Quantifying Memorization and Privacy Risks in Genomic Language Models

Alexander Nemecek; Wenbiao Li; Xiaoqian Jiang; Jaideep Vaidya; Erman Ayday

cs.LGMar 9, 2026

Quantifying Memorization and Privacy Risks in Genomic Language Models

Authors: Alexander Nemecek, Wenbiao Li, Xiaoqian Jiang, Jaideep Vaidya, Erman Ayday

Organizations: Case Western Reserve University Cleveland, Ohio, USA · The University of Texas Health Science Center at Houston Houston, Texas, USA · Rutgers University Newark, New Jersey, USA

Abstract

Genomic language models (GLMs) have emerged as powerful tools for learning representations of DNA sequences, enabling advances in variant prediction, regulatory element identification, and cross-task transfer learning. However, as these models are increasingly trained or fine-tuned on sensitive genomic cohorts, they risk memorizing specific sequences from their training data, raising serious concerns around privacy, data leakage, and regulatory compliance. Despite growing awareness of memorization risks in general-purpose language models, little systematic evaluation exists for these risks in the genomic domain, where data exhibit unique properties such as a fixed nucleotide alphabet, strong biological structure, and individual identifiability. We present a comprehensive, multi-vector privacy evaluation framework designed to quantify memorization risks in GLMs. Our approach integrates three complementary risk assessment methodologies: perplexity-based detection, canary sequence extraction, and membership inference. These are combined into a unified evaluation pipeline that produces a worst-case memorization risk score. To enable controlled evaluation, we plant canary sequences at varying repetition rates into both synthetic and real genomic datasets, allowing precise quantification of how repetition and training dynamics influence memorization. We evaluate our framework across multiple GLM architectures, examining the relationship between sequence repetition, model capacity, and memorization risk. Our results establish that GLMs exhibit measurable memorization and that the degree of memorization varies across architectures and training regimes. These findings reveal that no single attack vector captures the full scope of memorization risk, underscoring the need for multi-vector privacy auditing as a standard practice for genomic AI systems.

Figures & tables

Figure 1. Overview of the memorization risk quantification framework. Genomic training data is augmented with canary sequences at controlled repetition rates (left), used to fine-tune a genomic language model (center), and evaluated through three complementary vectors: perplexity-based detection, canary sequence extraction, and membership inference (right). The outputs are combined into a maximum vulnerability score (bottom).

Model	Architecture	Params	FT	Tokenization
SimpleDNALM	Causal Transformer	12.9M	Full	Character-level
DNABERT-2	BERT Encoder	117M	Full	BPE
HyenaDNA	Hyena (Conv)	14.2M	Full	Single-nucleotide
Evo	StripedHyena (SSM)	7B	LoRA	Byte-level

Table 1. Models evaluated. FT = fine-tuning strategy.

Dataset	Source	Organism	Biological Structure
Synthetic	Generated	—	None (zero-order)
E. coli	NCBI RefSeq	E. coli K-12	Prokaryotic
Yeast	NCBI RefSeq	S. cerevisiae S288C	Eukaryotic
GUE	HuggingFace	Multi-species	Promoter regions

Table 2. Datasets evaluated across all model types.

Model	$s_{\text{ppl}}$	$s_{\text{ext}}$	$s_{\text{mia}}$	$S_{\text{config}}$	$s_{\text{ppl}}$	$s_{\text{ext}}$	$s_{\text{mia}}$	$S_{\text{config}}$	$s_{\text{ppl}}$	$s_{\text{ext}}$	$s_{\text{mia}}$	$S_{\text{config}}$	$s_{\text{ppl}}$	$s_{\text{ext}}$	$s_{\text{mia}}$	$S_{\text{config}}$	$S_{\text{model}}$
	Synthetic				E. coli				Yeast				GUE
SimpleDNALM	.02	.50	.52	.53 $\pm$ .02	.01	.45	.47	.48 $\pm$ .00	.00	.48	.49	.50 $\pm$ .02	.00	.51	.45	.51 $\pm$ .04	.55 $\pm$ .01
DNABERT-2	.35	.14	.48	.48 $\pm$ .02	.34	.14	.43	.43 $\pm$ .01	.38	.17	.45	.45 $\pm$ .02	.38	.09	.45	.45 $\pm$ .01	.48 $\pm$ .01
HyenaDNA	-.36	.23	.48	.48 $\pm$ .01	-1.04	.15	.49	.49 $\pm$ .01	-.05	.15	.49	.49 $\pm$ .01	-.90	.21	.47	.47 $\pm$ .01	.49 $\pm$ .00
Evo (LoRA)	.20	.67	.48	.82 $\pm$ .23	.34	1.00	.57	1.00 $\pm$ .00	.33	1.00	.50	1.00 $\pm$ .00	.34	1.00	.40	1.00 $\pm$ .00	1.00 $\pm$ .00

Table 3. Per-vector memorization risk scores and maximum vulnerability scores for each model-dataset configuration. Component scores (

s_{\text{ppl}},s_{\text{ext}},s_{\text{mia}}

) are reported as average across seeds.

