PaperlayerView exact revision on arXiv

Source-linked AI summary

Extractable Memorization From First Principles

A. Feder Cooper, Marika Swanberg, Jamie Hayes, Lea Duesterwald, Christopher De Sa, Georgios Kaissis, Daniel E. Ho, Mark A. Lemley, Percy Liang

arXiv:2607.12649v2cs.LGcs.CL

TL;DR

Prior work leaves open when generated training text is evidence of memorization rather than general predictability, while reproduction of non-training text complicates extraction claims. This paper calibrates matched comparisons with a conformal test for populations and a census for single documents. Its results expose false positives in short Wikipedia matches and support memorization claims at very low book-sequence probabilities, prompting a query-budget-aware definition of extractable memorization.

  • Problem

    Prior studies both overstate extraction with short or target-leaking prompts and question it because models reproduce non-training text, leaving unclear when generation evidences memorization.

    Source: §1 · pp. 1–2

  • Method

    The paper calibrates generation scores against matched non-training sequences using a conformal test for populations and a census for single documents.

    Source: §1 · p. 2

  • Results

    24% of apparent OLMo 2 Wikipedia 10-token verbatim extractions are false positives, while Llama 3.1 70B book-census thresholds range from 10^-27 to 10^-21.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Extractable memorization requires both a valid matched-comparison memorization claim and near-certain generation within a realistic query budget.

    Source: §1 · p. 2, §7 · p. 10

    Perfectly matched non-members may not exist, so calibration may rely on a looser, more general null.

    Source: §7 · p. 10

Abstract

from arXiv · show

Recent work on extractable memorization in language models suffers from two contrasting validity problems. Some studies overstate extraction, for example, by using sequences too short to distinguish memorization from predictability. Others imply that extraction is unreliable evidence because models can reproduce real-world text they weren't explicitly trained on. Both overlook what makes a valid extraction claim: the model must generate a training sequence with high enough probability to indicate memorization. To determine what's high enough, one has to perform a matched comparison, measuring generation probabilities of training and comparable non-training sequences. Since non-training sequences can't have been memorized, their probabilities are a baseline for predictability; exceeding this baseline is evidence of memorization. We formalize matched comparisons with (1) a conformal test calibrated to a chosen false-positive rate when sequences are sampled from populations, and (2) a single-document census that calibrates against a matched non-training document. Matched comparisons enable rigorous, calibrated memorization claims and clarify where prior setups have validity issues. On Wikipedia, OLMo 2 32B reproduces non-training 10-token suffixes roughly 24% as often as training ones: that share reflects false positives, not memorization. For Llama 3.1 70B on books, calibrated census thresholds reach as low as 10^(-27), supporting memorization claims for sequences no feasible sampling budget would extract. We therefore refine "extractable memorization" to require both a valid memorization claim and near-certain generation within a realistic budget.

1 INTRODUCTION

Prior extraction studies can mistake predictability or prompt leakage for memorization, while reproduction of non-training text alone does not invalidate extraction. The paper makes matched non-training comparisons central to calibrated claims about when generation supports memorization.

1 INTRODUCTION

  • Earlier studies sometimes claimed extraction from very short sequences or prompts leaking the target, while others questioned extraction because models reproduce non-training text (Chang et al., 2023; Karamolegkou et al., 2023; Wei et al., 2025; Liu et al., 2025; Morris et al., 2025).Source: §1 · p. 1
  • Parrot prompts reproduce training and matched non-training text at essentially equal rates, so successful copying alone does not support a memorization claim.The larger OLMo 2 32B Instruct comparison also found equal rates (N = 3000 each).Source: §1 · p. 2, Figure 1 · p. 2
  • A shorter-than-target adversarial prompt also elicited a post-cutoff Jalen Brunson quote, showing that success on the Gretzky quote alone does not warrant a memorization claim (Schwarzschild et al., 2024).This result does not establish that Llama 2 13B failed to memorize the Gretzky quotation.Source: §1 · p. 2
  • Matched non-training sequences set a predictability baseline: generation counts as extraction only when its probability exceeds a calibrated threshold.Clearing the threshold supports a claim that the sequence is a training member the model memorized.Source: §1 · p. 2
  • The paper formalizes matched comparisons with a conformal test for populations and a matched-document census, then requires valid memorization evidence plus near-certain generation within a realistic query budget for extractable memorization.Source: §1 · p. 2
  • For OLMo 2 on Wikipedia, 24% of apparent 10-token verbatim extractions are false positives; for Llama 3.1 70B on books, calibrated thresholds range from 10^-27 to 10^-21.The latter thresholds support claims for sequences too improbable to sample in practice.Source: §1 · p. 2

2 BACKGROUND AND RELATED WORK

The background distinguishes sequence generation probabilities, memorization, and extraction, then represents an extraction procedure as a fixed set of model, decoding, prompting, scoring, and verification choices. The conformal-test illustration previews how matched non-members calibrate verification.

