A new one-round trick lets researchers guess whether your data trained a model without needing to train a second one.
The technique comes from the paper 'Calibrating One-Round Membership Inference with Neighbors' (arXiv:2609.36331), published today. Membership inference attacks try to determine whether a specific example was used to train a model, and the strongest versions calibrate their guess using reference models - copies trained without that example. Training reference models for today's large models is too costly, so one-round attacks, which only get access to a single trained model, usually produce a much weaker signal. The researchers found that querying the target model on neighbors of the point in question, especially against an early training checkpoint, reproduces the calibration information reference models would have given.
That matters because membership inference is the main tool auditors, journalists, and litigants use to check whether a model was trained on data it shouldn't have touched, from copyrighted books to leaked medical records. Cutting out the need for extra training could make privacy audits of expensive-to-retrain models dramatically cheaper and more accessible.
The catch: the paper only tests three image classification datasets and three training setups, not the language or multimodal models most people mean when they ask 'was my data used to train this.' Extending the neighbor trick to text and generative models is the obvious next step. Until someone runs that experiment, treat this as a promising lab result rather than a ready-made auditing tool for the models most people actually worry about.