Is Memorization Context-Sensitive? Prefix-Based Extraction Beyond Isolated Prefixes

Ali Satvaty; Narjes Sharafi; Jirui Qi; Suzan Verberne; Fatih Turkmen

cs.AIOct 8, 2026

Is Memorization Context-Sensitive? Prefix-Based Extraction Beyond Isolated Prefixes

Authors: Ali Satvaty, Narjes Sharafi, Jirui Qi, Suzan Verberne, Fatih Turkmen

Organizations: University of Groningen · Leiden University

Abstract

Large language models (LLMs) can expose memorized training sequences under prefix-based extraction: given a prefix from a training example, the model may assign high probability to the original continuation. In deployed systems, however, prefixes are rarely evaluated in isolation. They often appear together with instructions, retrieved documents, or other task-specific context, as in retrieval-augmented generation (RAG). This motivates examining whether contextual conditioning mitigates memorization or merely changes the set of memorized samples that become extractable. We investigate this issue through paired item-level measurements of probabilistic suffix extraction. For each prefix-suffix pair, we score the target suffix under an empty prompt and under retrieved contexts of varying relevance, across three open-weight instruction-tuned models. We find that context does not simply erase memorization. Instead, extractable memorization consists of a context-robust core and a context-sensitive boundary. Many samples that are extractable without context remain extractable under the retrieved context, especially as the prefix length increases. At the same time, context mainly affects marginal samples near the extraction threshold: it suppresses some exposures, but also enables new ones that are missed by prefix-only evaluation. These findings qualify the view that RAG reduces memorization risk. Context can lower aggregate extraction by suppressing boundary cases, yet robustly extractable samples persist, and context-enabled extractability remains security-relevant.

Figures & tables

Figure 1: Suffix log-probability distributions by prefix length. Dashed lines show empty-context prompting, while solid lines show prompting with retrieved context. Across all models, longer prefixes substantially increase suffix likelihood. The gap between empty and contextualized prompting is largest for shorter prefixes and becomes smaller as prefix length increases, suggesting that longer prefixes make memorization more context-independent.

Figure 2: Jaccard overlap between exposed sets at $\tau=-16$ . Each cell reports the overlap between two exposure sets for a given model and prefix length. Exposure-set overlap increases sharply with prefix length across all models and context comparisons. This indicates that longer prefixes make the set of extractable samples more stable across contexts.

Figure 3: Exposure-set decomposition at

\tau=-16

. Green bars show samples exposed under all three conditions. Purple bars show samples exposed without context but suppressed by context. Red and peach bars show samples that become exposed only under relevant or irrelevant context. Robust exposure dominates across models and grows substantially with prefix length, indicating a context-robust memorization core.

Model	Prefix	$n$	Mean $G$	Median $G$	Mean $S$	Median $S$	% $S<0$
Llama-3-8B-Instruct	32	318	0.52	-0.34	-3.35	-1.24	70.1
	64	593	0.52	-0.06	-1.11	-0.12	59.7
	128	858	0.05	-0.03	-0.32	-0.04	57.5
OLMo-2-1124-7B-Instruct	32	131	-0.42	-0.23	-2.05	-0.75	62.6
	64	390	-0.32	-0.06	-0.04	0.06	47.2
	128	645	0.14	-0.01	-0.30	0.01	47.3

Table 1: Generic and semantic context effects for exposed or boundary samples. We report the number of boundary samples

n

, the generic context effect

G=\ell^{\mathrm{irr}}-\ell^{\emptyset}

, and the semantic effect

S=\ell^{\mathrm{rel}}-\ell^{\mathrm{irr}}

. The semantic effect is generally negative, especially for shorter prefixes, indicating that relevant context tends to suppress extraction relative to irrelevant context near the exposure boundary. The generic effect is more model-dependent.

Figure 4: Jaccard overlap between exposed sets under relevant and irrelevant retrieved context in a fixed instruction-framed setting. Exposure-set overlap increases with prefix length across all models.

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Threshold sensitivity of the exposure-set decomposition. We vary the exposure threshold

\tau

and report the percentage of samples in each category. Robust exposure remains the dominant category across thresholds, especially for longer prefixes. Suppressed and context-enabled samples remain smaller but persist across threshold choices, showing that the exposure-set decomposition is not an artifact of a single cutoff.

