Pith. sign in

REVIEW 3 major objections 4 minor 57 references

STAMP Your Content: Proving Dataset Membership via Watermarked Rephrasings

T0 review · 3 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read STAMP claims that content creators can prove a dataset entered an LLM's pretraining corpus by publishing one keyed watermarked rephrasing, keeping other rephrasings private, and showing that the model consistently prefers the public…

desk verdict The paired watermarked-rephrasing idea is genuinely useful, but the 'must have seen' claim is stronger than the design supports—the paper's own Table 2 shows the key-reuse confound is close to biting. read the letter →

arxiv 2504.13416 v2 pith:2A6AYV4W submitted 2025-04-18 cs.LG cs.CLcs.CR

Saksham Rastogi , Pratyush Maini , Danish Pruthi This is my paper · ORCID
classification cs.LGcs.CLcs.CR
keywords datasetmembershiptest-setcontaminationLLMwatermarkingpairedstatisticaltestpretrainingdataauditingperplexityrephrasedbenchmarksKGWwatermark
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

STAMP is a statistical framework for proving that a dataset was included in an LLM's pretraining data, aimed at content owners and benchmark curators. Before releasing content, the creator generates several rephrasings of it, each carrying an invisible watermark tied to a secret key: one public version is published, the rest stay private. If a target model assigns systematically lower perplexity to the public version than to the private equivalents, a one-sided paired t-test declares membership. In controlled 6.7B-token corpora where each benchmark appears once and makes up less than 0.001% of tokens, the test reaches p-values between $10^{-6}$ and $10^{-4}$ and also detects paper abstracts and blog articles in real-world settings. The practical cost is that the content must be watermarked before it is ever released online.

What carries the argument

The load-bearing object is the KGW watermarking scheme: a hash function keyed by the preceding token partitions the vocabulary into 'green' and 'red' lists, and the rephrasing LLM adds a positive bias $\delta$ to green-list logits during generation. Two rephrases of the same document that use different secret keys therefore carry different, algorithmically detectable token-level biases while remaining semantically equivalent. The detection mechanism is a one-sided paired t-test on per-document differences $d_i = \mathrm{PPL}(\text{public}) - \frac{1}{m}\sum_j \mathrm{PPL}(\text{private}_j)$, where perplexity comes from the target model. Clipping the top 5% of outlier differences and averaging over $m$ private versions (about 5 suffices) stabilizes the statistic, and random key selection turns any systematic preference for the public key into evidence of training exposure.

What would settle it

Apply STAMP's paired test to a model whose training corpus is fully documented and certified to exclude the public watermarked rephrasings; if significant p-values (below 0.05) appear systematically across many random key choices, the null hypothesis that keys induce no preference is wrong.

Watch

Extended reading notes

Core claim

The paper's central claim is that key-selected watermarking turns dataset membership into a testable probabilistic statement: under the null hypothesis of no training exposure, a model cannot systematically prefer texts watermarked with one particular key over semantically equivalent rephrasings watermarked with other keys, because the keys are drawn at random. Under the alternative, exposure to the public version during pretraining lowers its perplexity relative to unseen private versions, making the mean paired difference negative. The authors validate this by continually pretraining Pythia 1B on OpenWebText plus four benchmarks injected once each, finding statistically significant p-values (between $6.6 \times 10^{-6}$ and $1.2 \times 10^{-4}$), no false positives on uncontaminated models or held-out subsets, and gains of several orders of magnitude over paired rephrasing without watermarks. They further show that watermarked test sets preserve benchmark utility, with model scores and relative rankings remaining close to the original benchmarks.

Load-bearing premise

The content must be watermarked before it is released online, so STAMP cannot be applied to already-published datasets that have already been crawled into pretraining corpora.

