Speculating LLMs' Chinese Training Data Pollution from Their Tokens

Qingjie Zhang; Di Wang; Haoting Qian; Liu Yan; Tianwei Zhang; Ke Xu; Qi Li; Minlie Huang

cs.CLAug 25, 2025

Speculating LLMs' Chinese Training Data Pollution from Their Tokens

Authors: Qingjie Zhang, Di Wang, Haoting Qian, Liu Yan, Tianwei Zhang, Ke Xu, Qi Li, Minlie Huang,

Organizations: Tsinghua University · Ant Group · Nanyang Technological University · Zhongguancun Laboratory

Abstract

Tokens are basic elements in the datasets for LLM training. It is well-known that many tokens representing Chinese phrases in the vocabulary of GPT (4o/4o-mini/o1/o3/4.5/4.1/o4-mini) are indicating contents like pornography or online gambling. Based on this observation, our goal is to locate Polluted Chinese (PoC) tokens in LLMs and study the relationship between PoC tokens' existence and training data. (1) We give a formal definition and taxonomy of PoC tokens based on the GPT's vocabulary. (2) We build a PoC token detector via fine-tuning an LLM to label PoC tokens in vocabularies by considering each token's both semantics and related contents from the search engines. (3) We study the speculation on the training data pollution via PoC tokens' appearances (token ID). Experiments on GPT and other 23 LLMs indicate that tokens widely exist while GPT's vocabulary behaves the worst: more than 40% long Chinese tokens (i.e., a token with more than two Chinese characters) are either porn or online gambling. We validate the accuracy of our speculation method on famous pre-training datasets like C4 and Pile. Then, considering GPT-4o, we speculate that the ratio of "Yui Hatano" related webpages in GPT-4o's training data is around 0.5%.

Figures & tables

Figure 1: Overview: we aim to perform a systematic study on PoC tokens starting from GPT’s vocabulary. Additionally, we try to address a challenging question: how to speculate GPT-4o’s training data pollution from its vocabulary. Photo is blurred for privacy concerns.

Figure 2: An example: the outputs of GPT-4.5, 4.1, and 4o when the input involves PoC tokens. We use Chinese to query and list the corresponding translation in gray color to help reading . GPT cannot explain or repeat PoC tokens. Full outputs are in Appendix B , and please kindly note GPT has different but similar outputs if reproduced.

	Interpretation		Repetition
	Normal	PoC	Normal	PoC
4-turbo	86.1	72.2 $\blacktriangledown$ $13.9$	100.0	100.0
4o	88.0	43.7 $\blacktriangledown$ $44.3$	96.0	54.2 $\blacktriangledown$ $41.8$
4o-mini	84.8	31.2 $\blacktriangledown$ $53.6$	91.0	35.4 $\blacktriangledown$ $55.6$
o1-mini	85.6	28.9 $\blacktriangledown$ $56.7$	94.3	46.7 $\blacktriangledown$ $47.6$
o3-mini	89.0	30.7 $\blacktriangledown$ $58.3$	89.6	33.1 $\blacktriangledown$ $56.5$

Table 1: Accuracy (%) of interpretation and repetition tasks. Advanced GPT models hardly understand PoC tokens compared to normal ones. Instead, GPT-4-turbo works well as its vocabulary is not polluted ( Table 2 ).

Figure 3: A Chinese news website in mC4: most of its contents are normal, but polluted contents are at the head and tail of the web (GPT’s PoC token “大发快三” appears 67 times). More details are in Appendix F .

	Adult Content	Online Gambling	Online Game	Online Video	Anomalous	Total
GPT-4o/o1/o3/4.5/4.1/o4	219 (13.2%)	459 (27.7%)	14 (0.84%)	47 (2.83%)	34 (2.05%)	773 (46.6%)
BLOOM	8 (0.11%)	0 (0.00%)	4 (0.06%)	0 (0.00%)	106 (1.51%)	118 (1.68%)
Qwen2/2.5/3	1 (0.02%)	13 (0.27%)	26 (0.54%)	1 (0.02%)	7 (0.15%)	48 (1.00%)
GLM4	4 (0.05%)	2 (0.03%)	6 (0.08%)	2 (0.03%)	5 (0.07%)	19 (0.25%)
DeepSeek-V3/R1	6 (0.06%)	0 (0.00%)	2 (0.02%)	1 (0.01%)	8 (0.08%)	17 (0.17%)
MiniCPM	0 (0.00%)	2 (1.92%)	0 (0.00%)	2 (1.92%)	2 (1.92%)	6 (5.77%)

Table 2: Number (Ratio

\%

) of PoC tokens in LLMs’ Chinese vocabularies (one token containing more than 2 Chinese characters).

