{"id":"9e085a18-e0c1-4488-8809-087fd1078aa6","arxiv_id":"2507.01844","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Only about 40% of low-perplexity 6-token spans generated by Pythia-6.9B can be exactly matched to The Pile, and the authors categorize matched and unmatched spans into four classes.","lead":"This paper studies low-perplexity spans (token runs the model is highly confident about) in outputs of Pythia-6.9B, and tries to find those spans in the training corpus, The Pile. Across four topics, only about 40 percent of 6-token spans match the corpus exactly, and the rest are classified into synthetic, memorized, replicated, or frequently encountered text.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 40% match rate is measured with Infini-gram's LLaMA-2 tokenizer against Pythia-generated windows; tokenizer misalignment can only lower the observed match rate, so the paper's 'cannot be mapped' conclusion is conditional until re-tested with a same-tokenizer index.","rationale":"The reader's weakest assumption identifies exactly the load-bearing issue: the Infini-gram match oracle uses LLaMA-2 tokenization while the model uses Pythia, so the reported match rate is a lower bound that could be an artifact of the matching pipeline rather than a property of low-perplexity generation. This is not a question of internal inconsistency; the paper is transparent about the limitation. But it directly affects the central quantitative claim: if a same-tokenizer re-index raises the match rate from ~40% to, say, 80%, the conclusion 'a substantial portion cannot be mapped' would need to be restated or abandoned. Other concerns, such as overlapping sliding windows inflating the effective sample size or prompt-repetition inflating Nrep, are secondary and in some cases would strengthen the 'unmatched' finding rather than weaken it. The proposed concrete test is decisive: it separates a tokenization artifact from a genuine model behavior. Since the reader already assigned CONDITIONAL with moderate confidence and the same weakest assumption, my stress-test does not move the verdict; it reinforces the condition under which the paper would be acceptable. If the tokenizer-aligned test shows no large change, the central claim stands and the paper could be upgraded; if it shows a large change, the paper's main conclusion is not supported.","tokens_in":9329,"tokens_out":5052,"duration_ms":60093,"concrete_test":"Sample 200 unmatched windows (Nc=0) per topic. Detokenize each window, re-tokenize with Pythia's tokenizer, and search the resulting raw text in a Pythia-tokenized index of The Pile (e.g., Elasticsearch configured with Pythia's tokenizer, or a small Infini-gram-style index built with Pythia tokenization). Recompute the overall Nc>0/N. If the match rate rises substantially above the reported 41%, the tokenizer mismatch is the primary driver of the 'cannot be mapped' result; if it stays near 41%, the conclusion survives.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (Section 3.1, Table 2) is that only about 40% of low-perplexity windows have at least one exact match in the training data, and the paper interprets the complementary ~60% as 'cannot be mapped to the corpus.' This measurement is made with Infini-gram, whose index is built with the LLaMA-2 tokenizer, while the generated windows come from Pythia 6.9B, which uses its own tokenizer (Section 2). The authors disclose this in Section 5: 'certain spans, especially verbatim sequences, may fail to align across models despite being present in the training data.' The risk is not merely a minor boundary effect: BPE tokenization is context-dependent, so a raw-text span that corresponds to a contiguous 6-token Pythia window may not align to LLaMA-2 token boundaries in the source document, and the specific LLaMA-2 n-gram queried may not exist in the index even though the text is present. This produces systematic false negatives, inflating the c=0 'synthetic coherence' category and deflating the reported Nc>0 rate. Because the paper's headline—'a substantial portion of these low-perplexity spans cannot be mapped to the corpus'—rests on this rate, the tokenizer mismatch is a load-bearing threat to the central empirical conclusion. The authors' own limitation note shows they are aware, but they do not quantify the impact or provide a tokenizer-aligned sensitivity check.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces an open-source pipeline that extracts low-perplexity token sequences from Pythia-6.9B generations on four specialized topics (cryptography, drugs, genetics, nuclear physics), converts them into 6-token sliding windows, and queries Infini-gram for exact matches in The Pile. The central empirical claim, stated in Section 3.1 and Table 2, is that only about 40% of low-perplexity windows have at least one exact match in the training data, and the paper interprets the complementary portion as evidence that many low-perplexity spans cannot be mapped back to the corpus. Matched windows are then partitioned by match count into four categories: synthetic coherence (c=0), memorization (050). The paper also reports scaling and temperature experiments in Section 3.3. The main conclusion is that exact-match tracing of low-perplexity sequences is incomplete and that the observed match distribution supports a nuanced view of memorization, but the headline measurement is conditional on the tokenizer mismatch and the absence of a control baseline.","tokens_in":9661,"tokens_out":3327,"duration_ms":36364,"significance":"If the central measurement