Analyzing Code Provenance in LLMs for Programming Education

Analyzing Code Provenance in LLMs for Programming Education Subhankar Maity1 , Faiza Belbachir1 , Omar Boucelma2 , and Guilherme Medeiros Machado1 LyRIDS, ECE Research Center, Paris, France Aix Marseille Univ, Université de Toulon, CNRS, LIS, Marseille, France {smaity, fbelbachir, gmedeirosmachado}@ece.fr, omar.boucelma@univ-amu.fr 1

arXiv:2611.09177v1 [cs.AI] 6 Nov 2026

2

Abstract. Large language models (LLMs) play an increasing role in programming education, challenging traditional assessment methods as they can generate fully functional code instantly. This disrupts the reliability of student submissions as indicators of learning and effort. To address this issue, code provenance is essential for tracing the origins of code and distinguishing student-authored, AI-generated, and externally sourced components. We extend the Min-K% probability approach by incorporating synthetic non-member code generation and apply it to Python code for membership inference and provenance tracking. Evaluations cover free LLMs such as GPT-2, DistilGPT-2, and DialoGPT, as well as state-of-the-art commercial models including GPT-5, Gemini 2.5, Mistral, DeepSeek, and LLaMA 3.3. Before evaluating our approach on higher-education student assignments, we validate its feasibility using Stack Overflow data. The results show that free models enable more sensitive code memorization detection than commercial models. By systematically comparing these LLMs, we assess trade-offs between detection accuracy and privacy protection, taking an initial step toward effective assessment of AI-assisted programming education through combined provenance detection and process visibility. Keywords: LLMs · Programming Education · Generative AI · Code Provenance · Automated Assessment

1

Introduction

The increasing integration of LLMs into education, alongside their use in industry and consumer services, underscores the need for transparency in training data provenance [13]. In educational contexts, it is essential for instructors to understand which data inform the model outputs. Such understanding builds trust and helps prevent unintended misuse, including biased or unfair grading. The enormous scale and diversity of datasets fueling LLM development complicate efforts to identify whether specific data samples have contributed to model learning, intensifying debates over intellectual property, data privacy, and ethical AI use [24]. These challenges are especially acute in education, where programming

2

S. Maity et al.

courses increasingly grapple with sophisticated forms of code plagiarism, often involving AI-generated or online-sourced solutions [9]. Traditional plagiarism detection mechanisms struggle against such sophisticated methods, jeopardizing academic integrity and legal compliance [20]. However, the motivation goes beyond plagiarism detection. We are in a transition period in which LLMs are significantly reshaping how learning is observed and assessed [13]. Before the advent of generative AI, programming assessments primarily focused on evaluating the final student code for correctness and style, following established summative or formative assessment approaches [29]. These traditional methods, grounded in product-based evaluation, emphasized the assessment of completed programming assignments rather than the learning journey itself. Coding exercises reliably reflected students’ understanding, effort, and problem-solving skills [15]. However, there is now a growing need to shift towards assessing the learning process itself, how students develop, modify, and integrate code over time. As LLMs can generate fully functional solutions instantly, code provenance, which tracks the origin and evolution of code segments, becomes essential for gaining deeper insight into student learning and supporting authentic process-oriented assessment. This shift demands a fundamental change in assessment practices, from focusing solely on final product correctness to emphasizing the student’s learning process. New formative assessment modalities are needed to make student thinking visible and support scalable instructor workflows. Code provenance technique offers a transformative solution by providing an overview of AI usage patterns across classes, acting as a pedagogical filter [4]. This enables instructors to prioritize formative feedback, identify students relying heavily on AI, or pinpoint widespread conceptual outsourcing, facilitating targeted interventions previously infeasible at scale. For example, an instructor could quickly identify students who rely almost exclusively on AI-generated code or pinpoint a specific programming concept (e.g., data structures, recursion, etc.) that a large portion of the class is outsourcing to AI. This enables a targeted intervention and makes the widespread adoption of formative assessment practices feasible for the first time. In this way, code provenance is not just an integrity tool; it serves as gate for a more effective and scalable homework assessment in the age of generative AI. Despite advances in membership inference for text data such as Wikipedia and copyright-protected books [26], research specifically addressing code remains sparse. Code data presents unique challenges compared to natural language text due to its structured syntax, dynamic behavior, and legal sensitivities [18]. These characteristics make provenance analysis especially crucial given the growing role of code generation in LLMs. Unlike plain text, code relies on precise formatting, hierarchical structure, and functional dependencies, which complicate traditional membership inference methods. To address this gap, we present the first comprehensive study applying membership inference attacks not only for code plagiarism detection but also for establishing a practical framework for scalable, process-oriented assessment methods. By systematically comparing free and commercial LLMs using the proposed method,

