Membership and Dataset Inference Attacks on Large Audio Generative Models

AI summary

Overview

Research area: Privacy, copyright auditing, and data governance for generative audio models, specifically membership inference attacks (MIA) and dataset inference (DI) applied to autoregressive and diffusion audio generators.

Technical level: Intermediate. The core ideas are intuitive (does the model recognize this sample?), but the paper relies on familiarity with diffusion denoising objectives, token-level likelihood statistics, and Welch's t-test.

Scope: The paper empirically benchmark single-sample MIAs and aggregated dataset inference across four open-source audio generative models (AudioGen, FIGARO, AudioLDM2, TANGO), finding that DI succeeds where MIA fails.

What This Paper Is About

Generative audio models are trained on massive corpora that may include copyrighted music, speech, and sound recordings without disclosure, and creators currently have no reliable way to check whether their work was used. This paper asks whether an attacker (or a rights-holder) can determine if a specific audio sample, or an entire collection of an artist's samples, was part of a model's training set. The authors test existing membership inference methods on four open-source audio models and find them largely useless at the single-sample level, then show that aggregating weak per-sample evidence through dataset inference produces statistically significant detection.

Key Contributions

1. Benchmarking of MIAs on large audio models. The authors evaluate existing membership inference attacks on both autoregressive models (AudioGen, FIGARO) and diffusion models (AudioLDM2, TANGO), reporting AUC and TPR@FPR=1% and showing that these attacks are near chance-level for models trained on larger datasets.

2. Extension of dataset inference to the audio domain. They adapt DI methodology previously developed for diffusion models (via the CDI approach of Dubiński et al. 2025) and autoregressive image models (via the approach of Kowalczuk et al.) to audio generative models, and evaluate its effectiveness.

3. Extensive empirical evaluation across four state-of-the-art audio models. They report the minimum number of suspected member samples needed to reject the null hypothesis for each model, demonstrating that DI can succeed where single-sample attacks fail.

4. A transparency recommendation for model providers. The discussion section argues that released generative models should report well-defined train/test partitions and reserve clean held-out sets so that independent researchers can audit privacy leakage and copyright compliance.

Main Findings

• Single-sample MIA is near chance for autoregressive audio models. On AudioGen, AUC ranged from 50.86 (Min-K%++) to 55.34 (Min-K%) across six attacks, with Loss at 52.85 ± 0.00 and Hinge at 54.42 ± 0.00. On FIGARO, every attack fell between 49.37 (Zlib) and 51.68 (CAMIA). TPR at a 1% false positive rate rarely exceeded 1% for either model, against a random-guessing baseline of 0.01.

• Diffusion models split into two regimes depending on dataset scale. AudioLDM2 (trained on 29.5k hours) produced AUCs of roughly 50–55% across all six attacks, with TPR@1% essentially zero for Loss, NoiseOpt, PIA, and PIAN. TANGO (trained on 46k clips) showed a detectable signal: AUC of 70.52 ± 0.87 and TPR@1% of 16.03 ± 2.21 for the Loss attack, and AUC of 69.47 ± 0.83 with TPR@1% of 16.68 ± 2.17 for Multiple Loss.

• Overfitting, not architecture, appears to drive detectability. The authors attribute TANGO's stronger membership signal to its smaller training set, which makes overfitting more apparent, whereas AudioLDM2's larger and more diverse data washes out the per-sample signal.

• Dataset inference works in audio. The minimum number of samples required to achieve a mean p ≤ 0.01 was 900 for AudioGen, 300 for FIGARO, 300 for AudioLDM2, and 20 for TANGO.

• DI still demands more data than a typical individual artist holds. For most models, the required collection size exceeds what an individual creator is likely to possess, particularly given that AudioCaps samples are 10 seconds long. The authors note these requirements remain attainable for media owners.

• Current transparency is inadequate for auditing. Many released models do not disclose clear train/test splits or maintain accessible held-out evaluation sets, which the authors identify as a barrier to assessing privacy leakage and copyright compliance.

Methodology in Plain English

The authors pick four open-source audio generators spanning two architectural families. For each, they use the model's own training split as the source of "members" and the held-out test split as the source of "non-members," so the attacker's candidate pool contains both genuine training data and independent samples.

