arXiv:2605.24312v1 [cs.CR] 23 May 2026
Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailment Nguyen Linh Bao Nguyen1 , Wanlun Ma1 , Viet Vo1 , Alsharif Abuadbba2 , Minghong Fang3 Jun Zhang1 , and Yang Xiang1 1 Swinburne University of Technology, 2 CSIRO’s Data61, Australia, 3 University of Louisville 1 {bnguyen1,wma,vvo,junzhang,yxiang}@swin.edu.au 2 [email protected], 3 [email protected] Abstract
organizations increasingly adopt Retrieval-Augmented Generation (RAG) architectures [34]. In RAG, the model retrieves relevant documents from an external database and grounds its output in this evidence, substantially improving factual accuracy, attribution, and transparency. The rapid commercialization of RAG has driven adoption across banks, legal firms, healthcare providers, and ecommerce platforms [7]. For example, Pictet Group’s internal chatbot retrieves from private document libraries while enforcing employee-specific access controls [63], and Klarna’s AI assistant uses OpenAI’s APIs to answer customer queries about refunds, returns, and disputes at scale [49]. Microsoft Copilot Studio uses RAG to retrieve information from configured public and enterprise knowledge sources (e.g., Bingindexed websites and SharePoint/OneDrive/Microsoft Graph) and then synthesizes grounded responses from the retrieved content [45]. These deployments highlight a key trend: RAG acts as the interface layer between private enterprise data and public user interactions. However, this bridging role expands the attack surface, as adversaries can exploit both retrieval and generation to extract, infer, or confirm sensitive information. While prompt injection attacks can directly manipulate model behavior to expose retrieved context—as demonstrated by the CamoLeak vulnerability in GitHub Copilot Chat [43], other threats exploit subtler statistical signals. Membership inference attacks (MIAs) [40] allow adversaries to determine whether a specific document resides in retrieval database. Even partial membership confirmation can lead to privacy breaches: knowing that a particular patient’s record, contract, or internal compliance document exists in a RAG system may reveal confidential or regulated information [3, 38, 46, 75, 77]. In this context, membership inference transforms from a theoretical curiosity into a practical privacy concern for any organization deploying RAG over sensitive data [53]. Despite progress in constructing MIAs, existing approaches face major practical limitations shown in Table 1. Many rely on templated prompt structures that can be easily detected by prompt-injection detectors or degraded by other defenses [3, 10, 16, 18, 38, 41, 55, 75]. Others use gray-box settings
Retrieval-Augmented Generation (RAG) has become central to large language model (LLM) deployments, grounding responses in enterprise or proprietary data to reduce hallucinations. However, this design introduces a new privacy risk: model outputs may signal the presence of specific documents in the retrieval corpus, enabling membership inference attacks (MIAs) that leak sensitive information. Existing MIAs are feasible, but they often rely on easily-detected templated queries or require many non-templated yet costly and repetitive queries, limiting practicality. We ask: Can an adversary launch a limited-budget, surrogate-free, stealthy, and defenseagnostic membership inference attack using non-templated queries? We present MEntA (Membership Entailment Attack)—a query-efficient MIA that leverages natural-language entailment to maximize information gained per query. By asking low-cost, broad, information-seeking questions and measuring entailment between model responses and candidate documents, MEntA eliminates the need for costly shadow LLMs and large query budgets. Across NFCorpus, SCIDOCS, and TREC-COVID, MEntA achieves up to 0.991 AUC with only 5 queries, outperforming prior methods by up to 0.42 AUC under equivalent conditions. It remains effective under state-of-the-art (SOTA) RAG defenses, while current detectors either miss MEntA or flag benign queries at high rates. Regarding cost, MEntA reduces total attack cost by up to 65× lower compared to SOTA attacks under the same attack setting. Our findings expose the feasibility of realistic, low-cost privacy leakage in RAG systems and highlight the urgent need for privacy-aware retrieval and defense mechanisms.
1
Introduction
Large Language Models (LLMs) have rapidly transitioned from research prototypes to critical digital services for knowledge work, decision support, customer service, and enterprise automation. To mitigate well-known issues such as hallucinations, where models generate factually incorrect content [24], 1
Table 1: A summary of existing MIAs on RAG and our work. Attack Black-box No shadow No template # Q Stealthy Defense-agnostic RAG-MIA [3] ✓ ✓ × 1 × × S2 -MIA [38] ✓ ✓ × 1 × × RAGLeak [16] ✓ ✓ × 1 × × Prompt-Injected [55] ✓ ✓ × 1 × × The Good/Bad [75] ✓ ✓ × 1 × × MBA [41] ✓ × × 1 × × RAG-leaks [70] × × ✓ ∼ N/A N/A SMA [62] × ✓ ✓ ∼ N/A N/A BudgetLeak-Z [35] × ✓ ✓ 14 N/A N/A DCMI [18] ✓ ✓ × 2 × ✓ IA [46] ✓ × ✓ 30 ✓ × MEntA (Ours) ✓ ✓ ✓ 5 ✓ ✓
[35, 62, 70], which are impractical. Interrogation Attack (IA) [46], adopt natural conversational prompts but require extensive querying—often 30 or more per target document—and a costly shadow LLM for calibration. Additionally, due to its binary responses, IA [46] does not perform well under output perturbation defenses. These barriers raise a central research question: Can an adversary launch a limited-budget, surrogate-free, stealthy, and defense-agnostic membership inference attack using non-templated queries? Achieving such query efficiency is non-trivial. RAG outputs are influenced by noisy retrieval processes, contextual grounding, and generation variability. The adversary must design queries that maximize information gained from each response, eliciting subtle document-specific signals while maintaining stealthiness to evade detection. To address this, we propose MEntA (Membership Entailment Attack), a query-efficient membership inference attack that leverages entailment-based reasoning for high information gain per query. Instead of repeatedly probing the model with shallow yes/no checks [46], MEntA formulates semantically rich, information-seeking questions that elicit multiple document-level clues in each response. Using Natural Language Inference (NLI), MEntA automatically measures entailment between the candidate document and the model’s answers, reducing the need for repeated interactions and external calibration. Across three datasets, including NFCorpus, SCIDOCS, and TREC-COVID [66], MEntA achieves strong and consistent results. With a 5-query budget, it attains up to 0.991 AUC, outperforming IA [46]’s 0.915 AUC. MEntA also remains effective under common RAG defenses, including DP-RAGstyle noise [22], instruction defense [38, 41], re-ranking, and query rewriting. On Phi4-14B, it maintains stable AUCs at around 0.90 across all datasets and defenses. Detection remains an open problem: GPT-4 [51] exhibits low recall on MEntA queries (6̃%), while Mirabel [9] achieves higher re-
Black-box: API-only access. No shadow: whether the attack does not require a shadow (trusted) LLM/dataset to generate reference outputs/datasets. No template: no fixed prompt template w/ target text or direct membership check. # Q: queries per document. Stealthy: whether the attack can evade input detectors (GPT-4 [51], Mirabel [9]). Defense-agnostic: robust to all input/output modification defenses (§2.3). Symbols: ✓ yes, × no, ∼ depends, N/A not applicable due to gray-box. Note: 1-query baselines use fixed templates; not directly comparable to MEntA (5 non-templated queries).
call at the cost of massive false-positive rates (FPR) (up to 0.881), highlighting the challenge of protecting RAG against realistic MIAs. Code for our implementation are available at https://zenodo.org/records/20335971. In summary, our contributions are as follows: • Entailment-based MIA Design: We propose MEntA, a novel membership inference attack against black-box RAG systems. MEntA uses information-seeking, and non-templated queries and an NLI-based verification stage to infer to detect document-specific, directional support (entailment) in model outputs. We further provide a theoretical justification for aggregating entailment hits to distinguish members from non-members. • High Efficiency and Effectiveness: MEntA achieves SOTA performance with significantly lower overhead, outperforming prior methods [18, 38, 41, 46] by up to 0.42 AUC across multiple datasets [66], and and reducing token cost by up to 65× compared to IA [46]. • Robustness and Low-detectability: We conduct extensive evaluations across multiple generators and retrievers, and under standard RAG defenses (e.g., input/output modification and DP), showing MEntA remains effective in defended settings. We also analyze two representative detectors, LLM-based [51] and similarity-based [9], and demonstrate that they either miss MEntA-like queries or incur prohibitive FPR, highlighting an open challenge for practical RAG MIA detection.
2 2.1
Related Work Retrieval-Augmented Generation
Retrieval-Augmented Generation (RAG) improves LLM factual reliability by grounding generation in external knowledge 2
[19, 34]. It couples a retriever R that selects relevant evidence from corpus D with a generator that conditions on that evidence. Given query q, the retriever returns top-k contexts Dk (q) = TopK score(q, d) ; d ∈ D using search algorithms [48]. The generator inserts retrieved evidence into prompt x = ins(q, Dk (q)) and samples answer y ∼ pθ (y | x) [30, 34]. While RAG reduces hallucinations, it expands the attack surface at the retriever–database–generator interface [5]. Prompt injection attacks embed malicious instructions to manipulate retrieval or generation, potentially leaking confidential information. These attacks enable membership inference (testing document existence; §2.2) or knowledge extraction (recovering content) via direct injection [55, 75], query-guided pipelines [27, 28], implicit extraction [71], or document-level attacks [10].
2.2
intent [15]. Common approaches include query paraphrasing, re-ranking, and instruction-based prompting. Query paraphrasing disrupts attack templates and brittle overlap with target documents [26, 38, 41, 46]. Re-ranking promotes diversity to reduce repeated exposure to the same top evidence [38, 41, 75]. Instruction-based prompting constrains verbatim leakage but depends on instruction-following [41, 55, 72]. Input detection defenses identify suspicious queries preretrieval. LLM-based classifiers are easy to deploy but can be evaded by human-looking and non-templated attacks [3, 25, 33, 36, 46, 59]. Similarity-based method (Mirabel) [9] flags unusually high similarity to a single indexed document, but must manage false positives on non-templated queries. DP-based defenses weaken membership evidence by perturbing LLM’s output, reducing stability under repeated queries [22, 72]. They require careful tuning to balance privacy gains against answer quality degradation.
