hiera base plus
80.8
1.20
0.567
0.554
0.539
sam2.1 1amn-__ieera_ai wwthhhirrssmaaa small
46.0
1.05
0.540
0.562
0.535
sam2.1 hiera tiny
38.9
1.03
0.561
0.550
0.545
to the large variant (e.g.. 0.597 0.598 Flickr and 0.561 vs. 0.565 DALL-E), demonstrating that lightweight segmentation backbones are enough for effective probing. This finding suggests that KCMP can be efficiently deployed using lightweight vision components without sacrificing attack accuracy, further improving scalability under limited computational budgets.
F.4 Sensitivity to Filtering Components
We further investigate the sensitivity of KCMP to different filtering components in the auxiliary modules. Table 14 presents the AUC results when varying the CLIP backbone used for saliency ranking. The default vit-large--aee wwwlaaarreeepe p14-p-14--5 p14-336 (428M parameters) achieves the best overall performance, but smaller variants such as vit bwse-assseee and vit wit-base-- www---aaeeppeeeee -20 yield only marginally lower accuracy. Across both VL-MIA/Flickr and VL-MIA/DALL-E, the AUC differences between large and base CLIP models are within 0.02-0.03, demonstrating that KCMP is not strongly dependent on a specific CLIP architecture. This indicates that lighter visual encoders can be employed without notable degradation detection capability, further improving the efficiency the framework.
Table 14: AUC with different CLIP encoders.
VL-MIA/Flickr
VL-MIA/DAL-EE
CLIP Model
LLaVA LLaMA Adapter MiniGPT-4
LLaVA LLaMA Adapter MiniGPT-4
vit-large-p14-3366 (r>428M)
0.598
0.573
0.544
0.565
0.568
0.543
vit-base-p16 (~151MM
0.585
0.555
0.547
0.558
0.560
0.527
vit-base-p32 (~151M)
0.592
0.550
0.532
0.552
0.544
0.534
18

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Yes. The abstract and introduction clearly state the problem, black-box setting, and key contributions, which are consistently supported by the experiments.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Yes, the paper discusses the limitations of the work performed by the authors which are described in the main text.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sellsspeciiiationn asymptotic approximations only holding locally). ). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
19

---

Answer: [Yes]
All theoretical results are stated with clear assumptions and complete, rigorous proofs
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proof' in the paper should be numbered and cross referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: Yes. We provide detailed implementation descriptions of our method in the Method section covering all components needed to reproduce the main results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
20

---

Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: Yes. We provide the full codebase and data used in experiments, along with detailed instructions to reproduce all main results at this anonymous repository https
//github. com Sopmede/XCMP
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.com
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
y /nips. /nips.cc//ppppp http:/ppblcggguueeeeeeebeeeeeee/ httpa///gguideeeddduuubiiiii
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question:
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification: All necessary training and testing details inclluin hyperparameter analysis, ablation, and selection methods-att are clearly specified the main text the paper
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes].
Justification:
Yes. All experiments were conducted five times.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
21

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Yes. We provides details on the computational resources used for each experiment, including the type of GPU, memory, and runtime at our anonymous code repository at pestps://githnn cow.oubbccoo//mmeee//ec//
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics htt.g//ggg/////arrro/./o///////a
Answer: [Yes]
Justification: The research fully complies with the NeurIPS Code of Ethics all respects.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Yes. We thoroughly discuss the potential impacts of this work on both the field and society in the introduction and throughout the paper.
Guidelines:
22

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (c.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate point that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e-g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
The paper confirms that the released data and models do not pose any identifi- able risk of misuse or privacy leakage.
Justification:
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: Yes. All creators and original owners of assets used this paper, including code, data, and models, are properly credited. Licenses and terms of use are explicitly mentioned and strictly respected.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
23

---

The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the datasets.papersstt paperswi thcode. com/datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Yes. provide detailed documentation about the curated dataset at anonymous code repository at at/tttps://iituut wtt.ccom//sseeee wwwm//pmee///C/
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Not applicable, as this paper does not involve crowdsourcing experiments or research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Bthics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Not applicable, as this study does not involve human participants.
Guidelines:

---

The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question:
Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: LLMs were used as an important, original, or non-standard component in the core methods of this research.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to LLM policy hbtp:e///earrpppcccc//offeerrrrr for what should or should not be described.
