DistractMIA: Black-Box Membership Inference on Vision-Language Models via Semantic Distraction

TL;DR

DistractMIA introduces a novel black-box membership inference method for vision-language models that relies on semantic distraction and response stability, outperforming existing techniques across various benchmarks.

Contribution

It proposes a new output-only framework using semantic distraction for membership inference on VLMs, effective even without access to model probabilities or logits.

Findings

Outperforms existing output-only and stronger-access baselines.

Effective across multiple VLMs and benchmarks.

Applicable to medical image-text benchmarks beyond object-centric images.

Abstract

Vision-language models (VLMs) are trained on large-scale image-text corpora that may contain private, copyrighted, or otherwise sensitive data, motivating membership inference as a tool for training-data auditing. This is especially challenging for deployed VLMs, where auditors typically observe only generated textual responses. Existing VLM membership inference attacks either rely on probability-level signals unavailable in such settings, or use mask-based semantic prediction tasks whose effectiveness depends on object-centric visual assumptions. To address these limitations, we propose DistractMIA, an output-only black-box framework based on semantic distraction. Rather than removing visual evidence, DistractMIA preserves the original image, inserts a known semantic distractor, and measures how generated responses change. This design is motivated by the intuition that member samples remain more anchored to the original image semantics, while non-member samples are more easily redirected toward the distractor. To make this signal reliable, DistractMIA calibrates distractor configurations on a reference set and derives membership scores from repeated textual generations, capturing response stability and distractor uptake without accessing logits, probabilities, or hidden states. Experiments across multiple VLMs and benchmarks show that DistractMIA consistently outperforms both output-only and stronger-access baselines. Its performance on a medical benchmark further demonstrates applicability beyond object-centric natural images.