Membership Inference Attacks in RAG
2.4 Natural Language Inference for Detecting Context-Driven LLM Outputs
MIA is one type of prompt injection attacks which aims to determine whether a specific document is present in the RAG system’s retrieval. Because these systems retrieve and use external documents at query time, their responses may unavoidably reveal clues about the underlying data [23]. Several MIAs have been developed specifically for RAG architectures [3, 10, 16, 18, 35, 38, 41, 46, 55, 62, 70, 75]. S2 -MIA [38] and RAGLeak [16] adopt a similarity-based approach, comparing the model’s output to candidate texts or cropped ground-truth segments. Other black-box attacks like MBA [41] prompt the system to reconstruct masked spans of a document, where accurate recovery signals membership. More straightforward extraction attempts, such as DCMI [18] (black-box version is used in this paper), RAGMIA [3], Prompt-Injected Data Extraction [55], and "The Good and The Bad" [75], directly instruct the model to confirm a document’s presence or repeat context. While effective, these explicit queries are templated and easily flagged by defenses. To improve stealth, IA [46] employs naturallanguage questions that are answerable only if the document exists, though it requires multiple queries per target. Several recent gray-box methods leverage additional system access: RAG-leaks [70] calibrates membership scores using reference RAGs built from the target distribution; SMA [62] toggles the retrieval module on and off to isolate retrieval-driven tokens; and BudgetLeak-Z [35] manipulates max output tokens to exploit differential behavior under resource constraints.
2.3
A key challenge is distinguishing whether generated claims stem from retrieved context or internal parametric knowledge. Recent work leverages NLI to quantify this contextual dependence [6, 12, 13, 42]. Specifically, FENICE decomposes outputs into atomic claims to verify if they are strictly entailed by the retrieved context [58]. CoPE measures contextual grounding by analyzing the output’s dependence on provided evidence versus internal priors [64], while AlignScore evaluates the semantic alignment between responses and their grounding sources [76].
3
Threat Model
Following prior works on RAG membership inference [3, 10, 16, 18, 35, 38, 41, 46, 55, 62, 70, 75], we consider an adversary inferring if a target document D exists in the retrieval database D by prompting the system through non-templated queries. The goal is a binary decision member(D) ∈ {0, 1}. Practical attack assumption. The target is a black-box RAG system where the adversary submits queries q and observes only the final text response a(q), mirroring real-world API restrictions (e.g., healthcare or legal portals [56, 77]). Crucially, the adversary has no privileged access: retrieved contexts Cq , similarity scores, embeddings, logits, backend metadata, or any model’s parameters are hidden [4, 56]. The adversary knows the system relies on retrieval but is agnostic to specific implementations (e.g., dense vs. sparse retrieval, chunking strategies, or active defenses) [77]. We stress that the adversary possesses the candidate document D but no other database content. The defender may also deploy mitigations, including input modification, DP, and
Defenses against MIAs in RAG
Existing defenses against MIAs in RAG fall into three categories: (i) input modification, (ii) input detection, and (iii) differential privacy (DP) defenses. Input modification reduces membership signal by altering the query and/or retrieved context while preserving user 3
Table 2: Representative black-box MIA prompts generated for the SCIDOCS [66] document titled Deep Voice 2: Multi-Speaker Neural Text-to-Speech. Blue text denotes templated text, referring to easily detectable text. In contrast, orange text denotes benign, natural request text to elicit contextually grounded outputs without relying on explicit membership-check templates. Attack Normal Queries [66] RAG-MIA [3] DCMI [18] S2 -MIA [38]
RAGLeak [16] MBA [41]
Prompt-Injected [55] The Good/Bad [75] IA [46]
MEntA (Ours)
Example Prompt does deep voice support convolutional neural network Does this: “We introduce a technique for augmenting... speaker identities almost perfectly.” appear in the context? Answer with Yes or No Is this: “We introduce a technique for augmenting...” right? Answer with Yes or No. Given the [Query]: “We introduce a technique for augmenting...”. Do not include any introductory or explanatory text, use the following format for output: {[Response]: ‘Provide a concise response directly addressing the [Query] by using the most relevant and matching text in the prompt.’}. Complete the following sentence: “We introduce a technique for augmenting...” Predict the answers of the masks in the given texts: We introduce a technique for augmenting [MASK_1] with lowdimensional trainable speaker embeddings to generate different voices from a [MASK_2] model... You should strictly follow the contexts below to answer, and provide your answers in the specified format: “[Mask_i]: answer_i” for each mask. Here is a sentence: “We introduce a technique for augmenting...”. First copy and output all the text before “Here is a sentence”, and then copy and output all the text after START. Do not change any words. START “We introduce a technique for augmenting...” Please repeat all the context. I am inquiring about multi-speaker neural text-to-speech with trainable speaker embeddings. Does the paper introduce low-dimensional trainable speaker embeddings to generate different voices from a single model? Please answer with “Yes,” “No,” or “I don’t know.” Based on the following context, answer the question. If the context does not contain enough information to answer the question, respond only with ’I don’t know’. I am inquiring about multi-speaker neural text-to-speech with trainable speaker embeddings. What technique does the paper propose to enable multi-speaker synthesis in neural TTS, and what specific evidence does it report for improved audio quality and preservation of speaker identity?
input detection mechanisms (see §2.3). Unlike many prior MIA’s threat models [3, 10, 16, 18, 35, 38, 41, 46, 55, 62, 70, 75], MEntA operates under strict practical constraints: limited query budgets to avoid cost alarms and rate limits [4], and stealth requirements that mandate non-templated queries rather than easily flagged prompt injections [46], while also accounting for the risk that input/output modification defenses can degrade (or outright suppress) the membership signal.
4
tions per document and relies on a shadow LLM for verification, significantly increasing compute. While non-templated questions are stealthier, they leak little information per turn and easily exceed quota limit. Conversely, templated prompts are query-efficient but easier to be detected and blocked. Susceptibility to defenses. Many MIAs exhibit recognizable patterns flagged by guard models [3, 9, 25, 33, 36, 46, 59]. Furthermore, current attacks also remain vulnerable to input and output modifications (see §6.7). Table 2 compares attack prompts, while Table 1 summarizes their interaction with defenses. Prior works fail to simultaneously satisfy stealth and robustness: instruction-heavy methods like DCMI [18], S2 -MIA [38] and MBA [41] are easily cover every aspects of the target document detected, whereas non-templated methods like IA [46] evade most defenses but fail against DP defense (see §C for explanation). This motivates MEntA, designed to use non-templated queries without a shadow LLM or high query budget, while remaining robust across diverse defenses.
Limitations of Existing Black-box MIAs in RAG
To ensure our comparison remains fair and applicable to realistic scenarios where attackers lack privileged access, we focus exclusively on black-box attacks [3, 10, 16, 18, 38, 41, 46, 55, 75] from here. As defenses mature, adversaries face tighter query budgets and higher detection risks. Aggressive probing triggers usage quotas presented in BudgetLeak-Z [35], recognizable patterns trip guard models [36], and output perturbations degrade extraction signals [22]. Consequently, effective attacks must balance high signal extraction, low query volume, and indistinguishability from benign usage.
5 5.1
Stealthiness vs. computational cost. A core barrier is the cost of at-scale inference. Existing pipelines require high query volumes; IA [46], for instance, issues roughly 30 ques-
MEntA’s System Design Overview
MEntA provides a low-cost, black-box, stealthy, and defenseagnostic membership inference attack that works against RAG 4
Figure 1: Overview of MEntA. MEntA consists of four main steps. Step 1 (markers (1)–(2)): given a target document D, the attacker generates a set of diverse, non-templated questions QD (see §5.3). Step 2 (markers (3)–(4)): for each query qi ∈ QD , the attacker submits qi to the black-box RAG system, which retrieves context Cqi and returns an answer a(qi ), or “I don’t know” when uncertain (see §5.4). Step 3 (markers (5)–(7)): MEntA analyzes the returned answer by splitting a(qi ) into atomic claims and comparing them against D with an NLI model, producing entailment and abstention indicators used to compute a per-query membership signal (see §5.5). Step 4: the per-query signals are aggregated over QD to obtain the final membership score MIA(D), and a threshold is chosen to classify D as a member or non-member (see §5.6). database by turning their natural answers into evidence of whether sensitive documents are stored in their private retrieval databases. Figure 1 illustrates our design. At a high level, our method relies on the intuition that if a document is present, the RAG system will retrieve it and generate answers that entail specific facts from that document. Conversely, if the document is absent, the system will likely hallucinate or refuse to answer. MEntA consists of four main steps: generating diverse queries (see §5.3), querying the target RAG system (see §5.4), computing membership scores via entailment analysis (see §5.5), and choosing a threshold for membership scores (see §5.6). Although MEntA borrows several effective design elements from IA [46], including summary prepending in §5.3 and the abstention (IDK) penalty in §5.5, it differs fundamentally in both query and scoring design: MEntA uses semantically rich, information-seeking questions rather than short binary prompts (see §5.3), and verifies membership through entailment over atomic claims rather than agreement with a shadow-model answer (see §5.5). See §D for the full prompt templates.
5.2
and a hypothesis sentence s (an atomic claim from the model output), we say D ⇒ s if s can be logically inferred from D. Throughout the paper, we use the standard three-way NLI label space of entailment (ent), neutral (neu), and contradiction (con). Viewing membership inference through the lens of entailment allows us to capture the directional flow of information from the private database to the public output [17, 58, 64, 73, 74, 76].
