通过分析模型输出分布,判断训练数据是否被大模型修改过。
Refinement Provenance Inference: Detecting LLM-Refined Training Prompts from Model Behavior
- 基于教师强制下的词元概率分布差异,检测提示词是否经大模型优化。
- 在多种不同优化器和训练设置下均保持高准确率,迁移性能强。
- 无需访问原始数据,适合用于模型数据溯源与争议仲裁场景。
指令微调越来越多依赖于大模型驱动的提示词优化:训练语料中的提示词会被外部优化器选择性重写,以提升清晰度与指令对齐。这引出了一个实例级审计问题:对于一个微调后的模型和一对训练提示-响应,能否判断该模型是基于原始提示还是大模型优化后的版本进行训练?这一问题对数据集治理与训练数据争议解决至关重要。然而实际中存在挑战:优化版与原始版数据在训练集中交错混合,且混合比例因来源而异,导致难以构建跨模型、跨训练设置的通用溯源方法。本文首次将此任务形式化为「优化溯源推理」(RPI),并发现提示优化会在教师强制下的词元分布上产生稳定且可检测的偏移,即使语义差异不明显。基于此,我们提出 RePro 框架,融合教师强制似然特征与词元排序信号。训练时通过影子微调学习可迁移表示,推理时仅用轻量线性头判断来源,无需访问训练数据。实验表明,RePro 在多个优化器和设置下均表现优异,且具有强泛化能力,说明其捕捉的是优化器无关的分布偏移,而非特定改写模式。
原文摘要 · Abstract (English)
Instruction tuning increasingly relies on LLM-based prompt refinement, where prompts in the training corpus are selectively rewritten by an external refiner to improve clarity and instruction alignment. This motivates an instance-level audit problem: for a fine-tuned model and a training prompt-response pair, can we infer whether the model was trained on the original prompt or its LLM-refined version within a mixed corpus? This matters for dataset governance and dispute resolution when training data are contested. However, it is non-trivial in practice: refined and raw instances are interleaved in the training corpus with unknown, source-dependent mixture ratios, making it harder to develop provenance methods that generalize across models and training setups. In this paper, we formalize this audit task as Refinement Provenance Inference (RPI) and show that prompt refinement yields stable, detectable shifts in teacher-forced token distributions, even when semantic differences are not obvious. Building on this phenomenon, we propose RePro, a logit-based provenance framework that fuses teacher-forced likelihood features with logit-ranking signals. During training, RePro learns a transferable representation via shadow fine-tuning, and uses a lightweight linear head to infer provenance on unseen victims without training-data access. Empirically, RePro consistently attains strong performance and transfers well across refiners, suggesting that it exploits refiner-agnostic distribution shifts rather than rewrite-style artifacts.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。