Calibrating Post-Training Feature Shifts for LLM Data Contamination Detection

# Calibrating Post-Training Feature Shifts for LLM Data Contamination Detection
Source: [https://arxiv.org/html/2608.10462](https://arxiv.org/html/2608.10462)
Zhen Yang1,∗, Mengqi Wang1,∗, Gengda Zhao1, Mo Zhou1, Jianwei Wang1, Wenjie Zhang1 1The University of New South Wales

###### Abstract

Large language models \(LLMs\) are trained on massive and largely undisclosed corpora that may contain copyrighted or privacy\-sensitive content\. Data contamination detection \(DCD\) therefore aims to determine whether a given text is a member of the pre\-training corpus of a target LLM\. Recent state\-of\-the\-art DCD methods follow a feature\-based paradigm that derives membership features from the input text and the corresponding model output\. However, most modern LLMs undergo post\-training, such as instruction tuning, preference optimization, and reasoning\-oriented training, which can alter model outputs and shift the corresponding membership features, thereby reducing the separability between members and non\-members\. To address this problem, we proposeCalibDCD, a broadly applicable calibration framework for feature\-based DCD methods, comprising \(1\) Multi\-View Shift Detection, which identifies recurring feature shifts associated with post\-training, and \(2\) Bounded Feature Correction, which selectively mitigates their influence on membership prediction\. Specifically, Multi\-View Shift Detection evaluates controlled prompt variants on known non\-member texts and consolidates the most informative views to identify recurring feature shifts\. Bounded Feature Correction selectively adjusts feature components aligned with the detected shifts and controls the correction extent to preserve useful detection information\. Experiments show thatCalibDCDconsistently improves existing feature\-based detectors, with gains of up to 7\.0% in AUC and 15\.0% in TPR@5%FPR\.

Calibrating Post\-Training Feature Shifts for LLM Data Contamination Detection

Zhen Yang1,∗, Mengqi Wang1,∗, Gengda Zhao1, Mo Zhou1, Jianwei Wang1, Wenjie Zhang11The University of New South Wales

††footnotetext:∗The first two authors contributed equally\.Corresponding author: jianwei\.wang1@unsw\.edu\.au## 1Introduction

The pre\-training corpora of large language models \(LLMs\) may contain copyrighted works, privacy\-sensitive documents, benchmark examples, and other proprietary or sensitive materials\(Brownet al\.,[2020](https://arxiv.org/html/2608.10462#bib.bib1); Carliniet al\.,[2021](https://arxiv.org/html/2608.10462#bib.bib2),[2023](https://arxiv.org/html/2608.10462#bib.bib4); Karamolegkouet al\.,[2023](https://arxiv.org/html/2608.10462#bib.bib10); Wanget al\.,[2026](https://arxiv.org/html/2608.10462#bib.bib31)\)\. Moreover, LLMs can memorize and reproduce portions of their pre\-training data\(Carliniet al\.,[2021](https://arxiv.org/html/2608.10462#bib.bib2),[2023](https://arxiv.org/html/2608.10462#bib.bib4); Jianget al\.,[2026](https://arxiv.org/html/2608.10462#bib.bib32)\), raising concerns about copyright, privacy, and evaluation integrity\. Data contamination detection \(DCD\) therefore aims to determine whether a given text was included in the pre\-training corpus of a target LLM\(Shiet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib7); Zhanget al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib11); Huet al\.,[2025](https://arxiv.org/html/2608.10462#bib.bib14)\)\. Following previous works, we refer to a text as a*member*if it was included in this corpus and as a*non\-member*otherwise\(Shokriet al\.,[2017](https://arxiv.org/html/2608.10462#bib.bib8); Carliniet al\.,[2022](https://arxiv.org/html/2608.10462#bib.bib3); Shiet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib7)\)\.

Existing DCD methods commonly operate in a black\-box setting, in which the detector can query the target LLM and observe its generated outputs but has no access to model parameters or internal signals\(Yeet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib36); Donget al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib37); Denget al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib39); Golchin and Surdeanu,[2025](https://arxiv.org/html/2608.10462#bib.bib38)\)\. Early task\-based methods formulate an input text as a task, such as cloze completion or multiple\-choice selection, and infer membership from the response generated by the target model\(Changet al\.,[2023](https://arxiv.org/html/2608.10462#bib.bib12); Duarteet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib13)\)\. Consequently, their effectiveness may vary with the task formulation and the ability of the target model to perform the constructed task\. Recent state\-of\-the\-art \(SOTA\) feature\-based methods, such as DPDLLM\(Zhouet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib15)\)and VeilProbe\(Huet al\.,[2025](https://arxiv.org/html/2608.10462#bib.bib14)\), derive*membership features*from the input text and the corresponding output generated by the target LLM, and train a classifier to distinguish members from non\-members\.

However, the reliance of feature\-based detectors makes them sensitive to behavioral changes introduced by post\-training\. Modern LLMs commonly undergo post\-training procedures, such as instruction tuning, preference optimization, and reasoning\-oriented training, which can change the style, length, structure, and content of the generated output, consequently shifting the resulting membership features and reducing the separability between members and non\-members\(Weiet al\.,[2022](https://arxiv.org/html/2608.10462#bib.bib18); Ouyanget al\.,[2022](https://arxiv.org/html/2608.10462#bib.bib19); Baiet al\.,[2022](https://arxiv.org/html/2608.10462#bib.bib20); Rafailovet al\.,[2023](https://arxiv.org/html/2608.10462#bib.bib21); DeepSeek\-AI,[2025](https://arxiv.org/html/2608.10462#bib.bib22)\)\.

![Refer to caption](https://arxiv.org/html/2608.10462v1/x1.png)Figure 1:Motivation ofCalibDCD\. \(a\) Black\-box DCD\. \(b\) Post\-training\-induced shifts and their impact on detection\. The table compares VeilProbe onBookTectionusing the base and post\-trained target models\(Duarteet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib13); Huet al\.,[2025](https://arxiv.org/html/2608.10462#bib.bib14)\)\.###### Example 1

Figure[1](https://arxiv.org/html/2608.10462#S1.F1)illustrates how such shifts affect detection: assistant\-style responses resulting from post\-training increase the membership scores of non\-members, causing some to cross the decision threshold and reducing the separation between members and non\-members\. This effect is also evident in the VeilProbe results onBookTection: under otherwise identical settings, changing the target model from Qwen2\.5\-7B to its post\-trained counterpart, Qwen2\.5\-7B\-Instruct, decreases the DCD performance, with AUC dropping from 0\.936 to 0\.888 and TPR@5%FPR from 0\.682 to 0\.536\. Appendix[F](https://arxiv.org/html/2608.10462#A6)provides the complete comparison setup\.

Two challenges remain in calibrating feature\-based DCD against post\-training\-induced shifts: \(1\)complex feature shifts under heterogeneous post\-training, as instruction tuning, preference optimization, and reasoning\-oriented training can produce more instruction\-following, preference\-aligned, or step\-by\-step responses, altering output length, structure, lexical overlap, and continuation patterns in different directions and magnitudes\(Kirket al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib33); Zhouet al\.,[2023](https://arxiv.org/html/2608.10462#bib.bib34)\); and \(2\)balancing post\-training shift correction and useful information preservation, as shift\-related feature components may also encode valid membership signals, making indiscriminate correction potentially detrimental\(Haghighatkhahet al\.,[2022](https://arxiv.org/html/2608.10462#bib.bib35); Belroseet al\.,[2023](https://arxiv.org/html/2608.10462#bib.bib17)\)\.

To address these challenges, we proposeCalibDCD, a broadly applicable calibration framework for feature\-based DCD methods\. It comprises \(1\) Multi\-View Shift Detection, which evaluates multiple prompt variants on known non\-member texts, prioritizes views based on their false\-positive pressure \(FPP\), and establishes cross\-view consensus to identify recurring feature\-shift directions; and \(2\) Bounded Feature Correction, which selectively suppresses features aligned with the detected shift subspace while controlling the correction extent to limit the loss of useful detection information\. The source code and experimental configurations are available at https://anonymous\.4open\.science/r/CALIBDCD/\.

Our main contributions are:

- •We propose a broadly applicable calibration framework for mitigating the induced shifts\.
- •We develop Multi\-View Shift Detection to rank prompt views by FPP and identify recurring shifts through cross\-view consensus\.
- •We devise Bounded Feature Correction to selectively suppress shift\-aligned features and preserve useful detection information\.
- •Extensive experiments show gains of up to 7\.0% in AUC and 15\.0% in TPR@5%FPR\.

![Refer to caption](https://arxiv.org/html/2608.10462v1/x2.png)Figure 2:Overview ofCalibDCD, which combines Multi\-View Shift Detection to estimate post\-training\-related feature\-shift subspaces with Bounded Feature Correction to selectively attenuate shift\-aligned components\.
## 2Related Work

#### Task\-based Data Contamination Detection\.

One line of work formulates contamination detection as a behavioral task designed to reveal model familiarity with the input text\. Name\-Cloze removes named entities from book passages and evaluates whether the target model can reconstruct the missing content\(Changet al\.,[2023](https://arxiv.org/html/2608.10462#bib.bib12)\), while DE\-COP asks the model to distinguish an original passage from perturbed alternatives\(Duarteet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib13)\)\. Related studies investigate benchmark\-level contamination by comparing model outputs across carefully constructed test variants\(Orenet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib9); Mainiet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib16)\)\. These methods are sensitive to task design and the task\-solving ability of the target model\.

#### Feature\-based Data Contamination Detection\.

Feature\-based methods convert observed model behavior into membership features and train a classifier to distinguish members from non\-members\. Prior methods use likelihood, neighborhood, or divergence signals to measure how strongly a model fits an input text\(Matternet al\.,[2023](https://arxiv.org/html/2608.10462#bib.bib5); Shiet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib7); Zhanget al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib11)\)\. In the black\-box setting, DPDLLM derives probability\-based features from generated text using a reference language model\(Zhouet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib15)\), while VeilProbe learns input–output mapping features and applies key\-token perturbations\(Huet al\.,[2025](https://arxiv.org/html/2608.10462#bib.bib14)\)\. Our work calibrates these output\-dependent feature representations without changing their detector design\.

## 3Problem Statement

We first formally define the DCD task\.

