Tab-MIA: A Benchmark Dataset for Membership Inference Attacks on Tabular Data in LLMs

TL;DR

This paper introduces Tab-MIA, a benchmark dataset for evaluating membership inference attacks on large language models trained on tabular data, revealing high vulnerability even after limited fine-tuning.

Contribution

It presents the first benchmark dataset and evaluation framework for MIAs on LLMs with tabular data, highlighting format-dependent memorization and privacy risks.

Findings

LLMs memorize tabular data variably across encoding formats.

Models fine-tuned for few epochs are highly vulnerable to MIAs.

High AUROC scores (~90%) indicate significant privacy risks.

Abstract

Large language models (LLMs) are increasingly trained on tabular data, which, unlike unstructured text, often contains personally identifiable information (PII) in a highly structured and explicit format. As a result, privacy risks arise, since sensitive records can be inadvertently retained by the model and exposed through data extraction or membership inference attacks (MIAs). While existing MIA methods primarily target textual content, their efficacy and threat implications may differ when applied to structured data, due to its limited content, diverse data types, unique value distributions, and column-level semantics. In this paper, we present Tab-MIA, a benchmark dataset for evaluating MIAs on tabular data in LLMs and demonstrate how it can be used. Tab-MIA comprises five data collections, each represented in six different encoding formats. Using our Tab-MIA benchmark, we conduct the first evaluation of state-of-the-art MIA methods on LLMs finetuned with tabular data across multiple encoding formats. In the evaluation, we analyze the memorization behavior of pretrained LLMs on structured data derived from Wikipedia tables. Our findings show that LLMs memorize tabular data in ways that vary across encoding formats, making them susceptible to extraction via MIAs. Even when fine-tuned for as few as three epochs, models exhibit high vulnerability, with AUROC scores approaching 90% in most cases. Tab-MIA enables systematic evaluation of these risks and provides a foundation for developing privacy-preserving methods for tabular data in LLMs.