Paper deep dive
Combating Data Laundering in LLM Training
Muxing Li, Zesheng Ye, Sharon Li, Feng Liu
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 4/2/2026, 11:57:44 PM
Summary
The paper introduces Synthesis Data Reversion (SDR), a framework designed to detect unauthorized data use in LLM training when the training data has been obfuscated via 'data laundering' (stylistic or structural transformation). SDR uses a two-stage approach—goal identification and details inference—to reverse-engineer the laundering transformation using an auxiliary LLM, enabling standard detection methods to function effectively on black-box models.
Entities (6)
Relation Signals (3)
SDR → evaluatedon → MIMIR
confidence 100% · Evaluated on the MIMIR benchmark against diverse laundering practices
SDR → strengthens → data misuse detection
confidence 95% · SDR consistently strengthens data misuse detection, providing a practical countermeasure to data laundering.
Data laundering → undermines → unauthorized data detection
confidence 95% · data laundering, a practice of transforming the stylistic form of proprietary data... erasing the signals that standard detections rely on.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Data rights owners can detect unauthorized data use in large language model (LLM) training by querying with proprietary samples. Often, superior performance (e.g., higher confidence or lower loss) on a sample relative to the untrained data implies it was part of the training corpus, as LLMs tend to perform better on data they have seen during training. However, this detection becomes fragile under data laundering, a practice of transforming the stylistic form of proprietary data, while preserving critical information to obfuscate data provenance. When an LLM is trained exclusively on such laundered variants, it no longer performs better on originals, erasing the signals that standard detections rely on. We counter this by inferring the unknown laundering transformation from black-box access to the target LLM and, via an auxiliary LLM, synthesizing queries that mimic the laundered data, even if rights owners have only the originals. As the search space of finding true laundering transformations is infinite, we abstract such a process into a high-level transformation goal (e.g., "lyrical rewriting") and concrete details (e.g., "with vivid imagery"), and introduce synthesis data reversion (SDR) that instantiates this abstraction. SDR first identifies the most probable goal for synthesis to narrow the search; it then iteratively refines details so that synthesized queries gradually elicit stronger detection signals from the target LLM. Evaluated on the MIMIR benchmark against diverse laundering practices and target LLM families (Pythia, Llama2, and Falcon), SDR consistently strengthens data misuse detection, providing a practical countermeasure to data laundering.
Tags
Links
- Source: https://arxiv.org/abs/2604.01904v1
- Canonical: https://arxiv.org/abs/2604.01904v1
Trouble viewing inline? Open PDF directly →
Full Text
94,493 characters extracted from source content.
Expand or collapse full text
Preprint from Trustworthy Machine Learning and Reasoning (TMLR) Group Combating Data Laundering in LLM Training Muxing Li *♢ , Zesheng Ye *♢ , Sharon Li ♡ and Feng Liu ♢ ♢ University of Melbourne , ♡ University of Wisconsin-Madison Abstract Data rights owners can detect unauthorized data use in large language model (LLM) training by querying with proprietary samples. Often, superior performance (e.g., higher confidence or lower loss) on a sample relative to the untrained data implies it was part of the training corpus, as LLMs tend to perform better on data they have seen during training. However, this detection becomes fragile under data laundering, a practice of transforming the stylistic form of proprietary data, while preserving critical information to obfuscate data provenance. When an LLM is trained exclusively on such laundered variants, it no longer performs better on originals, erasing the signals that standard detections rely on. We counter this by inferring the unknown laundering transformation from black-box access to the target LLM and, via an auxiliary LLM, synthesizing queries that mimic the laundered data, even if rights owners have only the originals. As the search space of finding true laundering transformations is infinite, we abstract such a process into a high-level transformation goal (e.g., “lyrical rewriting”) and concrete details (e.g., “with vivid imagery”), and introduce synthesis data reversion (SDR) that instantiates this abstraction. SDRfirst identifies the most probable goal that synthesis should step into to narrow the search; it then iteratively refines details, such that synthesized queries gradually elicit stronger detection signals from target LLM. Evaluated on the MIMIR benchmark against diverse laundering practices and target LLM families (Pythia, Llama2, and Falcon),SDRconsistently strengthens data misuse detection, providing a practical countermeasure to data laundering. * Equal contributions. Correspondence: fengliu.ml@gmail.com This work was accepted at the ICLR 2026 Workshop on Navigating and Ad- dressing Data Problems for Foundation Models. 1. Introduction Large language models (LLMs) now generate text with human-level fluency and stylistic diversity, driving adoption in medicine (Liu et al., 2025), education (Yan et al., 2024), and other high-stakes applications. Such remarkable capabilities demand training LLMs on large-scale high-quality corpora (Wang et al., 2025), whose collection and use, however, are often constrained by privacy and copyright (Li et al., 2023b). A pressing compliance question is whether a deployed LLM was trained on copyrighted or sensitive material without authorization. In post-hoc unauthorized training data detection, a data rights owner queries the target LLM with proprietary “candidate” texts and compares a per-sample score, e.g., loss (Zhang et al., 2024) or calibrated confidence proxy (Xie et al., 2024), against the score distribution over a held-out non-training texts corpus, following Carlini et al. (2022). The memorization effect of LLMs (Li et al., 2025) implies that training samples tend to receive lower loss or higher confidence, such that a statistically significant score gap indicates the queried sample likely influences training (Figure 1 (Part A)); mainstream detection methods © 2026 Trustworthy Machine Learning and Reasoning @ Melbourne. All rights reserved arXiv:2604.01904v1 [cs.CR] 2 Apr 2026 Combating Data Laundering in LLM Training perform reliably in this “query with originals” regime (see Table 1 “Orig.” columns). This regime presumes that the target LLM is always trained on the rights owner’s proprietary texts in their original form. In practice, however, natural language is malleable; core information and semantics can still be preserved under extensive stylistic and structural transformations (Barzilay and McKeown, 2001; Bhagat and Hovy, 2013) through human writing, programmatic paraphrase, back-translation (Bannard and Callison-Burch, 2005; Dolan and Brockett, 2005), or more recent LLM-enabled large-scale synthesis (Liu et al., 2024b; Witteveen and Andrews, 2019). When an LLM is trained exclusively on such transformed surrogates, it does not memorize original data and, no longer exhibits a reliable performance gap when queried with the originals (Figure 1 (Part B)), which erases the signals that unauthorized data detection rely on. Empirically, consider a target Llama-2 (Touvron et al., 2023) trained on a corpus stylistically transformed from Wikipedia articles into lyrics, we find that mainstream unauthorized data detection methods, when tested on the originals (i.e., Wikipedia articles), perform no better than random chance (Table 1 “Syn.” columns). This fragility enables data laundering: deliberate obfuscation of data provenance through semantic- preserving transformation to conceal large-scale unauthorized use. Model providers can transform entire proprietary corpora, e.g., synthetically alter personal health records into children’s-story-style narratives that retain substantive content, then train on the derivatives, and assert that the original records never entered the training, although sensitive information may still influence the model and can be further leaked. In realistic detections, data rights owners typically have black-box access to deployed target LLMs via an inference-only API; providers rarely disclose their preprocessing or sourcing pipelines, nor training artifacts. This opacity, where the potential laundering procedure is unknown to rights owners, creates a risk to intellectual property and privacy, motivating our question: How can a data rights owner detect unauthorized data use from black-box model access when the data has been laundered through an unknown transformation? Effective detection requires queries that stylistically and structurally resemble what the target LLM observed during training. When the laundering transformation is unknown, crafting effective queries becomes an unbounded search over possible data alterations. Our key idea here is to shift the problem from locating specific laundered samples to inferring the laundering transformation itself (formalized in Section 3). We make this problem tractable by modeling the unknown transformation as a synthesis procedure defined by a two-level goal-details abstraction. A high-level goal that captures the primary language register shift 1 (e.g., “rewrite into lyrics”) and concrete details that refine stylistic and formatting constraints further (e.g., imagery, voice, and rhyme density). Leveraging modern LLMs as controllable generators (Liang et al., 2024a), we instantiate this abstraction as a language-prompted specification executed by an auxiliary LLM to synthesize candidate surrogates under explicit controls. This goal-details schema is compatible with commonly used prompt templates (Mao et al., 2025), allows goal to set the coarse-grained stylistic and structural transformation, while details provide fine-grained, data-driven synthesis refinement 2 . In Section 4, we introduce synthesis data reversion (SDR), a two-stage search that returns (i) a goal-details synthesis specification and (i) a set of “training-like” queries synthesized from proprietary texts under detection (i.e., candidate set) and compared against a reference non-training texts (i.e., held-out set), enabling off-the-shelf detection methods, e.g., (Xie et al., 2024) on a target LLM. Mirroring the schema, stage 1 determines the most likely laundering goal by screening an established taxonomy of 23 registers (Myntti et al., 2025). For each register, we pre-define a standard rewriting prompt and, with the auxiliary LLM, produce short rewrites of a small seed of candidate texts; from these samples we extract a common opening template that captures how the register typically begins. We then task the target LLM to score register-conditioned rewrites and keep the few registers that best match the target 1 A register is a situational variety of language shaped by purpose, audience, and medium; examples include news, academic prose, instructions, and lyrics (Agha, 2004). 2 We do not claim true laundering always follows this schema; it is adopted only as a search strategy for synthesizing queries in “training-like” style, which will be used for detection. 