Definition 1 \(Data Contamination Detection\)\.LetΘ\\Thetadenote a target LLM pre\-trained on a corpus𝒟Θ\\mathcal\{D\}\_\{\\Theta\}\. Given an input textssand black\-box access toΘ\\Theta, DCD aims to predict

ms=𝕀​\[s∈𝒟Θ\],m\_\{s\}=\\mathbb\{I\}\\\!\\left\[s\\in\\mathcal\{D\}\_\{\\Theta\}\\right\],\(1\)wherems=1m\_\{s\}=1indicates thatssis a member of the pre\-training corpus andms=0m\_\{s\}=0otherwise\.

A feature\-based detector constructs

𝐳s,e0=ϕ​\(e0​\(s\),Θ​\(e0​\(s\)\)\)∈ℝd,\\mathbf\{z\}\_\{s,e\_\{0\}\}=\\phi\\bigl\(e\_\{0\}\(s\),\\Theta\(e\_\{0\}\(s\)\)\\bigr\)\\in\\mathbb\{R\}^\{d\},\(2\)wheree0e\_\{0\}is the original query construction function,ϕ\\phiis the feature extractor, andddis the feature dimension\. A scoring functionqqmaps𝐳s,e0\\mathbf\{z\}\_\{s,e\_\{0\}\}to a membership score, with a larger value indicating stronger membership evidence\. Given a thresholdη\\eta, the predicted label is

m^s=𝕀​\[q​\(𝐳s,e0\)≥η\]\.\\widehat\{m\}\_\{s\}=\\mathbb\{I\}\\\!\\left\[q\(\\mathbf\{z\}\_\{s,e\_\{0\}\}\)\\geq\\eta\\right\]\.\(3\)To improve the robustness of feature\-based DCD under post\-training, we formulate the following feature calibration problem\.

Definition 2 \(Feature Calibration under Post\-Training\)\.Let𝒟cal−=\{si−\}i=1n\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}=\\\{s\_\{i\}^\{\-\}\\\}\_\{i=1\}^\{n\}be a set of known non\-members, wheresi−∉𝒟Θs\_\{i\}^\{\-\}\\notin\\mathcal\{D\}\_\{\\Theta\}\. Given an existing feature\-based detector, black\-box access toΘ\\Theta, and𝒟cal−\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}, feature calibration aims to determine a transformation

𝒯​\(⋅;𝒟cal−\):ℝd→ℝd\\mathcal\{T\}\(\\cdot;\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}\):\\mathbb\{R\}^\{d\}\\rightarrow\\mathbb\{R\}^\{d\}\(4\)that maps the original feature𝐳s,e0\\mathbf\{z\}\_\{s,e\_\{0\}\}to

𝐳s,e0′=𝒯​\(𝐳s,e0;𝒟cal−\),\\mathbf\{z\}^\{\\prime\}\_\{s,e\_\{0\}\}=\\mathcal\{T\}\\bigl\(\\mathbf\{z\}\_\{s,e\_\{0\}\};\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}\\bigr\),\(5\)with the objective of producing features that support more reliable membership prediction under post\-training\-related shifts\. Appendix[A](https://arxiv.org/html/2608.10462#A1)summarizes the main notation used in the formulation\.

## 4Method

Figure[2](https://arxiv.org/html/2608.10462#S1.F2)presents an overview ofCalibDCD, a broadly applicable calibration framework that operates on the feature representations of existing feature\-based DCD detectors, comprising \(1\) Multi\-View Shift Detection, which estimates a consensus subspace of recurring post\-training\-related feature shifts using controlled prompt views, and \(2\) Bounded Feature Correction, which selectively attenuates components aligned with the consensus shift subspace by controlling the correction scope and strength\. Appendix[B](https://arxiv.org/html/2608.10462#A2)provides an end\-to\-end pipeline walkthrough example with the complete calibration algorithm \(Algorithm[1](https://arxiv.org/html/2608.10462#alg1)\)\.

### 4\.1Multi\-View Shift Detection

Motivation\.Multi\-View Shift Detection aims to identify a stable subspace of post\-training\-related feature changes that are relevant to membership prediction\. To achieve this goal, the module proceeds in three stages: \(1\)Multi\-View Shift Measurementevaluates known non\-members under multiple controlled query variants and measures their feature changes relative to the original query to obtain complementary observations of post\-training\-related shifts; \(2\)FPP\-Based View Rankingprioritizes views that increase the membership scores of known non\-members, thereby focusing subsequent analysis on shifts that are relevant to false\-positive predictions; and \(3\)Cross\-View Shift Consensusretains directions consistently supported across the selected views, so that query\-specific variations are excluded and recurring shift patterns form a stable subspace\.

#### Multi\-View Shift Measurement\.

The original query provides only a single view of model behavior, limiting the characterization of post\-training\-related feature shifts across query conditions\.CalibDCDtherefore evaluates each known non\-member under multiple controlled views and compares the resulting features and scores with those from the original query, providing complementary evidence for identifying stable, detector\-relevant shift directions\.

Specifically,CalibDCDmaintains a bankℰcand\\mathcal\{E\}\_\{\\mathrm\{cand\}\}of controlled views, comprising eight universal response\-format views and two assistant\-generation\-boundary views tailored to each target\-model family\. Each viewe∈ℰcande\\in\\mathcal\{E\}\_\{\\mathrm\{cand\}\}is a query construction function that maps an input textssto a query variante​\(s\)e\(s\)by modifying only the query prefix or generation boundary while preserving the text and its membership status\. The universal views add response cues such asAssistant,Answer,Reasoning, andSummarybefore the input text to elicit different response formats\. The two model\-specific views vary the chat\-template boundary between the user input and assistant generation\. For Qwen, the two views differ in whether they include an additional separator\. For Llama, they use compact and official header formats, respectively\. For DeepSeek, they differ in whether they include the reasoning opener \(detailed in Appendix[C](https://arxiv.org/html/2608.10462#A3)\)\.

For each calibration non\-memberssand controlled viewee, the target model generates a response toe​\(s\)e\(s\), and the original detector computes

𝐳s,e=ϕ​\(e​\(s\),Θ​\(e​\(s\)\)\),qs,e=q​\(𝐳s,e\)\.\\mathbf\{z\}\_\{s,e\}=\\phi\\bigl\(e\(s\),\\Theta\(e\(s\)\)\\bigr\),\\qquad q\_\{s,e\}=q\(\\mathbf\{z\}\_\{s,e\}\)\.\(6\)Using the feature𝐳s,e0\\mathbf\{z\}\_\{s,e\_\{0\}\}and scoreqs,e0q\_\{s,e\_\{0\}\}obtained under the original querye0e\_\{0\}as references, we define

Δ​𝐳s,e\\displaystyle\\Delta\\mathbf\{z\}\_\{s,e\}=𝐳s,e−𝐳s,e0,\\displaystyle=\\mathbf\{z\}\_\{s,e\}\-\\mathbf\{z\}\_\{s,e\_\{0\}\},\(7\)Δ​qs,e\\displaystyle\\Delta q\_\{s,e\}=qs,e−qs,e0\.\\displaystyle=q\_\{s,e\}\-q\_\{s,e\_\{0\}\}\.\(8\)Because the two observations share the same input text, target model, feature extractor, and scoring function, these paired differences isolate the changes exposed by the query view\.Δ​𝐳s,e\\Delta\\mathbf\{z\}\_\{s,e\}characterizes the feature displacement, whileΔ​qs,e\\Delta q\_\{s,e\}measures its effect on the membership score\. Together, these paired changes provide the sample\-level evidence used to rank controlled views and estimate score\-relevant shift directions\.

#### FPP\-Based View Ranking\.

Not all controlled views expose feature changes that are equally relevant to membership prediction\. Some views may induce substantial feature displacement without affecting detector scores, whereas views that consistently increase the scores of known non\-members provide stronger evidence of false\-positive risk\. We therefore rank the candidate views using*false\-positive pressure*\(FPP\), which measures their average positive score increase over the calibration non\-members\. We retain the positive part of each score change

us,e=\[Δ​qs,e\]\+=max⁡\(0,Δ​qs,e\),u\_\{s,e\}=\[\\Delta q\_\{s,e\}\]\_\{\+\}=\\max\(0,\\Delta q\_\{s,e\}\),\(9\)and define the FPP of vieweeas

FPP​\(e\)=1\|𝒟cal−\|​∑s∈𝒟cal−us,e,\\mathrm\{FPP\}\(e\)=\\frac\{1\}\{\|\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}\|\}\\sum\_\{s\\in\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}\}u\_\{s,e\},\(10\)where a higher FPP indicates that a view induces larger aggregate positive score changes among known non\-members, making it more informative for identifying feature changes associated with false\-positive tendency\.CalibDCDretains the three highest\-FPP viewsℰsel\\mathcal\{E\}\_\{\\mathrm\{sel\}\}fromℰcand\\mathcal\{E\}\_\{\\mathrm\{cand\}\}\.

#### Cross\-View Shift Consensus\.

After FPP\-based ranking identifies the views that most strongly shift known non\-members toward member predictions, it remains necessary to determine which feature directions are associated with these score increases\. Therefore,CalibDCDestimates a score\-guided shift subspace for each selected view and aggregates these view\-specific subspaces to retain directions with consistent cross\-view support\.

For each selected viewee, the sample\-level score increaseus,eu\_\{s,e\}is used to weight the corresponding feature shiftΔ​𝐳s,e\\Delta\\mathbf\{z\}\_\{s,e\}\. To limit the influence of extreme score changes, we define the within\-view clipping cap as the9595th percentile of the positive score increases:

ce=Percentile95⁡\(\{us,e∣s∈𝒟cal−,us,e\>0\}\)\.c\_\{e\}=\\operatorname\{Percentile\}\_\{95\}\\left\(\\left\\\{u\_\{s,e\}\\mid s\\in\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\},\\ u\_\{s,e\}\>0\\right\\\}\\right\)\.\(11\)The corresponding clipped weight and weighted feature shift are

ws,e=min⁡\(us,e,ce\),𝐡s,e=ws,e​Δ​𝐳s,e\.w\_\{s,e\}=\\min\(u\_\{s,e\},c\_\{e\}\),\\qquad\\mathbf\{h\}\_\{s,e\}=\\sqrt\{w\_\{s,e\}\}\\,\\Delta\\mathbf\{z\}\_\{s,e\}\.\(12\)Stacking𝐡s,e\\mathbf\{h\}\_\{s,e\}as the rows of𝐇e\\mathbf\{H\}\_\{e\}gives

𝐇e⊤​𝐇e=∑s∈𝒟cal−ws,e​Δ​𝐳s,e⊤​Δ​𝐳s,e\.\\mathbf\{H\}\_\{e\}^\{\\top\}\\mathbf\{H\}\_\{e\}=\\sum\_\{s\\in\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}\}w\_\{s,e\}\\,\\Delta\\mathbf\{z\}\_\{s,e\}^\{\\top\}\\Delta\\mathbf\{z\}\_\{s,e\}\.\(13\)Thus, each sample contributes in proportion to its clipped positive score increase\. The weighted shifts are not centered because their common directed component is part of the recurring score\-increasing movement being estimated\. We then compute

𝐇e=𝐏e​𝚺e​𝐔e⊤,\\mathbf\{H\}\_\{e\}=\\mathbf\{P\}\_\{e\}\\mathbf\{\\Sigma\}\_\{e\}\\mathbf\{U\}\_\{e\}^\{\\top\},\(14\)and let𝐔e,r\\mathbf\{U\}\_\{e,r\}contain the firstrrright singular vectors\. Its columns span the dominant score\-guided feature\-shift subspace for viewee, whererrcontrols the complexity of the view\-specific estimate\.