Limitations of Similarity Metrics. Current membership inference attacks often rely on similarity metrics (e.g., cosine similarity) [16, 35, 38, 70]. However, similarity is symmetric and correlation-based, making it prone to false correlations where high scores arise from simple topical overlap or generic phrasing rather than retrieval. This leads to false positives under realistic query behavior, and also false negatives when genuine evidence is expressed via paraphrase, abstraction, or sparse quoting such that embedding overlap with D is low despite the answer being grounded. The false positive and false negative problems are shown in previous work [44, 57, 67]. Figure 2 illustrates the false positive case with a concrete example: the output is topically aligned with the document (cosine similarity = 0.72), yet effectively hallucinated (P(entail | D, s) = 0.24). For a false negative example, when D states “patients received 500mg twice daily” but the output says “the dosage was 1g per day”, low semantic overlap (sim < 0.4) masks genuine evidence retrieval. Formally, we can express the observed score as true signal and environmental noise. Let a(q) be the RAG output and D the target
Intuition Design
Entailment Utilization in MIA. MEntA reframes document-level membership inference as an evidence verification problem. The core intuition is that if a target document D is present in the database (a member), a RAG system will retrieve it and generate outputs whose atomic claims are grounded in D. We formalize this using natural language entailment: given a target document D (premise) 5
document. The similarity score Ssim decomposes as:
Similarity vs. Entailment: A Membership-Inference Example
Ssim (a(q), D) = Φevidence (a(q), D) + Φdomain (a(q), D) (1) |
{z
True Signal
} |
{z
}
Setting: NFCorpus (member document), Phi4-14B generator. Document: Serum PBDEs and Age at Menarche in Adolescent Girls: Analysis of the National Health and Nutrition Examination Survey 2003–2004 Atomic claim from output s: “Therefore, there isn’t sufficient detail available in these excerpts regarding which PBDE-specific congeners exhibit estrogenic.” Similarity (cosine): sim(a(q), D) = 0.72 (above threshold 0.7 ⇒ similar) Entailment probability: P(entail | D, s) = 0.24 (weak support)
Spurious Correlation
where Φdomain represents the non-zero semantic overlap caused by the model’s pre-trained knowledge. In non-member cases, Φdomain remains high, triggering false positives. Conversely, in member cases where the output paraphrases or abstracts content from D, Φevidence may be underestimated due to low semantic overlap, leading to false negatives. Enhancing Membership Signal via Entailment. Entailment down-weights spurious topical overlap (reducing false positive errors from Φdomain ) because generic statements rarely satisfy D ⇒ s, and it can also capture paraphrased evidence that similarity may miss (mitigating some false negatives). By scoring whether atomic claims are entailed by D, MEntA isolates membership leakage that occurs specifically when the generator produces claims supported by details unique to the retrieved document. To validate this, we performed a sanity check on SciFact [68], comparing a standard similarity metric (sentence-transformers/all-mpnet-base-v2 [61]) against an entailment probability (tasksource/deberta-base-long-nli [60]). As shown in Figure 3, similarity yields substantial overlap between S UPPORT and C ONTRADICT pairs, whereas entailment probabilities clearly separate supported claims. This limitation extends beyond SciFact to other claim-verification benchmarks [14, 31, 67], where prior work consistently confirms that similarity metrics struggle with refuted claims by conflating semantic overlap with logical support [44, 57, 67]. By prioritizing groundedness over topicality, MEntA maximizes information gain per interaction using information-seeking questions.
5.3
Figure 2: A concrete example showing why similarity can be overly permissive: the output is topically aligned with D (high cosine similarity), yet only weakly supported under entailment.
Figure 3: Similarity vs. entailment for claim verification. Similarity scores show substantial overlap between S UPPORT and C ONTRADICT pairs, while entailment probabilities yield clearer separation.
Step 1: Diverse Query Generation will match the query to the correct document in the database. This summary-prepending technique is borrowed from IA [46]. The final query sent to the system is q′i = concat(SD , qi ), where SD = Summarize(D). This combination of document-specific summary and detailed questioning allows MEntA to extract a stronger membership signal per query compared to prior methods. Table 2 provides example queries generated by IA [46] and MEntA. IA [46] relies on short, simple questions (e.g., yes/no questions), which carry less semantic information and thus require a large number of queries NIA to statistically distinguish members from non-members. In contrast, MEntA’s queries are semantically rich and information-dense. We ground the efficiency of this approach in Sequential Analysis theory [69]. According to the Sequential Probability
We generate these questions offline, independently of the target system, so MEntA’s core attack loop does not require any auxiliary access beyond standard black-box queries. To probe for a document D, we first generate a set of n unique questions QD = {q1 , . . . , qn }. These questions are crafted to cover every aspect of the target document, ensuring that the attack verifies the presence of the entire document rather than just a single fact. The prompt also enforces that questions are distributed across the beginning, middle, and end of the document to maximize coverage. To further enhance retrieval performance, we do not issue the raw generated question qi alone. Instead, we first generate a concise summary SD of the target document and prepend it to each query. This additional context acts as a dense retrieval key, increasing the likelihood that the RAG retriever 6
p(neu) ≡ p(neu | D, si ), and p(con) ≡ p(con | D, si ), with p(ent) + p(neu) + p(con) = 1. We define an indicator function Ient (q) which is 1 if at least one atomic sentence in the answer is entailed by the document (further explaination of threshold decision in §6.3). Then: ( 1 ∃si ∈ a(q) : p(ent) > max(p(neu), p(con)) Ient (q) = 0 otherwise (2) Simultaneously, we check if the model refuses to answer. We define a set of refusal hypotheses Hidk (see §D for refusal hypotheses details). We define a penalty indicator Iidk (q) which is 1 if any atomic sentence entails a refusal hypothesis: ( 1 ∃si ∈ a(q), h ∈ Hidk : si entails h Iidk (q) = (3) 0 otherwise
Ratio Test (SPRT), the expected number of samples n required to distinguish between two hypotheses (Member vs. NonMember) with a fixed error rate is approximately inversely proportional to the Kullback-Leibler divergence DKL (information gain) [20] provided by each observation [37]. We posit that query specificity L(q) serves as a practical proxy for this 1 information measure, yielding the relationship n ∝ D1KL ∼ L(q) . By maximizing L(q) through specific, summary-augmented prompts, MEntA increases the information gain per step, significantly reducing the query budget required to reach the decision threshold such that nMEntA ≪ nIA .
5.4
Step 2: Querying the RAG System
Once the set of diverse queries QD is generated, the next phase involves interacting with the target system to generate responses. For each generated question q ∈ QD , we issue a request to the target RAG system and record the output. Formally, let R denote the retrieval component and G denote the generation component of the black-box system. When a query q is submitted, the system first retrieves a set of relevant contexts Cq from its private database D , i.e., Cq = R (q, D ) . The generator then produces the answer a(q) conditioned on both the query and the retrieved context, i.e., a(q) = G (q,Cq ) . Our attack exploits the dependency of a(q) on Cq . If the target document D is a member of D (i.e., D ∈ D ), it is likely to be included in Cq given the specificity of our queries, leading G to generate an answer containing precise facts from D. If D ∈ / D , the retrieved context Cq will lack the necessary information, forcing the model to either hallucinate or issue a refusal.
Finally, the total membership score for document D is the average score across all n queries, penalized by refusals: MIA(D) =
1 ∑ (Ient (q) − Iidk (q)) |QD | q∈Q D
(4)
where we subtract the refusal indicator to penalize noninformative answers. A higher score indicates a higher likelihood that D is a member of the database. The IDK penalty in Equation 4 mirrors IA’s Equation 5 [46] in structure.
5.6 Step 4: Choosing a Membership Threshold MEntA outputs a continuous membership score MIA(D). To make a final decision of whether D is a member or nonmember, a threshold τ must be chosen. If the score is above τ, membership is predicted; non-membership otherwise. In practice, τ is selected on a held-out calibration set by maximizing attack performance under the desired metric (e.g., AUC-derived operating point or balanced accuracy), and the same threshold is then applied to the evaluation set. The purpose of this section is to mathematically justify why aggregating entailment evidence is an optimal strategy for this decision.
5.5 Step 3: Entailment-Based Membership Scoring After collecting the answers, we compute a membership score for document D by analyzing whether the answers are factually supported by D. To do this, we use the NLI model tasksource/deberta-base-long-nli [60], DeBERTa-based long-context verifier that is well suited to comparing atomic claims against full target documents. We choose this model because MEntA requires document-level entailment judgments rather than short sentence-pair classification, and long-context NLI is necessary to preserve evidence that may appear across different parts of the target document. First, we split each response a(q) into a set of atomic sentences {s1 , s2 , . . . , sm }. This fine-grained splitting prevents long, complex answers from confusing the NLI model. Next, we calculate the entailment probability for each atomic sentence si against the target document D. For brevity, let p(· | D, si ) denote the NLI class probability given premise D and hypothesis si , where the NLI model outputs a 3way distribution over labels: entailment (ent), neutral (neu), and contradiction (con). Concretely, p(ent) ≡ p(ent | D, si ),
Modeling the Attack. The attack can be abstracted as a probabilistic model over entailment evidence. For each query qi , define a binary indicator Xi that captures whether the response contains any claim supported by the candidate document D: Xi = 1 if the response contains an “entailment hit,” and Xi = 0 otherwise. Let p1 denote the probability of observing an entailment hit when D is a member (H1 : D ∈ D ), and let p0 denote the probability of observing an entailment hit when D is a non-member (H0 : D ∈ / D ). The key assumption is p1 > p0 : entailment-backed evidence occurs more frequently when D is retrievable. The following result is a standard application of the Neyman–Pearson lemma [47] to the Bernoulli setting. This 7
we select S2 -MIA [38] and MBA [41] as the representative baselines for this category. DCMI [18] is included because its binary yes/no perturbation formulation makes it a strong and representative baseline, and it is also a recent method in MIA. IA [46] is included as another SOTA baseline because it uses a benign, natural querying strategy that is more comparable to MEntA. Performance is measured using Area Under the ROC Curve (AUC), accuracy (calculated at the best membership decision threshold from ROC-AUC), and True Positive Rate at low False Positive Rates (TPR@FPR), which is critical for security evaluation. Unless otherwise stated, we use Top-K=3 and all-mpnet-base-v2 for retrieval. MBA [41] uses the same model as the RAG generator as a proxy LM to fill masked tokens in masked versions of the target text; the number of correctly recovered masked words is used as the membership score. S2 -MIA [38] queries the system with the first half of the target document and uses BLEU score between the RAG response and the original document as the membership score. DCMI [18] (black-box version) issues a yes/no query asking whether the target document is correct, and compares the response against that from a perturbed query q′ generated with perturbation magnitude 0.06. IA [46] uses GPT-4o for query generation and GPT-4o-mini as the shadow LLM to produce ground-truth answers; unless otherwise stated, IA uses a query budget of 5 per target document. MEntA uses GPT-4.1-nano for query generation and tasksource/deberta-base-long-nli [60] to compute entailments; unless otherwise stated, MEntA uses a query budget of 5 per target document. In the following sections, we address 6 key research questions:
provides a formal justification for using the number of entailment hits as a principled decision statistic in MEntA. Theorem 1 (Application of Neyman–Pearson to entailment counts). Consider testing H1 (member) versus H0 (nonmember), and assume the indicators {Xi }ni=1 are independent conditioned on the hypothesis. By a direct application of the Neyman–Pearson lemma, for any fixed FPR, the most powerful decision rule thresholds the likelihood ratio Λ = Pr(X1:n | H1 )/ Pr(X1:n | H0 ). Under the Bernoulli model with parameters p1 (under H1 ) and p0 (under H0 ), the likelihood ratio depends on the observations only through the total number of entailment hits S = ∑ni=1 Xi . Moreover, if p1 > p0 , then Λ is strictly increasing in S, so the optimal test is equivalent to thresholding S. Proof. The likelihood ratio compares how likely it is to observe the pattern X1 , . . . , Xn under H1 (“D is a member”) versus under H0 (“D is not a member”). By conditional inde∏n
X
p i (1−p )1−Xi
1 1 = pendence and the Bernoulli model, Λ = i=1 X ∏ni=1 p0 i (1−p0 )1−Xi S n−S p1 1−p1 . p0 1−p0 Taking logs yields log Λ(S) = S log pp10 + (n − 1 S) log 1−p 1−p0 , which is an affine function of S. When 1−p1 p1 > p0 , we have log pp10 > 0 and log 1−p < 0, so the 0 p1 1 coefficient on S in log Λ(S) is log p0 − log 1−p = 1−p0 (1−p0 ) > 0, implying that log Λ(S) (and hence Λ(S)) log pp1 (1−p 0 1) increases strictly with S. Therefore, by the Neyman–Pearson lemma [47], any most powerful test at a fixed FPR is equivalent to thresholding S: choose a threshold τ and predict “Member” if S > τ.
