Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Automated Detection of Pre-training Text in Black-box LLMs

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read VeilProbe claims a fully automatic, text-only way to detect whether a document was part of an LLM's pre-training data, reporting AUC scores up to 0.963 and document-level AUC around 0.99.

desk verdict Clever framework, but the headline numbers are likely inflated by training the surrogate on the very texts it later scores. read the letter →

arxiv 2506.19399 v1 pith:I6BU24ZK submitted 2025-06-24 cs.CL cs.AI

Ruihan Hu , Yu-Ming Shang , Jiankun Peng , Wei Luo , Yazhe Wang , Xi Zhang This is my paper · ORCID
classification cs.CLcs.AI
keywords pre-trainingdatadetectionmembershipinferenceattackblack-boxLLMtext-to-suffixmappingprototype-basedclassifierkeytokenperturbationinformationbottleneckcontamination
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that pre-training membership can be detected in a black-box LLM, where the auditor sees only input text and generated output rather than token probabilities or internal parameters, and that this can be done without handcrafted prompts. Its framework, VeilProbe, asks the target LLM to continue each candidate text, trains a sequence-to-sequence model to imitate that text-to-suffix mapping, and uses the mapping model's hidden states plus calibration features from perturbed versions of the text as membership evidence. A prototype-based classifier trained on about 50 known training and non-training examples then decides membership. Across WikiMIA, BookTection, and arXivTection, the paper reports sentence-level AUC up to 0.963, TPR@5%FPR up to 0.845, and document-level detection averaging roughly 0.99 AUC. If true, an API-only auditor could screen corpora for pre-training membership at scale, with direct implications for copyright enforcement and privacy auditing.

What carries the argument

The load-bearing object is the sequence-to-sequence mapping model: a transformer trained to maximize P(sout|s), whose hidden states are extracted as mapping features. Around it, key-token perturbation uses proxy LLMs with a feature-attribution method to choose the top-γ% tokens to replace with synonyms, producing calibration features Zc = Zs − Zr; a Welch significance test keeps only dimensions that separate known training from non-training texts; and a prototype-based classifier constructs class prototypes c0 and c1 with Information Bottleneck denoising, scoring each text by δ=d(Ẑ,c0)−d(Ẑ,c1). The machinery's job is to convert the target LLM's visible completion behavior into a fixed-dimensional feature that is more separable than the raw outputs themselves.

What would settle it

Train the mapping model on text-to-suffix pairs from one random half of the candidate texts, evaluate the full VeilProbe pipeline on the other half, and compare sentence-level AUC and TPR@5%FPR with the paper's reported values; if the held-out numbers drop toward the grey-box baselines, the detection signal is memorization of the test texts rather than a transferable text-to-suffix rule.

Watch

Extended reading notes

Core claim

The central claim is that a black-box detector can learn a membership signal from text-to-suffix behavior alone. For each candidate text s, VeilProbe obtains the target LLM's autoregressive continuation sout and a continuation rout for a synonym-perturbed version r of s; a transformer sequence-to-sequence model is trained on these pairs to capture the mapping f: s→sout, and its hidden states become the text-to-suffix mapping feature Zs. The difference Zs−Zr is filtered by a significance test to produce a perturbation calibration feature, and the two are concatenated into a membership feature Z. A prototypical network with an Information Bottleneck term turns Z into a detection score δ=d(Ẑ,c0)−d(Ẑ,c1) against learned pre-training and non-training prototypes. The paper reports sentence-level AUC of 0.902–0.963 on WikiMIA and BookTection, TPR@5%FPR up to 0.845, and document-level detection averaging roughly 0.99 AUC, exceeding both grey-box baselines that use token probabilities and black-box baselines that require human-designed tasks.

Load-bearing premise

The load-bearing premise is that the mapping model that produces membership features has not been trained on the same candidate texts it later classifies, since the paper trains it on text-to-suffix pairs generated from the evaluation corpus and reserves only about 50 samples for the classifier.

