Detecting Pretraining Data from Large Language Models

🎯 Pitch

A simple, reference-free method can detect whether a text was used to train a large language model by just looking at the model's token probabilities—the trick is to focus on the few tokens the model finds most surprising. The approach even reveals that GPT-3 appears to have memorized substantial portions of copyrighted books, with nearly 90% of tested excerpts showing over 50% contamination.

1. Executive Summary

This paper introduces a method for detecting whether a piece of text was included in a large language model's pretraining data, using only black-box access to token probabilities. The authors construct a dynamic benchmark called WIKIMIA—built from Wikipedia event pages with creation dates that guarantee non-membership for models released before 2023—and evaluate across models including LLaMA, GPT-NeoX, Pythia, and OPT. The core detection mechanism is MIN-K% PROB, which operates on the hypothesis that unseen text contains more outlier tokens with unusually low probabilities than seen text (operationalized by averaging the log-likelihoods of the k% of tokens with minimum probabilities). On WIKIMIA, MIN-K% PROB achieves a 0.72 average AUC—a 7.4% improvement over the best baseline—while a FLOPs-matched analysis using the strongest existing reference-based methods is essentially impossible because pretraining data distributions are unavailable and pretraining shadow models is computationally prohibitive. In three case studies spanning copyrighted book detection (finding that nearly 90% of tested Books3 excerpts show contamination rates above 50% in GPT-3), downstream dataset contamination detection, and privacy auditing of machine unlearning, MIN-K% PROB remains effective, establishing that reference-free membership inference at pretraining scale is feasible precisely when detection difficulty correlates positively with model size, text length, example occurrence frequency, and learning rate.

2. Context and Motivation

The Core Problem: We Cannot Verify What Went Into an LLM's Training Data

The paper addresses a problem that sits at the intersection of transparency, legality, and scientific rigor: given a piece of text and black-box access to a language model, can we determine whether that model was trained on that text? This is formally a membership inference attack (MIA), but applied at a scale and in a regime where traditional MIA methods break down entirely.

The motivation is not merely academic curiosity. The authors identify three specific real-world scenarios where pretraining data detection is urgently needed:

Copyright enforcement. When an LLM can reproduce passages from copyrighted books, as Chang et al. (2023) demonstrated for ChatGPT, the question is not just whether the model can generate the text—it is whether the copyrighted material was ingested during training. Without a detection method, rights holders cannot establish that their work was used without permission, and model developers cannot audit their own pipelines for accidental inclusion of protected content.
Benchmark contamination assessment. If evaluation examples from widely reported benchmarks (MATH, BoolQ, MMLU) leaked into pretraining corpora, then reported performance numbers are inflated, making model comparisons meaningless. Sainz et al. (2023) and Magar & Schwartz (2022) showed that this contamination is plausible given the scale of web-scraped training data, but existing detection methods require access to the pretraining corpus itself—which model developers increasingly refuse to provide.
Privacy auditing of machine unlearning. Regulations like GDPR and CCPA grant individuals the "right to be forgotten," meaning their data must be removable from trained models. Techniques for machine unlearning (Ginart et al., 2019; Bourtoule et al., 2021; Eldan & Russinovich, 2023) claim to erase specific content from models, but without a detection method, there is no way to verify that the erasure actually succeeded. The paper explicitly uses MIN-K% PROB to audit a model that supposedly "unlearned" Harry Potter books, and finds evidence that memorized content persists.

The problem is not just practical—it is foundational. As pretraining datasets grow to trillions of tokens and model developers become increasingly secretive (the paper cites GPT-4 and LLaMA 2 as examples of models with undisclosed training data), the scientific community loses the ability to independently verify claims about what a model has or has not seen. This undermines reproducibility, fairness, and accountability.

Why Existing Methods Fail for Pretraining

Membership inference attacks have a substantial history in machine learning, originally proposed by Shokri et al. (2016) for tabular and image data. In NLP, MIA research has focused almost exclusively on fine-tuning data detection—given a model that was fine-tuned on a relatively small dataset for multiple epochs, can we determine whether a specific example was in that fine-tuning set? The paper identifies two reasons why these methods do not transfer to pretraining:

Challenge 1: The pretraining data distribution is unavailable. State-of-the-art MIA methods for fine-tuning, such as those by Carlini et al. (2022) and Watson et al. (2022), rely on reference models. The detector computes the target model's loss (or probability) on a candidate example, then compares it to a reference model's loss on the same example. The reference model is trained on shadow data sampled from the same distribution as the target model's training data, but guaranteed not to contain the candidate example. This calibration is essential because it controls for the background difficulty of the example: a low-probability sentence might indicate non-membership (the model never saw it), or it might simply be a genuinely difficult sentence that even an identically-trained model would assign low probability to. The reference model disentangles these two explanations.

For pretraining, this calibration strategy collapses for two reasons. First, the underlying data distribution $\mathcal{D}$ from which pretraining corpora are sampled is typically not disclosed—model developers do not release their data collection pipelines, source lists, or filtering criteria. Second, even if $\mathcal{D}$ were available, pretraining a reference model on shadow data from that distribution would be prohibitively expensive, requiring training a model of comparable scale to the target just to perform detection. The paper is explicit about this constraint:

"This is not possible for large language models, as the training distribution is usually not available and training would be too expensive."

Challenge 2: Pretraining detection is inherently harder. Fine-tuning typically runs for multiple epochs over a small dataset (thousands to millions of examples), meaning each example is seen repeatedly and the model has ample opportunity to memorize idiosyncratic patterns. Pretraining, by contrast, exposes each example only once (or, in some pipelines, a small number of times if deduplication is imperfect), and the dataset is enormous (trillions of tokens). This drastically reduces memorization—the primary signal that MIAs exploit. The paper formalizes this in Section 2.1 by citing theoretical bounds from Hardt et al. (2016) and Bassily et al. (2020): the total variation distance between the model's output on a training example $z$ and a non-training example $y$ (which determines how distinguishable they are) is bounded by a quantity proportional to the occurrence frequency of the example, the learning rate, and the inverse of dataset size. This means:

Larger datasets make detection harder (more data to "blend in" with).
Lower learning rates make detection harder (less aggressive memorization per step).
Single-epoch training makes detection harder (one exposure rather than many).

The paper provides empirical validation of these theoretical predictions in Section 6.2 (Figure 5), confirming that detection difficulty scales with all three factors.

The Landscape of Prior Detection Approaches

The paper categorizes existing methods into two groups and explains why neither is sufficient:

Reference-based methods (Carlini et al., 2021; Watson et al., 2022; Mattern et al., 2023) require a shadow model trained on data from the same distribution as the target. These are effective for fine-tuning—Carlini et al. (2022) achieved strong results on small-scale LM fine-tuning—but dead-on-arrival for pretraining due to the inaccessibility of $\mathcal{D}$ and the cost of shadow pretraining. The paper includes these as baselines (e.g., "Smaller Ref" in Table 1) but notes they require special accommodations: they use a smaller model from the same family (e.g., LLaMA-7B as the reference for LLaMA-65B), which is only possible because these open-source models were trained on known data—a luxury not available for proprietary models like GPT-3.

Reference-free methods attempt detection without a shadow model. The baselines the paper considers (Section 4.2) represent the state of this approach:

LOSS Attack / PPL (Yeom et al., 2018a): Thresholds on the model's perplexity of the example. Lower perplexity suggests membership. This is the simplest baseline and, as the paper shows, the strongest among existing reference-free methods, achieving 0.67 average AUC on WIKIMIA.
Zlib entropy ratio (Carlini et al., 2021): Compares the model's perplexity to the compression entropy of the text under zlib. The intuition is that memorized text should have unusually low perplexity relative to its information-theoretic complexity.
Lowercase ratio (Carlini et al., 2021): Compares the model's perplexity on the original example to its perplexity on a lowercased version. The idea is that training data is typically cased, so a model should be more surprised by uncased text if the original was memorized.
Neighborhood attack / DetectGPT (Mattern et al., 2023; Mitchell et al., 2023): Compares the log probability of the original text to the log probabilities of slightly perturbed (paraphrased) versions. The hypothesis is that the probability function is locally curved around memorized examples (high probability, steep drop-off under perturbation), while non-memorized examples sit in flatter regions of probability space.

The paper notes that all of these are sentence-level methods—they compute a single score for the entire input—whereas MIN-K% PROB operates at the token level by selectively focusing on the lowest-probability tokens.

Where This Paper Position Itself

The paper's central claim is not that MIN-K% PROB is a universally superior MIA method, but rather that reference-free, token-level detection is both feasible and substantially more effective than existing reference-free approaches at pretraining scale. The authors position their work as filling a methodological gap: the MIA community has developed sophisticated tools for fine-tuning, and the dataset contamination community has developed heuristics for detecting leaked benchmarks, but no method existed that could perform instance-level pretraining data detection without access to the pretraining corpus or a shadow model.

The paper makes this positioning explicit in the related work discussion (Section 8):

"Our work focuses on the application of MIA to pretraining data detection, an area that has received limited attention in previous research efforts."

The existing contamination detection methods they cite (Brown et al., 2020b; Wei et al., 2022; Du et al., 2022; Chowdhery et al., 2022) all require access to the pretraining corpus to check for n-gram overlaps—a requirement that is "largely unavailable for recent model releases." The prompting-based methods (Sainz et al., 2023; Golchin & Surdeanu, 2023) can extract memorized content but cannot determine contamination on an instance level—they can show that a model can generate test-set examples, but not that a specific example was in the training data.

MIN-K% PROB is thus positioned as a practical tool for a regime that was previously unaddressed: black-box, reference-free, instance-level detection at pretraining scale. The WIKIMIA benchmark is positioned as the infrastructure that makes systematic evaluation in this regime possible, with its key innovation being the use of temporal information (event creation dates) to construct ground-truth non-member data guaranteed to be absent from models pretrained before a cutoff date.

The paper is careful not to overclaim. It does not argue that MIN-K% PROB replaces reference-based methods in settings where reference models are available (the "Smaller Ref" baseline in Table 1 sometimes approaches MIN-K% PROB's performance, e.g., on LLaMA-65B). Rather, it argues that reference-based methods are impractical for pretraining, and MIN-K% PROB is the best practical alternative. The three case studies (copyright detection, contamination detection, unlearning auditing) are designed to demonstrate that this alternative is not merely a benchmark curiosity—it produces actionable findings in real-world scenarios where no other method works.

3. Technical Approach

3.1 Reader Orientation

This paper develops a statistical test for membership—a function that takes a piece of text and a language model, and returns a binary decision about whether that text was in the model's pretraining data. The core insight is that the model's per-token probabilities encode a detectable signature: tokens in unseen text are more likely to include a small number of surprisingly low-probability words (outliers that the model never learned to anticipate), while every token in seen text tends to stay within a higher-probability range because the model was optimized to predict them.

3.2 Big-Picture Architecture

The detection system has three components, executed in sequence:

Token probability extraction: Given a candidate text and black-box API access to the target LLM, query the model to obtain the log-probability of each token in the text conditioned on all preceding tokens. This requires no model weights and no training—only the ability to compute log p(x_i | x_1, ..., x_{i-1}) via the model's standard forward pass.
Outlier token selection (MIN-K% PROB): Identify the k% of tokens with the lowest probabilities (most negative log-likelihoods). These are the "surprising" tokens that the model did not expect. Compute the average of their log-likelihoods. This single scalar is the detection score.
Thresholding: Compare the MIN-K% PROB score to a pre-determined threshold ϵ. If the score falls below ϵ (meaning the outlier tokens are too improbable—the model is too surprised), classify the text as non-member (not in pretraining data). If the score is above ϵ (the outliers are not that surprising), classify it as member (in pretraining data).

None of these components requires knowledge of the pretraining corpus, access to model weights, or additional training. The system operates entirely through black-box queries.

3.3 Roadmap for the Deep Dive

First, the formal definition of the problem and its unique constraints relative to standard MIA: This establishes the mathematical setting and why reference-based approaches are excluded by assumption, which is the key constraint that motivates the entire design.
Second, the WIKIMIA benchmark construction pipeline: Understanding the evaluation framework is prerequisite to understanding why the method is designed the way it is—the benchmark provides the ground-truth labels and the evaluation protocol that drive all design decisions.
Third, the MIN-K% PROB mechanism in full detail: This is the core contribution. I explain the hypothesis, the token-level computation, the choice of k, the aggregation, and why this particular statistic captures the intended signal.
Fourth, the relationship between detection difficulty and controllable factors: The paper's theoretical framing (Section 2.1) and ablation studies (Section 6.2) reveal how dataset size, occurrence frequency, and learning rate modulate detectability—this is essential for understanding when the method works and why.

3.4 Detailed, Sentence-Based Technical Breakdown

This is primarily a methodological paper with an empirical evaluation: it proposes a new membership inference statistic (MIN-K% PROB) and a benchmark (WIKIMIA) for evaluating pretraining data detection, then systematically validates both against baselines and in three real-world case studies. The intellectual contribution is not a complex architecture but a specific hypothesis about the distribution of token probabilities in seen versus unseen text, operationalized as a simple computation that can be performed with black-box API access.

Formal Problem Definition and the Reference-Exclusion Constraint

The paper begins (Section 2.1) by situating itself within the standard membership inference attack (MIA) framework, then specifies the constraint that makes this setting novel.

Standard MIA definition. Let $f_\theta$ be a language model with parameters $\theta$ , and let $D = \{z_i\}_{i \in [n]}$ be its pretraining dataset, sampled from an underlying distribution $\mathcal{D}$ . A membership inference detector is a function:

$h(x, f_\theta) \to \{0, 1\}$

where $x$ is an arbitrary data point (a sequence of text) and the output is $1$ if $x \in D$ (member) and $0$ otherwise (non-member). The detector is assumed to have black-box access to $f_\theta$ : it can query the model for output probabilities on any input $x$ , but cannot inspect weights, gradients, or training data.

What it represents: This is the standard cryptographic-style formalization of a security attack: the adversary (detector) has query access to a target system and must infer a hidden property (membership) from the system's responses alone.

The critical constraint: no access to $\mathcal{D}$ and no reference model. The paper then departs from standard MIA practice by imposing an additional restriction: the detector has no access to the pretraining data distribution $\mathcal{D}$ . This means:

The detector cannot sample from $\mathcal{D}$ to construct shadow training data.
The detector cannot train a reference model $g_\gamma$ on shadow data to calibrate $f_\theta$ 's outputs.
The detector has no auxiliary model trained on similar data at any scale.

This restriction is not arbitrary—it mirrors the real-world deployment scenario for proprietary LLMs:

"the assumption of accessing the distribution of pretraining training data is not realistic because such information is not always available (e.g., not released by model developers)"

Even if $\mathcal{D}$ were known, "pretraining a reference model on it would be extremely computationally expensive given the incredible scale of pretraining data."

Consequence for detector design. The detector's functional form collapses from the standard $h(x, f_\theta, g_\gamma) \to \{0, 1\}$ (which includes a reference model $g_\gamma$ ) to the simpler $h(x, f_\theta) \to \{0, 1\}$ (purely reference-free). This means the detector must internally calibrate for the background difficulty of the example—it cannot rely on a second model to say "this sentence is easy/hard in general." The paper's key insight is that this calibration can be done within a single example by comparing the model's probability on its most surprising tokens to its probability on the rest of the text.

