Dataset Usage Inference without Shadow Models or Held-out Data

# Dataset Usage Inference without Shadow Models or Held-out Data
Source: [https://arxiv.org/html/2606.26257](https://arxiv.org/html/2606.26257)
Wojciech Łapacz Warsaw University of Technology &Stanisław Pawlak11footnotemark:1 Warsaw University of Technology Jan Dubiński11footnotemark:1 Warsaw University of Technology NASK National Research Institute &Franziska Boenish CISPA Helmholtz Center for Information Security &Adam Dziedzic CISPA Helmholtz Center for Information Security

###### Abstract

How much of my data was used to train a machine learning model?Dataset Usage Inference \(DUI\)aims to answer this by estimating what fraction of a dataset contributed to a model’s training\. However, existing DUI methods rely on assumptions that rarely hold in practice: they require training expensive shadow models to imitate the target model, and they assume access to both known training samples and an in\-distribution held\-out set confirmed to be absent from training\. These conditions make current approaches impractical for modern large models and real data ownership disputes\. We introduce a practical DUI framework that removes these constraints\. Our method requires neither shadow models nor real held\-out data\. Instead, it generates synthetic non\-member samples, extracts diverse membership signals, and casts DUI as a mixture proportion estimation problem to estimate what share of the candidate dataset was used during training\. Experiments on large image generative models show that our method reliably quantifies dataset usage, providing a practical tool for data owners to determine how much of their data was used to train a model\.

## 1Introduction

With the rise of large generative models, the question of what data was used for training has become a major legal and ethical concern\. This is no longer purely a technical issue: it has direct implications for copyright, consent, and accountability, as illustrated by ongoing disputes such as The New York Times suing OpenAI\[[44](https://arxiv.org/html/2606.26257#bib.bib13)\]orGetty Images v\. Stability AI\[[18](https://arxiv.org/html/2606.26257#bib.bib2)\]\.

These developments highlight a clear need for methods that can reliably check whether specific datasets were used to train a generative model\. In response, researchers have explored several directions for training\-data detection\. One line of work watermarks potential training data or backdoors the trained model so that training leaves a detectable trace\[[28](https://arxiv.org/html/2606.26257#bib.bib16),[27](https://arxiv.org/html/2606.26257#bib.bib17),[42](https://arxiv.org/html/2606.26257#bib.bib18),[26](https://arxiv.org/html/2606.26257#bib.bib19)\]; this requires intervening before training and is therefore unavailable to most third\-party auditors\. A second line, Membership Inference Attacks \(MIAs\), instead operates post\-hoc and asks whether a particular sample was part of the training set, exploiting the fact that models tend to behave differently on samples seen during training than on unseen ones\[[20](https://arxiv.org/html/2606.26257#bib.bib22)\]\. For large modern generative models, however, per\-sample membership signals are typically weak and sensitive to distribution shift between member and non\-member data, and most existing MIAs degrade to near\-random performance on unbiased benchmarks\[[30](https://arxiv.org/html/2606.26257#bib.bib438),[10](https://arxiv.org/html/2606.26257#bib.bib357)\]\.

Dataset Inference \(DI\) attacks address this weakness by aggregating membership evidence across many samples to obtain a stronger, dataset\-level signal\[[32](https://arxiv.org/html/2606.26257#bib.bib100)\]\. Although DI methods provide useful evidence of dataset usage, they address a binary question: was the dataset used in training or not? In practice, this binary view is insufficient\. Legal frameworks and real\-world data ownership disputes require quantifying theextentof usage\. For example, Section 107 of the U\.S\. Copyright Act\[[47](https://arxiv.org/html/2606.26257#bib.bib29)\]requires fair\-use analysis to consider the “amount and substantiality of the portion used” in relation to the copyrighted work\. A practical dataset audit must therefore not only detect whether a dataset was used, but also estimate what fraction of it was used\.

![Refer to caption](https://arxiv.org/html/2606.26257v1/x1.png)Figure 1:Overview ofNU\-DUI\.Given a suspect set, we generate a synthetic non\-member reference set with Stable Diffusion img2img and autoencode the suspect set with the same autoencoder to reduce distribution shift\. We then query the target model on both sets, extract MIA features, and apply mixture proportion estimation to infer what fraction of the suspect set was used for training\.Tonget al\.\[[46](https://arxiv.org/html/2606.26257#bib.bib28)\]formalized this problem and proposed DUCI, which uses debiased MIAs to estimate the proportion of a dataset used during training\. Their method, however, rests on two assumptions that rarely hold in realistic settings\. First, it requires training expensive shadow models that closely mimic the target model’s architecture and behavior; for modern large\-scale generative models this is computationally prohibitive: a single shadow model for a 1\.5B\-parameter image autoregressive target already takes more than 1,500 A100 hours, and the typical five\-shadow setup multiplies this further\. Second, it assumes access to an in\-distribution held\-out set that is verified to be excluded from training; in real disputes such trusted held\-out data is rarely available\.

To address these limitations, we introduce Negative Unlabeled Dataset Usage Inference \(NU\-DUI\), a practical framework that needs neither shadow models nor a real held\-out set\. Given a suspect set,NU\-DUI\(i\) constructs a synthetic non\-member reference by image\-to\-image paraphrasing with a generator from a*different family*than the audited model, which prevents the synthetic set from sitting at a fixed point of the target’s loss; \(ii\) autoencodes the suspect set with the same autoencoder used during paraphrasing, so that both sides of the comparison share the same generator artifacts and the residual distribution shift is dominated by membership; \(iii\) extracts a vector of MIA features tailored to the target model family; and \(iv\) applies mixture proportion estimation to recover a single estimated member ratiop^\\hat\{p\}\. The method requires only the dataset under examination, making it lightweight and applicable to large modern generative models\.

Empirically,NU\-DUIproduces accurate member\-ratio estimates across five large\-scale image generative models, both diffusion and autoregressive, without ever training a shadow model\. On RAR\-XXL\[[51](https://arxiv.org/html/2606.26257#bib.bib441)\]with a suspect set of 1,000 images, the fullNU\-DUIpipeline takes about 42\.5 A100 minutes, compared with the more than 1,500 A100 hours that would be required to execute DUCI with a single shadow model for the same target: a speedup of more than2,0002\{,\}000times\. With the autoencoded suspect set, the mean estimation error stays well below 0\.1 across most target models \(e\.g\.,MAE=0\.058\\text\{MAE\}=0\.058on RAR\-XXL with PUL\-based MPE\), closing most of the gap to the oracle setting that requires a trusted held\-out non\-member set\.

In summary, our main contributions are:

- •We recast Dataset Usage Inference as a Mixture Proportion Estimation problem, removing the need for expensive shadow models\.
- •We propose generating realistic synthetic non\-member samples and autoencoding the suspect set, eliminating the reliance on a trusted real held\-out set, which is rarely available in practice\.
- •We empirically demonstrate thatNU\-DUIproduces accurate member\-ratio estimates on five large\-scale autoregressive and diffusion image generators at orders\-of\-magnitude lower compute than shadow\-model\-based DUCI, unlocking dataset usage inference for modern generative models\.

## 2Background and Related Work

This section reviews the three lines of workNU\-DUIbuilds on: membership inference attacks, dataset inference, and mixture proportion estimation\.

#### Membership Inference Attacks\.

Membership Inference Attacks \(MIAs\) aim to determine whether a specific data point was included in a model’s training set\. They typically exploit overfitting: models tend to behave systematically differently on samples they have seen during training compared to unseen samples\.

In large language models \(LLMs\), MIAs commonly rely on likelihood\-based signals, such as token\-level losses\[[50](https://arxiv.org/html/2606.26257#bib.bib237)\], unusually confident token predictions\[[40](https://arxiv.org/html/2606.26257#bib.bib386)\], or combinations of likelihood\-ratio tests\[[52](https://arxiv.org/html/2606.26257#bib.bib191)\]\.Kowalczuket al\.\[[25](https://arxiv.org/html/2606.26257#bib.bib356)\]extend these ideas to image autoregressive models \(IARs\), showing that attacks developed for LLMs transfer to autoregressive image generators\. For diffusion models, MIAs typically estimate membership through noise\-prediction errors at selected timesteps\. SecMI\[[9](https://arxiv.org/html/2606.26257#bib.bib173)\]compares errors between sampling and inverse\-sampling trajectories, PIA\[[24](https://arxiv.org/html/2606.26257#bib.bib334)\]contrasts predictions on clean and noised inputs, and CLiD\[[53](https://arxiv.org/html/2606.26257#bib.bib336)\]measures membership via discrepancies in conditional likelihoods\.

A recurring finding, however, is that MIAs are highly sensitive to distribution shifts between member and non\-member data\. On unbiased benchmarks for large modern models, most existing attacks degrade substantially and often perform only marginally above random guessing\[[30](https://arxiv.org/html/2606.26257#bib.bib438),[10](https://arxiv.org/html/2606.26257#bib.bib357)\]\. This motivates aggregating membership evidence across many samples rather than relying on per\-sample decisions\.

#### Dataset Inference\.

Dataset Inference \(DI\)\[[32](https://arxiv.org/html/2606.26257#bib.bib100)\]aims to determine whether a specific dataset was included in a model’s training set\. Unlike MIAs, which operate on individual samples, DI aggregates membership signals across many points to obtain a dataset\-level decision\. Formally, given a target modelffand a suspect datasetDsusD\_\{\\text\{sus\}\}, DI tests whetherffwas trained onDsusD\_\{\\text\{sus\}\}by comparing its membership signals onDsusD\_\{\\text\{sus\}\}with those on a held\-out datasetDvalD\_\{\\text\{val\}\}drawn from the same distribution\.

The general DI pipeline consists of three steps: \(1\) extract membership features for samples in bothDsusD\_\{\\text\{sus\}\}andDvalD\_\{\\text\{val\}\}; \(2\) aggregate these features into a dataset\-level score; and \(3\) apply a statistical test to compare the scores between the two sets\. The choice of membership features depends on the learning paradigm, ranging from decision\-boundary signals in supervised models\[[32](https://arxiv.org/html/2606.26257#bib.bib100)\]to representational statistics in self\-supervised settings\[[12](https://arxiv.org/html/2606.26257#bib.bib323)\]\. Modern DI methods for generative models, including LLMs\[[31](https://arxiv.org/html/2606.26257#bib.bib190)\], diffusion models\[[10](https://arxiv.org/html/2606.26257#bib.bib357)\], and image autoregressive models\[[25](https://arxiv.org/html/2606.26257#bib.bib356)\], all follow this template: they derive membership features using MIAs designed for the specific model family and aggregate them into a dataset\-level indicator of training usage\. DI, however, still answers a binary question; it does not quantify what fraction ofDsusD\_\{\\text\{sus\}\}was actually used\.

#### Mixture Proportion Estimation\.

Mixture Proportion Estimation \(MPE\) is the task of identifying the fraction of positive instances,α\\alpha, within an unlabeled dataset, a problem central to Positive–Unlabeled Learning \(PUL\)\[[29](https://arxiv.org/html/2606.26257#bib.bib374)\]\. Early theoretical foundations byBlanchardet al\.\[[3](https://arxiv.org/html/2606.26257#bib.bib11)\]andScott \[[39](https://arxiv.org/html/2606.26257#bib.bib10)\]established theirreducibility conditionrequired for identifiability, but their initial estimators were often computationally infeasible\. Practical estimators followed fromElkan and Noto \[[13](https://arxiv.org/html/2606.26257#bib.bib366)\], who proposed leveraging a positive\-vs\-unlabeled classifier, andPlessiset al\.\[[33](https://arxiv.org/html/2606.26257#bib.bib375)\], who used Pearson divergence minimization; both, however, typically rely on the restrictive assumption of disjoint support between positive and negative distributions\.Ramaswamyet al\.\[[35](https://arxiv.org/html/2606.26257#bib.bib7)\]introduced the KM algorithm, providing the first computationally feasible approach with convergence guarantees by embedding distributions into a Reproducing Kernel Hilbert Space, although it scales poorly in high\-dimensional settings\. Tree\-based methods such as TIcE\[[1](https://arxiv.org/html/2606.26257#bib.bib367)\]partition the feature space to identify regions where positives occur at a higher rate than in the overall mixture but can become unreliable on complex features\. Classifier\-based heuristics such as AlphaMax\[[22](https://arxiv.org/html/2606.26257#bib.bib9)\]and DEDPUL\[[21](https://arxiv.org/html/2606.26257#bib.bib8)\]treat a positive\-vs\-unlabeled classifier as a dimensionality\-reduction tool and estimateα\\alphafrom the resulting one\-dimensional score; they are efficient but tend to depend strongly on classifier quality\. MPE can also be framed as histogram\-based estimation, where the outputs of a trained PU classifier\[[2](https://arxiv.org/html/2606.26257#bib.bib368),[19](https://arxiv.org/html/2606.26257#bib.bib369),[43](https://arxiv.org/html/2606.26257#bib.bib371)\]are binned to estimate the positive\-class likelihood within the unlabeled mixture\. Our work uses MPE as a modular tool, leveraging the fact that, under the “selected completely at random” \(SCAR\) assumption, MPE provides a lower bound on the class prior\.

