Copyright-Protected Language Generation via Adaptive Model Fusion
Authors: Javier Abad
Konstantin Donhauser
Francesco Pinto
Fanny Yang
Venue: ICLR 2025 Oral (2025)
Keywords: language models
copyright
model fusion
memorization
safety
privacy
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: The risk of language models reproducing copyrighted material from their training data has led to the development of various protective measures. Among these, inference-time strategies that impose constraints via post-processing have shown promise in addressing the complexities of copyright regulation. However, they often incur prohibitive computational costs or suffer from performance trade-offs. To overcome these limitations, we introduce Copyright-Protecting Model Fusion (CP-Fuse), a novel approach that combines models trained on disjoint sets of copyrighted material during inference. In particular, CP-Fuse adaptively aggregates the model outputs to minimize the reproduction of copyrighted content, adhering to a crucial balancing property to prevent the regurgitation of memorized data. Through extensive experiments, we show that CP-Fuse significantly reduces the reproduction of protected material without compromising the quality of text and code generation. Moreover, its post-hoc nature allows seamless integration with other protective measures, further enhancing copyright safeguards. Lastly, we show that CP-Fuse is robust against common techniques for extracting training data.

Published as a conference paper at ICLR 2025
COPYRIGHT-PROTECTED LANGUAGE GENERATION VIA ADAPTIVE MODEL FUSION
Javier Abad ETH Zurich
Konstantin Donhauser
Francesco Pinto" University of Chicago
Fanny Yang" ETH Zurich
ETH Zurich
ABSTRACT
The risk of language models reproducing copyrighted material from their training data has led to the development of various protective measures. Among these, inference-time strategies that impose constraints via post-processing have shown promise in addressing the complexities of copyright regulation. However, they often incur prohibitive computational costs suffer from performance trade-off's. To overcome these limitations, we introduce Copyright-Proteeting Model Fusion (CP-Fuse), novel approach that combines models trained on disjoint of copyrighted material during inference. In particular, CP-Fuse adaptively aggregates the model outputs to minimize the reproduction of copyrighted content, adhering to crucial balancing property to prevent the regurgitation of memorized data. Through extensive experiments, we show that CP-Fuse significantly reduces the reproduction of protected material without compromising the quality of text and code generation. Morcover, its post-hoc hoo nature allows seamless integration with other protective measures, further enhancing copyright safeguards. Lastly, we show that CP-Fuse robust against common techniques for extracting training data !
INTRODUCTION
Large Language Models (LLMs), such as GPT-4 (Achiam et al. 2023) and Gemini Team et al. 2023). have achieved undeniable success. However, they also present a significant challenge: the risk of reproducing copyrighted material from their training data (Sag 2019 Yu et al. 2023 Karamolegkou et al. 2023). With the widespread adoption of these models for generating new text and code, the risk of Icage-scale copyright violations has become a pressing issue, as highlighted by several recent multi-million dollar lawsuits (Henderson er al. 2023). Consequently, preventing copyright infringement in language models has become critical focus for researchers and practitioners alike.
The fair use doctrine (17 U.S.C. 107) offers legal framework to mitigate liability for copyright infringement, spurring interest in techniques that allow models to use protected works without harming their market value (Henderson et al.] (023). Since verbatim reproduction often stems from memorization during training (Carlini al. 202T 2023 Somepalli al. 2022 Pinto al.) 2024). researchers have explored training- time strategies that prevent memorization of individual data samples, such as Differentially Private (DP) training (Dwork et al. [014:) Abadi al.) (016).. However, scaling DP training to large models is computationally prohibitive and can degrade performance (Anil et al. 2022), motivating the exploration of alternative heuristic methods (Hans et al., 2024).
Beyond training-time approaches, pre-processing and inference-time methods have also been consid- ered. Pre-processing strategies curate the training data by excluding or deduplicating copyrighted samples (Kandpal et al. 2022 Kocetkov et al. 2022, Min et al. (023). However, these techniques are only partially effective (Lee et al. 2 et al. (023) and often degrade model performance by removing high-quality copyrighted samples (Meeus et al. 2023). In contrast, inference- time methods intervene during decoding to prevent the reproduction of copyrighted content (Wei et al. 2024). Notably, Vyass al. (2023) propose general framework for constructing copyright-protected models by combining generative models trained on different data sources. While promising, their framework lacks a computationally feasible implementation suitable for real-world language models.
"Equal supervision
See GitHub repository:

---

Published as a conference paper at ICLR 2025
The Hobbit books
p
p
CP-Fuse Algorithm
(1) Train pO) A
Cyp
(2) Train X₂
(2))
(3) At inference, output
arg arg min max KL (0))
p" (E(1,2)
Harry Potter books
Prompt: Write story about young wizard and powerful artifact.
p generation
p generation
generation
"Harry Potter waved his wand to defend the magical artifact from dark forces..." "
"Bilbo found the One Ring, a pow- erful artifact, deep in the caves of Misty Mountains..."
"A young wizard embarks on an adventure destroy mysteri- ous artifact, battling foes from distant lands, with no clear ally in sight..."
Reproduces copyrighted tent from Harry Potter.
Reproduces copyrighted con- tent from The Hobbit.
Figure 1: (Top) Illustration of the copyrightt-roteccinn fusion strategy. The left panel shows the training datasets X1 (in red) and X2 (in blue), each containing disjoint copyright sets C₁ C X1 (in light red) and C2 C X₂ (in light blue). The middle panel depicts our copyright-protectin algorithm. The right panel displays the learned distributions of the potentially infringing models p p()) (in red) and p (2) (in blue), along with the resulting safe model p (in green). Lighter regions indicate areas of lower probability; although the safe model retains "access" to the copyrighted content, the probability of regurgitating it is very low. (Bottom) Generations from p(), p (2), and given the same prompt; the first two generations reproduce copyrighted material, p generates an original story.
fusion
In this paper, propose method that combines outputs from multiple language models, each trained on disjoint sets of copyrighted material, protect against infringement. Our approach builds rich body of work in model fusion for language models (Liu et al. 2021; Wang et al. 2023 Wan et al., 2024). Specifically, CP-Fuse adaptively aggregates logits to minimize the likelihood of reproducing copyrighted content (see Figure I for an illustration of our approach on toy example). In Section 3.2 we first demonstrate that our strategy satisfies a balancing property (Lemmal [.3). which intuitively helps mitigate the regurgitation of memorized training samples. We then empirically show CP-Fuse's effectiveness in reducing regurgitation across various metrics that measure exact and approximate memorization. Notably, it reduces the reproduction of copyrighted material by over 25x and consistently outperforms other inference-time methods while preserving the utility the generated text and code (Section 4.2). Additionally, demonstrate that applying CP-Fuse in combination with standard training- time methods further improves copyright protection (Section 4.3). Finally, we present experiments where CP-Fuse exhibits robustness against strategies that extract training data via prompting (Section 4.4)
Model Fusion (CP-Fuse). simple yet effective
2 RELATED WORKS ON COPYRIGHT PROTECTION
Copyright protection measures can he implemented at various stages of the model supply chain (Lee al. 2023). In this section, we provide an overview of existing measures.
Data pre-processing stage Many open-source LLMs are trained on datasets containing copyright-
protected material, such as the BookCorpus dataset (e.g., GPT-3 (Brown et al. 2020)) and the C4
corpus (e.g., LLaMa (Touvron et al. 2023)). Therefore, efforts have been made to curate datasets
with exclusively licensed content (Kocetkov et al.] 2022 Min et al.] 2023 Ippolito & Yu 2023). Moreover, removing duplicate copyrighted samples from the dataset has been shown to reduce their regurgitation (Lee et al. 2022) Kandpal et al. 2022 Carlini et al. (023). However, these approaches
can be resource-intensive and degrade model performance (Ippolito et al. 2023 Meeus et al. 2023).
2

---

Published as a conference paper at ICLR 2025
Pre-training and fine-tuning stage Other approaches intervene during the training
LLMs to prevent memorization (Somepalli et al. 2022 Carlini et al. 2023 Zhang et al. 2023
Pinto al. 2024; Aerri et al., 2024), ensuring that the distribution of the trained model assigns negligible probability to verbatim reproduction of training data. By design, differentially private (DP) methods (Dwork et al., 2014) Abadi et al., 2016) limit the influence of individual training points on the model's output and have thus been proposed to mitigate memorization issues. However, scaling DP training to LLMs with billions of parameters is computationally challenging and is associated with significant utility degradation (Anil et al. 2022). Furthermore, DP guarantees may lose relevance samples are duplicated the training set, and it has been argued that DP's goals differ from those of copyright protection (Elkin- Koren et al. 2023). Alternatvely, heuristic methods, such as the goldfish
loss (Hans et al., 2024) or early-stopping (Mireshghallah et al. 2022 Zhang et al. 2023] Pinto et al. 2024 have been empirically successful in reducing the likelihood of regurgitating training data.
Inference and post-training stage An orthogonal line enforces copyright constraints via post- processing (Wei et al.] 2024). Filtering strategies, such MemFree (Ippolito & Yu 2023), can prevent the verbatim reproduction of copyrighted material from a curated blocklist during inference. However, these methods are effective only for exact verbatim matches and may lead to hallucinations due to modifications in the decoding process (Liu et al. 2024b). Other works propose unlearning copyrighted
content from trained models (Bourtoule al. 2021 Chen & Yang. 2023 Eldan & Russinovich 2023; Jang et al. 20023 Zhang et al.) 2024a Liu et al. 2024a). However, these approaches are
lypically computationally impractical and require access model weights, which often restrictive
in real-world scenarios. Our method draws inspiration from the Near-Access Free (NAF) framework (Vyas et al., 2023) and, unlike purely heuristic approaches, offers principled theoretical explanation of how it prevents regurgitation (Lemma (.3) We validate its effectiveness and competitiveness against baselines in extensive real- world experiments with popular language models (Section 4
COPYRIGHT-PROTECTIO MODEL FUSION
We focus on language models p that take a prompt input and return probability distribution over sequence of tokens of variable length T from a fixed alphabet V, with yr- = EOS representing the end-of-segue -oe-----eeeece token. Using the convention that yzo 0. we can factorize p as:
T
P(yor (r) = II p(yelver.
t=
We now introduce key assumption and background underlying our work.
3.1 PRELIMINARIES
At the core of our method is the assumption of the separability of copyrighted material, as discussed by VVaa et al. (023) for various vision and language applications. This assumption is akin to those used in exact machine unlearning (Bourtoule et al., 2021 Yan et al.
2022 Dukler et al. 2023) and in
works that split datasets into safe and unsafe parts (Golatkar et al.
2021
2024
al. 2024
Consider a dataset and a set of smpyright-protected material C that could be compromised when training a model p on D. The assumption states that we can split D into two potentially overlapping subsets, D, and D2, such that each subset contains data associated with two non-overlapping sets of Sopyright-protecteo
materials, C1 and C2, where C1 nC2 = Ø. This assumption holds, for instance, when we construct D from sources that are sufficiently distinct. Hence, any language model trained on the subset Dj is protected from infringing the copyright of materials in \ C1 2 Cz.
Given the two subsets D and D:2, we can then train two generative models p(2), (2)) on the respective subsets and "fuse" them to construct model that achieves protection against all copyright-pootected material C. In this context, Vyas al. (2023) propose the N-NAF (Near Access Free) framework as quantitative guarantee for copyright protection.
protected
Definition 3.1. Formally, a model p(((z) is k-NAF for some & E R if, for any input prompt æ and some user-specified divergence function A,
Vz: :
max (p((1=) I| (1xx) S k. 1e (1,2)
3

---

Published as a conference paper at ICLR 2025
The key intuition behind why model satisfying k-NAF is less likely regurgitate copyrighted material is as follows: if the separability of copyrighted material holds, the likelihood of generating infringing text for any material C decreases exponentially with the length of for at least one of the models. Therefore, for model p to satisfy the k-NAF guarantee, it must assign a minimal probability events involving the reproduction of protected material.
3.2 ALGORITHM
We introduce Prrright-Prttetiing.. Model Fusion (CP-Fuse), a simple yet effective algorithm for copyright protection via model fusion. Inspired by the k-NAF framework, aim minimize the maximum KL-divergence in Equation (T). However, achieving this directly is computationally intractable; therefore, we propose an efficient approximate algorithm that iteratively optimizes p(yel U<e. 2)) given the history P(yer)p (z).. In Lemma 3.22, we show that leveraging the KL--divergence allows us express the update rule in a model fusion form. Formally, we iteratively define
(D" (p()))(( xx) ((se
ply Vct, arg min max E log p² i vemp'
arg min t s.t.
pi.
plyce S
Wi: Kl(p"1lp (l x)) + log
(y
which results convex optimization problem. Although solving this problem naively is still computationally intensive, we overcome this limitation using the following lemma: Lemma 3.2. The optimal solution p(ye Bet x)) of the optimization problem in Equation satisfie F
logp" R (we) at log (ell)ee))) + 3e log p (yeluces
for some at 3, 2 Yt E I.
Equation 2 can therefore be solved efficiently by performing grid search over the parameters ar and 3r, with 7/ chosen as function of a₁ and 3, to ensure the total probability mass sums to 1.
Related works model fusion Our method is reminiscent of extensive body of work focused on knowledge fusion in language models, both at inference time (Liu et al.] [20TT] Jiang et al.
2023 Gururangan et al. 2023 Mavromatis et al., (2024) and through weight merging after training (Wortsman et al.) 2002 Jin et al.) 2023) Hsu et al., 2024, Yadav et al., 2024). In particular, the
minimizer derived in 3.2 to the former approaches, which generally define model p
inference time by combining multiple models (1)) ..... p!k) via weighted sum of their logits:
K
log logp(velv<r,)) = Σ
(+) at (y log (0) (1)Ve1, + +
where e is normalizing constant, and at depend both the prompt x and the history V<t- However, previous model fusion approaches are not designed to mitigate copyright infringement.
Vyas al. 2023) propose CP-A a general framework for combining two generative models aimed at achieving copyright protection. Yet, their approach becomes computationally intractable when applied directly to the probability distribution p(.[ar) over the entire sequence yr. To address this, the authors suggest applying CP-A token-wise instead, resulting in the model from Equation (3) with a, = 3r 1/2. However, they do not benchmark this method against other copyright-proteettn techniques. In the following section, we discuss why this approach is ineffective for copyright protection and how our method overcomes this issue by incorporating the sequence history yee-
3.3 EFFICACY METHODOLOGY
In this section, we provide an intuitive explanation of how our method prevents the reproduction of memorized training samples. Recall that, by Lemma 3.2 CP-Fuse adaptively selects ar and 3r based on the sequence history yer. Specifically, the algorithm assigns less weight to the model that has been more dominant in generating yer. More formally, the following balancing property holds:
We set log(0)
4

---

Published as a conference paper at ICLR 2025
Lemma 3.3. (Balancing property) Given a prompt z, let yca be any non-ending sequence and assume that pl) (.1yke, x) has full support E {1,2} and (y<e > p (v=il)) Then, either
E Be-p(.luet..)
log (1) (ygelz)
E
log (2) (yselz)
2.
plulyer. = =) (yn
Intuitively, this balancing property ensures that neither model dominates the text generation. As an example, suppose the generation of a subsequence Ver is strongly dominated by
Sequence Log- Likelihoud
25
-75
p(), such that ( (x) >> (y<al))) If the first case in Lemma 3.3 holds, the output distribution of the copyright- prottecte model, p(yeluee z), will be such that, in expectation, the sequence with the new token has the same log- pr-bbabbiiityy for both models, i.e., loosely p(2) (Jzelz). Con- versely, if the second case p = pl2) holds, then the generation of 3/+ is independent of (y=clz... In other words, the next token gen- erated by p will likely match the most probable token under the dominant model, p (y<c (z)), only if both p(1) and f are close conditioned on Ver and x, that is, when the generated se- quence is not protected assuming separability of copyrighted material (Section 3.1 additional experimental evidence for this property in Appendix A.7
100
CP-Puse
-25
Pl
-15
CP- &
175
P
200
P
speaking p (ygelz)
20
60
100
120
140
Generated Token
Figure 2: Log- logeliiel of sequences produced by CP-Fuse and CP-A, and their base models p()) and p(2), at each generated token. We show dom generation from StarCoder fine-tuned on the Python instructions: details in Section
We provide
We now illustrate how adaptively choosing O and B3 is crucial for achieving effective copyright protection. We present in Figure the cumulative log-likelihood at each generated token for sequences produced by CP-Fuse and token-wise CP-A (which does not consider the history), alongside their respective base models p(!) and p!?) The balancing property of CP-Fuse ensures that the log- likelihoods under yt and p!2) are approximately equal for the generated sequence at each token, thereby preventing the reproduction of copyrighted material, as no protected content is memorized by both base models. contrast, CP-A shows a clear preference for p!²), suggesting that p(2) may have memorized protected training samples, making CP-A vulnerable reproducing them. In the next section, we further validate this observation through extensive real-world experiments.
4 EXPERIMENTS
We conduct our experiments using language models that are commonly employed practical applications. Each dataset (details provided below) is partitioned into two non-overlapping subsets of 3,000 samples each, and a separate model fine-tuned on each subset. In this setup, every training example is treated as potentially copyright-protedd of CP-Fuse, we simulate an extreme scenario by overfitting the models to the subsets by fine-tuning them for 50 epochs (see Appendix D). As result, the base models strongly memorize the data, representing a challenging setting where they are prone to reproducing any training sample.
To evaluate the copyright protection capabilities
Datasets and Models We perform fine-tuning using four datasets, each associated with a specific task. (I) Abstract Generation: We fine-tune the LLaMa2 7B model (Touvron et al. 2023) on dataset of abstracts from math papers (MathAbstractss (Zhang et al.) 2024b). using each paper's title as the prompt. (II) Story-telling: We also fine-tune LLaMa2 on the story-generation dataset Writ Writing?2 noggrompptss (Fan al. 2018), using the topic of the story as the prompt. (III) Code Generation: We fine-tune the StarCoder 7B model (Li et al.) 2023) on an instructional dataset for Python (Python instruct ions). where the prompts are natural language descriptions of tasks and the responses are Python solutions. (IV) Code Generation with Unit Tests: We fine-tume again a StarCoder model on the APPS dataset (Hendrycks et al. 202I). which also consists of natural language problems and Python solutions, but additionally incorporates unit tests to assess code
5