Editorial extensions

If this is right

  • An API-only auditor could screen large text corpora for LLM pre-training membership without token-probability access, something grey-box methods cannot do for products like ChatGPT or Claude.
  • Document-level screening of books and papers would reach average AUC around 0.99 when sentence-level scores are aggregated, making copyright infringement screening practical at scale.
  • Because detection still works with only ten labeled ground-truth samples at roughly 80–90 percent AUC, deployment is feasible even when a provider discloses few or no training documents.
  • The framework is automated, so no per-text cloze questions or multiple-choice tasks need to be designed, and the same pipeline can be applied to new domains without human effort.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A strict inductive test, training the mapping model on one disjoint set of texts and evaluating on another, would determine whether the reported accuracy comes from a generalizable text-to-suffix rule or from the mapping model having already fit the candidate texts' continuation patterns; the paper's setup does not clearly separate these.
  • The use of proxy LLMs to choose perturbation tokens assumes the proxies' attribution preferences transfer to the target model; a target with very different tokenization, corpus, or generation style could lose the calibration feature's separating power.
  • The same feature-extraction and prototype-classification recipe could apply to related membership-detection tasks, such as data-contamination tests or fine-tuning-data detection, whenever an API exposes only completions.
  • If the claimed signal is real, it shows that output-only interfaces leak membership information, strengthening the case for output filtering or differential privacy in hosted models.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes VeilProbe, a framework for detecting whether a given text was part of a target LLM's pre-training data in a black-box setting where only input and output texts are accessible. The method first samples text-to-suffix pairs (including perturbed texts) from the target LLM, then trains a sequence-to-sequence mapping model to extract membership features from the hidden states of those pairs, combines them with perturbation calibration features, and finally uses a prototype-based classifier with an Information Bottleneck objective to classify texts. The authors report strong results on WikiMIA, BookTection, and arXivTection, outperforming grey-box and black-box baselines on both sentence-level and document-level detection.

Significance. The problem is practically important: detecting pre-training data in closed models is relevant to privacy, copyright, and data-contamination auditing. A fully automatic text-only detector would be a meaningful advance over existing black-box methods that require handcrafted instructions, and it could provide a complement to grey-box approaches that need token probabilities. The proposed design is thoughtful in combining a learned text-to-suffix mapping with perturbation calibration and a few-shot prototype classifier. If the evaluation is properly validated with a non-transductive protocol, the contribution would likely be significant for the community. The code is made available, which supports reproducibility of the re-run experiments.

major comments (3)
  1. [§4.2, §5.1] The evaluation appears to be transductive: the sequence-to-sequence mapping model is trained on the text-to-suffix pairs for 'each text s∈S' (Section 4.1) and then hidden states are extracted for the same texts (Section 4.2), while Section 5.1 only reserves approximately 50 ground-truth samples for the prototype classifier and treats the remaining samples as the texts to be detected. No disjoint split between mapping-model training and feature extraction is described. Consequently, the features used to evaluate a test text come from a surrogate model that has already fitted that exact text's continuation pattern, so the reported AUCs (Tables 2 and 3) may reflect pair-specific memorization rather than a generalizable text-only membership signal. Please re-run the experiments with a clean split (for example, train the mapping model only on the 50 ground-truth samples or on a separate training subset, then extract features for held-out texts), or provide evidence that the features for held-out texts are not materially degraded relative to the transductive ones.
  2. [§4.2, Eqs. (3)–(4)] The significance-test-based critical feature selection uses the ground-truth labels G1 and G0, but the paper does not state whether this test is restricted to the approximately 50 training samples or applied to the entire candidate pool. If the p-value threshold is chosen using features from the test texts, the labels of those test texts influence the final feature representation, which would be a form of label leakage. Please clarify that the significance test is performed only on the labeled training subset, and if it is currently applied more broadly, rerun the experiments accordingly.
  3. [§5.2, Tables 2–3] Because the mapping model is trained on text-to-suffix pairs for all candidate texts, including the test texts, the comparison against grey-box baselines is not apples-to-apples: VeilProbe effectively uses unlabeled input-output pairs from the test pool to train its feature extractor, whereas the baselines only use the token-level information of the test text itself. If a proper split is introduced, the claimed 'good margin' over grey-box methods may shrink. The manuscript should either report the held-out evaluation explicitly or discuss how the transductive training of the feature extractor affects the comparison.
minor comments (5)
  1. [Figure 1 caption] The caption contains a typo: 'comparation' should be 'comparison'.
  2. [Table 2] The baseline name 'FeartureAgg' should be 'FeatureAgg'.
  3. [§4.3, Eq. (8)] The value of β in the Information Bottleneck objective is not reported or ablated in the experiments; please specify how β is set and whether the results are sensitive to it.
  4. [§5.1 and §4.1] Section 5.1 says 'three suffixes' were generated per text, while Section 4.1 says 'more than one suffix' without specifying the number; the text should be consistent.
  5. [Appendix C.2] The text says 'GLMs' where it should say 'LLMs'.

