1 Introduction↩︎

The rapid development of generative AI triggered a pressing demand for training data, frequently leading to the unauthorized ingestion of private, sensitive, or copyrighted content. Consequently, with the scaling of generative models the importance of Membership inference attacks (MIAs) [1] and dataset inference (DI) [2] has become critical. Practical auditing – ranging from protecting medical privacy [3] to identifying licensed content [4] or detecting benchmark contamination [5]–[7] – requires determining whether specific samples or datasets were used to shape a model’s parameters. The definitive test is whether a model retains a structural “echo” of its training data, manifesting itself as a high-fidelity memorization signal that can be surfaced through targeted inference. Existing auditing methods, however, face a significant bottleneck. Most extract evidence from a single query [8], [9] or a set of loosely coupled samples [10]. These one-shot signals are often fragile; recent evaluations on unbiased benchmarks show that many MIAs degrade significantly under distributional shifts, often performing only slightly better than random guessing [4], [5]. Furthermore, high-performance “shadow model” attacks [11], [12] – which require training multiple auxiliary models to simulate the target – are computationally expensive and impractical for real-world large-scale generative architectures.

To address these limitations, we shift the perspective from a single static query to a dynamic trajectory. This concept is best illustrated through a forensic parallel: in a criminal interrogation, a suspect may maintain a lie for a single response, but that lie often collapses under the pressure of repeated, recursive follow-up questions. A truthful narrative, by contrast, remains coherent because it is grounded in a fixed reality. We argue that generative models exhibit a similar phenomenon – their “truth” is the training set. While a model can produce a plausible-looking output for a non-member sample once, it may struggle to sustain that plausibility over a recursive chain of self-generated inputs.

Our framework, MADreMIA, is inspired by the mechanics of Model Autophagy Disorder (MAD) [13], [14]. Traditionally, MAD describes a failure mode where models trained on their own synthetic outputs progressively lose variance and collapse into a state of degenerated “madness”. We pivot this phenomenon into a diagnostic, interference-time tool: if a sample was present during training, it acts as a stable “attractor” in the model’s latent space. By repeatedly feeding a model’s outputs back into itself – creating an iterative regeneration chain – we can amplify the signal of memorization.

Within this framework, we distinguish between two types of trajectories:

• Re-members: These are member samples (training data) that are iteratively re-generated. Because the model has “memorized” these points, they exhibit high stability and slow semantic degradation over time.

• Re-non-members: These are unseen samples that are iteratively re-generated. Lacking a structural anchor in the model’s weights, these samples drift rapidly toward the model’s average biases or dissolve into noise (see Figure 1).

MADreMIA functions as a modular, inference-time add-on that is intentionally method-, model-, and modality-agnostic. By measuring consistency across recursive loops, we provide richer signals across diverse architectures, including image autoregressive models (IARs), diffusion models (DMs), large language models (LLMs), and audio voice conversion models. We demonstrate that while a single output is often too noisy to be decisive, the trajectory of a “re-member” is different than “re-non-member” and thus acts as a powerful signal amplifier, surfacing traces of training data that are otherwise invisible.

MADreMIA iterative procedure moves beyond one-shot plausibility by probing whether the model preserves semantic and structural consistency under repeated self-interaction. Consequently, this work investigates a central research question: Can the dynamics of recursive self-generation serve as a signal amplifier to expose training data membership?

In summary, the main contributions of our paper are:

• We introduce an iterative regeneration setup to uncover data memorization invisible during single-pass inference.

• We show theoretically and empirically that trajectory features (generation dynamics over time) yield a significantly more statistically robust membership signal. By functioning as a variance reduction mechanism, these features isolate the underlying membership information much more effectively than standard one-shot baselines.

• We propose an inference-time, cross-modal framework that improves Membership and Dataset Inference efficiency across Vision and Language models without the need for expensive shadow model training.

2 Related Works↩︎

2.0.0.1 Memorization.

Memorization in generative models — the tendency to reproduce training examples rather than generate novel samples — has been studied across multiple model families. Early work formalized the distinction between memorization, mode collapse, and overfitting [15], while subsequent studies characterized the generalization-to-memorization transition in diffusion models [16], localized it through attention patterns [17], and showed that standard evaluation metrics fail to surface it [18]. Mitigation strategies have been proposed for both LLMs [19] and text-to-image models [20].

2.0.0.2 Membership and Dataset Inference.

Individual Membership Inference Attacks (MIAs) can be confounded by distribution shifts [5], prompting a shift toward Dataset Inference, which aggregates evidence across many samples [4], [21], [22]. Shadow-model approaches [11], [12] are now computationally infeasible for large architectures, so modern attacks extract signals from limited black-box outputs [8], [23], [24]. Most relevant to our work, [25] performs MIAs on diffusion models by repeatedly perturbing a target image and comparing averaged outputs to the original — but since queries are independent and do not evolve with model responses, deeper structural memorization remains unexploited.

2.0.0.3 Model Collapse.

Recursive self-training in generative models leads to progressive quality and diversity degradation when insufficient real data is injected — a phenomenon termed Model Autophagy Disorder [13]. Training on model-generated data further causes tails of the original distribution to disappear [14]. Together, these works suggest that iterative generation is structurally revealing: memorized regions may persist differently from non-member examples under repeated reuse. Our method turns this insight into a privacy-auditing mechanism, exploiting chained regeneration at inference time to amplify membership-relevant differences rather than treating collapse as a training-time pathology. The extended related works section can be found in Appendix 11.

