Source-aware Membership Audit (SMA)

• The paper replaces traditional inclusion proofs with proofs-of-progress using source-issued tokens and TEE accumulators to verify membership.
• It demonstrates SMA's application in trusted database auditing and image-based retrieval, ensuring privacy while maintaining O(1) computational complexity.
• The framework extends to causal analyses by incorporating source labels as covariates, enabling source-specific estimation of memorization effects.

Source-aware Membership Audit (SMA) denotes a family of mechanisms for determining whether a specific item belongs to a database or model-relevant corpus while explicitly exploiting source-side information. In Gyokuro, SMA is mapped to Source-assisted Private Membership Testing (SPMT) with two additions: the audit must be privacy-preserving and append-only aware, and membership is concluded from proof-of-progress anchored to external monitors rather than from a direct inclusion proof (Nakatsuka et al., 24 Mar 2026). In image-based retrieval-augmented generation, the same label is used for audits that combine retriever-aware and generator-aware queries to test whether a target image is present in an opaque retrieval database (Zhang et al., 2 Jun 2026). In causal analyses of membership inference, source-aware auditing treats source labels as covariates and estimates source-specific memorization effects rather than raw member–non-member score gaps (Even et al., 2 Feb 2026).

1. Definitions and conceptual scope

In the SPMT formulation, Private Membership Testing (PMT) is a protocol that allows a client to learn whether a data item is included in a database without revealing the item, namely the client’s interest, to the server or other parties. Source-assisted PMT (SPMT) is a PMT variant in which the client leverages compact source-provided information issued when the item was submitted to the database. Gyokuro states that SMA can be mapped to SPMT with two additions: the audit must be privacy-preserving and append-only aware (Nakatsuka et al., 24 Mar 2026).

In Gyokuro’s terminology, source awareness is implemented through a source-issued token tied to the item, and append-only awareness is implemented by checking equality between the TEE’s accumulator and a monitor’s accumulator. The client uses source-issued artifacts to verify that the TEE has processed the item, described as “sufficient progress,” and that monitors’ accumulators match the TEE’s, thereby enforcing a global append-only semantics (Nakatsuka et al., 24 Mar 2026).

A different usage appears in auditing retrieval-augmented generation. There, SMA in text-RAG refers to auditing whether a source passage is in the retrieval database by crafting queries that force retrieval of that specific source and extract discriminative signals in the generated response. ImageAuditor generalizes this idea to IRAG by decomposing each attack query into a retrieval segment and an extraction segment, because cross-modal retrieval and output modality make text-RAG methods fail to transfer directly (Zhang et al., 2 Jun 2026).

A third usage appears in causal membership inference. The causal framework introduces source labels $S$ as covariates and defines source-specific estimands such as

$\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$

so that source-aware auditing measures and compares memorization across sources and adjusts for source-induced confounding in zero-run settings (Even et al., 2 Feb 2026).

Setting	Source-aware component	Membership criterion
SPMT / Gyokuro	Source-issued token tied to the item	$POR < POP$ with matching accumulators
IRAG / ImageAuditor	Retrieval segment $T_{\mathrm{ret}}$ and extraction segment $T_{\mathrm{ext}}$	Thresholded aggregate score after K-means clustering
Causal MIA	Source label $S$ included in $X$	Causal effect or source-specific CATE

This comparison suggests that SMA is not a single protocol. Rather, it is a recurring audit pattern in which source information constrains how membership evidence is generated, validated, and interpreted.

2. Gyokuro’s reformulation of membership as progress

Gyokuro’s central design goal is to replace proof-of-existence with proof-of-progress. Instead of asking the server to produce an inclusion proof over the item, the client verifies that the TEE made sufficient progress to include the item into the database. The TEE maintains a monotonically increasing counter $cnt$ and a sequence of accumulators over processed batches. For the item of interest $d'$, the client compares the counter included in the source-provided Proof Of Reception (POR) with a Proof Of Processing (POP) derived by the TEE for the monitor’s current accumulator. If $POR < POP$ and the TEE’s accumulator matches the monitor’s, the client concludes that $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$0 was processed and is in the database (Nakatsuka et al., 24 Mar 2026).

The source-assisted token is explicitly defined as

$\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$1

Here, $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$2, $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$3 is the counter value at reception time, and $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$4 is the TEE attestation report binding $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$5 and $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$6 (Nakatsuka et al., 24 Mar 2026).

