{"course":{"slug":"open-models","title":"The Open Model Ecosystem","url":"https://addaly.com/learn/open-models","level":"intermediate","track":"deep"},"lesson":{"slug":"data-provenance","title":"Where the training data comes from","url":"https://addaly.com/learn/open-models/data-provenance","position":5,"of":71,"minutes":10,"answer":"Open models are built on a handful of named public web corpora processed by undisclosed filters, and crawler opt-outs only ever work forwards, so what a model already learned cannot be withdrawn.","keyIdea":"Open models are built on a handful of named public web corpora processed by undisclosed filters, and crawler opt-outs only ever work forwards, so what a model already learned cannot be withdrawn."},"body":{"format":"markdown","text":"## The corpora that are actually used\n\nAlmost every open model of the last few years is built on a small number of public web corpora, mixed with code, books, papers and synthetic text. Knowing the names is worth an afternoon because the model card usually names them, and if it does not, that absence is itself information.\n\n**Common Crawl** is a non-profit that has been crawling the web since 2008 and publishes monthly snapshots. Each snapshot is a few billion pages; the archive as a whole runs to hundreds of terabytes of compressed HTML. It is the raw material under nearly everything, and it is raw: boilerplate, navigation menus, spam, duplicated pages, and text in every language mixed together.\n\n**C4** is Google's cleaned English extract of a single Common Crawl snapshot, around 750 GB of text. It became the reference example of what filtering does, partly because researchers later audited it and found what the filters had removed, including a disproportionate amount of text written in African American English and text about LGBT topics, because a naive bad-word filter treats reclaimed language as profanity.\n\n**The Pile** was EleutherAI's 825 GB mixed corpus: code, PubMed, arXiv, Stack Exchange, and a books collection called Books3. Books3 turned out to be roughly 190,000 pirated books, and it was removed after takedown notices in 2023. Models trained before that still contain what it taught them.\n\n**Dolma** is AI2's 3-trillion-token corpus, released with its tooling. **FineWeb** is Hugging Face's 15-trillion-token filtered Common Crawl derivative, notable because the team published ablations: they trained small models on each filtering variant to test whether a filter actually improved anything, rather than assuming it did. That methodology is the useful thing to take away, more than the corpus itself.\n\n## What filtered actually means\n\nWhen a card says the data was filtered and deduplicated, it usually means some subset of these steps:\n\n> Figure: What \"filtered and deduplicated\" covers. Layers, top to bottom: Common Crawl snapshots (A few billion pages a month since 2008: boilerplate, spam, duplicates and every language mixed together); Language identification (The classifier is least accurate exactly where the data is thinnest, so low-resource languages disappear here); Deduplication, exact and near (Duplicated text is memorised far more readily, so this measurably reduces verbatim regurgitation); Quality classification (A small model trained to recognise reference-page text: a taste judgement wearing a statistical hat); Safety and toxicity filtering (The audit of C4 found a naive bad-word filter removing reclaimed language and text about LGBT topics); Benchmark decontamination (Only some labs, only the benchmarks they thought of, usually by n-gram overlap, which misses paraphrases). None of these steps is neutral and none is disclosed in enough detail to be reproduced for most commercial releases. A crawler opt-out added today changes nothing above this line, because those snapshots are already published and already mirrored.\n\n- **Language identification**, keeping documents a classifier thinks are in the target languages. This step is where low-resource languages disappear, because the classifier is least accurate exactly where the data is thinnest.\n- **Deduplication**, exact and near-duplicate, at document and sometimes paragraph level. This matters more than it sounds: duplicated text is memorised much more readily, and dedup measurably reduces verbatim regurgitation.\n- **Quality classification**, often a small model trained to recognise text that looks like a reference page or a textbook. This is a taste judgement wearing a statistical hat.\n- **Safety and toxicity filtering**, with the collateral damage described above.\n- **Benchmark decontamination**, removing documents that overlap with known test sets. Only some labs do it, only for the benchmarks they thought of, and usually by n-gram overlap, which misses paraphrases.\n\nNone of these steps is neutral, and none is disclosed in enough detail to be reproduced for most commercial releases.