Pith. sign in

REVIEW 2 major objections 6 minor 68 references

A Lightweight Method to Disrupt Memorized Sequences in LLM

T0 review · 2 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read TokenSwap claims that replacing a large model's probabilities for common grammar words with renormalized probabilities from a small auxiliary model at inference time breaks verbatim memorization with negligible task degradation, and that…

desk verdict Simple, plausible inference-time memorization defense with strong EMR reductions, but the 'negligible degradation' claim outruns the utility evidence. read the letter →

arxiv 2502.05159 v2 pith:D5QX2UZQ submitted 2025-02-07 cs.LG cs.CL

Parjanya Prajakta Prashant , Kaustubh Ponkshe , Babak Salimi This is my paper · ORCID
classification cs.LGcs.CL
keywords memorizationmitigationinference-timedefensetoken-levellogitsfunctionwordssmallauxiliarymodelverbatimgenerationcopyrightsafetylargelanguagemodels
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

TokenSwap is an inference-time defense against verbatim memorization in large language models. Its claim is that a large model's tendency to reproduce training text can be disrupted without touching its weights or training data: at each generation step, the method replaces the large model's probabilities for a fixed set of common grammar words with renormalized probabilities from a small auxiliary model such as DistilGPT-2. Because small models memorize far less, any memorized sequence that passes through one of those grammar tokens breaks, and the rest of generation carries on from the altered context. Evaluations on Pythia-6.9B and Llama-3-8B report up to a tenfold drop in exact memorization, and the paper argues this makes practical, API-only mitigation available to users who can see only token-level outputs.

What carries the argument

The load-bearing object is the fixed token subset $G$: roughly 110 grammar-based high-frequency English tokens (function words like 'the', 'of', 'and', pronouns, modals, auxiliary verbs), selected by part-of-speech filtering from the top frequent words. At every generation step, TokenSwap computes the main and auxiliary distributions, then replaces main probabilities on $G$ with $\alpha \cdot p_{\mathrm{aux}}[v]$ where $\alpha = (\sum_{v\in G} p_{\mathrm{main}}[v])/(\sum_{v\in G} p_{\mathrm{aux}}[v])$, leaving all other tokens untouched. The mechanism is that any memorized sequence containing a $G$ token as its greedy choice is derailed at that point, and the resulting context shift prevents the rest of the verbatim chain; because $G$ covers frequent function words, most natural-language memorized sequences are hit early.

What would settle it

Run TokenSwap on a set of memorized passages composed almost entirely of rare content words, with no grammar tokens among the greedy choices (e.g., code identifiers or technical names); if exact reproduction persists, the cascade-breaking mechanism has not generalised. The paper's MathAbstracts result (EMR 1.8% vs 0.1% on WritingPrompts) already suggests this boundary condition.

Watch

Extended reading notes

Core claim

The central discovery is that the performance-memorization trade-off of scale can be decoupled at inference time, because the two abilities live at different granularities. Large models are needed for fluent, capable text, but the probabilities of high-frequency grammatical tokens (determiners, prepositions, conjunctions, pronouns, modals, auxiliary verbs) are well approximated by models two orders of magnitude smaller, which have far less memorized content. TokenSwap exploits this by selecting a fixed grammar-token set $G$ (110 tokens in the main experiments) and, at every position, replacing the main model's probabilities on $G$ with scaled probabilities from the auxiliary model, renormalizing with $\alpha = \sum_{v\in G} p_{\mathrm{main}}[v] / \sum_{v\in G} p_{\mathrm{aux}}[v]$. The swap does not need to occur at every memorized position; hitting one token in the memorized chain changes the conditioning context for all later tokens, so the cascade collapses. The paper reports exact-match rates falling from 65.22% to 5.98% on the Pile-memorized set for Pythia-6.9B and from 9.65% to 0.96% on LeetCode for Llama-3-8B, with commonsense reasoning accuracy essentially unchanged.

Load-bearing premise

The defense assumes that a small auxiliary model's probabilities for common function words are fluent and trustworthy enough that swapping them in does not degrade output, and that memorized sequences contain enough of those tokens at decision points for the swap to break the chain.