25


Reviews:
[{"review_id": "SW27PCndmy", "reviewer": "Reviewer_zojf", "summary": "This paper presents Knowledge-Calibrated Memory Probing, the first membership-inference attack that can reveal whether a specific image appeared in a large vision–language model’s (LVLM’s) training data when the attacker has only text-based, **black-box access**. Proposed method converts each candidate image into a small set of object- and color-mask queries that the model can answer confidently only if it memorized the exact picture. To ensure the probes test memorization rather than commonsense, the method ranks salient regions with CLIP and filters “too obvious” questions using an external LLM. Repeated query accuracy becomes the membership score. Experiments on three open-source LVLMs (MiniGPT-4, LLaVA 1.5, LLaMA-Adapter v2) and several datasets show that proposed method consistently outperforms prior black-box baselines and approaches gray-box methods that require logits. Ablation studies confirm the importance of mask selection, prior-knowledge calibration, and combining shape- and colour-based probes.\n\nThe contributions are ：\n1) Formalising pure black-box membership inference for LVLMs, a setting highly relevant to commercial “generation-as-a-service” APIs.\n\n2) A practical attack that isolates memorisation signals by calibrating out prior knowledge.\n\n3) Empirical evidence across models and datasets demonstrating strong effectiveness and detailed ablations that illuminate each design choice.", "questions": "NA", "limitations": "NA", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths\n\n1.\tTimely and clearly-defined problem – The work targets pure black-box membership inference for LVLMs, a gap left by prior white-/gray-box studies, and grounds the need in real-world “text-only” APIs such as GPT-4o and Gemini Vision.\n\n2.\tConceptually novel approach – The method explicitly separates memorisation from commonsense by discarding “easy” questions with the help of an external LLM, yielding probes that genuinely test whether the image was memorised.\n\n3.\tSolid empirical support – Experiments span three open-source LVLM architectures, multiple datasets, and both sample- and set-level metrics, consistently surpassing the strongest existing black-box baseline and approaching gray-box performance ceilings.\n\nWeakness:\n\n1. Heavy auxiliary tool and compute cost – The attack depends on SAM (segmentation), CLIP (saliency ranking), and GPT-4o-style reasoning, which inflates GPU requirements and complicates large-scale scanning.\n\n2. High query overhead per image – Roughly 12 fine-grained probes, each repeated R times, are needed for a single membership decision; such dozens-of-queries overhead is expensive on metered APIs and increases the likelihood of detection or throttling.\n\n3. Limited evaluation scope – Validation is confined to MiniGPT-4, LLaVA-1.5, and LLaMA-Adapter v2. No experiments demonstrate resilience under commercial endpoints (GPT-4o, Gemini, Claude) with real-world rate limits or safety filters; even a small-scale test on such services would strengthen the claim of practical applicability. There are some unlearning benchmark can be leveraged. \n\ne.g. [1] Ma, Yingzi, et al. \"Benchmarking vision language model unlearning via fictitious facial identity dataset.\" arXiv preprint arXiv:2411.03554 (2024).", "was_revised": true, "final_justification": "All questions have been addressed by review. The score has been adjusted accordingly.", "rebuttal": "We thank the reviewer for careful attention to the paper. Our response to the queries and comments is as follows.\n\n> Comment 1: Heavy auxiliary tool and compute cost – The attack depends on SAM (segmentation), CLIP (saliency ranking), and GPT-4o-style reasoning, which inflates GPU requirements and complicates large-scale scanning.\n\nThank you for the thoughtful comment. The auxiliary tools mentioned are primarily employed to further enhance detection performance. However, our method remains effective even in the absence of these tools or when they are replaced with lighter alternatives. The following analysis of both detection accuracy and efficiency substantiates this claim.\n\n\n**The performance of simplified KCMP**. We construct a simplified variant of KCMP by applying the following three modifications: (1) removing the CLIP-based saliency ranking module, (2) removing the prior knowledge calibration component (i.e., GPT-4o-style reasoning), and (3) replacing the GPT-4o probe generator with a lightweight model (Qwen2.5-VL-7B). Experiments conducted on two datasets and across three models demonstrate that the simplified version achieves performance comparable to the original KCMP, while significantly outperforming intuitive black-box baselines. (The results for the baselines and the original KCMP method are reported in Table 1 of the paper.)\n\n\n| Dataset         | Method              | LLaVA | LLaMA Adapter | MiniGPT4 |\n|----------------|---------------------|-------|---------------|----------|\n| VL-MIA(Flickr)  | Image Infer (Rouge) | 0.512 | 0.516         | 0.473    |\n|    | Image Infer (MPNet) | 0.497 | 0.501         | 0.502    |\n|   | KCMP                | 0.598 | 0.573         | 0.544    |\n|    | Simplified KCMP  | 0.565 | 0.554         | 0.539    |\n| VL-MIA(DALL-E)  | Image Infer (Rouge) | 0.502 | 0.520         | 0.473    |\n|   | Image Infer (MPNet) | 0.503 | 0.514         | 0.502    |\n|    | KCMP                | 0.565 | 0.568         | 0.543    |\n|   | Simplified KCMP | 0.551 | 0.522         | 0.515    |\n\n**Efficiency Analysis**: We next analyze the time and GPU resource requirements of our method. The simplified KCMP only relies on a segmentation model (e.g., SAM) and a lightweight LVLM (Qwen2.5-VL-7B) for generating probing questions. All computations can be executed on a single NVIDIA RTX 5000 GPU (32 GB VRAM), indicating that our method does not impose demanding hardware requirements.\n\nFurthermore, the results presented in the following table show that the average time required to detect a single image is approximately 10.2 seconds. Given that membership inference attacks are typically performed offline and that the number of images involved in real-world detection tasks is often small- to moderate-scale (e.g., fewer than 10,000), we argue that our method is practically applicable.\n\nAdditionally, as a black-box approach, our method does not require local deployment of the target LLM. This feature significantly reduces the detection cost, particularly in terms of device-related expenses, and highlights the potential of our method for scalable application with large-scale target LVLMs.\n\n  |Stage|VL-MIA/Flickr|VL-MIA/DALL-E|\n  |-|-|-|\n  |SAM Runtime (s/image)|1.03|1.42|\n  |Probe Generation (s/image)|7.16|11.05|\n\nWe will incorporate these discussions and results into the revised manuscript. In addition, we will evaluate a further simplified variant of our method by replacing the SAM model with alternative lightweight segmentation models, in order to further demonstrate the efficiency potential of our approach.