Research map / Large language models / Language, safety and interpretability
Combating Data Laundering in LLM Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Synthesis Data Reversion (SDR), a two-stage search for an LLM rewriting prompt (register goal, then refined details) that recovers detection-useful surrogates so standard membership detectors regain power against laundered training data.
Problem
Post-hoc unauthorized training data detectors fail when a model provider trains on semantics-preserving laundered surrogates of proprietary data rather than the originals, collapsing candidate-reference score separation under black-box access.
Approach
Instead of recovering the exact hidden laundering transformation, search over a bounded set of 23 linguistic registers (goal) and refine fine-grained details via target-model continuation feedback, using an auxiliary LLM to synthesize queries that restore detector separation; the selection criterion is detector performance on synthesized candidate vs. reference sets.
Key results
- On Pythia-6.9B with outside-register laundering, Recall AUC rises from 61.7% to 73.4% and TPR@5% from 5.6% to 23.2% with SDR.
- Loss+SDR reaches 83.4% AUC with Claude as auxiliary model on Pythia-6.9B inside-register settings, versus 67.3% for Loss alone.
- Across detectors, SDR improves AUC, ASR and TPR@5% for Pythia, Falcon-7B and Llama-2-7B targets, and across MIMIR Wikipedia, HackerNews and C4 subsets.
Surprising findings
- Recovered prompts often differ from the true laundering prompt, yet still restore detection, suggesting exact prompt recovery is unnecessary for auditing.
- On the original (non-laundered) setting, standard detectors achieve near-perfect AUC (~1.000 for Loss, Zlib, Min-K), while on laundered data they fall to roughly chance (0.52-0.60 AUC).
Limitations
- Register taxonomy was not designed for data laundering and may not cover real laundering pipelines.
- Method relies on an auxiliary LLM and repeated synthesis and detector evaluation, adding cost.
- Evaluation uses simulated laundering on MIMIR with fine-tuning of small target models rather than real provider pipelines.
Experimental setup
Datasets: MIMIR-Wikipedia MIMIR-C4 MIMIR-HackerNews Polite dataset
Benchmarks: MIMIR-Wikipedia MIMIR-C4 MIMIR-HackerNews
Metrics: AUC ASR TPR@5% FPR TPR@1% FPR
Baselines: Loss Ref Zlib Min-K Recall
Builds on: Recall Min-K% Zlib reference-model membership inference register taxonomy (Biber)
Closest papers by meaning
- Open LLMs are Necessary for Current Private Adaptations and Outperform their Closed Alternatives (NeurIPS 2024 · similarity 0.87)
- Quantifying and Analyzing Entity-Level Memorization in Large Language Models (AAAI 2024 · similarity 0.87)
- Time Travel in LLMs: Tracing Data Contamination in Large Language Models (ICLR 2024 · similarity 0.86)
- A Closer Look at Machine Unlearning for Large Language Models (ICLR 2025 · similarity 0.86)
- PrivAuditor: Benchmarking Data Protection Vulnerabilities in LLM Adaptation Techniques (NeurIPS 2024 · similarity 0.86)
- SILO Language Models: Isolating Legal Risk In a Nonparametric Datastore (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.