Context-based attacks reveal private documents in AI retrieval systems
CIG-MIA: Context-Induced Information Gain Membership Inference Attacks against Retrieval-Augmented Generation
Cryptography and Security
Summary
Sometimes AI models use extra documents to help answer questions, but it can be possible to tell if a specific document is included in their knowledge. The authors show that by adding a candidate document into the AI’s input and seeing how much the model’s confidence changes, they can guess if the document is already part of the model’s information. They tested this idea in situations where you can partly or only indirectly observe the model’s answers and it worked well across several datasets.
What this means in practice
- •For security engineers: Assess privacy risks in AI systems that combine external documents with language models by detecting if sensitive data is included in their knowledge base.
- •For data privacy officers: Evaluate compliance and potential information leakage in AI services that answer queries using proprietary or private documents.
Authors
Tan Xue, Huo Chang, Wang Changhui, Yang Sanrui, Li Heng, Chen Ping, Luo Xiapu
Abstract
Retrieval-augmented generation (RAG) systems ground large language models on external knowledge bases, enabling access to private, domain-specific, and up-to-date knowledge without retraining. However, the same retrieval interface can expose whether a candidate document is contained in the knowledge base. This paper studies knowledge base membership inference against RAG systems under both gray-box and text-only black-box access. Existing RAG membership inference attacks rely on signals such as direct membership prompts, response similarity, mask recovery, or query perturbation, which can be sensitive to prompt defenses, semantically related retrieved documents, and the generator's parametric knowledge. We introduce CIG-MIA, a membership inference attack based on context-induced information gain. The key insight is that explicit candidate-document injection affects members and non-members differently: if a document is already available through retrieval, injection provides little additional support for document-derived answers; if it is absent, injection introduces new evidence and yields a larger likelihood gain. In the gray-box setting, CIG-MIA computes this gain directly from token-level likelihoods. In the black-box setting, it estimates the same gain from generated text by scoring selected answer tokens with a lightweight surrogate-based estimator using semantic similarity and exact-match features. We evaluate CIG-MIA on Natural Questions, MS-MARCO, and HealthCareMagic against recent RAG membership inference baselines. On Natural Questions, CIG-MIA achieves an AUC of 0.99 in the gray-box setting and 0.93 in the black-box setting. We further analyze the information-gain signal, RAG configuration effects, ablations, and robustness to paraphrasing and generation randomness.