Elamur Research⌕
☰
home / papers / 2026 / Detecting Non-Membership in LLM Training Data via Rank Correlations

Detecting Non-Membership in LLM Training Data via Rank Correlations

Paper · 2026 · Pranav Shetty, Mirazul Haque, Zhiqiang Ma et al.

Summary

Most auditing work on LLM training data asks whether a dataset was used (membership inference). This paper addresses the reverse question: how to show with statistical confidence that a model was not trained on a given dataset. Such evidence matters for copyright disputes, compliance checks, and agreements that restrict training on shared data.

The authors propose PRISM, which needs only grey-box access to logits. It also needs a reference model known to predate the dataset. Both models score every document with Min-K%++, and PRISM then computes the Spearman rank correlation between the two sets of scores. The intuition is that two capable models that never saw the data will rank documents similarly by difficulty. Training on the data disturbs that ranking through memorization. A distilled reference model provides a comparison correlation for the final statistical test.

Experiments use Pythia models, including a continued-pretraining variant, on eight datasets. PRISM rules out membership reliably without false positives. Unlike earlier methods, it requires no distribution-matched held-out data.

Key points

  • Test setup: Pythia-410m serves as the non-member target and Pythia-410m-CPT as the member target. Datasets include PubMed, HN, ArXiv, CommonCrawl, and Reddit, with eight datasets in total.
  • Pythia-1b was the most consistent reference model. Pythia-70m and Pythia-160m gave weaker signals, which the authors attribute to their lower capacity.
  • The test remains stable down to roughly 150 documents, and the authors claim it is usable with about 100.
  • Smaller K values in Min-K%++ give the strongest signal. After training, documents that were originally hard (high surprisal) shift most in rank.
  • Limitations: the dataset's release date must be known, partial inclusion of a dataset is not handled, and continued pretraining only approximates full pretraining. Existing methods such as LLM-DI and PaCoST are also discussed for comparison.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,894 works

Cite

Cite as Pranav Shetty, Mirazul Haque, Zhiqiang Ma and Xiaomo Liu. 2026. Detecting Non-Membership in LLM Training Data via Rank Correlations. Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.eacl-long.251

@inproceedings{shetty2026detecting,
  title = {{Detecting Non-Membership in LLM Training Data via Rank Correlations}},
  author = {Pranav Shetty, Mirazul Haque, Zhiqiang Ma and Xiaomo Liu},
  booktitle = {Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.eacl-long.251},
  url = {https://doi.org/10.18653/v1/2026.eacl-long.251}
}

