Organizations: Case Western Reserve University Cleveland, Ohio, USA · The University of Texas Health Science Center at Houston Houston, Texas, USA · Rutgers University Newark, New Jersey, USA
Genomic language models (GLMs) have emerged as powerful tools for learning representations of DNA sequences, enabling advances in variant prediction, regulatory element identification, and cross-task transfer learning. However, as these models are increasingly trained or fine-tuned on sensitive genomic cohorts, they risk memorizing specific sequences from their training data, raising serious concerns around privacy, data leakage, and regulatory compliance. Despite growing awareness of memorization risks in general-purpose language models, little systematic evaluation exists for these risks in the genomic domain, where data exhibit unique properties such as a fixed nucleotide alphabet, strong biological structure, and individual identifiability. We present a comprehensive, multi-vector privacy evaluation framework designed to quantify memorization risks in GLMs. Our approach integrates three complementary risk assessment methodologies: perplexity-based detection, canary sequence extraction, and membership inference. These are combined into a unified evaluation pipeline that produces a worst-case memorization risk score. To enable controlled evaluation, we plant canary sequences at varying repetition rates into both synthetic and real genomic datasets, allowing precise quantification of how repetition and training dynamics influence memorization. We evaluate our framework across multiple GLM architectures, examining the relationship between sequence repetition, model capacity, and memorization risk. Our results establish that GLMs exhibit measurable memorization and that the degree of memorization varies across architectures and training regimes. These findings reveal that no single attack vector captures the full scope of memorization risk, underscoring the need for multi-vector privacy auditing as a standard practice for genomic AI systems.
Figures & tables
Figure 1. Overview of the memorization risk quantification framework. Genomic training data is augmented with canary sequences at controlled repetition rates (left), used to fine-tune a genomic language model (center), and evaluated through three complementary vectors: perplexity-based detection, canary sequence extraction, and membership inference (right). The outputs are combined into a maximum vulnerability score (bottom).
Model
Architecture
Params
FT
Tokenization
SimpleDNALM
Causal Transformer
12.9M
Full
Character-level
DNABERT-2
BERT Encoder
117M
Full
BPE
HyenaDNA
Hyena (Conv)
14.2M
Full
Single-nucleotide
Evo
StripedHyena (SSM)
7B
LoRA
Byte-level
Table 1. Models evaluated. FT = fine-tuning strategy.
Dataset
Source
Organism
Biological Structure
Synthetic
Generated
—
None (zero-order)
E. coli
NCBI RefSeq
E. coli K-12
Prokaryotic
Yeast
NCBI RefSeq
S. cerevisiae S288C
Eukaryotic
GUE
HuggingFace
Multi-species
Promoter regions
Table 2. Datasets evaluated across all model types.
Synthetic
E. coli
Yeast
GUE
Model
sppl
sext
smia
Sconfig
sppl
sext
smia
Sconfig
sppl
sext
smia
Sconfig
sppl
sext
smia
Sconfig
Smodel
SimpleDNALM
.02
.50
.52
.53 ± .02
.01
.45
.47
.48 ± .00
.00
.48
.49
.50 ± .02
.00
.51
.45
.51 ± .04
.55 ± .01
DNABERT-2
.35
.14
.48
.48 ± .02
.34
.14
.43
.43 ± .01
.38
.17
.45
.45 ± .02
.38
.09
.45
.45 ± .01
.48 ± .01
HyenaDNA
-.36
.23
.48
.48 ± .01
-1.04
.15
.49
.49 ± .01
-.05
.15
.49
.49 ± .01
-.90
.21
.47
.47 ± .01
.49 ± .00
Evo (LoRA)
.20
.67
.48
.82 ± .23
.34
1.00
.57
1.00 ± .00
.33
1.00
.50
1.00 ± .00
.34
1.00
.40
1.00 ± .00
1.00 ± .00
Table 3. Per-vector memorization risk scores and maximum vulnerability scores for each model-dataset configuration. Component scores ( sppl,sext,smia ) are reported as average across seeds. Sconfig and Smodel are computed per seed as the maximum of the component scores for that seed, then reported as mean ± std across seeds. Bold indicates the maximum vector driving Sconfig .
Figure 2. Canary extraction success rate as a function of repetition tier across datasets. Evo (LoRA) achieves near-complete extraction on real genomic data regardless of repetition count, while DNABERT-2 remains resistant.
