Source-linked AI summary
Digger: Detecting Copyright Content Mis-usage in Large Language Model Training
Haodong Li, Gelei Deng, Yi Liu, Kailong Wang, Yuekang Li, Tianwei Zhang, Yang Liu, Guoai Xu, Guosheng Xu, Haoyu Wang
TL;DR
Because LLM training datasets are often undisclosed, determining whether models have learned copyrighted material is difficult. Digger compares sample-loss behavior using reference-model fine-tuning and estimates inclusion confidence; experiments report identification effectiveness, including controlled GPT2-XL results and affirmative quote findings.
Problem
Method
Digger uses loss differences between baseline and reference LLMs to distinguish familiar from new content and calibrates loss distributions to estimate training-inclusion confidence.
Source: §1 · p. 2Results
Digger identified learned samples in experiments, achieving 84.750% accuracy and 92.428% recall on GPT2-XL in prepared settings, with affirmative notable-quote findings for GPT2-XL and LLaMA-7b.
Source: §1 · p. 2, §9 · p. 18Takeaways & Limitations
The results support exploring copyrighted novels learned by LLMs through differences in sample-loss change.
Source: §9 · p. 18Direct validation is infeasible without verified training-data labels, and the study’s LLM selection is limited to GPT-2 and LLaMA-7b.
Source: §7.1 · p. 16
Abstract
from arXiv · showhide
Pre-training, which utilizes extensive and varied datasets, is a critical factor in the success of Large Language Models (LLMs) across numerous applications. However, the detailed makeup of these datasets is often not disclosed, leading to concerns about data security and potential misuse. This is particularly relevant when copyrighted material, still under legal protection, is used inappropriately, either intentionally or unintentionally, infringing on the rights of the authors. In this paper, we introduce a detailed framework designed to detect and assess the presence of content from potentially copyrighted books within the training datasets of LLMs. This framework also provides a confidence estimation for the likelihood of each content sample's inclusion. To validate our approach, we conduct a series of simulated experiments, the results of which affirm the framework's effectiveness in identifying and addressing instances of content misuse in LLM training processes. Furthermore, we investigate the presence of recognizable quotes from famous literary works within these datasets. The outcomes of our study have significant implications for ensuring the ethical use of copyrighted materials in the development of LLMs, highlighting the need for more transparent and responsible data management practices in this field.
1 INTRODUCTION
LLMs are trained on extensive datasets whose contents may be undisclosed, raising concerns about copyrighted material. The introduction presents Digger as a loss-gap framework for estimating whether content appeared in training and reports tests in controlled and real-world settings.
1 INTRODUCTION
- LLMs such as GPT-2, LLaMA, and GPT-3 are used for text generation, classification, and translation, while ChatGPT reached 100 million users two months after launch, according to a cited report.The passage attributes the user figure to The Guardian [9].Source: §1 · p. 1
- Sample-loss behavior changes during training: the inference-to-training-data discrepancy narrows and plateaus, larger models converge faster initially, and material properties affect loss.These observations make a single loss criterion difficult to apply across different training corpora.Source: §1 · p. 2
- Inference outcomes on copyrighted material alone do not conclusively establish prior training, so the authors propose simultaneous fine-tuning with baseline and target datasets.The introduction notes that distinct target materials can yield different inference results even for the same LLM.Source: §1 · p. 2
- Digger compares sample losses across baseline and reference LLMs to identify familiar versus new content, then calibrates the original model’s loss distribution to estimate inclusion confidence.The framework uses a loss gap observed during copyright-detection fine-tuning.Source: §1 · p. 2
- 84.750% accuracy and 92.428% recall on GPT2-XL in prepared settings; Digger also returned affirmative results for notable quotes in GPT2-XL and LLaMA-7b.The authors report testing in controlled environments with established labels and real-world scenarios.Source: §1 · p. 2
- The paper frames potential copyright infringement in LLM training as a research question and presents Digger as a way to identify particular training constituents.The authors describe controlled and real-world testing as evidence for the framework’s robustness and efficacy.Source: §1 · p. 2
2 BACKGROUND
The background describes legal, ethical, and technical complexities around training generative AI on copyrighted works. It also notes that legal and technological mitigations face practical challenges.
