{"id":"cba26811-db7f-4cb0-9e89-5e46ee82f9f0","arxiv_id":"2502.05159","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A decoding-time intervention that substitutes a small model's probabilities for common function words into a large model's output reduces exact training-data recall by up to 10x with minimal measured quality loss.","lead":"TOKEN SWAP swaps the probabilities of about 110 common function words (like 'the' and 'of') between a large model and a small auxiliary model during generation, cutting exact verbatim memorization by up to 10x on two production models while roughly preserving performance. It works with only token-level access, so it could be a practical defense for API users who cannot modify weights or training data.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'negligible task degradation' half of the central claim is not supported: all reported utility evaluations are insensitive to semantic errors introduced by swapping G tokens like 'is'/'was'.","rationale":"The reader's verdict is CONDITIONAL, with the weakest assumption placed on the auxiliary model's fluency and G-token coverage. I agree that this is a necessary condition, but I see a more load-bearing gap in the utility-preservation claim. The paper's own G includes semantically loaded copulas and auxiliary verbs ('is', 'was', 'be', 'have', 'do'), and TokenSwap replaces their probabilities with those of a small model. When the two models disagree, greedy decoding can change a fact or an instruction. The reported utility evidence does not measure this: CE loss is a token-level fluency metric, the commonsense tasks are multiple-choice with judged answers outside G, and MT-Bench is a coarse judge that will not heavily penalize a single factual error. Section 5's explicit exclusion of code and math further narrows the domain. If a broader evaluation shows meaningful accuracy drops on factoid QA or instruction-following, the central 'preserves capabilities' claim would fail for important use cases; if it does not, the concern is resolved. I would therefore keep the reader's CONDITIONAL verdict: the current evidence is suggestive but not sufficient. A secondary observation: the Pythia-70M row of Table 10 reports different Matching Length for Standard and TokenSwap even though the main and auxiliary models coincide, which would make the outputs identical; this should be checked, but it is not the basis of my main concern.","tokens_in":21010,"tokens_out":10990,"duration_ms":108498,"concrete_test":"Run TokenSwap with DistilGPT-2 as the auxiliary model on 1,000 open-ended factoid questions (e.g., Natural Questions or TriviaQA) using the same greedy decoding, and compute exact-match/F1 accuracy relative to standard generation. Also record the fraction of generations whose first divergence from Standard is at a G token and whether that divergence changes the final answer. If answer accuracy drops by more than a few points, or if a substantial share of diverging outputs change the answer, the 'negligible task degradation' claim needs revision; if accuracy is flat, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"TokenSwap's value proposition is the memorization/utility tradeoff, but the utility side is measured with tools that cannot detect the errors the method is most likely to cause. Appendix C.3 places 'is', 'was', 'have', 'do', and 'be' in G; swapping their probabilities can alter factual or instructional content (e.g., 'The capital of France is Paris' could become 'was Paris'). Table 6 reports identical commonsense accuracy, yet these are 128-sample multiple-choice tasks where the judged token is an answer letter or content word, not a G token, so the metric is blind to G-token flips. Table 3's SlimPajama CE measures token-level fluency rather than factuality, and MT-Bench is a holistic LLM-as-judge score that tolerates isolated factual errors. Section 5 explicitly excludes code and math, where function words carry syntax and semantics. Therefore, 'preserves the capabilities of large models' is an overstatement relative to the evidence; a correct statement would be 'does not degrade performance on the six evaluated commonsense tasks, SlimPajama fluency, and MT-Bench.' This is load-bearing because if TokenSwap flips even a small fraction of semantically loaded function words, it fails the 'negligible degradation' promise for deployed QA and instruction-following use.