Learning to Detect Language Model Training Data via Active Reconstruction

Junjie Oscar Yin; John X. Morris; Vitaly Shmatikov; Sewon Min; Hannaneh Hajishirzi

cs.LGFeb 22, 2026

Learning to Detect Language Model Training Data via Active Reconstruction

Authors: Junjie Oscar Yin, John X. Morris, Vitaly Shmatikov, Sewon Min, Hannaneh Hajishirzi

Organizations: University of Washington · Cornell University · UC Berkeley · Allen Institute for Artificial Intelligence

Abstract

Detecting LLM training data is generally framed as a membership inference attack (MIA) problem. However, conventional MIAs operate passively on fixed model weights, using log-likelihoods or text generations. In this work, we introduce Active Data Reconstruction Attack (ADRA), a family of MIA that actively induces a model to reconstruct a given text through training. We hypothesize that training data are more reconstructible than non-members, and the difference in their reconstructibility can be exploited for membership inference. Motivated by findings that reinforcement learning (RL) sharpens behaviors already encoded in weights, we leverage on-policy RL to actively elicit data reconstruction by finetuning a policy initialized from the target model. To effectively use RL for MIA, we design reconstruction metrics and contrastive rewards. The resulting algorithms, ADRA and its adaptive variant ADRA+, improve both reconstruction and detection given a pool of candidate data. Experiments show that our methods consistently outperform existing MIAs in detecting pre-training, post-training, and distillation data, with an average improvement of 10.7% over the previous runner-up. In particular, \MethodPlus~improves over Min-K%++ by 18.8% on BookMIA for pre-training detection and by 7.6% on AIME for post-training detection.

Figures & tables

Figure 1: Active Data Reconstruction Attack. Language model generates reconstructions from a candidate prefix and is rewarded via a contrastive objective. Members become easier to reconstruct than non-members over RL training, improving MIA performance.

Metric	Definition
Token set similarity	$\displaystyle s_{\text{tok}}(\hat{y},y^{\star})=\frac{\lvert T(\hat{y})\cap T(y^{\star})\rvert}{\lvert T(y^{\star})\rvert}$
Longest common sequence	$\displaystyle s_{\text{lcs}}(\hat{y},y^{\star})=\frac{\mathrm{LCS}(\hat{y},y^{\star})}{\lvert y^{\star}\rvert}$
N-gram set coverage	$\displaystyle s_{\text{ng}}(\hat{y},y^{\star})=\frac{\big\lvert\mathcal{N}_{[L_{\min},L_{\max}]}(\hat{y})\cap\mathcal{N}_{[L_{\min},L_{\max}]}(y^{\star})\big\rvert}{\big\lvert\mathcal{N}_{[L_{\min},L_{\max}]}(y^{\star})\big\rvert}$

Table 1: Lexical reconstruction rewards used for

\mathrm{sim}(\hat{y},y^{\star})

Task	Dataset	Dataset Cutoff	Model	Model Cutoff	Max Tokens
Pre-training	BookMIA	2023	Llama2-7B	2022*	1024
	WikiMIA 2024 Hard	2024	Qwen2-7B	2023*	1024
	Dolma3 ♠ (Olmo3 Mix)	2025	Olmo3-7B	2024	2048
Post-training	AIME ♠	2024	Tulu2-7B	2023	4096
	Olympia Math ♠	2025	Tulu2-7B	2023	4096
	Tulu3 Mix ♠	2024	Tulu3-8B	2024	1024

Table 2: Datasets, models, cutoffs, and maximum sequence lengths for pre-training, post-training, and distillation settings. Newly constructed MIA datasets are marked with ♠ . Cutoff dates marked with * are estimated.

		Active MIAs		Passive MIAs
Model	Type	ADRA+	ADRA	N-Sampling	Loss	R-Loss	Zlib	Min-K%	Min-K%++
BookMIA
Llama2-7B	Orig.	78.4	76.2	73.6	60.6	N/A	50.4	63.3	59.6
Llama2-7B	Para.	74.5	73.0	68.7	57.2	N/A	40.6	61.0	53.7
WikiMIA 2024 Hard
Qwen2-7B	Orig.	60.6	59.1	54.3	45.7	N/A	44.5	45.4	50.6

Table 3: Pre-training MIA results on BookMIA, WikiMIA 2024 Hard, and Dolma3 arXiv. Bold denotes the top-2 performance for each dataset. Our active MIA methods (ADRA and ADRA+) consistently outperform passive MIAs.