This construction changes what the audit proves. The client does not ask whether the server can exhibit an inclusion witness for $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$7. The client instead checks whether the TEE accepted $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$8 into its buffer at a specific counter value, whether the TEE later processed enough batches to move beyond that counter, and whether an external monitor’s append-only view agrees with the TEE’s recorded accumulator. In Gyokuro, this is the mechanism that turns SPMT into SMA (Nakatsuka et al., 24 Mar 2026).

A common misunderstanding is to treat Gyokuro as a conventional inclusion-proof system implemented in a TEE. The paper’s claim is narrower and more specific: Gyokuro “reframes Source-assisted Private Membership Testing (SPMT) as proofs of sufficient progress toward inclusion, rather than conventional existence (inclusion) proofs.” That distinction is central because it is what allows the client’s query to be independent of the audited item and therefore not reveal client interest (Nakatsuka et al., 24 Mar 2026).

3. System model, roles, and protocol workflow

Gyokuro’s system model comprises a data source, a client, a malicious server or database operator, a TEE, and one or more monitoring services. The data source creates items $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$9, signs them, and sends them to the server-hosted TEE. The client later verifies privately whether $POR < POP$0 is in the database using the source-assisted information and proofs from the TEE and monitor. The server hosts the TEE and database but may drop, reorder, fork the database, or attempt to violate client privacy. The TEE runs Gyokuro’s trusted code, maintains $POR < POP$1 and $POR < POP$2, signs POR and POP, and supports remote attestation and secure state. Monitoring services are honest-but-curious; they download the entire database, compute $POR < POP$3, sign it for clients, and detect split-view and deletions (Nakatsuka et al., 24 Mar 2026).

The initialization phase sets up the trust anchor. The TEE generates $POR < POP$4, sets $POR < POP$5, initializes $POR < POP$6 and $POR < POP$7, and obtains an attestation report. Clients obtain the Attestation Public Key $POR < POP$8 and the expected measurement $POR < POP$9 (Nakatsuka et al., 24 Mar 2026).

During submission, the data source generates $T_{\mathrm{ret}}$0 and sends $T_{\mathrm{ret}}$1 to the TEE. The TEE verifies the source signature against trusted DS certificates, appends $T_{\mathrm{ret}}$2 to the buffer, and returns

$T_{\mathrm{ret}}$3

This POR is a proof-of-reception that binds the TEE identity, the item, and the counter value at reception time (Nakatsuka et al., 24 Mar 2026).

When the buffer is full, the TEE exports it to the database. It then updates the accumulator by hashing all items in the buffer,

$T_{\mathrm{ret}}$4

iteratively, waits for an ACK from the database, appends $T_{\mathrm{ret}}$5 to $T_{\mathrm{ret}}$6, and increments $T_{\mathrm{ret}}$7. Separately, the monitor periodically downloads the entire database, updates a hash-chain or Merkle accumulator $T_{\mathrm{ret}}$8 over all $T_{\mathrm{ret}}$9, and signs $T_{\mathrm{ext}}$0 (Nakatsuka et al., 24 Mar 2026).

The audit itself is intentionally independent of $T_{\mathrm{ext}}$1. The client verifies the attestation report and expected measurement, verifies the source token, obtains the monitor’s signed accumulator $T_{\mathrm{ext}}$2, and sends only $T_{\mathrm{ext}}$3 to the TEE. The TEE verifies the monitor signature, looks up $T_{\mathrm{ext}}$4 in $T_{\mathrm{ext}}$5, returns a signed POP containing the associated counter or $T_{\mathrm{ext}}$6 if the value is absent, and the client verifies POP and checks $T_{\mathrm{ext}}$7. No item hashes, indices, or filters are queried (Nakatsuka et al., 24 Mar 2026).

This workflow is the mechanism behind the paper’s privacy claim. The client never sends $T_{\mathrm{ext}}$8 to the TEE during audit, and the only message sent to the TEE is the monitor’s accumulator, which is independent of $T_{\mathrm{ext}}$9 and identical across clients (Nakatsuka et al., 24 Mar 2026).

