{
  "abstract": "Membership inference attacks (MIAs) have emerged as critical tools for auditing privacy risks in large language models (LLMs), aiming to determine whether a given text was included in a model's training corpus. However, most existing MIAs require access to per-token logits or probabilities, making them inapplicable in practice to proprietary LLMs that expose only textual continuations. To address this underexplored setting, we propose Word-level Probability MIA (WPMIA), a statistically principled MIA for strict black-box privacy auditing. WPMIA estimates word-level generation probabilities via Monte Carlo sampling with local kernel smoothing, then aggregates these estimates into a sequence-level likelihood estimator. Furthermore, WPMIA constructs the likelihood conditioned on different prefixes, thereby amplifying the distributional differences between members and non-members. We evaluate WPMIA across various open-source LLMs and find that it consistently outperforms existing black-box baselines. Importantly, we also evaluate WPMIA on modern proprietary LLMs, including GPT-5-Chat, Gemini-2.5-Flash, and Claude-4.5-Haiku, achieving an average TPR@5\\%FPR of 42.0 across these models. These results offer a sound foundation for future research on strict black-box membership inference. Code is available at \\href{https://github.com/niusj03/WPMIA}{https://github.com/niusj03/WPMIA}.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": "2609.10611",
  "author_total": 3,
  "authors": [
    {
      "name": "Shengjie Niu"
    },
    {
      "name": "Yeheng Ge"
    },
    {
      "name": "Jian Huang"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/ahwyckhft4616.bib",
  "cited_by": 0,
  "doi": "10.48550/arxiv.2609.10611",
  "fulltext_url": null,
  "id": "ahwyckhft4616",
  "issns": [],
  "landing_url": "https://arxiv.org/abs/2609.10611",
  "language": null,
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "http://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": "CC0-1.0",
  "native_subjects": [
    [
      "arxiv",
      "cs.CR"
    ],
    [
      "arxiv",
      "cs.LG"
    ],
    [
      "arxiv",
      "stat.ML"
    ],
    [
      "openalex",
      "1702|Privacy-Preserving Technologies in Data"
    ]
  ],
  "openalex": "W7212287809",
  "pdf_url": "https://arxiv.org/pdf/2609.10611",
  "pmcid": null,
  "pmid": null,
  "published": "2026-09-08",
  "publisher": null,
  "ris": "https://research.draconitic.com/paper/ahwyckhft4616.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:20:36Z",
      "native_id": "2609.10611",
      "source": "arxiv",
      "url": "https://arxiv.org/abs/2609.10611"
    }
  ],
  "subjects": [
    {
      "field": "mathematics",
      "origin": "arxiv:stat.ML",
      "subfield": "statistics"
    }
  ],
  "title": "Black-Box Membership Inference via Word-Level Probability Estimation",
  "title_text": "Black-Box Membership Inference via Word-Level Probability Estimation",
  "type": "preprint",
  "updated_at": "2026-10-30T12:20:36Z",
  "url": "https://research.draconitic.com/paper/ahwyckhft4616",
  "venue": "arXiv",
  "versions": []
}