Research map / Large language models / Language, safety and interpretability
Measuring Fingerprints of Web-filtered Text Datasets and Fingerprint Propagation Through Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that neural classifiers can identify which web-filtered LLM pretraining dataset a text comes from (far better than humans), that these fingerprints propagate into text generated by models trained on them, and that they can be used to estimate mixture proportions and hint at finetuning data sources.
Problem
Popular web-filtered pretraining datasets for LLMs are derived from similar CommonCrawl curation pipelines, yet it is unclear whether they carry distinguishable dataset-specific fingerprints, how those fingerprints affect generalization, and whether they persist in model outputs.
Approach
Adapts the vision dataset-classification experiment to LLM pretraining corpora: finetunes a 160M autoregressive transformer with a classification head to identify source dataset, then uses that classifier on text generated by models trained on those datasets to trace fingerprint propagation, estimate mixture proportions, and compare instruction-tuned model outputs.
Key results
- Three-way classification of C4, FineWeb, and RefinedWeb reaches 74.76% accuracy (chance 33.3%), while two human researchers achieved 63% on binary C4 vs FineWeb versus 88% for the 160M classifier.
- Classifier trained on original RefinedWeb, DCLM-Baseline, and FineWeb-Edu achieves 89.15% on text generated by pretrained models (vs 89.76% on original data), showing fingerprints propagate through training.
- Models pretrained on a mixture of datasets have second-lowest perplexity on most individual evaluation sets and the lowest on the mixture evaluation data and on WikiText-103 (42.7) and Paloma (41.2).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train on an equal mixture of the seven datasets instead of a single dataset | 160M transformer · WikiText-103 | perplexity: 44.6 -> 42.7 | Helped |
| Train on an equal mixture of the seven datasets instead of a single dataset | 160M transformer · Paloma | perplexity: 42.2 -> 41.2 | Helped |
| Pretrain the classifier before classification finetuning (ablation) | C4, FineWeb, RefinedWeb classification · C4, FineWeb, RefinedWeb | classification accuracy: 71.59% -> 74.76% (3.17%) | Helped |
| Increase classification training data from 480M to 1.92B tokens (ablation) | 160M classifier · C4, FineWeb, RefinedWeb | classification accuracy: gain of 0.82% | Helped |
| Increase model size and pretraining data from the smallest to largest tested configuration (ablation) | Three-way C4, FineWeb, RefinedWeb classifier · C4, FineWeb, RefinedWeb | classification accuracy: 0.56% | No clear effect |
| Rewrite sequences with formatting removed or minimized (Prompt 3) (ablation) | C4 vs FineWeb classification · C4 vs FineWeb, rewritten text | classification accuracy: 87.4% -> 66.0% | Hurt |
| Remove structural formatting from the text (ablation) | C4 vs FineWeb classification · C4 vs FineWeb, regex-preprocessed text | classification accuracy: 87.37% -> 72.42% | Hurt |
| Use word frequencies only, disregarding format, grammar, word order, and context (ablation) | C4 vs FineWeb classification · C4 vs FineWeb | classification accuracy: 63.45% | Hurt |
| Distill GPT-4o responses into Qwen-2.5-7B-Instruct (ablation) | Qwen-2.5-7B-Instruct vs GPT-4o classification · OpenHermes prompts | classification accuracy: 97.4% -> 79.8% | Hurt |
| Use LLM2Vec instead of the 160M transformer classifier | C4, FineWeb, RefinedWeb classification · C4, FineWeb, RefinedWeb | classification accuracy: 73% -> 82% | Helped |
Surprising findings
- Human researchers performed only 13 points above chance at distinguishing C4 from FineWeb, while a 160M classifier reached 88%.
- GPT-4o and DeepSeek-V3 outputs on OpenHermes prompts were essentially indistinguishable for the 160M classifier (48.7% error), suggesting possible GPT-4o-generated data in DeepSeek-V3's finetuning.
Limitations
- Classification fails to separate datasets that share sources but differ only in mixture proportions, since sources may be assigned to the dataset that saw more of them.
- Rewriting and categorization rely on GPT-4o-mini; instruction-tuned model analysis depends on API-accessed models whose training data are undisclosed.
- Human evaluation is limited to two researchers and a single binary task (C4 vs FineWeb).
Experimental setup
Datasets: C4 RefinedWeb DolmaCC RedPajama-V2 FineWeb FineWeb-Edu DCLM-Baseline SlimPajama RedPajama-1T OpenHermes-2.5 Alpaca UltraChat
Benchmarks: WikiText-103 Paloma
Metrics: classification accuracy perplexity classification error
Baselines: Bag of Words LLM2Vec random-init 160M transformer human annotators
Builds on: dataset classification experiment (Torralba and Efros 2011) OpenLM LLM2Vec
Closest papers by meaning
- AttnDiff: Attention-based Differential Fingerprinting for Large Language Models (NeurIPS 2026 · similarity 0.86)
- STAMP Your Content: Proving Dataset Membership via Watermarked Rephrasings (ICML 2025 · similarity 0.86)
- The FineWeb Datasets: Decanting the Web for the Finest Text Data at Scale (NeurIPS 2024 · similarity 0.85)
- Data Mixture Inference Attack: BPE Tokenizers Reveal Training Data Compositions (NeurIPS 2024 · similarity 0.85)
- Detecting Pretraining Data from Large Language Models (ICLR 2024 · similarity 0.84)
- Scalable Fingerprinting of Large Language Models (NeurIPS 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.