2 BACKGROUND AND RELATED WORK

  • An autoregressive model and decoding policy induce a probability distribution over continuations from a prompt; greedy decoding assigns probability 1 to its unique continuation and 0 to others.Source: §2 · p. 3
  • Memorization concerns unusually high probability for a training sequence, whereas extraction is its reproduction in outputs via prompting; memorized sequences need not be extractable (Carlini et al., 2021; Nasr et al., 2023; 2025).Source: §2 · p. 3
  • Membership is defined at a chosen length, dissimilarity, and tolerance, so near-duplicates count as members and non-membership excludes training support within the candidate’s tolerance ball (Lee et al., 2022; Zhang et al., 2023; Cooper et al., 2026b).Setting tolerance ε = 0 recovers verbatim membership.Source: §2 · p. 3
  • An extraction procedure fixes a model, decoding policy, prompt-selection rule, scoring procedure, and verification rule; scores reflect how readily a candidate can be generated.Prompt-selection rules can range from a natural prefix to an adversarial search space.Source: §2 · p. 3
  • Prior extraction methods leave verification—deciding whether a score is high enough to support memorization—uncalibrated even when they compare against non-training data (Cooper et al., 2026a; Hayes et al., 2025b).Source: §2 · p. 3
  • The conformal-test illustration selects candidates and matched non-member controls, calibrates a threshold to a target false-positive rate, and claims memorization only when a candidate score exceeds it.With exchangeable controls and a fresh non-member, each claim has marginal FPR at most αN ≤ α.Source: Figure 2 · p. 4

3 A CONFORMAL TEST FOR MEMORIZATION

The conformal test treats a candidate’s score as evidence only relative to scores from matched non-members. It calibrates a threshold to a chosen false-positive rate, with guarantees conditional on exchangeability and limitations on what a non-rejection establishes.

3 A CONFORMAL TEST FOR MEMORIZATION

  • The test rejects a matched non-member null when a candidate score exceeds a threshold calibrated from matched controls, making the threshold crossing evidence of memorization at a chosen FPR.The same framework applies to any extraction method that instantiates the defined procedure.Source: §3 · p. 4
  • Controls should match candidates in source, format, length, and other score-relevant features, while being known non-members; applying the same fixed extraction procedure makes scores exchangeable under the null.A non-member candidate should look like another draw from the control-score distribution.Source: §3 · p. 4
  • A finite control sample certifies FPR levels in steps of 1/(N + 1), with αN the largest attainable level not exceeding the chosen α.The smallest nonzero certifiable level is 1/(N + 1); below it, the test cannot reject.Source: §3 · pp. 4–5
  • Under exchangeability, the null candidate’s score rank yields a marginal false-positive guarantee of at most αN ≤ α, but it is neither conditional on realized controls nor a familywise or false-discovery guarantee across many candidates.Ties at the threshold make the test conservative.Source: §3 · p. 5
  • A non-rejection is not evidence against memorization: the test bounds false positives but does not bound false negatives or estimate total latent memorization.The chosen prompt, decoding policy, or score may fail to surface encoded information.Source: §3 · p. 5
  • When parrot prompts produce matched member and non-member scores alike, the calibrated threshold rises with them and nothing clears it; the same logic handles other membership-independent score boosts.These include copying, instruction-following, predictability, and adversarial coaxing.Source: §3 · p. 5
  • Calibration depends on genuine non-members that are distributionally matched to candidates, and the authors say this can only be a best effort in practice.Source: §3 · p. 5

4 POPULATION RATE EXPERIMENTS

Population experiments show why raw generation rates are not memorization rates: short suffixes can match non-members often, while calibrated comparisons reveal stronger evidence for longer suffixes. The estimates rely on matched controls, and finite control samples limit the FPR levels that can be certified.