3 Theory of Trajectory-Based Signal Amplification↩︎

For each sample, we define an iterative trajectory \(Z_0, Z_1, \dots, Z_T\), where \(Z_0\) is the observed sample and \(Z_{t+1}\) is produced by one regeneration step. Let \(M \in \{0,1\}\) denote membership. Define a per-step score \(\phi_t := \phi(Z_t, Z_{t+1})\) and the average \(S_T := \frac{1}{T}\sum_{t=0}^{T-1}\phi_t\). The attack predicts \(M\) from \(S_T\). We use \(a_T \gtrsim b_T\) when \(a_T \ge c\,b_T\) for a constant \(c > 0\) independent of \(T\), and \(a_T \asymp b_T\) for two-sided bounds.

Interpretation. Multi-step attacks improve when mean signal decays slowly relative to variance reduction.

It is worth noting that we do not claim that trajectory iteration increase the Bayes information ceiling \(I(M; Z_0)\); No, instead it improves practical fixed-form statistics via temporal variance reduction.

This theory applies to any iterative protocol satisfying A1–A3. Theorem 1 provides a conditional amplification guarantee. We present proofs in the Appendix 18.

4 Method↩︎

MADreMIA is a trajectory-augmentation framework for privacy inference on generative models. It is designed as an any-box extension of standard one-shot attacks (MIA/DI): black-box by default, gray-box when richer outputs are available, and white-box when needed. The central design principle is to keep the downstream scorer unchanged and improve only its input representation through additional trajectory-derived evidence.

4.0.0.1 Unified setup.

Following Sec. 3, for each queried sample we construct \[Z_0, Z_1, \dots, Z_T,\qquad Z_{t+1}=\mathcal{R}(f, Z_t),\; t=0,\dots,T-1,\] where \(Z_0=x\) is the queried sample, \(f\) is the audited generator, and \(\mathcal{R}\) is a modality-specific regeneration operator executed under a fixed protocol. For MIA, the label is \(M\in\{0,1\}\) (member/non-member). For DI, we use an analogous binary label \(D\in\{0,1\}\) (in-target-dataset/out-of-target-dataset).

4.0.0.2 Threat model.

MADreMIA supports: black-box (query access to \(f\) outputs only), gray-box (query access plus output-level statistics such as loss/log-probability signals), and white-box (optional access to internals/gradients when available). In all cases, the adversary/auditor has no access to training data identities (labels), performs at most \(T\) regeneration steps per sample, and outputs a binary prediction via \(h\): \(M\) for MIA or \(D\) for DI.

4.0.0.3 Base one-shot signal.

The theory defines \(\phi_t := \phi(Z_t, Z_{t+1}),\qquad S_T := \frac{1}{T}\sum_{t=0}^{T-1}\phi_t.\)

A trajectory one-shot comparator corresponds to the \(T=1\) case (using \(\phi_0=\phi(Z_0,Z_1)\)). When available, we additionally report classical one-shot baselines \(z_{\mathrm{base}}=\phi_{\mathrm{base}}(Z_0)\). Importantly, for each modality/model, the orientation (sign) of \(\phi_t\) is fixed on train data only (equivalently \(\phi_t\) or \(-\phi_t\)) and then frozen for test-time evaluation.

4.0.0.4 Signals and Fusion.

MADreMIA augments one-shot evidence with trajectory summaries computed from \((Z_0,\dots,Z_T)\). We define \[z_{\mathrm{base}}=\phi_{\mathrm{base}}(Z_0)\in\mathbb{R}^{d},\qquad z_{\mathrm{traj}}=\psi(Z_0,\dots,Z_T)\in\mathbb{R}^{k},\] Here \(\psi\) aggregates temporal statistics aligned with the \(\phi_t\) process (e.g., drift, consistency, quality evolution, diversity, score decay, and summaries derived from \(\{\phi_t\}_{t=0}^{T-1}\) and \(S_T\)). The fused representation is \(\tilde{z}=[z_{\mathrm{base}}\|z_{\mathrm{traj}}]\in\mathbb{R}^{d+k},\) and the final attack score is \(s(Z_0)=h(\tilde{z}),\) with \(h\) a calibrated scorer. By default, following [22], \(h\) is an L1-regularized logistic regression fit as a plug-in estimator of \(P(M=1\mid \tilde{z})\).

4.0.0.5 Mechanism.

MADreMIA leverages the fact that members often exhibit slower average drift than non-members. Memorized samples typically lie in deeper local probability wells, causing iterative regenerations to remain closer to \(Z_0\). Gains represent fixed-statistic SNR improvements consistent with the DPI: \(I(M;\tilde{z})\le I(M;Z_0)\).

4.1 Modality-specific instantiations↩︎

4.1.0.1 Image autoregressive models (IARs) and diffusion models.

\(\mathcal{R}\) is image-to-image regeneration under fixed controls (autoregressive decoding for IARs; controlled re-noise/re-denoise for diffusion, i.e., partial forward noising to a fixed noise level followed by reverse denoising under fixed scheduler/settings). Trajectory features are defined relative to \(Z_0\), in particular \(\mathrm{MSE}(Z_0,Z_t)\), \(\mathrm{LPIPS}(Z_0,Z_t)\) [26], and \(\mathrm{SSIM}(Z_0,Z_t)\) [27].

