Singapore

Synthetic data generation plays an important role in enabling
data sharing, particularly in sensitive domains like healthcare and finance. Recent advances in diffusion models have
made it possible to generate realistic, high-quality tabular
data, but they may also memorize training records and leak
sensitive information. Membership inference attacks (MIAs)
exploit this vulnerability by determining whether a record
was used in training. While MIAs have been studied in images and text, their use against tabular diffusion models re-
mains underexplored despite the unique risks of structured
attributes and limited record diversity. In this paper, we introduce MIA-EPT, Membership Inference Attack via Error
Prediction for Tabular Data, a novel black-box attack specifically designed to target tabular diffusion models. MIA-EPT
constructs error-based feature vectors by masking and reconstructing attributes of target records, disclosing member-
ship signals based on how well these attributes are predicted.
MIA-EPT operates without access to the internal components
of the generative model, relying only on its synthetic data
output, and was shown to generalize across multiple stateof-the-art diffusion models. We validate MIA-EPT on three
diffusion-based synthesizers, achieving AUC-ROC scores of
up to 0.599 and TPR@10% FPR values of 22.0% in our internal tests. Under the MIDST 2025 competition conditions,
MIA-EPT achieved second place in the Black-box MultiTable track (TPR@10% FPR = 20.0%). These results demonstrate that our method can uncover substantial membership
leakage in synthetic tabular data, challenging the assumption
that synthetic data is inherently privacy-preserving.

AAAI 2026

MIA-EPT: Membership Inference Attack via Error Prediction for Tabular Data

synthetic tabular data

privacy leakage

membership inference attacks

diffusion models

data privacy

### Welcome to 2025 Annual Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics

Welcome to the 2025 meeting of the Nations of the Americas Chapter of the Association for Computational Linguistics! I am proud to help organize the first NAACL conference to carry the new name of our organization, one that emphasizes inclusion for all of the Americas. I am also pleased to welcome you to Albuquerque, New Mexico, a state whose unique blend of cultural influences will make for an excellent backdrop for NAACL 2025, especially with this year’s special theme on NLP in a Multicultural World. 
**[Continue reading...](https://drive.google.com/file/d/1jX-qGhqVSZZCIrAnJaz798pflu5Irrdn/view?usp=sharing)**

*- Colin Cherry, Google, NAACL 2025 General Chair* 

[![](https://assets.underline.io/markdown_image/1/image/b087f8a4dc5816d6e1a6514e59c59ac3.png)](https://drive.google.com/file/d/1T96GzPqObXrMln2BMByCSXTSizjTg69P/view?usp=sharing)

You need to log in with the email address you registered with. Access credentials have been sent to your email. 

Please be sure to check your spam and other email folders if you do not see an email confirmation right away.

Please log in to explore this event.

To access NAACL 2025 event page you are required to register. Please follow [**this link**](https://2025.naacl.org/registration/registration/) to register. Access will depend on your registration type.

Please register!

NAACL 2025

Welcome to 2025 Annual Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics

workshop paper

We are pleased to announce the Fortieth AAAI Conference on Artificial Intelligence (AAAI-26), which will be held in Singapore EXPO from January 20 to January 27, 2026.

The purpose of the AAAI conference series is to promote research in Artificial Intelligence (AI) and foster scientific exchange between researchers, practitioners, scientists, students, and engineers across the entirety of AI and its affiliated disciplines. AAAI-26 will feature technical paper presentations, special tracks, invited speakers, workshops, tutorials, poster sessions, senior member presentations, competitions, and exhibit programs, and a range of other activities to be announced.

To access this event page, you need to log in with the **email address you registered with**. Access credentials will be sent to your email from Underline - subject line "Welcome to AAAI 2026". Please be sure to check your spam email folder if you do not see an email confirmation right away.

Please log in

To access this event page, you are required to register.
Please complete your registration to continue.

We recommend reading [**the registration information**](https://aaai.org/conference/aaai/aaai-26/registration/) first.

