Source-linked AI summary
SynthSentry: Detecting Synthetic Data Contamination in Language Model Training Data
Praveen Kumar Myakala, Ravichandra Namburi, Sowmya Keragodu Jayaramu, Sooraj George Thomas
TL;DR
Recursive training on generated text can erode distributional tails and factual accuracy while fluency persists, creating a need to identify contamination before training. SynthSentry combines three corpus-level statistics into a score against a reference distribution. It ranks contamination severity, although its composites do not outperform lexical diversity alone in the reported hand-authored degenerate-text setting.
Problem
Recursive training on generated text can contract distributional tails and lexical diversity, while fluent output may persist after factual accuracy starts falling.
Source: §I · p. 1Method
SynthSentry derives a corpus-level score from three statistics measuring lexical diversity, n-gram tail truncation, and cross-model perplexity variance.
Source: §I · p. 1, §IV · p. 3Results
All three single features and both composites track severity, but lexical diversity ranks highest at 0.969, ahead of the uniform composite at 0.952 and Eq. (1) at 0.930.
Source: A. Severity Ranking and Predictive Power · p. 7Takeaways & Limitations
Per-feature attribution lets curators identify which mechanism triggered a flag, and the toolkit records screening decisions and calibration details.
Source: §VIII · p. 9The contamination sources are single-generation or hand-authored, so the study does not show whether the score tracks recursion depth.
Source: §VIII · p. 9
Abstract
from arXiv · showhide
Large language models trained recursively on their own or other models' outputs undergo model collapse, in which distributional tails and factual accuracy deteriorate while fluency survives. Prior work diagnoses collapse after training; the actionable problem is screening a corpus of unknown provenance before training. We introduce SynthSentry, a corpus-level, model-agnostic contamination signal requiring no access to the generating model, no generation history, and no synthetic labels. The score is a distributional divergence over three statistics: lexical diversity collapse, n-gram tail truncation, and perplexity variance across reference models. We evaluate on corpora contaminated by small open-weight generators and an instruction-tuned open-weight model under a leave-one-generator-out protocol. A domain-stratified study measures false positives on naturally repetitive human text (legal, clinical, source code). The score ranks corpora by severity with little loss when whole generator families are held out. Per-domain calibration holds near its nominal false-positive budget once covariance shrinkage and a bootstrap threshold replace a naive quantile, which runs four times over budget. A downstream fine-tuning check showed no contamination-driven accuracy deficit at our scale, so whether pruning recovers one remains open; the same run shows over-pruning risk once pruning exceeds the true contamination fraction. We frame screening as a data-curation defense rather than a post-hoc diagnosis and release the scoring toolkit. All results are small-scale; scope is English-language, batch-mode corpus screening. Contamination sources are single-generation or hand-authored rather than recursively generated, so results speak to synthetic contamination generally and not to recursion depth.
I. INTRODUCTION
Recursive training on generated text can erode distributional tails and lexical diversity, while fluency may persist after factual accuracy declines. SynthSentry addresses the different practical problem of screening mixed-origin corpora before training, when provenance labels and generator access may be unavailable.
A. Characterizing Collapse
- Recursive training on generated text contracts distributional tails and lexical diversity, and related analyses report collapse across modalities.Prior work describes loss of rare valid events, narrowing vocabulary, and declining diversity across generations.Source: §I · p. 1, A. Characterizing Collapse · p. 2
I. INTRODUCTION
- Fluency can persist after factual accuracy begins to fall, making contaminated model output appear competent despite worsening factual errors.The introduction argues that inspection alone will not catch this asymmetry and that large web crawls may contain unknown amounts of generated text.Source: §I · p. 1
- Practitioners often face mixed-origin, undocumented corpora and must decide whether to train on them before spending compute.Existing verification, accumulation, and filtering approaches rely on labels, generator access, or other signals practitioners may not have.Source: §I · p. 1
- SynthSentry frames contamination severity as an upstream corpus-provenance measurement computed from text alone.The paper proposes a single interpretable score derived from three statistics and an evaluation protocol holding out entire generator families.Source: §I · p. 1
B. Mitigating Collapse
Prior mitigation methods modify training loops or depend on labels, generator access, or reliable curation, while adjacent work studies provenance fingerprints and drift. SynthSentry instead screens unlabeled corpora at the corpus or shard level using collapse-linked statistics and a clean-text-calibrated threshold.
