cs.LGSep 18, 2026

Detecting Pretraining Data in Large Language Models from a Free-Energy Perspective

Authors: Chenye Ke, Zirui Liu, Qi Liu, Yan Zhuang, Jintao Zhang, Zhenya Huang, Shijin Wang

Organizations: State Key Laboratory of Cognitive Intelligence, University of Science and Technology of China · Institute of Artificial Intelligence, Hefei Comprehensive National Science Center · College of Artificial Intelligence, Nanjing University of Aeronautics and Astronautics · iFLYTEK AI Research (Central China), iFLYTEK Co., Ltd

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Detecting pretraining data in large language models is challenging because high likelihood can reflect either training exposure or strong generalization. In the joint space of prediction loss and predictive entropy, a likelihood-only detector uses a horizontal boundary and can mistake predictable non-members for members. Motivated by this, we introduce an inclined boundary that evaluates prediction loss relative to predictive entropy. Our analysis shows that entropy correction can preserve the expected membership signal while reducing its variance, thereby improving standardized member--non-member separation. We further extend the mean--variance analysis to the more general setting with a nonzero mean entropy gap. Interestingly, this entropy-adjusted score admits a Helmholtz free-energy interpretation, leading to Energy Transfer Detection (ETD), which views pretraining data detection from a macroscopic residual free-energy transfer perspective. Extensive experiments show that ETD achieves the best average detection performance, improving average AUROC by up to 3.5% and TPR@5%FPR by up to 5.1%, while remaining robust across diverse settings.