## 3Method

We estimate the fractionppof a suspect setXrealX^\{\\text\{real\}\}that was used to train a target generative modelMM\. The suspect set may contain both members and non\-members, and we assume access only toXrealX^\{\\text\{real\}\}and toMMat inference time: no shadow models and no trusted held\-out non\-member set\. Our pipeline \(Algorithm[1](https://arxiv.org/html/2606.26257#alg1)\) has three stages: \(i\) we construct a synthetic non\-member reference setXnonmemberimg2imgX^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}together with an autoencoded versionXAEX^\{\\text\{AE\}\}of the suspect set, both designed to limit the distribution shift between member\-side and non\-member\-side data; \(ii\) we extract membership\-inference \(MIA\) features from both sets using attacks tailored to the target model family; and \(iii\) we apply mixture proportion estimation \(MPE\) to the resulting features to estimatepp\.

Algorithm 1Negative Unlabeled Dataset Usage Inference

1:Suspect set

XrealX^\{\\text\{real\}\}; feature extractor

ΦMIA\\Phi\_\{\\text\{MIA\}\}
2:Construct

Xnonmemberimg2imgX^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}by image\-to\-image paraphrasing of

XrealX^\{\\text\{real\}\}
3:Construct

XAEX^\{\\text\{AE\}\}by autoencoding

XrealX^\{\\text\{real\}\}
4:

U←XAEU\\leftarrow X^\{\\text\{AE\}\}⊳\\trianglerightunlabeled

5:

N←Xnonmemberimg2imgN\\leftarrow X^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}⊳\\trianglerightsynthetic negatives

6:

ZMIA=ΦMIA​\(U∪N\)Z^\{\\text\{MIA\}\}=\\Phi\_\{\\text\{MIA\}\}\(U\\cup N\)
7:

p^←MPE​\(ZMIA,U,N\)\\hat\{p\}\\leftarrow\\textsc\{MPE\}\(Z^\{\\text\{MIA\}\},U,N\)
8:return

p^\\hat\{p\}

#### Synthetic Held\-Out Set Generation

A central obstacle in dataset usage inference is the absence of a trusted held\-out set known to contain only non\-members\[[55](https://arxiv.org/html/2606.26257#bib.bib494)\]\. Prior dataset inference and dataset usage inference methods sidestep this by assuming access to such a set, but in real auditing scenarios it is typically unavailable\. We instead build our reference data directly from the suspect setXrealX^\{\\text\{real\}\}: a synthetic non\-member setXnonmemberimg2imgX^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}, generated by paraphrasing the suspect images, and an autoencoded suspect setXAEX^\{\\text\{AE\}\}, obtained by encoding and decodingXrealX^\{\\text\{real\}\}with the same autoencoder used for paraphrasing\. We useXAEX^\{\\text\{AE\}\}rather thanXrealX^\{\\text\{real\}\}as the unlabeled set so that both sides of the comparison share the same generative\-model artifacts, reducing the distribution shift between the unlabeled mixture and the synthetic negatives\.

A key design choice is to generate synthetic non\-members with a model from a*different family*than the audited model\. For image autoregressive target models we use Stable Diffusion\[[36](https://arxiv.org/html/2606.26257#bib.bib200)\]; for diffusion target models we use a VAR model\[[45](https://arxiv.org/html/2606.26257#bib.bib442)\]\. The reason is that paraphrasing an image with a model from the same family produces samples that lie near a fixed point of that family’s loss: e\.g\., a diffusion\-paraphrased image is, by construction, a preferred state of the diffusion reverse process and exhibits unusually low denoising error\. If such samples were used as synthetic non\-members against a diffusion target, they would have artificially low diffusion loss and would be trivially separable from suspect samples for reasons unrelated to membership\. Cross\-family generation breaks this confound, because different generative families minimize different losses\.

Synthetic non\-members\.To build the synthetic non\-member set, we apply an image\-to\-image generator𝒢\\mathcal\{G\}to each suspect imagexrealx^\{\\text\{real\}\}, conditioned on a class\-level promptpcp\_\{c\}:

xnonmemberimg2img=𝒢​\(xreal,pc;s,g\),x^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}=\\mathcal\{G\}\\\!\\left\(x^\{\\text\{real\}\},\\,p\_\{c\};\\,s,g\\right\),wheresscontrols the noise injected into the input image andggis the guidance scale\. Compared with unconditional generation from noise, image\-to\-image paraphrasing better preserves coarse semantic content and low\-frequency structure, which is important for keeping the synthetic set distributionally close to the suspect data\. Because these outputs are newly generated, we treat them as non\-members and use them as the negative reference setNN\.111We adopt the set\-theoretic definition of non\-membership fromYeomet al\.\[[50](https://arxiv.org/html/2606.26257#bib.bib237)\]:xxis a non\-member ofMMiffx∉𝒟train​\(M\)x\\notin\\mathcal\{D\}\_\{\\text\{train\}\}\(M\)\. While paraphraser memorization can in principle produce a near\-verbatim copy of a training image, such cases are documented to occur at rates orders of magnitude too low to influence aggregate MPE estimates at our suspect\-set sizes\[[4](https://arxiv.org/html/2606.26257#bib.bib199)\]\. Our aim is the best practical solution under realistic auditing constraints, which we validate empirically in Section[4](https://arxiv.org/html/2606.26257#S4)\.

Autoencoded suspect set\.Images produced by generative models have been shown to differ from real images in the high\-frequency domain\[[38](https://arxiv.org/html/2606.26257#bib.bib489)\]\. This gap is fundamental and difficult to remove from the synthetic side\. Rather than attempting to remove this artifact from the synthetic side, we introduce the*same*shift on the suspect side, by reconstructing each suspect image with the autoencoder used during generation:

z=ℰ​\(xreal\),x~AE=𝒟​\(z\)\.z=\\mathcal\{E\}\\\!\\left\(x^\{\\text\{real\}\}\\right\),\\qquad\\tilde\{x\}^\{\\text\{AE\}\}=\\mathcal\{D\}\(z\)\.This preserves the semantic content and label of each image while injecting generator\-specific high\-frequency artifacts comparable to those present inXnonmemberimg2imgX^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}\. We denote the resulting set byXAEX^\{\\text\{AE\}\}and use it as the unlabeled setUU\. Figure[2](https://arxiv.org/html/2606.26257#S3.F2)shows examples of the resulting samples; Appendix[B](https://arxiv.org/html/2606.26257#A2)provides details for the full construction\.

![Refer to caption](https://arxiv.org/html/2606.26257v1/x2.png)Figure 2:Examples of synthetic non\-members and autoencoded suspect images\.For each real ImageNet samplex∈Xrealx\\in X^\{\\text\{real\}\}, we show the autoencoded reconstructionxAE=𝒟​\(ℰ​\(x\)\)x^\{\\text\{AE\}\}=\\mathcal\{D\}\(\\mathcal\{E\}\(x\)\)that we use as the unlabeled setUU, and the cross\-family image\-to\-image paraphrasexnonmemberimg2img=𝒢​\(x,pc;s,g\)x^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}=\\mathcal\{G\}\(x,p\_\{c\};\\,s,g\)that we use as the synthetic non\-member setNN\.
#### Extracting MIA Features

Given the unlabeled setUUand the synthetic negative setNN, we extract a feature vectorΦMIA​\(x\)∈ℝdM\\Phi\_\{\\text\{MIA\}\}\(x\)\\in\\mathbb\{R\}^\{d\_\{M\}\}for each sample using a suite of MIAs tailored to the target model family:

ΦMIA​\(x\)=\[f1​\(x\),…,fdM​\(x\)\],\\Phi\_\{\\text\{MIA\}\}\(x\)=\\left\[f\_\{1\}\(x\),\\ldots,f\_\{d\_\{M\}\}\(x\)\\right\],where eachfm​\(x\)f\_\{m\}\(x\)is a scalar membership score obtained by querying the target model onxx\.

We use multiple MIA signals rather than a single one because no single signal is reliably effective on large modern generative models: per\-sample membership cues are typically weak and noisy, and combining complementary signals into a single feature vector yields better separation between member and non\-member distributions\[[30](https://arxiv.org/html/2606.26257#bib.bib438),[10](https://arxiv.org/html/2606.26257#bib.bib357),[25](https://arxiv.org/html/2606.26257#bib.bib356)\]\. For image autoregressive target models we use the feature suite ofKowalczuket al\.\[[25](https://arxiv.org/html/2606.26257#bib.bib356)\]; for diffusion target models we use that ofDubińskiet al\.\[[10](https://arxiv.org/html/2606.26257#bib.bib357)\]\. Beyond this choice, our method is conceptually agnostic to the specific MIA features, as long as they provide some separation between member and non\-member score distributions\.

#### Estimating the Member Ratiopp

We cast dataset usage inference as a mixture proportion estimation problem\. After constructingU=XAEU=X^\{\\text\{AE\}\}andN=Xnonmemberimg2imgN=X^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}and computing the MIA feature vectors for both sets, we model the unlabeled score distribution as a two\-component mixture:

pU​\(s\)=π​pM​\(s\)\+\(1−π\)​pN​\(s\),p\_\{U\}\(s\)=\\pi\\,p\_\{M\}\(s\)\+\(1\-\\pi\)\\,p\_\{N\}\(s\),wherepM​\(s\)p\_\{M\}\(s\)andpN​\(s\)p\_\{N\}\(s\)are the score distributions of members and non\-members, andπ\\piis the unknown member proportion inUU\.

We then run a standard MPE estimator on the MIA feature vectors, treating the synthetic samples inNNas labeled non\-members and the autoencoded suspect samples inUUas the unlabeled mixture\. The estimator returnsp^\\hat\{p\}, our estimate ofπ\\pi, i\.e\., the predicted fraction of the suspect set used during training\. The framework is agnostic to the choice of MPE estimator; we evaluate several standard ones in Section[4](https://arxiv.org/html/2606.26257#S4)\.

## 4Empirical Evaluation

### 4\.1Experimental Setup

#### Models and data\.

We evaluateNU\-DUIon large, state\-of\-the\-art image autoregressive models VAR\-24 \(1\.0B\) and VAR\-30 \(2\.1B\)\[[45](https://arxiv.org/html/2606.26257#bib.bib442)\], RAR\-XL \(955M\) and RAR\-XXL \(1\.5B\)\[[51](https://arxiv.org/html/2606.26257#bib.bib441)\], and the diffusion model DiT\-RF\-XL/2\-8E2A \(4\.1B total, 1\.5B active parameters\)\[[15](https://arxiv.org/html/2606.26257#bib.bib488)\], all trained for class\-conditioned generation on ImageNet\-1k\[[7](https://arxiv.org/html/2606.26257#bib.bib159)\]\. To ensure scientifically sound evaluation, we restrict ourselves to models trained on public datasets with well\-defined IID train/test splits\[[11](https://arxiv.org/html/2606.26257#bib.bib436)\]\. The same restriction applies to prior MIA and DI works, since without an IID split, observed differences between member and non\-member sets cannot be reliably attributed to training membership\. Table[1](https://arxiv.org/html/2606.26257#S4.T1)summarizes the architecture, training budget, and reported FID\-50K of each evaluated model\.

