Elamur Research⌕
☰
home / papers / 2026 / EL-MIA: Quantifying Membership Inference Risks of Sensitive Entities in LLMs

EL-MIA: Quantifying Membership Inference Risks of Sensitive Entities in LLMs

Summary

Most membership inference attacks (MIA) on LLMs test whether a whole sequence, document or dataset was used in training. Privacy attackers, however, usually care about one sensitive value, such as a name or a phone number. The authors define an entity-level version of this problem, called EL-MIA. In their threat model, the adversary has a redacted training template with the PII slot masked, a pool of candidate values, and token-level log-probabilities from the model. The adversary must decide whether a given candidate filled that slot during training.

From the AI4Privacy dataset they derive a benchmark and further pre-train models from 160m to 6.9b parameters for up to four epochs. They then compare standard attacks with two new ones. The new methods score the candidate's suffix loss and normalise it against a reference set of synthetic entities of the same type.

Existing attacks barely beat chance. The reference-set approach is consistently strongest, which shows that the leakage is measurable with simple tools. This matters for auditing PII exposure, especially since NER-based scrubbing often misses sensitive spans.

Key points

  • The benchmark is built on AI4Privacy. Dataset-construction code is at github.com/alistvt/el-mia-data, and model checkpoints are on Hugging Face (collections/alistvt/el-mia).
  • Baselines are Lowest loss, Zlib, Min k% prob and Recall. The new methods are Lowest loss (suffix), Reference-set and Reference-set (suffix).
  • After one epoch, baseline scores in the main column stay around 51–54. Reference-set (suffix) reaches about 59–63 and has the best value at every model size.
  • Susceptibility grows with each epoch. Larger models jump sharply between epochs 2 and 3, then plateau. Early in training, a 1b model peaks first, which goes against the simple claim that bigger models memorise more.
  • Correlation between token length and TPR for the Reference-set attack increases with training (e.g., 0.14 to 0.49 for 6.9b). The study is limited to English, verbatim templates and a further pre-training setting.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

Fields: Linguistics & languages

Cite

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.63317/59k6vkt3biya

@inproceedings{satvaty2026el,
  title = {{EL-MIA: Quantifying Membership Inference Risks of Sensitive Entities in LLMs}},
  author = {Satvaty, Ali and Verberne, Suzan and Turkmen, Fatih},
  booktitle = {Proceedings of the Fifteenth Language Resources and Evaluation Conference},
  year = {2026},
  doi = {10.63317/59k6vkt3biya},
  url = {https://doi.org/10.63317/59k6vkt3biya}
}