\n\n\n> Comment 2: High query overhead per image – Roughly 12 fine-grained probes, each repeated R times, are needed for a single membership decision; such dozens-of-queries overhead is expensive on metered APIs and increases the likelihood of detection or throttling. \n\nThank you for this valuable comment. We address it from the following four aspects: (1) Clarification of the actual number of probes used in our method. (2) Evaluation of detection performance under varying probe sizes or repetition times. (3) Estimation of the associated API costs.(4) Discussion of potential defense strategies.\n\n**Actual Number of Probes Used for Detection**: In our paper, we analyze the impact of probe size on detection performance in Figure 4. We also mention \"up to 12 probes\" in the related discussion to refer to the range of probe sizes used for performance analysis, rather than the actual hyper-parameter setting—an expression that may have led to misunderstanding. In practice, we set the maximum number of probes for detection to 5. The table below further presents the distribution of probes generated per image, showing that the average number of probes actually used during detection is approximately 4.12.\n\n\n|Dataset| 1 Probes | 2 Probes | 3 Probes | 4 Probes | >=5 Probes | Avg. Probes/Image|\n  |-|-|-|-|-|-|-|\n  |VL-MIA/Flickr| 16.6% | 13.6% | 13.4% | 14.1% | 42.2% |4.72|\n  |VL-MIA/DALL-E| 21.8% | 24.0% | 16.9% | 12.5% | 24.9% |3.22|\n  |API dataset| 7.9% | 11.3% | 16.4% | 16.4% | 48.0% | 4.98|\n\n\n**Impact of probe sizes or repetition times**: Figure 4 of our paper illustrates the impact of the number of probes on detection performance, demonstrating that using approximately five probes yields optimal results for our method. Furthermore, we evaluate the detection performance under a fixed probe size of five and varying query repetition times ($R = 1, 2, 3, 4$). The results indicate that reducing the repetition count from 4 to 2 leads to only a modest decline in detection performance, suggesting that fewer repetitions can be adopted to effectively reduce the API query overhead without significantly compromising accuracy.\n\n\n**API Costs**:In our method, the average number of probes generated per image is approximately 4.12. Assuming a query repetition count of $R = 4$, this results in an estimated 17 API calls per image. Each API query involves a single image (with a resolution of approximately 300×350 pixels) and a prompt of around 60 characters, along with the generation of several response tokens (e.g., choice outputs). Based on current pricing for SOTA models, we provide a detailed cost estimation in the table below. The results indicate that the cost of detecting 1,000 images targeting Claude-3.7 is approximately 0.60, demonstrating the practicality and cost-efficiency of our method. Moreover, by reducing the repetition count $R$ to 2, which has minimal impact on detection performance as previously discussed, the total cost can be further halved, enhancing scalability in real-world applications.\n\n|API Model|Image Price ($/image)|Text Price ($/1M tokens)|Query Price ($/Probe)|Estimated Cost($)|\n  |-|-|-|-|-|\n  |GPT-4o|0.000638|2.5|0.00079|0.01340|\n  |Gemini-2.5|0.001315|1.25|0.00139|0.02363|\n  |Claude-3.7|0.00042|3|0.00060|0.01020|\n\n**Discussion of potential defense strategies**: Although our method issues multiple queries to the target LLM for a single image, these queries are carefully designed to resemble genuine user inputs—such as requests for image descriptions or responses to natural questions—rather than malformed or adversarial content. Consequently, potential defense mechanisms targeting our approach may also incur substantial false positives on benign user queries, thereby degrading the overall user experience. Moreover, we acknowledge that no method can be entirely future-proof against all possible defenses. We will include a detailed discussion of this limitation in the revised manuscript.\n\n\n> Comment 3: Limited evaluation scope – Validation is confined to MiniGPT-4, LLaVA-1.5, and LLaMA-Adapter v2. No experiments demonstrate resilience under commercial endpoints (GPT-4o, Gemini, Claude) with real-world rate limits or safety filters; even a small-scale test on such services would strengthen the claim of practical applicability. There are some unlearning benchmark can be leveraged.\n\nThank you for your valuable suggestion. We have constructed an image-based MIA dataset targeting closed-source models to demonstrate the effectiveness of our method.\n\n**Dataset Construction**: Following the comments from you and Reviewer 9Jf3, we constructed the image MIA dataset by leveraging the knowledge cut-off dates of the target models. The table below presents the release dates and knowledge cut-off dates of two representative API-based LVLMs. Based on this information, we identified Flickr—a widely used data source for LVLM training—and selected images uploaded after July 1, 2024 as candidate non-members (i.e., likely unseen during training), while images uploaded before this date were considered members. We curated a pilot benchmark consisting of 200 images (100 members and 100 non-members) for preliminary evaluation. This dataset will be publicly released following the rebuttal period.\n\n  | API Model         | Release Date   | Knowledge Cut-off Date |\n  |---------------|----------------|-------------------------|\n  | GPT-4o-mini | May 13, 2024   | October 2023           |\n  | Gemini 1.5 | February 8, 2024| Early 2024 (estimated) |\n\n\n**Performance Evaluation**: We conducted experiments on the curated benchmark under realistic API constraints. The AUC results are summarized in the table below. This evaluation highlights the practical effectiveness of our method in detecting membership for closed-source models. We will include both the newly constructed dataset and the corresponding results in the revised manuscript. Additionally, we plan to incorporate more closed-source models (e.g., Claude) into the evaluation to further strengthen our analysis.\n\n\n  |Method|GPT-4o-mini|Gemini 1.5|\n  |-|-|-|\n  |KCMP| 0.566 | 0.572 |\n\n\nWe hope that our response adequately addresses your concerns and respectfully invite you to reconsider your initial evaluation. We remain fully committed to addressing any further comments or questions you may have."