Detectable Only Where It Is Confounded: What Verified Duplication Counts Say About Membership Evidence in Language Models

仅在混淆处可检测：经验证的重复计数对语言模型成员资格证据的启示

Abstract: When a language model finds a sentence unusually cheap to predict, it is tempting to conclude that the sentence was in its training data. Almost every published test of that inference has had to guess which sentences were in the training data, the members, and which were not. This paper removes the guessing.

摘要： 当语言模型发现一个句子的预测成本异常低时，人们很容易得出结论：该句子存在于其训练数据中。几乎所有已发表的关于这一推断的测试，都不得不去猜测哪些句子属于训练数据（成员），哪些不属于。本文消除了这种猜测。

Two model families, OLMo-2 and Pythia, publish their pretraining corpora, and a public index over those corpora returns the exact number of times any sentence appeared in each. Those counts make three questions answerable directly. The answers form a pincer, closing from two sides.

OLMo-2 和 Pythia 这两个模型家族公开了它们的预训练语料库，并且针对这些语料库的公共索引可以返回任何句子在其中出现的精确次数。这些计数使得三个问题可以直接得到解答。这些答案形成了一个双向夹击的态势。

At the duplication levels ordinary text actually has, five models from 1B to 13B parameters carry at most a faint trace of their own exposure. We measure that trace with a design that reads the same sentence through two models, which cancels fluency and quality by construction, and it comes to a rank correlation near -0.08, where -1 would be a perfect relation and 0 none.

在普通文本实际存在的重复水平下，五个参数量从 10 亿（1B）到 130 亿（13B）的模型，最多只带有其自身训练数据暴露的微弱痕迹。我们通过一种设计来测量这种痕迹：让两个模型读取同一个句子，从而在构建上抵消了流畅度和质量的影响。结果显示，其秩相关系数接近 -0.08（其中 -1 代表完全相关，0 代表完全不相关）。

Where the trace does become strong, above roughly a thousand copies, the two corpora agree on which sentences those are, because they are the famous ones, so exposure can no longer be told apart from fame.

当这种痕迹变得明显时（大约超过一千次重复），两个语料库对于哪些句子属于此类达成了一致，因为这些都是“著名”的句子，因此此时已无法将“数据暴露”与“文本知名度”区分开来。

Two further measurements show how apparent membership signal gets manufactured. A common way to build a non-member is to change one word of a member. The model does prefer the original, but the gap is the same whether the original appeared once or a hundred times, so what the model is rewarding is the author’s word choice, not memory.

另外两项测量展示了表面的成员资格信号是如何被“制造”出来的。构建非成员句子的常见方法是修改成员句子中的一个词。模型确实更偏好原始句子，但无论原始句子出现过一次还是一百次，这种偏好差距都是一样的。因此，模型所奖励的是作者的措辞选择，而非记忆。

Above a thousand copies the gap grows with model size on the twelve sentences we can test there, at the same boundary where the pincer closes. And swapping the controls for sentences that differ from the members in register moves a detector from 0.83 to 0.94 AUC, on a scale where 0.5 is a coin flip and 1.0 is perfect separation. We release the sentence banks, counts, and code.

在超过一千次重复的情况下，在我们能测试的 12 个句子上，这种差距随着模型规模的增大而扩大，这正处于上述“双向夹击”闭合的边界。此外，将对照组替换为与成员句子语体不同的句子，会将检测器的 AUC 从 0.83 提升至 0.94（在 0.5 为随机猜测、1.0 为完美区分的量表上）。我们已公开了句子库、计数数据和代码。