4 POPULATION RATE EXPERIMENTS

  • 1.84% is the certified false-positive floor against 7.54% member generation for 10-token suffixes; at 50 tokens, member generation is 0.74% against a 0.04% floor.The 10-token floor matches about 24% of the apparent member extraction rate; the 50-token false positive came from contaminated controls and overstates the floor.Source: Figure 3 · p. 6, §4 · p. 6
  • Candidates are 5,000 Wikipedia passages dated January 2021–December 2023, matched with 5,000 passages dated 2024, with 50-token natural prefixes and 10- or 50-token suffixes.Random sampling within date ranges supports the stated independence assumption for confidence intervals and population-FPR interpretation.Source: §4 · p. 6
  • Discoverable extraction uses deterministic greedy decoding, so its binary score has only one operating point; member and non-member matches are therefore reported as generation, not extraction.A genuine non-member match cannot reflect memorization.Source: §4 · p. 6
  • Across the certified-FPR sweep, calibrated memorization is higher for 50-token than 10-token suffixes; at αN ≈ 0.1%, the estimates are 2.64% versus 1.06%.The figure notes that member contamination in controls, particularly for 50 tokens, makes the plotted rate an underestimate.Source: Figure 4 · p. 7, §4 · p. 7
  • With top-40 probabilistic scoring, 10-token suffixes have higher raw rates, but at the smallest plotted thresholds their member rate exceeds 50% while certified FPR exceeds 30%; 50-token rates peak near 3% with controls near zero and threshold 8.9 × 10^-6.These raw rates use thresholds five orders of magnitude apart, each calibrated from its own controls.Source: §4 · p. 7
  • The calibrated memorization rate subtracts the non-member false-positive rate from the member generation rate at a fixed threshold; the estimate subtracts αN to be unbiased under the stated sampling relation.Source: §4 · p. 7
  • The 5,000-control sample certifies FPR levels only in steps of 1/(N + 1), so the sweep’s minimum is about 0.02%; a smaller certified floor requires more controls.The authors favor low FPRs in practice even at the cost of more false negatives.Source: §4 · pp. 6–7

5 CENSUS EXPERIMENTS

The census compares whole-book scores for in-training books with matched non-training controls, using the controls to set thresholds for memorization claims. Many book windows clear those thresholds, but evidence strength varies and some memorized sequences remain impractical to generate.

5 CENSUS EXPERIMENTS

  • Killer Instinct shows effectively no memorization, with its score windows nearly entirely overlapping the matched control.Its results are omitted from the coverage plots because only one candidate window exceeds τ (book) = 10^-24.Source: Figure 5 · p. 8, Figure 6 · p. 8
  • The census scores overlapping 50-token suffixes given 50-token prefixes and measures whole-document character coverage above a threshold.Each book is matched to a recent post-cutoff book by the same author, intended to share style and genre.Source: §5 · p. 8
  • Each pair-specific τ (book) is the highest-scoring remaining own-prose sequence in the matched control, after removing web-verified contaminants.The control maximum is a measured threshold, not a certified level.Source: §5 · p. 8
  • At 10^5 queries, The Da Vinci Code coverage is 12.3% verbatim and 18.7% near-verbatim, while additional matched-threshold memorization lies beyond that budget.At n ≈ 3 × 10^21, the beyond-budget coverage is 68.5% verbatim and 51.5% near-verbatim.Source: Figure 7 · p. 9
  • For Llama 3.1 70B, τ (book) ranges from 10^-27 to 10^-21, with the highest threshold used as a shared τglobal across books.Raising a threshold above τ (book) reduces coverage; τglobal can only reduce it further.Source: Figure 6 · p. 8, §5 · p. 9
  • 68.5% of The Da Vinci Code, 53.3% of The Hunger Games, and 31.3% of We Were Eight Years in Power are memorized at their matched thresholds.At Δ=5, 55.6%, 46.4%, and 28.4% still clear their respective thresholds; the lowest qualifying scores remain at most 10^-16.Source: §5 · p. 9

6 REALISTIC EXTRACTABILITY VS. MEMORIZATION

The paper separates evidence that a sequence is memorized from whether it can be generated within a realistic query budget. Its revised definition of extractable memorization requires both calibrated evidence and practical reproducibility.

6 REALISTIC EXTRACTABILITY VS. MEMORIZATION

  • For a fixed prompt and per-attempt probability p, the probability of generating a candidate at least once after n independent attempts is 1 − (1 − p)^n.This budget calculation makes practical reproducibility a separate condition from threshold-based evidence.Source: §6 · p. 9
  • A sequence with p = 10^-21 requires about 3 × 10^21 attempts for 95% generation probability, nearly seven times the age of the universe at 1,000 queries per second.This is the largest census threshold discussed.Source: §6 · p. 9
  • A candidate is extractably memorized only if it clears the matched-comparison threshold and can be generated within n queries with probability at least 1 − δ.The second condition can be met by sampling or another decoding procedure of comparable cost.Source: §6 · p. 9
  • At a 10^5-query budget, extraction coverage is substantially smaller than total memorization revealed at the matched threshold.The Da Vinci Code example distinguishes budget-reachable coverage from memorized coverage; the other two books show similar results.Source: §6 · pp. 9–10

7 CONCLUSION

The conclusion makes matched non-training data the baseline for valid memorization claims and distinguishes those claims from practical extractability. It also identifies limits when controls are imperfect and when studies rely on short candidates or uncalibrated comparisons.