Model	Type	Method	Budget ( $N$ )	Lexical Jaccard (Best / Avg)	Lexical LCS (Best / Avg)	Lexical Coverage (Best / Avg)	Embedding Cosine (Best / Avg)
BookMIA
Llama2-7B	Orig.	ADRA+	32	21.9 / 18.5	62 / 54	5.7 / 2.4	89.0 / 83.9
		ADRA	32	18.9 / 15.9	56 / 48	4.2 / 2.0	88.6 / 84.4
		N-Sampling	32	19.9 / 15.6	57 / 46	4.9 / 1.5	89.6 / 82.7
WikiMIA 2024 Hard
Qwen2-7B		Orig.	ADRA+	32	20.1 / 14.1	51 / 33	16.1 / 6.0	88.4 / 82.3

Table 4: Pre-training member data reconstruction for original verbatim setting. Bold denotes the best average performance for each dataset. ADRA+ and ADRA consistently outperform the N-Sampling across all metrics. See Appendix E for paraphrased setting results.

		Active MIAs		Passive MIAs
Model	Type	ADRA+	ADRA	N-Sampling	Loss	R-Loss	Zlib	Min-K%	Min-K%++
Olympia Math
Tulu2-7B	Orig.	70.5	67.1	59.5	53.7	70.3	55.6	53.2	60.2
Tulu2-7B	Para.	68.5	69.4	58.2	49.6	60.1	54.9	51.1	52.9
AIME
Tulu2-7B	Orig.	85.9	85.6	72.7	71.1	67.8	61.7	75.8	78.3

Table 5: Post-training MIA results on AIME, Olympia Math, and Tulu3 Mix. Our active MIAs (ADRA and ADRA+) outperform calibration-free passive methods and match the calibration-based reference method (R-Loss).

Model	Type	Method	Budget ( $N$ )	Lexical Jaccard (Best / Avg)	Lexical LCS (Best / Avg)	Lexical Coverage (Best / Avg)	Embedding Cosine (Best / Avg)
Olympia Math
Tulu2-7B	Orig.	ADRA+	32	24.1 / 20.7	68 / 59	15.3 / 10.9	91.5 / 88.8
		ADRA	32	25.6 / 23.4	79 / 68	12.3 / 10.2	92.8 / 91.3
		N-Sampling	32	22.4 / 15.5	60 / 34	11.7 / 5.0	92.2 / 87.3
AIME
Tulu2-7B		Orig.	ADRA+	32	22.3 / 18.1	55 / 39	17.2 / 11.9	91.9 / 88.9

Table 6: Post-training member data reconstruction for original verbatim setting. ADRA+ and ADRA consistently outperform the N-Sampling across both lexical and semantic metrics. See Appendix Appendix F for paraphrased setting results.

Active MIA	Passive MIAs
ADRA	N-Sampling	Loss	R-Loss	ZLib	Min-K%	Min-K%++
S1.1 Distillation: Deepseek-R1
98.4	90.4	55.1	70.0	52.6	55.7	70.6
S1 Distillation: Gemini-2.0-flash
85.2	80.8	69.8	79.3	74.3	71.9	81.7

Table 7: Distillation MIA results. ADRA outperforms all passive MIAs on both distillation datasets (S1.1 and S1).

Method	Lexical Jaccard (Best / Avg)	Lexical LCS (Best / Avg)	Lexical Coverage (Best / Avg)	Embedding Cosine (Best / Avg)
S1.1 Distillation: Deepseek-R1
ADRA	45.4 / 44.5	145 / 143	48.6 / 47.7	97.6 / 97.5
N-Sampling	32.7 / 25.5	111 / 82	34.9 / 22.3	97.4 / 95.6
S1 Distillation: Gemini-2.0-Flash
ADRA	31.0 / 27.4	117 / 106	32.8 / 28.3	96.4 / 95.6
N-Sampling	27.8 / 21.2	111 / 80	27.4 / 17.5	96.2 / 93.7

Table 8: Distillation member data reconstruction. ADRA achieves significantly better reconstruction across all metrics.

Figure 2: Performance comparison between RL and SFT. As RL training continues, AUROC improves, whereas SFT decreases. ADRA and ADRA+ meaningfully improves over naive RL.

Active MIAs		Passive MIAs
ADRA+	ADRA	N-Sampling	Loss	R-Loss	ZLib	Min-K%	Min-K%++
89.5	84.4	72.7	70.7	63.3	60.6	77.7	82.8

Table 9: Tulu2-13B MIA results on AIME.

Method	Lexical	Embedding	LLM-as-Judge	No-Training
AUROC (Top-5 Mean)	81.3	76.9	78.8	74.8

Table 10: Reward type comparison. Lexical rewards outperform generative-based alternatives (Embedding and LLM-as-Judge).