Figures & tables

Figure 1: Motivation from the joint distribution of prediction loss and predictive entropy. Left: member texts (i.e., pretraining texts) and non-member texts (i.e., non-pretraining texts) may have overlapping token-level loss profiles. Right: during pretraining, a horizontal likelihood-only boundary may classify some predictable non-members as members, whereas an inclined boundary incorporating predictive entropy provides clearer separation.
Figure 2: Illustration of the statistical mechanism underlying entropy-adjusted scoring.
Figure 3: Schematic construction of ETD from a free-energy perspective. The prefix determines a predictive distribution; the observed token supplies an energy-like prediction loss ℓj\ell_{j} , while the full distribution supplies predictive entropy hjh_{j} . Their combination, ℓj−λhj\ell_{j}-\lambda h_{j} , defines a residual free-energy contribution for the observed token.
  GPT-Neo-2.7BMamba-2.8BOPT-6.7BPythia-12BGPT-NeoX-20BAverage
DatasetMethodOri.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.
WikiMIAPPL62.661.764.563.961.059.965.865.068.568.064.563.7
Ref59.760.162.362.565.967.065.566.565.665.863.864.4
Lowercase60.160.461.963.259.559.562.963.765.166.161.962.6
Zlib64.458.466.160.662.857.467.361.669.863.966.160.4
Min-K%65.765.967.467.863.763.169.368.871.971.267.667.4
Table 1: AUROC results on WikiMIA and StackMIAsub. Values are averaged over all length splits. Ori. and Para. denote original and paraphrased settings, respectively. Bold values indicate the best results, and underlined values indicate the second-best results in each column.
  GPT-Neo-2.7BMamba-2.8BOPT-6.7BPythia-12BGPT-NeoX-20BAverage
DatasetMethodOri.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.
WikiMIAPPL10.510.512.713.011.711.112.512.613.614.312.212.3
Ref6.56.37.08.18.010.78.89.612.313.88.59.7
Lowercase8.99.912.612.66.37.211.113.510.813.09.911.2
Zlib16.113.819.217.015.613.319.915.920.218.118.215.6
Min-K%14.914.416.614.814.314.019.918.019.119.017.016.0
Table 2: TPR@5%FPR results on WikiMIA and StackMIAsub. Values are averaged over all length splits. Ori. and Para. denote original and paraphrased settings, respectively. Bold values indicate the best results, and underlined values indicate the second-best results in each column.
ℓj(x;θ)\ell_{j}(x;\theta)hj(x;θ)h_{j}(x;\theta)FOS(x)\mathrm{FOS}(x)Ori.Para.
✓\checkmark  68.568.0
✓\checkmark✓\checkmark 72.371.6
✓\checkmark ✓\checkmark71.071.1
✓\checkmark✓\checkmark✓\checkmark74.373.7
Table 3: Component ablation of ETD. ℓj(x;θ)\ell_{j}(x;\theta) denotes token prediction energy, hj(x;θ)h_{j}(x;\theta) denotes local predictive entropy, and FOS(x)\mathrm{FOS}(x) denotes first-occurrence token aggregation.
Figure 7
Figure 5: Length-wise detection performance under the original setting. (a–b) AUROC and TPR@5%FPR on WikiMIA. (c–d) AUROC and TPR@5%FPR on StackMIAsub. ETD exhibits greater robustness on longer sequences across both benchmarks.
Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: Schematic illustration of the generalized mean–variance trade-off. For μH,t>0\mu_{H,t}>0 , entropy correction shifts the expected gap by λμH,t\lambda\mu_{H,t} while reducing its variance.
BenchmarkData sourceText length#ExamplesTotalApplicable models
WikiMIAWikipedia327761650Open-source LLMs (2017 ∼\sim 2023)
64542
128250
25682
StackMIAsubStack Exchange3232118267Open-source LLMs (2017 ∼\sim 2023)
643480
Appendix
Table 5: Summary statistics of the evaluation benchmarks used in our experiments. “Text length” denotes the number of words within each sample, and “#Examples” represents the number of samples in each split or subset.
Figure 7: Optimization dynamics during controlled continued pretraining.
Figure 8: Absolute scores at controlled exposure checkpoints k∈{0,1,2,4,8,16}k\in\{0,1,2,4,8,16\} . Adjacent bars report the means for DtrainD_{\mathrm{train}} (Member) and DnonD_{\mathrm{non}} (Non-member). (a) Mean likelihood-only score based on prediction loss. (b) Mean ETD score based on entropy-adjusted prediction loss. Error bars denote 95% bootstrap confidence intervals.