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces TokenSwap, an inference-time defense that replaces the probabilities of a fixed set G of 110 high-frequency English grammar tokens with scaled probabilities from a small auxiliary language model, leaving all non-G token probabilities unchanged. The authors evaluate the method in controlled fine-tuning scenarios on Llama-3.2-3B and in production-style settings on Pythia-6.9B and Llama-3-8B, reporting large reductions in exact match rate, matching length, and approximate-memorization metrics, with comparisons to CP-Fuse, MemFree, and Goldfish. They conclude that TokenSwap provides up to 800x reductions in verbatim generation while preserving model capabilities.","tokens_in":21271,"tokens_out":8934,"duration_ms":85560,"significance":"TokenSwap addresses a practical and timely problem: mitigating verbatim memorization under the realistic constraint that the user has access only to token-level outputs, not weights or training data. The core mechanism is simple, clearly described, and the empirical memorization reductions are substantial and consistent across the controlled and production-style evaluations. The ablations on G and on auxiliary model size provide useful guidance. The main weakness is the utility side of the memorization/utility tradeoff: the current benchmarks are largely insensitive to the semantic errors that G-token swaps are most likely to cause, so the 'negligible task degradation' claim is not yet established beyond the evaluated tasks.","major_comments":[{"comment":"The utility-preservation half of the paper's central claim is not yet supported. The commonsense accuracy in Table 6 is identical to Standard by construction, as the paper itself states in §B.2: TokenSwap 'does not affect token prediction for non-grammar tokens,' and the judged answer tokens in these multiple-choice tasks are not in G. Cross-entropy on SlimPajama measures token-level fluency, not factuality or instruction correctness, and MT-Bench is a holistic judge score reported without confidence intervals. Since G includes 'is', 'was', 'have', 'do', 'be', 'will', and other auxiliaries (Appendix C.3), TokenSwap can alter factual or instructional content, and none of the reported metrics would detect such errors. I request additional evaluations that are sensitive to G-token flips, such as closed-book QA with natural-language answers, factual-consistency or temporal-consistency checks, and grammar/number-agreement tasks, or the authors should explicitly restrict the performance claim to the evaluated benchmarks.","section":"§4.2, §B.2, Appendix C.3"},{"comment":"The memorization-reduction claim is domain-dependent. In the controlled experiments, EMR drops to 0.1% on WritingPrompts but only to 1.8% on MathAbstracts, and §5 explicitly excludes code and math from the current scope. The abstract's 'up to 10x drop' is accurate for the two production datasets, but the conclusion's broader statement of '10-800x reductions in verbatim generation' should be qualified to natural-language domains where function words occur frequently enough at decision points. Without this qualification, readers may over-generalize the method's effectiveness to content-word-dominated or structured outputs.","section":"§3, §4.1, Table 2, §5"}],"minor_comments":[{"comment":"Matching Length is reported as 464.0 in Table 2, but the generation length in Appendix C.4 is 128 tokens; please clarify whether ML is measured in characters or tokens and make the units consistent throughout.","section":"§4.1, Table 2, Appendix C.4"},{"comment":"The LeetCode column labeled EMR is actually ROUGE-L>0.8; the table caption and the surrounding text should use one consistent name for this metric.","section":"Table 3"},{"comment":"The definition of exact match rate is confused: it is described as a normalized longest-common-substring score, which is not an exact-match-rate definition; please replace it with a precise definition.","section":"Appendix D.1"},{"comment":"The arrows for Levenshtein distance are inconsistent with the rest of the paper: Table 8 shows 'Lev. ↓' while Tables 2 and 3 use 'Lev. ↑' with higher values indicating more divergence; please standardize the direction.","section":"Table 8"},{"comment":"The claimed one-to-one token mapping across tokenizers for G is only asserted; please document how G tokens are matched (for example, by string after detokenization) and confirm that all 110 tokens exist in every vocabulary used in the experiments.","section":"§3, Appendix C.2"},{"comment":"MT-Bench scores are reported without confidence intervals or multiple runs; please report variance or at least state the number of runs used.","section":"§4.2, Table 9"}],"recommendation":"major_revision","confidential_remarks":"The paper's contribution is real and the memorization results are strong. The main obstacle to acceptance is the utility evidence: the current benchmarks cannot detect the semantic errors that G-token swaps are most likely to cause. I would want either additional semantically sensitive evaluations or a carefully scoped claim before recommending acceptance. I also note that no code release or reproducibility package is mentioned, which would strengthen the paper."