This is the official repository of the paper "Membership Inference on LLMs in the Wild".

Membership Inference Attacks (MIAs) act as a crucial auditing tool for the opaque training data of Large Language Models (LLMs). However, existing techniques predominantly rely on inaccessible model internals (e.g., logits) or suffer from poor generalization across domains in strict black-box settings where only generated text is available. In this work, we propose SimMIA, a robust MIA framework tailored for this text-only regime by leveraging an advanced sampling strategy and scoring mechanism. Furthermore, we present WikiMIA-25, a new benchmark curated to evaluate MIA performance on modern proprietary LLMs. Experiments demonstrate that SimMIA achieves state-of-the-art results in the black-box setting, rivaling baselines that exploit internal model information.

• [2026-01-19] 🔥 We release the code of our paper. The detailed instructions can be found below.

SaMIA

SimMIA

Compared to SaMIA, a representative black-box MIA baseline, SimMIA advances it by:

1. Word-by-Word Sampling: SimMIA samples the immediate next word for every possible prefix rather than a complete continuation for a fixed-length prefix.
2. Semantic Scoring: SimMIA relies on soft embedding-based similarity to score each word rather than surface-form exact matching.
3. Relative Aggregation: SimMIA computes the relative ratio between scores perturbed by non-members and unperturbed scores.

• WikiMIA: SOTA black-box MIA, improving AUC by +16.6 over prior black-box baselines and even surpassing the best gray-box method on some models (e.g., OPT-6.7B).

  Detailed WikiMIA results.

  

• MIMIR: +14.9 AUC over previous SOTA black-box performance, trailing the best gray-box methods by only 3.4 AUC points on average.

  Detailed MIMIR results.

  

• WikiMIA-25: generalizes to both legacy and latest (including proprietary) LLMs, outperforming the best black-box baseline by +21.7 AUC and +25.8 TPR@5%FPR.

  Detailed WikiMIA-25 results.

  

Our implementation is based on python=3.12. Follow the commands below to prepare the Python environment (we recommend using Miniconda to setup the environment):

# git clone this repository
git clone https://github.com/simmia2026/SimMIA.git
cd simmia

# install dependencies
conda create -n simmia python=3.12
conda activate simmia
pip install -e .

If you want to experiment with closed-source LLM APIs, please run pip install -e .[api].

Before testing closed-source LLMs, export your API keys into the environment first:

export OPENAI_API_KEY="your-actual-api-key-here"
export GOOGLE_API_KEY="your-actual-api-key-here"
export ANTHROPIC_API_KEY="your-actual-api-key-here"

Here is an example of testing SimMIA in Pythia-6.9B with WikiMIA-25 (8 GPUs):

simmia.benchmark
  --gpu_ids 0 1 2 3 4 5 6 7
  --model_name_or_path EleutherAI/pythia-6.9b
  --sampling relative_word_by_word
  --postprocess process_relative_word_data
  --inference relative_semantic_ratio
  --output_dir simmia_out
  --num_samples 100
  --data SimMIA/WikiMIA-25
  --sub_dataset paper_subset
  --num_shots 7
  --prefix_ratio 0.0
  --top_k 20

Key Argument Explanations:

• --sampling: the way to sample continuations from LLMs. You can perform either word-by-word sampling like SimMIA or complete continuation from a fixed-length prefix like SaMIA.
• --postprocess: some necessary data preparation, especially for SimMIA.
• --inference: which method is used to compute the membership score.

To experiment with closed-source model APIs, simply add --concurrency to control the maximum number of parallel API requests, and prefix the API-based model name with api:. Here is an example that modifies the previous example to test Gemini 2.5 Flash:

simmia.benchmark
  --concurrency 5
  --gpu_ids 0 1 2 3 4 5 6 7
  --model_name_or_path api:google/gemini-2.5-flash
  ...  # others remain the same as the above

We provide scripts to reproduce the results of SaMIA, SimMIA*, and SimMIA reported in the paper.

cd simmia

# SaMIA
bash scripts/run_samia.sh <MODEL NAME OR PATH> <DATA> <SUB_DATASET> [GPU_IDS] [CONCURRENCY]

# SimMIA*
bash scripts/run_simmia_hard.sh <MODEL NAME OR PATH> <DATA> <SUB_DATASET> [GPU_IDS] [CONCURRENCY]

# SimMIA
bash scripts/run_simmia_soft.sh <MODEL NAME OR PATH> <DATA> <SUB_DATASET> [GPU_IDS] [CONCURRENCY]

Valid SUB_DATASET values for different DATA:

• For swj0419/WikiMIA: WikiMIA_length32, WikiMIA_length64, WikiMIA_length128, WikiMIA_length256 (or just 32, 64, 128, 256)
• For SimMIA/WikiMIA-25: WikiMIA_length32, WikiMIA_length64, WikiMIA_length128, paper_subset (or just 32, 64, 128 for length values)
• For iamgroot42/mimir: wikipedia_(en), github, pile_cc, pubmed_central, arxiv, dm_mathematics, hackernews

To reproduce the results of most gray-box MIAs (e.g., Loss/Reference/Zlib/Neighborhood/Min-K%/Min-K%++/ReCaLL) reported in the paper, please refer to the official MIMIR repo.

To reproduce the result of PETAL, please refer to the official artifacts.

Please cite our paper if you find our work useful:

@misc{yi2026membership,
      title={Membership Inference on LLMs in the Wild}, 
      author={Jiatong Yi and Yanyang Li},
      year={2026},
      eprint={2601.11314},
      archivePrefix={arXiv},
      primaryClass={cs.CL},
      url={https://arxiv.org/abs/2601.11314}, 
}