Figure 9: Membership-detection performance across exposure checkpoints k∈{0,1,2,4,8,16}k\in\{0,1,2,4,8,16\} . (a) AUROC of likelihood-only and ETD detectors. (b) Maximum empirical TPR at 5% FPR. Members are treated as the positive class. Error bars show pointwise 95% CIs from 10,000 stratified paired longitudinal bootstrap resamples.
Figure 10: Evolution of the per-sample likelihood-only score distributions at training steps 0, 20, 40, 60, 80, and 100. Member denotes DtrainD_{\mathrm{train}} and Non-member denotes DnonD_{\mathrm{non}} .
Figure 11: Evolution of the per-sample ETD score distributions at training steps 0, 20, 40, 60, 80, and 100. Member denotes DtrainD_{\mathrm{train}} and Non-member denotes DnonD_{\mathrm{non}} .
SettingLengthCov⁡(ΔLt,ΔHt)\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t})2Cov⁡(ΔLt,ΔHt)Var⁡(ΔHt)\dfrac{2\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t})}{\operatorname{Var}(\Delta H_{t})}Var⁡(ΔCt)Var⁡(ΔLt)\dfrac{\operatorname{Var}(\Delta\mathcal{C}_{t})}{\operatorname{Var}(\Delta\mathcal{L}_{t})}E[ΔLt]Var⁡(ΔLt)\dfrac{\mathbb{E}[\Delta\mathcal{L}_{t}]}{\sqrt{\operatorname{Var}(\Delta\mathcal{L}_{t})}}E[ΔCt]Var⁡(ΔCt)\dfrac{\mathbb{E}[\Delta\mathcal{C}_{t}]}{\sqrt{\operatorname{Var}(\Delta\mathcal{C}_{t})}}
Ori.320.5190 †1.7605 †0.4643 †0.44190.5409 †
640.3916 †1.8973 †0.4303 †0.38210.5048 †
1280.3124 †1.9362 †0.3871 †0.48710.5873 †
2560.1990 †1.7591 †0.3529 †0.51900.6340
Para.320.5074 †1.7445 †0.4721 †0.47370.5750 †
640.3910 †1.8936 †0.4373 †0.37260.4870 †
Appendix
Table 6: Empirical analysis of the variance-reduction mechanism using all token positions on GPT-NeoX-20B. All statistics are computed with the fixed coefficient λ=0.5\lambda=0.5 . Point estimates are reported to four decimal places. A superscript †\dagger on Cov⁡(ΔLt,ΔHt)\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t}) indicates that its 95% bootstrap confidence interval lies entirely above zero. A superscript †\dagger on the upper endpoint 2Cov⁡(ΔLt,ΔHt)/Var⁡(ΔHt)2\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t})/\operatorname{Var}(\Delta H_{t}) indicates that its 95% bootstrap confidence interval lies entirely above the fixed coefficient λ=0.5\lambda=0.5 . A superscript †\dagger on the variance ratio indicates that its 95% bootstrap confidence interval lies entirely below one. For the last column, †\dagger indicates that the 95% bootstrap confidence interval of the difference between the corrected and prediction-loss standardized gaps lies entirely above zero.
SettingLengthCov⁡(ΔLt,ΔHt)\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t})2Cov⁡(ΔLt,ΔHt)Var⁡(ΔHt)\dfrac{2\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t})}{\operatorname{Var}(\Delta H_{t})}Var⁡(ΔCt)Var⁡(ΔLt)\dfrac{\operatorname{Var}(\Delta\mathcal{C}_{t})}{\operatorname{Var}(\Delta\mathcal{L}_{t})}E[ΔLt]Var⁡(ΔLt)\dfrac{\mathbb{E}[\Delta\mathcal{L}_{t}]}{\sqrt{\operatorname{Var}(\Delta\mathcal{L}_{t})}}E[ΔCt]Var⁡(ΔCt)\dfrac{\mathbb{E}[\Delta\mathcal{C}_{t}]}{\sqrt{\operatorname{Var}(\Delta\mathcal{C}_{t})}}
Ori.320.5645 †1.8675 †0.5024 †0.47180.5641 †
640.4646 †2.0791 †0.4822 †0.45960.5717 †
1280.3968 †2.1530 †0.4701 †0.58840.6682 †
2560.3218 †2.0666 †0.4196 †0.60890.7258 †
Para.320.5393 †1.8406 †0.5133 †0.50360.5935 †
640.4466 †2.0169 †0.4892 †0.44580.5458 †
Appendix
Table 7: Empirical analysis of the variance-reduction mechanism after first-occurrence aggregation on GPT-NeoX-20B. All sequence-level statistics are computed over positions in FOS⁡(x)\operatorname{FOS}(x) with the fixed coefficient λ=0.5\lambda=0.5 . Point estimates are reported to four decimal places. A superscript †\dagger on Cov⁡(ΔLt,ΔHt)\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t}) indicates that its 95% bootstrap confidence interval lies entirely above zero. A superscript †\dagger on the upper endpoint 2Cov⁡(ΔLt,ΔHt)/Var⁡(ΔHt)2\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t})/\operatorname{Var}(\Delta H_{t}) indicates that its 95% bootstrap confidence interval lies entirely above the fixed coefficient λ=0.5\lambda=0.5 . A superscript †\dagger on the variance ratio indicates that its 95% bootstrap confidence interval lies entirely below one. For the last column, †\dagger indicates that the 95% bootstrap confidence interval of the difference between the corrected and prediction-loss standardized gaps lies entirely above zero.