Figure 4: Data points are confirmed to fall within the theoretical supremum and infimum, and thus can be reliably estimated using empirical bounds and median.

	Estimate from
To	Pile	C4	Dolma	Roots
Pile	99.6	99.8	99.6	96.1
C4	99.7	99.8	99.7	99.7
Dolma	59.9	68.6	99.7	61.9
Roots	99.8	99.8	99.8	99.7

Table 3: Accuracy (%) of whether the frequency lie in the empirical bounds estimated by PocTrace . PocTrace effectively estimate PoC tokens frequency in pretraining corpus, and is transferable to other corpus.

Figure 5: Estimated polluted ratio of Chinese training corpus within mC4 compared to ground truth (with each token manually verified in mC4).

Figure 6: Mixing “波*野结衣” related webpages with Pile at our estimated ratio (0.5%) can reproduce GPT-4o’s token ID of “波*野结衣” and its subsequences.

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 8: Top-5 contents returned by the search engine when searching with 波*野结衣 with token ID 185,946 (date: 2025.5.19).

Figure 9: Top-5 contents returned by the search engine when searching with 特朗普 with token ID 161,031 (date: 2025.5.19).

Figure 10: We built a labeling system (see web interface above) for experts to label 3,500+ Chinese tokens in GPT’s vocabulary, which can automatically record and calculate the labeling results.

Figure 11: Screenshots: GPT-4o/4.1/4.5 fail to repeat token "给主人留下些什么吧" (date: 2025.5.19).

Figure 12: Screenshots: GPT-4o/4.1/4.5 fail to explain token "大发展有限公司官网" (date: 2025.5.19).

Category	Count	Percentage (%)
Normal Content	3,008	76.73
Adult Content	277	7.07
Online Gambling	522	13.32
Online Game	16	0.41
Online Video	51	1.30
Anomalous	46	1.17

Appendix

Table 4: Distribution of token categories in dataset

Category	PoC tokens	Translation
Adult content	N/A	N/A
Online gambling	太阳城	Sun City casino
Online gambling	菲律宾申博	Philippines Shenbo betting
Online game	N/A	N/A
Online video	在线观看	watch online
Online video	在线视频	online video

Appendix

Table 5: PoC tokens in Llama 3/3.1/3.2 Chinese vocabularies.

Category	PoC tokens	Translation
Adult content	性生活	sex life
	性疾病	sexual disease
	性问题	sexual problem
	的身子	one’s body
	露出一	expose one/showing one
	黄色的	yellow/pornographic

Appendix

Table 6: PoC tokens in DeepSeek-V3/R1 Chinese vocabularies.

Category	PoC tokens	Translation
Adult content	性疾病	sexual disease
Online gambling	体育彩票	sports lottery
	体育投注	sports betting
	北京赛车	Beijing racing lottery
	大发快三	Dafa lottery game
	太阳城	Sun City casino

Appendix

Table 7: PoC tokens in Qwen2/2.5/3 Chinese vocabularies.

Category	PoC tokens	Translation
Adult content	N/A	N/A
Online gambling	太阳城	Sun City casino
Online gambling	菲律宾申博	Philippines Shenbo betting
Online video	在线观看	watch online
Online video	在线视频	online video
Anomalous	二二二二	meaningless fragments

Appendix

Table 8: PoC tokens in MiniCPM Chinese vocabularies.

