A unified privacy attack now works against three classes of generative AI — no model-specific tuning required.
Researchers published a framework that can run membership inference attacks — tests that determine whether a specific piece of data was used to train a model — across text-to-text, text-to-image, and image-to-text systems. Prior methods worked on one model class at a time, which made them academic curiosities more than practical tools. The new approach relies on a modality-agnostic observation: a generative model's output distribution tends to approximate its training data distribution. From there, the researchers map generated outputs and non-member samples into a shared embedding space and apply likelihood ratio testing to flag likely training members. Experiments ran in a strict black-box setting, meaning the attackers never touched model weights — only queried the model as an external user would.
The practical implication is that anyone auditing an AI system for privacy compliance — or trying to prove a model was trained on their data without consent — no longer needs a bespoke attack per modality. That matters as AI training data disputes move from blog posts into courtrooms, and as regulators in the EU push for training data transparency under the AI Act.
The framework outperforms existing single-class methods, per the researchers' own benchmarks — though independent replication will determine how well those numbers hold outside controlled conditions.