Theoretical motivation for detection difficulty. Section 2.1 also provides the theoretical scaffolding for when detection will be hard or easy. Drawing from Hardt et al. (2016) and Bassily et al. (2020), the paper notes that the total variation distance between the model output distributions on a training example $z$ and a non-training example $y$ is bounded by a quantity proportional to:

The occurrence frequency of $x$ in $D$ (more repetitions $\to$ easier detection)
The learning rate used during training (higher learning rate $\to$ easier detection)
The inverse of dataset size $1/|D|$ (larger dataset $\to$ harder detection, because the model's parameters move less per example)

This theoretical bound is not used to compute anything directly. Instead, it provides the hypothesis space for the paper's ablation studies in Section 6.2: the authors expect that detection AUC will increase with occurrence frequency and learning rate, and will decrease with dataset size (for in-distribution examples). The empirical results largely confirm these predictions, with one important exception discussed later (outlier contaminants become easier to detect as dataset size increases, because they stand out more).

The WIKIMIA Benchmark: Construction and Properties

The benchmark is the evaluation infrastructure for the entire paper. Its design is driven by the need for ground-truth labels without access to the actual pretraining data.

Core construction principle: temporal separation. The key idea is to exploit the fact that Wikipedia pages have creation timestamps, and LLM pretraining has a known cutoff date. Any Wikipedia page created after the model's training data was collected is guaranteed to be absent from pretraining. By collecting recent event pages (created after a chosen cutoff date) as non-member data and older event pages as member data, the benchmark obtains ground-truth labels without ever inspecting the model's actual pretraining corpus.

Step 1: Select non-member data (guaranteed unseen). The authors set January 1, 2023 as the cutoff date. They use the Wikipedia API to automatically retrieve articles that satisfy two conditions simultaneously:

The article belongs to the Wikipedia event category (it describes a specific occurrence in the world, not a concept or entity).
The page was created after January 1, 2023 (the event did not exist in Wikipedia during any earlier period).

This double condition is crucial, and the paper is explicit about why (Appendix B). A Wikipedia page created after 2023 that describes a non-event entity (e.g., a historical figure, a scientific concept) could contain text that overlaps substantially with an older version of the same page that existed during pretraining. The event restriction ensures that the text is genuinely new: "events that occur after LLM pretraining are guaranteed not to be present in the pretraining data. The temporal nature of events ensures that non-member data is indeed unseen and not mentioned in the pretraining data."

Step 2: Select member data (likely seen). For member data, the authors collect Wikipedia articles created before 2017. This cutoff is chosen because many widely-used pretrained models (LLaMA, GPT-NeoX, OPT, Pythia) were released after 2017 and are known to incorporate Wikipedia dumps in their pretraining data. The 2017 cutoff provides a margin—articles created four years before the earliest model release are extremely likely to have been included in any Wikipedia-based pretraining corpus.

Step 3: Filter meaningful text. The authors filter out pages that lack substantive prose: pages with titles like "Timeline of ..." or "List of ..." are removed because they consist primarily of structured data rather than natural language, which would make token-probability-based detection meaningless.

Final dataset composition. Due to the limited number of newsworthy events since January 2023, the final benchmark contains 394 recent events as non-member data and 394 randomly selected pre-2017 event pages as member data, creating a balanced binary classification task.

Three evaluation settings. The paper defines three distinct evaluation configurations to probe different aspects of detection robustness:

Verbatim (original) setting: The candidate text is exactly the Wikipedia article text as written. This tests whether the model can recognize text that is identical to what it was trained on.
Paraphrase setting: The text is fed through ChatGPT (the paper mentions "ChatGPT²" with a footnote linking to chat.openai.com) to produce a semantically equivalent but lexically different version. This tests whether the detection signal survives surface-form variation—a crucial property for real-world use where copyrighted or contaminated text may appear in reworded form.
Different-length setting: The Wikipedia event text is truncated to fixed token lengths of 32, 64, 128, and 256 tokens. Detection performance is reported separately for each length bucket. This probes the relationship between text length and detectability, which the paper hypothesizes is positive (longer text contains more memorizable information).

Desirable properties claimed by the authors (Appendix B). The benchmark is designed to be:

Accurate: The temporal guarantee means non-member labels are not just "probably correct" but provably correct—no post-2023 event could have been in pretraining data collected before 2023. This eliminates the label noise that plagues synthetic MIA benchmarks where non-member data is sampled from the same distribution as member data.
General: Because Wikipedia is a near-universal pretraining data source (the paper cites OPT, LLaMA, GPT-Neo, and Pythia as confirmed Wikipedia-trained models), the benchmark can be applied to evaluate detection methods on any future model that used Wikipedia.
Dynamic: The data construction pipeline is fully automated: as time passes, new events are created on Wikipedia, and the benchmark can be updated by simply advancing the cutoff date and re-running the collection script. The paper commits to continual updates.

Why events, not general Wikipedia articles? The paper's explicit justification in Appendix B is worth examining. If the benchmark used any Wikipedia page created after 2023 as non-member data, some of those pages might be about topics that existed in earlier Wikipedia versions. For example, a Wikipedia page about a historical figure created in 2024 might contain many paragraphs that were present in a 2020 version of the page under a different title. The model could have seen that text during pretraining even though the specific page is new. Event pages avoid this problem because the event did not occur before the cutoff, so no earlier Wikipedia article could describe it.

Limitations of the benchmark that the paper does not fully discuss. The member data (pre-2017 events) is not guaranteed to be in any particular model's training data—Wikipedia is a large corpus, and any given article might be omitted from a specific scrape or filtered during preprocessing. This means the member labels have some false-positive rate (texts labeled "member" that were actually not seen). However, for evaluation purposes, this noise is conservative: it makes the detection task appear harder than it is, so any positive results (high AUC) are lower bounds on true detection capability.

MIN-K% PROB: The Detection Mechanism

This is the technical core of the paper. The method is grounded in a simple hypothesis about how token-level probabilities differ between seen and unseen text.

The central hypothesis (stated in Section 1 and elaborated in Section 3). An unseen (non-member) text example is likely to contain a small number of outlier words—tokens that the model assigns very low probability (high negative log-likelihood) because it never learned to anticipate them in the given context. A seen (member) text example, by contrast, is less likely to contain such extreme outliers because the model was directly optimized to predict every token during training, pulling all probabilities upward.

The hypothesis does not claim that seen text has uniformly higher token probabilities than unseen text. That would be too crude: many tokens in seen text have moderate probability, and many tokens in unseen text are unremarkable (common words like "the" or punctuation will have high probability regardless of membership). The claim is specifically about the tail of the distribution—the few tokens that are hardest for the model to predict. In unseen text, the tail extends further into low-probability territory. In seen text, the tail is truncated.

Operationalizing the hypothesis as a computation. Given a text $x = x_1, x_2, \ldots, x_N$ consisting of $N$ tokens (subword units, produced by the model's standard tokenizer), the detection procedure has four steps:

Step 1: Extract per-token log-probabilities. For each position $i$ in the sequence, query the model $f_\theta$ to obtain:

$\log p(x_i \mid x_1, \ldots, x_{i-1})$

This is the standard log-probability that a causal language model assigns to token $x_i$ when conditioned on all preceding tokens in the text. It is obtained via a single forward pass through the model: the model processes the entire sequence, and the output logits at position $i-1$ (the prediction for the token at position $i$ ) are softmax-normalized and logged. No additional model calls are needed.

Step 2: Identify the minimum-probability tokens. Sort all $N$ tokens by their log-probability (from most negative to least negative). Select the bottom $k\%$ of tokens—those with the lowest probabilities—to form the set $\text{Min-K\%}(x)$ . Let $E = \lceil k \cdot N / 100 \rceil$ be the size of this set.

Step 3: Compute the average log-likelihood of these outlier tokens. The detection statistic is:

$\text{MIN-K\% PROB}(x) = \frac{1}{E} \sum_{x_i \in \text{Min-K\%}(x)} \log p(x_i \mid x_1, \ldots, x_{i-1})$

where $E$ is the number of tokens in $\text{Min-K\%}(x)$ .

What it computes: take the $k\%$ most surprising tokens according to the model, and average their log-probabilities. The result is a single scalar that captures how extreme the worst predictions are. A higher (less negative) average means the model was not very surprised by even its least-expected tokens, which the hypothesis associates with membership. A lower (more negative) average means the model found some tokens extremely improbable, which the hypothesis associates with non-membership.

Why this form, not full-sequence perplexity: Perplexity (the exponential of average negative log-likelihood over all tokens) dilutes the tail signal. A text with 999 high-probability tokens and 1 very-low-probability token may have perfectly ordinary perplexity, but that one outlier token carries the membership signal. MIN-K% PROB isolates this signal by discarding the bulk of the probability distribution (the well-predicted tokens) and focusing exclusively on the tail. The averaging over $E$ tokens rather than taking the single minimum provides robustness: a single token with artificially low probability due to tokenization artifacts or rare vocabulary does not dominate the statistic, while the general "surprise level" of the hardest fraction of tokens is captured.

Why average, not sum or minimum? A sum over $E$ tokens would grow with sequence length, making comparisons across different-length texts invalid without normalization. The minimum would be maximally sensitive to noise (a single token with probability near zero, which can happen for many reasons unrelated to membership, including tokenization of numbers or non-English text). The average over a fixed proportion of tokens provides a length-normalized statistic—the score is roughly comparable across texts of different lengths because it always represents the typical log-probability of the $k\%$ hardest tokens.

Step 4: Threshold the score. Compare $\text{MIN-K\% PROB}(x)$ to a predetermined threshold $\epsilon$ :

If MIN-K% PROB(x) < ϵ → classify as non-member (too many low-probability outliers)
If MIN-K% PROB(x) ≥ ϵ → classify as member (outliers are not extreme enough)

For evaluation purposes, the paper reports AUC (Area Under the ROC Curve), which measures the separability of member and non-member distributions without committing to a specific threshold. In deployment, the threshold is chosen by maximizing detection accuracy on a held-out validation set with known labels.

Algorithm 1 (Appendix C) provides the pseudocode for this entire process. The paper also notes that the method requires only a single forward pass per text (to extract $N$ conditional log-probabilities), making it computationally efficient: the cost is $O(N)$ forward steps, identical to computing perplexity.

Hyperparameter: choosing k. The percentage $k$ is the single tunable parameter. The paper reports:

"We performed a small sweep over 10, 20, 30, 40, 50 on a held-out validation set using the LLaMA-60B model and found that k = 20 works best. We use this value for all experiments without further tuning."

This means that across all models (Pythia-2.8B through LLaMA-65B), all datasets (WIKIMIA, Books3, downstream tasks), and all text lengths, the same k = 20 is used—a fixed 20% of tokens in any text contribute to the detection statistic. The paper does not report the sensitivity of performance to k beyond stating that 20 was optimal on the validation set, which is a notable omission: if performance degrades sharply for k = 10 or k = 30, then domain-specific tuning might be necessary. The consistency of results across diverse settings with a single k value is evidence that 20% captures a robust signal, but the lack of sensitivity analysis is a limitation.

Why this hypothesis is plausible, and when it might fail. The hypothesis rests on the assumption that pretraining memorization manifests as elevated token probabilities throughout the probability distribution, not just at the mean. For this to hold:

The model must have been trained with a language modeling objective (next-token prediction with cross-entropy loss). This is universally true for autoregressive LLMs.
The training must have been sufficient to partially memorize the text. If the text appeared in a single training epoch with a very small learning rate, the model's parameters may not have moved enough to affect token probabilities detectably.
The unseen text must not consist entirely of common, formulaic language. If a text is composed entirely of high-frequency patterns (e.g., "The cat sat on the mat. The dog ran."), then even an untrained model would assign high probabilities, and there is no tail signal to exploit.

The paper implicitly addresses the second point through the theoretical framing in Section 2.1: detection difficulty increases as occurrence frequency, learning rate, and inverse dataset size decrease, setting bounds on when the hypothesis breaks down.

Comparison to other membership signals. The paper contrasts MIN-K% PROB with existing methods that use entire-sequence statistics:

PPL (Loss Attack): Uses the mean negative log-likelihood over all tokens. This is a special case of MIN-K% PROB with k = 100 (all tokens contribute, not just the tail). The paper's results (Table 1) show that restricting to k = 20 improves AUC from 0.67 to 0.72 on average—a 7.4% relative improvement—indicating that the tail-focused signal is genuinely more informative than the mean.
Zlib / Lowercase / Neighbor: These are all attempts to calibrate the perplexity signal using auxiliary information (compression entropy, casing perturbations, or local probability curvature). The paper's hypothesis implies that these calibration signals are proxies for the same underlying phenomenon that MIN-K% PROB captures directly: how much of the model's uncertainty is concentrated in a small fraction of tokens. By directly measuring that concentration, MIN-K% PROB eliminates the need for the proxy.

Detection Difficulty Factors: Theoretical Framing and Empirical Validation Design

The paper's theoretical contribution is not a novel bound but a framework for interpreting the empirical factors that modulate detection difficulty. This framework (Section 2.1) informs the design of the ablation studies in Section 6.2 and helps explain why MIN-K% PROB works better on some texts and models than others.

The total variation distance bound. The paper cites results from Hardt et al. (2016) and Bassily et al. (2020) establishing that for a model $f_\theta$ trained with stochastic gradient descent, the total variation distance between $f_\theta(z)$ (the model's output distribution when conditioned on a training example $z$ ) and $f_\theta(y)$ (the distribution when conditioned on a non-training example $y$ drawn from $\mathcal{D}$ ) is bounded above by a quantity proportional to:

$\text{TV}(f_\theta(z), f_\theta(y)) \propto \frac{\text{freq}(x) \cdot \eta}{|D|}$

where $\text{freq}(x)$ is the number of times example $x$ appears in the training set, $\eta$ is the learning rate, and $|D|$ is the total number of training examples.

What it computes: an upper bound on how distinguishable a training example is from a random non-training example, based on the model's outputs. If the bound is tight (near zero), the two distributions are effectively identical, and no detector—including MIN-K% PROB—can reliably distinguish them. If the bound is large, the distributions are separable, and detection is possible in principle.

Why this form matters for pretraining detection: this bound explains why pretraining detection is fundamentally harder than fine-tuning detection. In fine-tuning, $|D|$ is small (thousands to millions), training runs for multiple epochs ( $\text{freq}(x) \gg 1$ ), and learning rates are often moderate to high. In pretraining, $|D|$ is enormous (trillions of tokens), $\text{freq}(x) \approx 1$ (single-epoch training with deduplication), and learning rates are carefully tuned for stability. All three factors conspire to make the bound extremely tight, pushing pretraining detection toward the infeasible regime.