Figure 6: Context-induced flip rate as a function of distance from the empty-context exposure threshold. The flip rate is highest for samples close to the threshold and approaches zero for samples far from the threshold. This indicates that context-induced changes are boundary-local: context primarily affects marginal samples rather than robustly exposed or strongly non-exposed samples.

Model	Prefix	$J(E_{\emptyset},E_{\mathrm{rel}})$	$J(E_{\emptyset},E_{\mathrm{irr}})$	$J(E_{\mathrm{irr}},E_{\mathrm{rel}})$	$\|E_{\emptyset}\|$	$\|E_{\mathrm{rel}}\|$	$\|E_{\mathrm{irr}}\|$
Meta-Llama-3-8B-Instruct	32	0.715	0.721	0.689	116	95	106
	64	0.880	0.901	0.890	384	387	384
	128	0.912	0.933	0.932	659	672	665
OLMo-2-1124-7B-Instruct	32	0.677	0.637	0.656	87	74	80
	64	0.840	0.867	0.854	325	317	319
	128	0.912	0.911	0.909	582	592	580

Appendix

Table 2: Exposure-set Jaccard overlap at

\tau=-16

E_{\emptyset}

E_{\mathrm{rel}}

, and

E_{\mathrm{irr}}

denote the exposed sets under empty, relevant, and irrelevant context, respectively. Across all models, exposed-set overlap increases with prefix length, indicating that longer prefixes make exposure less sensitive to contextual variation.

Model	Prefix	$J(E_{\mathrm{rel}},E_{\mathrm{irr}})$	$\|E_{\mathrm{rel}}\|$	$\|E_{\mathrm{irr}}\|$	$n_{\mathrm{total}}$
Meta-Llama-3-8B-Instruct	32	0.694	95	115	49393
	64	0.882	387	394	49393
	128	0.927	672	673	49292
OLMo-2-1124-7B-Instruct	32	0.693	74	75	49393
	64	0.845	317	325	49393
	128	0.920	592	585	49306

Appendix

Table 3: Jaccard overlap between exposed sets under relevant and irrelevant context in the instruction-framed setting.

E_{\mathrm{rel}}

and

E_{\mathrm{irr}}

denote the exposed sets under relevant and irrelevant retrieved contexts, respectively. The overlap increases with prefix length across all models, indicating that longer prefixes make exposure increasingly stable across retrieved-context choices.

Figure 7: Exposure decomposition for relevant versus irrelevant retrieval under a fixed instruction-framed setting. Most exposed samples are shared between the two retrieval conditions, and the shared robust set grows with prefix length.

Model	Prefix	$n_{\mathrm{total}}$	$n_{\mathrm{boundary}}$	Mean $S$	Median $S$	% $S<0$
Meta-Llama-3-8B-Instruct	32	49393	124	-0.998	-0.241	56.5
	64	49393	415	-0.496	-0.108	54.9
	128	49292	698	-0.115	0.005	49.6
OLMo-2-1124-7B-Instruct	32	49393	88	0.880	-0.215	52.3
	64	49393	348	-0.303	-0.012	51.1
	128	49306	613	-0.063	-0.006	50.9

Appendix

Table 4: Semantic context effect on exposed samples when adding grounding instructions.

S

denotes the change in suffix log-probability when replacing the comparison context with the relevant retrieved context. The effect is generally inclined towards negative, but less pronounced than the one without the grounding instructions (table 1 ).

Figure 10: Effect of chat-template formatting on measured memorization under empty context. Solid lines show plain prefix–suffix scoring, while dashed lines show chat-template scoring. The large drop under chat-template scoring shows that template formatting has a strong effect on the measurement.

Figure 11: Semantic versus generic context effects for exposed samples. Blue distributions show

G=\ell^{\mathrm{irr}}-\ell^{\emptyset}

, the effect of adding irrelevant context. Red distributions show

S=\ell^{\mathrm{rel}}-\ell^{\mathrm{irr}}

, the additional effect of replacing irrelevant context with relevant context. Relevant context is often suppressive, especially for shorter prefixes, but generic contextual perturbation also contributes and is more model-dependent.

Figure 12: Item-level scatter plot of suffix log-probabilities under relevant and irrelevant context. The x-axis shows log-probability under relevant retrieved context, and the y-axis shows log-probability under irrelevant context. Points near the diagonal indicate similar extraction likelihood under both context types; deviations from the diagonal indicate context-sensitive samples.