7 CONCLUSION

  • A valid memorization claim requires exceeding a matched non-member threshold, while extractable memorization additionally requires generation within a realistic query budget.The paper formalizes population-level conformal tests and single-document censuses as calibration approaches.Source: §7 · p. 10
  • Perfectly matched controls may not exist, so claims calibrated against looser controls should state the controls and qualify the resulting null.For example, no new Sherlock Holmes stories by Arthur Conan Doyle can serve as matched non-members.Source: §7 · p. 10
  • Short verbatim matches alone cannot distinguish memorization from general predictability, and matched non-members can produce false positives at short candidate lengths.The conclusion notes that member generation rates alone are insufficient for this distinction.Source: §7 · p. 10
  • Reproducing non-training text does not make extraction inherently unreliable, because conclusions depend on the specific procedure and baseline.The cited counterargument also does not account for near-duplicate members contaminating its non-member sequences.Source: §7 · p. 10
  • The relevant comparison is how many attempts an LLM needs relative to a fluent matched baseline, not whether it can produce a string by chance.The paper argues that practically generated, extractably memorized text can be many orders of magnitude above that baseline.Source: §7 · p. 10

AI USE STATEMENT

The statement describes the authors’ limited uses of generative AI and their review of AI-assisted work. It also records the paper’s ethics rationale, reproducibility materials, and motivating parrot-prompt experiment.

AI USE STATEMENT

  • Generative AI was used for typo identification, plot-accessibility feedback, a human-led null-decontamination agent skill, and notation checks.The authors report reviewing AI-assisted work and manually verifying changes.Source: AI USE STATEMENT · p. 11

ETHICS STATEMENT

  • The authors frame the paper as addressing the scientific validity of extraction evidence, including claims used in litigation.They hope it will help courts assess expert testimony about extraction of memorized training data.Source: ETHICS STATEMENT · p. 11

REPRODUCIBILITY STATEMENT

  • The authors release experiment code and provide links to public-domain books, but cannot distribute the copyrighted books used in the census.They report complete theoretical proofs and summarize assumptions in the appendices.Source: REPRODUCIBILITY STATEMENT · p. 11

A MOTIVATING EXAMPLES

A.1 “PARROT” PROMPTS EXPERIMENT

  • In the parrot experiment, OLMo 2 32B Instruct generated 50-token member and post-cutoff non-member Wikipedia sequences at statistically indistinguishable rates.The rates were 70.1% for members and 70.6% for non-members; the authors conclude that successful generation provides no basis for claiming memorization in this setup.Source: §A.1 · p. 18

A.2 GENERATING VERBATIM NON-TRAINING DATA WITH ACR

This section examines ACR success on non-training text, the relationship between teacher-forced success and greedy generation, and the definitions of training membership and extraction procedures. It also clarifies how population-calibrated conformal tests and fixed-document census thresholds relate to target, certified, and observed false-positive rates.

A.2 GENERATING VERBATIM NON-TRAINING DATA WITH ACR

  • 11 of 16 runs produced prompts marked successful by teacher-forced arg max that failed to generate the target verbatim under greedy decoding.The authors verified this behavior in their runs and do not claim that published results reflect the error.Source: §A.2 · p. 18
  • The relaxed ACR criterion requires target geometric-mean per-token probability ≥0.9, while GCG can reuse target words in prompts; an overlap penalty is suggested but not validated.The probability condition is equivalent to bounding GCG’s objective by loss ≤−ln 0.9, independent of target length; the proposed penalty could push Brunson’s ACR below 1.Source: §A.2 · p. 19
  • A 14-token prompt elicited Gretzky’s 17-token line (ACR 1.21), while a 22-token prompt elicited post-cutoff Brunson’s 23-token statement (ACR 1.05), showing ACR success alone does not establish memorization.Both prompts met the relaxed criterion of target geometric-mean per-token probability at least 0.9; the examples do not show that the Gretzky line was not memorized.Source: §A.2 · p. 19, Figure 8 · p. 19

B EXTENDED PRELIMINARIES

  • Memorization concerns unusually high probability for training sequences, whereas extraction is their reproduction in model outputs via prompting and is narrower than memorization.The preliminaries distinguish base, top-k, and deterministic greedy decoding policies.Source: B EXTENDED PRELIMINARIES · pp. 19–20

B.1 MEMBERS, NON-MEMBERS, AND THE MEMBERSHIP INDICATOR

  • A sequence is a near-verbatim training member when its ε-ball contains a training sequence; non-membership excludes even near-duplicates, not merely exact matches.Membership is checked over length-ℓ subsequences when training documents vary in length.Source: §B.1 · pp. 20–21

B.2 DEFINING AN EXTRACTION PROCEDURE

  • An extraction procedure combines a model, decoding policy, prompt-selection rule, score, and verification rule; the proposed conformal test calibrates the generation-probability threshold against matched non-members.Clearing that threshold licenses an extraction probability claim.Source: §B.2 · p. 21

