Beyond Public Access in LLM Pre-Training Data

Sruly Rosenblat; Tim O'Reilly; Ilan Strauss

cs.CLApr 24, 2025

Beyond Public Access in LLM Pre-Training Data

Authors: Sruly Rosenblat, Tim O'Reilly, Ilan Strauss

Organizations: AI Disclosures Project, Code for Science and Society · O’Reilly Media · Institute for Innovation and Public Purpose, University College London

Abstract

Using a legally obtained dataset of 34 copyrighted O'Reilly Media books (13,962 paragraphs), we apply the DE-COP membership inference attack to test whether OpenAI models show recognition of non-public (pay-walled) content they were not licensed to train on. Our main contribution is examining non-public books, which allows us to consider potential access violations and not just training inclusion. Our results suggest that GPT-4o, OpenAI's more recent and capable model in our sample, exhibits patterns consistent with recognition of non-public books, with an AUROC score of 0.82 (95% bootstrapped CI: 0.60-0.96) -- where above 50% is better than random chance. GPT-3.5 Turbo (trained two years prior) and the smaller GPT-4o Mini both score near chance recognition on non-public data (0.54 and 0.56, respectively). Results are robust to independent paraphrasers (Gemma and Qwen) and leave-one-book-out sensitivity analyses. We also test both GPT-4o and GPT-4o mini, with the same October 2023 training cutoff date, to ensure the model is not simply identifying language shifts over time. These findings support disclosure requirements for pre-training data provenance and formal licensing markets for training content. Results remain preliminary given the small book sample, possible contamination of post-cutoff controls, and differences across models in size, architecture, and training composition.

Figures & tables

Figure 1: We split our sample of O’Reilly books by time period & accessibility.

Model	Data-Split	Sample Size (n)	Average Word Count
GPT-4o	Public	1,965	112
	Non-Public	8,997	113
	Potentially In-Dataset	8,985	113
	Out-of-Dataset	1,977	110
GPT-4o Mini	Public	1,968	112
	Non-Public	9,005	113

Table 1: DE-COP – Paragraph-Level Sample Size and Average Word Count by Model (by type)

Model	Total Paragraphs	Non-Public	Public	Books
GPT-4o	10,962	8,997	1,965	24
GPT-4o Mini	10,973	9,005	1,968	24
GPT-3.5 Turbo	8,100	6,171	1,929	26

Table 2: AUROC Sample - Paragraph and Book Sample Sizes by Model

Figure 2: AUROC Scores: Recognition Patterns Consistent with Pre-Training Exposure

Figure 3: DE-COP Guess Rate Improves: More capable models identify human text even when not trained on it.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Title	Date	GPT-3.5 Turbo Paragraph Count	GPT-4o Mini Paragraph Count	GPT-4o Paragraph Count
97 Things Every Information Security Professional Should Know	2021-09-14	—	315	314
AI-Powered Business Intelligence	2022-06-10	239	397	396
Advancing into Analytics	2021-04-18	—	157	157
Applied Machine Learning and AI for Engineers	2022-11-10	329	353	353
Azure Cookbook	2023-06-29	42	—	—
Building Green Software	2024-03-11	226	416	414

Appendix

Table 3: Detailed information about the books included in our dataset.

Public Split		Non-Public Split
Phrase	Occurrences	Phrase	Occurrences
in this chapter	138	as well as	455
as well as	115	one of the	449
one of the	99	be able to	444
be able to	89	the number of	436
a lot of	85	you want to	399

Appendix

Table 4: There is a noticeable difference in phrasing between public and non-public text.

Figure 4: AUROC score is highly dependent on the data scale and method it is measured with.

	GPT-4o	GPT-4o Mini	GPT-3.5 Turbo
All Paragraphs
Papers Method for AUROC (Binary)	0.79	0.61	0.65
AUROC on Book Level	0.79	0.56	0.58
AUROC on Paragraph Level	0.63	0.49	0.50
Balanced AUROC Mean Using Papers Method	0.82	0.65	0.68
Balanced AUROC Mean on Book Level	0.81	0.56	0.60

Appendix

Table 5: All AUROC Metrics by Data Split and Model.

Model	Data-Split	Book Level AUROC
GPT-4o	All	0.79 (0.53, 0.96)
	Public	0.64 (0.36, 0.93)
	Non-Public	0.82 (0.60, 0.96)
GPT-4o Mini	All	0.56 (0.25, 0.84)
	Public	0.55 (0.20, 0.84)
	Non-Public	0.56 (0.28, 0.83)

Appendix

Table 6: Book Level AUROC Scores with Bootstrapped Confidence Intervals by Data Split.

Model	Data-Split	Paragraph Level AUROC
GPT-4o	All	0.63 (0.62, 0.65)
	Public	0.60 (0.57, 0.63)
	Non-Public	0.64 (0.63, 0.66)
GPT-4o Mini	All	0.49 (0.48, 0.51)
	Public	0.48 (0.45, 0.51)
	Non-Public	0.50 (0.48, 0.51)

Appendix

Table 7: Paragraph Level AUROC Scores with Bootstrapped Confidence Intervals by Data Split

Model	Non-Public AUROC	Public AUROC	Difference	95% CI	P-value
GPT-4o	0.82	0.65	0.18	(0.02, 0.38)	0.04
GPT-4o Mini	0.56	0.55	0.02	( $-0.19$ , 0.22)	0.87
GPT-3.5 Turbo	0.54	0.64	$-0.10$	( $-0.39$ , 0.14)	0.46