Table 1:Model details for the evaluated target models\.For each image autoregressive \(VAR\-d24, VAR\-d30, RAR\-XL, RAR\-XXL\) and diffusion \(DiT\-RF\-XL/2\-8E2A\) target, we report total and active parameter counts, the training budget \(epochs or iterations\), and the reported FID\-50K on ImageNet\-1k\.
#### Evaluation procedure\.

Our evaluation simulates a realistic auditing scenario: a user is interested in whether specific data points were part of the model’s training set, and to what extent\. Given a suspect setUU,NU\-DUIproduces a single estimated member ratiop^\\hat\{p\}\. We compare three reference conditions for the negative setNN:

- •Real non\-members\.An idealized but unrealistic setting in whichNNcontains genuine held\-out non\-members from the same distribution as the non\-member portion ofUU\. This assumes access to a trusted held\-out set known to be excluded from training, which is rarely available in practice\. Because the non\-member reference matches the test\-time distribution, this setting yields the lowest achievable estimation error\.
- •Synthetic non\-members\.A syntheticNNobtained by applying our image\-to\-image paraphrasing pipeline to samples fromUU, used directly together with the unmodified suspect set as the unlabeled mixture\. Because the synthetic samples carry generation artifacts that the real suspect samples do not, the MPE estimator can spuriously separate the two sets based on those artifacts rather than on membership cues, leading to inflated estimation errors\.
- •Synth \+ AE \(NU\-DUI\)\.The fullNU\-DUIpipeline: the same syntheticNNas above, but with the suspect set additionally autoencoded so that both sides of the comparison share the same generator\-induced artifacts\. This shifts the estimator back toward true membership signals\.

We vary the true member ratiop∈\(0,1\]p\\in\(0,1\]and the suspect\-set size\|U\|\|U\|to assess robustness across realistic auditing conditions\. We excludep=0p=0because in that case the suspect set contains no members at all, which reduces to the binary dataset inference question \(wasDsusD\_\{\\text\{sus\}\}used to trainffor not?\) and is already handled by DI methods for image autoregressive\[[25](https://arxiv.org/html/2606.26257#bib.bib356)\]and diffusion\[[10](https://arxiv.org/html/2606.26257#bib.bib357)\]models\.

### 4\.2Results

#### Accurate member\-ratio estimation across models\.

Figure[3](https://arxiv.org/html/2606.26257#S4.F3)visualizes the estimated member ratios as a function of the ground\-truthpp, and Table[2](https://arxiv.org/html/2606.26257#S4.T2)reports the corresponding MAE and max MAE across all testedpp\. In the Real setting,NU\-DUIstays close to the ground\-truth ratio across all evaluated autoregressive and diffusion target models, with the estimated curves tracking the identity line\. This setting also yields the lowest estimation errors in Table[2](https://arxiv.org/html/2606.26257#S4.T2), confirming that the MIA features used byNU\-DUIare sufficiently discriminative when the non\-member reference matches the test\-time distribution\. When a confirmed held\-out non\-member set is available,NU\-DUIreduces to exactly this Real setting; thereforeRealis not only an oracle baseline, but also the performance achievable byNU\-DUIwhen held\-out non\-member data is accessible\.Table[2](https://arxiv.org/html/2606.26257#S4.T2)also shows that the result is not specific to a single MPE estimator: TIcE, AlphaMax, and the two PUL variants \(LBE and NTC\-τ\\tauMI\) all exhibit the same qualitative behavior in the Real regime\.

![Refer to caption](https://arxiv.org/html/2606.26257v1/x3.png)\(a\)RAR\-XXL
![Refer to caption](https://arxiv.org/html/2606.26257v1/x4.png)\(b\)RAR\-XL
![Refer to caption](https://arxiv.org/html/2606.26257v1/x5.png)\(c\)DiT\-RF\-XL
![Refer to caption](https://arxiv.org/html/2606.26257v1/x6.png)\(d\)VAR\-30
![Refer to caption](https://arxiv.org/html/2606.26257v1/x7.png)\(e\)VAR\-24
Figure 3:Estimated member ratios\.We show estimated member ratios across evaluated models for varying ground\-truthppunder three reference conditions:real non\-members\(ideal but unrealistic\),synthetic non\-memberswith real unlabeled set, andsynthetic non\-members with autoencoded unlabeled set\(ourNU\-DUI\)\.
Table 2:Dataset usage estimation under different MPE methods\(suspect set size 1,000 images\)\. For each target model and reference condition \(Real, Synth, Synth \+ AE\), we report theMAEandmax MAEof the estimated member ratiop^\\hat\{p\}, taken as the mean and maximum absolute error across all tested ground\-truthp∈\(0,1\]p\\in\(0,1\]\. Across all four MPE methods, theSynthreference systematically degrades estimation relative to theRealoracle, andSynth \+ AErecovers most of this gap on the autoregressive targets, confirming that autoencoding the suspect set is the key ingredient that makes synthetic\-only references usable in practice\. Values are reported with standard deviation across 3 runs; lower is better\.
#### Synthetic non\-members introduce bias, which Synth \+ AE largely corrects\.

When the non\-member referenceNNcontains only synthetic samples, the “Synthetic” curves in Figure[3](https://arxiv.org/html/2606.26257#S4.F3)systematically overestimate the true member ratio at smallpp\. This effect arises because the unmodified suspect set and the synthetic non\-members differ in low\-level generation artifacts, which the MPE estimator can exploit instead of using genuine membership cues\. Table[2](https://arxiv.org/html/2606.26257#S4.T2)shows the same pattern: both MAE and max MAE in the Synth rows generally increase relative to Real\. Autoencoding the suspect set \(Synth \+ AE\) injects matching artifacts on the suspect side, which brings the estimated curves visibly closer to the diagonal and narrows the gap to Real\. This enables accurate dataset\-usage estimation without any access to a trusted held\-out non\-member set\.

#### Computational cost\.

A central practical advantage ofNU\-DUIover shadow\-model\-based approaches such as DUCI is its compute footprint\. Table[3](https://arxiv.org/html/2606.26257#S4.T3)compares the estimated A100 time ofNU\-DUIand DUCI on RAR\-XXL \(1\.5B\) for a suspect set of 1000 images\. DUCI is dominated by shadow\-model training: a single shadow model already requires more than 1500 hours, and the typical five\-shadow setup exceeds 7500 hours, equivalent to several months of continuous A100 use\. In contrast,NU\-DUIavoids shadow training entirely; the only costs are synthetic generation, autoencoding, target\-model queries, and lightweight MPE, totaling roughly 42\.5 minutes, more than2,000×2\{,\}000\\timesfaster than the single\-shadow DUCI configuration\. Beyond the raw cost,NU\-DUIalso avoids the need to reproduce the training pipeline of the inspected model, which for modern large\-scale generative models typically requires access to proprietary training data, training code, and full hardware budgets, none of which are realistic for an external auditor\.

Table 3:Estimated time comparison betweenNU\-DUIand DUCI\.For each method we report the per\-stage compute cost on the target model RAR\-XXL \(1\.5B\) with a suspect set of 1,000 images on an Nvidia A100 GPU\. The DUCI cost is dominated by shadow\-model training \(roughly 1,500 hours per shadow model\)\.NU\-DUIavoids shadow training entirely, totalling 42\.5 minutes, more than2,000×2\{,\}000\\timesfaster than the single\-shadow model DUCI configuration on the same target\.![Refer to caption](https://arxiv.org/html/2606.26257v1/x8.png)\(a\)IAR model \(RAR\-XXL\)
![Refer to caption](https://arxiv.org/html/2606.26257v1/x9.png)\(b\)Diffusion model \(DiT\-RF\)

Figure 4:Same\-family vs\. cross\-family synthetic non\-member generation\.Estimatedp^\\hat\{p\}vs\. truepp\. Same\-family generation pullsp^\\hat\{p\}off the ground truth, while cross\-family generation tracks it closely\.
#### Cross\-family generation supports more accurate estimation\.

A natural question is whether constructing the synthetic non\-member set in Section[3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px1)via image\-to\-image paraphrasing with a generator𝒢\\mathcal\{G\}from a*different*generative family than the audited target model is essential\. To probe this, we rerunNU\-DUIwith a*same\-family*generator instead, i\.e\., a generator drawn from the same generative family as the audited target: a VAR paraphraser for RAR\-XXL and a Stable Diffusion paraphraser for DiT\-RF\-XL\. Figure[4](https://arxiv.org/html/2606.26257#S4.F4)shows that estimation quality drops noticeably in both cases: the same\-familyp^\\hat\{p\}curves no longer track the diagonal and fall well below the cross\-family curves at most ground\-truth ratiospp\. This is consistent with the argument in Section[3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px1): same\-family paraphrases lie near a fixed point of the audited model’s own loss and therefore look member\-like to its MIA features, leaving the MPE estimator with little signal to separate true members from synthetic non\-members\.

#### Scaling with suspect set size\.

We study how estimation accuracy depends on the suspect\-set size\|U\|\|U\|, varying\|U\|∈\{100,500,1000,2000\}\|U\|\\in\\\{100,500,1000,2000\\\}across all evaluated models and MPE estimators \(Table[4](https://arxiv.org/html/2606.26257#S4.T4)\)\. The largest improvement occurs when increasing\|U\|\|U\|from 100 to 500–1000 samples, after which gains begin to saturate\. The trend is consistent across MPE estimators and model families\. Notably, even with a tiny suspect set of 100 images, the best\-performing estimator already produces a precise estimate \(e\.g\., TIcE on RAR\-XXL reaches MAE 0\.097\), indicating that the method remains practical when only a small amount of suspect data is available\.

Table 4:Impact of suspect set size on estimation quality\.For each MPE method \(AlphaMax, TIcE, PUL\-LBE, PUL\-NTC\-τ\\tauMI\) we report the MAE of the estimated member ratiop^\\hat\{p\}at suspect set sizes of 100, 500, 1,000, and 2,000 images, averaged over the same set of ground\-truthppvalues as Table[2](https://arxiv.org/html/2606.26257#S4.T2)\. Estimation quality improves quickly as the suspect set grows, and even at very small sizes \(\|U\|=100\|U\|=100\) several methods \(e\.g\., TIcE on RAR\-XXL with MAE0\.0970\.097\) already yield useful estimates, indicating thatNU\-DUIremains practical when only a small number of suspect samples is available\. Values are reported with standard deviation across 3 runs; lower is better\.

## 5Limitations

The accuracy ofNU\-DUIdepends on two main factors\. First, it relies on the strength of available membership\-inference signals: when the target model leaks little membership information, MIA features become less separable and our estimates less stable\. Thus,NU\-DUIinherits the limits of current MIA methods, while benefiting from future advances in the field\. Second,NU\-DUIrequires a sufficiently strong cross\-family generative model to produce synthetic non\-members\. In domains where no such generator is available, the method does not directly apply\.

## 6Conclusions

We introduced Negative Unlabeled Dataset Usage Inference \(NU\-DUI\), a practical framework for dataset usage inference that removes two major barriers in prior work: expensive shadow models and trusted held\-out non\-member sets\.NU\-DUIgenerates synthetic non\-members via image\-to\-image paraphrasing, autoencodes the suspect set to reduce distribution shift, extracts diverse MIA features, and formulates dataset usage inference as mixture proportion estimation\. Across large image autoregressive and diffusion models,NU\-DUIaccurately estimates member ratios at orders\-of\-magnitude lower compute than shadow\-model\-based approaches, requiring only the dataset under examination\. We viewNU\-DUIas a practical tool for data owners and auditors seeking quantitative evidence of training\-data usage in modern generative models\.

## Acknowledgements

This research was supported by the Polish National Science Centre \(NCN\) within grants no\. 2025/57/N/ST6/04025 and 2023/51/I/ST6/02854\. We gratefully acknowledge Polish high\-performance computing infrastructure PLGrid, HPC Center: ACK Cyfronet AGH, for providing computer facilities and support within computational grant no\. PLG/2024/017781\. This work was also supported by the German Research Foundation \(DFG\) within the framework of the Weave Programme under the project titled “Protecting Creativity: On the Way to Safe Generative Models”, project number 545047250\. We also gratefully acknowledge support from the Initiative and Networking Fund of the Helmholtz Association in the framework of the Helmholtz AI project call under the name “PAFMIM”, funding number ZT\-I\-PF\-5\-227\. Responsibility for the content of this publication lies with the authors\.