Because a direction estimated from a single view may reflect query\-specific variation rather than a recurring shift, the view\-specific subspaces are combined through the average projector

𝐆r=1\|ℰsel\|​∑e∈ℰsel𝐔e,r​𝐔e,r⊤\.\\mathbf\{G\}\_\{r\}=\\frac\{1\}\{\|\\mathcal\{E\}\_\{\\mathrm\{sel\}\}\|\}\\sum\_\{e\\in\\mathcal\{E\}\_\{\\mathrm\{sel\}\}\}\\mathbf\{U\}\_\{e,r\}\\mathbf\{U\}\_\{e,r\}^\{\\top\}\.\(15\)Projector averaging gives each selected view equal influence after its score\-guided subspace has been estimated, avoiding domination by a single view in a pooled decomposition\. We then compute

𝐆r\\displaystyle\\mathbf\{G\}\_\{r\}=𝐕r​diag​\(γr,1,…,γr,d\)​𝐕r⊤,\\displaystyle=\\mathbf\{V\}\_\{r\}\\,\\mathrm\{diag\}\(\\gamma\_\{r,1\},\\ldots,\\gamma\_\{r,d\}\)\\mathbf\{V\}\_\{r\}^\{\\top\},\(16\)γr,i\\displaystyle\\gamma\_\{r,i\}=1\|ℰsel\|​∑e∈ℰsel‖𝐔e,r⊤​𝐯r,i‖22,\\displaystyle=\\frac\{1\}\{\|\\mathcal\{E\}\_\{\\mathrm\{sel\}\}\|\}\\sum\_\{e\\in\\mathcal\{E\}\_\{\\mathrm\{sel\}\}\}\\left\\\|\\mathbf\{U\}\_\{e,r\}^\{\\top\}\\mathbf\{v\}\_\{r,i\}\\right\\\|\_\{2\}^\{2\},\(17\)where𝐯r,i\\mathbf\{v\}\_\{r,i\}is theii\-th eigenvector of𝐆r\\mathbf\{G\}\_\{r\}\. Sinceγr,i∈\[0,1\]\\gamma\_\{r,i\}\\in\[0,1\]measures the average squared projection of𝐯r,i\\mathbf\{v\}\_\{r,i\}onto the selected view subspaces, it quantifies the cross\-view support for that direction\. Given a support thresholdτ\\tau, the consensus basis is defined as

𝐁r=\[𝐯r,i∣γr,i≥τ\]\.\\mathbf\{B\}\_\{r\}=\\bigl\[\\mathbf\{v\}\_\{r,i\}\\mid\\gamma\_\{r,i\}\\geq\\tau\\bigr\]\.\(18\)Here,rrcontrols the complexity of each view\-specific subspace, whereasτ\\taucontrols the degree of cross\-view consistency required for a direction to be retained\. Appendix[D](https://arxiv.org/html/2608.10462#A4)provides the range argument forγr,i\\gamma\_\{r,i\}\.

### 4\.2Bounded Feature Correction

Motivation\.Bounded Feature Correction aims to reduce the influence of the detected shift subspace while limiting unnecessary modification of potentially useful feature components\. Directly removing all shift\-aligned components is undesirable because the detected directions may contain both post\-training\-related variation and valid membership evidence\. To balance these effects, the stage proceeds in two steps: \(1\)Bounded Feature Adjustmentconstructs candidate corrections that attenuate, rather than completely remove, feature components aligned with the consensus shift directions; and \(2\)Controlled Correction Selectiondetermines the correction scope and strength using known non\-members, so that detector scores are reduced without applying an unnecessarily aggressive transformation\.

#### Bounded Feature Adjustment\.

The consensus basis identifies recurring score\-increasing directions, but these directions may also contain information useful for membership prediction\. To avoid indiscriminate removal,CalibDCDattenuates only the component aligned with the consensus subspace while preserving its orthogonal complement\. Formally, because the columns of𝐁r\\mathbf\{B\}\_\{r\}are orthonormal, an original\-format feature𝐳\\mathbf\{z\}can be decomposed as

𝐳∥,r\\displaystyle\\mathbf\{z\}\_\{\\parallel,r\}=\(𝐳𝐁r\)​𝐁r⊤,\\displaystyle=\(\\mathbf\{z\}\\mathbf\{B\}\_\{r\}\)\\mathbf\{B\}\_\{r\}^\{\\top\},\(19\)𝐳⟂,r\\displaystyle\\mathbf\{z\}\_\{\\perp,r\}=𝐳−𝐳∥,r\.\\displaystyle=\\mathbf\{z\}\-\\mathbf\{z\}\_\{\\parallel,r\}\.\(20\)For rankrrand strengthλ\\lambda, we construct

𝐀r,λ\\displaystyle\\mathbf\{A\}\_\{r,\\lambda\}=𝐈−λ​𝐁r​𝐁r⊤,0≤λ≤1,\\displaystyle=\\mathbf\{I\}\-\\lambda\\mathbf\{B\}\_\{r\}\\mathbf\{B\}\_\{r\}^\{\\top\},\\qquad 0\\leq\\lambda\\leq 1,\(21\)𝐳′\\displaystyle\\mathbf\{z\}^\{\\prime\}=𝐳𝐀r,λ=𝐳⟂,r\+\(1−λ\)​𝐳∥,r\.\\displaystyle=\\mathbf\{z\}\\mathbf\{A\}\_\{r,\\lambda\}=\\mathbf\{z\}\_\{\\perp,r\}\+\(1\-\\lambda\)\\mathbf\{z\}\_\{\\parallel,r\}\.The operator acts only on the consensus subspace

𝐀r,λ​𝐁r\\displaystyle\\mathbf\{A\}\_\{r,\\lambda\}\\mathbf\{B\}\_\{r\}=\(1−λ\)​𝐁r,\\displaystyle=\(1\-\\lambda\)\\mathbf\{B\}\_\{r\},\(22\)𝐀r,λ​𝐯\\displaystyle\\mathbf\{A\}\_\{r,\\lambda\}\\mathbf\{v\}=𝐯if​𝐁r⊤​𝐯=𝟎\.\\displaystyle=\\mathbf\{v\}\\quad\\text\{if \}\\mathbf\{B\}\_\{r\}^\{\\top\}\\mathbf\{v\}=\\mathbf\{0\}\.The transformation is restricted to the consensus subspace, leaving all orthogonal components unchanged\. The parameterλ\\lambdacontrols the attenuation strength, ranging from no correction atλ=0\\lambda=0to complete removal of the aligned component atλ=1\\lambda=1, thereby allowing partial correction when full removal may discard useful information\.

#### Controlled Correction Selection\.

Using the candidate correction matrices𝐀r,λ\\mathbf\{A\}\_\{r,\\lambda\}constructed above,CalibDCDselects the final correction based only on known non\-members\. Letℛ\\mathcal\{R\}andΛ\\Lambdadenote the predefined candidate sets for the subspace rank and attenuation strength, respectively\. The original detector is first trained to obtain the scoring functionqq, which remains fixed during correction selection\. For each candidate pair\(r,λ\)\(r,\\lambda\), its calibration objective is defined as the average reduction in non\-member scores:

J​\(r,λ\)=1\|𝒟cal−\|​∑s∈𝒟cal−\[q​\(𝐳s,e0\)−q​\(𝐳s,e0​𝐀r,λ\)\]\.J\(r,\\lambda\)=\\frac\{1\}\{\|\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}\|\}\\sum\_\{s\\in\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}\}\\left\[q\(\\mathbf\{z\}\_\{s,e\_\{0\}\}\)\-q\\bigl\(\\mathbf\{z\}\_\{s,e\_\{0\}\}\\mathbf\{A\}\_\{r,\\lambda\}\\bigr\)\\right\]\.\(23\)A largerJ​\(r,λ\)J\(r,\\lambda\)indicates that the candidate correction more strongly reduces the membership evidence assigned to known non\-members\. The final parameters and correction matrix are selected as

\(r∗,λ∗\)\\displaystyle\(r^\{\*\},\\lambda^\{\*\}\)=arg⁡maxr∈ℛ,λ∈Λ⁡J​\(r,λ\),\\displaystyle=\\arg\\max\_\{r\\in\\mathcal\{R\},\\,\\lambda\\in\\Lambda\}J\(r,\\lambda\),\(24\)𝐀∗\\displaystyle\\mathbf\{A\}^\{\*\}=𝐀r∗,λ∗\.\\displaystyle=\\mathbf\{A\}\_\{r^\{\*\},\\lambda^\{\*\}\}\.\(25\)
After selecting𝐀∗\\mathbf\{A\}^\{\*\}, the same correction is applied to the supervised training features and to the features of each input text before classification\. A classifier from the original detector family is then retrained on the corrected training features, yielding the final scoring functionqfinalq\_\{\\mathrm\{final\}\}\. For an input textss, the calibrated detector computes

𝐳s,e0′=𝒯𝐀∗​\(𝐳s,e0\),q~​\(s\)=qfinal​\(𝐳s,e0′\),\\mathbf\{z\}^\{\\prime\}\_\{s,e\_\{0\}\}=\\mathcal\{T\}\_\{\\mathbf\{A\}^\{\*\}\}\(\\mathbf\{z\}\_\{s,e\_\{0\}\}\),\\qquad\\widetilde\{q\}\(s\)=q\_\{\\mathrm\{final\}\}\(\\mathbf\{z\}^\{\\prime\}\_\{s,e\_\{0\}\}\),\(26\)where𝒯𝐀∗\\mathcal\{T\}\_\{\\mathbf\{A\}^\{\*\}\}denotes the detector\-compatible application of the selected correction\.