Editorial extensions

If this is right

  • Benchmark curators can publish watermarked test sets and later audit any model with statistical evidence of contamination, even when leaked examples appear only once in pretraining.
  • Content creators can apply STAMP to newsletters, blogs, or abstracts before release and obtain p-values around $10^{-3}$ to $10^{-12}$ when their content is used without license.
  • The method raises the bar for supervised detection: per-example membership inference attacks stay near chance (AUROC $\approx 0.5$), while the paired dataset-level test succeeds.
  • Watermarked benchmarks remain usable for evaluation: LLM performance and relative rankings stay close to original benchmarks, unlike unicode-substitution watermarks that cause drops of up to 20%.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to apply STAMP to code, speech, and images, wherever one can generate keyed semantic equivalents and score model preference; the paper lists these as future work, and the same paired-test logic transfers.
  • If model developers respond to STAMP by filtering or rewriting watermarked content during data curation, that reaction itself reveals awareness and could be monitored by re-running the test on updated model versions.
  • The before-release constraint suggests that the realistic adoption path is a publication-time watermarking service, not retroactive auditing of already-crawled content.
  • The paper does not test a determined adversary who knows the public key and deliberately paraphrases the public version before training; robustness to such watermark-stripping remains an open question.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes STAMP, a framework for dataset membership detection in LLMs. A content creator first generates several rephrasings of each document, each watermarked with the KGW scheme under a distinct secret key; the version released publicly uses a 'public' key while the others are kept private. Membership is tested with a one-sided paired t-test on per-document perplexity differences between the public rephrasing and the average of private rephrasings. Experiments continually pretrain Pythia-1B on OpenWebText plus watermarked versions of TriviaQA, ARC-C, MMLU, GSM8K, EMNLP abstracts, and AI Snake Oil blogs, with each benchmark making up less than 0.001% of tokens and appearing once. The paper reports significant p-values (10^-4 to 10^-12), shows improvements over PaCoST, LLM DI, and MIAs, reports false-positive analyses on off-the-shelf models and on same-key held-out subsets, and includes utility and semantic-preservation evaluations.

Significance. If validated, STAMP would be a practically useful tool for content owners and benchmark curators, and the controlled evidence of detection at very low contamination rates is a meaningful empirical advance. Strengths include the release of code, data, and models; the comparison with the concurrent radioactivity approach in Appendix H; the explicit false-positive tests; and the human evaluation of abstract rephrasings. However, because the central 'must have seen' inference is threatened by the key-reuse confound and the statistical preprocessing is under-specified, the current evidence supports a weaker claim: STAMP detects exposure to text watermarked with a given key in the evaluated continual-pretraining setting.

major comments (3)
  1. [§3 (key insight), §3.2, Table 2, §5] The central inference is stated as: if the model consistently prefers public-key documents over private-key documents, it 'must have seen the preferred documents during pretraining' (§3). This is not entailed by the design. The KGW watermark is a deterministic function of the hash key and context (§2.2), so after exposure to sufficiently many documents watermarked with the same public key, a model can learn the key-specific green-list statistics and assign lower perplexity to unseen documents watermarked with that key. The manuscript's own stronger false-positive test in Table 2 is consistent with this mechanism: after training on watermarked EMNLP abstracts, held-out abstracts watermarked with the same public key yield p=0.07, which is close to the 0.05 threshold. Section 5 explicitly endorses reusing one public key across paper abstracts and blog posts, so same-key exposure is an endorsed use case rather than an edge case. The paper should analyze how much same-key training text can be present before the false-positive rate exceeds the claimed level, either avoid key reuse across datasets or account for it in the null hypothesis, and weaken the 'must have seen' wording unless that analysis shows the inference is safe.
  2. [§3.2, Eq. (3)] The top-5% outlier clipping applied before the paired t-test is not specified precisely and appears to be post hoc. The paper does not state whether the clipped 5% is defined by absolute difference, by the most negative differences, by the most positive differences, or by some other rule, nor does it report how the reported p-values vary under reasonable alternative clipping thresholds. Because the same data were used to select this preprocessing, the p-values in Tables 1, 2, 5, and 11 cannot be treated as confirmatory. Please provide the exact algorithm, justify the choice independently of the evaluation data, and include a sensitivity analysis over clipping fractions (for example, 0% to 10%).
  3. [§4.2 and §7] All detection experiments use continual pretraining of Pythia-1B on a deliberately contaminated OpenWebText corpus, not training from scratch. The authors acknowledge this in §7, but the abstract and introduction frame STAMP as detecting membership in 'pretraining corpora' generally. Since memorization and contamination behavior can differ substantially between continual pretraining and full pretraining, the paper should either add experiments with models trained from scratch (even at reduced scale) or explicitly limit the contribution to continual-pretraining and fine-tuning settings.
minor comments (4)
  1. [Eq. (4)] The summation notation in the definition of the average private perplexity is malformed in the typeset version ('j=mX j=1'), which makes the equation hard to read.
  2. [§4.2 and Appendix F] The number of private keys m and the watermark parameters (δ=1.0, k=1) used in the main experiments are not stated in the main text; please report them alongside Table 1.
  3. [Table 1] The row 'STAMP (w/o paired tests)' is unclear: it presumably uses a two-sample rather than a paired test, but this should be stated explicitly.
  4. [Title and Abstract] The word 'Proving' overstates the guarantees established by the experiments, especially in light of the key-reuse concern; consider 'Detecting' or 'Evidence of' unless the inference is tightened.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: STAMP is an empirical hypothesis test whose central inference is an explicit null-model assumption, not a conclusion derived from its own inputs.