SettingLengthμL,t\mu_{\mathcal{L},t}μH,t\mu_{H,t}λstd,t\lambda_{\mathrm{std},t}Cov⁡(ΔLt,ΔHt)\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t})Var⁡(ΔCt)Var⁡(ΔLt)\displaystyle\frac{\operatorname{Var}(\Delta\mathcal{C}_{t})}{\operatorname{Var}(\Delta\mathcal{L}_{t})}E[ΔLt]Var⁡(ΔLt)\displaystyle\frac{\mathbb{E}[\Delta\mathcal{L}_{t}]}{\sqrt{\operatorname{Var}(\Delta\mathcal{L}_{t})}}E[ΔCt]Var⁡(ΔCt)\displaystyle\frac{\mathbb{E}[\Delta\mathcal{C}_{t}]}{\sqrt{\operatorname{Var}(\Delta\mathcal{C}_{t})}}
Ori.320.3681 †0.1221 ‡1.1256 †0.5190 †0.4643 †0.44190.5409 †
640.2718 †0.07251.3622 †0.3916 †0.4303 †0.38210.5048 †
1280.2995 †0.1496 ‡1.0819 †0.3124 †0.3871 †0.48710.5873 †
2560.2435 †0.13360.97790.1990 †0.3529 †0.51900.6340
Para.320.3923 †0.1302 ‡1.1055 †0.5074 †0.4721 †0.47370.5750 †
640.2664 †0.07231.3440 †0.3910 †0.4373 †0.37260.4870 †
Appendix
Table 8: Empirical analysis of the generalized variance-reduction mechanism using all token positions on GPT-NeoX-20B. The corrected-gap statistics are computed with the fixed coefficient λ=0.5\lambda=0.5 . Point estimates are reported to four decimal places. A superscript †\dagger on μL,t\mu_{\mathcal{L},t} indicates that its 95% bootstrap confidence interval lies entirely above zero. A superscript ‡\ddagger on μH,t\mu_{H,t} indicates that zero is excluded from its 95% bootstrap confidence interval. A superscript †\dagger on λstd,t\lambda_{\mathrm{std},t} indicates that its 95% bootstrap confidence interval lies entirely above the fixed coefficient λ=0.5\lambda=0.5 . A superscript †\dagger on Cov⁡(ΔLt,ΔHt)\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t}) indicates that its 95% bootstrap confidence interval lies entirely above zero. A superscript †\dagger on the variance ratio indicates that its 95% bootstrap confidence interval lies entirely below one. For the last column, †\dagger indicates that the 95% bootstrap confidence interval of the difference between the corrected and prediction-loss standardized gaps lies entirely above zero.
SettingLengthμL,t\mu_{\mathcal{L},t}μH,t\mu_{H,t}λstd,t\lambda_{\mathrm{std},t}Cov⁡(ΔLt,ΔHt)\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t})Var⁡(ΔCt)Var⁡(ΔLt)\displaystyle\frac{\operatorname{Var}(\Delta\mathcal{C}_{t})}{\operatorname{Var}(\Delta\mathcal{L}_{t})}E[ΔLt]Var⁡(ΔLt)\displaystyle\frac{\mathbb{E}[\Delta\mathcal{L}_{t}]}{\sqrt{\operatorname{Var}(\Delta\mathcal{L}_{t})}}E[ΔCt]Var⁡(ΔCt)\displaystyle\frac{\mathbb{E}[\Delta\mathcal{C}_{t}]}{\sqrt{\operatorname{Var}(\Delta\mathcal{C}_{t})}}
Ori.320.4300 †0.1312 ‡1.1799 †0.5645 †0.5024 †0.47180.5641 †
640.3794 †0.1034 ‡1.4074 †0.4646 †0.4822 †0.45960.5717 †
1280.4462 †0.1976 ‡1.1116 †0.3968 †0.4701 †0.58840.6682 †
2560.3948 †0.17991.1625 †0.3218 †0.4196 †0.60890.7258 †
Para.320.4525 †0.1409 ‡1.1345 †0.5393 †0.5133 †0.50360.5935 †
640.3615 †0.1039 ‡1.3260 †0.4466 †0.4892 †0.44580.5458 †
Appendix
Table 9: Empirical analysis of the generalized variance-reduction mechanism after first-occurrence aggregation on GPT-NeoX-20B. All sequence-level statistics are computed over positions in FOS⁡(x)\operatorname{FOS}(x) with the fixed coefficient λ=0.5\lambda=0.5 . Point estimates are reported to four decimal places. A superscript †\dagger on μL,t\mu_{\mathcal{L},t} indicates that its 95% bootstrap confidence interval lies entirely above zero. A superscript ‡\ddagger on μH,t\mu_{H,t} indicates that zero is excluded from its 95% bootstrap confidence interval. A superscript †\dagger on λstd,t\lambda_{\mathrm{std},t} indicates that its 95% bootstrap confidence interval lies entirely above the fixed coefficient λ=0.5\lambda=0.5 . A superscript †\dagger on Cov⁡(ΔLt,ΔHt)\operatorname{Cov}(\Delta\mathcal{L}_{t},\Delta H_{t}) indicates that its 95% bootstrap confidence interval lies entirely above zero. A superscript †\dagger on the variance ratio indicates that its 95% bootstrap confidence interval lies entirely below one. For the last column, †\dagger indicates that the 95% bootstrap confidence interval of the difference between the corrected and prediction-loss standardized gaps lies entirely above zero.
 WikipediaGithubPile CCPubMed Central
Method160M1.4B2.8B6.9B12B160M1.4B2.8B6.9B12B160M1.4B2.8B6.9B12B160M1.4B2.8B6.9B12B
PPL51.253.253.955.456.274.979.580.982.083.150.050.851.051.952.450.752.052.653.353.7
