What the Benchmark Evidence Really Shows

The WBC mechanism is persuasive only if its reported advantage survives measurement rather than existing as an attractive explanation. This chapter examines the evidence for fine-tuned LLM membership leakage: what data and metrics the paper used, where WBC gains the most, and which changes in model, sequence, or reference alter the result. The goal is not to repeat a leaderboard, but to separate demonstrated behavior from conclusions that still depend on the paper’s experimental setting.

What was tested, and why low false positives matter

The paper evaluates membership inference as a binary discrimination problem. Each candidate belongs either to the fine-tuning set or to a held-out non-member set. The evaluator receives a continuous attack score, then varies a threshold to decide how many candidates to flag. This setup makes two kinds of error visible: a true positive is a member correctly identified, while a false positive is a non-member incorrectly treated as a member.

The evaluation uses balanced sets of 10,000 members and 10,000 non-members, with samples at least 512 tokens long. The main experiments cover six subsets of Cosmopedia, a synthetic corpus generated for instruction and domain adaptation, and five real-world document benchmarks: WikiText-103, XSum, Amazon Reviews, CC-News, and Reddit. Pythia-2.8B is the primary model, fine-tuned from its pretrained base, and the paper also studies other model sizes and architectures. WBC is compared with thirteen baselines, including methods that use only the target model and methods that compare target and reference losses.

The paper reports area under the receiver operating characteristic curve, or AUC, along with true-positive rate at false-positive rates of 10%, 1%, and 0.1%. AUC summarizes ranking quality across all thresholds. It is useful for a broad comparison, but it does not tell an operator what happens when alerts must be rare. TPR at 1% FPR answers a sharper question: if the evaluator is willing to incorrectly flag about one non-member in a hundred, what fraction of actual members can the method identify? TPR at 0.1% FPR is stricter still.

That distinction changes the practical interpretation of an attack. A method can improve its average ranking without producing many trustworthy alerts at a strict threshold. Conversely, a local method can have a moderate AUC improvement but a large gain where false positives are tightly constrained. Privacy evaluation often has asymmetric consequences: an organization may not want to label a large number of innocent records as exposed, while a person whose inclusion matters may still benefit from a sensitive audit. The low-FPR metrics make that trade-off visible rather than hiding it inside one curve.

In the paper’s aggregate summary across the evaluated datasets, WBC reaches a mean AUC of 0.839 compared with 0.754 for the strongest baseline. At a 1% false-positive rate, the reported true-positive rate rises from 5.2% to 14.6%, a 2.8-fold improvement. The representative Web Samples v2 result gives WBC an AUC of 0.843 and a 19.8% true-positive rate at 1% FPR. At the more extreme 0.1% FPR on Khan Academy, WBC identifies 2.6% of members, compared with 0.7% for the next best method.