full rationale

STAMP is an empirical hypothesis-testing framework rather than a derivation, so the main circularity templates do not apply. The load-bearing assertion in Section 3 — that a consistent perplexity preference for the public-key rephrase over private-key rephrases indicates pretraining exposure — is an assumed null-model behavior and causal hypothesis, not a conclusion obtained by rewriting the definitions of membership or watermarking. The test statistic (Eqs. 2-4) is computed directly from model perplexities; no fitted parameter is later renamed as a prediction, and the paper does not derive its p-values from the assumption that the public document was seen. The paper also reports false-positive checks on uncontaminated off-the-shelf models and on held-out subsets that were not trained on, providing independent evidence that the reported p-values are not forced by construction. The KGW watermarking scheme is an external, cited mechanism, not a self-citation, and the self-citations that appear (Maini et al. 2021/2024) are used for problem framing and baseline comparisons rather than as the evidence for the central claim. Potential concerns such as same-key exposure confounds and hyperparameter selection are statistical validity issues, not circularity by construction, and per the review rules they are not scored as circularity unless a specific equation or fitted parameter is shown to reduce to the conclusion.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method repurposes existing KGW watermarks and introduces no new entities. The main free parameters are the watermarking hyperparameters inherited from KGW and the method-specific choices of clipping threshold and number of private keys. The axioms are standard statistics assumptions and domain assumptions about the null hypothesis and the representativeness of continual pretraining.

free parameters (4)
  • Outlier clipping threshold = 5%
    Top 5% of perplexity differences are clipped before computing the t-statistic; the threshold is chosen post hoc and not theoretically justified.
  • Number of private keys (m) = 5 based on Figure 2b
    The paper uses m private rephrasings per document; sensitivity analysis shows diminishing returns beyond m=5, suggesting m=5 is used for main results.
  • KGW watermark strength delta = 1.0
    Standard choice from KGW watermarking; not fitted to the detection task.
  • KGW context window k = 1
    Standard choice from KGW watermarking.
assumptions (4)
  • standard math The paired t-test is valid for the perplexity difference distribution after clipping.
    Assumes approximate normality or CLT for n~1000; clipping changes the distribution but the test is applied as if standard.
  • domain assumption Under the null hypothesis, models have no systematic preference between public and private rephrases watermarked with different random keys.
    Empirically validated on off-the-shelf models, but this is a key assumption for the test's validity.
  • domain assumption The watermarking of rephrased documents does not alter the token distribution of the internet data.
    The paper claims this because different documents use different keys, but it is asserted rather than proved.
  • ad hoc to paper Continual pretraining on a 1B model is representative of training from scratch on larger corpora.
    The paper acknowledges this limitation and uses it as a computational approximation; detection may be easier in continual pretraining.

how reviews work

0 comments
Cite this review

Pith. "Pith review of STAMP Your Content: Proving Dataset Membership via Watermarked Rephrasings." pith.science (2026). https://pith.science/paper/2A6AYV4W

@misc{pith2026250413416,
  author       = {Pith},
  title        = {Pith review of: STAMP Your Content: Proving Dataset Membership via Watermarked Rephrasings},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2A6AYV4W}},
  note         = {Machine review of arXiv:2504.13416}
}
read the original abstract