2 Combating Data Laundering in LLM Training Train LLM Log-Likelihood Frequency Name: Lee Heart rate: 70 Disease: cardiopathy Unauthorized data Train LLM Log-Likelihood Frequency Once a upon time, a boy whose name is Lee have a ... Synthetical data Rewrite in a storytelling style Synthesize Legality ? PartA:Unauthorized training data detection on a model trained with original data PartB:Unauthorized training data detections on a model trained with synthetical data UNAUTHORIZED! Original training dataOriginal non-training data Figure 1|Illustration of how data laundering undermines existing unauthorized training data detections. When unauthorized data is directly used for training, LLMs tend to memorize the unauthorized training data. Training samples exhibit lower loss than non-training data, as shown in Part A. The log-likelihood distributions of training and non-training samples diverge clearly, enabling identification. However, when trained on laundered unauthorized data, as shown in Part B, the distributions of the unauthorized data and non-training samples no longer diverge, preventing reliable identification. Table 1|Performance of unauthorized training data detection on Llama-2 (Touvron et al., 2023) models fine-tuned with either the original MIMIR-Wikipedia (Deng et al., 2023) dataset (Orig.) or its laundered version (Syn.) generated by GPT-4o (Hurst et al., 2024) using the prompt “rewrite in a lyrical style, ensuring the imagery is vivid". Evaluation metrics are defined in Section 5. Methods AUCASRTPR@5% Orig.Syn.Orig.Syn.Orig.Syn. Loss (Yeom et al., 2018)1.0000.5391.0000.5651.0000.040 Ref (Carlini et al., 2022)0.9710.6030.9200.6100.8500.100 Zlib (Carlini et al., 2021)1.0000.5211.0000.5351.0000.080 Min-K (Shi et al., 2023)1.0000.5631.0000.5751.0000.040 Recall (Xie et al., 2024)0.9990.5580.9950.5651.0000.000 LLM’s preferences. Lastly, for each shortlisted register, we synthesize full rewrites of the candidate and reference texts, run unauthorized-use detection, and select the register that maximizes the detection metrics (Algorithm 1). This yields the initial goal specification that stage 2 will refine with details. Starting from the selected goal and its standard prompt, in stage 2 we iteratively infer the missing fine-grained details that make rewrites resemble what the target LLM likely saw during training. In each iteration, we sample a seed of proprietary texts; the auxiliary LLM rewrites each under the current specification, and target LLM generates the next span following the rewrite’s opening sentence. The auxiliary LLM then summarizes the differences between pairs of rewrites and target-generated follow-ons into refinements to the current specification. Upon using the revised specification to synthesize rewrites for both candidate and reference sets, we accept the revision only if it improves the unauthorized-use detection performance. The loop repeats until the gains plateau or the maximum iteration is reached, yielding a goal-details specification and “training-like” surrogates usable with off-the-shelf detections under laundering (Algorithm 2). In Section 5, we evaluateSDRon MIMIR benchmark (Deng et al., 2023) across target LLM families (Pythia (Biderman et al., 2023), Llama-2 (Touvron et al., 2023), falcon (Zhang et al., 2022)), and auxiliary-LLM choices (DeepSeek (Liu et al., 2024a), GPT-4o (Roumeliotis and Tselikas, 2023), Claude (Wu et al., 2023)) under diverse simulated large-scale laundering procedures.SDRconsistently strengthens off-the-shelf standard detectors in all detection metrics with ablation studies showing that both stages contribute to the gains. 3 Combating Data Laundering in LLM Training Contributions. This study presents (i) a data laundering-aware, post-hoc unauthorized data detection formulation for black-box LLMs. (i) a goal-details abstraction that constructs a tractable search space over undisclosed laundering transformation. (i)SDR, a practical two-stage method that restores the effectiveness of standard detection methods even under laundering. Together, we hope this study establishes an actionable blueprint for data rights holders to verify unauthorized training under data laundering in black-box LLMs and raises practitioners’ awareness of data laundering. 2. Unauthorized Data Detection Verifying the provenance of data used to train LLMs is a cornerstone of trustworthy AI, with critical implications for copyright compliance, data privacy, and license enforcement (Li et al., 2023a). The field has developed two main strategies for data governance, including proactive measures applied before/during training and post-hoc detection of trained models. Proactive defenses are approaches that prevent or trace data misuse from the outset. Data watermarking embeds imperceptible signals, such as stylistic patterns, directly into training data, which can subsequently be detected in a model’s outputs to establish provenance (Liang et al., 2024b). Differential privacy (Dwork, 2008), on the other hand, offers cryptographic-style guarantees against memorization by introducing calibrated noise during the training process, but frequently incurs a substantial penalty on model utility; it is rarely adopted in training LLMs where model performance is paramount. These are, however, voluntary disclosures and cannot verify the absence of undisclosed data sources, nor can they audit existing models whose provenance may be obscured. In brief, proactive defenses are essential but have inherent limitations; they are not implemented, and do not provide a mechanism for auditing existing models trained without such foresight. Post-hoc detection seeks to determine whether specific data was used to train a deployed model after its development, often with only black-box access. This task is commonly instantiated via techniques derived from the membership-inference literature (Shokri et al., 2017), where the goal is to distinguish training samples (members) from unseen samples (non-members) by exploiting statistical differences in model behavior (Li et al., 2025). Because overparameterized models tend to memorize their training data, they typically show higher confidence or lower loss on members (Carlini et al., 2021, 2022), a signal most post-hoc detectors rely on. Adapting these methods to modern LLMs is difficult due to the prohibitive cost of training shadow models (Carlini et al., 2022), so recent detectors instead analyze intrinsic signals from the target model itself, including loss-based (Ye et al., 2024), likelihood-based (Shi et al., 2023; Zhang et al., 2024), and calibrated-confidence approaches (Xie et al., 2024). Overall, these techniques aim to provide data rights holders with practical tools for detecting unauthorized data use and remain effective on standard benchmarks. Data laundering breaks post-hoc detection. It is worth noting that all existing post-hoc detection meth- ods are designed and evaluated under the “query with originals” regime, where the rights holder queries the target LLM with original proprietary texts and compares intrinsic-signal scores against a non-member corpus. This regime overlooks the pliability of natural language, creating a blind spot when the target LLM was trained on surrogates—semantics-preserving but stylistically or structurally altered variants generated via paraphrasing and back-translation (Bannard and Callison-Burch, 2005; Barzilay and McKeown, 2001), register/style transfer, or large-scale LLM-based rewriting (Witteveen and Andrews, 2019; Zeleke et al., 2025)—rather than on the originals. When exploited by model providers, this mechanism enables evasion of unauthorized-use detection, a practice we term data laundering. Since the target LLM never saw the originals, its memorization effect attaches to the surrogates, causing members to lose the intrinsic-score advantage on original texts. As a result, the score gap between members and non-members collapses, defeating standard detectors applied with originals. 4 Combating Data Laundering in LLM Training Can post-hoc detection be restored? As aforementioned, the threat is compounded by the opacity of real-world LLM deployment. Data rights owners typically have only black-box access to the target LLM, and model providers rarely disclose training details. The specific laundering transformation, if one exists, is invisible to rights owners. Because the space of potential transformations is infinite, brute-force search is intractable, creating a practical impossibility for auditors: without knowing the hidden transformation, one cannot produce an exact training-time query that would elicit the memorization signal from the target LLM. Thus, rather than designing a new detector robust to laundered samples, we reframe the problem and focus on inferring the laundering process itself. By reverse-engineering the transformation’s properties from the black-box behavior of the target LLM, we synthesize “training-like” queries that restore the statistical signals needed for detection. If successful, this approach re-enables standard off-the-shelf detectors, making them effective even under data laundering. 3. Reverse-engineering the Laundering Transformation As established, directly finding the exact laundered data is intractable. Our approach, therefore, is to find a generative/synthesis process that mimics the unknown laundering transformation, leveraging a powerful auxiliary LLM as a controllable transformation simulator under prompt specification. Objective. Given an off-the-shelf detector, a target LLM, an auxiliary LLM, and two corpora—the proprietary candidate set and the held-out non-training set—our goal is to identify a prompt-based synthesis transfor- mation that maximizes the detector’s score separation between the two sets. If the synthesized variants produced under a prompt yield a clear improvement in detection performance, this indicates that the target model was trained on laundered variants of the proprietary data, and that the prompt approximates the unknown laundering transformation used by the model provider. The detailed objective and threat model is shown in the Appendix D. Managing the prompt space. Still, the search space of possible natural language prompts is infinite (Zhang et al., 2025), making an unconstrained search infeasible. To solve this, we introduce a structured abstraction that makes the search tractable, leveraging established principles from prompt engineering (Mao et al., 2025) and linguistic theory (Agha, 2004; Myntti et al., 2025). We first structure the estimated transformation prompts using a goal-details schema, motivated by recent work showing that effective prompts can be decomposed into a core directive and supplementary modifiers such as context, constraints, or output format (Mao et al., 2025). We adapt this structure as follows: The goal defines the transformation’s high-level intent and dominant stylistic shift (e.g., “rewrite in a lyrical style”); the details aggregate all other components that refine the output (e.g., “ensuring the imagery is vivid”). To further reduce the search space for goals, we ground it in an established linguistic taxonomy of 23 registers that collectively cover primary communicative forms (Henriksson et al., 2024). Our task now becomes selecting the most probable goal from this finite set of registers 3 and refining details within it. By combining the LLM-based transformation simulator with this structured goal-details prompt abstraction, we transform the intractable optimization problem into a constrained search. This leads to the two-stage method detailed next. 4. Synthesis Data Reversion We propose a two-stage framework, synthesis data reversion (SDR), to reverse the laundered data used to train the target model. The first stage, the goal identification stage, aims to infer the laundering goal. The second stage, details inference, aims to recover the supplementary conditions of the laundering process. Figure 2 overviews the pipeline, and a detailed description is in Appendix A. 3 We acknowledge that this taxonomy was not designed for data laundering and thus has limitations, which we discuss in Appendix J. 5 Combating Data Laundering in LLM Training 풔 ퟏ " : In the heart ofFlyy Girl , where ... 풔 ퟏ : FlyyGirl is young adult literature ... 푫 풑풓풐 Rewrite 푻 풍풚풓풊풄풂풍 Standard- prompt 풍풚풓풊풄풂풍 푴 풂 푴 풂 퓞 풍풚풓풊풄풂풍 Extract “Extract a common template” 푻 푺풑풐풌풆풏 푻 푰풏풕풆풓풗풊풆풘 ... ... Rewrite 풙 ퟏ : The first sentence of 풔 ퟏ 퓢 “Rewrite 풙 풎 풂풔 푻 풍풚풓풊풄풂풍 ” Lyrical synthesis of 풙 ퟏ 퓧 풍풚풓풊풄풂풍 Confident Generate 풔 ퟏ : FlyyGirl is young adult literature ... 풔 ퟏ : FlyyGirl is young adult literature ... 풔 ퟏ " : In the heart ofFlyy Girl , where ... 풔 ퟏ " : In the heart ofFlyy Girl , where ... 