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The short version: TokenSwap is a simple, clearly-specified inference-time method that reduces exact memorization in LLMs by replacing probabilities of a fixed grammar-token set with those from a small auxiliary model. On Pythia-6.9B and Llama-3-8B it cuts exact-match rates by roughly 10x, and in fine-tuned \"extreme memorization\" settings by 50-800x. Those numbers look internally consistent, and the method operates with only token-level logits, which is a genuinely useful niche. The paper is worth reading and the method is worth testing.\n\nWhat's new: selective swapping of a grammar-token subset is a fresh variation on logit-mixing defenses (CP-Fuse, speculative decoding). The token-selection heuristic (high-frequency function words) is reasonable, and the ablations on G size and auxiliary model size are helpful. Comparison against Goldfish shows the post-hoc method can match a training-time defense, which is a nice result.\n\nWhere I'd push back: the utility side is under-evidenced. The stress-test note is right: the reported commonsense accuracy is identical by construction, because the answer tokens are not in G; MT-Bench is a holistic judge that tolerates isolated factual errors; and cross-entropy on SlimPajama measures fluency, not factuality. Swapping 'is' for 'was' in a factual sentence is exactly the kind of error these metrics won't catch. The paper should either run targeted factuality evals (e.g., open-domain QA, NLI, or a tense/agreement probe) or soften the \"negligible degradation\" claim to \"no degradation on the evaluated benchmarks.\" That is a real gap, but it is addressable; it does not sink the main memorization result.\n\nOther soft spots: no code or data release, which matters for a defense paper; and the memorization evaluation filters out code and URLs, so the natural-language-only scope should be stated more prominently. The MathAbstracts result (EMR 1.8% vs 0.1% on WritingPrompts) shows the mechanism weakens when content words dominate, which is a useful caveat.\n\nVerdict: this is a serious paper with a plausible mechanism and strong empirical reductions. The memorization half of the claim is well-supported; the utility half needs more work. Send it to review, with a request for targeted factuality evaluations and a more careful statement of the performance-preservation claim. I'd bring it to a reading group and would cite it if I worked on memorization defenses, though I'd cite the memorization results, not the utility claim.","headline":"Simple, plausible inference-time memorization defense with strong EMR reductions, but the 'negligible degradation' claim outruns the utility evidence.","tokens_in":21801,"tokens_out":3117,"would_cite":true,"duration_ms":29008,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TokenSwap claims that replacing a large model's probabilities for common grammar words with renormalized probabilities from a small auxiliary model at inference time breaks verbatim memorization with negligible task degradation, and that…","keywords":["memorization mitigation","inference-time defense","token-level logits","function words","small auxiliary model","verbatim generation","copyright safety","large language models"],"falsifier":"Run TokenSwap on a set of memorized passages composed almost entirely of rare content words, with no grammar tokens among the greedy choices (e.g., code identifiers or technical names); if exact reproduction persists, the cascade-breaking mechanism has not generalised. The paper's MathAbstracts result (EMR 1.8% vs 0.1% on WritingPrompts) already suggests this boundary condition.","tokens_in":20825,"feed_emoji":"🔀","tokens_out":7537,"duration_ms":63644,"temperature":0.7,"pith_summary":"TokenSwap is an inference-time defense against verbatim memorization in large language models. Its claim is that a large model's