4.1.0.2 Large language models (LLMs).

\(\mathcal{R}\) is an autophagous text loop where each generation is fed back as the next prompt/input under a fixed template, fixed context-window policy (with left-sided truncation to keep only the newest text), and fixed decoding configuration. We use multiple features to measure the quality and diversity of generations, specifically: Kullback-Leibler Divergence, Jensen-Shannon Divergence, Jaccard Index, Predictive Entropy, and Logit Margin: \[\mathrm{KLD}(Z_0,Z_t),\quad \mathrm{JSD}(Z_0,Z_t),\quad \mathrm{Jaccard}(Z_0,Z_t), \quad \mathrm{Entropy}(Z_t),\quad \mathrm{LogitMargin}(Z_t),\] for \(t\in\{1,\dots,T\}\). These are summarized along the trajectory and fused with \(z_{\mathrm{base}}\). For clarity, KLD/JSD are computed on aligned token-distribution vectors: in gray/white-box settings from next-token logits, and in black-box settings from smoothed empirical token-frequency distributions under a fixed tokenizer/vocabulary. In fact, metrics in our experiments follow the gray-box setting, but our framework itself is open to the black-box setting as well. A black-box setting requires repeated queries per step to estimate distributions. Jaccard is computed on token sets after the same fixed preprocessing. More information about features for vision and language models are provided in Appendix 14.

4.1.0.3 Audio generative models.

In the audio domain, \(\mathcal{R}\) employs iterative reconstruction loops. Notably, we do not conduct a full Membership or Dataset Inference evaluation for audio models, as the literature currently lacks proper audio benchmarks and specialized attacks tailored to the voice conversion setting. Nevertheless, to demonstrate the cross-modal generality of our framework, our first experiment explores this potential using an objective audio fidelity metric.

Across all modalities, MADreMIA follows the pipeline: \(Z_0 \rightarrow (Z_{0:T}) \rightarrow (\phi_{0:T-1}, S_T, z_{\mathrm{traj}}) \rightarrow \tilde{z} \rightarrow s(Z_0)\).

5 Experiments↩︎

5.1 Experimental Setup↩︎

To ensure a scientifically sound evaluation across our MIA tasks, we restrict our setup to models trained on public datasets with well-defined training and test splits. We evaluate our method across three diverse modalities to demonstrate its broad applicability. For image generation, we analyze SOTA autoregressive models (VAR-d{20, 24, 30} [28], RAR-{L, XL, XXL} [29]) and diffusion models (DiT-RF-{XL, G} [30], UViT-T2I-Deep [31]), trained primarily on the ImageNet [32] or COCO [33] datasets for class-conditioned and text-to-image generation. We extend this evaluation to the audio domain using modern Voice Conversion models (AutoVC [34], FreeVC [35]), and to the language domain utilizing prominent LLMs (LLaMA-13B [36], Pythia-6.9B [37], OLMo-7B [38], and OPT-6.7B [39]). Comprehensive details regarding all specific models and datasets used in experiments are provided in the Appendix 12 and 13. All experiments were conducted on a machine equipped with 3 NVIDIA RTX PRO 5000 Blackwell GPUs (48 GB VRAM each) and an Intel Xeon Gold 6526Y CPU.

5.2 Metrics↩︎

To measure similarity between feature representations and their fidelity, we utilize the Fréchet Inception Distance (FID) [40], and Fréchet Audio Distance (FAD) [41] for vision and audio models, respectively. For LLMs, we measure Token Diversity as the Kullback–Leibler Divergence (KLD) between the normalized average token probability distribution at the current iteration and that of the first evaluation iteration: Token Diversity at iteration \(t\) (for \(t > 1\)) is defined as the Kullback-Leibler divergence from iteration \(1\): \[\mathrm{TokenDiversity}(t) = D_{\mathrm{KL}}\!\left( p_t \,\|\, p_1 \right) = \sum_{i \in V} p_t(i)\,\log \frac{p_t(i)}{p_1(i)}.\] where \(p_t\) and \(p_1\) are the normalized average token probability distributions for step \(t\) and step \(1\) respectively.

5.3 MIA and DI procedures↩︎

5.3.0.1 MIA pipeline.

For each labeled member/non-member sample, we generate \(Z_0,\dots,Z_T\), compute \(\phi_t\), \(S_T\), and modality-specific trajectory features, form \(\tilde{z}\), and fit \(h_{\mathrm{mia}}\). We evaluate univariate trajectory statistics by direct thresholding and multivariate features by logistic-regression fusion on strictly stratified 80/20 train-test splits. We report AUC, TPR at 1% FPR, and accuracy. Splitting is performed at sample/source level before trajectory generation: all descendants of the same \(Z_0\) (all \(Z_t\), all derived features) remain in the same partition. Thresholds, feature normalization, and LR calibration are fit on train only and applied unchanged to test. Primary endpoint is the multivariate fusion score; univariate \(S_T^\star\) results are reported as theory-aligned diagnostics. If \(T\) is tuned, it is selected on train (or a train-only validation split) and never on test. We use established metrics: TPR@FPR=1%, AUC, and Accuracy.

5.3.0.2 DI pipeline.

The DI pipeline is identical, replacing the target label with dataset-origin variable \(D\). The same \(Z_t\), \(\phi_t\), and trajectory-fusion machinery is used; only label semantics and calibration change. For DI, splitting/evaluation are performed at dataset or source-group level, and per-sample logits are aggregated by a fixed mean rule into a dataset-level score. Dataset-level decisions are evaluated against a permutation-based null over dataset labels within the evaluation fold.

