Refinement Provenance Inference: Detecting LLM-Refined Training Prompts from Model Behavior

TL;DR

This work tackles Refinement Provenance Inference (RPI), the problem of auditing whether a fine-tuned model was trained on raw prompts or LLM-refined prompts for each instance. The authors show that prompt refinement induces robust distribution-level shifts in teacher-forced token probabilities, not merely surface changes, enabling cross-model and cross-refiner detection. They introduce RePro, a logit-based framework that learns transferable signals via shadow fine-tuning and supervised contrastive embeddings, then applies a lightweight linear classifier to unseen victim models. Across reasoning and code-generation tasks, different victim families, and refinement operators, RePro achieves strong detection performance, especially at low false-positive rates, and demonstrates resilience to refiner mismatches, suggesting the signals reflect refiner-agnostic distribution shifts. These findings have implications for dataset governance, provenance auditing, and privacy in instruction-tuning pipelines, and point to future work on broader refinement pipelines and mitigation strategies.

Abstract

Instruction tuning increasingly relies on LLM-based prompt refinement, where prompts in the training corpus are selectively rewritten by an external refiner to improve clarity and instruction alignment. This motivates an instance-level audit problem: for a fine-tuned model and a training prompt-response pair, can we infer whether the model was trained on the original prompt or its LLM-refined version within a mixed corpus? This matters for dataset governance and dispute resolution when training data are contested. However, it is non-trivial in practice: refined and raw instances are interleaved in the training corpus with unknown, source-dependent mixture ratios, making it harder to develop provenance methods that generalize across models and training setups. In this paper, we formalize this audit task as Refinement Provenance Inference (RPI) and show that prompt refinement yields stable, detectable shifts in teacher-forced token distributions, even when semantic differences are not obvious. Building on this phenomenon, we propose RePro, a logit-based provenance framework that fuses teacher-forced likelihood features with logit-ranking signals. During training, RePro learns a transferable representation via shadow fine-tuning, and uses a lightweight linear head to infer provenance on unseen victims without training-data access. Empirically, RePro consistently attains strong performance and transfers well across refiners, suggesting that it exploits refiner-agnostic distribution shifts rather than rewrite-style artifacts.

Figures (6)

• Figure 1: The process of Refinement Provenance Inference (RPI) problem.
• Figure 2: Feature diagnostics for teacher-forced logit.
• Figure 3: Overview of RePro. Stage 1 trains a supervised-contrastive encoder on logit-derived features from a shadow fine-tuned model. Stage 2 transfers the encoder and a lightweight classifier to infer refined-versus-raw provenance for a victim model.
• Figure 4: The ROC and TPR@1% FPR curves.
• Figure 5: Ablation and sensitivity analysis. (a) Comparison of different attacker training strategies. (b) AUC as a function of refined fraction $\rho$. (c) AUC as a function of fine-tuning steps.