{"id":"0fd16e63-d182-4ce1-b62e-9e6228ec095b","arxiv_id":"2506.12321","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"LLM memorization is concentrated in low-redundancy (high-entropy) samples, which are roughly twice as fragile under prefix perturbation as high-redundancy samples, according to the paper's measurements on Pythia models.","lead":"This paper reports that large language models memorize low-redundancy, high-entropy text more often than predictable text, and that such text loses memorization more quickly under small perturbations. It suggests using redundancy as a preprocessing signal to reduce privacy leakage, but the analysis does not show that redundancy matters beyond token frequency and repetition.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'beyond frequency' claim is untested: the redundancy measure in Eq. (1) is unigram entropy, and the paper never jointly controls for token frequency, so the 79% and 2x vulnerability results may be a proxy for rarity.","rationale":"The reader identified the same load-bearing weakness: the redundancy measure is never tested against frequency in a joint model, so the 'beyond frequency' claim is unsupported. My independent reading confirms this is the central problem. Eq. (1) is literally unigram entropy; it cannot be interpreted as a frequency-independent construct without a conditional analysis. The paper's own Section 5.1 establishes that frequency differentially affects memorized and non-memorized samples, making the confounding concrete rather than hypothetical. The additional issues (unspecified alpha, unspecified split threshold, internal contradiction in the abstract, and the circular 'prediction' in Section 7.3) compound the problem but are secondary; even if all were fixed, the absence of a frequency-controlled analysis would leave the core claim unproven. I do not see grounds for accepting the paper's central conclusion. The empirical correlations may be real, but they do not establish redundancy as a causal or even independent factor. I therefore agree with the reader's REJECT verdict. The concrete test above would settle the matter: if redundancy survives frequency controls, the paper could be revised into a conditional accept; if not, the central claim fails.","tokens_in":41923,"tokens_out":1915,"duration_ms":27163,"concrete_test":"On the same 10,000-sample test set used in the paper, compute for every sample the redundancy score Re(s) from Eq. (1), the average token frequency, repetition count, and prompt perplexity. Fit a logistic regression predicting memorization status (theta=0.5) with all four predictors, and separately a linear regression predicting perturbation-induced memorization drop with redundancy and frequency as competing predictors. If the redundancy coefficient loses significance or changes sign once token frequency is included, the 'beyond frequency' claim is not supported. Report standardized coefficients and partial correlations.","verdict_should_be":"REJECT","load_bearing_attack":"The paper's central claim is that information redundancy explains memorization 'beyond frequency.' That claim rests entirely on Eq. (1), which defines redundancy as 1 minus normalized unigram entropy. This quantity is a deterministic function of the token-frequency distribution: low redundancy corresponds to high entropy, which in practice means rare, diverse, or uniformly distributed tokens. Token frequency and rarity are already established memorization factors (Carlini et al. 2023; Biderman et al. 2023; Prashanth et al. 2025), and the paper's own Figure 3 shows frequency effects on memorization scores. Yet Sections 7.1 and 7.2 compare memorization rates and perturbation drops between high- and low-redundancy groups without conditioning on frequency, repetition, or perplexity. If low-redundancy samples are simply rare-token samples, then the 79% low-redundancy dominance among memorized samples and the 2-fold higher vulnerability are exactly what the frequency literature predicts; the 'beyond frequency' conclusion collapses. The paper also contains a direct internal contradiction: the abstract and Section 7.2 state that ~79% of memorized samples are low-redundancy and that these are the fragile ones, yet the abstract's final clause claims 'more redundant content becomes both more memorable and more fragile.' That clause is the opposite of the data. This is not a stylistic slip; the paper's own stated conclusion is unsupported by its reported results. The perturbation-weighting alpha and the high/low redundancy split threshold are never specified, so the key quantitative claims (79%, 2-fold, 0.6 vs 0.01) are not reproducible. The Section 7.3 'prediction' is a consistency check on the same data, not an independent test. The load-bearing assumption is the construct validity of Eq. (1) as 'redundancy' distinct from frequency; the paper provides no joint analysis to support it.