}, {"review_id": "C9kRYaJKrd", "reviewer": "Reviewer_gUWe", "summary": "This paper addresses the critical and underexplored challenge of performing membership inference attacks on LVLMs in a realistic black-box setting, where internal model representations are inaccessible. The authors introduce knowledge-calibrated memory probing (KCMP), a novel framework designed to disentangle memorization from generalization by formulating fine-grained semantic probing tasks. Through the use of semantic masking and systematically crafted object- and color-based queries, KCMP effectively isolates memory-driven signals that reveal training data exposure. The experimental evaluation is thorough, encompassing a range of target models and benchmark datasets. Empirical results demonstrate that KCMP consistently outperforms existing black-box approaches and, in certain scenarios, even surpasses recent gray-box baselines.", "questions": "Effect of Generation Hyperparameters: Since KCMP relies on model responses to semantically crafted queries, generation hyperparameters (e.g., temperature) may influence the model output and thus the inference performance. Could the authors provide an analysis or discussion on how such parameters affect the robustness and reliability of the membership inference attack?", "limitations": "Yes", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 3, "strengths_and_weaknesses": "# Strength:\n-Novel and Practical Methodology: This paper introduces a novel black-box membership inference framework tailored specifically for LVLMs, addressing a critical and previously underexplored problem. The approach is designed with practical constraints, particularly for commercial LVLM APIs where only textual outputs are available. This significantly enhances its applicability in real-world deployment settings.\n\n-Sound Algorithmic Design: The proposed knowledge-calibrated memory probing framework is conceptually well-founded and methodologically rigorous. In particular, the incorporation of a prior knowledge calibration module effectively distinguishes model memorization from generalization, which is central to robust membership inference.\n\n-Comprehensive Experimental Validation: The authors conduct extensive empirical evaluations across 4 LVLM targets and 3 benchmark datasets. The results demonstrate that KCMP is competitive with state-of-the-art gray-box approaches and consistently outperforms existing similarity-based black-box baselines, highlighting its efficacy and robustness.\n\n-Reproducibility and Clarity: The paper is clearly structured and well-written, making the methodology and experimental setup easy to follow. Additionally, the availability of a well-documented codebase promotes reproducibility and supports future research endeavors.\n\n\n# Weakness\n-Influence of Proxy Model Selection: The KCMP framework utilizes a proxy model for the prior knowledge calibration module, which plays a critical role in disentangling memorization from generalization. How sensitive is the proposed method to the choice of proxy model? Specifically, how does the inference performance vary when different language models are employed for knowledge calibration? A discussion or empirical analysis on this aspect would help assess the generalizability of the method.\n\n-Comparisons with Adapted Gray-box Variants: While the black-box baseline adopted in the study is understandably simple due to the limited literature on black-box membership inference for multimodal models, it would be valuable to explore whether existing gray-box methods can be adapted for black-box settings by removing internal access. Have the authors considered implementing such adapted variants as enhanced baselines? If so, how does KCMP perform in comparison? Including or discussing such enhanced baselines would better highlight the advantages of the proposed method.\n\n-Clarification of the Prior Knowledge Calibration Module: The mechanism by which the rationality of alternatives is evaluated in the prior knowledge calibration module remains somewhat unclear. It would be helpful if the authors could elaborate on the specific criteria or scoring functions used in this step. Additionally, including a concrete running example throughout the pipeline may aid in illustrating the logic and decisions made during calibration.", "was_revised": true, "final_justification": "I have carefully reviewed the author response, along with the newly presented experimental results and additional discussions, which have fully addressed my previous concerns. In particular, I also appreciate the inclusion of new experiments conducted on closed models, which extend beyond the scope of my initial review. These results provide further evidence of the practical effectiveness and generalizability of the proposed method. Accordingly, I will revise my score to reflect these improvements.", "rebuttal": "We appreciate the positive feedback and the recognition of our work’s strengths. Our response to the comments is as follows.\n\n> Comment 1: Influence of Proxy Model Selection: The KCMP framework utilizes a proxy model for the prior knowledge calibration module, which plays a critical role in disentangling memorization from generalization. How sensitive is the proposed method to the choice of proxy model? Specifically, how does the inference performance vary when different language models are employed for knowledge calibration? A discussion or empirical analysis on this aspect would help assess the generalizability of the method.\n\nThank you for raising this important question. We conducted an ablation to evaluate the sensitivity of KCMP to the choice of proxy model used in the prior knowledge calibration module. Our findings are summarized below:\n\n- Impact of Proxy Model Choice\n\n  We replaced GPT-4o with a lighter open-source model (LLaMA-3-8B) for knowledge calibration and measured the impact on KCMP performance on the VL-MIA/Flickr dataset using LLaVA as the target model.\n\n  | Used Proxy Model | LLaVA |\n  |-|-|\n  | GPT-4o | 0.598 |\n  | LLaMA-3-8B | 0.572 |\n\n  The above results suggest that KCMP is robust to the choice of filtering models and does not rely heavily on specific high-capacity models. We will include additional ablation results with other target models and datasets in the revised manuscript to further support this claim.\n\n\n\n> Comment 2: Comparisons with Adapted Gray-box Variants: While the black-box baseline adopted in the study is understandably simple due to the limited literature on black-box membership inference for multimodal models, it would be valuable to explore whether existing gray-box methods can be adapted for black-box settings by removing internal access. Have the authors considered implementing such adapted variants as enhanced baselines? If so, how does KCMP perform in comparison? Including or discussing such enhanced baselines would better highlight the advantages of the proposed method.\n\nWe appreciate this valuable suggestion. Below, we (1) discuss the design of black-box variants adapted from gray-box methods, and (2) present experimental results comparing them with KCMP. \n\n- Adapted Black-box Variants from Gray-box Methods\n\n  Directly removing internal access (e.g., logits) from gray-box methods renders their scoring functions inapplicable, as such methods rely heavily on internal signals. To address this, we designed two black-box variants based on ideas from prior gray-box MIA literature:\n \n  1.  Neighbourhood (adapted from [1])\n  \n      The original method computes loss differences between original and perturbed inputs, assuming member data lie in local minima.  \n      In our adaptation, we generate three perturbed versions of each test image (e.g., via rotation or cropping), concatenate them with the original, and prompt the model to rank them by familiarity. The rank position of the original image is used as the MIA score.