\n\n## Opt-out, and its honest limits\n\nSeveral mechanisms now exist for saying do not train on this.\n\n- `robots.txt` blocking specific crawler agents, including Common Crawl's `CCBot` and various lab-specific crawlers.\n- The emerging `ai.txt` and `llms.txt` conventions, which are conventions rather than enforcement.\n- Spawning's Do Not Train registry and the opt-out fields on some dataset hosts.\n\nEach of these has the same limitation, and it is a mechanical one rather than a legal one. **They are prospective only.** Blocking a crawler today does nothing about the snapshots taken in the last fifteen years, which are already published, already mirrored, and already inside models that are already trained. There is no mechanism to remove a page from a crawl that has been distributed, and no mechanism to remove what a trained model learned from it short of retraining.\n\nThat is worth saying plainly rather than implying otherwise, because a lot of writing on this subject leaves people believing that adding a line to a file protects work that was published in 2019.\n\n## What you can do in practice\n\nIf you need to know what is in a model, you have three moves and they get progressively weaker.\n\n1. **Search the corpus**, where the corpus is published. `grep` over Dolma or FineWeb is slow but conclusive for exact strings. Hugging Face's dataset search covers many public sets.\n2. **Probe the model.** Prompt it with the first half of a document you suspect and see whether it completes the second half verbatim. This detects memorisation, which is a subset of inclusion; a model can have trained on something without memorising it.\n3. **Test on fresh material.** Write new items in the same style and compare performance. A large drop on fresh items is evidence of contamination, without ever seeing the corpus.\n\nFor your own datasets, do the thing the labs mostly do not: write a dataset card. Where each part came from, what licence it carries, what you removed, and the date. It takes an hour and it is the only version of provenance anyone downstream will ever be able to check."},"check":{"question":"A publisher adds a rule to robots.txt in 2026 blocking Common Crawl's bot, then asks whether their archive from 2015 onwards is now protected from being used in model training. What is the mechanically accurate answer?","options":[{"text":"Yes, because Common Crawl honours robots.txt retroactively and removes previously crawled pages from published snapshots.","correct":false,"tempting":"Assumes a retroactive removal mechanism that does not exist; snapshots are already distributed and mirrored once published."},{"text":"Yes for text, no for images, because image crawlers use different opt-out registries.","correct":false,"tempting":"Invents a distinction by media type; the prospective-only limitation applies identically to both."},{"text":"Only future crawls are affected; existing snapshots stay published, and models already trained on them cannot unlearn the content without retraining.","correct":true},{"text":"No, because robots.txt has no legal force, so the rule changes nothing at all.","correct":false,"tempting":"Overshoots in the other direction: major crawlers do respect it going forward, so the rule does change future collection."}]},"prev":{"slug":"the-openness-spectrum","title":"Grading openness without arguing about the word","url":"https://addaly.com/learn/open-models/the-openness-spectrum"},"next":{"slug":"copyright-and-training-data","title":"The copyright question nobody has settled","url":"https://addaly.com/learn/open-models/copyright-and-training-data"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Where the training data comes from', in The Open Model Ecosystem. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/open-models/data-provenance (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Where the training data comes from","courseTitle":"The Open Model Ecosystem","module":{"index":1,"slug":"what-open-really-means","title":"What open actually means"},"answer":null,"keyIdea":"Open models are built on a handful of named public web corpora processed by undisclosed filters, and crawler opt-outs only ever work forwards, so what a model already learned cannot be withdrawn.","hero":{"kind":"figure","figure":{"t":"figure","label":"Figure","figure":{"type":"stack","title":"What “filtered and deduplicated” covers","layers":[{"label":"Common Crawl snapshots","detail":"A few billion pages a month since 2008: boilerplate, spam, duplicates and every language mixed together"},{"label":"Language identification","detail":"The classifier is least accurate exactly where the data is thinnest, so low-resource languages disappear here"},{"label":"Deduplication, exact and near","detail":"Duplicated text is memorised far more readily, so