Given how large parts of publicly available text are crawled to pretrain large language models (LLMs), data creators increasingly worry about the inclusion of their proprietary data for model training without attribution or licensing. Their concerns are also shared by benchmark curators whose test-sets might be compromised. In this paper, we present STAMP, a framework for detecting dataset membership-i.e., determining the inclusion of a dataset in the pretraining corpora of LLMs. Given an original piece of content, our proposal involves first generating multiple rephrases, each embedding a watermark with a unique secret key. One version is to be released publicly, while others are to be kept private. Subsequently, creators can compare model likelihoods between public and private versions using paired statistical tests to prove membership. We show that our framework can successfully detect contamination across four benchmarks which appear only once in the training data and constitute less than 0.001% of the total tokens, outperforming several contamination detection and dataset inference baselines. We verify that STAMP preserves both the semantic meaning and utility of the original data. We apply STAMP to two real-world scenarios to confirm the inclusion of paper abstracts and blog articles in the pretraining corpora.

Figures

Figures reproduced from arXiv: 2504.13416 by the authors.

Figure 1
Figure 1. Overview of STAMP. Stage 1: Create Watermarked Copies of the Dataset. We use a watermarked LLM to generate multiple rephrased versions of their original dataset, each uniquely watermarked using a distinct key. The version watermarked with the public key is released publicly on the internet, while other watermarked versions are kept private. Stage 2: Prove Membership using a Paired T-Test. To detect membership, we co… view at source ↗
Figure 2
Figure 2. Impact of benchmark size (n) and private key count (m) on STAMP’s statistical power. The dotted red line indicates the standard significance threshold (p = 0.05). Lower values indicate stronger statistical evidence of contamination. Private key count. Our proposed test compares the per￾plexity of the public version against the average perplexity of m private versions (Equation 4). Here we analyze how this hyperparam… view at source ↗
Figure 3
Figure 3. Log p-value vs pretraining corpus size. We observe that the rate of decline diminishes as we increase the corpus size, with negligible drop between 4B and 6B. and Appendix L , respectively. To evaluate whether the semantic content of abstracts is preserved, we use the P-SP metric (Wieting et al., 2022), where watermarked abstracts achieve a high score of 0.95, indicating that the semantic content is largely preserve… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Author evaluation of watermarked abstracts. Out of the 40 total abstracts, for 4 of them the watermarked version was preferred, for another 24 it was found to be acceptable, 11 required minor edits with just 1 requiring major edits, suggesting that watermarking preserv…
Figure 5
Figure 5. Figure 5: Log p-value vs proportion of benchmark that is contaminated. We plot the log p-value against the proportion of test examples that are leaked to analyze the sensitivity of our test to detect contaminated in scenarios where the benchmark is only partially contaminated (l…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 24 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    URL https://aclanthology.org/W01-0500

    Proceedings of the 2001 Conference on Empirical Methods in Natural Language Processing, 2001. URL https://aclanthology.org/W01-0500

    work page 2001

  3. [3]

    Llama 3 model card, 2024

    AI@Meta. Llama 3 model card, 2024. URL https://github.com/meta-llama/llama3/blob/main/MODEL_CARD.md

    2024

  4. [4]

    Claude 3 model card, 2024

    Anthropic. Claude 3 model card, 2024. URL https://www.anthropic.com/news/claude-3-family

    work page 2024

  5. [5]

    G., Bradley, H., O'Brien, K., Hallahan, E., Khan, M

    Biderman, S., Schoelkopf, H., Anthony, Q. G., Bradley, H., O'Brien, K., Hallahan, E., Khan, M. A., Purohit, S., Prashanth, U. S., Raff, E., Skowron, A., Sutawika, L., and van der Wal, O. Pythia: A suite for analyzing large language models across training and scaling. In Krause, A., Brunskill, E., Cho, K., Engelhardt, B., Sabato, S., and Scarlett, J. (eds....

    work page 2023

  6. [6]

    The secret sharer: Evaluating and testing unintended memorization in neural networks

