The problem of pre-training data detection for large language models (LLMs)
has received growing attention due to its implications in critical issues like
copyright violation and test data contamination. The current state-of-the-art
approach, Min-K%, measures the raw token probability which we argue may not be
the most informative signal. Instead, we propose Min-K%++ to normalize the
token probability with statistics of the categorical distribution over the
whole vocabulary, which accurately reflects the relative likelihood of the
target token compared with other candidate tokens in the vocabulary.
Theoretically, we back up our method by showing that the statistic it estimates
is explicitly optimized during LLM training, thus serving as a reliable
indicator for detecting training data. Empirically, on the WikiMIA benchmark,
Min-K%++ outperforms the SOTA Min-K% by 6.2% to 10.5% in detection AUROC
averaged over five models. On the more challenging MIMIR benchmark, Min-K%++
consistently improves upon Min-K% and performs on par with reference-based
method, despite not requiring an extra reference model.

通过使用整个词汇表的分类分布统计规范化目标词汇的概率，Min-K%++ 相对于 Min-K% 在检测预训练数据方面表现出更高的性能，且无需额外的参考模型。

Min-K%++：改进的基准模型用于检测大型语言模型的预训练数据

Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large  Language Models

With adversarial or otherwise normal prompts, existing large language models
(LLM) can be pushed to generate toxic discourses. One way to reduce the risk of
LLMs generating undesired discourses is to alter the training of the LLM. This
can be very restrictive due to demanding computation requirements. Other
methods rely on rule-based or prompt-based token elimination, which are limited
as they dismiss future tokens and the overall meaning of the complete
discourse. Here, we center detoxification on the probability that the finished
discourse is ultimately considered toxic. That is, at each point, we advise
against token selections proportional to how likely a finished text from this
point will be toxic. To this end, we formally extend the dead-end theory from
the recent reinforcement learning (RL) literature to also cover uncertain
outcomes. Our approach, called rectification, utilizes a separate but
significantly smaller model for detoxification, which can be applied to diverse
LLMs as long as they share the same vocabulary. Importantly, our method does
not require access to the internal representations of the LLM, but only the
token probability distribution at each decoding step. This is crucial as many
LLMs today are hosted in servers and only accessible through APIs. When applied
to various LLMs, including GPT-3, our approach significantly improves the
generated discourse compared to the base LLMs and other techniques in terms of
both the overall language and detoxification performance.

本文介绍了一种名为 “修正” 的方法，它利用了最新的强化学习文献中的死路理论，依据文本生成过程中各个阶段生成的文本可能被认为是有毒的概率来处理文本毒性问题，从而提高生成文本的质量和去毒能力。