2 BACKGROUND
- Generative models may produce material resembling copyrighted works, making the relationship between outputs and original works difficult to delineate and raising legal and ethical concerns.The passage cites Getty Images’ case involving Stability AI as a high-profile example of legal risk.Source: §2 · p. 3
- Legal mitigations such as consent or licensing involve complex negotiations, while technological alternatives require substantial investment and may not capture the richness of human-created content.The passage also identifies ethical concerns such as cultural appropriation and commodification.Source: §2 · p. 3
- The paper investigates copyrighted content internalized by LLMs and how models transform or potentially infringe upon it.Source: §2 · p. 3
3 CHARACTERISTIC STUDY
The characteristic study examines whether sample-loss behavior can distinguish material an LLM has learned from material it has not. Digger’s experiments find that discrimination improves with model size, repeated exposure, and longer test samples, while a universal loss threshold remains elusive.
3 CHARACTERISTIC STUDY
- The characteristic study tests whether prompted reproduction of training text signals prior exposure and examines sample loss as an indicator of learned material.Its premise is that training-set instances generally have lower sample loss than non-training instances.Source: §3 · pp. 3–4
3.1 RQ1: Impact of Fine-tuning
- Repeated exposure lowers sample loss, with the rate of loss reduction tapering; GPT2-XL converges fastest among the models analyzed.RQ1 fine-tuned GPT-2 models on 2023 book passages repeated one, two, or three times.Source: §3.1 · pp. 4–5
3.2 RQ2: Evaluation Metrics Investigation
- The reference LLM is trained on combined learned and unlearned sets, with learned samples repeated and unlearned samples shown once, then both loss distributions are compared using AUC.The experimental setup varies GPT-2 model size, training repetitions, and test-sample length.Source: §3.2 · pp. 5–6
- AUC ranged from 0.67318 for GPT-2 with once-repeated training samples and 50-token tests to 0.99995 for XL with thrice-repeated samples and 100-token tests.The study also reports that larger models, more repetitions, and longer test samples generally improve AUC, but model structure and training content make a universal loss threshold elusive.Source: §3.2 · p. 7
4 METHODOLOGY
Digger estimates whether target material appeared in an LLM’s training by comparing loss distributions across prepared models. Its workflow has preparation, simulation, and confidence-calculation phases.
4 METHODOLOGY
- The framework has three phases: preparation, simulation experiment, and confidence calculation, with different LLM colors indicating fine-tuning on different datasets.The confidence score is based on target-sample loss differences over the baseline and reference models.Source: §4 · pp. 7–8, Figure 3 · p. 8
4.1 Training phase
- Digger prepares baseline and reference LLMs, then fine-tunes both the vanilla and reference models on the target dataset with equal amounts of unlearned data.The foundational dataset is used to establish the baseline; the reference model is further trained on that dataset and unlearned data.Source: §4.1 · pp. 8–9
4.2 Simulation Experiment Phase
- The simulation phase compares loss distributions after fine-tuning, using a reference-dataset paradigm to address differences tied to the foundational dataset.The phase examines how distributions change when models encounter an unfamiliar target dataset, despite the absence of target labels.Source: §4.2 · p. 9
4.3 Confidence Calculation
- Confidence calculation measures divergence between reference-tuned and vanilla-tuned loss distributions with Wasserstein distance, then calibrates a standard reference distribution for membership inference.The calibrated distribution supports a loss threshold selected for an acceptable false-positive rate.Source: §4.3 · pp. 9–10
5 EVALUATION
Digger is evaluated in controlled settings with known sample exposure and on real-world literary excerpts for GPT2-XL and LLaMA-7b. The experiments compare loss distributions and use them to classify samples or estimate their training-set membership.
5 EVALUATION
- The evaluation asks whether samples belong to a vanilla LLM’s training set and whether Digger works on real-world LLMs without labels.The controlled evaluation precedes the real-world application.Source: §5 · p. 10