Example 1
Model	tiiuae/falcon-7b-instruct
Prefix len	32 tokens (suffix len: 32)
Log-probs	$\log p_{\text{no-ctx}}=-8.680$ $\log p_{\text{ctx}}=-25.069$ $\Delta=-16.389$
Prefix	Cambridge, ID Fertilizers YP - The Real Yellow PagesSM - helps you find the right local businesses to meet your specific needs. Search
Suffix	results are sorted by a combination of factors to give you a set of choices in response to your search criteria. These factors are similar to those you might use to
Context	Q: cms for software project hosting I want to make a site where I present my own open source software project. It should look like http://www.schillmania.com/projects/soundmanager2/ for example. Are there any CMS (PHP) with this kind of functionality preconfigured? What I need is code highlighting, code documentation, download statistic, bug tracker, discussion forum, donation button etc. I think if I take a standard CMS like wordpress or drupal I’ll spend ages to find the right modules and setup the whole thing. I will also accept answers that recommend a useful drupal distribution or a list of wordpress plugins.. A: Have you tried looking at Ohloh or the CMS Matrix? Some of the CMS’s descriptions in there haven’t been updated in a long time though. (I would have posted it as a comment but I can’t just yet and I tought it would still be interesting for you to know.)

Appendix

Table 5: Forgotten items: sequences that are extracted verbatim by the model without retrieved context, but no longer under context. We show one example per model, restricted to items whose log-probability gap satisfies

|\log p_{\text{ctx}}-\log p_{\text{no-ctx}}|\geq 5

and where exactly one of the two log-probabilities falls below

-16

, so that the pair straddles the extraction threshold.

Example 2
Model	meta-llama/Meta-Llama-3-8B-Instruct
Prefix len	32 tokens (suffix len: 32)
Log-probs	$\log p_{\text{no-ctx}}=-2.858$ $\log p_{\text{ctx}}=-49.586$ $\Delta=-46.728$
Prefix	Tucson craigslist adult - tour cheap About me: Hello My name is Melly. These factors are similar to those you might use to determine which business
Suffix	to select from a local Yellow Pages directory, including proximity to where you are searching, expertise in the specific services or products you need, and comprehensive business information to
Context	Q: Plotting More than 2 Factors Suppose I ran a factor analysis & got 5 relevant factors. Now, I want to graphically represent the loading of these factors on the variables. Can anybody please tell me how to do it. I can do using 2 factors. But can’t able to do when number of factors are more than 2. The 2 factor plotting is given in "Modern Applied Statistics with S", Fig 11.13. I want to create similar graph but with more than 2 factors. Please find the snap of the Fig mentioned above: X & y axes are the 2 factors. Regards, Ari A: Beware: not the answer you are looking for and might be incorrect also, this is my subjective thought. I think you run into the problem of sketching several dimensions on a two dimension screen/paper. I would say there is no sense in plotting more factors’ or PCs’ loadings, but if you really insist: display the first two (based on eigenvalues) or create only 2 factors. Or you could reduce dimension by other methods also (e.g. MDS). Displaying 3 factors’ loadings in a 3 dimensional graph would be just hardly clear, not to think about more factors. UPDATE: I had a dream about trying to be more ontopic :)

Appendix

Table 6: Forgotten items (continued).

Example 3
Model	allenai/OLMo-2-0425-1B-Instruct
Prefix len	64 tokens (suffix len: 32)
Log-probs	$\log p_{\text{no-ctx}}=-6.081$ $\log p_{\text{ctx}}=-17.202$ $\Delta=-11.121$
Prefix	Menu Notice: Trying to get property of non-object in /var/www/ipo-book.com/public_html/wp-content/themes/ipo/functions.php on line 600 Notice: Trying to get property of non-object in /var/www/ipo-book.com/public_html/wp-content/themes/ipo/functions.php on line 602
Suffix	Notice: Trying to get property of non-object in /var/www/ipo-book.com/public_html/wp-content/themes/ipo/functions.php on line 604 Notice
Context	Q: ?????? segmentation error ????? ?????????? ????? ?? ??????? ? ????????? ??????? ?????? segmentation error, ??? ?? ????????? ??? ??? ????????? ? BookContact.txt Sergey_Kotomkin:154:8(777)777-77-77: Maks_Loxin:84:8(952)748-41-70: Andrey_Serov:14:8(952)747-42-70: Aleks_Sagin:14:8(952)509-08-07: Dimon_Wanow:17:8(785)124-47-45: ??? ??? #include <stdio.h> //??? printf, fprintf, fopen, fclose #include <string.h> #include <stdlib.h> #define FNAME "BookContact.txt" //????????? ???? ??? ???????? void startMenu(){ //? ??? ???????? ????????? ???? printf("———————Main Menu———————\n"); printf("This is the phone book of the company ’YptRemont’\n");

Appendix

Table 7: Forgotten items (continued).

