Min-K%++: Improved Baseline for Pre-Training Data Detection from Large Language Models
Authors: Jingyang Zhang
Jingwei Sun
Eric Yeats
Yang Ouyang
Martin Kuo
Jianyi Zhang
Hao Frank Yang
Hai Li
Venue: ICLR 2025 Spotlight (2025)
Keywords: pre-training data detection
large language model
Primary area: foundation or frontier models, including LLMs

Abstract: The problem of pre-training data detection for large language models (LLMs) has received growing attention due to its implications in critical issues like copyright violation and test data contamination. Despite improved performance, existing methods (including the state-of-the-art, Min-K%) are mostly developed upon simple heuristics and lack solid, reasonable foundations. In this work, we propose a novel and theoretically motivated methodology for pre-training data detection, named Min-K%++. Specifically, we present a key insight that training samples tend to be local maxima of the modeled distribution along each input dimension through maximum likelihood training, which in turn allow us to insightfully translate the problem into identification of local maxima. Then, we design our method accordingly that works under the discrete distribution modeled by LLMs, whose core idea is to determine whether the input forms a mode or has relatively high probability under the conditional categorical distribution. Empirically, the proposed method achieves new SOTA performance across multiple settings (evaluated with 5 families of 10 models and 2 benchmarks). On the WikiMIA benchmark, Min-K%++ outperforms the runner-up by 6.2% to 10.5% in detection AUROC averaged over five models. On the more challenging MIMIR benchmark, it consistently improves upon reference-free methods while performing on par with reference-based method that requires an extra reference model.

Published as a conference paper at ICLR 2025
MIN-K%++ IMPROVED BASELINE FOR DETECTING ELS
DATA FROM LARGE LANGUAGE MOD-
Jingyang Zhang'; Jingwei Sun'; Eric Yeats Yang Ouyang', Martin Kuo',
Jianyi Zhang', Hao Frank Vang!.2, Hai Li
Duke University Johns Hopkins University
github. wwwabb..ommmnnnnee io/mink-plus-plus.
ABSTRACT
The problem of pre-training data detection for large language models (LLMs) has received growing attention due to its implications in critical issues like copyright violation and test data contamination. Despite improved performance, existing methods are mostly developed upon simple heuristics and lack solid, reasonable foundations. In this work, we propose a novel and theoretically motivated method- ology for pre- pre-training data detection, named din+K Specifically, we present a key insight that training samples tend to be local maxima of the modeled distri- bution along each input dimension through maximum likelihood training, which in turn allow us to insightfully translate the problem into identification of local maxima. Then, we design our method accordingly that works under the discrete distribution modeled by LLMs, whose core idea is to determine whether the input forms mode or has relatively high probability under the conditional categorical distribution. Empirically, the proposed method achieves new SOTA performance across multiple settings (evaluated with 5 families of 10 models and 2 benchmarks). On the WikiMIA benchmark, Min-K outperforms the runner-up by 6.2% to 10.5% in detection AUROC averaged over five models. On the more challenging MIMIR benchmark, it consistently improves upon reference-fre methods while performing on par with reference-based method that requires an extra reference model.
INTRODUCTION
Data is one of the most important factors for the success of large language models (LLMs). As the training corpus grows in scale, it has increasing tendency to be held in house as proprietary data instead of being publicly disclosed (Touvron et al. 2023b Achiam et al.. 2023). However, for large-scale training corpora that consist of up to trillions of tokens (Computer) [2023), the sheer volume of the training corpus can lead to unintended negative consequences. For example, memorized private information is vulnerable to data extraction (Carlini et al.) 2021), and memorized copyrighted contents (e.g., books and news articles) may violate the rights of content creators (Grynbaum & Mac 2023 Knibbs 2023). Furthermore, it becomes increasingly likely that evaluation data is exposed at training time, bringing the faithfulness and effectiveness of evaluation benchmarks into question (Oren et al. 2023).
For these reasons, there has been growing interest in effective pre-training data detection strategies. be considered special case of Membership Inference Attack (MIA) (Shokri et al., 2017): the goal is to infer whether a given input has been used for training target LLM (see Figure left for illustration). Due characteristics pre-training corpora and training characteristics of LLMSs (Shi et al.) 2024 Duan et al. 2024). this problem has been shown to be much more challenging than conventional MIA settings (see Section
Pre-training data detection
2 for details). There are a few
methods proposed recently, dedicated to this problem (Carlini et al. 202 Mattern et al. 2023 Shi
"qqual contribution.

---

Published as a conference paper at ICLR 2025
Input Text
Pre-Trained LLN
16
The 2014 Coupe Ligue Final was 20th
Final of France's football league cup.-
0-3-
True Positivee Rate
Marchett''s constant the everage time spant person for commuting each day. Its volue...
score threshold:
Iraining data!
Rer NSSO 42
JUSON $7.3
score
threshold:
non-Ireining data!
Ro (Dars) 86.8
0.2
U.5.
Prediction
Scoring Function
Faloz Pas tive Rate
We study the pre-training data detection problem for LLMs (Shi et al. 2024 Duan et al. 2024). Given the grey-box access to the target LLM (only the logits, token probabilities, and loss are available), the goal is to design a scoring function that yields a score which (upon thresholding) best separates training and non-training text. Right: ROC (receiver operating characteristic) curves of various methods on WikiMIA benchmark (Shi et al. 2024). The AUROC (area under the ROC curve) score is denoted in the legend. Our Min-K%++ improves upon existing approaches by large margin.
Figure 1: Left:
et al. 2024). However, despite their improved performance, most existing methods are developed with simple heuristics, lacking solid and interpretable foundations.
In this work, we propose novel and thcoretically motivated methodology, Min-K%++ for pre- training data detection. Our exploration starts by asking fundamental question of "what characteris- ties or footprints do training samples exhibit within the model", where we answer it by revisiting the maximum likelihood training objective through the lens of score matching (Hyvärinen & Dayan 2005). Importantly, we uncover that for continuous distributions with maximum likelihood training, training data points tend be local maxima be located near local maxima along input dimensions, a key insight that allows us for the first time to translate the training data detection problem into iden- tification of local maxima. Then, upon theoretical insight, we develop a practical scoring mechanism that works for the discrete distribution modeled by LLMs. The core idea is to examine whether the input next token forms a mode or has relatively high probability under the conditional categorical distribution.
Empirically, we perform extensive experiments to verify the proposed method on two established
benchmarks with up to 5 families of models, including LLaMA (Touvron et al.) (023a). Pythia
(Biderman et al., 2023), and the new state-space architecture Mamba (Gu & Dao 2023). Figure [
right showcases the performance comparison between our method and previous ones. Notably, Min+K%+++ on average leads to 6.2% to 10.5% absolute increases over the runner-up Min-K% (Shi et al. 2024) the WikiMIA benchmark (Shi al. 2024). On the more challenging MIMIR benchmark, our method still consistently outperforms other reference-free methods and is on par with the reference-based method (Carlini et al., [021]: unlike reference-based methods which require another LLM to calibrate the likelihood, Min-K%+H applied to a standalone target LLM. We also seeectt-hile-geeeraiinn
study an online detection setting that simulates again performs the best. Lastly, Min-K%++ can also be interpreted from a calibration perspective: with ablation study we show that both calibration factors in the formulation contribute to the overall high performance. We summarize our contributions as follows:
the proposed Min-K%++
(1) We establish that for maximum likelihood training, training instances tend to form local maxima or locate near local maxima along each input dimension (under continuous distributions), allowing us to turn training data detection into local maxima identification. (2) We develop novel and sound methodology for LLM training data detection which functions by examining whether the input forms a mode or has relatively high probability under the conditional categorical distribution. (3) We demonstrate remarkable improvements over existing methods on established benchmarks.
RELATED WORK
Membership Inference Attacks. MIA has long been a security and privacy-related topic. Given target model and target input, MIA aims to infer whether the input has been used to train the
2

