SMA: Who Said That? Auditing Membership Leakage in Semi-Black-box RAG Controlling

TL;DR

This paper introduces SMA, a novel method for fine-grained source attribution in retrieval-augmented generative models, enhancing privacy accountability by identifying content origins across modalities in semi-black-box settings.

Contribution

SMA is the first source-aware membership audit that enables detailed attribution of generated content to its sources, including retrieval traces and external inputs, in complex multimodal systems.

Findings

Effective source attribution in semi-black-box RAG systems.

Robust approximation of input influence via perturbation sampling.

First token-level attribution for image retrieval traces.

Abstract

Retrieval-Augmented Generation (RAG) and its Multimodal Retrieval-Augmented Generation (MRAG) significantly improve the knowledge coverage and contextual understanding of Large Language Models (LLMs) by introducing external knowledge sources. However, retrieval and multimodal fusion obscure content provenance, rendering existing membership inference methods unable to reliably attribute generated outputs to pre-training, external retrieval, or user input, thus undermining privacy leakage accountability To address these challenges, we propose the first Source-aware Membership Audit (SMA) that enables fine-grained source attribution of generated content in a semi-black-box setting with retrieval control capabilities. To address the environmental constraints of semi-black-box auditing, we further design an attribution estimation mechanism based on zero-order optimization, which robustly approximates the true influence of input tokens on the output through large-scale perturbation sampling and ridge regression modeling. In addition, SMA introduces a cross-modal attribution technique that projects image inputs into textual descriptions via MLLMs, enabling token-level attribution in the text modality, which for the first time facilitates membership inference on image retrieval traces in MRAG systems. This work shifts the focus of membership inference from 'whether the data has been memorized' to 'where the content is sourced from', offering a novel perspective for auditing data provenance in complex generative systems.