Membership inference (MI) attacks try to determine if a data sample was used
to train a machine learning model. For foundation models trained on unknown Web
data, MI attacks can be used to detect copyrighted training materials, measure
test set contamination, or audit machine unlearning. Unfortunately, we find
that evaluations of MI attacks for foundation models are flawed, because they
sample members and non-members from different distributions. For 8 published MI
evaluation datasets, we show that blind attacks -- that distinguish the member
and non-member distributions without looking at any trained model -- outperform
state-of-the-art MI attacks. Existing evaluations thus tell us nothing about
membership leakage of a foundation model's training data.

成员推理攻击通过确定数据样本是否用于训练机器学习模型，可以检测版权训练材料，衡量测试集的污染程度或审计机器遗忘。然而，对于基于未知网络数据训练的基础模型的成员推理攻击的评估存在缺陷，因为它们从不同的分布中对成员和非成员进行采样。对于 8 个已发布的成员推理评估数据集，我们显示盲攻击 - 区分成员和非成员分布而不查看任何训练模型 - 胜过最先进的成员推理攻击。因此，现有的评估对于基础模型的训练数据的成员泄漏没有任何作用。