# Neighborhood Deviation Attack Against In-Context Learning
## 5 Experiments
### Ablation Experiments
#### 5.5.5 Distribution of Metric Deviation  
This experiment aims to analyze the distribution of the metric deviations used in the Neighbor Deviation Attack. By examining the deviations of different evaluation metrics (including similarity, PPL, BLEU, and ROUGE-L), we aim to understand how the member states affect these metrics' deviations. This is of great significance for analyzing the feasibility and effectiveness of the Neighbor Deviation Attack. By analyzing the differences in the distribution of the metric deviations, we can further design and optimize our attack methods.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Train**} & \multicolumn{4}{c}{**Test**} \\ \cline{2-5}  & **LLaMA2\&TREC** & **LLaMA2\&AGNews** & **GPT2-XL\&TREC** & **GPT2-XL\&AGNews** \\ \hline LLaMA2\&TREC & / & 0.76 & 0.87 & 0.83 \\ LLaMA2\&AGNews & 0.88 & / & 0.82 & 0.91 \\ GPT2-XL\&TREC & 0.92 & 0.80 & / & 0.77 \\ GPT2-XL\&AGNews & 0.88 & 0.90 & 0.83 & / \\ \hline \hline \end{tabular}
\end{table}
Table 4: Attack model generalization across datasets and LLMs.The performance is measured in terms of Advantage.  
Figure 8: Confusion matrix of different attack models on DBPedia on LLaMA3. The confusion matrix is obtained by testing 200 data points, half of which are positive, while half are negative.  
From Figure 9, we can observe the following. Overall, the metric deviations of member samples are more concentrated within a specific range compared to non-member samples, allowing us to distinguish between them. Specifically, the BLEU deviation and ROUGE-L deviation of member samples exhibit significantly higher concentrations than those of non-member samples, making these two metrics particularly effective for differentiation. While the similarity deviation and PPL deviation of member samples are less concentrated than the former two metrics, they still demonstrate substantial distinctions from non-member samples, thereby also serving as viable criteria for classification. This provides a reliable basis for our proposed method to distinguish between member and non-member samples.  
Although the experimental results demonstrate that individual metric biases can be utilized independently for membership inference, relying solely on a single metric deviation proves suboptimal for achieving robust attack performance. This limitation arises because different models and datasets may exhibit varying degrees of sensitivity to each metric, potentially leading to inconsistencies across different attack scenarios. In pursuit of enhanced attack efficacy, we propose integrating metric deviations rather than relying on a single specific deviation for judgment. To this end, we employ the machine learning model mentioned above to comprehensively synthesize these deviations, thereby achieving superior accuracy and stability in attack performance.  
Figure 9: The membership distribution of four metric deviations. The result was obtained by conducting tests on two hundred data points. (**a**) Similarity deviation distribution between members and non-members. (**b**) PPL deviation distribution between members and non-members. (**c**) BLEU deviation distribution between members and non-members. (**d**) ROUGE-L deviation distribution between members and non-members.  
As shown in Figure 10, the performance achieved by combining multiple deviations clearly outperforms that obtained using any single metric. This validates the effectiveness of our integration strategy in enhancing the overall attack performance.