SILO Language Models: Isolating Legal Risk In a Nonparametric Datastore

• Training only on low-risk data degrades performance because permissive text is scarce and narrowly distributed relative to common language-model corpora.This creates an extreme domain-generalization challenge for the parametric component.Source: §1 · p. 1
• SILO trains parameters on low-risk data and retrieves high-risk data only through an inference-time nonparametric datastore.The datastore can be updated or have individual examples removed, unlike trained parameters.Source: §1 · p. 1, Figure 1 · p. 2
• The datastore supports sentence-level attribution and individual-example removal, enabling creators to trace contributions and opt out.These capabilities are contrasted with the difficulty of removing or attributing data in parametric models.Source: §1 · pp. 1–2
• SILO combines a 1.3B-parameter model trained on the Open License Corpus with either kNN-LM or retrieval-in-context datastore access.The OLC contains permissively licensed text, while the datastore can include copyrighted or otherwise high-risk material.Source: §1 · p. 2, Figure 1 · p. 2
• Adding retrieval substantially improves out-of-domain performance, with kNN-LM reducing the Pythia gap by 90% on average across domains.Both retrieval methods improve performance, but kNN-LM generalizes better and benefits from datastore scaling.Source: §1 · p. 2

• Large language models are typically trained on vast mixed-source corpora whose books, repositories, and web pages may carry restrictive licenses.The legal status of this training practice remains contested across jurisdictions.Source: §2 · p. 3
• Copyright and privacy rules create different obligations, including fair-use considerations and GDPR rights to access, correct, and erase personal data.Retraining can be expensive when data must be corrected or erased.Source: §2 · p. 3
• SILO places copyrighted data in a datastore with instance-level attribution and opt-out, aligning its controls with fair-use and GDPR-related requirements.The authors contrast these built-in controls with post-hoc attribution and parameter-level data removal, which lack inherent guarantees and are hard to scale.Source: §2 · p. 3
• Permissive-only training is difficult to extend across domains because legally permissive data is especially scarce for books and news.This motivates separating permissive parameter training from broader inference-time data access.Source: §2 · pp. 3–4

3 BUILDING THE OPEN LICENSE CORPUS: A PERMISSIVELY-LICENSED PRE-TRAINING CORPUS

• OLC is a manually curated corpus of permissively licensed text used to train model parameters, with its skewed domains motivating extreme domain generalization.The corpus spans multiple domains and uses a taxonomy distinguishing public-domain, software, attribution, and non-permissive data.Source: §3 · p. 4, §3.1 · p. 4
• OLC’s license categorization is not universally safe because legal status can vary by country and time, and permissively licensed sources may still contain privacy or other legal risks.The authors recommend consulting legal professionals for particular applications.Source: §3 · p. 4

3.1 TAXONOMY OF DATA LICENSES

• The taxonomy treats public-domain text, permissively licensed software, and attribution-licensed data as progressively distinct categories, while other data is assumed non-permissive.The paper excludes attribution data from its main experiments despite retaining it for future use and ablations.Source: §3.1 · p. 4

3.2 BUILDING THE OPEN LICENSE CORPUS

• OLC is a 228B-token corpus of public-domain, software-licensed, and CC-BY data from 17 manually selected sources of primarily English text under permissive licenses.Source: §3.2 · p. 5

3.3 ANALYSIS OF OLC

• Compared with the Pile, OLC is 31% smaller and more concentrated in code, scientific, and legal text rather than the broader distribution of typical pretraining corpora.Table 2 presents the corpus distributions and token frequencies used for this comparison.Source: §3.3 · p. 6, Table 2 · p. 6
• OLC-to-validation n-gram overlap averages 17%±9%, versus 28%±14% for Pile training data, indicating larger test-time domain shifts.The overlap statistics correlate strongly with language-modeling performance in later experiments.Source: §3.3 · p. 6

