TS-RaMIA: Membership Inference Attacks for Symbolic Music Generation Models

Yuxuan Liu, Rui Sang, Peihong Zhang, Zhixin Li, Kunyang Zhang, Shengyuan He, Ye Li, Kaiyi Xu, Shengchen Li
Proceedings of Machine Learning Research, PMLR 303:1-15, 2026.

Abstract

Artists and rights holders face growing concerns about unauthorized use of their copyrighted works in training generative models. We introduce TS-RaMIA, a practical auditing framework enabling creators to test whether their symbolic music has been used without authorization. Unlike existing likelihood-based approaches that are confounded by piece length and density, TS-RaMIA exploits structural tokens—bar lines, positions, and tempo markers—encoding musical phrasing through sample-level analysis and rigorous debiasing. Our method combines (i) length matching and conditional calibration to remove spurious confounders, (ii) tail-of-top-k aggregation on structural tokens to amplify sparse memorization signals, and (iii) a lightweight meta-attacker fusing statistical cues via composer-stratified cross-validation. Evaluated on a 67M-parameter REMI Transformer trained on MAESTRO pieces, TS-RaMIA achieves AUC 0.826 and TPR@1%FPR 14.6%, while a debiased baseline drops to AUC 0.563. Cross-representation validation on NotaGen (ABC notation) yields comparable performance (AUC 0.73, TPR@1%FPR 8.9%), demonstrating transferability.

Cite this Paper

BibTeX
@InProceedings{pmlr-v303-liu26a, title = {TS-RaMIA: Membership Inference Attacks for Symbolic Music Generation Models}, author = {Liu, Yuxuan and Sang, Rui and Zhang, Peihong and Li, Zhixin and Zhang, Kunyang and He, Shengyuan and Li, Ye and Xu, Kaiyi and Li, Shengchen}, booktitle = {Proceedings of Machine Learning Research}, pages = {1--15}, year = {2026}, editor = {Herremans, Dorien and Bhandari, Keshav and Roy, Abhinaba and Colton, Simon and Barthet, Mathieu}, volume = {303}, series = {Proceedings of Machine Learning Research}, month = {26 Jan}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v303/main/assets/liu26a/liu26a.pdf}, url = {https://proceedings.mlr.press/v303/liu26a.html}, abstract = {Artists and rights holders face growing concerns about unauthorized use of their copyrighted works in training generative models. We introduce TS-RaMIA, a practical auditing framework enabling creators to test whether their symbolic music has been used without authorization. Unlike existing likelihood-based approaches that are confounded by piece length and density, TS-RaMIA exploits structural tokens—bar lines, positions, and tempo markers—encoding musical phrasing through sample-level analysis and rigorous debiasing. Our method combines (i) length matching and conditional calibration to remove spurious confounders, (ii) tail-of-top-k aggregation on structural tokens to amplify sparse memorization signals, and (iii) a lightweight meta-attacker fusing statistical cues via composer-stratified cross-validation. Evaluated on a 67M-parameter REMI Transformer trained on MAESTRO pieces, TS-RaMIA achieves AUC 0.826 and TPR@1%FPR 14.6%, while a debiased baseline drops to AUC 0.563. Cross-representation validation on NotaGen (ABC notation) yields comparable performance (AUC 0.73, TPR@1%FPR 8.9%), demonstrating transferability.} }
Endnote
%0 Conference Paper %T TS-RaMIA: Membership Inference Attacks for Symbolic Music Generation Models %A Yuxuan Liu %A Rui Sang %A Peihong Zhang %A Zhixin Li %A Kunyang Zhang %A Shengyuan He %A Ye Li %A Kaiyi Xu %A Shengchen Li %B Proceedings of Machine Learning Research %C Proceedings of Machine Learning Research %D 2026 %E Dorien Herremans %E Keshav Bhandari %E Abhinaba Roy %E Simon Colton %E Mathieu Barthet %F pmlr-v303-liu26a %I PMLR %P 1--15 %U https://proceedings.mlr.press/v303/liu26a.html %V 303 %X Artists and rights holders face growing concerns about unauthorized use of their copyrighted works in training generative models. We introduce TS-RaMIA, a practical auditing framework enabling creators to test whether their symbolic music has been used without authorization. Unlike existing likelihood-based approaches that are confounded by piece length and density, TS-RaMIA exploits structural tokens—bar lines, positions, and tempo markers—encoding musical phrasing through sample-level analysis and rigorous debiasing. Our method combines (i) length matching and conditional calibration to remove spurious confounders, (ii) tail-of-top-k aggregation on structural tokens to amplify sparse memorization signals, and (iii) a lightweight meta-attacker fusing statistical cues via composer-stratified cross-validation. Evaluated on a 67M-parameter REMI Transformer trained on MAESTRO pieces, TS-RaMIA achieves AUC 0.826 and TPR@1%FPR 14.6%, while a debiased baseline drops to AUC 0.563. Cross-representation validation on NotaGen (ABC notation) yields comparable performance (AUC 0.73, TPR@1%FPR 8.9%), demonstrating transferability.
APA
Liu, Y., Sang, R., Zhang, P., Li, Z., Zhang, K., He, S., Li, Y., Xu, K. & Li, S.. (2026). TS-RaMIA: Membership Inference Attacks for Symbolic Music Generation Models. Proceedings of Machine Learning Research, in Proceedings of Machine Learning Research 303:1-15 Available from https://proceedings.mlr.press/v303/liu26a.html.

Related Material