Token Probability Deviation in LM Research

• Token Probability Deviation (TBD) is a metric that measures how far generated token probabilities fall below a high reference value, aiding in the detection of data exposure during distillation.
• TBD covers a family of diagnostics by quantifying deviations from expected token distributions, reference policies, and evaluator model preferences across various applications.
• Empirical studies report that TBD improves model auditing, decoding strategies, and alignment by using token-level deviations to enhance performance metrics and reliability.

Token Probability Deviation (TBD) is a non-unified term in recent language-model research. It is defined explicitly in reasoning-distillation auditing as a score that measures how far generated token probabilities fall below a high reference probability, with lower scores for questions likely seen during distillation (Zhang et al., 6 Oct 2025). In adjacent literatures, closely related constructs quantify deviation from a reference policy at the token level, deviation between correct and distractor option probabilities, deviation from an evaluator model’s preferred token, or deviation between model-assigned and theoretically expected probabilities (Zhu et al., 17 Jun 2025, Chen et al., 11 Jan 2025, Quevedo et al., 2024, Toney-Wails et al., 1 Nov 2025). Taken together, these uses indicate that TBD is presently better understood as a family of token-distribution diagnostics than as a single canonical metric.

1. Formalization in distillation data detection

The most explicit definition of TBD appears in work on detecting whether a question was used in reasoning distillation (Zhang et al., 6 Oct 2025). For a question $q$, a distilled model generates a response sequence $(y_1, y_2, \ldots, y_M)$, and at each step assigns probability

$p_\theta(y_i \mid y_{<i}, q).$

TBD measures how far each generated token falls below a high reference value $\tau$, typically close to $1$, through the token-level deviation

$$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$

The sample-level score is then

$$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$

where $\alpha > 0$ controls the emphasis on larger deviations and

$$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$

counts outlier tokens. Classification is threshold-based: $$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$ The practical hyperparameter choices reported are $(y_1, y_2, \ldots, y_M)$0, $(y_1, y_2, \ldots, y_M)$1, and $(y_1, y_2, \ldots, y_M)$2 (Zhang et al., 6 Oct 2025).

The underlying empirical observation is that distilled models tend to generate near-deterministic tokens for seen questions, while producing more low-probability tokens for unseen questions. In this setting, lower TBD scores indicate likely members and higher scores indicate non-members. On the S1 dataset, TBD achieved an AUC of $(y_1, y_2, \ldots, y_M)$3 and a TPR@1% FPR of $(y_1, y_2, \ldots, y_M)$4; the best baseline on the same table reached $(y_1, y_2, \ldots, y_M)$5 AUC and $(y_1, y_2, \ldots, y_M)$6 TPR@1% FPR (Zhang et al., 6 Oct 2025). The paper further reports that input-token-based baselines perform near random in the question-only regime, whereas simple generated Min-K\% or perplexity improve over that baseline family but still lag behind TBD.

A notable design choice is the restriction to the first $(y_1, y_2, \ldots, y_M)$7 generated tokens and to outlier tokens with probability below $(y_1, y_2, \ldots, y_M)$8. The reported ablations state that truncation, token-deviation focus, and deviation exponentiation each improve performance (Zhang et al., 6 Oct 2025). This formulation makes TBD a black-box, question-only detector whose signal arises entirely from output-token confidence structure rather than from access to the hidden distillation corpus.

2. Decoding, expected values, and output-space analysis

A separate line of work argues that standard decoding discards useful information in the full next-token distribution (Zawistowski, 2024). On Likert-scale scoring tasks with options $(y_1, y_2, \ldots, y_M)$9, the paper contrasts greedy decoding,

$p_\theta(y_i \mid y_{<i}, q).$0

with the expected score

$p_\theta(y_i \mid y_{<i}, q).$1

The reported issue is that at usual temperatures ($p_\theta(y_i \mid y_{<i}, q).$2) the model is spuriously overconfident, so $p_\theta(y_i \mid y_{<i}, q).$3. The proposed remedy is to scale logits with large temperature, specifically $p_\theta(y_i \mid y_{<i}, q).$4, to increase entropy and spread probability mass across more options (Zawistowski, 2024).