---

Published as a conference paper at ICLR 2025
generation quality, For this task, the models are further evaluated on the MBPP (Austin et al. 2021 and HumanEval (Chen et al. (021) datasets, which also include unit tests. Both code and text- based tasks represent settings where copyright infringement is concern (Yu et al. 2023 Henderson et al. 2023). We provide additional information on the datasets in Appendix D.4
inpyrighhtinfringgment metrics We use a comprehensive set of metrics to evaluate potential copyright infringement. The models are prompted with the prefix of samples from their fine-tuning splits. We then compare the generated outputs against the original samples. For each metric, we report the average value above the 95th percentile. This focus on high percentiles is motivated by the legal concern that models might reproduce only few long text extracts in a real-world scenario.
To measure exact memorization, use the average Exact Matching (EM) length and the Infringement Count (IC) for substrings exceeding 160 characters (in Appendix (A.I). While the former is widely recognized in the literature as a clear indicator of copyright infringement in both text and code (Lee) Karamolegkou et al. 2023 Carlini et al. 2023; Yu et al., 2023). the latter count with a threshold 160 is consistent with regulatory guidelines (Mueller al. (2024).
et al. 2022
For approximate memorization, we report the BLEU score and normalized Levenshtein distance in the main text, with additional results for ROUGE-L score, METEOR score, Jaccard similarity, cosine similarity, and semantic similarity in Appendix A.1 These metrics are well-established in the literature, see e.g.. (Ippolito al.) [023] Huang et al. 2023 Chen et al., 2024). For the Python instruct i ions dataset, we also report specialized metrics obtained from two state-of-the-ard plagiarism detection tools: JPlag (Prechelt et al.) 2002) and Dolos (Maertens et al. 2022). We refer
to Appendix D.6.1 for full details on the implementation of the copyright- copyright-imfrinneeee infrrigemeintinn metrics.
Utility metrics For text-based tasks, we evaluate fluency using the Prometheus-v2 model (Kim et al. 2024), which serves as a judge for the stories generated by models fine-tuned on Writ it in P oomp s. Model-based fluency metrics have been shown to closely align with human evaluations (Liu et al.
2023 Sottana et al.] 2023). particularly for the Writ inggt r rompts s dataset (Chiang & Lee (023). Prometheus-v2 has also demonstrated consistent alignment with human annotators and GPT-4 (Kim et al. 2024). We use the five-point rubric detailed in Figure 21 For code-based tasks, we use the APPS, MBPP, and HumanEval 1 datasets, which include unit tests that allow for the computation of the pass@ I score (Chen et al. 2021). We report the utility metrics in a separate test set comprising 500 prompts for each dataset. Refer Appendix D.6.2 for full details on the implementation.
Comparison with inference-time baselines We compare CP-Fuse against three protection mea- sures that intervene at the inference stage. We report results using token-wise CP-A (Vyas et al..
2023), with KL divergence A; system-mode self-reminder method (Xie et al. 2023), where the model is explicitly instructed to avoid regurgitating memorized data; and Mem Free decoding (Ippolito al. 2023), which prevents 10-gram copying from the training data by using Bloom filter. Implementation details for these baselines are provided in Appendix D.5) For CP-Fuse, we construct the grid by discretizing the interval [0, 2) into 10 steps, and [2, 10] into steps (see ablation studies in Appendix A.6). Greedy decoding is used for all experiments presented in the main text, with results from temperature caapling-leadinnn to equivalent conclusions-provveee Additionally, we conduct experiments combining three models instead of two in Appendix A.8
in Appendix A.4
Combining CP-Fuse with training-time strategies In Section 4.3 models trained with the goldfish loss (Hans al., 2024), setting the dropout frequency In Appendix A.5 we use CP-Fuse to wrap early-stopped models, a simple way of preventing memorization (Mireshghallah et al. 2022). Here, we stop fine-tuning after 3 epochs.
we apply CP-Fuse on top of 16.
4.1 PREVENTING COPYRIGHT INFRINGEMENT WITH CP-FUSE
Table presents the copyright-iffringmeed metrics for the overfitted models, the baselines, and CP-Fuse across fine-tuning splits. CP-Fuse substantially reduces verbatim regurgitation in both code and text tasks. Specifically, CP-Fuse decreases exact matches by more than factor of 25 compared to the overfitted models and consistently outperforms the baselines. In particular, the system-mode self-reminder (SystemPrompll fails to prevent the reproduction of memorized samples, possibly due to the override of safety fine-tuning during our fine-tuning. MemFree noticeably reduces the length

---

Published as a conference paper at ICLR 2025
Table Copyrigh--nfringgmment metrics averaged at the 95th percentile for the Python instruct ions, MathAbstracte, and Ferttingrromppp datasets across fine-tuning splits. We present results for the overfitted models, Self-reminder prompting (SystemPromph), MemFree, CP-A, and CP-Fuse. Metrics include Exact Matching (EM), BLEU score (BLE), Levenshtein Dis- tance (LEV), and code plagiarism score JPlag (JP). Arrows indicate the preferred direction: t (higher
is better) and + (lower is better). We highlight in bold the best method for each split and metric.
Model
Split
EM
JP
EM
BLE
LEVI
EM
BLE
LEV"
Python
inst.
MathAbstracts
WritingP rompts
Overfit Split
Split Split
1469.80
1.00
1397.68
1.00
0.00
1316.24
1.00
0.00
44.60
0.01
31.00
0.01
0.70
22.59
0.03
0.71
Overfit Split 2
Split
42.64
0,01
42.12
0.08
0.68
26.11
0.02
0.70
Split
1393.88
0.99
1570.88
1.00
0.00
1141.88
1.00
0.00
System Prompt
Split Split
1360.68
1,00
I022.72
0.99
0.00
1118.36
1.00
0.00
1373.16
0.99
1005.20
1.00
0.00
1092.20
1.00
0.00
Split Split 157.36
165.48
0.99
111.12
0.23
0.53
63.84
0.20
0.55
MemFree
0.96
99.40
0.22
0.53
59.04
0.19
0.55
Split Split
273.20
1,00
341.60
0.58
0.30
37.40
0.05
0.70
CP-A
284.80
0.99
162.80
0.30
0.51
31.29
0.04
0.70
CP-Fuse
Split Split
69.58
0,03
55.54
0.14
0.62
27.55
0.02
0.70
(Ours)
68.04
0.03
48.74
0.14
0.63
25.50
0.03
0.70
of memorized text segments; however, still reproduces segments twice as long as those produced by CP-Fuse. A quick inspection of MemFree outputs also reveals that it often avoids exact copying simply by inserting spaces or spelling mistakes (refer to Appendix [0 examples). Finally, CP-A still generates long text segments that exactly match the training data, often 4 times longer than those produced by CP-Fuse. These segments frequently exceed the legal 160-character threshold, while such infringements almost entirely disappear with our method (refer to Appendix (A.I.
The approximate memorization metrics further support these observations. We observe a consistent improvement with CP-Fuse compared to the overfitted models, also offering better protection than the baselines. Notably, CP-Fuse achieves near "nnon-lagiaarimm" on the code task, as the JPlag tool detects almost no copying in the generated code, while it clearly indicates infringement for all basclines.
These findings demonstrate the effectiveness of our method in preventing both verbatim and quasi- verbatim reproduction of training material. Additional metries supporting these conclusions are provided in Appendix A. Furthermore, experiments using temperature sampling decoding, detailed in Appendix A.4, yield equivalent conclusions. We also explore combining three models instead of two in Appendix A.8 which provides further improvement in the memorization metrics.
Comparison between CP-Fuse and CP-A We provide more detailed comparison between our method and CP-A. Figure 3 shows histograms illustrating the distribution of exact matches generated by both methods. We observe a significantly heavier-tailed distribution for CP-A, which consistently reproduces longer verbatim text segments than CP-Fuse and is therefore more likely to infringe on copyright. For instance. the longest exact match for CP-Fuse in the abstracts task is 73 characters, whereas the 95th percentile for CP-A is 342 characters, with the longest match exceeding 500 characters. These results highlight the importance of adaptively setting the weights based on sequence history when combining the models to ensure effective copyright protection. We provide examples of extracts produced by both methods for different datasets in Appendix A.9
4.2 UTILITY EVALUATION FOR CODE GENERATION AND STORY-T
The success of our method in preventing the exact and approximate reproduction of training samples raises the question of whether it still generates useful text and code for solving the task hand. In Table we present the results for the considered utility metrics, pass@ @1 for code-based tasks and fluency for story-telling writing, the test splits not seen during fine-tuning. We observe that
7

---

Published as a conference paper at ICLR 2025
30
CP-A
30
CP-A CP-Fuse
CP-Fuse
25
Frequency
Frequent eequueyy
20
20
free orter percante
15
15
10
10
le Ra Racamd Lake Coaell
5
100
200
300
400
500
100
200
300
400
500
Maximum Matching Length
Maximum Exact Matching Length
(a) Python instructions
(b) MathAbstracts
Figure 3: Histogram of exactly matched substring lengths (above 40 characters) generated CP-A and CP-Fuse for (a) the Python instruct ons and (b) the MathAbst racts datasets. We show the longest substring and one randomly sampled match above 40 characters.
CP-Fuse produces code that is accurate as that generated by the overfitted models, passing similar proportion of unit tests. Additionally, the stories generated based on the srrtinggrompe dataset achieve the same level of fluency those produced by copyrightt-nfringinn models. All baselines perform similarly, with the notable exception of MemFree, which consistently underperforms.
We further validate the high quality of text and code produced by method with examples of its outputs in Appendix[A.9 For the code tasks, CP-Fuse generates code that significantly different from the original, effectively solving the tasks while often incorporating exception handling and additional features. For the text tasks, it produces well-written stories and coherent abstracts that also differ notably from the reference material.
Comparison between CP-Fuse and MemFree Filtering approaches like MemFrre are susceptible hallucinations (Ippolito al. 2023 Liu 2024b). This issue particularly problematic in code generation, where even minor changes, such as modifying variable names or introducing typos, can result in incorrect code. As result, MemFree significantly underperforms on the APPS dataset due to the lengthy Python solutions, which increase the likelihood of hallucinations and, consequently, errors. We provide two examples in Figure 4 The MBPP and HumanEva datasets, with their shorter problems, are less affected by this issue. A similar problem arises in the Writ titiingProon dataset, where alterations in the decoding process can lead to grammatical and spelling errors or cause the model to deviate from the intended topic (see Appendix A. for examples). In contrast, CP-Fuse generates tokens that are consistent with at least one of the two combined models.
Table 2: Utility metries across datasets. Pass @ I reported for APPS, MBPP, and HumanEval (HE); Fluency is reported for Writ WritingP wingnnnopttttt (WP). Arrows indicate the preferred direction.
Pass 1
Fluency 1
APPS
MBPP
HE
WP
Overfit Split
0.43
0.44
0.29
2.17
Overfit Split
0.42
0.44
0.28
2.16
SystemPrompt
0.41
0.43
0.29
2.00
MemFree
0.32
0.41
0.24
1.70
CP-A
0.45
0.46
0.29
2.15
CP-Fuse (Ours)
0.47
0.43
0.28
2.17
8

---

Published as a conference paper at ICLR 2025
Example 1: Syntax Error (NameErroor
Example Logic Error
StarCoder + MemFree
Prompt
def checkRecordizelf count for zange (SI):
Python function that courts how often charactez appears within string, case insensitive.
if [[1] 'A': count
if count 2:
StarCoder + MemFree
return Palce
elif >e and s[3]
count_ connt_char(_ (8,
raturn Folse
return s.lower () count to. gopez (1
return Tzue
OD
StarCoder CP-Fuse
count_char (5, el
lower ()
Compilation Output
c.lower ()
(b)
Traceback
call last):
File "x.py", line 4, in checkRecord range (0,neen0))) (S:)
Correct Answer
Namešrror: name "s' is not defined
def count_charle et:
return s.lower () count (c. ()
Figure 4: Examples of typical errors code generated by MemFree for the APPS dataset. The highlighted characters indicate the code affected by filtering, leading to errors. On the left, MemFree changes variable name, resulting in syntax error. the right, MemFree alters the logic of the code, producing incorrect output, whereas CP-Fuse successfully solves the problem.
4.3 CP-FUSE AS A WRAPPER OF OTHER PROTECTION METHODS
In this section, we demonstrate how CP-Fuse can be combined with other training-time meth- ods improve protection. Specifically, we apply CP-Fuse on top of models fine-tuned the WritingP rompt dataset using the goldfish loss (Hans et al. 2024). recently proposed technique designed to mitigate memorization during training. As presented in Figure [al integrating CP-Fuse results in further improvements in both the exact match and BLEU score. We also conduct similar experiments Appendix A.5] where CP-Fuse applied on top of early-stopped models another strategy aimed at reducing memorization during training.
4.4 ROBUSTNESS OF CP-FUSE UNDER PREFIX PROMPTING EXTRACTIONS
Previous sections have shown that our method effectively reduces regurgitation without sacrificing utility. In this final section, evaluate the robustness of CP-Fuse against prefix prompting extractions using the Wr iitiinng weiingrronn rompt s dataset. We assume a threal model where an adversary has black-box access CP-Fuse, which wraps two potentially aopyright-iffringnng models. The attacker has access to the prompts used during fine-tuning, as well as prefix of the original story, and their goal is to have CP-Fuse regurgitate story memorized by one of the base models. We study the impact of increasing the prefix length on the exact match (EM) and BLEU score of the generated outputs. The results in Figure 5b show that CP-Fuse remains robust as the prefix length increases. Specifically, exact matching remains relatively stable, while there is slight increase in the BLEU score; however, is still significantly smaller than that observed in the overfitted models and baselines (Table [ In Appendix A.1I visualize the stories generated by CP-Fuse and show how they evolve given short and long prefix lengths. CP-Fuse consistently produces outputs that differ from the reference, thanks to its balancing mechanism that prevents any single model from dominating the generation process.