Category	PoC tokens	Translation
Adult content	性生活	sex life
	性疾病	sexual disease
	性问题	sexual problem
	黄色的	yellow/pornographic
Online gambling	届中国	session China
Online gambling	时时彩	real-time lottery

Appendix

Table 9: PoC tokens in GLM4 Chinese vocabularies.

Category	PoC tokens	Translation
Adult content	N/A	N/A
Online gambling	N/A	N/A
Online video	N/A	N/A
Anomalous	N/A	N/A
Online game	的游戏	of game

Appendix

Table 10: PoC tokens in Gemma-1/2 Chinese vocabularies.

Figure 13: Contents returned by the search engine when searching with 传奇私服 (date: 2025.5.19).

Figure 14: Contents returned by the search engine when searching with 菲律宾申博 (date: 2025.5.19).

Figure 15: The content of a polluted Chinese news website from the mC4 dataset: "timestamp": "2019-10-18T07:20:03Z", "url": "http://hnyueyuan.net/lizhi/duhougan.html" (url is not accessible now).

Figure 16: Data distribution of 4 open-source training corpus: Pile Gao et al. (2020) , C4 Raffel et al. (2020) , Dolma Soldaini et al. (2024) , and Roots Laurençon et al. (2022) .

Data Contamination in Language Models

Data contamination in language models examines how training exposure to evaluation data affects measured capability, benchmark validity, and model behavior.

See all 64 papers

Auditing Chinese Web-scale Corpora via Sampled BPE Token Statistics
Aug 11, 2026Qingjie Zhang, Ziqi Tang, Jie Zhang +7LLM Auditing Data Contamination
Tsinghua University · SiliconProspect AI · Nanyang Technological University +1
Tokens, the oft-overlooked appetizer: Large language models, the distributional hypothesis, and meaning
Dec 14, 2024Julia Witte Zimmerman, Denis Hudon, Kathryn Cramer +9LLM Interpretability Distributional Semantics
Computational Story Lab, Vermont Complex Systems Institute, University of Vermont, Burlington, VT 05405, USA · Vermont Complex Systems Institute, University of Vermont, Burlington, VT 05405, USA · Department of Computer Science, St. Michael’s College, Colchester, VT 05439, USA +3
Breaking Safety at the Token Boundary: How BPE Tokenization Creates Exploitable Gaps in LLM Alignment
May 1, 2026Tung-Ling Li, Hongliang Liu, Yuhao WuLanguage Model Safety Evaluation Adversarial Attacks on LLMs
Palo Alto Networks

Aug 11, 2026J/K move · Enter open · S save

Auditing Chinese Web-scale Corpora via Sampled BPE Token Statistics

Qingjie Zhang, Ziqi Tang, Jie Zhang, Gelei Deng+6

Tsinghua University · SiliconProspect AI · Nanyang Technological University+1

LLM Auditing Data Contamination

Open paper AskPDF arXiv

Chinese web pollution has surfaced in LLMs, motivating audits of upstream Chinese corpora. However, auditing such corpora faces three challenges: (1) their web-scale size makes full scan costly; (2) prior analyses are often too coarse to expose token-level pollution; (3) Chinese web pollution is implicit and rapidly changing. We propose Sampled-BPE, a lightweight token-level auditing pipeline that sample a small subset and train BPE tokenizer to surface polluted tokens. Experiments show that Sampled-BPE preserves usable estimates while substantially reducing runtime and memory: a 148.4

\times

speedup and a 35.8

\times

memory reduction induce only 4.25% relative error for pollution categories. We apply the pipeline to 11 open Chinese corpora and 6 Chinese Common Crawl snapshots from 2021 to 2026. The audit reveals widespread but uneven pollution across open corpora, as well as highly polluted and temporally shifting Chinese web content. We further release a hierarchical Chinese web token dataset with 660k+ token records, each with web context, category, and explanation fields, organized as trees to support review and tracing of pollution.

Abstract

Data Contamination in Language Models

Explore similar work

Auditing Chinese Web-scale Corpora via Sampled BPE Token Statistics

Tokens, the oft-overlooked appetizer: Large language models, the distributional hypothesis, and meaning

Breaking Safety at the Token Boundary: How BPE Tokenization Creates Exploitable Gaps in LLM Alignment