B. Mitigating Collapse
- Accumulation, reinforcement, correction, and preference-curation methods modify training or generation, generally assuming control of the loop, generator knowledge, or labels.Other work questions whether self-improvement is durable and selects generators for known downstream tasks rather than detecting contamination in an unlabeled corpus.Source: B. Mitigating Collapse · p. 2
C. Provenance, Drift, and Data Curation
- Related provenance and auditing work measures behavioral drift and distributional fingerprints in synthetic corpora.These lines of work motivate operational monitoring but do not themselves specify the screening approach described here.Source: C. Provenance, Drift, and Data Curation · p. 2
D. Zero-Shot Detection of Machine-Generated Text
- Document-level machine-text detectors use likelihood, perturbation, watermark, or learned signals, whereas SynthSentry makes a calibrated corpus-level decision about collapse-linked contamination.Its cross-model perplexity variance is panel-based and combined with two collapse-specific statistics; whether that combination beats an aggregated document-level detector is evaluated as an empirical question.Source: D. Zero-Shot Detection of… · p. 2
III. PROBLEM FORMULATION AND THREAT MODEL
SynthSentry considers an undocumented-origin corpus with only its token sequences observable, and scores its corpus-level features against a reference distribution of uncontaminated text. The design combines three statistics, with explicit assumptions about the scoring panel, reference sample, and aggregation procedure.
III. PROBLEM FORMULATION AND THREAT MODEL
- The threat model gives the curator only token sequences from a corpus of undocumented origin, without generation logs, document labels, or generator-query access.The setting represents web-scale and enterprise curation where human and model-written documents circulate together.Source: §III · p. 2
- The score requires no access to the generator, but its perplexity feature depends on a chosen panel whose robustness to panel changes remains untested.The paper specifies changes in architecture, tokenizer, size, or panel membership as an ablation not yet run.Source: §III · pp. 2–3
- The threat model assumes incidental contamination and a modest pre-generative reference sample; adversarial poisoning and decentralized settings without a central reference are outside scope.The score can be computed locally in federated or multi-tenant settings, but only its parameters need sharing.Source: §III · p. 3
IV. THE SYNTHSENTRY CONTAMINATION SCORE
- SynthSentry maps a corpus to three features and scores its distance from a reference distribution, with multiple features intended to capture competent generated text that preserves fluency and vocabulary breadth.The design separates which statistics respond to generation from how their responses combine into one score.Source: §IV · p. 3
A. Feature Space
- Lexical diversity, n-gram tail truncation, and cross-model perplexity variance target vocabulary contraction, low-frequency mass loss, and scorer agreement, respectively.The perplexity statistic is variance across a panel of three distinct public causal language models, using each document's mean token-level negative log-likelihood truncated to 256 tokens.Source: A. Feature Space · p. 3, Table I · p. 3
- Document features are aggregated with a 10 percent symmetric trimmed mean and standardized against the reference sample before corpus-level scoring.Trimming limits the influence of malformed or boilerplate documents but may attenuate a minority-document tail signal at low mixing ratios, motivating an aggregator ablation.Source: A. Feature Space · p. 3
B. From Heuristic Weighting to a Divergence
SynthSentry replaces hand-chosen feature weights with a Mahalanobis distance from a pre-generative reference distribution. The formulation accounts for feature covariance and motivates empirical rather than naive parametric thresholding at small reference-sample sizes.