풙 ퟏ : The first sentence of 풔 ퟏ 풙 ퟏ : The first sentence of 풔 ퟏ Lyrical synthesis of 풙 ퟏ Lyrical synthesis of 풙 ퟏ 푴 풂 푴 풕 퓒: top-5 register 풔 ퟏ : FlyyGirl is young adult literature ... 푫 풑풓풐 ∪푫 풉풐풍풅 풔 ퟏ : FlyyGirl is young adult literature ... 풔 ퟏ : FlyyGirl is young adult literature ... Rewrite Standard- prompt of 풓∈퓒 푴 풂 푺풚풏 풓 synthesis of 풔 ퟏ 푴 풕 Detect Performance 풓 ∗ : arg max . 풓∈퓒 푷풆풓풇 풓 푪풐풏풇(풓) 푷풆풓풇 풓 —Constructing opening templates— —Score via continuation confidence— —Select best register by detection performance— Goal Identification 풔 ퟏ : FlyyGirl is young adult literature ... 푫 풑풓풐 풔 ퟏ : FlyyGirl is young adult literature ... 풔 ퟏ : FlyyGirl is young adult literature ... Rewrite 푴 풂 풔 ퟏ " 풔 ퟏ " 풔 ퟏ " The first sentence of: Generate 푴 풕 풔 ퟏ " 풔 ퟏ " 풔 ퟏ 0 “Editing 풑 enables 풔 ퟏ ' into 풔 ퟏ ( ” 풑 풔 ퟏ " 풔 ퟏ " 풑 ퟏ 0 ℋ Extract 풑′ 퐢퐟 퐬퐜퐨퐫퐞 풏풆풘 >풔풄풐풓풆 풐풍풅 Details Inference 푴 풂 Figure 2|Pipeline of theSDRframework. In the goal identification stage (left part),SDRtries to find the register that is closely aligned with the laundering goal (See Algorithm. 1). The details inference stage (right part) tries to infer the remaining details in the laundering process (See Algorithm. 2). Goal identification stage. At this stage, our method seeks to identify which of the 23 predefined registers best matches the laundering goal (Algorithm 1). A naïve approach would synthesize every proprietary sample into each register using the auxiliary LLM and evaluate which register yields the largest improvement in unauthorized data retention detection. However, synthesizing long-token sequences is costly. To reduce this cost, we rewrite only the opening sentence of each sample using register-specific opening templates. If the proprietary data were laundered toward a particular register, the laundered samples would likely adopt an opening resembling that register’s template, leading the target model to generate continuations with higher confidence (Yeom et al., 2018). By measuring which register’s opening sentences elicit higher continuation confidence, we can efficiently identify the register closest to the laundering goal. Specifically, for each register푟, we first use the auxiliary LLM to generate a Standard-prompt that can synthesize data into that register. Using Standard-prompt, the auxiliary LLM rewrites푛samples of퐷 pro and abstracts the first sentences of them into an opening templateT 푟 (see constructing opening templates). Following the Score via continuation confidence, these templates are applied to rewrite the first sentence of the original data (i.e., the first sentence of푠∈ UniformSample(퐷 pro , 푚)). Rewritten sentences are then provided to푀 푡 and measure the average model’s continuation confidenceConf(푟)(Details of the confidence calculation are shown in Appendix C). The top-5 registers with the highestConf(푟)are retained as candidate registers퐶. Finally, the closest register푟 * is selected from퐶based on its unauthorized training data detection performance (See the “Select best register by detection performance” part in Algorithm 1). Details inference stage. Once the closest register has been identified, we can reverse the laundered data by synthesizing the original samples into that register. However, this reversion may still diverge from the true laundered training data, as additional details may have been applied in the laundering process. The second stage seeks to recover these additional details (see Algorithm 2). Directly comparing the closest register synthesis with the true training data would reveal such details, but this is infeasible for the data rights owner unless similar data can be found. In the previous stage, we know that the first sentence of the closest register synthesis resembles that of the target model’s training data. Providing such a familiar opening sentence to the target model activates its memory of training data, enabling it to reproduce the 6 Combating Data Laundering in LLM Training Algorithm 1 Goal identification stage Require:Proprietary originals퐷 pro , held-out data퐷 held , target model푀 푡 , auxiliary LLM푀 푎 , set of 23 registers푅, sample size 푛 and 푚 Ensure: the register 푟 * ∈ 푅 that is closely aligned with the laundering directive. 1: —Constructing opening templates— 2: for all 푟 ∈ 푅 do 3:Standard-prompt 푟 ← 푀 푎 (“Give me a prompt that can transfer text into register 푟") 4:푂 푟 ← The first sentence of 푀 푎 (Standard-Prompt 푟 , 푠)| 푠∈ UniformSample(퐷 pro , 푛) 5:T 푟 ← 푀 푎 (“Extract a common template.", 푂 푟 ) 6: end for 7: —Score via continuation confidence— 8: for all 푟 ∈ 푅 do 9:푆 ← The first sentence of 푠| 푠∈ UniformSample(퐷 pro , 푚) 10:푋 푟 ← 푀 푎 (“Rewrite 푥 as T 푟 ”)| 푥∈ 푆 11:for 푗 ← 1 to 푚 do 12:푐 푗 ← Average next token confidence of 푀 푡 (푋 푟 [푗]) 13:end for 14: Conf(푟)← 1 푚 ∑︀ 푗 푐 푗 15: end for 16: 퐶 ← top-5 registers with largest Conf(푟) 17: —Select best register by detection performance— 18: for all 푟 ∈ 퐶 do 19: Syn r ← 푀 푎 (Standard-prompt 푟 , 푑)| 푑∈ 퐷 pro ∪ 퐷 held 20: Perf 푟 ← Unauthorized training data detection on 푀 푡 using Syn r 21: end for 22: 푟 * ← arg max 푟∈퐶 Perf 푟 23: return 푟 * , Standard-prompt 푟 * corresponding memorized continuations that are similar to the training data. As a result, analyzing the differences between the closest register synthesis and the reproduced continuations enables us to recover the additional conditions. Particularly, we first synthesize proprietary samples with the auxiliary LLM using an initial prompt 푝that can synthesize data into the closest register (theStandard-prompt 푟 * got from the previous stage). Using the functionConditionInference, the first sentence of the synthesis is fed into the target model to generate continuations. Both the synthesized data and the generated continuations are provided to푀 푎 , which infers the details involved in the laundering process. We applyConditionInferenceto multiple samples from퐷 pro , obtaining a collection of candidate prompts퐻. We then query푀 푎 with these prompts to distill a common system prompt that captures their shared transformation pattern. To determine whether refinement improves performance, we apply theEvaluatefunction; if so, the refined prompt replaces the initial one and the process continues iteratively. Through iterative updates, a refined prompt with enhanced details is created that best approximates the laundering process, improving detection performance on its reversed data. 5. Experiments and Results 5.1. Experiments Setting Dataset and victim models. We utilize the MIMIR (Deng et al., 2023) benchmark dataset (a detailed introduction to the MIMIR dataset is provided in Appendix F.), a widely recognized resource in research on unauthorized training data detection. To evaluate the generality ofSDR, we select three subsets from MIMIR: Wikipedia, C4, and HackerNews, corresponding to encyclopedia articles, web text, and news reports, respectively. As victim models, we employ different architectures, including Pythia (Biderman et al., 2023), 7 Combating Data Laundering in LLM Training Algorithm 2 Details inference stage Require:register푟 * andStandard-prompt 푟 * got from Algorithm 1 , proprietary data퐷 푝푟표 , held-out data퐷 held , target model 푀 푡 , auxiliary LLM 푀 푎 , iteration budget 퐾, sample size 푙 Ensure: Reversed prompt 1: 푝 = Standard-prompt 푟 * 2: function ConditionInference(퐷 pro , 푝, 푀 푡 , 푀 푎 ) 3:for all 푠∈ UniformSample(퐷 pro , 푙) do 4:^푠← 푀 푎 (푝, 푠), ̃푠← 푀 푡 (the first sentence of ^푠) 5:퐻.Append(푀 푎 (“Editing 푝 enables the transformation of ^푠 into ̃푠")) 6:end for 7:return 푀 푎 (“Extract a common prompt.", 퐻) 8: end function 9: function Evaluate(퐷 푝푟표 , 퐷 held , 푝, 푀 푡 , 푀 푎 ) 10: Syn p ← 푀 푎 (푝, 푥)| 푥∈ 퐷 pro ∪풟 held 11: Perf 푟 ← Unauthorized training data detection on 푀 푡 using Syn p 12:return Perf 푝 13: end function 14: for 푘 ← 0 to 퐾− 1 do 15:푝 ′ ← ConditionInference(퐷 pro , 푝, 푀 푡 , 푀 푎 ) 16: score new ← Evaluate(퐷 pro , 퐷 held , 푝 ′ , 푀 푡 , 푀 푎 ), score old ← Evaluate(퐷 pro , 퐷 held , 푝, 푀 푡 , 푀 푎 ) 17:if score new > score old then 18:푝← 푝 ′ 19:end if 20: end for 21: return 푝 Falcon (Zhang et al., 2022), and Llama-2 (Touvron et al., 2023) to evaluate the robustness ofSDRacross architectures. Baselines and metrics. We involve five baseline unauthorized training data detections in our experiments: Loss (Yeom et al., 2018), which uses likelihood loss as the membership score; Ref (Carlini et al., 2022), which calibrates input loss via a reference model; Zlib (Carlini et al., 2021), which compresses input loss through entropy coding; Min-K% (Shi et al., 2023) and Recall (Xie et al., 2024) as introduced in Section 2. Following prior work (Carlini et al., 2022), we report three metrics: Area Under the Curve (AUC), Attack Success Rate (ASR), and True Positive Rate at 5% False Positive Rate (TPR@5%). Details explaining the metrics are shown in Appendix G.1. Experimental setup for laundering reversal evaluation. We evaluate the effectiveness ofSDRby examining whether it reverses data to enhance the performance of existing unauthorized training data detection methods against target LLMs trained on laundered data. (See Appendix G for details.) Synthesized prompt setting. We consider two types of prompts that may be applied by the model provider: inside-register and outside-register. Inside-register prompts assume that the model provider synthesizes the original data into one of the 23 sub-registers. For each register, we use GPT-5 (Leon, 2025) to generate a corresponding prompt. Outside-register prompts are those generated by GPT-5 that do not align with any established register. The full list of inside- and outside-register prompts is provided in Appendix H. 5.2. Experiments Result 5.2.1. Improving Unauthorized Data Detection with SDR Result analysis across different synthesized prompts. To evaluate whetherSDRcan reverse synthesize training data from different prompts, we use GPT-4o (Roumeliotis and Tselikas, 2023) to synthesize the MIMIR-Wikipedia data into new data with different inside- and outside prompts (mentioned in Section 5) 8 Combating Data Laundering in LLM Training Table 2|The average performance of each unauthorized training data detection method across data synthesized from different inside and outside laundering processes. The experiment is located on Pythia-6.9B (Biderman et al., 2023), fine-tuned on Wikipedia synthesis. The results for each prompt are provided in Appendix I. We report the additional TPR@1% results in Appendix M. Method Inside RegistersOutside Registers AUCASRTPR@5%AUCASRTPR@5% Recall.64.7%63.4%8.9%61.7%61.4%5.6% Recall+SDR76.2%72.0%25.3%73.4%73.3%23.2% Loss.63.7%62.8%10.7%62.7%62.6%9.2% Loss+SDR76.6%72.6%26.2%75.5%75.5%22.9% Ref68.6%67.0%15.0%67.6%65.6%13.2% Ref+SDR74.8%70.8%29.9%72.0%72.1%24.2% Zlib63.9%63.5%15.2%63.6%63.5%13.9% Zlib+SDR68.9%66.7%18.8%68.4%68.4%16.2% Min-K63.5%62.6%11.8%64.2%62.5%10.5% Min-K+SDR75.1%71.6%25.1% 73.6%73.5%22.7% and fine-tune a Pythia-6.9B (Biderman et al., 2023) model. Table 2 shows that across both inside- and outside-register prompts,SDRconsistently enhances the average performance of the detection. Specifically, the average detection AUC of Loss increases by 12.9% across the inside prompts and 12.8% across the outside prompts. The specific results for each prompt are provided in Appendix I. Result on mixed-register transformations. We have conducted experiments on mixed-register transfor- mations by combining two registers in the laundering prompt (e.g., “opinion blog post with a persuasive tone”, “storytelling narrative as a sports report”, “informational description like a recipe”). We present all three mixed-register transformation prompts and their corresponding recovered prompts in Appendix K. As shown in Table 3, across all three mixed-register prompts,SDRconsistently improves both AUC and ASR, demonstrating that it can successfully transfer to mixed laundering transformations. Nevertheless, we agree that extremely exotic transformations (e.g., pseudo-translation into low-resource languages) may further stress SDR. Table 3| SDRtransferability on mixed-register laundering prompts.SDRconsistently improves AUC and ASR across three mixed-register