---

Published as a conference paper at ICLR 2025
target model (Shokri al. 2017: Yeom et al. 2018). It has been extensively studied in both vision
(Carlini et al. 2022a b] 2023b] Zarifzadeh et al. (023) and language domains (Carlini et al. 2021
Watson et al. 2022; Mattern et al. 2023). Besides investigations
advanced methodologies, MIA
also has profound implications in quantifying privacy risks (Mireshghallat) et al. 20222) measuring
memorization (Carlini al., 2023a), helping with privacy auditing (Steinke et al. 2003 Yao et al.
2024), and detecting test-set contamination (Oren et al. (023) and copyrighted contents (Mecus et al.
2023; Duarte et al., 2024). In particular, benchmark leakage has been a serious problem in the LLM
era, and researchers have dedicated endeavors towards assessing and/or mitigating it (Xu et al. 2024
Zhang et al.) 2024).
Pre-training data detection for LLMs. Despite being an instance of MIA (the general definition and evaluation metrics remain the same), this problem poses unique challenges compared with conventional MIA settings (Shi et al., 2024, Duan et al. 2024). For example, many early MIA methods need to train shadow models on the same distribution as the target model, which is no longer practical as many LLMs' pre-training corpus is nonpublic. Second, characteristics of LLM pre- training (e.g,, few training epochs, large-scale training) inherently makes MIA much more challenging. Lastly, most existing works on MIA against LLMs target the fine-tuning stage (Mireshghallah et al., 2022b; Fu et al. 2023) Mattern et al. 2023). which cannot transfer to the pre-training stage for the same reasons.
As a result, there has been growing interests in pre-training data detection recently, though it is still largely underexplored. (Shi et al. (2024), to our knowledge, is the first investigate this problem. They contribute the WikiMIA benchmark and propose the 4 method. Duan et al. (2024) perform systematic evaluation with the constructed MIMIR benchmark and analyze the challenges. There are also works that specifically investigate copy-righted content detection, e.g,, identifying memorized books (Duarte al. 2024). In this work, we propose novel method that outperforms the
previously best-pent rest-performing Min- K% and achieve superior performances over existing (reference-free) methods on both benchmarks. In addition, our insightful finding of that training data tends to form local maximum is unique, which relates to but complements and solidifies previous intuitions that LLM's s output distribution is most likely to be peaked when it is emitting memorized data (Dong
al. 2024
3
BACKGROUND
In this section, we first cover the problem statement of pre-training data detection defined by prior works (Shokri et al., 2017 Shi et al. 2024 Duan et al. 2024). Then we briefly introduce how LLMs work and how they are traind.
Problem statement. Pre-training data detection is an instance of Membership Inference Attack (MIA) (hhkri et al., (2017). Formally, given 1) a data instance and 2) pre-trained auto-regressive LLM M that is trained on dataset D, the goal to infer whether x E 'D or not (i.e., x is training data or non-training data). The approach to detection leverages a scoring function s(z; M) that computes a score for each input. A threshold is then applied to the score to yield a binary prediction:
[1 (x D), s(r: () <>'
s(x: 2
prediction M)
where A is a case-dependent threshold. Following the established standard (Mattern et al. 2023
Shi et al. 2024 Duan al., 2024), we consider grey-box access to the target model M, meaning that one can only access the output statistics including the loss value, logits, and token probabilities. Additional information such as the model weights and gradients are not available. In summary, the key to the pre-training data detection is to design appropriate scoring function that best separates training data from non-training data.
(Auto-regressive) LLMs. LLMs are typically trained by maximum likelihood training that maximizes the probability of training token sequences (Radford et al. 2019 Brown et al. (020)). In particular, auto-regressive LLMs decompose the probability of token sequence (x), 22, .... 2x) with chain rule (Wikipedial 2023). i.e., p(#1, I2, 23) = p [21, I2 ...) p(#1 22, It..) For brevity, throughout the paper we abbreviate the prefix of 2, as T<t. At inference stage, LLMs yield new tokens one by one according to its predicted conditional categorical distribution p( (x<{)) over the vocabulary.
3

---

Published as a conference paper at ICLR 2025
4 MIN-K%++
In this section we introduce our methodology, called Min-K%++. We start by discussing our grounding observation around general maximum likelihood training for continuous distribution, where we unveil that training samples tend to form local maxima or locate near local maxima along each input dimension of the distribution captured by the model. This insight allows us to introduce unique and theoretically sound perspective for addressing the problem. Then, translating our insight into a practical solution, we formulate the proposed Min-K which works for discrete inputs of LLMs by examining whether the input forms a mode or has a relatively high probability under the conditional categorical distribution of the predicted next token.
4.1 MOTIVATION & INSIGHT
To approach the pre-training data detection problem, unlike prior methods that often rely on heuristics (Yeom et al. 2018, Carlini et al. 2022a Shi et al., (024), we choose to start our in-depth exploration by asking fundamental question that existing works fail to touch to knowledge. That is, what characteristics or "footprints" " do training samples leave to the model after training? Since training data interacts with the model through training-time optimization, to answer the question, revisit the maximum likelihood training objective of (auto-regressive) LLMs through the lens of score matching (Hyvärinen & Dayan 2005). For the ease of discussion, let generalize from LLMs, which model discrete distribution over tokens, to the general maximum likelihood training with continuous distribution for now.
Earlier, Koehler et al. (2022) have proved that implicit score matching (ISM) objective (Hyvärinen) & Dayan 2005) a relaxation (within a multiplicative factor) of maximum likelihood estimation. Consequently, one can reformulate the maximum likelihood training loss with ISM as
(x)((x))
2 11))))
Ox;
the sum of the second-order purtial derivalives
where (xx))
3 plgg(()) 8x
is the score function (Hyvärinen & Dayan 2005) for a d-dimensional input
æ, æz is the element at the i-th dimension of æ. v/s(a)) 8log plæ) and N is the number of training samples. Without ambiguity, are omitting the model parameters in the formulation of for brevity.
Remark. It can be seen from Equation 2 that maximum likelihood training implicitly minimizes both 1) the magnitude of first-order derivatives of likelihood log p(x) w.r.t. x and 2) the sum of the second-order partial derivatives of log p(x:) w.r.t each dimension of æ. As result, we posit that the first-order [lg will be close to 0 and the second-order 8 log plae) will be minimized Oa.
be negative for training samples. Importantly, according the univariate (Wainwright et al. 2005), the implication here is that when looking along each dimension of the input (corresponding to each æ;), training data points tend form local maxima or be located near local maxima of the likelihood. Given this key insight, we can translate the problem of detecting training data into identifying whether the input is local maximum or locates near a local maximum (along inpul dimensions), providing a novel and theoretically grounded perspective for tackling this task.
-ooondddrivvatie test
Empirical evidence. It turns out that we can empirically verify our theoretical insight the continu- ous space by considering diffusion model for image generative modeling, as 1) pixel values (after preprocessing) are continuous, and 2) diffusion models are trained by maximizing the (variational lower bound of) log likelihood (Ho et al. 2020 Here we test whether the input is a local maximum along each input dimension by perturbing random pixels of the image (one pixel corresponds to one dimension of the input) and comparing the likelihood of the original image with that of the perturbed one The result is shown in Figure 2 We see that the training image (with unperturbed pixel) is
'The ideal way of testing whether the training images form local maxima along each input dimension would be to compute the first and second-order partial derivative of log likelihood w.r.t. each pixel. However, this would be computationally infeasible evaluating likelihood with diffusion model involves series of chained forward passes with thousands of steps (the computation graph would be too large compute the gradients).
4

---

Published as a conference paper at ICLR 2025
petataaoo
peraaatoon
panatates
In each plot, we perturb a random pixel of a random training image of a diffusson model trained on CIFAR-10 and evaluate the (variational lower bound of) log likelihood. Perturbing certain pixel is essentially moving the input along certain dimension. We mark the original pixel with orange and the perturbed pixels with blue. We see that the training input (with the unperturbed pixel) is indeed the local maximum (the concave pattern), effectively echoing theoretical discussion.
Figure 2:
indeed the local maximum within its vicinity. This experiment thus verifies our theoretical insight, and actually hints at the potential of applying our idea to other modalities and models beyond LLMs.
4.2 FORMULATING MIN-K%++
From insights to actual method. Our insight essentially indicates that training input tends to have higher probability than other neighbor input values along each input dimension. In the context of LLMs, each dimension of the token sequence corresponds to token. Therefore, translating the insight to the discrete categorical distribution of LLMs, we posit that each training token will tend to have higher probability relative to many other candidate tokens in the vocabulary, even form mode of the conditional distribution modeled by the LLM.
To achieve this, the core idea of our actual method is to compare the probability of the target token with the expected probability of all tokens within the vocabulary. Concretely, we propose the following formulation for our Min-K%++
log logp(z, x p.lze
Min- +token sog (2 xx)
(3)
J.Jrc
Min-K%++(11)
Σ
Min- Min-K%+Ho taken sey, (Iee, 2t).
| (men::+))min-455
Here, [llere Es-p(- (log probability over the vocabulary of the model given the prefix Jet. and J.juze / (ee (logp(z(==<)) - p. )2] the standard deviation. In practice, both terms can be computed analytically since the categorical distribution p(- p(-(a is encoded by the output logits of the model, which we have access to. The computation of Min-K %+++ incurs no computational overhead on top of LLM inference,
is the expectation of the next token's log
illustrate in Appendix A
Upon the sequence-wisc score computed by Equation we adopt a similar strategy to Shi et al. (2024) where we select the k% of the token sequences with the minimum score and compute the average over them to obtain the final sentence-wise score, as described by Equation (4). This is because in practice LLM training minimizes the loss of all possible sequences in each training text/sentence. Therefore, by computing an aggregated score we expect to get a more robust estimation for the full sentence input. While our method is closely motivated by our theoretical insight, below we provide further interpretations for more comprehensive understanding.
Interpretation 1: More robust identification of the mode. We have translated training data detection into determining whether the input token has high probability the conditional distribution. Besides motivating our method, this unique scheme also allows us to understand why existing methods may be sub-optimal (which was unclear earlier since they were mostly developed upon heuristics).
forms mode of
Specifically, let take the sfate-of-the art Min-K% (Shi et al. 2024) as example, which uses the token probability as the score based on a simple intuition that training texts are less likely to include low-probability "outlier" tokens. This actually may not identify the mode robustly accurately as
5