**Online Registration Form**: https://aaai.getregistered.net/conference-2026 

Registration Required

We are pleased to announce the Fortieth AAAI Conference on Artificial Intelligence (AAAI-26), which will be held in Singapore EXPO from January 20 to January 27, 2026.

Text-to-image diffusion models achieve high-fidelity image generation from natural language prompts. ControlNets extend these models by enabling conditioning on structural inputs (e.g., edge maps, depth, pose), providing fine-grained control over outputs. Yet their reliance on large, publicly scraped datasets and community fine-tuning makes them vulnerable to data poisoning. We introduce a model-poisoning attack that embeds a covert backdoor into a ControlNet, causing it to produce attacker-specified content when exposed to visual triggers, without textual prompts. Experiments show that poisoning only 1% of the fine-tuning corpus yields a 90–98\% attack success rate, while 5\% further strengthens the backdoor, all while preserving normal generation quality. To mitigate this risk, we propose clean fine-tuning (CFT): freezing the diffusion backbone and fine-tuning only the ControlNet on a sanitized dataset with a reduced learning rate. CFT lowers attack success rates on held-out data. These results expose a critical security weakness in open-source, ControlNet-guided diffusion pipelines and demonstrate that CFT offers a practical defense for responsible synthetic-data pipelines.

Backdoors in Conditional Diffusion: Threats to Responsible Synthetic Data Pipelines

The increased availability of genetic data has transformed genomics research, but raised many privacy concerns regarding its handling due to its sensitive nature. This work explores the use of language models (LMs) for the generation of synthetic genetic mutation profiles, leveraging differential privacy (DP) for the protection of sensitive genetic data. We empirically evaluate the privacy guarantees of our DP modes by introducing a novel **Biologically-Informed Hybrid Membership Inference Attack** (biHMIA), which combines traditional black box MIA with contextual genomics metrics for enhanced attack power. Our experiments show that both small and large transformer GPT-like models are viable synthetic variant generators for *small-scale genomics*, and that our hybrid attack leads, on average, to higher adversarial success compared to traditional metric-based MIAs.

Biologically-Informed Hybrid Membership Inference Attacks on Generative Genomic Models

The proliferation of AI-generated video technologies poses challenges to information integrity. While recent benchmarks advance AIGC video detection, they overlook a critical factor: many state-of-the-art generative models embed digital watermarks in outputs, and detectors may partially rely on these patterns. To evaluate this influence, we present RobustSora, the benchmark designed to assess watermark robustness in AIGC video detection. We systematically construct a dataset of 6,500 videos comprising four types: Authentic-Clean (A-C), Authentic-Spoofed with fake watermarks (A-S), Generated-Watermarked (G-W), and Generated-DeWatermarked (G-DeW). Our benchmark introduces two evaluation tasks: Task-I tests performance on watermark-removed AI videos, while Task-II assesses false alarm rates on authentic videos with fake watermarks. Experiments with ten models spanning specialized AIGC detectors, transformer architectures, and MLLM approaches reveal performance variations of 2-8pp under watermark manipulation. Transformer-based models show consistent moderate dependency (6-8pp), while MLLMs exhibit diverse patterns (2-8pp). These findings indicate partial watermark dependency and highlight the need for watermark-aware training strategies. RobustSora provides essential tools to advance robust AIGC detection research.

RobustSora: De-Watermarked Benchmark for Robust AI-Generated Video Detection

Large Language Models (LLMs) have shown advanced capabilities in tasks like counterfactual generation and style transfer using prompt strategies. However, previous strategies lacked detailed instructions, limiting effectiveness. To address this, we introduce Compare&Generate, an algorithm inspired by human comparison, where minimal instructions lead to substantial learning. Specifically, our method incorporates an objective function that quantitatively assesses alignment with the task goal and the content relevance in the output. Then, it constructs comparison pairs based on previous generation assessments and prompts the model to reconsider how to optimize its output. Through comparison, the model focuses on the critical aspects of the task objective and refines its outputs accordingly. We benchmark our method with single-instruction as well as iterative refinement approaches across three natural language generation tasks. Experimental results show that our approach outperforms other related methods; for instance, it surpasses its single-instruction base by 17% and a state-of-the-art refinement approach by 7% on IMDB datasets in generated label accuracy, highlighting the effectiveness of using comparisons in prompts to enhance LLMs.