## 5Experiments

### 5\.1Experimental Setup

Datasets\.Following prior work, we evaluateCalibDCDon four pre\-training data detection benchmarks\.WikiMIAconsists of Wikipedia event snippets, whileBookMIAcontains book passages\(Shiet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib7)\)\.BookTectioncontains excerpts from copyrighted books, andArxivTectioncontains passages from scientific papers on arXiv\(Duarteet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib13)\)\. Table[1](https://arxiv.org/html/2608.10462#S5.T1)summarizes the dataset statistics and split sizes\.

Table 1:Statistics of the DCD benchmarks\. Parentheses report the numbers of members and non\-members\.BenchmarkTotalSupervised TrainEvaluation PoolBookTection2,0002\{,\}000100​\(50/50\)100\\;\(50/50\)1,900​\(950/950\)1\{,\}900\\;\(950/950\)BookMIA2,0002\{,\}000100​\(50/50\)100\\;\(50/50\)1,900​\(950/950\)1\{,\}900\\;\(950/950\)ArxivTection1,5481\{,\}548100​\(50/50\)100\\;\(50/50\)1,448​\(712/736\)1\{,\}448\\;\(712/736\)WikiMIA542542100​\(50/50\)100\\;\(50/50\)442​\(234/208\)442\\;\(234/208\)Table 2:AUC results of VeilProbe and DPDLLM with and withoutCalibDCDacross four benchmarks and three target LLMs\. Bold values indicate the better result within each baseline–calibrated pair\.MethodBookTectionBookMIAArxivTectionWikiMIAQwenLlamaDeep\-SeekQwenLlamaDeep\-SeekQwenLlamaDeep\-SeekQwenLlamaDeep\-SeekVeilProbe88\.888\.286\.878\.580\.777\.091\.390\.386\.094\.695\.193\.9VeilProbe\+\+CalibDCD91\.790\.689\.184\.084\.479\.393\.491\.487\.596\.195\.295\.5DPDLLM72\.573\.570\.367\.375\.854\.364\.558\.753\.561\.266\.657\.0DPDLLM\+\+CalibDCD74\.275\.871\.470\.078\.561\.365\.859\.355\.162\.467\.457\.8Table 3:TPR@5%FPR results of VeilProbe and DPDLLM with and withoutCalibDCDacross four benchmarks and three target LLMs\. Bold values indicate the better result within each baseline–calibrated pair\.MethodBookTectionBookMIAArxivTectionWikiMIAQwenLlamaDeep\-SeekQwenLlamaDeep\-SeekQwenLlamaDeep\-SeekQwenLlamaDeep\-SeekVeilProbe53\.660\.345\.341\.545\.236\.763\.163\.850\.474\.870\.169\.7VeilProbe\+\+CalibDCD68\.666\.158\.049\.855\.741\.672\.268\.457\.381\.671\.475\.6DPDLLM15\.322\.712\.417\.920\.26\.615\.98\.35\.912\.413\.78\.5DPDLLM\+\+CalibDCD26\.030\.019\.322\.232\.215\.516\.412\.99\.620\.120\.112\.4Target LLMs\.We evaluate Qwen2\.5\-7B\-Instruct\(Qwen Team,[2024](https://arxiv.org/html/2608.10462#bib.bib24)\), Llama\-3\.1\-8B\-Instruct\(Grattafioriet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib23)\), and DeepSeek\-R1\-Distill\-Qwen\-7B\(DeepSeek\-AI,[2025](https://arxiv.org/html/2608.10462#bib.bib22)\)\. These models are comparable in scale but differ in model family and post\-training design, allowing us to evaluate across diverse post\-training settings\.

Evaluation Metrics\.Following prior works\(Huet al\.,[2025](https://arxiv.org/html/2608.10462#bib.bib14); Carliniet al\.,[2022](https://arxiv.org/html/2608.10462#bib.bib3)\), we use the Area Under the Receiver Operating Characteristic Curve \(AUC\) and the True Positive Rate at a 5% False Positive Rate \(TPR@5%FPR\) as evaluation metrics\. A higher AUC indicates better overall discrimination between members and non\-members across classification thresholds, while a higher TPR@5%FPR indicates stronger member detection under a low false\-positive constraint\.

Baselines\.We applyCalibDCDto two feature\-based DCD detectors:VeilProbe\(Huet al\.,[2025](https://arxiv.org/html/2608.10462#bib.bib14)\), which learns input–output mapping features and applies key\-token perturbations, andDPDLLM\(Zhouet al\.,[2024](https://arxiv.org/html/2608.10462#bib.bib15)\), which derives probability\-based features from generated text using a reference language model\.

Implementation Details\.For each setting, we construct ten fixed controlled views, including eight universal views and two model\-specific views, from which FPP selects the top three\. We setℛ=\{3,4,5,6\}\\mathcal\{R\}=\\\{3,4,5,6\\\},Λ=\{0\.7,0\.8,0\.9,1\.0\}\\Lambda=\\\{0\.7,0\.8,0\.9,1\.0\\\}, andτ=0\.95\\tau=0\.95\. Calibration uses only known non\-members and does not access evaluation metrics or member labels from the evaluation pool\. Controlled\-view outputs, features, and scores are cached and reused throughout calibration\. ForVeilProbe, correction is applied only to the output\-derived feature block, whereas forDPDLLM, it is applied to the complete membership\-feature vector\. After correction, the original classifier family is retrained on the corrected supervised training features\. Appendix[E](https://arxiv.org/html/2608.10462#A5)provides the complete configuration\. Experiments are conducted using Python 3\.10 and CUDA 12\.6 on a server equipped with eight NVIDIA RTX A5000 GPUs with2424GB of memory each\.

### 5\.2Main Results

Tables[2](https://arxiv.org/html/2608.10462#S5.T2)and[3](https://arxiv.org/html/2608.10462#S5.T3)show thatCalibDCDimproves both AUC and TPR@5%FPR in all 24 settings, with average gains of 2\.1% and 7\.0%, respectively\. The largest gains reach 7\.0% in AUC for DPDLLM on BookMIA with DeepSeek and 15\.0% in TPR@5%FPR for VeilProbe on BookTection with Qwen, demonstrating consistent effectiveness across benchmarks, target models, and detector families\.

The improvement is particularly pronounced under the low\-FPR condition\. VeilProbe gains 2\.3% in AUC and 7\.7% in TPR@5%FPR on average, while DPDLLM gains 2\.0% and 6\.4%, respectively\. This trend is consistent withCalibDCDfocusing on score\-increasing shifts of non\-members, which mainly reduces high\-confidence false positives\. Across Qwen, Llama, and DeepSeek, the respective AUC gains are 2\.4%, 1\.7%, and 2\.3%, confirming robustness to different post\-training designs\. At the benchmark level, BookMIA achieves the largest average AUC gain of 4\.0%, whereas BookTection obtains the largest TPR@5%FPR gain of 9\.7%, indicating thatCalibDCDadapts to different types of post\-training\-induced feature shifts\.

Table 4:Ablation results in percentages\. Parentheses show the average change from the complete method on the same settings\.ConfigurationnnAUCTPR@5%FPRCalibDCD242478\.3%78\.3\\%41\.8%41\.8\\%Random\-3 Views242477\.7%​\(−0\.6%\)77\.7\\%\\;\(\-0\.6\\%\)38\.7%​\(−3\.1%\)38\.7\\%\\;\(\-3\.1\\%\)Top\-1 View242477\.2%​\(−1\.1%\)77\.2\\%\\;\(\-1\.1\\%\)37\.6%​\(−4\.2%\)37\.6\\%\\;\(\-4\.2\\%\)No Cross\-View Consensus242477\.0%​\(−1\.3%\)77\.0\\%\\;\(\-1\.3\\%\)37\.9%​\(−3\.9%\)37\.9\\%\\;\(\-3\.9\\%\)Binary Positive Weight242477\.4%​\(−0\.9%\)77\.4\\%\\;\(\-0\.9\\%\)38\.8%​\(−3\.0%\)38\.8\\%\\;\(\-3\.0\\%\)CalibDCD\(λ<1\\lambda<1\)181878\.0%78\.0\\%40\.6%40\.6\\%Fixed Full Correction181877\.1%​\(−0\.9%\)77\.1\\%\\;\(\-0\.9\\%\)38\.0%​\(−2\.6%\)38\.0\\%\\;\(\-2\.6\\%\)![Refer to caption](https://arxiv.org/html/2608.10462v1/x3.png)Figure 3:Average performance drop relative to the complete method\. Parentheses report the number of settings in which the complete method performs better\. The final comparison includes the1818settings with a selectedλ<1\\lambda<1\.
### 5\.3Ablation Studies

We change one component at a time while fixing all other settings\. The variants replace FPP\-based view selection with seeded Random\-3 views, retain only the top\-FPP view, remove cross\-view consensus, use binary positive weights, or apply full correction withλ=1\\lambda=1to the1818settings whereCalibDCDselectsλ<1\\lambda<1\. Table[4](https://arxiv.org/html/2608.10462#S5.T4)and Figure[3](https://arxiv.org/html/2608.10462#S5.F3)report the absolute results and average performance drops\.

Replacing FPP\-based selection with Random\-3 Views reduces AUC and TPR@5%FPR by0\.6%0\.6\\%and3\.1%3\.1\\%, respectively, withCalibDCDachieving higher AUC in all2424settings and higher TPR in2323\. This confirms that prioritizing views with stronger false\-positive pressure provides more informative shift observations than arbitrary view selection\. Using only the Top\-1 View causes larger drops of1\.1%1\.1\\%in AUC and4\.2%4\.2\\%in TPR@5%FPR, and underperformsCalibDCDin all2424settings on both metrics, demonstrating the importance of combining complementary views rather than relying on a single view\.

Removing Cross\-View Consensus produces the largest AUC reduction of1\.3%1\.3\\%and decreases TPR@5%FPR by3\.9%3\.9\\%across all2424settings\. This shows that consensus filtering is necessary to retain recurring shift directions while excluding view\-specific variations\. Replacing score\-sensitive weights with Binary Positive Weight reduces AUC by0\.9%0\.9\\%and TPR@5%FPR by3\.0%3\.0\\%in every setting, indicating that weighting feature shifts by their induced score increases better captures their contribution to false\-positive behavior\. Finally, Fixed Full Correction reduces AUC by0\.9%0\.9\\%and TPR@5%FPR by2\.6%2\.6\\%across the1818partial\-correction settings; the selected strengths perform better in1717settings for AUC and all1818for TPR\. This validates the importance of bounded correction in mitigating shift\-related components without unnecessarily removing useful membership information\.