The paper's empirical strategy. The three predicted relationships (positive with frequency, positive with learning rate, inverse with dataset size) structure the ablation experiments in Section 6.2. However, the paper does not simply assume these relationships hold—it constructs controlled experiments where each factor is varied in isolation and measures the resulting AUC. The one counterintuitive finding (outlier contaminants become easier to detect as dataset size increases) is explained post-hoc by the long-tail memorization theory of Feldman (2020): when downstream examples are outliers relative to the pretraining distribution, larger pretraining corpora make them more distinctive, increasing the model's tendency to memorize them (since they represent rare patterns not explained by the bulk of the data).

Connection to MIN-K% PROB. These difficulty factors are not directly incorporated into the MIN-K% PROB computation—the method is purely statistical, operating on token probabilities with no knowledge of how the model was trained. Rather, this framework helps predict when MIN-K% PROB will work: on larger models (which memorize more aggressively), on longer texts (which contain more tokens with identifiable tail distributions), on examples that appeared multiple times in training, and on models trained with higher learning rates. The paper confirms these predictions:

Figure 2a: AUC increases with model size (LLaMA 7B $\to$ 65B).
Figure 2b: AUC increases with text length (32 $\to$ 256 tokens).
Figure 5c: AUC increases with occurrence frequency.
Table 4: AUC increases with learning rate (from $10^{-5}$ to $10^{-4}$ ).

For dataset size, the relationship depends on whether contaminants are in-distribution (AUC decreases with size, matching theory) or outliers (AUC increases with size, explained by long-tail memorization), as shown in Figures 5a and 5b respectively.

Summary of Design Choices and Their Justifications

Reference-free design over reference-based calibration: The pretraining data distribution is unknown for proprietary models, and pretraining a shadow reference model is computationally prohibitive. The reference-free approach is a practical necessity, not a methodological preference.
Token-tail statistic over full-sequence perplexity: Perplexity dilutes the signal from the few extreme-probability tokens that carry membership information. MIN-K% PROB isolates these tokens by discarding the well-predicted bulk of the distribution.
Average over the bottom k% rather than the single minimum: A single minimum token probability is overly sensitive to tokenization artifacts and rare vocabulary that can produce spuriously low probabilities on any text. Averaging over a fixed proportion provides robustness while preserving the tail-focused signal.
Fixed k = 20 across all settings: The single validation sweep on LLaMA-65B showed 20% as optimal, and this generalizes across models and datasets. The lack of per-model tuning simplifies deployment but leaves open the question of whether model-specific k could further improve performance.
Event-based temporal separation for benchmark labels: Using Wikipedia event creation dates guarantees that non-member data is genuinely unseen, avoiding the label noise that would arise from using random Wikipedia pages where recent versions might overlap with older content seen during pretraining.
Balanced benchmark (394 members, 394 non-members): Equal class sizes prevent AUC from being inflated by class imbalance and force the detector to be equally sensitive to both error types (false positives and false negatives).
Multiple evaluation settings (verbatim, paraphrase, different-length): These probe distinct robustness properties—surface-form invariance, semantic-level detection, and length-dependence—providing a more complete picture of real-world detector performance than a single aggregate metric.

4. Key Insights and Innovations

Innovation 1: Token-Level Tail Statistics as a Self-Calibrating Membership Signal

The fundamental conceptual move in this paper is the recognition that membership inference at pretraining scale can be performed without a reference model if the detector shifts its focus from whole-sequence statistics to within-sequence tail statistics. This is not merely a new scoring function—it is a reframing of what constitutes a membership signal in the absence of external calibration.

Prior to this work, the dominant paradigm for membership inference—established by Carlini et al. (2021, 2022), Watson et al. (2022), and Mattern et al. (2023)—was to compare a target model's loss on a candidate example to some external baseline. That baseline might be a separately trained reference model (the standard approach), the zlib compression entropy of the text, the perplexity under a smaller model from the same family, or the perplexity on a perturbed version of the example. All of these operate at the level of the entire sequence: compute a single scalar for the whole text (perplexity, loss, or a ratio thereof), then compare it to the baseline scalar. The calibration comes from outside the sequence.

MIN-K% PROB departs from this paradigm by performing calibration within a single sequence. Instead of asking "is this text's overall perplexity lower than a reference model's perplexity?", it asks "is the tail of this text's token probability distribution less extreme than we would expect from unseen text?" The reference baseline is effectively replaced by the bulk of the token distribution—the 80% of tokens that are well-predicted—while the signal is concentrated in the 20% that are worst-predicted. This is a fundamentally different diagnostic concept: membership is not about the overall shape of the probability distribution, but about whether that distribution has a truncated left tail.

The innovation is not that low-probability tokens exist—that is trivially true for any text—but that the systematic difference in tail behavior between seen and unseen text is a reliable membership signature that can be isolated without external calibration. The paper operationalizes this by computing the average log-likelihood of the bottom k% of tokens (Equation 1), but the conceptual move is the idea itself: that within-sequence relative comparisons can substitute for between-model calibration when the detector is allowed to focus on distributional extremes rather than central tendencies.

This reframing resolves the central tension that made pretraining MIA seem infeasible. The field knew that reference-based calibration was the gold standard (Carlini et al., 2022) but also knew that reference models were unavailable for pretraining (Section 2.1). The implicit conclusion was that pretraining MIA was therefore impractical. MIN-K% PROB demonstrates that calibration can be achieved through a different mechanism entirely—one that is internal to the example rather than external to the model. This is a conceptual breakthrough because it defines a new class of reference-free MIA methods that do not sacrifice the calibration principle but rather implement it differently.

The evidence that this reframing works is in Table 1: across five model families, MIN-K% PROB achieves a 0.72 average AUC, a 7.4% relative improvement over the best reference-free baseline (PPL, at 0.67). But the deeper evidence is that it works at all on pretraining data, where single-epoch exposure on trillion-token corpora was thought to leave insufficient memorization signal for reliable detection. Figure 2a and 2b show that the signal is robust enough to scale with model size and text length, suggesting that the tail-based approach captures something fundamental about how memorization manifests in token-level predictions rather than exploiting a brittle artifact.

Innovation 2: WIKIMIA's Temporal Guarantee as a Benchmark Design Principle

The paper's second key innovation is methodological rather than algorithmic: the construction of WIKIMIA using temporal separation to obtain ground-truth non-member labels without access to the pretraining corpus. This is a significant advance in MIA evaluation infrastructure because it solves a problem that had made rigorous benchmarking at pretraining scale essentially impossible.

Before WIKIMIA, evaluating MIA methods on pretraining data faced a fundamental chicken-and-egg problem. To know whether a detection method works, you need ground-truth labels (member vs. non-member). To get ground-truth labels, you need to know what was in the pretraining data. But the whole point of MIA is that the pretraining data is unknown—if you had access to it, you would not need the MIA. Prior work sidestepped this by either (a) training small models on known data where membership is controlled, or (b) using heuristic overlap metrics that require inspecting the pretraining corpus (e.g., n-gram collision checks by Brown et al., 2020b; Wei et al., 2022; Chowdhery et al., 2022). Option (a) does not scale to real pretrained models—the training dynamics differ qualitatively at billion-parameter scale with single-epoch training on web-scale data. Option (b) is circular: it assumes access to the very information that MIA is supposed to infer.

WIKIMIA breaks this circularity through a simple but powerful insight: if you know when a text was created, and you know when the model's training data was collected, creation-after-collection guarantees non-membership. The guarantee requires no access to the pretraining data, no assumptions about the model's training distribution, and no synthetic data generation. It relies only on the causal fact that text that did not exist cannot have been included in pretraining.

The event-based restriction (only Wikipedia articles in the "event" category, not general articles) is a crucial refinement that prevents a subtle failure mode. A Wikipedia article created in 2024 about a historical topic could contain large sections of text that existed in earlier versions of a related article and were therefore present in pretraining data. The event restriction ensures that the content is as temporally bounded as the page: an event that occurred after January 2023 could not have been described in any earlier Wikipedia article, so the text is provably novel. This attention to the distinction between page creation date and content novelty demonstrates a level of benchmark design rigor that was absent from prior MIA evaluation, where non-member data was typically sampled from held-out splits of the same dataset (valid for controlled experiments but not applicable to real pretrained models).

The dynamic property—that the benchmark updates automatically as time passes and new events are added to Wikipedia—is more than a convenience. It means WIKIMIA is future-proof: as new models are released, the benchmark can be regenerated with an appropriate cutoff date, always providing guaranteed unseen data for evaluation. This addresses a persistent problem in security research where defenses and attacks co-evolve and evaluation benchmarks become stale. The paper commits to maintaining this dynamic benchmark, though it does not specify the update frequency or hosting mechanism.

The significance of WIKIMIA extends beyond this paper. By providing a standardized evaluation framework for pretraining data detection, it enables the field to move from qualitative claims ("this method probably works") to quantitative comparison. Without such a benchmark, each paper evaluating pretraining MIA would need to construct its own evaluation data with its own assumptions about membership, making cross-paper comparison impossible. WIKIMIA is positioned to become the standard evaluation protocol for this problem, analogous to how established benchmarks structure progress in other NLP subfields.

Innovation 3: Empirical Characterization of When Detection Works (and When It Doesn't)

The paper's third contribution is a systematic empirical analysis of the boundary conditions for pretraining data detection—the factors that determine whether membership inference succeeds or fails. This is not a theoretical contribution (the bounds from Hardt et al., 2016 and Bassily et al., 2020 were already known, as the paper acknowledges in Section 2.1), but it is a significant empirical contribution because it translates abstract theoretical predictions into concrete, measured relationships in a realistic pretraining setting.

What makes this distinctive is not the existence of the theoretical predictions—prior work had already established that detection difficulty should scale with dataset size, occurrence frequency, and learning rate—but the controlled experimental design that isolates each factor and the counterintuitive finding that complicates the simple theory. The paper does not merely confirm the expected trends; it discovers a reversal that reveals important nuance.

Specifically, Section 6.2 and Figure 5 demonstrate that detection difficulty follows the theoretical predictions only for in-distribution data. When the contaminants are outliers relative to the pretraining distribution (downstream task examples inserted into RedPajama data), the relationship with dataset size reverses: larger pretraining corpora make outlier contaminants easier to detect, not harder (Figure 5a). The paper explains this post-hoc using the long-tail memorization theory of Feldman (2020): outliers are more strongly memorized when they are more distinctive relative to the bulk of the training data. This is not a failure of the theory—the theory bounds total variation distance for any example, not specifically outliers—but it reveals that the simple "larger dataset = harder detection" intuition is incomplete. The dataset size effect depends on whether the example blends in (in-distribution, Figure 5b, where AUC decreases with size as predicted) or stands out (outlier, Figure 5a, where AUC increases with size).

This finding has significant practical implications. It means that pretraining data detection is likely to be most effective precisely where it is most needed: for detecting unique, distinctive content that rights holders care about (copyrighted books, private communications, benchmark test examples) rather than for detecting generic, in-distribution text that no one has a stake in auditing. The Books3 detection case study (Section 5) confirms this: copyrighted literary text is highly distinctive relative to typical web-scraped pretraining data, and MIN-K% PROB achieves an AUC of 0.88 on this task, substantially higher than the 0.72 average on WIKIMIA (which uses Wikipedia articles that are more in-distribution for models trained on Wikipedia).

The learning rate analysis (Table 4) and occurrence frequency analysis (Figure 5c) are more straightforward confirmations of theoretical predictions, but they serve an important function: they validate that MIN-K% PROB is measuring a genuine memorization signal rather than exploiting a spurious artifact. If the detection statistic were simply responding to some property of the text unrelated to training, it would not show the predicted dependence on training hyperparameters. The fact that it does—detection AUC increases nearly linearly with occurrence frequency in the Poisson-distributed duplication experiment, and jumps substantially when the learning rate increases from 10^{-5} to 10^{-4}—is strong evidence that the method is capturing the intended signal.

The model size and text length trends (Figures 2a, 2b) complete the characterization. Both relationships are monotonic and consistent across detection methods (not just MIN-K% PROB), suggesting they reflect fundamental properties of memorization in autoregressive LMs rather than idiosyncrasies of the detection statistic.

Taken together, these findings provide the first comprehensive empirical map of when pretraining data detection is feasible—a prerequisite for deploying such methods in real-world auditing and enforcement scenarios. Without this characterization, a proposed detection method is a black box; with it, practitioners can estimate expected performance based on the known properties of their target model and target text.

Innovation 4: Machine Unlearning Auditing as a MIA Application

The fourth innovation is conceptual rather than technical: the paper demonstrates that membership inference attacks can serve as privacy auditing tools for machine unlearning, not merely as attacks that violate privacy. This reframes MIA from a pure security threat to a dual-use technology with legitimate verification applications.

Prior work on machine unlearning (Ginart et al., 2019; Bourtoule et al., 2021; Eldan & Russinovich, 2023) focused on developing algorithms to remove data from trained models, but the evaluation of these algorithms was typically limited to measuring downstream task performance (does the unlearned model still perform well on general benchmarks?) or qualitative inspection (can the model still generate text about the unlearned topic?). There was no systematic, quantitative method for auditing whether unlearning actually succeeded at the instance level. The paper identifies this gap explicitly and positions MIN-K% PROB as the auditing tool that fills it.

The Harry Potter unlearning case study (Section 7) is the strongest evidence for this innovation's significance. The audited model, LLaMA2-7B-WhoIsHarryPotter, was specifically designed to forget the Harry Potter book series using the technique from Eldan & Russinovich (2023). The paper's auditing reveals that the unlearning was incomplete: MIN-K% PROB identifies 188 suspicious chunks (out of ~1000) where the unlearned model's token probabilities remain similar to the original model's, and of those, story completion experiments find multiple chunks whose auto-completions closely match the original text (scoring ≥4 out of 5 on GPT-4 similarity evaluation). The question-answering experiment shows the unlearned model correctly answering detailed Harry Potter questions (Table 5), with the selected questions (those flagged by MIN-K% PROB) showing nearly 2.5× higher ROUGE-L recall with reference answers than unselected questions (0.23 vs. 0.10).

This is not merely a demonstration that the unlearning was imperfect—it is a demonstration that MIN-K% PROB can identify which specific pieces of content survived the unlearning process. The method does not just say "the model still knows about Harry Potter" (which could be established by simple prompting); it identifies which passages and which facts the model retains, enabling targeted remediation. This transforms MIA from a binary audit (pass/fail on unlearning) to a diagnostic tool that can guide iterative improvement of unlearning algorithms.

The broader significance is that this application establishes MIA as a necessary component of responsible ML deployment in privacy-regulated contexts. GDPR and CCPA grant individuals the right to data deletion, and machine unlearning is the technical mechanism for compliance. Without a reliable auditing method, unlearning claims are unverifiable, and regulatory compliance is essentially trust-based. MIN-K% PROB provides the verification mechanism. This reframes the value proposition of MIA research: it is not just about exposing vulnerabilities but about enabling accountability and compliance verification in deployed systems.