Editorial extensions

If this is right

  • Users who access a model only through an API with token-level logits can mitigate memorized generation without retraining, unlearning, training-data access, or model weights (the paper's central use case).
  • On the evaluated models, exact memorization drops by roughly an order of magnitude (EMR from 65.22% to 5.98% on the Pile-memorized Pythia set; from 9.65% to 0.96% on LeetCode for Llama-3-8B) while commonsense benchmark accuracy stays at 71.87% and cross-entropy rises minimally.
  • TokenSwap matches or exceeds Goldfish, a pre-training memorization-defense method, when both are tested on the same Wikipedia data, and combining TokenSwap with Goldfish reduces memorization further, suggesting the two defenses are orthogonal.
  • The method's effectiveness is governed by the auxiliary model's low memorization: smaller auxiliary models (135M vs 1.7B SmolLM variants) produce less verbatim reproduction.
  • It is partial for non-natural-language domains: on MathAbstracts the exact-match rate falls to 1.8% (from 93.6%), higher than the 0.1% on WritingPrompts, because content words dominate and the grammar-token set is English-specific.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: an adaptive $G$ that changes per domain or per prompt (for instance, syntax tokens for code, equation delimiters for math) could extend the same cascade-breaking mechanism to modalities where English function words are scarce.
  • Editorial inference: if the auxiliary model memorizes a sequence itself, TokenSwap inherits that memorization; the paper notes this limitation, so a practical deployment would want to verify low memorization of the chosen auxiliary model or combine it with a small-model unlearning method.
  • Editorial inference: because the method already runs a small model alongside the large one, it could be combined with speculative decoding, where the small model proposes tokens and the large model verifies; if the swap is applied to the verification stage, the runtime cost of the defense might be largely absorbed.
  • Editorial inference: a direct testable extension would compare TokenSwap's grammar-token swap against swapping the same fraction of randomly selected high-frequency content tokens, to measure whether it is the grammatical category, rather than frequency alone, that preserves task performance.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper introduces TokenSwap, an inference-time defense that replaces the probabilities of a fixed set G of 110 high-frequency English grammar tokens with scaled probabilities from a small auxiliary language model, leaving all non-G token probabilities unchanged. The authors evaluate the method in controlled fine-tuning scenarios on Llama-3.2-3B and in production-style settings on Pythia-6.9B and Llama-3-8B, reporting large reductions in exact match rate, matching length, and approximate-memorization metrics, with comparisons to CP-Fuse, MemFree, and Goldfish. They conclude that TokenSwap provides up to 800x reductions in verbatim generation while preserving model capabilities.

Significance. TokenSwap addresses a practical and timely problem: mitigating verbatim memorization under the realistic constraint that the user has access only to token-level outputs, not weights or training data. The core mechanism is simple, clearly described, and the empirical memorization reductions are substantial and consistent across the controlled and production-style evaluations. The ablations on G and on auxiliary model size provide useful guidance. The main weakness is the utility side of the memorization/utility tradeoff: the current benchmarks are largely insensitive to the semantic errors that G-token swaps are most likely to cause, so the 'negligible task degradation' claim is not yet established beyond the evaluated tasks.