Analyzing Code Provenance in LLMs for Programming Education

3

this research takes an initial step toward assessing the trade-offs between detection accuracy and privacy protection in programming education. The central research question guiding this study is: To what extent can membership inference attacks on LLMs effectively detect code provenance to enable pedagogically meaningful, process-oriented assessment in AI-assisted programming education? This investigation aims to inform ongoing efforts to enhance assessment practices through a proof-of-concept in AI-assisted programming education. Specifically, this study makes the following contributions. – We extend the Min-K% probability approach by introducing a method for generating synthetic non-member code, specifically tailored to Python code data for provenance tracing of LLMs. These adaptations account for the unique structural and semantic characteristics of code data in educational settings, ensuring the method’s applicability beyond text to programming code. Furthermore, the approach can be readily extended to other programming languages. – We evaluate multiple free models, including variants of GPT-2, Distil GPT-2, and DialoGPT, alongside state-of-the-art commercial models such as GPT-5, Gemini 2.5, Mistral, DeepSeek, and LLaMA 3.3 using the proposed methodology. – To verify the applicability of this method in real-world educational settings, we conduct a proof-of-concept experiment on Python programming assignments from higher-education students. This experiment evaluates the extent of memorization in general-purpose LLMs, as these models are most commonly used by students for programming tasks. – We fill a critical gap in the literature by analyzing the trade-offs between privacy protection and detection effectiveness that educational institutions face when choosing between free and paid AI models.

2

Related Work

Membership Inference Attacks (MIAs): The primary objective of MIAs is to determine whether an arbitrary data sample was part of the training dataset of a target model [27]. Model memorization occurs when LLMs reproduce segments of their training data verbatim or nearly so, raising concerns about unintended disclosure of sensitive or proprietary information [5]. Data provenance, defined as the traceability of the origin and history of data modification, provides an essential lens to ensure accountability in AI systems and educational applications [23]. Previous research has focused largely on textual data such as Wikipedia and copyrighted book collections [26], while code data, with its inherent structural and semantic complexity and its unique importance in educational contexts, has received comparatively less attention. MIAs have evolved from basic nearest-neighbor detection to sophisticated probabilistic metrics, including the Min-K% approach, computing the average log-probability of the least likely tokens in given samples. [10] and [19] have emphasized the privacy risks and

4

S. Maity et al.

legal implications of data leakage in LLMs, sparking debate about responsible AI in practice. However, these works largely overlook code data, which is more sensitive due to its embodiment of intellectual property, unique problem-solving logic, and potential exposure of confidential business or security processes. Traditional Plagiarism Detection in Programming Education: Plagiarism detection in programming education has traditionally relied on analyzing code similarity, employing static metrics, and leveraging stylometric techniques [1, 3]. Notable approaches include structural comparison methods, such as those employed in MOSS and JPlag, behavioral analysis systems, like BPlag, which measures program execution similarity, and consensus-based frameworks that combine multiple detection tools to improve accuracy [6, 16]. Recent work has also explored machine learning approaches [7], with SVM-based systems showing promise for detecting plagiarism of Python code in undergraduate settings [11], and visual proof systems that provide transparent evidence of code similarity for educators [14]. Limitations of Existing Approaches with AI-Generated Code: However, these traditional approaches face significant limitations in the educational landscape of today. Although they effectively identify similar code structures or patterns, they cannot distinguish whether these similarities arise from exposure to model training data or from direct AI generation [1,9], a crucial distinction for an accurate educational evaluation. This limitation becomes increasingly problematic as students nowadays engage more in general-purpose LLMs, making it essential for educators to understand not only whether code is AI-generated, but also the source and nature of that generation [4].

3

Task Definition

The membership inference attack problem can be formally defined as follows. Let fθ be a language model trained on a dataset D = {zi }ni=1 sampled from an underlying distribution. The objective is to learn a detector h that infers the membership status of any arbitrary data point x, formally expressed as h(x, fθ ) → {0, 1}, where ‘0’ denotes non-membership and ‘1’ indicates membership. We assume a black-box setting in which the detector can only query fθ to obtain token probabilities for the input x. Given a target language model M equivalent to fθ , trained on a code dataset D, the task is to determine whether a query code sample x is part of D. This problem is posed as binary classification: ( 1 if x ∈ D (member) y= 0 if x ∈ / D (non-member). Member data D consists of code samples encountered during training, for which the model is expected to assign higher confidence (lower perplexity). Conversely, non-member data D′ comprises unseen code samples eliciting lower confidence

Analyzing Code Provenance in LLMs for Programming Education

5

(higher perplexity). In practical terms, such a membership detector can be employed to analyze coding assignments and determine if a given code snippet was likely seen during model training. A positive membership classification indicates that the model has ‘seen’ or memorized the code, which has important implications for maintaining assessment fairness and supporting authentic student learning.