References

46 references, 6 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. ai4Privacy. 2023. 1d4c0a1). pii-masking-200k (revision Mikhail Belkin, Daniel Hsu, Siyuan Ma, and Soumik Mandal. 2019. Reconciling modern machine-learning practice and the classical bias–variance trade-off. Proceedings of the National Academy of Sciences, 116(32):15849–15854. find
  2. Stella Biderman, Hailey Schoelkopf, Quentin Anthony, Herbie Bradley, Kyle O’Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, Aviya Skowron, Lintang Sutawika, and Oskar Van Der Wal. 2023. Pythia: a suite for analyzing large language models across trainin… find
  3. Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. 2023. Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Representations. find
  4. Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19), pages 267–284. find our card
  5. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21), pages 2633–2650. https… find our card
  6. Kent Chang, Mackenzie Cramer, Sandeep Soni, and David Bamman. 2023. Speak, memory: An archaeology of books known to ChatGPT/GPT-4. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 7312–7327, Singapore. Association for Computational Linguistics. find our card
  7. Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, Wei Ye, Yue Zhang, Yi Chang, Philip S. Yu, Qiang Yang, and Xing Xie. 2024. A survey on evaluation of large language models. ACM Trans. Intell. Syst. Technol., 15(3). find our card
  8. Shuai Cheng, Shu Meng, Haitao Xu, Haoran Zhang, Shuai Hao, Chuan Yue, Wenrui Ma, Meng Han, Fan Zhang, and Zhao Li. 2025. Effective {PII} extraction from {LLMs} through augmented {Few-Shot} learning. In 34th USENIX Security Symposium (USENIX Security 25), pages 8155–8173. find
  9. Zhichen Dong, Zhanhui Zhou, Chao Yang, Jing Shao, and Yu Qiao. 2024. Attacks, defenses and evaluations for LLM conversation safety: A survey. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: L… find
  10. Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. 2024. Do membership inference attacks work on large language models? In First Conference on Language Modeling. find
  11. André V. Duarte, Xuandong Zhao, Arlindo L. Oliveira, and Lei Li. 2024. De-cop: detecting copyrighted content in language models training data. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org. find
  12. Jamie Hayes, Ilia Shumailov, Christopher A. Choquette-Choo, Matthew Jagielski, George Kaissis, Katherine Lee, Milad Nasr, Sahra Ghalebikesabi, Niloofar Mireshghallah, Meenatchi Sundaram Mutu Selva Annamalai, Igor Shilov, Matthieu Meeus, Yves-Alexandre de Montjoye, Franziska Boenisch, Adam Dziedzic,… find
  13. Jamie Hayes, Marika Swanberg, Harsh Chaudhari, Itay Yona, Ilia Shumailov, Milad Nasr, Christopher A. Choquette-Choo, Katherine Lee, and A. Feder Cooper. 2025b. Measuring memorization in language models via probabilistic extraction. In Proceedings of the 2025 Conference of the Nations of the Americas… find
  14. Nils Homer, Szabolcs Szelinger, Margot Redman, David Duggan, Waibhav Tembe, Jill Muehling, John V Pearson, Dietrich A Stephan, Stanley F Nelson, and David W Craig. 2008. Resolving individuals contributing trace amounts of dna to highly complex mixtures using high-density snp genotyping microarrays.… find
  15. Masahiro Kaneko, Youmi Ma, Yuki Wata, and Naoaki Okazaki. 2024. Sampling-based pseudo-likelihood for membership inference attacks. find
  16. Imed Keraghel, Stanislas Morbieu, and Mohamed Nadif. 2024. Recent advances in named entity recognition: A comprehensive survey and comparative study. find
  17. Siwon Kim, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and Seong Joon Oh. 2023. ProPILE: Probing privacy leakage in large language models. In Thirty-seventh Conference on Neural Information Processing Systems. find
  18. Zhenhua Liu, Tong Zhu, Chuanyuan Tan, Bing Liu, Haonan Lu, and Wenliang Chen. 2024. Probing language models for pre-training data detection. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1576–1587, Bangkok, Thailand. Associa… find
  19. Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelin. 2023. Analyzing leakage of personally identifiable information in language models. In 2023 IEEE Symposium on Security and Privacy (SP), pages 346–363. IEEE. find
  20. Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. 2024. LLM dataset inference: Did you train on my dataset? In The Thirty-eighth Annual Conference on Neural Information Processing Systems. find
  21. Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schoelkopf, Mrinmaya Sachan, and Taylor Berg-Kirkpatrick. 2023. Membership inference attacks against language models via neighbourhood comparison. In Findings of the Association for Computational Linguistics: ACL 2023, pages 11330–113… find
  22. Matthieu Meeus, Shubham Jain, Marek Rei, and Yves-Alexandre de Montjoye. 2024a. Did the neurons read your book? document-level membership inference for large language models. In 33rd USENIX Security Symposium (USENIX Security 24), pages 2369–2385. find
  23. Matthieu Meeus, Igor Shilov, Manuel Faysse, and Yves-Alexandre De Montjoye. 2024b. Copyright traps for large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org. find
  24. Matthieu Meeus, Igor Shilov, Shubham Jain, Manuel Faysse, Marek Rei, and Yves-Alexandre de Montjoye. 2025. SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It) . In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 385–401, Los Alamitos, CA,… find
