BPE tokenizers can leak whether a dataset was in training
Original title: Tokenizer Tokens Tell Training Tales
RTAM-Fusion uses rare-token mass and fewer shadow tokenizers to beat Vocabulary Overlap on a membership benchmark.
The paper asks whether a BPE tokenizer's vocabulary reveals if a candidate dataset was in its training corpus. Under a threshold model, rare strings become tokens only after enough corpus frequency, so the likelihood-ratio test weights tokens that are rare in the background but frequent in the candidate. RTAM-Fusion calibrates rare-token mass with shadow tokenizers. On the tokenizer membership benchmark it improves AUC and balanced accuracy over Vocabulary Overlap while using fewer shadow tokenizers, and the authors say existing defenses still leak against adaptive attackers at production vocabulary sizes.
Unconfirmed: Defense leakage is reported by the authors against adaptive attackers, not independently confirmed.
- Merge rank and merge-graph position add no first-order signal once token existence and frequency are known.
- Signals are combined across rarity levels after calibration with shadow tokenizers.
- Code is linked at an anonymous repository.
From the original article
1 min read at arxiv.orgTokenizers are usually treated as fixed preprocessing tools, but they are trained on text and can retain traces of that text in their vocabularies. We ask whether a BPE tokenizer can reveal if a candidate dataset was part of its training corpus. The key observation is simple.
By Nishita Jain · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.