this measurably reduces verbatim regurgitation"},{"label":"Quality classification","detail":"A small model trained to recognise reference-page text: a taste judgement wearing a statistical hat"},{"label":"Safety and toxicity filtering","detail":"The audit of C4 found a naive bad-word filter removing reclaimed language and text about LGBT topics"},{"label":"Benchmark decontamination","detail":"Only some labs, only the benchmarks they thought of, usually by n-gram overlap, which misses paraphrases"}],"caption":"None of these steps is neutral and none is disclosed in enough detail to be reproduced for most commercial releases. A crawler opt-out added today changes nothing above this line, because those snapshots are already published and already mirrored."},"alt":"Figure: What “filtered and deduplicated” covers. Layers, top to bottom: Common Crawl snapshots (A few billion pages a month since 2008: boilerplate, spam, duplicates and every language mixed together); Language identification (The classifier is least accurate exactly where the data is thinnest, so low-resource languages disappear here); Deduplication, exact and near (Duplicated text is memorised far more readily, so this measurably reduces verbatim regurgitation); Quality classification (A small model trained to recognise reference-page text: a taste judgement wearing a statistical hat); Safety and toxicity filtering (The audit of C4 found a naive bad-word filter removing reclaimed language and text about LGBT topics); Benchmark decontamination (Only some labs, only the benchmarks they thought of, usually by n-gram overlap, which misses paraphrases). None of these steps is neutral and none is disclosed in enough detail to be reproduced for most commercial releases. A crawler opt-out added today changes nothing above this line, because those snapshots are already published and already mirrored."}},"blocks":[{"t":"h2","id":"the-corpora-that-are-actually-used","runs":[{"text":"The corpora that are actually used"}]},{"t":"p","runs":[{"text":"Almost every open model of the last few years is built on a small number of public web corpora, mixed with code, books, papers and synthetic text. Knowing the names is worth an afternoon because the model card usually names them, and if it does not, that absence is itself information."}]},{"t":"p","runs":[{"text":"Common Crawl","b":true},{"text":" is a non-profit that has been crawling the web since 2008 and publishes monthly snapshots. Each snapshot is a few billion pages; the archive as a whole runs to hundreds of terabytes of compressed HTML. It is the raw material under nearly everything, and it is raw: boilerplate, navigation menus, spam, duplicated pages, and text in every language mixed together."}]},{"t":"p","runs":[{"text":"C4","b":true},{"text":" is Google’s cleaned English extract of a single Common Crawl snapshot, around 750 GB of text. It became the reference example of what filtering does, partly because researchers later audited it and found what the filters had removed, including a disproportionate amount of text written in African American English and text about LGBT topics, because a naive bad-word filter treats reclaimed language as profanity."}]},{"t":"p","runs":[{"text":"The Pile","b":true},{"text":" was EleutherAI’s 825 GB mixed corpus: code, PubMed, arXiv, Stack Exchange, and a books collection called Books3. Books3 turned out to be roughly 190,000 pirated books, and it was removed after takedown notices in 2023. Models trained before that still contain what it taught them."}]},{"t":"p","runs":[{"text":"Dolma","b":true},{"text":" is AI2’s 3-trillion-token corpus, released with its tooling. "},{"text":"FineWeb","b":true},{"text":" is Hugging Face’s 15-trillion-token filtered Common Crawl derivative, notable because the team published ablations: they trained small models on each filtering variant to test whether a filter actually improved anything, rather than assuming it did. That methodology is the useful thing to take away, more than the corpus itself."}]},{"t":"h2","id":"what-filtered-actually-means","runs":[{"text":"What filtered actually means"}]},{"t":"p","runs":[{"text":"When a card says the data was filtered and deduplicated, it usually means some subset of these steps:"}]},{"t":"ul","items":[[{"text":"Language identification","b":true},{"text":", keeping documents a classifier thinks are in the target languages. This step is where low-resource languages disappear, because the classifier is least accurate exactly where the data is thinnest."}],[{"text":"Deduplication","b":true},{"text":", exact and near-duplicate, at document and sometimes paragraph level. This matters more than it sounds: duplicated text is memorised much more readily, and dedup measurably reduces verbatim regurgitation."