\n\n\n  2. Entropy (adapted from [2])  \n      The original method uses loss or token-level confidence to distinguish members.\n\n      We compute the entropy of the output token distribution as a proxy for confidence, based solely on the generated text. The idea is that member samples produce more confident and focused responses, resulting in lower entropy.\n\n- Experimental Results\n\n  We evaluate both variants on two datasets and three target models. KCMP consistently outperforms these adapted baselines:\n\n  VL-MIA/Flickr:\n\n  |Method|LLaVA|LLaMA Adapter|MiniGPT4|\n  |-|-|-|-|\n  | Neighbourhood | 0.524 | 0.492 | 0.518 |\n  | Entropy | 0.537 | 0.506 | 0.489 |\n  | KCMP| 0.598 | 0.573 | 0.544 |\n\n  VL-MIA/DALL-E:\n\n  ||LLaVA|LLaMA Adapter|MiniGPT4|\n  |-|-|-|-|\n  | Neighbourhood | 0.495 | 0.503 | 0.493 |\n  | Entropy | 0.511 | 0.526 | 0.485 |\n  | KCMP| 0.565 | 0.568 | 0.543 |\n\n  These results demonstrate that while some intuition from gray-box designs can be translated into black-box settings, the resulting methods show limited performance. KCMP significantly outperforms these enhanced baselines, underscoring its strength in strictly black-box scenarios.\n\n\n[1] Mattern, Justus, et al. \"Membership inference attacks against language models via neighbourhood comparison.\" arXiv preprint arXiv:2305.18462 (2023).  \n[2] Yeom, Samuel, et al. \"Privacy risk in machine learning: Analyzing the connection to overfitting.\" 2018 IEEE 31st computer security foundations symposium (CSF). IEEE, 2018.\n\n\n\n> Comment 3: Clarification of the Prior Knowledge Calibration Module: The mechanism by which the rationality of alternatives is evaluated in the prior knowledge calibration module remains somewhat unclear. It would be helpful if the authors could elaborate on the specific criteria or scoring functions used in this step. Additionally, including a concrete running example throughout the pipeline may aid in illustrating the logic and decisions made during calibration.\n\n\nThank you for your helpful feedback. We clarify this question by (1) explaining the design objective of the Prior Knowledge Calibration (PKC) module, (2) detailing its implementation, and (3) providing a concrete running example to illustrate the workflow. \n\n- Objective: The PKC module enhances membership inference reliability by filtering out semantically implausible or irrelevant confusers. This ensures that only rational, contextually valid alternatives are retained, which is critical for generating meaningful contrast and amplifying membership signals.\n\n- Evaluation of Alternative Rationality: The plausibility of each confuser is assessed through a two-stage LLM-based process:\n    1. Contextual Textualization: Each masked image is converted into a natural language description, which captures the visible context of the image while disentangling model predictions from low-level visual patterns. It provides a textual prior that allows language models to reason about what could plausibly occupy the masked space.\n    2. Plausibility Scoring: Confuser candidates (objects or colors) are then scored for contexual plausibility. A candidate is retained if judged plausible (“Yes”); otherwise, it is discarded and regenerated, up to a fixed number of attempts.\n\n  This process ensures that only diverse, plausible, and semantically coherent alternatives are included in the final candidate set.\n\n- Illustrative Workflow: Given a masked image with the hidden object labeled as “dog”:\n    - The LLM first checks if “dog” is too obvious based on the masked image description (e.g., leash and walking woman); if so, this probe is skipped.\n    - Valid distractors (e.g., “cat”, “scooter”, “child”) are then evaluated for plausibility.\n    - Implausible candidates (e.g., “scooter”) are replaced via LLM-based filtering until three plausible alternatives are selected.\n\nWe will revise the paper to include this clarification and add a full example in the supplementary material."}, {"review_id": "DZFGnUBkHj", "reviewer": "Reviewer_9Jf3", "summary": "The paper introduces a method membership inference attack (MIA) method for testing if vision language models were trained on some image. Importantly, their method is entirely black-box, only require access to the output tokens of the target model, as opposed to logits or model internals.\n\nAt a high level, their method involves taking images and changing their content (either by placing patches over objects, or turning the image grayscale) and querying the target model about the resulting image (what object is under a patch or what color should an object be). The data is designed such that the model can only get the question correct if they have memorized the entire image (that is the answer cannot be reasonably inferred from the other contents of the time). \n\nTheir results are good. They outperform an existing black box baseline, and get results that are close to some methods that require model logits (in the certain scenarios).", "questions": "(1) Can you respond to (5) of the weaknesses section. Does this experiment seem reasonable to you? If so can you run it? If it does not can you explain why? To me it seems the main point of a black-box MIA is to detect if a closed source model trained on some data. So there needs to be some more treatment of how one would use the proposed approach in the paper to actually do this. Best would be an actual experiment doing this, like the one I have suggested. \n\n(2) In table 1, performance increases with K. Why do you only test to k=30? I seems that you have not hit diminishing returns at K=30? If this is true, why not increase K further?\n\n(3) Could you respond to point (6) of the weaknesses section.", "limitations": "Yes, they state clearly that their method underperforms methods that have access to model logits.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "# Strengths\n\n(1) The paper is clear and well written. I was able to understand the method well from section 3.\n\n(2) The experimental results are of a high quality. The authors test their method against a number of baselines. Moreover, section 4.3 contains ablations of key algorithm components. \n\n(3) The motivation for MIA is good, especially in the black box setting. Overall, the paper is contributing to an important problem.\n\n# Weaknesses\n\n(5) While the paper is motivated using frontier models that we only have black box access to, there are no results using these models. Now of course, the advantage of using white box models as the authors do is that we know what data they were trained on and what they were not, which is not true for closed source models, thus we cannot have collect AUROC of the method on closed source models.\n\nWith that being said, I wonder if it is possible to use image data released after a closed source models release as \"not in training set\", and some very common image data on the internet, e.g. imagenet, as \"assumed to be in the training set\". Reporting even just the average detection score on these two datasets for closed source models would be of value.