## References

- \[1\]J\. Bekker and J\. Davis\(2018\)Estimating the class prior in positive and unlabeled data through decision tree induction\.InProceedings of the AAAI conference on artificial intelligence,Vol\.32\.Cited by:[Table 5](https://arxiv.org/html/2606.26257#A5.T5.21.10.5.2),[Table 5](https://arxiv.org/html/2606.26257#A5.T5.21.7.2.2),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.30.26.26.7),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.51.47.47.7),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.9.5.5.7)\.
- \[2\]J\. Bekker, P\. Robberechts, and J\. Davis\(2019\)Beyond the selected completely at random assumption for learning from positive and unlabeled data\.External Links:1809\.03207,[Link](https://arxiv.org/abs/1809.03207)Cited by:[Appendix D](https://arxiv.org/html/2606.26257#A4.SS0.SSS0.Px3.p1.6),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2)\.
- \[3\]G\. Blanchard, G\. Lee, and C\. Scott\(2010\)Semi\-supervised novelty detection\.Journal of Machine Learning Research11\(99\),pp\. 2973–3009\.External Links:[Link](http://jmlr.org/papers/v11/blanchard10a.html)Cited by:[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2)\.
- \[4\]N\. Carlini, J\. Hayes, M\. Nasr, M\. Jagielski, V\. Sehwag, F\. Tramèr, B\. Balle, D\. Ippolito, and E\. Wallace\(2023\)Extracting training data from diffusion models\.External Links:2301\.13188Cited by:[§C\.2](https://arxiv.org/html/2606.26257#A3.SS2.SSS0.Px1),[footnote 1](https://arxiv.org/html/2606.26257#footnote1)\.
- \[5\]H\. Chang, A\. S\. Shamsabadi, K\. Katevas, H\. Haddadi, and R\. Shokri\(2024\)Context\-aware membership inference attacks against pre\-trained large language models\.arXiv preprint arXiv:2409\.13745\.Cited by:[§C\.1](https://arxiv.org/html/2606.26257#A3.SS1.SSS0.Px5)\.
- \[6\]M\. Chen, A\. Radford, R\. Child, J\. Wu, H\. Jun, D\. Luan, and I\. Sutskever\(2020\)Generative pretraining from pixels\.InInternational conference on machine learning,pp\. 1691–1703\.Cited by:[Appendix A](https://arxiv.org/html/2606.26257#A1.SS0.SSS0.Px2.p1.2)\.
- \[7\]J\. Deng, W\. Dong, R\. Socher, L\. Li, K\. Li, and L\. Fei\-Fei\(2009\)Imagenet: a large\-scale hierarchical image database\.In2009 IEEE conference on computer vision and pattern recognition,pp\. 248–255\.Cited by:[§4\.1](https://arxiv.org/html/2606.26257#S4.SS1.SSS0.Px1.p1.1)\.
- \[8\]J\. Devlin, M\. Chang, K\. Lee, and K\. Toutanova\(2019\-06\)BERT: pre\-training of deep bidirectional transformers for language understanding\.InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 \(Long and Short Papers\),J\. Burstein, C\. Doran, and T\. Solorio \(Eds\.\),Minneapolis, Minnesota,pp\. 4171–4186\.External Links:[Link](https://aclanthology.org/N19-1423/),[Document](https://dx.doi.org/10.18653/v1/N19-1423)Cited by:[Appendix A](https://arxiv.org/html/2606.26257#A1.SS0.SSS0.Px4.p1.1)\.
- \[9\]J\. Duan, F\. Kong, S\. Wang, X\. Shi, and K\. Xu\(2023\-23–29 Jul\)Are diffusion models vulnerable to membership inference attacks?\.InProceedings of the 40th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.202,pp\. 8717–8730\.Cited by:[§C\.2](https://arxiv.org/html/2606.26257#A3.SS2.SSS0.Px2),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px1.p2.1)\.
- \[10\]J\. Dubiński, A\. Kowalczuk, F\. Boenisch, and A\. Dziedzic\(2025\)Cdi: copyrighted data identification in diffusion models\.InProceedings of the Computer Vision and Pattern Recognition Conference,pp\. 18674–18684\.Cited by:[§C\.2](https://arxiv.org/html/2606.26257#A3.SS2.SSS0.Px5.p1.1),[§C\.2](https://arxiv.org/html/2606.26257#A3.SS2.p1.6),[§1](https://arxiv.org/html/2606.26257#S1.p2.1),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px1.p3.1),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px2.p2.3),[§3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px2.p2.1),[§4\.1](https://arxiv.org/html/2606.26257#S4.SS1.SSS0.Px2.p3.5)\.
- \[11\]J\. Dubiński, A\. Kowalczuk, S\. Pawlak, P\. Rokita, T\. Trzciński, and P\. Morawiecki\(2024\)Towards more realistic membership inference attacks on large diffusion models\.InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision,pp\. 4860–4869\.Cited by:[§4\.1](https://arxiv.org/html/2606.26257#S4.SS1.SSS0.Px1.p1.1)\.
- \[12\]A\. Dziedzic, H\. Duan, M\. A\. Kaleem, N\. Dhawan, J\. Guan, Y\. Cattan, F\. Boenisch, and N\. Papernot\(2022\)Dataset inference for self\-supervised models\.Advances in Neural Information Processing Systems35,pp\. 12058–12070\.Cited by:[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px2.p2.3)\.
- \[13\]C\. Elkan and K\. Noto\(2008\)Learning classifiers from only positive and unlabeled data\.InProceedings of the 14th ACM SIGKDD international conference on Knowledge discovery and data mining,pp\. 213–220\.Cited by:[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2)\.
- \[14\]P\. Esser, R\. Rombach, and B\. Ommer\(2020\)Taming transformers for high\-resolution image synthesis\.External Links:2012\.09841Cited by:[Appendix A](https://arxiv.org/html/2606.26257#A1.SS0.SSS0.Px2.p1.5)\.
- \[15\]Z\. Fei, M\. Fan, C\. Yu, D\. Li, and J\. Huang\(2024\)Scaling diffusion transformers to 16 billion parameters\.External Links:2407\.11633,[Link](https://arxiv.org/abs/2407.11633)Cited by:[§4\.1](https://arxiv.org/html/2606.26257#S4.SS1.SSS0.Px1.p1.1)\.
- \[16\]J\. Gailly and M\. Adler\(2004\)Zlib compression library\.External Links:[Link](http://www.dspace.cam.ac.uk/handle/1810/3486)Cited by:[§C\.1](https://arxiv.org/html/2606.26257#A3.SS1.SSS0.Px4)\.
- \[17\]W\. Gerych, T\. Hartvigsen, L\. Buquicchio, E\. Agu, and E\. Rundensteiner\(2022\)Recovering the propensity score from biased positive unlabeled data\.InProceedings of the AAAI conference on artificial intelligence,Vol\.36,pp\. 6694–6702\.Cited by:[Appendix D](https://arxiv.org/html/2606.26257#A4.SS0.SSS0.Px3.p1.6)\.
- \[18\]\(2025\-11\-04\)Getty Images \(US\), Inc\. et al\. v\. Stability AI Ltd\.\.Note:High Court of Justice, Business and Property Courts of England and Wales, Intellectual Property List \(ChD\)Neutral Citation: \[2025\] EWHC 2863 \(Ch\); Case No\. IL\-2023\-000007External Links:[Link](https://www.judiciary.uk/judgments/getty-images-v-stability-ai/)Cited by:[§1](https://arxiv.org/html/2606.26257#S1.p1.1)\.
- \[19\]C\. Gong, Q\. Wang, T\. Liu, B\. Han, J\. You, J\. Yang, and D\. Tao\(2022\)Instance\-dependent positive and unlabeled learning with labeling bias estimation\.IEEE transactions on pattern analysis and machine intelligence44\(8\),pp\. 4163–4177\.Cited by:[Appendix D](https://arxiv.org/html/2606.26257#A4.SS0.SSS0.Px1.p1.2),[Table 5](https://arxiv.org/html/2606.26257#A5.T5.21.12.7.1),[Table 5](https://arxiv.org/html/2606.26257#A5.T5.21.9.4.1),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.19.15.15.6),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.40.36.36.6),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.61.57.57.6)\.
- \[20\]H\. Hu, Z\. Salcic, G\. Dobbie, J\. Chen, L\. Sun, and X\. Zhang\(2022\)Membership inference via backdooring\.arXiv preprint arXiv:2206\.04823\.Cited by:[§1](https://arxiv.org/html/2606.26257#S1.p2.1)\.
- \[21\]D\. Ivanov\(2020\)DEDPUL: difference\-of\-estimated\-densities\-based positive\-unlabeled learning\.In2020 19th IEEE International Conference on Machine Learning and Applications \(ICMLA\),Vol\.,pp\. 782–790\.External Links:[Document](https://dx.doi.org/10.1109/ICMLA51294.2020.00128)Cited by:[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2)\.
- \[22\]S\. Jain, M\. White, M\. W\. Trosset, and P\. Radivojac\(2016\)Nonparametric semi\-supervised learning of class proportions\.arXiv preprint arXiv:1601\.01944\.Cited by:[Table 5](https://arxiv.org/html/2606.26257#A5.T5.21.11.6.1),[Table 5](https://arxiv.org/html/2606.26257#A5.T5.21.8.3.1),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.14.10.10.6),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.35.31.31.6),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.56.52.52.6)\.
- \[23\]R\. Kiryo, G\. Niu, M\. C\. du Plessis, and M\. Sugiyama\(2017\)Positive\-unlabeled learning with non\-negative risk estimator\.External Links:1703\.00593,[Link](https://arxiv.org/abs/1703.00593)Cited by:[Appendix D](https://arxiv.org/html/2606.26257#A4.SS0.SSS0.Px3.p1.6)\.
- \[24\]F\. Kong, J\. Duan, R\. Ma, H\. T\. Shen, X\. Shi, X\. Zhu, and K\. Xu\(2024\)An efficient membership inference attack for the diffusion model by proximal initialization\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=rpH9FcCEV6)Cited by:[§C\.2](https://arxiv.org/html/2606.26257#A3.SS2.SSS0.Px3),[§C\.2](https://arxiv.org/html/2606.26257#A3.SS2.SSS0.Px4),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px1.p2.1)\.
- \[25\]A\. Kowalczuk, J\. Dubiński, F\. Boenisch, and A\. Dziedzic\(2025\)Privacy attacks on image autoregressive models\.arXiv preprint arXiv:2502\.02514\.Cited by:[§C\.1](https://arxiv.org/html/2606.26257#A3.SS1.p1.2),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px1.p2.1),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px2.p2.3),[§3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px2.p2.1),[§4\.1](https://arxiv.org/html/2606.26257#S4.SS1.SSS0.Px2.p3.5)\.
- \[26\]Y\. Li, Y\. Bai, Y\. Jiang, Y\. Yang, S\. Xia, and B\. Li\(2022\)Untargeted backdoor watermark: towards harmless and stealthy dataset copyright protection\.Advances in Neural Information Processing Systems35,pp\. 13238–13250\.Cited by:[§1](https://arxiv.org/html/2606.26257#S1.p2.1)\.
- \[27\]Y\. Li, Z\. Zhang, J\. Bai, B\. Wu, Y\. Jiang, and S\. Xia\(2020\)Open\-sourced dataset protection via backdoor watermarking\.arXiv preprint arXiv:2010\.05821\.Cited by:[§1](https://arxiv.org/html/2606.26257#S1.p2.1)\.