S_{\text{config}}

and

S_{\text{model}}

are computed per seed as the maximum of the component scores for that seed, then reported as mean

\pm

std across seeds. Bold indicates the maximum vector driving

S_{\text{config}}

Panel of Figure 2 — Figure 2. Canary extraction success rate as a function of repetition tier across datasets. Evo (LoRA) achieves near-complete extraction on real genomic data regardless of repetition count, while DNABERT-2 remains resistant.

Model	Dataset	Train	Test	Canary	Gap
SimpleDNALM	Synthetic	3.93 $\pm$ 0.00	4.00 $\pm$ 0.00	3.93 $\pm$ 0.01	1.02 $\pm$ 0.00
	E. coli	3.91 $\pm$ 0.00	3.94 $\pm$ 0.00	3.91 $\pm$ 0.01	1.01 $\pm$ 0.00
	Yeast	3.84 $\pm$ 0.02	3.86 $\pm$ 0.00	3.84 $\pm$ 0.02	1.00 $\pm$ 0.01
	GUE	3.82 $\pm$ 0.03	3.84 $\pm$ 0.01	3.83 $\pm$ 0.02	1.00 $\pm$ 0.00
DNABERT-2	Synthetic	1.75 $\pm$ 0.00	2.69 $\pm$ 0.04	1.74 $\pm$ 0.00	1.54 $\pm$ 0.02
	E. coli	1.68 $\pm$ 0.03	2.51 $\pm$ 0.03	1.66 $\pm$ 0.01	1.51 $\pm$ 0.02

Table 4. Mean perplexity across data splits and memorization gap ratio (test divided by canary perplexity) reported as average

\pm

std across seeds. Gap

>1.0

indicates the model assigns lower perplexity to canaries than to test sequences, signaling memorization.

Model	Synthetic	E. coli	Yeast	GUE
SimpleDNALM	0.76 $\pm$ 0.01	0.74 $\pm$ 0.00	0.75 $\pm$ 0.01	0.72 $\pm$ 0.00
DNABERT-2	0.74 $\pm$ 0.01	0.71 $\pm$ 0.01	0.73 $\pm$ 0.01	0.72 $\pm$ 0.01
HyenaDNA	0.74 $\pm$ 0.00	0.74 $\pm$ 0.00	0.74 $\pm$ 0.00	0.73 $\pm$ 0.01
Evo (LoRA)	0.74 $\pm$ 0.01	0.79 $\pm$ 0.02	0.75 $\pm$ 0.00	0.70 $\pm$ 0.01

Table 5. Membership inference AUC-ROC via likelihood ratio attack (mean

\pm

std). AUC = 0.5 indicates random guessing; AUC = 1.0 indicates perfect membership discrimination.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Component	Configuration
Vocabulary size	8 (A, C, G, T + special tokens)
Hidden dimension	512
Attention heads	8
Transformer layers	4
Feedforward dimension	2048
Dropout	0.05

Appendix

Table 6. SimpleDNALM architectural specification.

Figure 3.

S_{\text{config}}

per seed for each model-dataset configuration. Each point represents one seed. Evo (LoRA) separates sharply on real genomic datasets while exhibiting high variance on synthetic data. The remaining models cluster tightly with low cross-seed variance.

Model	Seed 42	Seed 123	Seed 456	Mean $\pm$ Std
SimpleDNALM	0.55	0.57	0.54	0.55 $\pm$ 0.01
DNABERT-2	0.50	0.47	0.48	0.48 $\pm$ 0.01
HyenaDNA	0.49	0.49	0.49	0.49 $\pm$ 0.00
Evo (LoRA)	1.00	1.00	1.00	1.00 $\pm$ 0.00

Appendix

Table 7.

S_{\text{model}}

per seed. Each value represents the maximum

S_{\text{config}}

across all four datasets for a given model and seed.

Model	Dataset	Seed	$s_{\text{ppl}}$	$s_{\text{ext}}$	$s_{\text{mia}}$	$S_{\text{config}}$
SimpleDNALM	Synthetic	42	0.0201	0.5300	0.5538	0.5538
		123	0.0172	0.4300	0.5077	0.5077
		456	0.0200	0.5400	0.5071	0.5400
	E. coli	42	0.0085	0.4500	0.4703	0.4703
		123	0.0085	0.4100	0.4791	0.4791
		456	0.0096	0.4800	0.4611	0.4800

Appendix

Table 8. Full results across all models, datasets, and seeds.

S_{\text{config}}

is the maximum of

s_{\text{ppl}}

s_{\text{ext}}

, and

s_{\text{mia}}

for each configuration.