laundering transformations, demonstrating robustness to more complex combinations of stylistic rewrites. Method Mixed Prompt 1Mixed Prompt 2Mixed Prompt 3 AUCASRAUCASRAUCASR Recall0.5590.5600.6660.6500.7370.715 Recall + SDR0.7570.7050.7770.7250.8310.770 Loss0.5720.5750.6700.6550.7380.685 Loss + SDR0.7670.7050.7960.7500.8340.785 Min-K0.5870.5800.6770.6700.7470.705 Min-K + SDR0.7500.7150.7490.7000.8200.765 Min-K++0.4750.5350.4750.5150.5860.605 Min-K++ + SDR0.5860.615 0.5380.5800.6170.615 Comparison to reverse prompt engineering methods. To contextualizeSDRwithin the broader landscape of prompt-search and reverse-engineering approaches, we provide in Appendix L a comparison betweenSDRand state-of-the-art reverse prompt engineering methods (Li and Klabjan, 2024), including an 9 Combating Data Laundering in LLM Training adapted version of that aligns with our problem setting. Negative-control experiment. A reliable detection method should not fabricate evidence of data misuse when no laundering has occurred. We evaluateSDRon a setting where neither퐷 pro nor any laundered variant appears in the target model’s training set. As shown in Table 4, both AUC and ASR remain close to 0.5 on ArXiv and Wikipedia, confirming thatSDRdoes not spuriously create evidence of data misuse in the absence of laundered training data. Table 4|Negative-control experiment on Pythia-6.9B. When the target model is not trained on any laundered variants of the proprietary data,SDRdoes not find a prompt to improve unauthorized training- data detection. Across all detectors and both datasets (ArXiv and Wikipedia), the AUC and ASR scores before and afterSDRremain close to 0.5, indicating thatSDRdoes not fabricate evidence of misuse in the absence of laundered training data. Method ArXivWiki AUCASRAUCASR Recall0.5160.5320.5280.545 Recall + SDR0.4880.5250.4730.540 Loss0.4860.5220.4710.510 Loss + SDR0.4900.5350.4650.515 Min-K0.5360.5100.4860.515 Min-K + SDR0.4990.5350.4400.525 Min-K++0.4760.5210.4830.535 Min-K++ + SDR0.4830.5200.4460.515 5.2.2. Transferability Result analysis across different datasets. To evaluate the robustness ofSDRacross different datasets, we applied unauthorized training data detections to Pythia-6.9B models, which were trained with synthesized data from various datasets (Wikipedia, Hackernews, and C4) under outside prompts. Table 6 shows that across all three datasets,SDRconsistently improves detection performance. For example, Recall achieves a clear AUC gain on all datasets corresponding to an average improvement of 10.8%. Result analysis across different LLM structures. To evaluate the robustness ofSDRacross different trained model architectures, Table 7 shows the performance of unauthorized training data detections on three different model architectures (Pythia-6.9B, Falcon-7B, and Llama-2-7B) fine-tuned with MIMIR- Wikipedia synthesis using outside register prompts. Across all three models,SDRconsistently enhances detection effectiveness. For example, Recall achieves substantial AUC gains on all models, with an average improvement of 9.3%. Result analysis with different auxiliary models. We examine a scenario in which the auxiliary LLM applied by the data rights holder forSDRdiffers from the one employed by the model provider used to launder data. As shown in Table 5, in this experiment, we consider that the model provider synthesizes data using GPT-4o, whileSDRemploys auxiliary LLMs such as Claude and DeepSeek for reverse synthesis. Results are averaged using the first ten inside prompts. From the result, we can find thatSDRachieves an average AUC improvement of 13.5% on GPT-4o, 11.5% on Claude, and 12.7% on DeepSeek. These increasing values are close, indicating that SDR’s effectiveness is stable across different auxiliary LLMs. SDR Transferability to Third-Party Laundering Pipelines. We evaluate cross-launderer transferability ofSDRusing two forms of third-party laundering pipelines—specifically, data laundered by DeepSeek-v3 (Liu 10 Combating Data Laundering in LLM Training Table 5|Comparison of the average performance of unauthorized training data detection withSDRusing different auxiliary LLMs. Method GPT-4oClaudeDeepSeek AUCASRTPR@5%AUCASRTPR@5%AUCASRTPR@5% Recall64.5% 63.5%9.9%66.8% 65.9%9.7%65.5% 64.8%7.4% Recall+SDR79.7% 75.0%31.6%81.6% 77.7%31.0%79.8% 75.5%31.2% Loss63.4% 62.2%14.3%67.3% 65.3%12.1%65.9% 64.7%12.2% Loss+SDR80.3% 75.6%32.6%83.4% 77.8%41.9%79.0% 74.7%32.8% Min-K63.7% 62.3%11.0%68.1% 65.5%14.5%67.0% 64.6%14.2% Min-K+SDR72.0% 75.1%32.8%81.2% 75.3%34.7%77.8% 73.1%30.3% Table 6|Comparison of average performance of unauthorized training data detection across different datasets trained with synthesis using outside register prompts. Method WikipediaHackernewsC4 AUCACCTPR@5%AUCACCTPR@5%AUCACCTPR@5% Recall61.7%61.4%5.6%53.9%56.2%9.9%52.2%55.0%5.0% Recall+SDR73.4% 73.3%23.2%61.6% 60.3%10.7%65.2% 63.0%12.0% Loss62.7%62.6%9.2%54.2%56.0%6.3%58.4%59.1%7.2% Loss+SDR75.5% 75.5%22.9% 62.7% 59.6%8.7%67.3% 64.2%13.0% Min-K64.2%62.5%10.5%53.8%55.9%5.7%57.6%59.2%6.2% Min-K+SDR73.6% 73.5%22.7%61.7% 60.8%8.3%66.8% 64.7%11.8% et al., 2024a) and a human-rewritten corpus. For an evaluation of alternative LLM Launderer with DeepSeek-v3, we fine-tune the target LLM ex- clusively on data laundered by DeepSeek-v3, whileSDRcontinues to use GPT-4o as the auxiliary model 푀 푎 for prompt search. We apply the first five inside-register prompts (Table 19) as laundering templates and execute laundering with DeepSeek-v3. As shown in Table 8,SDRconsistently improves detection performance across all four off-the-shelf detectors. For example, Loss improves from AUC/ASR of0.65/0.64 to0.81/0.76, and Min-K improves from0.67/0.65to0.78/0.73. This demonstrates thatSDRcan recover useful transformations even when the laundering pipeline is completely different from GPT-4o. While LLMs enable automated, large-scale rewriting practices, real-world laundering may not be carried out solely by LLMs. We simulate a laundering scenario using the Polite dataset (Wang et al., 2022), in which human annotators rewrote impolite sentences into polite versions. For an evaluation of a situation in which a human is a launderer, we treat the polite versions as "laundered" training data퐷 train , whereas their original versions are treated as퐷 pro . We find thatSDRrecovers a “personal review" style prompt (as shown below) and improves most off-the-shelf detectors (from Table 9). We notice that Recall+SDRbecomes slightly worse than Recall alone, which we attribute to polite expressions such as “I think” being already common in pretraining, making both training and non-training data equally easy to continue and collapsing the gap Recall relies on. Other detectors (+SDR) remain generally effective. In practice, Loss (+SDR) and Min-K (+SDR) may provide more reliable signals in this setting. Overall, these results demonstrate thatSDRremains effective when the laundering pipeline uses a different LLM or human rewriting, and when the auxiliary and laundering models are mismatched, confirming the transferability of SDR in diverse and practical scenarios. Partial laundering experiment. In real-world scenarios, the model provider may launder only a subset of 퐷 pro for training. To demonstrate thatSDRdoes not rely on full laundering, we conducted an experiment 11 Combating Data Laundering in LLM Training Table 7|Comparison of average performance of unauthorized training data detection across three different model architectures fine-tuned with synthesis generated by outside register prompts. Method Pythia-6.9BFalcon-7BLlama-2-7B AUCACCTPR@5%AUCACCTPR@5%AUCACCTPR@5% Recall61.7%61.4%5.6%62.1%61.8%8.2%61.6%61.6%8.2% Recall+SDR73.4% 73.3%23.2% 72.4% 69.1%23.0%67.5% 66.2%12.5% Loss62.7%62.6%9.2%64.4%64.4%11.5%64.5%64.4%11.1% Loss+SDR75.5% 75.5%22.9% 71.2% 68.0%20.2%73.6% 70.4%26.9% Min-K64.2%62.5%10.5%63.3%62.6%10.5%62.5%62.5%13.9% Min-K+SDR73.6% 73.5%22.7%70.2% 68.0%20.0%70.9% 68.2%22.9% Table 8| SDRtransferability on DeepSeek-v3 laun- dering pipelines for the target LLM trained exclu- sively on DeepSeek-laundered data.SDRuses GPT- 4o as 푀 푎 . MethodAUCASR Recall0.6410.630 Recall + SDR0.7670.718 Loss0.6500.635 Loss + SDR0.8080.760 Min-K0.6720.645 Min-K + SDR0.7840.734 Min-K++0.5550.584 Min-K++ + SDR0.5650.595 Table 9| SDRtransferability on human-rewritten laundering pipelines for the target LLM trained ex- clusively on Polite dataset.SDRuses GPT-4o as푀 푎 . MethodAUCASR Recall0.6490.635 Recall + SDR0.5660.575 Loss0.6870.680 Loss + SDR0.7510.725 Min-K0.6520.680 Min-K + SDR0.7130.690 Min-K++0.5600.575 Min-K++ + SDR0.6240.615 to evaluate whetherSDRremains effective when only a portion of the proprietary data is laundered. In the model’s training set, we randomly selected half of the samples and applied an inside-register prompt (see Table 21) to generate the laundered subsets, while leaving the remaining samples unaltered.SDRwas then applied to the full training set to infer the laundering transformation. Table 10 reports the average detection performance on partially laundered data, averaged over the first five inside-register prompts. SDR successfully improves detection performance across all four off-the-shelf detectors. For example, the AUC/ASR of Loss increases from 0.599/0.597 to 0.732/0.703. Table 10| Average performance across all five laundering prompts under partial laundering. MethodAvg AUCAvg ASR Recall0.6080.590 Recall + SDR0.7220.694 Loss0.5990.597 Loss + SDR0.7320.703 Min-K0.6080.603 Min-K + SDR0.7240.701 Min-K++0.5530.565 Min-K++ + SDR0.5800.602 12 Combating Data Laundering in LLM Training 5.2.3. Ablation Study 66% 68% 70% 72% 74% 76% 78% 80% 72.0% 75.3% 77.3% AUC 66% 68% 70% 72% 74% 76% 78% 80% 68.6% 72.3% 75.2% ASR 0% 5% 10% 15% 20% 25% 30% 35% 40% 19.9% 24.8% 32.3% FPR=5% w/o stage 1w/o stage 2SDR Figure 3|Ablation study on the effectiveness of each stage in SDR. Results are reported as the average performance of unau- thorized training data detections across different inside prompts. Removing the directive identification stage (w/o stage 1) or the detailed prompt condition inference stage (w/o stage 2) leads to noticeable degradation, while the fullSDRconsistently achieves the best performance. Evaluating the Contribution of Each Stage in SDR. To assess the contribution of each stage in the proposedSDRframework, we conduct an ablation study by selectively removing individual stages. By comparing the performance of detections on the data reversed with the fullSDRframework against that with individual stages, we can evaluate the necessity of each stage. As shown in Figure 3, di- rectly applying the identified directive from the goal identification stage (w/o stage 2) to reverse the synthesized data leads to degradations in all average detection metrics across different inside prompts. In particular, TPR@5% drops by 7.5% com- pared to the fullSDRframework (SDR). Skipping the register identification stage and only relying on the details inference (w/o stage 1) causes even more severe degradation, reducing TPR@5% by 12.5%. These results demonstrate that both stages are indispensable. Hyperparameter Sensitivity Study. We con- ducted an extended sensitivity study to examine howSDRbehaves under different choices of the key hyperparameters퐾(see Table 11),푙(see Table 12), 푚(see Table 14), and푛(see Table 13), usingLoss+SDRunder the No. 1 inside-register prompt. Our key findings are as follows (see the tables below for detailed numbers): Increasing퐾from 3 to 15 improves AUC from 0.71 to 0.75 and ASR from 0.69 to 0.71, at the cost of higher runtime and query budget (roughly $7–$39 with GPT-4o; substantially cheaper with GPT-4o-mini). The value of푚has the strongest impact. Varying 푚from 3 to 9 raises AUC from 0.72 to 0.81 and ASR from 0.69 to 0.76 with almost unchanged query cost, making푚 = 9a strong default choice.푙and푛exhibit moderate gains. Setting푙 = 7and푛 = 7achieves a good balance between performance and cost. (Note that unless otherwise specified, we use퐾 = 10,푙 = 5, 푚 = 5, and푛 = 10as the default hyperparameters.) Overall, a practical and efficient configuration for SDR is: (퐾 = 5, 푙 = 7, 푚 = 9, 푛 = 7), which attains most of the performance gains at moderate cost. Table 11| Sensitivity to 퐾. 