Both MIA and DI setups inherit standard generative privacy-audit conventions, including the IAR setting introduced in [22].

5.4 Research questions↩︎

We evaluate whether chained regeneration can be a signal amplifier for one-shot auditing across modalities, model families, and access regimes. Our analysis focuses on the following questions: (Q1) What distinguishes member/non-member chained generation trajectories? (Q2) Can one-shot membership signal be amplified for single \(\phi(t)\) features? What are the gains for trajectory-based \(S_T\) over \(\phi(t)\) across modalities? (Q3) Does MADreMIA increase member/non-member separability compared to one-shot MIA? (Q4) Does increasing generative model stochasticity during regeneration loop affect the trajectories separation between members and non-members? (Q5) How does model size affect member/nonmember trajectory signals? Finally, we also provide a short analysis of the Getty Images case [42] in Appendix 17.

5.5 Members and Nonmembers differ in generative trajectories: qaulitative results.↩︎

Across all modalities, members and non-members exhibit distinct regeneration dynamics. Members preserve structure longer and drift more slowly, while non-members degrade faster and diverge toward the model’s generic prior. This pattern is visible both in per-step qualitative examples ([fig:mem_trajectory,fig:nonmem_trajectory]) and in aggregate divergence trajectories (2) comparing the quality of regenerations to base samples (FID for images, FAD for audio) and the drift of output token distribution in text model. The results presented support the core hypothesis that auto-regeneration trajectory contains multiple membership cues. The key trajectory asymmetry findings are:

1. Fidelity and degradation: Re-members maintain high structural quality throughout the trajectory, whereas re-non-members exhibit rapid perceptual and semantic degradation.

2. Persistence and divergence: Re-members demonstrate significant structural persistence and coherence across iterations. Conversely, re-non-members diverge more quickly, drifting toward the model’s general distribution and losing the specific characteristics of the original input.

5.5.0.1 The asymmetry is present across diverse models and modalities.

We test broad architectural diversity: image autoregressive and diffusion models, audio voice conversion/generation models, and text generative models. 2 summarizes trajectory behavior using modality-appropriate divergence metrics 5.2. This design directly tests whether our proposed signal amplification is model- and modality-agnostic.

5.6 \(\phi(t)\) statistics may increase membership signal over one-shot \(\phi(0)\).↩︎

We evaluate the validity of our theoretical assumptions using empirical generative trajectories, fixing \(T\) to the first 15 iterations. As summarized in Table [tbl:tab:assumption-support-restricted], while Assumption A2 is fully supported, A1 and A3 receive only partial empirical backing. Specifically, for certain values of \(\phi_t\), the absence of clear exponential decay within the first 15 iterations is acceptable for our main claim, since it indicates slower or plateau-like leakage. It suggests that non-exponential leakage forms may also govern real trajectories.

To assess the efficacy of modality-specific trajectory statistics, we evaluate whether aggregated trajectory evidence remains competitive with - or outperforms - the one-shot evidence. We define \(\mathrm{gain}:=\frac{\max_T \mathrm{SNR}^2(S_T)}{\max_t \mathrm{SNR}^2(\phi_t)},\) and show results in Table ¿tbl:tab:gains?. Trajectory diagnostics are strong: \(P(\mathrm{gain}\ge 1)=\frac{8}{11}=0.73,\qquad P(\mathrm{gain}\ge 0.9)=\frac{10}{11}=0.91,\) with median gain \(=1.00\). Given the small number of tested features, we interpret these numbers as supportive preliminary evidence.

5.7 MADreMIA amplifies baseline MIA↩︎

[tab:mia-llm,tab:mia-iar] compare MADreMIA-augmented attacks against their unaided baselines across LLMs and IARs. Across all base attacks and model families, incorporating reconstruction Diversity (\(MSE_{\text{sum}}\), \(LPIPS_{\text{sum}}\)), Quality (\(SSIM_{\text{sum}}\), \(SSIM_{\text{std}}\)), or both (Combined) consistently raises attack performance. Gains are most pronounced on OLMo-7B, where, for example, the Zlib baseline collapses to AUC 0.179 yet recovers to 0.868 with Combined signals, and CAMIA reaches AUC 0.969 — the strongest result across all settings. On the remaining LLMs the improvements are more modest but consistent. For IARs, MADreMIA yields clear gains in classification accuracy: VAR-d30 improves from 0.607 to 0.696 (+8.9 p.p.) and RAR-XXL from 0.562 to 0.713 (+15.1 p.p.), although TPR@1%FPR gains are smaller and less stable. Together, these results confirm that iterative reconstruction signals provide complementary, architecture-agnostic information that reliably strengthens membership inference across both LLMs and IARs.

5.8 MADreMIA amplifies baseline DI↩︎

The p-value histograms in 4 demonstrate that MADreMIA trajectory features consistently strengthen the statistical evidence for dataset-level inference across all evaluated architectures. On Pythia-6.9B, augmented variants reach the 95% confidence threshold at around 100 samples versus roughly 150 for the baseline. Furthermore, augmented variants shift the distribution of \(-\log_{10}(p)\) values noticeably rightward relative to the baseline, with this pattern holding across all three signal types. The effect is more pronounced on RAR-XXL, where the Combined variant produces a substantially larger rightward shift, indicating that individual trials yield stronger and more reliable evidence for membership inference.

