> could trace whether that data was used

The point of de-identifying data is to ensure you can't trace who it came from. It would be a serious privacy violation if they could.

If the model includes unique data from a person then that person can identify the data - the allegedly plagiarised material - and so re-identify it. There doesn't need to be a privacy breach to close that loop as it requires the person to identify the information is associated with them first.