- \[28\]Y\. Li, M\. Zhu, X\. Yang, Y\. Jiang, T\. Wei, and S\. Xia\(2023\)Black\-box dataset ownership verification via backdoor watermarking\.IEEE Transactions on Information Forensics and Security\.Cited by:[§1](https://arxiv.org/html/2606.26257#S1.p2.1)\.
- \[29\]B\. Liu, W\. S\. Lee, P\. S\. Yu, and X\. Li\(2002\)Partially supervised classification of text documents\.InICML,Vol\.2,pp\. 387–394\.Cited by:[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2)\.
- \[30\]P\. Maini, H\. Jia, N\. Papernot, and A\. Dziedzic\(2024\)LLM dataset inference: did you train on my dataset?\.External Links:2406\.06443,[Link](https://arxiv.org/abs/2406.06443)Cited by:[§1](https://arxiv.org/html/2606.26257#S1.p2.1),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px1.p3.1),[§3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px2.p2.1)\.
- \[31\]P\. Maini and A\. SuriReassessing emnlp 2024’s best paper: does divergence\-based calibration for mias hold up?\.InThe Fourth Blogpost Track at ICLR 2025,Cited by:[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px2.p2.3)\.
- \[32\]P\. Maini, M\. Yaghini, and N\. Papernot\(2021\)Dataset inference: ownership resolution in machine learning\.InProceedings of ICLR 2021: 9th International Conference on Learning Representationsn,Cited by:[§1](https://arxiv.org/html/2606.26257#S1.p3.1),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px2.p1.6),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px2.p2.3)\.
- \[33\]M\. D\. Plessis, G\. Niu, and M\. Sugiyama\(2015\-07–09 Jul\)Convex formulation for learning from positive and unlabeled data\.InProceedings of the 32nd International Conference on Machine Learning,F\. Bach and D\. Blei \(Eds\.\),Proceedings of Machine Learning Research, Vol\.37,Lille, France,pp\. 1386–1394\.External Links:[Link](https://proceedings.mlr.press/v37/plessis15.html)Cited by:[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2)\.
- \[34\]A\. Radford, J\. Wu, R\. Child, D\. Luan, D\. Amodei, I\. Sutskever,et al\.Language models are unsupervised multitask learners\.Cited by:[Appendix A](https://arxiv.org/html/2606.26257#A1.SS0.SSS0.Px2.p1.5)\.
- \[35\]H\. Ramaswamy, C\. Scott, and A\. Tewari\(2016\)Mixture proportion estimation via kernel embeddings of distributions\.InInternational conference on machine learning,pp\. 2052–2060\.Cited by:[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2)\.
- \[36\]R\. Rombach, A\. Blattmann, D\. Lorenz, P\. Esser, and B\. Ommer\(2022\)High\-resolution image synthesis with latent diffusion models\.InIEEE/CVF Conference on Computer Vision and Pattern Recognition,Cited by:[Appendix B](https://arxiv.org/html/2606.26257#A2.p3.5),[§3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px1.p2.1)\.
- \[37\]B\. Ross\(2014\-02\)Mutual information between discrete and continuous data sets\.PloS one9,pp\. e87357\.External Links:[Document](https://dx.doi.org/10.1371/journal.pone.0087357)Cited by:[Appendix D](https://arxiv.org/html/2606.26257#A4.SS0.SSS0.Px1.p1.15)\.
- \[38\]K\. Schwarz, Y\. Liao, and A\. Geiger\(2021\)On the frequency bias of generative models\.InAdvances in Neural Information Processing Systems,M\. Ranzato, A\. Beygelzimer, Y\. Dauphin, P\.S\. Liang, and J\. W\. Vaughan \(Eds\.\),Vol\.34,pp\. 18126–18136\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2021/file/96bf57c6ff19504ff145e2a32991ea96-Paper.pdf)Cited by:[§3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px1.p4.4)\.
- \[39\]C\. D\. Scott\(2015\)A rate of convergence for mixture proportion estimation, with application to learning from noisy labels\.InInternational Conference on Artificial Intelligence and Statistics,External Links:[Link](https://api.semanticscholar.org/CorpusID:7110638)Cited by:[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2)\.
- \[40\]W\. Shi, A\. Ajith, M\. Xia, Y\. Huang, D\. Liu, T\. Blevins, D\. Chen, and L\. Zettlemoyer\(2024\)Detecting pretraining data from large language models\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=zWqr3MQuNs)Cited by:[§C\.1](https://arxiv.org/html/2606.26257#A3.SS1.SSS0.Px2),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px1.p2.1)\.
- \[41\]J\. Song, C\. Meng, and S\. Ermon\(2021\)Denoising diffusion implicit models\.InInternational Conference on Learning Representations,Cited by:[§C\.2](https://arxiv.org/html/2606.26257#A3.SS2.SSS0.Px2.p1.7)\.
- \[42\]R\. Tang, Q\. Feng, N\. Liu, F\. Yang, and X\. Hu\(2023\)Did you train on my dataset? towards public dataset protection with clean\-label backdoor watermarking\.arXiv preprint arXiv:2303\.11470\.Cited by:[§1](https://arxiv.org/html/2606.26257#S1.p2.1)\.
- \[43\]P\. Teisseyre, T\. Martens, J\. Bekker, and J\. Davis\(2025\-03–05 May\)Learning from biased positive\-unlabeled data via threshold calibration\.InProceedings of The 28th International Conference on Artificial Intelligence and Statistics,Y\. Li, S\. Mandt, S\. Agrawal, and E\. Khan \(Eds\.\),Proceedings of Machine Learning Research, Vol\.258,pp\. 2314–2322\.External Links:[Link](https://proceedings.mlr.press/v258/teisseyre25a.html)Cited by:[Appendix D](https://arxiv.org/html/2606.26257#A4.SS0.SSS0.Px1.p1.11),[Table 5](https://arxiv.org/html/2606.26257#A5.T5.20.4.1),[Table 5](https://arxiv.org/html/2606.26257#A5.T5.21.5.1),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px3.p1.2),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.20.16.16.1),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.41.37.37.1),[Table 2](https://arxiv.org/html/2606.26257#S4.T2.62.58.58.1)\.
- \[44\]The New York Times Company\(2023\-12\)Complaint\.Note:[https://nytco\-assets\.nytimes\.com/2023/12/NYT\_Complaint\_Dec2023\.pdf](https://nytco-assets.nytimes.com/2023/12/NYT_Complaint_Dec2023.pdf)Civil Action No\. 1:23\-cv\-11195, United States District Court for the Southern District of New YorkCited by:[§1](https://arxiv.org/html/2606.26257#S1.p1.1)\.
- \[45\]K\. Tian, Y\. Jiang, Z\. Yuan, B\. Peng, and L\. Wang\(2024\)Visual autoregressive modeling: scalable image generation via next\-scale prediction\.External Links:2404\.02905,[Link](https://arxiv.org/abs/2404.02905)Cited by:[Appendix A](https://arxiv.org/html/2606.26257#A1.SS0.SSS0.Px3.p1.1),[Appendix B](https://arxiv.org/html/2606.26257#A2.p3.5),[§3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px1.p2.1),[§4\.1](https://arxiv.org/html/2606.26257#S4.SS1.SSS0.Px1.p1.1)\.
- \[46\]Y\. Tong, J\. Ye, S\. Zarifzadeh, and R\. Shokri\(2025\)How much of my dataset did you use? quantitative data usage inference in machine learning\.InThe Thirteenth International Conference on Learning Representations,Cited by:[§1](https://arxiv.org/html/2606.26257#S1.p4.1),[Table 3](https://arxiv.org/html/2606.26257#S4.T3.3.1.2),[Table 3](https://arxiv.org/html/2606.26257#S4.T3.4.2.2)\.
- \[47\]United States Code\(1976\)U\.s\. copyright act, title 17, section 107\.Note:[https://www\.copyright\.gov/title17/92chap1\.html\#107](https://www.copyright.gov/title17/92chap1.html#107)Fair UseCited by:[§1](https://arxiv.org/html/2606.26257#S1.p3.1)\.
- \[48\]A\. van den Oord, O\. Vinyals, and K\. Kavukcuoglu\(2018\)Neural discrete representation learning\.External Links:1711\.00937,[Link](https://arxiv.org/abs/1711.00937)Cited by:[Appendix A](https://arxiv.org/html/2606.26257#A1.SS0.SSS0.Px2.p1.5)\.
- \[49\]A\. Vaswani, N\. Shazeer, N\. Parmar, J\. Uszkoreit, L\. Jones, A\. N\. Gomez, L\. Kaiser, and I\. Polosukhin\(2017\)Attention is all you need\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.30,pp\. 5998–6008\.External Links:[Link](https://arxiv.org/abs/1706.03762)Cited by:[Appendix A](https://arxiv.org/html/2606.26257#A1.SS0.SSS0.Px2.p1.5)\.
- \[50\]S\. Yeom, I\. Giacomelli, M\. Fredrikson, and S\. Jha\(2018\)Privacy risk in machine learning: analyzing the connection to overfitting\.InIEEE Computer Security Foundations Symposium \(CSF\),Cited by:[§C\.2](https://arxiv.org/html/2606.26257#A3.SS2.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px1.p2.1),[footnote 1](https://arxiv.org/html/2606.26257#footnote1)\.
- \[51\]Q\. Yu, J\. He, X\. Deng, X\. Shen, and L\. Chen\(2024\)Randomized autoregressive visual generation\.External Links:2411\.00776,[Link](https://arxiv.org/abs/2411.00776)Cited by:[Appendix A](https://arxiv.org/html/2606.26257#A1.SS0.SSS0.Px4.p1.1),[§1](https://arxiv.org/html/2606.26257#S1.p6.2),[§4\.1](https://arxiv.org/html/2606.26257#S4.SS1.SSS0.Px1.p1.1)\.
- \[52\]S\. Zarifzadeh, P\. Liu, and R\. Shokri\(2023\)Low\-cost high\-power membership inference attacks\.arXiv preprint arXiv:2312\.03262\.Cited by:[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px1.p2.1)\.
- \[53\]S\. Zhai, H\. Chen, Y\. Dong, J\. Li, Q\. Shen, Y\. Gao, H\. Su, and Y\. Liu\(2024\)Membership inference on text\-to\-image diffusion models via conditional likelihood discrepancy\.InAdvances in Neural Information Processing Systems,A\. Globerson, L\. Mackey, D\. Belgrave, A\. Fan, U\. Paquet, J\. Tomczak, and C\. Zhang \(Eds\.\),Vol\.37,pp\. 74122–74146\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2024/file/874411a224a1934b80d499068384808b-Paper-Conference.pdf)Cited by:[§C\.2](https://arxiv.org/html/2606.26257#A3.SS2.SSS0.Px5),[§2](https://arxiv.org/html/2606.26257#S2.SS0.SSS0.Px1.p2.1)\.
- \[54\]A\. Zhang and C\. Wu\(2024\)Adaptive pre\-training data detection for large language models via surprising tokens\.arXiv preprint arXiv:2407\.21248\.Cited by:[§C\.1](https://arxiv.org/html/2606.26257#A3.SS1.SSS0.Px6)\.
- \[55\]B\. Zhao, P\. Maini, F\. Boenisch, and A\. Dziedzic\(2025\)Unlocking post\-hoc dataset inference with synthetic data\.InForty\-second International Conference on Machine Learning,External Links:[Link](https://openreview.net/forum?id=a5Kgv47d2e)Cited by:[§3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px1.p1.6)\.