Ref51.253.754.556.657.635.142.043.044.044.750.552.452.553.454.049.852.453.053.754.1
Lowercase50.853.854.356.157.179.181.582.483.584.151.051.352.053.054.552.353.954.755.155.5
Zlib50.152.853.855.456.279.182.483.484.485.451.051.952.152.953.351.352.453.053.553.9
Min-K%50.153.454.656.357.573.679.380.681.883.050.751.451.452.452.751.152.453.153.754.6
Appendix
Table 10: AUROC results on the MIMIR benchmark. Results are reported on seven subsets and the average across subsets. Bold values indicate the best results, and underlined values indicate the second-best results in each column.
 WikipediaGithubPile CCPubMed Central
Method160M1.4B2.8B6.9B12B160M1.4B2.8B6.9B12B160M1.4B2.8B6.9B12B160M1.4B2.8B6.9B12B
PPL7.69.511.012.212.929.743.447.750.152.83.47.36.88.08.44.55.04.95.66.1
Ref6.28.810.010.911.25.98.49.210.111.36.29.08.411.110.94.45.86.37.87.6
Lowercase7.010.010.010.310.649.756.057.258.760.05.08.08.69.010.64.86.87.07.58.9
Zlib6.38.38.69.810.349.956.059.761.162.05.67.07.88.88.93.94.75.15.25.4
Min-K%7.49.710.012.112.228.243.046.850.953.14.25.66.16.68.04.65.55.05.86.0
Appendix
Table 11: TPR@5%FPR results on the MIMIR benchmark. Results are reported on seven subsets and the average across subsets. Bold values indicate the best results, and underlined values indicate the second-best results in each column.
  GPT-Neo-2.7BMamba-2.8BOPT-6.7BPythia-12BGPT-NeoX-20BAverage
Len.MethodOri.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.
32PPL61.362.363.765.260.461.665.666.667.568.663.764.9
Ref59.758.762.161.966.666.766.266.265.564.664.063.6
Lowercase59.959.864.164.060.359.865.565.567.067.563.463.3
Zlib62.061.864.464.461.161.365.965.867.867.464.264.1
Min-K%63.264.565.466.961.563.167.768.869.370.465.466.7
Appendix
Table 12: Length-wise AUROC results on WikiMIA. Ori. and Para. denote the original and paraphrased settings, respectively. Bold values indicate the best results, and underlined values indicate the second-best results in each column.
  GPT-Neo-2.7BMamba-2.8BOPT-6.7BPythia-12BGPT-NeoX-20BAverage
Len.MethodOri.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.
32PPL16.014.514.715.211.913.715.215.214.019.114.415.5
Ref7.07.010.610.88.85.77.07.212.19.69.18.1
Lowercase9.610.618.115.07.06.515.215.211.18.812.211.2
Zlib13.414.017.314.512.415.516.316.817.115.215.315.2
Min-K%19.618.916.017.316.316.521.224.024.624.319.520.2
Appendix
Table 13: Length-wise TPR@5%FPR results on WikiMIA. Ori. and Para. denote the original and paraphrased settings, respectively. Bold values indicate the best results, and underlined values indicate the second-best results in each column.
  GPT-Neo-2.7BMamba-2.8BOPT-6.7BPythia-12BGPT-NeoX-20BAverage
Len.MethodOri.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.
32PPL60.656.362.257.862.958.662.958.562.558.062.257.8
Ref53.953.351.552.448.949.254.254.855.054.252.752.8
Lowercase56.652.556.351.955.952.457.152.556.651.856.552.2
Zlib55.952.257.053.356.953.357.553.657.153.356.953.1
Min-K%61.457.362.158.162.758.562.958.662.457.962.358.1
Appendix
Table 14: Length-wise AUROC results on StackMIAsub. Ori. and Para. denote the original and paraphrased settings, respectively. Bold values indicate the best results, and underlined values indicate the second-best results in each column.
  GPT-Neo-2.7BMamba-2.8BOPT-6.7BPythia-12BGPT-NeoX-20BAverage
Len.MethodOri.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.Ori.Para.
32PPL9.88.211.69.911.310.312.710.112.79.511.69.6
Ref7.76.65.66.15.05.86.09.07.78.66.47.2
Lowercase7.05.87.55.46.55.96.55.96.45.26.85.6
Zlib7.36.48.56.87.87.78.56.88.96.68.26.9
Min-K%11.19.311.510.712.611.412.711.312.09.312.010.4
Appendix
Table 15: Length-wise TPR@5%FPR results on StackMIAsub. Ori. and Para. denote the original and paraphrased settings, respectively. Bold values indicate the best results, and underlined values indicate the second-best results in each column.
Figure 12: Sample-level evolution in the predictive-entropy–prediction-loss plane under controlled continued pretraining, from exposure count 0 to 16. Each point represents an evaluation example, with Member denoting DtrainD_{\mathrm{train}} and Non-member denoting DnonD_{\mathrm{non}} . At exposure count 0, neither subset has been used for parameter updates in the controlled training run.
More in this topic