major comments (2)
  1. [§4.2, §B.2, Appendix C.3] The utility-preservation half of the paper's central claim is not yet supported. The commonsense accuracy in Table 6 is identical to Standard by construction, as the paper itself states in §B.2: TokenSwap 'does not affect token prediction for non-grammar tokens,' and the judged answer tokens in these multiple-choice tasks are not in G. Cross-entropy on SlimPajama measures token-level fluency, not factuality or instruction correctness, and MT-Bench is a holistic judge score reported without confidence intervals. Since G includes 'is', 'was', 'have', 'do', 'be', 'will', and other auxiliaries (Appendix C.3), TokenSwap can alter factual or instructional content, and none of the reported metrics would detect such errors. I request additional evaluations that are sensitive to G-token flips, such as closed-book QA with natural-language answers, factual-consistency or temporal-consistency checks, and grammar/number-agreement tasks, or the authors should explicitly restrict the performance claim to the evaluated benchmarks.
  2. [§3, §4.1, Table 2, §5] The memorization-reduction claim is domain-dependent. In the controlled experiments, EMR drops to 0.1% on WritingPrompts but only to 1.8% on MathAbstracts, and §5 explicitly excludes code and math from the current scope. The abstract's 'up to 10x drop' is accurate for the two production datasets, but the conclusion's broader statement of '10-800x reductions in verbatim generation' should be qualified to natural-language domains where function words occur frequently enough at decision points. Without this qualification, readers may over-generalize the method's effectiveness to content-word-dominated or structured outputs.
minor comments (6)
  1. [§4.1, Table 2, Appendix C.4] Matching Length is reported as 464.0 in Table 2, but the generation length in Appendix C.4 is 128 tokens; please clarify whether ML is measured in characters or tokens and make the units consistent throughout.
  2. [Table 3] The LeetCode column labeled EMR is actually ROUGE-L>0.8; the table caption and the surrounding text should use one consistent name for this metric.
  3. [Appendix D.1] The definition of exact match rate is confused: it is described as a normalized longest-common-substring score, which is not an exact-match-rate definition; please replace it with a precise definition.
  4. [Table 8] The arrows for Levenshtein distance are inconsistent with the rest of the paper: Table 8 shows 'Lev. ↓' while Tables 2 and 3 use 'Lev. ↑' with higher values indicating more divergence; please standardize the direction.
  5. [§3, Appendix C.2] The claimed one-to-one token mapping across tokenizers for G is only asserted; please document how G tokens are matched (for example, by string after detokenization) and confirm that all 110 tokens exist in every vocabulary used in the experiments.
  6. [§4.2, Table 9] MT-Bench scores are reported without confidence intervals or multiple runs; please report variance or at least state the number of runs used.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the method's memorization reduction and performance claims are empirical and benchmarked against external data.

full rationale

The derivation chain is self-contained. TokenSwap's memorization reduction is the direct effect of Algorithm 1: for tokens in G, pfinal is set to a scaled version of the auxiliary model's probabilities, so any memorized sequence containing a G token cannot be reproduced greedily unless the auxiliary model happens to make the same choice. The paper measures this effect on external memorization benchmarks (Pile-memorized and LeetCode) rather than defining the metric in terms of the swap, and the reported magnitudes (e.g., EMR falling from 65.22% to 5.98%) are empirical outcomes, not identities. The performance claim is checked against external benchmarks (Commonsense170k subsets, SlimPajama cross-entropy, and MT-Bench) that are not part of the method's construction. No parameter is fitted to the evaluation data and then reported as a prediction: G is built from COCA frequency and part-of-speech filtering, independently of the memorized test sets, and the auxiliary models are publicly available pretrained models. There are no load-bearing self-citations; the cited scaling-law and function-word-fluency results are external to the authors. The utility metrics' insensitivity to G-token flips, such as multiple-choice answer tokens that are not in G, is a genuine threat to the strength of the 'negligible task degradation' claim, but it is an evidence-quality limitation rather than a circular derivation: the paper's conclusions are not identical to its premises by construction.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim rests on two empirical regularities about model scale and token probabilities, plus a tokenizer-mapping assumption. No new physical or mathematical entities are introduced. The G set is a hand-tuned design choice, and the method's effectiveness is measured empirically rather than derived.

free parameters (2)
  • Grammar token set G (size 110) = 110 tokens (from top 500 COCA words with POS filtering)
    The set of tokens whose probabilities are swapped is a hand-chosen design parameter. Ablation in Appendix B.3 shows memorization reduction scales with |G|, so the choice affects the central claim.
  • Auxiliary model choice = DistilGPT-2 (80M) primary; SmolLM-135M, 360M, 1.7B in ablations
    The auxiliary model's fluency and memorization profile determine both disruption strength and quality preservation. The paper tests several but does not provide a principled selection rule.
assumptions (3)
  • domain assumption Larger language models memorize more training data than smaller models
    Relies on Carlini et al. 2022 and Biderman et al. 2024; also confirmed by the paper's own Table 10. This is the foundation for expecting the swap to disrupt memorization.
  • domain assumption Small models assign fluent probabilities to high-frequency function words
    Cited from Pinto et al. 2024a and Eldan and Russinovich 2023. The paper does not independently verify across all contexts; it is the key premise for preserving fluency.
  • ad hoc to paper A one-to-one token mapping exists for G across tokenizers
    The method assumes each grammar word in G is a single token in both main and auxiliary tokenizers, enabling direct probability transfer. The paper asserts this without systematic verification (Appendix C.2).