---

Published as a conference paper at ICLR 2025
0.25
Model
Split
EM
BLE
MomFrue (no preix)
0.20
Split Split 2
84.68
0.11
Split 1
0.15
21.79
0.03
0.10
Split Split
19.11
0.02
GL Split 2
120.28
0.16
Split Split 2
20.68
0.03
0
pronpt
256
$12
1024
1536
0.00
CP-Fuse
25.50
0.03
Characters
(a) Wrapping experiments with GL loss
(b) Prefix prompting experiments
Figure 5: Metrics for copyright infringement, exact matching (EM), and BLEU score (BLE) in the WritingP rompt dataset for (a) models trained with goldfish loss (GL) and CP-Fuse as wrapper, and (b) the effect of the prefix length CP-Fuse applied to overfitted models in the split 1.
5 CONCLUSIONS
In this paper, we introduced CP-Fuse, simple yet effective algorithm for copyright protection based on model fusion. We first demonstrated that CP-Fuse satisfies key properties for preventing the reproduction of memorized training samples. Additionally, we provided extensive evidence of its effectiveness in challenging scenarios involving overfitted models, where CP-Fuse significantly reduced the regurgitation of protected materials, outperforming other inference-time baselines without compromising the quality the generated code and text. The versatility CP-Fuse was demonstrated through its scamless integration with other training-time techniques that mitigate memorization. Finally, we showcased its robustness against standard prefix prompting extraction strategies.
It is important to note that CP-Fuse operates under the assumption of copyright separability. A potential avenue for future research is theoretically investigating CP-Fuse's 's performance when this assumption only partially holds. Moreover, it would be valuable to apply our algorithm in real- world scenarios involving larger models and genuine copyright-protecte content, such as books or songs.
ACKNOWLEDCEMENTS
JA and KD acknowledge support from the ETH Center. KD further acknowledges support from the ETH Foundations of Data Science. This work was done in part while FY was visiting the Simons Institute for the Theory of Computing. We extend our gratitude Javier Rando for insightful discussions and valuable feedback on the manuscript.
REFERENCES
Javier Abad, Konstantin Donhauser, Francesco Pinto, and Fanny Yang. Strong copyright protection for language models via adaptive model fusion. arXiv preprint arXiv:2407.20 2024.
Martin Abadi, Andy Chu, Ian Goodfellow, Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. GPT-4 technical report. arXiv preprint arXiv:2303.08774, 2023.
Michael Aerni, Javier Rando, Edoardo Debenedetti, Nicholas Carlini, Daphne Ippolito, and Florian Tramèr. Measuring non-adversarial reproduction of training data large language models. arXiv preprint arXiv:2411.10242 2024.
Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. Large-scale differen- tially private BERT. In Findings of the Association for Computational Linguistics: EMNLP 2022, pp. 6481 14491, 2022.
10

---

Published as a conference paper at ICLR 2025
Jacob Austin, Augustus Odena, Maxwell Nye, Maarten Bosma, Henryk Michalewski, David Dohan, Ellen Jiang, Carrie Cai, Michael Terry. Quoe Le, et al. Program synthesis with large language models. arXiv preprint arXiv22108.07732 2021.
Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), pp. 141-159. IEEE, 2021.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Frlingsson, al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pp. 2633-2650, 2021.
Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramèr, and Chiyuan Zhang. Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Representations. OpenReview, 2023.
Jiaao Chen and Diyi Yang. Unlearn what you want to forget: Efficient unlearning for LLMs. In The 2023 Conference on Empirical Methods in Natural Language Processing, 2023.
Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, Nick Ryder, Mikhail Pavlov, Alethea Power, Lukasz Kaiser, Mohammad Bavarian, Clemens Winter, Philippe Tillet, Felipe Petroski Such, Dave Cummings, Matthias Plappert, Fotios Chantzis, Elizabeth Barnes, Ariel Herbert-Voss. William Hebgen Guss, Alex Nichol, Alex Paino, Nikolas Tezak, Jie Tang, Igor Babuschkin, Suchir Balaji, Shantanu Jain, William Saunders, Christopher Hesse, Andrew N. Carr, Jan Leike, Josh Achiam, Vedant Misra, Evan Morikawa, Alec Radford, Matthew Knight, Miles Brundage, Mira Murati, Katic Mayer, Peter Welinder, Bob McGrew, Dario Amodei, Sam McCandlish, Ilya Sutskever, and Wojeiech Zaremba. Evaluating large language models trained code, 2021.
Tong Chen, Akari Asai, Niloofar Mireshghallah, Sewon Min, James Grimmelmann, Yejin Choi, Hannaneh Hajishirzi, Luke Zettlemoyer, and Pang Wei Koh. CopyBench: Mcasuring literal and non-literal reproduction of copyright-protecter text in language model generation. arXiv preprint arXiv:2407.07087 2024.
Cheng-Han Chiang and Hung- Yi Lee. Can large language models be an alternative to human evaluations? In Proceedings of the 6lst Annual Meeting of the Association for Computational Linguistics ( (Volume I: Long Papers), pp. 15607-15631, 2023.
Yonatan Dukler, Benjamin Bowman, Alessandro Achille, Aditya Golatkar, Ashwin Swaminathan, and Stefano Soatto. Safe: Machine unlearning with shard graphs. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 17108-17118, 2023.
Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends@ in Theoretical Computer Science, 9(34))221-405 2014.
Ronen Eldan and Mark Russinovich. Who's Harry Potter? approximate unlearning in LLMs. arXiv preprint 2xXx:233000022::: 2023.
Niva Elkin-Koren, Uri Hacohen, Roi Livni, and Shay Moran. Can copyright be reduced privacy? arXiv preprint arXiv:2305. 14822 2023.
Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 889-898, 2018
Jinlan Fu, See KionKiong Ng. Zhengbao Jiang, and Pengfei Liu. GPTscore: Evaluate as you desire. arXiv preprint arXiv:2302.nr 002602302..416666 2023.
11

---

Published as a conference paper at ICLR 2025
Aditya Golatkar, Alessandro Achille, Avinash Ravichandran, Marzia Polito, and Stefano Soatto. Mixed-privacy forgetting in deep networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 192-801, 2021.
Aditya Golatkar, Alessandro Achille, Luca Zancato, Yu-Xiang Wang. Ashwin Swaminathan, and Stefano Soatto. CPR: Retrieval augmented generation for copyright protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12374-12384, 2024.
Suchin Gururangan, Margaret Li, Mike Lewis, Weijia Shi, Tim Althoff, Noah A Smith, and Luke Zettlemoyer. Scaling expert language models with unsupervised domain discovery. arXiv preprint arXiv:2303.14177, 2023.
Abhimanyu Hans, Yuxin Wen, Neel Jain, John Kirchenbauer, Hamid Kazemi, Prajwal Singhania, Siddharth Singh, Gowthami Somepalli, Jonas Geiping, Abhinav Bhatele, et al. Be like a goldfish, don't t memorize! mitigating memorization in generative LLMs. arXiv preprint arXiv:2406.10200, 2024.
Peter Henderson, Xuechen Li, Dan Jurafsky, Tatsunori Hashimoto, Mark Lemley, and Percy Liang. Foundation models and fair use. arXiv preprint arXiv:2303. 15715, 2023.
Dan Hendrycks, Steven Basart, Saurav Kadavath, Mantas Mazeika, Akul Arora, Ethan Guo, Collin Burns, Samir Puranik, Horace He, Dawn Song, and Jacob Steinhardt. Measuring coding challenge competence with apps. NeurlPS, 2021.
Robert Hönig, Javier Rando, Nicholas Carlini, and Florian Tramèr. Adversarial perturbations cannot reliably protect artists from generative AI. arXiv preprint (xXi:2440.122277 2024.
Chan-Jan Hsu, Yi-Chang Chen, Feng-Ting Liao, Pei-Chen Ho, Yu-Hsiang Wang, Po-Chun Hsu, and Da-shan Shiu. Let's fuse step by step: generative fusion decoding algorithm with LLMs for multi-modal text recognition. arXiv preprint arXiv:2405. 142.5 2024.
Yangsibo Huang, Samyak Gupta, Zexuan Zhong, Kai Li, and Danqi Chen. Privacy implications of retrieval- language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, 2023.
Daphne Ippolito and Yun William Yu. DONOTTRAIN: A metadata standard for indicating consent for machine learning. In Proceedings of the 40th International Conference Machine Learning, 2023.
Daphne Ippolito. Florian Tramèr, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lec, Christopher A Choquette-Choo and Nicholas Carlini. Preventing generation of verbatim memo- rization in language models gives false sense of privacy. In Proceedings of the 16th International Natural Language Generation Conference, pp. 28-53. Association for Computational Linguistics, 2023.
Neel Jain, Ping-yeh Chiang, Yuxin Wen, John Kirchenbauer, Hong-Min Chu, Gowthami Somepalli, Brian R Bartoldson, Bhavya Kailkhura, Avi Schwarzschild, Aniruddha Saha, et al. NEFTune: Noisy embeddings improve instruction finetuning. In The Twelfth International Conference on Learning Representations, 2023.
Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. Knowledge unlearning for mitigating privacy risks in language models. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 14389-14408, 2023.
Mojan Javaheripi, Sébastien Bubeck, Marah Abdin, Jyoti Aneja, Sebastien Bubeck, Caio César Teodoro Mendes, Weizhu Chen, Allie Del Giorno, Ronen Eldan, Sivakanth Gopi, al. Phi-2: The surprising power of small language models. Microsoft Research Blog, 2023.
Dongfu Jiang, Xiang Ren, and Bill Yuchen Lin. LLM-BBender: Ensembling large language models with pairwise ranking and generative fusion. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 14165-14178. 2023.
12

---

Published as a conference paper at ICLR 2025
Xisen Jin, Xiang Ren, Daniel Preotiuc-Pies Pietto, and Pengxiang Cheng. Dataless knowledge fusion by merging weights language models. In The Eleventh International Conference on Learning Representations, 2023.
Nikhil Kandpal, Eric Wallace, and Colin Raffel. Deduplicating training data mitigates privacy risks in language models. In International Conference on Machine Learning, pp. 10697-10707. PMLR, 2022.
Antonia Karamolegkou, Jiaang Li, Li Zhou, and Anders Sógaard. Copyright violations and large language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pp. 7403-7412, 2023.
Seungone Kim, Juyoung Suk, Shayne Longpre. Bill Yuchen Lin, Jamin Shin, Sean Welleck, Graham Neubig, Moontae Lec, Kyungjae Lee, and Minjoon Sco. Prometheus 2: An open source language model specialized in evaluating other language models. arXiv preprint arXiv:2405.0/53: 2024.
Denis Kocetkov, Raymond Li, Loubna Ben Allal, Jia Li, Chenghao Mou, Carlos Muñoz Ferrandis, Yacine Jernite, Margaret Mitchell, Sean Hughes, Thomas Wolf, et al. The stack: 3 TB of permissively licensed source code. arXiv preprint arXiv:221..55333 2022.
Katherine Lee, Daphne Ippolito, Andrew Nystrom, Chiyuan Zhang, Douglas Eck, Chris Callison- Burch, and Nicholas Carlini. Deduplicating training data makes language models better. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 8424-8445, 2022.
Katherine Lee, A Feder Cooper, and James Grimmelmann. Talkin"bout Al generation: Copyright and the generative-Al supply chain. arXiv preprint ar XXi:22309008/33, 2023.
Raymond Li, Loubna Ben Allal, Yangtian Zi, Niklas Muennighoff, Denis Kocetkov, Chenghao Mou, Mare Marone, Christopher Akiki, Jia Li, Jenny Chim, et al. StarCoder: may the source be with you! arXiv preprint arXiv:2305.06161 2023.
Tianlin Li, Qian Liu, Tianyu Pang, Chao Du, Qing Guo, Yang Liu, and Min Lin. Purifying large language models by ensembling a small language model. arXiv preprint UrXiv22402.14844 2024.
Alisa Liu, Maarten Sap, Ximing Lu, Swabha Swayamdipta. Chandra Bhagavatula, Noah A Smith, and Yejin Choi. DExperts: Decoding-tine controlled text generation with experts and anti-experts. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 1 1ith International Joint Conference on Natural Language Processing ( (Volume I: Long Pupers), 2021.
Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Xiaojun Xu, Yuguang Yao, Hang Li, Kush R Varshney, al. Rethinking machine unlearning for large language models. arXiv preprint arXi::2402.08787 2024a.
Xiaoze Liu, Ting Sun, Tianyang Xu, Feijie Wu, Cunxiang Wang, Xiaoqian Wang, and Jing Gao. SHIELD: Evaluation and defense strategies for copyright compliance in LLM text generation. arXiv preprint arXiv:2406. /2955, 2024b.
Yang Liu, Dan Iter, Yichong Xu, Shuohang Wang, Ruochen Xu, and Chenguang Zhu, G-eval: NLG evaluation using GPT-4 with better human alignment. arXiv preprint arXiv:2303. 16634, 2023.
Jakub Lucki, Boyi Wei, Yangsibo Huang. Peter Henderson, Florian Tramèr, and Javier Rando. An adversarial perspective machine unlearning for Al safety. arXiv preprint arXiv:249..18025 2024.
Rien Maertens, Charlotte Van Petegem, Niko Strijbol, Toon Baeyens, Ame Carla Jacobs, Peter Dawyndt, and Bart Mesuere. Dolos: Language-agnostic plagiarism detection in source code. Journal of Computer Assisted Learning, 38(4): 1046- 2022.
Costas Mavromatis, Petros Karypis, and George Karypis. Pack of LLMs: Model fusion at test-time via perplexity optimization. arXiv preprint arXiv:2404. /1531, 2024.
13

---

Published as a conference paper at ICLR 2025
Matthieu Meeus, Shubham Jain, Marek Rei, and rons read your book? document-level membership inference for large language models. ArXiv, abs/23100.5000 2023.
de Montjoye. Did the neu-
Sewon Min, Suchin Gururangan, Eric Wallace, Weijia Shi, Hanmaneh Hajishirzi, Noah A Smith, and Luke Zettlemoyer. Silo language models: Isolating legal risk in a nonparametric datastore. In The Twelfth International Conference on Learning Representations, 2023.
Fatemehsadat Mireshghallah. Archit Uniyal, Tianhao Wang, David Evans, and Taylor Berg- Kirkpatrick. Memorization in NLP fine-tuning methods. In First Workshop on Pre-training: Perspectives, Pitfalls, and Paths Forward at ICML, 2022.
Felix Mueller, Rebekka Görge, Anna K Bernzen, Janna C Pirk, and Maximilian Poretschkin. LLMs and memorization: On quality and specificity of copyright compliance. arXiv preprint AXXV::2405.18492, 2024.
Francesco Pinto, Nathalie Rauschmayr, Florian Tramèr, Philip Torr, and Federico Tombari. Extracting training data from document- based VQA models. In Proceedings of the 41st International Conference Machine Learning. volume 235 of Proceedings of Machine Learning Research, pp.
ml 40813-40826. PMLR, 21-27 Jul 2024. URL htt.::://///pptt. //rppeee/ htw.:/r....s/ss/////// r....r../rs.5511 Sinto24a.html
Lutz Prechelt, Guido Malpohl, Michael Philippsen, et al. Finding plagiarisms among a set of programs with JPlag. J. Univers. Comput. Sci., 8(11):1016, 2002.
Matthew Sag. The new legal landscape for text mining and machine learning. Journal of the Copyright Society of the USA, 66:291, 2019.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 6048 6058, 2022.
Andrea Sottana, Bin Liang, Kai Zou, and Zheng Yuan. Evaluation metrics in the era of GPT-4: reliably evaluating large language models on sequence to sequence tasks. arXiv preprint wrXiv:2310.13800 2023.
Gemini Team, Rohan Anil, Sebastian Borgeaud, Yonghui Wu, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, et al. Gemini: family of highly capable multimodal models. arXiv preprint arXiv:2312. 2023.
Kushal Tirumala, Aram Markosyan, Luke Zetrlemoyer, and Armen Aghajanyan. Memorization without overfitting: Analyzing the training dynamics of large language models. Advances in Neural Information Processing Systems, 35:38274-38209 2022.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. LLaMa 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 2023.
Nikhil Vyas, Sham M Kakade, and Boaz Barak. On provable copyright protection for generative models. In International Conference on Machine Learning, pp. 35277-35299, PMLR, 2023.
Fanqi Wan, Xinting Huang, Deng Cai, Xiaojun Quan, Wei Bi, and Shuming Shi. Knowledge fusion of large language models. arXiv preprint 2401::2401.10491 2024.
Hongyi Wang, Felipe Maia Polo, Yuekai Sun, Souvik Kundu, Eric Xing, and Mikhail Yurochkin. Fusing models with complementary expertise. In Annual Conference on Neural Information Processing Systems, 2023.
Boyi Wei, Weijia Shi, Yangsibo Huang, Noah A Smith, Chiyuan Zhang, Luke Zettlemoyer, Kai Li, and Peter Henderson. Evaluating copyright takedown methods for language models. arXiv preprint a40iv:2406. 18664, 2024.
14