---

Published as a conference paper at ICLR 2025
0.6
log probabiiity probabinity
p((p)c))
logpix/KKed
0.4
Mir = fogggt..l =a)
0.2
0
-2
4
(e)
(b)
all tokens in the vocabulary
all tokens in the vocabulary
Figure 3: A conceptual example showcasing the idea of Min-K%+++ (a) and (b) show two next token distributions for two different input token sequences (I<a, Te). The bars with the hatch pattern (?I1") correspond to the target next token Iy. Existing methods often measure the exact next token probability of 24 (hatched bars), which fails to separate these two inputs due to the same probability (0.2). By comparison, Min-K determines if zi forms a mode or has relatively high probability by comparing p(a (r)))) with ul ; the score is the difference between the red and pink dashed lines. See text for detailed discussion.
token probabilities can vary a lot across different inputs. For example, some training texts may be rare or inherently difficult leart thus having low token probabilities despite still being the mode. Our design, in contrast, can account for such cases since it explicitly compares the log likelihood of the target next token p(re (e and the expected log likelihood over all candidate tokens j.lme.s- Regardless of the absolute value of the token likelihood, the larger log ((tx)(/<<))) Ml|pe. is, the more likely Fe forms a mode or has a relatively high probability among the vocabulary.
To this more clearly, let us consider conceptual example depicted in Figure 3 where we show the predicted next token probability distribution for two different input token sequences (I<r,, Tz), supposing vocabulary of size 10. In the two cases (Figure 3 (a) and (b)), both p(a, (x<<)) is 0,2. Existing methods often measure exactly the next token probability (Shi et al. 2024) and thus will give the same judgement to both inputs (e.g., that the sequence (Ie), was not seen the training). However, inspecting them with the idea of our Min-K%++ reveals their distinct characteristics.
In Figure 3 (a), one can notice that the distribution actually peaked at sy (the bar with the hatch pattern V/"), indicating that the current sequence x; forms mode of p(-Jarer) and is very likely to have appeared in the training. In Figure 3 (b), the probubility distribution is not peaked at az as there is another token that gets assigned much larger probability mass. This means that x; is less likely to follow the prefix Z<t according to the learned distribution of the model, which should be seen as an indicator that the sequence (I<t,, 2:4) was not seen in the training.
The above reasoning can be concisely reflected by comparing log p( (2)) and [l.ja.... which are marked by the two dashed lines in Figure 3 Accordingly, it can be seen that Figure (a) and (b) exhibit positive and negative por (+) Pllaze respectively, which successfully separate them apart.
Interpretation 2: A calibration perspective. Reference- membership inference attacks (Carlini al., 202 l) show superior performance by calibrating the (sentence-level) likelihood with certain "references" such as the likelihood of the same input on a smaller LLM, the Zlib entropy, or the likelihood of lowercased text. In this regard, Min-K%++ can be seen as a calibrating method, too, where it calibrates the next token log likelihood with two calibration factors, Pl ance and Jm Our method is unique that instead of using some external references (e.g., an extra L.MM), we leverage the statistics that can be readily computed with the target model only.
Concretely, the effect of plaz has been thoroughly discussed in the first interpretation. The inclusion of G. is inspired by temperature scaling (Guo et al.] (017), a technique for calibrating the prediction probability of neural networks. scales the model output by a constant and has been shown to benefit tasks like out-of-distribution detection (Liang et al., 2018 Zhang et al. (023). Such idea is well-suited for our task and method as we are closely looking at the the predicted
Ww note that rare and difficult-to difficult-to-eearinng training texts could be challenging for all methods and needs more research efforts in the future. Here we use such scenario only to exemplify the advantage of over existing methods.

---

Published as a conference paper at ICLR 2025
probabilities of LLMs. In the meantime, while temperature scaling a constant scaling factor, we posit that the suitable temperature can vary across inputs and models for training data detection. Therefore, we intend to have a dynamic scaling factor that is adaptive to different cases, which would make the calibrated score more robust. Specifically, by using the standard deviation a-jac as the calibration factor, we are essentially doing z-score normalization over log p( making the value of log p( (x=<e) more comparable across different cases. Later we will demonstrate that both factors contribute to the success of Min-K%++ through ablation study.
5 EXPERIMENTS
We conduct extensive experiments to validate the empirical efficacy of the proposed Min-K%+++. We first focus on two established benchmarks for pre- pre-training data detection. Following that, ablation studies are presented and discussed.
5.1 SETUP
Benchmarks. We focus on two benchmarks (and the only two to our knowledge) for pre-training data detection, WikiMIA (Shi et al.) 2024) and MIMIR (Duan et al. 2024). WikiMIA is the first benchmark for pre-training data detection, which consists of texts from Wikipedia events. The training non-trainn non-training data is determined by the timestamp. WikiMIA specifically groups data into splits according to the sentence length, intending to provide a fine-grained evaluation. It also considers two settings: original and paraphrased. The former assesses the detection of verbatim training texts, while the latter paraphrases the training texts (using ChatGPT) and evaluates on paraphrased inputs.
MIMIR (Duan al. 2024) is built upon the Pile dataset (Gao et al. 2020), where training samples and non- con-training samples are drawn from the train and test split, respectively. MIMIR is found to be more challenging than WikiMIA since the training and non-training texts from the same dataset and thus have minimal distribution shifts and temporal discrepancy (Duan et al. 2024).
Baselines. We consider 6 representative and state-of- of-the-art methods our baselines, which also featured in the benchmarking work of Duan et al. (2024). Loss method (Yeom et al. 2018) is general technique that directly takes the loss as the score for detection. In the context of LLMs, this method is also reasonable as it is found that perplexity (the exponential of cross-entropy, can be a proxy for the occurrences of the training data (Gonen et al.) 2023). Reference method (Carlini et al. (021) (Ref)) uses extra L.M as reference to calibrate the likelihood of the input. Zlib and Lowercase method (Carlini et al. 202T) use zlib compression entropy and the likelihood of lowercased text as the reference to calibrate the likelihood, respectively. Neighbor method (Mattern et al. 2023) perturbs the input sentence with masked language models to create "neighbors" and calibrate the loss of the input sentence with the average loss of the neighbor sentences. Lastly, Min-K% (Shi et al. 2024 examines the exact token probability and averages a subset of minimum token scores over the input; it is currently the best-performing method on WikiMIA. For all methods,
either take the recommended configuration directly from the used benchmarks (Duan et al. (024) or choose the hyperparameters with a hold-out validation set, following (Shi al. (2024). Later we will show that the proposed Min-K K% is robust against its byperparameter k and obtains performance improvements over wide range of k values.
Models. WikiMIA is applicable to a wide range of models since Wikipedia dumps are often included into the training corpus of many LLMs. Specifically, we consider 5 families of models, including Pythia (Biderman et al. 2023) (B.8B. 6.9B, 12B). GPT-NeoX (Black et al. 2022) (20B), LLaMA (Touvron al. 2023a) (I3B, 30B, 65B), OPT (Zhang et al. 2022) (66B), and the new state-space model architecture Mamba (Gu & Dao 2023) (1.4B, 2.8B). When reference model is needed, following Shi et al. (2024) we use the smaller version correspondingly. e.g., LLaMA-7B for L.AMA models and Pythia-70M for Pythia models. MIMIR is applicable models that trained on Pile. To be consistent with Duan et al. (2024). we focus on Pythia models (160M. 1.4B, 2.8B, 6.9B, 12B). In Appendix B provide further details to show that WikiMIA and MIMIR are indeed the right datasets for these models.
Metrics. As binary classification problem, the detection performance be evaluated with the AUROC score (area under the receiver operating characteristic curve) (Carlini et al., [221]] Shi et al. 2024 Duan al. 2024). We define training data as "positive" and non-training data "negative".
7