퐾AUCASRTime (h:m:s)Query Budget (GPT4o / mini) 30.7120.68502:23:42∼ $7/0.8 50.7270.69004:11:33∼ $13/1.5 150.7470.70513:27:12∼ $39/4.5 Table 12| Sensitivity to 푙. 푙AUCASRTime (h:m:s)Query Budget (GPT4o / mini) 30.7150.67008:21:33∼ $10/1 7 0.7310.69509:13:12∼ $10/1 9 0.7180.69509:35:17∼ $10/1 13 Combating Data Laundering in LLM Training Table 13|Sensitivity to푛.푛controls the construction of the template and is computed only once during initialization. Therefore, it does not contribute to the runtime or query budget. 푛AUCASRTime (h:m:s)Query Budget 30.7050.675– 7 0.7520.705– 90.7420.695– Table 14| Sensitivity to 푚. 푚AUCASRTime (h:m:s)Query Budget (GPT4o / mini) 30.7180.68508:14:33∼ $10/1 70.7960.74008:19:29∼ $10/1 9 0.8100.76008:26:45∼ $10/1 110.8060.75508:33:34∼ $10/1 6. Conclusion This paper identified a critical vulnerability in current auditing practices: conventional unauthorized training data detections fail under data laundering, leaving a loophole that enables model providers to obscure the provenance of training data. To address this challenge, we proposedSDR, a two-stage framework that reconstructs the synthesis process by inferring a prompt to recover laundered data, thereby restoring the detectability of unauthorized usage. Through extensive evaluation across datasets, model architectures, and auxiliary LLM models, we demonstrated thatSDRenhances the effectiveness of unauthorized training data detection. In future work, the focus should be on developing finer-grained, task-specific directive taxonomies to improve the accuracy and robustness of prompt reversal. In sum, we believeSDRopens a promising direction for developing robust privacy auditing tools against data laundering. 14 Combating Data Laundering in LLM Training References A. Agha. Registers of language. A companion to linguistic anthropology, 2004. C. Bannard and C. Callison-Burch. Paraphrasing with bilingual parallel corpora. In ACL, 2005. R. Barzilay and K. McKeown. Extracting paraphrases from a parallel corpus. In ACL, 2001. R. Bhagat and E. Hovy. What is a paraphrase? Computational linguistics, 2013. S. Biderman, H. Schoelkopf, Q. G. Anthony, H. Bradley, K. O’Brien, E. Hallahan, M. A. Khan, S. Purohit, U. S. Prashanth, E. Raff, et al. Pythia: A suite for analyzing large language models across training and scaling. In International Conference on Machine Learning, 2023. N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, et al. Extracting training data from large language models. In USENIX Security, 2021. N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer. Membership inference attacks from first principles. In SP, 2022. C. Deng, Y. Zhao, X. Tang, M. Gerstein, and A. Cohan. Investigating data contamination in modern benchmarks for large language models. arXiv preprint arXiv:2311.09783, 2023. B. Dolan and C. Brockett. Automatically constructing a corpus of sentential paraphrases. In IWP, 2005. C. Dwork. Differential privacy: A survey of results. In TAMC, pages 1–19, 2008. E. Henriksson, A. Myntti, S. Hellström, A. Eskelinen, S. Erten-Johansson, and V. Laippala. Automatic register identification for the open web using multilingual deep learning. arXiv preprint arXiv:2406.19892, 2024. A. Hurst, A. Lerer, A. P. Goucher, A. Perelman, A. Ramesh, A. Clark, A. Ostrow, A. Welihinda, A. Hayes, A. Radford, et al. Gpt-4o system card. arXiv preprint arXiv:2410.21276, 2024. M. Leon. Gpt-5 and open-weight large language models: Advances in reasoning, transparency, and control. Information Systems, 2025. B. Li, P. Qi, B. Liu, S. Di, J. Liu, J. Pei, J. Yi, and B. Zhou. Trustworthy ai: From principles to practices. ACM Computing Surveys, 2023a. H. Li and D. Klabjan. Reverse prompt engineering. arXiv preprint arXiv:2411.06729, 2024. H. Li, Y. Chen, J. Luo, J. Wang, H. Peng, Y. Kang, X. Zhang, Q. Hu, C. Chan, Z. Xu, et al. Privacy in large language models: Attacks, defenses and future directions. arXiv preprint arXiv:2310.10383, 2023b. M. Li, Z. Ye, Y. Li, A. Song, G. Zhang, and F. Liu. Membership inference attack should move on to distributional statistics for distilled generative models. arXiv preprint arXiv:2502.02970, 2025. X. Liang, H. Wang, Y. Wang, S. Song, J. Yang, S. Niu, J. Hu, D. Liu, S. Yao, F. Xiong, et al. Controllable text generation for large language models: A survey. arXiv preprint arXiv:2408.12599, 2024a. Y. Liang, J. Xiao, W. Gan, and P. S. Yu. Watermarking techniques for large language models: A survey. arXiv preprint arXiv:2409.00089, 2024b. A. Liu, B. Feng, B. Xue, B. Wang, B. Wu, C. Lu, C. Zhao, C. Deng, C. Zhang, C. Ruan, et al. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437, 2024a. 15 Combating Data Laundering in LLM Training Q. Liu, F. Wang, N. Xu, T. Yan, T. Meng, and M. Chen. Monotonic paraphrasing improves generalization of language model prompting. In EMNLP Findings, 2024b. X. Liu, H. Liu, G. Yang, Z. Jiang, S. Cui, Z. Zhang, H. Wang, L. Tao, Y. Sun, Z. Song, et al. A generalist medical language model for disease diagnosis assistance. Nature medicine, 2025. Y. Mao, J. He, and C. Chen. From prompts to templates: A systematic prompt template analysis for real-world llmapps. In FSE, 2025. A. Myntti, E. Henriksson, V. Laippala, and S. Pyysalo. Register always matters: Analysis of llm pretraining data through the lens of language variation. arXiv preprint arXiv:2504.01542, 2025. K. I. Roumeliotis and N. D. Tselikas. Chatgpt and open-ai models: A preliminary review. Future Internet, 2023. W. Shi, A. Ajith, M. Xia, Y. Huang, D. Liu, T. Blevins, D. Chen, and L. Zettlemoyer. Detecting pretraining data from large language models. arXiv preprint arXiv:2310.16789, 2023. R. Shokri, M. Stronati, C. Song, and V. Shmatikov. Membership inference attacks against machine learning models. In SP, 2017. H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023. K. Wang, G. Zhang, Z. Zhou, J. Wu, M. Yu, S. Zhao, C. Yin, J. Fu, Y. Yan, H. Luo, et al. A comprehensive survey in llm (-agent) full stack safety: Data, training and deployment. arXiv preprint arXiv:2504.15585, 2025. X. Wang, T. Ge, A. Mao, Y. Li, F. Wei, and S.-Q. Chen. Pay attention to your tone: Introducing a new dataset for polite language rewrite. arXiv preprint arXiv:2212.10190, 2022. S. Witteveen and M. Andrews. Paraphrasing with large language models. In ACL Workshop on Neural Generation and Translation, 2019. S. Wu, M. Koo, L. Blum, A. Black, L. Kao, F. Scalzo, and I. Kurtz. A comparative study of open-source large language models, gpt-4 and claude 2: Multiple-choice test taking in nephrology. arXiv preprint arXiv:2308.04709, 2023. R. Xie, J. Wang, R. Huang, M. Zhang, R. Ge, J. Pei, N. Z. Gong, and B. Dhingra. Recall: Membership inference via relative conditional log-likelihoods. arXiv preprint arXiv:2406.15968, 2024. L. Yan, L. Sha, L. Zhao, Y. Li, R. Martinez-Maldonado, G. Chen, X. Li, Y. Jin, and D. Gašević. Practical and ethical challenges of large language models in education: A systematic scoping review. British Journal of Educational Technology, 2024. W. Ye, J. Hu, L. Li, H. Wang, G. Chen, and J. Zhao. Data contamination calibration for black-box llms. arXiv preprint arXiv:2405.11930, 2024. S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In CSF, 2018. B. Zeleke, A. Soni, and L. Manikonda. Human or genai? characterizing the linguistic differences between human-written and llm-generated text. In ACM Web Science Conference, 2025. 16 Combating Data Laundering in LLM Training J. Zhang, J. Sun, E. Yeats, Y. Ouyang, M. Kuo, J. Zhang, H. F. Yang, and H. Li. Min-k%++: Improved baseline for detecting pre-training data from large language models. arXiv preprint arXiv:2404.02936, 2024. S. Zhang, S. Roller, N. Goyal, M. Artetxe, M. Chen, S. Chen, C. Dewan, M. Diab, X. Li, X. V. Lin, et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068, 2022. X. Zhang, J. Cao, J. Wei, C. You, and D. Ding. Why prompt design matters and works: A complexity analysis of prompt search space in llms. arXiv preprint arXiv:2503.10084, 2025. 17 Combating Data Laundering in LLM Training Appendix A. Mathematical Notation We summarize the key mathematical symbols used throughout the paper. SymbolDescription ℛSet of 23 establised registers. 푟 * Register selected as most closely aligned with the laundering goal. 푛, 푚, 푙Sample sizes used in constructing templates, scoring, and inference, respectively. 퐾Maximum number of iterations in the detailed prompt condition inference stage. Standard-prompt 푟 A canonical prompt that synthesizes text into register 푟. 푇 푟 Opening template extracted for register 푟. ^푠Synthetic data generated by 푀 푎 from an original sample 푠 under prompt 푝. ̃푠Continuation produced by the target model 푀 푡 when prompted with ^푠. Conf(푟)Average next-token confidence of 푀 푡 under register 푟. 풞Candidate set of top-푘 registers with highest confidence scores. Syn 푟 Dataset synthesized into register 푟 by 푀 푎 . Perf 푟 Unauthorized training data detection performance of Syn 푟 on 푀 푡 . 푝Current reverse-synthesis prompt refined during iterations. B. Register Taxonomy The register taxonomy proposed by Henriksson et al. (2024) defines 23 sub-registers across nine major categories, ranging from narrative forms (e.g., news and sports reports, blogs) and informational texts (e.g., encyclopedia entries, research articles, legal documents) to opinion pieces, persuasive descriptions, interactive discussions (e.g., FAQs, interviews), instructional texts (e.g., recipes), spoken and lyrical registers, and machine-translated content (details are shown in Table 15). This taxonomy provides near-comprehensive coverage of open-domain texts, offering a systematic and scalable framework that reduces unbounded stylistic variation into a bounded set of functional categories. Table 15| Register categories and abbreviations NameAbbr.NameAbbr. LyricallyEncyclopedia articleen SpokenspResearch articlera InterviewitDescription of a thing or persondtp Interactive discussionidFAQfi NarrativenaLegal terms & conditionslt News reportneOpinionop Sports reportsrReviewrv Narrative blognbOpinion blogob How-to or instructionshiDenominational religious blog or sermonrs RecipereDescription with intent to sellds Informational persuasionipInformational descriptionin News & opinion blog or editorialed 18 Combating Data Laundering in LLM Training C. Average Token-level Confidence We use the average token-level confidence to evaluate the model’s confidence. We define the confidence score of register 푟 as Conf(푟) = 1 푛 푛 ∑︁ 푗=1 ⎛ ⎝ 1 퐿 푗 퐿 푗 ∑︁ 푖=1 max 푤∈푉 푃 푀 (︁ 푤 | 푋 (푗) 푟,<푖 )︁ ⎞ ⎠ , where푟is the register,푉is the vocabulary,퐿 푗 is the length of the generated continuation for the rewritten opening sentence, and푋 (푗) 푟,<푖 refers to the concatenation of the rewritten opening sentence and the first 푖− 1 tokens already generated in the continuation, 푀 represents the target model. D. The Objective and Threat Model Threat model.Our setting follows a black-box auditing formulation used in post-hoc unauthorized data detection (Carlini et al., 2022; Xie et al., 2024), describing a threat model where: 1. The model provider trains the target LLM푀 푡 on an unknown training set퐷 train that may include laundered variants of some samples in a proprietary dataset퐷 pro . 2. The data rights holder owns a proprietary dataset퐷 pro and has a held-out reference set퐷 held guaranteed not to appear in퐷 train . The rights holder only has access to (i) 퐷 pro , (i)퐷 held , and (i) black-box query access to푀 푡 (e.g., API). It does not have access to퐷 train , nor to the (potentially unknown) laundering pipeline. 3. An auxiliary LLM푀 푎 is any model that the rights holder can query to synthesize surrogate samples. We additionally summarize all symbols and their roles in Table 16. Table 16| Notation used in the threat model. SymbolDescription & RoleVisible to Rights Holder? 