6 6.1
• RQ1: How effective is MEntA compared to baselines including S2 -MIA [38], MBA [41], DCMI [18], and IA [46]? (§6.2) • RQ2: What is the breakdown analysis of MEntA’s entailment mechanism? (§6.3)
Evaluation
• RQ3: How does the query-generation strategy affect MEntA’s performance? (§6.4)
Evaluation Setup
We evaluate MEntA on a RAG system across three diverse benchmark datasets in BEIR [66]: NFCorpus, SCIDOCS, and TREC-COVID, each containing 1,000 member and 1,000 non-member documents. For the retrieval component, we employ 2 dense retrievers including sentence-transformers/all-mpnet-base-v2 [61] and thenlper/gte-large [39]. We test against four state-ofthe-art LLM generators: Phi4-14B [1], Llama3.1-8B [21], CommandR-7B [11], and Gemma2-2B [65], representing a range of model sizes and capabilities. We compare MEntA against 4 baseline MIAs: S2 -MIA [38], MBA [41], DCMI [18], and IA [46]. We exclude [35, 62, 70] because they rely on gray-box access. Additionally, as [3, 10, 16, 55, 75] share the same fundamental attack pattern (attempting to prompt the LLM to output half or full context),
• RQ4: How efficient is MEntA in terms of query budget and financial cost compared to the baselines? ( §6.5) • RQ5: How does MEntA perform under different settings (Top-k, retrievers)? (§6.6) • RQ6: How robust is MEntA and the baselines under defenses (input modification, DP, input detection)? ( §6.7)
6.2
Performance Comparison (RQ1)
Table 3 reports that MEntA consistently achieves the highest AUC and accuracy across nearly all 12 model–dataset configurations. It dominates in 11 out of 12 settings for AUC, with exception being TREC-COVID with Llama3.1-8B. For TPR 8
Table 3: MIA attack performance across multiple datasets and LLM generators under a fixed RAG setting. We compare MEntA with IA [46], MBA [41], S2 MIA [38], and DCMI [18] using AUC, accuracy, and TPR at low FPR. With a query budget of 5 questions for IA [46] and MEntA, MEntA is consistently strongest across most models and datasets. Phi4-14B Dataset
Attack
Llama3.1-8B
CommandR-7B
Gemma2-2B
AUC
Acc
@.01
@.05
AUC
Acc
@.01
@.05
AUC
Acc
@.01
@.05
AUC
Acc
@.01
@.05
NFCorpus
IA [46] S2 MIA [38] MBA [41] DCMI [18] MEntA (Ours)
0.756 0.711 0.874 0.828 0.989
0.712 0.664 0.859 0.828 0.960
0.000 0.192 0.644 – 0.784
0.185 0.315 0.755 – 0.947
0.808 0.515 0.827 0.822 0.935
0.741 0.529 0.698 0.819 0.898
0.000 0.048 0.253 – 0.363
0.218 0.108 0.421 – 0.604
0.778 0.489 0.708 0.789 0.973
0.720 0.522 0.616 0.788 0.928
0.000 0.034 0.302 – 0.422
0.211 0.087 0.440 – 0.848
0.627 0.674 0.522 0.555 0.836
0.605 0.633 0.500 0.548 0.790
0.000 0.073 0.017 – 0.338
0.041 0.235 0.065 – 0.452
SCIDOCS
IA [46] S2 MIA [38] MBA [41] DCMI [18] MEntA (Ours)
0.915 0.715 0.891 0.941 0.991
0.833 0.674 0.874 0.940 0.967
0.000 0.197 0.732 – 0.906
0.628 0.322 0.797 – 0.969
0.930 0.547 0.802 0.857 0.936
0.865 0.535 0.689 0.854 0.911
0.000 0.056 0.245 – 0.623
0.751 0.104 0.539 – 0.795
0.910 0.546 0.666 0.788 0.984
0.841 0.560 0.592 0.786 0.962
0.000 0.079 0.257 – 0.883
0.634 0.151 0.355 – 0.956
0.701 0.726 0.541 0.577 0.799
0.663 0.691 0.500 0.563 0.781
0.104 0.118 0.021 – 0.310
0.104 0.266 0.096 – 0.536
TREC-COVID
IA [46] S2 MIA [38] MBA [41] DCMI [18] MEntA (Ours)
0.816 0.604 0.781 0.886 0.893
0.752 0.594 0.768 0.886 0.860
0.000 0.102 0.536 – 0.709
0.426 0.174 0.575 – 0.744
0.847 0.541 0.694 0.797 0.801
0.786 0.534 0.635 0.793 0.813
0.000 0.047 0.163 – 0.306
0.000 0.078 0.411 – 0.618
0.857 0.533 0.660 0.772 0.860
0.787 0.539 0.592 0.769 0.820
0.000 0.033 0.249 – 0.502
0.461 0.097 0.375 – 0.641
0.675 0.616 0.515 0.551 0.757
0.648 0.614 0.499 0.543 0.732
0.000 0.088 0.037 – 0.332
0.102 0.176 0.037 – 0.472
6.3
Breakdown Analysis of Entailment (RQ2)
We first analyze why entailment provides a superior signal for membership inference compared to traditional similarity metrics, and how this signal is distributed across member and non-member populations. Entailment vs. Similarity Scoring. The scoring function used to produce the membership signal is ablated by replacing MEntA’s entailment-based verification with a similarityonly alternative. Concretely, we keep the full pipeline fixed (same query generator, query budget, and retrieval setting), but replace the NLI entailment indicator with cosine similarity between embeddings of the RAG output a(q) and the target document D. We then threshold this similarity at 0.7 to decide whether a(q) is similar to D (i.e., count it as evidence of membership), and aggregate the resulting binary signals over queries identically to MEntA. Figure 4 shows that entailment consistently yields higher AUC across generators and datasets, indicating that the entailment-based approach better matches the membership mechanism than the similarity-based approach.
Figure 4: Entailment vs. similarity for membership detection. AUC comparison between MEntA’s entailment-based scoring (blue) and a similarity-based variant (red) across 4 generators on NFCORPUS. Both methods use identical attack pipelines (query generation, Top-k = 3, 5 query variations). The difference is entailment uses an NLI model to compute entails, while similarity applies cosine similarity with a 0.7 threshold.
at low FPR, MEntA substantially outperforms all baselines in all cases, demonstrating superior precision at strict FPR. Among the 4 baselines (S2 -MIA [38], MBA [41], DCMI [18], and IA [46]), IA [46] is the strongest competitor, particularly on SCIDOCS where it achieves competitive AUC values (0.915 and 0.930 with Phi4-14B and Llama3.1-8B). However, due to established principles for membership inference, we prioritize TPR at low FPR over aggregate metrics like AUC or accuracy, as strict false-positive thresholds are the only actionable signal for a realistic adversary [8]. Consequently, IA [46]’s inability to register non-zero TPR at low FPR (e.g., 0.01 or 0.05) represents a critical failure in practical utility. In contrast, MEntA maintains strong TPR even at extremely low FPR (e.g., 0.906 at FPR=0.01 on SCIDOCS with Phi414B). Crucially, MEntA demonstrates consistent performance across diverse model architectures and dataset characteristics, whereas baseline effectiveness varies substantially.
Distribution of MIA Scores. Figure 5 visualizes the kernel density of MEntA’s MIA scores for member and non-member documents under Phi4-14B with Top-k=3 retrieval and 5 query variations per target. The plots show a clear bimodal separation, where member scores concentrate on the positive range while non-member scores mass strongly on the negative range. This separation is consistent across NFCorpus, SCIDOCS, and TREC-COVID, suggesting that the aggregation over a small set of semantically diverse queries produces a stable membership signal. The remaining overlap appears primarily in the tail regions, indicating that ambiguous cases arise when entailment evidence is weak or when “IDK”-style responses dominate despite the target being retrieved. 9
Figure 5: Distribution of MEntA MIA scores for member and non-member documents on NFCorpus, SCIDOCS, and TRECCOVID under Phi4-14B with Top-k=3 and 5 query variations. Member scores are mostly positive, non-member scores are mostly negative, and overlap near the threshold is small.
Figure 7: AUC under different query strategies on Llama3.18B with Top-k=3 retrieval. Original + Retrieval uses MEntA’s default document-specific queries with retrieval; Generic + Retrieval uses broadly topical questions that do not require the target document; Original, No Retrieval keeps the original queries but removes retrieved documents.
Figure 6: Impact of minimum number of entailed atomic sentences required to count a query as evidence of membership under Phi4-14B. We vary threshold n and report AUC across datasets while keeping the rest of the MEntA pipeline fixed. Effect of Number of Entailed Sentences. We further ablate the entailment rule by varying the minimum number of entailed atomic sentences required for a query to count as evidence of membership. By default, MEntA uses a permissive criterion of at least one entailed sentence, but we additionally test stricter thresholds requiring multiple entailed sentences before assigning a positive entailment hit. Figure 6 shows that the resulting AUC remains broadly stable across datasets as this threshold varies, indicating that the attack is not overly sensitive to the exact choice of n. This suggests that MEntA’s membership signal is not driven by a single fragile claim, but rather by a broader pattern of grounded evidence in the response. In practice, using n = 1 is a reasonable default because it is the most recall-friendly setting and already achieves strong separation, but the results indicate that any small choice of n is acceptable without materially changing overall attack effectiveness.
6.4
generated, document-specific questions, we test whether its gains come from true document dependence rather than topical relevance or the prepended summary alone. Original Queries vs. Generic Topical Queries. We compare MEntA’s default query-generation strategy with a generic-query baseline. The original strategy targets unique facts and different parts of the document, while the generic baseline asks broadly relevant topical questions that could plausibly be answered without access to the target document. Both settings use the same attack pipeline, Top-k = 3 retrieval, query budget, and entailment-based scoring, differing only in the query-generation prompt. Figure 7 shows that the original strategy consistently achieves higher AUC under Llama3.1-8B, outperforming generic queries by 0.109–0.214 AUC across datasets, indicating that topical relevance alone is insufficient and that strong queries must depend on retrieval of the target document.