}],[{"text":"Quality classification","b":true},{"text":", often a small model trained to recognise text that looks like a reference page or a textbook. This is a taste judgement wearing a statistical hat."}],[{"text":"Safety and toxicity filtering","b":true},{"text":", with the collateral damage described above."}],[{"text":"Benchmark decontamination","b":true},{"text":", removing documents that overlap with known test sets. Only some labs do it, only for the benchmarks they thought of, and usually by n-gram overlap, which misses paraphrases."}]]},{"t":"p","runs":[{"text":"None of these steps is neutral, and none is disclosed in enough detail to be reproduced for most commercial releases."}]},{"t":"h2","id":"opt-out-and-its-honest-limits","runs":[{"text":"Opt-out, and its honest limits"}]},{"t":"p","runs":[{"text":"Several mechanisms now exist for saying do not train on this."}]},{"t":"ul","items":[[{"text":"robots.txt","code":true},{"text":" blocking specific crawler agents, including Common Crawl’s "},{"text":"CCBot","code":true},{"text":" and various lab-specific crawlers."}],[{"text":"The emerging "},{"text":"ai.txt","code":true},{"text":" and "},{"text":"llms.txt","code":true},{"text":" conventions, which are conventions rather than enforcement."}],[{"text":"Spawning’s Do Not Train registry and the opt-out fields on some dataset hosts."}]]},{"t":"p","runs":[{"text":"Each of these has the same limitation, and it is a mechanical one rather than a legal one. "},{"text":"They are prospective only.","b":true},{"text":" Blocking a crawler today does nothing about the snapshots taken in the last fifteen years, which are already published, already mirrored, and already inside models that are already trained. There is no mechanism to remove a page from a crawl that has been distributed, and no mechanism to remove what a trained model learned from it short of retraining."}]},{"t":"p","runs":[{"text":"That is worth saying plainly rather than implying otherwise, because a lot of writing on this subject leaves people believing that adding a line to a file protects work that was published in 2019."}]},{"t":"h2","id":"what-you-can-do-in-practice","runs":[{"text":"What you can do in practice"}]},{"t":"p","runs":[{"text":"If you need to know what is in a model, you have three moves and they get progressively weaker."}]},{"t":"ol","start":1,"items":[[{"text":"Search the corpus","b":true},{"text":", where the corpus is published. "},{"text":"grep","code":true},{"text":" over Dolma or FineWeb is slow but conclusive for exact strings. Hugging Face’s dataset search covers many public sets."}],[{"text":"Probe the model.","b":true},{"text":" Prompt it with the first half of a document you suspect and see whether it completes the second half verbatim. This detects memorisation, which is a subset of inclusion; a model can have trained on something without memorising it."}],[{"text":"Test on fresh material.","b":true},{"text":" Write new items in the same style and compare performance. A large drop on fresh items is evidence of contamination, without ever seeing the corpus."}]]},{"t":"p","runs":[{"text":"For your own datasets, do the thing the labs mostly do not: write a dataset card. Where each part came from, what licence it carries, what you removed, and the date. It takes an hour and it is the only version of provenance anyone downstream will ever be able to check."}]}],"check":{"question":[{"text":"A publisher adds a rule to robots.txt in 2026 blocking Common Crawl’s bot, then asks whether their archive from 2015 onwards is now protected from being used in model training. What is the mechanically accurate answer?"}],"options":[{"text":[{"text":"Yes, because Common Crawl honours robots.txt retroactively and removes previously crawled pages from published snapshots."}],"correct":false,"tempting":[{"text":"Assumes a retroactive removal mechanism that does not exist; snapshots are already distributed and mirrored once published."}]},{"text":[{"text":"Yes for text, no for images, because image crawlers use different opt-out registries."}],"correct":false,"tempting":[{"text":"Invents a distinction by media type; the prospective-only limitation applies identically to both."}]},{"text":[{"text":"Only future crawls are affected; existing snapshots stay published, and models already trained on them cannot unlearn the content without retraining."}],"correct":true,"tempting":null},{"text":[{"text":"No, because robots.txt has no legal force, so the rule changes nothing at all."}],"correct":false,"tempting":[{"text":"Overshoots in the other direction: major crawlers do respect it going forward, so the rule does change future collection."}]}],"order":[0,1,3,2],"why":null},"prev":{"slug":"the-openness-spectrum","title":"Grading openness without arguing about the word","minutes":9},"next":{"slug":"copyright-and-training-data","title":"The copyright question nobody has settled","minutes":10}}}