Tag&Tab: Pretraining Data Detection in Large Language Models Using Keyword-Based Membership Inference Attack (2025)

Abstract: Large language models (LLMs) have become essential tools for digital task assistance. Their training relies heavily on the collection of vast amounts of data, which may include copyright-protected or sensitive information. Recent studies on detecting pretraining data in LLMs have primarily focused on sentence- or paragraph-level membership inference attacks (MIAs), usually involving probability analysis of the target model’s predicted tokens. However, these methods often exhibit poor accuracy, failing to account for the semantic importance of textual content and word significance. To address these shortcomings, we propose Tag&Tab, a novel approach for detecting data used in LLM pretraining. Our method leverages established natural language processing (NLP) techniques to tag keywords in the input text, a process we term Tagging. Then, the LLM is used to obtain probabilities for these keywords and calculate their average log-likelihood to determine input text membership, a process we refer to as Tabbing. Our experiments on four benchmark datasets (BookMIA, MIMIR, PatentMIA, and the Pile) and several open-source LLMs of varying sizes demonstrate an average increase in AUC scores ranging from 5.3% to 17.6% over state-of-the-art methods. Tag&Tab not only sets a new standard for data leakage detection in LLMs, but its outstanding performance is a testament to the importance of words in MIAs on LLMs.

## introduction the rapid advancement of generative artificial intelligence (genai) in recent years has significantly shifted the tech industry's focus toward the development of powerful tools such as large language models (llms). llms are now widely used for tasks such as conversational ai, content generation, and scientific research @xcite @xcite . their adoption reflects a broader shift in ai towards largescale language understanding. the widespread use of llms has intensified competition to improve model performance, which relies on the collection of vast amounts of data @xcite . to achieve these improvements, llms are primarily trained on open-source datasets obtained from various sources using methods such as synthetic data generation and web scraping @xcite . the type of data collected includes books, code, academic papers, and medical records @xcite @xcite . the methods employed for data collection raise significant privacy and ethical concerns @xcite , primarily regarding the inclusion of personally identifiable information (pii) @xcite and copyright-protected content @xcite @xcite . high-profile lawsuits, such as the new york times company vs. openai (times, 2023), highlight the need for tools that can detect unauthorized use of data in llm training @xcite . membership inference attacks (mias) aim to identify whether a given text was part of a model's training data by exploiting behavioral differences in how llms process seen versus unseen data (e.g., higher prediction confidence or lower loss) @xcite . existing mias face several key limitations. first, most methods rely solely on token-level probabilities, neglecting the semantic importance of words within the broader context @xcite . second, their performance varies widely across different models and datasets, often lacking consistent generalization @xcite . lastly, mias are often evaluated on data that is not independently and identically distributed (iid), which can lead to the detection of distribution shifts rather than genuine membership inference, thereby undermining the attacks' reliability @xcite . to address the limitations of existing methods, we introduce tag&tab, a novel approach based on common natural language processing (nlp) methods that is designed to efficiently and effectively detect llms' pretraining data. specifically, our method aims to determine whether an llm was trained on a given text sample, given black-box access to the target llm (i.e., can only query the model). building on the work of lukas et al. @xcite , who highlighted the role of named entities in pii leakage detection, tag&tab prioritizes informative keywords using entropy-based selection. tag&tab is designed to address the three key limitations of prior mia methods. first, rather than relying solely on token-level probabilities, our method introduces semantic awareness by prioritizing meaningful content through keyword selection. second, our results demonstrate strong generalization across models and datasets, addressing the issue of model inconsistency. finally, while no mia is entirely immune to distribution shifts, our focus on rare and informative keywords, rather than shallow statistical artifacts, provides better resilience to distributional variations. our method consists of the following steps: words with a low entropy contribution are usually either very common or very rare. after constructing the entropy map, we observed that rare content words stand out more in the low-entropy pool, making them more likely to be chosen as keywords. our method is based on the intuition that a higher log-likelihood for low-entropy words, together with ner spans, suggests that the model encountered the text during training @xcite based on this intuition, we hypothesize that these rare low-entropy words and rare entities are more likely to be memorized by the model and thus serve as effective indicators of the text's membership in the pretraining dataset @xcite . by selecting a small number of lowentropy keywords and augmenting them with ner spans, our method captures the most informative text elements while minimizing noise from other word probabilities. we evaluated our method on ten llms of varying sizes and four datasets containing nine types of textual data. our results show that tag&tab outperforms state-of-the-art (sota) mias, achieving an average increase in auc scores ranging from 5.3% to 17.6% compared to the best-performing sota method on multiple textual data types. the contributions of our paper are as follows: large language model membership inference is a subdomain of membership inference that has gained increasing research attention. within this subdomain, detecting pretraining data has been the focus of numerous studies exploring different methodologies for determining whether specific texts were included in an llm's training dataset. existing mias for llms fall into two categories: reference-based and reference-free. reference-based @xcite methods compare a target model's outputs to those of reference models, which are typically trained on the same data distribution. one such method is lira @xcite , which estimates the likelihood ratio of a target example's loss under models trained with and without the example, using gaussian distributions to simplify the computation. in