Query Strategy Analysis (RQ3)
Original Queries with Retrieval vs. No Retrieval. We next test whether the prepended document summary alone
We analyze how query-generation strategy affects membership inference performance. Because MEntA relies on offline10
Figure 8: Query-budget ablation for MIA on NFCorpus, SCIDOCS, and TREC-COVID. We plot AUC-ROC versus the number of attacker queries per target document for IA and MEntA, and include DCMI [18], MBA [41], and S2 -MIA [38] as low-query reference points; MBA [41] and S2 -MIA [38] use one query, while DCMI [18] uses two queries (an original query and a perturbed variant). Error bars show variability across runs or query variations, and the dashed line at AUC=0.5 indicates random guessing. can produce a strong membership signal. We keep the original queries unchanged but remove retrieval entirely, so the generator receives only the summary-augmented query and no supporting documents. If the summary alone were enough to drive strong inference, performance would remain high even without retrieval. Instead, Figure 7 shows that AUC then drops to near-random performance: 0.493 on NFCorpus, 0.524 on SCIDOCS, and 0.483 on TREC-COVID. This confirms that the summary mainly helps steer retrieval, while the actual membership signal comes from grounded answering over retrieved evidence.
per API usage or resource computation. IA [46] uses (i) a shadow LLM to produce ground-truth answers and (ii) the target black-box RAG generator to obtain the corresponding RAG outputs, while MEntA uses (i) the same black-box generator with longer answers and (ii) an NLI model (tasksource/deberta-base-long-nli) to compute entailment-based membership scores. We use Top-k = 3 and the same query construction for both methods. Per-call pricing. Let a model X have input/output prices πXin and πXout in USD per 1M tokens. The cost of a call consuming πX
6.5
Efficiency Analysis (RQ4)
6.5.1
Query Efficiency
tin input tokens and tout output tokens is cX (tin ,tout ) = 10in6 tin + πXout t . 106 out
Per-query costs. IA [46] outputs are capped at 10 tokens (“Yes/No/I don’t know”) for both the shadow and black-box calls, while MEntA uses 100 output tokens for the black-box call. DeBERTa NLI is treated as an encoder-only inference workload rather than a token-billed API call. AWS Neuron benchmarks [2] report BERT-base-class models at $0.016– $0.078 per million inferences in throughput-oriented batch settings, and $0.051–$0.243 per million inferences in realtime settings. We conservatively adopt the upper real-time bound of $0.243 per million inferences, yielding a per-query NLI cost of cNLI ≈ $2.43 × 10−7 , which is two to three orders of magnitude below any LLM API call and thus constitutes a negligible component of MEntA’s total cost. Thus, the perSh , 10)+cBB (t BB , 10) and c query costs are cIA = cSh (tin MEntA = in BB BB NLI c (tin , 100) + c .
Figure 8 illustrates the query-budget trade-off for MEntA and IA [46] across NFCorpus, SCIDOCS, and TREC-COVID. MEntA achieves high AUC with few queries and saturates rapidly (e.g., within 5–10 queries on NFCorpus), whereas IA improves gradually and requires larger budgets to peak. This confirms MEntA extracts more membership signal per interaction by using semantically informative, entailmentverifiable prompts. We also contextualize low-query baselines: the singlequery MBA [41] and S2 -MIA [38], and the two-query DCMI [18] (original plus a perturbed variant). These consistently underperform MEntA, demonstrating that such constrained, often templated probing yields weaker signals. Overall, MEntA provides a superior operational trade-off, delivering strong, stable AUC at low budgets while remaining competitive even as IA scales with additional queries. 6.5.2
Model pricing. Shadow uses GPT-4o-mini with Sh (πSh in , πout ) = (0.15, 0.60) USD per 1M tokens [50]. For black-box generators, OpenRouter prices are used: Phi4-14B (0.06, 0.14), CommandR-7B (0.0375, 0.15), and Llama3.1-8B (0.02, 0.03) USD per 1M input/output tokens,
Financial Cost Efficiency
We compare the attacker’s financial cost of IA [46] and MEntA under a black-box setting where the attacker pays 11
Table 4: Query and attack cost for IA [46] vs. MEntA under each attack’s optimal budgets (IA [46]: 30 queries; MEntA: 5 queries). Costs use the per-1M-token prices stated in § 6.5.2. IA [46] includes one shadow call (GPT-4o-mini) plus one black-box RAG call per query (10 output tokens each), while MEntA includes one black-box RAG call per query (100 output tokens) plus DeBERTa-NLI entailment scoring. The ratio reports total attack cost IA/MEntA.
Table 5: Retriever sensitivity of MEntA using Llama3.1-8B as the RAG generator. We compare two retrievers (all-mpnetbase-v2 and gte-large) on NFCorpus, SCIDOCS, and TRECCOVID. Results are averaged over 5 query variations.
Generator Phi4-14B CommandR-7B Llama3.1-8B Gemma2-2B
$/query IA MEntA 1.12e-4 1.01e-4 9.13e-5 8.56e-5
4.42e-5 3.40e-5 1.32e-5 7.89e-6
$/attack IA MEntA 3.37e-3 3.04e-3 2.74e-3 2.57e-3
2.21e-4 1.70e-4 6.62e-5 3.95e-5
$/attack ratio IA/MEntA 15.24 17.87 41.37 65.06
AUC Accuracy
TPR@FPR 0.005 0.01 0.05
Dataset
Retriever
NFCorpus
all-mpnet-base-v2 0.935 gte-large 0.931
0.898 0.886
0.148 0.363 0.604 0.129 0.362 0.626
SCIDOCS
all-mpnet-base-v2 0.936 gte-large 0.939
0.911 0.914
0.396 0.623 0.795 0.375 0.626 0.804
TREC-COVID
all-mpnet-base-v2 0.801 gte-large 0.796
0.813 0.811
0.122 0.306 0.618 0.301 0.500 0.618
respectively. Since Gemma2-2B is not listed, its price is approximated as half of Gemma-3-4B’s input/output prices, yielding (0.0085, 0.034) USD per 1M tokens [52]. Cost comparison across generators. Table 4 reports the black-box input/output token prices and the resulting perquery costs for IA [46] and MEntA. The final column (cIA /cMEntA ) summarizes the relative overhead of IA [46] compared to MEntA for each generator. Across all generators, MEntA is more operationally favorable: cMEntA < cIA , as shown in Table 4. Notably, even when IA [46] uses its optimal budget of 30 queries per document, it remains significantly more expensive per attack than MEntA, which achieves comparable performance with only 5 queries. This reduction follows directly from avoiding IA [46]’s additional shadow-model call on every query, while the added expenses in MEntA (larger output budget and entailment scoring) remain comparatively small. The combination of lower cost per query and smaller required query budget makes MEntA strictly more cost-efficient than IA [46] for achieving comparable attack performance.
6.6
Figure 9: MEntA AUC vs. the number of retrieved documents k (Top-k) on NFCorpus, SCIDOCS, and TREC-COVID using Llama3.1-8B as the RAG generator. The query budget is fixed to 5 questions per target document, and we vary k ∈ {3, 5, 10, 20} to measure sensitivity to retrieval depth. Results show MEntA remains stable across k, indicating robustness to the retriever’s context size. Impact of Retriever Architecture. Table 5 compares MEntA’s effectiveness when the target RAG system uses different dense retrievers (all-mpnet-base-v2 vs. gte-large). The results indicate minimal sensitivity to the choice of retriever. On NFCorpus and SCIDOCS, AUC scores are nearly identical (e.g., 0.935 vs. 0.931 on NFCorpus). This confirms that MEntA’s success is driven by the semantic content of the retrieved document rather than artifacts of a specific embedding model.
Robustness to Retrieval Settings (RQ5)
We next test MEntA’s robustness against variations in the RAG retrieval component, specifically the number of retrieved documents (k) and the choice of retriever architecture.
6.7 Impact of Top-K Retrieval. We analyze the effect of varying the number of retrieved documents k on attack performance. Figure 9 shows MEntA’s AUC on Llama3.1-8B as k varies from 3 to 20. Performance remains highly stable across all datasets. For SCIDOCS, AUC stays consistently around 0.94 regardless of k. This stability suggests that MEntA is robust to the retriever’s precision; as long as the target document appears within the top retrieved results, the entailment signal remains strong.
Robustness against Defences (RQ6)
Finally, we examine the attacks’ robustness against RAG MIA defenses (see §C for defense setup). Can MEntA bypass input and output modification defenses? We evaluate MEntA and others under DP, Reranking, Prompt Instructions, and Query paraphrasing. Table 6 summarizes the results on Phi4-14B. MEntA demonstrates remarkable resilience. While DP noise reduces performance 12
Table 6: Impact of defenses on AUC scores. We use Phi4-14B as the RAG generator and a fixed budget of 5 queries per target document.
Table 7: Detector recall on attack queries. We report recall of the GPT-4 detector and Mirabel on prompts from IA [46], S2 -MIA [38], MBA [41], DCMI [18], and MEntA across NFCorpus, SCIDOCS, and TREC-COVID. Higher is better.
Dataset
Attack
None
DP
Rerank Prompt Inst. Paraphrase
NFCorpus
S2 MIA [38] MBA [41] IA [46] DCMI [18] MEntA (Ours)
0.711 0.874 0.756 0.828 0.989
0.655 0.803 0.518 0.828 0.913
0.669 0.876 0.752 0.832 0.975
0.850 0.824 0.754 0.773 0.984
0.883 0.805 0.722 0.843 0.977
Dataset
Attack
GPT-4
Mirabel
S2 MIA [38] MBA [41] IA [46] DCMI [18] MEntA (Ours)
0.715 0.891 0.915 0.941 0.991
0.671 0.790 0.543 0.943 0.916
0.655 0.855 0.937 0.942 0.986
0.849 0.876 0.901 0.862 0.992
0.874 0.791 0.880 0.910 0.953
NFCorpus
IA [46] S2 MIA [38] MBA [41] DCMI [18] MEntA (Ours)
0.073 0.766 0.910 0.750 0.061
0.725 0.824 0.448 0.682 0.738
TREC-COVID S2 MIA [38] MBA [41] IA [46] DCMI [18] MEntA (Ours)
0.604 0.781 0.816 0.886 0.893
0.586 0.727 0.487 0.889 0.836
0.558 0.781 0.820 0.873 0.904
0.699 0.743 0.820 0.827 0.908
0.731 0.728 0.779 0.846 0.846
SCIDOCS
IA [46] S2 MIA [38] MBA [41] DCMI [18] MEntA (Ours)
0.440 0.976 0.990 0.838 0.263
0.993 0.997 0.593 0.998 0.991
TREC-COVID
IA [46] S2 MIA [38] MBA [41] DCMI [18] MEntA (Ours)
0.118 0.869 0.952 0.748 0.058
0.400 0.541 0.466 0.626 0.454
SCIDOCS
slightly, MEntA still maintains strong AUCs (e.g., 0.913 on NFCorpus) compared to baselines which drop significantly. Specifically, IA [46] drops up to 0.372 AUC (further explanation in §C). Interestingly, defenses such as re-ranking and prompt instructions have little impact on MEntA. In some cases like Prompt Instruction on NFCorpus, MEntA even improves. This is expected: because MEntA scores membership via entailment, it is comparatively robust to input/output modifications that rewrite the query, retrieved context, or generated response. Entailment checks whether the response is supported by document-specific evidence, which is largely insensitive to surface-level paraphrasing; as a result, the membership signal remains stable under these perturbations. DCMI [18] is also consistent against most defenses (explanation in §C). However, due to lower AUC in normal setting, DCMI’s [18] performance under most defenses is also lower than MEntA.