B. From Heuristic Weighting to a Divergence
- The contamination score is a Mahalanobis distance of the standardized corpus feature vector from the pre-generative reference mean and covariance.The scoring architecture standardizes three feature axes against a pre-generative reference sample and reduces them to one score with per-feature attribution.Source: B. From Heuristic Weighting to a… · p. 3, Figure 1 · p. 4
- Covariance adjustment accounts for correlated features, while feature-wise variance normalization avoids incompatible units without hand-tuned coefficients.The covariance term prevents correlated lexical-diversity and tail-truncation signals from being double-counted.Source: B. From Heuristic Weighting to a… · p. 3
- A chi-square calibration is conditional on approximately multivariate-normal clean features and population parameters; estimated parameters instead yield a scaled F null distribution.The passage notes that type-token ratio and rank-frequency slope are non-Gaussian by construction.Source: B. From Heuristic Weighting to a… · p. 3
- At small reference-sample sizes, using the chi-square law is anticonservative, so the threshold is taken from an empirical bootstrap.The score also reports feature contributions in a whitened basis, which sum to the squared score and avoid misattributing shared variance across correlated features.Source: B. From Heuristic Weighting to a… · p. 4
V. CALIBRATION AND PRUNING THRESHOLDS
SynthSentry sets screening decisions from clean-reference calibration and applies them at shard granularity when pruning. Although the protocol describes recursive contamination, the reported contamination sources are single-generation or hand-authored, so results do not isolate recursion-depth effects.
A. Reference Fitting and Operating Points
- At n = 15, the unshrunk covariance condition number was 1.44e12, making Ledoit-Wolf shrinkage necessary in this small-sample regime.The passage attributes the ill-conditioning to sample size and feature scale rather than genuine collinearity.Source: A. Reference Fitting and Operating… · pp. 4–5
- Bootstrap thresholds from a disjoint clean calibration pool meet the stated false-positive budget without a distributional assumption.The threshold is calibrated on reference-sized clean samples; the calibration pool is separate from the pool used to fit the reference statistics.Source: A. Reference Fitting and Operating… · pp. 4–5
B. Pruning Rather Than Rejection
- Shard-level pruning removes the highest-scoring shards until the aggregate score falls below τ, using thresholds calibrated at shard granularity.Corpus-sized calibration would over-flag smaller shards because their trimmed-mean features have more sampling variance.Source: B. Pruning Rather Than Rejection · p. 5
A. Contamination Sources
- The specified sources include recursive fine-tuning of sub-billion-parameter open-weight models across depths one through five and single-sampled instruction-tuned models.Clean text comes from pre-generative snapshots.Source: A. Contamination Sources · p. 5
- The protocol specifies recursive generations, but reported contamination sources are single-generation or hand-authored, preventing separation of recursive contamination detection from synthetic-text detection.The instruction-tuned source is not a frontier model, and the recursion ladder has not been run.Source: A. Contamination Sources · p. 5
B. Domain Stratification
The evaluation stratifies human corpora by domain and tests transfer to held-out generator families. It also specifies a fixed-model factual-accuracy check and baseline groups, while noting that external detector baselines have not been run.
B. Domain Stratification
- Legal contracts, clinical documentation, source code, and general-text domains are scored against domain-specific references to test false positives from natural repetitiveness.The study treats low lexical diversity as a property of some human writing, not itself as a contamination marker.Source: B. Domain Stratification · p. 5
C. Leave-One-Generator-Out Protocol
- Each leave-one-generator-out fold excludes the held-out family from the perplexity scoring panel, testing transfer to unseen architectures and tokenizers.The clean-reference calibration has no generator-specific parameter; the supervised classifier baseline is refit per fold.Source: C. Leave-One-Generator-Out Protocol · p. 5
D. Downstream Evaluation and Baselines
- Downstream degradation is assessed by fine-tuning a fixed small model and measuring closed-book factual accuracy with the model, hyperparameters, and evaluation set held constant.The design attributes accuracy differences across conditions to the training corpus rather than the training recipe.Source: D. Downstream Evaluation and Baselines · p. 5
- Baselines include single-feature ablations, a naive uniformly weighted composite, and a label-aware classifier; specified external detector and perplexity-filter comparisons were not run.The supervised classifier is an upper bound rather than a deployment competitor because it consumes contamination labels.Source: D. Downstream Evaluation and Baselines · pp. 5–6
E. Cost of the Scoring Panel
The cross-model perplexity panel dominates screening cost, and a measured two-stage variant reduces that cost but remains expensive on CPU. The section also describes cost amortization opportunities and the reported measurement and reproducibility details.