Evaluation Methodology

Dataset. The primary evaluation benchmark is WIKIMIA, constructed by the authors from Wikipedia event pages (Section 2.2). It contains 394 member examples (events from pre-2017 Wikipedia pages, likely included in pretraining data of models released after 2017) and 394 non-member examples (events from post-January 2023 Wikipedia pages, guaranteed absent from pretraining data). The dataset is evaluated in three configurations: verbatim (original text), paraphrase (text rewritten by ChatGPT), and different-length (text truncated to 32, 64, 128, and 256 tokens). For the copyrighted book detection case study (Section 5), the validation set uses 50 books known to be memorized by ChatGPT as positives and 50 new books published in 2023 as negatives, with 100 randomly extracted 512-word snippets per book, yielding 10,000 balanced examples. The test set uses 100 randomly selected books from the Books3 corpus, also with 100 snippets per book. For downstream contamination detection (Section 6), the evaluation uses 200 contaminant (positive) and 200 non-contaminant (negative) examples from each of BoolQ, Commonsense QA, IMDB, and Truthful QA. For machine unlearning auditing (Section 7), the evaluation uses approximately 1000 chunks of 512 words from Harry Potter books 1–4, and 1000 GPT-4-generated Harry Potter questions filtered to 103 suspicious questions using MIN-K% PROB.
Base model(s). The paper evaluates MIN-K% PROB across five model families: LLaMA (7B, 13B, 30B, 65B) (Touvron et al., 2023a), GPT-NeoX-20B (Black et al., 2022), Pythia-2.8B (Biderman et al., 2023), and OPT-66B (Zhang et al., 2022). For the copyrighted book detection case study, the target is GPT-3 (text-davinci-003), accessed via black-box API. For the downstream contamination detection ablation studies, the authors continually pretrain LLaMA-7B on contaminated RedPajama data. For the machine unlearning auditing, the target is LLaMA2-7B-WhoIsHarryPotter (Eldan & Russinovich, 2023), a version of LLaMA2-7B-chat fine-tuned to unlearn Harry Potter content. The model selection spans open-source models with known Wikipedia pretraining (enabling ground-truth validation on WIKIMIA) and a proprietary black-box model (GPT-3), demonstrating the method's applicability across both access regimes.
Metrics. Detection performance is evaluated using two standard MIA metrics (Section 4.1): (1) AUC (Area Under the ROC Curve), which measures the separability of member and non-member distributions across all possible detection thresholds, and is the primary metric reported in most tables; (2) TPR@5%FPR (True Positive Rate at a 5% False Positive Rate), which measures detection sensitivity at a low false-alarm rate, reported in Appendix A (Tables 6 and 7). For the story completion experiment in machine unlearning auditing (Section 7.2.1), the paper uses SimCSE cosine similarity scores (Gao et al., 2021) between generated completions and ground-truth text, and GPT-4-based similarity ratings on a 1–5 scale. For the question-answering experiment (Section 7.2.2), the paper uses ROUGE-L recall (Lin, 2004) between the unlearned model's answers and GPT-4 reference answers.
Baselines. The paper compares MIN-K% PROB against five baseline detection methods, all of which compute a single sequence-level score (Section 4.2): (1) LOSS Attack / PPL (Yeom et al., 2018a): thresholds on the target model's perplexity for the example, where lower perplexity indicates membership. (2) Zlib (Carlini et al., 2021): computes the ratio of the example's perplexity under the target model to its zlib compression entropy, based on the intuition that memorized text should have unusually low perplexity relative to its information-theoretic complexity. (3) Lowercase (Carlini et al., 2021): computes the ratio of the example's perplexity in its original casing to its perplexity when lowercased, exploiting the fact that training data is typically cased. (4) Neighbor (Mattern et al., 2023): uses probability curvature by comparing the log probability of the original text to log probabilities of perturbed versions, identical to the DetectGPT method (Mitchell et al., 2023). (5) Smaller Ref (Carlini et al., 2021): uses a smaller model from the same family trained on the same data as a reference, computing the ratio of the target model's loss to the smaller model's loss. For WIKIMIA experiments, the reference model pairings are: LLaMA-7B for LLaMA-65B and LLaMA-30B, GPT-Neo-125M for GPT-NeoX-20B, OPT-350M for OPT-66B, and Pythia-70M for Pythia-2.8B.
Generation budget / compute accounting. All detection methods require only a single forward pass through the target model per candidate text to extract token-level log-probabilities (Section 3). No additional generation, sampling, or training is performed at detection time. For MIN-K% PROB, the method computes the average log-likelihood over the bottom k% of tokens, requiring exactly the same number of model forward operations as computing perplexity. The only computational overhead relative to the PPL baseline is the sorting operation to identify minimum-probability tokens, which is negligible compared to model inference. In the downstream contamination experiments where models are continually pretrained (Section 6.2), compute is measured in total pretraining tokens seen (0.17M to 26M tokens across dataset size experiments). For the machine unlearning auditing experiments, the detection process queries the unlearned model and the original model (for calibration) on chunks of text, but no additional training is performed.
Cross-validation / statistical protocol. The paper uses a held-out validation set to determine the hyperparameter k (the percentage of minimum-probability tokens) by sweeping over {10, 20, 30, 40, 50} on LLaMA-65B and selecting k = 20 (Section 4.3). This single value is then used for all experiments across all models and datasets without further tuning. For the copyrighted book detection case study (Section 5), the optimal detection threshold ϵ is determined by maximizing accuracy on the held-out validation set of 50 memorized + 50 new books, then applied to the separate test set of 100 Books3 books. The paper does not report cross-validation on the WIKIMIA benchmark itself—AUC is reported as a threshold-independent metric, so no threshold selection is required. For the downstream contamination experiments, the 200 positive and 200 negative examples per dataset serve as the full evaluation set; the paper does not describe a separate validation split. For the machine unlearning auditing (Section 7), the selection of suspicious chunks uses a ratio-based criterion (MIN-K% PROB scores from the unlearned and original models are within a factor of 1.15), and no held-out tuning is performed. The paper does not report confidence intervals or statistical significance tests for any AUC or TPR comparisons.

Main Quantitative Results

Membership Detection on WIKIMIA

The headline result is that MIN-K% PROB achieves an average AUC of 0.72 across five model families and two settings (original and paraphrase), representing a 7.4% improvement over the best reference-free baseline, PPL, which achieves an average AUC of 0.67 (Table 1). This is not simply a marginal gain—the improvement is consistent across every model and setting combination tested, with MIN-K% PROB achieving the highest AUC in 9 out of 10 configurations (the sole exception being LLaMA-65B in the original setting, where Smaller Ref achieves 0.74 versus MIN-K% PROB's 0.74, a tie). The TPR@5%FPR metric in Table 6 shows a similar pattern: MIN-K% PROB achieves an average TPR of 22.2, compared to 20.6 for Zlib and 19.3 for PPL.

Breaking down Table 1 by setting: in the original (verbatim) setting, MIN-K% PROB achieves the highest AUC for 4 out of 5 models—Pythia-2.8B (0.67 vs. 0.65 from Zlib), NeoX-20B (0.76 vs. 0.72 from Zlib), LLaMA-30B (0.74 vs. 0.72 from Zlib/Smaller Ref), and OPT-66B (0.71 vs. 0.67 from Zlib). For LLaMA-65B, MIN-K% PROB (0.74) ties with Smaller Ref (0.74) and exceeds PPL (0.71) and Zlib (0.72). In the paraphrase setting, MIN-K% PROB achieves the highest AUC for all five models, with particularly large margins on NeoX-20B (0.74 vs. 0.70 from PPL) and LLaMA-30B (0.73 vs. 0.70 from PPL). The fact that MIN-K% PROB outperforms in the paraphrase setting is notable because paraphrasing disrupts exact surface-form memorization—the method's token-tail statistic appears to capture a semantic-level signal that survives lexical variation.

The baseline rankings are informative: PPL (simple perplexity thresholding) is consistently the strongest reference-free baseline, with an average AUC of 0.67. Zlib and Neighbor achieve 0.65 on average, Lowercase achieves 0.61, and Smaller Ref—despite being the only reference-based method—achieves only 0.66 on average, statistically indistinguishable from PPL and worse than MIN-K% PROB. The fact that Smaller Ref does not dominate is important: it suggests that even when a smaller reference model from the same family is available (a best-case scenario for reference-based methods that is unavailable for proprietary models), the reference-free MIN-K% PROB is competitive or superior.

Table 6 in Appendix A reports TPR@5%FPR for WIKIMIA. MIN-K% PROB achieves the highest average (22.2) but the pattern is noisier than AUC: Zlib achieves 20.6, PPL achieves 19.3, and Neighbor achieves 17.2. The paraphrase setting shows larger advantages for MIN-K% PROB (e.g., 27.3 on NeoX-20B vs. 24.9 for PPL; 30.9 on LLaMA-65B vs. 23.0 for Zlib and PPL), confirming that the method is particularly robust to surface-form variation.

Analysis: Effect of Model Size and Text Length

Figure 2a plots AUC against model size for LLaMA models (7B, 13B, 30B, 65B) on 128-token WIKIMIA examples. The trend is monotonic and positive: MIN-K% PROB AUC increases from approximately 0.68 at 7B to approximately 0.74 at 65B. This pattern holds for all detection methods—PPL, Zlib, Neighbor, and Lowercase all show increasing AUC with model size—but the slope is steepest for MIN-K% PROB and Zlib. The paper attributes this to larger models having greater capacity to memorize pretraining data, making the token-probability distinction between seen and unseen text more pronounced. This finding has practical implications: detection is more reliable for larger models, which is precisely the regime where transparency concerns are most acute (GPT-3, GPT-4, LLaMA-65B).

Figure 2b plots AUC against text length (32, 64, 128, 256 tokens) for the original setting on LLaMA-65B. The relationship is again monotonic and positive for all methods. MIN-K% PROB AUC increases from approximately 0.57 at 32 tokens to approximately 0.74 at 256 tokens, a gain of roughly 0.17 AUC. PPL shows a similar trend but plateaus earlier, and Neighbor shows a sharper increase from 128 to 256 tokens. The practical implication is clear: detection of short texts (e.g., single sentences or QA pairs) is substantially harder than detection of longer passages (e.g., paragraphs or documents), and the "different-length" evaluation protocol that the paper introduces for WIKIMIA is necessary to surface these differences rather than averaging them away.

Length-Stratified WIKIMIA Performance

The paper reports AUC scores for different text lengths (32, 64, 128, 256) in Table 1 aggregated across lengths, but the length-stratified results are shown in Figure 2b rather than in tabular form. The text states: "our results reveal that data length significantly impacts the difficulty of detection. Intuitively, shorter sentences are harder to detect. Consequently, different data length buckets may lead to varying rankings of MIA methods" (Section 2.2). This motivates the different-length evaluation setting. The paper does not provide a full table of AUC per method per length bucket, which is a notable omission—the figure only shows results for LLaMA-65B, and the interaction between length and method (does MIN-K% PROB's advantage over PPL grow or shrink with length?) is not quantified across models.

Copyrighted Book Detection on GPT-3

Section 5 presents the most striking individual result: on the validation set of 50 known-memorized vs. 50 new (post-2023) books, MIN-K% PROB achieves an AUC of 0.88, compared to 0.84 for PPL, 0.81 for Zlib, 0.80 for Lowercase, and 0.75 for Neighbor (Figure 3). This 0.88 AUC on a completely black-box model (GPT-3, text-davinci-003) with no knowledge of its pretraining data is a strong validation of the method's real-world applicability.

Applying the optimal threshold from this validation set to the test set of 100 Books3 books (10,000 total snippets of 512 words each), the paper reports: "Figure 4 reveals nearly 90% of the books have an alarming contamination rate over 50%" (Section 5.2). Specifically, the distribution of contamination rates (the percentage of snippets from each book that MIN-K% PROB classifies as members) is heavily right-skewed: nearly 90% of the 100 tested books have more than half their snippets flagged as present in GPT-3's training data. Table 2 lists the top 20 books with the highest contamination rates: 6 books show a 100% contamination rate (every extracted snippet classified as a member), including "The Violin of Auschwitz" (2010), "North American Stadiums" (2018), and "White Chappell Scarlet Tracings" (1987). The remaining top-20 books show contamination rates between 98% and 99%.

These findings are significant because they provide quantitative, instance-level evidence—rather than anecdotal generation examples—that GPT-3 was likely trained on copyrighted books from the Books3 corpus. The paper does not claim definitive proof (the detection method has a non-zero false positive rate, and the threshold is set on a validation set that may not perfectly represent the test distribution), but the magnitude of the detected contamination (books with 100% of tested snippets classified as members) is difficult to explain away as noise, particularly given the 0.88 validation AUC.

Downstream Dataset Contamination Detection

Section 6.1 evaluates MIN-K% PROB's ability to detect leaked downstream benchmark examples in a controlled setting where LLaMA-7B is continually pretrained on RedPajama data contaminated with 200 examples from each of four downstream datasets (BoolQ, Commonsense QA, IMDB, Truthful QA). Table 3 reports per-dataset AUC scores: BoolQ (MIN-K% PROB: 0.91, PPL: 0.89), Commonsense QA (0.80 vs. 0.78), IMDB (0.98 vs. 0.97), and Truthful QA (0.74 vs. 0.71). MIN-K% PROB achieves the highest AUC for each dataset, but the margins over PPL are small: 0.02 on BoolQ and Commonsense QA, 0.01 on IMDB, and 0.03 on Truthful QA. The average AUC across datasets is 0.86 for MIN-K% PROB versus 0.84 for PPL—a 2.4% relative improvement, substantially smaller than the 7.4% improvement on WIKIMIA.

This reduced margin is informative. In the controlled contamination setting, the examples are relatively short (single QA pairs or sentences), and the model has been trained for only one epoch at a constant learning rate of 1e-4. Under these conditions, PPL is already a strong detector because the contaminant examples are outliers that the model partially memorizes, making their overall perplexity substantially lower than non-contaminants. The tail-focused MIN-K% PROB statistic provides additional discriminative power, but the benefit is more modest when the mean (PPL) already captures most of the signal. This contrasts with WIKIMIA, where the examples are longer, the pretraining is more heterogeneous, and the membership signal is more diffuse across the token distribution, making the tail-focused approach more advantageous.

Table 7 in Appendix A reports TPR@5%FPR for contamination detection. MIN-K% PROB achieves an average TPR of 46, compared to 42 for PPL—a 9.5% relative improvement that is larger than the AUC margin. On BoolQ (55 vs. 52), IMDB (83 vs. 74), and Truthful QA (21 vs. 17), MIN-K% PROB shows gains; on Commonsense QA (23 vs. 24) it is slightly worse. The low TPR on Truthful QA (21 at 5% FPR) suggests that detecting contamination of short-form factual QA pairs is substantially harder than detecting contamination of longer-form text (IMDB reviews, where TPR reaches 83).

Ablation on Detection Difficulty Factors

Section 6.2 uses the controlled contamination setting to empirically measure how detection difficulty scales with three factors identified by the theoretical framework in Section 2.1.

