💻 computer science

Single-Sample Black-Box Membership Inference Attack against Vision-Language Models via Cross-modal Semantic Alignment

This paper proposes a novel single-sample black-box membership inference attack framework for Vision-Language Models that leverages cross-modal semantic alignment to detect training data memorization without relying on internal model outputs or large-scale statistical distributions.

Original authors: Jiaqing Li, Yajuan Lu, Xiaochuan Shi, Gang Wu, ZhongYuan Wang, Chao Liang

Published 2026-05-19

📖 4 min read☕ Coffee break read

CC0 1.0

Original authors: Jiaqing Li, Yajuan Lu, Xiaochuan Shi, Gang Wu, ZhongYuan Wang, Chao Liang

Original paper dedicated to the public domain under CC0 1.0 (http://creativecommons.org/publicdomain/zero/1.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Memory Leak" in AI

Imagine a Vision-Language Model (VLM) as a super-smart, well-traveled tour guide. This guide has read millions of books and seen millions of photos to learn how to describe the world.

The problem is that sometimes, this guide memorizes specific details about the exact photos they studied, rather than just learning general rules. If you show them a photo they've seen before (a "member"), they might describe it with perfect, specific details. If you show them a photo they've never seen (a "non-member"), they might guess, hallucinate, or get the details slightly wrong.

This paper is about a new way to catch a "leak" of private data. It asks: "Can we tell if a specific photo was in the guide's training library just by listening to how they describe it?"

The Problem with Old Methods

Before this paper, trying to catch this leak had two big hurdles:

The "Gray-Box" Problem: Some old methods required looking inside the guide's brain (checking their internal math scores or "logits"). But in the real world, companies don't let you peek inside their AI; they only let you ask questions and get answers.
The "Crowd" Problem: Other methods that did work without peeking inside required you to show the AI a huge stack of photos at once to find statistical patterns. But what if you only have one single photo to check? The old methods failed here.

The New Solution: CSA-MIA (The "Alignment Detective")

The authors propose a new method called CSA-MIA. It works in a strict "black-box" setting (you only see the output) and only needs one single photo.

Here is how it works, using an analogy:

The Setup:
Imagine you are a detective. You have a suspect photo (the one you want to check). You show it to the AI tour guide and ask, "Describe this picture as accurately as possible."

The Observation:

If the photo was in the training set (Member): The guide remembers it perfectly. They describe the bus, the leaves on the bus, and the people with high precision. The description matches the photo perfectly.
If the photo was NOT in the training set (Non-Member): The guide has to guess. They might say the bus is "parked in the snow" when it's actually on a sunny street, or they might mistake a toy tractor for a real one. The description is "hallucinated" and doesn't quite fit the visual reality.

The Trick (Cross-Modal Alignment):
The detective doesn't just listen to the story; they use a second, independent tool (a pre-trained AI called CLIP) to check the "vibe" match between the photo and the story.

The detective takes the Photo and turns it into a digital fingerprint (embedding).
They take the AI's Description and turn that into a digital fingerprint too.
They calculate the Cosine Similarity (a fancy way of saying "how close are these two fingerprints?").

The Verdict:

High Match: If the photo and the description are a perfect match, the AI likely memorized the photo. Verdict: It was in the training set.
Low Match: If the description sounds off or doesn't align with the visual details, the AI is guessing. Verdict: It was NOT in the training set.

Why This is a Big Deal

The paper tested this on several famous AI models (like LLaVA, MiniGPT-4, and even commercial ones like GPT-4 and Claude-3).

It works on single photos: You don't need a crowd of images to make a decision.
It doesn't need inside access: It works even if the company hides all their internal math.
It's tough: The method still works even if the photo is blurry, has noise, or is cropped (though if you crop out the main subject entirely, the detective gets confused).

The Results

In their tests, this new "Alignment Detective" was much better than previous methods.

On one dataset, it achieved a score of 0.821 (where 1.0 is perfect), significantly beating the old "crowd" methods which struggled to get above 0.6 or 0.7.
It successfully identified training data leaks in both open-source models and closed commercial APIs.

Summary

This paper introduces a clever way to catch AI models that have secretly memorized private or unauthorized photos. By simply asking the AI to describe a single photo and checking how well that description "aligns" with the actual image, we can tell if the AI has seen that photo before, without needing to hack into the AI's internal code or show it hundreds of other pictures.

Technical Summary: Single-Sample Black-Box Membership Inference Attack against Vision-Language Models via Cross-modal Semantic Alignment

Problem Formulation

Vision-Language Models (VLMs) rely on massive training datasets, raising concerns about unintended memorization and the subsequent leakage of private or unauthorized data. Membership Inference Attacks (MIAs) aim to determine whether a specific data sample was part of a model's training set. However, existing MIA methods for VLMs face two critical bottlenecks in realistic deployment scenarios:

Gray-Box Limitations: Many effective methods rely on accessing internal model logits or token-level probabilities. In real-world API interactions, these internal states are typically restricted, rendering such methods impractical.
Single-Sample Limitations: Existing black-box methods often require large-scale datasets to establish statistical distributions for inference. They struggle significantly in "few-shot" or strict single-sample scenarios where an attacker has access to only one image and its corresponding textual response.