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Lightweight Method to Disrupt Memorized Sequences in LLM." pith.science (2026). https://pith.science/paper/D5QX2UZQ

@misc{pith2026250205159,
  author       = {Pith},
  title        = {Pith review of: A Lightweight Method to Disrupt Memorized Sequences in LLM},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D5QX2UZQ}},
  note         = {Machine review of arXiv:2502.05159}
}
abstract

As language models scale, their performance improves dramatically across a wide range of tasks, but so does their tendency to memorize and regurgitate parts of their training data verbatim. This tradeoff poses serious legal, ethical, and safety concerns, especially in real-world deployments. Existing mitigation techniques, such as differential privacy or model unlearning, often require retraining or access to internal weights making them impractical for most users. In this work, we introduce TokenSwap, a lightweight, post-hoc defense designed for realistic settings where the user can only access token-level outputs. Our key insight is that while large models are necessary for high task performance, small models (e.g., DistilGPT-2) are often sufficient to assign fluent, grammatically plausible probabilities to common function words - and crucially, they memorize far less. By selectively swapping token probabilities between models, TokenSwap preserves the capabilities of large models while reducing their propensity for verbatim reproduction. Evaluations on Pythia-6.9B and Llama-3-8B show up to a 10$\times$ drop in exact memorization with negligible task degradation. Our method offers a practical, accessible solution for mitigating memorized generation in deployed LLMs.

Figures

Figures reproduced from arXiv: 2502.05159 by the authors.

Figure 1
Figure 1. Overview of TOKENSWAP. Our approach replaces token probabilities of high-frequency "grammar-based" tokens with those from a small auxiliary language model. This mitigates memorized generation while maintaining fluency and model performance. The top path shows standard LLM generation, while the bottom path demonstrates how TOKENSWAP alters token selection to disrupt memorization and produce novel text. We consider th… view at source ↗
Figure 2
Figure 2. Memorization (EMR) vs Performance (CE Loss) across different model sizes. Larger, more capa￾ble models exhibit higher memorization. TOKENSWAP, with Pythia-70M as the auxiliary model, achieves low memorization rates while maintaining competitive per￾formance. Details in Section 4.2 and Section 5. In this work, we present TOKENSWAP, an inference-time method that significantly allevi￾ates this tradeoff by combining lar… view at source ↗
Figure 3
Figure 3. Comparison of text generation methods. Red text indicates memorized content. Standard [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: We compare TOKENSWAP with Goldfish [Hans et al., 2024] on RougeL score distributions for Wikipedia generations [Bridge, 2001]. The similar distributions of TOKENSWAP and Goldfish (k=3) demonstrate that our inference-time approach is comparable to expensive pre-training…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

68 extracted references · 24 canonical work pages

  1. [1]

    Copyright-Protected Language Generation via Adaptive Model Fusion

    Javier Abad, Konstantin Donhauser, Francesco Pinto, and Fanny Yang. Copyright-protected language generation via adaptive model fusion. arXiv preprint arXiv:2412.06619, 2024

    work page Pith review arXiv 2024

  2. [2]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308--318, 2016

    2016

  3. [3]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  4. [4]

    Smollm2: When smol goes big--data-centric training of a small language model

    Loubna Ben Allal, Anton Lozhkov, Elie Bakouch, Gabriel Mart \' n Bl \'a zquez, Guilherme Penedo, Lewis Tunstall, Andr \'e s Marafioti, Hynek Kydl \' c ek, Agust \' n Piqueres Lajar \' n, Vaibhav Srivastav, et al. Smollm2: When smol goes big--data-centric training of a small language model. arXiv preprint arXiv:2502.02737, 2025

    arXiv 2025

  5. [5]

    Physics of language models: Part 3.3, knowledge capacity scaling laws

    Zeyuan Allen-Zhu and Yuanzhi Li. Physics of language models: Part 3.3, knowledge capacity scaling laws. In International Conference on Learning Representations (ICLR), 2025

    work page 2025

  6. [6]

    Large-scale differentially private bert

    Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. Large-scale differentially private bert. arXiv preprint arXiv:2108.01624, 2021

    arXiv 2021

  7. [7]

    Information complexity of stochastic convex optimization: Applications to generalization and memorization

