Pith. sign in

REVIEW 3 major objections 5 minor 34 references

Watermarking Training Data of Music Generation Models

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Watermarks embedded in released audio can leak into the output of a music-generation model fine-tuned on that audio, allowing detection of unauthorized training use.

desk verdict A honest proof-of-concept for watermark-based auditing of music generation models, but the 'imperceptible watermark' claim rests on a 10 Hz tone that won't survive high-pass filtering. read the letter →

arxiv 2412.08549 v2 pith:H2LOR3Q4 submitted 2024-12-11 cs.LG cs.SDeess.AS

Pascal Epple , Igor Shilov , Bozhidar Stevanoski , Yves-Alexandre de Montjoye This is my paper · ORCID
classification cs.LGcs.SDeess.AS
keywords audiowatermarkingmembershipinferencemusicgenerationtrainingdatadetectionGenSealfine-tuningimperceptiblewatermark
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether a musician can prove that their songs were used to fine-tune a music-generation model, by watermarking the audio before releasing it. The authors fine-tune MusicGen on clean audio and on audio carrying a watermark, then ask the watermark's own detector to classify which model produced each continuation. The central result is that the watermark changes generation behavior enough for detection: a continuous 440 Hz tone gives an AUC of 0.7787, and a 10 Hz tone, claimed to be in the imperceptible range, gives 0.7112. Detection also works when only 10% of the training data is watermarked, with an AUC of 0.6794. The main limitation is that the watermark must survive the model's audio tokenizer, and the perceptual claims rest on metrics with no established threshold.

What carries the argument

The load-bearing objects are the model's audio tokenizer and the watermark detectors. MusicGen compresses audio into discrete tokens with Encodec32 before the transformer predicts continuations, so a watermark only influences generation if it survives that compression; this is the bottleneck that makes vanilla AudioSeal undetectable. The paper's main technical move is repeated watermarking, applying AudioSeal $k$ times to the same sample, to push the watermark through the tokenizer, and its evaluation uses the watermark's own detector—a rule-based mel-band energy sum for tones and AudioSeal's trained detector for AudioSeal—to classify generated outputs.

What would settle it

Play Tone-10-watermarked and clean clips to listeners in an ABX test; if listeners reliably identify the watermarked clips, the imperceptibility premise fails. Alternatively, high-pass filter the watermarked training audio above 20 Hz before fine-tuning and check whether the output-classification AUC drops from 0.7112 toward 0.5.

Watch

Extended reading notes

Core claim

The paper's central claim is that audio watermarks embedded in a music model's fine-tuning data leak into the model's generated output, so that the watermark's own detector can tell a watermarked model from a clean one. This holds for simple tones, including a 10 Hz tone in the sub-audible band, and for AudioSeal only when the watermark is applied many times so that it survives Encodec32 compression: vanilla AudioSeal is indistinguishable from random guessing (AUC 0.4914), but 50 repeated applications reach AUC 0.7113 at heavy perceptual cost. The effect scales with the fraction of watermarked data and is frequency-specific—a model trained on Tone 440 does not produce detectable continuations of Tone 880 prompts—and generating multiple continuations per prompt improves extraction for frequency-switching secrets.

Load-bearing premise

The result that imperceptible watermarks shift model outputs assumes the 10 Hz tone really is inaudible; the paper's only evidence is PESQ and SI-SNR scores, which have no established threshold for music and were not validated by human listening, and the tone disappears under common high-pass filtering.