C EXTENDED DETAILS ON THE CONFORMAL TEST FOR MEMORIZATION

  • The conformal test calibrates claims about populations to a chosen false-positive level, while the single-document census uses a control book’s maximum window score without an analogous FPR guarantee.Census windows overlap or share paragraph context, so the threshold is a measured maximum rather than an exchangeable-rank statement.Source: C EXTENDED DETAILS ON THE CONFORMAL… · p. 22

C.1 NOTATION AND SUMMARY OF RELEVANT QUANTITIES

  • For the conformal test, the certified FPR is K/(N+1), while the in-sample FPR and unknown population FPR are distinct; the threshold is the Kth-largest control score.With N = 5000 and target FPR α = 0.1%, K = 5 and the certified level is 5/5001; the population FPR varies across control draws.Source: §C.1 · pp. 22–23, Figure 9 · p. 24
  • For K≥1, the in-sample FPR is 4/5000=0.08%, and the rate (K−1)/N from controls above τ has no guarantee attached.The population guarantee is described as having mean α_N, with Beta(5, 4996) and a 95% central interval of [0.032%, 0.205%].Source: §C.1 · p. 25
  • For N=5000 and target α=0.1%, K=5 gives threshold score(5) and certified α_N=5/5001≈0.09998%, so testing at either level is identical.The p-value grid is 1/(N+1), making the target and certified-level tests equivalent.Source: §C.1 · p. 25
  • The target α can map many-to-one to a threshold, while each certified α_N on the 1/(N+1) grid uniquely identifies an order statistic.For example, targets from 0.09998% to below 0.11997% all yield score(5); α_N records the attained level, while α records the requested level.Source: §C.1 · p. 25

C.2 FINITE-SAMPLE VALIDITY OF THE CONFORMAL TEST

The conformal test controls the marginal false-positive rate when matched non-member scores are exchangeable with a fresh candidate. Its guarantees depend on matching and apply across control samples; the realized threshold’s population false-positive rate varies.

C.2 FINITE-SAMPLE VALIDITY OF THE CONFORMAL TEST

  • Under exchangeable matched non-member scores, the conformal test’s marginal FPR is at most αN; ties can only make it conservative.The procedure must be fixed independently of calibration controls and candidate scores. The guarantee averages over the controls and a fresh non-member candidate.Source: §C.2 · pp. 25–26

C.3 PRACTICAL LIMITS OF MATCHING

  • Controls must be genuine non-members selected by the same rule as candidates; post-cutoff material alone does not ensure non-membership.Wikipedia entries can reuse pre-cutoff text, and post-cutoff books can quote earlier material that was likely in training.Source: §C.3 · p. 27
  • Distribution shift can make the actual FPR exceed certified αN, while contaminated controls raise the threshold and make the test more conservative.Claims are relative to the control distribution, so controls should match candidates in source, format, length, and other score-relevant features.Source: §C.3 · pp. 27–28

C.4 THE POPULATION FALSE-POSITIVE RATE OF THE THRESHOLD

  • The certified αN is an average over random control draws, not a guarantee for each realized threshold; the true population FPR α∗ varies across samples.The distribution of α∗ describes this sample-to-sample variation.Source: §C.2 · p. 27, §C.4 · p. 28

C.4.1 THE BETA LAW

  • Under i.i.d. continuous non-member scores, α∗ follows Beta(K, N −K + 1) with mean αN; with ties, the Beta law remains exact below α† when the threshold clears the atom.The tied-score result applies when the threshold falls among nonzero scores; ties can alter the law outside that range.Source: §C.4 · p. 28, §C.4.1 · pp. 29–30

C.4.2 OUR SCORE ISN’T ALWAYS CONTINUOUS

Extraction scores can have atoms, so the continuous-score Beta result does not automatically describe the calibrated threshold’s population FPR. When atoms lie at or below a boundary, the Beta law still holds below that boundary, with remaining probability accounted for separately.

C.4.2 OUR SCORE ISN’T ALWAYS CONTINUOUS

  • 89.6% of 50-token control scores and 41.1% of 10-token control scores are zero under top-40 decoding.A score value with positive probability is an atom; here the zero-score block can affect the calibrated threshold’s population FPR distribution.Source: §C.4.2 · p. 30
  • If at least K controls score above the atom, the calibrated threshold clears it and α∗ falls below α†, where the Beta law applies.With top-40 decoding, the atom is the block of zero scores; α† is the share of non-members scoring above zero.Source: §C.4.2 · p. 31
  • When all atoms lie at or below τ†, α∗ has the Beta(K, N −K + 1) distribution below α†; probability at or above α† is handled separately.The upper-region probability is the chance that fewer than K controls score above τ†.Source: §C.4.2 · p. 31

C.4.3 CONDITIONAL GUARANTEES

The appendix distinguishes marginal calibration from guarantees about a particular control draw, then details practical constraints on decoding, candidate testing, experiments, and plotted uncertainty.