E. Cost of the Scoring Panel
- The two-stage variant cuts cost by roughly 62 percent by invoking the panel on the 37.6 percent of shards near the threshold, but still takes weeks on CPU.No GPU was available for the measurements, so whether batched GPU inference closes the gap remains open.Source: E. Cost of the Scoring Panel · p. 6
- The first two n-gram features are streaming-pass statistics, enabling a two-stage screen to reserve panel scoring for borderline shards.Existing pretraining perplexity-filter log-likelihoods can serve as a panel member where available.Source: E. Cost of the Scoring Panel · p. 6
- The reported protocol includes reference and corpus sizes, mixing ratios, panel identities and hashes, fold checkpoints, trimming fraction, seeds, and comparative tests.Table III lists the scoring-panel identities and configuration hashes; a footnote defines the hash as a truncated SHA-256 of the serialized configuration.Source: E. Cost of the Scoring Panel · p. 6, Table III · p. 6
- Table II accounts for screening cost against the Section III bar; the three-member panel costs 3,674 to 7,047 CPU-hours per billion tokens on one CPU core.The passage characterizes this unbatched estimate as a naive upper bound and reports that the CPU screen exceeds the bar.Source: Table II · p. 6, E. Cost of the Scoring Panel · p. 6
- Timing used one CPU core, single-threaded, unbatched, one document at a time; run ranges varied roughly 2x, so absolute figures warrant one-significant-figure precision.No GPU was available, and the reported measurements are CPU measurements rather than GPU estimates.Source: E. Cost of the Scoring Panel · p. 6
VII. RESULTS
In this small-scale synthetic check, all three single features and both composites track severity, but the composites do not outperform lexical diversity.
VII. RESULTS
- Table IV omits correlation with downstream factual accuracy and a label-aware supervised upper bound because both remain unmeasured.The ranking check measures association with the known construction mixing ratio, not an observable quantity at screening time.Source: §VII · p. 7, A. Severity Ranking and Predictive Power · p. 7
A. Severity Ranking and Predictive Power
- The synthetic check used 36 instances from 20-document corpora at six mixing ratios; the neural-panel consistency check used a reduced grid of 12 instances.Corpora were sampled from eight hand-authored clean sentences and six repetitive templates; the contamination was not neural-generator output or recursively fine-tuned text.Source: A. Severity Ranking and Predictive Power · p. 7
- 0.969 was the lexical-diversity correlation; the uniform composite reached 0.952 and Eq. (1) reached 0.930, so neither composite beat the strongest single feature.The contamination was hand-authored degenerate text, directly distorting vocabulary and giving lexical diversity an easy target.Source: A. Severity Ranking and Predictive Power · p. 7, Table IV · p. 7
B. Cross-Family Generalization
Generator-family holdout deltas were small and unresolved at this scale; bootstrap calibration stayed near its false-positive budget across domains, unlike naive calibration.
B. Cross-Family Generalization
- Held-out deltas were +0.017 for distilgpt2, +0.031 for opt-125m, −0.080 for pythia-70m, and mechanically 0.000 for SmolLM2.Seed-to-seed spread was 0.05 to 0.15, the same magnitude as the deltas; two seeds cannot distinguish a real effect from noise.Source: B. Cross-Family Generalization · pp. 7–8, Table V · p. 8
C. Domain-Stratified False Positives
- The false-positive study used template-generated domains other than source code, an n-gram proxy, and 15 fit, 100 calibration, and 30 test documents per domain.Results were averaged over three seeds; the authors limit their claim to near-nominal calibration on low-entropy structured text.Source: C. Domain-Stratified False Positives · p. 8
- Naive calibration gave a 0.211 false-positive rate for encyclopedic, legal, and clinical text against a nominal 0.05, barely changing at α = 0.01.The naive threshold used fit-pool quantiles; estimating a 99th percentile from fifteen scores was close to meaningless.Source: Table VI · p. 8, C. Domain-Stratified False Positives · p. 8
- Bootstrap calibration placed every domain between 0.044 and 0.067 at α = 0.05, and between 0.000 and 0.022 at α = 0.01.The reported spread changed from 0.000–0.211 to near the nominal budgets using the same feature vectors and fitted covariance.Source: Table VI · p. 8, C. Domain-Stratified False Positives · p. 8
- Short synthetic notes have mostly unique tokens, including varying vitals numbers, which inflates per-document TTR regardless of the domain’s boilerplate repetitiveness.A corpus-level repetition measure would be needed to capture native lexical diversity in this case.Source: C. Domain-Stratified False Positives · p. 8
D. Pruning and Recovery
In a toy fine-tuning experiment, pruning did not recover an accuracy gap because the unpruned contaminated corpora already supported near-ceiling recall. Pruning beyond the true contamination fraction instead removed genuine fact documents and lowered recall.