Circularity Check

1 steps flagged · score 7.0 of 10

VeilProbe's seq2seq mapping model is trained on the same ⟨s,sout⟩ pairs it later scores, so reported AUCs reflect transductive memorization rather than a generalizable black-box detector.

  1. fitted input called prediction [Sections 4.1-4.2 (Eqs. 2, 5) and Section 5.1 (Eq. 9)]
    "Specifically, this mapping model is trained on ⟨s, sout⟩ pairs to learn the input-output dependency, that is, f : s → sout. ... Upon completion of the training process, once a text input is provided to the sequence-to-sequence model, the hidden states of the model are extracted as the text-to-suffix mapping feature Zs. ... For each text to be detected, three suffixes were generated using the target LLM, with the maximum suffix length set to 512 tokens. ..."

    The membership feature Zs for a text s is obtained from a sequence-to-sequence model trained on the very pair ⟨s, sout⟩ that includes that text, and the detection score in Eq. 9 combines this Zs via Eq. 5. Section 5.1 describes a split only for the prototype classifier (about 50 ground-truth samples), not for the mapping model's training data. Thus every 'text to be detected' has already had its exact s→sout mapping fitted by the feature extractor. The reported AUC/TPR therefore measure how well the mapping model recognizes inputs it was trained on, not whether the learned features generalize to unseen texts.

full rationale

The paper's central evaluation is undermined by a concrete training/evaluation overlap: the text-to-suffix mapping model that produces the membership features is trained on all candidate texts, including those later scored, while only the prototype classifier receives a train/test split. This is the 'fitted input called prediction' pattern, because the feature for each test input is a function of a model that has already fit that exact input-output pair. No load-bearing self-citations or imported uniqueness arguments appear; the other components (prototypical network, information bottleneck, perturbation calibration) are standard and not circular. Because the leaked feature extraction sits at the core of the claimed state-of-the-art results, the circularity score is high, though the paper does contain independent methodological pieces beyond this evaluation flaw.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The framework relies on a number of dataset-dependent choices (γ, p-value threshold, β) and on the assumption that a surrogate model's hidden states reflect the target LLM's training-data memory. No new physical or external entities are posited; the 'latent mapping feature Z' is a learned representation internal to the model.