5.9 Sensitivity analysis of generation strength↩︎

Figure 5 shows PR curves for VAR-d30 across regeneration strengths \(s \in \{2, 4, 6, 8\}\), where \(s\) controls how many final scales are regenerated. Members consistently achieve higher precision and recall than non-members across all values of \(s\), confirming that the MIA signal is robust to the choice of regeneration strength. As \(s\) increases, however, the two groups converge in PR space (see Appendix 16).

5.10 Trajectory asymmetry scaling across model families↩︎

As illustrated in 6, the membership signal – quantified by \(\Delta\text{FID} = \text{FID}_{\text{nonmem}} - \text{FID}_{\text{mem}}\) persists across all model scales, suggesting that the observed asymmetry is a fundamental property rather than an artifact of specific parameter regimes. While the magnitude of this separation varies across architectures, its relationship with model scale is not uniform. The separation grows stronger with model size in VAR and DiT-MoE, but remains largely unaffected by scaling in RARs. Ultimately, the underlying trend is robust: iterative trajectory chaining consistently exposes a larger membership gap compared to standard one-shot generations.

6 Conclusions↩︎

We introduced MADreMIA, a model-agnostic membership inference signal amplifier for large generative models. By chaining repeated regenerations rather than relying on a single query, MADreMIA exploits a consistent asymmetry: member samples retain coherence across iterations while non-members drift and deteriorate. This signal generalizes across image, text, and audio generators, spanning IAR, diffusion, and LLM families. Our experimental results show that fusing trajectory-derived features with baseline MIA/DI scores further improves member/non-member separability, suggesting that iterative regeneration is a broadly applicable lens for privacy auditing and copyright attribution.

Acknowledgments↩︎

We gratefully acknowledge Polish high-performance computing infrastructure PLGrid for providing computer facilities and support within computational grant no. PLG/2025/018391. This research was partially funded by National Science Centre, Poland, grant no: 2023/51/I/ST6/02854.

7 Impact Statement↩︎

This work advances methods for auditing generative models by improving membership and dataset inference through chained regeneration. The primary positive impact is stronger accountability: MADreMIA can help detect memorization of sensitive, proprietary, or benchmark data, supporting privacy audits, copyright verification, and unlearning validation across model families and modalities.

While enhanced inference capabilities can assist in model auditing and transparency, they also require responsible application to avoid potential misuse. We frame MADreMIA as a tool for research evaluation, compliance monitoring, and internal red-teaming. It is important to note that our method provides statistical evidence rather than a definitive proof of data inclusion; therefore, results should be interpreted alongside additional forensic and procedural evidence within a broader data governance framework.

8 Limitations↩︎

While our proposed framework is designed to be cross-modal and model-agnostic, our experimental scope is naturally constrained by several practical and theoretical factors. Most notably, we do not conduct full Membership Inference Attack (MIA) evaluations on audio generation models. Although our initial signal-degradation experiments indicate that iterative trajectory features exist in the audio domain, the literature currently lacks established single-step baselines tailored for these architectures, leaving MIA for audio models untested. Furthermore, while our framework is conceptually compatible with restricted setups, our current empirical evaluations rely on gray-box access to exact next-token logits, meaning that strictly black-box MIA remains untested in our work. Operationally, the primary limitation of our method is its scalability; the iterative regeneration loop inherently introduces a linear computational overhead by requiring multiple forward passes per sample. From a theoretical perspective, our core assumptions A1 and A3 are only partially satisfied in practice, as demonstrated by the empirical measurements in Table 2. Finally, our evaluations may be susceptible to distribution-shift confounds—where trajectory differences might stem from inherent dataset mismatches rather than pure memorization—and the exploratory findings presented in Section 5.6 are based on preliminary small-\(n\) evidence that will require larger-scale validation in future work.

9 LLM Usage↩︎

Large language models were used to improve the readability and clarity of portions of the manuscript, as well as to provide feedback during the writing and revision process. The authors verified all technical statements, citations, and claims and take full responsibility for the final content.

10 Method Overview↩︎

11 Extended Related Works↩︎

Our work builds upon three intersecting lines of prior research: the characterization of data memorization in generative models, the evolution of membership inference, and the dynamics of model collapse during recursive generation.

11.1 Memorization↩︎

Memorization — the tendency of generative models to reproduce training examples rather than generate novel samples — has been studied across multiple model families and from both measurement and mitigation perspectives. [15] formalized the problem for probabilistic generative models such as VAEs, showing that memorization differs fundamentally from mode collapse and overfitting and is not captured by commonly-used nearest-neighbor tests. For diffusion models, [16] show that the denoising score matching objective has a closed-form optimum that can only replicate training samples, and introduces the EMM metric to quantify how dataset size and model configuration govern the generalization-to-memorization transition. [17] localize this phenomenon through bright-ending cross-attention patterns, while the sharpness-based framework of [45] justifies score-difference memorization metrics and proposes mitigation via sharpness-aware regularization of the initial noise. The benchmarking study [18] demonstrated that standard evaluation metrics fail to surface memorization even in competitive settings. Mitigation has been tackled both for LLMs, where [19] propose the goldfish loss that excludes randomly sampled token subsets from the training objective to prevent verbatim reproduction, and for text-to-image diffusion models, where [20] address the privacy–utility tension by combining prompt re-anchoring with semantic prompt search to improve both dimensions simultaneously.