4

Methodology

At the core of our pipeline is the extended Min-K% membership algorithm [26], implemented for code snippets in a modular fashion to enable robust and comparative evaluation across both free and commercial LLMs (Algorithm 1). As a novel contribution, we introduce synthetic non-member code generation to simulate code samples absent from a given model’s training data (Algorithm 2). Although this study focuses on Python code, the approach is designed to be adaptable to other programming languages and educational contexts. The Min-K% Algorithm: The core intuition behind the algorithm is that language models assign differential confidence levels to samples they have seen during training versus unseen samples. Training data typically yield higher token probabilities (and thus lower perplexities). Focusing on the lowest K% of token probabilities highlights the model’s most uncertain predictions, which are more discriminative than average perplexity, enhancing detection accuracy [26]. Algorithm 1 details the membership inference detection procedure for code snippets.

Algorithm 1 Membership Inference Detection for Code Snippets Input: Python code token sequence x = x1 , x2 , . . . , xn ; threshold τ ; parameter K% Output: Membership classification (Member/Non-member) 1: for i = 1 to n do 2: Compute log probability p(xi |x1 , . . . , xi−1 ) via model fθ 3: end for 4: Sort log probabilities ascending → Lsorted (x) 5: Extract the lowest k log-probabilities: Min-k(x) = Lsorted (x)[1 : k] P 6: Compute score: SMinK (x) = k1 ki=1 Min-k%(x)[i] 7: if SMinK (x) ≥ τ then 8: return Non-Member ▷ Code snippet likely unseen 9: else 10: return Member ▷ Code snippet likely in training data 11: end if

Workflow Phases: Fig. 1 presents the workflow for detecting LLM-generated code in coding homework using Min-K% Membership Inference Attack. Each phase of the workflow is as follows.

6

S. Maity et al.

a. Problem-solving Phase: The workflow begins with students submitting source code to a Learning Management System (LMS). A target code sample x is selected for analysis. b. Detection Phase: In the Detection Phase, x is tokenized and fed to the target LLM fθ . The Min-K% algorithm (Algorithm 1) processes the token probabilities: it calculates and sorts the log-probabilities, then computes the average SMinK (x) of the lowest K% values. The score is compared against a pre-defined threshold (τ ) to classify the sample as a Member (flagged) or a Non-member (Authentic). c. Assessment and Feedback Phase: Finally, in this phase, the membership result is presented to the instructor through a dashboard where they can check the probability that the flagged code was generated by different general-purpose LLMs. An instructor can also analyze the specific programming concepts related to the flagged code, gaining insights into which concepts students use LLMs most frequently and understanding their problemsolving processes. This enables educators to provide targeted feedback and assessments tailored to each student’s usage of AI-generated code.

Fig. 1. Workflow for detecting LLM-generated code in students’ code using the MinK% membership inference attack.

Threshold Selection: In our methodology, percentile-based thresholding is used to convert continuous membership scores into binary membership predictions. Following [32], thresholds (τ ) are calculated from the empirical distributions of membership scores for member and non-member samples. The average of the 75th percentile of member scores and the 25th percentile of non-member

Analyzing Code Provenance in LLMs for Programming Education

7

scores is chosen as the threshold. This choice is prudent as it effectively separates the two distributions by capturing a central tendency while minimizing the impact of outliers and noise. It ensures more stable and interpretable decision boundaries compared to heuristic or midpoint methods. Such robustness is crucial given the variability in code samples and complex behavior of language models.