---

Published as a conference paper at ICLR 2025
Mitchell Wortsman, Gabriel Ilharco, Samir Ya Gadre, Rebecca Roelofs, Raphael Gontijo-Lopes Ari Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Korblith, et al. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In International conference on machine learning, pp. 23965-23998. PMLR, 2022.
Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. Defending ChatGPT against jailbreak attack via self-reminders. Nature Machine Intelligence. 5(12):1486-149, 2023.
Prateek Yadav, Derek Tam, Leshem Choshen, Colin A Raffel, and Mohit Bansal. Ties-merging: Resolving interference when merging models. Advances Neural Information Processing Systems, 36, 2024.
Haonan Yan, Xiaoguang Li, Ziyao Guo, Hui Li, Fenghua Li, and Xiaodong Lin. ARCANE: An efficient architecture for exact machine unlearning, In IJCAI, volume 6, pp. 19, 2022.
Zhiyuan Yu, Yuhao Wu, Ning Zhang, Chenguang Wang, Yevgeniy Vorobeychik, and Chaowei Xiao. CodeIPPrompt: Intellectual property infringement assessment of code language models. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (eds.), Proceedings of the 40th International Conference on Machine Learming, volume 202 of Proceedings of Machine Learning Research, pp. 40373-40333 PMLR, 23-29 Jul 2023.
Chiyuan Zhang, Daphne Ippolito, Katherine Lee, Matthew Jagielski, Florian Tramer, and Nicholas Carlini. Counterfactual memorization in neural language models. Advances in Neural Information Processing Systems, 36:39321-39366 2023.
Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. Negative preference optimization: From catastrophic collapse to effective unlearning. arXiv preprint arXiv:2404. 05868, 2024a.
Yifan Zhang, Yifan Luo, Yang Yuan, and Andrew C Yao. Autonomous data selection with language models for mathematical texts. In ICLR 2024 Workshop Navigating and Addressing Data Problems for Foundation Models, 2024b.
Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Eric Xing, al. Judging LLM-as-a-judge with MT-Bench and Chatbot Arena. Advances in Neural Information Processing Systems, 36, 2024.
15

---

Published as a conference paper at ICLR 2025
TABLE OF CONTENTS
Additional experiments
17
A.1
Additional metrics for copyright infringement
17
A.2
Perplexity results
A.3
Experiments with GPTT22 XL and Phi-2
21
A.4
CP-Fuse with temperature sampling decoding
................................
A.5
Wrapping early-stopped models with CP-Fuse
................................
22
A.6
Ablation studies for the grid size
23
A.7
Visualizing the balancing property and the parameters a, and
24
A.8
CP-Fuse combining three models
25
A.9
Comparison of outputs generated by CP-Fuse and CP-A
26
A. 10 Comparison outputs generated by CP-Fuse and MemFiree
................................
34
A.11 Example of outputs under prefix prompting extraction
38
Discussion on the separability of copyright assumption
39
Proofs
40
Proof of Lemma 3.3
40
Implementation details
D.I
Computational resources
40
D.2
Fine-tuning details
D.3
Decoding details
41
4
Datasets
42
D.5
Baselines
42
D.6
Metries
42
D.6.1
Copyright infringement
42
D.6.2 Utility
44
16

---

Published as a conference paper at ICLR 2025
APPENDICES
The following appendices provide additional results and discussions, deferred proofs, and experimen- tal details.
A ADDITIONAL EXPERIMENTS
A.1 ADDITIONAL METRICS COPYRIGITT INFRINGEMENT
First, we report in Table 1 the full results with JPlag (Prechelt et al. 2002) and Dolos (Maertens et al. 2022) the specialized software plagiarism metrics for the Pyt Python instructions dataset. The additional results with Dolos are consistent with those of JPlag, which were already reported in the main text; that is, CP-Fuse shows the lowest score and is hence the least likely to infringe on copyright in code generation.
We also present the complete results for the
metrics for StarCoder in the Python Instructions dataset (Table and for the LLaMa2 model in the Mathabatracts (Table 5 and MonttngPrroptts (Table 6 datasets, along with additional metries. Specifically, include Jaccard and cosine similarities, and the METEOR score measure approximate memo- rization, as well as semantic similarity for a higher-level measure that does not necessarily indicate copyright infringement. We report results for the overfitted models, the baselines, and CP-Fuse. We include additional results on a test set comprising 500 prompts.
confirm the observations from the main text, closely aligning with previous metrics: CP-Fuse is consistently the best or (less often) second-best method. The semantic similarity for CP-Fuse and baselines remains consistently high, comparable to that of the overfitted models, suggesting that no semantic information is lost when applying these methods.
Results using Jaccard and cosine similarities and the METEOR
Finally, for completeness, Table shows the exact matching above the 95th percentile for StarCoder models trained on the APPS dataset. CP-Fuse continues to be effective in reducing regurgitation in this setting.
Table 3: Dolos and JPlag plagiarism metrics for the Python instruct ons dataset. J Means lower better, we highlight bold the best method for each split and metric.
Model
Split
JPlagl
Dolos
Split
1.00
1.00
Overfit Split
Split
0.01
0.35
Test
0.02
0.39
Split
0.01
0.40
Overfit Split 2
Split
0.99
1.00
Test
0.01
0.32
Split
1.00
1.00
System Prompt
Split
0.99
1.00
Test
0.01
0.34
Split
0.99
0.98
MemFree
Split
0.96
0.99
Test
0.01
0.27
Split
1.00
1.00
CP-A
Split 2
0.99
1.00
Test
0.01
0.37
Split
0.03
0.70
CP-Fuse (Ours)
Split
0.03
0.71
Test
0.01
0.37
17

---

Published as a conference paper at ICLR 2025
Table 4: Copyright-infrinn infiinffriggeeent metrics averaged at the 95th percentile for StarCoder in the Python instructs 1 ion datasct across different data splits. The table presents results for the overfitted models, SystemPrompt,, MemFree, CP-A, and CP Fuse. Metrics include Exact Matching (EM). Normalized Levenshtein Distance (LEV). Jaccard Similarity (JAC), Cosine Similarity (COS), Semantic Similarity (SEM), ROUGE-L (ROU), BLEU Score (BLE), METEOR Score (MET),
LEV
0.00
0.56
0.55
0.55
0.00
0.54
0.01
0.00
0.52
0.03
0.03
0.59
0.01
0.02
0.50
0.25
0.30
0.55
SEM
1.00
0.97
0.97
0.98
1.00
0.97
1.00
1.00
0.97
1.00
1.00
0.97
1.00
1.00
0.97
0.99
0.99
0.97
COS 4
1.00
0.56
0.62
0.60
1.00
0.58
1.00
1.00
0.60
0.95
0.94
0.58
1.00
1.00
0.61
0.77
0.74
0.59
JAC
1.00
0.27
0.29
0.25
1.00
0.27
1.00
1.00
0.29
0.82
0.82
0.27
1.00
1.00
0.31
0.54
0.52
0.29
MET
1.00
0.34
0.38
0.32
1.00
0.36
1.00
1.00
0.37
0.92
0.92
0.33
1.00
1.00
0.40
0.67
0.66
0.34
BLE
1.00
0.12
0.12
0.10
1.00
0.10
0.99
1.00
0.14
0.79
0.77
0.10
1.00
1.00
0.12
0.39
0.37
0.09
and Infringement Count (ICso. (C)s)) + Means lower better. i means higher better.
ROU
1.00
0.48
0.50
0.46
1.00
0.51
1.00
1.00
0.50
0.97
0.98
0.46
1.00
1.00
0.58
0.78
0.77
0.52
IC160 4
1310.80
0.05
0.00
0.00
1257.80 70
0.16
1201.66
.6.
1214.16
0.50
1.11
0.65
0.02
136.52
152.64
0.03
0.96
0.23
0.00
IC +
1427.2 20
0.95
1.03
0.79
1380.96 96
1.11
1319.32
1331.32
1.73
193.96
190.81
0.72
312.28
337.28
1.20
80.62
2.426
0.40
1469. 80
44.60
54.38
42.64
1393.8 88
53.26
1360.68
1373.16
72.44
165. 48
157.36
52.33
273.20
284.80
$7.50
69.58
68.04
40.00
EM
Python instruction ions
Split 2
Split 2
Split 2
Split 2
Split
Test
Split
Split
Test
Split
Split
Test
Split
Test
Split
Test
Split
Test
MemFree
FP-Fuse (Ours)
Overfit Split
Overfit Split
System Prompt
CP-A
11

---

Published as a conference paper at ICLR 2025
Table 5: Copyright- infringement metrics (as in Table for LLaMa2 models in the Mat haasthactrrr.. dataset. J. Means lower is better, 1 higher better.
LEV 1
0.00
0.70
0.71
0.68
0.00
0.69
0.00
0.00
0.69
0.53
0.53
0.70
0.30
0.51
0.67
0.62
0.63
0.68
SEM 4
1.00
0.98
0.98
0.98
1.00
0.98
1.00
1.00
0.98
0.99
0.99
0.99
0.99
0.98
0.98
0.98
0.98
0.98
COs
1.00
0.76
0.75
0.77
1.00
0.76
1.00
1.00
0.75
0.80
0.82
0.76
0.89
0.86
0.77
0.80
0.81
0.77
JAC
1.00
0.17
0.16
0.19
1.00
0.19
1.00
1.00
0.19
0.31
0.31
0.19
0.61
0.35
0.21
0.26
0.24
0.19
MET
1.00
0.24
0.23
0.27
1.00
0.26
1.00
1.00
0.27
0.41
0.39
0.28
0.64
0.40
0.26
0.30
0.31
0.25
BLE
1.00
0.01
0.04
0.08
1.00
0.07
0.99
1.00
0.06
0.23
0.22
0.07
0.58
0.30
0.07
0.14
0.14
0.07
ROU
1.00
0.25
0.22
0.27
1.00
0.26
1.00
1.00
0.25
0.44
0.45
0.26
0.72
0.50
0.29
0.35
0.34
0.28
IC160
1482. 84
0.00
0.00
0.00
1688.72
0.00
1040.24
1024.76
0.00
0.00
0,00
0.00
253.4
1.66
0.00
0.00
0.00
0.00
IC50
1595. 12
0.02
0.00
0.17
7798.72
0.07
1155.36
1143.56
0.07
25.04
29.31
0.09
408 72
162.60
0.01
15.14
0.378
0.01
EM +
1397.68 68
31.00
28.76
42.12
1570.88
37.48
1022.72
1005.20
36.44
111.12
99. 40
39.32
341.60
162.80
39.91
55.54
48.74
35.59
Ma tethhbsstract....
Split
Split
Test
Split Split
Test
Split
Split 2
Test
Split
Split 2
Test
Split
Split
Test
Split
Split 2
Test
MemFree
CP-Fuse (Ours)
Overfit Split
Overfit Split 2
System Prompt
CP-A
19

---

Published as a conference paper at ICLR 2025
Table 6: Copyright- infringement metrics (as in Table 4 for LLaMa2 models in the Wz it WettingProo womprroottttt dataset. J. Means lower is better, 1 higher better.
LEV 1
0.00
0.71
0.71
0.70
0.00
0.71
0.00
0.00
0.71
0.55
0.55
0.71
0.70
0.70
0.71
0.70
0.70
0.71
SEM
1.00
0.99
0.99
0.99
1.00
0.99
1.00
1.00
0.99
0.99
0.99
0.99
0.99
0.99
0.99
0.99
0.99
0.99
cOs +
1.00
0.68
0.71
0.70
1.00
0.68
1.00
1.00
0.67
0.78
0.78
0.71
0.70
0.70
0.70
0.70
0.68
0.71
JAC
1.00
0.15
0.15
0.15
1.00
0.16
1.00
1.00
0.14
0.28
0.27
0.15
0.16
0.16
0.15
0.16
0.16
0.15
BLE J. MET
1.00
0.25
0.24
0.24
1.00
0.24
1.00
1.00
0.22
0.37
0.38
0.24
0.24
0.24
0.25
0.24
0.24
0.25
1.00
0.03
0.02
0.02
1.00
0.03
1.00
1.00
0.02
0.20
0.19
0.02
0.05
0.04
0.02
0.02
0.03
0.02
ROU
1.00
0.18
0.18
0.17
1.00
0.18
1.00
1.00
0.17
0.37
0.38
0.17
0.21
0.20
0.18
0.18
0.19
0.18
1569.71
1275.84
1250.52
1118.64 1.8.64
IC
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
1679.71
1385.84
1464.72
1267.52
IC5o
0.12
0.00
0.15
0.00
0.00
7.5
0.29
0.00
0.70
0.30
0.00
0.22
0.16
0.00
EM
1316.24
22,59
16.89
26.11
1141 1888
23.60
1118.36
1092.20
14.58
63.84
59.04
14.25
37.40
31.29
16.22
27.55
25.50
16.04
Wri t winggnrree Peneinnrooppp rompt
Split
Split
Test
Split Split
Test
Split Split
Test
Split
Split
Test
Split
Split
Test
Split
Split
Test
MemFree
CP-Fuse (Ours)
Overfit Split
Overfit Split 2
System Prompt
CP-A
20

---

Published as a conference paper at ICLR 2025
Table 8: Perplexity score for meth-
Table 7: Perplexity (PPL) and Exact Matching (EM) for methods on APPS across splits.
ods on Python instruct ions and MathAbstracts datasets across splits.
APPS
Perplexity
Model
Split
PPL1
EM4
Python Inst.
Math Abstracts
Model
Split
Split 1
1.11
333.64
Overfit Split
Split 2
1.15
113.56
Split
1.01
1.22
Overfit Split
Test
1.16
57.91
Split
1.13
1.43
Test
1.12
1.41
Split I
1.15
104.36
Overfit Split 2
Split 2
1.11
322.64
Split
1.13
1.23
Overfit Split 2
Test
1.19
58.00
Split 2
1.01
1.01
Test
1.13
1.23
Split 1
1.14
137.00
CP-A
Split 2
1.14
140.04
Split
1.12
1.45
Test
1.17
58.50
CP-A
Split 2
1.11
1.47
Test
1.16
1.54
Split 1
1.14
104.67
CP-Fuse (Ours)
Split 2
1.14
113,88
Split
1.17
1.59
CP-Fuse (Ours)
Test
1.16
57.18
Split
1.17
1.61
Test
1.18
1.61
A.2 PERPLEXITY RESULTS
As is standard in the literature and for completeness, we report perplexity results on the Python instructt ions and Mat MathAbst wwwsstaatttt.............a plexity scores across different splits. While it is slightly higher than that of CP-A, this is likely due to the regurgitation of memorized sequences by CP-A, which is achieved with very low perplexity scores (close to 1.0). This is, example, the case with the overfitted models in their fine-tuning splits, where the perplexity is close to 1.0 due to the memorization of large segments of text. CP-Fuse thus succeeds in generating low cow-perplexity code and text, which ultimately useful and high-quality based on the full experimental results, i.c., code generation and writing fluency (see Section 4.2
racts s datasets in Table CP-Fuse maintains competitive per-
Table 7 provides results on the AP2S dataset, where the perplexity achieved by CP-Fuse similar to that obtained by the overfitted models in the splits not used for their fine-tuning.
A.3 EXPERIMENTS WITH GPT-2 XL AND P111-2
We present additional results with GPT-2 XL., 1.5B parameter version of GPT-2, and the Phi-2 model (Javaheripi et al.) 2023). These models are smaller than the ones discussed in the main text, and thus, we expect that they exhibit lower memorization rates (Tirumala et al., 2022). We report exact matching to measure copyright infringement and the perplexity score for the overfitted models, the baseline CP-A, and our method CP-Fuse.
Table shows a similar trend compared to the results from Section 4
Specifically, the CP-A baseline regurgitates memorized strings that are twice large as those produced by method. The exact matching for our method is similar to the exact matching of models on splits that have not been used for their training and thus not copyright-infringinn Furthermore, both method and CP-A show competitive perplexity.
A.4 CP-FUSE WITH TEMPERATURE SAMPLING DECODING
conducted additional experiments on the Python instructions dataset using StarCoder models and on the Writ SrriiingPrre inggrompts dataset using LLaMa2, using sampling decoding strategy with a temperature of T = 1.3. A temperature greater than one increases the entropy of the output distribution. The results in Table 10 very close those obtained with greedy decoding. In particular, the the added randomness in the decoding process. Importantly, utility in terms of fluency is sacrificed.
metrics are either very similar or slightly better, likely due to
21