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Prompt Template
BookMIA	You will receive a prefix from a passage and be asked to complete it based on the text of a famous work. Provide only the continuation for the last given prefix without any extra commentary, formatting, or additional text. Complete the prefix: {prefix}
WikiMIA 2024 Hard	Continue the generation as closely to verbatim as possible. {prefix}
Dolma3 arXiv	Continue the generation as closely to verbatim as possible. {prefix}

Appendix

Table 11: Prompts used for pre-training experiments across datasets. The {prefix} placeholder indicates where the input text is inserted.

Dataset	Learning rate	Eff. batch size	LR Schedule	Precision	Epochs	Warmup ratio	Max seq. len.
AIME	2e $-$ 5	64	Linear	BF16	1	0.00	4096
Olympia Math	5e $-$ 6	128	Constant	BF16	1	0.00	4096

Appendix

Table 12: Supervised fine-tuning hyperparameters for controlled contamination setting.

Dataset	Learning rate	Eff. batch size	LR Schedule	Precision	Epochs	Warmup ratio	Max seq. len.
S1 - Gemini-2.0-Flash	2e $-$ 5	128	Linear	BF16	1	0.00	8192
S1.1 - Deepseek-R1	5e $-$ 6

Appendix

Table 13: Supervised fine-tuning hyperparameters for model distillation setting.

Panel of Figure 3 — Figure 3: Prompts used to paraphrase datasets. The {input} placeholder indicates where the input text is inserted.

Hyperparameters	Setting
Advantage estimator	GRPO
Learning rate (actor)	$5e-05$
Normalize advantages (GRPO)	True
Use KL loss (not reward penalty)	True
KL loss coef.	0.005
Entropy coefficient	0

Appendix

Table 14: GRPO hyperparameters used with verl . Only core settings are shown; batch size, rollouts, sequence lengths, and training epochs vary by dataset.

Dataset	Batch size	Rollouts	Max prompt / response tokens	Steps	Reconstruction Metrics	Distractors $K$	Length penalty
BookMIA	64	32	1028 / 1028	30	Trio , N-Gram	7	1.5
WikiMIA 2024 Hard	64	32	1028 / 1028	30	Trio , N-Gram	7	1.5
Dolma3 arXiv	64	32	1028 / 1028	30	Trio , N-Gram	7	1.5
AIME	64	32	2048 / 2048	100	Trio , N-Gram	7	1.5
OlympiaMath	64	32	2048 / 2048	100	Trio , N-Gram	7	2.0 / 1.5
Tulu3 Aya / Wildchat	64	32	1024 / 512	200	Trio , N-Gram	7	1.5

Appendix

Table 15: Dataset-specific hyperparameters for ADRA training.

Metric	Definition	Normalization
Token-based Metrics
Jaccard similarity	$\displaystyle s_{\text{jacc}}(\hat{y},y^{\star})=\frac{\lvert T(\hat{y})\cap T(y^{\star})\rvert}{\lvert T(\hat{y})\cup T(y^{\star})\rvert}$	Union (symmetric)
Token overlap (ref)	$\displaystyle s_{\text{tok}}(\hat{y},y^{\star})=\frac{\lvert T(\hat{y})\cap T(y^{\star})\rvert}{\lvert T(y^{\star})\rvert}$	Reference
Token overlap (cand)	$\displaystyle s_{\text{tok}}^{\text{cand}}(\hat{y},y^{\star})=\frac{\lvert T(\hat{y})\cap T(y^{\star})\rvert}{\lvert T(\hat{y})\rvert}$	Candidate
Sequence-based Metrics
LCS length	$\displaystyle\mathrm{LCS}(\hat{y},y^{\star})$	Raw (unnormalized)

Appendix

Table 16: Evaluation metrics for measuring reconstruction quality and producing membership score. Each metric is computed for both average-of-

N

and best-of-

N

aggregations.

Model	Type	Method	Budget ( $N$ )	Lexical Jaccard (Best / Avg)	Lexical LCS (Best / Avg)	Lexical Coverage (Best / Avg)	Embedding Cosine (Best / Avg)
BookMIA
Llama2-7B	Para.	ADRA+	32	15.8 / 13.5	51 / 44	3.0 / 1.0	88.2 / 84.2
		ADRA	32	14.7 / 13.0	47 / 42	2.2 / 0.9	87.3 / 84.3
		N-Sampling	32	15.5 / 12.3	48 / 39	2.5 / 0.5	88.2 / 81.5
WikiMIA24-Hard
Qwen2-7B		Para.	ADRA+	32	16.4 / 13.1	33 / 25	8.1 / 4.0	86.5 / 82.0

Appendix

Table 17: Pre-training member data reconstruction for paraphrased setting. Bold denotes the best average performance for each dataset. ADRA+ and ADRA consistently outperform the N-Sampling across all metrics. See Table 4 for original verbatim setting results.