4.1 THE PARAMETRIC COMPONENT

• The parametric component is a fixed dense decoder-only transformer LM based on the LLaMA architecture.Its parameters remain fixed during inference.Source: §4.1 · p. 7

4.2 THE NONPARAMETRIC COMPONENT

• kNN-LM interpolates a datastore-derived next-token distribution with the parametric LM, whereas RIC-LM retrieves text blocks and feeds them into the LM as context.kNN-LM directly changes the output distribution, while RIC-LM indirectly changes it through the model input.Source: §4.2 · pp. 7–8
• The two retrieval methods trade off influence and efficiency: kNN-LM relies less on the parametric model, while RIC-LM is more compatible with black-box models and uses less memory.The paper compares these methods across datastore sizes and distribution-shift settings.Source: §4.2 · p. 8

4.3 BUILDING SILO

• SILO datastores provide inherent attribution, individual-example opt-out, and flexible updating, filtering, and growth.Removing data from the datastore guarantees that it no longer contributes to model predictions.Source: §4.2 · p. 8, §4.3 · p. 8

4 SILO

• SILO trains model parameters on low-risk data while using high-risk data only in an inference-time nonparametric datastore.This separates datasets across the parametric and nonparametric components rather than training both components on the same data.Source: §4 · pp. 6–7, §4.3 · p. 8

4.4 IMPLEMENTATION DETAILS

• Evaluation measures perplexity across 14 domains spanning in-domain and out-of-domain text, including copyrighted, non-permissively licensed, and private data.The setup constructs domain-specific datastores from available training data and uses FAISS for kNN-LM or BM25 for RIC-LM.Source: §4.4 · p. 9, §4.3 · p. 9

5.1 RESULTS: PARAMETRIC COMPONENT

• Parametric-only SILO is competitive with Pythia on several OLC-covered domains but falls short most on domains that are out-of-domain for SILO, including news, books, OpenWebText, and emails.The largest gaps align with domains covered by Pythia but not by the permissive training data.Source: §5.1 · p. 10, Table 3 · p. 10
• Domain similarity strongly predicts the relative gap: the correlation between OLC overlap and normalized perplexity difference is r=-0.72, p < 0.005.More dissimilar evaluation domains favor Pythia relative to SILO.Source: §5.1 · p. 10

5.2 RESULTS: ADDING THE NONPARAMETRIC COMPONENT

• Adding a datastore with kNN-LM reduces SILO's gap to Pythia across domains, exceeding Pythia on Github, CC News, Enron Emails, and MIMIC-III while reducing the Books3 gap by 28%.RIC-LM also improves performance, but kNN-LM is more effective; in most other domains it reduces the gap by more than 50%.Source: §5.2 · p. 11, Table 4 · p. 11
• Scaling the datastore consistently improves perplexity, with kNN-LM improving more rapidly than RIC-LM across datasets and a strong log-linear trend.Extrapolation suggests further kNN-LM scaling may close remaining gaps on domains where SILO has not yet matched Pythia.Source: §5.2 · pp. 11, 13, Figure 3 · p. 11
• Both retrieval methods improve more rapidly with SILO's out-of-domain test data than with Pythia, and this effect is clearer for kNN-LM.The analysis attributes kNN-LM's advantage both to stronger overall performance and to better out-of-domain scaling.Source: §5.2 · p. 12
• On ten out-of-domain classification datasets, parametric-only SILO underperforms Pythia, whereas adding a datastore allows SILO to match Pythia.The evaluation uses PMI calibration and kNN-Prompt for applying kNN-LM downstream.Source: §5.2 · p. 12, Table 5 · p. 12
• Most remaining performance gaps arise from SILO's out-of-domain parametric LM rather than its encoder, because replacing the LM with Pythia helps substantially while replacing the encoder helps marginally.The comparison fixes one component while substituting Pythia for the other.Source: §5.2 · p. 12, Figure 4 · p. 12