Editorial extensions

If this is right

  • A content creator can audit a suspect music model by watermarking released audio, generating continuations from the model, and running the watermark detector on those outputs; a clearly above-chance AUC indicates the model was likely fine-tuned on the watermarked audio.
  • Increasing the fraction of watermarked training samples makes detection easier: with 10% of the fine-tuning data watermarked by a 440 Hz tone, the detector still reaches an AUC of 0.6794.
  • Watermark robustness to the model's audio tokenizer is decisive; making watermarks tokenizer-resistant, rather than merely imperceptible to humans, is what enables detection in generated output.
  • For temporal 'secret' watermarks, generating many continuations per prompt raises detection from an AUC of 0.569 to 0.7294, so an auditor can trade generation budget for stronger evidence.
  • A watermark in the nominal imperceptible frequency range (10 Hz) can shift outputs detectably, but that result depends on the audio pipeline preserving sub-20 Hz content.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • In a deployed setting, high-pass filtering—a common audio preprocessing step—would likely erase the 10 Hz tone before training, so the imperceptible-watermark result probably requires a pipeline that preserves sub-20 Hz content; the paper explicitly notes this vulnerability.
  • A human listening test on Tone-10-watermarked clips would settle whether the 'imperceptible' premise holds; the paper's PESQ and SI-SNR metrics were designed for speech and have no accepted threshold for music.
  • The tokenizer-bottleneck finding suggests that training a watermark end-to-end against Encodec32, rather than applying AudioSeal repeatedly, could yield watermarks that are both imperceptible and detectable in generated output.
  • Because the method only needs access to a model's outputs, the same audit strategy could plausibly transfer to other autoregressive audio models, while diffusion-based music models may respond differently to watermarked training data.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper asks whether audio watermarks embedded in the training data of a music generation model can be detected in the model's generated outputs. The authors fine-tune MusicGen-small on MusicCaps, watermarking 50% of the training data with either tone-based watermarks or AudioSeal (including repeated AudioSeal embeddings), and compare outputs of the watermarked model against a matched clean model using the watermark's own detector as a binary classifier. They report that Tone 440 achieves AUC 0.7787, Tone 10—claimed to be imperceptible—achieves AUC 0.7112, and repeated AudioSeal (Multi 50) achieves AUC 0.7113, while vanilla AudioSeal does not beat random guessing. A different-tone control yields AUC 0.51, and a scaling experiment with Tone 440 shows increasing AUC with the proportion of watermarked data.

Significance. If the results hold, this is a useful first step toward auditing whether a music generation model was trained on protected content, and the matched clean/watermarked model design is a strength: both models use the same training procedure, three sampling seeds are used, a random-guess baseline is reported, and the different-tone control in Section 5.4 helps establish specificity to the trained watermark. The study of AudioSeal's robustness to the Encodec32 tokenizer, including the repeated-embedding idea, is also valuable. However, the paper's central 'imperceptible watermark' claim rests on a single 10 Hz tone condition whose imperceptibility is asserted from objective metrics that the authors themselves say have no established threshold, and whose real-world survival is questionable. Until that condition is substantiated by human listening or robustness experiments, the significance of the main claim is substantially weaker.

major comments (3)
  1. [§3.5, Table 1] The abstract's claim that watermarking techniques 'including some that are imperceptible to humans' cause detectable shifts rests almost entirely on the Tone 10 result (AUC 0.7112). The only imperceptibility evidence offered is PESQ 4.59 and SI-SNR 3.00, but the authors state in Section 3.5 that there is no established threshold for either metric and that human evaluations are out of scope. PESQ was designed for speech quality, not music, and SI-SNR 3.00 does not by itself establish perceptual transparency. Without a human listening test or a music-appropriate perceptual evaluation, the manuscript does not support the 'imperceptible' part of the headline claim; please add such evidence or remove/qualify the claim.
  2. [§7] The conclusion acknowledges that Tone 10 'is subject to removal through high-pass filtering,' yet no high-pass filtering is applied in the experiments. Because real music datasets and playback chains routinely high-pass filter at 20–30 Hz, the Tone 10 AUC of 0.7112 may not survive standard preprocessing. Please report the AUC after high-pass filtering, or explicitly scope all claims to unfiltered audio; as written, the conclusion that a model trained on Tone 10 watermarks produces significantly different outputs is not robust to a threat the authors themselves identify.
  3. [Table 1, §5.2] The high-AUC AudioSeal result (Multi 50, AUC 0.7113) is obtained under clear audible degradation (PESQ 1.86, SI-SNR 3.59) and therefore is not an imperceptible watermark. The paper should not be read as showing that an imperceptible state-of-the-art watermark survives training; at best it shows that repeated, perceptible embeddings do. Please separate the imperceptible and perceptible regimes in the abstract and conclusion, and be explicit that the only claimed imperceptible condition is Tone 10.
minor comments (5)
  1. [Table 1] The row label 'Secret 5' is not defined in Section 4.2.1, which defines Switch d and Alternate d but not a watermark called Secret 5. Please define it or rename it to Switch 5.
  2. [Eq. (2)] The Fréchet Audio Distance formula should use the squared L2 norm of the mean difference, ||μ_r − μ_g||², not the unsquared norm as written; please correct the formula.
  3. [§5.2] There is a duplicated phrase in the text: 'the rule-based classifier the classifier captures a change in distribution' should read 'the rule-based classifier captures a change in distribution.'
  4. [§6.1] The phrase 'Lest Significant Bit' should be 'Least Significant Bit.'
  5. [Figure 4] Figure 4 reports mean AUC values without error bars, while Table 1 reports ± standard deviations for the same type of measurement; please add error bars or confidence intervals for consistency.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the watermark detection pipeline is an external oracle, the clean-model control isolates the training effect, and the paper's self-citations are background only.