free parameters (4)
  • γ (top-γ% tokens perturbed) = 10
    Chosen by hand (Section 5.1); no sensitivity analysis in the main text beyond the ablation showing key perturbation helps.
  • p-value significance threshold = not stated for main results
    Selected from {0.001, 0.01, 0.05, 0.1}; Section 5.4 and Figure 6 show the optimal value varies by dataset, but the paper does not describe a validation protocol, suggesting possible test-set tuning.
  • β in IB objective (Eq. 8) = not reported
    The trade-off parameter for the information bottleneck is never specified, and no implementation details are given.
  • Number of suffixes per text = 3
    Fixed choice in Section 5.1; no analysis of variance across suffix samples.
assumptions (5)
  • domain assumption Hidden states of a surrogate seq2seq model trained on the target LLM's text-to-suffix pairs carry membership-distinguishable information.
    Section 4.2 justifies this by analogy to white-box findings (Wang et al., 2024), but provides no evidence that a small surrogate's hidden states preserve the target model's memorization signal.
  • domain assumption Proxy LLMs from the same family as the target select similar key tokens, so perturbing those tokens yields useful calibration features.
    Section 4.1 and Appendix C.2 show token-overlap rates on 50 texts, but consistency of attribution does not imply that the resulting perturbations are discriminative for membership.
  • domain assumption The known member and non-member labels in WikiMIA, BookTection, and arXivTection are correct for the closed models (ChatGPT, Claude 2.1).
    Section 3 asserts published books/papers/Wikipedia are in pre-training corpora; for proprietary models this cannot be verified, and mislabeled ground truth would bias the trained classifier and the feature selection.
  • domain assumption Autoregressive continuation is the probing task that exposes membership.
    Section 4.1 chooses continuation without instructions; no experiment compares this to other probing tasks.
  • standard math Per-dimension two-sample tests (Welch's t-test) are valid for feature selection despite multiple testing and a 50-sample training set.
    Section 4.2 applies significance tests to each feature dimension without multiple-testing correction or distributional checks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Automated Detection of Pre-training Text in Black-box LLMs." pith.science (2026). https://pith.science/paper/I6BU24ZK

@misc{pith2026250619399,
  author       = {Pith},
  title        = {Pith review of: Automated Detection of Pre-training Text in Black-box LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I6BU24ZK}},
  note         = {Machine review of arXiv:2506.19399}
}
read the original abstract

Detecting whether a given text is a member of the pre-training data of Large Language Models (LLMs) is crucial for ensuring data privacy and copyright protection. Most existing methods rely on the LLM's hidden information (e.g., model parameters or token probabilities), making them ineffective in the black-box setting, where only input and output texts are accessible. Although some methods have been proposed for the black-box setting, they rely on massive manual efforts such as designing complicated questions or instructions. To address these issues, we propose VeilProbe, the first framework for automatically detecting LLMs' pre-training texts in a black-box setting without human intervention. VeilProbe utilizes a sequence-to-sequence mapping model to infer the latent mapping feature between the input text and the corresponding output suffix generated by the LLM. Then it performs the key token perturbations to obtain more distinguishable membership features. Additionally, considering real-world scenarios where the ground-truth training text samples are limited, a prototype-based membership classifier is introduced to alleviate the overfitting issue. Extensive evaluations on three widely used datasets demonstrate that our framework is effective and superior in the black-box setting.

Figures

Figures reproduced from arXiv: 2506.19399 by the authors.

Figure 1
Figure 1. The comparation between existing methods and [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of VeilProbe. (a) The text-to-suffix sampling module generates text-to-suffix pairs; (b) The membership feature inference module infers membership features with a sequence-to-sequence model based on the above pairs; (c) The prototype-based classifier is trained based on the features from ground-truth samples, and then the pre-training and non-training prototypes are constructed. The first two modules prepar… view at source ↗
Figure 3
Figure 3. The pipeline of key token perturbation module. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: VeilProbe’s performance w.r.t different general factors. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 6
Figure 6. Figure 6: VeilProbe’s performance w.r.t p-value. shows that AUC scores improve as the number of samples increases. Nevertheless, even with only 10 ground-truth sam￾ples, our method is still capable of achieving an AUC detec￾tion rate of approximately 80-90% across three datasets…
Figure 8
Figure 8. Figure 8: Comparison of selected token overlap rates for 50 texts be [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: The visualization of token importance across different [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 7
Figure 7. Figure 7: Density plots for consistency and semantic shift across [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Implicit Reasoning Steering via Concept Chaining

    cs.CL 2026-07 conditional novelty 6.0 of 10

    Reinforcement-learning-optimized concept-chain paragraphs covertly steer language-model multiple-choice preferences after continued pretraining, with far lower detectability than direct paraphrases.