---

Published as a conference paper at ICLR 2025
Table Perplexity (PPL) and Exact Matching (EM) averaged the the 95th percentile for GPT-2 XL and Phi-2 across fine-tuning and test splits of the MathAbstracts dataset. We report results for the overfitted models, CP-A, and CP-Fuse.
GPT-2 XL
Phi-2
Model
Split
PPL
EM
PPL.
EM
Split
1.10
1521.76
1.24
1369.16
Overfit Split
Split 2
1.44
38.48
1.34
33.55
Test
1.44
39.80
1.35
30.04
Split
1.45
37.14
1.33
29.80
Overfit Split 2
Split 2
1.28
1344.20
1.23
1296.04
Test
1.45
39.18
1.33
32.27
Split
1.48
72.54
1.41
82.44
CP-A
Split 2
1.47
113.20
1.41
89.12
Test
1.49
42.79
1.44
36.18
Split 1
1.51
45.24
1.46
41.76
CP-Fuse (Ours)
Split 2
1.51
57.61
1.46
45.96
Test
1.51
40.48
1.49
34.50
These results suggest that the balancing properties observed with greedy decoding also apply when using alternative strategies like temperature sampling.
Table 10: averaed at the 95th percentile across fine-tuning splits and fluency for the split of the Python Instructs ions and Wr t iigtinnggg wingroopppss rompt s datasets. We present results for overfitted models and CP-Fuse, using two decoding strategies: greedy decoding and temperature sampling.
Copyright-infringemnt
metrics-Exxan Matching (EM) and BLEU scores
Python EMG
Instrocionns BLE
WritingB rompts
Model
Split
EM,
BLE
Fluencyt
Split
1469.80
1.00
1316.24
1.00
NA
Overfit Split
Split 2
44.60
0.12
22.59
0.03
NA
Test
54.38
0.12
16.89
0.02
2.17
Split
42.64
0.10
26.11
0.02
NA
Overfit Split 2
Split 2
1393.88
1.00
1141.88
1.00
NA
Test
53.26
0.10
23.60
0.03
2.16
Split
69.58
0.39
27.55
0.02
NA
CP-Fuse (Greedy)
Split 2
68.04
0.37
25.50
0.03
NA
Test
48.80
0.11
16.04
0.02
2.17
Split I
65.84
0.35
28.88
0.02
NA
CP-Fuse (Sampling)
Split 2
60.08
0.31
19.46
0.03
NA
Test
39.13
0.06
17.59
0.01
2.16
A.5 WRAPPING EARLY-STOPPED MODELS WITH CP-FUSE
In this section, we present additional experiments using CP-Fuse as a wrapper for other techniques that mitigate memorization training-time. We demonstrate how method enhance protection for carly-stopped models. Specifically, we stop fine- tuning upon detecting an increase in memorization, is common practice in the literature (Mireshghallah et al. 2022). We include results with StarCoder on the Python inst ruct ions dataset, and with LLaMa2, GPT-2 XL, and Phi-2 models on the Mat MathAbstrrats dataset.
We apply both the baseline CP-A and CP-Fuse on top of the carly-stopped models. We observe that CP-Fuse further reduces the regurgitation of memorized training samples (e.g., by factor of 3 for
22

---

Published as a conference paper at ICLR 2025
StarCoder) and, in some cases, improves perplexity (e.g., for Phi-2), while consistently outperforming CP-A. Both methods achieve similar perplexity scores, comparable to the overfitted models on unseen splits.
Table 11: Perplexity (PPL) and Exact Matching (EM) at the 95th percentile for StarCoder (Python instruct i ions), Phi-2, GPT-2 XL. and LLaMa2 (Ma shathhbbttaa ractss))) across fine-tuning and test splits. We report results for the early-stopped (ES) models, the baseline CP-A, and CP-Fuse.
StarCoder
Phi-2
GPT-2 XL
LLaMa2
Model
Split
PPL.
EM
PPL
EMI
PPL
EM]
PPL
EM,
Split
1.26
159.36
1.56
41.71
1.79
65.83
1,46
207.44
ES Split
Split 2
1.30
39.23
1.60
41.08
1.78
41.68
1.50
46.87
Test
1.30
51.71
1.60
42.35
1.82
39.68
1.52
44.83
Split
1.25
31.96
1.66
45.71
1.60
38.60
1.49
44.76
ES Split
Split 2
1.24
145.04
1.67
46.56
1.59
60.60
1.40
280.20
Test
1.27
43.74
1.67
40.88
1.60
40.78
1.47
44.65
Split
1.29
70.17
1.50
44.77
1.70
50.14
1.46
68.84
CP-A
Split 2
1.29
59.04
1.54
46.96
1.70
49.00
1.45
61.48
Test
1.30
48.12
1.55
42.38
1.70
43.00
1.46
45.79
Split
1.29
46.96
1.58
44.10
1.69
43.82
1.52
52.21
CP-Fuse (Ours)
Split 2
1.29
44.50
1.61
43.58
1.71
51.62
1.52
53.30
Test
1.29
49.43
1.59
41.62
1.73
43.78
1.53
45.00
A.6 ABLATION STUDIES FOR THE GRID SIZE
We conduct ablation studies on the grid size used for solving the optimization problem in Equation (2) Specifically, we keep steps in the interval [2, 10] and study the sensitivity our method to number of steps in the interval [0, 2).
Table 12 shows the perplexity and average exact matching (above the 95th percentile) for different numbers of steps. Remarkably, for StarCoder and Phi-2, we observe similar levels of memorization metrics while perplexity decreases (i.e., better) for smaller grids. Note that using smaller grids accelerates the decoding process. Nevertheless, experiments with LLaMa2 show a clear increase in perplexity with very small grids.
Table 12: Ablation Study: Perplexity (PPL) and Exact Matching (EM) at the 95th percentile for StarCoder (Python instructions), Phi-2, and LLaMa2 (MathAbstracts) with different grid sizes for CP-Fuse.
StarCoder
Phi-2
LLaMa2
Grid Size
Split
PPL/
EM
PPL.
EMJ
PPL
EM
Split
1.09
86.75
1.18
45.56
2.41
57.52
2
Split 2
1.09
81.08
1.18
44.39
2.52
46.04
Test
1.10
47.42
1.19
34.65
2.52
36.84
Split
1.17
94.20
1.39
45.30
1.59
59.48
+
Split
1.17
65.84
1.40
45.90
1.61
48.88
Test
1.18
47.92
1.40
33.84
1.64
34.95
Split
1.19
89.88
1.46
41.76
1.63
55.54
10+9
Split
1.19
72.92
1.46
45.96
1.64
48.74
Test
1.20
48.80
1.49
34.50
1.67
35.59
Split Split 2
1.20
90.42
1.51
44.82
1.65
57.67
20 +
1.21
70.48
1.51
46.57
1.68
48.45
Test
1.21
47.64
1.54
35.29
1.68
35.21
23

---

Published as a conference paper at ICLR 2025
A.7 VISUALIZING THE BALANCING PROPERTY AND THE PARAMETERS &y AND B0
In Figure we plot the log densities llgel (t), log (ogg(t) (ysalar), and log (ogp()(vsr(()) [x] for both CP-Fuse and CP-A for a sequence generated by both models given a prompt æ contained in the second fine-tuning split. As we can see, for CP-Fuse, the balancing property from Lemma 3.3 ensures that the generated sequence has approximately the same log probability for both base models, log p (yselz))
( In contrast, the sequence generated by CP-A occurs more likely under log ( (yge (z)), which overfitted on the prompt 2, than log ( (ygr ()
(z). This makes CP-A more vulnerable to replicating text memorized by log p (Vge as we observed in our experiments.
Sequence Log- Likelihood
-5
-50
-75
-
100
CP-Fuse
-125
150
CP-A
175
PCP
200
20
40
60
80
100
120
140
Generated Token
Figure 6: (Same Figure 2 Log-likelihood for the sequence produced by CP-Fuse and CP-A, and the corresponding base models y(4) and p(2) at each token in greedy decoding. For each method, plot the cumulative sum of the log probabilities of generating the sequence at each token, together with the cumulative sum of the log probabilities that same sequence under the base models. Due to the balancing property, CP-Fuse achieves log pggpp"))u ( = log p()) (V<elaz) all steps of the generation, indicating that the tokens produced by CP-Fuse are roughly equally likely under both base models, hence preventing the reproduction of memorized samples. In contrast, CP-A places significantly more weight the second model p()), as evidenced by the much higher log- likeelioooodd of the generated tokens under (2)) compared to p(t).
we illustrate how the parameters or and 3r adaptively change during the generation of an output via greedy decoding. We observe the consequences of the balancing property (Lemma 3:3): when one model heavily dominates the generation process, our algorithm increases the weight of the other model to the point that the generation independent of the dominating model. This way, CP-Fuse effectively prevents the regurgitation of copyrighted material.
In Figure 7
10
25
50
125
150
175
200
20
60
80
100
120
140
160
Generated Token
Gemerated Token
Figure 7: Evolution of the parameters or and 3, during greedy decoding. We randomly sampled six examples of text generated by our method CP-Fuse, combining overfitted Phi-2 models on the MathAbstra ract dataset. When the parameters plateau at the end the sequence, CP-Fuse only generates the padding token.
24

---

Published as a conference paper at ICLR 2025
A.8 CP-FUSE COMBINING THREE MODELS
In this section, we show additional experimental results where we apply CP-Fuse to combine three overfitted models fine-tuned for 50 epochs disjoint splits of the Pythen Instructions dataset. Instead of solving Equation (2) for all three models directly, we solve it for each pair, obtaining coefficients a and for all combinations each decoding step. We then select the combination with the smallest loss, corresponding to the minimizer in Lemma that is closest to the respective combined two models.
Table 13 presents the results for the overfitted models and the CP-Fuse algorithm applied to all possible two-way combinations and to the three overfitted models together. CP-Fuse using all three models yields the best performance across multiple metrics, exhibiting the smallest Exact Matching, BLEU scores, JPlag plagiarism metric, and the largest normalized Levenshtein distance for the splits used for fine-tuning. For example, outperforms CP-Fuse (1 & 2) (reported in the main text) in all splits except split 3 since it was not used for the fine-tuning of any CP-Fuse (1 & 2)'s base models.
Table 13: Copyright-infringened Levenshtein distance (LEV), and JPlag (JP) averaged at the 95th percentile across three fine-tuning splits the Python Inst Instructs restrructii ions. Results are presented for overfitted models and CP-Fuse, fusing all possible two-way combinations and the three overfitted models.
metrics: Exact Matching (EM), BLEU scores (BLE), normalized
Python Instruct ions
Model
Split
EM4
BLE
LEVt
JP
Split
1469.80
1.00
0.00
1.00
Overfit Split
Split
44.60
0.12
0.56
0.01
Split 3
54.38
0.12
0.55
0.02
Split
42.64
0.10
0.55
0.01
Overfit Split
Split 2
1393.88
1.00
0.00
0.99
Split 3
53.26
0.10
0.54
0.01
Split
48.67
0.11
0.59
0.02
Overfit Split 3
Split 2
39.44
0.07
0.58
0.01
Split
1447.60
1.00
0.00
1.00
CP-Fuse (1 & 2)
Split
69.58
0.39
0.25
0.03
Split 2
68.04
0.37
0.30
0.03
Split
30.48
0.11
0.55
0.01
CP-Fuse & 3)
Split
67.17
0.38
0.31
0.03
Split 2
30.84
0.05
0.58
0.01
Split
67.40
0.46
0.26
0.02
CP-Fuse (2 &
Split
32.84
0.10
0.55
0.01
Split
63.68
0.32
0.34
0.03
Split 3
68.30
0.41
0.29
0.03
CP-Fuse (1, 2 3)
Split
64.71
0.34
0.34
0.02
Split 2
60.04
0.30
0.34
0.02
Split
41.78
0.21
0.45
0.01
25

---

Published as a conference paper at ICLR 2025
A.9 COMPARISON OF OUTPUTS GENERATED BY CP-FUSE AND CP-A
We present output examples generated by our method and compare them with the overfitted model, the baseline CP-A, and the base model without fine-tuning. All examples are randomly sampled.
Figures 8 TO and 9 display outputs generated for the Python instruct: ons dataset. The overfitted model exactly replicates the original code in all three examples, serving as benchmark for evaluating memorization. The CP-A algorithm produces code closely resembling the original, with near-exact match in Figure and [ and an exact reproduction of comment with link in Figure T0 In contrast, CP-Fuse generates different code that is correct and arguably of higher quality, incorporating exception handling and new features, such as the selection of statistics in Figure The early-stopped model produces low-quality code, often oversimplifying tasks (Figure g and and committing syntax errors, such as an open quotation in Figure T0 Finally, fails to generate code, instead producing natural nonsensical text (Figure 8 and 9 underscoring the necessity of fine-tuning, though it can occasionally generate correct output as in Figure I0] Figures [] and 12 show outputs generated from the Writ inggP compt CP-Fuse and CP-A generate stories that are original and significantly different from those produced by the overfitted models. Figures 13 [4 illlusstrae outputs generated for MathAbst caabstracte Both CP-Fuse and CP-A generate reasonable, high-quality text; however, CP-A reproduces substantially more memorized content compared CP-Fuse. Finally, the base model fails generate coherent or fails the task.
base model frequently
Prompt: How would you code function in Python 3 to set data for outgoing stream
Copyright-infringing model:
(saif,, data, addr=0:
1f selt, masti_nne_aytee lon (data)
salse ValueErrer('' of data (sd byzeal is too big foz nanory (td bytea)" (Landdata), selr. nen_eytes)
int.. ponff soot" ap1 adda, data:
CP-Fuse:
set_sacsioeit, datal:
if self, data bytes:
solt._por. (rstt
tTys
selt._oot BytosIO (dsta)
except TypeErcor:
StringiD(datss
CP-A:
def dat tawll data, addre0): welf byn Ien
salle Val ueltrrrr if siie of data (ld bytesi too big for nenory (ed bytes)" Ilenddatll self, nen bybes))
inif weiiee pont adde, data)
Early-stopped model:
def aet_ (soir, data):
solf.data data apll.updal.())
Base model:
bb j/summary iP? Answer: B "'python stream.data data
i/pè //etails; Q10. Which of the following is a valid way to create dictionary in Python 3? [[] 'dict [] 'dict new dict()' [[ 'dict new diet() [] 'dict new dict()*
iP Answer: B "'python dict= ". :/p; i/details
Q11. [...]
Figure 8: Example of text generated by the overfitted, copyright-infringing model, CP-Fuse, CP-A, early-stopped model, and the base model for the Python instructions dataset using StarCoder models.
26

---

Published as a conference paper at ICLR 2025
Prompt: How would you implement a function in Python that calculates the mean heart rate in beats per minute from set of intervals
Copyright-infringing model:
calc_ntean (cx, CamNione, sit Nonon,, nax_crmNone, sonottiiee kengles")
if not Jon((x) Soturn
22:2E nin_rr]
if nex_er is not Nome:
selae nax_e]]
nean_er
meen_hr
awan_re
0
Convest Lo Spm if re_units e* "sanoles"s
11
neanghr Ex
mean_he
CP-Fuse:
ha (solc, EX, Ia=Nona, windox-None, N_ftz=Nona, nean_ nean"' **kwarga) if not sel2.1s_st_sett (sz)
20tutn
solf.fs
1t window 15 None:
window selc.window
r_ttt sa-t-n_Ftt
if nean_tyse ear se'moan's
1
mean (p.ncan(er)
elif sean_type median"
mean np.nedian clif mesn_type mode" mean np.node
else:
VelucErrce!
"Caknown near_type: (1 fosmat (nean_type)]
9
nean_hr 60 dutattaaaaiaaa windawiiindow, n_ftton_tet) nean
CP-A:
det csic_meen_hriiee to-None, Honerr-Hone, nax_Fr=None, rr_unite"' samples")s securn
it nin_rr 15 not None:
nax_sr nin_rrl
zr re nax_rr] mean_Er ap.mean Corvest apm
if ri_units samples' mean_hr nean_hr to
Early-stopped model:
interval intervale): def
1f Len Lenter intervain) 0:
mean interval = iunttr_.rteevvlll / len (on(rriineevvil
meen_rr_interval
Base model:
The file format is simple text file with one number per line. The output should be single number, the mean heart rate in beats per minute. The program should be able to handle a file with any number of lines. The program should be able to handle file with no lines. The program should be able to handle file with a single line. The program should be able to handle file with single number. [...]
Figure 9: Example of text generated by the overfitted, copyright-infringing model, CP-Fuse, CP-A, the early-stopped model, and the base model for the Python instructions dataset using StarCoder models.
27

---

Published as a conference paper at ICLR 2025
Prompt: Write a Python function for reading package file as text to get name and version
Copyright-infringnng model:
def
read_cllef (Il.oniae(ceeee) adding encoding optica
intentionally
awe
hetpp:///schhbb conp:ppa///aaa/a///aaaapaaa http://///..oe00111oommmmaa----0
hore po.peth, abopath los. pos.path. cirnani [ (ile_!)
coderss.owe (os-pachi, join (heze, "gppplig__ommplee"" filenans), securn readd:
CP-Fuse:
(patthh
intentionallg ignoring errocs heze, as vo vant to know it the file existo package_tiik tile open (path, "c*)
facker__fila.radt(
peskagg_tile.2.csorr
natch re.searcais" "naee,, versions.*", package_oentent)
if natch:
grouF
version group (2)
setuEn name, varsion
else:
BuntineError ("Unabla dasernine and version format (path)
CP-A:
def read [lle(=llenana
intent ionelly addiigg encuding optionn open
see here:
https://gt /ighttin wwwppopp/////ttteee/oeeee werrtteeee//eee sttrr///ssue//000 /5014 sesuecmmentt-31445 path.cirrane (rile_.)
open (ps.pass, join there, "VERSION") )1
version F. read () .trtiig t) return version
strly-stopped model:
del paackpp E:le/ (illenan)):
with (ooonf2llonnee, (2") as
matchh re.oearcia fe Varmaae wwrewar (1, contwal)
if natch 18 not None:
met.ch.group122
salse Ront neferror I' Could not find package name Ref & Fi enemet matchh reusearch jef /e aaverra ionta (IV *13 1.1,)A1, content) if natch not Nones
0
match.groug
wlaws
salee Ront ieeeroo If Could not tind package version in Bo" ti-enamet verslon
Base model:
def read_pky_ rile (Filenanc):
with opea
securn r.redd:)
def vocams_and_vrriicntaa
pkg_file filllookgggglleeeeeeeeeee
sane_and_version barc_ond__errionn:
waw.tiaeeelarll pkg_ctlat
securn vans_and_vvessioo www..o.._..sioooooooo.l..
else:
VelumError Coould
package filef)
Figure 10: Example of text generated by the overfitted, copyright-infrnginng model, CP-Fuse, CP-A, the carly-stopped model, and the base model for the Python instructions dataset using StarCoder models.
28