Appendix

Table 8: Clustered Paired Bootstrap of the Non-Public Minus Public Book Level AUROC Difference

Target Model	Claude 3.5 Sonnet (original)	Gemma 4 26B	Qwen 3.5 9B	Paragraphs
GPT-4o	0.74	0.85	0.81	960
GPT-4o Mini	0.51	0.61	0.68	960
GPT-3.5 Turbo	0.43	0.55	0.55	759

Appendix

Table 9: Paraphraser Robustness: Book Level AUROC by Paraphrasing Model (Paired Subsample)

Figure 5: For GPT-4o, the 95% Bootstrapped Confidence Interval First Excludes Chance at the True Training Boundary

Figure 6: Leave-One-Book-Out Sensitivity of Book Level AUROC

Model	Last Public	First Private	Diff.	95% CI	P-value	Pairs
GPT-4o	0.80	0.74	$-0.06$	( $-0.26$ , 0.11)	0.55	281
GPT-4o Mini	0.79	0.63	$-0.16$	( $-0.44$ , 0.11)	0.28	282
GPT-3.5 Turbo	0.44	0.27	$-0.17$	( $-0.41$ , 0.04)	0.11	225

Appendix

Table 11: Boundary-Adjacent Control Around the Public/Private Preview Cutoff

Model	Ch. 4 Public	Ch. 3/5 Private	Diff.	95% CI	P-value	Books
GPT-4o	0.57	0.67	0.11	( $-0.11$ , 0.35)	0.39	24
GPT-4o Mini	0.44	0.43	$-0.01$	( $-0.20$ , 0.19)	0.97	24
GPT-3.5 Turbo	0.46	0.59	0.13	( $-0.17$ , 0.45)	0.42	25

Appendix

Table 12: Adjacent-Chapter Control: Chapter 4 Public vs Chapters 3 and 5 Private

Privacy Leakage in Language Models

Privacy leakage in language models concerns how models expose training data, infer sensitive traits, or transmit private context through outputs and internal channels.

See all 296 papers

Alignment Whack-a-Mole : Finetuning Activates Verbatim Recall of Copyrighted Books in Large Language Models
Mar 21, 2026Xinyue Liu, Niloofar Mireshghallah, Jane C. Ginsburg +1LLM Alignment Memorization in Language Models
Stony Brook University · Carnegie Mellon University · Columbia Law School
MC-PDD: Masked Corpus-Level Pretraining Data Detection for Black-Box Large Language Models
Jun 6, 2026Kaixin Lan, Mu You, Tao Fang +3Membership Inference Attacks LLM Auditing
Natural Language Processing & Portuguese-Chinese Machine Translation (NLP2CT) Laboratory, University of Macau, Macau SAR, China · Institute of International Language Services Studies, Macau Millennium College, Macau SAR, China · Innovation Research & Development, BoardWare Information System Limited
From Unfamiliar to Familiar: Detecting Pre-training Data via Gradient Deviations in Large Language Models
Mar 5, 2026Ruiqi Zhang, Lingxiang Wang, Hainan Zhang +2Membership Inference Attacks LLM Auditing
Beijing Advanced Innovation Center for Future Blockchain and Privacy Computing, Beihang University · School of Artificial Intelligence, Beihang University

Mar 21, 2026J/K move · Enter open · S save

Alignment Whack-a-Mole : Finetuning Activates Verbatim Recall of Copyrighted Books in Large Language Models

Xinyue Liu, Niloofar Mireshghallah, Jane C. Ginsburg, Tuhin Chakrabarty

Stony Brook University · Carnegie Mellon University · Columbia Law School

LLM Alignment Memorization in Language Models Training Data Extraction LLM Fine-Tuning Memorization in Generative Models

Open paper AskPDF arXiv

Frontier LLM companies have repeatedly assured courts and regulators that their models do not store copies of training data. They further rely on safety alignment strategies via RLHF, system prompts, and output filters to block verbatim regurgitation of copyrighted works, and have cited the efficacy of these measures in their legal defenses against copyright infringement claims. We show that finetuning bypasses these protections: by training models to expand plot summaries into full text, a task naturally suited for commercial writing assistants, we cause GPT-4o, Gemini-2.5-Pro, and DeepSeek-V3.1 to reproduce up to 85-90% of held-out copyrighted books, with single verbatim spans exceeding 460 words, using only semantic descriptions as prompts and no actual book text. This extraction generalizes across authors: finetuning exclusively on Haruki Murakami's novels unlocks verbatim recall of copyrighted books from over 30 unrelated authors. The effect is not specific to any training author or corpus: random author pairs and public-domain finetuning data produce comparable extraction, while finetuning on synthetic text yields far little extraction, indicating that finetuning on individual authors' works reactivates latent memorization from pretraining. Three models from different providers memorize the same books in the same regions (

r \ge 0.90

), pointing to an industry-wide vulnerability. Our findings offer compelling evidence that model weights store copies of copyrighted works and that the security failures that manifest after finetuning on individual authors' works undermine a key premise of recent fair use rulings, where courts have conditioned favorable outcomes on the adequacy of measures preventing reproduction of protected expression.

Abstract

Privacy Leakage in Language Models

Explore similar work

Alignment Whack-a-Mole : Finetuning Activates Verbatim Recall of Copyrighted Books in Large Language Models

MC-PDD: Masked Corpus-Level Pretraining Data Detection for Black-Box Large Language Models

From Unfamiliar to Familiar: Detecting Pre-training Data via Gradient Deviations in Large Language Models