Data Provenance Auditing of Fine-Tuned Large Language Models with a Text-Preserving Technique

We propose a system for marking sensitive or copyrighted texts to detect their use in fine-tuning large language models under black-box access with statistical guarantees. Our method builds digital “marks” using invisible Unicode characters organized into (“cue”, “reply”) pairs. During an audit, prompts containing only “cue” fragments are issued to trigger regurgitation of the corresponding “reply”, indicating document usage. To control false positives, we compare against held-out counterfactual marks and apply a ranking test, yielding a verifiable bound on the false positive rate. Empirically, we obtain a true positive rate of 96.7\% at 0\% false positive rate and reply regurgitation rates exceeding 28\% per document with only 40 (4\%) watermarked documents. The approach is minimally invasive, scalable across many sources, robust to standard processing pipelines, and achieves high detection power even when marked data is a small fraction of the fine-tuning corpus.

Did an AI model train on your texts without permission? Our work proposes a way to answer this question by embedding invisible marks into texts before they are released. These marks fully preserve the text, but can later be recovered from a language model trained on the marked data using minimal API access. This makes it possible to provide statistically grounded evidence that a model has used specific texts during training, helping creators and organizations audit unauthorized data usage.