5.3 EXAMPLES OF DATA ATTRIBUTION AND OPT-OUT

• Removing Harry Potter books from the datastore worsens perplexity toward the parametric-only model, while retained books improve all seven evaluation books; retrieved contexts also provide token-level attribution.The examples show that datastore contents affect predictions and can expose relevant source context, including for Github, news, and emails.Source: §5.3 · p. 13, Table 6 · p. 13, Table 7 · p. 14

Addressing the limitations of SILO

• SILO does not eliminate legal risk, but its opt-out, attribution, and content-control mechanisms may improve alignment with legal regulations.It still may require permission for copyrighted datastore content and does not prevent copying by itself.Source: §6 · p. 14
• SILO may exacerbate fairness problems such as toxicity toward marginalized groups and racial bias, especially from older copyright-expired books.Balancing legal-risk mitigation against fairness is identified as future work.Source: §6 · p. 14
• Explicit license metadata may underestimate the amount and diversity of permissively licensed web text, motivating scalable license inference.The authors suggest inferred licenses could support more heterogeneous permissively licensed corpora.Source: §6 · p. 14

Introducing novel data licensing approaches

• SILO suggests licensing schemes could distinguish parameter training from datastore inclusion, enabling easier removal, per-prediction attribution, and potential compensation.This proposal is presented as distinct from licensing training data directly.Source: §6 · p. 14

Investigating other copyright risk mitigation strategies

• Alternative risk-mitigation strategies include output filtering, differential privacy, near-access freeness, and post-hoc attribution, and are described as complementary to SILO.These approaches target non-infringing generation, memorized details, or attribution without changing the model class.Source: §6 · pp. 14–15

Generalizing SILO as a modular language model

• Future work could extend SILO with parametric expert models specialized by risk level or apply compartmentalized retrieval augmentation to text-to-image and other modalities.The proposed extensions cover modular language models and public-domain data in images, speech, and video.Source: §6 · p. 15

Conclusion

• SILO trains parameters only on permissively licensed OLC data and uses an unrestricted nonparametric datastore during inference.This supports attribution and removal of datastore content without training on high-risk data.Source: §7 · p. 15
• Adding kNN-LM retrieval substantially reduces or sometimes eliminates SILO’s performance gap with unrestrictedly trained Pythia on out-of-domain data.Parametric-only SILO remains competitive in OLC-covered domains but struggles under extreme domain generalization.Source: §7 · p. 15
• Datastore scaling is key to nonparametric performance, and the nonparametric encoder is more robust to distribution shift than the parametric component.These findings motivate further research on high-quality models with mitigated legal risk.Source: §7 · p. 15

Parametric component

• Parametric SILO uses a LLaMA-style decoder-only transformer with a GPT-NeoX-20B tokenizer and fixed training hyperparameters across models.The reported training budgets are 60B, 250B, and 350B tokens for pd, pdsw, and pdswby.Source: A MODEL DETAILS · p. 22

Nonparametric component

• kNN-LM uses quantized IndexIVFPQ retrieval, with λ, k, and τ selected on validation data in a domain-specific manner.The distance proxy uses quantized-vector distances rather than exact original-embedding distances.Source: A MODEL DETAILS · p. 22
• Datastores are capped at up to 10% of Pile training data and 1024.0M tokens for kNN-LM because of resource constraints.The authors identify larger datastore scaling as future work.Source: A MODEL DETAILS · p. 22, Table 9 · p. 22

Downstream task evaluation

• Downstream evaluation covers nine zero-shot classification datasets spanning topic, sentiment, subjectivity, and entailment tasks.Templates and label words convert each task into sentence completion, with domain-conditional PMI used for label probabilities.Source: A MODEL DETAILS · p. 22

Parametric component

• Table 11 compares pd, pdsw, and pdswby against Pythia 1.4B using validation perplexity across in-domain and out-of-domain categories.The table distinguishes out-of-domain cases that have related in-domain data.Source: Table 11 · p. 23

