ai-research-survey

scan.json (31505B)

---

 {
   "paper": {
     "title": "Exposing Privacy Gaps: Membership Inference Attack on Preference Data for LLM Alignment",
     "authors": [
       "Qizhang Feng",
       "Siva Rajesh Kasa",
       "Santhosh Kasa",
       "Hyokun Yun",
       "Choon Hui Teo",
       "Sravan Bodapati"
     ],
     "year": 2025,
     "venue": "International Conference on Artificial Intelligence and Statistics (AISTATS) 2025",
     "arxiv_id": "2407.06443",
     "doi": "10.48550/arXiv.2407.06443"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["theoretical", "benchmark-eval"],
   "key_findings": "DPO-aligned LLMs are significantly more vulnerable to membership inference attacks (MIA) than PPO-aligned models, both theoretically (due to overfitting on preference data) and empirically (AUROC up to 0.93 for DPO vs ~0.52 for PPO on tuple detection). The novel PREMIA reference-based attack framework, which leverages the base/SFT model as a reference, consistently outperforms existing MIA baselines. The relationship between model size and MIA vulnerability is nuanced, depending on task complexity—larger pretrained models on easier tasks are less susceptible. PPO provides comparable utility to DPO while offering substantially better privacy protection.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper's own reproducibility checklist claims code is available 'as footnotes in §4.2', but these footnotes only link to external packages (TRL, PEFT, BitsAndBytes), not the authors' own experiment code. No repository URL or code archive is provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The experiments use publicly available datasets: Stack-Exchange-Paired (https://huggingface.co/datasets/lvwerra/stack-exchange-paired) and IMDB-RLHF-Pair (Rafailov et al., 2024). Both are accessible without restriction."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Appendix C lists package names (TRL, PEFT, BitsAndBytes) and LoRA settings, but provides no version numbers for any library, no requirements.txt, and no environment specification sufficient to recreate the setup."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. Appendix C has implementation details (hyperparameters, training settings) but no commands, scripts, or README-style guide to replicate the experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All AUROC scores in Tables 1, 2, 3, 4, and 5 are reported as single point estimates with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims DPO is more vulnerable than PPO and that PREMIA outperforms baselines based solely on comparing raw AUROC numbers. No statistical significance tests (t-tests, bootstrap, etc.) are applied to any comparison."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not report formal effect sizes. Raw AUROC values are presented in tables, but no Cohen's d, relative improvement, or other effect size measures are computed for DPO-vs-PPO or PREMIA-vs-baseline comparisons."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "80k training examples are used for SE and 20k for IMDB. No justification is given for these sizes, no power analysis is performed, and no discussion of whether these sizes are sufficient for the statistical claims being made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance across seeds, or any spread measures are reported. All results appear to be single-run experiments."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Multiple MIA baselines are compared: Perplexity (Yeom et al., 2018), Zlib (Carlini et al., 2021), Lowercase (Carlini et al., 2021), Ref, MIN-K (Shi et al., 2023), and Neighbourhood attack (Mattern et al., 2023). See Table 1 and Appendix A."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent methods: MIN-K% PROB (Shi et al., 2023/2024), DC-PDD (Zhang et al., 2024), and ReCALL (Xie et al., 2024). The Neighbourhood attack is from 2023. These represent the state of the art in LLM MIA."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper ablates the reference model choice: PREMIA-base (pretrained model as reference) vs PREMIA-SFT (SFT model as reference). Table 3 tests cross-family reference models (Open-llama-3b/7b swapped). Individual vs tuple attack modes are also compared."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "MIA performance uses AUROC across Chosen, Rejected, and Pair attack modes. Utility evaluation uses 10+ metrics: Reward, Perplexity, MSTTR-100, Distinct-1/2, Unique-1/2, BERTScore, ROUGE, BLEU, METEOR (Table 2)."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "Human evaluation is not relevant to MIA vulnerability assessment, which is inherently a statistical detection task measured by AUROC."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "MIA evaluation inherently requires separation: training data (members) vs non-training data (non-members). SE uses data/rl for training and data/evaluation for validation. IMDB uses 20k for training and remaining for evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by model (9 models across GPT2 and larger families), dataset (SE, IMDB), response type (Chosen, Rejected, Pair), and attack method. Tables 1, 4, and 5 provide detailed per-category results."