    Idan Attias, Gintare Karolina Dziugaite, Mahdi Haghifam, Roi Livni, and Daniel M Roy. Information complexity of stochastic convex optimization: Applications to generalization and memorization. arXiv preprint arXiv:2402.09327, 2024

    arXiv 2024

  8. [8]

    Mirostat: A neural text decoding algorithm that directly controls perplexity

    Sourya Basu, Govardana Sachitanandam Ramachandran, Nitish Shirish Keskar, and Lav R Varshney. Mirostat: A neural text decoding algorithm that directly controls perplexity. arXiv preprint arXiv:2007.14966, 2020

    arXiv 2007

Show all 68 references
  1. [9]

    Pythia: A suite for analyzing large language models across training and scaling, 2023

    Stella Biderman, Hailey Schoelkopf, Quentin Anthony, Herbie Bradley, Kyle O'Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, Aviya Skowron, Lintang Sutawika, and Oskar van der Wal. Pythia: A suite for analyzing large language mode...

    2023 arXiv

  2. [10]

    Emergent and predictable memorization in large language models

    Stella Biderman, Usvsn Prashanth, Lintang Sutawika, Hailey Schoelkopf, Quentin Anthony, Shivanshu Purohit, and Edward Raff. Emergent and predictable memorization in large language models. Advances in Neural Information Processing Systems, 36, 2024

    2024

  3. [11]

    Piqa: Reasoning about physical commonsense in natural language

    Yonatan Bisk, Rowan Zellers, Jianfeng Gao, Yejin Choi, et al. Piqa: Reasoning about physical commonsense in natural language. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 7432--7439, 2020

    2020

  4. [12]

    Wikipedia, the free encyclopedia

    Astoria-Megler Bridge. Wikipedia, the free encyclopedia. San Francisco (CA): Wikimedia Foundation, 2001

    2001

  5. [13]

    Targeted memorized‐data unlearning for large language models

    Alexandru Bărbulescu and Evangelos Triantafillou. Targeted memorized‐data unlearning for large language models. In Proceedings of the 41st International Conference on Machine Learning (ICML), 2024

    2024

  6. [14]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pages...

    2021

  7. [15]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. arXiv preprint arXiv:2202.07646, 2022

    2022 arXiv

  8. [16]

    Do localization methods actually localize memorized data in llms? a tale of two benchmarks

    Ting-Yun Chang, Jesse Thomason, and Robin Jia. Do localization methods actually localize memorized data in llms? a tale of two benchmarks. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Techn...

    2024

  9. [17]

    Neural surgery for memorisation: Locating and removing verbatim recall neurons

    Wenwen Chang, Tal Schuster, and Yann LeCun. Neural surgery for memorisation: Locating and removing verbatim recall neurons. In NeurIPS, 2024 b

    2024

  10. [18]

    Accelerating large language model decoding with speculative sampling

    Shaohan Chen, William Raine, and James Bradbury. Accelerating large language model decoding with speculative sampling. In arXiv preprint arXiv:2308.08066, 2023

    2023 arXiv

  11. [19]

    Parapo: Aligning language models to reduce verbatim reproduction of pre-training data

    Tong Chen, Faeze Brahman, Jiacheng Liu, Niloofar Mireshghallah, Weijia Shi, Pang Wei Koh, Luke Zettlemoyer, and Hannaneh Hajishirzi. Parapo: Aligning language models to reduce verbatim reproduction of pre-training data. arXiv preprint arXiv:2504.14452, 2025

    2025 arXiv

  12. [20]

    Boolq: Exploring the surprising difficulty of natural yes/no questions

    Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. Boolq: Exploring the surprising difficulty of natural yes/no questions. arXiv preprint arXiv:1905.10044, 2019

    1905 arXiv

  13. [21]

    Think you have solved question answering? try arc, the ai2 reasoning challenge

    Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. Think you have solved question answering? try arc, the ai2 reasoning challenge. arXiv preprint arXiv:1803.05457, 2018

    2018 arXiv

  14. [22]

    The corpus of contemporary american english as the first reliable monitor corpus of english

    Mark Davies. The corpus of contemporary american english as the first reliable monitor corpus of english. Literary and linguistic computing, 25 0 (4): 0 447--464, 2010

    2010

  15. [23]

    The llama 3 herd of models

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  16. [24]

    Who’s harry potter? approximate unlearning in llms

    Ronen Eldan and Mark Russinovich. Who’s harry potter? approximate unlearning in llms. arXiv preprint arXiv:2310.02238, 2023

