LLM 会泄漏训练数据，但它们想吗？评估大语言模型的记忆倾向（PropMe）
LLMs Can Leak Training Data But Do They Want To? Evaluating Memorization Propensity in LLMs
AI 导读
研究者提出 PropMe 框架，将 prefix attacks 的能力评估与非对抗性记忆倾向评估配对，并用 SimpleTrace（OLMoTrace 跨度匹配的开源批量实现）对全部生成文本对照索引训练语料检查。
正文 · 原文
Abstract:Large language models can reproduce training data, but memorization evaluations mostly measure whether models can be made to do so, not whether they do so without adversarial prompting. We introduce PropMe, a framework that pairs a capability evaluation (prefix attacks) with non-adversarial propensity evaluation, and a propensity metric to relate the two. We check every generation against the model's full indexed training corpus with SimpleTrace, an open-source batch implementation of OLMoTrace span matching. We evaluate Comma, its continually pre-trained descendant DFM Decoder, and OLMo3 32B on Common Pile, Dynaword, and Dolma3, with four non-adversarial settings ranging from no prompt to sentences from unseen in-domain sources. Our results show that natural sentence prompts reproduce far less training text than prefix attacks. Generation with no prompt or a single common word, however, reproduces about as much as prefix attacks, or more, in three out of four model-corpus pairs; most of this text is duplicated licenses, code, and templates. In our setting, continual pre-training reduces long verbatim reproduction of the original corpus only modestly. More broadly, we argue that by testing both capability and propensity, we can attain a more comprehensive picture of a model's memorization behavior.
| Subjects: | Computation and Language (cs.CL); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2606.06286 [cs.CL] |
| (or arXiv:2606.06286v2 [cs.CL] for this version) | |
| https://doi.org/10.48550/arXiv.2606.06286 arXiv-issued DOI via DataCite |
Submission history
From: Gianluca Barmina [view email]
[v1]
Thu, 4 Jun 2026 15:25:24 UTC (1,385 KB)
[v2]
Tue, 27 Oct 2026 08:36:26 UTC (885 KB)
来源：arXiv cs.AI · arxiv.org