    Carlini, N., Liu, C., Erlingsson, \'U ., Kos, J., and Song, D. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19), pp.\ 267--284, 2019

    2019

  7. [7]

    Extracting training data from large language models

    Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, U., et al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pp.\ 2633--2650, 2021

    2021

  8. [8]

    Think you have solved question answering? try arc, the ai2 reasoning challenge

    Clark, P., Cowhey, I., Etzioni, O., Khot, T., Sabharwal, A., Schoenick, C., and Tafjord, O. Think you have solved question answering? try arc, the ai2 reasoning challenge. ArXiv preprint, abs/1803.05457, 2018. URL https://arxiv.org/abs/1803.05457

    arXiv 2018

Show all 57 references
  1. [9]

    Training verifiers to solve math word problems

    Cobbe, K., Kosaraju, V., Bavarian, M., Chen, M., Jun, H., Kaiser, L., Plappert, M., Tworek, J., Hilton, J., Nakano, R., et al. Training verifiers to solve math word problems. ArXiv preprint, abs/2110.14168, 2021. URL https://arxiv.org/abs/2110.14168

    2021 arXiv

  2. [10]

    Opencompass: A universal evaluation platform for foundation models, 2023

    Contributors, O. Opencompass: A universal evaluation platform for foundation models, 2023

    2023

  3. [11]

    Blind baselines beat membership inference attacks for foundation models, 2024

    Das, D., Zhang, J., and Tramèr, F. Blind baselines beat membership inference attacks for foundation models, 2024. URL https://arxiv.org/abs/2406.16201

    2024 arXiv

  4. [12]

    Do membership inference attacks work on large language models? ArXiv preprint, abs/2402.07841, 2024

    Duan, M., Suri, A., Mireshghallah, N., Min, S., Shi, W., Zettlemoyer, L., Tsvetkov, Y., Choi, Y., Evans, D., and Hajishirzi, H. Do membership inference attacks work on large language models? ArXiv preprint, abs/2402.07841, 2024. URL https://arxiv.org/abs/2402.07841

    2024 arXiv

  5. [13]

    P., Groeneveld, D., Soldaini, L., Singh, S., Hajishirzi, H., Smith, N

    Elazar, Y., Bhagia, A., Magnusson, I., Ravichander, A., Schwenk, D., Suhr, A., Walsh, E. P., Groeneveld, D., Soldaini, L., Singh, S., Hajishirzi, H., Smith, N. A., and Dodge, J. What's in my big data? In The Twelfth International Conference on Learning Representations, ICLR 20...

    2024

  6. [14]

    A framework for few-shot language model evaluation, 2024

    Gao, L., Tow, J., Abbasi, B., Biderman, S., Black, S., DiPofi, A., Foster, C., Golding, L., Hsu, J., Le Noac'h, A., Li, H., McDonell, K., Muennighoff, N., Ociepa, C., Phang, J., Reynolds, L., Schoelkopf, H., Skowron, A., Sutawika, L., Tang, E., Thite, A., Wang, B., Wang, K., a...

    2024

  7. [15]

    and Surdeanu, M

    Golchin, S. and Surdeanu, M. Time travel in llms: Tracing data contamination in large language models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024 . OpenReview.net, 2024. URL https://openreview.net/forum?id=2Rwq6c3tvr

    2024

  8. [16]

    Grynbaum, M. M. and Mac, R. The times sues openai and microsoft over a.i. use of copyrighted work https://www.nytimes.com/2023/12/27/business/media/new-york-times-open-ai-microsoft-lawsuit.html, 2023 a . URL https://www.nytimes.com/2023/12/27/business/media/new-york-times-open...

    2023

  9. [17]

    Grynbaum, M. M. and Mac, R. Sarah silverman and authors sue openai and meta over copyright infringement, 2023 b . URL https://www.nytimes.com/2023/07/10/arts/sarah-silverman-lawsuit-openai-meta.html

    2023

  10. [18]

    Measuring massive multitask language understanding

    Hendrycks, D., Burns, C., Basart, S., Zou, A., Mazeika, M., Song, D., and Steinhardt, J. Measuring massive multitask language understanding. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021 . OpenReview.net, 2021. UR...