Improving Synthetic Data Generation with LLMs through Strategic Comparisons

Knowledge Graphs (KGs) enable applications in various domains such as semantic search, recommendation systems, and natural language processing. KGs are often incomplete, missing entities and relations, an issue addressed by Knowledge Graph Completion (KGC) methods that predict missing elements. Different evaluation metrics, such as Mean Reciprocal Rank (MRR), Mean Rank (MR), and Hit@k (e.g., Hit@1), are commonly used to assess the performance of such KGC models. A major challenge in evaluating KGC models however, lies in comparing their performance across multiple datasets and metrics. A model may outperform others on one dataset but underperform on another, making it difficult to determine overall superiority. Moreover, even within a single dataset, different metrics such as MRR and Hit@1 can yield conflicting rankings, where one model excels in MRR while another performs better in Hit@1, further complicating model selection for downstream tasks. These inconsistencies hinder holistic comparisons and highlight the need for a unified meta-metric that integrates performance across all metrics and datasets to enable a more reliable and interpretable evaluation framework. To address this need, we propose KG \textit{E}valuation based on \textit{D}istance from \textit{A}verage \textit{S}olution (EDAS), a robust and interpretable meta-metric that synthesizes model performance across multiple datasets and diverse evaluation criteria into a single normalized score ($M_i \in [0,1]$). Unlike traditional metrics that focus on isolated aspects of performance, EDAS offers a global perspective that supports more informed model selection and promotes fairness in cross-dataset evaluation. Experimental results on benchmark datasets such as FB15k-237 and WN18RR demonstrate that EDAS effectively integrates multi-metric, multi-dataset performance into a unified ranking, offering a consistent, robust, and generalizable framework for evaluating KGC models.

KG-EDAS: A Meta-Metric Framework for Evaluating Knowledge Graph Completion Models

Dialogue State Tracking (DST) requires precise extraction of structured information from multi-domain conversations, a task where Large Language Models (LLMs) struggle despite their impressive general capabilities. We present GEM (Graph-Enhanced Mixture-of-Experts), a novel framework that combines language models and graph-structured dialogue understanding with ReAct agent-based reasoning for superior DST performance. Our approach dynamically routes between specialized experts: a Graph Neural Network that captures dialogue structure and turn-level dependencies, and a finetuned T5-Small encoder-decoder for sequence modeling, coordinated by an intelligent gating network. For complex value generation tasks, we integrate ReAct agents that perform structured reasoning over dialogue context. On MultiWOZ 2.2, GEM achieves 65.19% Joint Goal Accuracy, substantially outperforming end-to-end LLM approaches (best: 38.43%) and surpassing state-of-the-art (SOTA) methods including TOATOD (63.79%), D3ST (58.70%), and Diable (56.48%). Our graph-enhanced mixture-of-experts architecture with ReAct integration demonstrates that combining structured dialogue representation with dynamic expert routing and agent-based reasoning provides a powerful paradigm for dialogue state tracking, achieving superior accuracy while maintaining computational efficiency through selective expert activation.