This paper addresses the most restrictive yet realistic threat model: conducting a membership inference attack on a single sample under strict black-box conditions, where the attacker can only query the target VLM with an image and a text prompt and observe the generated text response.

Methodology: CSA-MIA

The authors propose CSA-MIA (Cross-modal Semantic Alignment Membership Inference Attack), a framework that leverages the "memorization effect" inherent in VLM training.

Core Insight

Through qualitative and quantitative analysis, the authors observe a distinct difference in how VLMs process member versus non-member images:

Member Images: The model exhibits stronger "memorization," generating descriptions with precise, specific attributes that align closely with the visual content (e.g., accurate object identification and scene details).
Non-Member Images: The model is more prone to "semantic hallucinations," generating descriptions that deviate from the visual reality (e.g., misidentifying objects, inventing non-existent features, or describing incorrect environments).

Attack Pipeline

CSA-MIA quantifies this alignment without accessing internal model states:

Generation Stage: The attacker queries the target VLM ( $M$ ) with a target image ( $x$ ) and a textual instruction ( $T_{in}$ ) to generate a textual description ( $T_{out}$ ).
Inference Stage: An external, pre-trained cross-modal encoder (e.g., CLIP), independent of the target VLM, is used to extract embeddings for both the input image ( $\Phi_{img}(x)$ ) and the generated text ( $\Phi_{txt}(T_{out})$ ).
Scoring: The cosine similarity between the image and text embeddings is computed as the membership signal:
$\text{Score}(x, T_{out}) = \frac{\Phi_{img}(x) \cdot \Phi_{txt}(T_{out})}{\|\Phi_{img}(x)\| \|\Phi_{txt}(T_{out})\|}$
Threshold Selection: To make a binary decision without prior knowledge of the target's training distribution, the method employs an auxiliary reference set ( $D_{ref}$ ) consisting of confirmed non-member samples (e.g., synthesized data or data released after the model's cutoff). The decision threshold ( $\lambda$ ) is set as the average alignment score computed over this reference set. If $\text{Score}(x, T_{out}) > \lambda$ , the sample is classified as a member.

Key Contributions

Novel Threat Model: The paper investigates and formalizes the challenging scenario of MIA against VLMs in a strict black-box, single-sample setting, moving beyond the dataset-level or gray-box assumptions of prior work.
Cross-Modal Alignment Signal: The authors identify and exploit the discrepancy in cross-modal semantic alignment as a robust signal for membership inference. They demonstrate that member images exhibit significantly higher alignment between visual content and generated text compared to non-members.
CSA-MIA Framework: A practical attack framework is proposed that bypasses the need for internal logits or large-scale statistical references, relying instead on an external encoder and a small auxiliary reference set.
Comprehensive Evaluation: The method is validated across three open-source models (LLaVA-1.5, MiniGPT-4, LLaMA Adapter v2) and two closed-source APIs (GPT-4, Claude-3) on multiple datasets.

Experimental Results

The experiments demonstrate that CSA-MIA consistently outperforms existing baselines:

Performance on Open-Source Models: On the VL-MIA/Flickr dataset with LLaVA-1.5, CSA-MIA achieves an AUC of 0.821, significantly surpassing the best gray-box baselines (e.g., MaxRényi-Max-100% at 0.723) and black-box baselines (Image-only Inference at 0.587).
Closed-Source Models: The method remains effective against commercial APIs. Against GPT-4 (partial gray-box access), it achieves an AUC of 0.736, outperforming all gray-box baselines which often fell below random guessing (AUC < 0.5). Against Claude-3 (strict black-box), it achieves an AUC of 0.738.
Robustness: The attack remains robust under diverse image perturbations (blur, noise, compression, cropping, etc.), maintaining an AUC above 0.7 in most scenarios, except for extreme cropping that removes the primary semantic subject.
Ablation Studies: The method is shown to be robust to variations in embedding models (CLIP, SLIP, FLIP), description lengths, sampling temperatures, and prompt formulations.

Significance and Claims

The paper claims that CSA-MIA highlights the inherent privacy risks in deployed VLMs, demonstrating that even without access to internal model parameters or large datasets, an attacker can effectively infer training data membership from a single query.

The authors emphasize that their findings:

Reveal that training data leakage is a tangible risk in VLMs, driven by the model's tendency to memorize specific visual-textual pairs.
Provide a practical tool for privacy auditing in black-box scenarios, which is critical for detecting unauthorized or infringing image usage in real-world applications.
Suggest that the "memorization effect" creates a detectable signal in the joint embedding space, challenging the assumption that black-box access sufficiently protects training data privacy.

The work concludes by noting that these insights support the need for responsible deployment and potential mitigation strategies against unauthorized data usage in vision-language systems.