4. Security properties, correctness, and append-only semantics

Gyokuro gives a membership privacy game in which the adversary $S$0 chooses $S$1, the challenger runs the membership test for $S$2 where $S$3 is uniform, and $S$4 outputs $S$5. Privacy is satisfied if no adversary can win better than random guessing:

$S$6

The paper’s justification is operational rather than purely abstract: the client never sends $S$7 or any function of $S$8 to the server or the TEE, and the only message the client sends is $S$9, which is independent of $X$0 (Nakatsuka et al., 24 Mar 2026).

Correctness is expressed informally as follows: if $X$1, then $X$2 at the monitor’s checkpoint. The underlying invariant is that when the TEE completes exporting a batch to the database, it updates $X$3 using all items in the batch, stores $X$4, and increments $X$5. Therefore, if the monitor’s $X$6 equals some past $X$7, the associated counter is POP; from $X$8 it follows that $X$9 was accepted and processed in a batch prior to POP (Nakatsuka et al., 24 Mar 2026).

Append-only semantics are enforced by external monitors rather than by the TEE alone. Monitoring services maintain and sign accumulators such as Merkle tree heads or hash chains over their full copy of the log, and clients check equality between the TEE’s and monitors’ accumulators to detect deletions. If the server removes data after the monitor’s update, monitors detect the mismatch by recomputing and comparing signed accumulators. If the server shows one view to clients and another to monitors, the equality check fails or the TEE cannot find $cnt$0 in $cnt$1 and returns $cnt$2, causing $cnt$3 to fail (Nakatsuka et al., 24 Mar 2026).

The trust model is explicit about what is and is not assumed. TEE execution integrity and secure state are trusted; TEEs provide remote attestation reports binding code measurements and generated keys. The host can delay packets, halt TEEs, and learn memory access patterns; DoS is out of scope. Rollback resistance, state continuity, and fork detection are assumed available in the TEE platform. Cryptographic code follows constant-time coding so keys used for signatures do not leak, but non-cryptographic code may leak processed data. Gyokuro’s privacy design mitigates this specific risk because the client never sends $cnt$4 to the TEE (Nakatsuka et al., 24 Mar 2026).

This trust decomposition clarifies another common misconception. SMA, in the Gyokuro sense, does not eliminate trust assumptions; it relocates them. Heavy cryptographic per-query protection is avoided, but the resulting audit depends on TEE integrity, attestation, rollback or fork protection, and monitor correctness (Nakatsuka et al., 24 Mar 2026).

5. Efficiency, implementation, and operational constraints

Gyokuro’s complexity claims are asymptotic and empirical. Communication per query is $cnt$5 because membership testing exchanges a constant number of signed messages independent of database size $cnt$6. Computation per query is also $cnt$7 because the client verifies a constant number of signatures and compares counters, while the TEE verifies a signature and performs a constant-time hashtable lookup in $cnt$8. The paper states formally that both online computation and communication are $cnt$9 (Nakatsuka et al., 24 Mar 2026).

The implementation evaluated in the paper uses Azure Cloud, AMD SEV-SNP on DC16ads v5 for the TEE, D32ads v6 for client and data source, D8ads v6 for the database, Ubuntu 24.04, Azure Attestation Service for remote attestation, ECDSA over secp256r1, SHA-256, and SQLite3 in-memory. In the Certificate Transparency case study, the dataset contains 3.3 million certificates (Nakatsuka et al., 24 Mar 2026).

The reported latency for upload, including data submission and processing, is approximately $d'$0 ms at high concurrency. Membership testing plus consistency checking is approximately $d'$1 ms and includes attestation verification and signature checks. Server-side POP signing and verification is approximately $d'$2 ms, attestation verification approximately $d'$3 ms, and network sockets approximately $d'$4 ms. Upload throughput is approximately $d'$5 requests/sec/core, corresponding to about $d'$6 submissions/sec on a $d'$7-core server with $d'$8 concurrent clients. Membership testing throughput is approximately $d'$9 requests/sec/core, corresponding to about $POR < POP$0 POP requests/sec under the same server and concurrency configuration (Nakatsuka et al., 24 Mar 2026).

The design uses buffering, asynchronous processing to the database, and a hashtable representation of hash-chain history for $POR < POP$1 lookup. Monitoring lag is handled by storing a bounded history of $POR < POP$2 tuples. The stated bound is

$POR < POP$3

where $POR < POP$4 is the TEE’s reception frequency and $POR < POP$5 is the slowest monitor’s update frequency (Nakatsuka et al., 24 Mar 2026).