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3.2 discusses where MIA is less effective: larger models on easier tasks (IMDB), PPO being nearly impervious (AUROC ~0.5), and the nuanced relationship between model size and vulnerability. Fig. 3 shows rapid DPO convergence explaining fast overfitting."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "PPO is shown to be nearly impervious to all MIA frameworks (AUROC ~0.5 in most settings). Table 4 IMDB results show PREMIA tuple detection fails for larger models (AUROC 0.500-0.556). Traditional MIA methods on GPT2 are barely above random (Table 5)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims (1) theoretical motivation for DPO vulnerability is supported by §2.4 Propositions 1-3 and Theorem 2.1; (2) PREMIA framework is introduced in §3 and validated in §4; (3) empirical demonstration of DPO vulnerability is supported by Tables 1 and 4."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper claims 'DPO tends to overfit on the preference data vis à vis PPO' and provides both theoretical justification (Propositions 1-2 show DPO has tighter training-error bounds) and controlled comparisons (same data, same base models, DPO vs PPO as the only variable)."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper generally stays within its evidence bounds, qualifying findings by model family and task difficulty. Section 4.3.2 notes the relationship between model size and vulnerability is 'more nuanced, depending on the task complexity.' The theoretical results are explicitly framed with their assumptions."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper attributes DPO's higher vulnerability entirely to overfitting via its theoretical framework. It does not discuss alternative explanations such as differences in training hyperparameters (DPO lr=5e-4 vs PPO lr=5.4e-5), training epochs, LoRA convergence behavior, or whether the reward model in PPO acts as a regularizer beyond the KL penalty."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures AUROC on membership inference, which directly corresponds to the claimed privacy vulnerability. No proxy gap exists—AUROC on train/non-train classification is the standard measure for MIA effectiveness."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model versions are stated: Gemma-2-2B, Mistral-7B-v0.3, Mistral-7B-v0.1, Open-llama-3b, Open-llama-7b, GPT2, GPT2-medium, GPT2-large, GPT2-xl. These are identifiable open-source model checkpoints."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not use prompting as a methodology. It trains and fine-tunes models on preference datasets. Prompts come from the datasets themselves, not from experiment design."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C provides detailed hyperparameters for SFT (lr=8e-5, epochs=2, batch=4, warmup=100, etc.), PPO (lr=5.4e-5, batch=16, KL coef=0.1, PPO epochs=6, etc.), DPO (lr=5e-4, epochs=3, beta=0.4, etc.), and LoRA settings (alpha=32, dropout=0.05, r=16)."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The paper trains and evaluates models directly."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Data splits are documented: SE uses data/rl for training (80k selected) and data/evaluation for validation. IMDB uses 20k for training and remaining for validation. Maximum length constraints are specified (prompt: 256, sequence: 1024, output: 128 for PPO)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 5 'Conclusion and Limitations' contains a substantive paragraph discussing limitations including: no exploration of mitigation techniques (DP-SGD, model pruning, privacy-aware losses), and PREMIA's requirement for base model access limiting applicability to closed-source LLMs."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations are specific to this study: (1) PREMIA's optimistic assumption of base model access limits real-world applicability for closed-source models; (2) the paper focuses only on DPO and PPO, leaving other alignment methods unexamined; (3) mitigation strategies like DP-SGD are not explored."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper states: 'While we have focused on highlighting MIA vulnerabilities, we haven't touched upon the various ways to mitigate them.' It also notes PREMIA works for open-source models only: 'there is a need for designing effective frameworks for closed-source LLMs where there is no access to the base model.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The source datasets (SE, IMDB) are public, but the trained model checkpoints, intermediate outputs, and raw AUROC computation results are not released for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "The datasets are described: SE contains Stack Overflow questions/answers with vote-based preferences; IMDB-RLHF-Pair has sentiment-based preferences. Data splits and sizes are specified in §4.2."