    2023 arXiv

  17. [25]

    Can copyright be reduced to privacy? arXiv preprint arXiv:2305.14822, 2023

    Niva Elkin-Koren, Uri Hacohen, Roi Livni, and Shay Moran. Can copyright be reduced to privacy? arXiv preprint arXiv:2305.14822, 2023

    2023 arXiv

  18. [26]

    Hierarchical neural story generation

    Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation. arXiv preprint arXiv:1805.04833, 2018

    2018 arXiv

  19. [27]

    Exploring memorization and copyright violation in frontier llms: A study of the new york times v

    Joshua Freeman, Chloe Rippe, Edoardo Debenedetti, and Maksym Andriushchenko. Exploring memorization and copyright violation in frontier llms: A study of the new york times v. openai 2023 lawsuit. arXiv preprint arXiv:2412.06370, 2024

    2023 arXiv

  20. [28]

    The times sues openai and microsoft over ai use of copyrighted work

    Michael M Grynbaum and Ryan Mac. The times sues openai and microsoft over ai use of copyrighted work. The New York Times, 27, 2023

    2023

  21. [29]

    Leetcode problem dataset, 2021

    gzipChrist. Leetcode problem dataset, 2021. URL https://www.kaggle.com/datasets/gzipchrist/leetcode-problem-dataset

    2021

  22. [30]

    Be like a goldfish, don't memorize! mitigating memorization in generative llms

    Abhimanyu Hans, Yuxin Wen, Neel Jain, John Kirchenbauer, Hamid Kazemi, Prajwal Singhania, Siddharth Singh, Gowthami Somepalli, Jonas Geiping, Abhinav Bhatele, et al. Be like a goldfish, don't memorize! mitigating memorization in generative llms. arXiv preprint arXiv:2406.10209, 2024

    2024 arXiv

  23. [31]

    Sok: Memorization in general-purpose large language models, 2023

    Valentin Hartmann, Anshuman Suri, Vincent Bindschaedler, David Evans, Shruti Tople, and Robert West. Sok: Memorization in general-purpose large language models, 2023. URL https://arxiv.org/abs/2310.18362

    2023 arXiv

  24. [32]

    Llm-adapters: An adapter family for parameter-efficient fine-tuning of large language models, 2023

    Zhiqiang Hu, Lei Wang, Yihuai Lan, Wanyu Xu, Ee-Peng Lim, Lidong Bing, Xing Xu, Soujanya Poria, and Roy Ka-Wei Lee. Llm-adapters: An adapter family for parameter-efficient fine-tuning of large language models, 2023. URL https://arxiv.org/abs/2304.01933

    2023 arXiv

  25. [33]

    Demystifying verbatim memorization in large language models, 2024

    Jing Huang, Diyi Yang, and Christopher Potts. Demystifying verbatim memorization in large language models, 2024. URL https://arxiv.org/abs/2407.17817

    2024 arXiv

  26. [34]

    Preventing verbatim memorization in language models gives a false sense of privacy

    Daphne Ippolito, Florian Tram \`e r, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christopher A Choquette-Choo, and Nicholas Carlini. Preventing verbatim memorization in language models gives a false sense of privacy. arXiv preprint arXiv:2210.17546, 2022

    arXiv

  27. [35]

    Knowledge unlearning for mitigating privacy risks in language models

    Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. Knowledge unlearning for mitigating privacy risks in language models. arXiv preprint arXiv:2210.01504, 2022

    2022 arXiv

  28. [36]

    Deduplicating training data mitigates privacy risks in language models

    Nikhil Kandpal, Eric Wallace, and Colin Raffel. Deduplicating training data mitigates privacy risks in language models. In International Conference on Machine Learning, pages 10697--10711. PMLR, 2022

    2022

  29. [37]

    Copyright violations and large language models

    Antonia Karamolegkou, Jiaang Li, Li Zhou, and Anders S gaard. Copyright violations and large language models. arXiv preprint arXiv:2310.13771, 2023

    2023 arXiv

  30. [38]

    Big-little decoder: Faster language generation with an auxiliary model

    Soo Min Kim, Jason Wei, and Denny Zhou. Big-little decoder: Faster language generation with an auxiliary model. In NeurIPS, 2023