    2021

  11. [19]

    Stop uploading test data in plain text: Practical strategies for mitigating data contamination by evaluation benchmarks

    Jacovi, A., Caciularu, A., Goldman, O., and Goldberg, Y. Stop uploading test data in plain text: Practical strategies for mitigating data contamination by evaluation benchmarks. In Bouamor, H., Pino, J., and Bali, K. (eds.), Proceedings of the 2023 Conference on Empirical Meth...

    2023 doi

  12. [20]

    T rivia QA : A large scale distantly supervised challenge dataset for reading comprehension

    Joshi, M., Choi, E., Weld, D., and Zettlemoyer, L. T rivia QA : A large scale distantly supervised challenge dataset for reading comprehension. In Barzilay, R. and Kan, M.-Y. (eds.), Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volum...

    2017 doi

  13. [21]

    A watermark for large language models

    Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., and Goldstein, T. A watermark for large language models. In Krause, A., Brunskill, E., Cho, K., Engelhardt, B., Sabato, S., and Scarlett, J. (eds.), International Conference on Machine Learning, ICML 2023, 23-29 July...

    2023

  14. [22]

    On the reliability of watermarks for large language models

    Kirchenbauer, J., Geiping, J., Wen, Y., Shu, M., Saifullah, K., Kong, K., Fernando, K., Saha, A., Goldblum, M., and Goldstein, T. On the reliability of watermarks for large language models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna,...

    2024

  15. [23]

    Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense

    Krishna, K., Song, Y., Karpinska, M., Wieting, J., and Iyyer, M. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. In Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., and Levine, S. (eds.), Advances in Neural Information Proce...

    2023

  16. [24]

    Lau, G. K. R., Niu, X., Dao, H., Chen, J., Foo, C.-S., and Low, B. K. H. Waterfall: Framework for robust and scalable text watermarking and provenance for llms, 2024. URL https://arxiv.org/abs/2407.04411

    2024 arXiv

  17. [25]

    Ai ai bias: Large language models favor their own generated content

    Laurito, W., Davis, B., Grietzer, P., Gavenčiak, T., Böhm, A., and Kulveit, J. Ai ai bias: Large language models favor their own generated content. ArXiv preprint, abs/2407.12856, 2024. URL https://arxiv.org/abs/2407.12856

    2024 arXiv

  18. [26]

    Watermarking text data on large language models for dataset copyright

    Liu, Y., Hu, H., Chen, X., Zhang, X., and Sun, L. Watermarking text data on large language models for dataset copyright. ArXiv preprint, abs/2305.13257, 2023 a . URL https://arxiv.org/abs/2305.13257

    2023 arXiv

  19. [27]

    G -eval: NLG evaluation using gpt-4 with better human alignment

    Liu, Y., Iter, D., Xu, Y., Wang, S., Xu, R., and Zhu, C. G -eval: NLG evaluation using gpt-4 with better human alignment. In Bouamor, H., Pino, J., and Bali, K. (eds.), Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pp.\ 2511--2522, Sin...

    2023 doi

  20. [28]

    and Hutter, F

    Loshchilov, I. and Hutter, F. Decoupled weight decay regularization. In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019 . OpenReview.net, 2019. URL https://openreview.net/forum?id=Bkg6RiCqY7

    2019

  21. [29]

    and Schwartz, R

    Magar, I. and Schwartz, R. Data contamination: From memorization to exploitation. In Muresan, S., Nakov, P., and Villavicencio, A. (eds.), Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pp.\ 157--165, Dublin, I...

    2022 doi

  22. [30]

    Dataset inference: Ownership resolution in machine learning

    Maini, P., Yaghini, M., and Papernot, N. Dataset inference: Ownership resolution in machine learning. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021 . OpenReview.net, 2021. URL https://openreview.net/forum?id=hvdKKV2yt7T

    2021

  23. [31]

    LLM dataset inference: Did you train on my dataset? In Globersons, A., Mackey, L., Belgrave, D., Fan, A., Paquet, U., Tomczak, J

    Maini, P., Jia, H., Papernot, N., and Dziedzic, A. LLM dataset inference: Did you train on my dataset? In Globersons, A., Mackey, L., Belgrave, D., Fan, A., Paquet, U., Tomczak, J. M., and Zhang, C. (eds.), Advances in Neural Information Processing Systems 38: Annual Conferenc...