\n\n(6) The baselines at the bottom of page 6 could be explained in more detail (you could link to an appendix section to do this). In particular, it is not clear to me what prompts you use for the baselines.", "was_revised": true, "final_justification": "The paper is well written and provides an interesting novel MIA attack algorithm. I had a concern regarding the efficacy against real world models, but the authors provided additional results along these lines during the rebuttal which addressed this concern. I recommend the paper for acceptance.", "rebuttal": "We appreciate the thoughtful review and the noted strengths on presentation, problem motivation and results of our paper. Our response to the queries and comments is as follows.\n\n> Question 1 and Comment (5): While the paper is motivated using frontier models that we only have black box access to, there are no results using these models. Now of course, the advantage of using white box models as the authors do is that we know what data they were trained on and what they were not, which is not true for closed source models, thus we cannot have collect AUROC of the method on closed source models. With that being said, I wonder if it is possible to use image data released after a closed source models release as \"not in training set\", and some very common image data on the internet, e.g. imagenet, as \"assumed to be in the training set\". Reporting even just the average detection score on these two datasets for closed source models would be of value.\n\nThank you for your valuable suggestion. We have constructed an image-based MIA dataset targeting closed-source models to demonstrate the effectiveness of our method.\n\n**Dataset Construction**: Following the comments, we constructed the image MIA dataset by leveraging the knowledge cut-off dates of the target models. The table below presents the release dates and knowledge cut-off dates of two representative API-based LVLMs. Based on this information, we identified Flickr—a widely used data source for LVLM training—and selected images uploaded after July 1, 2024 as candidate non-members (i.e., likely unseen during training), while images uploaded before this date were considered members. We curated a pilot benchmark consisting of 200 images (100 members and 100 non-members) for preliminary evaluation. This dataset will be publicly released following the rebuttal period.\n\n  | API Model         | Release Date   | Knowledge Cut-off Date |\n  |---------------|----------------|-------------------------|\n  | GPT-4o-mini | May 13, 2024   | October 2023           |\n  | Gemini 1.5 | February 8, 2024| Early 2024 (estimated) |\n\n\n**Performance Evaluation**: We conducted experiments on the curated benchmark under realistic API constraints. The AUC results are summarized in the table below. This evaluation highlights the practical effectiveness of our method in detecting membership for closed-source models. We will include both the newly constructed dataset and the corresponding results in the revised manuscript. Additionally, we plan to incorporate more closed-source models (e.g., Claude) into the evaluation to further strengthen our analysis.\n\n  |Method|GPT-4o-mini|Gemini 1.5|\n  |-|-|-|\n  |KCMP| 0.566 | 0.572 |\n\n> Question 2: In table 1, performance increases with K. Why do you only test to k=30? I seems that you have not hit diminishing returns at K=30? If this is true, why not increase K further?\n\nThank you for the question. We clarify our choice of $K$ as follows:\n\n$K$ defines an experimental setting, not a tunable hyperparameter: $K$ reflects the size of the candidate set in the evaluation and is not a parameter of our method. As expected, larger $K$ improves performance by aggregating more membership signals. We include additional results for other $K$ values below:\n\n|Method|Flickr (K=5)|Flickr (K=15)|Flickr (K=50)|DALL-E (K=5)|DALL-E (K=15)|DALL-E (K=50)|\n|-|-|-|-|-|-|-|\n|LLaVA|0.698|0.819|0.958|0.664|0.801|0.923|\n|LLaMA Adapter|0.658|0.760|0.910|0.687|0.742|0.926|\n|MiniGPT4|0.562|0.582|0.730|0.603|0.789|0.835|\n\n- Implication of $K$ in real-world scenarios  \n  In practice, users (e.g., creators) often hold large sample collections (hundreds or thousands), enabling larger $K$ and thus offering strong potential for high real-world performance.\n\n> Question 3 and Comment (6): The baselines at the bottom of page 6 could be explained in more detail (you could link to an appendix section to do this). In particular, it is not clear to me what prompts you use for the baselines.\n\nThank you for the helpful suggestion. We have added a section in *Appendix E* detailing the prompts used for KCMP and will include a dedicated section clarifying the baselines. Below is a brief explanation due to space constraints:\n\n- Gray-box baselines\n  For each image, these methods [1] generate a description using the prompt 'Describe this image', then construct an input sequence with the image, the prompt, and the description. Characteristic scores are computed from logit slices across different input regions during generation. We reproduce these baselines using the original open-source code to ensure fair comparison.\n\n- Black-box baselines\n  The only black-box baseline (Image Infer in Table 1) [2] measures the consistency of model outputs by computing the mean similarity among repeated descriptions of the same image. We use the same prompt (“Describe this image”) as in the original paper.\n  \n[1] Li, Zhan, et al. \"Membership inference attacks against large vision-language models.\" Advances in Neural Information Processing Systems 37 (2024): 98645-98674.  \n[2] Hu, Yuke, et al. \"Membership inference attacks against vision-language models.\" arXiv preprint arXiv:2501.18624 (2025)."}, {"review_id": "WOA5ipifno", "reviewer": "Reviewer_fTfC", "summary": "### Background\n- Existing MIA methods for LVLMs typically operate under white- or gray-box assumptions.\n- However, a few LVLMs typically only disclose the generated results while hiding their internal computational features.\n### Method\n- The authors propose a black-box MIA framework for LVLMs\n\nFirst, they introduce a semantic mask prediction task construction strategy.\n\nSecond, they propose a prior knowledge calibration mechanism.\n\nLast, the target LVLM is prompted and the training samples are identified.\n\n- Besides, this paper introduces a benchmark dataset based on the DAM model.\n\n### Results\n- The proposed method can effectively identify training data in purely black-box LVLM settings, achieving performance comparable to recent gray-box baselines.", "questions": "Please see the weaknesses section.", "limitations": "The authors discuss the limitations in the supplementary materials. I didn't see the discussion on potential negative societal impact.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "## Strengths\n- The proposed method KCMP operates under the black-box settings, which is more general compared to white- or gray-box MIA methods.\n- KCMP achieves comparable performance to recent gray-box baselines.\n- The ideas behind the method are intuitive and easy to understand.