full rationale

The paper's central claim is that watermarking training data shifts the outputs of a fine-tuned music generation model in a detectable way. The detection pipeline uses either a fixed rule-based tone detector or the pre-trained AudioSeal detector, neither of which is fitted to the generated outputs; the AUC is measured, not optimized. Although the audio prompts given to both models are watermarked with the same technique used in training, the clean model receives the same watermarked prompts, so any difference in output distributions is attributable to the training data rather than to the prompt alone. The control experiment in Section 5.4, where a Tone 440-trained model is prompted with Tone 880 and yields AUC 0.51, further shows that the detected shift is tied to the trained frequency rather than to a generic prompt effect. The paper's self-citations ([22] on copyright traps and [23] on membership inference) appear only as related work and are not load-bearing for the present derivation. The imperceptibility and real-world-robustness concerns about Tone 10 and PESQ thresholds are validity caveats, not circularity. Overall, no step in the derivation reduces by construction to its inputs.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

No new physical or architectural entities are introduced; the paper proposes a procedure (Multi-k) rather than a new entity. The free parameters listed are experimental design choices, not fitted constants.

free parameters (3)
  • Proportion of watermarked training samples (p) = 0.50 in main experiments; 0.01/0.10 in Figure 5
    Hand-chosen experimental variable. Central AUC results are reported at p=0.50 (and p=0.10 in Section 5.3); no optimization over p is performed.
  • Tone watermark frequency (f) = 440 Hz headline; 10 Hz imperceptible; 512-8192 Hz sweep in Figure 4; secrets use 440/880 Hz and 5/15 Hz
    Hand-chosen watermark design parameter. The best AUC (0.7787) is for f=440 Hz, selected from a frequency sweep; the imperceptible result is f=10 Hz.
  • Number of repeated AudioSeal embeddings (k) = 10, 25, 50
    Hand-chosen parameter for Multi-k. AUC rises with k and only exceeds random guessing at k=25 (0.6036) and k=50 (0.7113), while PESQ drops from 3.51 (k=10) to 1.86 (k=50).
assumptions (4)
  • domain assumption MusicCaps evaluation samples were not seen by MusicGen during pre-training
    Stated in Section 4.3 ('we are confident that it has not yet been seen by the model'). If false, the clean model's familiarity with validation prompts could confound the attribution of output differences to watermarks.
  • domain assumption PESQ and SI-SNR are adequate proxies for human-perceived imperceptibility of watermarks in music
    Section 3.5 uses these metrics and explicitly concedes there is no established threshold and no human evaluation; the 'imperceptible' Tone 10 claim depends on these proxies.
  • domain assumption A fine-tuned MusicGen-small on 5,402 clips for 5 epochs with 10-50% watermarked data behaves like a model trained on watermarked content in the real world
    The conclusion generalizes from this regime to 'an effective tool' for detecting unauthorized use; Section 6.1 acknowledges the results are 'highly influenced by the training regime' and that a clean end-to-end setup was not run.
  • domain assumption The rule-based Mel-band energy detector and AudioSeal detector scores are valid on generated, potentially out-of-distribution audio
    Section 4.5 uses these detectors as the binary classifier. The rule-based detector's Mel band choice and AudioSeal's generalization to MusicGen outputs are not independently validated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Watermarking Training Data of Music Generation Models." pith.science (2026). https://pith.science/paper/H2LOR3Q4

@misc{pith2026241208549,
  author       = {Pith},
  title        = {Pith review of: Watermarking Training Data of Music Generation Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H2LOR3Q4}},
  note         = {Machine review of arXiv:2412.08549}
}
read the original abstract

Generative Artificial Intelligence (Gen-AI) models are increasingly used to produce content across domains, including text, images, and audio. While these models represent a major technical breakthrough, they gain their generative capabilities from being trained on enormous amounts of human-generated content, which often includes copyrighted material. In this work, we investigate whether audio watermarking techniques can be used to detect an unauthorized usage of content to train a music generation model. We compare outputs generated by a model trained on watermarked data to a model trained on non-watermarked data. We study factors that impact the model's generation behaviour: the watermarking technique, the proportion of watermarked samples in the training set, and the robustness of the watermarking technique against the model's tokenizer. Our results show that audio watermarking techniques, including some that are imperceptible to humans, can lead to noticeable shifts in the model's outputs. We also study the robustness of a state-of-the-art watermarking technique to removal techniques.