5

Experiments

In this section, we describe the datasets used, detailing the member and synthetic non-member data, outline the external feasibility check conducted on Stack Overflow, present the experimental setup, and discuss the metrics employed to evaluate membership inference performance. Member Data: Python code samples are extracted from the ProCQA dataset [17]. ProCQA contains approximately 1.008 million records for Python, drawn from a collection spanning 11 popular programming languages, including Python, Java, JavaScript, Ruby, C, C++, C#, Rust, PHP, Lisp, and Go, sourced from Stack Overflow. Each record in ProCQA consists of a ‘question’, ‘description’, and ‘answer ’. For our study, only the ‘answer ’ record was used. These samples serve as our member code corpus for subsequent membership inference attacks and provenance tracking. The focus was narrowed to Python, which is the most popular language on Stack Overflow, widely used in educational settings, and the language of our curated student programming assignments. Table 1 presents the key Python programming concepts and the number of related programming questions in the ProCQA dataset. The set of programming concepts was adopted from the core topics3 and the recommended textbook on MIT OpenCourseWare. Table 1. Distribution of key Python programming concepts and the number of programming questions related to each concept in the ProCQA dataset. Programming Concept Frequency Tuples, Lists, Aliasing, Mutability, Cloning ∼1.5M String manipulation, Guess and Check, Approximations, Bisection ∼1.26M Decomposition, Abstractions, Functions ∼993K Branching and iterations ∼963K Recursion, Dictionaries ∼806K Testing, Debugging, Exceptions, Assertions ∼596K Data structures and algorithms ∼569K

Synthetic Non-Member Data: Inspired by prior work on data augmentation and code transformation for evaluating memorization in language models [2, 12, 21, 22, 30], we introduce a novel method (Algorithm 2) to syntheti3

MIT OpenCourseWare

8

S. Maity et al.

cally generate non-member code. This technique provides a controlled and reproducible way to simulate non-member samples, code segments that are algorithmically derived from, yet distinct from, the original training-like code. We generate diverse synthetic variations of the member code using five weighted randomization transformation strategies, designed to alter the surface form while preserving, partially preserving, or intentionally perturbing semantic intent. The transformation strategies are as follows: 1. Semantic Transformation (15%): Randomizes the name of variables and functions while modifying, removing, or paraphrasing comments to prevent memorization based on identifiers and text from natural language [30]. 2. Structural Transformation (15%): Alters indentation, spacing, formatting, and reorders control flow and logical blocks to disrupt superficial visual and logical patterns [21]. 3. Aggressive Transformation (40%): Injects redundant or equivalent logic and deliberately breaks code logic while maintaining syntactic correctness, challenging model robustness against subtle memorization [12]. 4. Cross Language Conversion (25%): Rewrites code to adopt the syntax and idioms of diverse languages and frameworks, e.g., JavaScript, Java, C++, GraphQL, Jupyter notebooks, adding syntactic and structural variety without altering its semantic intent [2]. 5. Novel Pattern Generation (5%): Generates entirely novel code structures beyond Python, including SQL/NoSQL queries, orchestration patterns (Kubernetes, Docker), and configuration scripts (Terraform), offering linguistically distant and structurally diverse examples [22].

Algorithm 2 Synthetic Non-Member Code Generation for Code Data Input: Python code snippets extracted from the ProCQA dataset C Output: Synthetic non-member code set C ′ 1: Initialize C ′ ← ∅ 2: for each code sample c ∈ C do 3: Randomly draw r ∼ Uniform(0, 1) 4: if r < 0.15 then 5: c′ ← SemanticTransformation(c) 6: else if r < 0.30 then 7: c′ ← StructuralTransformation(c) 8: else if r < 0.70 then 9: c′ ← AggressiveTransformation(c) 10: else if r < 0.95 then 11: c′ ← CrossLanguageConversion(c) 12: else 13: c′ ← NovelPatternGeneration(c) 14: end if 15: Add c′ to C ′ 16: end for 17: return C ′

