[Submitted on 24 Apr 2025 (v1), last revised 30 Oct 2026 (this version, v3)]
Abstract:Using a legally obtained dataset of 34 copyrighted O’Reilly Media books (13,962 paragraphs), we apply the DE-COP membership inference attack to test whether OpenAI models show recognition of non-public (pay-walled) content they were not licensed to train on. Our main contribution is examining non-public books, which allows us to consider potential access violations and not just training inclusion. Our results suggest that GPT-4o, OpenAI’s more recent and capable model in our sample, exhibits patterns consistent with recognition of non-public books, with an AUROC score of 0.82 (95% bootstrapped CI: 0.60-0.96) — where above 50% is better than random chance. GPT-3.5 Turbo (trained two years prior) and the smaller GPT-4o Mini both score near chance recognition on non-public data (0.54 and 0.56, respectively). Results are robust to independent paraphrasers (Gemma and Qwen) and leave-one-book-out sensitivity analyses. We also test both GPT-4o and GPT-4o mini, with the same October 2023 training cutoff date, to ensure the model is not simply identifying language shifts over time. These findings support disclosure requirements for pre-training data provenance and formal licensing markets for training content. Results remain preliminary given the small book sample, possible contamination of post-cutoff controls, and differences across models in size, architecture, and training composition.
Submission history
From: Ilan Strauss Dr. [view email]
[v1] Thu, 24 Apr 2025 15:49:59 UTC (499 KB)
[v2] Wed, 6 May 2026 17:41:54 UTC (237 KB)
[v3] Fri, 30 Oct 2026 16:20:37 UTC (461 KB)