Figures

Figures reproduced from arXiv: 2412.08549 by the authors.

Figure 1
Figure 1. Mel-Spectrograms of Watermarked Audio: The spectrograms of an audio sample watermarked with the following techniques: Tone 880, Switch 2, Alternate 2 and Stop 5. The frequencies f and f ′ are set to 440 Hz and 880 Hz, respectively. tones with the Root Mean Square (RMS) amplitude of the original audio signal before adding them to the signal. Given an audio of duration d watermarked with Switch d or Alternate d, it is… view at source ↗
Figure 2
Figure 2. Detection Accuracy with Multiple Watermarking: We compute the detection accuracy on compressed audio samples from MusicCaps when applying AudioSeal multiple times, after Encodec32 compression. 5 Results 5.1 Robustness of AudioSeal to MusicGen’s Tokenizer We first investigate the robustness of AudioSeal to Encodec32, the audio tokenizer of MusicGen [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Top Audio Continuations : The mel-spectrogram of the continuations with highest detection scores generated by the clean (left) and watermarked (right) models. We further investigate the impact of the frequency of the injected tone [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: AUC for Tones at Different Frequencies: We plot the AUC of the Rule-based classifier for a wide range of frequencies. data is watermarked with vanilla AudioSeal. We observe an increase in AUC as we increase the number of times we watermark the training samples with Aud…
Figure 5
Figure 5. Figure 5: Varying Percentage of Watermarked Data : We plot the AUC when watermarking 1%, 10% and 50% of the data with Tone 440. 1 20 40 60 80 100 Number of Generated Continuations 0.4 0.5 0.6 0.7 0.8 0.9 AUC Watermarked Random guess baseline 1 20 40 60 80 100 Number of Generated…
Figure 6
Figure 6. Figure 6: Watermark Extraction of Secret: We plot the AUC of the rule-based classifier for increasing numbers of generated continuations for Switch 5 in the imperceptible range (left) with f = 5 Hz, f ′ = 15 Hz, and in the perceptible range (right) with f = 440 Hz and f ′ = 880 …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 14 canonical work pages

  1. [1]

    Denk, Zalán Borsos, Jesse Engel, Mauro Verzetti, Antoine Caillon, Qingqing Huang, Aren Jansen, Adam Roberts, Marco Tagliasacchi, Matt Sharifi, Neil Zeghidour, and Christian Frank

    Andrea Agostinelli, Timo I. Denk, Zalán Borsos, Jesse Engel, Mauro Verzetti, Antoine Caillon, Qingqing Huang, Aren Jansen, Adam Roberts, Marco Tagliasacchi, Matt Sharifi, Neil Zeghidour, and Christian Frank. Musiclm: Generating music from text, 2023. URL: https://arxiv. org/abs/2301.11325, arXiv:2301.11325

    arXiv 2023

  2. [2]

    Exploring musical roots: Applying audio embeddings to empower influence attribution for a generative music model, 2024

    Julia Barnett, Hugo Flores Garcia, and Bryan Pardo. Exploring musical roots: Applying audio embeddings to empower influence attribution for a generative music model, 2024. URL: https://arxiv.org/abs/2401.14542, arXiv:2401.14542

    arXiv 2024

  3. [3]

    The foundation model transparency index, 2023

    Rishi Bommasani, Kevin Klyman, Shayne Longpre, Sayash Kapoor, Nestor Maslej, Betty Xiong, Daniel Zhang, and Percy Liang. The foundation model transparency index, 2023. URL: https://arxiv.org/abs/2310.12941, arXiv:2310.12941

    arXiv 2023

  4. [4]

    Membership inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914. IEEE, 2022

    2022

  5. [5]

    The secret sharer: Evaluating and testing unintended memorization in neural networks

    Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19), pages 267–284, 2019. 13

    work page 2019

  6. [6]

