A new auditing method can tell whether a chatbot's answer came from its training data, a document it just retrieved, or the prompt you typed.
Researchers built a system called SMA, short for Source-aware Membership Audit, aimed at retrieval-augmented generation (RAG) and its multimodal cousin, MRAG. Older membership-inference techniques could flag that a model had seen a given piece of data somewhere, but not say whether that data came from pretraining, a retrieved document, or the live prompt. SMA works in what the researchers call a semi-black-box setting with retrieval control, meaning it does not need full access to model weights but can steer what gets retrieved. To estimate which input tokens actually shaped an output, it perturbs inputs at scale and fits a ridge-regression model to the results, a workaround for not having direct access to internal gradients.
That distinction matters because RAG systems are increasingly the layer between chatbots and private company documents, and a leak from a retrieved file is a very different problem than a leak baked into a foundation model during training. SMA also handles images: it converts them into text descriptions using multimodal LLMs so the same token-level attribution can flag membership leaks in image-retrieval traces, something the authors say has not been done before in multimodal RAG systems. The paper's real contribution is a reframe, from asking whether data was memorized to asking where a piece of output actually originated.
It is worth noting this method still assumes some control over the retrieval pipeline, so whether it holds up against a production chatbot an outside auditor can't configure is the harder question the paper leaves open.