---

Published as a conference paper at ICLR 2025
Table I: AUROC results WikiMIA benchmark (Shi 2024 Ori. and Para. denote the original and paraphrased settings, respectively, Bolded number shows the best result within each column across all methods. The proposed Min-K%++ leads to remarkable improvements over existing methods in most settings.
Mamba-1.4B
Pythia-6.9B
LLaMA-13B
LLaMA-30B
LLaMA-65B
Average
Len.
Method
Ori.
Para.
Ori.
Pora.
Ori.
Pora.
Ori.
Para
Ori.
Para
Ori.
Para.
Loss
61.0
61.4
63.8
64.1
67.5
68.0
69.4
70.2
70.7
71.8
66.5
67.1
Ref
62.2
62.3
63.6
63.5
57.9
56.2
63.5
62.4
68.8
68.2
63.2
62.5
Lowercase
60.9
60.6
63.2
64.1
61.2
64.8
Zlib
61.9
62.3
64.3
64.2
67.8
68.3
69.8
70.4
71.1
72.0
67.0
67.4
Neighbor
64.1
63.6
65.8
65.5
65.8
65.0
67.6
66.3
69.6
68.7
66.6
65.8
Min-K%
63.2
62.9
66.3
65.2
68.0
68.4
70.1
70.7
71.3
72.2
67.8
67.9
Min- ++++
66.8
66.1
82.7
84.3
78.3
Loss
58.2
56.4
60.7
63.1
66.2
67.9
67.7
Ref
60.6
59.6
62.4
62.9
63.4
60.9
69.0
65.4
73.4
71.0
65.88
63.9
Lowercase
57.0
57.0
58.2
57.7
62.0
61.0
62.1
59.8
64.5
61.9
60.8
59.5
Zlib
60.4
59.1
62.6
61.6
65.3
65.3
67.5
67.4
69.1
69.3
65.0
64.5
Neighbor
60.6
60.6
67.1
69.5
Min-K
62.2
58.0
65.0
61.1
66.0
64.0
68.5
65.7
69.8
67.9
66.3
63.3
Min-K%+++ K%+++
67.2
63.3
71.6
64.8
85.7
78.8
84.7
74,9
83.8
74.0
78.6
71.2
Loss
63.3
62.7
65.1
64.7
67.8
67.2
70.3
69.2
70.7
70.2
67.4
66.8
Ref
62.0
61.1
63.3
62.9
62.6
59.7
71.9
70.0
73.7
72.0
66.7
65.1
Lowercase
58.5
57.7
59.1
63.3
60.1
128
Zlib
65.6
65.3
67.6
67.4
69.7
69.6
71.8
71.5
72.1
72.1
69.4
69.2
Neighbor
64.8
62.6
67.5
64.3
68.3
64.0
72.2
67.2
73.7
70.3
69.3
65.7
Min- K%
66.8
64.5
69.5
67.0
71.5
68.7
73.9
70.2
73.6
70.8
71.0
Min- K
68.8
65.6
82.6
80.0
70.7
70.6
AUROC is threshold- iinhooldddideeeeeentt and can interpreted as the the probability that a positive instance has higher score than negative instance according to the detector. Therefore, the higher the better, and the random- guesssng baseline is 50%. While we use AUROC as the main metric, we also report True Positive Rate (TPR) at low False Positive Rate (FPR) which measures detection rate at meaningful threshold.
5.2 RESULTS
WikiMIA results. Table shows major results terms of AUROC; for results on more models and TPR numbers, please see Appendix TabidssixDTbbes to We remark that Min-K%+ achieves significant improvements over existing methods. In the original setting, Min-K%+++ on average outperforms the runner-up Min-K% by (10.5%. 12.3%. 6.2%} with inputs of length (32, 64, 128), respectively. In the paraphrased setting, M+++K%++ is also the best-performing approach on average in all cases.
Min-K %++ + is consistent across models and input lengths. It can be noticed that Min-K%++'s superior results are agnostic to models: besides transformer-basee L.Mss, Min-K%++ also decently outperforms others on the new state space-based architecture, Mamba. In terms of input length, Shi et al. (2024) identify that short inputs are more challenging than longer inputs. While this is indeed the case for Min-K% which yields (62.2%, 66.8%) AUROC (64, 128]-length inputs with Mamba-1.44 1.4B (a 4.6% decrease when changing to shorter inputs), Min- K%+++ achieves a much more consistent performances of (67.2%, 68.8%) } (a mere decrease of 1.6%). Both observations demonstrate the robustness and generality of our proposed method.
MIMIR results. Table shows the AUROC results; see Appendix Table for TPR results. Most numbers are taken from those reported by Duan et al. (2024). MIMIR is challenging in that the training and non-training texts are maximally similar to each other since they are drawn from the %+++
same dataset. Nonetheless, Min-K M+++ still improves upon existing (reference-free) methods in most cases. Averaged over subsets, Min-K%++' 's relative AUROC w.r.t. the powerful Min- K% is (-0.2% +0.5%, +1.1%, 16, +1.8%, +2.8% on Pythia model with 160M, 1.4B, 2.8B, 6.9B, 12B) parameters, respectively. Extrapolating this trend, we anticipate Min- K 's effectiveness to be obvious with larger models.
8

---

Published as a conference paper at ICLR 2025
Table 2: AUROC results the challenging MIMIR benchmark (Duan et al. 2024) with suite of Pythia models (Biderman et al. 2023)). In each column, the best result across all methods is bolded, with the runner-up underlined. Ref relies on an extra reference LLM. #Neighbor induces significant extra computational cost than others (25x in this case), for which reason we don't 't run on the 12B model. Despite not requiring a reference model like the Ref method does, our Min-K%++ consistently achieves superior or comparable performance.
Wikipedia
Github
Pile CC
PubMed Central
Method
160M
1.4B
2.8
6.9B
12B
160M
1.4B
2.80
6.9B
12B
160M
1.4B
2.80
6.9B
12B
160M
1.4B
2.8
6.9B
12B
Loss
50.2
51.3
51.8
52.8
53.5
65.7
69.8
71.3
73.0
74.0
49.6
50.0
50.1
50.7
51.1
49.9
49.8
49.9
50.6
51.3
"Ref
51.2
55.2
88.1
61.8
63.9
63.9
67.1
65.3
64.4
63.0
49.2
52.2
53.7
54.9
56.7
51.3
53.1
83.7
55.9
58.2
Zlib
51.1
52.0
52.4
53.5
54.3
67.4
71.0
72.3
73.9
74.8
49.6
50.1
50.3
50.8
51.1
49.9
50.0
50.1
50.6
51.2
Neighhor
51.7
52.2
53.2
1
72.1
49.6
50.0
47.9
49.1
49.7
50.1
Min-K%
50.2
51.3
51.8
53.6
54.4
65.7
69.9
71.4
73.2
14.3
50.3
51.0
50.8
51.5
51.7
50.6
50.3
50.5
51.2
52.3
Min- M+++KX++++
49.7
53.7
35.1
58.0
61.1
64.8
69.6
70.9
72.8
74.2
50.6
51.0
51.0
53.0
53.5
50.6
514
52.4
54.2
55.4
ArXiv
DM Mathematics
HackerNews
Average
Method
160M
1.4B
288
6.9B
12B
160M
1.4
2,8B
6.9B
12B
160M
1.4B
2.88
6.9B
12B
160M
1.4B
2.8B
6.9B
12B
Loss
$1.0
51.5
51.9
52.9
53.4
48.8
48.5
48.4
48.5
48.5
49.4
50.5
51.3
52.1
52.8
52.1
53.1
53.5
54.4
54.9
'Ref
49.4
51.5
53.1
55.8
57.5
51.1
$1.1
50.5
51.1
50.9
49.1
52.2
55.1
57.9
60.6
52.2
54.6
55.6
57.4
58.7
Zlib
51.3
52.2
48.1
48.1
53.2
53.6
Neighbor
50.7
51.4
51.8
52.2
49.0
47.0
46.8
46.6
f
50.9
51.7
51.5
51.9
52.0
52.9
53.2
53.8
Min K
51.0
51.7
52.5
53.6
54.6
49.4
49.7
49.5
49.6
49.7
50.9
51.3
52.6
53.6
54.6
52.6
53.6
54.2
55.2
55.9
+++
53.7
55.2
50.5
5U.
52.6
54.5
5244
54.1
55.3
57.0
One powerful method on MIMIR is the Reference approach (Carlini et al. 2021) (Ref). However, needs to perform inference with another LLM, which is expensive and much less feasible. Further- more, the actual results of Ref on MIMIR are obtained by exhaustively trying out 8 different LLMs the reference model and picking the best one (Duan et al.) 2024). In contrast, does not rely on a reference model, yet provides competitive performance that on par with Ref. Meanwhile, remark that Min-K%++ achieves methods (as evidenced in the "Average" tab in Table Lastly, in Appendix D Table Min-K + outperforms all baselines when it comes to TPR performance.
Min-K%++
SOTA results among all the reference-
An online detection setting. We further study an online detection setting to simulate a "detect-while- generating" scenario which help minimize the generation of memorized and sensitive content. In nutshell, we approximate such setting by adapting WikiMIA and perform experiments which have shown that the proposed method again outperform existing ones by noticeable margins. See Appendix for details.
5.3 ABLATION STUDY
We focus WikiMIA with LLaMA-13B model for ablation study.
Ablation on the hyperparameter 1%. k determines what percent of token sequences with minimum scores chosen to compute the final score. From Figure 4 it is obvious that Min-K%++ is robust to the choice of k; with the best and the worst result being 84.8% and 82. 1% (a variation of 2.7%), respectively. Min-K% has similar hyperparameter but is more sensitive it: the variation between the best (68.0%) and the worst result (63.6%) is 4.4%, slightly larger than that of Min-K%++
Decomposing the contribution of calibration factors. Recall that our method can be interpreted as calibrating the log probability p(xx/( with two calibrationg factors jllaac and 0. (Equation 33). In Table 3. we decompose the effect of ji and o J-neee Specifically, starting from the log probability p(z, (re)), gradually incorporate /l|re. and 0. into the score computation, until we reach the final formulation of our Min-K % For example, when log ((x)( and T.Ize are included (marked by Vin Table 3). the token-wise score becomes log log p(ay(az)) From the results, we see that calibrating the log probability with either jact az
lxage
alone already leads to 9.3% and 7.0% performance boosts over using raw log probability, Combining them together, which leads the formulation specified by Min-K+++, takes advantage from both