Model
Dataset
Train
Test
Canary
Gap
SimpleDNALM
Synthetic
3.93 ± 0.00
4.00 ± 0.00
3.93 ± 0.01
1.02 ± 0.00
E. coli
3.91 ± 0.00
3.94 ± 0.00
3.91 ± 0.01
1.01 ± 0.00
Yeast
3.84 ± 0.02
3.86 ± 0.00
3.84 ± 0.02
1.00 ± 0.01
GUE
3.82 ± 0.03
3.84 ± 0.01
3.83 ± 0.02
1.00 ± 0.00
DNABERT-2
Synthetic
1.75 ± 0.00
2.69 ± 0.04
1.74 ± 0.00
1.54 ± 0.02
E. coli
1.68 ± 0.03
2.51 ± 0.03
1.66 ± 0.01
1.51 ± 0.02
Table 4. Mean perplexity across data splits and memorization gap ratio (test divided by canary perplexity) reported as average ± std across seeds. Gap >1.0 indicates the model assigns lower perplexity to canaries than to test sequences, signaling memorization.
Model
Synthetic
E. coli
Yeast
GUE
SimpleDNALM
0.76 ± 0.01
0.74 ± 0.00
0.75 ± 0.01
0.72 ± 0.00
DNABERT-2
0.74 ± 0.01
0.71 ± 0.01
0.73 ± 0.01
0.72 ± 0.01
HyenaDNA
0.74 ± 0.00
0.74 ± 0.00
0.74 ± 0.00
0.73 ± 0.01
Evo (LoRA)
0.74 ± 0.01
0.79 ± 0.02
0.75 ± 0.00
0.70 ± 0.01
Table 5. Membership inference AUC-ROC via likelihood ratio attack (mean ± std). AUC = 0.5 indicates random guessing; AUC = 1.0 indicates perfect membership discrimination.
Appendix figures & tables8 assets
Supplementary material from the paper’s appendix.
Appendix
Component
Configuration
Vocabulary size
8 (A, C, G, T + special tokens)
Hidden dimension
512
Attention heads
8
Transformer layers
4
Feedforward dimension
2048
Dropout
0.05
Appendix
Table 6. SimpleDNALM architectural specification.
Figure 3. Sconfig per seed for each model-dataset configuration. Each point represents one seed. Evo (LoRA) separates sharply on real genomic datasets while exhibiting high variance on synthetic data. The remaining models cluster tightly with low cross-seed variance.
Model
Seed 42
Seed 123
Seed 456
Mean ± Std
SimpleDNALM
0.55
0.57
0.54
0.55 ± 0.01
DNABERT-2
0.50
0.47
0.48
0.48 ± 0.01
HyenaDNA
0.49
0.49
0.49
0.49 ± 0.00
Evo (LoRA)
1.00
1.00
1.00
1.00 ± 0.00
Appendix
Table 7. Smodel per seed. Each value represents the maximum Sconfig across all four datasets for a given model and seed.
Model
Dataset
Seed
sppl
sext
smia
Sconfig
SimpleDNALM
Synthetic
42
0.0201
0.5300
0.5538
0.5538
123
0.0172
0.4300
0.5077
0.5077
456
0.0200
0.5400
0.5071
0.5400
E. coli
42
0.0085
0.4500
0.4703
0.4703
123
0.0085
0.4100
0.4791
0.4791
456
0.0096
0.4800
0.4611
0.4800
Appendix
Table 8. Full results across all models, datasets, and seeds. Sconfig is the maximum of sppl , sext , and smia for each configuration.
Dataset
Feature
AUC
Synthetic
shannon_entropy
0.504±0.001
gc_content
0.509±0.012
sequence_length
0.506±0.005
nucleotide_freq_variance
0.496±0.001
dinucleotide_chi2
0.491±0.015
trinucleotide_complexity
0.491±0.007
Appendix
Table 9. Per-feature membership inference AUC scores for the canary detectability analysis across all four evaluation datasets. Each feature is evaluated independently as a membership signal; LR_combined denotes the likelihood-ratio classifier combining all features. Values reported as mean ± std across three random seeds.
Hyperparameter
SimpleDNALM
DNABERT-2
HyenaDNA
Evo
Max sequence length
512
512
512
512
Max epochs
50
50
50
25
Batch size
8
8
8
4
Learning rate
2e−5
2e−5
2e−5
5e−5
Weight decay
0.01
0.01
0.01
0.01
Warmup ratio
0.1
0.1
0.1
0.1
Appendix
Table 10. Full training hyperparameters by model. All models use AdamW with weight decay of 0.01, warmup ratio of 0.1, gradient clipping at norm 1.0, and early stopping with patience 5 and δmin=0.001 .