On the SummEval dataset of 1600 annotated summaries, this high-entropy expected-value decoding yields large gains in correlation with human judgment. Reported examples include Mistral 7B relevance increasing from $p_\theta(y_i \mid y_{<i}, q).$5 to $p_\theta(y_i \mid y_{<i}, q).$6, Mixtral 8x7B relevance increasing from $p_\theta(y_i \mid y_{<i}, q).$7 to $p_\theta(y_i \mid y_{<i}, q).$8, and SOLAR 10.7B relevance increasing from $p_\theta(y_i \mid y_{<i}, q).$9 to $\tau$0; quantized models are described as only marginally worse than their full-precision counterparts (Zawistowski, 2024). The same study notes that part of the gain seems related to positional bias and that the expected-value method is more robust to answer-order effects than greedy decoding.

The paper also introduces a probability-based tree sampling algorithm that systematically enumerates highly probable completions using a top-$\tau$1 cumulative probability threshold $\tau$2, a loglikelihood threshold $\tau$3, and designated stop tokens (Zawistowski, 2024). In creative paraphrasing experiments with Mixtral Instruct at $\tau$4 and top-$\tau$5, only $\tau$6-$\tau$7 paraphrases were produced with substantial probability, while the remaining tail typically devolved into irrelevant or rambling outputs. The paper links this output collapse to what it calls a potential source for Token Probability Deviation, in the sense that empirical token distributions can deviate from more natural expectations of diversity (Zawistowski, 2024).

3. Token-level alignment and preference optimization

In supervised fine-tuning, token probability is also used as a proxy for semantic importance. ProFit reports a strong correlation between a token’s predicted probability and its semantic importance, with core tokens assigned consistently higher predicted probabilities and trivial tokens concentrated in the low-probability tail; the paper reports a hypothesis test with $\tau$8 (Liu et al., 14 Jan 2026). Its binary masking operator is

$\tau$9

and the modified objective is

$1$0

The paper’s interpretation is that low-probability tokens induce disproportionately large gradients and can overshadow learning of core semantics. On Qwen3-4B-Base, ProFit reports $1$1 average accuracy versus $1$2 for standard SFT, and on Llama-3.1-8B it reports a $1$3 gain over vanilla SFT (Liu et al., 14 Jan 2026).

Within preference optimization, TGDPO makes token probability deviation explicit as deviation from a reference policy (Zhu et al., 17 Jun 2025). For token $1$4 at position $1$5, the base deviation is

$1$6

TGDPO assigns token-dependent weights derived from token-level reward guidance, using

$1$7

and the full loss in Equation (20) applies these weights to the tokenwise log-ratios for winning and losing responses. The paper states that this is the mathematical quantification of token probability deviation in its framework. It reports win-rate gains of up to $1$8 points on MT-Bench, $1$9 points on AlpacaEval 2, and $$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$0 points on Arena-Hard (Zhu et al., 17 Jun 2025).

TokenRatio extends the same token-level concern to pairwise preference learning by introducing Token-level Bregman Preference Optimization (TBPO) (Nguyen et al., 12 May 2026). The paper argues that sequence-level DPO leaves per-prefix optimality implicit and that large TBD means the policy is not locally optimal at each decision point. TBPO instead posits a token-level Bradley–Terry preference model and derives a Bregman-divergence density-ratio matching objective. Its two practical variants are TBPO-Q, which learns a lightweight state baseline, and TBPO-A, which removes the baseline through advantage normalization. The paper reports improved alignment quality, improved training stability, and increased output diversity relative to strong sequence-level and token-level baselines (Nguyen et al., 12 May 2026). This suggests that, in alignment settings, TBD functions as a credit-assignment problem over tokenwise policy shifts.

4. Retrieval, hallucination detection, and evaluation

In retrieval-augmented multiple-choice QA, first-token probability is used as a confidence score that guides dynamic context adjustment (Chen et al., 11 Jan 2025). For options $$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$1, the model computes

$$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$2

normalizes across valid options to obtain $$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$3, and uses

$$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$4

as the confidence score. If $$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$5, the system adjusts chunk number $$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$6 and chunk window size $$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$7; alternatively, a best-probability search selects $$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$8. The paper frames the gap between correct-option and distractor probabilities as what may more generally be studied as Token Probability Deviation in RAG (Chen et al., 11 Jan 2025). Reported results include $$d_i(q; \tau) = \max\Big(0,\, \tau - p_\theta(y_i \mid y_{<i}, q)\Big).$$9 accuracy on filtered questions at $$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$0, about 250 answered questions above that threshold, and up to $$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$1 accuracy with combined strategies, a $$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$2 increase over the baseline (Chen et al., 11 Jan 2025).

