{"id":"bd3406b8-f3d5-43ef-adde-14dac14aa95a","arxiv_id":"2504.13416","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"STAMP detects dataset membership in LLMs by comparing model perplexity on a publicly released watermarked rephrasing against private watermarked rephrasings of the same documents.","lead":"STAMP lets content creators detect whether their data was used to train a large language model by comparing two watermarked rephrasings of the same text. The method works even when the dataset is a tiny fraction of training data, and it preserves the usefulness and meaning of the original content.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Key-reuse confound: a model trained on enough same-key watermarked text can prefer that key on unseen documents, so STAMP's 'must have seen' inference is not logically secure.","rationale":"The reader's weakest assumption (no retroactive watermarking) limits scope but does not threaten the validity of the inference when the protocol is followed. The key-reuse confound directly attacks the causal claim: the test compares perplexity of public vs private versions, but the public version is characterized by two things—its exact text and its watermark key. Training on other text with the same key can imprint the latter. Because the paper's Section 5 deliberately reuses a single public key across datasets, this is not a strawman. The existing false-positive result (p=0.07 for abstracts) is suggestive but underpowered; a scaling test would settle it. This concern does not overturn the paper's empirical contributions; STAMP may still work with unique per-dataset keys or limited reuse. Hence the CONDITIONAL verdict stands, with the condition sharpened to include key-reuse calibration.","tokens_in":24969,"tokens_out":9142,"duration_ms":84294,"concrete_test":"Re-run the controlled contamination experiment with a single public key reused across N disjoint document sets. Train a Pythia-1B model (continual pretraining) on 10,000 documents watermarked with key K. Then apply STAMP to a held-out set of documents watermarked with K versus private keys, holding benchmark size, corpus size, and all other protocol details fixed. Record the paired t-test p-value. Repeat for N ∈ {1, 100, 1,000, 10,000, 100,000} same-key training documents. If the held-out p-value falls below 0.05 for any realistic N, the false-positive confound is real and the central 'must have seen' claim fails for key-reuse protocols; the paper should then either require a fresh public key per dataset or provide a quantitative bound on key reuse.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central inference (§3) is that a systematic perplexity preference for the public key over private keys can only arise from the model having been trained on those exact public documents. The statistical test (§3.2) inherits this claim from exchangeability of the key assignment under the null. However, the watermark is a deterministic function of the key and context (KGW, §2.2): all documents watermarked with the same public key share a systematic statistical pattern. If the target model has been exposed to any sufficiently large body of text watermarked with that key, it can learn the key-specific green-list distribution and assign lower perplexity to previously unseen documents watermarked with the same key. The paper's own false-positive test in Table 2 (Pythia Contaminated) hints at this: held-out abstracts watermarked with the same public key yield p=0.07, approaching significance after training on only ~1,000 same-key abstracts. Section 5 explicitly reuses one public key across both paper abstracts and blog posts, so key reuse is an endorsed use case. Consequently, the claim 'must have seen the preferred documents' is not entailed by the design; it is an empirical regularity that may break as same-key exposure scales. The paper offers no analysis of how much same-key training text can be tolerated before false positives dominate.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes STAMP, a framework for dataset membership detection in LLMs. A content creator first generates several rephrasings of each document, each watermarked with the KGW scheme under a distinct secret key; the version released publicly uses a 'public' key while the others are kept private. Membership is tested with a one-sided paired t-test on per-document perplexity differences between the public rephrasing and the average of private rephrasings. Experiments continually pretrain Pythia-1B on OpenWebText plus watermarked versions of TriviaQA, ARC-C, MMLU, GSM8K, EMNLP abstracts, and AI Snake Oil blogs, with each benchmark making up less than 0.001% of tokens and appearing once. The paper reports significant p-values (10^-4 to 10^-12), shows improvements over PaCoST, LLM DI, and MIAs, reports false-positive analyses on off-the-shelf models and on same-key held-out subsets, and includes utility and semantic-preservation evaluations.","tokens_in":25231,"tokens_out":6419,"duration_ms":61674,"significance":"If validated, STAMP would be a practically useful tool for content owners and benchmark curators, and the controlled evidence of detection at very low contamination rates is a meaningful empirical advance. Strengths include the release of code, data, and models; the comparison with the concurrent radioactivity approach in Appendix H; the explicit false-positive tests; and the human evaluation of abstract rephrasings. However, because the central 'must have