    Extracting training data from diffusion models

    Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pages 5253–5270, 2023

    2023

  7. [7]

    Wavmark: Watermarking for audio generation, 2024

    Guangyu Chen, Yu Wu, Shujie Liu, Tao Liu, Xiaoyong Du, and Furu Wei. Wavmark: Watermarking for audio generation, 2024. URL: https://arxiv.org/abs/2308.12770, arXiv:2308.12770

    arXiv 2024

  8. [8]

    Simple and controllable music generation.Advances in Neural Information Processing Systems, 36, 2024

    Jade Copet, Felix Kreuk, Itai Gat, Tal Remez, David Kant, Gabriel Synnaeve, Yossi Adi, and Alexandre Défossez. Simple and controllable music generation.Advances in Neural Information Processing Systems, 36, 2024

    work page 2024

Show all 34 references
  1. [9]

    drake” and “the weeknd

    Joe Coscarelli. An a.i. hit of fake “drake” and “the weeknd” rattles the mu- sic world, 4 2023. URL: https://www.nytimes.com/2023/04/19/arts/music/ ai-drake-the-weeknd-fake.html

    2023

  2. [10]

    Cvejic and T

    N. Cvejic and T. Seppanen. Increasing robustness of lsb audio steganography using a novel embedding method. In International Conference on Information Technology: Coding and Computing, 2004. Proceedings. ITCC 2004. , volume 2, pages 533–537 V ol.2, 2004. doi: 10.1109/ITCC.2004.1286709

    2004 arXiv

  3. [11]

    Blind baselines beat membership inference attacks for foundation models, 2024

    Debeshee Das, Jie Zhang, and Florian Tramèr. Blind baselines beat membership inference attacks for foundation models, 2024. URL: https://arxiv.org/abs/2406.16201, arXiv: 2406.16201

    2024 arXiv

  4. [12]

    Oliveira, and Lei Li

    André Vicente Duarte, Xuandong Zhao, Arlindo L. Oliveira, and Lei Li. DE-COP: Detecting copyrighted content in language models training data. In Forty-first International Conference on Machine Learning, 2024. URL: https://openreview.net/forum?id=LO4xhXmFal

    2024

  5. [13]

    High fidelity neural audio compression, 2022

    Alexandre Défossez, Jade Copet, Gabriel Synnaeve, and Yossi Adi. High fidelity neural audio compression, 2022. URL: https://arxiv.org/abs/2210.13438, arXiv:2210.13438

    2022 arXiv

  6. [14]

    Vampnet: Music generation via masked acoustic token modeling, 2023

    Hugo Flores Garcia, Prem Seetharaman, Rithesh Kumar, and Bryan Pardo. Vampnet: Music generation via masked acoustic token modeling, 2023. URL: https://arxiv.org/abs/ 2307.04686, arXiv:2307.04686

    2023 arXiv

  7. [15]

    Beyonce and adele publisher accuses firms of training ai on songs, 5 2024

    Tom Gerken. Beyonce and adele publisher accuses firms of training ai on songs, 5 2024. URL: https://www.bbc.co.uk/news/articles/c0434yx8vgxo

    2024

  8. [16]

    Cnn architectures for large-scale audio classification

    Shawn Hershey, Sourish Chaudhuri, Daniel PW Ellis, Jort F Gemmeke, Aren Jansen, R Chan- ning Moore, Manoj Plakal, Devin Platt, Rif A Saurous, Bryan Seybold, et al. Cnn architectures for large-scale audio classification. In 2017 ieee international conference on acoustics, speec...

    2017

  9. [17]

    Deduplicating training data mitigates privacy risks in language models

    Nikhil Kandpal, Eric Wallace, and Colin Raffel. Deduplicating training data mitigates privacy risks in language models. In International Conference on Machine Learning, pages 10697– 10707. PMLR, 2022

    2022

  10. [18]

    Fréchet audio distance: A metric for evaluating music enhancement algorithms, 2019

    Kevin Kilgour, Mauricio Zuluaga, Dominik Roblek, and Matthew Sharifi. Fréchet audio distance: A metric for evaluating music enhancement algorithms, 2019. URL: https:// arxiv.org/abs/1812.08466, arXiv:1812.08466

    2019 arXiv

  11. [19]