![Refer to caption](https://arxiv.org/html/2608.10462v1/x4.png)Figure 4:Outcomes for affected false positives at the corrected detector’s5%5\\%FPR threshold\. Benchmark and detector rows partition the same201201cases\. Labels report the number and proportion of recovered cases among affected cases\.
### 5\.4Analysis

Recovery of Shift\-Associated False Positives\.To examine whetherCalibDCDimproves the specific decisions targeted by calibration, we conduct a decision\-level recovery analysis\. For each benchmark–model–detector setting, we consider the selected controlled view with the highest FPP and identify the known non\-members associated with this view that are misclassified as members by the original detector at its5%5\\%FPR operating point\. We then determine whether the corrected detector reclassifies these examples as non\-members using its corresponding threshold at the same5%5\\%FPR, thereby holding the operating constraint constant\. Figure[4](https://arxiv.org/html/2608.10462#S5.F4)reports the recovery rates by benchmark and detector\. Overall,9090of the201201identified false positives are recovered as true negatives, corresponding to a recovery rate of44\.8%44\.8\\%\. The recovery rate ranges from36\.4%36\.4\\%onWikiMIAto47\.5%47\.5\\%onBookMIA, and averages41\.8%41\.8\\%forVeilProbeand52\.7%52\.7\\%forDPDLLM\. These results show thatCalibDCDmitigates a substantial fraction of the false positives emphasized by high\-FPP views, providing decision\-level evidence that complements the aggregate improvements in AUC and TPR@5%FPR\.

Adaptive Correction Selection\.Figures[5](https://arxiv.org/html/2608.10462#S5.F5)and[6](https://arxiv.org/html/2608.10462#S5.F6)compare adaptive correction selection with the fixed configuration\(r=3,λ=0\.9\)\(r=3,\\lambda=0\.9\)in terms of AUC and TPR@5%FPR, respectively\. Adaptive selection improves the average AUC from89\.4%89\.4\\%to90\.0%90\.0\\%forVeilProbeand from66\.3%66\.3\\%to66\.6%66\.6\\%forDPDLLM\. The advantage is more pronounced at low FPR, where the average TPR@5%FPR increases from60\.3%60\.3\\%to63\.9%63\.9\\%and from17\.0%17\.0\\%to19\.7%19\.7\\%, respectively\. These results indicate that adapting the correction rank and strength to each setting is more effective than using a single fixed configuration\.

![Refer to caption](https://arxiv.org/html/2608.10462v1/x5.png)Figure 5:AUC comparison between adaptive correction selection and the fixed configuration\(r=3,λ=0\.9\)\(r=3,\\lambda=0\.9\)\. Q, L, and DS denote Qwen, Llama, and DeepSeek, while BT, BM, AT, and WM denoteBookTection,BookMIA,ArxivTection, andWikiMIA, respectively\.![Refer to caption](https://arxiv.org/html/2608.10462v1/x6.png)Figure 6:TPR@5%FPR comparison between adaptive correction selection and the fixed configuration\(r=3,λ=0\.9\)\(r=3,\\lambda=0\.9\)\. Abbreviations follow Figure[5](https://arxiv.org/html/2608.10462#S5.F5)\.

## 6Conclusion

We studied feature\-based black\-box data contamination detection under post\-training\-induced output shifts\. We proposedCalibDCD, which identifies recurring score\-increasing feature shifts from controlled views of known non\-members and applies a bounded correction before classification while retaining the original detector query\. Across four benchmarks, three post\-trained LLMs, and two detector families,CalibDCDimproves both AUC and TPR@5%FPR in all2424settings, with average gains of2\.1%2\.1\\%and7\.0%7\.0\\%and maximum gains of7\.0%7\.0\\%and15\.0%15\.0\\%, respectively, without modifying the target LLM or detection\-time query process\. These results highlight calibration as a practical way to improve the robustness of feature\-based DCD under post\-training procedures\.

## Limitations

CalibDCDcorrects score\-increasing feature shifts observed on known non\-members\. Although post\-training motivates the study, these shifts may also reflect dataset artifacts, decoding behavior, or the feature extractor\. The method therefore identifies shifts associated with higher non\-member scores during calibration rather than proving that every corrected shift is caused by post\-training\.

CalibDCDrequires known non\-members outside supervised classifier training\. Temporal benchmarks and data released after a model cutoff provide such examples, but the requirement is harder to satisfy when the cutoff is unknown or no trusted non\-member pool is available\. The calibration examples remain in the reporting pool in our protocol\. They provide non\-member shift estimates, while reporting\-pool member labels and evaluation metrics are not used to select the correction\. Calibration also requires additional target\-model queries under controlled views, and its quality depends on whether these views expose the score\-increasing shifts relevant to the detector\.

The method applies to feature\-based detectors that expose numerical membership features and scores\. Its bounded linear correction may not address nonlinear or sample\-specific false\-positive sources\.

## Ethics Statement

Data contamination detection can support audits of copyrighted, private, or benchmark data\. Its outputs are probabilistic and should not be treated as definitive proof that a particular text was used in training\. Audits should use lawfully obtained data and avoid unnecessary exposure of sensitive content\.