Model	Type	Method	Budget ( $N$ )	Lexical Jaccard (Best / Avg)	Lexical LCS (Best / Avg)	Lexical Coverage (Best / Avg)	Embedding Cosine (Best / Avg)
Olympia Math
Tulu2-7B	Para.	ADRA+	32	23.8 / 21.0	67 / 60	16.0 / 11.4	91.7 / 89.3
		ADRA	32	24.1 / 21.4	68 / 61	12.7 / 8.5	92.1 / 89.6
		N-Sampling	32	22.8 / 15.5	60 / 34	11.9 / 5.1	92.4 / 87.3
AIME
Tulu2-7B		Para.	ADRA+	32	22.7 / 18.8	54 / 40	17.5 / 12.7	92.2 / 88.8

Appendix

Table 18: Post-training member data reconstruction for paraphrased setting. ADRA+ and ADRA consistently outperform the N-Sampling across both lexical and semantic metrics. See Table 6 for original verbatim setting results.

Panel of Figure 4 — Figure 4: Qualitative example from Olmo3 Mix Arxiv: Reconstruction of a GP-based audiometry paper. Highlighted phrases show semantic and lexical overlap in core technical concepts— Gaussian process (GP) , threshold curve , function of frequency , uncertainty estimates/bands , stopping criterion/criteria , smoothness , and prior knowledge/information —suggesting that the reconstruction recovers the paper’s key methodological vocabulary and conceptual structure.

Panel of Figure 5 — Figure 5: Qualitative Example 1 from AIME. The reconstruction captures core mathematical reasoning patterns and expressions from the ground truth, despite yielding wrong final answer.

Panel of Figure 6 — Figure 6: Qualitative Example 2 from AIME. The reconstruction captures key mathematical patterns and modular arithmetic reasoning despite different final answer.

Panel of Figure 7 — Figure 7: Qualitative example from S1.1 Deepseek-R1 Distillation. Near-verbatim reconstruction of a matrix powers problem. Highlighted parts show overlap in algebraic identities, the cyclic structure insight ( $\mathbf{M}^{3}=\mathbf{I}$ ), cycle decomposition logic, and entry-sum computation steps. Despite closely reproducing the full solution template, the reconstruction arrives at an incorrect final answer ( $2010$ vs. $4018$ ).

Panel of Figure 8 — Figure 8: Prompts used for LLM-as-Judge reward model evaluation.

Membership Inference Attacks

Membership inference attacks test whether records or entities were used to train a machine-learning model, revealing potential privacy leakage.

See all 111 papers

Detecting Data Contamination in Large Language Models
Apr 21, 2026Juliusz Janicki, Savvas Chamezopoulos, Evangelos Kanoulas +1Membership Inference Attacks LLM Auditing
University of Amsterdam · Elsevier
Combating Data Laundering in LLM Training
Apr 2, 2026Muxing Li, Zesheng Ye, Sharon Li +1LLM Auditing Data Contamination in Language Models
University of Melbourne · University of Wisconsin-Madison
OLMo-Detect: A Multi-Stage, Confounder-Controlled Benchmark for Membership Inference on Large Language Models
Oct 2, 2026Tao Shi, Chaoyi Xiang, Qiongkai Xu +1Membership Inference Attacks Privacy Leakage in Language Models
The University of Melbourne · Macquarie University

Apr 21, 2026J/K move · Enter open · S save

Detecting Data Contamination in Large Language Models

Juliusz Janicki, Savvas Chamezopoulos, Evangelos Kanoulas, Georgios Tsatsaronis

University of Amsterdam · Elsevier

Membership Inference Attacks LLM Auditing Privacy Leakage in Language Models

Open paper AskPDF arXiv

Large Language Models (LLMs) utilize large amounts of data for their training, some of which may come from copyrighted sources. Membership Inference Attacks (MIA) aim to detect those documents and whether they have been included in the training corpora of the LLMs. The black-box MIAs require a significant amount of data manipulation; therefore, their comparison is often challenging. We study state-of-the-art (SOTA) MIAs under the black-box assumptions and compare them to each other using a unified set of datasets to determine if any of them can reliably detect membership under SOTA LLMs. In addition, a new method, called the Familiarity Ranking, was developed to showcase a possible approach to black-box MIAs, thereby giving LLMs more freedom in their expression to understand their reasoning better. The results indicate that none of the methods are capable of reliably detecting membership in LLMs, as shown by an AUC-ROC of approximately 0.5 for all methods across several LLMs. The higher TPR and FPR for more advanced LLMs indicate higher reasoning and generalizing capabilities, showcasing the difficulty of detecting membership in LLMs using black-box MIAs.

Abstract

Membership Inference Attacks

Explore similar work

Detecting Data Contamination in Large Language Models

Combating Data Laundering in LLM Training

OLMo-Detect: A Multi-Stage, Confounder-Controlled Benchmark for Membership Inference on Large Language Models