    Spread-spectrum watermarking of audio

    Darko Kirovski and Henrique Malvar. Spread-spectrum watermarking of audio. Signal Process- ing, IEEE Transactions on, 51:1020 – 1033, 05 2003. doi:10.1109/TSP.2003.809384

    2003

  12. [20]

    Us record labels sue ai music generators suno and udio for copyright infringement, 6 2024

    Kate Knibbs. Us record labels sue ai music generators suno and udio for copyright infringement, 6 2024. URL: https://www.wired.com/story/ ai-music-generators-suno-and-udio-sued-for-copyright-infringement/

    2024

  13. [21]

    High-fidelity audio compression with improved rvqgan, 2023

    Rithesh Kumar, Prem Seetharaman, Alejandro Luebs, Ishaan Kumar, and Kundan Kumar. High-fidelity audio compression with improved rvqgan, 2023. URL: https://arxiv.org/ abs/2306.06546, arXiv:2306.06546

    2023 arXiv

  14. [22]

    Copyright traps for large language models

    Matthieu Meeus, Igor Shilov, Manuel Faysse, and Yves-Alexandre De Montjoye. Copyright traps for large language models. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp, editors, Proceedings of the 41st...

    2024

  15. [23]

    Sok: Membership inference attacks on llms are rushing nowhere (and how to fix it), 2024

    Matthieu Meeus, Igor Shilov, Shubham Jain, Manuel Faysse, Marek Rei, and Yves-Alexandre de Montjoye. Sok: Membership inference attacks on llms are rushing nowhere (and how to fix it), 2024. URL: https://arxiv.org/abs/2406.17975, arXiv:2406.17975

    2024 arXiv

  16. [24]

    An empirical analysis of memorization in fine-tuned autoregressive language models

    Fatemehsadat Mireshghallah, Archit Uniyal, Tianhao Wang, David Evans, and Taylor Berg- Kirkpatrick. An empirical analysis of memorization in fine-tuned autoregressive language models. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors, Proceedings of the 2022 Conferen...

    2022

  17. [25]

    Feder Cooper, Daphne Ippolito, Christopher A

    Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A. Feder Cooper, Daphne Ippolito, Christopher A. Choquette-Choo, Eric Wallace, Florian Tramèr, and Katherine Lee. Scalable extraction of training data from (production) language models, 2023. URL: https: //arxiv...

    2023 arXiv

  18. [26]

    Neuroscience

    Dale Purves, George J Augustine, David Fitzpatrick, et al., editors. Neuroscience. Sinauer Associates, Sunderland, MA, 2nd edition, 2001. URL: https://www.ncbi.nlm.nih.gov/ books/NBK10924/

    2001

  19. [27]

    Radioactive data: tracing through training

    Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Hervé Jégou. Radioactive data: tracing through training. In International Conference on Machine Learning, pages 8326–8335. PMLR, 2020

    2020

  20. [28]

    Proactive detection of voice cloning with localized watermarking

    Robin San Roman, Pierre Fernandez, Hady Elsahar, Alexandre D´efossez, Teddy Furon, and Tuan Tran. Proactive detection of voice cloning with localized watermarking. ICML, 2024

    2024

  21. [29]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017

    2017

  22. [30]

    Diffusion art or digital forgery? investigating data replication in diffusion models, 2022

    Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models, 2022. URL: https://arxiv.org/abs/2212.03860, arXiv:2212.03860

    2022 arXiv

  23. [31]

    Understanding and mitigating copying in diffusion models, 2023

    Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Understanding and mitigating copying in diffusion models, 2023. URL:https://arxiv.org/ abs/2305.20086, arXiv:2305.20086

    2023 arXiv

  24. [32]

    Machine learning models that remember too much

    Congzheng Song, Thomas Ristenpart, and Vitaly Shmatikov. Machine learning models that remember too much. In Proceedings of the 2017 ACM SIGSAC Conference on computer and communications security, pages 587–601, 2017

    2017

  25. [33]

    Metaxas, and Shiqing Ma

    Zhenting Wang, Chen Chen, Lingjuan Lyu, Dimitris N. Metaxas, and Shiqing Ma. Diagnosis: Detecting unauthorized data usages in text-to-image diffusion models, 2024. URL: https: //arxiv.org/abs/2307.03108, arXiv:2307.03108

    2024 arXiv

  26. [34]

    Enhanced membership inference attacks against machine learning models

    Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. Enhanced membership inference attacks against machine learning models. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 3093–3106, 2022. 15

    2022

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.