References

35 references, 9 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbie Bradley, Kyle O’Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, and 1 others. 2023. Pythia: A suite for analyzing large language models across training and scaling. In International Co… find
  2. Nicolas Boizard, Kevin El Haddad, Céline Hudelot, and Pierre Colombo. 2024. Towards cross-tokenizer distillation: the universal logit distillation loss for llms. arXiv preprint arXiv:2402.12030.
  3. Blake Brittain. 2024. Authors sue Anthropic for copyright infringement over AI training. Reuters. Technology/Artificial Intelligence section. find
  4. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, and 1 others. 2021. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21), pages 2633–2650…
  5. Bowen Chen, Namgi Han, and Yusuke Miyao. 2025a. A statistical and multi-perspective revisiting of the membership inference attack in large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 22854–22874, Vienna, A… find
  6. Yijie Chen, Yijin Liu, Fandong Meng, Yufeng Chen, Jinan Xu, and Jie Zhou. 2025b. Enhancing cross-tokenizer knowledge distillation with contextual dynamical mapping. In Findings of the Association for Computational Linguistics: ACL 2025, pages 8005–8018, Vienna, Austria. Association for Computational… find
  7. Debeshee Das, Jie Zhang, and Florian Trantèr. 2025. Blind baselines beat membership inference attacks for foundation models. In 2025 IEEE Security and Privacy Workshops (SPW), pages 118–125. IEEE. find
  8. Bhuwan Dhingra, Manaal Faruqui, Ankur Parikh, Ming-Wei Chang, Dipanjan Das, and William W Cohen. 2019. Handling divergent reference texts when evaluating table-to-text generation. arXiv preprint arXiv:1906.01081.
  9. Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. 2024. Do membership inference attacks work on large language models? In Conference on Language Modeling (COLM).
  10. Bradley Efron. 1992. Bootstrap methods: another look at the jackknife. In Breakthroughs in statistics: Methodology and distribution, pages 569–593. Springer. find
  11. Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, and 1 others. 2020. The pile: An 800gb dataset of diverse text for language modeling. arXiv preprint arXiv:2101.00027. find
  12. Dirk Groeneveld, Iz Beltagy, Evan Walsh, Akshita Bhagia, Rodney Kinney, Oyvind Tafjord, Ananya Jha, Hamish Ivison, Ian Magnusson, Yizhong Wang, Shane Arora, David Atkinson, Russell Authur, Khyathi Chandu, Arman Cohan, Jennifer Dumas, Yanai Elazar, Yuling Gu, Jack Hessel, and 24 others. 2024. OLMo: A… find
  13. Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531.
  14. Nikhil Kandpal, Brian Lester, Colin Raffel, Sebastian Majstorovic, Stella Biderman, Baber Abbasi, Luca Soldaini, Enrico Shippole, A Feder Cooper, Aviya Skowron, and 1 others. 2025. The common pile v0. 1: An 8tb dataset of public domain and openly licensed text. arXiv preprint arXiv:2506.05209. find
  15. Solomon Kullback and Richard A Leibler. 1951. On information and sufficiency. The annals of mathematical statistics, 22(1):79–86. find
  16. Ian Magnusson, Akshita Bhagia, Valentin Hofmann, Luca Soldaini, Ananya Harsh Jha, Oyvind Tafjord, Dustin Schwenk, Evan Walsh, Yanai Elazar, Kyle Lo, and 1 others. 2024. Paloma: A benchmark for evaluating language model fit. Advances in Neural Information Processing Systems, 37:64338–64376.
  17. Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. 2024. Llm dataset inference: Did you train on my dataset? find
  18. Markus Ojala and Gemma C Garriga. 2010. Permutation tests for studying classifier performance. Journal of machine learning research, 11(6). find
  19. Belinda Phipson and Gordon K Smyth. 2016. Permutation p-values should never be zero: calculating exact p-values when permutations are randomly drawn. arXiv preprint arXiv:1603.05766. — [arXiv:1603.05766](https://arxiv.org/abs/1603.05766) find
  20. Haritz Puerto, Martin Gubri, Sangdoo Yun, and Seong Joon Oh. 2025. Scaling up membership inference: When and how attacks succeed on large language models. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 4165–4182, Albuquerque, New Mexico. Association for Computational… find
  21. Saksham Rastogi, Pratyush Maini, and Danish Pruthi. 2025. Stamp your content: Proving dataset membership via watermarked rephrasings. Preprint, arXiv:2504.13416. — [arXiv:2504.13416](https://arxiv.org/abs/2504.13416) find
  22. Patrick Schober, Christa Boer, and Lothar A Schwarte. 2018. Correlation coefficients: appropriate use and interpretation. Anesthesia & analgesia, 126(5):1763– 1768. find
  23. Pranav Shetty, Mirazul Haque, Petr Babkin, Zhiqiang Ma, Xiaomo Liu, and Manuela Veloso. 2025. Perturb your data: Paraphrase-guided training data watermarking. arXiv preprint arXiv:2512.17075. find
  24. Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. 2023. Detecting pretraining data from large language models. Preprint, arXiv:2310.16789. find
  25. Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE.
  26. Luca Soldaini, Rodney Kinney, Akshita Bhagia, Dustin Schwenk, David Atkinson, Russell Authur, Ben Bogin, Khyathi Chandu, Jennifer Dumas, Yanai Elazar, and 1 others. 2024. Dolma: An open corpus of three trillion tokens for language model pretraining research. arXiv preprint arXiv:2402.00159. find
  27. Jonathan Stempel. 2023. NY Times sues OpenAI, Microsoft for infringing copyrighted work. Reuters. Legal/Transactional section. find
  28. Mohammad Tabatabai, Stephanie Bailey, Zoran Bursac, Habib Tabatabai, Derek Wilus, and Karan P Singh. 2021. An introduction to new robust linear and monotonic correlation coefficients. BMC bioinformatics, 22(1):170. find
  29. Alexander Wettig, Aatmik Gupta, Saumya Malik, and Danqi Chen. 2024. Qurating: Selecting high-quality data for training language models. arXiv preprint arXiv:2402.09739.
  30. Rand Wilcox. 2017. Modern statistics for the social and behavioral sciences: A practical introduction. Chapman and Hall/CRC. find
  31. Rand R Wilcox. 2016. Comparing dependent robust correlations. British Journal of Mathematical and Statistical Psychology, 69(3):215–224. find
  32. Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. 2018. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pages 268–282. IEEE. *Table 6: Dataset statistics* Huixuan Zhang, Yun Lin, and Xiaojun Wan…
  33. Dataset PubMed HN ArXiv CommonCrawl Reddit Ubuntu Freelaw Enron Jingyang Zhang, Jingwei Sun, Eric Yeats, Yang Ouyang, Martin Kuo, Jianyi Zhang, Hao Frank Yang, and Hai Li. 2025. Min-k%++: Improved baseline for pre-training data detection from large language models. In The Thirteenth International Co… find
  34. Weichao Zhang, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Yixing Fan, and Xueqi Cheng. 2024b. Pre-training data detection for large language models: A divergence-based calibration method. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 5263–5274, Mi… find
  35. Bihe Zhao, Pratyush Maini, Franziska Boenisch, and Adam Dziedzic. 2025. Unlocking post-hoc dataset inference with synthetic data. In Forty-second International Conference on Machine Learning. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/shetty-2026-detecting-non-membership-llm-training/