One-sentence Summary

Researchers from ICT, CAS, UCAS, Zhongguancun Laboratory, and University of Amsterdam propose a divergence-based calibration method that computes the cross-entropy between token probability and token frequency distributions to correct Min-K% Prob's misclassification of non-training texts containing many common high-probability tokens, achieving significant gains on both English and Chinese pretraining data detection benchmarks.

Key Contributions

• Introduce DC-PDD, a divergence-based calibration method for black-box pretraining data detection that computes the cross-entropy between token probability distributions and token frequency distributions to produce a more reliable membership score.

• Introduce Patent-MIA, a Chinese-language benchmark for evaluating whether text was included in large language model pretraining data, extending pretraining data detection assessment beyond commonly used English benchmarks.

• Experimental results on English benchmarks and Patent-MIA show that DC-PDD significantly outperforms existing baselines while requiring only token probability access and no additional reference models or full vocabulary probability distributions.

Introduction

Large language models rely on large pretraining corpora, but many developers do not disclose the data used. This transparency gap matters for copyright, privacy, ethical compliance, and data contamination checks, since it is difficult to determine whether a model memorized test content or trained on a particular text. Prior black-box pretraining data detection methods typically use token probabilities, assuming lower probabilities indicate non-training data. These approaches can be biased by common words: frequent tokens may receive higher probabilities, causing non-training texts to be misclassified as training texts. Some related methods also require reference models or full vocabulary access, which may not be available for closed commercial LLMs. The authors leverage a divergence-from-randomness idea to introduce DC-PDD, a calibration method that compares a model’s token probability distribution against an estimated token frequency distribution from a public reference corpus. Tokens whose probabilities diverge strongly from general corpus frequencies are treated as more informative for membership inference. The authors also introduce PatentMIA, a Chinese-language benchmark for pretraining data detection, and show that DC-PDD outperforms prior black-box methods.

Dataset

• The paper uses benchmarks for pretraining data detection in LLMs, where the goal is to identify whether text examples were likely part of an LLM’s pretraining corpus.

• The authors use two pre-existing English benchmarks, WikiMIA and BookMIA, which were constructed by separating training and non-training examples according to the target LLM’s knowledge cutoff date. Training examples come from before the cutoff, while non-training examples come from after it.

• The authors also introduce a new Chinese benchmark called PatentMIA to evaluate detection methods on a language with different formatting and spacing characteristics from English.

• PatentMIA is built from Google Patents Chinese patent texts. The authors randomly crawl 5,000 Chinese patent pages with publication dates before January 1, 2023, and 5,000 pages with priority dates after March 1, 2024.

• The date-based split is used as a proxy for membership: early published pages are assumed more likely to have been available to LLMs during pretraining, while later priority-dated pages are assumed not to have been present.

• The crawled patent pages are cleaned and processed using steps similar to those used in ChineseWebText, so the benchmark format matches common LLM pretraining data formats.

• For each patent page, the authors randomly extract a 512-word snippet after segmenting the Chinese text with jieba.

• The resulting PatentMIA benchmark contains a balanced set of 10,000 examples, with 5,000 examples from each date category.

• The authors use WikiMIA, BookMIA, and PatentMIA as evaluation benchmarks for measuring how effectively methods can detect whether text was included in LLM pretraining data.

Method

Pretraining Data Detection via Distribution Divergence

The authors propose a training-free pretraining data detection method that treats a target large language model as a queryable probability oracle. Instead of training a classifier or extracting hidden states, the method compares how strongly the language model favors each token in a candidate text with how frequently that token appears in a reference corpus. The core assumption is that if a token is highly probable under the target model despite being uncommon in an external reference corpus, the model may have encountered that token sequence during pretraining. The final detection score is derived from this mismatch, and the overall pipeline can be understood as a four-stage comparison process.

Given an input text $x = x_1 x_2 \ldots x_n$x=x1​x2​…xn​, where each $x_i$xi​ is a token obtained from the tokenizer, the method first computes the token-level probability distribution induced by the target language model $\mathcal{M}$M. Because next-token prediction models do not assign a probability to the first token without a preceding context, the authors prepend a start-of-sentence token $x_0$x0​ to form

The extended sequence $x'$x′ is then fed into the target model. The model produces a sequence of predicted probabilities corresponding to the actual tokens in $x$x:

Here, each token probability is conditioned on the preceding tokens $x_{<i}$x<i​, meaning that the model evaluates how likely token $x_i$xi​ is given the previous context. For simplicity, this conditional probability is later written as $p(x_i; \mathcal{M})$p(xi​;M).

Since the true pretraining corpus of the target model is assumed unavailable, the method cannot directly measure how often each token appears in the model’s training data. To approximate this distribution, the authors estimate token frequencies using a large-scale publicly available reference corpus $\mathcal{D}'$D′. The raw frequency-based estimate is

where $\operatorname{count}(x_i)$count(xi​) is the number of occurrences of token $x_i$xi​ in $\mathcal{D}'$D′, and $N'$N′ is the total number of tokens in the reference corpus. Because rare or out-of-reference tokens may never appear in $\mathcal{D}'$D′, the method applies Laplace smoothing to avoid zero probabilities:

where $|V|$∣V∣ denotes the vocabulary size of the target model. This smoothed frequency distribution serves as the baseline against which the model’s internal token probabilities are compared.

