Search papers, labs, and topics across Lattice.
This paper addresses the validity issues in current research on extractable memorization in large language models (LLMs) by introducing a rigorous framework for making memorization claims. The authors propose a matched comparison approach that distinguishes between memorization and predictability by measuring the generation probabilities of training sequences against non-training sequences. Their findings reveal that previous studies may overstate memorization claims, with empirical results showing that LLMs like OLMo 2 32B and Llama 3.1 70B exhibit significant false positives in memorization assessments, necessitating a refined definition of extractable memorization.
Matched comparisons reveal that LLMs may reproduce training sequences at alarming rates, but many of these instances are actually false positives rather than true memorization.
Recent work on extractable memorization in LLMs suffers from two contrasting validity problems. Some studies overstate extraction, e.g., relying on sequences too short to distinguish memorization from predictability. Others imply that extraction is unreliable evidence of memorization, since models can also reproduce real-world text they weren't explicitly trained on. In different ways, both overlook what makes a valid extraction claim: the model must generate a training sequence with high enough probability to indicate memorization. To determine what's high enough, one has to perform a matched comparison: measuring the generation probabilities of both the training sequences of interest and comparable non-training sequences. Because non-training sequences cannot have been memorized, their probabilities provide a baseline for predictability; a training sequence exceeding this baseline provides evidence of memorization. We formalize matched comparisons in two ways: (1) a conformal test that calibrates a threshold to a chosen FPR when training and non-training sequences are sampled from populations, and (2) a census that calibrates against a matched non-training document when the object is a single document (e.g., a book). We show that matched comparisons enable rigorous, calibrated memorization claims, and reveal where prior setups have validity issues. For instance, on Wikipedia OLMo 2 32B reproduces non-training 10-token suffixes roughly 24% as often as training ones: that share of the training generation rate reflects false positives, not memorization. For Llama 3.1 70B on books, the thresholds we calibrate are as low as 1e-27, supporting memorization claims for sequences that no feasible sampling budget would extract. Based on these results, we refine"extractable memorization"to require a valid memorization claim and near-certain generation within a realistic budget.
Stanford HAI