Dataset	Feature	AUC
Synthetic	shannon_entropy	$0.504\pm 0.001$
	gc_content	$0.509\pm 0.012$
	sequence_length	$0.506\pm 0.005$
	nucleotide_freq_variance	$0.496\pm 0.001$
	dinucleotide_chi2	$0.491\pm 0.015$
	trinucleotide_complexity	$0.491\pm 0.007$

Appendix

Table 9. Per-feature membership inference AUC scores for the canary detectability analysis across all four evaluation datasets. Each feature is evaluated independently as a membership signal; LR_combined denotes the likelihood-ratio classifier combining all features. Values reported as mean

\pm

std across three random seeds.

Hyperparameter	SimpleDNALM	DNABERT-2	HyenaDNA	Evo
Max sequence length	512	512	512	512
Max epochs	50	50	50	25
Batch size	8	8	8	4
Learning rate	$2\mathrm{e}{-5}$	$2\mathrm{e}{-5}$	$2\mathrm{e}{-5}$	$5\mathrm{e}{-5}$
Weight decay	0.01	0.01	0.01	0.01
Warmup ratio	0.1	0.1	0.1	0.1

Appendix

Table 10. Full training hyperparameters by model. All models use AdamW with weight decay of 0.01, warmup ratio of 0.1, gradient clipping at norm 1.0, and early stopping with patience 5 and

\delta_{\min}=0.001

Figure 4. Canary extraction success rate as a function of length.

Model	Dataset	Len	Train	Test	Canary	Gap	MIA
SimpleDNALM	Synthetic	32	3.92	4.00	3.92	1.02	0.75
SimpleDNALM	Synthetic	64	3.93	4.00	3.92	1.02	0.78
SimpleDNALM	Synthetic	128	3.96	4.01	3.96	1.01	0.76
SimpleDNALM	E. coli	32	3.88	3.94	3.88	1.02	0.74
SimpleDNALM	E. coli	64	3.91	3.95	3.91	1.01	0.74
SimpleDNALM	E. coli	128	3.94	3.96	3.94	1.00	0.75

Appendix

Table 11. Perplexity statistics, gap ratio (test/canary), and membership inference AUC by canary length.

Memorization in Language Models

Memorization in language models studies how training examples and facts are stored, recalled, generalized, and exposed by model parameters.

See all 116 papers

A Prior-Aware Metric for Efficiently Distinguishing Memorization from Generalization in Large Language Models
Feb 21, 2026Trishita Tiwari, Ari Trachtenberg, G. Edward SuhMemorization in Language Models LLM Auditing
Cornell University · Boston University · NVIDIA, Cornell University
TRAP: Understanding and Mitigating Privacy Memorization in Language Models
Sep 26, 2026Muhammed Ustaomeroglu, Ziyue Xu, Hanshen Xiao +3Safety-Preserving Fine-Tuning of Language Models Memorization in Language Models
Carnegie Mellon University · NVIDIA · Purdue University
LLMs Can Leak Training Data But Do They Want To? Evaluating Memorization Propensity in LLMs
Jun 4, 2026Gianluca Barmina, Peter Schneider-Kamp, Lukas Galke PoechData Leakage Memorization in Language Models
University of Southern Denmark

Feb 21, 2026J/K move · Enter open · S save

A Prior-Aware Metric for Efficiently Distinguishing Memorization from Generalization in Large Language Models

Trishita Tiwari, Ari Trachtenberg, G. Edward Suh

Cornell University · Boston University · NVIDIA, Cornell University

Memorization in Language Models LLM Auditing Privacy Leakage in Language Models

Open paper AskPDF arXiv

Training data leakage from Large Language Models (LLMs) raises serious concerns related to privacy, security, and copyright compliance. A central challenge in assessing this risk is distinguishing prefix-specific memorization of training data from the generation of statistically common sequences. Existing approaches to measuring memorization often conflate these phenomena, labeling outputs as memorized even when they arise from generalization over common patterns. Counterfactual memorization and other related metrics \citep{zhang2023counterfactual, wang2025generalization, lesci2024causal} provide principled solutions, however, their reliance on retraining multiple baseline models or parsing through the training data makes them computationally impractical at scale. This work introduces Prior-Aware memorization, a theoretically grounded, lightweight and training-free criterion for identifying prefix-specific memorization in LLMs. The key idea is to evaluate whether a candidate suffix is strongly associated with its specific training prefix or whether it appears with high probability across many IID sampled sequences from the training data distribution due to statistical commonality. We correlate our metric with counterfactual memorization, and also evaluate it on the training corpora of two pre-trained models, LLaMA and OPT. Our results show that between 55% and 90% of sequences previously labeled as memorized fail our criterion and are consistent with statistical commonality

Abstract

Memorization in Language Models

Explore similar work

A Prior-Aware Metric for Efficiently Distinguishing Memorization from Generalization in Large Language Models

TRAP: Understanding and Mitigating Privacy Memorization in Language Models

LLMs Can Leak Training Data But Do They Want To? Evaluating Memorization Propensity in LLMs