\n\n## Weaknesses\n### Major\n- The proposed mask prediction task uses shape- or color-based probe to identify training samples. But I’m wondering whether it’s still possible to construct these two types of probes for certain important training samples. For example, in the case of a patient’s X-ray image or someone's ID card, it might be very difficult to find appropriate objects or color in the images. \n- The authors use CLIP and GPT-o1 for filtering tasks (prior knowledge calibration). In the experiments, they show that this filtering mechanism consistently improves AUC across all models and KCMP variants. I'm wondering how much the filtering mechanism relies on CLIP and GPT-o1. If we use weaker models for filtering, will MIA performance decrease significantly?\n- Could the authors provide some cost estimation and comparison for their method? Because the proposed method needs to call GPT-o1 for filtering tasks and probe the black-box LVLM multiple times, I'm afraid that this method might lead to a high API calling cost for each sample.\n- The authors claim that they \"construct a benchmark dataset based on the DAM model\" and evaluate different methods on three benchmarks. But I didn't find the new benchmark in the method or experiment sections. Could the authors clarify that?\n### Minor\n- What does the $K$ mean in the experiments? Some methods like \"Min-K% Prob\" contain a hyperparameter $K$ while there is a dataset size $K$ in experiments. I'm confused here. For example, in table 1, what does it mean when $K$ increases from 1 to 30?\n- The authors emphasize that \"mainstream LVLMs\" generally only expose generated outputs. But I feel \"mainstream\" is kind of subjective. Currently, some popular LVLMs such as LLaVA, Qwen, InternVL and so on are open-source, and some proprietary models like GPT-4 also provide part of logit outputs via API. Thus, the authors are recommended to slightly modify their arguments.  \n- Typos:\n\nThere are often missing spaces between the main text and the citations, especially in the introduction section. \n\nLine 72, \"visual inputs\"\n\nLines 142-143, \"X_i\" should be $X_i$?", "was_revised": true, "final_justification": "Thank the authors for their detailed response!\n\nMost of my concerns have been addressed. \n\n- Current implementation is primarily designed for natural images and faces challenges when applied to specialized images with low semantic diversity or weak structure (e.g., X-rays, ID cards). The authors propose some possible directions to extend their method. Although the scope is kind of limited, the method is effective and it does not significantly diminish the value of this paper.\n\n- How much does the filtering mechanism rely on CLIP and GPT-o1? The authors conducted additional experiments. The proposed method is robust to different model selection. Addressed.\n\n- Could the authors provide some cost estimation and comparison for their method? The authors conducted additional experiments to show the cost of their method. Addressed.\n\n- Could the authors clarify how they construct a benchmark dataset based on the DAM model? Addressed.\n\nI raise my score to 5 and argue for the paper to be accepted.", "rebuttal": "We thank the reviewer for careful attention to the paper. Our response is as follows.\n> Comment 1: The proposed mask prediction task uses shape- or color-based probe to identify training samples. But I’m wondering whether it’s still possible to construct these two types of probes for certain important training samples. For example, in the case of a patient’s X-ray image or someone's ID card, it might be very difficult to find appropriate objects or color in the images.\n\nThank you for your thoughtful observation. We respond in three parts:\n(1) clarify the current scope,\n(2) explain why these domains are challenging, and\n(3) propose domain-specific extensions.\n\n- Current Scope.\n  We acknowledge that our current implementation is primarily designed for natural images and faces challenges when applied to specialized images with low semantic diversity or weak structure (e.g., X-rays, ID cards), where meaningful visual features (e.g., shape, color) are difficult to extract or segment. This is noted in the *Limitation* section of Supplementary Material.\n\n- Potential Solution.\n  Such images often exhibit subtle or uncommon patterns that are challenging to interpret, even for humans without domain expertise. To address this, it may be beneficial to incorporate domain-specific knowledge into the probe construction process of our KCMP method, enabling better adaptation to such specialized data. For instance, in medical images, auxiliary models such as saliency detectors [1] or organ/lesion segmenters [2] can help localize clinically relevant regions for generating semantically meaningful distractors. For ID cards, OCR models [3] can identify fields like names or ID numbers to guide probe generation. We plan to explore these extensions of KCMP in future work.\n\n> Comment 2: If we use weaker models for filtering, will MIA performance decrease significantly?\n\nThank you for the suggestion. We conducted new ablations regarding CLIP and filtering model to investigate this:\n\n- CLIP Model Impact\n\n  We replaced the default vit-large-p14-336 (used in the main paper) with weaker CLIP variants:\n  |Dataset|CLIP Model|Size|LLaVA|LLaMA Adapter|MiniGPT-4|\n  |-|-|-|-|-|-|\n  |VL-MIA/Flickr|vit-large-p14-336|~428M|0.598|0.573|0.544|\n  ||vit-base-p16|~151M|0.585|0.555|0.547|\n  ||vit-base-p32|~151M|0.592|0.550|0.532|\n  |VL-MIA/DALL-E|vit-large-p14-336|~428M|0.565|0.568| 0.543|\n  ||vit-base-p16|~151M|0.558|0.560|0.527|\n  ||vit-base-p32|~151M|0.552|0.544|0.534|\n\n- o1 Filtering Mechanism Impact\n\n  We replaced GPT-4o with a lighter open-source model (LLaMA-3-8B) in the prior knowledge calibration step. Performance on VL-MIA/Flickr and LLaVA model is shown below:\n  |Filtering Model|LLaVA|\n  |-|-|\n  |GPT-4o|0.598|\n  |LLaMA-3-8B|0.572|\n\nThese results show that KCMP is robust to the choice of filtering models and does not rely heavily on specific high-capacity models. We will include these results in the revision.\n\n> Comment 3: Could the authors provide some cost estimation and comparison for their method?\n\nWe address this in three parts:\n(1) the optional nature of GPT-o1 filtering,\n(2) trade-offs between query repetition and performance, and\n(3) API cost estimation per image.\n\n- 'GPT-o1 for filtering' is optional\n\n  The GPT-o1 filtering module provides performance gains but is not required. Removal incurs only modest performance degradation:\n  |Method|LLaVA|LLaMA Adapter|MiniGPT4|\n  |-|-|-|-|\n  |KCMP|0.598|0.573|0.544|\n  |KCMP (no GPT-4o filtering)|0.572|0.553|0.536|\n\n- Query Count Reduction via Fewer Repeats\n\n  By default, each probe is repeated R = 4 times. We evaluated the effect of using fewer repetitions on VL-MIA/Flickr:\n  |Method|LLaVA|LLaMA Adapter|MiniGPT4|\n  |-|-|-|-|\n  |KCMP (R=4)|0.598|0.573|0.544|\n  |KCMP (R=3)|0.579|0.558|0.536|\n  |KCMP (R=2)|0.585|0.560|0.515|\n  |KCMP (R=1)|0.548|0.531|0.519|\n\n  Reducing R from 4 to 2 causes a mild drop in AUC, indicating that fewer repetitions can be used to reduce cost.