11.2 Membership/Dataset Inference↩︎

A second line of work investigates whether specific examples or datasets can be identified from model behavior. Because individual Membership Inference Attacks (MIAs) can be confounded by distribution shifts [5], recent literature often favors Dataset Inference (DI), which aggregates feature evidence across many samples to statistically detect training data usage [4], [21], [22]. Concurrently, individual MIA methods must adapt to increasingly restrictive black-box deployments. Furthermore, approaches based on training multiple shadow models to learn membership distributions [11], [12] are now computationally infeasible for massive modern architectures. Consequently, modern attacks must extract signals using only limited outputs rather than internal weights or gradients [8], [23], [24].

In these restricted settings, recent black-box attacks heavily rely on output variations. For example, [25] perform MIAs on diffusion models by repeatedly perturbing a target image via an API, averaging the results, and comparing them to the original sample. However, in an interrogation analogy, this approach merely asks multiple paraphrased versions of the exact same question. Because the target sample is perturbed independently each time, the query does not dynamically evolve in response to the model’s previous answers, leaving deeper structural memorization unexploited.

11.3 Model Collapse↩︎

The last, but very important point is the literature on recursive self-training in generative models. [13] showed that self-consuming generative loops lead to progressive degradation in quality or diversity when insufficient fresh real data is injected at each generation, a phenomenon they term Model Autophagy Disorder. Their analysis is especially important for our setting because it frames repeated regeneration not as a neutral operation, but as a process that can magnify latent properties of the learned distribution. Closely related, [14] showed that recursively training on model-generated data causes model collapse, where tails of the original distribution disappear and learned behaviour drifts toward degenerate approximations. Taken together, these works suggest that iterative generation is structurally revealing: under repeated reuse, memorized or high-density regions may persist differently from non-member examples, while generic outputs may drift or collapse. Our method turns this insight into a privacy-auditing mechanism: rather than studying recursive generation as a training-time pathology, we exploit chained regeneration at inference time to amplify membership-relevant differences.

12 Model Details↩︎

In our experiments, we consider two vision model families: image autoregressive models (IARs) and diffusion models. The IAR category includes VAR [28] and RAR [29] variants, while the diffusion category includes DiT-MoE [30] and UViT-T2I [31]. Furthermore, as others modalities, we evaluate large language models (LLMs) and voice conversion (VC) models. The LLMs include Pythia [37], OLMo [38], OPT [39], and Llama [36], while the VC models consist of AutoVC [34] and FreeVC [35]. Across all settings, we focus on representative, high-performing model variants.

13 Dataset Details↩︎

For vision and audio models that have publicly known and available train/test splits we use these datasets. For most LLMs we use established MIA benchmarks (e.g. WikiMIA), but for OLMo, we use their corresponding training sets and the Global News as non-member set, as suggested in [7].

Importantly, for the Pythia-6.9B we use the Mimir dataset [46] which consists of 6 subsets: arxiv, dm_mathematics, github, hackernews, pubmed_central, and wikipedia_(en). We concatenate all these subsets and randomly select samples from the pool. We use the ngram_7_0.2 data split. For the rest of the models, we employ their corresponding datasets’ train split as members and val/test split as nonmembers.

14 Metrics Details↩︎

The following metrics are computed over the sequence of model outputs collected across MADreMIA iterations, capturing how the model’s generative behavior evolves under repeated generation.

14.1 Features for Language Models↩︎

Jaccard Similarity:

Measures the lexical overlap between the model’s output at a given iteration and its initial response, computed over trigrams. A high Jaccard similarity indicates that the model rigidly reproduces the same surface forms across iterations, which is characteristic of memorized content. \[J(A,B) = \frac{|A \cap B|}{|A \cup B|}\]

Token Diversity:

Quantifies the divergence between the token probability distribution at the current iteration \(P\) and the initial distribution \(Q\). Large values indicate that the model’s vocabulary preferences shift substantially during reconstruction, reflecting instability in its output distribution. \[D_{KL}(P \parallel Q) = \sum_{x \in \mathcal{X}} P(x) \log \left( \frac{P(x)}{Q(x)} \right)\]

Token Distribution Shift:

We define it as a Jensen-Shannon Divergence, which is a symmetric and bounded variant of KLD that measures the distributional distance between \(P\) and \(Q\) via their mixture \(M\). Compared to KLD, JSD is well-defined even when the supports of \(P\) and \(Q\) do not fully overlap, making it a more numerically stable measure of distributional drift across iterations. \[\begin{align} \mathrm{JSD}(P \parallel Q) &= \frac{1}{2} D_{KL}(P \parallel M) + \frac{1}{2} D_{KL}(Q \parallel M) \\ \text{where } M &= \frac{1}{2}(P + Q) \nonumber \end{align}\]

Predictive Entropy:

Measures the uncertainty of the model’s next-token distribution over the full vocabulary \(\mathcal{V}\). Low entropy indicates that the model assigns high probability mass to a single token — consistent with confident, memorized reproduction — whereas high entropy reflects diffuse, uncertain predictions. \[H(Y \mid \mathbf{x}) = - \sum_{c \in \mathcal{V}} P(y=c \mid \mathbf{x}) \log P(y=c \mid \mathbf{x})\]

Margin:

Captures the decisiveness of the model’s token predictions by computing the difference in probability between the top-ranked and second-ranked tokens. A large margin indicates high confidence in a specific token, which may signal memorized recall, while a small margin reflects genuine uncertainty between competing continuations. \[M = P(\hat{y}_1 \mid \mathbf{x}) - P(\hat{y}_2 \mid \mathbf{x})\]

14.2 Features for Vision Models↩︎

Mean Squared Error (MSE):