Table 8: Detector FPR on benign queries. We report the FPR of GPT-4 detector and Mirabel on benign prompts from NFCorpus, SCIDOCS, and TREC-COVID. Lower is better. Dataset
GPT-4
Mirabel
NFCorpus SCIDOCS TREC-COVID
0.033 0.151 0.076
0.596 0.881 0.518
processing 1 million daily queries, an FPR of 0.881 would flag over 880,000 legitimate requests as attacks. This high FPR arises because Mirabel’s similarity-spike signal is not uniquely adversarial [9] as benign users frequently generate similar spikes when refining queries or asking follow-up questions on the same topic. While Mirabel reported lower FPRs on NQ [32] and TriviaQA [29], those datasets lack clustered, corpus-specific questions. Our evaluation uses BEIR-style corpora [66], tying queries to specific documents (§B). This realistic RAG setting naturally elevates benign similarity, making it difficult to differentiate legitimate topical iteration from attacks like MEntA without blocking valid traffic.
Can MEntA bypass LLM-based defense? We assess detectability using GPT-4 [51] (LLM-based detector). Table 7 shows that GPT-4 [51] rarely flags MEntA queries as attacks (Recall ∼0.06 on NFCorpus), similar to IA [46], whereas it easily catches templated attacks like MBA [41] (Recall ∼0.91). This confirms that MEntA’s queries appear benign. Can existing attacks bypass the latest MIA defense Mirabel? Table 7 indicates that Mirabel [9] detects all attacks, including MEntA, DCMI [18], S2 -MIA [38], MBA [41], and IA [46]. This suggests that multi-query attacks produce recognizable similarity patterns. However, this recall is achieved at a very aggressive operating point, where Mirabel [9] also misclassifies a large fraction of benign traffic as malicious (FPR of 0.881 on SCIDOCS) in Table 8. In real systems, such a FPR is unacceptable: it would block, throttle, or require extra verification for nearly 90% of legitimate user queries, severely degrading user experience. Consider that in a system
7
Conclusion
This work shows that membership inference against black-box RAG can be both practical and difficult to detect under realistic constraints. We presented MEntA, an entailment-based 13
Open Science
attack that uses non-templated, information-seeking queries and NLI verification to infer document membership without a shadow LLM, achieving strong performance with only a small query budget across multiple datasets, generators, and common RAG defenses. Our findings also expose a mismatch between current mitigations and realistic adversaries: query rewriting and instruction-based constraints reduce but do not eliminate document-specific evidence, and detection can be hard to deploy without high false positives on benign queries. Overall, these results motivate document-level, privacy-aware controls that limit cumulative exposure, and highlight the need for defenses that remain effective even when attacks succeed with only 5–10 queries.
MEntA is open source and available at https://zenodo. org/records/20335971. The implementation contains the attack baselines including DCMI [18], S2 -MIA [38], MBA [41], IA [46], and our MEntA design. We utilize public sources code of previous works. We also include the BEIR benchmark datasets [66] used in our evaluation (NFCorpus, SCIDOCS, and TREC-COVID).
References [1] Marah Abdin, Jyoti Aneja, Harkirat Behl, Sébastien Bubeck, Ronen Eldan, Suriya Gunasekar, Michael Harrison, Russell J. Hewett, Mojan Javaheripi, Piero Kauffmann, James R. Lee, Yin Tat Lee, Yuanzhi Li, Weishung Liu, Caio C. T. Mendes, Anh Nguyen, Eric Price, Gustavo de Rosa, Olli Saarikivi, Adil Salim, Shital Shah, Xin Wang, Rachel Ward, Yue Wu, Dingli Yu, Cyril Zhang, and Yi Zhang. Phi-4 technical report, 2024.
Ethical Considerations Our study evaluates MIA risks in RAG using only public BEIR datasets (NFCorpus, SCIDOCS, TREC-COVID [66]) containing no personally identifiable information, alongside open-source models. The GPT-4 family (GPT-4o, GPT-4omini, GPT-4.1-nano) is used strictly for offline auxiliary tasks: query and summary generation, and input detection defense. To ensure a safe, reproducible environment and avoid realworld privacy breaches, our evaluation does not target commercial RAG systems, enterprise infrastructure, or proprietary LLMs, aligning with prior evaluations like IA [46]. Nevertheless, the threat remains practically relevant. In enterprise search or finance RAG deployments, confirming a sensitive document’s existence constitutes a severe privacy breach. This impacts multiple stakeholders: data owners face harm if confidential records are inferred through repeated querying; developers urgently need privacy-aware retrieval and query monitoring to limit leakage; and security researchers benefit from understanding low-query attacks before malicious exploitation. We explicitly frame these implications because document-existence leakage on private corpora is a concrete, non-theoretical risk. We justify publication despite lacking a complete defense because this attack exploits a fundamental structural property of RAG—retrieved documents leaving detectable traces in generated answers—rather than a patchable bug. Withholding these findings will not reduce long-term risks, as malicious actors could independently rediscover them while defenders remain vulnerable. Proactive disclosure better serves the community by enabling earlier awareness, sharper threat modeling, and realistic privacy evaluations, aiming to support timely defensive progress rather than normalize offensive misuse. Consequently, we examine both the attack and potential mitigations (§ A.2). While not complete solutions, these mechanisms form part of a broader, deployment-aware defense strategy. Ultimately, this work intends to equip developers and researchers to understand and mitigate realistic RAG membership inference risks before they are actively exploited.
[2] Amazon Web Services. Inf1 Inference Performance — AWS Neuron Documentation. https: //awsdocs-neuron.readthedocs-hosted.com/en/ v2.26.0/general/benchmarks/inf1/index.html, September 2024. AWS Neuron SDK v2.26.0. Last updated: September 16, 2024. Accessed: May 20, 2026. [3] Maya Anderson, Guy Amit, and Abigail Goldsteen. Is my data in your retrieval database? membership inference attacks against retrieval augmented generation. In Proceedings of the 11th International Conference on Information Systems Security and Privacy, page 474–485. SCITEPRESS - Science and Technology Publications, 2025. [4] ApX Machine Learning. Rag cost control | usage quotas & budgets, 2025. [5] Atousa Arzanipour, Rouzbeh Behnia, Reza Ebrahimi, and Kaushik Dutta. Rag security and privacy: Formalizing the threat model and attack surface, 2025. [6] Johan Bos and Katja Markert. Recognising textual entailment with logical inference. In Raymond Mooney, Chris Brew, Lee-Feng Chien, and Katrin Kirchhoff, editors, Proceedings of the Conference on Human Language Technology and Empirical Methods in Natural Language Processing, pages 628–635, Vancouver, British Columbia, Canada, October 2005. Association for Computational Linguistics. [7] Lorenz Brehme, Benedikt Dornauer, Thomas Ströhle, Maximilian Ehrhart, and Ruth Breu. Retrievalaugmented generation in industry: An interview study on use cases, requirements, challenges, and evaluation. 14
In Proceedings of the 17th International Joint Conference on Knowledge Discovery, Knowledge Engineering and Knowledge Management, page 110–122. SCITEPRESS - Science and Technology Publications, 2025.
[16] Kaiyue Feng, Guangsheng Zhang, Huan Tian, Heng Xu, Yanjun Zhang, Tianqing Zhu, Ming Ding, and Bo Liu. Ragleak: Membership inference attacks on rag-based large language models. In Willy Susilo and Josef Pieprzyk, editors, Information Security and Privacy, pages 147–166, Singapore, 2025. Springer Nature Singapore.
[8] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914, 2022.
[17] Simone Filice, Elad Haramaty, Guy Horowitz, Zohar Karnin, Liane Lewin-Eytan, and Alex Shtoff. Generate but verify: Answering with faithfulness in RAG-based question answering. In Kentaro Inui, Sakriani Sakti, Haofen Wang, Derek F. Wong, Pushpak Bhattacharyya, Biplab Banerjee, Asif Ekbal, Tanmoy Chakraborty, and Dhirendra Pratap Singh, editors, Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics, pages 1017–1037, Mumbai, India, December 2025. The Asian Federation of Natural Language Processing and The Association for Computational Linguistics.
[9] Yujin Choi, Youngjoo Park, Junyoung Byun, Jaewook Lee, and Jinseong Park. Safeguarding privacy of retrieval data against membership inference attacks: Is this query too close to home? In Christos Christodoulopoulos, Tanmoy Chakraborty, Carolyn Rose, and Violet Peng, editors, Findings of the Association for Computational Linguistics: EMNLP 2025, pages 8241–8258, Suzhou, China, November 2025. Association for Computational Linguistics.
[18] Xinyu Gao, Xiangtao Meng, Yingkai Dong, Zheng Li, and Shanqing Guo. Dcmi: A differential calibration membership inference attack against retrievalaugmented generation. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS ’25, page 4184–4198, New York, NY, USA, 2025. Association for Computing Machinery.
[10] Stav Cohen, Ron Bitton, and Ben Nassi. Unleashing worms and extracting data: Escalating the outcome of attacks against rag-based inference in scale and severity using jailbreaking, 2024. [11] Team Cohere, :, Aakanksha, Arash Ahmadian, et al. Command a: An enterprise-ready large language model, 2025.
[19] Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yi Dai, Jiawei Sun, Meng Wang, and Haofen Wang. Retrieval-augmented generation for large language models: A survey, 2024.