\n\n- Cost Estimation\n\n  The average number of probes per image is 4.12. Assuming R = 4, the total API calls per image is ~17. Each API query consists of a single image (~300×350 resolution) and a prompt of approximately 60 characters. Based on current public pricing, we estimate the per-image cost as follows:\n\n  |API Model|Image Price ($/image)|Text Price ($/1M tokens)|Estimated Cost($)|\n  |-|-|-|-|\n  |GPT-4o-mini|0.001275|0.15|0.0218|\n  |Gemini-2.5|0.001315|1.25|0.0014|\n  |Claude-3.7|0.00042|3|0.0006|\n\n  These costs are manageable—especially in use cases like copyright enforcement or model misuse detection, where the value at stake per image far exceeds the query cost.\n\n> Comment 4: The authors claim that they \"construct a benchmark dataset based on the DAM model\" and evaluate different methods on three benchmarks. But I didn't find the new benchmark in the method or experiment sections.\n\nThank you for pointing this out. Our response is structured as follows:\n(1) we explain how the DAM-based benchmark was constructed,\n(2) how it was used in our main paper experiments, and\n(3) provide additional baseline results.\n\n- Benchmark Construction\n\n  We created a dedicated benchmark using the DAM model [4], whose training data and segmentation annotations are publicly available. The goal was to build a transparent and controlled testbed.\n    - 200 member samples: drawn from DAM's released COCOStuff training set [5]\n    - 200 non-member samples: sampled from COCOStuff, ensuring no overlap with DAM's training data\n\n- Benchmark Usage in Experiments  \n  In Section 4.3 from main paper, we used DAM's segmentation annotations to study how region-level training annotations affect probe question effectiveness (Figure 4).\n \n- Additional Baseline Evaluation\n  We also benchmarked several MIA methods the dataset:\n\n  |Method|AUC|\n  |-|-|\n  |Perplexity (inst)|0.702|\n  |Perplexity (desp)|0.645|\n  |Max-Prob-Gap (inst)|0.601|\n  |Max-Prob-Gap (desp)|0.622|\n  |Min-K% (inst)|0.743|\n  |Min-K% (desp)|0.674|\n  |Image Infer (Rouge)|0.502|\n  |Image Infer (MPNet)|0.489|\n  |KCMP|0.584|\n\nWe will revise the manuscript to include benchmark details and add baseline comparisons.\n\n> Comment 5: What does the K mean in the experiments?\n\nThank you for pointing this out. To clarify the distinction:\n\n- $K$ in Table 1 and Experimental Results:  \nThis denotes the **dataset size** used in **set-level membership inference**. Specifically, it indicates the number of suspected samples included in each candidate set. \n\n- $K$ in \"Min-K% Prob\" and Similar Methods:  \nThis represents a **hyperparameter** that specifies the percentage of lowest-probability tokens (e.g., bottom 10%) used in computing the membership score for a single sample. \n\nWe will revise the manuscript to clarify this and avoid ambiguity in the notation.\n\n> Comment 6: The authors emphasize that \"mainstream LVLMs\" generally only expose generated outputs. But I feel \"mainstream\" is kind of subjective. Currently, some popular LVLMs such as LLaVA, Qwen, InternVL and so on are open-source, and some proprietary models like GPT-4 also provide part of logit outputs via API. Thus, the authors are recommended to slightly modify their arguments.\n\nThank you for the helpful feedback. We understand that the term \"mainstream\" may appear subjective and will revise our wording for clarity.\n\nOur key point is that many widely used LVLMs—especially commercial APIs—restrict access to model internals, making existing gray/white-box MIA methods inapplicable due to a misalignment between what these methods require and what commercial APIs provide:\n\n- **What gray/white-box MIAs need:**  \n  Traditional MIA methods estimate a model's confidence in generating a test sample by computing scores (e.g., generation loss [6]), which requires access to logits—typically needing gray/white-box access. For images and LVLMs (text output), recent gray-box methods [7] first generate a description from the target model, then construct an input sequence, i.e., image + prompt (instruction + generated description) and compute scores **using logit slices from different parts of the input sequence**:\n\n    - Image logits: Logits slice extracted from the complete logit sequence corresponding to the image embeddings.\n    - Prompt logits: Logits over prompt tokens.\n\n- **What commercial APIs expose:**  \n  Most commercial LVLM APIs do not expose token logits. Even in cases where partial logits are exposed (e.g., GPT-4o provides top 5 token logits per position), they are limited to the **generated output tokens** only, which are incompatible with existing MIA methods. \n\nWe surveyed several commercial LVLM APIs and summarized their accessibility below (we omit GPT-4 which you mentioned as it does not support image input):\n\n|Model/API|Image Logits|Prompt Logits|Output Logits|Applicable to Gray/White-box Methods|\n|-|-|-|-|-|\n|GPT-4o,GPT-4o-mini (OpenAI)|✘|✘|✔|✘|\n|grok-4 (xAI)|✘|✘|✔|✘|\n|Gemini (Google)|✘|✘|✔|✘|\n|Claude (Anthropic)|✘|✘|✘|✘|\n|hunyuan-large-vision (Tencent)|✘|✘|✘|✘|\n|Seed1.5-VL (ByteDance)|✘|✘|✘|✘|\n\nWe will revise the manuscript to clarify this and explicitly highlight our focus on the **black-box threat model**, which better reflects real-world deployments.\n\n> Comment 7:  Typos \n\nThank you for flagging typos and formatting issues. We have corrected them and carefully proofread the entire manuscript to ensure clarity and consistency in the revised version.\n\n[1] Wavnet—visual saliency detection using discrete wavelet convolutional neural network.\"  \n[2] Medical sam adapter: Adapting segment anything model for medical image segmentation.\"  \n[3] A convolutional neural network-based chinese text detection algorithm via text structure modeling.\"   \n[4] Describe anything: Detailed localized image and video captioning.\"   \n[5] https://huggingface.co/datasets/nvidia/describe-anything-dataset  \n[6] Copyright traps for large language models.\"  \n[7] Membership inference attacks against large vision-language models."}]

Author rebuttal:

Meta-review: This paper presents Knowledge-Calibrated Memory Probing, the first membership-inference attack that can reveal whether a specific image appeared in a large vision–language model’s (LVLM’s) training data when the attacker has only text-based, black-box access. Reviewers recognized that the importance of the problem, the novelty of the approach with extensive empirical results. During rebuttal, the authors addressed all the concerns, such as, heavy auxiliary tool and computational costs, evaluation scope (e.g., close models), and clarification about the constructed dataset.  In my view, this work is novel and addresses a practical concern, but the empirical results are not such convincing to make it practically useful (e.g., AUC<0.6 is close to a random guess), given the complex workflow and powerful auxiliary tools. All in all, I recommend an acceptance for this work, considering its contribution to the community.
Decision: Accept (poster)