Measures the average pixel-level reconstruction error between the generated image at a given iteration and the original input. Lower MSE indicates that the model consistently reproduces fine-grained pixel details across iterations, which is a strong signal of memorization. \[\mathrm{MSE}(x, \hat{x}) = \frac{1}{N} \sum_{i=1}^{N} \left( x_i - \hat{x}_i \right)^2\]

Structural Similarity Index Measure (SSIM) [27]:

Evaluates perceptual similarity between the reconstructed image \(\hat{x}\) and the original \(x\) by jointly comparing luminance, contrast, and structural information across local image patches. Unlike MSE, SSIM is sensitive to perceptual distortions that are meaningful to human observers, and its stability across iterations serves as a complementary signal to pixel-level metrics. \[\mathrm{SSIM}(x, \hat{x}) = \frac{(2\mu_x \mu_{\hat{x}} + c_1)(2\sigma_{x\hat{x}} + c_2)}{(\mu_x^2 + \mu_{\hat{x}}^2 + c_1)(\sigma_x^2 + \sigma_{\hat{x}}^2 + c_2)}\] where \(\mu_x\), \(\mu_{\hat{x}}\) are local means, \(\sigma_x^2\), \(\sigma_{\hat{x}}^2\) are local variances, \(\sigma_{x\hat{x}}\) is the cross-covariance, and \(c_1\), \(c_2\) are stabilization constants.

Learned Perceptual Image Patch Similarity (LPIPS) [26]:

Quantifies perceptual dissimilarity between \(x\) and \(\hat{x}\) using deep feature representations extracted from a pretrained network \(\phi\). By operating in a learned feature space rather than pixel space, LPIPS captures high-level semantic and textural differences that are invisible to MSE or SSIM, making it particularly sensitive to cases where a model reproduces semantic content while varying low-level details. \[\mathrm{LPIPS}(x, \hat{x}) = \sum_{l} \frac{1}{H_l W_l} \sum_{h,w} \left\| w_l \odot \left( \phi_l(x)_{hw} - \phi_l(\hat{x})_{hw} \right) \right\|_2^2\] where \(\phi_l\) denotes the feature map at layer \(l\) of the pretrained network and \(w_l\) are learned channel-wise weights.

15 Additional Dataset Inference Results↩︎

8 extends our dataset inference evaluation to Llama-13B and VAR-d30. On Llama-13B, augmented variants reach the 95% confidence threshold faster than the baseline, with the Combined and Quality signals leading, though convergence is noisier at low sample counts. On VAR-d30, the benefit is more pronounced: augmented variants cross the threshold at roughly 100 samples compared to over 200 for the baseline, with all three signal types outperforming it consistently. The significance histograms corroborate these findings — the Combined variant shifts the \(-\log_{10}(p)\) distribution rightward on both models, confirming that trajectory features yield stronger per-trial evidence.

16 Precision and Recall for Generative Models↩︎

9 shows Precision and Recall across iterations for VAR-d30 and DiT-MoE-XL. In both models and both metrics, members consistently score higher than non-members throughout all iterations, confirming that the membership signal is stable and model-agnostic. Notably, the gap between members and non-members widens as iterations progress, indicating that chained regeneration amplifies the underlying asymmetry rather than merely preserving it.

17 Getty Images Case↩︎

As a practical case study, we consider the Getty Images v. Stability AI dispute [42] and evaluate whether chained regeneration can distinguish images that are plausibly associated with the Stable Diffusion training distribution from images that are very unlikely to have been included. We use Stable Diffusion 1.5 as the target model. For the positive pool, we extract 2,000 images from LAION-2B whose metadata contains the string gettyimages and treat them as members. For the negative pool, we collect 2,000 images from the Getty Images website whose upload date is after January 1, 2025, and treat them as non-members. Because these images post-date the original Stable Diffusion 1.5 training era (late 2022), they provide a conservative practical control group for this experiment.

For each pool, we run the same chained-regeneration procedure for 15 iterations and summarize the trajectories with SSIM and reconstruction error (MSE) (see 10). The SSIM plot measures whether regenerations remain structurally closer to the initial query for the member pool than for the non-member pool. The MSE plot provides a complementary pixel-level view across regeneration depth by measuring how quickly reconstructed samples drift away from their reference images. In our experiments, the two pools remain visibly separated under both SSIM and MSE. We do not use FID in this case, because it is very unstable on 2,000-image pools. We still interpret MSE conservatively: it is sensitive to low-level reconstruction error rather than semantic fidelity alone. For this reason, we use MSE as a stable auxiliary trajectory measure across iterations, while SSIM remains the more directly interpretable structural signal in this case study.