Analyzing Code Provenance in LLMs for Programming Education

9

To validate that the synthetic non-member samples are distinct from the member data, we compute abstract syntax tree (AST)-based distance [28] by first parsing each code snippet into an AST and then measuring the normalized tree-edit distance between the original member AST and its synthetic counterpart over 500 code pairs. A distance of 0.996 (mean) indicates that synthesizing the transformed code from the original AST requires extensive structural edits, showing that the synthetic instances are structurally and syntactically far from the original data. External Feasibility Check on Stack Overflow: Before evaluating our approach on student programming assignments, we assess its feasibility using public Stack Overflow data, as represented in the ProCQA dataset. Stack Overflow, widely used by students for coding assistance, provides extensive community-curated programming knowledge and practical problem-solving insights [8]. By first evaluating the method on code derived from Stack Overflow code snippets and then on student assignments (Section 7), we ensure that our approach generalizes beyond a single in-house code base and remains applicable in realistic, education-relevant settings. Experimental Setup: Our experimental setup provides an evaluation framework across multiple LLMs. Data are split into 30% for threshold calibration and 70% for evaluation and results analysis. Following [26], we explored different fixed values of the hyperparameter k, such as k = 5, 10, 20, to identify the optimal number of lowest token probabilities to consider when computing the Min-K score. We found that k = 10 works best for membership inference detection. We evaluate both free models, including GPT-2, Distil GPT-2, and DialoGPT variants, on approximately 3000 samples per class via the Hugging Face platform. Furthermore, we evaluated commercial API-based models, including GPT-5, Gemini-2.5-Flash, Mistral-Small-24B-Instruct, DeepSeek-V3, and LLaMA-3.370B-Instruct, on approximately 200 samples per class due to budget constraints, using OpenRouter APIs4 . We focus on general-purpose models because these models are the ones most commonly accessible to students and educators in real-world educational settings [25]. Moreover, as of October 2025, recent coding LLM leaderboard5 highlight that general-purpose models within the GPT, DeepSeek, Llama, Gemini, and Mistral families consistently rank among the topperforming systems. We ran all our experiments on NVIDIA Tesla T4 GPU. The code and dataset are available at Anonymized GitHub Repository. Metrics: Following prior work [26], we calculate the detection effectiveness using the true positive rate (TPR) and the false positive rate (FPR). As core metrics, we report the area under the ROC curve (AUC), indicating whether the method assigns higher scores to training samples than to non-training ones, and TPR@5%FPR, which measures the proportion of real training samples cor4 5

https://openrouter.ai/models Coding LLM Leaderboard

10

S. Maity et al.

rectly detected with only 5% false positives. In addition, we also report precision and F1 scores to provide a more comprehensive assessment of performance.

6

Results and Analysis

The results on general-purpose LLMs and Stack Overflow code are first presented, which serve as a technical validation before presenting the educational proof-of-concept validation. The membership inference detection performance of the free LLMs demonstrates notable variation across the evaluated metrics. As shown in Table 2, DistilGPT-2 emerges as the top performer among the free models, achieving the highest AUC of 0.713, along with leading precision (0.680) and F1 score (0.674). This means DistilGPT-2 demonstrates superior capability in distinguishing member from non-member data and detecting code provenance among free LLMs. GPT-2 achieves the strongest TPR@5%FPR at 18.19%, indicating its superior capability to identify member samples while minimizing false alarms. In contrast, the DialoGPT models, both medium and large versions, show relatively lower performance, pointing to the influence of architectural and training differences on the detectability of membership inference. Paid LLMs generally report lower membership inference detection scores. As presented in Table 2, Gemini-2.5-Flash stands out with the highest AUC of 0.654, reflecting its superior overall membership inference detection capability relative to its commercial peers. GPT-5 outperforms other paid LLMs in terms of TPR@5%FPR, achieving the highest value of 10.14%, as well as precision with a score of 0.569. Notably, LLaMA-3.3-70B-Instruct exhibits the strongest performance in F1 score (0.667), indicating a balanced trade-off between precision and recall, and thus robust membership inference detection overall. Importantly, these results show that some smaller or medium-sized free LLMs can outperform larger paid counterparts in membership inference detection, underscoring that model size alone does not determine leakage potential. Instead, detection capability depends on a complex interplay of model architecture, training data, and implementation specifics. Fig. 2 visually presents AUC performance relative to model size (in billions of parameters) for both free and paid LLM categories. The figure indicates no straightforward correlation between model size and inference accuracy. Some smaller or medium-sized free LLMs outperform larger paid counterparts, underscoring that model size alone does not determine leakage potential. As seen from Table 2, paid LLMs generally show lower membership inference detection performance compared to free models, primarily due to intentional design choices made by providers aimed at enhancing user privacy and data protection. Constraints such as limited inference samples arise from the higher computational costs and usage fees associated with paid services, which restrict extensive membership testing. In addition, commercial providers integrate advanced privacy-preserving mechanisms [31]. These include techniques such as differential privacy and noise injection, which effectively reduce memorization and protect against membership inference attacks [31]. Architectural innovations focusing on security, combined with API restrictions that limit data

Analyzing Code Provenance in LLMs for Programming Education

11

Table 2. Performance metrics of general-purpose LLMs on membership inference evaluation. The top portion presents free LLMs, while the bottom portion lists paid/commercial LLMs. The highest scores within each group are highlighted in bold. Model DialoGPT-medium DialoGPT-large GPT-2 DistilGPT-2

AUC TPR@5%FPR Precision F1 0.577 9.24 0.564 0.543 0.585 10.28 0.608 0.471 0.664 18.19 0.651 0.631 0.713 17.24 0.680 0.674

