AI Insight
This study introduces a new method called decoding-constrained beam search to efficiently assess the risk that large language models (LLMs) will reproduce training data with slight modifications (near-verbatim extraction). The researchers demonstrate that their approach provides reliable risk estimates at approximately 1/5000th the computational cost of traditional Monte Carlo sampling methods, while revealing substantially more extractable sequences than methods that only detect exact matches. The technique uncovers patterns in how extraction risk varies across different model sizes and text types that were previously undetectable.
Why it matters
This work addresses critical privacy and copyright concerns in AI systems by enabling practical assessment of whether LLMs might leak sensitive training data through paraphrased or slightly altered outputs. The computational efficiency of this method makes it feasible to audit large-scale models for data extraction vulnerabilities that existing techniques miss.
Understand the Science
⚠️ Preprint – Noch nicht peer-reviewed
Dieser Artikel wurde noch nicht von unabhängigen Experten begutachtet. Die Ergebnisse sind vorläufig und sollten mit Vorsicht interpretiert werden.
-cross
Abstract: Recent work shows that standard greedy-decoding extraction methods for quantifying memorization in LLMs miss how extraction risk varies across sequences. Probabilistic extraction — computing the probability of generating a target suffix given a prefix under a decoding scheme — addresses this, but is tractable only for verbatim memorization, missing near-verbatim instances that pose similar privacy and copyright risks. Quantifying near-verbatim extraction risk is expensive: the set of near-verbatim suffixes is combinatorially large, and reliable Monte Carlo (MC) estimation can require ~100,000 samples per sequence. To mitigate this cost, we introduce decoding-constrained beam search, which yields deterministic lower bounds on near-verbatim extraction risk at a cost comparable to ~20 MC samples per sequence. Across experiments, our approach surfaces information invisible to verbatim methods: many more extractable sequences, substantially larger per-sequence extraction mass, and patterns in how near-verbatim extraction risk manifests across model sizes and types of text.
Source: Estimating near-verbatim extraction risk in language models with decoding-constrained beam search