seen' inference is threatened by the key-reuse confound and the statistical preprocessing is under-specified, the current evidence supports a weaker claim: STAMP detects exposure to text watermarked with a given key in the evaluated continual-pretraining setting.","major_comments":[{"comment":"The central inference is stated as: if the model consistently prefers public-key documents over private-key documents, it 'must have seen the preferred documents during pretraining' (§3). This is not entailed by the design. The KGW watermark is a deterministic function of the hash key and context (§2.2), so after exposure to sufficiently many documents watermarked with the same public key, a model can learn the key-specific green-list statistics and assign lower perplexity to unseen documents watermarked with that key. The manuscript's own stronger false-positive test in Table 2 is consistent with this mechanism: after training on watermarked EMNLP abstracts, held-out abstracts watermarked with the same public key yield p=0.07, which is close to the 0.05 threshold. Section 5 explicitly endorses reusing one public key across paper abstracts and blog posts, so same-key exposure is an endorsed use case rather than an edge case. The paper should analyze how much same-key training text can be present before the false-positive rate exceeds the claimed level, either avoid key reuse across datasets or account for it in the null hypothesis, and weaken the 'must have seen' wording unless that analysis shows the inference is safe.","section":"§3 (key insight), §3.2, Table 2, §5"},{"comment":"The top-5% outlier clipping applied before the paired t-test is not specified precisely and appears to be post hoc. The paper does not state whether the clipped 5% is defined by absolute difference, by the most negative differences, by the most positive differences, or by some other rule, nor does it report how the reported p-values vary under reasonable alternative clipping thresholds. Because the same data were used to select this preprocessing, the p-values in Tables 1, 2, 5, and 11 cannot be treated as confirmatory. Please provide the exact algorithm, justify the choice independently of the evaluation data, and include a sensitivity analysis over clipping fractions (for example, 0% to 10%).","section":"§3.2, Eq. (3)"},{"comment":"All detection experiments use continual pretraining of Pythia-1B on a deliberately contaminated OpenWebText corpus, not training from scratch. The authors acknowledge this in §7, but the abstract and introduction frame STAMP as detecting membership in 'pretraining corpora' generally. Since memorization and contamination behavior can differ substantially between continual pretraining and full pretraining, the paper should either add experiments with models trained from scratch (even at reduced scale) or explicitly limit the contribution to continual-pretraining and fine-tuning settings.","section":"§4.2 and §7"}],"minor_comments":[{"comment":"The summation notation in the definition of the average private perplexity is malformed in the typeset version ('j=mX j=1'), which makes the equation hard to read.","section":"Eq. (4)"},{"comment":"The number of private keys m and the watermark parameters (δ=1.0, k=1) used in the main experiments are not stated in the main text; please report them alongside Table 1.","section":"§4.2 and Appendix F"},{"comment":"The row 'STAMP (w/o paired tests)' is unclear: it presumably uses a two-sample rather than a paired test, but this should be stated explicitly.","section":"Table 1"},{"comment":"The word 'Proving' overstates the guarantees established by the experiments, especially in light of the key-reuse concern; consider 'Detecting' or 'Evidence of' unless the inference is tightened.","section":"Title and Abstract"}],"recommendation":"major_revision","confidential_remarks":"The paper is a solid empirical contribution with a useful code and data release, and it fits the scope of the venue. My main concern for the editor is that the title and the key-insight paragraph make a proof claim that the experiments do not fully support; the key-reuse confound and the post hoc clipping rule need to be addressed before acceptance. I would not reject the paper on these grounds, as both issues are addressable within the manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the paired watermarked-rephrasing idea is a real step forward: comparing two LLM-generated copies that differ only in watermark key controls for the model's preference for machine text, which is exactly the confounder that sinks PaCoST. The empirical results are genuinely impressive: significant p-values with each benchmark appearing once and under 0.001% of the corpus. Second, the central inference is stated too strongly. Section 3 says a systematic preference for the public key entails that the model saw those documents, but the design only entails exposure to text watermarked with that key. Your stress-test note is right: the KGW green-list pattern is a deterministic function of key and context, so enough same-key training text can produce a preference on unseen documents. The paper's own Table 2 hints at this: held-out abstracts watermarked with the same public key give p=0.07 after training on only ~1,000 other abstracts with that key. That is one bad draw away from a false positive. Section 5 endorses key reuse by using the same public key for abstracts and blogs, so the confound is not an edge case. The limitations section acknowledges retroactive inapplicability, gray-box access, and continual pretraining, but it never mentions the key-reuse issue, which is a more serious threat to the test's validity.