Pretraining dataset size (Figure 5a and 5b). The paper constructs contaminated datasets of increasing size (0.17M, 0.27M, 2.6M, 26M tokens) by mixing fixed downstream examples with varying amounts of RedPajama data. When the contaminants are downstream task examples (outliers relative to RedPajama), AUC increases with dataset size (Figure 5a): from approximately 0.75 at 0.17M tokens to approximately 0.86 at 26M tokens. This is the counterintuitive reversal of the theoretical prediction that larger datasets make detection harder. The paper explains this via long-tail memorization: "LMs better memorize tail outliers" (Feldman, 2020; Zhang et al., 2021), and with more RedPajama tokens, the downstream examples become more distinctive outliers, increasing memorization and thus detectability.

To verify that this reversal is specific to outliers, the paper constructs a control experiment using in-distribution data: contaminant examples are sampled from Real Time Data News August 2023 (post-LLaMA data, guaranteed unseen), meaning they are from the same distribution as the pretraining corpus (news articles). When dataset size increases from 0.77M to 3.9M to 7.6M tokens, AUC decreases from approximately 0.58 to 0.55 to 0.52 (Figure 5b). This matches the theoretical prediction: for in-distribution data, larger datasets make detection harder because the model memorizes each individual example less. The contrast between Figures 5a and 5b is one of the paper's most illuminating results, demonstrating that the relationship between dataset size and detection difficulty is not monotonic—it depends on whether the target data blends into the pretraining distribution or stands out from it.

Data occurrence frequency (Figure 5c). The paper constructs a pretraining corpus where each contaminant example appears with frequency following a Poisson distribution. When AUC is plotted against occurrence frequency, the relationship is positive and nearly linear: examples that appear more times are easier to detect. The paper does not report exact AUC values for each frequency bin in the text, but Figure 5c shows AUC increasing from approximately 0.5 at frequency 1 to approximately 0.9 at frequency 10. This directly validates the theoretical bound from Hardt et al. (2016): detection difficulty is inversely proportional to occurrence frequency.

Learning rate (Table 4). The paper trains LLaMA-7B on the same contaminated data at two learning rates: 1 × 10^{-5} and 1 × 10^{-4}. For BoolQ, AUC increases from 0.64 to 0.91; for Commonsense QA, from 0.59 to 0.80; for IMDB, from 0.76 to 0.98; for Truthful QA, from 0.56 to 0.74; and for LSAT QA (an additional dataset not in the main results), from 0.72 to 0.82. The average AUC across the five datasets increases from 0.65 to 0.85—a 31% relative improvement from a 10× increase in learning rate. This is a large effect, confirming the theory and demonstrating that pretraining detection is substantially easier when models are trained with more aggressive optimization.

Table 8 provides a critical validation: the paper checks whether the higher learning rate increases AUC through memorization or through generalization (better downstream task performance would benefit both contaminant and non-contaminant examples equally, preserving AUC). For contaminant examples, average accuracy increases from 0.55 at learning rate 1 × 10^{-5} to 0.64 at 1 × 10^{-4} (a 0.09 gain). For non-contaminant examples, accuracy increases from 0.51 to 0.53 (only a 0.02 gain). The larger gain for contaminant examples indicates that the higher learning rate disproportionately improves performance on training-set examples, which is the definition of memorization. This confirms that the AUC increase in Table 4 is driven by memorization rather than generalization.

Machine Unlearning Auditing

Section 7 evaluates whether LLaMA2-7B-WhoIsHarryPotter, a model fine-tuned to unlearn Harry Potter content, has actually forgotten the targeted material.

Story completion (Section 7.2.1). MIN-K% PROB is applied to approximately 1000 chunks of 512 words from Harry Potter books 1–4, scoring each chunk under both the unlearned model and the original LLaMA2-7B-chat. Chunks are classified as "suspicious" (potentially unlearn-failed) if the ratio of the two models' MIN-K% PROB scores falls within (1/1.15, 1.15)—meaning the unlearned model's token probabilities on the passage are similar to the original model's, suggesting the content was not erased. This yields 188 suspicious chunks. The paper notes: "using perplexity alone as the metric fails to identify any such chunk," highlighting that the tail-focused statistic captures residual memorization that mean-based metrics miss.

For each suspicious chunk, the unlearned model is prompted with the first 200 words and asked to generate 20 completions via multinomial sampling. Completions are compared to the original Harry Potter text using SimCSE score (cosine similarity of sentence embeddings) and GPT-4 similarity ratings on a 1–5 scale. Figure 7a shows the distribution of SimCSE scores: a non-trivial fraction of completions score above 0.7 and 0.8, indicating high semantic similarity. Figure 7b shows the GPT-4 similarity distribution: "5.3% generated completions have greater and equal to 4 GPT score similarity to the gold completion." The paper reports that "10 chunks have a similarity score higher than or equal to 4 according to the GPT-4 evaluator." Table 10 provides three example chunks with SimCSE scores of 0.82, 0.84, and 0.77, and GPT-4 scores of 5, 4, and 4, along with side-by-side comparisons of the ground-truth continuation and the unlearned model's generation, showing substantial overlap in narrative elements and phrasing.

Question answering (Section 7.2.2). The paper generates 1000 Harry Potter-related questions using GPT-4, then filters to 103 questions where the MIN-K% PROB score ratio between the unlearned and original models falls within (1/1.15, 1.15). The unlearned model answers each question with 20 multinomial samples. Answers are compared to GPT-4 reference answers using ROUGE-L recall. For the 103 selected questions, average ROUGE-L recall is 0.23; for the 897 unselected questions, it is 0.10. This 2.3× difference validates that MIN-K% PROB successfully identifies questions where the unlearned model retains knowledge.

Table 5 shows eight examples where the unlearned model answers correctly (ROUGE-L recall = 1). For instance, when asked "What type of animal is Hedwig?", the model responds "Hedwig is a white owl." (correct). When asked "what creature guards the vaults at Gringotts Bank?", the model generates "In the Harry Roper series by T.L. Knighton, the creature that guards the vaults... is a dragon."—the framing is garbled (wrong series name, wrong author), but the core fact (dragon) is correct and verifiable against the original books. Other examples show similar patterns: the model often generates partially confabulated context ("In the 'Magic for Good' series by John G. Hartness...") while preserving the correct factual answer. This suggests the unlearning process may have disrupted the model's ability to coherently frame Harry Potter knowledge without erasing the factual content itself.

Ablation Studies and Robustness Checks

Choice of k (the percentage of minimum-probability tokens): The paper sweeps k ∈ {10, 20, 30, 40, 50} on a held-out validation set using LLaMA-65B and finds that k = 20 works best (Section 4.3). This single value of k = 20 is used for all experiments across all models, datasets, text lengths, and settings. The paper does not report the AUC values for other k choices, the margin by which k = 20 outperforms k = 10 or k = 30, or whether the optimal k varies across models (e.g., does a larger model benefit from a smaller k because it memorizes more tokens?). The absence of this sensitivity analysis is a limitation: if performance degrades sharply for k = 10, domain-specific tuning would be necessary for reliable deployment. The fact that a single k works across diverse settings is evidence of robustness, but the lack of quantification makes it difficult to assess how sensitive the method is to this hyperparameter.

Original vs. paraphrase settings (Table 1): Across all five model families, MIN-K% PROB AUC in the paraphrase setting is within 0.02 of the original setting. For example, on LLaMA-65B, paraphrase AUC is 0.74 vs. 0.74 original; on NeoX-20B, 0.74 vs. 0.76; on LLaMA-30B, 0.73 vs. 0.74. The paraphrase invariance is stronger for MIN-K% PROB than for baselines—Neighbor drops from 0.71 to 0.69 on LLaMA-65B, and Zlib drops from 0.72 to 0.66. This suggests that the token-tail statistic captures a semantic-level signal (the model's relative uncertainty about key content-bearing tokens) that is preserved under paraphrasing, whereas methods that rely on surface-form features (Zlib's compression ratio, Neighbor's local curvature) are more disrupted by lexical variation.

Different-length settings (Figure 2b): The monotonic relationship between text length and AUC is consistent across methods, but the paper only shows results for LLaMA-65B. It does not report length-stratified AUC for all models in Table 1—the table aggregates across lengths. This means the paper cannot distinguish whether MIN-K% PROB's 7.4% average AUC improvement over PPL is concentrated at certain lengths (e.g., does the advantage disappear for very short texts of 32 tokens, where the number of tokens in the k = 20% tail is only ~6 tokens?).

Reference model quality (Smaller Ref in Table 1): Smaller Ref uses a model from the same family trained on the same data as a calibration baseline (e.g., LLaMA-7B for LLaMA-65B). Despite this privileged access to a related model—an assumption violated for proprietary models—Smaller Ref achieves an average AUC of only 0.66, statistically indistinguishable from PPL (0.67) and worse than MIN-K% PROB (0.72). This is a robustness check for the reference-free paradigm: even in the best-case scenario for reference-based methods (a smaller model from the same family, trained on the same data, is publicly available), MIN-K% PROB outperforms it. However, the paper does not ablate whether using a closer reference model (e.g., LLaMA-30B for LLaMA-65B rather than LLaMA-7B) would improve Smaller Ref's performance, and on LLaMA-65B original, Smaller Ref ties MIN-K% PROB at 0.74, suggesting the reference approach can be competitive when the reference model is sufficiently similar.

Verbatim detection vs. contamination detection paradigms: The paper evaluates MIN-K% PROB in two distinct settings: (1) detecting whether arbitrary text was in the original pretraining data (WIKIMIA, Sections 4 and 5), and (2) detecting whether specific examples were deliberately inserted into a controlled pretraining corpus (downstream contamination, Section 6). The performance is higher in the controlled setting (average AUC 0.86 vs. 0.72), which is expected because the contaminant examples are known outliers. But the paper does not ablate how performance changes as the distinction between these paradigms blurs—e.g., what if the "contaminant" examples are in-distribution rather than outliers? Figure 5b answers this partially by showing that AUC for in-distribution contaminants (news articles) is much lower (0.52–0.58) than for outlier contaminants (0.75–0.86 in Figure 5a), quantitatively confirming that outlier status matters enormously.

Threshold sensitivity in copyrighted book detection: The threshold ϵ for classifying a snippet as member vs. non-member is determined by maximizing accuracy on the validation set (50 known-memorized + 50 new books). The paper reports the resulting contamination rates (Table 2, Figure 4) but does not report: (1) the validation accuracy at the chosen threshold, (2) the false positive and false negative rates on the validation set, (3) how contamination rates change if the threshold is varied, or (4) whether the Books3 test set has different characteristics (book age, genre, writing style) from the validation set that could cause threshold miscalibration. These omissions make it difficult to assess the reliability of the alarming "nearly 90% of books have >50% contamination" finding.

ReST^EM revision model failure: This negative result appears in the referenced paper's Appendix K (Section 6.1 of the original paper notes the ReST^EM failure for revision models). While this is a finding from the earlier paper on test-time compute scaling rather than from this paper, it demonstrates the importance of reporting negative results. The current paper does not report any negative results for MIN-K% PROB—the method outperforms baselines in every setting tested. There is no ablation where MIN-K% PROB fails (e.g., on extremely short texts, on models trained with very low learning rates, on in-distribution data with large pretraining corpora) that would define the method's failure modes. Figure 5b shows that AUC drops to ~0.52 for in-distribution contaminants in a 7.6M-token corpus, approaching random-chance performance (0.50), which is the closest the paper comes to a failure mode. But this is presented as a validation of theoretical predictions rather than as a limitation of the method.

Model architecture variation: All evaluated models are standard decoder-only autoregressive transformers (LLaMA, GPT-NeoX, Pythia, OPT, GPT-3). The paper does not evaluate MIN-K% PROB on encoder-decoder models (T5), encoder-only models (BERT), or mixture-of-experts architectures (Mixtral, GLaM). While the hypothesis (token probabilities are elevated for seen text) should apply to any model trained with next-token prediction loss, the paper does not provide evidence that the tail-statistic approach generalizes across architectural families.

Critical Assessment

Claim 1: MIN-K% PROB is an effective pretraining data detection method that outperforms existing reference-free baselines. The evidence for this claim is strong and internally consistent. Table 1 shows 0.72 average AUC, a 7.4% improvement over PPL's 0.67. This pattern holds across five model families, original and paraphrase settings, and three case studies (copyrighted books, dataset contamination, unlearning auditing). The AUC improvement is not enormous in absolute terms—0.72 is far from perfect detection—but in the context of pretraining MIA, where the theoretical bounds suggest detection should be extremely difficult (single epoch, trillion-token corpora, unknown data distribution), any reliable above-chance performance is notable, and a consistent 7% margin over the best alternative is practically meaningful.

However, a nuance is important: the 7.4% improvement is relative to the best baseline (PPL), not relative to all baselines. Against weaker baselines like Lowercase (0.61), the improvement is 18%. This matters because it means MIN-K% PROB's advantage is not uniformly large—it is concentrated relative to methods that do not use any form of calibration. Against PPL, which is a genuinely strong and simple baseline, the improvement is more modest. Whether a 7.4% AUC gain justifies the additional complexity of sorting tokens and selecting a k% subset is a practical judgment that depends on the deployment context. For high-stakes auditing (e.g., copyright litigation), the gain may be critical; for bulk screening, PPL may be sufficient.

The paper does not establish statistical significance for the AUC differences. With 394 member and 394 non-member examples, the standard error of the AUC depends on the correlation structure of the scores, which is not reported. It is possible that some of the per-model AUC differences (e.g., 0.74 vs. 0.73 for MIN-K% PROB vs. PPL on LLaMA-30B original) are within sampling noise. Reporting confidence intervals—via DeLong's method or bootstrap—would substantially strengthen the comparisons.

Claim 2: MIN-K% PROB works without any knowledge of the pretraining corpus or any additional training. This claim is definitional—the method uses only token probabilities from the target model, which requires black-box API access but no training data, no reference model, and no fine-tuning. This is fully supported by the method's design (Section 3) and by the experiments: all results are obtained using only model forward passes to extract log-probabilities, with no shadow training, no data collection, and no model modification. The k = 20 hyperparameter was tuned once on a held-out validation set using LLaMA-65B and then fixed for all other experiments, so the method requires no per-model or per-dataset tuning at deployment time. The copyrighted book detection on GPT-3 is the strongest evidence for the zero-knowledge claim: GPT-3's training data is undisclosed, yet MIN-K% PROB achieves 0.88 AUC using only API-accessible token probabilities.

Claim 3: The WIKIMIA benchmark provides reliable ground-truth labels for evaluating pretraining data detection. The temporal guarantee (post-2023 events cannot be in pretraining data of models trained before 2023) is logically sound and is the benchmark's key strength. The event-based restriction prevents the subtle failure mode where recent pages contain old content (a non-event page created in 2024 could duplicate text from a 2019 version). The balanced design (394 member, 394 non-member) avoids AUC inflation from class imbalance.

