Detecting Non-Membership in LLM Training Data via Rank Correlations
arXiv:2603.22707v1 Announce Type: new Abstract: As large language models (LLMs) are trained on increasingly vast and opaque text corpora, determining which data contributed to training has become essential for copyright enforcement, compliance auditing, and user trust. While prior work focuses on detecting whether a dataset was used in training (membership inference), the complementary problem -- verifying that a dataset was not used -- has received little attention. We address this gap by introducing PRISM, a test that detects dataset-level non-membership using only grey-box access to model logits. Our key insight is that two models that have not seen a dataset exhibit higher rank correlation in their normalized token log probabilities than when one model has been trained on that data. Using this observation, we construct a correlation-based test that detects non-membership. Empirically, PRISM reliably rules out membership in training data across all datasets tested while avoiding fa
arXiv:2603.22707v1 Announce Type: new Abstract: As large language models (LLMs) are trained on increasingly vast and opaque text corpora, determining which data contributed to training has become essential for copyright enforcement, compliance auditing, and user trust. While prior work focuses on detecting whether a dataset was used in training (membership inference), the complementary problem -- verifying that a dataset was not used -- has received little attention. We address this gap by introducing PRISM, a test that detects dataset-level non-membership using only grey-box access to model logits. Our key insight is that two models that have not seen a dataset exhibit higher rank correlation in their normalized token log probabilities than when one model has been trained on that data. Using this observation, we construct a correlation-based test that detects non-membership. Empirically, PRISM reliably rules out membership in training data across all datasets tested while avoiding false positives, thus offering a framework for verifying that specific datasets were excluded from LLM training.
Executive Summary
The article introduces PRISM, a novel method for detecting non-membership of specific datasets in LLM training data using rank correlations between normalized token log probabilities. Unlike prior work focused on membership inference, PRISM addresses the complementary problem of verifying exclusion, offering a grey-box test that reliably identifies when a dataset was not used in training without false positives. The insight hinges on the empirical observation that models trained without a dataset exhibit stronger rank correlation than those trained with it, enabling a correlation-based detection mechanism. This innovation fills a critical gap in compliance auditing and copyright enforcement by providing a reliable verification tool for dataset exclusion.
Key Points
- ▸ PRISM detects non-membership via rank correlations in log probabilities
- ▸ It offers a grey-box solution without requiring full model access
- ▸ Empirical results show reliable exclusion detection with no false positives
Merits
Novelty
PRISM addresses an overlooked problem—non-membership verification—with a novel statistical correlation-based approach.
Practical Utility
The method is applicable to compliance audits, copyright enforcement, and user trust verification without requiring proprietary model access.
Demerits
Scope Limitation
PRISM’s effectiveness is contingent on access to grey-box logit outputs; it may not apply to models with opaque or inaccessible logit interfaces.
Generalization Concern
Empirical validation is based on tested datasets; broader applicability across diverse LLM architectures remains unproven.
Expert Commentary
The PRISM methodology represents a significant advancement in the field of AI auditing by shifting focus from mere detection of inclusion to the equally important validation of exclusion. The use of rank correlations as a proxy for training exposure is both elegant and empirically substantiated. Importantly, the authors avoid overreaching by acknowledging the dependency on grey-box access, which introduces a realistic constraint that aligns with practical deployment. This work bridges a conceptual gap between membership inference and exclusion verification, potentially influencing future architectures of AI accountability frameworks. While the current validation is robust, longitudinal studies on evolving LLM architectures—particularly those with adaptive or dynamic training pipelines—will be critical next steps to assess scalability and adaptability. Overall, PRISM offers a pragmatic, scalable, and legally actionable tool for reinforcing trust in AI training data integrity.
Recommendations
- ✓ Researchers should extend PRISM’s validation to open-source and proprietary LLM variants across diverse training pipelines.
- ✓ Legal counsel should consider integrating PRISM into contractual clauses requiring verification of dataset exclusion as a condition of compliance reporting.
Sources
Original: arXiv - cs.CL