survives the tokenizer-mismatch and baseline checks, the paper would be a useful empirical contribution to training-data attribution and memorization research. Its strengths are the open-source pipeline, the multi-topic design, the model-scaling and temperature sweeps, and the explicit categorical framework for interpreting match counts. The paper is also honest in listing its limitations, including the tokenizer mismatch in Section 5. The claim is an empirical observation rather than a theoretical law, and its value depends on the reliability of exact-match search as a proxy for presence in the training data; that reliability is exactly what the main concern targets.","major_comments":[{"comment":"The central measurement in Table 2 is made with Infini-gram's LLaMA-2 tokenizer on windows generated by Pythia, which uses a different tokenizer. The authors acknowledge this mismatch in Section 5, but because BPE tokenization is context-dependent, a 6-token Pythia window that is present verbatim in The Pile may not align to any contiguous LLaMA-2 n-gram stored in Infini-gram's index, producing systematic false negatives. This can only lower the observed Nc>0 rate, so the headline 'only 40% of low-perplexity windows have at least one exact match' is potentially an artifact of tokenization rather than a property of low-perplexity generation. The manuscript needs a same-tokenizer sensitivity check, for example by indexing the relevant Pile subset with the Pythia tokenizer or by re-tokenizing matched windows, and a quantitative estimate of the mismatch rate, before the 'cannot be mapped' conclusion can be accepted.","section":"Section 3.1, Table 2, and Section 5"},{"comment":"There is no control condition comparing the match rate of low-perplexity windows with high-perplexity or randomly selected windows of the same length. Without such a baseline, the statement that low-perplexity spans are surprisingly unmappable is not supported: the observed 25-67% match rates could reflect the general sparsity of exact 6-gram matches in a trillion-token corpus under a mismatched tokenizer rather than a distinctive property of low-perplexity generation. I request a control experiment, for example sampling windows from the same outputs with high standalone perplexity or sampling random contiguous spans from held-out text, and reporting the same Nc>0 statistics for those controls.","section":"Section 3.1, Table 2, and Section 5"},{"comment":"Because the prompts are quotes extracted from the Wikipedia portion of The Pile, a substantial fraction of low-perplexity windows are prompt repetitions (Nrep/N ranges from 7.9% to 32% in Table 2), and these repetitions are retained in the subsequent analyses. This inflates the overall Nc>0 rate and the memorization/segmental-replication categories in a way that is not intrinsic to low-perplexity generation but instead reflects re-generation of the provided context. The main statistics should be reported both with and without windows that overlap the prompt, so readers can separate genuine recall from re-sampling of the supplied prompt.","section":"Section 3.1 and Section 5"}],"minor_comments":[{"comment":"The table header contains the typo 'Crypt2ography'; it should read 'Cryptography'.","section":"Table 1"},{"comment":"The column header 'N>0/N' is inconsistent with the notation 'Nc>0' used in Table 2 and the text; the same quantity should be named uniformly throughout.","section":"Tables 4 and 5"},{"comment":"The text contains the typo 'occurances' for 'occurrences'.","section":"Section 3.1"},{"comment":"The justification that a 6-token window is 'long enough to avoid random matches' would benefit from a null-model estimate or a citation; as written, the choice of window size is asserted rather than tested.","section":"Section 2"},{"comment":"The thresholds c=5 and c=50 are acknowledged as arbitrary, but the paper does not provide a sensitivity analysis for these cutoffs; a brief robustness check would make the cross-topic comparison in Table 3 more convincing.","section":"Section 3.2"}],"recommendation":"major_revision","confidential_remarks":"The paper is transparent about its main limitation, which is commendable, but the tokenizer mismatch is not a peripheral issue: it directly affects the paper's most striking quantitative claim. The requested sensitivity analysis and the high-perplexity control are both feasible within the manuscript's scope, so I do not think the paper should be rejected; however, the current version's central claim is conditional on an unquantified source of false negatives."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a clean, honest empirical pipeline that measures how often low-perplexity 6-token windows from Pythia-6.9B outputs have exact matches in The Pile. The headline number—only about 40% match—is real for this setup but is entangled with a tokenizer mismatch that the authors themselves disclose in Section 5.\n\nWhat's actually new: the systematic focus on 6-token low-perplexity windows and the match-count categorization (c=0, 1-5, 5-50, >50) with topic-level variation. Prior work used low perplexity or n-gram matching separately, but not this combined window-based triage with match-frequency bins. That gives TDA and memorization researchers a practical way to sort spans into reviewable categories. The pipeline and code are open-source, and the authors are upfront about limitations—the Infini-gram LLaMA-2 tokenizer vs Pythia tokenizer problem is stated plainly, as is the prompt-repetition bias. That honesty earns real credit.