{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/did-the-neurons-read-your-book-document-level","title":"Did the Neurons Read your Book? Document-level Membership Inference for Large Language Models","arxiv_id":"2310.15007","date":"2023-10-23","proceeding":null,"authors":["Matthieu Meeus","Shubham Jain","Marek Rei","Yves-Alexandre de Montjoye"],"abstract":"With large language models (LLMs) poised to become embedded in our daily lives, questions are starting to be raised about the data they learned from. These questions range from potential bias or misinformation LLMs could retain from their training data to questions of copyright and fair use of human-generated text. However, while these questions emerge, developers of the recent state-of-the-art LLMs become increasingly reluctant to disclose details on their training corpus. We here introduce the task of document-level membership inference for real-world LLMs, i.e. inferring whether the LLM has seen a given document during training or not. First, we propose a procedure for the development and evaluation of document-level membership inference for LLMs by leveraging commonly used data sources for training and the model release date. We then propose a practical, black-box method to predict document-level membership and instantiate it on OpenLLaMA-7B with both books and academic papers. We show our methodology to perform very well, reaching an AUC of 0.856 for books and 0.678 for papers. We then show our approach to outperform the sentence-level membership inference attacks used in the privacy literature for the document-level membership task. We further evaluate whether smaller models might be less sensitive to document-level inference and show OpenLLaMA-3B to be approximately as sensitive as OpenLLaMA-7B to our approach. Finally, we consider two mitigation strategies and find the AUC to slowly decrease when only partial documents are considered but to remain fairly high when the model precision is reduced. Taken together, our results show that accurate document-level membership can be inferred for LLMs, increasing the transparency of technology poised to change our lives.","url_abs":"https://arxiv.org/abs/2310.15007v2","url_pdf":"https://arxiv.org/pdf/2310.15007v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"did-the-neurons-read-your-book-document-level","repo_url":"https://github.com/computationalprivacy/document-level-membership-inference","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"did-the-neurons-read-your-book-document-level","repo_url":"https://github.com/ceichler/MIA-bias-removal","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"misinformation","task_name":"Misinformation"},{"task_slug":"sentence","task_name":"Sentence"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2310.15007","atlas_url":"https://app.syntology.ai/?focus=2310.15007","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2310.15007"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/computationalprivacy/document-level-membership-inference","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ceichler/MIA-bias-removal","reach":{"status":"ok"}}],"summary":{"ran":13,"unverified":3},"by_repo_kind":{"official":{"samples":16,"ran":13,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"650014829c70a9f8","entry":"compute_baselines","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/compute_baselines.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/compute_baselines.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"650014829c70a9f8"}},{"code_sha256_prefix":"19d90f1525de7b3c","entry":"extract_features","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/feature_extraction.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/feature_extraction.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"19d90f1525de7b3c"}},{"code_sha256_prefix":"534d1ab80c6edb56","entry":"filter_on_date","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/split_chunks.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/split_chunks.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"534d1ab80c6edb56"}},{"code_sha256_prefix":"7022375f485ac9be","entry":"get_diff_max_token","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/normalization.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/normalization.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7022375f485ac9be"}},{"code_sha256_prefix":"8fc952dbcf49f67d","entry":"get_norm_val","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/normalization.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/normalization.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8fc952dbcf49f67d"}},{"code_sha256_prefix":"6dee4ea2c9310a31","entry":"get_token_count","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/compute_token_freq.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/compute_token_freq.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6dee4ea2c9310a31"}},{"code_sha256_prefix":"2bf9d952a5b20ff3","entry":"get_token_freq","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/compute_token_freq.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/compute_token_freq.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2bf9d952a5b20ff3"}},{"code_sha256_prefix":"4907842083ba956e","entry":"normalize_token_loss","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/normalization.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/normalization.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4907842083ba956e"}},{"code_sha256_prefix":"10d15d0c9b1eb682","entry":"remove_small_docs","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/split_chunks.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/split_chunks.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"10d15d0c9b1eb682"}},{"code_sha256_prefix":"f103f8afd8bf8f81","entry":"scale_features","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/meta_classifier.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/meta_classifier.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f103f8afd8bf8f81"}},{"code_sha256_prefix":"e9631d636a73e644","entry":"simple_agg_feat_extraction","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/feature_extraction.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/feature_extraction.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e9631d636a73e644"}},{"code_sha256_prefix":"d173585d2fb91fd1","entry":"split_data","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/meta_classifier.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/meta_classifier.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d173585d2fb91fd1"}},{"code_sha256_prefix":"f7625eef253c7afe","entry":"validate_clf","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/meta_classifier.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/meta_classifier.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f7625eef253c7afe"}},{"code_sha256_prefix":"1183adedf54bed5a","entry":"calculatePerplexity","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/compute_baselines.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/compute_baselines.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1183adedf54bed5a"}},{"code_sha256_prefix":"a2c54d95202e2509","entry":"compute_perplexity","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/compute_perplexity.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/compute_perplexity.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a2c54d95202e2509"}},{"code_sha256_prefix":"9b828cec3990ecfe","entry":"histogram_feats","repo":"computationalprivacy/document-level-membership-inference","repo_kind":"official","path":"src/feature_extraction.py","file_url":"https://github.com/computationalprivacy/document-level-membership-inference/blob/HEAD/src/feature_extraction.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9b828cec3990ecfe"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}