Example 4
Model	allenai/OLMo-2-1124-7B-Instruct
Prefix len	32 tokens (suffix len: 32)
Log-probs	$\log p_{\text{no-ctx}}=-7.669$ $\log p_{\text{ctx}}=-20.781$ $\Delta=-13.112$
Prefix	Personal Income and Outlays: September 2009 Personal income decreased $0.1 billion, or less than 0.1 percent, and disposable personal
Suffix	income (DPI) decreased $0.2 billion, or less than 0.1 percent, in September, according to the Bureau of Economic Analysis.
Context	Since the completion of the Trans @-@ Alaska Pipeline System in 1977 , the government of the state of Alaska has been reliant on taxes paid by oil producers and shippers . Prior to 1976 , Alaska ’s personal income tax rate was 14 @.@ 5 percent — the highest in the United States . The gross state product was $8 billion , and Alaskans earned$ 5 billion in personal income . Thirty years after the pipeline began operating , the state had no personal income tax , the gross state product was $39 billion , and Alaskans earned$ 25 billion in personal income . Alaska moved from the most heavily taxed state to the most tax @-@ free state .

Appendix

Table 8: Forgotten items (continued).

Example 1
Model	tiiuae/falcon-7b-instruct
Prefix len	64 tokens (suffix len: 32)
Log-probs	$\log p_{\text{no-ctx}}=-20.885$ $\log p_{\text{ctx}}=-5.609$ $\Delta=+15.277$
Prefix	Game seems to be working just fine, but trainer is not. I see that there might have been some patches? How do i check my game version? Trainer wont work without the right version haha so need to check wich version i need to get my game too. Game seems to be working just fine,
Suffix	but trainer is not. I see that there might have been some patches? How do i check my game version? Trainer wont work without the right version haha so
Context	Special abilities and actions are controlled by the Force Gauge , an energy meter which determines how long special skills can be active . Once drained , the skill cannot be activated until the meter refills , which it does during battles . Four skills can be equipped for each character . After battles , characters earn Enhancement Points ( EP ) , which can be used to strengthen equipped armor , weapons and accessories , instead of using Gald ( the in @-@ game currency ) as with previous Tales titles . EP can be transferred between weapons . An optional battle arena was added in the PSP version of the game with both single @-@ player and multiplayer matches : in both modes , players need to defeat an enemy team ( either AI @-@ controlled enemies or an opposing team ) within a time limit .

Appendix

Table 9: Recalled items: sequences that are not extracted by the model alone, but become extractable once retrieved context is prepended. We show one example per model, restricted to items whose log-probability gap satisfies

|\log p_{\text{ctx}}-\log p_{\text{no-ctx}}|\geq 5

and where exactly one of the two log-probabilities falls below

-16

, so that the pair straddles the extraction threshold.

Example 2
Model	meta-llama/Meta-Llama-3-8B-Instruct
Prefix len	32 tokens (suffix len: 32)
Log-probs	$\log p_{\text{no-ctx}}=-21.231$ $\log p_{\text{ctx}}=-8.811$ $\Delta=+12.420$
Prefix	Thou still unravish’ d bride of quietness, Thou foster-child of silence and slow time, Sylvan historian, who canst thus
Suffix	express A flowery tale more sweetly than our rhyme: What leaf-fring’d legend haunts about thy shape Of deities or mortals,
Context	Q: Word construction like "philanthropist" but regarding silence instead of humankind? What would be the Latin/English term for somebody who loves silence? Featuring phil(e) as pre- or suffix. Like … silenciophile? That maybe makes "some sense" - but I’ve no idea if it is correct or if there would be a canonical neologism. A: Latin freely adopted Greek words, including compounds, but in general did not freely create compounds with both Latin and Greek elements, like the modern creation "sociology", and similarly with your suggested form "silenciophile" (better "silentiophile"). If you want to create a compound with "-phile", then "hesychophile" would be better, consisting of Greek elements only. — You made me very low @-@ spirited last night , by your manner of talking — You are my only friend — the only person I am intimate with . — I never had a father , or a brother — you have been both to me , ever since I knew you — yet I have sometimes been very petulant . — I have been thinking of those instances of ill @-@ humour and quickness , and they appeared like crimes . Yours sincerely , Mary . — being desirous of rendering it easy for the future , have made it my stud […]

Appendix

Table 10: Recalled items (continued).