---

Published as a conference paper at ICLR 2025
81.8
Table 3: Decomposing the token-wise of Min-K%+++ in Equation (3). The last row corresponds the final design of our Min- k%++.
AUROC
75
Min-Ke
Min K%
log p( (1)))<<)))
Mast
azst
AUROC
65 63.6
68.0
40
00
hyperparameter k
77.3
Figure 4: Ablation on k: Min-K%++ robust to the hyperparameter choice.
75.0
84.8
factors and results in larger improvement of 16.8%. Such observation again validates the proposed method.
CONCLUSION AND DISCUSSION
In this work, we propose Min-K %+++ as a novel method for pre-training data detection for LLMs. Motivated by our insight that training data tends to be local maximum or locates near local maximum along input dimensions, we design our method to examine whether the input forms the mode or has relatively high probability under the conditional categorical distribution of the LLM. It consistently achieves superior performances on two existing benchmarks and in various settings, which establishes solid baseline for future studies. We hope that method, along with our theoretical and empirical analysis, can motivate more research upon the pre-training data detection problem.
ACKNOWLEDGEMEETT
This work is supported by NSF CNS CNN-223380812, NSF CNS-2112566 and DoD W91 INF-23-22-02
REFERENCES
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Almman Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint (.X.::2333.08777 2023.
Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbie Bradley, Kyle OBrien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, et al. Pythia: A suite for analyzing large language models across training and scaling. In International Conference Machine Learning, pp. 2397-2430. PMLR, 2023.
Sidney Black, Stella Biderman, Eric Hallahan, Quentin Gregory Anthony, Leo Gao, Laurence Golding. Horace He, Connor Leahy, Kyle McDonell, Jason Phang. Michael Martin Pieler, USVSN Sai Prashanth, Shivanshu Purohit, Laria Reynolds, Jonathan Tow, Ben Wang, and Samuel Weinbach. GPT-neox-20b: An open-source autoregressive language model. In Challenges & Perspectives in Creating Large Language Models, 2022. URL
net forummid
H1 11Z155
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhari- wal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agar- wal, Ariel Herbert- Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel Ziegler, Jeffrey Wu, Clemens Winter, Chris Hesse, Mark Chen, Eric Sigler, Ma- teusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCan- dlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learners. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Ad- vances in Neural Information Processing Systems, volume 33, pp. 1877-1901. Curran Asso- ciates, Inc., 2020. URL htw.:///ww.aatttpee///eeeeeeane. 4000 http://5000000000004000002022220
files/paper/
10

---

Published as a conference paper at ICLR 2025
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagieiski, Ariel Herbert- Werserr--osss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pP. 2633-2650, 2021.
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first prineiples. In 2022 IEEE Symposium on Security and Privacy (SP), pp. 1897-1914. IEEE, 2022a.
Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nicolas Papernot, Andreas Terzis, and Florian Tramer. The privacy onion effect: Memorization is relative. Advances in Neural Information Processing Systems, 35:13263-13276, 13276, 2022b.
Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. In ICLR, 2023a.
Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 5253-5270, 2023b.
Together Computer. Redpajama: an open dataset for training large language models, October 2023. URL
RedPaa ama Data
Yihong Dong, Xue Jiang, Huanyu Liu, Zhi Jin, Bin Gu, Mengfei Yang. and Ge Li. Generalization or memorization: Data contamination and trustworthy evaluation for large language models, arXiv preprint arXiv:2402.15588 2024.
Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. Do membership inference attacks work on large language models? arXiv preprint arXiv:2402.07841 2024.
Andr V. Duarte, Xuandong Zhao, Arlindo L. Oliveira, and Lei Li. DE-COP: Detecting Copyrighted Content in Language Models Training Data, 2024.
Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Practical membership inference attacks against fine-tuned large language models via self self-prompt calibration, 2023.
Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, et al. The pile: An 800gb dataset of diverse text for language modeling, arXiv preprint (tt::2001.0022. 2020.
Hila Gonen, Srini Iyer, Terra Blevins, Noah Smith, and Luke Zettlemoyer. Demystifying prompts in language models via perplexity estimation. In Houda Bouamor, Juan Pino, and Kalika Bali (eds.), Findings of the Association for Computational Linguistics: EMNLP 2023, pp. 10136-10148, Singapore, December 2023. Association for Computational Linguistics. 2023
doi: 11.86653/1/2222 findings-emnlp.679, URL Findings emm p.
Michael M. Grynbaum and Ryan Mac. The times sues openai and microsoft over a.i. use of copyrighted work. https:/ wwww www.nnytimes.. http://mmmmmmmmmm/////// new york timeeme meme open ai microsoft wwwpoosooottwassttttttoemm....ee wwwsuit. html 2023.
Albert Gu and Tri Dao. Mamba: Linear-time sequence modeling with selective state spaces, arXiv preprint arXiv:2312.00753 2023.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Weinberger. On calibration of modern neural networks. In ICML, 2017.
Jonathan Ho. Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851 2020.
Aapo Hyvärinen and Peter Dayan. Estimation of non-normalized statistical models by score matching. Journal of Machine Learning Research, 6(4), 2005.
11

---

Published as a conference paper at ICLR 2025
Kate Knibbs. The battle over books3 could change ai forever. https: www. www.wwww.e...o http::://wwwwwtt
story/battlee-vve-bookss 2023.
Frederic Koehler, Alexander Heckett, and Andrej Risteski. Statistical efficiency of score matching:
The view from isoperimetry. arXiv preprint arXiv:2210.00725 2022.
Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. In ICLR, 2018.
Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schoelkopf, Mrinmaya Sachan, and Taylor Kirr-Kirkpatrick. Membership inference attacks against language models via neigh- bourhood comparison. Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki (eds.), Findings of the Association for Computational Linguistics: ACL 2023, pp. 11330- 11343, Toronto, Canada, July 2023. Association for Computational Linguistics. doi: 10.3 http://////22222..nnaanaaaaaa.. findings-acl.719. URL http:httts/accllloo //ac///th/laaaahoooooaoooo ogy. wttg/222... findinggnnc.da.oc.. 719.
Matthieu Meeus, Shubham Jain, Marek Rei, and Yves-Alexandre de Montjoye. Did the neurons read your book? document-leve membership inference for large language models. arXiv preprint 1oXiv:2310.15007, 2023.
Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Kang-Kirkpatrick, and Reza Shokri. Quantifying privacy risks of masked language models using membership inference attacks. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang (eds.), Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pp. 8332-8347, Abu Dhabi, United Arab Emirates, December 2022a. Association for Computational Linguistics. doi: org. wttpr//2222.e..m111mme main. 570
emnlp- mallp-mmai..77... URL httpt:ttppppaatteteeette
Fatemehsadat Mireshghallah, Archit Uniyal, Tianhao Wang, David K Evans, and Taylor Berg- Kirkpatrick. An empirical analysis of memorization in fine-tuned autoregressive language models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing. pp. 1816-1826, 2022b.
Yonatan Oren, Nicole Meister, Niladri Chatterji, Faisal Ladhak, and Tatsunori B Hashimoto. Proving test set contamination in black box language models. arXiv preprint 1312:2331..7663,, 2023.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695 2022.
Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. In The Twelfth International Conference on Learning Representations, 2024.
met/forund idd -id
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEEE, 2017.
Thomas Steinke, Milad Nasr, and Matthew Jagielski. Privacy auditing with one (1) training run. In NeurlPS, 2023.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint (xXiw:2302.13977 2023a.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Ilama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 20233
Kevin Wainwright et al. Fundamental methods of mathematical economics. McGraw-Hie 2005.
12

