\section{Threat Model \& Problem Setup}
\label{sec:threat}

\subsection{Knowledge \& Access}
We consider a copyright auditor (artist, rights holder, or third-party investigator) who seeks to test whether a given musical piece was used to train a target model. The auditor has forward-pass access only: they can submit a piece and obtain per-token log-probabilities via teacher forcing; gradients and weight updates are unavailable and not required. We assume knowledge of the tokenization scheme (typically documented) but no access to internal training data or optimizer states..

\subsection{Decision Problem}
Given a sequence $\mathbf{x}=(x_{1},\dots,x_{T})$ over vocabulary $V$, the auditor computes a score $s(\mathbf{x})\in\mathbb{R}$ that is monotonically related to membership likelihood and issues a binary decision. The hypotheses are
\begin{equation}
\begin{aligned}
H_0&:\ \mathbf{x}\notin \mathcal{D}_{\text{train}}\ \ \text{(non-member)},\\
H_1&:\ \mathbf{x}\in \mathcal{D}_{\text{train}}\ \ \text{(member)}.
\end{aligned}
\end{equation}
A threshold $\tau$ induces the decision rule $\mathbb{1}[s(\mathbf{x})>\tau]$. Thresholding and evaluation metrics follow the protocol defined in \S\ref{sec:setup}.