Membership in Training Data

Given a document and a model, was that document in the model's training set? Authors want to know it about their books, benchmark maintainers about their test sets, and everyone about their own writing. It is a simple question with no reliable answer from outside, which is why so much rests on provenance being recorded rather than inferred.

The detection methods rely on a model assigning higher likelihood to text it has seen — comparing per-token probabilities against a reference, looking at the least-likely tokens, or comparing against a second model trained without the candidate. All of them work better on unusual text than on ordinary text, and they degrade sharply when the candidate resembles the general distribution, which is most writing.

This is a detection problem with a base rate that makes it unforgiving. A candidate document is one of billions, so even a test that separates seen from unseen well produces far more false positives than true ones when applied at corpus scale — and the cases people care about are precisely the ordinary documents where separation is worst. Membership Inference is the same shape aimed at a privacy attack on a trained model; this is the auditing question, and it fails for the same reason.