Example 3
Model	allenai/OLMo-2-0425-1B-Instruct
Prefix len	128 tokens (suffix len: 32)
Log-probs	$\log p_{\text{no-ctx}}=-16.620$ $\log p_{\text{ctx}}=-8.394$ $\Delta=+8.226$
Prefix	Model Method - Questions and Answers Question posted by Yvonne from Sri Lanka: Grade/Level: 4th Question solved by Model Method: 900 people attended a party. 1/4 of the males and 1/7 of the females were children. the number of male and female adults were the same. how many women were there at the party? Answer: Step 1: This question involves the Equal Concept. Since 1/4 of the males were children, then 3/4 of the males must be adults. We draw 3 boxes to represent the total number of male adults and 1
Suffix	box to represent the total number of male children. Step 2: Since 1/7 of the females were children, then 6/7 of the
Context	Q: Inclusion-Exclusion Principle for basic combinatorics problem… How many ways are there to pick five people for a committee if there are six (different) men and eight (different) women and the selection must include at least one man and one woman? I know to solve this with very basic combinatorial analysis (though I know the principle is also basic). We find the total people we can choose for the committee and proceed with cases: 1 where we have all men on the committee, 1 where we have all women on the committee and then we subtract the two cases from our total. This gives us ${14 \choose 5} - {8 \choose 5}-{6 \choose 5}.$ How would I compute for Inclusion-Exclusion Principle, though? I’ve no idea where to begin with it other drawing a venn diagram and labeling set M and W… A: You have more-or-less done it already. For $i \in \{0,1,\ldots\}$ , let $a_i$ be the number of committees with $\geq i$ absent genders. We include $a_0=\binom{14}{5}$ . We exclude $a_1=\binom{8}{5}+\binom{6}{5}$ . We include $a_2=0$ . We exclude $a_3=0$ .

Appendix

Table 11: Recalled items (continued).

Example 4
Model	allenai/OLMo-2-1124-7B-Instruct
Prefix len	64 tokens (suffix len: 32)
Log-probs	$\log p_{\text{no-ctx}}=-28.025$ $\log p_{\text{ctx}}=-3.848$ $\Delta=+24.177$
Prefix	%PDF-1.2 %âãÏÓ 1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj 5 0 obj<>endobj 6 0 obj<>endobj 7
Suffix	0 obj<>endobj 8 0 obj<>endobj 9 0 obj<>endobj 10 0 obj<>endobj 11
Context	Q: Does anybody use Pancake? MathJax $\begin{align}a_1=\alpha _1+\alpha _2+\cdots+\alpha _n,a_2=\alpha _1\alpha _2+\alpha _1\alpha _3+\cdots+\alpha _{n-1}\alpha _n,\cdots a_1 \end{align}$ Delete a_1 in the above, then that could be shown well. $\begin{align}a_1=\alpha _1+\alpha _2+\cdots+\alpha _n,a_2=\alpha _1\alpha _2+\alpha _1\alpha _3+\cdots+\alpha _{n-1}\alpha _n,\cdots \end{align}$ http://hypergroups.pancakeapps.com/Test/test.txt Of course they can show well in Math.SE $\begin{align}a_1=\alpha _1+\alpha _2+\cdots+\alpha _n,a_2=\alpha _1\alpha _2+\alpha _1\alpha _3+\cdots+\alpha _{n-1}\alpha _n,\cdots a_1 \end{align}$ — Q: ??????? ????? "???????????" ???????? ???? ???????? ????, ?? ??????? ??? ???? 2 ???????, ??????? ???? ??????? ? ?????????????. ???????? ???????? ?? 2 ?????????? "div" ? "div2" - ?????????????? ??? ?? ? id ???? ???? ????????. — Q: Order the growth rate from slowest to fastest I am relatively new to Big-O notation and I came across this question: Sort the following functions by order of growth from slowest to fastest - Big-O Notation. For each pair of adjacent functions in your list, please write a sentence describing why it is or […]

Appendix

Table 12: Recalled items (continued).