C.4.3 CONDITIONAL GUARANTEES

  • With 5,000 controls and α=0.1%, αN≈0.1% is the mean—not a bound on a particular draw; with 90% confidence, α*≤0.16%, and with 95%, α*≤0.18%.At αN, α* exceeds the certified level for 44% of control samples; the 95% interval is [0.032%, 0.205%].Source: §C.4.3 · p. 34
  • At K=1, αN≈0.02%, but α* is at most 0.02% for only 63% of draws; the 90% bound is 0.05%, and ρ0.9=1.30.The guarantee applies unchanged to the top-40 results because α†≈10.4%.Source: §C.4.3 · p. 34

C.4.4 THE POINT OF ALL THIS IN PRACTICE

  • Under top-40 decoding, α† is the share of non-members the policy can generate and caps attainable certified FPR; it is 10.4% for 50-token and 58.9% for 10-token suffixes.Reported intervals lie below α†, where the Beta law is exact; if α†=0, the operating-point sweep collapses to one point.Source: §C.4.4 · p. 35

C.5 MULTIPLE TESTING ACROSS CANDIDATES

  • A shared control sample supports per-candidate claims, but reuse makes claims dependent; the individual guarantee does not bound familywise or false-discovery error across candidates.In these experiments every candidate is a member, so the candidate-set FWER and FDR are zero by construction.Source: §C.5 · pp. 35–36
  • With 5,000 controls, Bonferroni can control 5% FWER for at most 250 candidates, or 0.1% FWER for 5; controlling 0.1% across 5,000 candidates takes about five million controls.Benjamini–Hochberg can bound FDR at π0δ≤δ under independent or PRDS p-values, but the paper’s highlighted greedy and top-k scores have atoms.Source: §C.5 · pp. 37–38

D POPULATION EXPERIMENTS

  • The appendix extends population experiments across suffix lengths, decoding policies, and model sizes, including OLMo 2 7B, 13B, and 32B under the base distribution at T=1.Source: D POPULATION EXPERIMENTS · p. 38

D.1 PLOTTED INTERVALS

  • Plotted uncertainty depends on the random quantity: calibrated-rate bands shift member-rate Clopper–Pearson intervals down by αN, while differences may use independent- or paired-proportion intervals.The shifted bands hold the control-set threshold fixed; they do not include uncertainty from drawing a different control sample.Source: §D.1 · pp. 38–39

D.2 SCORE DISTRIBUTIONS AND CONTAMINATION

At 10 tokens, predictable non-member continuations force a high calibrated threshold; at 50 tokens, matched non-members are rarely reproduced, allowing a much smaller threshold. Contaminated controls raise the extreme-tail threshold and suppress the calibrated rate.

D.2 SCORE DISTRIBUTIONS AND CONTAMINATION

  • At 10 tokens, many non-member continuations are highly predictable, so a 0.1% target FPR requires a near-one threshold; at 50 tokens, the same target uses a threshold orders of magnitude smaller.Source: §D.2 · p. 39
  • Removing 12 verified member-text contaminants changes the estimated calibrated rate; ten contaminants among the 5,000-control pool sit at the distribution top and raise the extreme-tail threshold.The remaining two score exactly 0 and do not move the threshold. The decontaminated pool has αN = 4/4989 ≈ 0.0802%, while the full pool has αN = 5/5001 ≈ 0.09998%.Source: §D.2 · p. 39
  • Budget results and T=1 model-scaling experiments use the decontaminated pool (N=4,988), while the main results and suffix-length sweep use the full pool (N=5,000).Source: §D.2 · p. 39

D.3 VARYING SUFFIX LENGTH

The suffix-length sweep contrasts greedy decoding, where member and non-member rates both decline, with probabilistic extraction, where calibrated memorization rises at fixed target FPR. The sweep uses the full control pool because contamination is difficult to define at very short suffix lengths.

D.3 VARYING SUFFIX LENGTH

  • The sweep scores the same 5,000 members and 5,000 matched controls at every suffix length, using the full control pool because contamination is hard to define at one or two tokens.Source: §D.3 · p. 39
  • For greedy decoding, the difference peaks near ℓ=3 at about 22% certified FPR, so the curve’s heights are not comparable across lengths.Each length is its own operating point, and the difference subtracts the in-sample non-member rate rather than the certified FPR.Source: §D.3 · p. 39, Figure 11 · p. 41
  • At α=0.1%, probabilistic calibrated memorization rises to about 2.64 percentage points by ℓ=50, even though raw member generation rates fall as suffixes lengthen.At α=1%, the calibrated rate rises to about 9%; at α=10%, it reaches about 18% by ℓ≈25 and then levels off.Source: §D.3 · p. 40, Figure 13 · p. 41, Figure 12 · p. 41
  • At ℓ=1, greedy non-member and member rates are 58% and 65%; at ℓ=50, they are 0.02% and 0.74%, respectively.The member–non-member difference peaks near ℓ=3 at about 10 percentage points, then falls to 0.72 points at ℓ=50.Source: Figure 11 · p. 41

D.4 TESTING A DIFFERENT DECODING POLICY

Under the base decoding policy, 50-token suffixes have higher calibrated memorization rates than 10-token suffixes across model sizes, and calibrated rates generally rise with model size. The margin view adds how far candidate scores clear the matched-control threshold.