    2024

  24. [32]

    Copyright traps for large language models

    Meeus, M., Shilov, I., Faysse, M., and de Montjoye, Y. Copyright traps for large language models. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024 . OpenReview.net, 2024 a . URL https://openreview.net/forum?id=LDq1JPdc55

    2024

  25. [33]

    Sok: Membership inference attacks on llms are rushing nowhere (and how to fix it)

    Meeus, M., Shilov, I., Jain, S., Faysse, M., Rei, M., and de Montjoye, Y.-A. Sok: Membership inference attacks on llms are rushing nowhere (and how to fix it). 2024 b . URL https://api.semanticscholar.org/CorpusID:270737841

    2024

  26. [34]

    J., Mitra, K., and Hruschka, E

    Mishra, A., Rahman, S., Kim, H. J., Mitra, K., and Hruschka, E. R. Characterizing large language models as rationalizers of knowledge-intensive tasks. ArXiv preprint, abs/2311.05085, 2023. URL https://arxiv.org/abs/2311.05085

    2023 arXiv

  27. [35]

    and Kapoor, S

    Narayanan, A. and Kapoor, S. Ai snake oil., 2023. URL https://www.aisnakeoil.com/. Newsletter

    2023

  28. [36]

    The times sues openai and microsoft over a.i

    NewYorkTimes. The times sues openai and microsoft over a.i. use of copyrighted work. https://www.nytimes.com/2023/12/27/business/media/new-york-times-open-ai-microsoft-lawsuit.html, 2023

    2023

  29. [37]

    Gpt-4 technical report, 2023

    OpenAI. Gpt-4 technical report, 2023. URL https://arxiv.org/abs/2303.08774

    2023 arXiv

  30. [38]

    S., Ladhak, F., and Hashimoto, T

    Oren, Y., Meister, N., Chatterji, N. S., Ladhak, F., and Hashimoto, T. Proving test set contamination in black-box language models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024 . OpenReview.net, 2024. URL https...

    2024

  31. [39]

    L., and Agirre, E

    Sainz, O., Campos, J., Garc \' a-Ferrero, I., Etxaniz, J., de Lacalle, O. L., and Agirre, E. NLP evaluation in trouble: On the need to measure LLM data contamination for each benchmark. In Bouamor, H., Pino, J., and Bali, K. (eds.), Findings of the Association for Computationa...

    2023 doi

  32. [40]

    A., García-Ferreroa, I., and andEneko Agirre, J

    Sainz, O., Campos, J. A., García-Ferreroa, I., and andEneko Agirre, J. E. Did chatgpt cheat on your test? https://hitz-zentroa.github.io/lm-contamination/blog/, 2023 b

    2023

  33. [41]

    Watermarking makes language models radioactive

    Sander, T., Fernandez, P., Durmus, A., Douze, M., and Furon, T. Watermarking makes language models radioactive. In Globersons, A., Mackey, L., Belgrave, D., Fan, A., Paquet, U., Tomczak, J. M., and Zhang, C. (eds.), Advances in Neural Information Processing Systems 38: Annual ...

    2024

  34. [42]

    Detecting benchmark contamination through watermarking

    Sander, T., Fernandez, P., Mahloujifar, S., Durmus, A., and Guo, C. Detecting benchmark contamination through watermarking. ArXiv preprint, abs/2502.17259, 2025. URL https://arxiv.org/abs/2502.17259

    2025 arXiv

  35. [43]

    Detecting pretraining data from large language models

    Shi, W., Ajith, A., Xia, M., Huang, Y., Liu, D., Blevins, T., Chen, D., and Zettlemoyer, L. Detecting pretraining data from large language models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024 . OpenReview.net, ...