Membership Inference Attacks

Membership inference attacks test whether records or entities were used to train a machine-learning model, revealing potential privacy leakage.

See all 116 papers

Explore similar work

CardsList

  1. From Unfamiliar to Familiar: Detecting Pre-training Data via Gradient Deviations in Large Language Models

    Mar 5, 2026Ruiqi Zhang, Lingxiang Wang, Hainan Zhang +2Membership Inference AttacksLLM Auditing

    Beijing Advanced Innovation Center for Future Blockchain and Privacy Computing, Beihang University · School of Artificial Intelligence, Beihang University

  2. Learning to Detect Language Model Training Data via Active Reconstruction

    Feb 22, 2026Junjie Oscar Yin, John X. Morris, Vitaly Shmatikov +2Membership Inference AttacksPrivacy Leakage in Language Models

    University of Washington · Cornell University · UC Berkeley +1

  3. MC-PDD: Masked Corpus-Level Pretraining Data Detection for Black-Box Large Language Models

    Jun 6, 2026Kaixin Lan, Mu You, Tao Fang +3Membership Inference AttacksLLM Auditing

    Natural Language Processing & Portuguese-Chinese Machine Translation (NLP2CT) Laboratory, University of Macau, Macau SAR, China · Institute of International Language Services Studies, Macau Millennium College, Macau SAR, China · Innovation Research & Development, BoardWare Information System Limited