As large language models (LLMs) are trained on increasingly opaque corpora, membership inference attacks (MIAs) have been proposed to audit whether copyrighted texts were used during training, despite growing concerns about their reliability under realistic conditions. We ask whether MIAs can serve as admissible evidence in adversarial copyright disputes where an accused model developer may obfuscate training data while preserving semantic content, and formalize this setting through a judge-prosecutor-accused communication protocol. To test robustness under this protocol, we introduce SAGE (Structure-Aware SAE-Guided Extraction), a paraphrasing framework guided by Sparse Autoencoders (SAEs) that rewrites training data to alter lexical structure while preserving semantic content and downstream utility. Our experiments show that state-of-the-art MIAs degrade when models are fine-tuned on SAGE-generated paraphrases, indicating that their signals are not robust to semantics-preserving transformations. While some leakage remains in certain fine-tuning regimes, these results suggest that MIAs are brittle in adversarial settings and insufficient, on their own, as a standalone mechanism for copyright auditing of LLMs.

翻译：随着大型语言模型（LLMs）在日益不透明的语料库上进行训练，尽管在现实条件下其可靠性备受质疑，成员推理攻击（MIAs）仍被提议用于审计训练过程中是否使用了受版权保护的文本。我们探讨在对抗性版权纠纷中，当被指控的模型开发者可能在保留语义内容的同时对训练数据进行模糊处理时，MIAs 能否作为可采纳的证据。我们通过法官-检察官-被告的通信协议形式化这一设定。为测试该协议下的鲁棒性，我们提出了 SAGE（结构感知的稀疏自编码器引导提取），这是一个由稀疏自编码器（SAEs）引导的复述框架，它重写训练数据以改变词汇结构，同时保留语义内容和下游效用。实验表明，当模型在 SAGE 生成的复述文本上进行微调时，最先进的 MIAs 性能下降，表明其信号对语义保持的变换不具备鲁棒性。尽管在某些微调机制中仍存在部分信息泄露，但这些结果表明，MIAs 在对抗性环境中是脆弱的，其本身不足以作为 LLMs 版权审计的独立机制。