For diffusion models, they apply attack methods that examine the denoising process — for instance, how low the denoising loss is at intermediate timesteps, how the loss behaves across a grid of timesteps, how much performance degrades when the most influential latent regions are masked, and how much perturbation is needed to reduce the loss. For autoregressive models, they adapt token-level attacks from the language-model literature — loss thresholds, zlib compression ratios, Min-K%, Min-K%++, and context-aware features — to the discrete audio or MIDI token sequences these models generate.

They then move from single samples to collections. Dataset inference takes a set of suspected member samples and an equal-size set of known non-member samples from the test split, extracts membership features for every sample using multiple MIAs, converts those features into scalar scores, and compares the two score distributions with Welch's t-test at α = 0.01. The null hypothesis is that the mean member score is no greater than the mean non-member score; rejecting it flags the suspected collection as having been used in training. The headline metric is the smallest number of samples P needed for rejection — a smaller value means stronger information leakage. For diffusion models, a logistic regression scorer fits the feature-to-score mapping; for autoregressive models, features are normalized and summed.

Why This Matters

The paper provides an empirical grounding for a question that currently has mostly legal and anecdotal answers: can a rights-holder actually prove that a generative audio model was trained on their work? The answer it gives is nuanced — not through any single track, but potentially through an artist's or label's catalog.

Real-world applications:

• Copyright dispute evidence. A record label or composer with a substantial catalog could test whether a suspected model used those recordings, providing statistical evidence for a claim or licensing negotiation.
• Model auditing and compliance reporting. Regulators or third-party auditors assessing whether a model's training data matches its stated provenance.
• Data licensing verification. Verifying that a dataset vendor actually excluded content it claimed to exclude, or that a licensee's material was or was not used.
• Artist-facing detection tools. Building services that let creators check their back catalog against released generative models, with the paper's sample-size requirements providing realistic expectations about feasibility.

Industry relevance: The results suggest that transparent train/test disclosure is a prerequisite for any credible auditing regime. Model providers who publish clean held-out splits enable independent verification; those who do not make such audits ambiguous or impossible. The paper also quantifies the practical gap for individual artists versus institutional media owners, which matters for how licensing and enforcement ecosystems are designed.

Future Directions

• Improving DI sample efficiency. The 900-sample requirement for AudioGen exceeds most individual artists' catalogs, so reducing the required collection size — or improving per-sample signal strength — is a clear next step.
• Standardizing train/test disclosure. The authors explicitly call on model providers to report well-defined train/test partitions and reserve clean held-out sets, which would enable fair and reproducible leakage audits.
• Broadening the model and data coverage. The study covers four models; extending MIA and DI evaluation to other architectures, larger proprietary systems, and additional audio domains (speech, sound effects, symbolic music) would test the generality of the findings.
• Evaluating DI robustness under distribution mismatch. The paper notes that Welch's t-test requires both sample sets to be i.i.d. and that distributional mismatch can bias the test, leaving open how DI behaves when the attacker cannot obtain well-matched non-member data.

Target Audience

This paper is most useful to researchers working on privacy, memorization, and data provenance in generative models, particularly those extending membership inference and dataset inference beyond vision and text. It is also relevant to legal and policy professionals dealing with AI copyright questions, to model providers deciding what to disclose about training data, and to rights-holders and collective management organizations evaluating whether technical auditing is a viable path. Practitioners building content-detection or compliance tooling will benefit from the concrete sample-size numbers, which set realistic expectations about what is and is not currently detectable.

Authors’ abstract

Generative audio models, based on diffusion and autoregressive architectures, have advanced rapidly in both quality and expressiveness. This progress, however, raises pressing copyright concerns, as such models are often trained on vast corpora of artistic and commercial works. A central question is whether one can reliably verify if an artist's material was included in training, thereby providing a means for copyright holders to protect their content. In this work, we investigate the feasibility of such verification through membership inference attacks (MIA) on open-source generative audio models, which attempt to determine whether a specific audio sample was part of the training set. Our empirical results show that membership inference alone is of limited effectiveness at scale, as the per-sample membership signal is weak for models trained on large and diverse datasets. However, artists and media owners typically hold collections of works rather than isolated samples. Building on prior work in text and vision domains, in this work we focus on dataset inference (DI), which aggregates diverse membership evidence across multiple samples. We find that DI is successful in the audio domain, offering a more practical mechanism for assessing whether an artist's works contributed to model training. Our results suggest DI as a promising direction for copyright protection and dataset accountability in the era of large audio generative models.