The application domains named in the paper are Certificate Transparency, supply-chain auditing, and content provenance or public document auditing. In the Certificate Transparency example, clients verify that a certificate is logged without sending it to the log and use the certificate’s POR together with monitor accumulators. In supply-chain auditing, QR codes carry POR and regulators act as monitors. In content provenance and public document auditing, journalistic photos or government documents can be audited privately for public logging and append-only guarantees (Nakatsuka et al., 24 Mar 2026).

Operational limits are equally explicit. The design relies on TEEs, so vulnerabilities such as side channels and microcode issues affect trust. Rollback or fork protection and state continuity are assumed but are not universally available. Monitors must protect signing keys and run faithfully. Enclave memory constraints require bounded history rather than unbounded state. Server stalling or DoS is out of scope, and a malicious server can refuse POP responses or halt the TEE, in which case clients do not obtain $POR < POP$6 (Nakatsuka et al., 24 Mar 2026).

6. Related formulations in retrieval auditing and causal memorization analysis

ImageAuditor extends the source-aware audit idea to image-based Retrieval-Augmented Generation (IRAG). It models an IRAG system as $POR < POP$7, where $POR < POP$8 indexes an external image database $POR < POP$9 using an embedding model $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$00, and $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$01 is a frozen generator for either text-to-image or question answering. The auditing objective is to determine whether a target image $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$02 belongs to $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$03. The attack decomposes each query into a retrieval segment $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$04 and an extraction segment $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$05. The retrieval segment is optimized to increase the probability that the target image is among retrieved references when it is a member, and the extraction segment is designed to elicit outputs whose distribution separates members from non-members (Zhang et al., 2 Jun 2026).

The paper formalizes this with a score $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$06, aggregates scores across queries with K-means clustering for reliable membership decisions, and derives task-specific instantiations for text-to-image and question answering. For retrieval, it introduces Reward-Guided Policy Optimization (RGPO), which updates a stochastic policy from reward-ranked candidates and is stated to admit finite-sample optimality guarantees under a local additive surrogate. Empirically, across various IRAG systems, ImageAuditor exceeds $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$07 AUROC with only four queries per audited image and remains robust across diverse settings (Zhang et al., 2 Jun 2026).

This IRAG formulation differs sharply from Gyokuro’s. Gyokuro produces a privacy-preserving audit in which the client query is independent of the target item. ImageAuditor is a black-box membership inference attack that deliberately engineers queries to induce discriminative behavior from the target system. The output is therefore statistical evidence rather than the protocol-level inclusion conclusion used in Gyokuro. The paper itself recommends treating outputs as statistical evidence, not definitive proof (Zhang et al., 2 Jun 2026).

The causal MIA framework uses “source-aware” in yet another sense. It defines each record as a unit with covariates $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$08, source label $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$09, membership assignment $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$10, and potential outcomes $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$11. Memorization is defined as the causal effect of inclusion in training:

$\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$12

The framework then introduces source-specific effects, including

$\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$13

and shows how to estimate them by stratification in randomized regimes or by propensity-based IPW and doubly robust AIPW in zero-run settings where membership assignment is confounded by source (Even et al., 2 Feb 2026).

This causal source-aware extension is motivated by the fact that zero-run evaluations popular for LLMs often compare members and non-members from different sources or time periods, so raw score differences do not have a causal interpretation. The framework therefore requires overlap, treats source as part of $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$14, and recommends reporting source-specific causal ROC, causal AUC, and TPR@FPR $\tau_s = \mathbb{E}[Y(1) - Y(0)\mid S=s],$15 rather than only classical MIA metrics (Even et al., 2 Feb 2026).

Taken together, these works show that SMA spans at least three distinct technical regimes. In trusted database auditing, it denotes source-assisted, privacy-preserving, append-only-aware membership testing. In black-box retrieval auditing, it denotes source-targeted query design for statistical membership inference. In causal privacy evaluation, it denotes source-conditioned identification and estimation of memorization effects. The shared structure is the use of source information to refine what membership means and how membership evidence should be interpreted, but the trust assumptions, outputs, and guarantees differ substantially across these regimes (Nakatsuka et al., 24 Mar 2026).