The detection signal is then computed token by token. For each token $x_i$xi​, the method forms a divergence-style score

Intuitively, a large $\alpha_i$αi​ arises when the target model assigns high probability to a token that is relatively infrequent in the reference corpus. Such a mismatch can suggest that the model has memorized patterns associated with that token sequence rather than simply modeling ordinary statistical regularities of language.

To prevent a small number of extreme token scores from dominating the final result, the authors introduce a cap $a$a on each per-token score:

This clipping step stabilizes the final aggregate and makes the detector less sensitive to a few unusual high-probability, low-frequency tokens.

The method further addresses a repetition-related artifact. When a word or token appears multiple times in the same text, language models often assign higher probabilities to later occurrences because the token has already appeared in the context. This can inflate the score for later tokens without necessarily providing stronger evidence of pretraining exposure. To reduce this effect, the final score is computed only over the first occurrence of each distinct token in the text. Let $\mathrm{FOS}(x)$FOS(x) denote the set of tokens that appear for the first time in $x$x. The final sequence-level score is

This averaging procedure normalizes over the number of first-occurrence tokens and produces a compact calibration of the model’s preference for the candidate text relative to the reference corpus.

The final prediction is a binary decision obtained by comparing $\beta$β with a predefined threshold $\tau$τ:

A score above the threshold indicates that the candidate text is predicted to have been included in the model’s pretraining corpus, while a score below the threshold indicates that it is predicted not to have been included. Thus, the overall method operates through a clean comparison loop: query the target model for token probabilities, estimate external token frequencies from a reference corpus, derive per-token divergence scores, aggregate robust first-occurrence evidence, and threshold the resulting score for detection.

Experiment

The experiments evaluate pretraining data detection on English benchmarks WikiMIA and BookMIA plus a newly constructed Chinese PatentMIA benchmark, across open models and GPT-3, against standard scoring baselines. DC-PDD generally achieves the strongest detection performance and shows more consistent robustness across models and languages, though its advantage is smaller on the limited WikiMIA setting. Ablation and sensitivity analyses indicate that probability calibration and first-occurrence weighting improve detection, while larger models, longer texts, diverse reference corpora, and appropriately tuned probability caps further enhance reliability.

The benchmarks distinguish training and non-training examples for pretraining data detection, with WikiMIA and BookMIA covering English Wikipedia and book texts and PatentMIA adding Chinese patent texts. PatentMIA is constructed using patent priority dates to identify texts unlikely to be in a model’s pretraining corpus, extending detection evaluation beyond English. Experiments on Chinese texts indicate that longer examples are easier to separate from non-training examples. PatentMIA expands pretraining data detection benchmarks from English-only settings to Chinese patent data. Longer Chinese examples are easier to distinguish from non-training examples. WikiMIA uses Wikipedia texts, BookMIA uses books, and PatentMIA uses Google Patents texts.

DC-PDD achieves the best detection AUC across most benchmark and target model combinations, showing statistically significant improvement over the Min-K% Prob baseline. It is especially useful for Chinese pretraining data, where lowercase-based detection is unsuitable and several baselines are limited by model access. Relative gains can be smaller on very small benchmarks, indicating that benchmark scale and token probability behavior can affect the comparison. DC-PDD ranks first on most model and benchmark settings Statistically significant AUC gain over Min-K% Prob Strong performance on Chinese data where lowercase-based detection cannot apply Limited gains on small benchmarks suggest sensitivity to sample size

The table compares pretraining text detection at a low false positive rate, with baselines performing unevenly across benchmarks and target models. The reported results indicate that DC-PDD is the strongest method overall and improves significantly over Min-K% Prob. Some baselines are limited by model access, text language, or benchmark size, explaining occasional exceptions. Detection performance varies by benchmark and target model rather than following a single baseline ranking DC-PDD is reported as the best method overall and significantly better than Min-K% Prob Lowercase and reference-based baselines show applicability limits on Chinese text or closed-source models

Across reference corpus options spanning general C4 and legal Case-law at two scales, DC-PDD maintains nearly stable AUC performance, showing limited sensitivity to corpus choice. The broader C4 setting at the larger scale yields the strongest result, consistent with more accurate token-frequency estimation. Reference corpus domain and scale produce only small differences in AUC. Larger C4 gives the best performance among the tested settings.

The table reports AUC scores for DC-PDD across five settings of the hyperparameter a on two PatentMIA targets and a BookMIA target. Detection performance changes noticeably as a varies, and poorly chosen values can weaken the separation between training and nontraining texts. A setting of 0.01 gives strong results across all evaluated models and is recommended for practical pretraining data detection. PatentMIA AUC scores for Baichuan-13B and Qwen1.5-14B peak when a is 0.01. BookMIA performance with GPT-3 is highest when a is 10, showing that the best setting can depend on target and benchmark. Overall, a low setting of 0.01 provides the most balanced AUC performance across the evaluated models.

The experiments evaluate pretraining data detection on WikiMIA, BookMIA, and PatentMIA, which cover English Wikipedia, book, and Chinese patent texts and distinguish training from non-training examples. The main results show that DC-PDD is the most effective method overall, particularly for Chinese data where lowercasing or reference-based baselines are less applicable, although very small benchmarks can make gains less pronounced and longer Chinese examples are easier to detect. Further studies show that DC-PDD is stable across different reference corpora and performs best with a small hyperparameter setting, supporting its robustness across model and corpus choices.