On the Evidentiary Limits of Membership Inference for Copyright Auditing
As large language models (LLMs) are trained on increasingly opaque corpora, membership inference attacks (MIAs) have been proposed to audit whether copyrighted texts were used during training, despite growing concerns about their reliability under realistic conditions. We ask whether MIAs can serve as admissible evidence in adversarial copyright disputes where an accused model developer may obfuscate training data while preserving semantic content, and formalize this setting through a judge-prosecutor-accused communication protocol. To test robustness under this protocol, we introduce SAGE (Structure-Aware SAE-Guided Extraction), a paraphrasing framework guided by Sparse Autoencoders (SAEs) that rewrites training data to alter lexical structure while preserving semantic content and downstream utility. Our experiments show that state-of-the-art MIAs degrade when models are fine-tuned on SAGE-generated paraphrases, indicating that their signals are not robust to semantics-preserving transformations. While some leakage remains in certain fine-tuning regimes, these results suggest that MIAs are brittle in adversarial settings and insufficient, on their own, as a standalone mechanism for copyright auditing of LLMs.
69708c50a8be625b19c2b01f
Murat Bilgehan Ertan
claimed_verified
2026-01-21T09:18:49.845Z
65ff72e6b9bcfbb87523d680
https://cdn-avatars.huggingface.co/v1/production/uploads/65ff72e6b9bcfbb87523d680/Ye5sBxFjPSOcgy0ZkaC1m.jpeg
M. Bilgehan Ertan
bilgehanertan
user
bilgehanertan
69708c50a8be625b19c2b020
Emirhan Böge
claimed_verified
2026-01-21T09:18:47.470Z
62d7e9120d2ce1c626244e7d
https://cdn-avatars.huggingface.co/v1/production/uploads/62d7e9120d2ce1c626244e7d/t7RTVRjMgM3_ukD9x-mdj.png
emirhan boge
emirhanboge
user
emirhanboge
69708c50a8be625b19c2b021
Min Chen
69708c50a8be625b19c2b022
Kaleel Mahmood
69708c50a8be625b19c2b023
Marten van Dijk
On the Evidentiary Limits of Membership Inference for Copyright Auditing
As large language models (LLMs) are trained on increasingly opaque corpora, membership inference attacks (MIAs) have been proposed to audit whether copyrighted texts were used during training, despite growing concerns about their reliability under realistic conditions. We ask whether MIAs can serve as admissible evidence in adversarial copyright disputes where an accused model developer may obfuscate training data while preserving semantic content, and formalize this setting through a judge-prosecutor-accused communication protocol. To test robustness under this protocol, we introduce SAGE (Structure-Aware SAE-Guided Extraction), a paraphrasing framework guided by Sparse Autoencoders (SAEs) that rewrites training data to alter lexical structure while preserving semantic content and downstream utility. Our experiments show that state-of-the-art MIAs degrade when models are fine-tuned on SAGE-generated paraphrases, indicating that their signals are not robust to semantics-preserving transformations. While some leakage remains in certain fine-tuning regimes, these results suggest that MIAs are brittle in adversarial settings and insufficient, on their own, as a standalone mechanism for copyright auditing of LLMs.
Membership inference attacks fail to reliably detect copyrighted text usage in large language models when training data is paraphrased using structure-aware methods that preserve semantic content.
membership inference attacks large language models paraphrasing framework Sparse Autoencoders SAE-guided extraction semantic content downstream utility adversarial copyright disputes training data obfuscation