Gemini-2.5-Flash 0.654 Mistral-Small-24B-Instruct 0.535 DeepSeek-V3 0.540 LLaMA-3.3-70B-Instruct 0.559 GPT-5 0.566

6.16 7.29 5.86 7.48 10.14

0.567 0.509 0.500 0.557 0.569

0.666 0.639 0.666 0.667 0.577

exposure, further diminish the attack surface available to adversaries. Training techniques emphasizing regularization and selective data exposure also play a crucial role in mitigating membership leakage [31]. Furthermore, differences in the way token probabilities are computed and aggregated influence the success of inference detection. These factors collectively highlight the trade-off between maximizing detection accuracy and maintaining privacy safeguards. The findings underscore the need to select models carefully according to the privacy and security requirements of the deployment context. Free models typically enable more effective detection of membership inference risks, while paid LLMs exhibit differing behaviors in memorization that may affect detection sensitivity. Moreover, many free LLMs evaluated are earlier or smaller-scale versions of paid models. Although these models often facilitate stronger detection signals, it remains essential to assess their broader capabilities, including dimensions beyond code generation quality.

7

Proof-of-Concept Evaluation on Student Python Programming Assignments

Experiments: To validate the applicability of our approach in authentic educational contexts, we conducted a proof-of-concept on Python programming assignments collected from a data science hackathon involving higher education students. In this hackathon, student groups were tasked with developing the bestperforming classification model for the well-known Titanic dataset, predicting passenger survival outcomes. Each group consisted of seven students and submitted one integrated Jupyter notebook as their final solution. For this study, we selected submissions from five groups who provided explicit consent for the use of their code. In addition, these groups voluntarily shared their interaction logs with LLMs used during the hackathon for code generation and completion. These conversation records served as the ground truth for our provenance analysis. We applied the enhanced Min-K% probability method to these code

12

S. Maity et al.

Fig. 2. We show AUC performance across various LLMs plotted against their model size (number of parameters, in billions (B)). The models are grouped into free and paid categories to illustrate differences in membership inference detection effectiveness relative to model scale.

submissions to estimate the likelihood that different code segments were generated by general-purpose LLMs. The analysis focused on identifying where in the development process, such as package imports, data loading, feature engineering, model training, or evaluation, students relied on LLM assistance. From the shared interaction logs, we extracted both code and associated comments to establish reference annotations of LLM-generated content. To align Min-K% predictions with the ground truth from chat logs, we applied four complementary matching strategies: exact matching after normalization, character-level fuzzy matching based on sequence similarity, token-level fuzzy matching using code token sequences, and set-based token matching via Jaccard similarity. Comparing these annotations with the Min-K%-based predictions allowed us to evaluate the accuracy of provenance detection. This proof-of-concept thus demonstrates the method’s practical viability in real classroom-like settings and its potential to reveal fine-grained insights into how students integrate AI assistance into their coding workflows. Results: Table 3 summarizes the provenance detection performance of the enhanced Min-K% method across the five analyzed student groups. Each group represents an independent submission from the hackathon dataset. Overall, the AUC values (0.58–0.64) indicate moderate discriminative ability in distinguishing LLM-generated from student-authored code segments. The TPR@5%FPR values remain below 9%, reflecting the challenge of achieving strong detection sensitivity at very low false positive rates in authentic, linelevel code data. Precision and F1 scores show notable variation across groups, suggesting different levels of reliance on and post-editing of AI-generated code. Groups 1 and 2 achieved higher precision (0.72–0.89) and balanced F1 scores, indicating clearer separability between human-written and LLM-derived con-

Analyzing Code Provenance in LLMs for Programming Education

13

Table 3. Performance of the enhanced Min-K% method on student group submissions. Group AUC TPR@5%FPR Precision F1 Group 1 0.584 6.25 0.723 0.780 Group 2 0.594 7.03 0.895 0.757 Group 3 0.640 8.24 0.688 0.700 Group 4 0.644 7.86 0.542 0.644 Group 5 0.629 7.10 0.233 0.368

tent. Beyond quantitative metrics, a qualitative inspection of matched segments revealed that most groups used LLM-generated content primarily for feature engineering tasks, followed by assistance in importing packages, training models, and generating evaluation plots. These patterns provided instructors with fine-grained insights into where students sought AI assistance, enabling more targeted feedback on specific coding stages and supporting process-oriented assessment. Additionally, when estimating the probability of code written by different general-purpose LLMs, our implementation consistently attributed the highest likelihood to GPT-5 (ChatGPT) across all groups. This observation was further confirmed by students’ shared conversation logs, which verified that ChatGPT was indeed the primary model used throughout their coding process.

