PaperlayerView exact revision on arXiv

Source-linked AI summary

Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large Language Models

Jingyang Zhang, Jingwei Sun, Eric Yeats, Yang Ouyang, Martin Kuo, Jianyi Zhang, Hao Frank Yang, Hai Li

arXiv:2404.02936v4cs.CLcs.LG

TL;DR

Pre-training data detection matters for concerns including copyright violations and test-data contamination, yet existing methods often rely on heuristics without solid foundations. Min-K%++ uses a local-maxima insight to assess conditional token probabilities. It improves over reference-free approaches across WikiMIA and MIMIR, with a 6.2% to 10.5% AUROC gain over Min-K% on WikiMIA.

  • Problem

    Pre-training data detection matters for copyright and test-data-contamination concerns, but existing methods are largely heuristic and lack solid, interpretable foundations.

    Source: §1 · pp. 1–2

  • Method

    Min-K%++ uses the insight that maximum-likelihood training tends to make training samples local maxima, then checks whether input tokens are modes or relatively high-probability under conditional categorical distributions.

    Source: §1 · p. 2

  • Results

    Min-K%++ improves over reference-free methods on WikiMIA and MIMIR, with 6.2% to 10.5% absolute AUROC increases over Min-K% on WikiMIA averaged over five models.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The authors present Min-K%++ as a solid baseline for future pre-training data detection research.

    Source: §6 · p. 10

    Rare and difficult-to-learn training texts can challenge all methods and require further research.

    Source: §4.2 · p. 6

Abstract

from arXiv · show

The problem of pre-training data detection for large language models (LLMs) has received growing attention due to its implications in critical issues like copyright violation and test data contamination. Despite improved performance, existing methods (including the state-of-the-art, Min-K%) are mostly developed upon simple heuristics and lack solid, reasonable foundations. In this work, we propose a novel and theoretically motivated methodology for pre-training data detection, named Min-K%++. Specifically, we present a key insight that training samples tend to be local maxima of the modeled distribution along each input dimension through maximum likelihood training, which in turn allow us to insightfully translate the problem into identification of local maxima. Then, we design our method accordingly that works under the discrete distribution modeled by LLMs, whose core idea is to determine whether the input forms a mode or has relatively high probability under the conditional categorical distribution. Empirically, the proposed method achieves new SOTA performance across multiple settings. On the WikiMIA benchmark, Min-K%++ outperforms the runner-up by 6.2% to 10.5% in detection AUROC averaged over five models. On the more challenging MIMIR benchmark, it consistently improves upon reference-free methods while performing on par with reference-based method that requires an extra reference model.

1 INTRODUCTION

The introduction frames pre-training data detection as important amid privacy, copyright, and evaluation concerns, while noting that existing methods lack solid, interpretable foundations. It introduces Min-K%++ through a local-maxima insight and reports improved benchmark performance.

1 INTRODUCTION

  • Large training corpora raise concerns about private-information extraction, copyright violations, and evaluation-data exposure.The introduction notes that large corpora increasingly tend to be proprietary.Source: §1 · p. 1
  • Pre-training data detection infers whether an input was used to train a target LLM, but existing methods rely largely on simple heuristics without solid, interpretable foundations.The paper frames the task as especially challenging compared with conventional membership inference.Source: §1 · pp. 1–2
  • Maximum-likelihood training makes training samples tend to be local maxima along input dimensions, reframing detection as identifying local maxima.For LLMs’ discrete distributions, Min-K%++ checks whether an input token is a mode or has relatively high conditional probability.Source: §1 · p. 2
  • Min-K%++ improves on the runner-up Min-K% by 6.2% to 10.5% absolute AUROC on WikiMIA, and on MIMIR it beats reference-free methods while matching a reference-based method.The method uses a standalone target LLM; experiments also report the best performance in an online detection setting.Source: §1 · p. 2

2 RELATED WORK

Related work connects pre-training data detection to membership inference while emphasizing the distinctive challenges of applying it to LLM pre-training. The paper positions Min-K%++ against early benchmarks and methods, highlighting its local-maximum insight and benchmark performance.

Membership Inference Attacks

  • MIA asks whether an input was used to train a target model and connects to privacy-risk measurement, memorization, privacy auditing, test-set contamination, and copyrighted-content detection.The cited applications include test-set contamination (Oren et al., 2023) and copyrighted contents (Meeus et al., 2023).Source: §2 · pp. 2–3

Pre-training data detection for LLMs

  • Pre-training detection is a challenging MIA setting because pre-training corpora are often nonpublic, LLMs use few epochs at large scale, and many prior methods target fine-tuning.Shadow-model methods can be impractical when the target’s pre-training distribution is unavailable.Source: §2 · p. 3
  • Pre-training detection remains underexplored; Shi et al. (2024) introduced WikiMIA and Min-K%, while Duan et al. (2024) developed MIMIR and analyzed the challenges.The paper says Min-K%++ outperforms Min-K% and existing reference-free methods on both benchmarks.Source: §2 · p. 3

3 BACKGROUND

The background defines pre-training data detection as a thresholded membership-inference task under limited model access. It also summarizes how autoregressive LLMs model token sequences and produce next-token distributions.