## References

- Y\. Bai, S\. Kadavath, S\. Kundu, A\. Askell, J\. Kernion, A\. Jones, A\. Chen, A\. Goldie, A\. Mirhoseini, C\. McKinnon, C\. Chen, C\. Olsson, C\. Olah, D\. Hernandez, D\. Drain, D\. Ganguli, D\. Li, E\. Tran\-Johnson, E\. Perez, J\. Kerr, J\. Mueller, J\. Ladish, J\. Landau, K\. Ndousse, K\. Lukosuite, L\. Lovitt, M\. Sellitto, N\. Elhage, N\. Schiefer, N\. Mercado, N\. DasSarma, R\. Lasenby, R\. Larson, S\. Ringer, S\. Johnston, S\. Kravec, S\. E\. Showk, S\. Fort, T\. Lanham, T\. Telleen\-Lawton, T\. Conerly, T\. Henighan, T\. Hume, S\. R\. Bowman, Z\. Hatfield\-Dodds, B\. Mann, D\. Amodei, N\. Joseph, S\. McCandlish, T\. Brown, and J\. Kaplan \(2022\)Constitutional AI: harmlessness from AI feedback\.arXiv preprint arXiv:2212\.08073\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2212.08073),[Link](https://arxiv.org/abs/2212.08073)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p3.1)\.
- LEACE: perfect linear concept erasure in closed form\.InAdvances in Neural Information Processing Systems,Vol\.36,pp\. 66044–66063\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/d066d21c619d0a78c5b557fa3291a8f4-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p4.1)\.
- T\. B\. Brown, B\. Mann, N\. Ryder, M\. Subbiah, J\. Kaplan, P\. Dhariwal, A\. Neelakantan, P\. Shyam, G\. Sastry, A\. Askell, S\. Agarwal, A\. Herbert\-Voss, G\. Krueger, T\. Henighan, J\. Wu, C\. Winter, M\. Chen, E\. Sigler, M\. Litwin, S\. Gray, B\. Chess, J\. Clark, C\. Berner, S\. McCandlish, A\. Radford, I\. Sutskever, and D\. Amodei \(2020\)Language models are few\-shot learners\.InAdvances in Neural Information Processing Systems,Vol\.33,pp\. 1877–1901\.External Links:[Link](https://proceedings.neurips.cc/paper/2020/hash/1457c0d6bfcb4967418bfb8ac142f64a-Abstract.html)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p1.1)\.
- N\. Carlini, S\. Chien, M\. Nasr, S\. Song, A\. Terzis, and F\. Tramèr \(2022\)Membership inference attacks from first principles\.In2022 IEEE Symposium on Security and Privacy,pp\. 1897–1914\.External Links:[Document](https://dx.doi.org/10.1109/SP46214.2022.9833649),[Link](https://doi.org/10.1109/SP46214.2022.9833649)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p1.1),[§5\.1](https://arxiv.org/html/2608.10462#S5.SS1.p3.1)\.
- N\. Carlini, D\. Ippolito, M\. Jagielski, K\. Lee, F\. Tramèr, and C\. Zhang \(2023\)Quantifying memorization across neural language models\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=TatRHT_1cK)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p1.1)\.
- N\. Carlini, F\. Tramèr, E\. Wallace, M\. Jagielski, A\. Herbert\-Voss, K\. Lee, A\. Roberts, T\. Brown, D\. Song, Ú\. Erlingsson, A\. Oprea, and C\. Raffel \(2021\)Extracting training data from large language models\.In30th USENIX Security Symposium,pp\. 2633–2650\.External Links:[Link](https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p1.1)\.
- K\. K\. Chang, M\. Cramer, S\. Soni, and D\. Bamman \(2023\)Speak, memory: an archaeology of books known to ChatGPT/GPT\-4\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing,Singapore,pp\. 7312–7327\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.emnlp-main.453),[Link](https://aclanthology.org/2023.emnlp-main.453/)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p2.1),[§2](https://arxiv.org/html/2608.10462#S2.SS0.SSS0.Px1.p1.1)\.
- DeepSeek\-AI \(2025\)DeepSeek\-R1: incentivizing reasoning capability in LLMs via reinforcement learning\.arXiv preprint arXiv:2501\.12948\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2501.12948),[Link](https://arxiv.org/abs/2501.12948)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p3.1),[§5\.1](https://arxiv.org/html/2608.10462#S5.SS1.p2.1)\.
- C\. Deng, Y\. Zhao, X\. Tang, M\. Gerstein, and A\. Cohan \(2024\)Investigating data contamination in modern benchmarks for large language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),Mexico City, Mexico,pp\. 8706–8719\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.naacl-long.482),[Link](https://aclanthology.org/2024.naacl-long.482/)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p2.1)\.
- Y\. Dong, X\. Jiang, H\. Liu, Z\. Jin, B\. Gu, M\. Yang, and G\. Li \(2024\)Generalization or memorization: data contamination and trustworthy evaluation for large language models\.InFindings of the Association for Computational Linguistics: ACL 2024,Bangkok, Thailand,pp\. 12039–12050\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.716),[Link](https://aclanthology.org/2024.findings-acl.716/)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p2.1)\.
- A\. V\. Duarte, X\. Zhao, A\. L\. Oliveira, and L\. Li \(2024\)DE\-COP: detecting copyrighted content in language models training data\.InProceedings of the 41st International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.235,pp\. 11940–11956\.External Links:[Link](https://proceedings.mlr.press/v235/duarte24a.html)Cited by:[Figure 1](https://arxiv.org/html/2608.10462#S1.F1),[§1](https://arxiv.org/html/2608.10462#S1.p2.1),[§2](https://arxiv.org/html/2608.10462#S2.SS0.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2608.10462#S5.SS1.p1.1)\.
- S\. Golchin and M\. Surdeanu \(2025\)Data contamination quiz: a tool to detect and estimate contamination in large language models\.Transactions of the Association for Computational Linguistics13,pp\. 809–830\.External Links:[Document](https://dx.doi.org/10.1162/tacl.a.20),[Link](https://aclanthology.org/2025.tacl-1.37/)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p2.1)\.
- A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan, A\. Yang, A\. Fan,et al\.\(2024\)The Llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2407.21783),[Link](https://arxiv.org/abs/2407.21783)Cited by:[§5\.1](https://arxiv.org/html/2608.10462#S5.SS1.p2.1)\.
- P\. Haghighatkhah, A\. Fokkens, P\. Sommerauer, B\. Speckmann, and K\. Verbeek \(2022\)Better hit the nail on the head than beat around the bush: removing protected attributes with a single projection\.InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing,Abu Dhabi, United Arab Emirates,pp\. 8395–8416\.External Links:[Document](https://dx.doi.org/10.18653/v1/2022.emnlp-main.575),[Link](https://aclanthology.org/2022.emnlp-main.575/)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p4.1)\.
- R\. Hu, Y\. Shang, J\. Peng, W\. Luo, Y\. Wang, and X\. Zhang \(2025\)Automated detection of pre\-training text in black\-box LLMs\.InProceedings of the Thirty\-Fourth International Joint Conference on Artificial Intelligence, IJCAI\-25,pp\. 385–393\.Note:Main TrackExternal Links:[Document](https://dx.doi.org/10.24963/ijcai.2025/44),[Link](https://doi.org/10.24963/ijcai.2025/44)Cited by:[Figure 1](https://arxiv.org/html/2608.10462#S1.F1),[§1](https://arxiv.org/html/2608.10462#S1.p1.1),[§1](https://arxiv.org/html/2608.10462#S1.p2.1),[§2](https://arxiv.org/html/2608.10462#S2.SS0.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2608.10462#S5.SS1.p3.1),[§5\.1](https://arxiv.org/html/2608.10462#S5.SS1.p4.1)\.
- R\. Jiang, J\. Wang, G\. Zhao, C\. Luo, K\. Wang, and W\. Zhang \(2026\)Advancing multimodal agent reasoning with long\-term neuro\-symbolic memory\.arXiv preprint arXiv:2603\.15280\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2603.15280),[Link](https://arxiv.org/abs/2603.15280)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p1.1)\.
- A\. Karamolegkou, J\. Li, L\. Zhou, and A\. Søgaard \(2023\)Copyright violations and large language models\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing,Singapore,pp\. 7403–7412\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.emnlp-main.458),[Link](https://aclanthology.org/2023.emnlp-main.458/)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p1.1)\.
- R\. Kirk, I\. Mediratta, C\. Nalmpantis, J\. Luketina, E\. Hambro, E\. Grefenstette, and R\. Raileanu \(2024\)Understanding the effects of RLHF on LLM generalisation and diversity\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=PXD3FAVHJT)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p4.1)\.
- P\. Maini, H\. Jia, N\. Papernot, and A\. Dziedzic \(2024\)LLM dataset inference: did you train on my dataset?\.InAdvances in Neural Information Processing Systems,Vol\.37\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2024/hash/e01519b47118e2f51aa643151350c905-Abstract-Conference.html)Cited by:[§2](https://arxiv.org/html/2608.10462#S2.SS0.SSS0.Px1.p1.1)\.
- J\. Mattern, F\. Mireshghallah, Z\. Jin, B\. Schölkopf, M\. Sachan, and T\. Berg\-Kirkpatrick \(2023\)Membership inference attacks against language models via neighbourhood comparison\.InFindings of the Association for Computational Linguistics: ACL 2023,Toronto, Canada,pp\. 11330–11343\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.findings-acl.719),[Link](https://aclanthology.org/2023.findings-acl.719/)Cited by:[§2](https://arxiv.org/html/2608.10462#S2.SS0.SSS0.Px2.p1.1)\.
- Y\. Oren, N\. Meister, N\. S\. Chatterji, F\. Ladhak, and T\. B\. Hashimoto \(2024\)Proving test set contamination in black\-box language models\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=KS8mIvetg2)Cited by:[§2](https://arxiv.org/html/2608.10462#S2.SS0.SSS0.Px1.p1.1)\.
- L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Ray, J\. Schulman, J\. Hilton, F\. Kelton, L\. Miller, M\. Simens, A\. Askell, P\. Welinder, P\. Christiano, J\. Leike, and R\. Lowe \(2022\)Training language models to follow instructions with human feedback\.InAdvances in Neural Information Processing Systems,Vol\.35,pp\. 27730–27744\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2022/hash/b1efde53be364a73914f58805a001731-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p3.1)\.
- Qwen Team \(2024\)Qwen2\.5: a party of foundation models\.Note:Technical blogExternal Links:[Link](https://qwenlm.github.io/blog/qwen2.5/)Cited by:[§5\.1](https://arxiv.org/html/2608.10462#S5.SS1.p2.1)\.
- R\. Rafailov, A\. Sharma, E\. Mitchell, C\. D\. Manning, S\. Ermon, and C\. Finn \(2023\)Direct preference optimization: your language model is secretly a reward model\.InAdvances in Neural Information Processing Systems,Vol\.36\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/a85b405ed65c6477a4fe8302b5e06ce7-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p3.1)\.
- W\. Shi, A\. Ajith, M\. Xia, Y\. Huang, D\. Liu, T\. Blevins, D\. Chen, and L\. Zettlemoyer \(2024\)Detecting pretraining data from large language models\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=zWqr3MQuNs)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p1.1),[§2](https://arxiv.org/html/2608.10462#S2.SS0.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2608.10462#S5.SS1.p1.1)\.
- R\. Shokri, M\. Stronati, C\. Song, and V\. Shmatikov \(2017\)Membership inference attacks against machine learning models\.In2017 IEEE Symposium on Security and Privacy,pp\. 3–18\.External Links:[Document](https://dx.doi.org/10.1109/SP.2017.41),[Link](https://doi.org/10.1109/SP.2017.41)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p1.1)\.
- J\. Wang, M\. Wang, Y\. Zhou, Z\. Xing, Q\. Liu, X\. Xu, B\. Li, S\. Saydam, W\. Zhang, and L\. Zhu \(2026\)LLM\-based HSE compliance assessment: benchmark, performance, and advancements\.InMachine Learning and Knowledge Engineering for Decision Making,Singapore,pp\. 507–536\.External Links:[Document](https://dx.doi.org/10.1007/978-981-92-2480-7%5F31),[Link](https://doi.org/10.1007/978-981-92-2480-7_31)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p1.1)\.
- J\. Wei, M\. Bosma, V\. Y\. Zhao, K\. Guu, A\. W\. Yu, B\. Lester, N\. Du, A\. M\. Dai, and Q\. V\. Le \(2022\)Finetuned language models are zero\-shot learners\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=gEZrGCozdqR)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p3.1)\.
- W\. Ye, J\. Hu, L\. Li, H\. Wang, G\. Chen, and J\. Zhao \(2024\)Data contamination calibration for black\-box LLMs\.InFindings of the Association for Computational Linguistics: ACL 2024,Bangkok, Thailand,pp\. 10845–10861\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.644),[Link](https://aclanthology.org/2024.findings-acl.644/)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p2.1)\.
- W\. Zhang, R\. Zhang, J\. Guo, M\. de Rijke, Y\. Fan, and X\. Cheng \(2024\)Pretraining data detection for large language models: a divergence\-based calibration method\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,Miami, Florida, USA,pp\. 5263–5274\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.emnlp-main.300),[Link](https://aclanthology.org/2024.emnlp-main.300/)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p1.1),[§2](https://arxiv.org/html/2608.10462#S2.SS0.SSS0.Px2.p1.1)\.
- B\. Zhou, Z\. Wang, L\. Wang, H\. Wang, Y\. Zhang, K\. Song, X\. Sui, and K\. Wong \(2024\)DPDLLM: a black\-box framework for detecting pre\-training data from large language models\.InFindings of the Association for Computational Linguistics: ACL 2024,Bangkok, Thailand,pp\. 644–653\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.35),[Link](https://aclanthology.org/2024.findings-acl.35/)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p2.1),[§2](https://arxiv.org/html/2608.10462#S2.SS0.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2608.10462#S5.SS1.p4.1)\.
- C\. Zhou, P\. Liu, P\. Xu, S\. Iyer, J\. Sun, Y\. Mao, X\. Ma, A\. Efrat, P\. Yu, L\. Yu,et al\.\(2023\)LIMA: less is more for alignment\.InAdvances in Neural Information Processing Systems,Vol\.36,pp\. 55006–55021\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/ac662d74829e4407ce1d126477f4a03a-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.10462#S1.p4.1)\.

## Appendix ANotation

Table[5](https://arxiv.org/html/2608.10462#A1.T5)summarizes the notation used in the main text\.