---

Published as a conference paper at ICLR 2025
Lauren Watson, Chuan Guo, Graham Cormode, and Alexandre Sablayrolles. On the importance of difficulty calibration in membership inference attacks. Internationaal Conference on Learning Representations, 2022. URL
Wikipedia. Chain nule (probability). 2023. URL httpss//en.wkkjpccaaarr//////
Ruijie Xu, Zengzhi Wang, Run-Ze Fan, and Pengfei Liu. Benchmarking benchmark leakage in large language models. arXiv preprint arXiv:2404. 18824, 2024.
Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang, Zezhou Cheng, and Xiang Yue. Machine unlearning of pre-trained large language models. arXiv preprint wrXiv:2402.15/59 2024.
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pp. 182. IEEE, 2018.
Sajjad Zarifzadeh, Philippe Liu, and Reza Shokri. Low-cost high-power membership inference by boosting relativity. arXiv preprint urXiv2231..03200 2023.
Hugh Zhang, Jeff Da, Dean Lee, Vaughn Robinson, Catherine Wu, Will Song, Tiffany Zhao, Pranav Raja, Dylan Slack, Qin Lyu, et al. A careful examination of large language model performance on grade school arithmetic. arXiv preprint arXiv:2405.00332, 2024.
Jingyang Zhang, Jingkang Yang, Pengyun Wang, Haoqi Wang, Yueqian Lin, Haoran Zhang, Yiyou Sun, Xuefeng Du, Kaiyang Zhou, Wayne Zhang, Yixuan Li, Ziwei Liu, Yiran Chen, and Hai detection. arXiv preprint
Li. Openood v1.5: Enhanced benchmark for arXiv:2306.099 09300, 2023.
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.0100 2022.
13

---

Published as a conference paper at ICLR 2025
A COMPUTATIONAL COMPLEXITY
I: input token sequence length
V: vocabulary size of the model input_ ids (T, input token sequence
Togits D', v]: raw outputs of the model
probs [',, V]: softmax probability distribution over the vocabulary at
each token position
(T, V]: log softmax probabilities over the vocabulary at each token position
token__eee probs [T,]: ]: the log probability of each input token
888 ( standard LIM inference; necessary for all methods logits model (input_ids labels-input_ids. probs terch. functional (ogtttt log_probs = torch. nn. f (logits :-1], dim--1)
:-1], dim--1)
probs = log props gather (dim= index-input, ids) .queeee (-1)
#
operations specific to Min-K
basic algebraic operations with negligible computational cost
(probs (og_probs).sum(l))
sigma_square square (probs corch.square.
[lo_ppoobs) sum (-1) torch.
mu)
Equation (3)
mink_pp (token_log_pre) Equation (4)
mu) /
sigma_square. sqrt ()
Link_pp__gggegatte
numpy, mean mean (ap. sort (mink_pp) [sint (len (mink_pp
k) 1
We show the python and pytorch-style pseudo-code above which implements Min-K%++ Concretely, the computational cost almost solely comes from the one-time LLM inference itself, which is shared by all methods. After obtaining the output statistics, the detection score of Min-K%++ are computed with basic algebraic operations, whose computational overhead is negligible.
In terms comparison with baseline methods, Min+K%++ is as fast as the fastest ones (including Loss, Zlib, and Min-K (%), their execution all consists of one forward pass of the LLM and then some basic algebraic operations. Ref, Lowercase, and Neighbor all requires multiple forward passes of the LLM,, thus being significantly slower than the other methods.
B DETAILS OF BENCHMARKS
Here discuss more details of the used benchmarks and evaluated models to clarify their validity.
For WikiMIA, the training texts are from wiki articles before 2017, and the non-training texts are from wiki events that occurred post-2023 (Shi et al. 2024). Among the considered models, Pythia, GPT-NeoX, OPT, and Mamba models are all trained on the Pile dataset, which includes Wikipedia dumps in its corpora and was released to public in January 2021. The timestamps guarantee that non- training texts are not seen by the models. Similarly, for LLMMA models, they trained on Wikipedia dumps later than August 2022.
MIMIR is constructed from the Pile dataset, where training v.s. non-training texts are directly determined by the train-test split provided by the Pile. Here considered Pythia models which were trained on the training split of the Pile (and of course were not exposed to the test split), exactly following the evaluation setup in the work of MIMIR (Duan et al. 2024
C AN ONLINE DETECTION SETTING
Motivation. Just like image generative models typically have filter to screen harmful generated contents (Rombach et al. 2022). we believe building a similar mechanism for LLMs to detect memorized generated content in online fashion would be helpful. Say, for example, that after
14

---

Published as a conference paper at ICLR 2025
generating few sentences, the model for some reason suddenly starts to emit copyrighted private information that is memorized from the training data. In such case, an effective mitigation would be use pre- pre-training data detection method internally to identify that part of the generated text is training data, and then let the model refrain from further generation.
Setup. Current benchmarks fail simulate the online detection setting, since each whole input is either pure training text or pure non-training text. To address this, we adapt WikiMIA to construct an online version of the benchmark. Concretely, each input text is created by concatenating training text at the end of non-training text, closely simulating the representative scenario discussed above. Both the training and non training text have random length, varying among (32, 64, 128). In this online setting, the prediction on each part of the input, instead of on the whole input, is of interests. Therefore, we split each input into chunks with a length of 32. Methods will be operating on all chunks, and the performance is evaluated on the chunk level. Essentially, this setup simulates using non-overlapping sliding window of size to sweep over the texts and detecting whether each part within the sliding window is training data or not.
Results. Table summarizes the results. Note that the Ref, Lowercase, and Neighbor method are no longer ap- plicable or practical online setting since they require repeated model inference. We that Min-K is still the most reliable method for online detection. The num- bers lower than those in the conventional offline setting (Table [ which is expected because now we can only evaluate log ( y) with y being the prepended text, rather than the exact log p(
Table AUROC results in the online
detection setting with LLaMA models.
13B
30B
65B
Loss Zlib
58.1
61.4
64.0
58.3
61.5
64.0
Min-K%
58.4
61.6
64.1
Min-K ++++
68.1
67.4
68.4
D ADDITIONAL RESULTS
We present additional results here. Tables 5 and 6 show
the AUROC results on WikiMIA with all the 10 models in the original and paraphrased setting, respectively. Tables and show the TPR at low FPR results. Thole the TPR at low FPR results on MIMIR.
15

---

Published as conference paper at ICLR 2025
Table 5: Full AUROC results on WikiMIA in the original (verbatim training text) setting.
Len.
Model
Loss
Ref
Lowercase
Zlib
Neighbor
Min-KS
Min-K
Mamba-1 1.48
61.0
62.2
60.9
61.9
64.1
63.2
66.8
Mamha-2.80
63.6
Pythia-2.88
61.4
61.3
60.9
62.1
64.2
61..8
64,4
Pythia-6.9B
62.2
Pythia-128
65.4
65.1
64.8
65.8
66.6
68.1
72.3
32
NeoX-20B
68.8
67.2
68.0
69.0
70.2
71.8
75.0
LLaMA-13B
67.5
$7.9
84.8
LLaMA-3015
69.4
63.5
64.1
69.8
67.6
70.1
84.3
70.7
OPT-66B
65.7
68.7
63.0
66.0
68.2
67.7
70.2
Average
65.8
64.5
63.8
66.3
74.3
Mamba-1.4B
58.2
60.6
57.0
60.4
67.2
Mamba-2.8B
61.2
64.3
61.7
63.0
63.6
63.4
70.6
Pythia-2.88
Pythia-6.9B
60.7
62.4
58.2
62.6
63.2
63.0
71.6
Pythia- 12B
61.9
63.0
59.6
63.5
62.6
67.8
72.6
64
NeaX-20B
66.2
65.7
65.8
67.1
76.0
LLaMA-13B
63.6
63.4
62.0
65.3
64.1
66.0
85.7
LLaMA-65B
67.9
73.4
64,5
69.1
69.6
69.8
83.8
OPT-66B
62.3
67.0
61.2
70.0
Average
62.7
64.8
61.0
64.4
64.3
66.5
74.7
Mamba-1.4t ,BB
63.3
62.0
58.5
65.6
64.8
66.8
68.8
Pythia-2.8B
62.8
59.6
59,5
66.0
65.2
66.8
66.8
Pythia-6.9B
65.1
63.3
60.5
67.6
70.7
Pythia-12B
65.8
63.9
61.4
67.8
72.7
NooX-20B
70.1
67.8
67.7
71.8
71.6
75.0
75.9
LLaMA-13B
62.6
LLaMA- 30B
70.3
71.9
59.1
71.8
72.2
73.9
82.6
LLaMA-65B
70.7
73.7
63.3
80.0
OPT
65.5
66.9
59.3
67.5
67.7
70.5
72.3
Average
66.8
65.8
Table 6: Full AUROC results on WikiMIA in the paraphrased setting.
Len.
Model
Loss
Ref
Lowercase
Zlib
Neighbor
Min-K%
Min-K%++
Mamba 1.4B
61.4
62.3
60.6
62.9
66.1
Mamba-2.8B
64.5
66.6
63.5
67.9
Pythia 2.88
61.6
61.2
60.3
62.3
64,5
61.7
62.4
Pythia-6.9R
Pythia-12B 12B
65.6
64.9
64.4
65.9
66.8
67.2
69.8
NeaX-20B
68.2
66.3
66.7
68.2
69.7
69.6
LLaMA-13B
68.0
56.2
63.2
68.3
82.7
LLaMA-30B
70.2
62.4
61.2
70.4
66.3
70.7
81.2
LLaMA-65B
71.8
68.2
72.0
OPT-66B
65.3
68.2
62.7
65.4
66.7
66.3
68.1
Average
66.1
64.0
62.9
66.4
66.2
71.7
Mamba-1.4B
56.4
59.6
57.0
63.3
Mamba-2.8B
59.8
64.5
62.0
61.9
63.7
62.4
65.8
Pythia-2.8B
56.5
Pythia-6.9B
59.3
62.9
57.7
61.6
63.1
61.1
64.8
64
Pythia-12B
NeaX-200
64.4
60.0
65.9
63.2
65.1
59,1
66.4
62.1
67.4
62.8
66.1
67.5
65.8
LLaMA-13B
63.1
60.9
61.0
65.3
64.7
64.0
78.8
LLaMA-65B
67.7
71.0
61.9
68.3
69,5
67.9
74.0
OPT-66B
60.4
67.9
60.1
62.3
64.7
Average
61.3
64.0
60.0
63.4
64.3
62.7
67.8
Mamba-1.44
62.7
61.1
57.7
65.3
62.6
61.5
65.6
Mamha- 2.88
Pythia-2.88
62.3
$9.5
59,6
65.11
61.9
64.7
63.4
Pythia-6.9B
64.7
62.9
67.4
66.8
Pythia-12B
65.4
63.9
60.4
67.9
64.3
68.8
NeaX-20B
69.5
67.8
67.4
71.8
69.6
72.6
72.2
LLaMA-13B
67.2
76.2
LLaMA-30B
69.2
70.0
55,4
71.5
67.2
70.2
73.8
LLaMA-65B
70.2
72.0
70.7
OPT-66B
64.5
66.8
574
66.9
63.4
67.2
68.2
Average
65.0
16

