When Reasoning Leaks Membership: Membership Inference Attack on Black-box Large Reasoning Models

TL;DR

This paper demonstrates that black-box large reasoning models leak membership information through reasoning traces, posing privacy risks, and introduces BlackSpectrum, a novel attack framework exploiting these traces to infer training data membership.

Contribution

The paper is the first to systematically explore membership inference attacks on black-box large reasoning models and proposes the BlackSpectrum attack framework leveraging reasoning trace representations.

Findings

Exposing reasoning traces increases vulnerability to membership inference attacks.

BlackSpectrum effectively predicts data membership with high accuracy.

New datasets arXivReasoning and BookReasoning support future research.

Abstract

Large Reasoning Models (LRMs) have rapidly gained prominence for their strong performance in solving complex tasks. Many modern black-box LRMs expose the intermediate reasoning traces through APIs to improve transparency (e.g., Gemini-2.5 and Claude-sonnet). Despite their benefits, we find that these traces can leak membership signals, creating a new privacy threat even without access to token logits used in prior attacks. In this work, we initiate the first systematic exploration of Membership Inference Attacks (MIAs) on black-box LRMs. Our preliminary analysis shows that LRMs produce confident, recall-like reasoning traces on familiar training member samples but more hesitant, inference-like reasoning traces on non-members. The representations of these traces are continuously distributed in the semantic latent space, spanning from familiar to unfamiliar samples. Building on this observation, we propose BlackSpectrum, the first membership inference attack framework targeting the black-box LRMs. The key idea is to construct a recall-inference axis in the semantic latent space, based on representations derived from the exposed traces. By locating where a query sample falls along this axis, the attacker can obtain a membership score and predict how likely it is to be a member of the training data. Additionally, to address the limitations of outdated datasets unsuited to modern LRMs, we provide two new datasets to support future research, arXivReasoning and BookReasoning. Empirically, exposing reasoning traces significantly increases the vulnerability of LRMs to membership inference attacks, leading to large gains in attack performance. Our findings highlight the need for LRM companies to balance transparency in intermediate reasoning traces with privacy preservation.