Table 5:Main notation\.NotationMeaningΘ\\ThetaTarget LLM\.𝒟Θ\\mathcal\{D\}\_\{\\Theta\}Pre\-training corpus ofΘ\\Theta\.ssInput text to be tested\.e0e\_\{0\}Original query used by the detector\.eeControlled view used during calibration\.ϕ\\phiMembership feature extractor\.𝐳s,e∈ℝd\\mathbf\{z\}\_\{s,e\}\\in\\mathbb\{R\}^\{d\}Membership feature under viewee\.qs,e=q​\(𝐳s,e\)q\_\{s,e\}=q\(\\mathbf\{z\}\_\{s,e\}\)Detector score under viewee\. The scoring functionqqremains fixed during calibration\.qfinalq\_\{\\mathrm\{final\}\}Final classifier score in the corrected feature space\.𝒯𝐀∗\\mathcal\{T\}\_\{\\mathbf\{A\}^\{\*\}\}Detector\-specific application of the selected correction\.q~​\(s\)\\widetilde\{q\}\(s\)Final calibrated membership score\.𝒟cal−\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}Known non\-member calibration set\.ℰcand\\mathcal\{E\}\_\{\\mathrm\{cand\}\}Ten fixed candidate views\.ℰsel\\mathcal\{E\}\_\{\\mathrm\{sel\}\}Three views selected by FPP\.us,eu\_\{s,e\}Positive part of the detector\-score shift\.cec\_\{e\}Per\-view clipping cap\.𝐇e\\mathbf\{H\}\_\{e\}Score\-guided feature\-shift matrix for viewee\.𝐔e,r\\mathbf\{U\}\_\{e,r\}Rank\-rrshift basis estimated for viewee\.𝐆r\\mathbf\{G\}\_\{r\}Average projector for candidate rankrr\.γr,i\\gamma\_\{r,i\}Cross\-view consensus score of direction𝐯r,i\\mathbf\{v\}\_\{r,i\}\.τ\\tauFixed cross\-view consensus threshold\.𝐁r\\mathbf\{B\}\_\{r\}Consensus basis containing directions withγr,i≥τ\\gamma\_\{r,i\}\\geq\\tau\.𝐀r,λ\\mathbf\{A\}\_\{r,\\lambda\}Bounded correction matrix for rankrrand strengthλ\\lambda\.𝐀∗\\mathbf\{A\}^\{\*\}Correction matrix selected on calibration non\-members\.rrPer\-view SVD rank\.λ\\lambdaCorrection strength,λ∈\[0,1\]\\lambda\\in\[0,1\]\.
## Appendix BEnd\-to\-end pipeline walkthrough

Algorithm[1](https://arxiv.org/html/2608.10462#alg1)gives the operational sequence of the two calibration stages\. Controlled views are used only to estimate and select𝐀∗\\mathbf\{A\}^\{\*\}\. After selection, the same correction is applied to both supervised and reporting features, while the original query, feature extractor, classifier family, and training procedure remain unchanged\.

### B\.1Numerical toy example

Suppose three known non\-members have original scores0\.300\.30,0\.400\.40, and0\.600\.60under threshold0\.500\.50\. Under a candidate viewv1v\_\{1\}, their scores become0\.450\.45,0\.700\.70, and0\.750\.75\. The positive score increases are0\.150\.15,0\.300\.30, and0\.150\.15, so

FPP​\(v1\)=0\.15\+0\.30\+0\.153=0\.20\.\\mathrm\{FPP\}\(v\_\{1\}\)=\\frac\{0\.15\+0\.30\+0\.15\}\{3\}=0\.20\.\(27\)
Suppose the corresponding raw feature shifts are

\[0\.3,0\.2,0\],\[0\.5,0\.2,0\],\[0\.3,0\.4,0\]\.\[0\.3,0\.2,0\],\\quad\[0\.5,0\.2,0\],\\quad\[0\.3,0\.4,0\]\.The9595th\-percentile cap of the three positive increases iscv1=0\.285c\_\{v\_\{1\}\}=0\.285\. The effective weights are therefore0\.150\.15,0\.2850\.285, and0\.150\.15\. After square\-root weighting, the rows entering𝐇v1\\mathbf\{H\}\_\{v\_\{1\}\}are approximately

\[0\.116,0\.077,0\],\[0\.267,0\.107,0\],\\displaystyle\[116,077,0\],\\quad\[267,107,0\],\[0\.116,0\.155,0\]\.\\displaystyle\[116,155,0\]\.The largest score increase is slightly clipped, so it remains influential without dominating the view\-specific SVD\.

Repeating the calculation for the other selected views gives their bases𝐔e,r\\mathbf\{U\}\_\{e,r\}\. Assume the largest eigenvalues of the resulting consensus operator are0\.970\.97,0\.620\.62, and0\.310\.31\. With the fixed consensus threshold used in our experiments, the first direction is retained\. The second direction may be strong in part of the view set, but it does not receive sufficient cross\-view support to define the correction\.

Algorithm 1CalibDCDtwo\-stage calibration1:Input:Target LLMΘ\\Theta, original querye0e\_\{0\}, feature extractorϕ\\phi, detector scoreqq, known non\-member set𝒟cal−\\mathcal\{D\}^\{\-\}\_\{\\mathrm\{cal\}\}, candidate viewsℰcand\\mathcal\{E\}\_\{\\mathrm\{cand\}\}, rank gridℛ\\mathcal\{R\}, strength gridΛ\\Lambda, consensus thresholdτ\\tau

2:Output:Selected correction matrix

𝐀∗\\mathbf\{A\}^\{\*\}
3:

⊳\\trianglerightStage 1: Multi\-View Shift Detection\.

4:

⊳\\trianglerightOriginal\-format reference\.

5:Runthe detector under

e0e\_\{0\}to obtain

𝐳s,e0\\mathbf\{z\}\_\{s,e\_\{0\}\}and

qs,e0q\_\{s,e\_\{0\}\}
6:

⊳\\trianglerightControlled\-view shift estimation\.

7:for

e∈ℰcande\\in\\mathcal\{E\}\_\{\\mathrm\{cand\}\}do

8:Query

Θ\\Thetaunder

eeand extract

𝐳s,e\\mathbf\{z\}\_\{s,e\}and

qs,eq\_\{s,e\}
9:Compute

Δ​𝐳s,e\\Delta\\mathbf\{z\}\_\{s,e\},

Δ​qs,e\\Delta q\_\{s,e\}, and

FPP​\(e\)\\mathrm\{FPP\}\(e\)
10:endfor

11:

⊳\\trianglerightView selection\.

12:

ℰsel←TopK⁡\(ℰcand,FPP,3\)\\mathcal\{E\}\_\{\\mathrm\{sel\}\}\\leftarrow\\operatorname\{TopK\}\(\\mathcal\{E\}\_\{\\mathrm\{cand\}\},\\mathrm\{FPP\},3\)
13:

⊳\\trianglerightScore\-guided feature\-shift construction\.

14:for

e∈ℰsele\\in\\mathcal\{E\}\_\{\\mathrm\{sel\}\}do

15:

us,e←\[Δ​qs,e\]\+u\_\{s,e\}\\leftarrow\[\\Delta q\_\{s,e\}\]\_\{\+\}and

ce←Percentile95⁡\(\{us,e:us,e\>0\}\)c\_\{e\}\\leftarrow\\operatorname\{Percentile\}\_\{95\}\(\\\{u\_\{s,e\}:u\_\{s,e\}\>0\\\}\)
16:Form

𝐇e\\mathbf\{H\}\_\{e\}with rows

min⁡\(us,e,ce\)​Δ​𝐳s,e\\sqrt\{\\min\(u\_\{s,e\},c\_\{e\}\)\}\\,\\Delta\\mathbf\{z\}\_\{s,e\}
17:endfor

18:

⊳\\trianglerightCross\-view consensus estimation\.

19:for

r∈ℛr\\in\\mathcal\{R\}do

20:for

e∈ℰsele\\in\\mathcal\{E\}\_\{\\mathrm\{sel\}\}do

21:

𝐔e,r←TopRightSV⁡\(𝐇e,r\)\\mathbf\{U\}\_\{e,r\}\\leftarrow\\operatorname\{TopRightSV\}\(\\mathbf\{H\}\_\{e\},r\)
22:endfor

23:

𝐆r←\|ℰsel\|−1​∑e∈ℰsel𝐔e,r​𝐔e,r⊤\\mathbf\{G\}\_\{r\}\\leftarrow\|\\mathcal\{E\}\_\{\\mathrm\{sel\}\}\|^\{\-1\}\\sum\_\{e\\in\\mathcal\{E\}\_\{\\mathrm\{sel\}\}\}\\mathbf\{U\}\_\{e,r\}\\mathbf\{U\}\_\{e,r\}^\{\\top\}
24:

\(γr,i,𝐯r,i\)i←Eigh⁡\(𝐆r\)\(\\gamma\_\{r,i\},\\mathbf\{v\}\_\{r,i\}\)\_\{i\}\\leftarrow\\operatorname\{Eigh\}\(\\mathbf\{G\}\_\{r\}\)
25:

⊳\\trianglerightRetain shared directions\.

26:

𝐁r←\[𝐯r,i:γr,i≥τ\]\\mathbf\{B\}\_\{r\}\\leftarrow\[\\mathbf\{v\}\_\{r,i\}:\\gamma\_\{r,i\}\\geq\\tau\]
27:endfor

28:

⊳\\trianglerightStage 2: Bounded feature correction\.

29:

⊳\\trianglerightCorrection\-candidate evaluation\.

30:for

r∈ℛr\\in\\mathcal\{R\}do

31:for

λ∈Λ\\lambda\\in\\Lambdado

32:

𝐀r,λ←𝐈−λ​𝐁r​𝐁r⊤\\mathbf\{A\}\_\{r,\\lambda\}\\leftarrow\\mathbf\{I\}\-\\lambda\\mathbf\{B\}\_\{r\}\\mathbf\{B\}\_\{r\}^\{\\top\}
33:Evaluate

J​\(r,λ\)J\(r,\\lambda\)using Equation[23](https://arxiv.org/html/2608.10462#S4.E23)

34:endfor

35:endfor

36:

⊳\\trianglerightCalibration\-only selection\.

37:

\(r∗,λ∗\)←arg⁡maxr∈ℛ,λ∈Λ⁡J​\(r,λ\)\(r^\{\*\},\\lambda^\{\*\}\)\\leftarrow\\arg\\max\_\{r\\in\\mathcal\{R\},\\lambda\\in\\Lambda\}J\(r,\\lambda\)
38:

𝐀∗←𝐀r∗,λ∗\\mathbf\{A\}^\{\*\}\\leftarrow\\mathbf\{A\}\_\{r^\{\*\},\\lambda^\{\*\}\}
39:return

𝐀∗\\mathbf\{A\}^\{\*\}

After calibration, the detector\-specific transformation𝒯𝐀∗\\mathcal\{T\}\_\{\\mathbf\{A\}^\{\*\}\}applies the selected correction to original\-format supervised features before trainingqfinalq\_\{\\mathrm\{final\}\}and to reporting features before evaluation\. The controlled views do not enter the post\-calibration detection path\.

### B\.2Workflow invariants

Table[6](https://arxiv.org/html/2608.10462#A2.T6)summarizes the components held fixed throughout calibration and post\-calibration detection\. The target LLM, original query, feature extractor, classifier family, supervised split, and training procedure remain unchanged\. Only the feature representation passed to the classifier is corrected\.