## Broader Impact

This work can help data owners and auditors estimate whether, and to what extent, a particular dataset was used to train a generative model, supporting transparency and accountability around large\-scale training data\. The same capability, however, may also be misused against the owners of the data: an adversary could in principle useNU\-DUIas a privacy attack to infer whether someone’s private dataset was incorporated into a model’s training set without consent, or to extract dataset\-level information about confidential training corpora that the model owner has not disclosed\.

## Appendix Overview

The appendix provides additional background and implementation details that support the main paper\. Section[A](https://arxiv.org/html/2606.26257#A1)reviews image autoregressive models\. Section[B](https://arxiv.org/html/2606.26257#A2)expands on the synthetic\-reference construction used byNU\-DUI\. Section[C](https://arxiv.org/html/2606.26257#A3)details the MIA feature suites for autoregressive and diffusion targets\. Section[D](https://arxiv.org/html/2606.26257#A4)describes the PUL\-based MPE estimator\. Section[E\.1](https://arxiv.org/html/2606.26257#A5.SS1)reports the ablation on the img2img noise strength\. We close with broader\-impact considerations in Section[Broader Impact](https://arxiv.org/html/2606.26257#Ax1)\.

## Appendix AImage Autoregressive Models

#### Notation\.

We denote image dimensions byC,H,WC,H,W, and writeNtN\_\{t\}for the number of discrete tokens obtained after quantization\. An input image is represented asx∈ℝC×H×Wx\\in\\mathbb\{R\}^\{C\\times H\\times W\}, and its autoregressively generated counterpart asx^\\hat\{x\}\. After discretization, the image is mapped to a token sequencet∈ℕNtt\\in\\mathbb\{N\}^\{N\_\{t\}\}, witht^\\hat\{t\}denoting the generated sequence\.

#### Autoregressive modeling for images\.

Classical image autoregressive \(AR\) models\[[6](https://arxiv.org/html/2606.26257#bib.bib450)\]model the joint distribution of an image by predicting tokens sequentially, e\.g\., in raster\-scan order\. Lettingtnt\_\{n\}denote thenn\-th token, the model factorizes

pM​\(x\)=∏n=1NtpM​\(tn∣t1:n−1\),p\_\{M\}\(x\)=\\prod\_\{n=1\}^\{N\_\{t\}\}p\_\{M\}\(t\_\{n\}\\mid t\_\{1:n\-1\}\),\(1\)wherepMp\_\{M\}is the next\-token distribution produced by the target modelMM, and is trained by minimizing the negative log\-likelihoodLAR=𝔼x∼𝒟train​\[−log⁡pM​\(x\)\]L\_\{\\text\{AR\}\}=\\mathbb\{E\}\_\{x\\sim\\mathcal\{D\}\_\{\\text\{train\}\}\}\\left\[\-\\log p\_\{M\}\(x\)\\right\]\. Modeling images at the pixel level produces very long sequences with strong local redundancy and is computationally prohibitive at scale\. Methods such as VQ\-VAE\[[48](https://arxiv.org/html/2606.26257#bib.bib439)\]and VQ\-GAN\[[14](https://arxiv.org/html/2606.26257#bib.bib445)\]alleviate this by introducing a discrete latent representation: an encoder compresses the image into a lower\-resolution latent grid that is quantized using a learned codebook, the resulting discrete codes form a much shorter token sequence, and a decoder reconstructs the image from these tokens\. This token\-based formulation aligns image generation with the modeling paradigm used in NLP, so modern image autoregressive models commonly adopt transformer architectures\[[49](https://arxiv.org/html/2606.26257#bib.bib399)\]similar to those used in GPT\-style language models\[[34](https://arxiv.org/html/2606.26257#bib.bib449)\]\.

#### Visual Autoregressive Models \(VAR\)\.

VAR\[[45](https://arxiv.org/html/2606.26257#bib.bib442)\]departs from the standard practice of predicting a 1D token sequence in raster order\. It instead adopts a multi\-scale, coarse\-to\-fine generation strategy in which images are represented as hierarchical 2D token maps\. The model first generates coarse\-level tokens and then refines them at progressively higher resolutions, which preserves spatial structure, substantially improves scalability and memory efficiency, and accelerates sampling\. VAR exhibits clear scaling behavior analogous to large language models\.

#### Randomized Autoregressive Models \(RAR\)\.

RAR\[[51](https://arxiv.org/html/2606.26257#bib.bib441)\]addresses a central limitation of standard AR training: its strictly left\-to\-right conditioning\. Inspired by bidirectional objectives such as BERT\[[8](https://arxiv.org/html/2606.26257#bib.bib453)\], RAR introduces random permutations of token order during training, allowing the model to learn from a diverse set of bidirectional contexts while still optimizing a likelihood\-based AR loss\. The permutation schedule gradually anneals toward a fixed raster order, ensuring compatibility with standard autoregressive sampling at inference time, and the resulting bidirectional context yields improved image fidelity\.

## Appendix BSynthetic Reference Construction

Here, we give details for constructing s the synthetic\-reference\-set used byNU\-DUI\. Given the suspect setXrealX^\{\\text\{real\}\}, the procedure produces both the synthetic non\-member setXnonmemberimg2imgX^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}and the autoencoded suspect setXAEX^\{\\text\{AE\}\}, which serve as the negative referenceNNand the unlabeled mixtureUUin Algorithm[1](https://arxiv.org/html/2606.26257#alg1), respectively\.

Each suspect imagex∈Xrealx\\in X^\{\\text\{real\}\}is processed twice using components of the same image\-to\-image generator𝒢\\mathcal\{G\}\. First, it is routed through the autoencoder\(ℰ,𝒟\)\(\\mathcal\{E\},\\mathcal\{D\}\)alone to produce

xAE=𝒟​\(ℰ​\(x\)\)\.x^\{\\text\{AE\}\}=\\mathcal\{D\}\(\\mathcal\{E\}\(x\)\)\.Second, it is passed through the full image\-to\-image generator to produce a class\-conditioned paraphrase

xnonmemberimg2img=𝒢​\(x,pc;s,g\)\.x^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}=\\mathcal\{G\}\(x,p\_\{c\};\\,s,g\)\.Routing both sides through the same autoencoder ensures that the unlabeled and negative sets share matching generator\-induced artifacts, so that the residual gap betweenUUandNNis dominated by membership rather than by low\-level distribution shift\.

The generator𝒢\\mathcal\{G\}is chosen from a different generative family than the audited target model\. We use Stable Diffusion\[[36](https://arxiv.org/html/2606.26257#bib.bib200)\]for image autoregressive targets and a VAR generator\[[45](https://arxiv.org/html/2606.26257#bib.bib442)\]for diffusion targets\. This cross\-family choice avoids the fixed\-point artifact described in Section[3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px1): if synthetic non\-members are generated by the same family as the audited target, they can become artificially easy or hard under that target’s own training loss for reasons unrelated to membership\. The class promptpcp\_\{c\}is the ImageNet class label ofxx; the noise strengthssand guidance scaleggare fixed across all suspect images\.

## Appendix CMIA Feature Suite

This section details the per\-sample MIA features that constitute the feature extractorΦMIA\\Phi\_\{\\text\{MIA\}\}defined in Section[3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px2)\. Recall that

ΦMIA​\(x\)=\[f1​\(x\),…,fdM​\(x\)\]∈ℝdM,\\Phi\_\{\\text\{MIA\}\}\(x\)=\\left\[f\_\{1\}\(x\),\\ldots,f\_\{d\_\{M\}\}\(x\)\\right\]\\in\\mathbb\{R\}^\{d\_\{M\}\},\(2\)where each scalar featurefm​\(x\)f\_\{m\}\(x\)is a membership score obtained by querying the target modelMMonxx\. Each subsection below specifies which scalar scoresfmf\_\{m\}enterΦMIA\\Phi\_\{\\text\{MIA\}\}for a given target\-model family\. We feed the resulting vectors directly into the MPE estimator \(Algorithm[2](https://arxiv.org/html/2606.26257#alg2)\) and never threshold any individualfmf\_\{m\}\.

### C\.1Image Autoregressive Targets

For image autoregressive target models we use the suite ofKowalczuket al\.\[[25](https://arxiv.org/html/2606.26257#bib.bib356)\], who develop the first MIAs for IARs by adapting token\-level signals from LLMs\. Because IARs produce both conditional and unconditional next\-token distributions through classifier\-free guidance, every base scoreℳ\\mathcal\{M\}is computed twice \(with and without the class conditioncc\) and combined into a single feature

Δ​ℳ​\(x\)=ℳ​\(M​\(x∣c\)\)−ℳ​\(M​\(x∣∅\)\),\\Delta\\mathcal\{M\}\(x\)=\\mathcal\{M\}\\\!\\left\(M\(x\\mid c\)\\right\)\-\\mathcal\{M\}\\\!\\left\(M\(x\\mid\\varnothing\)\\right\),\(3\)which sharpens the contrast between members and non\-members\. EachΔ​ℳ\\Delta\\mathcal\{M\}contributes one scalar featurefmf\_\{m\}toΦMIA​\(x\)\\Phi\_\{\\text\{MIA\}\}\(x\)\. We list the IAR\-specific base scoresℳ\\mathcal\{M\}below\.

#### Loss\-based score\.

The simplest signal is the per\-sample negative log\-likelihood underMM, used in conditional and unconditional modes and combined via Eq\.[3](https://arxiv.org/html/2606.26257#A3.E3)\.

#### Min\-K%\[[40](https://arxiv.org/html/2606.26257#bib.bib386)\]\.

Min\-K% averages the log\-probability of the least likelyK%K\\%of tokens inxx:

𝒮Min\-K%​\(x\)=1\|SK\|​∑n∈SKlog⁡pM​\(tn∣t<n\),\\mathcal\{S\}\_\{\\text\{Min\-K\\%\}\}\(x\)=\\frac\{1\}\{\|S\_\{K\}\|\}\\sum\_\{n\\in S\_\{K\}\}\\log p\_\{M\}\(t\_\{n\}\\mid t\_\{<n\}\),\(4\)whereSKS\_\{K\}is the set of token positions with the lowest conditional probabilities\. We compute the score in both classifier\-free\-guidance modes, take their difference, and select the bestK∈\{10,20,30,40,50\}K\\in\\\{10,20,30,40,50\\\}\.

#### Min\-K%\+\+\.

Min\-K%\+\+ standardizes the per\-token log\-probabilities before averaging the bottomK%K\\%:

𝒮Min\-K%\+\+​\(x\)=1\|SK\|​∑n∈SKlog⁡pM​\(tn∣t<n\)−μt<nσt<n,\\mathcal\{S\}\_\{\\text\{Min\-K\\%\+\+\}\}\(x\)=\\frac\{1\}\{\|S\_\{K\}\|\}\\sum\_\{n\\in S\_\{K\}\}\\frac\{\\log p\_\{M\}\(t\_\{n\}\\mid t\_\{<n\}\)\-\\mu\_\{t\_\{<n\}\}\}\{\\sigma\_\{t\_\{<n\}\}\},\(5\)whereμt<n\\mu\_\{t\_\{<n\}\}andσt<n\\sigma\_\{t\_\{<n\}\}are the mean and standard deviation of the next\-token distribution at positionnn\. The score is again computed in both modes and the difference is used\.

#### Zlib ratio\[[16](https://arxiv.org/html/2606.26257#bib.bib408)\]\.

The Zlib feature normalizes the model’s perplexity by a content\-dependent compressibility term:

𝒮Zlib​\(x\)=𝒫M​\(x\)zlib​\(x\),\\mathcal\{S\}\_\{\\text\{Zlib\}\}\(x\)=\\frac\{\\mathcal\{P\}\_\{M\}\(x\)\}\{\\mathrm\{zlib\}\(x\)\},\(6\)wherezlib​\(x\)\\mathrm\{zlib\}\(x\)is the byte length of the zlib\-compressed input\. The numerator is computed in conditional and unconditional modes; the denominator is image\-only and shared across both\.

#### CAMIA\[[5](https://arxiv.org/html/2606.26257#bib.bib461)\]\.

CAMIA extracts several context\-aware statistics from the per\-token loss sequence—slope, approximate entropy, Lempel–Ziv complexity, the fraction of low\-loss tokens, and the loss reduction when the input is repeated\. Each statistic is computed under conditional and unconditional decoding and contributes one feature via Eq\.[3](https://arxiv.org/html/2606.26257#A3.E3)\.