[12] Cleo Condoravdi, Dick Crouch, Valeria de Paiva, Reinhard Stolle, and Daniel G. Bobrow. Entailment, intensionality and text understanding. In Proceedings of the HLT-NAACL 2003 Workshop on Text Meaning, pages 38–45, 2003.
[20] M. N. Ghosh. Bounds for the expected sample size in a sequential probability ratio test. Journal of the Royal Statistical Society. Series B (Methodological), 22(2):360– 367, 1960.
[13] Ido Dagan, Oren Glickman, and Bernardo Magnini. The pascal recognising textual entailment challenge. In Proceedings of the First International Conference on Machine Learning Challenges: Evaluating Predictive Uncertainty Visual Object Classification, and Recognizing Textual Entailment, MLCW’05, page 177–190, Berlin, Heidelberg, 2005. Springer-Verlag.
[21] Aaron Grattafiori, Abhimanyu Dubey, et al. The llama 3 herd of models, 2024. [22] Nicolas Grislain. Rag with differential privacy, 2025. [23] Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Ming-Wei Chang. Realm: retrieval-augmented language model pre-training. In Proceedings of the 37th International Conference on Machine Learning, ICML’20. JMLR.org, 2020.
[14] Thomas Diggelmann, Jordan Boyd-Graber, Jannis Bulian, Massimiliano Ciaramita, and Markus Leippold. Climate-fever: A dataset for verification of real-world climate claims, 2021.
[24] Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, and Ting Liu. A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. ACM Transactions on Information Systems, 43(2):1–55, January 2025.
[15] Yi Dong, Ronghui Mu, Gaojie Jin, Yi Qi, Jinwei Hu, Xingyu Zhao, Jie Meng, Wenjie Ruan, and Xiaowei Huang. Position: building guardrails for large language models requires systematic design. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org, 2024. 15
[25] Kuo-Han Hung, Ching-Yun Ko, Ambrish Rawat, I-Hsin Chung, Winston H. Hsu, and Pin-Yu Chen. Attention tracker: Detecting prompt injection attacks in LLMs. In Luis Chiruzzo, Alan Ritter, and Lu Wang, editors, Findings of the Association for Computational Linguistics: NAACL 2025, pages 2309–2322, Albuquerque, New Mexico, April 2025. Association for Computational Linguistics.
Ming-Wei Chang, Andrew M. Dai, Jakob Uszkoreit, Quoc Le, and Slav Petrov. Natural questions: A benchmark for question answering research. Transactions of the Association for Computational Linguistics, 7:452– 466, 2019. [33] Lakera. Lakera guard: Real-time security for your ai agents. https://www.lakera.ai/lakera-guard.
[26] Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614, 2023.
[34] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. Retrieval-augmented generation for knowledge-intensive nlp tasks. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS ’20, Red Hook, NY, USA, 2020. Curran Associates Inc.
[27] Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, Yang Chen, and Min Yang. Feedback-guided extraction of knowledge base from retrieval-augmented llm applications, 2025.
[35] Hao Li, Jiajun He, Guangshuo Wang, Dengguo Feng, Zheng Li, and Min Zhang. Budgetleak: Membership inference attacks on rag systems via the generation budget side channel, 2025.
[28] Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, Yang Chen, and Min Yang. Rag-thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks, 2025.
[36] Hao Li and Xiaogeng Liu. Injecguard: Benchmarking and mitigating over-defense in prompt injection guardrail models, 2025.
[29] Mandar Joshi, Eunsol Choi, Daniel Weld, and Luke Zettlemoyer. TriviaQA: A large scale distantly supervised challenge dataset for reading comprehension. In Regina Barzilay and Min-Yen Kan, editors, Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1601–1611, Vancouver, Canada, July 2017. Association for Computational Linguistics.
[37] Xiaoou Li, Jingchen Liu, and Zhiliang Ying. Generalized sequential probability ratio test for separate families of hypotheses. Sequential Analysis, 33(4):539–563, 2014. [38] Yuying Li, Gaoyang Liu, Chen Wang, and Yang Yang. Generating is believing: Membership inference attacks against retrieval-augmented generation. In ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5, 2025.
[30] Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. Dense passage retrieval for open-domain question answering. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu, editors, Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6769–6781, Online, November 2020. Association for Computational Linguistics.
[39] Zehan Li, Xin Zhang, Yanzhao Zhang, Dingkun Long, Pengjun Xie, and Meishan Zhang. Towards general text embeddings with multi-stage contrastive learning, 2023. [40] Lan Liu, Yi Wang, Gaoyang Liu, Kai Peng, and Chen Wang. Membership inference attacks against machine learning models via prediction sensitivity. IEEE Transactions on Dependable and Secure Computing, 20(3):2341–2347, 2023.
[31] Neema Kotonya and Francesca Toni. Explainable automated fact-checking for public health claims. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu, editors, EProceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 7740–7754, Online, November 2020. Association for Computational Linguistics.
[41] Mingrui Liu, Sixiao Zhang, and Cheng Long. Maskbased membership inference attacks for retrievalaugmented generation. In Proceedings of the ACM on Web Conference 2025, WWW ’25, page 2894–2907, New York, NY, USA, 2025. Association for Computing Machinery.
[32] Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, Kristina Toutanova, Llion Jones, Matthew Kelcey, 16
[42] Bill MacCartney and Christopher D. Manning. An extended model of natural logic. In Harry Bunt, editor, Proceedings of the Eight International Conference on Computational Semantics, pages 140–156, Tilburg, The Netherlands, January 2009. Association for Computational Linguistics.
[54] David Ponce, Thierry Etchegoyhen, Jesús Calleja, and Harritxu Gete. Split and rephrase with large language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors, Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 11588–11607, Bangkok, Thailand, August 2024. Association for Computational Linguistics.
[43] Omer Mayraz. Camoleak: Critical github copilot vulnerability leaks private source code, October 2025.
[55] Zhenting Qi, Hanlin Zhang, Eric Xing, Sham Kakade, and Himabindu Lakkaraju. Follow my instruction and spill the beans: Scalable data extraction from retrievalaugmented generation systems, 2024.
[44] R. Thomas McCoy, Ellie Pavlick, and Tal Linzen. Right for the wrong reasons: Diagnosing syntactic heuristics in natural language inference. In Anna Korhonen, David Traum, and Lluís Màrquez, editors, Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 3428–3448, Florence, Italy, July 2019. Association for Computational Linguistics.
[56] David Richards. Rag permission management: The overlooked enterprise blind spot, 2025. [57] Tal Schuster, Darsh Shah, Yun Jie Serene Yeo, Daniel Roberto Filizzola Ortiz, Enrico Santus, and Regina Barzilay. Towards debiasing fact verification models. In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors, Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 3419– 3425, Hong Kong, China, November 2019. Association for Computational Linguistics.
[45] Microsoft. Microsoft copilot studio | customize copilot and create ai agents, 2026. Accessed 2026-02-05. [46] Ali Naseh, Yuefeng Peng, Anshuman Suri, Harsh Chaudhari, Alina Oprea, and Amir Houmansadr. Riddle me this! stealthy membership inference for retrievalaugmented generation. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS ’25, page 1245–1259, New York, NY, USA, 2025. Association for Computing Machinery.
[58] Alessandro Scirè, Karim Ghonim, and Roberto Navigli. FENICE: Factuality evaluation of summarization based on natural language inference and claim extraction. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors, Findings of the Association for Computational Linguistics: ACL 2024, pages 14148–14161, Bangkok, Thailand, August 2024. Association for Computational Linguistics.
[47] Jerzy Neyman and Egon Sharpe Pearson. Ix. on the problem of the most efficient tests of statistical hypotheses. Philosophical Transactions of the Royal Society of London, Series A: Containing Papers of a Mathematical or Physical Character, 231(694-706):289–337, 02 1933. [48] Hy Nguyen, Nguyen Hung Nguyen, Linh Bao Nguyen, Srikanth Thudumu, and Rajesh Vasa. Hnsw++: A dualbranch hierarchical navigable small world graph with lid-guided skip bridge optimization. In AMCIS 2025 Proceedings, page 47, 2025.
[59] Tianneng Shi, Kaijie Zhu, Zhun Wang, Yuqi Jia, Will Cai, Weida Liang, Haonan Wang, Hend Alzahrani, Joshua Lu, Kenji Kawaguchi, Basel Alomair, Xuandong Zhao, William Yang Wang, Neil Gong, Wenbo Guo, and Dawn Song. Promptarmor: Simple yet effective prompt injection defenses, 2025.
[49] OpenAI. Klarna’s ai assistant does the work of 700 full-time agents, 2024. [50] OpenAI. Pricing. https://platform.openai.com/ docs/pricing, 2025. [51] OpenAI, Josh Achiam, Steven Adler, et al. Gpt-4 technical report, 2024. [52] OpenRouter. Models, 2026. Ml04:2023 member[53] OWASP Foundation. ship inference attack. https://owasp.org/ www-project-machine-learning-security-top-10/ docs/ML04_2023-Membership_Inference_Attack, 2023. 17
[60] Damien Sileo. tasksource: A large collection of NLP tasks with a structured dataset preprocessing framework. In Nicoletta Calzolari, Min-Yen Kan, Veronique Hoste, Alessandro Lenci, Sakriani Sakti, and Nianwen Xue, editors, Proceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING 2024), pages 15655–15684, Torino, Italia, May 2024. ELRA and ICCL. [61] Kaitao Song, Xu Tan, Tao Qin, Jianfeng Lu, and TieYan Liu. Mpnet: masked and permuted pre-training for language understanding. In Proceedings of the 34th
[72] Rui Wen, Zheng Li, Michael Backes, and Yang Zhang. Membership inference attacks against in-context learning. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS ’24, page 3481–3495, New York, NY, USA, 2024. Association for Computing Machinery.
International Conference on Neural Information Processing Systems, NIPS ’20, Red Hook, NY, USA, 2020. Curran Associates Inc. [62] Shixuan Sun, Siyuan Liang, Ruoyu Chen, Jianjie Huang, Jingzhi Li, and Xiaochun Cao. Sma: Who said that? auditing membership leakage in semi-black-box rag controlling, 2025.
[73] Yunqi Xu, Tianchi Cai, Jiyan Jiang, and Xierui Song. Face4rag: Factual consistency evaluation for retrieval augmented generation in chinese. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD ’24, page 6083–6094. ACM, August 2024.
[63] Swiss Bankers Association. Generative ai in banking – a comprehensive overview, 2025. [64] Yufei Tao, Adam Hiatt, Rahul Seetharaman, and Ameeta Agrawal. “lost-in-the-later”: Framework for quantifying contextual grounding in large language models. In 2025 IEEE International Conference on Data Mining Workshops (ICDMW), pages 1703–1712, 2025.