  25. Hamid Mozaffari and Virendra Marathe. Semantic membership inference attack against large language models. In Neurips Safe Generative AI Workshop 2024. find
  26. Ashwinee Panda, Xinyu Tang, Milad Nasr, Christopher A Choquette-Choo, and Prateek Mittal. 2025. Privacy auditing of large language models. arXiv preprint arXiv:2503.06808. — [arXiv:2503.06808](https://arxiv.org/abs/2503.06808) find
  27. Rahil Parikh, Christophe Dupuy, and Rahul Gupta. 2022. Canary extraction in natural language understanding models. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 552–560, Dublin, Ireland. Association for Computational Lingui… find
  28. Dzung Pham, Peter Kairouz, Niloofar Mireshghallah, Eugene Bagdasarian, Chau Minh Pham, and Amir Houmansadr. 2025. Can large language models really recognize your name? find
  29. Ali Satvaty, Suzan Verberne, and Fatih Turkmen. 2025a. Undesirable memorization in large language models: A survey. find
  30. Ali Satvaty, Anna Visman, Dan Seidel, Suzan Verberne, and Fatih Turkmen. 2025b. Memorization is language-sensitive: Analyzing memorization and inference risks of LLMs in a multilingual setting. In Proceedings of the First Workshop on Large Language Model Memorization (L2M2), pages 106–126, Vienna, A… find
  31. Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. 2024. Detecting pretraining data from large language models. In The Twelfth International Conference on Learning Representations. find
  32. Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE. find our card
  33. Thomas Vakili and Hercules Dalianis. 2021. Are clinical bert models privacy preserving? the difficulty of extracting patient-condition associations. In AAAI 2021 Fall Symposium on Human Partnership with Medical AI: Design, Operationalization, and Ethics (AAAI-HUMAN 2021), Virtual Event, November 4-6… find
  34. Thomas Vakili and Hercules Dalianis. 2023. Using membership inference attacks to evaluate privacy-preserving language modeling fails for pseudonymizing data. In Proceedings of the 24th Nordic Conference on Computational Linguistics (NoDaLiDa), pages 318–323, Tórshavn, Faroe Islands. University of Ta… find
  35. Cheng Wang, Yiwei Wang, Bryan Hooi, Yujun Cai, Nanyun Peng, and Kai-Wei Chang. 2025. Con-ReCall: Detecting pre-training data in LLMs via contrastive decoding. In Proceedings of the 31st International Conference on Computational Linguistics, pages 1013–1026, Abu Dhabi, UAE. Association for Computatio… find
  36. Johnny Wei, Ryan Wang, and Robin Jia. 2024. Proving membership in LLM pretraining data via data watermarks. In Findings of the Association for Computational Linguistics: ACL 2024, pages 13306–13320, Bangkok, Thailand. Association for Computational Linguistics. find
  37. Roy Xie, Junlin Wang, Ruomin Huang, Minxing Zhang, Rong Ge, Jian Pei, Neil Zhenqiang Gong, and Bhuwan Dhingra. 2024a. ReCaLL: Membership inference via relative conditional log-likelihoods. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 8671–8689, Mia… find
  38. Roy Xie, Junlin Wang, Ruomin Huang, Minxing Zhang, Rong Ge, Jian Pei, Neil Zhenqiang Gong, and Bhuwan Dhingra. 2024b. ReCaLL: Membership inference via relative conditional log-likelihoods. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 8671–8689, Mia… find
  39. Biwei Yan, Kun Li, Minghui Xu, Yueyan Dong, Yue Zhang, Zhaochun Ren, and Xiuzhen Cheng. 2024. On protecting the data privacy of large language models (llms): A survey. find
  40. Wentao Ye, Jiaqi Hu, Liyao Li, Haobo Wang, Gang Chen, and Junbo Zhao. 2024. Data contamination calibration for black-box LLMs. In Findings of the Association for Computational Linguistics: ACL 2024, pages 10845–10861, Bangkok, Thailand. Association for Computational Linguistics. find
  41. Shenglai Zeng, Yaxin Li, Jie Ren, Yiding Liu, Han Xu, Pengfei He, Yue Xing, Shuaiqiang Wang, Jiliang Tang, and Dawei Yin. 2024. Exploring memorization in fine-tuned language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pa… find
  42. Anqi Zhang and Chaofeng Wu. 2024. Adaptive pre-training data detection for large language models via surprising tokens. find
  43. Jingyang Zhang, Jingwei Sun, Eric Yeats, Yang Ouyang, Martin Kuo, Jianyi Zhang, Hao Frank Yang, and Hai Li. 2024. Min-k%++: Improved baseline for detecting pre-training data from large language models. arXiv preprint arXiv:2404.02936. — [arXiv:2404.02936](https://arxiv.org/abs/2404.02936) find
  44. Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, Yifan Du, Chen Yang, Yushuo Chen, Zhipeng Chen, Jinhao Jiang, Ruiyang Ren, Yifan Li, Xinyu Tang, Zikang Liu, Peiyu Liu, Jian-Yun Nie, and Ji-Rong Wen. 2025. A survey of l… find our card
  45. Zhenhong Zhou, Jiuyang Xiang, Chaomeng Chen, and Sen Su. 2024. Quantifying and analyzing entity-level memorization in large language models. In Proceedings of the Thirty-Eighth AAAI Conference on Artificial Intelligence and Thirty-Sixth Conference on Innovative Applications of Artificial Intelligenc… find
  46. Model Size Method Lowest loss Zlib Perplexity ratio Min k% prob Lowest loss (suffix) Reference-set Reference-set (suffix) 160m Lowest loss Zlib Perplexity ratio Min k% prob Lowest loss (suffix) Reference-set Reference-set (suffix) 410m Lowest loss Zlib Perplexity ratio Min k% prob Lowest loss (suffi… find

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/satvaty-2026-el-mia-quantifying-membership-inference/