---

Published as a conference paper at ICLR 2025
Table 7: Full TPR low FPR (FPR=5%) results WikiMIA in the original (verbatim training text)
setting.
Len.
Model
Loss
Ref'
Lowercase
Zlib
Neighbor
Min-K %
Min-K % ++
Mamba-1
14.2
7.8
Manba-2.8B
14.7
9.8
16.8
16.3
16.0
18.1
13.4
Pythia-2.88
14.7
6.2
11.1
15.8
15.0
17.1
14,2
Pythia-6.9B
14.2
10.6
16.5
17.8
Pythia-122 12B
17.1
9.0
16.3
17.1
19.4
23.0
18.6
32
NeaX
LLaMA-13B
13.9
4.7
9.6
11.6
11.6
18.9
38.5
LLaMA-30B
18.4
9.8
11.
14.5
21.2
31.3
IJaMA-65B
22.5
12.4
12.1
18.6
26.1
41.1
OPT-66B
14.2
108
10.6
16.0
21.7
22.0
19.4
Average
16.4
9.3
12.8
16.1
15.0
20.7
22.6
Mamba-1.4B
9.5
4.6
8.8
14.1
8.8
19.4
16.6
Mambu-2.88
10.2
9.2
16.6
14.8
19.0
21.5
Pythia-2.88
10.2
10.6
10.2
14.4
10.2
18.3
16.2
Pythia-6.99
1344
12.0
11.6
16.2
10.9
19.0
26.1
Pythia-12B
64
NeoX-20B
13,0
15,5
15,5
16.6
13.0
20.4
20.4
LLaMA-13B
11.3
4.2
11.6
34.1
LLaMA-50B
13.7
11.3
11.3
15.5
17.6
36.3
LLaMA-65B
15.1
13.0
12.3
16.9
9.9
18.0
38.4
OPT-66B
Average
11.9
10.6
12.1
14.6
10.7
19.7
25.2
Mamba-1..
11.5
10.1
12.9
19.4
Manba-2.8B
19.4
10.1
13.7
23.7
15.1
25.9
21.6
Pythia-2.8B
9.3
10.1
10.8
18.7
8.6
13.7
17.3
Pythia-6.9B
14.4
12,9
22.3
Pythia 12B
18.0
12.2
12,9
23.7
10.1
25.2
20.9
128
NeoX-20B
18.7
15.8
12.2
23.0
15.8
23.0
LLaMA-13B
21.6
10.8
15.8
18.7
12,9
25.9
43.2
1.aMA-30B
23.7
10.8
10.1
18.0
15.1
23.7
40.3
LLaMA-65B
23.0
18.0
14,4
22.3
27.3
6PT
20.9
17.3
14.4
21.6
12.9
23,0
16.6
Average
18.1
12.9
13.0
21.0
13,3
22.1
24.9
17

---

Published as conference paper at ICLR 2025
Table 8: Full TPR at low FPR (FPR=5%) results WikiMIA in the paraphrased setting.
Len.
Model
Loss
Ref
Lowercase
Zlib
Neighbor
Min-K %
Min-K%+
Mamba: 1.4B
14.2
5.9
13.2
13.2
7.2
15.2
10.6
Mamba-2.8B
16.5
10.1
15.0
12.7
9.3
19.9
13.4
Pythia-2.88
14.2
7.2
11.6
14.5
16.5
Pythia-6.9P
15.0
6.2
11.9
12.7
9.5
21.7
17.1
Pythia-12B
17.3
16.5
32
NeoX-20B
18.1
15.2
15.5
18.6
15.2
19,6
12.9
LLaMA-13B
16.3
5,4
9.6
15.0
8.5
17.6
35,9
LLaMA-30B
14.7
7,5
12.7
15.0
27.4
LLaMA-65B
23.3
9.3
11.9
16.5
12.1
24.3
35,9
OPT-66B
Average
16.5
8.5
13.1
15.1
10.2
19.1
20.0
Mambu-
8.1
8.1
9.5
15.1
7.0
Mamba-2.8B
12.3
Pythia-2.88
9.5
13.0
11.3
16.6
11.3
11.3
9.9
Pythia
64
Pythia-12B
11.6
14.4
134
16.2
10.6
14.4
13.7
NeoX
16.2
14.1
13,7
19.4
18.3
17.6
13.0
LJaMA-13B
12.0
4.6
13.7
13.4
14.4
13.4
26.4
LLaMA-30B
13.4
8.1
8.1
16.9
11.6
14.4
21.5
10,9
OPT-66B
13.4
13.0
134
14.8
13.7
14.8
12.7
Average
12.0
Mamha-1.44
13.7
11.5
11.5
17.3
13.7
14.4
10.1
Mamba-2.8B
16.6
10.8
15.1
20.1
17.3
20.1
15.1
Pythia-2.8B
Pythia-6.99
16.6
8.6
11,5
20.9
17.3
17.3
21.6
Pythia-12B
19.4
8,6
12.2
19.4
17.3
128
NeoX-20B
15.8
19.4
16.6
21.6
18.7
22.3
19.4
LLaMA-13B
18.0
4.3
15.8
21.6
13.7
20.1
35.2
LLaMA-30B
LLaMA 65B
24.5
12.9
13.7
22.3
18.7
25.2
25.2
OPT-66B
18.0
15.8
11.5
18.7
20.1
18.7
Average
17.6
11.8
13.0
19.8
14.9
19.4
19.9
Table 9: TPR at low FPR (FPR=5%) results MIMIR. In each column, the best result across all methods is bolded, with the runner-up underlined. Ref relies on an extra reference LLM. #Neighbor induces significant extra computational cost than others (25 in this case), for which reason we don't run on the 12B model.
Wikipedia
Github
Pile CC
PubMed Central
Method
160M
1.4B
28B
6.9B
12B
16UM
L.4B
2,88
6.91
12B
160M
1.4B
2,88
6.9B
12B
160M
1.4B
2.8B
6.98
12B
Loss
4.2
4.7
4.7
5.1
5.0
22.6
32.1
33.6
38.5
40.7
3.1
5.0
4.8
5.1
4.0
4.4
4.3
4.9
5.0
"Ref
6.1
5.3
5.5
5.6
5.7
23.4
14.8
14.9
15.4
16.2
5.5
5.6
5.8
5.8
7.5
5.7
4.1
4.0
5.9
8.7
5.7
5.9
6.3
25.0
32.8
40.8
4.0
3.8
3.6
3.5
Neighhor
/
Min-KSs
6.4
5.6
6.4
6.5
8.1
23.3
32.2
34.0
39.0
40.8
4.2
5.1
5.2
5.5
5.7
4.7
5.2
4.8
5.9
5.4
Min-K%
6.1
8.5
11.4
11.5
38.2
40.1
5.8
5.1
6.3
6.5
ArXiv
DM Mathematies
HackerNews
Average
Method
160M
1.4B
288
6.9B
12B
160M
1.4B
2.8B
6.9B
12B
160M
1.4B
2.8B
6.9B
12B
160M 1.4B
2.8B
6.9B
12B
Loss
4.0
4.8
4.6
5.4
5.6
3.8
4.3
4.1
4.1
4.0
5.0
4.8
5.5
5.9
6.8
6.7
8.6
8.8
9.8
10.3
RRe
5.2
5.4
5.9
6.8
7.4
4.9
5.4
5.9
5.2
6.3
7.6
7.6
8.1
6.4
6.9
7.4
8.4
Zlib
2.9
4.3
4.1
4.6
4.6
43
4.3
5.0
5.8
7.0
8.9
9.3
10.1
10.5
Neighbor
4.7
4.8
4.4
4.1
{
5.6
4.4
4.5
4.5
6.5
5.2
5.3
7.6
8.3
8.2
Min-K%
4.9
4.8
4.7
5.6
6.2
4.5
4.5
4.6
4.7
5.2
5.2
5.7
6.3
6.9
7.6
9.0
9.4
10.5
11.2
Min-KS+++
6.7
8.2
8.6
5.7
6.3
5.5
8.4
10.4
12.0
12.6
18