18 Proofs for Section 3↩︎

18.1 Proof of Theorem 1↩︎

Proof. By definition, \[\mathbb{E}[S_T\mid M=m]=\frac{1}{T}\sum_{t=0}^{T-1}\mathbb{E}[\phi_t\mid M=m],\qquad m\in\{0,1\}.\] Hence \[\mathbb{E}[S_T\mid1]-\mathbb{E}[S_T\mid0] =\frac{1}{T}\sum_{t=0}^{T-1}\Big(\mathbb{E}[\phi_t\mid1]-\mathbb{E}[\phi_t\mid0]\Big).\] Under A1, \[\mathbb{E}[\phi_t\mid1]-\mathbb{E}[\phi_t\mid0]\ge \Delta_t\ge0,\quad \forall t,\] so \[\mathbb{E}[S_T\mid1]-\mathbb{E}[S_T\mid0]\ge \frac{1}{T}\sum_{t=0}^{T-1}\Delta_t\ge0.\] Therefore \[\Gamma_T:=\big|\mathbb{E}[S_T\mid1]-\mathbb{E}[S_T\mid0]\big| \ge \frac{1}{T}\sum_{t=0}^{T-1}\Delta_t.\] For the denominator, A3 gives, for each class \(m\), \[\mathrm{Var}(S_T\mid M=m)\le C\frac{\sigma^2\tau_{\mathrm{eff}}}{T}.\] Hence \[\max_m \mathrm{Var}(S_T\mid M=m)\le C\frac{\sigma^2\tau_{\mathrm{eff}}}{T}.\] Combining with the lower bound on \(\Gamma_T\), \[\mathrm{SNR}^2(S_T) =\frac{\Gamma_T^2}{\max_m\mathrm{Var}(S_T\mid M=m)} \ge \frac{\left(\frac{1}{T}\sum_{t=0}^{T-1}\Delta_t\right)^2}{C\sigma^2\tau_{\mathrm{eff}}/T}.\] This proves Theorem 1. 0◻

18.2 Proof of Corollary 1↩︎

Proof. Assume \(\Delta_t=\Delta_0e^{-t/\tau_g}\). Then \[\frac{1}{T}\sum_{t=0}^{T-1}\Delta_t =\frac{\Delta_0}{T}\sum_{t=0}^{T-1}e^{-t/\tau_g} =\frac{\Delta_0}{T}\cdot\frac{1-e^{-T/\tau_g}}{1-e^{-1/\tau_g}}.\] Since \(1-e^{-u}\le u\) for \(u>0\), with \(u=1/\tau_g\) we get \[1-e^{-1/\tau_g}\le \frac{1}{\tau_g} \quad\Longrightarrow\quad \frac{1}{1-e^{-1/\tau_g}}\ge \tau_g.\] Therefore \[\frac{1}{T}\sum_{t=0}^{T-1}\Delta_t \ge \Delta_0\frac{1-e^{-T/\tau_g}}{T/\tau_g}.\] By Theorem 1, \[\mathrm{SNR}^2(S_T)\ge \frac{\left(\frac{1}{T}\sum_{t=0}^{T-1}\Delta_t\right)^2}{C\sigma^2\tau_{\mathrm{eff}}/T} \;\gtrsim\; \frac{\Delta_0^2\tau_g}{\sigma^2\tau_{\mathrm{eff}}}\,g(x),\] where \[g(x):=\frac{(1-e^{-x})^2}{x},\qquad x:=T/\tau_g,\] and \(\gtrsim\) absorbs only \(T\)-independent constants (including \(1/C\) and comparability constants).

To optimize the shape in \(x\), differentiate: \[g'(x)=\frac{(1-e^{-x})\big(2xe^{-x}-(1-e^{-x})\big)}{x^2}.\] For \(x>0\), critical points satisfy \[2xe^{-x}=1-e^{-x} \quad\Longleftrightarrow\quad e^x=2x+1.\] This has a unique positive solution \(x^\star\approx1.2564\), so the surrogate shape is maximized at \[T^\star\approx x^\star\tau_g\approx1.2564\,\tau_g.\] 0◻

18.3 Proof of Corollary 2 (shape-constant clarification)↩︎

Proof. From the previous corollary (under the same comparability regime), \[\mathrm{SNR}^2(S_{T^\star}) \gtrsim \frac{\Delta_0^2\tau_g}{\sigma^2\tau_{\mathrm{eff}}}\,g(x^\star).\] Assume additionally \[\Gamma_1\asymp \Delta_0,\qquad \mathrm{Var}(S_1\mid M)\asymp \sigma^2,\] so \(\mathrm{SNR}(S_1)\asymp \Delta_0/\sigma\). Taking square roots and ratio: \[\frac{\mathrm{SNR}(S_{T^\star})}{\mathrm{SNR}(S_1)} \gtrsim \sqrt{g(x^\star)}\sqrt{\frac{\tau_g}{\tau_{\mathrm{eff}}}} = c_{\mathrm{shape}}\sqrt{\kappa},\] where \[\kappa:=\frac{\tau_g}{\tau_{\mathrm{eff}}},\qquad c_{\mathrm{shape}}:=\sqrt{g(x^\star)}\approx0.638.\] Thus \(c_{\mathrm{shape}}\) is the idealized shape constant; additional model-dependent prefactors remain absorbed by \(\gtrsim\). 0◻

18.4 Additional comments on Bayes-cap statement at the end of Section 3↩︎

If membership is deterministic in the initial sample, \(M=f(Z_0)\), then \(H(M\mid Z_0)=0\), so \[I(M;Z_0)=H(M)-H(M\mid Z_0)=H(M).\] Also, conditioning on \(Z_0\) already determines \(M\), hence \[H(M\mid Z_0,Z_{1:T})=0=H(M\mid Z_0),\] which implies \[I(M;Z_{1:T}\mid Z_0)=H(M\mid Z_0)-H(M\mid Z_0,Z_{1:T})=0.\] Therefore, by the chain rule for mutual information, \[I(M;Z_{0:T})=I(M;Z_0)+I(M;Z_{1:T}\mid Z_0)=I(M;Z_0).\] Thus trajectory iteration cannot increase Bayes-optimal information; it can improve practical fixed-form statistics through variance reduction and temporal aggregation.

References↩︎

---

1. Equal contribution.↩︎

2. Contact: wojciech.lapacz02@gmail.com↩︎