Model update histories can reveal when training examples entered or left a model

Static membership-inference attacks ask whether a data point was used to train a model. TMIA studies a different temporal question: at which training checkpoints was that point present? Its authors observe predictions from successive checkpoints and train a bidirectional LSTM to infer when a sample was added, removed or re-added. That history can remain statistically observable even if the latest checkpoint no longer contains the record.

The paper evaluates controlled updates to Pythia-70M, T5, GPT-2 and image classifiers. For Pythia-70M on SST-5, it reports timestamp-level F1 of 91.34%, compared with 77.59% for a static timestamp-wise baseline, and interval-level F1 of 84.16% compared with approximately 57.01%. Observability matters: with only a quarter of checkpoints visible, timestamp F1 fell to 48.48%. A differential privacy setting with cumulative epsilon 10 reduced one timestamp F1 measure to 17.47% while reducing accuracy from 43.26% to 38.43%. These are research benchmarks, not observations about commercial ChatGPT users or any person's hidden training history.

The finding extends the privacy model for versioned AI systems. A deletion or unlearning claim should specify what persistence guarantees it makes about prior published checkpoints, accessible output histories and observational side channels, not only the current training set.

The threat model depends on a time series. The authors simulate repeated additions and removals over many model updates, then attempt to recover intervals of membership from black-box model outputs. When only 50% of checkpoints were visible, they report timestamp and interval F1 scores of 72.82% and 64.66%; with 25% observable, these declined to 48.48% and 36.47%. In a separate reduced-precision experiment, 4-bit quantization weakened but did not eliminate the observed signal. A model provider that never exposes comparable snapshot histories does not automatically face this measured attack rate.

A deletion claim needs a specific temporal boundary. Removing one record from current training data is different from making historical model releases unobservable, purging logs, preventing repeated queries, or proving that an observer cannot infer prior participation. The private attribute-uniqueness protocol solves a different problem: learning whether a set of attributes is rare before disclosure, under its own two-server assumptions. Neither technique guarantees broad anonymity.