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from publicly available benchmark datasets (Stack Exchange, IMDB)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented across sections: public datasets → SFT training → PPO/DPO alignment → MIA evaluation using various frameworks → AUROC computation. Implementation details in Appendix C cover each stage."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding disclosure or acknowledgments section is present. All authors are from Amazon Inc. but no statement about funding source is provided."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All authors are listed under 'Amazon Inc.' affiliation on the first page."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Amazon (the implied funder) does not have a specific commercial stake in DPO being more vulnerable than PPO. The paper evaluates open-source models, not Amazon products."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial disclosure is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper trains models on specific preference datasets to study MIA vulnerability. It does not evaluate a pre-trained model's capability on a benchmark—the evaluation measures attack effectiveness on aligned models."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper studies MIA (detecting training data membership), not model knowledge on benchmarks. Train/test separation is the experimental variable, not a contamination concern."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests an attack framework's ability to detect training data membership, not a model's benchmark performance. Standard benchmark contamination concepts do not apply."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study is entirely computational, evaluating models on public datasets."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All experiments involve model training and automated evaluation."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference costs, API costs, or timing information reported for either the alignment training or the MIA evaluation. The computational cost of running PREMIA or baselines is not quantified."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No GPU hours, hardware specifications, or total compute budget is stated, despite training 9 models with both DPO and PPO across two datasets. The paper's own checklist claims computing infrastructure is described, but it is not visible in the provided text."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds. All results appear to be from single runs. Given that MIA evaluation depends on model training, which is stochastic, seed sensitivity is relevant but unreported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. It is unclear whether results are from a single run or averaged across multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is described. The paper uses fixed hyperparameters (Appendix C) without explaining how they were selected or how many configurations were tried."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses specific hyperparameter configurations (e.g., DPO lr=5e-4, beta=0.4; PPO lr=5.4e-5, KL coef=0.1) without justifying why these were chosen or how they were selected."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes many comparative claims across 9 models × 8 attack methods × 2 datasets × 3 response types, but performs no formal statistical tests at all, let alone corrections for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors compare their PREMIA framework against baselines without acknowledging potential bias in running baselines in their own experimental setup. No independent evaluation or acknowledgment of author-evaluation bias."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "DPO and PPO have different computational requirements (DPO is typically cheaper as it skips reward model training), but the paper does not report or compare compute budgets for the two approaches."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "AUROC is used as the sole MIA metric without discussing whether it adequately captures real-world privacy risk. No discussion of whether AUROC on these specific datasets generalizes to actual privacy threats in deployment."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. The paper directly trains and evaluates models."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The base pretrained models (Mistral, Llama, GPT2) may have been trained on data overlapping with Stack Exchange or IMDB, which could affect baseline probability distributions and thus PREMIA's reference-based comparisons. This is not discussed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup might leak information. For instance, using the same base model for reference and alignment could create subtle dependencies not accounted for."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Train and non-train splits come from the same dataset distribution. No discussion of whether structural similarities between member and non-member examples could affect MIA evaluation validity."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete method is used to detect whether base pretrained models may have seen the preference data during pretraining, which could confound the MIA results."
