Accepted at ECCV 2026

MGI: Member vs Generated Inference

Bihe Zhao, Michel Meintz, Juangui Xu, Franziska Boenisch, Adam Dziedzic

CISPA Helmholtz Center for Information Security

Paper  |  Code  |  BibTeX

On This Page

Overview · Motivation · Extension · Solution · Results · Attacks · Take-Aways · Citation

Overview

We introduce a new task MGI (Member vs Generated Inference): given a sample and a target generative model, infer whether the sample is a true training member or a generated output of that model. In the era of the powerful generative models, this new MGI task is a natural extension to the MIA (Membership Inference Attack) that distinguishes between a true training member and a non-member sample.

The above figure presents an overview of the new MGI task and its predecessor, the MIA task. MGI asks whether a given sample should be attributed to training data or to model-generated data. For the original model \(\mathcal{M}\), the task is to distinguish between \(M\), \(N\), and \(G\), separating true natural training members \(M\) from natural non-members \(N\) (as in the canonical MIA task) and from model’s \(\mathcal{M}\) generated samples \(G\).

Motivation

As generative models increasingly produce samples that are indistinguishable from human-created content, it becomes difficult to determine whether a given data point was part of a model’s natural training set or was generated by the model itself, especially when models memorize and reproduce training data. We formalize this challenge as Member vs Generated Inference (MGI): given a sample and a target generative model, infer whether the sample is a true training member or a generated output of that model. Focusing on image generation, we show that existing MIA methods systematically misclassify generated samples as training members, while attribution-based methods often misclassify true members as generated. This failure arises because both approaches rely on likelihood-related signals that are similarly elevated for training examples and for the model’s own outputs.

MGI is fundamentally harder than standard membership inference: generated images are optimized under the same latent distribution as training members, causing their likelihood-based scores to overlap heavily, as we demonstrate in the figure below for IARs (Image Autoregressive Models).

The figure below presents the distributions of scores for membership inference attack (MIA) and image attribution on IARs. In all cases, the differentiation between training (Train) and generated (Belonging) images is more difficult than between training (Train) and validation (Val) images. This indicates more difficult cases of the MGI (Member vs Generated Inference) than MIA task. The evaluated model is VAR. The figure on the left shows the distribution of scores for the state-of-the-art MIA on IARs (Image Autoregressive Models), while the figure on the right shows the distribution of scores for a IAR-generated image attribution.

Extensions

We further explore a more challenging and practically relevant extensions of the original MGI tasks to the model derivative setting, where the samples generated by model \(\mathcal{M_1}\) are (potentially published online, then scraped from the internet, and) used to train the subsequent model version \(\mathcal{M_2}\). In this regime, members are no longer purely natural samples, and simply separating natural from generated content is insufficient. Both membership inference and attribution methods degrade further in the \(\mathcal{M_2}\) setting, where generated training data introduces compounding ambiguity between membership and generation signals.

Let \(N = M \cup N\) denote a natural dataset, where \(M \cap N = \varnothing\). A generative model \(\mathcal{M_1}\) is trained on the member set \(M\), while \(N\) is held out as natural non-member data. After training, \(\mathcal{M_1}\) produces a generated dataset \(G = G_M \cup G_N\), with \(G_M \cap G_N = \varnothing\). Here, \(G_M\) and \(G_N\) are both generated by \(\mathcal{M_1}\) and therefore follow the same generated-data distribution, but they play different roles in downstream settings: \(G_M\) is used to train a new model \(\mathcal{M_2}\), whereas \(G_N\) is withheld and serves as generated non-member data for \(\mathcal{M_2}\). The new model \(\mathcal{M_2}\) is thus trained on generated members \(G_M\) rather than natural members \(M\). The new model \(\mathcal{M_2}\) in turn generates a new dataset \(G' = G'_M \cup G'_N\), where \(G'_M \cap G'_N = \varnothing\); samples in \(G'_M\) may be used to train further downstream models such as \(\mathcal{M_3}\), while \(G'_N\) remains withheld. Under this setup, MGI asks whether a given sample should be attributed to training data or to model-generated data. For the original model \(\mathcal{M_1}\), the task is to distinguish among \({M, N, G}\), separating true natural training members \(M\) from natural non-members \(N\) (as in the canonical membership inference task) and from model’s \(\mathcal{M_1}\) generated samples \(G\). For the derivative model \(\mathcal{M_2}\), the task becomes: distinguish among \({G_M, G_N, G'}\), separating generated training members \(G_M\) from both generated non-members \(G_N\) and from model’s \(\mathcal{M_2}\) generated samples \(G'\). We can further incorporate the natural samples \(N\) as \(\mathcal{M_2}\)’s non-member data, however, the \(G_N\) represents the most difficult case of the non-member data.