tendency to reproduce training text can be disrupted without touching its weights or training data: at each generation step, the method replaces the large model's probabilities for a fixed set of common grammar words with renormalized probabilities from a small auxiliary model such as DistilGPT-2. Because small models memorize far less, any memorized sequence that passes through one of those grammar tokens breaks, and the rest of generation carries on from the altered context. Evaluations on Pythia-6.9B and Llama-3-8B report up to a tenfold drop in exact memorization, and the paper argues this makes practical, API-only mitigation available to users who can see only token-level outputs.","feed_headline":"Tiny model's word swaps cut LLM memorized output 10x","feed_subtitle":"TokenSwap swaps function-word probabilities at inference, keeping reasoning scores while breaking verbatim recall.","key_machinery":"The load-bearing object is the fixed token subset $G$: roughly 110 grammar-based high-frequency English tokens (function words like 'the', 'of', 'and', pronouns, modals, auxiliary verbs), selected by part-of-speech filtering from the top frequent words. At every generation step, TokenSwap computes the main and auxiliary distributions, then replaces main probabilities on $G$ with $\\alpha \\cdot p_{\\mathrm{aux}}[v]$ where $\\alpha = (\\sum_{v\\in G} p_{\\mathrm{main}}[v])/(\\sum_{v\\in G} p_{\\mathrm{aux}}[v])$, leaving all other tokens untouched. The mechanism is that any memorized sequence containing a $G$ token as its greedy choice is derailed at that point, and the resulting context shift prevents the rest of the verbatim chain; because $G$ covers frequent function words, most natural-language memorized sequences are hit early.","core_discovery":"The central discovery is that the performance-memorization trade-off of scale can be decoupled at inference time, because the two abilities live at different granularities. Large models are needed for fluent, capable text, but the probabilities of high-frequency grammatical tokens (determiners, prepositions, conjunctions, pronouns, modals, auxiliary verbs) are well approximated by models two orders of magnitude smaller, which have far less memorized content. TokenSwap exploits this by selecting a fixed grammar-token set $G$ (110 tokens in the main experiments) and, at every position, replacing the main model's probabilities on $G$ with scaled probabilities from the auxiliary model, renormalizing with $\\alpha = \\sum_{v\\in G} p_{\\mathrm{main}}[v] / \\sum_{v\\in G} p_{\\mathrm{aux}}[v]$. The swap does not need to occur at every memorized position; hitting one token in the memorized chain changes the conditioning context for all later tokens, so the cascade collapses. The paper reports exact-match rates falling from 65.22% to 5.98% on the Pile-memorized set for Pythia-6.9B and from 9.65% to 0.96% on LeetCode for Llama-3-8B, with commonsense reasoning accuracy essentially unchanged.","pith_inferences":["Editorial inference: an adaptive $G$ that changes per domain or per prompt (for instance, syntax tokens for code, equation delimiters for math) could extend the same cascade-breaking mechanism to modalities where English function words are scarce.","Editorial inference: if the auxiliary model memorizes a sequence itself, TokenSwap inherits that memorization; the paper notes this limitation, so a practical deployment would want to verify low memorization of the chosen auxiliary model or combine it with a small-model unlearning method.","Editorial inference: because the method already runs a small model alongside the large one, it could be combined with speculative decoding, where the small model proposes tokens and the large model verifies; if the swap is applied to the verification stage, the runtime cost of the defense might be largely absorbed.","Editorial inference: a direct testable extension would compare TokenSwap's grammar-token swap against swapping the same fraction of randomly selected high-frequency content tokens, to measure whether it is the grammatical category, rather than frequency alone, that preserves task performance."],"forward_implications":["Users who access a model only through an API with token-level logits can mitigate memorized generation without retraining, unlearning, training-data access, or model weights (the paper's central use case).","On the evaluated models, exact memorization drops by roughly an order of magnitude (EMR from 65.22% to 5.98% on the Pile-memorized Pythia set; from 