8

Conclusion

This study extends the Min-K% probability approach for tracing code provenance in programming education, enabling differentiation between student-authored and LLM-generated code. Through comprehensive evaluations on both open and commercial models and a real-world proof-of-concept with student hackathon submissions, the results demonstrate that the method can reliably identify patterns of AI assistance at a fine-grained level. Free models showed greater sensitivity for detecting memorization, while commercial models provided stronger privacy defenses, underscoring a key trade-off for educational deployments. The proof-of-concept further revealed that students primarily used ChatGPT (GPT5) for feature engineering, model training, and result visualization tasks. We acknowledge that our method detects training data membership, potentially conflating AI generation with manual retrieval from web sources like Stack Overflow. While these actions involve distinct cognitive processes—searching versus prompting—both represent a reliance on external solutions rather than independent synthesis. By identifying such non-original code, this work offers a foundational step toward process-oriented assessment, moving beyond final-product evaluation while future extensions aim to disentangle specific provenance. These insights highlight the dual value of provenance analysis for both privacy evaluation and pedagogical feedback, offering educators a practical framework to promote transparency, integrity, and process-oriented assessment in AI-assisted programming education.

14

S. Maity et al.

References 1. Amirzhanov, A., Turan, C., Makhmutova, A.: Plagiarism types and detection methods: a systematic survey of algorithms in text analysis. Frontiers in Computer Science 7, 1504725 (2025) 2. Bhattarai, M., Vu, M.N., E. Santos, J., Ismael, I., O’Malley, D.: Enhancing cross-language code translation via task-specific embedding alignment in retrievalaugmented generation. In: Shi, W., Yu, W., Asai, A., Jiang, M., Durrett, G., Hajishirzi, H., Zettlemoyer, L. (eds.) Proceedings of the 4th International Workshop on Knowledge-Augmented Methods for Natural Language Processing. pp. 107–117. Association for Computational Linguistics, Albuquerque, New Mexico, USA (May 2025) 3. Burrows, S., Tahaghoghi, S.M., Zobel, J.: Efficient plagiarism detection for large code repositories. Software: Practice and Experience 37(2), 151–175 (2007) 4. Cambaz, D., Zhang, X.: Use of ai-driven code generation models in teaching and learning programming: a systematic literature review. In: Proceedings of the 55th ACM Technical Symposium on Computer Science Education V. 1. pp. 172–178 (2024) 5. Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, U., et al.: Extracting training data from large language models. In: 30th USENIX security symposium (USENIX Security 21). pp. 2633–2650 (2021) 6. Cheers, H., Lin, Y., Smith, S.P.: Academic source code plagiarism detection by measuring program behavioral similarity. IEEE Access 9, 50391–50412 (2021) 7. Cheers, H., Lin, Y., Yan, W.: Identifying plagiarised programming assignments with detection tool consensus. Informatics in Education 22(1), 1–19 (2023) 8. Cheng, R., Wang, R., Zimmermann, T., Ford, D.: “it would work for me too”: How online communities shape software developers’ trust in ai-powered code generation tools. ACM Transactions on Interactive Intelligent Systems 14(2), 1–39 (2024) 9. Dickey, E.: The failure of plagiarism detection in competitive programming. arXiv preprint arXiv:2505.08244 (2025) 10. Duan, M., Suri, A., Mireshghallah, N., Min, S., Shi, W., Zettlemoyer, L., Tsvetkov, Y., Choi, Y., Evans, D., Hajishirzi, H.: Do membership inference attacks work on large language models? In: First Conference on Language Modeling 11. Gandhi, N., Gopalan, K., Prasad, P.: A support vector machine based approach for plagiarism detection in python code submissions in undergraduate settings. Frontiers in Computer Science 6, 1393723 (2024) 12. Hort, M., Vidziunas, L., Moonen, L.: Semantic-preserving transformations as mutation operators: A study on their effectiveness in defect detection. In: 2025 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW). pp. 337–346. IEEE (2025) 13. Idris, M.D., Feng, X., Dyo, V.: Revolutionizing higher education: Unleashing the potential of large language models for strategic transformation. IEEE Access 12, 67738–67757 (2024) 14. John, S., Boateng, G.: “i didn’t copy his code”: Code plagiarism detection with visual proof. In: International Conference on Artificial Intelligence in Education. pp. 208–212. Springer (2021) 15. Kohen-Vacs, D., Usher, M., Jansen, M.: Integrating generative ai into programming education: Student perceptions and the challenge of correcting ai errors. International Journal of Artificial Intelligence in Education pp. 1–19 (2025)

