计算机科学

计算机科学 ›› 2026, Vol. 53 ›› Issue (10): 102-112.doi: 10.11896/jsjkx.260400118

• 大模型与多模态智能感知 • 上一篇    下一篇

融合异常度与参考差异的软加权聚合预训练数据检测方法

白皓丞, 杜彦辉, 周杰, 段奕晨, 仵一铭, 张挺   

  1. 中国人民公安大学信息网络安全学院 北京 100038
  • 收稿日期:2026-04-20 修回日期:2026-07-30 发布日期:2026-10-13
  • 通讯作者: 杜彦辉(duyanhui@ppsuc.edu.cn)
  • 基金资助:
    陕西省智慧警务重点实验室自主/开放课题(SXZJ25KF01)

Soft-weighted Aggregation for Pretraining Data Detection via Token Surprisal and Reference Gap

BAI Haocheng, DU Yanhui, ZHOU Jie, DUAN Yichen, WU Yiming, ZHANG Ting   

  1. School of Information Network Security,People’s Public Security University of China,Beijing 100038, China
  • Received:2026-04-20 Revised:2026-07-30 Online:2026-10-13
  • About author:BAI Haocheng,born in 2001,postgra-duate.His main research interests include artificial intelligence security,and so on.
    DU Yanhui,born in 1969,Ph.D,professor,Ph.D supervisor,is a member of CCF(No.14195M).His main research interests include network security and artificial intelligence security.
  • Supported by:
    Independent Research Topic/the Open Program of Shaanxi Key Laboratory of Intelligent Policing(SXZJ25KF01).

PDF (PC)

73

摘要： 预训练数据检测判断候选文本是否在预训练阶段被大语言模型(LLM)学习。现有方法采用硬阈值或关键词选定词元后等权平均,将未选中词元丢弃,且仅依赖词元异常度(token surprisal),忽略了参考差异(reference gap,目标模型相对同族小型参考模型的对数概率优势)。针对上述权重固定与信号单一两点局限,将现有方法统一为加权聚合框架的特例,提出软加权聚合方法SoftTail:利用17个参数的多层感知机(Multilayer Perceptron,MLP)为所有词元生成连续权重,并引入参考差异作为互补信号。在MIMIR基准175次交叉验证上,SoftTail在宏平均曲线下面积(AUC)和5%假阳性率下的真阳性率(TPR@5%FPR)两项指标上均取得最高值,后者相对于Min-K%++提升4.77个百分点,配对自助法(bootstrap)检验表明差异显著。消融实验表明参考差异的引入是性能提升的关键。WikiMIA基准与GPT-2跨架构验证中,所提模型检测优势保持一致。

关键词: 预训练数据检测, 成员推断, 软加权聚合, 参考差异, 词元异常度

Abstract: Pretraining data detection determines whether a candidate text has been memorized by a large language model(LLM) during pretraining.Existing mainstream methods employ fixed aggregation rules that select tokens via hard thresholds or keyword rules and then apply equal-weight averaging,and they rely on token surprisal alone while ignoring the reference gap.To address these limitations,existing methods are unified as special cases of a weighted token aggregation framework,and a soft-weighted aggregation method named SoftTail is proposed.A lightweight multilayer perceptron(MLP) with only 17 parameters gene-rates continuous weights for all tokens and incorporates the reference gap(the log-probability advantage of the target model over a smaller reference model of the same family) as a complementary signal to surprisal.Over 175 fold cross-validations on the MIMIR benchmark,SoftTail achieves the highest values on both macro-averaged area under the curve(AUC) and true positive rate at a 5% false positive rate(TPR@5%FPR),with the latter yielding a 4.77 percentage points improvement over Min-K%++;a paired bootstrap test confirms statistical significance.Ablation study results show that introducing the reference gap is the key driver of performance gains.The detection advantage remains consistent on the WikiMIA benchmark and under GPT-2 cross-architecture validation.

Key words: Pretraining data detection, Membership inference, Soft-weighted aggregation, Reference gap, Token surprisal

中图分类号: 

