{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,15]],"date-time":"2026-07-15T09:18:54Z","timestamp":1784107134304,"version":"3.55.0"},"reference-count":44,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,4,6]],"date-time":"2025-04-06T00:00:00Z","timestamp":1743897600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,4,6]],"date-time":"2025-04-06T00:00:00Z","timestamp":1743897600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100009950","name":"Ministry of Education","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100009950","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100009950","name":"Ministry of Education","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100009950","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,4,6]]},"DOI":"10.1109\/icassp49660.2025.10889013","type":"proceedings-article","created":{"date-parts":[[2025,3,12]],"date-time":"2025-03-12T13:56:59Z","timestamp":1741787819000},"page":"1-5","source":"Crossref","is-referenced-by-count":12,"title":["Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation"],"prefix":"10.1109","author":[{"given":"Yuying","family":"Li","sequence":"first","affiliation":[{"name":"Hubei University,Key Laboratory of Intelligent Sensing System and Security (Ministry of Education), School of Artificial Intelligence,Wuhan,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gaoyang","family":"Liu","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology,Hubei Key Laboratory of Smart Internet Technology,Wuhan,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chen","family":"Wang","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology,Hubei Key Laboratory of Smart Internet Technology,Wuhan,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yang","family":"Yang","sequence":"additional","affiliation":[{"name":"Hubei University,Key Laboratory of Intelligent Sensing System and Security (Ministry of Education), School of Artificial Intelligence,Wuhan,China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.463"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i17.29859"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01845"},{"key":"ref4","article-title":"Self-rag: Learning to retrieve, generate, and critique through self-reflection","volume-title":"Proceedings of ICLR","author":"Asai"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.164"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP48485.2024.10447448"},{"key":"ref7","article-title":"Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models","author":"Zou","year":"2024","journal-title":"CoRR"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.267"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.14722\/aiscc.2024.23018"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671932"},{"key":"ref11","article-title":"Is my data in your retrieval database? membership inference attacks against retrieval augmented generation","author":"Anderson","year":"2024","journal-title":"CoRR"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00449"},{"key":"ref13","first-page":"2369","article-title":"Did the neurons read your book? document-level membership inference for large language models","volume-title":"Proceedings of USENIX Security","author":"Meeus"},{"key":"ref14","article-title":"Llm dataset inference: Did you train on my dataset?","author":"Maini","year":"2024","journal-title":"CoRR"},{"key":"ref15","article-title":"Large language models: A survey","author":"Minaee","year":"2024","journal-title":"CoRR"},{"key":"ref16","article-title":"Balancing diversity and risk in llm sampling: How to select your method and parameter for open-ended text generation","author":"Zhou","year":"2024","journal-title":"CoRR"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.765"},{"key":"ref18","first-page":"31210","article-title":"Large language models can be easily distracted by irrelevant context","volume-title":"Proceedings of ICML","author":"Shi"},{"key":"ref19","article-title":"Ra-dit: Retrieval-augmented dual instruction tuning","volume-title":"Proceedings of ICLR","author":"Lin"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671470"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.546"},{"key":"ref22","article-title":"Privacy auditing of large language models","volume-title":"Proceedings of ICML Workshop NextGenAISafety","author":"Panda"},{"key":"ref23","article-title":"Bert: Pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2018","journal-title":"CoRR"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00276"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P17-1147"},{"key":"ref26","article-title":"Mitigating the privacy issues in retrieval-augmented generation (rag) via pure synthetic data","author":"Zeng","year":"2024","journal-title":"CoRR"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.1236"},{"key":"ref28","first-page":"3929","article-title":"Retrieval augmented language model pre-training","volume-title":"Proceedings of ICML","author":"Guu"},{"key":"ref29","article-title":"Llama 2: Open foundation and fine-tuned chat models","author":"Touvron","year":"2023","journal-title":"CoRR"},{"issue":"3","key":"ref30","first-page":"6","article-title":"Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality","volume":"2","author":"Chiang","year":"2023"},{"issue":"9","key":"ref31","article-title":"Stanford alpaca: an instruction-following llama model (2023)","volume":"1","author":"Taori","year":"2023"},{"key":"ref32","article-title":"Language models are few-shot learners","author":"Brown","year":"2020","journal-title":"CoRR"},{"key":"ref33","article-title":"Unsupervised dense information retrieval with contrastive learning","author":"Izacard","year":"2022","journal-title":"Transactions on Machine Learning Research"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.550"},{"key":"ref35","article-title":"Do membership inference attacks work on large language models?","author":"Duan","year":"2024","journal-title":"CoRR"},{"key":"ref36","first-page":"8717","article-title":"Are diffusion models vulnerable to membership inference attacks?","volume-title":"Proceedings of ICML","author":"Duan"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"ref38","first-page":"2633","article-title":"Extracting training data from large language models","volume-title":"Proceedings of USENIX Security","author":"Carlini"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.719"},{"key":"ref40","article-title":"Detecting pretraining data from large language models","volume-title":"Proceedings of ICLR","author":"Shi"},{"key":"ref41","article-title":"Baseline defenses for adversarial attacks against aligned language models","author":"Jain","year":"2023","journal-title":"CoRR"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3626772.3657959"},{"key":"ref43","article-title":"Investigating the prompt leakage effect and black-box defenses for multi-turn llm interactions","author":"Agarwal","year":"2024","journal-title":"CoRR"},{"key":"ref44","article-title":"Rankrag: Unifying context ranking with retrieval-augmented generation in llms","author":"Yu","year":"2024","journal-title":"CoRR"}],"event":{"name":"ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","location":"Hyderabad, India","start":{"date-parts":[[2025,4,6]]},"end":{"date-parts":[[2025,4,11]]}},"container-title":["ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10887540\/10887541\/10889013.pdf?arnumber=10889013","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,25]],"date-time":"2026-03-25T05:22:17Z","timestamp":1774416137000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10889013\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4,6]]},"references-count":44,"URL":"https:\/\/doi.org\/10.1109\/icassp49660.2025.10889013","relation":{},"subject":[],"published":{"date-parts":[[2025,4,6]]}}}