Figure 4. Canary extraction success rate as a function of length.
Model
Dataset
Len
Train
Test
Canary
Gap
MIA
SimpleDNALM
Synthetic
32
3.92
4.00
3.92
1.02
0.75
SimpleDNALM
Synthetic
64
3.93
4.00
3.92
1.02
0.78
SimpleDNALM
Synthetic
128
3.96
4.01
3.96
1.01
0.76
SimpleDNALM
E. coli
32
3.88
3.94
3.88
1.02
0.74
SimpleDNALM
E. coli
64
3.91
3.95
3.91
1.01
0.74
SimpleDNALM
E. coli
128
3.94
3.96
3.94
1.00
0.75
Appendix
Table 11. Perplexity statistics, gap ratio (test/canary), and membership inference AUC by canary length.
Training data leakage from Large Language Models (LLMs) raises serious concerns related to privacy, security, and copyright compliance. A central challenge in assessing this risk is distinguishing prefix-specific memorization of training data from the generation of statistically common sequences. Existing approaches to measuring memorization often conflate these phenomena, labeling outputs as memorized even when they arise from generalization over common patterns. Counterfactual memorization and other related metrics \citep{zhang2023counterfactual, wang2025generalization, lesci2024causal} provide principled solutions, however, their reliance on retraining multiple baseline models or parsing through the training data makes them computationally impractical at scale. This work introduces Prior-Aware memorization, a theoretically grounded, lightweight and training-free criterion for identifying prefix-specific memorization in LLMs. The key idea is to evaluate whether a candidate suffix is strongly associated with its specific training prefix or whether it appears with high probability across many IID sampled sequences from the training data distribution due to statistical commonality. We correlate our metric with counterfactual memorization, and also evaluate it on the training corpora of two pre-trained models, LLaMA and OPT. Our results show that between 55% and 90% of sequences previously labeled as memorized fail our criterion and are consistent with statistical commonality
Trishita Tiwari, Ari Trachtenberg, G. Edward Suh
Cornell University · Boston University · NVIDIA, Cornell University
Fine-tuning a language model on sensitive records can leave it able to reproduce them. We ask when this memorization arises and how to prevent it without knowing in advance which spans are sensitive. Our starting point is that most memorization scores and attacks share one statistical core: whether the model assigns a token more probability than some reference would. Taking as the reference a model trained on the complementary half of the same corpus gives the Target Reference Advantage (TRA), a per-token signal that separates what a model fit to a particular record from what it learned across records, and is cheap and differentiable. We then study what drives memorization during fine-tuning: it keeps growing well past the validation minimum, is larger on small datasets and at higher learning rates, and higher when the underlying task is harder. Early stopping removes much of it, but because it is chosen by aggregate validation loss it helps least for rare, hard-to-predict spans embedded in otherwise learnable text, which is exactly what sensitive information tends to be. We therefore introduce TRAP, a one-sided penalty on tokenwise TRA that acts only where the target model pulls ahead of its reference. On student essays with annotated personal information and clinical cases with patient identifiers, TRAP brings memorization near the level of an untrained model at little utility cost, where generic regularizers barely move and differential privacy gives up most of what fine-tuning bought.
Muhammed Ustaomeroglu, Ziyue Xu, Hanshen Xiao +3
Carnegie Mellon University · NVIDIA · Purdue University
Large language models can reproduce training data, but memorization evaluations mostly measure whether models can be made to do so, not whether they do so without adversarial prompting. We introduce PropMe, a framework that pairs a capability evaluation (prefix attacks) with non-adversarial propensity evaluation, and a propensity metric to relate the two. We check every generation against the model's full indexed training corpus with SimpleTrace, an open-source batch implementation of OLMoTrace span matching. We evaluate Comma, its continually pre-trained descendant DFM Decoder, and OLMo3 32B on Common Pile, Dynaword, and Dolma3, with four non-adversarial settings ranging from no prompt to sentences from unseen in-domain sources. Our results show that natural sentence prompts reproduce far less training text than prefix attacks. Generation with no prompt or a single common word, however, reproduces about as much as prefix attacks, or more, in three out of four model-corpus pairs; most of this text is duplicated licenses, code, and templates. In our setting, continual pre-training reduces long verbatim reproduction of the original corpus only modestly. More broadly, we argue that by testing both capability and propensity, we can attain a more comprehensive picture of a model's memorization behavior.
Gianluca Barmina, Peter Schneider-Kamp, Lukas Galke Poech