       }
     }
   },
   "claims": [
     {
       "claim": "DPO-aligned models are more vulnerable to membership inference attacks than PPO-aligned models.",
       "evidence": "Theoretical: Propositions 1-2 show DPO has tighter training-error bounds (overfits more), Proposition 3 proves M(πDPO, z1) ≥ M(πPPO, z1) under MALT assumption, Theorem 2.1 provides a general lower bound linking overfitting to MIA susceptibility. Empirical: Tables 1 and 4 show consistently higher AUROC for DPO across all models, datasets, and attack methods.",
       "supported": "moderate"
     },
     {
       "claim": "PREMIA consistently achieves higher AUROC than existing MIA frameworks on DPO-aligned models.",
       "evidence": "Table 1 shows PREMIA-SFT achieves highest or second-highest AUROC in most DPO columns across Gemma-2-2B, Mistral-7B, Open-llama models. For SE tuple detection, PREMIA reaches 0.93 (Figure 2) vs ~0.5-0.6 for baselines. Table 4 confirms across GPT2 series.",
       "supported": "moderate"
     },
     {
       "claim": "PPO provides similar utility performance to DPO with substantially lower MIA vulnerability.",
       "evidence": "Table 2 shows Mistral-7B PPO has better Reward (-0.771 vs -1.035), comparable BERTScore (0.883 vs 0.877), ROUGE (0.457 vs 0.443), while MIA AUROC is ~0.52 vs 0.80-0.93 for DPO.",
       "supported": "weak"
     },
     {
       "claim": "The relationship between model size and MIA vulnerability depends on task complexity.",
       "evidence": "Section 4.3.2: GPT2 models show higher vulnerability on DPO than larger models (Table 4 SE vs Table 1). For easier IMDB task, larger models like Mistral-7B show lower vulnerability. Fig. 3 shows Mistral-7B achieves >90% DPO accuracy in 0.2 epochs on IMDB, indicating rapid convergence on easy tasks.",
       "supported": "moderate"
     },
     {
       "claim": "DPO overfits on preference data more than PPO, which is the theoretical mechanism behind its higher MIA vulnerability.",
       "evidence": "Propositions 1-2 show DPO's error bound on training data is 2εr (reward error only) while PPO's population bound includes +2εy (response distribution error), indicating DPO fits training distribution better. Theorem 2.1 connects overfitting probability to MIA score lower bound.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or uncertainty quantification",
       "detail": "All AUROC scores across Tables 1-5 are single point estimates. No confidence intervals, standard deviations, or multiple-run statistics are reported. Many DPO-vs-PPO differences are small (e.g., 0.56 vs 0.53) and could be within noise."
     },
     {
       "flag": "No significance tests for comparative claims",
       "detail": "The paper makes extensive claims about DPO being more vulnerable than PPO and PREMIA outperforming baselines, but no statistical significance tests support any of these comparisons. Hundreds of pairwise comparisons are made by visual inspection alone."
     },
     {
       "flag": "Confounded DPO-vs-PPO comparison",
       "detail": "DPO and PPO use substantially different hyperparameters (DPO lr=5e-4 vs PPO lr=5.4e-5; DPO beta=0.4; different epoch counts; PPO has reward model). The vulnerability difference could partially stem from these hyperparameter choices rather than the alignment method itself."
     },
     {
       "flag": "Utility comparison on single model/dataset only",
       "detail": "The privacy-utility trade-off analysis (Table 2) is shown only for Mistral-7B on the SE dataset. The claim that 'PPO provides similar utility' is not validated across the other 8 models and second dataset."
     },
     {
       "flag": "Amazon affiliation with no funding or conflict disclosure",
       "detail": "All six authors are from Amazon Inc. No funding disclosure, acknowledgments, or competing interests statement is present, despite Amazon being a major provider of LLM services."
     },
     {
       "flag": "Theoretical results rely on restrictive assumptions",
       "detail": "Proposition 3 relies on the MALT assumption, which the paper itself calls 'quite restrictive.' Theorem 2.1 adds the assumption that likelihoods are i.i.d. under the posterior. A footnote notes an assumption was 'added in a later revision to address a limitation in the original analysis.'"
     }
   ],
   "cited_papers": [
     {
       "title": "Direct preference optimization: Your language model is secretly a reward model",
       "authors": ["R. Rafailov", "A. Sharma", "E. Mitchell", "C. Manning", "S. Ermon", "C. Finn"],
       "year": 2024,
       "relevance": "Foundational DPO method, a central subject of this paper's privacy analysis of LLM alignment techniques."
     },
     {
       "title": "Detecting pre-training data from large language models",
       "authors": ["W. Shi", "A. Ajith", "M. Xia", "Y. Huang", "D. Liu", "T. Blevins", "D. Chen", "L. Zettlemoyer"],
       "year": 2024,
       "arxiv_id": "2310.16789",
       "relevance": "Proposes MIN-K% PROB MIA method used as a baseline; studies membership inference on pretrained LLMs."
     },
     {
       "title": "Membership inference attacks against machine learning models",
       "authors": ["R. Shokri", "M. Stronati", "C. Song", "V. Shmatikov"],
       "year": 2017,
       "relevance": "Foundational work on membership inference attacks in machine learning, establishing the threat model used in this paper."
