mlsanityData to 7 Oct 2026

Data Provenance Auditing of Fine-Tuned Large Language Models with a Text-Preserving Technique

arXiv 2510.09655 ↗First posted 7 Oct 2025cs.CR cs.AIcited by 3

Not on the map. Why?

Abstract (arXiv)

We propose a system for marking sensitive or copyrighted texts to detect their use in fine-tuning large language models under black-box access with statistical guarantees. Our method builds digital ``marks'' using invisible Unicode characters organized into (``cue'', ``reply'') pairs. During an audit, prompts containing only ``cue'' fragments are issued to trigger regurgitation of the corresponding ``reply'', indicating document usage. To control false positives, we compare against held-out counterfactual marks and apply a ranking test, yielding a verifiable bound on the false positive rate. Empirically, we obtain a true positive rate of 96.7% at 0% false positive rate and reply regurgitation rates exceeding 28% per document with only 40 (4%) watermarked documents. The approach is minimally invasive, scalable across many sources, robust to standard processing pipelines, and achieves high detection power even when marked data is a small fraction of the fine-tuning corpus.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 55 of its 73 references that are in the map. First posted on arXiv 7 Oct 2025.

Builds on

55 of 73 references.

References · 55

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  5. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,146
  6. 2017Deep reinforcement learning from human preferencescited by 3,846
  7. 2023FlashAttention-2: Faster Attention with Better Parallelism and Work Partitioningcited by 2,551
  8. 2020The Pile: An 800GB Dataset of Diverse Text for Language Modelingcited by 2,346
  9. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  10. 2020Extracting Training Data from Large Language Modelscited by 2,144
  11. 2024The FineWeb Datasets: Decanting the Web for the Finest Text Data at Scalecited by 1,104
  12. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
38 more
  1. 2022Quantifying Memorization Across Neural Language Modelscited by 755
  2. 2023Extracting Training Data from Diffusion Modelscited by 723
  3. 2023A Watermark for Large Language Modelscited by 667
  4. 2019CCNet: Extracting High Quality Monolingual Datasets from Web Crawl Datacited by 544
  5. 2024Dolma: an Open Corpus of Three Trillion Tokens for Language Model Pretraining Researchcited by 475
  6. 2023Scalable Extraction of Training Data from (Production) Language Modelscited by 415
  7. 2023Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defensecited by 401
  8. 20218-bit Optimizers via Block-wise Quantizationcited by 395
  9. 2020Label-Only Membership Inference Attackscited by 371
  10. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 188
  11. 2024RedPajama: an Open Dataset for Training Large Language Modelscited by 178
  12. 2023On the Reliability of Watermarks for Large Language Modelscited by 170
  13. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  14. 2020Membership Leakage in Label-Only Exposurescited by 156
  15. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  16. 2024LLM Dataset Inference: Did you train on my dataset?cited by 107
  17. 2023A Survey of Text Watermarking in the Era of Large Language Modelscited by 102
  18. 2024On Protecting the Data Privacy of Large Language Models (LLMs): A Surveycited by 91
  19. 2023Protecting Language Generation Models via Invisible Watermarkingcited by 81
  20. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  21. 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermarkcited by 78
  22. 2024DE-COP: Detecting Copyrighted Content in Language Models Training Datacited by 72
  23. 2022CATER: Intellectual Property Protection on Text Generation APIs via Conditional Watermarkscited by 68
  24. 2023Mark My Words: Analyzing and Evaluating Language Model Watermarkscited by 62
  25. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 54
  26. 2024Watermarking Makes Language Models Radioactivecited by 52
  27. 2024Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Datacited by 49
  28. 2024Proving membership in LLM pretraining data via data watermarkscited by 38
  29. 2023Did You Train on My Dataset? Towards Public Dataset Protection with Clean-Label Backdoor Watermarkingcited by 37
  30. 2024Copyright Traps for Large Language Modelscited by 36
  31. 2022Distillation-Resistant Watermarking for Model Protection in NLPcited by 29
  32. 2022Membership Inference via Backdooringcited by 24
  33. 2023Watermarking Text Data on Large Language Models for Dataset Copyrightcited by 24
  34. 2024Scaling Up Membership Inference: When and How Attacks Succeed on Large Language Modelscited by 21
  35. 2024Double-I Watermark: Protecting Model Copyright for LLM Fine-tuningcited by 18
  36. 2024SoK: Dataset Copyright Auditing in Machine Learning Systemscited by 14
  37. 2022Data Isotopes for Data Provenance in DNNscited by 11
  38. 2024LUMIA: Linear probing for Unimodal and MultiModal Membership Inference Attacks leveraging internal LLM statescited by 8

50 most cited of 55 All 55 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Implicit Identity Technologies for LLMs: Fingerprinting and Watermarking across Datasets, Models, and Generated Contentcited by 1
  2. 2026AuditWeave: A Tamper-Evident, Auditor-Navigable Evidence Layer for AI-Assisted and Data-Transformation Workflowscited by 0
  3. 2026Auditing Data Provenance in LLM Fine-tuning via Intrinsic Distributional Fingerprintscited by 0