9.65% to 0.96% on LeetCode for Llama-3-8B) while commonsense benchmark accuracy stays at 71.87% and cross-entropy rises minimally.","TokenSwap matches or exceeds Goldfish, a pre-training memorization-defense method, when both are tested on the same Wikipedia data, and combining TokenSwap with Goldfish reduces memorization further, suggesting the two defenses are orthogonal.","The method's effectiveness is governed by the auxiliary model's low memorization: smaller auxiliary models (135M vs 1.7B SmolLM variants) produce less verbatim reproduction.","It is partial for non-natural-language domains: on MathAbstracts the exact-match rate falls to 1.8% (from 93.6%), higher than the 0.1% on WritingPrompts, because content words dominate and the grammar-token set is English-specific."],"supporting_citations":[{"why":"Defines extractable memorization, the paper's target notion of verbatim training-data reproduction.","marker":"[Carlini et al., 2021]"},{"why":"Documents the scaling-law trend that larger models memorize more training data, which the paper's trade-off rests on.","marker":"[Carlini et al., 2022]"},{"why":"Establishes that memorization emerges and grows predictably with model size, motivating the large-versus-small split.","marker":"[Biderman et al., 2024]"},{"why":"Supplies the CP-Fuse fusion baseline and the extreme fine-tuning protocol that TokenSwap is compared against.","marker":"[Abad et al., 2024]"},{"why":"Supplies the Goldfish pre-training baseline and pre-trained models used in Section 4.3.","marker":"[Hans et al., 2024]"},{"why":"Supplies MemFree, the blocking baseline that requires training-data access and is compared in the extreme memorization setup.","marker":"[Ippolito et al., 2022]"},{"why":"Provides the Pile-memorized evaluation set of 32-token prefixes and 48-token suffixes used to test Pythia-6.9B.","marker":"[Chang et al., 2024a]"},{"why":"Documents LeetCode statement memorization in Llama models, motivating the LeetCode evaluation set.","marker":"[Karamolegkou et al., 2023]"},{"why":"Supports the claim that small models approximate probabilities of high-frequency function words while diverging on rare terms.","marker":"[Pinto et al., 2024a]"},{"why":"Supplies the 80M DistilGPT-2 auxiliary model used to provide grammar-token probabilities.","marker":"[Sanh et al., 2019]"}],"fun_headline_variants":["TokenSwap: 10x drop in LLM memorization with tiny model","Lightweight token swap kills LLM verbatim recall (10x)","Cut LLM memorization 10x by swapping function words","Inference-time token swap reduces LLM memorization 10x"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense assumes that a small auxiliary model's probabilities for common function words are fluent and trustworthy enough that swapping them in does not degrade output, and that memorized sequences contain enough of those tokens at decision points for the swap to break the chain.","fun_headline_variants_meta":{"raw":{"variants":["TokenSwap: 10x drop in LLM memorization with tiny model","Lightweight token swap kills LLM verbatim recall (10x)","Cut LLM memorization 10x by swapping function words","Inference-time token swap reduces LLM memorization 10x"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000557,"raw_usage":{"total_tokens":2693,"prompt_tokens":1033,"completion_tokens":1660,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":649,"completion_tokens_details":{"reasoning_tokens":1584}},"tokens_in":649,"tokens_out":1660,"duration_ms":11195,"temperature":1.0,"reasoning_tokens":1584,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T20:02:24.060616+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run TokenSwap on a set of memorized passages composed almost entirely of rare content words, with no grammar tokens among the greedy choices (e.g., code identifiers or technical names); if exact reproduction persists, the cascade-breaking mechanism has not generalised. The paper's MathAbstracts result (EMR 1.8% vs 0.1% on WritingPrompts) already suggests this boundary condition.","supporting_citations":[{"cited_title":"Copyright-Protected Language Generation via Adaptive Model Fusion","cited_arxiv_id":"2412.06619","evidence_quote":"Supplies the CP-Fuse fusion baseline and the extreme fine-tuning protocol that TokenSwap is compared against."},{"cited_title":"Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter","cited_arxiv_id":null,"evidence_quote":"Supplies the 80M DistilGPT-2 auxiliary model used to provide grammar-token probabilities."}],"review_version":1}