D. Pruning and Recovery
- The toy experiment injected eight fictional facts into a small clean pool, mixed contamination at ratio 0.7, and fine-tuned for 40 steps across 37 shards.Contamination came from hand-authored repetitive templates or single-generation SmolLM2-135M-Instruct samples; recall was exact-match on the eight facts.Source: D. Pruning and Recovery · p. 8
- Recall stayed at ceiling through 0.60, then fell at 0.75 to 0.750 for hand-authored and 0.625 for LM-generated contamination.By then, every contamination shard was removed in one arm and all but two in the other.Source: D. Pruning and Recovery · p. 8, Figure 3 · p. 9
- Fixed-step training let the model memorize the facts even at ratio 0.7, so the unpruned corpus showed no deficit for pruning to recover.With 37 short documents, random 64-token blocks repeated facts often enough to reach the loss floor around step 20; pruning beyond the contamination fraction removed fact documents instead.Source: D. Pruning and Recovery · p. 8
VIII. DISCUSSION AND LIMITATIONS
The discussion bounds SynthSentry’s claims by its calibration data, aggregate decision scale, assumptions, and small experiments. It also describes auditability and where screening fits into a data pipeline.
VIII. DISCUSSION AND LIMITATIONS
- Each screening run records its threshold, calibration mode, reference and panel identifiers, shard size, flagged-shard attributions, and approving role.The record is intended to make the threshold policy auditable later.Source: §VIII · p. 9
- The score assumes incidental contamination, requires a pre-generative reference sample, and supports shard-level rather than individual short-document decisions.A knowledgeable adversary could preserve the measured features, while generator decoding changes can erode the perplexity-variance signal and require recalibration.Source: §VIII · p. 9
- No recursive generation was tested: all contamination sources were single-generation or hand-authored, so the score has not been shown to track recursion depth.Measuring the score along a recursion ladder is identified as future work.Source: §VIII · p. 9
- Bootstrap thresholding on a disjoint calibration pool held close to nominal across domains, unlike the naive fit-pool quantile; parametric alternatives were not evaluated.Reference-fit leakage and covariance conditioning at 1.44e12 were fixed, illustrating implementation sensitivity in a small-sample result.Source: §VIII · p. 9
- Experiments were small, with no confidence intervals; differences of a few hundredths in the experimental section remain unresolved.The reported studies included 36 corpus instances for severity ranking, two seeds for generator folds, and 37 shards for pruning.Source: §VIII · p. 9
- Generator independence does not mean model independence: the perplexity feature depends on a specific panel, and panel changes across model properties remain untested.The model-agnostic claim therefore covers the generator only.Source: §VIII · p. 9
- The study is English-only and mostly uses template-generated domain corpora, leaving naturally occurring and necessarily low-diversity human text underrepresented.The authors warn that pruning can narrow topical and demographic coverage, so deployment should track what is removed as well as accuracy recovered.Source: §VIII · p. 9
- The proposed placement is after deduplication and alongside, not instead of, quality filtering; continuous monitoring is suggested because ingest-time scores go stale as corpora grow.How much contamination signal survives aggressive deduplication remains an experiment rather than an assumption.Source: §VIII · p. 9
IX. CONCLUSION
SynthSentry ranks contamination severity, but composite features do not outperform lexical diversity alone in the reported three-feature problem. Calibration results are favorable after shrinkage and bootstrap thresholding, while small holdout results and the pruning test leave important questions unresolved.
IX. CONCLUSION
- Severity ranking works, but three-feature composites do not beat lexical diversity alone on this problem.Source: §IX · p. 9
- Per-domain calibration holds near its budget with shrinkage and a bootstrap threshold, while generator-family holdout deltas are mixed-sign and unresolved with two seeds.Source: §IX · p. 10
- The pruning experiment showed no contamination-driven accuracy deficit to recover, but did show over-pruning risk.Source: §IX · p. 10