Refinement Provenance Inference: Detecting LLM-Refined Training Prompts from Model Behavior

TL;DR

This paper introduces RePro, a method to detect whether training prompts for language models were original or refined by an external refiner, using stable shifts in model output distributions for dataset governance and dispute resolution.

Contribution

The paper formalizes the Refinement Provenance Inference task and proposes RePro, a logit-based framework that effectively detects refined prompts across models without access to training data.

Findings

RePro achieves strong performance in provenance inference.

RePro transfers well across different refiners.

Detection relies on stable distribution shifts rather than rewrite artifacts.

Abstract

Instruction tuning increasingly relies on LLM-based prompt refinement, where prompts in the training corpus are selectively rewritten by an external refiner to improve clarity and instruction alignment. This motivates an instance-level audit problem: for a fine-tuned model and a training prompt-response pair, can we infer whether the model was trained on the original prompt or its LLM-refined version within a mixed corpus? This matters for dataset governance and dispute resolution when training data are contested. However, it is non-trivial in practice: refined and raw instances are interleaved in the training corpus with unknown, source-dependent mixture ratios, making it harder to develop provenance methods that generalize across models and training setups. In this paper, we formalize this audit task as Refinement Provenance Inference (RPI) and show that prompt refinement yields stable, detectable shifts in teacher-forced token distributions, even when semantic differences are not obvious. Building on this phenomenon, we propose RePro, a logit-based provenance framework that fuses teacher-forced likelihood features with logit-ranking signals. During training, RePro learns a transferable representation via shadow fine-tuning, and uses a lightweight linear head to infer provenance on unseen victims without training-data access. Empirically, RePro consistently attains strong performance and transfers well across refiners, suggesting that it exploits refiner-agnostic distribution shifts rather than rewrite-style artifacts.