# Subtle Injection for Ground-truth Inference of LLM Training Data

arXiv: https://arxiv.org/abs/2606.06502 · HTML: https://mlsanity.com/paper/2606.06502/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Membership inference attacks, one of 12 directions in LLM safety and security.
- Builds on 15 of its 24 references that are in the map.
- First posted on arXiv 18 May 2026.

## Placed in

- LLM safety and security / [Membership inference attacks](https://mlsanity.com/safety/membership-inference-attacks/)

## Builds on (most cited first, 15 of 15)

- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Extracting Training Data from Large Language Models](https://mlsanity.com/paper/2012.07805/) (2020)
- [Pythia: A Suite for Analyzing Large Language Models Across Training and Scaling](https://mlsanity.com/paper/2304.01373/) (2023)
- [The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks](https://mlsanity.com/paper/1802.08232/) (2018)
- [Quantifying Memorization Across Neural Language Models](https://mlsanity.com/paper/2202.07646/) (2022)
- [A Watermark for Large Language Models](https://mlsanity.com/paper/2301.10226/) (2023)
- [TOFU: A Task of Fictitious Unlearning for LLMs](https://mlsanity.com/paper/2401.06121/) (2024)
- [Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense](https://mlsanity.com/paper/2303.13408/) (2023)
- [Detecting Pretraining Data from Large Language Models](https://mlsanity.com/paper/2310.16789/) (2023)
- [Provable Robust Watermarking for AI-Generated Text](https://mlsanity.com/paper/2306.17439/) (2023)
- [Did the Neurons Read your Book? Document-level Membership Inference for Large Language Models](https://mlsanity.com/paper/2310.15007/) (2023)
- [Passive Hack-Back Strategies for Cyber Attribution: Covert Vectors in Denied Environment](https://mlsanity.com/paper/2508.16637/) (2025)
- [ARCANE: Cross-Campaign Attacker Re-identification via Passive Beacon Telemetry -- A Bayesian Network Framework for Longitudinal Cyber Attribution](https://mlsanity.com/paper/2604.24644/) (2026)
- [PHANTOM: Polymorphic Honeytoken Adaptation with Narrative-Tailored Organisational Mimicry](https://mlsanity.com/paper/2605.02992/) (2026)
- [CLOUDBURST: Cloud-Layer Observations Using Beacons for Unified Real-time Surveillance and Threat Attribution](https://mlsanity.com/paper/2605.12976/) (2026)

## Abstract (arXiv)

As large language models (LLMs) are increasingly trained on scraped web corpora without authorisation, content owners require forensic methods to prove that their documents were included in a model's training set. We propose SIGIL (Subtle Injection for Ground-truth Inference of LLM training data), a framework that embeds imperceptible canary sequences into protected text and code such that any LLM trained on those documents exhibits statistically detectable behavioural signatures when probed with targeted queries. SIGIL defines five canary strategies -- lexical-rare, lexical-phrase, syntactic, semantic, and code-pattern -- and a Membership Inference Score (MIS) grounded in the Neyman-Pearson hypothesis testing framework with formal false-positive rate (FPR) control. Simulator parameters are calibrated against the empirical membership inference literature, yielding realistic heterogeneous results across 36,000 trials: overall AUC = 0.892, rising from 0.831 at 0.1% injection to 0.947 at 10%. Detection rates range from 33% to 78% across model-size and injection-rate conditions. Code Pattern canaries achieve the highest AUC (0.903, Cohen's d = 1.84); Syntactic Structure the lowest (0.875, d = 1.63). All four experimental factors -- injection rate, model size, canary strategy, and mixture ratio -- have significant independent effects on MIS (p < 0.001). SIGIL maintains AUC > 0.86 even under 100% paraphrasing (AUC = 0.864), confirming robustness through semantic leakage that survives surface-level rewriting.