Our Initial Solution

To address MGI, we propose an initial solution: Data Circuit Breaker (DCB). It is a three-stage method that combines complementary signals from a generative model’s autoencoder and latent generator to distinguish training members from generated samples. Across multiple generative models, including image autoregressive and diffusion models, DCB consistently addresses the shortcomings of membership inference and attribution methods, remains effective even when models reproduce near-duplicates of training samples, and generalizes to challenging model derivative settings in which new models are trained on generated data.

Our DCB method treats the generation pipeline holistically rather than focusing solely on the latent generator. The key insight is that while the latent generator produces high scores for members and generated samples, the autoencoder introduces measurable artifacts: generated samples, having passed through the full encode-decode pipeline, exhibit lower reconstruction and quantization errors than natural data points under the autoencoder. DCB exploits this by proceeding in three stages: (1) an autoencoder-based filtering step that identifies generated samples, separating them from non-generated data points; (2) a membership inference step on the non-generated samples using the latent generator, where the standard assumption that members score is restored; and (3) a cross-generator attribution step that compares conditional log-probabilities across multiple model versions to distinguish among the generated samples from different generators. Together, these stages enable our initial DCB to solve MGI even in the cases of training data memorization.

Main Results

Under this new setting of generative models, we analyze the performance of the original MIAs and image attribution methods for IARs (Image AutoRegressive Models) in the Table below and report the TPR@1%FPR. We find that while existing MIAs are able to separate the natural members from the natural non-members, they break when the generated data is introduced. Our DCB however achieves near 100% TPR@1%FPR under the generated vs natural setting and improves the average performance by over 36% (LlamaGen). Under the MGI task DCB benefits from combining multiple signals leading to a consistent performance across detections.

The table below shows TPR@1%FPR for IARs (Image AutoRegressive Models) in the direct training setting. Only DCB achieves consistent performance across all comparisons and models. LG denotes the LlamaGen model.

We additionally analyze the MGI task on diffusion models in the Table below, following CLiD and fine-tuning the models on natural MS-COCO data to obtain natural members and non-members. Our results show that, similar as for the IARs above, while the baseline methods are able to distinguish non-members and members, they fail when the generated data is introduced. Only DCB, which takes the full generative pipeline into account, can distinguish the generated data from the natural data.

The table below shows TPR@1%FPR for diffusion models in the direct training setting. Only DCB achieves consistent performance across all comparisons and models.

What Are the Main Takeaways?

1. New task. We introduce Member vs Generated Inference (MGI) task, which asks whether a given sample is a true training member of a generative model or an output example generated by that same model.
2. Limits of prior work. We demonstrate that existing approaches are insufficient for MGI: Membership Inference Attack (MIA) methods systematically misclassify generated samples as members, while attribution methods often incorrectly label training members as generated.
3. Initial Solution. We propose DCB (Data Circuit Breaker), a three-stage procedure that exploits autoencoder self-consistency to filter generated samples, latent-generator scores for membership inference, and cross-generator probability discrepancies as an initial solution to address MGI for the image generative models.

BibTeX

@inproceedings{zhao2026mgi,
  title = {MGI: Member vs Generated Inference},
  author = {Zhao, Bihe and Meintz, Michel, and Xu, Juangui and Boenisch, Franziska and Dziedzic, Adam},
  booktitle = {Proceedings of the European Conference on Computer Vision},
  year = {2026},
  note = {Accepted at ECCV 2026},
  url = {https://arxiv.org/abs/2606.23872}
}