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies verbatim memorization in Pythia LLMs (70M to 12B) using a dataset of 32-token extractable sequences. It first reports that token frequency and repetition affect memorized and non-memorized samples differently, then proposes a unified perturbation quantification based on positional changes, defines sequence redundancy via normalized unigram entropy (Eq. 1), and claims that roughly 79% of memorized samples are low-redundancy, that low-redundancy samples are about twice as vulnerable to prefix perturbations, and that this demonstrates a role for information redundancy beyond surface-level factors such as frequency. The paper closes with a proposed practical application to data preprocessing for privacy and bias mitigation.","tokens_in":42186,"tokens_out":7954,"duration_ms":94769,"significance":"The empirical setup is attractive: it spans eight Pythia scales and multiple training checkpoints, uses a public extraction test set, and formalizes four perturbation types in a unified framework. If the redundancy account were properly supported, it would add a useful dimension to memorization research and motivate redundancy-guided data curation. The paper also makes a fair methodical point that aggregate frequency/repetition correlations can hide opposite or thresholded behavior within memorized versus non-memorized subsets. However, the central contribution—redundancy as an explanatory factor beyond frequency—is not demonstrated, because the redundancy analysis never jointly controls for frequency, repetition, or perplexity. The abstract's final sentence also states a conclusion opposite to the paper's own reported findings. The manuscript does not mention releasing code or data, which limits reproducibility of the perturbation and redundancy computations.","major_comments":[{"comment":"The redundancy measure Re(s) in Eq. (1) is a deterministic transform of the empirical unigram distribution of the prefix, so \"low redundancy\" corresponds to high entropy, i.e., sequences with many distinct or rare tokens. The paper never conditions on token frequency, repetition count, or prefix perplexity when comparing high- and low-redundancy groups, even though those factors are established memorization drivers and are plotted in the paper's own Figure 3. The reported 79% low-redundancy dominance among memorized samples and the 2-fold vulnerability difference may therefore be entirely explained by rarity or repetition, which would collapse the title's \"beyond frequency\" claim. A concrete joint analysis, such as stratifying by frequency bins or fitting a model with both frequency and redundancy as predictors, is needed to support the central claim.","section":"Section 3.2, Eq. (1); Sections 7.1-7.2"},{"comment":"The final sentence of the abstract says that \"more redundant content becomes both more memorable and more fragile,\" which is the opposite of the paper's own results. Section 7.2 reports that about 79% of memorized samples are low-redundancy, and Section 7.1 reports that low-redundancy samples are the more vulnerable ones. Section 8 correctly concludes that models preferentially memorize low-redundancy content. This internal contradiction in the abstract's statement of the central conclusion must be fixed; as written, the paper's headline finding is not supported by its reported data.","section":"Abstract and Section 7.2"},{"comment":"The \"testable prediction\" in Section 7.3 is derived from the findings of Sections 7.1 and 7.2 and then tested on the same dataset and models that produced those findings. The resulting observation that memorized samples drop by 0.6 while non-memorized samples drop by 0.01 is therefore a consistency check, not an independent confirmation. To be a genuine prediction test, the authors should use held-out data, a different model family, or a pre-registered threshold; otherwise the prediction language overstates the evidential value of the result.","section":"Section 7.3"}],"minor_comments":[{"comment":"The unified perturbation magnitude and the absolute position change are both denoted by P, which is confusing; consider renaming one of them (e.g., U for the unified magnitude).","section":"Section 3.1"},{"comment":"The text states that R2 values \"over 85% of uncertainty variance\" are explained, but the reported mean is 0.85 and the range is 0.82-0.91; the correct wording would be \"on average, about 85%,\" not \"over 85%.\"","section":"Section 6"},{"comment":"The distribution p(v) in Eq. (1) is not explicitly defined; the authors should state that it is the empirical unigram distribution of the prefix and discuss the effect of the short 32-token prefix length on the stability of the entropy estimate.","section":"Section 3.2"},{"comment":"The chi-square test is reported only as p < 0.001; the test statistic, degrees of freedom, and effect size should be given so the reader can assess the magnitude of the 79%/21% imbalance.","section":"Section 7.2"},{"comment":"The phrase \"control factor r\" is misleading; r is a perturbation intensity ratio (the fraction of tokens modified), not a control variable in the statistical sense, and the terminology should be changed accordingly.","section":"Section 3.1"}],"recommendation":"major_revision","confidential_remarks":"The reader's rejection is understandable because the central 'beyond frequency' claim is currently untested and the abstract contains a direct contradiction. I recommend major revision rather than outright rejection because the missing frequency-controlled analysis is, in principle, obtainable within the manuscript's scope: the authors could stratify or regress on frequency, repetition, and perplexity using the same dataset. If a revised version does not demonstrate incremental explanatory power of redundancy over these established factors, or if the abstract remains inconsistent with the results, the paper should not be accepted."