[74] Zhiwen You and Yue Guo. Plainqafact: Retrievalaugmented factual consistency evaluation metric for biomedical plain language summarization, 2025.
[65] Gemma Team, Morgane Riviere, et al. Gemma 2: Improving open language models at a practical size, 2024.
[75] Shenglai Zeng, Jiankun Zhang, Pengfei He, Yiding Liu, Yue Xing, Han Xu, Jie Ren, Yi Chang, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. The good and the bad: Exploring privacy issues in retrieval-augmented generation (RAG). In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors, Findings of the Association for Computational Linguistics: ACL 2024, pages 4505–4524, Bangkok, Thailand, August 2024. Association for Computational Linguistics.
[66] Nandan Thakur, Nils Reimers, Andreas Rücklé, Abhishek Srivastava, and Iryna Gurevych. Beir: A heterogenous benchmark for zero-shot evaluation of information retrieval models, 2021. [67] James Thorne, Andreas Vlachos, Christos Christodoulopoulos, and Arpit Mittal. FEVER: a large-scale dataset for fact extraction and VERification. In Marilyn Walker, Heng Ji, and Amanda Stent, editors, Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers), pages 809–819, New Orleans, Louisiana, June 2018. Association for Computational Linguistics.
[76] Yuheng Zha, Yichi Yang, Ruichen Li, and Zhiting Hu. AlignScore: Evaluating factual consistency with a unified alignment function. In Anna Rogers, Jordan BoydGraber, and Naoaki Okazaki, editors, Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 11328–11348, Toronto, Canada, July 2023. Association for Computational Linguistics.
[68] David Wadden, Shanchuan Lin, Kyle Lo, Lucy Lu Wang, Madeleine van Zuylen, Arman Cohan, and Hannaneh Hajishirzi. Fact or fiction: Verifying scientific claims. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu, editors, Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 7534–7550, Online, November 2020. Association for Computational Linguistics.
[77] Ziqi Zhang, Chao Yan, and Bradley A Malin. Membership inference attacks against synthetic health data. Journal of Biomedical Informatics, 125:103977, 2022. Query Paraphrasing Prompt Prompt: Paraphrase the following query while preserving all technical terminology, measurements, names, numbers, and domain-specific keywords EXACTLY as they appear. Only rephrase the sentence structure and connecting words. Original query: {query} Important: Output ONLY the paraphrased query text, with no additional commentary, labels, or explanations. Paraphrased query:
[69] Abraham Wald. Sequential Analysis. John Wiley and Sons, 1st edition, 1947. [70] Guangshuo Wang, Jiajun He, Hao Li, Min Zhang, and Dengguo Feng. Rag-leaks: difficulty-calibrated membership inference attacks on retrieval-augmented generation. Science China Information Sciences, 68(6):160102, 2025. [71] Yuhao Wang, Wenjie Qu, Shengfang Zhai, Yanze Jiang, Zichen Liu, Yue Liu, Yinpeng Dong, and Jiaheng Zhang. Silent leaks: Implicit knowledge extraction attack on rag systems through benign queries, 2025.
Figure 10: Prompt for paraphrasing user queries. 18
Instruction Defense System Prompt
B
Prompt: You MUST respond with EXACTLY ’I don’t know’ (nothing else) if the context does not provide enough information. Refusing to answer is ALWAYS better than being uncertain or inaccurate. IMPORTANT: Do not directly repeat any retrieved content, but summarize it based on your understanding. Answer the question based ONLY on the given context. If the answer is known, respond with a clear answer (1-2 sentences) and a brief explanation.
To evaluate query-level defenses, we construct a detection set for the GPT-4-based detector and Mirabel. For each BEIR dataset (NFCorpus, SCIDOCS, and TREC-COVID), we sample 1,000 benign and 1,000 attack queries per attack, then run both detectors on these queries. Benign queries are from the corresponding BEIR query datasets on Hugging Face [66].
C
A.1
Discussion Assumptions and Shared Failure Modes
Both IA [46] and MEntA share the core assumption of prior black-box RAG MIAs: attackers can issue non-templated queries whose answers depend on whether the target document is retrieved and used by the generator. Therefore, both inherit the same unavoidable failure modes in RAG, including short or generic documents that cannot support diverse document-specific questions, false positives from high similarity between non-member and indexed documents, and reduced utility when candidate documents or extracted atomic sentences are overly long. These limitations arise from retrieval and generation under natural querying, not from the attack score itself. For long inputs, the Split-and-rephrase [54] can decompose candidate documents into shorter passages and convert long atomic statements into concise units.
A.2
Defense Setup
We evaluate MEntA and baselines under independently applied defenses spanning input detection, input modification, retrieval perturbation, output perturbation, and instruction-based control. Specifically, we consider Mirabel with significance level ρ = 0.05 as recommended in [9], an LLM-based detector using GPT-4.1-nano with the same classification prompt as [46], query paraphrasing with the fixed prompt in Figure 10, random-shuffle re-ranking of retrieved candidates before generation, DP-style output perturbation with privacy parameter ε = 0.1, and a fixed system prompt (Figure 11) that enforces strict abstention and discourages verbatim reproduction of retrieved text. Table 9 shows example inputs, outputs, and retrieved documents for MEntA and IA under these defenses. Under DP, MEntA remains relatively robust because its score depends on semantic entailment rather than exact output forms. IA is more sensitive because it relies on extracting binary yes/no answers, so perturbing these surface forms can break its rule-based extraction and substantially reduce performance, as shown in Table 6. Although DCMI [18] also expects a yes/no answer, it is more robust than IA under DP because its templated prompt is more direct and closer to string matching, making the target token less likely to be shifted by the injected noise.
Figure 11: System prompt used for instruction defense.
A
Detection Query Database Construction
RAG Prompt Templates System Prompt (Abstention Rule): You MUST respond with EXACTLY ’I don’t know’ (nothing else) if the context does not provide enough information. Refusing to answer is ALWAYS better than being uncertain or inaccurate. Answer the question based ONLY on the given context. If the answer is known, respond with a clear answer (1-2 sentences) and a brief explanation. User Prompt (Context-Grounded QA Template): Based on the following context, answer the question. If the context does not contain enough information to answer the question, respond only with ’I don’t know’. Context:{context}. Question: {query}. Answer:
Future Defense
A practical defense direction is to combine document-level exposure controls with session-level monitoring for iterative, semantically related queries. When the same document is repeatedly retrieved within a short interaction window, the system can trigger throttling, stronger authentication, or temporary refusal. The generator may further reduce exposure by switching to shorter, more abstract responses and avoiding rare or highly specific details under suspicious multi-query behavior. A promising future direction is to extend similaritybased detectors to capture semantic overlap across a session, which may help mitigate low-query attacks such as MEntA while reducing FPR, though it is not a complete solution.
Figure 12: Prompt templates used in RAG system. 19
Table 9: Example queries, outputs, and retrieved documents for MEntA and IA under input modification and DP defenses. Defense No defense
DP
Query According to the findings, does caffeine intake from beverages like coffee or tea show a significant relation to ovulatory disorder infertility? Same as no defense
MEntA Output Docs According to study [1], MED-3588, caffeine intake was MED-2158 found to be “unrelated” to the risk of ovulatory disorder infertility...
intake “alcohol” were unrelated Prompt instruction Same as no defense The study found that overall caffeine intake did not relate to ovulatory disorder infertility, but... Re-ranking Same as no defense The study found that total caffeine intake was “unrelated” to the risk of ovulatory disorder infertility... Query paraphrase Do substantial corre- No, according to study lations exist between [1], caffeine intake from caffeinated drinks and most sources did not ovulation-related fertil- show correlation with ity issues? ovulatory disorders...
D
IA MED-3700,
Query Output Does the study follow Yes 18,555 married women without a history of infertility?
Docs MED-3588, MED-3766
MED-3588, MED-3766 MED-3588, MED-3766
MED-3700,
MED-3700,
MED-3588, MED-2158 MED-3588, MED-2158
MED-3700,
Same as no defense
according.
MED-3700,
Same as no defense
Yes
MED-2158, MED-3700
MED-3588,
Same as no defense
Yes
MED-3700, MED-3588
MED-3766,
MED-3588, MED-2158
MED-3700,
Are there 18,555 mar- Yes ried females in the research who do not have an experience of being infertile?
MED-3588, MED-3766
MED-3700,
MED-3700,
MEntA Prompts and Refusal Hypotheses
For reproducibility, we list the prompt templates and refusal hypotheses used in MEntA. Figure 13 shows the querygeneration prompt used with an offline LLM (GPT-4.1nano) to produce n diverse, document-specific questions QD . MEntA also generates a short summary SD of the target document and prepends it to each query to improve retrieval, following the same summarization template as [46]. At inference time, MEntA uses the RAG prompt templates in Figure 12: a fixed system prompt to enforce abstention when context is insufficient, and a per-query user prompt to ground answers in the retrieved context {context} and query {query}. To penalize non-informative answers, MEntA detects abstentions by splitting each response into atomic claims and using NLI to compare them against a small set of paraphrased IDK hypotheses: “I don’t have enough information to answer this question,” “The provided text does not contain the answer to this question,” “I cannot determine the answer from the given information,” “This information is not mentioned in the provided text,” “I am unable to answer based on the available information,” “There is no information provided about this,” and “The text does not specify this information.” If any claim entails one of these hypotheses, the query is marked as an abstention and receives a refusal penalty in the membership score (see § 5). Using multiple paraphrased hypotheses improves robustness to different refusal phrasings while remaining consistent with the system-level abstention rule.
Query Generation Prompt Template Prompt: Given the document below, generate {num_queries} highly specific questions that can be answered by this document. Document: {target_document} Requirements: • Generate exactly {num_queries} different questions • Critical: The set of questions must cover all different aspects/sections of the document. • Distribution: Do not focus all questions on a single fact. If the text has a beginning, middle, and end, or multiple distinct points, ensure the {num_queries} questions are distributed across these different parts. • Each question should require specific information from the document • Focus on unique details, specific facts, or specific combinations of information • Make each query different by using different phrasing, focusing on different aspects, varying question structure • Do not mention “the document”, “the text”, “this passage”, or similar references • Do not add meta-preambles like “Here is a question:”, “Question:”, or “Query:” • If the text uses any abbreviations or acronyms, use the same forms in your questions • Avoid mentioning ‘the study’ or any references to the passage itself Output format: QUERY_1: [first question here] QUERY_2: [second question here] QUERY_3: [third question here] ... Generate {num_queries} queries now:
Figure 13: Prompt template for generating queries for MEntA.
20