However, the benchmark has a significant limitation that the paper acknowledges only partially: the member data (pre-2017 events) is not guaranteed to be in any specific model's pretraining data. Wikipedia dumps are large, and any individual article might be omitted due to filtering, language detection, or quality thresholds. If a non-trivial fraction of the 394 "member" examples were actually not seen by a particular model, then the AUC for that model is underestimated—the detection task is contaminated with false-negative labels in the ground truth. The paper describes this as "conservative" noise that makes results a "lower bound," which is mathematically correct if the label noise is random with respect to the detection scores. But if the omitted articles share characteristics that also affect token probabilities (e.g., they cover obscure topics with rare vocabulary, which might produce lower probabilities regardless of membership), the noise could be systematic and bias the AUC in unknown directions. The paper does not analyze potential correlations between article properties and inclusion likelihood.

Additionally, the benchmark is currently small: 788 total examples. The different-length setting splits these into four length buckets of approximately 197 examples each (half member, half non-member). When AUC is computed per length bucket, the effective sample size is small (~99 members and ~99 non-members per bucket), making the AUC estimates potentially noisy. The paper does not report per-bucket AUC for all methods, which would reveal whether the 7.4% average improvement is consistent or driven by specific length regimes.

Claim 4: GPT-3 was likely trained on copyrighted books from Books3. The evidence for this claim comes from the case study in Section 5: a validation AUC of 0.88, and contamination rates above 50% for nearly 90% of 100 tested Books3 books, with 6 books showing 100% contamination (all 100 tested snippets classified as members).

This evidence is suggestive but has important caveats. First, the validation set construction introduces potential bias: the positive examples are 50 books "known to be memorized by ChatGPT, likely indicating their presence in its training data" (citing Chang et al., 2023). If the Books3 test books differ systematically from these known-memorized books (e.g., by obscurity, publication date, or genre), the threshold optimized on the validation set may not transfer cleanly to the test set. Second, the false positive rate of the detector on the validation set is not reported. If the detector has, say, a 10% FPR at the chosen threshold, then even books not in pretraining data could show apparent contamination rates of 10% simply due to chance. A 50% contamination rate would still be far above this baseline, but the exact FPR matters for interpreting the precise contamination percentages in Table 2. Third, the paper does not analyze whether the detected "contamination" correlates with known properties of the books (e.g., are more recently published books less likely to be flagged, as they would be if the pretraining data had a publication-date cutoff?). Such an analysis would provide convergent validation.

Despite these caveats, the result is genuinely striking. A 0.88 AUC on a completely black-box model, combined with contamination rates that saturate near 100% for multiple books, is difficult to dismiss as a methodological artifact. The finding is consistent with external evidence (Chang et al., 2023 showed GPT-3 can generate verbatim book excerpts) and the known composition of the Pile dataset (which includes Books3). The paper appropriately hedges: it presents this as evidence, not proof, and the method's limitations (unknown FPR, potential validation-test distribution shift) are inherent to the black-box setting rather than unique to this analysis.

Claim 5: Detection difficulty scales predictably with model size, text length, occurrence frequency, and learning rate. Figures 2a, 2b, and 5c, and Table 4 provide consistent evidence for these relationships. The monotonic trends for model size and text length (Figures 2a, 2b) are clear from the plots, though the exact AUC values at each point are not tabulated. The Poisson frequency experiment (Figure 5c) shows a near-linear relationship, and the learning rate experiment (Table 4) shows a large effect (0.65 → 0.85 average AUC from a 10× learning rate increase), with Table 8 confirming this is driven by memorization rather than generalization.

The dataset size relationship is more nuanced, as the paper itself demonstrates. Figure 5a shows the counterintuitive reversal for outlier contaminants (AUC increases with dataset size), while Figure 5b shows the predicted trend for in-distribution data (AUC decreases with dataset size). The paper explains this post-hoc via long-tail memorization, which is plausible but was not predicted in advance—the theoretical framework in Section 2.1 would have predicted decreasing AUC for both cases. This means the paper's original theoretical framing was incomplete, and the empirical findings refine it. This is a strength of the paper (it discovered an important nuance) but also means the "scales predictably" claim requires the qualification: predictable given knowledge of whether the target data is in-distribution or an outlier.

Missing experiments that would strengthen the paper. Several experiments that are not run would have been informative: (1) Sensitivity analysis for k across models and datasets: the single sweep on LLaMA-65B leaves open whether k = 20 is near-optimal for smaller models (Pythia-2.8B, where AUC is only 0.67), for very short texts (32 tokens, where the tail is only ~6 tokens), or for non-English text. Reporting AUC as a function of k for a few representative settings would allow readers to assess whether the default value is robust. (2) Confidence intervals for AUC: with 788 test examples, bootstrap or DeLong confidence intervals would allow statistical comparison between methods and reveal whether the 7.4% improvement is significant at conventional levels. (3) Ablation on tokenizer effects: the token-tail statistic could be influenced by tokenization artifacts (e.g., rare subword splits producing spuriously low probabilities). Comparing MIN-K% PROB using byte-level vs. BPE tokenization, or controlling for token frequency, would address this concern. (4) Cross-domain generalization: all WIKIMIA experiments use Wikipedia event data, and the case studies use literary text, QA pairs, and movie reviews. The paper does not systematically evaluate whether MIN-K% PROB's advantage over PPL varies across text domains (encyclopedic vs. conversational vs. technical). (5) Downstream impact of k on the case studies: the copyrighted book detection and unlearning auditing results depend on the choice of k = 20. If k = 10 or k = 30 substantially changes the contamination rates in Table 2, the headline finding ("nearly 90% of books have >50% contamination") could be sensitive to this hyperparameter.

Overall assessment. The experimental design is thorough within its scope: a new benchmark with ground-truth labels, five model families, two evaluation settings (original and paraphrase), three real-world case studies, and ablation studies that isolate key factors affecting detection difficulty. The results consistently support the central claim that token-tail statistics enable reference-free pretraining data detection, with MIN-K% PROB outperforming all existing reference-free baselines. The primary limitations are (1) the absence of statistical significance quantification, (2) the lack of sensitivity analysis for the single hyperparameter k, (3) the relatively small benchmark size (788 examples) that may limit the precision of per-length and per-model comparisons, and (4) the reliance on a single benchmark domain (Wikipedia events) for the main evaluation, though the case studies partially address generalizability. The paper's strongest empirical contribution is not the absolute AUC numbers but the characterization of when detection works—the factors that modulate difficulty (dataset size, outlier status, occurrence frequency, learning rate, model size, text length)—which provides a predictive framework for deploying the method in new settings.

6. Limitations and Trade-offs

The Difficulty Estimation Cost Is Unaccounted For and Potentially Dominates the Detection Budget

The assumption or constraint. The WIKIMIA benchmark requires ground-truth labels for evaluation, which the paper provides through temporal separation (post-2023 events are guaranteed non-members). However, for real-world deployment of pretraining data detection, the method requires a detection threshold ϵ (Section 3, Step 4) to make binary membership decisions, and determining this threshold requires a labeled validation set with known members and non-members. The paper addresses this in the copyrighted book case study (Section 5.1) by constructing a validation set of 50 known-memorized and 50 post-2023 books, then optimizing the threshold for maximum accuracy. But constructing such a validation set in a general deployment scenario requires either (a) knowledge of some guaranteed member and non-member texts for the target model, or (b) expensive data collection. The paper never quantifies this calibration cost or provides a method that works without any labeled data.

The consequence. In the copyrighted book detection scenario, the threshold is calibrated on a specific validation set (50 memorized books + 50 new books). If the target model's training data distribution differs from this validation distribution—for example, if the model was trained on scientific papers rather than literary fiction—the calibrated threshold will be miscalibrated, leading to uncontrolled false positive or false negative rates. The paper reports AUC (threshold-independent) for most experiments, which sidesteps this issue for evaluation, but the headline case study results in Table 2 (contamination rates of 100% for multiple books) depend entirely on the chosen threshold. The paper does not report: the validation accuracy at the chosen threshold, the false positive rate on the validation set, or a sensitivity analysis showing how the contamination rates in Table 2 change if the threshold is varied. Without this information, the "90% of books have >50% contamination" claim (Section 5.2) could be substantially threshold-dependent. A practitioner who calibrates on a different validation set—or who lacks access to guaranteed-positive and guaranteed-negative examples—may obtain materially different contamination estimates.

What evidence exists in the paper. The paper explicitly acknowledges the calibration requirement in Section 5.1: "We determine the optimal classification threshold with MIN-K% PROB by maximizing detection accuracy on this [validation] set." However, it never discusses what happens when such a validation set is unavailable, what the calibration cost is (the validation set required identifying 50 known-memorized books through prior work by Chang et al., 2023, which itself required extensive manual analysis), or whether the threshold generalizes across domains.

Mitigation status. Not addressed. The paper does not propose a method for threshold calibration without labeled validation data, does not discuss domain shift in threshold selection, does not report threshold sensitivity, and does not flag this as a limitation or future work. For the WIKIMIA benchmark evaluation, threshold calibration is not needed because AUC is threshold-independent. For the case studies, the paper treats the availability of a labeled validation set as given, which is a significant assumption for real-world deployment.

The Method Fails on In-Distribution Data at Realistic Pretraining Scale

The assumption or constraint. The paper's theoretical framework (Section 2.1, drawing from Hardt et al., 2016 and Bassily et al., 2020) predicts that detection difficulty increases with dataset size for in-distribution examples—those that are not outliers relative to the pretraining data distribution. The paper validates this prediction empirically in Figure 5b: when contaminant examples are sampled from the same distribution as the pretraining corpus (Real Time Data News articles), AUC drops from approximately 0.58 to approximately 0.52 as the pretraining corpus grows from 0.77M to 7.6M tokens. Extrapolating this trend to web-scale pretraining corpora (trillions of tokens) suggests that MIN-K% PROB would perform near chance levels on in-distribution data for real LLMs.

The consequence. This failure mode is not a minor edge case—it means that MIN-K% PROB is effective only when the target text is distinctive relative to the pretraining distribution. For auditing scenarios where the text of interest is similar to what the model was generally trained on (e.g., detecting whether a specific Wikipedia article, news article, or common web forum post was in pretraining data), the method may provide little signal above random guessing. The paper's strong results on copyrighted books (AUC 0.88) and downstream dataset contamination (AUC 0.86) rely on these texts being outliers—literary prose and formatted QA pairs look different from typical web-scraped pretraining data. But for privacy auditing scenarios where individuals want to know whether their social media posts, emails, or blog articles were included in pretraining, those texts may be far more in-distribution, and detection performance would degrade substantially. The paper never evaluates MIN-K% PROB on in-distribution data at the scale of a real pretrained model (the Figure 5b experiment only goes up to 7.6M tokens and uses a model continually pretrained from LLaMA-7B, not a model pretrained from scratch on web-scale data).

What evidence exists in the paper. Figure 5b directly demonstrates this limitation, though the paper presents it as a validation of theoretical predictions rather than as a limitation of the method: "detecting general in-distribution samples from the pretraining data distribution gets harder with more data, following theoretical expectations" (Section 6.2). The WIKIMIA benchmark itself partially addresses this—Wikipedia event articles are closer to in-distribution for models trained on Wikipedia—and the AUC there is only 0.72 on average, lower than the outlier case studies. But WIKIMIA uses only 394 examples per class, and the paper does not analyze whether the subset of Wikipedia articles that are most in-distribution (e.g., those covering common topics with typical Wikipedia prose style) show lower detectability.

Mitigation status. The paper partially mitigates this through the WIKIMIA evaluation (which is closer to in-distribution than the case studies) and through the theoretical discussion in Section 2.1 that frames detection difficulty as dependent on dataset size and outlier status. The paper does not propose any modification to MIN-K% PROB to improve in-distribution detection, does not evaluate on genuinely in-distribution data at realistic pretraining scale, and does not provide guidance on how to estimate whether a target text is "distinctive enough" for the method to work. The finding that larger models increase AUC (Figure 2a) suggests some hope—web-scale pretrained models may memorize in-distribution data more strongly than the small-scale controlled experiments suggest—but this is not tested.

The Benchmark Is Small, Temporally Sparse, and Potentially Domain-Biased

The assumption or constraint. WIKIMIA contains exactly 394 member examples and 394 non-member examples (Section 2.2), drawn exclusively from Wikipedia event pages. The non-member data relies on events occurring after January 1, 2023—a date range that produced only 394 qualifying articles as of the paper's writing. The member data is randomly sampled from pre-2017 Wikipedia events to match this count. The benchmark is further subdivided: the different-length evaluation setting slices these 788 examples into four length buckets (32, 64, 128, 256 tokens), yielding roughly 99 members and 99 non-members per bucket (Section 4.1).

The consequence. With approximately 99 examples per class per length bucket, the standard error of the AUC estimate is substantial. For a balanced sample of ~200 total examples with an AUC around 0.70, the standard error is approximately 0.03–0.04 (using DeLong's formula). This means the 7.4% average AUC improvement over PPL (0.72 vs. 0.67, Table 1) could be partially attributable to sampling variance rather than a genuine performance gap. The paper reports AUC values to two decimal places but does not provide confidence intervals, making it impossible to assess whether differences between methods—or between models—are statistically significant. The per-model comparisons in Table 1 have even higher variance: MIN-K% PROB achieves 0.74 on LLaMA-65B vs. 0.72 for Zlib, a difference of 0.02, which could easily fall within the confidence interval.

Furthermore, the single-domain nature of the benchmark (Wikipedia event articles) means the evaluation does not test whether MIN-K% PROB's advantage over baselines generalizes to other text types. The case studies provide some domain diversity (literary books, QA pairs, movie reviews, news articles), but do so with separate experimental protocols and datasets, making direct comparison of AUC values across domains impossible. A practitioner cannot look at the WIKIMIA results and infer expected performance on, say, legal documents or code repositories.

The temporal construction of the benchmark also introduces a subtle confound: the member data (pre-2017 events) and non-member data (post-2023 events) differ not only in membership status but also in topic distribution, writing style, and named entity distribution (older events involve different people, places, and technologies). If the model's token probabilities are influenced by temporal factors independent of membership—for example, if the model assigns lower probabilities to tokens associated with recent entities because they appear less frequently in the broader pretraining corpus—this could create a spurious signal that inflates AUC. The paper does not control for this possibility.

What evidence exists in the paper. The paper explicitly states the benchmark size in Section 2.2: "Given the limited number of events post-2023, we ultimately collected 394 recent events as our non-member data, and we randomly selected 394 events from pre-2016 Wikipedia pages as our member data." The lack of confidence intervals is apparent from the results tables—no error bars, standard deviations, or statistical tests are reported anywhere in the paper. The domain restriction to Wikipedia events is acknowledged in the benchmark description but not analyzed as a potential confound.

Mitigation status. Partially addressed. The paper commits to making WIKIMIA dynamic (Section 2.2, Appendix B): "we will continually update our benchmark by gathering newer non-member data (i.e., more recent events) from Wikipedia since our data construction pipeline is fully automated." As time passes and more post-2023 events are created, the benchmark size will grow, reducing sampling variance. However, the temporal confound (older vs. newer events differing in content, not just membership) is not addressed and would persist even with more data. The paper does not propose any control for temporal effects—for example, using a model known not to have been trained on Wikipedia as a temporal baseline, or constructing member data from a date range that is temporally matched (e.g., member events from 2020–2022, non-member from 2023+, which would reduce topic-distribution differences). This is a significant limitation because it means the benchmark's ground-truth labels are valid (post-2023 events are genuinely non-members), but the member/non-member distinction is confounded with old/new content distinction, potentially inflating detection performance estimates.