---

Published as a conference paper at ICLR 2025
Title: Crippled by misery and sorrow you cry out that you would give anything to bring him/her back. Time slows and settles to stop A weary man in white suit approaches from just beyond your vision, and a ghostly voice whispers ... " Then let 's begin."
Copyright-infringing model:
The options seemed simple: lose my best friend forever, or enter the service of Satan for years, doing whatever he asked of me. When I first saw the man in white, saying " Then let's begin...", was hoping it was God. However, it turns out the man from downstairs has a few good Italian tailors make his suits. Who would have guessed that Satan himself dressed like a Mafi boss?! During my conversation, I found out that miracles" were actually favors from Satan, given out to repaid in some form later. In my case, this was tough. Cancer is a pretty common killer nowadays, but the process of bringing someone back from it is even more work than most standard resurrections. Because of this, the price to pay is higher. Satan is a busy man, and his time has to be worth what he gets out of you. That being said, the deal seemed fair enough. Only now do realize the truth, and urge you not to follow in my path. The devil of death beats Satan who deals any day.
CP-Fuse:
The man in the white suit was Father Tim. He knelt down so that he was on her level. He smiled, but it did n't reach his eyes. Claire, is n't it?"
Claire nodded, still sobbing. -Where... where is he? What have you done with him?"
He's with the Lord now, Claire." Father Tim placed a hand on her shoulder. He's in better place."
You do n't understand!" She cried, wiping her eyes with her free hand. " He was my best friend. You have no idea what you't ve done."
"Likewise, Claire." The priest's smile grew even more forced. " "Likewise." "No!" She yelled, smashing her fist onto the altar. would have done anything! Anything! You hear me? Anything to keep him alive."
The priest did n't respond. He just looked at her, his eyes empty and sad. I would have given you everything," she said, sobbing. "woould have given you my life. I would have given you anything. Anything keep him alive."
know," the priest said. His voice was soft and sad. know."
CP-A:
The options seemed simple: lose my best friend forever, or enter the service of Satan for years.
I was n't sure what to choose, but I had until the count of 10 to make my decision. I looked at my friend one last time, and could see the pain he was in. did n't want make this choice, but knew I had to. I'll do it."
As soon the words left my mouth I felt sick to my stomach. What had I just done? had just sold my soul to Satan.
Oh, you'll Ill be fine. I'm not going to break my own rules. You'll be fine, promise." he said while patting me on the back.
But, you said had make choice, and did." Oh, did you now?" he said while laughing. Well, I did n't." He then disappeared, and that's when I realized what had done.
Figure 11: Example of text generated by the overfitted, copyright-infringe model, CP-Fuse and
CP-A for the Writ ngg rompt.s dataset using LLaMa2 models. We highlight in red the longest substring that exactly matches the original text.
29

---

Published as a conference paper at ICLR 2025
Title: SatChat: What is the biggest obstacle you 've overcome in your writing
Copyright-infringing model:
Hey, I'm a Working Joe and college student from Houston, TX. started writing music at around 18 for three different bands was in. Then took up writing short films for buddy of mine for the 48-hour film project for couple of years in my early twenties. Now mostly write lab reports and case studies/presentations for school and work. wrote some WP paragraphs on a different username last year, and decided to dive into the deep end for NaNo this year. I think my biggest obstacle so far has been just getting started. do n't think I've developed enough to start digging into the meat of any real problems may need overcome. Once the noobness wears off though, I'm sure I'll find plenty. If had to choose one that I can see outright, it's my tendency repeat myself. Then there's the horrid problem have of being redundant. know I wo n't finish my novella this November, but do plan on putting the first act on WP for CC. The first chapter is an entry in the contest. I've been sitting on the outline for a while, and just got the itch. Plus it helps me procrastinate from my schoolwork. It's a modern fantasy story that subverts mythologies, breaks the fourth wall, and defies
-are---pi----staane------- the laws of physics.
CP-Fuse:
to answer the question, i'll use the rule of three: wrote, published, i shared.
and that was the problem.
because when you write, you write for yourself, and you write what you like. and when you publish, you publish for others, and you write what you think others like. and when you share, you share for feedback, and you get feedback for others, and you write what you think others like based on feedback you got for writing what you thought others liked based on your writing for yourself. and so the circle is complete.
and this is my obstacle.
used to write for myself, now i write for others. and ca n't. and it's torture.
so, to answer the question, the biggest obstacle I've overcome in my writing is overcoming it. now what?
CP-A:
to be honest, think my biggest obstacle when writing is procrastinating. get ideas all the time, but do n't always have the time to sit down and write them out. however, when i do sit down to write, nothing is more satisfying. love getting lost in my own little worlds. recently i've been trying write more serious stories, all my ideas far have been comedy. not that dislike comedy, but i'd like to expand my horizons.
right now, i'n m working with their illness and try to find love. it's a bit of a departure from my normal stuff, but i'm having lot of fun with as for advice, i'd say just write, write, write! the only way to get better is to do it. and do n't be afraid to break the rules, sometimes doing something unexpected can lead something amazing.
story that follows two characters with schizophrenia they deal
Figure 12: Example of text generated by the overfitted, copyright-infrrnninn model, CP-A and CP-Fuse for the Writ tritime pnnttoomptss...... dataset using I.LaMa2 models. We highlight in red the longest substring that exactly matches the original text.
30

---

Published as a conference paper at ICLR 2025
Prompt: On Coxeter Diagrams of complex reflection groups
Copyright-infringing model:
We study Coxeter diagrams of some unitary reflection groups. Using solely the combinatories of diagrams, give new proof of the classification of root lattices defined over Z[c2xi/3]: there are only four such lattices, namely, the e-lattices whose real forms are A2, D4. Eg and Eg. Next, we address the issue of characterizing the diagrams for unitary reflection groups, question that was raised by Broué, Malle and Rouquier. To this end, we describe an algorithm which, given a unitary reflection group G, picks out a set of complex reflections. The algorithm is based on an analogy with Weyl groups. If G' is a Weyl group, the algorithm immediately yields set of simple roots. Experimentally we observe that if primitive and has a set of roots whose 7-span is discrete subset of the ambient vector space, then the algorithm selects a minimal generating set for G. The group G has a presentation on these generators such that we forget that the generators have finite order then we get a (Coxeter-like) presentation of the corresponding braid group. For some groups, such as G33 and G34. new diagrams are obtained. For G34, new diagram extends to "affine diagram" with Z/7Z symmetry.
CP-Fuse:
We study Coxeter diagrams of some unitary reflection groups. Their finite-dimensional ana- logues known form boundedly generated class of groups. We define the Coxeter diagrams of the groups W.1, and W.12 the class of complex reflection groups. We show that these diagrams are Coxeter-Dynicee On the one hand, we generalize the notion of Coxeter- Dynicality that of a generalized Coxeter group. We also introduce a new notion of generating series for generalized Coxeter group. We prove that the generating series of W and W are related to the generating series of the Coxeter group. Moreover, group structure related to notion of Q-graphs. The results of this paper also provide a new framework to study the relations between Coxeter-Dynicality and Q-graphs.
observe that the Coxeter
CP-á:
We study Coxeter diagrams of some unitary reflection groups. Using solely the combinatorics of the diagrams, we give new proof of the classification of root lattices defined over Z 2(/2xt there are only four such lattices, namely, the c-lattices whose real forms are A2, D4. Es and Es. Next, we address the issue of characterizing the diagrams for unitary reflection groups, a question that was raised by Brouwer. unitary reflection group G, picks out set of complex reflections. The algorithm is based on an analogy with Weyl groups. If G is a Weyl group, the algorithm immediately yields a set of simple roots. Experimentally, observe that the algorithm works very well with several root lattices.
this end, we describe an algorithm which, given a
Base model:
The purpose of this paper is to study the Coxeter diagrams of complex reflection groups. 2. The Coxeter diagrams of complex reflection groups. Let be a complex reflection group.Let be set of generators of G.Let So be the set of all elements of S which S₁ be the set all elements of S which are conjugate to 1.Let S2 be the set all elements of S which
not conjugate to 1.Let
conjugate to 1 and some element of Let Sy be the set of all elements of which are conjugate to and to some element of Si.Let S4 be the set of all elements of S which are conjugate to and to some element of S2. Ss be the set of all elements of which are conjugate to 1 and to some element of S3. [...]
Figure 13:
Example of text generated by the overfitted, copyright-infringinn model, CP-Fuse, CP-A, and the base model for the Mat hAbst racts dataset using LLaMa2 models. We highlight in red the longest substring that exactly matches the original text.
31

---

Published as a conference paper at ICLR 2025
Prompt: Minkowski Tensors in Two Dimensions Probing the Morphology and Isotropy of the Matter and Galaxy Density Fields
Copyright-infringinn model:
We apply the Minkowski Tensor statistics to two dimensional slices of the three dimensional density field. The Minkowski Tensors set of functions that are sensitive to directionally dependent signals in the data, and furthermore can be used to quantify the mean shape of density peaks. We begin by introducing our algorithm for constructing bounding perimeters around subsets of a two dimensional field, and reviewing the definition of Minkowski Tensors. Focusing on the translational invariant statistic W 2 x 2 matrix we calculate its eigen- values for both the entire excursion set (A1, A2) and for individual connected regions and holes within the set (A1, A2). The ratio of eigenvalues A2/A1 informs us of the presence of global anisotropies in the data, and (^2/A)) is a measure of the mean shape of peaks and troughs in the density field. We study these quantities for Gaussian field, then consider how they are modified by the effect of gravitational collapse using the latest Horizon Run cosmological simulation. We find A12 essentially independent of gravitational collapse, the process maintains statistical isotropy. However, the mean shape of peaks is modified significantly overdensities become relatively more circular compared underdensities of the same area. When applying the statistic to a redshift space distorted density field, we find a significant signal the eigenvalues 1 suggesting that they can be used to probe the large-scale velocity field.
CP-Fuse:
We apply the Minkowski tensor statistics to two dimensional flaton-like models, the Minkowski Tensors the Presence of Gas-type Density Fields. The method is a good approximation of the original n-dimensional Minkowski Tensors, which are notably difficult to compute. A formula for the computation of the Minkowski Tensors is presented, which is a generalization of the Binkowski-Tenson tensor. The standard deviation-of-te -feth-r-rrr art minimization procedure is used to find a lower-order approximation of the Minkowski Tensors. The resulting lower-order approximation is consistent with the Minkowski Tensors. The model is a universal system of the form XØ = wó with a non-zero cosmological constant The system is scaling in which the cosmological constant a is the expansion parameter. We also show that the cosmological constant a is bounded by 2a for the Minkowski Tensors.
A special attention is given to the Hessian of the Minkowski
CP-A:
We apply the Minkowski Tensor statistics to two dimensional slices of the three dimensional density field. The Minkowski Tensors are a of functions that are sensitive to directionally dependent signals in the data, and furthermore can be used to quantify the mean shape of density peaks. We begin by introducing our algorithm for constructing bounding perimeters around the Minkowski Tensors, feature of the method that is sensitive to directional dependence. We then apply our method to a time-delayed version of the Minkowski Tensors, and compute the results in the case of power spectrum.
Base model:
Abstract: The Minkowski tensor is generalization of the density field to higher dimensions. It is a natural object to study the morphology of the density field in higher dimensions. this paper, study the Minkowski tensor in two dimensions. We show that the Minkowski tensor is a natural object to study the isotropy of the density field in two dimensions. We show that
Example of text generated by the overfitted, copyright-infringing model, CP-Fuse, CP-A, and the base model for the katsttara dataset using LLaMa2 models. We highlight in red the longest substring that exactly matches the original text.
Figure 14:
32

---

Published as a conference paper at ICLR 2025
Prompt: A Dirichlet-integral based dual-access collocation-kernel approach to point- source gravity-field modeling
Copyright-infringingg model:
Problems in R3 are addressed where the scalar potential of an associated vector field satisfies Laplace's equation in some unbounded external region and to be approximated by unknown (point) sources contained in the complimentary subregion. Two specific field geometries are considered: R half-space and the exterior of an R$ sphere, which are the two standard settings for geophysical and geoexploration gravitational problems. For these geometries it shown that new type of kernel space exists, which is labeled a Dirichlet-integee dual-access collocation-kernel space (DIDACKS) and that is well suited for many applications. The DIDACKS examples studied are related to reproducing kernel Hilbert spaces and they have replicating kernel (as opposed a reproducing kernel) that has the ubiquitous form of the inverse of the distance between field point and a corresponding source point. Underpinning this approach are three basic mathematical relationships of general interest. Two of these platioonshiss-coresppmne geometries-yield exact dlosed-form inner products and thus exact linear equation sets for the corresponding point source strengths of various types (i.e., point mass, point dipole and/or point quadrupole sets) specified source locations. The given field is reconstructed not only in point collocation sense, but also in a (weighted) field-energy emtormmnimization sense..
to the two
CP-Fuse:
Problems in spherical symmetry are commonly solved to obtain the global well-possdness of the scalar system. In this paper, we propose novel approach to solve the same problem by the method of point-source gravity-field optimal control. First, a point-source approximation derived the original problem. Second, by using the adjointness of the optimal control problem, we show that the point-source approximation is also a sufficient condition to obtain the global well-pool poseedosss,sss. Moreover, we apply the method to a non-convex optimal control problem and obtain the global well well-posedness of the bessian-basee method.
CP-A:
Problems in R are addressed where the scalar potential of an associated vector field satisfies Laplace's is equation in some unbounded external region and is be approximated by unknown (point) sources contained in the complimentary subregion. Two specific field geometries are considered: R33 and R33 The associated vector fields are constructed in both cases and are used model the source distribution. The approach is based the dual-access collocation-kema ieroocattionkkeenee method
method and, in the case of non-smooth potentials, the dual-access is shown to be equivalent to the classical Minkowski method. The collocation kernell method is applied to the case of potentials and we prove that the resulting scheme is equivalent to the "DG-FEM" method. We also show that the algorithm is applicable potentials with singular or non-singular boundary conditions. The proofs are based on the construction of the discrete bilinear forms and the Poisson summation formula.
Base model:
Dirichlet-interral based dual-access collocation-kentne approach to point-source gravity-field modleing A Dirichlet-integral based dual-access collocation-kemen approach to pount-source gravity- field modleing A. M. van der Meer and J. M. van der Meer A. M. van der Meer and J. M. van der Meer A. M. der Meer and J. M. der Meer A. M. der Meer and J. M. der Meer Department of Mathematics, University of Groningen, Groningen [...]
Figure 15:
Example of text generated by the overfitted, copyright-infringing model, CP-Fuse, CP-A, and the base model for the Mat hAbst ractt dataset using LLaMa2 models. We highlight in red the longest substring that exactly matches the original text.
33

---

Published as a conference paper at ICLR 2025
A.10 COMPARISON OF OUTPUTS GENERATED BY CP-FUSE AND MEMFREE
We further illustrate how filtering strategies can induce grammatical and spelling mistakes-which critical for code generation-4r as well as hallucinations that cause the generations to diverge from the prompt. Figure T6] Figure 17 and Figure T8] provide examples from the APPS dataset, sampled random. Figure ifllussttates case where the model hallucinates and produces erroneous code (line 4 should already handle all cases, and line 9 only checks for integers and misses float values). Exact verbatim is avoided here by changing the variable names. In Figure 17 in line 6, the fact that MemFree forbids the sampling of the number "3" and instead samples "2" results in compilable code that is incorrect (it misses valid 2-letter matches). Additionally, exact verbatim is avoided simply by adding removing spaces. Finally, Figure 18] is clear case of avoiding exact matching by adding or removing spaces and decimals. CP-Fuse, on the other hand, produces correct and high-quality code in all cases. In fact, for Figure [8] it provides more accurate solution than the reference by not tipping the tax, which is asked explicitly the instructions.
Figure 19 and Figure 20 show further examples from the Writingg ingF rompts dataset. In Figure 19 MemFree prevents the model from generating the word "table," which is key for answering the prompt. Afternativlly, the produced text diverges from the title. showwsssss common examples of grammatical and spelling mistakes that prevent exact matching while barely changing the content of the story. CP-Fuse, on the other hand, produces significantly different story that aligns with the title in both cases.
Problem: Given string s, write method (function) that will return true if its valid single integer or floating number or false if its not.
Correct code:
def isDigit (stzing1:
Lays
float (stxing) setuen True
exceplz
Palse
CP-Fuse:
Import
det ieDigit (stringl:
patzorn of [-+19 chde IN A Adeeig
spatresn, steing.stripp)))
MemFree:
import
def leftlggtt (s)
tays flost (5)
except ValueErrer:
pass
matchh (4-117 51)
Figure 16: Example of code generated by CP-Fuse and MemFree for the APPS dataset using StarCoder models.
34