  • TP391
[1] CHANG K K,CRAMER M,SONI S,et al.Speak,Memory:An Archaeology of Books Known to ChatGPT/GPT-4[C]//Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing.Stroudsburg,PA:ACL,2023:7312-7327.
[2] CARLINI N,TRAMER F,WALLACE E,et al.ExtractingTraining Data from Large Language Models[C]//Proceedings of the 30th USENIX Security Symposium.Berkeley,CA:USENIX Association,2021:2633-2650.
[3] SAINZ O,CAMPOS J A,GARCÍA-FERRERO I,et al.NLPEvaluationin Trouble:On the Need to Measure LLM Data Contamination for Each Benchmark[C]//Findings of the Association for Computational Linguistics:EMNLP.Stroudsburg,PA:ACL,2023:10776-10787.
[4] 全国信息安全标准化技术委员会.人工智能安全治理框架1.0[S].北京:中国国家互联网信息办公室,2024.
[5] National Institute of Standards and Technology.AI Risk Ma-nagement Framework(AI RMF 1.0)[S].Gaithersburg,MD:NIST,2023.
[6] European Parliament.Regulation(EU) 2024/1689 on Artificial Intelligence(AI Act)[S].Brussels:Official Journal of the European Union,2024.
[7] SHI W,AJITH A,XIA M,et al.Detecting Pretraining Datafrom Large Language Models[C]//Proceedings of the 12th International Conference on Learning Representations.2024.
[8] DUAN M,SURI A,MIRESHGHALLAH N,et al.Do Membership Inference Attacks Work on Large Language Models?[C]//Proceedings of the 1st Conference on Language Modeling.2024.
[9] ZHANG J,SUN J,YEATS E,et al.Min-K%++:Improved Baseline for Detecting Pre-Training Data from Large Language Models[C]//Proceedings of the 13th International Conference on Learning Representations.2025.
[10] ANTEBI S,HABLER E,SHABTAI A,et al.Tag&Tab:Pre-training Data Detection in Large Language Models Using Keyword-Based Membership Inference Attack[C]//Findings of the Association for Computational Linguistics:EMNLP.Stroudsburg,PA:ACL,2025:5273-5286.
[11] GAO L,BIDERMAN S,BLACK S,et al.The Pile:An 800GB Dataset of Diverse Text for Language Modeling[PP/OL].ar-Xiv:(2020-12-31)[2026-05-21].https://arxiv.org/abs/2101.00027.
[12] CARLINI N,IPPOLITO D,JAGIELSKI M,et al.QuantifyingMemorization Across Neural Language Models[C]//Procee-dings of the 11th International Conference on Learning Representations.2023.
[13] SHOKRI R,STRONATI M,SONG C,et al.Membership Inference Attacks Against Machine Learning Models[C]//Procee-dings of the 2017 IEEE Symposium on Security and Privacy.Piscataway,NJ:IEEE,2017:3-18.
[14] YEOM S,GIACOMELLI I,FREDRIKSON M,et al.PrivacyRisk in Machine Learning:Analyzing the Connection to Overfitting[C]//Proceedings of the 31st IEEE Computer Security Foundations Symposium.Piscataway,NJ:IEEE,2018:268-282.
[15] MATTERN J,MIRESHGHALLAH F,JIN Z,et al.Member-ship Inference Attacks Against Language Models via Neighbourhood Comparison[C]//Findings of the Association for Computational Linguistics:ACL.Stroudsburg,PA:ACL,2023:11330-11343.
[16] MEEUS M,JAIN S,REI M,et al.Did the Neurons Read Your Book?Document-Level Membership Inference for Large Language Models[C]//Proceedings of the 33rd USENIX Security Symposium.Berkeley,CA:USENIX Association,2024:2369-2386.
[17] SONG C,SHMATIKOV V.Auditing Data Provenance in Text-Generation Models[C]//Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining.New York:ACM,2019:196-206.
[18] KANDPAL N,DENG H,ROBERTS A,et al.Large Language Models Struggle to Learn Long-Tail Knowledge[C]//Procee-dings of the 40th International Conference on Machine Lear-ning.Cambridge,MA:PMLR,2023:15696-15707.
[19] BIDERMAN S,SCHOELKOPF H,ANTHONY Q,et al.Pythia:A Suite for Analyzing Large Language Models Across Training and Scaling[C]//Proceedings of the 40th International Conference on Machine Learning.Cambridge,MA:PMLR,2023:2397-2430.
[20] RADFORD A,WU J,CHILD R,et al.Language Models AreUnsupervised Multitask Learners[R].San Francisco,CA:OpenAI,2019.
[21] MITCHELL E,LEE Y,KHAZATSKY A,et al.DetectGPT:Zero-Shot Machine-Generated Text Detection Using Probability Curvature[C]//Proceedings of the 40th International Confe-rence on Machine Learning.Cambridge,MA:PMLR,2023:24950-24962.
[22] TOUVRON H,LAVRIL T,IZACARD G,et al.LLaMA:Open and Efficient Foundation Language Models[PP/OL].arXiv:(2023-02-27)[2026-05-21].https://arxiv.org/abs/2302.13971.
[23] VASWANI A,SHAZEER N,PARMAR N,et al.Attention Is All You Need[C]//Proceedings of the 31st International Conference on Neural Information Processing Systems.2017:5998-6008.
Viewed
Full text


Abstract

Cited
  Shared   
  Discussed   
No Suggested Reading articles found!
渝ICP备16013121号-4
地址：重庆市两江新区洪湖西路18号    邮编：401121  
电话：023-63500828（编辑部） 023-67039612（会议/专题） 023-67039623（财务/发票）
E-mail：jsjkx12@163.com
本系统由北京玛格泰克科技发展有限公司设计开发