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"There is a real observation hiding in here, but the paper's headline claim, that redundancy explains memorization beyond frequency, is not supported by the experiments. The redundancy measure in Eq. (1) is simply 1 minus normalized unigram entropy, which is a direct function of the token frequency distribution. Low redundancy means high entropy, i.e., diverse or rare tokens. Since the paper never conditions on token frequency or repetition when comparing high- and low-redundancy groups, the 79% low-redundancy dominance and the 2-fold vulnerability are exactly what the existing frequency/rarity literature predicts. The 'beyond frequency' conclusion collapses.\n\nWhat is actually new and worth taking seriously is the differential finding in Section 5: memorized samples respond far less to frequency and repetition changes than non-memorized samples across Pythia scales. That is a clean, potentially useful observation. The perturbation quantification framework, using positional displacement plus relative order across insertion, deletion, replacement, and shuffle, is a reasonable formalization, and the validation against output uncertainty (R^2 around 0.85) is solid. The paper is also transparent about using a 10k-sample subset and provides a pilot validation.\n\nThe soft spots are load-bearing and not minor. First, the construct validity of Eq. (1) as 'redundancy' is never established against frequency; a joint analysis or partial correlation is missing. Second, the abstract's final sentence says 'more redundant content becomes both more memorable and more fragile,' which is the opposite of what the paper's own data show, since the data say low-redundancy content is memorable and fragile. That is a direct internal contradiction. Third, the perturbation weighting alpha and the high/low redundancy split threshold are never reported, so the headline numbers (79%, 2-fold, 0.6 vs 0.01) are not reproducible as written. Fourth, Section 7.3 is a consistency check on the same data, not an independent prediction, even though the paper frames it as testable.\n\nWho is this for? Researchers working on memorization factors might get value from the differential frequency/repetition analysis and from the perturbation method. But the paper would need substantial revision, including joint frequency and redundancy modeling, full reporting of alpha and threshold, fixing the abstract, and reframing Section 7.3, before the central claim is credible.\n\nMy recommendation: send it to peer review, but with a clear expectation of heavy revision. A good referee could salvage the differential observation and the perturbation method, and that would be worth having. As written, the central claim does not stand.","headline":"A real differential observation about memorized versus non-memorized samples, but the 'beyond frequency' claim collapses because redundancy is unigram entropy and frequency is never jointly controlled.","tokens_in":799,"tokens_out":818,"would_cite":false,"duration_ms":35454,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Information redundancy, not just token frequency, shapes what large language models memorize: about 79 percent of memorized samples are low-redundancy and roughly twice as fragile to perturbation.","keywords":["large language models","memorization","information redundancy","unigram entropy","prefix perturbation","Pythia models","privacy risk"],"falsifier":"A matched-pair or joint-regression study that varies the entropy-based redundancy score while holding average token frequency fixed: if within frequency bins the redundancy measure shows no residual association with memorization status or perturbation-induced score drops, the 'beyond frequency' conclusion fails.","tokens_in":41671,"feed_emoji":"🧠","tokens_out":6563,"duration_ms":74014,"temperature":0.7,"pith_summary":"This paper argues that information redundancy—how much of a text can be predicted from context—governs what large language models memorize, beyond the previously studied factors of token frequency and repetition. The authors report that about 79% of memorized samples are low-redundancy, that these low-redundancy samples lose memorization scores at about twice the rate of high-redundancy ones under the same prefix perturbation, and that memorized samples drop by 0.6 while non-memorized samples drop by only 0.01. If true, the finding turns redundancy into a practical lever: curating or perturbing training text by its redundancy could reduce privacy leakage and memorization-driven bias, and it would explain why frequency manipulations move memorized and non-memorized samples so differently.","feed_headline":"79% of memorized training text is low-redundancy","feed_subtitle":"Prefix perturbations show these dense samples are twice as fragile as high-redundancy ones, in Pythia models from 70M to 12B.","key_machinery":"The paper's load-bearing tool is an entropy-based redundancy measure, $Re(s) = 1 - \\frac{1}{\\log_2 |V|} \\sum_{v\\in V} p(v) \\log_2 p(v)$, a unigram predictability score where lower values mean most tokens are unpredictable and hence 'low redundancy.' Around it, the paper builds (i) four formal perturbation operators—insertion, deletion, replacement, and shuffling—and a unified magnitude $\\mathcal{P} = \\alpha P + (1-\\alpha) R$ combining absolute token displacement with relative-order disruption, and (ii) an n-gram overlap memorization score $M_n(O,G)$ that classifies outputs as memorized above threshold $\\theta = 0.5$. The redundancy score assigns samples to high/low groups; the perturbation magnitude makes different error types comparable for measuring vulnerability; the memorization score defines the outcome.","core_discovery":"The central claim is that models preferentially memorize low-redundancy content, and that this content is disproportionately fragile. Testing the eight Pythia model scales (70M to 12B) on extractable sequences from The Pile, the paper finds that measured by unigram entropy, roughly 79% of memorized samples are low-redundancy across thresholds and scales (with χ² test, p<0.001), and that under identical insertion, deletion, replacement, or shuffling perturbations, low-redundancy samples show a 2-fold higher memorization drop than high-redundancy samples. The paper concludes that information redundancy is a deep-level factor underlying memorization, with conventional surface-level characteristics like frequency acting as symptoms rather than primary drivers, and that models prefer low-redundancy content first, gradually memorizing higher-redundancy content as scale and training progress.","pith_inferences":["If redundancy is the operative variable, deduplication-based defenses may not address the risk: deduplication removes repeated, often high-redundancy text, whereas the memorized and fragile strings reported here are dense and unique.","A direct test of the 'beyond frequency' framing would re-run the same perturbation experiments on samples matched for token frequency but split into high/low entropy; the paper leaves that comparison unperformed.","The redundancy score is unigram-based, so a bigram or contextual variant could plausibly reassign many samples; reporting how much the 79% figure moves under such a variant would sharpen the claim.","The unified perturbation magnitude contains a free weighting hyperparameter α; the reported drops may shift with α, so a sensitivity sweep would clarify whether the 2-fold ratio is robust."],"forward_implications":["Redundancy can be used as a preprocessing signal during data curation: filtering or augmenting low-redundancy text before training should reduce memorization and the privacy risks that come with it.","Perturbation-vulnerability scoring can be applied to any model family, because it reduces four different error types to one comparable strength measure rather than treating typos, deletions, and shuffles as incommensurable.","Stratifying memorization analyses by memorized versus non-memorized status exposes effects that aggregate correlations hide, so future studies should report subgroup patterns alongside pooled results.","Because the low-redundancy preference appears early in training and weakens only gradually with scale, redundancy-based defenses would need to act on the corpus rather than on model size or training duration."],"supporting_citations":[{"why":"Supplies the concept of 50% natural-language redundancy and the entropy-based measurement formula used in Eq. (1).","marker":"Fedorenko et al. (2024)"},{"why":"Releases the Pythia model suite and the 32-token extractable-sequence test set from The Pile that all experiments use.","marker":"Biderman et al. (2023)"},{"why":"Establishes the memorization quantification paradigm, the θ=0.5 threshold, and the frequency/repetition scaling results the paper claims to go beyond.","marker":"Carlini et al. (2023)"},{"why":"Defines verbatim training-data extraction, the privacy threat model this work addresses.","marker":"Carlini et al. (2021)"},{"why":"Provides The Pile corpus, the pretraining data behind the Pythia checkpoints evaluated here.","marker":"Gao et al. (2020)"}],"fun_headline_variants":["Low-redundancy text drives LLM memorization","Memorized text is 79% low-redundancy","Redundancy predicts LLM fragility more than frequency","LLMs prefer low-redundancy content for memorization","Low-redundancy samples 2x more vulnerable to perturbation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the unigram-entropy score in Eq. (1) measures information redundancy and is distinct from token frequency and rarity: the paper never tests redundancy against frequency in the same model, so if low redundancy is mainly a proxy for low frequency, the central conclusion does not follow.","fun_headline_variants_meta":{"raw":{"variants":["Low-redundancy text drives LLM memorization","Memorized text is 79% low-redundancy","Redundancy predicts LLM fragility more than frequency","LLMs prefer low-redundancy content for memorization","Low-redundancy samples 2x more vulnerable to perturbation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000195,"raw_usage":{"total_tokens":1350,"prompt_tokens":928,"completion_tokens":422,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":544,"completion_tokens_details":{"reasoning_tokens":337}},"tokens_in":544,"tokens_out":422,"duration_ms":4265,"temperature":1.0,"reasoning_tokens":337,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T00:52:24.778237+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A matched-pair or joint-regression study that varies the entropy-based redundancy score while holding average token frequency fixed: if within frequency bins the redundancy measure shows no residual association with memorization status or perturbation-induced score drops, the 'beyond frequency' conclusion fails.","supporting_citations":[],"review_version":1}