Problem statement

  • Pre-training data detection asks whether an input x belongs to the target LLM’s training dataset D, using a score and threshold to produce a binary prediction.The rule assigns training status when s(x; M) ≥ λ and non-training status when s(x; M) < λ.Source: §3 · p. 3
  • Under grey-box access, detection can use only the target model’s loss, logits, and token probabilities; weights and gradients are unavailable.The scoring function is designed to separate training from non-training data.Source: §3 · p. 3

(Auto-regressive) LLMs

  • Autoregressive LLMs factor a token-sequence probability into conditional probabilities and predict each next token from a categorical distribution over the vocabulary.The paper abbreviates the prefix preceding token x_t as x_<t.Source: §3 · p. 3

4 MIN-K%++

Min-K%++ grounds pre-training data detection in the idea that maximum-likelihood training makes training inputs local maxima or near-local maxima along input dimensions. It transfers this idea to LLMs by comparing a target token’s probability with the conditional distribution over candidate tokens, then aggregates low-scoring token sequences for a sentence-level score.

4.1 MOTIVATION & INSIGHT

  • Maximum-likelihood training tends to place training inputs at or near local maxima along each input dimension, reframing detection as identifying such maxima.The paper motivates this interpretation by viewing maximum-likelihood training through score matching.Source: §4.1 · p. 4
  • Figure 2’s pixel perturbations show training images at local likelihood maxima within their vicinity, empirically supporting the continuous-space insight.The test perturbs random pixels and compares the original image’s likelihood with perturbed versions; direct derivative testing was computationally infeasible for the diffusion model.Source: §4.1 · pp. 4–5, Figure 2 · p. 5

4.2 FORMULATING MIN-K%++

  • Min-K%++ treats training-token detection as testing whether a target token is a mode or has relatively high probability under the model’s conditional categorical distribution.Its score compares the target token’s log probability with the expected log probability over candidate tokens.Source: §4.2 · pp. 5–6
  • For a sentence-level score, Min-K%++ averages the k% of token sequences with the minimum scores to estimate the full-text input more robustly.This aggregation follows the premise that LLM training minimizes loss over all sequences in each training text or sentence.Source: §4.2 · p. 5
  • Unlike absolute token-probability scoring, Min-K%++ compares each target token’s log probability with the expected log probability across the vocabulary, helping distinguish inputs with equal target probabilities.In the conceptual example, both target tokens have probability 0.2, but the proposed score is positive in one distribution and negative in the other.Source: §4.2 · p. 6, Figure 3 · p. 6
  • Min-K%++ also calibrates next-token log likelihood using target-model statistics rather than an external reference model.The method uses the conditional mean and standard deviation; the standard deviation provides input-adaptive scaling, described as z-score normalization.Source: §4.2 · pp. 5–7

5 EXPERIMENTS

The experiments evaluate Min-K%++ on WikiMIA and MIMIR across multiple model families, then examine its hyperparameters and score components. The reported results show gains over existing methods, with performance patterns varying by benchmark and model size.

5.1 SETUP

  • For MIMIR, training and non-training texts come from the same dataset, and WikiMIA evaluates timestamp-defined splits in original and paraphrased settings.The experiments also use five model families on WikiMIA and Pythia models on MIMIR.Source: §5.1 · p. 7

5.2 RESULTS

  • 10.5%, 12.3%, and 6.2% are Min-K%++’s average AUROC gains over Min-K% on original WikiMIA inputs of lengths 32, 64, and 128, respectively.Min-K%++ also performs best on average across all paraphrased cases.Source: §5.2 · p. 8, Table 1 · p. 8
  • On Mamba-1.4B, Min-K%++’s AUROC falls only 1.6% between 128- and 64-token inputs, versus a 4.6% decrease for Min-K%.The paper reports that Min-K%++’s advantages also extend across model architectures.Source: §5.2 · p. 8
  • On MIMIR, Min-K%++’s relative AUROC versus Min-K% ranges from –0.2% to +2.8% across Pythia sizes, while remaining competitive with reference-based Ref without an extra model.It achieves new SOTA results among the five reference-free methods; Ref results were selected after trying eight reference LLMs.Source: §5.2 · pp. 8–9, Table 2 · p. 9
  • In the online detect-while-generating setting, Min-K%++ again outperforms existing methods by noticeable margins; only prepended-text-conditioned likelihood is evaluated.Ref, Lowercase, and Neighbor are not practical for this setting because they require repeated model inference.Source: §5.2 · p. 9

