← 研踪 PaperTrailarXiv:2606.06286 · v2
LLMs Can Leak Training Data But Do They Want To? Evaluating Memorization Propensity in LLMs
首次提交 2026-06-04 23:25
版本更新 2026-10-27 16:36
雷达观测 2026-10-29 00:35
摘要
Large language models can reproduce training data, but memorization evaluations mostly measure whether models can be made to do so, not whether they do so without adversarial prompting. We introduce PropMe, a framework that pairs a capability evaluation (prefix attacks) with non-adversarial propensity evaluation, and a propensity metric to relate the two. We check every generation against the model's full indexed training corpus with SimpleTrace, an open-source batch implementation of OLMoTrace span matching. We evaluate Comma, its continually pre-trained descendant DFM Decoder, and OLMo3 32B on Common Pile, Dynaword, and Dolma3, with four non-adversarial settings ranging from no prompt to sentences from unseen in-domain sources. Our results show that natural sentence prompts reproduce far less training text than prefix attacks. Generation with no prompt or a single common word, however, reproduces about as much as prefix attacks, or more, in three out of four model-corpus pairs; most of this text is duplicated licenses, code, and templates. In our setting, continual pre-training reduces long verbatim reproduction of the original corpus only modestly. More broadly, we argue that by testing both capability and propensity, we can attain a more comprehensive picture of a model's memorization behavior.
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v2 · 2026-10-27 16:36 · 最新观测版本
LLMs Can Leak Training Data But Do They Want To? Evaluating Memorization Propensity in LLMs
Large language models can reproduce training data, but memorization evaluations mostly measure whether models can be made to do so, not whether they do so without adversarial prompting. We introduce PropMe, a framework that pairs a capability evaluation (prefix attacks) with non-adversarial propensity evaluation, and a propensity metric to relate the two. We check every generation against the model's full indexed training corpus with SimpleTrace, an open-source batch implementation of OLMoTrace span matching. We evaluate Comma, its continually pre-trained descendant DFM Decoder, and OLMo3 32B on Common Pile, Dynaword, and Dolma3, with four non-adversarial settings ranging from no prompt to sentences from unseen in-domain sources. Our results show that natural sentence prompts reproduce far less training text than prefix attacks. Generation with no prompt or a single common word, however, reproduces about as much as prefix attacks, or more, in three out of four model-corpus pairs; most of this text is duplicated licenses, code, and templates. In our setting, continual pre-training reduces long verbatim reproduction of the original corpus only modestly. More broadly, we argue that by testing both capability and propensity, we can attain a more comprehensive picture of a model's memorization behavior.
查看此版本解读 →查看此版本原文 ↗