The Hyperparameter k Is Tuned Once on a Single Model, With No Sensitivity Analysis Reported

The assumption or constraint. The method's only tunable parameter is k, the percentage of minimum-probability tokens included in the detection statistic. The paper states (Section 4.3):

"We performed a small sweep over 10, 20, 30, 40, 50 on a held-out validation set using the LLAMA-60B model and found that k = 20 works best. We use this value for all experiments without further tuning."

The paper does not report the AUC values from this sweep, the margin by which k = 20 outperforms alternatives, or whether the optimal k varies across models, datasets, text lengths, or evaluation settings.

The consequence. A practitioner cannot assess whether k = 20 is near-optimal for their specific deployment scenario—or whether the method's performance is robust to this choice. This matters because the optimal k plausibly depends on factors that vary across applications:

Text length: For very short texts (32 tokens), k = 20 selects only ~6 tokens. Increasing k to 30 or 40 might provide a more stable statistic with additional tokens. For very long texts (2048+ tokens), k = 20 selects hundreds of tokens, potentially diluting the tail signal with moderately low-probability tokens that carry no membership information.
Model size: Larger models may memorize more tokens (Figure 2a), meaning a smaller k might suffice to capture the memorization signal, while smaller models may require a larger k to aggregate enough information from a weaker tail signal.
Domain: The copyrighted book detection case study achieved 0.88 AUC, much higher than the 0.72 WIKIMIA average. If k = 20 was tuned on WIKIMIA-like data (Wikipedia events evaluated on LLaMA-65B), it might be suboptimal for the book detection setting, and the 0.88 AUC could potentially be improved—or could be sensitive to k in ways the paper does not explore.

The sensitivity is especially important for the headline case study results. The contamination rates in Table 2 (100% for six books) and the "nearly 90% of books have >50% contamination" claim (Section 5.2) depend on the detection threshold, which depends on the MIN-K% PROB score distribution, which depends on k. If k = 10 or k = 30 produces substantively different contamination rate estimates, the paper's strongest real-world finding would be called into question.

What evidence exists in the paper. The paper reports the sweep procedure and the chosen value (Section 4.3), but provides no quantitative results from the sweep—no table or figure showing AUC as a function of k on the validation set. The fact that a single k = 20 works across five model families, multiple text lengths, three case studies, and original/paraphrase settings is indirect evidence of robustness, but without seeing the sweep results, the reader cannot distinguish between (a) k = 20 is genuinely near-optimal across all settings, and (b) performance is largely insensitive to k in the 10–50 range, making the specific choice less critical.

Mitigation status. Minimally addressed. The paper's use of AUC rather than a fixed-threshold metric for the main evaluation (WIKIMIA) means that the detection threshold is not an issue for those results, but k itself affects the AUC by determining which tokens contribute to the score. The paper does not suggest that future work should conduct more thorough hyperparameter sensitivity analysis, nor does it provide recommendations for practitioners on how to select k for new domains or models beyond the blanket use of 20.

Detection of Short Texts Remains Fundamentally Difficult, With No Proposed Solution

The assumption or constraint. The paper demonstrates a strong positive relationship between text length and detection performance (Figure 2b): on LLaMA-65B with WIKIMIA original text, MIN-K% PROB AUC increases from approximately 0.57 at 32 tokens to approximately 0.74 at 256 tokens. This relationship is consistent across all detection methods tested and is intuitive—longer texts contain more information that can be memorized and thus more signal for membership inference. However, many real-world membership inference targets are short: individual sentences from copyrighted works, single QA pairs from benchmark datasets, brief code snippets, short personal communications. The paper does not evaluate any text shorter than 32 tokens and does not propose any method modification to improve short-text detection.

The consequence. For many of the most important applications of pretraining data detection, the text of interest may be too short for reliable inference. Consider:

Dataset contamination detection for short-form benchmarks like BoolQ (single-sentence questions with yes/no answers) or Truthful QA (short factual claims). Table 3 shows AUC of 0.74 on Truthful QA with MIN-K% PROB—the lowest of the four downstream datasets, and only 0.03 above PPL's 0.71. Table 7 shows TPR@5%FPR of only 21 for Truthful QA, meaning at a 5% false positive rate, only 21% of truly contaminated examples are detected.
Copyright enforcement for short quotes or excerpts. The copyrighted book detection (Section 5) uses 512-word snippets—substantially longer than a typical copyright-disputed quotation, which might be a sentence or two. The paper provides no evidence that MIN-K% PROB can detect membership for texts of, say, 20–50 words.
Privacy auditing for short personal data entries (names, addresses, phone numbers) that might appear in pretraining data but are far shorter than the 32-token minimum evaluated.

At 32 tokens, the AUC of 0.57 is only marginally above chance (0.50), and the practical utility of a detector operating at this level—especially when deployed in adversarial or high-stakes settings—is questionable. The paper's Figure 2b trends suggest that below 32 tokens, AUC would approach 0.50, meaning the method provides essentially no signal for very short texts.

What evidence exists in the paper. Figure 2b directly shows the length-dependence, but only for LLaMA-65B on WIKIMIA. The different-length evaluation protocol was specifically introduced to surface this issue (Section 2.2): "shorter sentences are harder to detect. Consequently, different data length buckets may lead to varying rankings of MIA methods." However, the paper does not report length-stratified AUC for all models or all methods—only a single plot for one model. Table 1 aggregates across all lengths, masking the short-text performance degradation.

Mitigation status. Partially acknowledged but not addressed. The paper introduces the different-length evaluation setting to make the length-dependence visible, which is valuable transparency. However, it proposes no method to improve short-text detection—no ensembling across multiple short texts from the same source, no use of document-level context to boost sentence-level signals, no modification to the token selection strategy for short sequences. The limitation is presented as an empirical observation rather than as a problem requiring a solution, which leaves practitioners who need to detect short-text membership without guidance.

The Method Provides No Formal Privacy or Reliability Guarantees

The assumption or constraint. MIN-K% PROB is a heuristic detection statistic: it computes a scalar score based on the hypothesis that unseen text has more low-probability outlier tokens, and membership is determined by thresholding this score. The paper evaluates the method empirically using AUC, TPR@5%FPR, and (in case studies) contamination rates, but provides no theoretical guarantees about the method's false positive rate, false negative rate, or robustness to adversarial evasion.

The consequence. The absence of formal guarantees matters in two distinct deployment scenarios:

Adversarial settings. If a model developer wants to evade detection—for example, to train on copyrighted data while passing a MIN-K% PROB audit—they could potentially modify the model to inflate token probabilities on targeted non-member texts (e.g., by post-training on those texts, or by modifying the output probability distribution via temperature scaling or logit adjustments) without actually including them in pretraining. The paper provides no analysis of whether MIN-K% PROB is robust to such evasion, and the heuristic nature of the statistic means there is no theoretical lower bound on detectability that an adversary must respect.
High-stakes auditing. If MIN-K% PROB is used as evidence in legal proceedings (copyright litigation, regulatory privacy audits), the reliability of individual membership decisions matters. The paper reports aggregate metrics (AUC, contamination rates), which do not provide confidence bounds for individual classifications. A book flagged with 100% contamination in Table 2 might be a genuine positive, or it might be a statistical artifact—the paper provides no way to distinguish these cases at the level of individual texts. In legal contexts, where the standard of evidence may require quantified uncertainty (e.g., "we are 95% confident this text was in the training data"), the method in its current form is insufficient.
Distribution shift. The paper's threshold calibration (Section 5.1) assumes the validation set is representative of the test distribution. If the target texts differ from the validation distribution in topic, style, or length, the FPR and FNR at the fixed threshold will shift in unknown ways. Without theoretical characterization of how the MIN-K% PROB score distribution depends on text properties, practitioners cannot bound the worst-case error under distribution shift.

What evidence exists in the paper. The paper provides no formal analysis of the method's statistical properties. There is no discussion of confidence intervals for individual predictions, no adversarial robustness evaluation, no differential privacy-style bounds on the information leakage that MIN-K% PROB exploits, and no analysis of calibration across domains.

Mitigation status. Not addressed. The paper treats pretraining data detection as an empirical problem to be solved with better heuristics, not as a problem requiring formal guarantees. This is not necessarily a flaw—the paper's contribution is demonstrating that a simple heuristic can work where no prior method did, and formal guarantees in this setting are extremely challenging (they would require modeling the pretraining data distribution, the optimization dynamics of large-scale training, and the adversary's capabilities). However, a practitioner in a high-stakes setting should understand that the method provides empirical evidence, not proof, and that its reliability in adversarial or distribution-shifted settings is unknown. The paper would benefit from explicitly stating this scope limitation and, ideally, from conducting even basic robustness checks (e.g., does temperature scaling of the output logits reduce AUC? Does post-training the model on unrelated data affect the MIN-K% PROB score distribution?).

7. Implications and Future Directions

How This Work Changes the Landscape

This paper does not introduce a new model architecture, training paradigm, or optimization algorithm. Instead, it introduces a new diagnostic capability: the ability to determine whether an arbitrary piece of text was included in a language model's pretraining data using only black-box access to token probabilities. This capability did not exist before this work, and its absence was not a gap that the field had learned to work around—it was a fundamental blind spot that undermined scientific evaluation, legal accountability, and privacy verification for deployed LLMs.

The conceptual shift is from trust-based to evidence-based claims about training data composition. Before this paper, the field largely accepted that pretraining data was unknowable for proprietary models. When OpenAI declined to disclose GPT-4's training data, or when Meta released LLaMA 2 with only high-level descriptions of its corpus, there was no recourse—no method existed to independently verify what was or was not included. Researchers resorted to prompting-based probes (Sainz et al., 2023; Chang et al., 2023) that could demonstrate a model could produce certain content, but could not determine whether a specific instance was ingested during training. This paper demonstrates that instance-level detection is feasible at pretraining scale without access to the pretraining corpus, without training a reference model, and without any knowledge of the data distribution. This transforms pretraining data detection from an impossibility into a tractable empirical problem, which is a genuine methodological breakthrough.

The magnitude of the shift is best understood by examining what becomes possible that was previously impossible:

Independent copyright auditing. Before MIN-K% PROB, a rights holder who suspected their book was used to train GPT-3 had no way to gather evidence. The model might generate passages from the book (Chang et al., 2023), but that could be attributed to memorization of quotes from reviews, summaries, or discussion forums. MIN-K% PROB provides a direct statistical test: does the model's token-probability distribution on this text look like it does on text known to be in the training data? The 0.88 AUC on the copyrighted book validation set (Figure 3) and the finding that 6 out of 100 tested Books3 books show 100% snippet-level contamination (Table 2) provide the kind of quantitative evidence that was previously unavailable. This does not settle legal questions—AUC of 0.88 means the detector is not perfect—but it converts the question from "we have no way to know" to "we have a statistical test with known sensitivity and specificity," which is a categorical improvement in evidence quality.
Verifiable machine unlearning. The right to be forgotten (GDPR, CCPA) requires that individuals can request deletion of their data from trained models. Machine unlearning techniques (Ginart et al., 2019; Bourtoule et al., 2021; Eldan & Russinovich, 2023) claim to accomplish this, but prior to MIN-K% PROB, there was no way to audit whether unlearning actually succeeded. The paper's Harry Potter case study (Section 7) is the first demonstration that an unlearning audit can be performed at the instance level: MIN-K% PROB identifies specific chunks where the unlearned model retains memorized content, and the story completion and QA experiments confirm that the identified chunks genuinely reflect residual knowledge. This reframes unlearning from a claim made by model developers to a claim that can be independently verified—a critical capability for regulatory compliance.
Benchmark contamination detection without corpus access. The dataset contamination literature (Brown et al., 2020b; Wei et al., 2022; Chowdhery et al., 2022) had developed increasingly sophisticated n-gram overlap methods, but all required access to the pretraining corpus. For proprietary models, this meant contamination could not be detected. MIN-K% PROB enables contamination detection on any model with API access to token probabilities, without ever seeing the training data. The controlled experiments in Section 6.1 (AUC of 0.86 on downstream datasets) demonstrate that the method works in principle, and the ablation studies in Section 6.2 characterize when it works best (outlier contaminants, higher learning rates, more frequent occurrence).

The paper also reconciles contradictory impulses in the MIA literature. Prior work had established that membership inference was effective for fine-tuning data (Song & Shmatikov, 2019; Carlini et al., 2022; Watson et al., 2022) but had largely concluded—implicitly through absence of results—that it was infeasible at pretraining scale. The theoretical bounds the paper cites (Hardt et al., 2016; Bassily et al., 2020) suggested detection would be extremely difficult due to single-epoch training on trillion-token corpora. The empirical evidence in this paper resolves the tension: detection is difficult, but it is not impossible, and the key is to focus on the tail of the token probability distribution rather than the mean. The finding that detection works best for outlier data (copyrighted books, downstream benchmarks) and worst for in-distribution data (Figure 5a vs. 5b) explains why prior negative results in the MIA literature were not the final word—those studies typically evaluated on in-distribution held-out data, where the signal is weakest.

Research directions that become more attractive after this work:

Verifier and auditor development for ML systems. The paper demonstrates that MIA is not just an attack vector—it is a necessary auditing tool for responsible deployment. This reframes MIA research from adversarial to dual-use, and makes the development of more accurate, more robust, and more efficient detection methods a priority for privacy engineering rather than purely for security research.
Long-tail memorization as a detectable phenomenon. The finding that outlier contaminants become easier to detect as dataset size increases (Figure 5a) provides empirical support for Feldman's (2020) long-tail memorization theory and suggests that memorization of distinctive content is a fundamental, measurable property of large-scale language model training. This opens a line of research connecting memorization theory to practical detection methods.
Transparency through inference. If detection methods continue to improve, model developers may face increasing pressure to disclose training data composition, or alternatively to design models that are provably resistant to membership inference. Either outcome increases transparency in the LLM ecosystem.

Research directions that become less attractive:

Reference-based MIA for pretraining. The paper establishes that reference models are unnecessary for effective pretraining data detection—MIN-K% PROB outperforms the Smaller Ref baseline (0.72 vs. 0.66 average AUC, Table 1) without requiring any shadow training. Given the prohibitive cost of pretraining reference models, further development of reference-based methods for this setting appears to be a dead end.
Pure mean-based detection statistics. The consistent superiority of MIN-K% PROB over PPL (0.72 vs. 0.67 average AUC) demonstrates that whole-sequence perplexity discards membership-relevant information present in the tail of the token probability distribution. Future detection methods should incorporate distributional information beyond the mean, and simple perplexity thresholding should not be considered a competitive baseline going forward.