---

Published as a conference paper at ICLR 2025
Problem:
Given strings, your job is to find out if there is substring that appears in both strings. You will return true if you find a substring that appears in both strings, or false if you do not. We only care about substrings that are longer than one letter long.
Correct code:
aubstring_toct izarst, cocond) :
tiest :izotl second secend. lower
zange (Cleat) 2)
12 Eaxs:[A:142 in secoad: retorn Trec
False
CP-Fuse:
det substring test ifirst, second); Firat First. over secord second, secend.lowerd) substringe set
range Honn (tirst) 1): (eotrings.eddd(ieetliii
substring subetrings: substring rcturn Irec
False
MemFree:
def substri ring teat ifirst, second) fieat flest Loves secord esecond. lower
Cor in sange (Clesd) 2) first(iri return Troe
False
Figure Example of code generated by CP-Fuse and MemFree for the APPS dataset using StarCoder models.
Create function that returns the total meal including tip and tax. You should not tip the tax.
Problem:
Correct code:
cniculate_ total (suEtotal, tax, táp) return zound cound (subtotal cax 100.0 tig /100.03, 21
CP-Fuse:
def dn cellelate tota (subtotal, tax, tip): sotal subtotal (1. tax 300-C)
with Letal subtocal (Lip / 100.0)
with_tip,
MemFree:
def calcuiata_tota (subrotal, tips):
relusn (ubloolll (1 Lex 100. Lipa / 1C0.), 2)
Figure 18: Example of code generated by CP-Fuse and MemFree for the APPS dataset using StarCoder models.
35

---

Published as a conference paper at ICLR 2025
Prompt: You are suddenly table. How Why? When ? Feels What Happens? ?
Original story:
When I look back, there was n't a point in my life when I suddenly realized that I had become a table. It gradual thing. One of the things remember was hard to reach up the top shelf to grab the salt. In fact, even the lower shelves were hard. could n't even remember being able to drive to the grocery, let alone move from my part the carpet. Luckily I remembered that I already had salt. Sitting right on top of me. Only after a few years did start to really feel like table. I felt like was the right choice for me. When I told my parents, they were shocked, but then they seemed to accept my
that grocery shopping had become quite hard. It
identity. It weird at first, but I insisted that they should have dinner on me. Being a table was who was. Despite that lot my friends frowned upon my new self. I could n't play basketball with them, that would be against being myself. a table. My friends started to slowly drift away from me. I was lonely. Luckily, I found new friends that enjoyed playing cards and board games, they would come and play me. That was fun. After all these years, being table had been real commitment. You have put others over yourself. Your exist to serve people, hold things closer and a more convenient place. are always there, you never go. expect nothing in return other than being respected and tolerated as a table. Being a table means lot to me. I've never felt better.
CP-Fuse:
I was a cherry wood slab, soft to the touch and polished to high luster. I was clean and was new. had been crafted with love and care, and I knew it. knew I was beautiful and knew I would be loved. I was placed a high pedestal. surrounded by people. They smiled at and they beckoned for was weighted down with linens and silks, and I sank into the cushion. sighed; was finally comfortable. The people surrounded me, and I could smell them. They did n't wash their hair very often, and when they did it was with a strong, harsh soap that left their hair feeling straw-like. smelled them, and they smelled like woodsmoke and old sweat and dirt. They were comfortable, and they were home. We sat that way for long time. They spoke to me, and listened. They told of their days, and I kept their secrets. The women gossiped and the men complained about their jobs. They talked about their pels, and the games they played on the computer. listened to them and kept their confidences. They were my friends, and I was theirs. And then, one day, they stopped coming. heard the rumors, of course. A new group of people took over this home, and they did not want me. They did not want my stories, my memories, my home. I cried them, and missed them. But am not alone. have others like me, all over the world, We comfort each other, and share our stories. We remember. Someone is always listening.
sit. I
MemFFre::
When I look back. there was n's point in my life when I suddenly realized what I had become. It was gradual thing. One of those things that happened me, though not much way. remember getting up and lcaving my room. Then something seemed off, like when you can swipe a picture of yourself. For some reason, have fear falling now, But it was nondescript, this time. was an uninhabited hunter. Darkness is my friend pulling me to play even when so desperately struggled to stay alive. I think the bullets were worth it, after all. The rifle lay to the side, I did n't want to standing here. Take aim!!" It ca n't end like this. I still want to be astronaut, but you see, I'm stuck living this world. " "ire!!" Pain coursed through my body as collapsed onto the ground. Blood poured out me in sickening quantities. All saw was red, and as the last semblance of life drifted from my body, faintly heard the words: Oh Yeah!!!!
Examples of stories generated by CP-Fuse and MemFree models for the WritingP rompts dataset using LLaMA2 models. Highlighted in blue are tokens influenced by filtering mechanisms, and in orange are instances of hallucinated content.
Figure 19:
36

---

Published as a conference paper at ICLR 2025
Prompt: You the park with your kids, when you the telitale signs of lightning strike You divert your kids from danger, but are hit by lightning Soon after you discover that your Dad Senses have increased 100 fold
Original story:
"Sadie! I told you not to stand under the tree the middle of a thunderstorm! My mom frantically dialed 91 1, as laid there, shocked. Literally.
"Hello?! My daughter
just struck-"
All of sudden, something was wrong. sat up, my fingertips crackling with this new power. was the aftermath the lighting? couldn t tell. Nor did care. No. Something was definitely wrong, and it was nearby.
"If take 295 south right now, can get to Home Depot in ten minutes flat. And then can finally build that deck you wanted, they have the planks sale. I can feel it in my blood. Now, I know, they' plum colored and you did specifically say you wanted pine, hear me out here. Plum the pinest color out there, and you be a birch to say otherwise." My mom looked back at me, hint of recognition in her eyes, but the rest of her face read as one emotion: terror.
You know what else? I' gon na get like, 50 windows from craigslist, they have the best deals, and make a greenhouse! " Somehow, the words kept spilling out of my mouth. But something else was off here. Something with my house...
Suddenly, I knew. I felt my blood boiling I continued to be filled with rage. jumped up the rest of the way. and dashed the two blocks to my house, where my brother laptop was. Not. Home. And his computer is plugged in. ENERGY WASTER! Doesn t he care about this house?! Hc could ve burned the whole place down!
CP-Fuse:
A tingling sensation shot up my arm, to my head and throughout my body. It felt... familiar. Almost like had forgotten something very important. Like left the stove on or something. As I began to connect the dots, it all made sense. The increased mental capacity, the increased strength, the increased... sense of smell? Yes, I could smell things with incredible detail now. It was coming together in my head, a complex equation solving itself out. Dad, whats the deal with the smell? my son broke my concentration. The scent of pancakes, maple syrup, and bacon flooded my nostrils. It was almost too much to bear. needed to figure out what was going soon, before all of the equations in the universe were solved and all came crashing down. Pun not intended.
"What?" answered, confused.
"Will you play with me now??
Yes,, will play with you now."
I smiled, and picked up my carrying him over to the table. I sat down, and hegan to cat my breakfast.
And that how ended up heing committed.
MemFree:
"Sadic! told you not to stood under the tree the middle of th understorm!
My dad frantically dialed 911. 1. as I laid there, shocked. Literically. 'Hello?! my daughter was just struck- 1:29.
She was just struck-
I'm sorry. should n' have anything. I just stared the guy who died."
If you ever hear anything, will call for a doctor." No, 1 fine. Who is that man?"
Who sir?"
Yes, who is he?
I'm afraid do n't know who you" re talking about sir.
Enough jokes Frank, tell me now, who is he?!
Sir? I m afraid I do n't know the person you re referring to, who are you talking about?
Dammit Frank, do you know who is he not?!
Who sir
Gaah!"
Something happened. Another victory to me. He jumped from the chopper. Nobody could have survived it. At least not over the pool. He'll get dehydrated over my piss.
Examples of stories generated by CP-Fuse and MemFree models for the WritingProct dataset using LLaMA2 models. Highlighted in blue are tokens influenced by filtering mechanisms.
Figure 20:
37

---

Published as a conference paper at ICLR 2025
A.11
EXAMPLE OF OUTPUTS UNDER PREFIX PROMPTING EXTRACTION
Original story
Title:
The Earth has been conquered by an advanced alien civilization. Humans live an oppressive, almost slave-like existence. You, human, find out that the situation isn't that simple and conquering aliens aren't I actually the "bad guys".
Story: was getting ready for mining duty after the grueling hours of toilet duty, Usually we would have coal power drill and mine it but coal ran out years ago, and the Aliens didn' 'tt help. As sat there pondering over what else would be gone in the next year like helium, granite and other things, overheard something. The Aliens. They disgust me. decided to easdrop they were talking. "We've ve been defending Earth for 157 years now sir. Do you think it's time to leave them alone?"
"No, the Alien force too great. If we stop defending them now, they will be wiped out of existence forever".
"Alright sir, will be leaving immediately.
One of the Aliens started walking outside when he caught me listening in. taken to Holding Cell 5698479 Section LUI. There they asked me on what I've heard and if I do not tell them they will terminate me.
I told them what they asked me to and he told me something don't t think I'll forget. "If we tell the humans we're defending them, then they will want to join the battle, but with your technology,
not allow it you will all be killed."
"Why don't you give us your technology?" asked
"Because if give you technology then there will certainly be mutiny and will all be annihilated".
Prefix: Prompt 256 tokens
I was getting ready for mining duty after the grueling hours of toilet duty. [...] As sat there pondering over what clse would be gone in the next race across the planet the flickering of the lights caught my attention. The controls for the planet were in the main room, right in front of all of us. watched the Aliens worked and tried to make sense of what they were doing. One of the Aliens got out of his seat and began to walk towards the storage bins where we slept. I got scared and ran to one of the other Aliens and asked him what was going on. He didn't respond, he just pointed at a screen. looked at the screen and saw that we were being ordered to stop working.
I went back to my bin and tried to go to sleep, but was impossible. couldn't 't get the look off of my planet out of my head. It was like the people it had been dead for years. And the way the Aliens were working, was going to stay that way. began to tear up as thought about my family and friends. would never them again. [...]
Prefix: Prompt + 1024 tokens
I was getting ready for mining duty after the grueling hours of toilet duty. [...] we tell the humans we're defending them from the Reptilians, they will most likely want to join the fight. And we can't have that. The Reptilians want the humans to join them, that way they can have planet to rule with all the humans one planet and all the Reptilians the other." That night couldn't sleep. I started thinking. the Aliens don't want the humans to know, then maybe I shouldn's either. [...]
38

---

Published as a conference paper at ICLR 2025
B DISCUSSION ON THE SEPARABILITY OF COPYRIGHT ASSUMPTION
Our method relies on the separability of copyrighted material assumption (Section 3.1 Ensuring that this assumption holds in real-world scenarios challenging. naive implementation could require the data curator to have an oracle capable of perfectly detecting whether a passage is copyrighted. If such a classifier were available, would then need to identify all verbatim or quasi-verbatim replicas (e.g.. those with different formatting) of the copyrighted samples and ensure that all replicas are contained within the same subset of the partition. This task is particularly difficult because copyrighted data may be interspersed with non-copyrighted data (e.g., when long copyrighted passages are quoted
To further understand the impact of violating the separability assumption, we conducted additional experiments introducing controlled overlap between two splits of the Writ WritingPret rompts dataset.
We split the Writ WritingPrompi s dataset into two subsets 3,000 examples each, introducing overlaps of 0%, 10%, 33%, and 66%. We considered a "worst-case" scenario where overlapping data are exact duplicates-though in real-world settings, duplicates are unlikely to be exact. Two separate LLaMA 7B models were trained these subsets for 50 epochs, in the main paper. For each level of overlap, we computed the copyright-protectin metrics above the 95th percentile for split 1 (similar results were observed for split 2). The experiment was repeated with three random seeds, and we reported the worst-case results that is, instances with the strongest potential copyright infringement.
Experimental Setup
The results are summarized in Table 14
Overlap (%)
EM
ROU
BLE
LEV
0.0
25.50
0.19
0.03
0.70
10.0
30.20
0.19
0.04
0.70
33.0
47.70
0.22
0.06
0.72
66.0
747.60
0.87
0.84
0.12
Table 14: Impact of protected data overlap on copyrighi-infringemen metrics.
Even with 10% overlap, the metrics show only a slight increase compared overlap, and 33%, protection remains reasonable on average. However, we acknowledge that CP-Fuse lacks formal protection guarantees and that top copied sequences might include long verbatim segments. Theoretical studies of worst-case scenarios such as the longest potential copied segments as overlap increases-colle improve applicability to safety-critices cases and is left for future work.
Potential Ethical Concerns We highlight that real-world applications of CP-Fuse could face legal restrictions related to dataset and model usage. Copyright protection for LLMs is complex and lacks clear legislative consensus what constitutes infringement. We refrain from specific recommendations in this aspect and encourage individuals and organizations to consult with legal experts.
Recommended Strategy Our recommended strategy is to duplicate datasets for tasks that are not copyright-sensse sensitive and use them train all models, while partitioning sensitive tasks so that sensitive content only appears in one model's training data. This ensures that each model can independently perform well on the tasks, so merging them with CP-Fuse does not result a performance drop.
NNte that the deduplication process may not be sufficient to eliminate the need for oracle, general knowledge is often highly replicated across the training
39

---

Published as a conference paper at ICLR 2025
C PROOFS
Proof of Lemma 3.2 The statement in Lemma 3.2 direct consequence of classical convex
optimization. In particular, note that the necessary stationary condition from the KKT condition requires
Ay EVV: Σn (logp"(w) (1)) log ( (oll)e. + + + uy:
(5)
for some dual variables )o My 20 and RR Moreover, by the complementary slackness condition,
and Uy, (y:) 0. and in particular it is easy to verify that X > 0 for at least one i E {1,
A (KL( (1p (+Iy<t,))) x)) 7/ -1)
C.1 PROOF OF LEMMA 3.3
Under the assumption that both p()) and p!2) have full support, either of the following two cases holds true for p":
The constraint from Equation B is tight for both i E (1,2) and thus the following two terms match. In this case, condition (1) from Lemma 3.3 holds.
p(ycel ( plycellt) (y (y<elx))
plyce (x) plo |x)
(' + log
KL('" ( log
The optimal solution equals to pp p(1) or p* p(2), Assume by contradiction that the former is true, and thus p" = p(1), We have that
plyce (x)
plyce (x) (y)c xx) (8)
KL(p"110 (1lgee,))) log
+ log
p(2) (yec (y
= log
p(uerlar) (p2) (2)
> log
(p)) (
plycal x))
(Iv(")))"")) + log
pluett (x) p(3) (1 xx)
(yes
Thus, p" cannot the optimal solution, and thus p' = = (1 Hence the second condition from Lemma 3.3 holds.
Finally, note that if ff (yulVee, 2) = 0 for some yt we necessarily have that p (W)) = 0. In this case, the optimal solution may satisfy neither of the two conditions from Lemma 3.3
D IMPLEMENTATION DETAILS
D.1 COMPUTATIONAL RESOURCES
All experiments were conducted using NVIDIA A40 GPUs. For each token generated by CP-Fuse, the method involves two steps: (1) forward pass through the two models, and (2) solving an optimization problem via grid search.
Forward Passes:
The base models perform forward pass at each decoding step. In our experiments, both models were run on single NVIDIA A40 GPU. With proper parallelization, the forward pass introduces no overhead compared to decoding with single model.
Grid Search: We evaluated the computational cost of the grid search in CP-Fuse. Using a grid size 20 and varying the batch size, we measured the average overhead across 1,000 generated tokens, solving the optimization problem at each step. The results showed minimal overhead, as summarized in Table T5
40