GEM: Graph-Enhanced Mixture-of-Experts with ReAct Agents for Dialogue State Tracking

With the increase of data in day-to-day life, businesses and different stakeholders need to analyze the data for better predictions. Traditionally, relational data has been a source of various insights, but with the increase in computational power and the need to understand deeper relationships between entities, the need to design new techniques has arisen. For this graph data analysis has become an extraordinary tool for understanding the data, which reveals more realistic and flexible modelling of complex relationships. Recently, Graph Neural Networks (GNNs) have shown great promise in various applications, such as social network analysis, recommendation systems, drug discovery, and more. However, many adversarial attacks can happen over the data, whether during training (poisoning attack) or during testing (evasion attack), which can adversely manipulate the desired outcome from the GNN model. Therefore, it is crucial to make the GNNs robust to such attacks. The existing robustness methods are computationally demanding and perform poorly when the intensity of attack increases. This paper presents a computationally efficient framework, namely, pLAPGNN, based on weighted p-Laplacian for making GNNs robust. Empirical evaluation on real datasets establishes the efficacy and efficiency of the proposed method.

Enhancing Robustness of Graph Neural Networks through p-Laplacian

Many real-world systems, from neural circuits to economic networks, exhibit feedback loops that are best represented as directed cyclic graphs (DCGs). Yet most scalable causal discovery methods either impose hard acyclicity or rely on global backpropagation, making them unsuitable for feedback-rich settings. We propose PreCyc, a predictive coding framework for causal structure learning that combines node-wise energy minimisation with a soft acyclicity surrogate and sparsity regularisation. The algorithm alternates local state inference and weight updates, avoiding reverse-mode differentiation while remaining scalable to larger graphs. Our analysis shows convergence to a stationary point under standard smoothness assumptions, and we clarify the distinction between local error signals for data fit and the global nature of acyclicity enforcement. Experiments on synthetic Erdos–Renyi, Watts–Strogatz, and scale free graphs, as well as the 279-node C. elegans connectome, demonstrate competitive performance in both structure recovery and cycle identification compared with state-of-the art cyclic causal discovery methods. While the current implementation focuses on linear structural equation models with observational equilibrium data, PreCyc establishes predictive coding as a principled and scalable foundation for causal discovery in feedback-rich systems.

Predictive Coding Causal Discovery for Directed Cyclic Graphs

Prior work on node classification shows that Graph Neural Networks (GNNs) can learn transferable representations of graph properties when those properties are consistent across graphs. For a fixed graph, one would then expect GNNs trained for link prediction to learn a representation consistent with that learnt for node classification. We show this intuition does not hold in the general case. We find instead, popular link prediction models can learn a trivial mini-batch dependent heuristic, enabled by batch normalisation layers, to solve the edge classification task. When correcting for this, we observe increased alignment of network representation with node-class relevant features, suggesting the network has learnt a graph representation that better aligns with the underlying graph's properties. Our findings suggest that standard link prediction training may be leading us to overestimate link predictors' ability to learn a generalised representation of a graph that is consistent across tasks.

Mini-Batch Class Composition Bias in Link Prediction

Knowledge graph completion aims to infer unknown information in a knowledge graph that is incomplete, due to noisy or missing data. Geographic knowledge graphs, which are typically derived from crowd-sourced data, are often incomplete, making geographic knowledge graph completion an important problem. Most current methods for knowledge graph completion are generic, and do not account for the spatial nature of geographic knowledge graphs. The few methods that are tailored to geographic knowledge graphs are computationally expensive or are designed for a closed-world setting, which is not practical in the geography domain. We study this problem by evaluating existing state-of-the-art standard and geo-specific knowledge graph completion methods on a large dataset of geographic knowledge graphs. Our findings reveal that these methods perform poorly, leaving an open problem for the AI and graphs community. To aid in further research, we suggest some possible areas of work that we believe could lead to fruitful developments for this problem.

Content not yet available

Downloads

Next from AAAI 2026

Backdoors in Conditional Diffusion: Threats to Responsible Synthetic Data Pipelines

Similar lecture

Scaling Up Membership Inference: When and How Attacks Succeed on Large Language Models

Content not yet available

.css-70qvj9{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-align-items:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;}Downloads

Next from AAAI 2026

Backdoors in Conditional Diffusion: Threats to Responsible Synthetic Data Pipelines

Similar lecture

Scaling Up Membership Inference: When and How Attacks Succeed on Large Language Models

Downloads