    2024

  36. [44]

    Membership inference attacks against machine learning models, 2016

    Shokri, R., Stronati, M., Song, C., and Shmatikov, V. Membership inference attacks against machine learning models, 2016. URL https://arxiv.org/abs/1610.05820

    2016 arXiv

  37. [45]

    K., Kocyigit, M

    Singh, A. K., Kocyigit, M. Y., Poulton, A., Esiobu, D., Lomeli, M., Szilvasy, G., and Hupkes, D. Evaluation data contamination in llms: how do we measure it and (when) does it matter? ArXiv preprint, abs/2411.03923, 2024. URL https://arxiv.org/abs/2411.03923

    2024 arXiv

  38. [46]

    The probable error of a mean

    Student. The probable error of a mean. Biometrika, pp.\ 1--25, 1908

    1908

  39. [47]

    M ini C heck: Efficient fact-checking of LLM s on grounding documents

    Tang, L., Laban, P., and Durrett, G. M ini C heck: Efficient fact-checking of LLM s on grounding documents. In Al-Onaizan, Y., Bansal, M., and Chen, Y.-N. (eds.), Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp.\ 8818--8847, Miami, Fl...

    2024 doi

  40. [48]

    Exploring document-level literary machine translation with parallel paragraphs from world literature

    Thai, K., Karpinska, M., Krishna, K., Ray, B., Inghilleri, M., Wieting, J., and Iyyer, M. Exploring document-level literary machine translation with parallel paragraphs from world literature. In Goldberg, Y., Kozareva, Z., and Zhang, Y. (eds.), Proceedings of the 2022 Conferen...

    2022 doi

  41. [49]

    T.-Z., Wang, R

    Wei, J. T.-Z., Wang, R. Y., and Jia, R. Proving membership in llm pretraining data via data watermarks. ArXiv preprint, abs/2402.10892, 2024. URL https://arxiv.org/abs/2402.10892

    2024 arXiv

  42. [50]

    Paraphrastic representations at scale

    Wieting, J., Gimpel, K., Neubig, G., and Berg-kirkpatrick, T. Paraphrastic representations at scale. In Che, W. and Shutova, E. (eds.), Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pp.\ 379--388, Abu Dhabi, UAE,...

    2022 doi

  43. [51]

    a good pun is its own reword : Can large language models understand puns? In Al-Onaizan, Y., Bansal, M., and Chen, Y.-N

    Xu, Z., Yuan, S., Chen, L., and Yang, D. a good pun is its own reword : Can large language models understand puns? In Al-Onaizan, Y., Bansal, M., and Chen, Y.-N. (eds.), Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp.\ 11766--11782, ...

    2024 doi

  44. [52]

    Privacy risk in machine learning: Analyzing the connection to overfitting

    Yeom, S., Giacomelli, I., Fredrikson, M., and Jha, S. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pp.\ 268--282. IEEE, 2018

    2018

  45. [53]

    Tree of problems: Improving structured problem solving with compositionality, 2024

    Zebaze, A., Sagot, B., and Bawden, R. Tree of problems: Improving structured problem solving with compositionality, 2024. URL https://arxiv.org/abs/2410.06634

    2024 arXiv

  46. [54]

    Pacost: Paired confidence significance testing for benchmark contamination detection in large language models, 2024 a

    Zhang, H., Lin, Y., and Wan, X. Pacost: Paired confidence significance testing for benchmark contamination detection in large language models, 2024 a . URL https://arxiv.org/abs/2406.18326

    2024 arXiv

  47. [55]

    Membership inference attacks cannot prove that a model was trained on your data, 2024 b

    Zhang, J., Das, D., Kamath, G., and Tramèr, F. Membership inference attacks cannot prove that a model was trained on your data, 2024 b . URL https://arxiv.org/abs/2409.19798

    2024 arXiv

  48. [56]

    F., and Li, H

    Zhang, J., Sun, J., Yeats, E., Ouyang, Y., Kuo, M., Zhang, J., Yang, H. F., and Li, H. Min-k\ ArXiv preprint, abs/2404.02936, 2024 c . URL https://arxiv.org/abs/2404.02936

    2024 arXiv

  49. [57]

    Pretraining data detection for large language models: A divergence-based calibration method, 2024 d

    Zhang, W., Zhang, R., Guo, J., de Rijke, M., Fan, Y., and Cheng, X. Pretraining data detection for large language models: A divergence-based calibration method, 2024 d . URL https://arxiv.org/abs/2409.14781

    2024 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.