#### SURP\[[54](https://arxiv.org/html/2606.26257#bib.bib459)\]\.

SURP averages the next\-token probability over tokens that are simultaneously low\-probability and emitted under low predictive entropy:

𝒮SURP​\(x\)=1\|𝒮\|​∑n∈𝒮pM​\(tn∣t<n\),𝒮=\{n∣Hn<ϵe,pM​\(tn∣t<n\)<τk\},\\mathcal\{S\}\_\{\\text\{SURP\}\}\(x\)=\\frac\{1\}\{\|\\mathcal\{S\}\|\}\\sum\_\{n\\in\\mathcal\{S\}\}p\_\{M\}\(t\_\{n\}\\mid t\_\{<n\}\),\\quad\\mathcal\{S\}=\\\{n\\mid H\_\{n\}<\\epsilon\_\{e\},\\;p\_\{M\}\(t\_\{n\}\\mid t\_\{<n\}\)<\\tau\_\{k\}\\\},\(7\)whereτk\\tau\_\{k\}is the bottomk%k\\%probability threshold andHnH\_\{n\}is the entropy of the predictive distribution at positionnn\. We sweepk∈\{10,20,30,40,50\}k\\in\\\{10,20,30,40,50\\\}andϵe∈\{2,4,8,16\}\\epsilon\_\{e\}\\in\\\{2,4,8,16\\\}, and follow Eq\.[3](https://arxiv.org/html/2606.26257#A3.E3)for the final feature\.

### C\.2Diffusion Targets

For diffusion target models we adopt the feature suite of CDI\[[10](https://arxiv.org/html/2606.26257#bib.bib357)\], which aggregates several gray\-box membership signals computed from the model’s noise predictionM​\(zt,t\)M\(z\_\{t\},t\)on the latentz=ℰ​\(x\)z=\\mathcal\{E\}\(x\)at carefully chosen timesteps\. We use the same encoderℰ\\mathcal\{E\}as in Section[3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px1);α¯t\\bar\{\\alpha\}\_\{t\}denotes the standard cumulative noise schedule\. The descriptions below summarize the formulations fromDubińskiet al\.\[[10](https://arxiv.org/html/2606.26257#bib.bib357)\]and the underlying papers; we refer the reader to those works for full derivations\. Each scalar score below contributes one featurefmf\_\{m\}toΦMIA​\(x\)\\Phi\_\{\\text\{MIA\}\}\(x\)\.

#### Denoising loss\[[4](https://arxiv.org/html/2606.26257#bib.bib199)\]\.

Following the loss\-attack tradition for discriminative models\[[50](https://arxiv.org/html/2606.26257#bib.bib237)\], this score evaluates the squared denoising error at a fixed timestept∗=100t^\{\*\}\{=\}100:

𝒮Loss​\(x\)=1K​∑k=1K‖ϵk−M​\(zt∗\(k\),t∗\)‖22,zt∗\(k\)=α¯t∗​z\+1−α¯t∗​ϵk,\\mathcal\{S\}\_\{\\text\{Loss\}\}\(x\)=\\frac\{1\}\{K\}\\sum\_\{k=1\}^\{K\}\\left\\\|\\epsilon\_\{k\}\-M\\\!\\left\(z\_\{t^\{\*\}\}^\{\(k\)\},t^\{\*\}\\right\)\\right\\\|\_\{2\}^\{2\},\\quad z\_\{t^\{\*\}\}^\{\(k\)\}=\\sqrt\{\\bar\{\\alpha\}\_\{t^\{\*\}\}\}\\,z\+\\sqrt\{1\-\\bar\{\\alpha\}\_\{t^\{\*\}\}\}\\,\\epsilon\_\{k\},\(8\)averaged overK=5K\{=\}5independent noise samplesϵk∼𝒩​\(0,I\)\\epsilon\_\{k\}\\sim\\mathcal\{N\}\(0,I\)to reduce variance\. Members are expected to receive lower loss than non\-members\.

#### SecMIstat\{\}\_\{\\text\{stat\}\}\[[9](https://arxiv.org/html/2606.26257#bib.bib173)\]\.

SecMIstat\{\}\_\{\\text\{stat\}\}measures how well a deterministic DDIM\[[41](https://arxiv.org/html/2606.26257#bib.bib348)\]denoising step inverts the corresponding sampling step, an operation the target model is expected to perform more accurately on members\. LettingΦM​\(z,t\)\\Phi\_\{M\}\(z,t\)denote the deterministic DDIM reverse trajectory fromzzto timesteptt,ϕM​\(⋅,t\)\\phi\_\{M\}\(\\cdot,t\)the DDIM sampling\-inverse step, andψM​\(⋅,t\)\\psi\_\{M\}\(\\cdot,t\)the DDIM denoising step, the score is thett\-error

𝒮SecMI​\(x\)=‖ψM​\(ϕM​\(ΦM​\(z,t∗\),t∗\),t∗\)−ΦM​\(z,t∗\)‖22,\\mathcal\{S\}\_\{\\text\{SecMI\}\}\(x\)=\\left\\\|\\psi\_\{M\}\\\!\\left\(\\phi\_\{M\}\\\!\\left\(\\Phi\_\{M\}\(z,t^\{\*\}\),t^\{\*\}\\right\),t^\{\*\}\\right\)\-\\Phi\_\{M\}\(z,t^\{\*\}\)\\right\\\|\_\{2\}^\{2\},\(9\)witht∗=100t^\{\*\}\{=\}100\. Intuitively, this is the round\-trip error of one DDIM step starting from the deterministic reverse latentΦM​\(z,t∗\)\\Phi\_\{M\}\(z,t^\{\*\}\); members are expected to yield a lowertt\-error\.

#### PIA\[[24](https://arxiv.org/html/2606.26257#bib.bib334)\]\.

The Proximal Initialization Attack \(PIA\) compares the noise prediction on a clean latent with the noise prediction on a noised latent constructed from it: a model that has memorizedxxwill track this trajectory more closely\. The score is

𝒮PIA​\(x\)=‖M​\(z,0\)−M​\(α¯t∗​z\+1−α¯t∗​M​\(z,0\),t∗\)‖p,\\mathcal\{S\}\_\{\\text\{PIA\}\}\(x\)=\\left\\\|M\(z,0\)\-M\\\!\\left\(\\sqrt\{\\bar\{\\alpha\}\_\{t^\{\*\}\}\}\\,z\+\\sqrt\{1\-\\bar\{\\alpha\}\_\{t^\{\*\}\}\}\\,M\(z,0\),\\;t^\{\*\}\\right\)\\right\\\|\_\{p\},\(10\)witht∗=200t^\{\*\}\{=\}200andp=5p\{=\}5\. Members are expected to receive lower scores\.

#### PIAN\[[24](https://arxiv.org/html/2606.26257#bib.bib334)\]\.

PIAN is a normalized variant of PIA that rescales the clean\-latent noise prediction so that it more closely matches the standard\-Gaussian assumption onM​\(z,0\)M\(z,0\):

M^​\(z,0\)=C⋅H⋅Wπ/2⋅M​\(z,0\)‖M​\(z,0\)‖1\.\\hat\{M\}\(z,0\)=\\frac\{C\\cdot H\\cdot W\}\{\\sqrt\{\\pi/2\}\}\\cdot\\frac\{M\(z,0\)\}\{\\\|M\(z,0\)\\\|\_\{1\}\}\.\(11\)The PIA score is then computed as above withM^​\(z,0\)\\hat\{M\}\(z,0\)in place ofM​\(z,0\)M\(z,0\)\.

#### CLiD\[[53](https://arxiv.org/html/2606.26257#bib.bib336)\]\.

The Conditional Likelihood Discrepancy attack \(CLiD\) exploits classifier\-free\-guidance models by contrasting the conditional and unconditional denoising losses at the same timestep:

𝒮CLiD\(x\)=∥ϵ−M\(zt∗,t∗∣c\)∥22−∥ϵ−M\(zt∗,t∗∣∅\)∥22,\\mathcal\{S\}\_\{\\text\{CLiD\}\}\(x\)=\\left\\\|\\epsilon\-M\(z\_\{t^\{\*\}\},t^\{\*\}\\mid c\)\\right\\\|\_\{2\}^\{2\}\-\\left\\\|\\epsilon\-M\(z\_\{t^\{\*\}\},t^\{\*\}\\mid\\varnothing\)\\right\\\|\_\{2\}^\{2\},\(12\)which acts as a diffusion analog of theΔ\\Deltascore in Eq\.[3](https://arxiv.org/html/2606.26257#A3.E3)and is more discriminative than either branch alone for class\-conditional and text\-conditional models\[[10](https://arxiv.org/html/2606.26257#bib.bib357)\]\. The rest of our pipeline is identical to the IAR case in Section[3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px3)\.

## Appendix DPUL\-based Mixture Proportion Estimation

This section details the MPE construction that underlies the PUL\-LBE and PUL\-NTC\-τ\\tauMI rows of Table[2](https://arxiv.org/html/2606.26257#S4.T2)\. It instantiates the abstractMPE​\(ZMIA,U,N\)\\textsc\{MPE\}\(Z^\{\\text\{MIA\}\},U,N\)call from Algorithm[1](https://arxiv.org/html/2606.26257#alg1), whereU=XAEU=X^\{\\text\{AE\}\}is the unlabeled set,N=Xnonmemberimg2imgN=X^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}the labeled\-negative set, andZMIA=ΦMIA​\(U∪N\)Z^\{\\text\{MIA\}\}=\\Phi\_\{\\text\{MIA\}\}\(U\\cup N\)the corresponding MIA features\. The construction has three steps: \(i\) train a Positive–Unlabeled classifier on\(U,N\)\(U,N\), \(ii\) project both sets onto its scalar scores​\(x\)∈ℝs\(x\)\\in\\mathbb\{R\}, and \(iii\) estimate the member proportionπ\\piofUUby histogram matching on this score, returningp^\\hat\{p\}as our estimate ofπ\\pi\.

#### PUL classifiers\.

We use two distinct paradigms for modeling labeled and unlabeled data\.LBE\[[19](https://arxiv.org/html/2606.26257#bib.bib369)\]is a probabilistic, instance\-dependent PU learner that assumes the labeling probability depends on both features𝐱\\mathbf\{x\}and latent labelsyy, and factorizes the joint as

P​\(y,ℓ∣𝐱\)=P​\(y∣𝐱\)​P​\(ℓ∣y,𝐱\),P\(y,\\ell\\mid\\mathbf\{x\}\)=P\(y\\mid\\mathbf\{x\}\)\\,P\(\\ell\\mid y,\\mathbf\{x\}\),\(13\)whereℓ∈\{0,1\}\\ell\\in\\\{0,1\\\}indicates whether a sample is observed as labeled, i\.e\., whether it belongs toNN\. The class\-posterior parametersθ1\\theta\_\{1\}and the labeling\-mechanism parametersθ2\\theta\_\{2\}are jointly fit by maximizing the marginal likelihood

maxθ=\(θ1,θ2\)​∏i=1nP​\(ℓi∣𝐱i;θ\)=maxθ​∏i=1n∑yi∈\{0,1\}P​\(ℓi,yi∣𝐱i;θ\)\\max\_\{\\theta=\(\\theta\_\{1\},\\theta\_\{2\}\)\}\\prod\_\{i=1\}^\{n\}P\(\\ell\_\{i\}\\mid\\mathbf\{x\}\_\{i\};\\theta\)=\\max\_\{\\theta\}\\prod\_\{i=1\}^\{n\}\\sum\_\{y\_\{i\}\\in\\\{0,1\\\}\}P\(\\ell\_\{i\},y\_\{i\}\\mid\\mathbf\{x\}\_\{i\};\\theta\)\(14\)via the Expectation–Maximization \(EM\) algorithm\.NTC\-τ\\tauMI\[[43](https://arxiv.org/html/2606.26257#bib.bib371)\]instead trains a Non\-Traditional Classifier \(NTC\) on\(U,N\)\(U,N\)and then chooses a decision thresholdτ\\tauthat maximizes the mutual information between the binarized predictionsY^τ\\hat\{Y\}^\{\\tau\}and the continuous NTC scoresZZ,

τ∗=arg⁡maxτ⁡M​I​\(Y^τ,Z\),\\tau\_\{\*\}=\\arg\\max\_\{\\tau\}\\;MI\(\\hat\{Y\}^\{\\tau\},Z\),\(15\)estimating the mixed\-typeM​IMIvia akk\-nearest\-neighbors estimator\[[37](https://arxiv.org/html/2606.26257#bib.bib370)\]that runs inO​\(n​log⁡n\)O\(n\\log n\)time on the one\-dimensional scoreZZ\.