Analyzing Code Provenance in LLMs for Programming Education

15

16. Lancaster, T., Culwin, F.: A comparison of source code plagiarism detection engines. Computer Science Education 14(2), 101–112 (2004) 17. Li, Z., Zhang, J., Yin, C., Ouyang, Y., Rong, W.: ProCQA: A large-scale community-based programming question answering dataset for code search. In: Calzolari, N., Kan, M.Y., Hoste, V., Lenci, A., Sakti, S., Xue, N. (eds.) Proceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING 2024). pp. 13057–13067. ELRA and ICCL, Torino, Italia (May 2024) 18. Mohsin, A., Janicke, H., Wood, A., Sarker, I.H., Maglaras, L., Janjua, N.: Can we trust large language models generated code? a framework for in-context learning, security patterns, and code evaluations across diverse llms. arXiv preprint arXiv:2406.12513 (2024) 19. Mozaffari, H., Marathe, V.: Semantic membership inference attack against large language models. In: Neurips Safe Generative AI Workshop 2024 20. Ogwueleka, F.N.: Plagiarism detection in the age of artificial intelligence: current technologies and future directions. AI and ethics, academic integrity and the future of quality assurance in higher education 10 (2025) 21. Oliveira, D., Santos, R., Madeiral, F., Masuhara, H., Castor, F.: A systematic literature review on the impact of formatting elements on code legibility. Journal of Systems and Software 203, 111728 (2023) 22. Orvalho, P., Kwiatkowska, M.: Are large language models robust in understanding code against semantics-preserving mutations? arXiv preprint arXiv:2505.10443 (2025) 23. Pahune, S., Akhtar, Z., Mandapati, V., Siddique, K.: The importance of ai data governance in large language models. Big Data and Cognitive Computing 9(6), 147 (2025) 24. Piri, C.: Data privacy in the age of llm-based services in education: Current challenges, improvement guidelines and future directions (2024) 25. Puthumanaillam, G., Bretl, T., Ornik, M.: The lazy student’s dream: Chatgpt passing an engineering course on its own. IFAC-PapersOnLine 59(7), 213–218 (2025), 14th IFAC Symposium on Advances in Control Education ACE 2025 26. Shi, W., Ajith, A., Xia, M., Huang, Y., Liu, D., Blevins, T., Chen, D., Zettlemoyer, L.: Detecting pretraining data from large language models. In: The Twelfth International Conference on Learning Representations (2024) 27. Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. In: 2017 IEEE symposium on security and privacy (SP). pp. 3–18. IEEE (2017) 28. Song, Y., Lothritz, C., Tang, D., Bissyandé, T., Klein, J.: Revisiting code similarity evaluation with abstract syntax tree edit distance. In: Ku, L.W., Martins, A., Srikumar, V. (eds.) Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers). pp. 38–46. Association for Computational Linguistics, Bangkok, Thailand (Aug 2024). https://doi.org/10. 18653/v1/2024.acl-short.3, https://aclanthology.org/2024.acl-short.3/ 29. Sun, Q., Wu, J., Rong, W., Liu, W.: Formative assessment of programming language learning based on peer code review: Implementation and experience report. Tsinghua Science and Technology 24(4), 423–434 (2019) 30. Wen, J., Hu, Q., Guo, Y., Cordy, M., Le Traon, Y.: Variable renaming-based adversarial test generation for code model: Benchmark and enhancement. ACM Transactions on Software Engineering and Methodology (2025)

16

S. Maity et al.

31. Yan, B., Li, K., Xu, M., Dong, Y., Zhang, Y., Ren, Z., Cheng, X.: On protecting the data privacy of large language models (llms): A survey. arXiv preprint arXiv:2403.05156 (2024) 32. Zanella-Beguelin, S., Wutschitz, L., Tople, S., Salem, A., Rühle, V., Paverd, A., Naseri, M., Köpf, B., Jones, D.: Bayesian estimation of differential privacy. In: International Conference on Machine Learning. pp. 40624–40636. PMLR (2023)

Related documents

• E2E-SWE: Benchmarking LLMs on Building Working Codebases from Scratch#1169651
• E2E-SWE: Benchmarking LLMs on Building Working Codebases from Scratch#1142936
• CROCODIL: Cross-Model Code Editing with LLMs#926762
• Harness Engineering in LLM Tool Use via Agent-Native Reusable Tool Primitives#822166
• Impacts of Histories and Models on LLM Grading: A Study in Advanced Software Engineering Courses#267728