푀 푡 Target LLM trained on 퐷 train No 푀 푎 Auxiliary LLM used only for synthesisYes 푇True (unknown) laundering transformationNo 푝Reverse synthesis prompt inferred by SDRYes 퐷 pro Proprietary dataset (candidate corpus)Yes 퐷 ′ pro Unknown in-training subset of 퐷 pro No 퐷 train Model provider’s full training datasetNo 퐷 lau Laundered version of 퐷 ′ pro No 퐷 held Held-out non-training reference datasetYes 푠Original sampleYes ˆ푠 = 푀 푎 (푝, 푠)Synthetic surrogate rewriteYes Syn 푝 (푆)Surrogate set induced by prompt 푝Yes Perf 푝 Detector performance under prompt 푝Yes WhatSDRoptimizes.SDRseeks to optimize a prompt푝so that samples in퐷 pro are mapped closer to the true laundered variants used in training푀 푡 , thereby restoring the effectiveness of standard unauthorized training-data detectors. Firstly, we use푀 푎 to synthesizeSyn 푝 (퐷 pro )andSyn 푝 (퐷 held ). And then runs an off-the-shelf detector (ReCaLL, Min-K, etc.) on푀 푡 using these two sets, exactly as in standard post-hoc unauthorized data detection, but using the synthesized variants. Finally,SDRtakes the detector’s output scalar score (e.g., ReCaLL’s two-sample score) asPerf 푝 , andSDRseeks to optimize a prompt푝that maximizes Perf 푝 . 19 Combating Data Laundering in LLM Training Detail introduction aboutPerf 푝 .Given a fixed detector (e.g., Recall, Min-K), a prompt푝induces synthetic surrogatesSyn 푝 (퐷 pro )andSyn 푝 (퐷 held )via푀 푎 . We then run the detector on푀 푡 precisely as in prior work, but using these surrogates as candidate vs. reference sets, and record a scalar performance measure Perf p . Algorithms 2 and 1 describe our pipeline that searches over the prompt space to maximize this scalar.Perf p distinguishesSyn 푝 (퐷 pro )fromSyn 푝 (퐷 held ), implying that푀 푡 was indeed trained on a laundered version of퐷 pro , and푝can recover the unknown laundering process used by the model provider. Otherwise, it implies that the current prompt푝cannot recover the laundered training data, and we need to continue searching for more plausible ones. Eventually, if no such performance-improving prompt can be found, we consider that no laundering of 퐷 pro was used in training 푀 푡 . E. Opening Template Table 17 presents the representative opening templates푇 푟 that we derived for each register. These templates were obtained by synthesizing a small subset of samples into the corresponding register푟and then prompting a large language model to extract a generalized first-sentence structure. As shown in the table, each register exhibits distinct stylistic cues in its openings: for example, lyrical texts often begin with abstract imagery, interviews with a direct address from the interviewer, and storytelling narratives with a scene-setting phrase such as “Once upon a time.” Such templates capture the prototypical entry points of different registers, which serve as useful anchors for aligning synthesized outputs with their intended discourse forms. F. An Introduction to the MIMIR Dataset The MIMIR benchmark is specifically constructed for evaluating unauthorized training data detection. For each model to be evaluated (Pythia, Falcon, LLaMA-2), it defines "seen" splits (i.e., ground-truth training data) against "non-seen" splits (i.e., non-training data), which contain documents collected after the model’s release and thus not used in its pretraining (Deng et al., 2023). This therefore ensures the "non-seen" splits thus can be reliably used in our evaluation. The MIMIR dataset is publicly available athttps: //huggingface.co/datasets/iamgroot42/mimir. G. Experimental Setup for Laundering Reversal Evaluation G.1. Evaluation Metrics Following Carlini et al. (Carlini et al., 2022), we adopt three complementary metrics to evaluate membership inference attacks. Area Under the ROC Curve (AUC). AUC measures the overall discriminative power of the attack, independent of any specific threshold. It reflects how well an unauthorized training data detection method can separate training data from unseen data on average. It may overstate effectiveness since it also includes high false-positive regions that are less relevant in practice. Attack Success Rate (ASR). ASR measures the fraction of correctly identified training data under a single decision threshold that maximizes balanced accuracy across training data and unseen data. Unlike AUC, ASR reflects the practical effectiveness of an attack when deployed, as real-world unauthorized training data detections typically operate at a single fixed threshold. True Positive Rate at 5% False Positive Rate (TPR@5%). This metric evaluates the ability of a detection to identify training data while maintaining a strict false-positive constraint. Prior work highlights 20 Combating Data Laundering in LLM Training Table 17| Registers and their corresponding opening templates. RegisterTemplate (first-sentence / opening) LyricalIn the heart of [abstract domain], a tale unfolds, where [abstract concept], [abstract detail], [abstract entity], [abstract action]. Spoken styleSo, let’s talk about [TOPIC]. InterviewInterviewer: Thank you for joining us, [Person/Expert Title]. Can you tell us about [Subject/Topic]? Interactive discussion[Participant 1]: So, have you guys heard about [Topic/Subject]? I recently came across some interesting information about it. Storytelling narrative Once upon a time, in a [adjective] [type of place] called [place name], there lived a [adjective] [type of character] named [character name]. News report[Event/Topic]: [Description/Significance] [Location/Context] – [Details about the subject, including noteworthy contributions, roles, or milestones]. Sports reportIn a thrilling [event/display/action], [subject/actor] has [verb] [descrip- tion/impact] in [field/area/genre]. Narrative blog post In the context of [broad category or field], [subject or specific work] has made a significant impact, often leading to [general observation or effect]. Step-by-step guide (How-to)Step-by-Step Guide to Understanding [Subject] — Step 1: [Initial focus or background]. Learn that [Subject Description]. Recipe Recipe for [General Concept]: [Specific Edition/Style] — Ingredients: [Variable 1], [Variable 2], [Variable 3]. . . Encyclopedia article[Subject] is a [type/category] that [provides a description or function], [addi- tional information if applicable]. Research articleThis article explores the significance of [subject or topic], a [description or classification], characterized by [notable features or contributions]. Description of a thing or personIntroducing [Subject/Entity], a [descriptor] [type/category] [context/detail] renowned for its [property/characteristic]. FAQWhat is [Subject]? — [Subject] is a [general category or description] [specific type or detail] [additional information]. Legal terms & conditionsTerms and Conditions Regarding [Subject/Theme]. OpinionIn my view, [Subject/Entity] represents [significance/impact/legacy] in [field/area], and its influence on [audience/community/context] cannot be overstated. Review[Subject] is a [descriptor] that [verb phrase] [contextual information]. Opinion blog (editorial)When we think of [general category or field], [a notable example or subject] often comes to mind. Denominational religious sermonBeloved congregation, today we gather to reflect upon [individual/concept] that illuminates our lives and encourages us to contemplate our shared journey. Description with intent to sellIntroducing [Subject]: a [descriptor] [product/service] designed for [use case]; discover how it [benefit/outcome] for [target user]. Informational persuasionIn the context of [domain or field], few [types/categories] resonate as pro- foundly within [subfields] as [specific work/name/entity]. Informational description[Entity/Subject] is a [description] in the field of [broader category], specifically within [subcategory/locale]. News & opinion blog or editorialWhen we think of [general category or field], [notable subject] often comes to mind — situating today’s discussion of [topic] within [context]. that low false-positive regimes are the most meaningful for privacy evaluation, since even a small number of incorrect training data decisions can undermine the credibility of the attack. TPR@5% therefore provides a high-precision view of attack success. 21 Combating Data Laundering in LLM Training G.2. Experimental Setup We evaluate the effectiveness of our approach by examining whether the data reversed bySDRenhances the performance of existing unauthorized training data detection methods against LLMs trained on synthesized data. Specifically, we first sample 200 data points from the dataset that have not been seen by the target LLM. These 200 samples are synthesized into a new version using a prompt to simulate the data laundering process applied by the model provider. We then randomly select half of these synthesized samples as training data to fine-tune the LLM (training details are provided in Table 18), while the remaining half serves as non-training data. Subsequently,SDRis employed to infer a transformation prompt that restores the synthesis process and recovers the synthesized samples. Using this inferred prompt, we rewrite the original 200 data. Finally, we apply baseline unauthorized training data detections to both the original 200 samples and the 200 samples rewritten with the inferred prompt, comparing their attack performance to assess whether the inferred prompt improves the effectiveness of detections. Table 18| Hyperparameter settings for LoRA fine-tuning. Lora_alpharepochslr gradient accumulation steps weight_decaylogging_strategy 328300.0004250.1“epoch” H. Synthesized Prompts Used in Experiments Table 19 lists the complete set of inside-register prompts corresponding to the 23 predefined registers in our framework. Each prompt is generated by GPT-5 using the instruction: “Generate a rewriting prompt that transfers the text into [REGISTER].” Here, [REGISTER] denotes one of the 23 registers. Table 20 lists the complete set of outside-register prompts; none align with any of the 23 predefined registers. These prompts are generated by GPT-5 using the instruction: “You are a prompt generator. Generate rewriting prompts that transform the original content into broadly different domains (e.g., Facebook post, academic article, children’s story, legal document). Make the prompts as mutually distinct in domain as possible, and ensure each induces substantial changes to the original text rather than merely surface-level edits.” I. The Specific Results for Each Prompt Table 2 reports the average performance of each unauthorized training data detection method across models fine-tuned on data synthesized with different prompts. Tables 21 and 22 present the detailed average performance across five unauthorized training data detection methods for each inside-synthesized prompt. Tables 23 present the details for each outside-synthesized prompt. The “Original Prompt" column denotes the true synthesized prompt. The “Reversed Prompt” column denotes the best prompt recovered bySDR. The “Orig.” column reports the average AUC across detection methods using the original data, whereas the “SDR ” column reports the results using SDR -reversed data. I.1. Analysis of non-goal synthesis process We analyze a special case where the synthesis prompt does not provide an explicit directive. For example, consider the outside-synthesized prompt: “Rewrite the text with stronger transitions between sentences and paragraphs, ensuring smoother reading without adding new information.” Although this instruction lacks a clear goal keyword,SDRinfers a broader editorial-style prompt: “Rewrite the text in the style of an 22 Combating Data Laundering in LLM Training Table 19| Inside register prompts. IDSynthesize Prompts 1Rewrite the text in a lyrical style, ensuring the imagery is vivid, the rhythm flows naturally. 2Rewrite the text in a spoken style, making it sound natural and conversational, and ensure the tone feels engaging and easy to follow for a live audience. 3Rewrite the text in the form of an interview, ensuring the questions flow naturally and the answers provide clear, engaging explanations for the audience. 4Rewrite the text as an interactive discussion between two or more participants, ensuring the conversation flows logically, with each speaker’s tone and style clearly distinguishable. 