    2023

  31. [39]

    Fast inference from transformers via speculative decoding

    Yair Leviathan, Clemens Rosenbaum, and Slav Petrov. Fast inference from transformers via speculative decoding. In ICML, 2023

    2023

  32. [40]

    Contrastive decoding: Open-ended text generation as conditional density estimation

    Junnan Li, Dongxu Li, and Caiming Xiong. Contrastive decoding: Open-ended text generation as conditional density estimation. In NeurIPS, 2022

    2022

  33. [41]

    Deepseek-v3 technical report

    Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437, 2024

    2024 arXiv

  34. [42]

    Nltk: The natural language toolkit

    Edward Loper and Steven Bird. Nltk: The natural language toolkit. arXiv preprint cs/0205028, 2002

    2002 arXiv

  35. [43]

    Can neural network memorization be localized? arXiv preprint arXiv:2307.09542, 2023

    Pratyush Maini, Michael C Mozer, Hanie Sedghi, Zachary C Lipton, J Zico Kolter, and Chiyuan Zhang. Can neural network memorization be localized? arXiv preprint arXiv:2307.09542, 2023

    2023 arXiv

  36. [44]

    Can a suit of armor conduct electricity? a new dataset for open book question answering

    Todor Mihaylov, Peter Clark, Tushar Khot, and Ashish Sabharwal. Can a suit of armor conduct electricity? a new dataset for open book question answering. arXiv preprint arXiv:1809.02789, 2018

    2018 arXiv

  37. [45]

    Memorization in nlp fine-tuning methods

    Fatemehsadat Mireshghallah, Mohammadali Naseri, Nils Holzenberger, Pratyush Mani, Harsha Nori Ramaswamy, Mohammad Khani, Daniel Tran, and Florian Tramer. Memorization in nlp fine-tuning methods. arXiv preprint arXiv:2205.12506, 2022

    2022 arXiv

  38. [46]

    Scalable extraction of training data from (production) language models

    Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette-Choo, Eric Wallace, Florian Tram \`e r, and Katherine Lee. Scalable extraction of training data from (production) language models. arxiv 2023. arXiv prepr...

    2023 arXiv

  39. [47]

    Scalable extraction of training data from aligned, production language models

    Milad Nasr, Javier Rando, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette-Choo, Florian Tram \`e r, and Katherine Lee. Scalable extraction of training data from aligned, production language models. In The Thirteent...

    2025

  40. [48]

    Generative ai and copyright issues globally: Ani media v openai

    Aklovya Panwar. Generative ai and copyright issues globally: Ani media v openai. Tech Policy Press, jan 2025. URL https://www.techpolicy.press/generative-ai-and-copyright-issues-globally-ani-media-v-openai/

    2025

  41. [49]

    The fair language model paradox

    Andrea Pinto, Tomer Galanti, and Randall Balestriero. The fair language model paradox. arXiv preprint arXiv:2410.11985, 2024 a

    2024 arXiv

  42. [50]

    Extracting training data from document-based vqa models

    Francesco Pinto, Nathalie Rauschmayr, Florian Tram \`e r, Philip Torr, and Federico Tombari. Extracting training data from document-based vqa models. arXiv preprint arXiv:2407.08707, 2024 b

    2024 arXiv

  43. [51]

    Obliviate: Efficient unmemorization for protecting intellectual property in large language models

    Mark Russinovich and Ahmed Salem. Obliviate: Efficient unmemorization for protecting intellectual property in large language models. arXiv preprint arXiv:2502.15010, 2025

    2025 arXiv

  44. [52]

    Winogrande: An adversarial winograd schema challenge at scale

    Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. Winogrande: An adversarial winograd schema challenge at scale. Communications of the ACM, 64 0 (9): 0 99--106, 2021

    2021

  45. [53]

    Mitigating memorization in language models

    Mansi Sakarvadia, Aswathy Ajith, Arham Khan, Nathaniel Hudson, Caleb Geniesse, Kyle Chard, Yaoqing Yang, Ian Foster, and Michael W Mahoney. Mitigating memorization in language models. arXiv preprint arXiv:2410.02159, 2024

    2024 arXiv

  46. [54]

    Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter

    Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. In NeurIPS EMC\(^2\) Workshop, 2019

    2019

  47. [55]

