M4I: Multi-modalModels Membership Inference

ROUGE-N scores are the overlapping of n-grams [2] between the generated and referencesequence. Those scores are then averaged overthe whole corpus toreach anoverall quality. For both proposed MMMMI attack methods, shadow models are indispensable. The first hidden layer in the attack model has 256 units and the second hidden layer has20units, bothactivatedbyReLU function. We used resnet-LSTM architecture as the target model architecture.