Reviews:
[{"review_id": "sToN6AOj1w", "reviewer": "Reviewer_xYYm", "summary": "This paper presents a method, Min-K%++, designed to detect pre-training data in LLMs by identifying local maxima in the model’s conditional distributions. The proposed approach theoretically grounds pre-training data detection in maximum likelihood training, showing that training instances often exhibit distinct distributional patterns. From the empirical experiments, it demonstrate that Min-K%++ achieving competitive performance on benchmarks like WikiMIA and MIMIR, with notable improvements over prior methods, particularly in challenging settings.", "questions": "- What is the computational overhead of Min-K%++ compared to baseline methods, and is it feasible for real-time applications?\n\n- Would Min-K%++ perform well on diverse language corpora with complex semantics or high paraphrasing, or would adjustments be needed?\n\n- Could you explain the theoretical choice of $\\mu_{x<t}$ and $\\sigma_{x<t}$ as calibration factors, especially in improving detection sensitivity in noisy settings?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "The originality of Min-K%++ lies in its focus on identifying local maxima to detect training data, moving beyond heuristic-based methods by leveraging theoretical insights from maximum likelihood training. The quality of the experiments is high, covering multiple benchmarks and various model sizes, showing consistent improvements over state-of-the-art baselines. The clarity is adequate in explaining the methodology and motivation, though some sections could benefit from clearer illustrations. The significance is evident, as pre-training data detection can enhance model transparency and accountability, which are critical in LLM applications.", "weaknesses": "The novelty of Min-K%++ is somewhat limited, as it builds incrementally on the existing Min-K% methodology rather than introducing a transformative approach. Additionally, the paper does not provide sufficient information about the computational resources required for implementing Min-K%++, which makes it difficult to assess the method’s feasibility on different hardware configurations or scales. While the benchmarks are well-chosen, a comparison with broader language tasks would better illustrate Min-K%++'s general applicability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UStavQGLNd", "reviewer": "Reviewer_5hJP", "summary": "This paper provides a MIA (Membership Inference Attack) method to detect whether data was used to train models, building upon previous MIN-K methods. Instead of using absolute logit likelihood values, they propose subtracting the mean of previous token likelihoods to identify how far the current value deviates from the previous distribution. This method shows improvements over MIN-K on two benchmarks, WIKIMIA and MIMIR, across different models.", "questions": "I think conceptually we should have several groups of data to be classified, and these groups should be 'imagined' by researchers who are truly spending time looking at the *pattern of pre-training corpora*. Given a pre-trained chunk $s = \\langle s_1,s_2,...,s_n\\rangle$ with n tokens, we need to consider the false positive and false negative rates of proposed methods to identify:\n\n1. Subportions of text $s' = \\langle s_i,...,s_j\\rangle$\n2. Rare sequences versus untrained sequences\n3. Rare tokens $s_i$ within a sequence\n\nI am concerned that there are many nuances here, and these methods seem to capture them not very effectively.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The research topic is important and worth more work for it.\n- I love the motivation based on ISM objects, but sadly it seems that this does not lead to a well-established method based on this.", "weaknesses": "- The theoretical connection between Section 4.1's gradient conditions ($\\frac{\\partial \\log p(x)}{\\partial x_i} = 0$ and $\\frac{\\partial^2 \\log p(x)}{\\partial x_i^2} < 0$) and the proposed normalized score method ($\\frac{\\log p(x_t|x_{<t}) - \\mu_{x_{<t}}}{\\sigma_{x_{<t}}}$) for min-k% token selection needs clearer explanation. The current presentation shows a gap between the theoretical motivation and practical implementation.\n\n- The justification in lines 256-263 regarding the method's effectiveness on rare or difficult-to-learn training texts requires stronger argumentation. For rare texts, distinguishing between untrained and rare samples remains challenging regardless of whether using direct scores or mean-subtracted scores. The same applies to inherently difficult-to-learn texts. This limitation needs to be addressed more explicitly.\n\n- The state-of-the-art landscape has evolved beyond Min-K. Recent methods like [ReCall](https://arxiv.org/pdf/2406.15968) have demonstrated significant improvements, achieving nearly 20% performance gains over Min-K on the WIKIMIA benchmark. Including comparisons with these newer methods would strengthen the paper's relevance. While Min-K was among the first to apply MIA for data contamination detection, its limitations based on its underlying assumptions should be acknowledged.\n\n- The MIMIR benchmark results, where most methods show minimal performance differences, warrant further discussion. The assumption that reference-based methods should naturally outperform reference-free approaches needs reconsideration, as these references differ from ground-truth evaluations. Therefore, achieving comparable performance to reference-based methods could serve as compelling evidence for method validation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GuBrbUzmxS", "reviewer": "Reviewer_uqhR", "summary": "This paper proposes a methodology for pre-training data detection, Min-K%++. They reduce the problem as identification of local maxima. Their method achieves state of the art results across multiple settings.", "questions": "Line 147. Is Wang et al . 2022 the right ppaer to cite to refer to auto-regressive LLM maximum log likelihood training?\n\nI wonder if the findings in this paper may merit a discussion and a mention in comparison to what is presented in yours. https://arxiv.org/pdf/2212.04037, thoughts?\n\nLine 328: could you elaborate how the paraphrased inputs are created for the WIKIMIA dataset? How is it ensured that the paraphrases are accurate?\n\nLine 460: why focus on WIKIMIA and Llama-13B ?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper is well written and it is easy to follow.\n\nThe paper shows the best results (or second best when reference models are used for the MIMIR benchmark) reported on the existing benchmarks, and compares with 6 established baselines for MIA task.\n\nFigure 2 and Figure 3 in the paper provide a very good  summary of  the idea that the paper follows (first the concept of local maxima for identification of training examples, and second how it contrasts with prior work that solely looks at token probability).", "weaknesses": "Line 323: any additional benchmarks you could think of designing for this task? there are new open source LLMs for which the training data is also provided. I think the paper could be stronger if it is not only relying on existing benchmarks for MIA task, and devises its own.\n\nI think the paper could improve if you clarify why MIMIR and WIKIMIA are the right datasets to measure this for the models used for evaluation. Line 347 and 352 touch on it but do not expand on why the current models have not seen the entire set. I am more curious about WIKIMIA for recent models, and how they are comparable as they are trained at different times.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nI0O4vrNVD", "reviewer": "Reviewer_o61x", "summary": "This paper presents a novel pretraining data detection method, theoretically identified as the optimal solution. It reframes the data detection problem as one of identifying local maxima, utilizing average and standard deviation metrics rather than relying on reference models. Experiments across two benchmarks and five models highlight the effectiveness of MinK++.", "questions": "I came across the DC-PDD paper [1], which concluded that MinK++ performs worse than MinK on their PatentMIA Benchmark. I'm curious to understand the reasons behind this. If you have the time and are willing to share your thoughts, I would greatly appreciate it. Of course, I understand if you're too busy and can't respond.\n\n[1] Pretraining Data Detection for Large Language Models: A Divergence-based Calibration Method. https://arxiv.org/pdf/2409.14781", "limitations": "", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. The motivation is clear and makes sense, which has been demonstrated by theoretical analysis.\n2. The method is very simple and effective, which impresses me.\n3. The experiments are very solid across two benchmarks, 5 models, and 6 baselines, which also highlights the effectiveness of MinK++.\n4. The writing is good and easy to follow.", "weaknesses": "The work is very solid and has no more significant weaknesses.\n\n1. It would be better to add some impactful works of 2024 in related works, including `A Careful Examination of Large Language Model Performance on Grade School Arithmetic` [1] and `Benchmarking Benchmark Leakage in Large Language Models` [2].\n\n[1] A Careful Examination of Large Language Model Performance on Grade School Arithmetic. https://arxiv.org/abs/2405.00332\n\n[2] Benchmarking Benchmark Leakage in Large Language Models. https://arxiv.org/abs/2404.18824", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Spotlight)