5.1.1 Building Datasets.
- The dataset setup draws on 120 novels and separates baseline, unlearned, target, and second unlearned datasets; target versions contain seen, unseen, or mixed novels.Real-world evaluation also uses 500 excerpts sourced from Goodreads, while another evaluation set contains 500 internet-sourced poetry segments and literary excerpts.Source: §5.1.1 · p. 10, §5.2 · p. 13
5.2 RQ3: The performance in the experimental environment
- The controlled evaluation uses target sets that are fully seen, fully unseen, or evenly mixed, with loss-distribution comparisons varying according to the target set.Figure 4 presents the distribution curves for the comparative experiments.Source: §5.2 · p. 11, Figure 4 · p. 12
- When the target set contains only seen samples, vanilla-tuned loss distributions distinguish them from unlearned samples with an AUC of 0.947, but the distributions overlap for exclusively unseen targets.The gap narrows as the proportion of unseen samples increases.Source: §5.2 · p. 11
- Reference-tuned distributions are less separated than vanilla-tuned distributions, while target distributions shift left relative to unlearned samples as unseen content increases.The controlled evaluation keeps the baseline loss distribution invariant across the three exposure conditions.Source: §5.2 · p. 11
- 0.912 AUC was achieved in the mixed seen-and-unseen control experiment; at 25% FPR, accuracy and F1 began to wane.At 5% FPR, the reported threshold was 0.460, with 69.857% accuracy and 59.733% F1.Source: §5.2 · p. 12, Table 2 · p. 13
- At 20% FPR, accuracy and F1 peaked at 84.750% and 85.442%, respectively, in the controlled evaluation’s summary of results.The evaluation also reports confidence-interval counts for single-type target sets.Source: §5.2 · p. 13
- The 500 poetry segments and literary excerpts were reported as likely to be included in the training data of GPT2-XL and LLaMA-7b.The real-world evaluation estimated sample membership from patterns in the “Actual comparison” loss distributions.Source: §5.2 · pp. 13, 15
6 DISCUSSION
The discussion identifies substantial compute and storage costs and an empirical distributional assumption in target-probability calculation.
6 DISCUSSION
- Digger requires repeated fine-tuning and inference on many unlearned samples, increasing compute and storage costs; the study focuses primarily on small-to-medium LLMs.The authors describe improving detection efficiency as future work and say the costs do not substantially compromise meaningful results in their study.Source: §6 · p. 15
- Target-probability calculation assumes the loss-difference distribution for unlearned samples is normal; kernel density estimation remains an alternative under investigation.The authors identify comparing the two approaches as a focus for future experiments.Source: §6 · p. 16
7 THREATS TO VALIDITY
The study’s validation is constrained by unverified training-set labels and a narrow selection of models. Its confidence calculation and legal framing also limit how broadly results can be generalized.
7.1 Internal Threats
- The study uses web-sourced likely candidates because GPT-2 and LLaMA training contents lack verified labels, preventing direct validation.The authors also note that focusing on GPT-2 and LLaMA-7b may miss a broader extent of copyright issues in larger models.Source: §7.1 · pp. 16–17
7.2 External Threats
- Normal-distribution fitting is only one confidence-estimation method, and the study’s specific legal framework may not apply globally.The authors describe the detection technique as orthogonal to the legal-context issue.Source: §7.2 · p. 17
8 RELATED WORK
Prior work examines how LLMs reproduce training information and how sample membership can be inferred from model losses. The paper situates its copyright-detection approach against these lines of research.
8.1 Sensitive Information Analysis for LLMs
8.2 Member Inference Attacks Against LLMs
- Member inference tests whether a sample was in a target LLM’s training data, but sample-loss thresholds can misclassify examples because of content complexity [15].Earlier approaches used target-model sample losses and thresholds [22] [23] [29].Source: §8.2 · p. 17
9 CONCLUSION
Digger uses changes in sample loss to distinguish material learned by a target LLM from material not learned. Experiments demonstrate effective identification, using differences between reference and vanilla model distributions for classification.
9 CONCLUSION
- Digger formulates the difference in sample-loss change as an indicator of whether the LLM learned a sample.The framework is introduced as a universal optimization approach informed by a study of sample loss and its rate of change.Source: §9 · pp. 17–18
- Differences between reference-LLM and vanilla-LLM test-sample loss distributions refine a baseline distribution used for classification.The baseline distribution is established through experiments on a vanilla LLM.Source: §9 · p. 18
- Extensive experiments demonstrate that Digger effectively identifies samples learned by a target LLM.The authors present differences in sample-loss change as a promising way to investigate copyrighted novels learned by LLMs.Source: §9 · p. 18
A APPENDIX
The appendix includes a table of five books published in 2023, selected in Section 3.1, with genre information.
A APPENDIX
- The table lists five books published in 2023.The books were selected in Section 3.1.Source: Table 9 · p. 19
- The listed books are the selection made in Section 3.1.Source: Table 9 · p. 19
- The table provides genre information for the five books.Source: Table 9 · p. 19