\n\nThe soft spots are real but proportionate. The tokenizer mismatch is the biggest one: it can only produce false negatives, so the 40% figure is probably an upper bound under a same-tokenizer index. The qualitative claim that many low-perplexity spans are unmatched may survive, but the size is uncertain. Also, there's no baseline comparing high-perplexity windows. Without that, we don't know whether low perplexity matters or whether any 6-gram from the model would behave similarly. Prompt repetition from Pile-derived prompts inflates some counts, though the authors track it. The category thresholds (5, 50) are arbitrary but presented as interpretive, not fitted, so that's minor. Citation pattern looks fine: they build on Carlini and Prashanth without overselling novelty.\n\nWho this is for: people working on memorization, training data attribution, and n-gram novelty. They'll get a useful empirical data point and a reproducible pipeline. It deserves a serious referee. The right ask is a same-tokenizer sensitivity analysis and a high-perplexity control before the central claim is stated as robust. I'd bring it to reading group for the methodology discussion.","headline":"Real empirical finding on low-perplexity windows, but the headline match rate is conditional on a disclosed tokenizer mismatch; deserves review with a same-tokenizer sensitivity check.","tokens_in":10200,"tokens_out":1506,"would_cite":true,"duration_ms":18247,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper reports that only around 40% of low-perplexity 6-token windows generated by Pythia 6.9B have at least one exact match in The Pile, and classifies the rest and the matched subsets by match frequency.","keywords":["low-perplexity sequences","training data attribution","memorization","verbatim recall","Infini-gram","Pythia","The Pile","exact n-gram matching"],"falsifier":"Re-run the matching pipeline with Infini-gram re-indexed using the Pythia tokenizer (or an equivalent tokenizer-matched exact-match oracle) on the same generated windows. If the share of windows with at least one exact match rises from roughly 40% toward the 90%+ range, the claim that most low-perplexity spans cannot be mapped to the corpus would be an artifact of tokenizer mismatch rather than a property of generation.","tokens_in":9117,"feed_emoji":"🔎","tokens_out":6540,"duration_ms":49186,"temperature":0.7,"pith_summary":"This paper asks whether the stretches of text an LLM generates with very high confidence are verbatim copies of its training data. The authors measure this on Pythia 6.9B over four specialised topics, extracting 6-token windows whose every token has conditional probability $p \\ge 0.9$ and counting exact matches in The Pile via Infini-gram. They find that only about 40% of such low-perplexity windows have any exact match, and the rest appear to be synthetically coherent text the model produced without copying. Matched windows split by match frequency into memorization, segmental replication, and frequently encountered text, with about 20% traceable to few enough documents for manual review. The paper thus provides a quantitative, category-level answer to when low perplexity signals memorization rather than fluent synthesis.","feed_headline":"Only 40% of low-perplexity LLM spans match training data","feed_subtitle":"High-confidence 6-token windows in Pythia 6.9B output mostly have no exact match in The Pile.","key_machinery":"The central object is the low-perplexity window: a contiguous 6-token span in which every token has conditional probability at least 0.9 ($\\log_2 P \\le 0.152$). The pipeline slides a stride-1 window over low-perplexity sequences extracted from model outputs, then queries Infini-gram's trillion-token n-gram index of The Pile for exact occurrences of each window. The number of matching documents $c$ for each window is the quantity that drives the taxonomy of synthetic coherence, memorization, segmental replication, and frequently encountered text.","core_discovery":"The paper's central empirical discovery is that low perplexity is not a reliable marker of verbatim training-data recall. Measuring 6-token windows with per-token probability $p \\ge 0.9$ in generations by Pythia 6.9B, only 40% of windows have at least one exact n-gram match in The Pile ($N_{c>0}$), with topic-level match rates from 25% (nuclear physics) to 67% (drugs). The remaining ~60% of low-perplexity windows are coherent text the model produced with no exact corpus match. Among matched windows, the number of matching documents $c$ separates three behaviours: memorization ($050$), roughly 20% of all windows falling in the manually reviewable first two categories.","pith_inferences":["Correcting the tokenizer mismatch with a Pythia-indexed Infini-gram could shrink the synthetic-coherence bucket; the paper's own limitation section indicates such spans may fail to align despite being present in the training data.","The arbitrary thresholds of 5 and 50 matches could be replaced by data-driven clustering of the match-count distribution to produce sharper boundaries between the three matched categories.","The pipeline could serve as a cheap pre-filter for training-data attribution: windows with a small number of matches are the ones worth expensive influence-based tracing, since they pinpoint few reviewable documents."],"forward_implications":["Low perplexity alone is not evidence of memorization: roughly 60% of high-confidence windows have no exact corpus match and are classified as synthetic coherence.","About 20% of low-perplexity windows fall into memorization ($0