    Socialiqa: Commonsense reasoning about social interactions

    Maarten Sap, Hannah Rashkin, Derek Chen, Ronan LeBras, and Yejin Choi. Socialiqa: Commonsense reasoning about social interactions. arXiv preprint arXiv:1904.09728, 2019

    1904 arXiv

  48. [56]

    Rethinking llm memorization through the lens of adversarial compression

    Avi Schwarzschild, Zhili Feng, Pratyush Maini, Zachary C Lipton, and J Zico Kolter. Rethinking llm memorization through the lens of adversarial compression. arXiv preprint arXiv:2404.15146, 2024

    2024 arXiv

  49. [57]

    Ununlearning: Unlearning is not sufficient for content regulation in advanced generative ai

    Ilia Shumailov, Jamie Hayes, Eleni Triantafillou, Guillermo Ortiz-Jimenez, Nicolas Papernot, Matthew Jagielski, Itay Yona, Heidi Howard, and Eugene Bagdasaryan. Ununlearning: Unlearning is not sufficient for content regulation in advanced generative ai. arXiv preprint arXiv:24...

    2024 arXiv

  50. [58]

    Slimpajama: A 627b token cleaned and deduplicated version of redpajama, 2023

    Daria Soboleva, Faisal Al-Khateeb, Robert Myers, Jacob R Steeves, Joel Hestness, and Nolan Dey. Slimpajama: A 627b token cleaned and deduplicated version of redpajama, 2023

    2023

  51. [59]

    Blockwise parallel decoding for deep autoregressive models

    Mitchell Stern, William Chan, and Jakob Uszkoreit. Blockwise parallel decoding for deep autoregressive models. In EMNLP, 2018

    2018

  52. [60]

    Activation steering: Mitigating verbatim memorisation at inference time

    Pranav Suri, Rachel Hou, and Denny Zhou. Activation steering: Mitigating verbatim memorisation at inference time. In ACL Findings, 2025

    2025

  53. [61]

    Gemini: a family of highly capable multimodal models

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805, 2023

    2023 arXiv

  54. [62]

    Memorization without overfitting: Analyzing the training dynamics of large language models

    Kushal Tirumala, Aram Markosyan, Luke Zettlemoyer, and Armen Aghajanyan. Memorization without overfitting: Analyzing the training dynamics of large language models. Advances in Neural Information Processing Systems, 35: 0 38274--38290, 2022

    2022

  55. [63]

    More is less: The pitfalls of multi-model synthetic preference data in dpo safety alignment

    Yifan Wang, Runjin Chen, Bolian Li, David Cho, Yihe Deng, Ruqi Zhang, Tianlong Chen, Zhangyang Wang, Ananth Grama, and Junyuan Hong. More is less: The pitfalls of multi-model synthetic preference data in dpo safety alignment. arXiv preprint arXiv:2504.02193, 2025

    2025 arXiv

  56. [64]

    Redpajama: an open dataset for training large language models

    Maurice Weber, Daniel Fu, Quentin Anthony, Yonatan Oren, Shane Adams, Anton Alexandrov, Xiaozhong Lyu, Huu Nguyen, Xiaozhe Yao, Virginia Adams, et al. Redpajama: an open dataset for training large language models. arXiv preprint arXiv:2411.12372, 2024

    2024 arXiv

  57. [65]

    Speculative decoding for non–autoregressive neural machine translation

    Jianxiang Xia, Yi Ren, and Shiliang Zhang. Speculative decoding for non–autoregressive neural machine translation. In ACL, 2023

    2023

  58. [66]

    Autonomous data selection with language models for mathematical texts

    Yifan Zhang, Yifan Luo, Yang Yuan, and Andrew C Yao. Autonomous data selection with language models for mathematical texts. In ICLR 2024 Workshop on Navigating and Addressing Data Problems for Foundation Models, 2024

    2024

  59. [67]

    Judging llm-as-a-judge with mt-bench and chatbot arena

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, 36: 0 46595--46623, 2023

    2023

  60. [68]

    Quantifying and analyzing entity-level memorization in large language models, 2023

    Zhenhong Zhou, Jiuyang Xiang, Chaomeng Chen, and Sen Su. Quantifying and analyzing entity-level memorization in large language models, 2023. URL https://arxiv.org/abs/2308.15727

    2023 arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.