\n\nWhat the paper does well: the false-positive analysis is the right check, and most values are comforting. The utility preservation work with P-SP and model rankings is careful. The comparison with Sander et al.'s radioactivity method is useful. Code, data, and models are released. The bag-of-words experiment in Table 9 makes the case against PaCoST cleanly.\n\nWhere it is soft, beyond the confound: the top-5% outlier clipping is post hoc and not pre-specified; an adversary or an optimist could tune it. Continual pretraining on Pythia 1B is acknowledged, but it does limit transfer to the from-scratch setting. The title and abstract say 'prove membership', which overclaims for a statistical test with assumptions that can be violated by key reuse.\n\nNet: the core method is solid and the experiments are the strongest part. The key-reuse confound does not destroy the contribution; it means the paper should be framed as a test for exposure to a watermark key, with a recommendation that creators use unique keys and with a scaling analysis of how much same-key exposure is tolerable. I would send this to a serious referee. If I were reviewing, I would ask for a toned-down title, a pre-registered or justified clipping rule, and an adversarial analysis of the key-reuse scenario before accepting. This is exactly the kind of paper that benefits from a careful referee who can push on the gap between the statistical test and the 'proving' language.","headline":"The paired watermarked-rephrasing idea is genuinely useful, but the 'must have seen' claim is stronger than the design supports—the paper's own Table 2 shows the key-reuse confound is close to biting.","tokens_in":25761,"tokens_out":5606,"would_cite":true,"duration_ms":51428,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"STAMP claims that content creators can prove a dataset entered an LLM's pretraining corpus by publishing one keyed watermarked rephrasing, keeping other rephrasings private, and showing that the model consistently prefers the public…","keywords":["dataset membership","test-set contamination","LLM watermarking","paired statistical test","pretraining data auditing","perplexity","rephrased benchmarks","KGW watermark"],"falsifier":"Apply STAMP's paired test to a model whose training corpus is fully documented and certified to exclude the public watermarked rephrasings; if significant p-values (below 0.05) appear systematically across many random key choices, the null hypothesis that keys induce no preference is wrong.","tokens_in":24754,"feed_emoji":"🔍","tokens_out":6810,"duration_ms":59739,"temperature":0.7,"pith_summary":"STAMP is a statistical framework for proving that a dataset was included in an LLM's pretraining data, aimed at content owners and benchmark curators. Before releasing content, the creator generates several rephrasings of it, each carrying an invisible watermark tied to a secret key: one public version is published, the rest stay private. If a target model assigns systematically lower perplexity to the public version than to the private equivalents, a one-sided paired t-test declares membership. In controlled 6.7B-token corpora where each benchmark appears once and makes up less than 0.001% of tokens, the test reaches p-values between $10^{-6}$ and $10^{-4}$ and also detects paper abstracts and blog articles in real-world settings. The practical cost is that the content must be watermarked before it is ever released online.","feed_headline":"A watermark proves your data trained the LLM","feed_subtitle":"Paired public/private rephrasings make membership detectable even at 0.001% of pretraining tokens.","key_machinery":"The load-bearing object is the KGW watermarking scheme: a hash function keyed by the preceding token partitions the vocabulary into 'green' and 'red' lists, and the rephrasing LLM adds a positive bias $\\delta$ to green-list logits during generation. Two rephrases of the same document that use different secret keys therefore carry different, algorithmically detectable token-level biases while remaining semantically equivalent. The detection mechanism is a one-sided paired t-test on per-document differences $d_i = \\mathrm{PPL}(\\text{public}) - \\frac{1}{m}\\sum_j \\mathrm{PPL}(\\text{private}_j)$, where perplexity comes from the target model. Clipping the top 5% of outlier differences and averaging over $m$ private versions (about 5 suffices) stabilizes the statistic, and random key selection turns any systematic preference for the public key into evidence of training exposure.","core_discovery":"The paper's central claim is that key-selected watermarking turns dataset membership into a testable probabilistic statement: under the null hypothesis of no training exposure, a model cannot systematically prefer texts watermarked with one particular key over semantically equivalent rephrasings watermarked with other keys, because the keys are drawn at random. Under the alternative, exposure to the public version during pretraining lowers its perplexity relative to unseen private versions, making the mean paired difference negative. The authors validate this by continually pretraining Pythia 1B on OpenWebText plus four benchmarks injected once each, finding statistically significant p-values (between $6.6 \\times 10^{-6}$ and $1.2 \\times 10^{-4}$), no