OCDR: Overlap-Aware Counterfactual Dual-Representation Scoring for Membership Inference in Retrieval-Augmented Generation

Retrieval-augmented generation (RAG) systems can leak whether a target sample is present in the external knowledge base. Existing membership-inference attacks can achieve useful ranking performance while still producing substantially overlapping member and non-member score distributions, leaving an ambiguous decision region. We study whether counterfactual reference evidence can be represented to improve score separability while retaining competitive attack utility. We propose OCDR (Overlap-Aware Counterfactual Dual-Representation), which represents each target using two complementary Out-RAG statistics: the raw deviation from the Out-RAG mean and its variance-normalized counterpart. The two features are standardized on development data, expanded with second-order interactions, and combined using an L2-regularized logistic scorer. On HealthCareMagic with Mistral-7B-Instruct-v0.2, OCDR achieves an AUC of 0.6614 and TPR@5%FPR of 0.260, compared with 0.6270 and 0.175 for DC-MIA. It also reduces KDE overlap from 0.9324 to 0.7743 and 80-bin histogram overlap from 0.895 to 0.570. Additional experiments across generator backbones and datasets further show that ranking performance, low-FPR detection, and score- distribution overlap capture complementary aspects of membership-inference be- havior. These results suggest that explicitly modeling and evaluating member/non-member score overlap provides a useful complementary perspective for membership infer- ence in RAG systems.