5.3 ABLATION STUDY

  • On WikiMIA with LLaMA-13B, Min-K%++ scores 84.8% at its best and 82.1% at its worst across k, a 2.7% variation, compared with Min-K%’s 4.4%.k selects the percentage of minimum-scored token sequences used to compute the final score.Source: §5.3 · p. 9
  • Calibrating raw log probability with μ or σ alone yields performance boosts of 9.3% and 7.0%, respectively; combining both yields a 16.8% improvement.Table 3 decomposes the token-wise score and identifies the final design in its last row.Source: §5.3 · pp. 9–10, Table 3 · p. 10

6 CONCLUSION AND DISCUSSION

Min-K%++ detects pre-training data by checking whether an input forms a mode or has relatively high probability under an LLM’s conditional categorical distribution, motivated by a local-maxima insight about training data. It performs well across two benchmarks and various settings.

6 CONCLUSION AND DISCUSSION

  • Min-K%++ checks whether an input forms a mode or has relatively high probability under the LLM’s conditional categorical distribution.The method is motivated by the observation that training data tends to be a local maximum or near one along input dimensions.Source: §6 · p. 10
  • The method consistently achieves superior performance on two existing benchmarks and in various settings.The authors describe it as a solid baseline for future pre-training data detection studies.Source: §6 · p. 10
  • The authors hope Min-K%++ and its theoretical and empirical analysis will motivate further research on pre-training data detection.Source: §6 · p. 10

A COMPUTATIONAL COMPLEXITY

Min-K%++ computes token-level statistics from one LLM inference pass, then aggregates scores with basic operations. Its execution is as fast as the fastest comparison methods and faster than methods requiring repeated inference.

A COMPUTATIONAL COMPLEXITY

  • The Min-K%++ score standardizes each input token’s log probability using the conditional distribution’s mean and variance, then averages low-ranked token scores.The supplied pseudocode computes the distribution statistics and forms the token score before sorting and aggregating.Source: A COMPUTATIONAL COMPLEXITY · p. 14
  • Min-K%++’s computation is dominated by the one-time LLM inference shared by all methods; its additional algebraic operations have negligible overhead.Source: A COMPUTATIONAL COMPLEXITY · p. 14
  • Min-K%++ is as fast as Loss, Zlib, and Min-K%, while Ref, Lowercase, and Neighbor are significantly slower because they require multiple model forward passes.Source: A COMPUTATIONAL COMPLEXITY · p. 14

B DETAILS OF BENCHMARKS

The benchmark details describe how training and non-training examples are distinguished in WikiMIA and MIMIR, and how the evaluated models relate to those data splits.

B DETAILS OF BENCHMARKS

  • In WikiMIA, training texts are wiki articles from before 2017, while non-training texts are wiki events after 2023.Source: B DETAILS OF BENCHMARKS · p. 14
  • The WikiMIA dates place non-training texts after the training exposure periods described for the evaluated models.Pile-trained Pythia, GPT-NeoX, OPT, and Mamba models used a corpus released in January 2021; LLaMA models trained on Wikipedia dumps no later than August 2022.Source: B DETAILS OF BENCHMARKS · p. 14
  • MIMIR labels training and non-training texts using the Pile train-test split and evaluates Pythia models trained on the training split.Source: B DETAILS OF BENCHMARKS · p. 14

C AN ONLINE DETECTION SETTING

The online setting evaluates training-data detection on chunks of mixed training and non-training text. Min-K%++ remains the most reliable method there, although scores are lower than in offline evaluation.

C AN ONLINE DETECTION SETTING

  • The proposed online use is to detect memorized training text during generation and let the model refrain from further generation.The motivating scenario is that generated text begins emitting memorized copyrighted or private information.Source: C AN ONLINE DETECTION SETTING · pp. 14–15
  • The online benchmark concatenates a non-training text with a training text and evaluates predictions on 32-token chunks.The texts have random lengths of 32, 64, or 128 tokens, and the chunking simulates a non-overlapping sliding window.Source: C AN ONLINE DETECTION SETTING · p. 15
  • Min-K%++ remains the most reliable method in online detection, where results are lower than in the conventional offline setting.The online evaluation uses log p(x_t|x_<t, y), with y as prepended text, rather than the exact log p(x_t|x_<t).Source: C AN ONLINE DETECTION SETTING · p. 15

D ADDITIONAL RESULTS

The additional-results tables document WikiMIA AUROC and low-FPR results across original and paraphrased settings, plus low-FPR MIMIR results and online LLaMA AUROC.

D ADDITIONAL RESULTS

Loading 2404.02936v4…