D.4 TESTING A DIFFERENT DECODING POLICY

  • Under top-k, zero-score sequences create a ceiling on certified FPR levels; at 50 tokens, the maximum αN is 10.4% for 32B, 8.0% for 13B, and 6.4% for 7B.The base policy avoids this ceiling because every sequence has positive probability and scores are continuous.Source: §D.4 · p. 42
  • At αN ≈ 0.08%, 50-token suffix rates are 2.74%, 3.68%, and 3.70% for 7B, 13B, and 32B, versus 1.16%, 1.74%, and 1.18% at 10 tokens.The 50-token rate exceeds the 10-token rate across the full sweep.Source: §D.4 · p. 42, Figure 14 · p. 43
  • A paired comparison uses candidates where model sizes disagree on a memorization claim, helping distinguish a scale effect in memorization from better prediction.The reported paired differences are positive across the sweep, though the 32B–13B interval includes zero at 0.1%.Source: §D.4 · pp. 42–43
  • At α = 0.1%, calibrated rates are 2.74%, 3.68%, and 3.70% for 7B, 13B, and 32B, rising to 15.78%, 19.82%, and 23.22% at 10%.Rates rise with model size at every target FPR; Fig. 15 also reports paired differences across sizes.Source: §D.4 · p. 42, Figure 15 · p. 44

D.5 MARGIN

  • A margin measures how far a candidate’s score sits above the calibrated threshold; a margin just above zero is the weakest threshold-clearing evidence.Candidates near the threshold score about as well as the control that set it and may be among the first claims lost under a tighter threshold.Source: §D.5 · p. 44
  • Margin also normalizes threshold differences: a margin of 2 means two orders of magnitude above the threshold, whether it is 8.9 × 10^-6 or 0.95.Greedy decoding has no margin because its scores are binary.Source: §D.5 · p. 44

E CENSUS EXPERIMENTS

The census scores every window in four matched book pairs, using a post-cutoff book by the same author as each control. Thresholds come from decontaminated control windows, with verified reused passages removed.

E CENSUS EXPERIMENTS

  • The census scores every window in four matched book pairs, making reported book coverage exact rather than an estimate.Each Books3 title is paired with a same-author book published after Llama 3.1’s December 2023 pretraining cutoff.Source: E CENSUS EXPERIMENTS · p. 45, Table 1 · p. 45

E.1 CALIBRATING THRESHOLDS AND DECONTAMINATION

  • For each pair, the threshold is the largest score among decontaminated control windows, rounded up to the next power of ten.Rounding upward avoids relying on unreliable floating-point mantissas at probabilities near 10^-20 and below.Source: §E.1 · p. 45
  • Control books are decontaminated by manually verifying high-scoring passages as reused text and removing only those confirmed passages.The in-training book is not culled; figures 16 and 17 show the non-member distributions before and after decontamination.Source: §E.1 · p. 45, Figure 16 · p. 46, Figure 17 · p. 47
  • For the Finder books, member and non-member score distributions are indistinguishable.The figure caption reports this for the Finder pair after matched-control decontamination.Source: Figure 17 · p. 47

E.2 ADDITIONAL RESULTS

The appendix adds book-level views of threshold margins, query-budget extraction, and deterministic recovery, alongside assumptions and context for the paper’s extraction framework.

E.2 ADDITIONAL RESULTS

  • For The Hunger Games, a heatmap assigns each character the largest 50-token suffix score among overlapping windows covering it, relative to a matched-book threshold.Margin plots show coverage as the required probability rises above each book’s own threshold; positive Δ clears that threshold, and larger Δ moves farther above it.Source: §E.2 · p. 48, Figure 18 · p. 48

F.1 QUERY BUDGET

  • At 95% success confidence, sampling a sequence with per-query probability p costs roughly 3/p independent attempts.The appendix uses this conversion to relate generation probability to a finite query budget.Source: §F.1 · p. 49

F.2 POPULATION BUDGET VIEWS

  • The Wikipedia budget plots compare member and non-member generation rates with calibrated rates at 95% success confidence, including an illustrative budget of 10^5 attempts.The figures use a 0.1% target FPR reference and distinguish the target from the certified level αN.Source: §F.2 · p. 49, Figure 20 · p. 50