Reference graph

Works this paper leans on

40 extracted references · 40 canonical work pages · cited by 1 Pith paper

  1. [1]

    To believe or not to believe your LLM: Iterativeprompting for estimating epistemic uncertainty

    [Abbasi-Yadkori et al., 2024] Yasin Abbasi-Yadkori, Ilja Kuzborskij, Andr ´as Gy ¨orgy, and Csaba Szepesvari. To believe or not to believe your LLM: Iterativeprompting for estimating epistemic uncertainty. In The Thirty-eighth Annual Conference on Neural Information Processing Systems,

    work page 2024

  2. [7]

    Chang, Mackenzie Cramer, Sandeep Soni, and David Bamman

    [Chang et al., 2023] Kent K. Chang, Mackenzie Cramer, Sandeep Soni, and David Bamman. Speak, memory: An archaeology of books known to chatgpt/gpt-4,

    work page 2023

  3. [8]

    Generaliza- tion or memorization: Data contamination and trustworthy evaluation for large language models,

    [Dong et al., 2024] Yihong Dong, Xue Jiang, Huanyu Liu, Zhi Jin, Bin Gu, Mengfei Yang, and Ge Li. Generaliza- tion or memorization: Data contamination and trustworthy evaluation for large language models,

    work page 2024

  4. [9]

    Do membership inference attacks work on large language models?

    [Duan et al., 2024] Michael Duan, Anshuman Suri, Niloo- far Mireshghallah, Sewon Min, Weijia Shi, Luke Zettle- moyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Han- naneh Hajishirzi. Do membership inference attacks work on large language models?

    work page 2024

  5. [10]

    Duarte, Xuandong Zhao, Ar- lindo L

    [Duarte et al., 2024] Andr´e V . Duarte, Xuandong Zhao, Ar- lindo L. Oliveira, and Lei Li. De-cop: Detecting copy- righted content in language models training data,

    work page 2024

  6. [11]

    Time travel in llms: Tracing data contamina- tion in large language models,

    [Golchin and Surdeanu, 2024] Shahriar Golchin and Mihai Surdeanu. Time travel in llms: Tracing data contamina- tion in large language models,

    work page 2024

  7. [12]

    Grynbaum and Richard Mac

    [Grynbaum and Mac, 2023] Michael M. Grynbaum and Richard Mac. The times sues openai and microsoft over a.i. use of copyrighted work. The New York Times,

    work page 2023

  8. [13]

    A benchmark for inter- pretability methods in deep neural networks,

    [Hooker et al., 2019] Sara Hooker, Dumitru Erhan, Pieter- Jan Kindermans, and Been Kim. A benchmark for inter- pretability methods in deep neural networks,

    work page 2019

Show all 40 references
  1. [15]

    Copyright violations and large language models,

    [Karamolegkou et al., 2023] Antonia Karamolegkou, Jiaang Li, Li Zhou, and Anders Søgaard. Copyright violations and large language models,

    2023

  2. [16]

    Propile: Probing privacy leakage in large language models,

    [Kim et al., 2023] Siwon Kim, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and Seong Joon Oh. Propile: Probing privacy leakage in large language models,

    2023

  3. [17]

    Gilot: Interpreting generative language models via optimal transport

    [Li et al., 2024] Xuhong Li, Jiamin Chen, Yekun Chai, and Haoyi Xiong. Gilot: Interpreting generative language models via optimal transport. In Forty-first International Conference on Machine Learning,

    2024

  4. [18]

    Please tell me more: Privacy impact of explain- ability through the lens of membership inference attack