For hallucination detection, one supervised approach reduces the problem to four scalar features computed by an evaluator model under teacher forcing (Quevedo et al., 2024). The four features are minimum token probability,

$$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$3

average token probability,

$$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$4

maximum LLM probability deviation,

$$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$5

and minimum LLM probability spread,

$$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$6

The paper states directly that Maximum LLM Probability Deviation implements the notion of token probability deviation by measuring how much less probable the generated token was, according to the evaluator, than the evaluator’s own most probable token (Quevedo et al., 2024). Using only these four features, logistic regression and a simple neural network surpass state-of-the-art results on multiple tasks across HaluEval, remain competitive on HELM, and underperform on the True-False benchmark, illustrating both the usefulness and the limits of shallow token-probability features.

SPAD pushes hallucination analysis toward mechanistic attribution by decomposing each token probability into seven sources: Query, RAG, Past, Current Token, FFN, Final LayerNorm, and Initial Embedding (Lu et al., 8 Dec 2025). The final probability for token $$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$7 is exactly decomposed as

$$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$8

SPAD then aggregates token-level attribution vectors by POS tags and treats deviations from normal source-POS patterns as hallucination signals. The paper gives the example that nouns should normally rely on RAG, whereas high FFN or Final LayerNorm attribution on NOUNS is suspicious (Lu et al., 8 Dec 2025). Reported results include $$\mathcal{S}(q,\theta) = \frac{1}{E} \sum_{i=1}^{M} d_i(q;\tau)^{\alpha},$$9, $\alpha > 0$0 on RAGTruth with Llama2-13B, and $\alpha > 0$1, $\alpha > 0$2 on Dolly with Llama2-13B, outperforming baselines such as ReDeEP (Lu et al., 8 Dec 2025).

Bias evaluation provides another deviation-based use of token probabilities. In work comparing token probability and textual entailment as bias metrics, the term TBD is not explicitly formalized, but the raw deviation

$\alpha > 0$3

is described as central to fine-grained analysis (Felkner et al., 9 Oct 2025). The same paper reports very low correlation between token-probability and NLI bias metrics, with maximum $\alpha > 0$4, and concludes that neither token probability nor NLI is uniformly superior (Felkner et al., 9 Oct 2025). Here, deviation captures stereotype preference at the sentence-pair level rather than membership, calibration, or alignment.

5. Related probability-distance phenomena

Several recent studies analyze token-probability deviations without using TBD as a single named metric. In controlled probabilistic scenarios, GPT-4.1 and DeepSeek-Chat achieve $\alpha > 0$5 validity on prompts such as coin flips and die rolls, yet their token-level probabilities and entropies diverge systematically from theoretical distributions (Toney-Wails et al., 1 Nov 2025). For a six-sided die, the theoretical probability is $\alpha > 0$6; the paper reports $\alpha > 0$7 for GPT-4.1 and $\alpha > 0$8 for DeepSeek-Chat under specified prompts, with entropy errors greater than $\alpha > 0$9 in all cases and close to $$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$0 for the coin flip scenario (Toney-Wails et al., 1 Nov 2025). The paper’s central claim is that certainty inferred from logits does not imply alignment with the theoretical probability distribution of the task.

Prompt framing alone can also induce measurable probability divergence. In a production–perception study, the same poem tokens are re-scored under production-oriented and perception-oriented prompts, and token probability distance is measured by

$$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$1

Across five open-weight models, production–perception distances consistently exceed production–production distances, with an overall average ratio of approximately $$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$2 (Marklová et al., 13 Jul 2026). For Llama-3.1-8B, the reported mean absolute distances are $$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$3 for production–perception and $$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$4 for production–production, and the temporal analysis models decay as $$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$5 (Marklová et al., 13 Jul 2026). This constitutes a prompt-conditioned probability deviation over the same generated text rather than a deviation tied to truth, preference, or membership.