5Rewrite the text as a storytelling narrative. The story should flow naturally, use simple and engaging language, and be easy for all kinds of listeners to follow. 6Rewrite the text in the style of a news report, ensuring the information is presented objectively and concisely. 7Rewrite the text as a sports report, ensuring the action is described with dynamic, energetic language that conveys the pace, tension, and excitement of the event. 8Rewrite the text as a narrative blog post, organized into clear sections with subheadings. Use a tone that is engaging and reflective, blending storytelling with explanation. 9 Rewrite the text as a step-by-step instructional guide. Break the content into numbered steps, with each step beginning with a clear imperative verb. 10Rewrite the text as a recipe, introduce the information as sequential steps. 11 Rewrite the text to persuade the reader through factual information, making sure to include at least three specific data points or statistics to support the argument. 12Rewrite the text as a sales description, and be sure to include a clear call-to-action at the end. 13Rewrite the text in the style of an editorial, making sure to include a clear stance or opinion and a concluding paragraph that calls for action or reflection. 14Rewrite the text as an informational description, ensuring the tone is neutral and objective, and include at least one definition or clarification to help the reader better understand the subject. 15Rewrite the text in the style of an encyclopedia entry, maintaining a neutral, authoritative tone, and include at least one date, fact, or reference to give it the appearance of being sourced. 16Rewrite the text as an academic research article, structured with sections such as Abstract, Intro- duction, Method, Results, and Conclusion, and include at least one in-text citation (invented if necessary) to simulate scholarly referencing. 17Rewrite the text as a descriptive profile of a specific thing or person, using vivid details and attributes (appearance, characteristics, or context) and ending with a short summary sentence that highlights its significance. 18 Rewrite the text in the form of a Frequently Asked Questions (FAQ) section, making sure to include at least three question–answer pairs, with the questions phrased from the perspective of a curious reader. 19Rewrite the text as legal terms and conditions, using formal legal language, and ensure at least one numbered clause is included for clarity. 20Rewrite the text as a personal opinion piece, written in the first person, making sure to clearly express a stance and support it with at least one reason or example. 21Rewrite the text as a review, giving it a clear positive or negative stance, and include at least one specific detail or example to justify the evaluation. 22Rewrite the text as an opinion blog post, written in a conversational and persuasive tone, and include at least one personal anecdote or illustrative example to strengthen the argument. 23 Rewrite the text as a denominational religious sermon, using a reverent and exhortative tone, and include at least one scriptural quotation or moral teaching to guide the audience toward reflection or action. 23 Combating Data Laundering in LLM Training Table 20| Outside register prompts. IDSynthesize Prompts 1Rewrite the following content as slide presentation bullet points. Focus on summarizing the key arguments and findings clearly and concisely. Use concise phrases that highlight core points. 2 Rewrite the following text in the style of a Facebook post. Sharing interesting information with followers. You may add light commentary, questions to the audience, or casual phrasing, but keep it natural and human-like. Avoid using emojis, hashtags, or overly dramatic expressions. 3Adapt the text into a poetic form with vivid metaphors, rhythmic structure, and emotionally evocative language. 4Convert the content into a tutorial-style explanation for beginners, using step-by-step instructions, simple analogies, and common misunderstandings. 5Rewrite the text as a formal business email, ensuring clarity, professionalism, and a polite tone. 6 Rewrite the passage as a scientific abstract, including Background, Methods, Results, and Conclusions. Invent at least two numerical values (percentages, sample sizes, or statistical outcomes) to support claims. 7Rewrite the text as a product description for an e-commerce website, highlighting key features, benefits, and use cases in a persuasive manner. 8 Rewrite the text as a blog post, incorporating vivid descriptions of locations, cultural insights, and personal experiences to engage readers. 9Rewrite the text as a classroom lecture transcript, with explanations, rhetorical questions, and occasional student interaction. 10Rewrite the text with stronger transitions between sentences and paragraphs, ensuring smoother reading without adding new information. editorial, focusing on enhancing the narrative through emotional engagement, historical significance, and the subject’s impact, while highlighting community involvement and contemporary relevance.” Despite the absence of an explicit goal, this inferred prompt enhances the performance of unauthorized training data detection, particularly improving the AUC of Loss (Yeom et al., 2018) from 0.538 to 0.669. J. Limitation A key limitation of our current approach is that the register taxonomy it relies on is too coarse-grained to locate goals accurately. Although the existing taxonomy of 23 sub-registers offers broad coverage of textual styles, it was not initially designed for classifying the laundering goal. Consequently, there are cases where none of the 23 registers can adequately capture the intent of a synthesized prompt, leading to reduced accuracy in goal identification and, in turn, lower quality in restored prompts. Overcoming this limitation calls for future research on developing more fine-grained taxonomies tailored to synthesized data, thereby enabling more accurate and robust prompt reversal in practical scenarios. K. Mixed-Register Laundering Pipelines We have conducted experiments on mixed-register transformations by combining two registers in the laundering prompt (e.g., “opinion blog post with a persuasive tone”, “storytelling narrative as a sports report”, “informational description like a recipe”). Across all three mixed prompts,SDRconsistently improves detection. For each mixed prompt, we present the recovered prompt followed by the corresponding detection results. 24 Combating Data Laundering in LLM Training Table 21| Inside register prompts and corresponding reversed prompts with Orig and SDR results. IDOriginal PromptReversed Prompt (SDR)Orig (AUC) SDR (AUC) 1Rewrite the text in a lyrical style, ensuring the im- agery is vivid, the rhythm flows naturally. Rewrite the text in a lyrical style, enhancing the poetic rhythm and imagery while capturing the essence and emotional depth of the original con- tent. 0.5400.692 2Rewrite the text in a spoken style, making it sound natural and conversational, and ensure the tone feels engaging and easy to follow for a live audience. Rewrite the text to sound natural and conversational, using everyday language and personal anecdotes to create an engaging and friendly atmosphere for the listener. 0.7020.894 3 Rewrite the text in the form of an interview, ensur- ing the questions flow naturally and the answers provide clear, engaging explanations for the audi- ence. Rewrite the text in the form of an interview, ensur- ing a clear and engaging dialogue that accurately conveys the information while maintaining a con- versational tone and eliciting detailed responses. 0.7130.823 4 Rewrite the text as an interactive discussion be- tween two or more participants, ensuring the con- versation flows logically, with each speaker’s tone and style clearly distinguishable. Rewrite the text as an interactive discussion be- tween two or more participants, ensuring a natural flow of dialogue that incorporates factual informa- tion and engages with the topic through building on each other’s comments. 0.6500.770 5 Rewrite the text as a storytelling narrative. The story should flow naturally, use simple and engaging language, and be easy for all kinds of listeners to follow. Rewrite the text in the form of a Frequently Asked Questions section, transforming the information into clear and concise questions and answers that emphasize key details and engage the reader effec- tively. 0.6460.735 6Rewrite the text in the style of a news report, en- suring the information is presented objectively and concisely. Rewrite the text into a Frequently Asked Questions section, organizing the information into clear and concise questions and answers while highlighting key details and maintaining clarity and readability. 0.7930.904 7Rewrite the text as a sports report, ensuring the ac- tion is described with dynamic, energetic language that conveys the pace, tension, and excitement of the event. Rewrite the text in the style of an engaging editorial, enhancing the narrative through vivid language, emotional depth, and a focus on the significance of the subject matter. 0.6550.713 8Rewrite the text as a narrative blog post, organized into clear sections with subheadings. Use a tone that is engaging and reflective, blending storytelling with explanation. Rewrite the text in the form of a Frequently Asked Questions section, focusing on clearly structured questions and answers that highlight key aspects, contributions, and significance of the subject matter in a conversational tone. 0.6670.748 9Rewrite the text as a step-by-step instructional guide. Break the content into numbered steps, with each step beginning with a clear imperative verb. Rewrite the text as a step-by-step instructional guide, breaking down the information into clear, organized steps that highlight key concepts, details, and relevant insights for enhanced understanding. 0.7780.841 10Rewrite the text as a recipe, introduce the informa- tion as sequential steps. Rewrite the text to persuasively present factual in- formation, emphasizing key aspects and structuring the content clearly to enhance engagement and clar- ity. 0.7000.724 11Rewrite the text to persuade the reader through factual information, making sure to include at least three specific data points or statistics to support the argument. Rewrite the text in the style of an encyclopedia entry, focusing on enhancing structural clarity, coherence, and technical detail by organizing the information into distinct sections and emphasizing historical significance and key contributions. 0.6330.633 12Rewrite the text as a sales description, and be sure to include a clear call-to-action at the end. Rewrite the text as a Frequently Asked Questions section, transforming the original content into a clear and engaging question-and-answer format that effectively highlights key elements, signifi- cance, and context for the reader. 0.6220.725 25 Combating Data Laundering in LLM Training Table 22|Inside register prompts and corresponding reversed prompts with Orig andSDRresults (continues). IDOriginal PromptReversed Prompt (SDR)Orig (AUC) SDR (AUC) 13Rewrite the text in the style of an editorial, making sure to include a clear stance or opinion and a con- cluding paragraph that calls for action or reflection. Rewrite the text as a personal opinion piece, empha- sizing reflective commentary and personal insights while exploring the broader societal implications and significance of the subject matter. 0.5940.657 14Rewrite the text as an informational description, en- suring the tone is neutral and objective, and include at least one definition or clarification to help the reader better understand the subject. Rewrite the text as a step-by-step instructional guide, organizing the content into clear, numbered sections that effectively communicate essential in- formation about the subject. 