Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Membership and Dataset Inference Attacks on Large Audio Generative Models

Jakub Proboszcz, Paweł Kochanski, Karol Korszun, Donato Crisostomi, Giorgio Strano, Emanuele Rodolà, Kamil Deja, Jan Dubinski

TL;DR

This paper assesses whether membership inference attacks (MIA) can reliably reveal if an artist's works were included in training of large open-source audio generative models. It benchmarks MIAs on autoregressive and diffusion-based audio systems and extends dataset inference (DI) to the audio domain. The key finding is that single-sample MIAs are weak on large, diverse datasets, whereas DI can detect training-set participation with relatively small collections, especially for certain models. The work underscores DI as a practical tool for copyright protection and calls for transparent data partitions to enable robust auditing.

Abstract

Generative audio models, based on diffusion and autoregressive architectures, have advanced rapidly in both quality and expressiveness. This progress, however, raises pressing copyright concerns, as such models are often trained on vast corpora of artistic and commercial works. A central question is whether one can reliably verify if an artist's material was included in training, thereby providing a means for copyright holders to protect their content. In this work, we investigate the feasibility of such verification through membership inference attacks (MIA) on open-source generative audio models, which attempt to determine whether a specific audio sample was part of the training set. Our empirical results show that membership inference alone is of limited effectiveness at scale, as the per-sample membership signal is weak for models trained on large and diverse datasets. However, artists and media owners typically hold collections of works rather than isolated samples. Building on prior work in text and vision domains, in this work we focus on dataset inference (DI), which aggregates diverse membership evidence across multiple samples. We find that DI is successful in the audio domain, offering a more practical mechanism for assessing whether an artist's works contributed to model training. Our results suggest DI as a promising direction for copyright protection and dataset accountability in the era of large audio generative models.

Membership and Dataset Inference Attacks on Large Audio Generative Models

TL;DR

This paper assesses whether membership inference attacks (MIA) can reliably reveal if an artist's works were included in training of large open-source audio generative models. It benchmarks MIAs on autoregressive and diffusion-based audio systems and extends dataset inference (DI) to the audio domain. The key finding is that single-sample MIAs are weak on large, diverse datasets, whereas DI can detect training-set participation with relatively small collections, especially for certain models. The work underscores DI as a practical tool for copyright protection and calls for transparent data partitions to enable robust auditing.

Abstract

Generative audio models, based on diffusion and autoregressive architectures, have advanced rapidly in both quality and expressiveness. This progress, however, raises pressing copyright concerns, as such models are often trained on vast corpora of artistic and commercial works. A central question is whether one can reliably verify if an artist's material was included in training, thereby providing a means for copyright holders to protect their content. In this work, we investigate the feasibility of such verification through membership inference attacks (MIA) on open-source generative audio models, which attempt to determine whether a specific audio sample was part of the training set. Our empirical results show that membership inference alone is of limited effectiveness at scale, as the per-sample membership signal is weak for models trained on large and diverse datasets. However, artists and media owners typically hold collections of works rather than isolated samples. Building on prior work in text and vision domains, in this work we focus on dataset inference (DI), which aggregates diverse membership evidence across multiple samples. We find that DI is successful in the audio domain, offering a more practical mechanism for assessing whether an artist's works contributed to model training. Our results suggest DI as a promising direction for copyright protection and dataset accountability in the era of large audio generative models.

Paper Structure

This paper contains 13 sections, 13 equations, 1 figure, 4 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Identifying Training Data
  4. Audio Generative Models
  5. Method
  6. Results
  7. Discussion and Conclusions
  8. Details on Membership Inference for Autoregressive Models
  9. Details on Membership Inference for Diffusion Models
  10. Multiple Loss.
  11. Gradient Masking.
  12. Noise Optimization.
  13. Details on Dataset Inference

Figures (1)

  • Figure 1: Dataset Inference Procedural Steps. The process consists of four main steps: Data Preparation: Prepare the data to verify whether the (suspected) member samples P were used to train the model. The (confirmed) nonmember samples U, from the same distribution as P, serve as the validation set. Feature Extraction: Run each individual MIA on all inputs from $\{\textbf{P}\xspace,\textbf{U}\xspace\}$ to extract membership features for all data samples. We use our MIAs tailored to ARMs and DMs for the respective model types. Score Computation: We map extracted feature vectors into scalar membership scores for each sample. We use a scoring model for DMs, following dubinski2025cdi, and feature summation kowalczukprivacy for ARMs (see Appendix for more details. Statistical Testing: Apply a statistical t-test to verify whether the scores obtained for the public suspect data points P are statistically significantly higher than those for U. If so, P is marked as being part of the model's training set. Otherwise, the test is inconclusive and the model's training set is considered independent of P.