Detecting Data Contamination in Large Language Models

2026-04-21

AI Summary

This study addresses the challenge of membership inference for copyrighted or sensitive content in the training data of large language models (LLMs) under black-box settings. To overcome the lack of standardized evaluation in existing approaches, the authors propose a novel "familiarity ranking" method that enhances model output flexibility to better reveal memorization tendencies toward specific data points. The work systematically evaluates multiple black-box membership inference attacks on mainstream LLMs within a unified benchmark. Experimental results demonstrate that all tested methods struggle to reliably infer membership, achieving near-random performance (AUC-ROC ≈ 0.5). Moreover, the stronger generalization capabilities of advanced models further exacerbate the difficulty of black-box detection, highlighting fundamental limitations of current techniques for this task.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: (Large) Language Models
• Computer Vision: Large Vision Models

Application Category

• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Large Language Models (LLMs) utilize large amounts of data for their training, some of which may come from copyrighted sources. Membership Inference Attacks (MIA) aim to detect those documents and whether they have been included in the training corpora of the LLMs. The black-box MIAs require a significant amount of data manipulation; therefore, their comparison is often challenging. We study state-of-the-art (SOTA) MIAs under the black-box assumptions and compare them to each other using a unified set of datasets to determine if any of them can reliably detect membership under SOTA LLMs. In addition, a new method, called the Familiarity Ranking, was developed to showcase a possible approach to black-box MIAs, thereby giving LLMs more freedom in their expression to understand their reasoning better. The results indicate that none of the methods are capable of reliably detecting membership in LLMs, as shown by an AUC-ROC of approximately 0.5 for all methods across several LLMs. The higher TPR and FPR for more advanced LLMs indicate higher reasoning and generalizing capabilities, showcasing the difficulty of detecting membership in LLMs using black-box MIAs.

Problem

• Data Contamination
• Large Language Models
• Membership Inference Attacks
• Black-box Setting
• Training Data Privacy

Innovation

• Membership Inference Attacks
• Black-box MIA
• Familiarity Ranking
• Data Contamination
• Large Language Models