     },
     {
       "title": "Extracting training data from large language models",
       "authors": ["N. Carlini"],
       "year": 2021,
       "relevance": "Key prior work on LLM privacy risks; Zlib and Lowercase MIA baselines used in this paper originate from this work."
     },
     {
       "title": "Training language models to follow instructions with human feedback",
       "authors": ["L. Ouyang", "J. Wu", "X. Jiang", "D. Almeida"],
       "year": 2022,
       "relevance": "InstructGPT paper establishing RLHF/PPO pipeline for LLM alignment, one of the two alignment methods studied."
     },
     {
       "title": "Deep learning with differential privacy",
       "authors": ["M. Abadi", "A. Chu", "I. Goodfellow", "H.B. McMahan", "I. Mironov", "K. Talwar", "L. Zhang"],
       "year": 2016,
       "relevance": "DP-SGD framework mentioned as a potential MIA mitigation technique for preference data alignment."
     },
     {
       "title": "Is DPO superior to PPO for LLM alignment? A comprehensive study",
       "authors": ["S. Xu", "W. Fu", "J. Gao", "W. Ye", "W. Liu", "Z. Mei", "G. Wang", "C. Yu", "Y. Wu"],
       "year": 2024,
       "arxiv_id": "2404.10719",
       "relevance": "Comprehensive comparison of DPO vs PPO for alignment quality, directly relevant to the utility-privacy trade-off analyzed here."
     },
     {
       "title": "Do membership inference attacks work on large language models?",
       "authors": ["M. Duan", "A. Suri", "N. Mireshghallah", "S. Min", "W. Shi", "L. Zettlemoyer", "Y. Tsvetkov", "Y. Choi", "D. Evans", "H. Hajishirzi"],
       "year": 2024,
       "arxiv_id": "2402.07841",
       "relevance": "Finds most MIAs barely outperform random guessing on pretrained LLMs, motivating the focus on fine-tuned/aligned models in this paper."
     },
     {
       "title": "LLM dataset inference: Did you train on my dataset?",
       "authors": ["P. Maini", "H. Jia", "N. Papernot", "A. Dziedzic"],
       "year": 2024,
       "arxiv_id": "2406.06443",
       "relevance": "Proposes Dataset Inference Attack for pretrained LLMs, complementary to the preference data MIA studied here."
     },
     {
       "title": "White-box vs black-box: Bayes optimal strategies for membership inference",
       "authors": ["A. Sablayrolles", "M. Douze", "C. Schmid", "Y. Ollivier", "H. Jégou"],
       "year": 2019,
       "relevance": "Provides the theoretical framework (MALT assumption, Bayes optimal membership inference) that underpins the theoretical results in this paper."
     },
     {
       "title": "Fundamental limits of membership inference attacks on machine learning models",
       "authors": ["E. Aubinais", "E. Gassiat", "P. Piantanida"],
       "year": 2023,
       "arxiv_id": "2310.13786",
       "relevance": "Provides fundamental lower bounds on MIA that this paper extends with a tighter bound (Lemma 3, Theorem 2.1)."
     },
     {
       "title": "Practical membership inference attacks against fine-tuned large language models via self-prompt calibration",
       "authors": ["W. Fu", "H. Wang", "C. Gao", "G. Liu", "Y. Li", "T. Jiang"],
       "year": 2023,
       "arxiv_id": "2311.06062",
       "relevance": "Studies MIA on fine-tuned LLMs, directly related to the alignment-stage MIA focus of this paper."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "PREMIA could be used for privacy auditing of aligned LLMs, but requires reference model access and no code is released."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "DPO's higher vulnerability is somewhat intuitive given it directly optimizes on preference data; the finding confirms rather than contradicts expectations."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that widely-used DPO alignment leaks preference data membership, raising real privacy concerns for organizations fine-tuning on sensitive human feedback."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Mild tension: DPO is popular for its simplicity but shown to have a privacy cost, though this is presented as a technical finding rather than a controversy."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code released, no demo, no public tool available."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Amazon authors provide some recognition, but the paper is about open-source models (GPT2, Mistral, Llama), not Amazon products."
     }
   }
 }