false positives on uncontaminated models or held-out subsets, and gains of several orders of magnitude over paired rephrasing without watermarks. They further show that watermarked test sets preserve benchmark utility, with model scores and relative rankings remaining close to the original benchmarks.","pith_inferences":["A natural extension is to apply STAMP to code, speech, and images, wherever one can generate keyed semantic equivalents and score model preference; the paper lists these as future work, and the same paired-test logic transfers.","If model developers respond to STAMP by filtering or rewriting watermarked content during data curation, that reaction itself reveals awareness and could be monitored by re-running the test on updated model versions.","The before-release constraint suggests that the realistic adoption path is a publication-time watermarking service, not retroactive auditing of already-crawled content.","The paper does not test a determined adversary who knows the public key and deliberately paraphrases the public version before training; robustness to such watermark-stripping remains an open question."],"forward_implications":["Benchmark curators can publish watermarked test sets and later audit any model with statistical evidence of contamination, even when leaked examples appear only once in pretraining.","Content creators can apply STAMP to newsletters, blogs, or abstracts before release and obtain p-values around $10^{-3}$ to $10^{-12}$ when their content is used without license.","The method raises the bar for supervised detection: per-example membership inference attacks stay near chance (AUROC $\\approx 0.5$), while the paired dataset-level test succeeds.","Watermarked benchmarks remain usable for evaluation: LLM performance and relative rankings stay close to original benchmarks, unlike unicode-substitution watermarks that cause drops of up to 20%."],"supporting_citations":[{"why":"Supplies the KGW watermarking scheme whose green-list bias embeds the keyed signal into public and private rephrasings.","marker":"Kirchenbauer et al., 2024"},{"why":"Provides the paired t-test statistic on which the membership detection procedure is built.","marker":"Student, 1908"},{"why":"PaCoST is the closest rephrasing-based contamination baseline, whose null assumption of identical human/rephrased distributions STAMP identifies and corrects.","marker":"Zhang et al., 2024a"},{"why":"LLM dataset inference baseline requiring an unseen validation set; STAMP outperforms it without that requirement.","marker":"Maini et al., 2024"},{"why":"Supplies the Pythia 1B model used in the continually pretrained, deliberately contaminated corpora.","marker":"Biderman et al., 2023"},{"why":"Prior data-watermark membership test based on random sequences or unicode substitutions, whose utility loss STAMP is designed to avoid.","marker":"Wei et al., 2024"}],"fun_headline_variants":["STAMP: Watermarked rephrasings prove LLM data inclusion","Secret watermarks expose LLM training data membership","Watermark trick reveals if your text trained the model","STAMP: Tiny token share, provable contamination test","Keyed rephrasings make dataset membership statistically provable"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The content must be watermarked before it is released online, so STAMP cannot be applied to already-published datasets that have already been crawled into pretraining corpora.","fun_headline_variants_meta":{"raw":{"variants":["STAMP: Watermarked rephrasings prove LLM data inclusion","Secret watermarks expose LLM training data membership","Watermark trick reveals if your text trained the model","STAMP: Tiny token share, provable contamination test","Keyed rephrasings make dataset membership statistically provable"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000264,"raw_usage":{"total_tokens":1611,"prompt_tokens":958,"completion_tokens":653,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":574,"completion_tokens_details":{"reasoning_tokens":571}},"tokens_in":574,"tokens_out":653,"duration_ms":5873,"temperature":1.0,"reasoning_tokens":571,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T12:08:25.232183+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Apply STAMP's paired test to a model whose training corpus is fully documented and certified to exclude the public watermarked rephrasings; if significant p-values (below 0.05) appear systematically across many random key choices, the null hypothesis that keys induce no preference is wrong.","supporting_citations":[{"cited_title":"On the reliability of watermarks for large language models","cited_arxiv_id":null,"evidence_quote":"Supplies the KGW watermarking scheme whose green-list bias embeds the keyed signal into public and private rephrasings."},{"cited_title":"The probable error of a mean","cited_arxiv_id":null,"evidence_quote":"Provides the paired t-test statistic on which the membership detection procedure is built."},{"cited_title":"LLM dataset inference: Did you train on my dataset? In Globersons, A., Mackey, L., Belgrave, D., Fan, A., Paquet, U., Tomczak, J","cited_arxiv_id":null,"evidence_quote":"LLM dataset inference baseline requiring an unseen validation set; STAMP outperforms it without that requirement."},{"cited_title":"G., Bradley, H., O'Brien, K., Hallahan, E., Khan, M","cited_arxiv_id":null,"evidence_quote":"Supplies the Pythia 1B model used in the continually pretrained, deliberately contaminated corpora."}],"review_version":1}