#### Histogram\-based ratio estimation\.

After training, both methods reduce to a one\-dimensional scores​\(x\)∈ℝs\(x\)\\in\\mathbb\{R\}for eachx∈U∪Nx\\in U\\cup N\. We bin these scores into a fixed gridℬ\\mathcal\{B\}and form histogramshU​\(s\)h\_\{U\}\(s\)andhN​\(s\)h\_\{N\}\(s\), treatinghUh\_\{U\}as an empirical estimate of the score\-space mixturepU​\(s\)=π​pM​\(s\)\+\(1−π\)​pN​\(s\)p\_\{U\}\(s\)=\\pi\\,p\_\{M\}\(s\)\+\(1\-\\pi\)\\,p\_\{N\}\(s\)from Section[3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px3)\. We then solve for the largest non\-member\-mass coefficientπ^N\\hat\{\\pi\}\_\{N\}that allowshUh\_\{U\}to be approximately explained by a scaledhNh\_\{N\}:

π^N=max⁡\{πN∈\[0,1\]\|hU​\(s\)−πN​hN​\(s\)≥−δ,∀s∈ℬ\},\\hat\{\\pi\}\_\{N\}=\\max\\\!\\left\\\{\\pi\_\{N\}\\in\[0,1\]\\;\\middle\|\\;h\_\{U\}\(s\)\-\\pi\_\{N\}\\,h\_\{N\}\(s\)\\geq\-\\delta,\\ \\forall s\\in\\mathcal\{B\}\\right\\\},\(16\)whereδ\>0\\delta\>0is a small relaxation that absorbs finite\-sample noise \(see Figure[5](https://arxiv.org/html/2606.26257#A4.F5)\)\. All histograms share identical bin edges and extremely sparse bins are masked\. The estimated member ratio is thenp^=1−π^N\\hat\{p\}=1\-\\hat\{\\pi\}\_\{N\}, our MPE estimate ofπ\\pi\. We rerun the full pipeline with33independent random seeds and report the mean and standard deviation ofp^\\hat\{p\}in Tables[2](https://arxiv.org/html/2606.26257#S4.T2)and[4](https://arxiv.org/html/2606.26257#S4.T4)\.

![Refer to caption](https://arxiv.org/html/2606.26257v1/x10.png)Figure 5:Density of membership scores produced by a PUL classifier\.The unlabeled setUUis treated as a mixture of positive and negative samples;hNh\_\{N\}andhUh\_\{U\}are the score histograms of theknown synthetic negatives\(NN\) and theunlabeledset \(UU\), respectively\. In each bin, the portion ofhUh\_\{U\}that lies abovehNh\_\{N\}reflectspositives, i\.e\., the “excess mass\.” Integrating this excess across all bins recovers the estimated fraction of positive samplesp^\\hat\{p\}inUU\.Algorithm 2PUL\-based MPE\(MPEsubroutine of Algorithm[1](https://arxiv.org/html/2606.26257#alg1)\)

1:MIA features

ZMIAZ^\{\\text\{MIA\}\}; unlabeled set

UU; synthetic negatives

NN; bin edges

ℬ\\mathcal\{B\}; relaxation

δ\\delta
2:

ℓ​\(x\)←𝟙​\[x∈N\]\\ell\(x\)\\leftarrow\\mathbb\{1\}\[x\\in N\]for all

x∈U∪Nx\\in U\\cup N⊳\\trianglerightobserved\-label indicator

3:Train PUL classifier on

\(ZMIA,ℓ\)\(Z^\{\\text\{MIA\}\},\\ell\)
4:Compute classifier score

s​\(x\)s\(x\)for all

x∈U∪Nx\\in U\\cup N
5:

hU←Hist​\(\{s​\(x\):x∈U\},ℬ\)h\_\{U\}\\leftarrow\\textsc\{Hist\}\(\\\{s\(x\):x\\in U\\\},\\,\\mathcal\{B\}\),

hN←Hist​\(\{s​\(x\):x∈N\},ℬ\)h\_\{N\}\\leftarrow\\textsc\{Hist\}\(\\\{s\(x\):x\\in N\\\},\\,\\mathcal\{B\}\)
6:

π^N←max⁡\{πN∈\[0,1\]:hU​\(s\)−πN​hN​\(s\)≥−δ,∀s∈ℬ\}\\hat\{\\pi\}\_\{N\}\\leftarrow\\max\\\{\\pi\_\{N\}\\in\[0,1\]:h\_\{U\}\(s\)\-\\pi\_\{N\}\\,h\_\{N\}\(s\)\\geq\-\\delta,\\ \\forall s\\in\\mathcal\{B\}\\\}
7:

p^←1−π^N\\hat\{p\}\\leftarrow 1\-\\hat\{\\pi\}\_\{N\}
8:return

p^\\hat\{p\}

#### Assumptions\.

The estimatorp^\\hat\{p\}is consistent and asymptotically unbiased under four standard MPE conditions:

1. 1\.Mixture assumption\.The unlabeled score distribution is a convex mixturepU​\(s\)=π​pM​\(s\)\+\(1−π\)​pN​\(s\)p\_\{U\}\(s\)=\\pi\\,p\_\{M\}\(s\)\+\(1\-\\pi\)\\,p\_\{N\}\(s\)of the member and non\-member score distributions, as in Section[3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px3)\.
2. 2\.Representative non\-members\.The reference setNNfaithfully represents the non\-member component ofUU, with no covariate or domain shift betweenNNand the non\-member portion ofUU\.
3. 3\.Support separation\.There exists at least one region in score space where members occur but non\-members do not, ensuring identifiability ofπ\\pi\.
4. 4\.Sufficient sample size\.The histogramshUh\_\{U\}andhNh\_\{N\}approximate the true densities closely enough that sampling noise does not dominate the mixture\-ratio constraint\.

When these conditions hold,p^\\hat\{p\}converges to the true member ratioπ\\pias the sample sizes ofUUandNNincrease\. Our framework is not tied to any specific PUL algorithm; other estimators from the literature can be plugged in in place of LBE or NTC\-τ\\tauMI\[[2](https://arxiv.org/html/2606.26257#bib.bib368),[17](https://arxiv.org/html/2606.26257#bib.bib372),[23](https://arxiv.org/html/2606.26257#bib.bib364)\]\.

## Appendix EAdditional Experiments

### E\.1Effect of the img2img Noise Strengthss

#### Setup\.

AlgorithmLABEL:alg:construct\_synthconstructs the synthetic non\-member setXnonmemberimg2imgX^\{\\text\{img2img\}\}\_\{\\text\{nonmember\}\}with the Stable Diffusion img2img pipeline, where the noise strengths∈\[0,1\]s\\in\[0,1\]controls how much of the original latent is replaced by Gaussian noise before denoising\. Throughout the main paper we fixs=0\.5s=0\.5\. Two opposing pressures shape this choice\. Forss*too small*, the paraphrase𝒢​\(x,pc;s,g\)\\mathcal\{G\}\(x,p\_\{c\};\\,s,g\)stays close to the autoencoder reconstruction𝒟​\(ℰ​\(x\)\)\\mathcal\{D\}\(\\mathcal\{E\}\(x\)\)used to buildXAEX^\{\\text\{AE\}\}, so the unlabeled setUUand the synthetic negativesNNcollapse onto each other in the MIA feature space and the MPE estimator sees little residual signal between members and non\-members\. Forss*too large*, the paraphrase departs significantly from the original semantics, and the dominant gap betweenUUandNNbecomes a generic content shift rather than a membership signal—the same failure mode that drives theSynthrows of Table[2](https://arxiv.org/html/2606.26257#S4.T2)away from theRealoracle\. We therefore expect a sweet spot at intermediatess, and we ablate this choice empirically by re\-running the fullNU\-DUIpipeline \(Synth \+ AEconfiguration only\) ats∈\{0\.4,0\.5,0\.6\}s\\in\\\{0\.4,0\.5,0\.6\\\}for the two image autoregressive targets VAR\-24 and RAR\-XL, keeping every other component unchanged\. For these two targets, thes=0\.5s=0\.5column of Table[5](https://arxiv.org/html/2606.26257#A5.T5)reproduces theSynth \+ AEblock of Table[2](https://arxiv.org/html/2606.26257#S4.T2)\.

Table 5:Ablation on the img2img noise strengthssin theSynth \+ AEconfiguration ofNU\-DUI\(suspect set size 1,000 images; mean and max absolute error over ground\-truth ratiosp∈\{0\.1,…,1\.0\}p\\in\\\{0\.1,\\ldots,1\.0\\\}\)\. For each target model and MPE estimator we reportMAEandmax MAEof the estimated member ratiop^\\hat\{p\}at three noise strengths used in AlgorithmLABEL:alg:construct\_synth\.Boldmarks the strength with the lowest MAE in each row\. Thes=0\.5s=0\.5column reproduces theSynth \+ AEblock of Table[2](https://arxiv.org/html/2606.26257#S4.T2)for these two targets\. Across the 8 \(target, estimator\) cells,s=0\.5s=0\.5achieves the lowest mean MAE and the lowest mean max MAE;s=0\.4s=0\.4is uniformly the worst, whiles=0\.6s=0\.6is comparable tos=0\.5s=0\.5in mean MAE but markedly less stable in the worst case\. Lower is better\.
#### s=0\.4s=0\.4is uniformly worse\.

At the lower noise strength the synthetic paraphrase𝒢​\(x,pc;s,g\)\\mathcal\{G\}\(x,p\_\{c\};\\,s,g\)stays close to the autoencoder reconstruction𝒟​\(ℰ​\(x\)\)\\mathcal\{D\}\(\\mathcal\{E\}\(x\)\)used to constructXAEX^\{\\text\{AE\}\}, so the unlabeled mixtureUUand the synthetic negativesNNbecome barely separable in the MIA feature space and the MPE estimator loses the membership signal\. MAE roughly doubles or triples relative tos=0\.5s=0\.5on every \(target, estimator\) cell \(e\.g\., RAR\-XL/TIcE:0\.3170\.317vs\.0\.1040\.104; VAR\-24/PUL\-LBE:0\.1960\.196vs\.0\.1260\.126\), and the max MAE consistently exceeds0\.30\.3\. Across all 8 cells, the mean MAE ats=0\.4s=0\.4\(0\.2200\.220\) is more than2×2\\timesthe mean MAE ats=0\.5s=0\.5\(0\.1090\.109\)\.

#### s=0\.5s=0\.5is the most robust choice\.

s=0\.5s=0\.5attains the lowest MAE in5/85/8cells and is within0\.0110\.011of the best in the remaining three\. Averaged over the 8 \(target, estimator\) cells,s=0\.5s=0\.5gives the lowest mean MAE \(0\.1090\.109\) and the lowest mean max MAE \(0\.2290\.229\), beating boths=0\.4s=0\.4\(0\.2200\.220,0\.4170\.417\) ands=0\.6s=0\.6\(0\.1150\.115,0\.2620\.262\)\. The improvement overs=0\.6s=0\.6in the worst\-case error is the practically relevant metric for an auditing tool, where pathological prevalences should not blow up the estimate: e\.g\., VAR\-24/PUL\-LBE max MAE drops from0\.3610\.361ats=0\.6s=0\.6to0\.2510\.251ats=0\.5s=0\.5, and RAR\-XL/AlphaMax from0\.2400\.240to0\.1740\.174\.

#### Increasingssto0\.60\.6does not pay off\.

Whiles=0\.6s=0\.6marginally outperformss=0\.5s=0\.5in MAE on3/83/8cells, the wins are small \(≤0\.011\\leq 0\.011, with two of the three differences below0\.0070\.007\) and are offset by larger losses on the other 5 cells \(up to0\.0280\.028in MAE and0\.1100\.110in max MAE\)\. Pushingssfurther toward11would amount to nearly unconditional generation, which Section[3](https://arxiv.org/html/2606.26257#S3.SS0.SSS0.Px1)already argues against on conceptual grounds\.

#### Conclusion\.

Our experimental observations support the choices=0\.5s=0\.5in AlgorithmLABEL:alg:construct\_synth: large enough that the img2img paraphrase departs meaningfully from the autoencoded suspect, but not so large that semantic drift dominates over the membership signal\. We therefore uses=0\.5s=0\.5throughout the main paper\.