Gap-K%: Measuring Top-1 Prediction Gap for Detecting Pretraining Data

TL;DR

Gap-K% addresses pretraining data detection by exploiting the optimization dynamics of next-token prediction. It introduces a top-1 log-probability gap score $g_t = \frac{\log p(x_t|x_{<t}) - \max_v\log p(v|x_{<t})}{\sigma_t}$, applies sequential smoothing with a window $w$ to obtain $\bar{g}_t^{(w)}$, and defines the Gap-K% score as the average of the bottom-$k\%$ smoothed scores $\bar{g}_t^{(w)}$. Compared to token-likelihood baselines like Min-K%++, Gap-K% explicitly penalizes confident errors and aligns with the distribution mode, yielding stronger detection signals. Empirical results on WikiMIA and MIMIR show Gap-K% achieving state-of-the-art AUROC across model sizes and input lengths, with robust ablations confirming the benefits of top-1 gap scoring and sequential smoothing. These findings suggest that monitoring top-1 prediction behavior and local score patterns can significantly improve pretraining data detection and inform privacy considerations in LLMs.

Abstract

The opacity of massive pretraining corpora in Large Language Models (LLMs) raises significant privacy and copyright concerns, making pretraining data detection a critical challenge. Existing state-of-the-art methods typically rely on token likelihoods, yet they often overlook the divergence from the model's top-1 prediction and local correlation between adjacent tokens. In this work, we propose Gap-K%, a novel pretraining data detection method grounded in the optimization dynamics of LLM pretraining. By analyzing the next-token prediction objective, we observe that discrepancies between the model's top-1 prediction and the target token induce strong gradient signals, which are explicitly penalized during training. Motivated by this, Gap-K% leverages the log probability gap between the top-1 predicted token and the target token, incorporating a sliding window strategy to capture local correlations and mitigate token-level fluctuations. Extensive experiments on the WikiMIA and MIMIR benchmarks demonstrate that Gap-K% achieves state-of-the-art performance, consistently outperforming prior baselines across various model sizes and input lengths.

Figures (9)

• Figure 1: Illustration of token-level scores before and after sequential smoothing. The gray curve shows raw token-level scores, while the green curve shows the smoothed scores.
• Figure 2: Conceptual comparison between Min-K%++ and Gap-K% using a toy example with a small vocabulary size of 8. Inspired by the illustrative analysis in zhang2025mink, we compare the token-level scores of Min-K%++ ($z_t$) and Gap-K% ($g_t$) under two different next-token probability distributions. The $z_t$ and $g_t$ values annotated in the figure are normalized quantities as defined in the text. The blue hatched bar denotes the observed token $x_t$, while the yellow hatched bar indicates the top-1 token. In (a), the distribution is relatively flat, resulting in low-confidence incorrect predictions, whereas in (b) the model assigns high confidence to an incorrect top-1 token. While the Min-K%++ score $z_t$ is identical in both cases, the Gap-K% score $g_t$ distinguishes confident mispredictions from uncertain predictions by capturing the gap between the observed token and the distribution mode.
• Figure 3: Average TPR@5% FPR across models for each evaluation setting (original vs. paraphrased inputs; sequence lengths of 32, 64, and 128). Full results are reported in Appendix \ref{['app:fpr']}.
• Figure 4: Effect of window size on sequential smoothing for LLaMA-13B and Pythia-12B.
• Figure 5: Effect of the $k\%$ ratio on AUROC.