Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large Language Models

TL;DR

The paper tackles pre-training data detection for large language models under grey-box access, addressing privacy and copyright concerns. It presents Min-K%++, a theory-driven detector grounded in the insight that training data tend to form local maxima along input dimensions under maximum likelihood training, enabling mode-based detection in LLMs. The method scores next-token probabilities relative to their vocabulary-wide expectations and aggregates the bottom-k% of sequences, achieving state-of-the-art AUROC on WikiMIA and competitive results on MIMIR without requiring a reference model. Empirical results, online-detection evaluation, and ablation studies demonstrate robustness to hyperparameters and the pivotal role of calibration terms, establishing Min-K%++ as a strong baseline for future work in pre-training data detection.

Abstract

The problem of pre-training data detection for large language models (LLMs) has received growing attention due to its implications in critical issues like copyright violation and test data contamination. Despite improved performance, existing methods (including the state-of-the-art, Min-K%) are mostly developed upon simple heuristics and lack solid, reasonable foundations. In this work, we propose a novel and theoretically motivated methodology for pre-training data detection, named Min-K%++. Specifically, we present a key insight that training samples tend to be local maxima of the modeled distribution along each input dimension through maximum likelihood training, which in turn allow us to insightfully translate the problem into identification of local maxima. Then, we design our method accordingly that works under the discrete distribution modeled by LLMs, whose core idea is to determine whether the input forms a mode or has relatively high probability under the conditional categorical distribution. Empirically, the proposed method achieves new SOTA performance across multiple settings. On the WikiMIA benchmark, Min-K%++ outperforms the runner-up by 6.2% to 10.5% in detection AUROC averaged over five models. On the more challenging MIMIR benchmark, it consistently improves upon reference-free methods while performing on par with reference-based method that requires an extra reference model.

Figures (4)

• Figure 1: Left: We study the pre-training data detection problem for LLMs mia_minkmimir. Given the grey-box access to the target LLM (only the logits, token probabilities, and loss are available), the goal is to design a scoring function that yields a score which (upon thresholding) best separates training and non-training text. Right: ROC (receiver operating characteristic) curves of various methods on WikiMIA benchmark mia_mink. The AUROC (area under the ROC curve) score is denoted in the legend. Our Min-K%++ improves upon existing approaches by large margin.
• Figure 2: In each plot, we perturb a random pixel of a random training image of a diffusion model trained on CIFAR-10 and evaluate the (variational lower bound of) log likelihood. Perturbing a certain pixel is essentially moving the input along a certain dimension. We mark the original pixel with orange and the perturbed pixels with blue. We see that the training input (with the unperturbed pixel) is indeed the local maximum (the concave pattern), effectively echoing our theoretical discussion.
• Figure 3: A conceptual example showcasing the idea of Min-K%++. (a) and (b) show two next token distributions for two different input token sequences $(x_{<t},x_t)$. The bars with the hatch pattern ('//') correspond to the target next token $x_t$. Existing methods often measure the exact next token probability of $x_t$ (hatched bars), which fails to separate these two inputs due to the same probability (0.2). By comparison, Min-K%++ determines if $x_t$ forms a mode or has relatively high probability by comparing $\log p(x_t|x_{<t})$ with $\mu_{\cdot|x_{<t}}$; the score is the difference between the red and pink dashed lines. See text for detailed discussion.
• Figure 4: Ablation on $k$. Min-K%++ is robust to the hyperparameter choice.