Downstream task evaluation

• For downstream kNN-LM, validation search varies datastore choice, k, and τ, with an additional 8-million-token IMDB datastore.The selected settings are reported in Table 10.Source: A MODEL DETAILS · p. 23, Table 10 · p. 23

N-gram overlap

• The analysis computes unigram and bigram overlap after stopword removal and minimum document-frequency filtering, using samples of up to 10M tokens per source.It also plots the relationship between n-gram overlap and the performance gap between pdsw and Pythia.Source: B ADDITIONAL DATA ANALYSIS · p. 23

• Validation findings are largely consistent with the corresponding test-data results for both parametric and nonparametric language models.Source: C ADDITIONAL EXPERIMENTAL RESULTS · p. 23
• Table 12 compares perplexity for parametric-only, kNN-LM, and RIC-LM systems across in-domain and out-of-domain validation data.The table also distinguishes out-of-domain datasets with relevant in-domain data.Source: Table 12 · p. 24
• Table 13 evaluates domain upsampling and explicit source-code inclusion using validation perplexity.Source: Table 13 · p. 24

Domain upsampling

• Upsampling less-representative domains slightly improves out-of-domain performance, averaging 19.6 versus 19.7 across nine datasets.Non-upweighted in-domain datasets such as FreeLaw show slight degradation, while the upweighting ratio and alternatives were not tuned.Source: §C.1 · p. 24

Source-code ablation

• Nearly 20 perplexity points of improvement on PhilPapers result from including source code in the training data.The source-code ablation compares pdsw with a version retaining Hacker News, Ubuntu IRC, Deepmind Math, and AMPS but excluding actual source code.Source: §C.1 · p. 24

Cross-model results

• Across SILO variants and Pythia, kNN-LM and RIC-LM outperform parametric-only models, with kNN-LM generally achieving the best performance.A pd-based kNN-LM is comparable to a pdsw parametric LM, while pdsw-based kNN-LM is comparable to a pdswby parametric LM.Source: §C.2 · pp. 24–25, Figure 5 · p. 25

RIC-LM variants

• The basic RIC-LM variant is retained because concat-2 and concat-next perform poorly, while ensbl-10 improves performance but costs roughly 20x a parametric LM’s runtime.The ensemble variant uses ten retrieved blocks and is approximately ten times slower than the basic RIC-LM variant.Source: §C.2 · p. 25, Table 14 · p. 25

Datastore scaling

• Larger datastores consistently improve both kNN-LM and RIC-LM, while kNN-LM scales better and usually surpasses RIC-LM at reasonable datastore sizes.The exception is Pythia on Github, where RIC-LM outperforms kNN-LM with a reasonable datastore size.Source: §C.2 · pp. 25–26, Figure 6 · p. 27

Distance approximation

• Aggressive distance approximation reduces disk memory to under 2% of the original footprint at an approximately 0.5% performance loss.The approximation drops the original embeddings and is used for the remaining experiments.Source: §C.2 · p. 26, Table 15 · p. 26

Runtime

• Datastore lookup is slower than parametric inference, but kNN-LM can match RIC-LM speed while outperforming it using 102M tokens and p = 1.Runtime decreases as the datastore shrinks, while the hardware used for benchmarking had unusually slow I/O.Source: §C.2 · p. 26, Table 16 · p. 26

Qualitative examples

• Retrieved context can provide highly relevant continuations, per-token attribution, and copyright notices when copyrighted text contributes to predictions.The qualitative examples include Github, Enron Emails, and CC News contexts.Source: §C.2 · p. 26, Table 17 · p. 28

Domain overlap

• OLC-domain n-gram overlap negatively correlates with the perplexity gap between pdsw and Pythia, with r = -0.72 and p < 0.005.Source: Figure 7 · p. 29, Table 18 · p. 29