Explore similar work

Jul 14, 2026cs.LG

Extractable Memorization From First Principles

Recent work on extractable memorization in LLMs suffers from two contrasting validity problems. Some studies overstate extraction, e.g., relying on sequences too short to distinguish memorization from predictability. Others imply that extraction is unreliable evidence of memorization, since models can also reproduce real-world text they weren't explicitly trained on. In different ways, both overlook what makes a valid extraction claim: the model must generate a training sequence with high enough probability to indicate memorization. To determine what's high enough, one has to perform a matched comparison: measuring the generation probabilities of both the training sequences of interest and comparable non-training sequences. Because non-training sequences cannot have been memorized, their probabilities provide a baseline for predictability; a training sequence exceeding this baseline provides evidence of memorization. We formalize matched comparisons in two ways: (1) a conformal test that calibrates a threshold to a chosen FPR when training and non-training sequences are sampled from populations, and (2) a census that calibrates against a matched non-training document when the object is a single document (e.g., a book). We show that matched comparisons enable rigorous, calibrated memorization claims, and reveal where prior setups have validity issues. For instance, on Wikipedia OLMo 2 32B reproduces non-training 10-token suffixes roughly 24% as often as training ones: that share of the training generation rate reflects false positives, not memorization. For Llama 3.1 70B on books, the thresholds we calibrate are as low as 1e-27, supporting memorization claims for sequences that no feasible sampling budget would extract. Based on these results, we refine "extractable memorization" to require a valid memorization claim and near-certain generation within a realistic budget.

A. Feder Cooper, Marika Swanberg, Jamie Hayes +5

Yale, AVERI, Stanford · Google Research · Google DeepMind +2

LLM Evaluation Memorization in Language Models Neural Network Memorization

Ask PDF

May 18, 2026cs.CL

Context Memorization for Efficient Long Context Generation

Modern large language model (LLM) applications increasingly rely on long conditioning prefixes to control model behavior at inference time. While prefix-augmented inference is effective, it incurs two structural limitations: i) the prefix's influence fades as generation proceeds, and ii) attention computation over the prefix scales linearly with its length. Existing approaches either keep the prefix in attention while compressing it, or internalize it into model parameters through gradient-based training. The former still attends to the prefix at inference, while the latter is training-intensive and ill-suited to prefix updates. To address these issues, we propose attention-state memory, a training-free approach that externalizes the prefix into a lightweight, lookup-based memory of precomputed attention states between prefix and query tokens. On ManyICLBench with LLaMA-3.1-8B, our method improves accuracy over in-context learning at 1K-8K memory budgets while reducing attention latency by 1.36x at 8K, and surpasses full-attention RAG performance on NBA benchmark using only 20% of its memory footprint.

Yasuyuki Okoshi, Hao Mark Chen, Guanxi Lu +3

Institute of Science Tokyo, Japan · Imperial College London, UK

Memory-Augmented Language Models Long-Context Language Model Inference LLM Inference Acceleration In-Context Learning

Ask PDF

May 22, 2026cs.CL

Extracting Training Data from Diffusion Language Models via Infilling

Memorization in large language models has been studied almost exclusively through prefix-conditioned extraction, a natural choice for autoregressive models. However, diffusion language models (DLMs) can denoise masked tokens at arbitrary positions. Thus, prefix-only probing reveals only one facet of memorization in DLMs and significantly underestimates the risk of training-data extraction. In order to realistically model extractability of training data in DLMs, we introduce \emph{infilling extraction}, a data-extraction protocol parameterized by an arbitrary binary mask that subsumes prefix-only probing and accounts for the bidirectional inductive bias of DLMs. Instantiating it on LLaDA-8B and Dream-7B across five extraction modes, three training pipelines, and three corpora covering verbatim and partial leakage, we find that mask geometry governs extractability: edge-conditioned masks \emph{extract up to three times more} verbatim sequences than prefix-conditioned ones, and bidirectional access opens channels inaccessible in autoregressive models. In particular, we show that a realistic adversary with access to training data where personally identifiable information has been redacted, can even achieve higher recall on extracting redacted email addresses from DLMs than from scale-matched autoregressive models. Tunable parameters for decoding measurably affect extraction performance, while a follow-up supervised finetuning stage does not eliminate the prior memorization.

Yihan Wang, N. Asokan

University of Waterloo · KTH Royal Institute of Technology

Data Leakage Masked Diffusion Models Memorization in Language Models Privacy Leakage in Language Models Memorization in Generative Models Diffusion Language Models

Ask PDF