    [Liu et al., 2024] Han Liu, Yuhao Wu, Zhiyuan Yu, and Ning Zhang. Please tell me more: Privacy impact of explain- ability through the lens of membership inference attack. In 2024 IEEE Symposium on Security and Privacy (SP) , pages 4791–4809,

    2024

  5. [19]

    Analyzing leakage of personally identifiable in- formation in language models,

    [Lukas et al., 2023] Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella- B´eguelin. Analyzing leakage of personally identifiable in- formation in language models,

    2023

  6. [20]

    LLM dataset inference: Did you train on my dataset? In The Thirty-eighth An- nual Conference on Neural Information Processing Sys- tems,

    [Maini et al., 2024] Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. LLM dataset inference: Did you train on my dataset? In The Thirty-eighth An- nual Conference on Neural Information Processing Sys- tems,

    2024

  7. [21]

    Mem- bership inference attacks against language models via neighbourhood comparison

    [Mattern et al., 2023] Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schoelkopf, Mrinmaya Sachan, and Taylor Berg-Kirkpatrick. Mem- bership inference attacks against language models via neighbourhood comparison. In Anna Rogers, Jordan Boyd-Graber, and Naoak...

    2023

  8. [22]

    [Mireshghallah et al., ] Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri

    Association for Computational Linguistics. [Mireshghallah et al., ] Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. Quantifying privacy risks of masked language models using membership inference attacks. [Oren et al., 2023] Yo...

    2023

  9. [23]

    Scaling up membership infer- ence: When and how attacks succeed on large language models,

    [Puerto et al., 2024] Haritz Puerto, Martin Gubri, Sangdoo Yun, and Seong Joon Oh. Scaling up membership infer- ence: When and how attacks succeed on large language models,

    2024

  10. [24]

    Detecting pretraining data from large language models

    [Shi et al., 2024] Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. In The Twelfth International Con- ference on Learning Representations,

    2024

  11. [25]

    Membership infer- ence attacks against machine learning models

    [Shokri et al., 2017] Reza Shokri, Marco Stronati, Con- gzheng Song, and Vitaly Shmatikov. Membership infer- ence attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP) , May

    2017

  12. [27]

    Auditing data provenance in text-generation models

    [Song and Shmatikov, 2019] Congzheng Song and Vitaly Shmatikov. Auditing data provenance in text-generation models. In Proceedings of the 25th ACM SIGKDD In- ternational Conference on Knowledge Discovery & Data Mining, Jul

    2019

  13. [28]

    [Sutskever et al., 2014] Ilya Sutskever, Oriol Vinyals, and Quoc V . Le. Sequence to sequence learning with neural networks,

    2014

  14. [30]

    Gomez, Lukasz Kaiser, and Illia Polosukhin

    [Vaswani et al., 2023] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need,

    2023

  15. [31]

    Wang, Jason Wang, Marvin Li, and Seth Neel

    [Wang et al., 2024] Jeffrey G. Wang, Jason Wang, Marvin Li, and Seth Neel. Pandora’s white-box: Precise train- ing data detection and extraction in large language models,

    2024

  16. [32]

    [WELCH, 1947] B. L. WELCH. The generalization of ‘stu- dent’s’ problem when several different population var- lances are involved. Biometrika, 34(1-2):28–35, 01

    1947

  17. [34]

    Data contamination calibration for black-box llms,

    [Ye et al., 2024] Wentao Ye, Jiaqi Hu, Liyao Li, Haobo Wang, Gang Chen, and Junbo Zhao. Data contamination calibration for black-box llms,

    2024

  18. [35]

    Bag of tricks for training data extraction from lan- guage models,

    [Yu et al., 2023] Weichen Yu, Tianyu Pang, Qian Liu, Chao Du, Bingyi Kang, Yan Huang, Min Lin, and Shuicheng Yan. Bag of tricks for training data extraction from lan- guage models,

    2023

  19. [36]

    Aligning books and movies: Towards story- like visual explanations by watching movies and reading books

    [Zhu et al., 2015] Yukun Zhu, Ryan Kiros, Rich Zemel, Rus- lan Salakhutdinov, Raquel Urtasun, Antonio Torralba, and Sanja Fidler. Aligning books and movies: Towards story- like visual explanations by watching movies and reading books. In 2015 IEEE International Conference on C...