F.3 CENSUS BUDGET VIEWS

  • Additional census budget views cover We Were Eight Years in Power and The Hunger Games, using verbatim and near-verbatim procedures for the book pairs.Killer Instinct is omitted because the experiments detect effectively no memorization signal for that book.Source: §F.3 · p. 51, Figure 21 · p. 51

F.4 DETERMINISTIC RECOVERY

  • For The Da Vinci Code, the near-verbatim algorithm costs roughly 20 independent samples, yet some recovered memorized content would not be sampled within 10^5 attempts.Near-verbatim recovery permits distance up to five tokens; the figure also reports 6.1% verbatim coverage from top-1 outputs in the 800-sequence pool.Source: Figure 22 · p. 52, §F.4 · p. 52, Figure 23 · p. 52

G ASSUMPTIONS USED THROUGHOUT THE PAPER

  • The conformal test relies on exchangeability between candidate and matched-control scores, while census thresholds rely on same-author post-cutoff controls and decontamination.A highly memorized contaminated passage can push a census threshold close to 1; the paper therefore decontaminates the control’s high-scoring tail.Source: G ASSUMPTIONS USED THROUGHOUT THE PAPER · p. 53

H EXTENDED DISCUSSION OF PRIOR WORK

  • The extended prior-work discussion revisits extraction definitions, claim validity, and similarities to membership-inference attacks.It frames existing extraction procedures through the paper’s definition of an extraction procedure.Source: H EXTENDED DISCUSSION OF PRIOR WORK · p. 55

H.1 PRIOR WORK ON EXTRACTION, IN THESE TERMS

  • For prior extraction procedures, the conformal test supplies the verification step by calibrating when a score is high enough to support a memorization claim.The discussion also describes near-verbatim scoring through probability mass on an ε-ball and a lower-bound algorithm.Source: §H.1 · p. 55

H.2 PRIOR WORK IN LIGHT OF MATCHED COMPARISONS

Prior extraction definitions and procedures can mistake predictability or prompt-induced reproduction for memorization; matched non-member controls test whether a candidate’s score is actually exceptional. The section also contrasts the conformal test’s data-based null and calibration with reference-model membership inference.

H.2 PRIOR WORK IN LIGHT OF MATCHED COMPARISONS

  • Short-prefix prompting does not eliminate false positives from low-entropy text, while matched comparisons address parrot prompts, trivial repetition, and repeated substrings without special carve-outs.The paper attributes parrot success to instruction-following and low-entropy continuations to predictability, regardless of training membership.Source: §H.2 · p. 56
  • Under unrestricted prompt selection, a training hit is not evidence of memorization if applying the same selection rule to matched non-members also makes them appear extracted.The rule need not be narrowed in advance; the matched non-member null supplies the reference.Source: §H.2 · pp. 56–57

H.3 VALIDITY IN PRIOR WORK

  • A short verbatim match alone cannot support a valid memorization claim; Liu et al. (2026) count five NLTK words, below the cited field standard of 50 tokens.Member generation rates alone cannot distinguish memorization from general predictability.Source: §H.3 · p. 57
  • Negative controls are inadequate when they use a different model, procedure, or text than the extraction claim; the authors also generated non-training text with ACR on Llama 2 13B.The cited ACR headline results used Llama-2-7B-chat and Phi-1.5 without controls, and its available checks were not matched to famous quotes.Source: §H.3 · p. 57
  • Prompts can leak target words into outputs, and trimming contiguous five-word overlaps may not remove short matches reassembled from a plot-summary prompt.The paper notes that the cited work does not run non-training controls to test short-span or prompt-leakage false positives.Source: §H.3 · pp. 57–58
  • Some purported non-members may be near-duplicates that function as training members, and extraction claims remain relative to a specific procedure and baseline.Thus, verbatim completion of such text does not by itself refute extraction claims under another calibrated procedure.Source: §H.3 · p. 58

H.4 MEMBERSHIP INFERENCE

  • The conformal test compares a candidate with matched non-member data under one fixed model, whereas reference-model attacks compare the evaluated model with models trained with or without the sequence.The conformal comparison requires candidate-control exchangeability; distribution shift or contaminated controls degrades the match, while reference-model tests depend on model exchangeability.Source: §H.4 · pp. 58–59
  • The conformal test certifies FPR on the 1/(N + 1) grid without assuming a score-distribution shape, while Gaussian LiRA tails extrapolate below 1/256 and depend on fit.The paper favors low FPR even at the cost of false negatives; its sweep is not an ROC because it lacks a certified zero-FPR point and a known memorization TPR.Source: §H.4 · pp. 59–60
Loading 2607.12649v2…