Detecting Pretraining Data from Large Language Models

LLMs are trained on trillions of tokens, almost certainly including test data for widely reported benchmarks, but there's no way to know which data was included.

Introduces WIKIMIA (dynamic benchmark using data created before/after model training) and Min-K% Prob detection method. Min-K% Prob: unseen examples contain outlier words with low probabilities; seen examples don't. Achieves 7.4% improvement on WIKIMIA over previous methods. Applied to copyrighted book detection, contaminated downstream example detection, and privacy auditing.

arXiv preprint, no venue claim in comments. This is the canonical paper on benchmark contamination detection. The key insight: if a model has seen a benchmark in training, its perplexity on that benchmark will be artificially low, making the benchmark result meaningless. The Min-K% Prob method requires no knowledge of the pretraining corpus. VENUE CORRECTED 2026-10-04 (paper-verification pass): venue/year arxiv-preprint 2023 -> iclr 2024. EVIDENCE: Exact title "Detecting Pretraining Data from Large Language Models" appears in the ICLR 2024 accepted-paper index (https://iclr.cc/virtual/2024/papers.html?filter=titles) at match score 1.0 against a 2275-title list; no other title scored above 0.695. Semantic Scholar independently returns venue "International Conference on Learning Representations". arXiv 2310.16789 has an EMPTY comment field and no journal_ref, so nothing in the arXiv metadata justified recording this as an unpublished preprint; Semantic Scholar was the only prior signal and it pointed at ICLR. arxiv_id stays 2310.16789 — that is the preprint identifier, and the venue field now marks the peer-reviewed version separately. Both values retained here deliberately; status set to contested because this changes a peer-reviewed attribution. arxiv_id unchanged (2310.16789). VENUE_TRACK BACKFILL 2026-10-04 (paper-fields pass, agent w3p): venue_track 'main'. This is STRUCTURAL rather than researched: iclr has no Findings volume and no workshop track in which a paper could appear, so 'main' is the only possible honest value and no per-paper evidence was needed. The field is annotated here so that 'findings' and 'workshop' remain MEANINGFUL - a filter for findings=true must return only the papers that actually are findings, which requires every other paper to be explicitly NOT findings. 2026-10-10: ICLR 2024 accepted titles index (idx7.py: https://iclr.cc/virtual/2024/papers.html?filter=titles) lists "Detecting Pretraining Data from Large Language Models" (poster 21766). Source meth-detecting-pretraining-data-arxiv notes state arXiv preprint without venue claim, while sco-iclr-accepted-index-2024 does not list this title in its note summary. Sources do not agree on a single venue; status remains contested.