0.5940.795 15 Rewrite the text in the style of an encyclopedia en- try, maintaining a neutral, authoritative tone, and include at least one date, fact, or reference to give it the appearance of being sourced. Rewrite the text as an informational description, fo- cusing on presenting a clear, structured overview of the subject’s key facts, achievements, and back- ground while maintaining concise and objective lan- guage. 0.7920.923 16Rewrite the text as an academic research article, structured with sections such as Abstract, Introduc- tion, Method, Results, and Conclusion, and include at least one in-text citation (invented if necessary) to simulate scholarly referencing. Rewrite the text in the form of an interview, trans- forming the original content into a conversational dialogue that incorporates engaging questions and responses while maintaining clarity and coherence. 0.5250.546 17Rewrite the text as a descriptive profile of a specific thing or person, using vivid details and attributes (appearance, characteristics, or context) and ending with a short summary sentence that highlights its significance. Rewrite the text as a sales description, transforming it into an engaging narrative that highlights the sub- ject’s achievements, legacy, and emotional impact to captivate and appeal to potential audiences. 0.6610.765 18Rewrite the text in the form of a Frequently Asked Questions (FAQ) section, making sure to include at least three question–answer pairs, with the ques- tions phrased from the perspective of a curious reader. Rewrite the text in the form of an interview, trans- forming factual information into a conversational question-and-answer format that captures personal insights, key themes, and details from the original content. 0.6400.792 19Rewrite the text as legal terms and conditions, us- ing formal legal language, and ensure at least one numbered clause is included for clarity. Rewrite the text into a Frequently Asked Questions section by converting the content into clear ques- tions and answers, ensuring clarity, conciseness, ac- curacy, and structured organization of information. 0.7310.833 20Rewrite the text as a personal opinion piece, written in the first person, making sure to clearly express a stance and support it with at least one reason or example. Rewrite the text as a review, focusing on summariz- ing key aspects and implications while maintaining an engaging narrative style that connects with the reader. 0.5750.613 21Rewrite the text as a review, giving it a clear positive or negative stance, and include at least one specific detail or example to justify the evaluation. Rewrite the text as a review, emphasizing the sub- ject’s significance, key achievements, and connec- tions to broader themes or contexts, while main- taining a consistent tone and providing a balanced evaluation. 0.5930.698 22Rewrite the text as an opinion blog post, written in a conversational and persuasive tone, and include at least one personal anecdote or illustrative example to strengthen the argument. Rewrite the text as a conversational interview, focus- ing on transforming factual content into dialogue by incorporating questions, responses, and personal insights while maintaining the original essence. 0.5770.630 23Rewrite the text as a denominational religious ser- mon, using a reverent and exhortative tone, and include at least one scriptural quotation or moral teaching to guide the audience toward reflection or action. Rewrite the text as a denominational religious ser- mon, transforming the narrative into an inspira- tional message that emphasizes spiritual themes, fosters community, and resonates with the congre- gation’s values. 0.5410.627 26 Combating Data Laundering in LLM Training Table 23| Outside register prompts and corresponding reversed prompts with Orig and SDR results. IDOriginal PromptReversed Prompt (SDR)Orig (AUC) SDR (AUC) 1Rewrite the following content as slide presentation bullet points. Focus on summarizing the key ar- guments and findings clearly and concisely. Use concise phrases that highlight core points. Rewrite the text as a step-by-step instructional guide, organizing the information into clear sections and ensuring each step provides concise, relevant details on the specified topic. 0.7300.799 2 Rewrite the following text in the style of a Facebook post. Sharing interesting information with followers. You may add light commentary, questions to the audience, or casual phrasing, but keep it natural and human-like. Avoid using emojis, hashtags, or overly dramatic expressions. Rewrite the text as a Frequently Asked Questions section, transforming the information into an en- gaging question-and-answer format that encourages reader interaction and maintains a conversational tone. 0.6440.730 3 Adapt the text into a poetic form with vivid metaphors, rhythmic structure, and emotionally evocative language. Rewrite the text in a lyrical style that transforms factual content into an evocative narrative, using vivid imagery, poetic devices, and rhythmic flow to highlight emotional resonance and thematic cohe- sion. 0.5380.674 4 Convert the content into a tutorial-style explana- tion for beginners, using step-by-step instructions, simple analogies, and common misunderstandings. Rewrite the text as a step-by-step instructional guide, ensuring clear and concise steps that effec- tively outline key aspects and concepts while main- taining an engaging tone and logical flow through- out. 0.6160.679 5 Rewrite the text as a formal business email, ensuring clarity, professionalism, and a polite tone. Rewrite the text in the style of an encyclopedia entry, emphasizing clear and concise organization, formal language, and distinct sections that present factual information and key points effectively. 0.7950.884 6 Rewrite the passage as a scientific abstract, includ- ing Background, Methods, Results, and Conclusions. Invent at least two numerical values (percentages, sample sizes, or statistical outcomes) to support claims. Rewrite the text as a Frequently Asked Questions section, transforming the original content into clear, concise questions and answers that emphasize key themes, significant information, and factual accu- racy. 0.6000.678 7Rewrite the text as a product description for an e- commerce website, highlighting key features, bene- fits, and use cases in a persuasive manner. Rewrite the text as a dialogue in an interview format, emphasizing key details and insights while main- taining clarity and engagement through a question- and-answer structure. 0.6030.673 8Rewrite the text as a blog post, incorporating vivid descriptions of locations, cultural insights, and per- sonal experiences to engage readers. Rewrite the text as a sales description that empha- sizes unique aspects and engaging narratives, high- lighting significance and emotional appeal to capti- vate the audience. 0.6260.728 9 Rewrite the text as a classroom lecture transcript, with explanations, rhetorical questions, and occa- sional student interaction. Rewrite the text in the form of an interview, trans- forming the information into a natural dialogue that incorporates questions and answers while preserv- ing the original content’s key details and themes. 0.6670.764 10Rewrite the text with stronger transitions between sentences and paragraphs, ensuring smoother read- ing without adding new information. Rewrite the text in the style of an editorial, focusing on enhancing the narrative through emotional en- gagement, historical significance, and the subject’s impact, while highlighting community involvement and contemporary relevance. 0.5700.646 27 Combating Data Laundering in LLM Training Mixed-register prompt 1. Rewrite the text as an opinion blog post with a persuasive tone.SDR- reversed prompt: Rewrite the text as an opinion blog post, emphasizing personal narratives and reflections that highlight the emotional, cultural, or historical significance of the subject while engaging the reader. Mixed-register prompt 2. Rewrite the text as a storytelling narrative to introduce information as a sports report.SDR-reversed prompt: Rewrite the text as a narrative blog post. Focus on transforming the original information into a more engaging story, emphasizing the historical context and the evolution of the organization while maintaining a conversational tone. Mixed-register prompt 3.Rewrite the text as an informational description like a recipe.SDR-reversed prompt: Rewrite the text as a step-by-step instructional guide, clearly outlining key aspects and maintaining a logical flow and numbered steps. L. Comparison to Reverse Prompt Engineering Methods To clarify howSDRdiffers from related lines of work, especially those based on prompt-recovery techniques, we note an important methodological distinction: To the best of our knowledge, existing reverse prompt engineering methods, however, assume that the unknown prompt is applied at inference time and leaves a direct trace in the observed outputs. In our setting, the laundering prompt is applied before training. The data-rights holder only sees the trained model and never observes any text generated under the unknown laundering prompt, making a direct application impossible. We summarize the conceptual differences between Reverse Prompt Engineering (Li and Klabjan, 2024) andSDRas follows. Reverse prompt engineering assumes that the unknown prompt is applied during inference, meaning that it directly conditions the model’s outputs and therefore leaves observable traces that the recovery procedure can exploit. In contrast,SDRtargets laundering transformations applied before training, where the prompt does not manifest in any generated text. Instead, only implicit consequences of the laundering process remain embedded in the trained model. Moreover, reverse prompt engineering methods rely on having direct access to model outputs produced under the unknown prompt, whereas in our setting the data-rights holder never observes any prompt-conditioned outputs and can only query the final trained model. These differences make existing reverse prompt engineering approaches incompatible with the laundering-before-training scenario that SDR is designed to address. To still provide a comparison, we slightly adapt Reverse Prompt Engineering (Li and Klabjan, 2024) to a use case better aligned with our problem setup: given an original document, we let푀 푡 generate a continuation and treat that continuation as a proxy “laundered” version; we then ask Reverse Prompt Engineering (Li and Klabjan, 2024) to infer a prompt connecting the original and continuation. Table 24 shows thatSDRprovides the largest improvement among all methods.Loss+SDRachieves an AUC of 0.782 and an ASR of 0.764, clearly outperforming both the baseline detector and the adapted reverse prompt engineering approach. While reverse prompt engineering offers modest gains over the baseline, its improvements remain limited, highlighting that it is considerably less effective thanSDRin recovering laundering transformations and restoring detector performance. M. TPR@1% Result We report TPR@1% (True Positive Rate at 1% False Positive Rate) as a complementary metric to TPR@5% reported in the main paper. While TPR@5% evaluates detection performance under a relatively lenient false- 28 Combating Data Laundering in LLM Training Table 24| Comparison between SDR and reverse prompt engineering. MethodAUCASR Loss + SDR0.7820.764 Loss + Reverse Prompt Engineering0.6820.663 Loss0.6380.635 positive constraint, TPR@1% imposes a stricter threshold, reflecting scenarios where auditors require higher precision before making an accusation of data misuse. A higher TPR@1% indicates that the detection method can correctly identify more training samples while maintaining a very low rate of false accusations. As shown in Table 25,SDRconsistently improves TPR@1% across all detectors and both inside- and outside-register settings, further confirming its effectiveness under stricter evaluation criteria. Table 25| TPR@1% results for the main experiment. MethodInside TPR@1Outside TPR@1 Recall0.0020.008 Recall + SDR0.106 0.062 Loss0.0470 Loss + SDR0.112 0.069 Min-K0.00130.016 Min-K + SDR0.0960.082 Min-K++0.0020.012 Min-K++ + SDR0.0860.071 29