Rethinking LLM Memorization through the Lens of Adversarial Compression
Avi Schwarzschild, Zhili Feng, Pratyush Maini, Zachary C. Lipton, J. Zico Kolter
TL;DR
<3-5 sentence high-level summary> Addresses the memorization vs generalization question in LLMs and proposes Adversarial Compression Ratio (ACR) to quantify memorized strings via minimal adversarial prompts, enabling practical auditing for data usage compliance. Critiques existing memorization notions as inadequate for practical auditing and argues for an adversarial compression perspective to robustly assess memorization and unlearning implications. Introduces MiniPrompt, a gradient-based prompt-optimization approach to approximate the shortest prompts that elicit training-data outputs, and validates it across multiple data categories and model scales, showing larger models memorize more and unlearning can be incomplete. The work includes case studies (TOFU, Harry Potter) and discusses limitations and broader regulatory implications, aiming to provide a quantitative tool for regulators, practitioners, and courts to reason about data usage and copyright concerns in LLMs.
Abstract
Large language models (LLMs) trained on web-scale datasets raise substantial concerns regarding permissible data usage. One major question is whether these models "memorize" all their training data or they integrate many data sources in some way more akin to how a human would learn and synthesize information. The answer hinges, to a large degree, on how we define memorization. In this work, we propose the Adversarial Compression Ratio (ACR) as a metric for assessing memorization in LLMs. A given string from the training data is considered memorized if it can be elicited by a prompt (much) shorter than the string itself -- in other words, if these strings can be "compressed" with the model by computing adversarial prompts of fewer tokens. The ACR overcomes the limitations of existing notions of memorization by (i) offering an adversarial view of measuring memorization, especially for monitoring unlearning and compliance; and (ii) allowing for the flexibility to measure memorization for arbitrary strings at a reasonably low compute. Our definition serves as a practical tool for determining when model owners may be violating terms around data usage, providing a potential legal tool and a critical lens through which to address such scenarios.