Follow-Up Research This Work Enables

Calibration-free thresholding using extreme value theory. The paper's largest practical gap is the requirement for a labeled validation set to determine the detection threshold (Section 5.1). This is not needed for AUC-based evaluation, but it is needed for any deployment that produces binary membership decisions—including the copyrighted book contamination estimates in Table 2 and Figure 4 that constitute the paper's most striking results. A strong follow-up would ask: can the threshold be determined from the statistical properties of the MIN-K% PROB score distribution itself, without any labeled data? The hypothesis is that the distribution of minimum token probabilities in any sufficiently long text, under any language model, follows a known extreme value distribution (e.g., Gumbel or Weibull), and the parameters of this distribution can be estimated from the target text alone. If true, the detection threshold could be set by asking "is the observed tail lighter than the extreme value distribution would predict for unseen text?" This would eliminate the calibration dependency entirely. A concrete experiment: for each of the 788 WIKIMIA texts, fit an extreme value distribution to the bottom-k% token probabilities, compute the goodness-of-fit statistic, and test whether member/non-member status is predictable from the deviation of the observed tail from the theoretical expectation, without using any labels to set a threshold. The paper's own data (Figure 2b, showing AUC increasing with text length) provides indirect support: longer texts provide more tail observations, enabling better distributional fitting, which may partly explain the length-dependence of detection performance.

MIN-K% PROB as a continuous optimization target for machine unlearning. The Harry Potter auditing case study (Section 7) uses MIN-K% PROB as a post-hoc diagnostic: after unlearning is performed, the method identifies chunks where memorization persists. A natural extension is to use MIN-K% PROB as the optimization objective during unlearning. Specifically, during the unlearning fine-tuning process (Eldan & Russinovich, 2023), the loss function could include a term that penalizes the model when the MIN-K% PROB score on to-be-unlearned text is indistinguishable from the score on known-unseen text. This would make unlearning targeted: instead of degrading general performance or relying on proxy objectives (e.g., next-token prediction on alternative labels), the model would be directly optimized to change its token probability distribution on the forget set so that it resembles unseen text. A concrete experiment: take LLaMA2-7B-chat, apply the Eldan & Russinovich unlearning procedure but with an additional MIN-K% PROB-based regularization term on Harry Potter chunks, and then evaluate both (a) whether the unlearning is more complete (lower ROUGE-L recall on QA, lower SimCSE similarity on story completion) and (b) whether general benchmark performance (MMLU, HellaSwag) degrades less than with the original approach. If successful, this would demonstrate that membership inference methods can be inverted to provide training signals for privacy-preserving model modification.

Multi-token dependency modeling in the tail statistic. MIN-K% PROB treats each token's probability independently: it selects the k% of tokens with the lowest marginal probabilities and averages them. But memorization is not just about individual surprising tokens—it is about the model's ability to reproduce multi-token sequences. A low-probability token might be surprising in isolation but perfectly predictable given additional context, or vice versa. A natural extension would condition the tail statistic on local coherence: instead of selecting tokens based on their marginal log-probability log p(x_i | x_{<i}), select tokens based on their conditional surprise relative to a local language model—for example, log p(x_i | x_{i-w}, ..., x_{i-1}) where the context window is small (e.g., 5–10 tokens). The hypothesis is that a seen text has low local uncertainty even at tokens that are surprising globally (because the model memorized the local phrase structure), while an unseen text has high local uncertainty at the same positions. This would be sensitive to multi-token memorization patterns that marginal token probabilities miss. A concrete experiment: on the WIKIMIA benchmark, compare AUC for the standard MIN-K% PROB (global context) against a variant where token probabilities are computed with a restricted context window of 5, 10, or 20 tokens. If the restricted-context variant achieves higher AUC, it demonstrates that local coherence carries membership signal beyond what global perplexity captures. This experiment can be run directly on the existing benchmark without additional data collection.

Cross-domain calibration via language model families. The paper demonstrates that MIN-K% PROB works across five model families (LLaMA, GPT-NeoX, Pythia, OPT, GPT-3), but each evaluation treats models independently—there is no attempt to calibrate detection scores across models. A natural question: if you have a small, open-source model trained on known data (e.g., Pythia-2.8B with full pretraining data access), can you use it to calibrate detection on a large, black-box model (e.g., GPT-3) by learning a mapping between their token probability distributions? The hypothesis is that token-level "surprise" is partially transferable across models trained on similar data distributions: a token that is low-probability under Pythia-2.8B because it was not in Pythia's training data is also likely to be low-probability under GPT-3 if GPT-3's training data had similar composition, regardless of model scale. If this mapping can be learned, the small model serves as a cross-model reference that replaces the within-family reference models the paper shows are insufficient (Smaller Ref, Table 1). A concrete experiment: train a simple regression model that takes as input the per-token log-probabilities from Pythia-2.8B on WIKIMIA texts and predicts the MIN-K% PROB score from LLaMA-65B on the same texts. Then evaluate whether the predicted score discriminates members from non-members on LLaMA-65B. If the cross-model prediction achieves AUC significantly above 0.50, it demonstrates transferable surprise and provides a practical calibration method for black-box models using open-source proxies.

Adversarial robustness of the tail statistic. The paper does not evaluate whether MIN-K% PROB is robust to deliberate evasion. A model developer who wants to train on copyrighted data while passing a MIN-K% PROB audit has several potential strategies: (1) post-train the model on a small amount of the target text with modified token probabilities (e.g., temperature scaling), (2) add noise to the output logits at inference time, or (3) modify the pretraining pipeline to reduce memorization of outlier texts (e.g., by deduplication or by excluding distinctive documents). Understanding which of these strategies is effective—and at what cost to model quality—is essential before MIN-K% PROB can be used in adversarial settings. A concrete experiment: take a LLaMA-7B model that has been trained on contaminated data (the setting from Section 6.1), apply post-training interventions of increasing strength (temperature scaling from 1.0 to 2.0, adding Gaussian noise to logits with increasing variance, fine-tuning on unrelated data for increasing numbers of steps), and measure both (a) the drop in MIN-K% PROB AUC on the contaminated examples, and (b) the degradation in downstream task performance (BoolQ, IMDB accuracy). If there exists an intervention that substantially reduces AUC with minimal performance degradation, that is a practical evasion strategy that model developers could deploy, and future detection methods would need to be robust to it. If all effective interventions also substantially degrade model quality, then MIN-K% PROB is robust in practice because the cost of evasion is prohibitive.

Length-adaptive token selection. Figure 2b demonstrates that detection performance degrades substantially for shorter texts (AUC ~0.57 at 32 tokens vs. ~0.74 at 256 tokens). The paper uses a fixed k = 20 for all text lengths, meaning that for a 32-token text, the detection statistic is based on only ~6 tokens. This is statistically unstable—the variance of the average over 6 tokens is high, and a single outlier token can dominate the statistic. A simple improvement would make k adaptive to text length: use a larger percentage for short texts (e.g., k = 50 for texts under 64 tokens) and a smaller percentage for long texts (e.g., k = 10 for texts over 512 tokens), ensuring that the statistic is always computed over a minimum number of tokens. More sophisticated approaches could use the empirical distribution of token probabilities to set k dynamically: if the model's probabilities are uniformly high (suggesting highly predictable text, typical of formulaic or template-based content), select only the extreme tail (small k); if probabilities are highly variable, include a larger fraction to stabilize the estimate. A concrete experiment: on the WIKIMIA different-length setting, sweep k adaptively—use k = max(10, min(50, 200/N)) where N is the number of tokens, ensuring at least 10 and at most 50 tokens in the tail set—and compare AUC to the fixed k = 20 baseline for each length bucket. If the adaptive strategy narrows or eliminates the performance gap between short and long texts, it would substantially improve the method's practical utility for the many real-world scenarios (QA pairs, short quotes, code snippets) where texts are short.

Practical Applications and Downstream Use Cases

Copyright enforcement for training data transparency. The most immediate application is to provide evidence in copyright disputes involving LLM training data. The paper demonstrates (Section 5) that MIN-K% PROB achieves 0.88 AUC on detecting copyrighted book excerpts in GPT-3, and finds that 6 out of 100 tested Books3 books show 100% snippet-level contamination rates, with nearly 90% of books exceeding 50% contamination (Figure 4). For a rights holder—an author, publisher, or collective licensing organization—this provides a concrete, quantitative method for screening whether their works were likely included in a proprietary model's training data. The workflow would be: (1) obtain API access to the target model, (2) extract token probabilities for excerpts from the copyrighted work, (3) compute MIN-K% PROB scores, (4) compare to a validation set of known-positive and known-negative texts to calibrate a threshold, and (5) report the contamination rate. While the paper does not establish legal standards of evidence, the ability to produce a statistical estimate with quantified discrimination (AUC 0.88) is a substantial advance over the current state, where rights holders can only point to anecdotal generation examples that might have alternative explanations. The method is particularly valuable for books published before the model's training cutoff—like the 20 books in Table 2 with contamination rates of 98–100%—where there is no plausible source for memorization other than inclusion in the pretraining corpus.

Regulatory compliance auditing for machine unlearning. GDPR Article 17 and CCPA Section 1798.105 grant individuals the right to request deletion of their personal data, and this right extends to data used to train machine learning models. When a user requests that their data be removed from an LLM, the model developer may apply machine unlearning techniques (Eldan & Russinovich, 2023) and claim compliance. MIN-K% PROB provides the auditing mechanism to verify that claim. The paper's Harry Potter case study (Section 7) demonstrates a concrete auditing protocol: (1) segment the user's data into chunks (e.g., 512-word passages for long-form text), (2) compute MIN-K% PROB scores under both the unlearned model and the original model, (3) flag chunks where the scores are similar (within a factor of 1.15) as potentially unlearn-failed, (4) for flagged chunks, perform targeted generation experiments (story completion, QA) to confirm that the content is accessible. The paper finds 188 suspicious chunks out of ~1000 in Harry Potter books 1–4, and demonstrates that the unlearned model can correctly answer detailed questions about the supposedly forgotten content (Table 5, 8 examples with ROUGE-L recall of 1). For a regulatory body or privacy auditor, this protocol provides a replicable, quantitative method for testing unlearning claims. The fact that the model generates correct answers while confabulating source context ("In the 'Magic for Good' series by John G. Hartness...") is particularly important: it demonstrates that surface-level checks (does the model still mention Harry Potter?) would miss residual knowledge because the model has learned to frame its responses in ways that obscure the source.

Benchmark integrity verification for model evaluation. The ML community relies on benchmark evaluations (MATH, MMLU, HumanEval) to compare model capabilities, but these comparisons are undermined if evaluation examples leaked into pretraining data. Sainz et al. (2023) and Magar & Schwartz (2022) showed this contamination is plausible given web-scale training data collection, and model developers increasingly do not disclose their training data sources (the paper cites GPT-4 and LLaMA 2 as examples). MIN-K% PROB enables third-party contamination audits without access to the pretraining corpus. The paper's controlled experiments (Section 6.1) achieve AUC of 0.86 on average across BoolQ, Commonsense QA, IMDB, and Truthful QA when benchmark examples are inserted into pretraining data and a LLaMA-7B model is trained for one epoch. The practical workflow for a benchmark maintainer (e.g., the MMLU or MATH teams) would be: (1) hold out a subset of benchmark examples that are guaranteed not to be in any public pretraining data (e.g., newly created examples, or examples released only under embargo), (2) for each new model release, compute MIN-K% PROB scores on both the held-out (guaranteed clean) and public benchmark examples, (3) test whether the score distributions differ, indicating contamination of the public set. If a model shows elevated MIN-K% PROB scores on public but not held-out examples, its reported benchmark numbers should be treated as potentially inflated. The paper's finding that detection is easier for outlier contaminants (Figure 5a) is advantageous here: benchmark examples (formatted QA pairs, math problems with LaTeX) are typically outliers relative to web-scraped pretraining text, making them more detectable. The TPR@5%FPR values (Table 7), while variable across datasets (55% for BoolQ but only 21% for Truthful QA), provide guidance on which types of benchmarks are most amenable to this auditing approach.

Model transparency reports and nutrition labels. As regulatory pressure for AI transparency increases (the EU AI Act, proposed U.S. legislation), model developers may be required to disclose training data composition or to submit to third-party audits. MIN-K% PROB provides a technical mechanism for auditing claims about training data exclusion—that is, verifying that certain types of data were not included. For example, a model developer might claim that their model was not trained on copyrighted books, on personal communications, or on a specific benchmark's test set. A third-party auditor can use MIN-K% PROB to test these exclusion claims: collect a representative sample of the excluded data type, compute membership scores, and test whether the scores are statistically distinguishable from a known-unseen baseline. The paper's WIKIMIA benchmark, with its temporal guarantee of non-membership for post-2023 events, provides a template for constructing the known-unseen baseline. For a transparency report, the auditor would report: "For 394 excerpts from copyrighted books published before the model's training cutoff, the MIN-K% PROB score distribution was [describe statistics]. This distribution was [significantly / not significantly] different from the distribution for 394 texts known to be absent from training (post-2023 Wikipedia events), with an AUC of [value] and a TPR of [value] at 5% FPR." This moves transparency from self-reported claims to independently verifiable measurements, which is the foundation of credible oversight.

When to Prefer This Method

The paper does not articulate a tradeoff between MIN-K% PROB and named alternative detection paradigms for practitioners (the alternatives are baselines that MIN-K% PROB uniformly outperforms). However, the empirical results support a conditional decision rule based on the properties of the target text and the target model:

Prefer MIN-K% PROB when the target text is an outlier relative to typical pretraining data. The method achieves 0.88 AUC on copyrighted books (literary prose vs. web text) and 0.86 on downstream benchmarks (formatted QA pairs vs. narrative text), but only ~0.52–0.58 on in-distribution news articles at realistic corpus sizes (Figure 5b). If the text is distinctive—rare vocabulary, unusual formatting, domain-specific structure—the tail signal is strong. If the text is generic web prose, PPL may be nearly as effective and simpler to implement.
Prefer MIN-K% PROB when the target model is large and trained with aggressive optimization. Figure 2a shows AUC increasing with model size (0.68 at 7B to 0.74 at 65B for LLaMA), and Table 4 shows AUC jumping from 0.65 to 0.85 when the learning rate increases by 10×. Detection is substantially more reliable for large models trained with high learning rates—a regime that includes most frontier LLMs (GPT-3, GPT-4, LLaMA-65B, PaLM).
Prefer MIN-K% PROB over PPL when the cost of false positives or false negatives is asymmetric. MIN-K% PROB achieves 22.2 TPR@5%FPR vs. 19.3 for PPL on WIKIMIA (Table 6)—a 15% relative improvement in sensitivity at a stringent false positive rate. For high-stakes applications (copyright litigation, regulatory audits), where a false positive means incorrectly accusing a model developer of using data they did not use, this additional sensitivity at low FPR is valuable.
Expect poor performance—regardless of method—when texts are very short, when models are small, or when the data is in-distribution at scale. Figure 2b shows AUC of ~0.57 at 32 tokens and ~0.74 at 256 tokens—a 0.17 AUC gap that no current method closes. For deployment scenarios involving sentence-level detection (short quotes, individual QA pairs), all current methods, including MIN-K% PROB, provide weak discrimination that is unsuitable for high-confidence individual decisions. The method can still be used for aggregate screening (e.g., testing a corpus of short texts and flagging the distribution as suspicious), but per-instance reliability is low.