contrast, reference-free methods aim to determine membership by applying different probability-based calculations on token predictions. one such method, the loss attack @xcite , uses model loss values, which in language models correspond to text perplexity. perplexity measures how well a probability model predicts a sample and is calculated as the exponentiation of the negative average log-likelihood per token: common models for evaluating mias on llms include open-source models with known pretraining data. one such model is llama 1 @xcite , created by meta, which was trained on a mixture of publicly available datasets, including certain subsets of the pile such as books3 and gutenberg, according to meta's original paper. the open-source pythia model suite @xcite , which includes eight llms ranging from 70m to 12b parameters. these models were trained on data including the pile dataset, with all models processing the public data in the same order during training. ## method we introduce tag&tab, a novel resource-and timeefficient method for identifying data used to pretrain llms. tag&tab applies common nlp techniques to tag keywords in the pretraining data and predict their membership using the target llm. our method strategically selects words from the input that should be challenging for the llm to predict. successful prediction may indicate that the model previously learned the content during pretraining. in tag&tab, words are selected according to their entropy contribution values. words with a low entropy contribution value tend to be either very common (e.g., 'or,' 'in') or very rare. after constructing an entropy map, we found that the low-entropy pool tends to be dominated by rare content words, which are therefore more likely to be selected as keywords. tag&tab relies on the hypothesis that while llms tend to memorize repeated data, they also memorize rare or unique training data. this aligns with the findings of carlini et al. @xcite , who stated that: "memorization does still happen, even with just a few duplicates-thus, deduplication will not perfectly prevent leakage." this insight was further validated by lukas et al. @xcite , who found that piis tokens, which are distinctive rare tokens, are effective in revealing memorized content. thus, an llm is likely to assign a higher probability to these low-entropy words when they appear in familiar contexts it has seen before, compared to the same low-entropy words in novel or unfamiliar contexts. for example, in the sentence "astronomers detected light from the edge of the universe emitted by a quasar," the word "quasar" is a low-entropy word. if this sentence appeared in the training data, the model will assign a higher probability to "quasar" in this context than if it had not seen the sentence before. tag&tab selects k words with the lowest entropy values in a sentence, which are referred to as keywords. by selecting a small number of informative keywords, it aims to capture the semantic importance of the pretraining content. this approach hinges on a hypothesis that only k selected keywords are needed to accurately predict the membership of the entire input text in the pretraining data, minimizing noise from other words in the input text @xcite . tag&tab operates under black-box constraints, meaning that we can observe token probabilities from a given input but lack access to the model's weights, which is standard practice in mias @xcite @xcite . the tag&tab method consists of four stages, which are illustrated in figure 1: 1. preprocessing -first, the word entropy map is constructed using the python package wordfreq (speer, 2022), which provides frequency estimates for words in a specified language. the entropy contribution value for each word is calculated using the formula: this value is high for mid-frequency words and low for both very common and very rare words. in this stage, the text is also split into individual sentences, using segmentation tools (e.g., the nltk package @xcite ). to avoid selecting less informative keywords due to insufficient sentence length, sentences with fewer than a specified number of words are filtered out. the final keyword set is the union of the lowentropy words and the ner spans. because this is a union, the set may be larger than k, but in practice it is often exactly k, because ner spans often overlap with low-entropy tokens. for clarity, we continue to denote the size of this final set as k, referring to the number of keywords after the union. the method selects the k keywords from s and computes the average log-likelihood of the keywords: ## evaluation this section presents a detailed evaluation of tag&tab's effectiveness. the experiments were conducted on a nvidia rtx 6000 gpu, running for nearly three days on all models and datasets. we used the default parameter settings of widely adopted libraries, including spacy and nltk. ## results this section presents the results of two case studies using tag&tab, each examining a different aspect of pretraining data detection in llms. each case study is evaluated using the following metrics: auc and tpr at a low fpr of 5% (t@@xmath0. throughout this section, we report the results for tag&tab using @xmath1, as these values yielded the most consistent and highperforming outcomes across models and datasets. this choice is supported by the results presented in figure 2 , which shows that tag&tab performs robustly for k values between 4 and 10 for most of the models, with minimal performance variation-making the method resilient to non-optimal keyword selections. case study 1 serves as the primary benchmark evaluation, while case study 2 is included to illustrate a more practical, engineered audit scenario closer to real-world use. the reported results are based on a single run, as we observed minimal variation across multiple runs. ## conclusion we present tag&tab, a novel black-box method for detecting pretraining data in llms. by focusing on the semantic and contextual relevance of words, the method enhances detection capabilities. tag&tab outperforms sota attacks and consistently achieves high performance across diverse textual data types. our comprehensive evaluation spans nine textual data types from four datasets (the pile, mimir, bookmia, and patentmia) and ten llms of varying sizes and architectures (llama 1-7b, 13b, 30b, pythia-160m, 1.4b, 2.8b, 6.9b, 12b, gpt-3.5 turbo, qwen1.5-14b). our study confirms that the selection of low-entropy contribution keywords, augmented with ner spans, improves membership inference attack results, further validating our approach. future work could extend tag&tab by considering keyword context and placement within documents. additionally, developing new mias that leverage advanced nlp techniques to assess word significance could further improve the detection of pretraining data in llms.