At the representation level, token probability information appears to be encoded directly in model parameters. Work on output embeddings reports an approximate common log-linear encoding of output token probabilities,

$$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$6

with adjusted $$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$7 for GPT2 and $$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$8 for GPT-J, and with more than $$E = \sum_{i=1}^{M} \mathbf{1}(p_\theta(y_i \mid y_{<i}, q) < \tau)$$9 of output-embedding dimensions deletable without significant movement in output distribution and sequence generation (Cho et al., 2024). This suggests that many TBD-like observables may have a sparse geometric substrate in the output embedding space.

Token-probability structure has also been lifted into spatial detectors. CodeVision converts line-by-line code log probabilities into a matrix $$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$0, where $$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$1 is the log probability of the $$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$2-th token in the $$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$3-th line, and then treats this matrix as a 2D token probability map for ViT or ResNet classification (Xu et al., 6 Jan 2025). In that work, token probability deviation is not a single scalar; rather, the detector learns spatial patterns of confidence, indentation, and local irregularity from the map itself.

6. Methodological cautions and standardization issues

Recent work on decoder monitoring argues that not every token-probability observable is diagnostically meaningful (Ettifouri et al., 13 Jul 2026). The paper shows that the centered token log-probability increment

$$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$4

is a mean-zero martingale under the model’s own sampling law because

$$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$5

As a result, it measures sampling self-consistency rather than trajectory health and is nearly silent during confident repetition, where both $$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$6 and entropy are close to zero. The proposed replacement is a degeneration-aware alarm score,

$$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$7

with $$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$8 and $$G(q; \mathcal{M}) = \begin{cases} 1 & \text{if } \mathcal{S}(q, \mathcal{M}) < \lambda \quad (\text{member}) \ 0 & \text{otherwise} \quad (\text{non-member}). \end{cases}$$9, combined with an e-process-inspired detector. On GSM8K with DeepSeek-R1-Distill-Qwen-1.5B in FP16 and INT4, calibration turns a monitor that fires on $(y_1, y_2, \ldots, y_M)$00-$(y_1, y_2, \ldots, y_M)$01 of generations into a more selective detector, with $(y_1, y_2, \ldots, y_M)$02, precision $(y_1, y_2, \ldots, y_M)$03 against a $(y_1, y_2, \ldots, y_M)$04 base rate, and a positive but statistically inconclusive INT4 accuracy change from $(y_1, y_2, \ldots, y_M)$05 to $(y_1, y_2, \ldots, y_M)$06 at a $(y_1, y_2, \ldots, y_M)$07 token-budget cost (Ettifouri et al., 13 Jul 2026).

This caution matters for TBD because the literature uses “deviation” in several incompatible ways. In the distillation-detection setting, deviation is distance below a high-certainty reference (Zhang et al., 6 Oct 2025). In alignment, it is deviation from a reference policy weighted by token-level reward (Zhu et al., 17 Jun 2025). In retrieval and bias measurement, it can be the gap between option probabilities or paired sentence scores (Chen et al., 11 Jan 2025, Felkner et al., 9 Oct 2025). In hallucination detection, it may be disagreement with an evaluator model or anomalous source attribution for a POS category (Quevedo et al., 2024, Lu et al., 8 Dec 2025). In probabilistic calibration studies, it is the divergence between model confidence and known theoretical probabilities (Toney-Wails et al., 1 Nov 2025).

A plausible implication is that TBD has become a useful cross-cutting lens for analyzing token distributions, but not yet a standardized object with fixed semantics, aggregation rules, or null hypotheses. The current literature supports at least four distinct functions: auditing training-data exposure, improving decoding and scoring by using the full token distribution, shaping token-level optimization during post-training, and detecting reliability failures such as hallucinations or degenerate generation (Zhang et al., 6 Oct 2025, Zawistowski, 2024, Liu et al., 14 Jan 2026, Ettifouri et al., 13 Jul 2026). Further standardization would likely require explicit separation between uncertainty, calibration, memorization, preference shift, and structural attribution, since current papers show that these phenomena can all be expressed as “token probability deviation” while remaining technically non-equivalent.