    2015

  20. [38]

    , 2024a ]

    For Neighbor baselines, the number of neighbors is set to 10, which is consistent with [Zhang et al. , 2024a ]. For FeatureAgg [Maini et al., 2024 ], we follow the settings provided in the author’s demo code and use the following features as input: ppl, k min 0.05, k min 0.1, ...

    2024

  21. [40]

    Please narrate a story about the Olympics,

    (f) Arxiv Shift Figure 7: Density plots for consistency and semantic shift across different datasets. Indicator WikiMIA BookTection arXivTection Consistency 0.572 0.744 0.451 Semantic Shift 0.522 0.649 0.529 Table 7: AUC scores on three datasets when using consistency and sema...

    2024

  22. [128]

    The exception is DE-COP, for which only the results at a sequence length of 128 are reported due to cost consid- erations. For document-level detection on the 165 books and 50 papers, all methods follow the previous work [Duarte et al., 2024], which use the averaged detection ...

    2024

  23. [1947]

    En- hanced membership inference attacks against machine learning models

    [Ye et al., 2022] Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. En- hanced membership inference attacks against machine learning models. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , Nov

    2022

  24. [2014]

    Deep learning and the information bottleneck principle,

    [Tishby and Zaslavsky, 2015] Naftali Tishby and Noga Za- slavsky. Deep learning and the information bottleneck principle,

    2015

  25. [2015]

    • Perplexity [Carlini et al., 2021]

    A Baseline Details We select eight grey-box detection methods and two black- box detection methods as our baselines. • Perplexity [Carlini et al., 2021]. It is the basic detection method based on perplexity (PPL) by averaging the log- likelihood of all tokens in a sequence. • ...

    2021

  26. [2017]

    [Snell et al., 2017] Jake Snell, Kevin Swersky, and Richard S. Zemel. Prototypical networks for few-shot learning,

    2017

  27. [2019]

    [Jiang et al., 2023] Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, L´elio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, T...

    2023

  28. [2020]

    Extracting training data from large language models

    [Carlini et al., 2021] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Kather- ine Lee, Adam Roberts, Tom Brown, Dawn Song, Ul- far Erlingsson, et al. Extracting training data from large language models. In 30th USENIX Security Symposium...

    2021

  29. [2021]

    Membership inference attacks from first principles,

    [Carlini et al., 2022] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles,

    2022

  30. [2022]

    Language models are few-shot learners

    [Brown et al., 2020] Tom Brown, Benjamin Mann, Nick Ry- der, and .etc Subbiah. Language models are few-shot learners. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances in Neural Informa- tion Processing Systems , volume 33, pages 1877–1901. C...

    2020

  31. [2023]

    Gpt-neox-20b: An open-source autoregressive language model,

    [Black et al., 2022] Sid Black, Stella Biderman, Eric Halla- han, Quentin Anthony, Leo Gao, Laurence Golding, Ho- race He, Connor Leahy, Kyle McDonell, Jason Phang, Michael Pieler, USVSN Sai Prashanth, Shivanshu Puro- hit, Laria Reynolds, Jonathan Tow, Ben Wang, and Samuel Wei...

    2022

  32. [2024]

    Pythia: A suite for analyzing large language models across training and scal- ing,

    [Biderman et al., 2023] Stella Biderman, Hailey Schoelkopf, Quentin Anthony, Herbie Bradley, Kyle O’Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, Aviya Skowron, Lin- tang Sutawika, and Oskar van der Wal. Pythia: A suite for ana...

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.