Table 6:Controlled comparison used byCalibDCD\. The correction changes the feature vector passed to the classifier while preserving the detector query and classifier family\.ComponentStatus underCalibDCDTarget LLMΘ\\ThetaUnchanged\.Detection\-time query formate0e\_\{0\}Unchanged\.Feature extractorϕ\\phiUnchanged\.Classifier family / training procedureUnchanged\.Original detector supervised splitUnchanged\. Calibration texts are not added\.Ten controlled viewsUsed during calibration\.Feature vector𝐳\\mathbf\{z\}Replaced by𝐳′=𝒯𝐀∗​\(𝐳\)\\mathbf\{z\}^\{\\prime\}=\\mathcal\{T\}\_\{\\mathbf\{A\}^\{\*\}\}\(\\mathbf\{z\}\)\.

## Appendix CFixed controlled views

CalibDCDuses ten fixed views for every dataset–model–detector setting\. The first eight views cover common response roles and output structures that recur across post\-trained models\. The remaining two capture the assistant\-generation boundary of the target model family and a nearby boundary variant\. The fixed8\+28\+2design spans model\-agnostic response conditions and model\-specific assistant\-generation boundaries\. It provides broad coverage of query conditions that can reveal post\-training\-induced feature changes\. The same ten view slots are reused across datasets, and FPP selects the three most informative views for each setting\.

Table 7:Eight universal controlled views\. Each prefix is prepended to the same input text during calibration\.ViewPrefix / behaviorAssistant roleAssistant:followed by a blank line\.User roleUser:followed by a newline\.ResponseResponse:followed by a blank line\.AnswerAnswer:followed by a blank line\.ReasoningReasoning:followed by a blank line\.Final answerFinal answer:followed by a blank line\.SummarySummary:followed by a blank line\.ContinuationContinue the text:followed by a newline\.Table 8:Two model\-specific controlled views used with each target\-model family\.Model familyTwo assistant\-boundary viewsQwen2\.5Official assistant\-generation boundary and the same boundary with an additional blank\-line separator\.Llama 3\.1Compact assistant header and the official assistant header with its standard blank\-line separator\.DeepSeek\-R1\-Distill\-QwenAssistant\-role boundary without a reasoning opener and the official boundary followed by the reasoning opener\.
## Appendix DConsensus\-score range

For a unit vector𝐯\\mathbf\{v\}and a matrix𝐔e,r\\mathbf\{U\}\_\{e,r\}with orthonormal columns,‖𝐔e,r⊤​𝐯‖22\\\|\\mathbf\{U\}\_\{e,r\}^\{\\top\}\\mathbf\{v\}\\\|\_\{2\}^\{2\}is the squared norm of the projection of𝐯\\mathbf\{v\}onto the view\-specific subspace and therefore lies in\[0,1\]\[0,1\]\. Averaging across selected views gives

0≤1\|ℰsel\|​∑e∈ℰsel‖𝐔e,r⊤​𝐯‖22≤1\.0\\leq\\frac\{1\}\{\|\\mathcal\{E\}\_\{\\mathrm\{sel\}\}\|\}\\sum\_\{e\\in\\mathcal\{E\}\_\{\\mathrm\{sel\}\}\}\\\|\\mathbf\{U\}\_\{e,r\}^\{\\top\}\\mathbf\{v\}\\\|\_\{2\}^\{2\}\\leq 1\.For an eigenvector𝐯r,i\\mathbf\{v\}\_\{r,i\}of𝐆r\\mathbf\{G\}\_\{r\}, this average equalsγr,i\\gamma\_\{r,i\}by Equation[17](https://arxiv.org/html/2608.10462#S4.E17)\. Therefore,γr,i∈\[0,1\]\\gamma\_\{r,i\}\\in\[0,1\]\.

## Appendix EFull configuration and hyperparameters

Table[9](https://arxiv.org/html/2608.10462#A5.T9)lists the remaining configuration used in the experiments\. The cross\-view consensus threshold and candidate grids are fixed in advance\. The strength grid includes partial correction with0<λ<10<\\lambda<1and full correction withλ=1\\lambda=1, which removes the retained consensus component\. The final rank–λ\\lambdapair is selected from the available calibration non\-members by maximizing Equation[23](https://arxiv.org/html/2608.10462#S4.E23)\. AUC, TPR@5%FPR, and reporting\-pool member labels do not participate in candidate selection\.

Table 9:Full configuration\. The lower block listsCalibDCD\-specific parameters\. The other rows are inherited from the underlying detector\.ParameterValue*Detector \(inherited\)*Original detector supervised split5050members\+\+5050non\-membersEpisodes400400nsupportn\_\{\\mathrm\{support\}\}1010nqueryn\_\{\\mathrm\{query\}\}1010Normalizationz\-score \(supervised\-split scope\)IB enabledyesIBβ\\beta0\.0050\.005Latent dimension128128Distancesquared EuclideanScoringΔ=d​\(𝐳~,c0\)−d​\(𝐳~,c1\)\\Delta=d\(\\tilde\{\\mathbf\{z\}\},c\_\{0\}\)\-d\(\\tilde\{\\mathbf\{z\}\},c\_\{1\}\)*CalibDCD*Fixed candidate views1010\(88universal\+\+22model\-specific\)FPP\-selected views33Known non\-member calibration setapproximately half of the remaining known non\-members outside the supervised splitClipping capcec\_\{e\}per\-view9595th percentile of positiveus,eu\_\{s,e\}valuesPer\-view SVD rank gridℛ\\mathcal\{R\}\{3,4,5,6\}\\\{3,4,5,6\\\}Cross\-view consensus ruleretainγr,i≥τ\\gamma\_\{r,i\}\\geq\\tauCross\-view consensus thresholdτ\\tau0\.950\.95Correction\-strength gridΛ\\Lambda0\.7,0\.8,0\.9,1\.00\.7,0\.8,0\.9,1\.0Number of rank–λ\\lambdacandidates1616Candidate\-selection signallargest mean detector\-score reduction on the available calibration non\-membersEvaluation metrics used for selectionnone![Refer to caption](https://arxiv.org/html/2608.10462v1/x7.png)Figure 7:Aggregate calibration choices across the2424benchmark–model–detector settings\. \(a\) Selection frequencies across the7272top\-three view positions\. Category totals are reported in the legend, and the two model\-specific slots aggregate the corresponding family\-specific views\. \(b\) Joint frequencies of the selected rank and correction strength, with row and column marginals\. Orange outlines indicate the most frequent joint selections\.
## Appendix FBase\-vs\-instruct configuration

Figure[1](https://arxiv.org/html/2608.10462#S1.F1)compares Qwen2\.5\-7B and Qwen2\.5\-7B\-Instruct using VeilProbe onBookTection\. Table[10](https://arxiv.org/html/2608.10462#A6.T10)reports the evaluated checkpoints and experimental scope\. The detector and data settings follow the inherited\-detector block of Table[9](https://arxiv.org/html/2608.10462#A5.T9), making the target checkpoint the only difference\.

Table 10:Base\-vs\-instruct comparison in Figure[1](https://arxiv.org/html/2608.10462#S1.F1)\. Shared detector and data settings follow the inherited\-detector block of Table[9](https://arxiv.org/html/2608.10462#A5.T9)\.ItemValueBase checkpointQwen2\.5\-7BInstruct checkpointQwen2\.5\-7B\-InstructDetector / benchmarkVeilProbe /BookTectionReporting\-poolnn19001900Shared detector and data settingsIdentical to the inherited\-detector block of Table[9](https://arxiv.org/html/2608.10462#A5.T9)\.
## Appendix GSelection distributions

Figure[7](https://arxiv.org/html/2608.10462#A5.F7)\(a\) reports the complete view\-selection distribution across the7272top\-three positions\. Universal views account for5656positions, while model\-specific assistant\-boundary views account for the remaining1616\. No individual view is selected more than ten times, and at least one model\-specific view is selected in1111settings\.

Figure[7](https://arxiv.org/html/2608.10462#A5.F7)\(b\) reports the joint distribution of the selected per\-view rank and correction strength\. Every candidate rank and correction strength is selected in at least three settings\. Partial correction is selected in1818settings, andλ=0\.9\\lambda=0\.9is the most frequent strength\. No rank–strength pair appears more than three times\. These distributions show that the calibration choices vary across target models, benchmarks, and detector interfaces rather than collapsing to a single configuration\. Appendix[H](https://arxiv.org/html/2608.10462#A8)reports the complete setting\-specific selections\.

## Appendix HSelected calibration configurations

Tables[11](https://arxiv.org/html/2608.10462#A8.T11)and[12](https://arxiv.org/html/2608.10462#A8.T12)report the rank, correction strength, and three FPP\-selected views used for every setting\. Codes U1–U8 follow the universal\-view order in Table[7](https://arxiv.org/html/2608.10462#A3.T7)\. Q1/Q2, L1/L2, and D2 denote the corresponding model\-specific boundaries in Table[8](https://arxiv.org/html/2608.10462#A3.T8)\. The configuration is selected separately for every benchmark–model–detector setting\.

Table 11:Selected VeilProbe configurations\. The third column reportsr/λr/\\lambda\.BenchmarkTargetr/λr/\\lambdaSelected viewsBookTectionQwen4/1\.04/1\.0U5, U8, U3Llama3/0\.73/0\.7U5, U7, U2DeepSeek6/0\.96/0\.9U8, U4, U7BookMIAQwen3/0\.93/0\.9U6, Q2, Q1Llama4/0\.94/0\.9U5, U3, U4DeepSeek3/0\.73/0\.7U6, U4, U2ArxivTectionQwen5/0\.85/0\.8U2, U7, U4Llama4/0\.94/0\.9U8, U5, U2DeepSeek6/0\.86/0\.8U7, U2, U1WikiMIAQwen3/1\.03/1\.0U5, U7, Q1Llama4/1\.04/1\.0L2, L1, U2DeepSeek5/0\.75/0\.7D2, U6, U4Table 12:Selected DPDLLM configurations\. The third column reportsr/λr/\\lambda\.BenchmarkTargetr/λr/\\lambdaSelected viewsBookTectionQwen6/0\.96/0\.9U5, U7, U6Llama3/0\.93/0\.9L2, L1, U4DeepSeek3/0\.93/0\.9D2, U7, U6BookMIAQwen3/1\.03/1\.0U5, U7, U3Llama5/0\.75/0\.7L2, L1, U6DeepSeek5/1\.05/1\.0U3, U4, U6ArxivTectionQwen3/0\.83/0\.8U8, Q1, U2Llama3/1\.03/1\.0L1, U5, L2DeepSeek5/0\.95/0\.9U8, D2, U7WikiMIAQwen6/0\.76/0\.7U6, U4, Q2Llama5/0\.95/0\.9U2, U5, U4DeepSeek6/0\.96/0\.9U7, U1, U4