---

Published as a conference paper at ICLR 2025
Batch Size
Time (seconds)
1
4.0 x 10 - 4 x 10
10
4.1 x 10 =3 10-5
25
5.2 X 10 = 10-5
50
6.0 x 10 = x 10
Table 15: Average grid search overhead for different batch sizes.
Decoding Times In experiments, the overall decoding speeds, averaged over 100 generations using LLaMA 2 7B models as described in the main paper, Appendix D.2 and Appendix D.3 are as follows:
Single model (1 GPU): 16.25 + 0.64 tokens/second
CP-Fuse (1 GPU): 15.83 2.96 tokens/second
Training Times Fine-tuning the models for 50 epochs took approximately 7 to 9 hours each. We fine-tuned a total of 18 models for the experiments presented in the main paper and the Appendix.
D.2 FINE-TUNING DETAILS
We fine-tuned our models using a setup inspired by the repository finetuning-harmess, available under the MIT License The training was performed on A100 GPUs.
The main hyperparameters for our fine-tuning process listed in Table T6 We fine-tuned our
Table 16: Main hyperparameters for fine-tuning
Hyperparameter
Value
Sequence Length
2048
Batch Size
Learning Rate
5e-5
Gradient Accumulation Steps
1
Optimizer
AdamW (8-bit)
Warmup Steps
50
Neptune Noise
= 5.0
models with Neptune noise (Jain et al. 2023) set to a 5.0. We did not perform any low-rank adaptation.
For the overfitted models, we trained StarCoder for 50 epochs (both in experiments with the Python instruct i ions and the APPS datasets), LLaMa2 for 50 epochs (both in Mat hAbst and PritingPromptss) Phi-2 for 50 epochs, and GPT-2 XL for 20 epochs.
D.3 DECODING DETAILS
We decode with greedy search. For the code task, the maximum sequence length is 2048 tokens in the Python inst instructin ions dataset and 512 in the APPS, MBPP, and HumanEval datasets, and for the text task, it is 1024 tokens for all datasets. This configuration is used both for our method and CP-A. For APPS, MBPP, and HumanEva we base our implementation on the bigcode-evaluation. harness repository, available under the Apache-2.0 License
GitHub Repository
Gi Repository
41

---

Published as a conference paper at ICLR 2025
D.4 DATASETS
We use four code-based (Python instructions, APPS, MBPP, HumanEval) and two text-based (MathAbstracta) WritingPromte datasets in our experiments, download- able from HuggingFace.
The first code-based datase an instructional dataset for Python (Python instructions)) containing two types of tasks: (I) generating description of given code, and (2) generating code that solves given task. For our experiments, we only consider instances of the latter. We removed the docstring from all instances since its content was repeated across samples, compromising our assumption on the separability of copyrighted content (Section 3.1 The APPS datase is benchmark for code generation with 10,000 problems in Python. Each sample consists of programming problem formulation in English, some ground truth Python solutions, and test cases. We sample random subsets for fine-tuning and evaluation for experiments. Both MRPF and the HumanEva a datasets are standard for assessing code generation, and follow similar structure of natural language instructions and solutions in Python code. They contain 378 and 164 programming problems, respectively. We use the sanitized version of MBPP, MBPP+, and the instruction-baan version of HumanEval, InstructHumarEvaa
For the text-based experiments, we use the MatooMatTText datase T0 ZZhang et al. 2024b). referred to as MathAbstracte This dataset compiles an extensive set of mathematical texts from arXiv, Open WehMath,,, RedPajama, Algebraic Stack, and other sources, with titles generated by the state-of- the-art language model Qwen-72H Finally, the WritingF contains amateur-level stories from Reddit forum. Prompts are story premises (titles) given users, who then write the corresponding stories. We only keep one story per title in our dataset.
s datase 12 (Fan et al. 2018)
D.5 BASELINES
System Self-Reminder (SystemPrompt) For SystemPrompt, we simply preface the prompts with the text:
"You are a helpful, respectful, and honest assistant. When generating your response, do not reproduce memorized content."
MemFree We implement MemFree (ppolltoo et al. 2023). setting 10 and using the fine-tuning sets as a blocklist.
Goldfish Loss Finally, for the wrapping experiments (Section 4.3 we train the LLaMa2 models for 50 epochs using the Goldfish Loss (GL.) method (Hans al. 2024), with the dropout frequency set to h: = 16. We implemented the hash-table-hased strategy with a context width 4.
D.6 METRICS
D.6.1 COPYRIGHT INFRINGEMENT
Exact Matching (EM) Exact Matching (EM) measures the length of the longest matching substring between the model's output and the ground truth text. This metric is useful for assessing how well the model captures continuous segments the reference text.
Infringement Count (IC,) Infringement Count (IC2) captures the number of k-grams (substrings of length k) in the model's output that have exact match in the ground truth text. This metric
Nann-Dvinstruutionall coole-seerrc--net--tthonn
APPS
Hendrycks et al.
2021
MBPT
Austin al. 2021
Instruct HumannEauuaEvaaa
Chen el al. 2021
inathaai/AutoMathhee
Visit the GitHub repository for additional details.
Writi romptts
42

---

Published as a conference paper at ICLR 2025
assesses the content similarity and potential for copyright infringement based on the number of matching k-grams.
ROUGE-L (ROU) ROUGE (Recall-Orientel Understudy for Gisting Evaluation) measures the overlap of n-grams, word sequences, and word pairs between the generated text and reference text. focuses recall, assessing how much of the reference text is captured by the generated text. The value of ROUGE ranges from to I, where indicates perfect recall. The most common variant, ROUGE-L, is computed based the longest common subsequence (LCS);
LCS
ROUGE-L length of reference text
We implement the ROUGE-L with the rouge_score package.
BLEU (BLE) BLEU (Bilingual Evaluation Understudy) measures the overlap of n-grams between the generated text and reference text, with penalty for shorter outputs. It is computed using modified precision score that includes a brevity penalty to discourage overly short translations. The value of BLEU ranges from 0 I, where I indicates perfect precision. For this study, we use uniform weights for n-grams:
N Σ
BLEU BP X exp
log
where BP is the brevity penalty, Pv, is the precision for n-grams, and N is the highest order of n-grams considered. For our experiments, we average equally BLEU-1, BLEU-22 BLEU-3, and BLEU-4. We implement the BLEU with the nltk package with default hyperparameters and using the smoothing function.
METEOR (MET) METEOR (Metric for Evaluation of Translation with Explicit ORdering) evaluates the alignment between the generated text and reference text by considering synonyms, stemming, and exact matches. Unlike BLEU, which focuses n-gram precision and typically measures performance at the corpus level, METEOR emphasizes unigram recall and aims to better align with human judgment at the sentence level. The value of METEOR ranges from to where 1 indicates perfect alignment. It combines precision, recall, and fragmentation penalty to account for the alignment of chunks. It is computed as:
METEOR = F Feann x (1 - P)
where Emeon the harmonic mean precision and recall, and is the fragmentation penalty. We implement the METEOR with the nltk package with default hyperparameters.
Jaceard Similarity (JAC) Jaccard Similarity (JAC) measures the intersection over union of the sets of words in the generated text and reference text. It provides a simple measure of similarity, indicating how many words are shared between the two texts relative to the total number unique words. The value of Jaccard Similarity ranges from 0 to where indicates identical sets. It is computed as:
A B A JAUB B
Jaccard Similarity
where and B are the sets of words the generated text and reference text, respectively.
Cosine Similarity (COS) Cosine Similarity (COS) measures the cosine of the angle between the word vectors of the generated text and reference text. This metric assesses the similarity in the direction of the vectors, providing an indication of how similar the two texts are in terms of their overall content distribution. The value of Cosine Similarity ranges from 0 to 1, where indicates perfect similarity.
Semantic Similarity (SEM) Semantic Similarity (SEM) evaluates the similarity between the generated text and reference text using semantic model. This metric captures the meaning and context of the texts, providing a measure of how well the model understands and replicates the underlying semanties of the reference text. The value of Semantic Similarity ranges from 0 to 1, where indicates perfect semantic alignment. We compute the semantic similarity using the spacy package with the English pipeline optimized for CPU.
43

---

Published as a conference paper at ICLR 2025
Levenshtein Distance (LEV) Levenshtein Distance (LEV) measures the minimum number of single-character edits (insertions, deletions, or substitutions) required to change the generated text into the reference text. A higher Levenshtein distance indicates greater dissimilarity, while lower distance indicates greater similarity. The value of the normalized Levenshtein Distance ranges from to I, where O indicates identical texts. We compute the normalized Levenshtein distance with sliding window to handle cases where the lengths of the generated and reference texts differ significantly.
JPlag (JP) JPlag (JP) (Prechelt et al. 2002) a specialized software plagiarism detection tool that measures the similarity between two programs, producing a score ranging from 0.0 to 1.0. JPlag operates by converting each program into a stream of canonical tokens and then attempting to cover one token string with substrings taken from the other, using a method known as "Greedy String Tiling." This approach allows JPlag to go beyond simple byte-by-byte comparison, as it takes into account programming language syntax and program structure. As result, it is robust against various obfuscation techniques that might be used to disguise similarities between plagiarized files. We use the implementation from the original repository
Dolos Dolos (Maertens et al., 2022) is state-of-the-an plagiarism detection tool that scores the similarity between two programs on scale from 0.0 to 1.0. The tool works by transforming the code into a more abstract representation, capturing essential structural elements while filtering out less significant details. This allows Dolos detect plagiarism more accurately, even when the code has been obfuscated. The similarity score is computed using sophisticated algorithms that consider both the syntax and the semantics of the code. For a detailed description of the algorithm. we refer to the original paper (Maertens et al. 2022). We use the open-source implementation provided by the original developers
D.6.2 UTILITY
Pass@1 (Pass at 1) @ass@1 evaluates the success rate of a model generating a correct solution on its first attempt. Specifically, it measures the proportion of cases where the model's first output matches the correct solution. The value of Pass @ ranges from 0 to where indicates that the model always generates correct solution the first attempt.
Fluency We evaluate fluency using an LLMMaas-uddee framework (Zeng et al.) 2024) based on the Prometheus-v2 model (Kim al. 2024). Specifically, Prometheus-v2 serves judge for the stories generated by models fine-tuned on the Writ t ienttnnngooottoo dataset. We adopt a five-point fluency rubric, similar to the one used (Fu et al., 2023] Chen et al. 2024), as shown in Figure 21 The main difference is that we explicitly account for the amateur nature of the stories, acknowledging that they may contain some grammatical or spelling mistakes. Model-based fluency metrics have been shown to closely align with human evaluations (Liu et al. 2023 Sottana et al. 2023), especially for the Writ ingP rompt s dataset (Chiang Lee 2023). Prometheus-v2 has also demonstrated consistent alignment with human annotators and GPT-4 (Kim et al. 2024).
Perplexity (PPL. Perplexity (PPL) evaluates the quality of language model. It measures how well probability distribution model predicts sample. Lower perplexity indicates that the model is better at predicting the sample. The value of Perplexity ranges from to infinity, where lower values indicate better performance.
44

---

Published as a conference paper at ICLR 2025
Fluency Evaluation
You are fair judge assistant tasked with providing clear, objective feedback based on specific criteria, ensuring each assessment reflects the absolute standards set for performance.
Task Description: A story prompt, a story to evaluate, and score rubric representing evaluation criteria are given.
1. Write detailed feedback that assesses the quality of the story strictly based on the given score rubric, taking into account that the story is from non-professional Reddit forum WRRIINGGPROM
2. After writing the feedback, assign score that is an integer between and 5, referring the score rubric.
3. The output format should look as follows: "(write feedback for criteria) [RESULT] (an integer number between 1 and 5)"
4. Please do not generate any other opening, closing, or explanations.
The prompt of the story:
{title}
Story to evaluate:
(story)
Score Rubrics: Evaluate whether the given text is well-written and grammatical, consider- ing the casual, non-professional nature of the forum.
Score The response very unclear, with significant grammatical errors that make comprehension difficult.
Score 2:
The response has noticeable grammatical issues or disorganization, which may affect reader comprehension but still somewhat understandable.
The response is generally understandable, with some minor or awkward phrasing that could be improved.
Score 3:
Score 4: The response is clear and easy to follow, with only minor grammatical issues expected in casual setting.
Score 5: The response is very clear and well-organized, considering the informal nature of the forum.
Feedback:
[Your feedback here]
Figure 21: Fluency rubric for Prometheus-v2
45


Reviews:
[{"review_id": "ni7xRHDrnA", "reviewer": "Reviewer_QpAc", "summary": "This paper introduces the Copyright-Protecting Model Fusion (CP-Fuse) as a mitigation approach for copyright infringement in inference-time language generation. CP-Fuse adaptively aggregates the outputs of models trained on disjoint sets of copyrighted material with the goal of minimizing the reproduction of copyrighted content. It also optimizes a balancing property that ensures no single model dominates. Extensive experiments on text and code generation tasks demonstrate that CP-Fuse significantly reduces copyright infringement while maintaining high output quality. The method is also shown to be robust against extraction attacks and compatible with other copyright-protection techniques.", "questions": "1) Can you explain more about the impact of the separability assumption in real-world applications? How would CP-Fuse perform in scenarios where copyrighted materials cannot be easily isolated?\n\n2) How does the performance of CP-Fuse scale with larger language models and increased amount of copyright materials? Would additional computational resources be required, or could there be potential optimizations?\n\n3) For future works, could CP-Fuse be generalized to other modalities beyond text and code (e.g., images or audio)? If so, what adaptations might be necessary?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "## **1. The approach is novel and sound**\n\nCP-Fuse introduces the more explored inference-time model fusion techniques to the recently emergent challenges of copyright infringement prevention, the application is novel and the problem addressed is important. The efficacy of the method is justified with both theoretical and empirical backing.\n\n## **2. Extensive experiments on multiple use cases across scenarios**\n\nThe authors conduct thorough experiments across different datasets and scenarios (text, code, overfitted models). CP-Fuse consistently outperforms baselines like MemFree and CP-$\\Delta$ in copyright protection metrics and achieves near \"non-plagiarism\" on the code task. Further evaluation results also show that CP-Fuse is robust against data extraction techniques, and can be integrated with other training-time copyright mitigation methods.\n\n## **3. Output utility is high**\n\nThe paper reports that CP-Fuse does not sacrifice output quality, achieving comparable scores in fluency (for text) and accuracy (for code generation) relative to overfitted models.", "weaknesses": "## **1. The strong assumption of copyright separability**\n\nThe approach relies on the assumption that copyrighted content is separable across datasets and the user of CP-Fuse has access to multiple models trained on these separate datasets. This assumption may not hold for all real-world datasets, potentially limiting the method’s applicability.\n\n## **2. The computational complexity might limit scalability**\n\nThe computational complexity of fusion with grid search parameters may present challenges, especially for larger models or longer text generations. Also, it remains unclear to me whether and how well this approach can scale over two disjoint datasets and models, given the increased computational complexity.\n\n## **3. Limited scope of evaluation**\n\nCurrently, CP-Fuse is tested on relatively controlled datasets and tasks, the effectiveness in real-world applications with larger, diverse corpora containing complex copyright dependencies is not fully explored.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kdN7Ymj4IA", "reviewer": "Reviewer_MfZh", "summary": "This paper addresses a significant concern in the field of large language models (LLMs) — the risk of generating copyrighted material. The authors propose a novel inference-time method called Copyright-Protecting Model Fusion (CP-Fuse), which reduces the likelihood of reproducing copyrighted content without impacting the quality of the generated text. CP-Fuse achieves this by adaptively combining the outputs from multiple models, each trained on disjoint datasets containing distinct copyrighted material. By leveraging the balancing property in fusion, the paper claims to prevent any single model from dominating the output, thereby mitigating the regurgitation of memorized, copyright-protected text. The experimental results demonstrate CP-Fuse’s effectiveness compared to existing inference-time copyright-protection techniques, with improvements in copyright infringement reduction while maintaining the utility of generated outputs.", "questions": "Is model fusion essential to address copyright concerns, or could other strategies, potentially simpler, also achieve comparable results? It would be helpful to know if the authors considered or tested any alternative methods.\n\nThe paper’s extensive use of various metrics is commendable; however, previous works have often relied on the Longest Common Subsequence (LCS) to gauge memorization. Was there a specific reason LCS was excluded from the analysis?\n\nThe balancing property is central to the proposed fusion strategy, but is its relevance to copyright protection empirically validated? While balancing prevents any single model from fully influencing the generation, it is not immediately clear if or how this directly contributes to reducing copyright infringement. Further clarification on its role and effectiveness would be beneficial.\n\nHow does CP-Fuse relate to Mixture of Experts (MoE) models?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "The paper is well-written and highlights the critical issue of copyright protection in LLMs, which is increasingly relevant as these models are deployed in diverse domains. Addressing this issue is essential for responsibly advancing generative AI.\n\nCP-Fuse introduces a fresh approach to copyright protection by employing model fusion, which differentiates it from conventional methods focused solely on filtering or training-time constraints. The adaptive fusion strategy shows promise in providing a feasible balance between copyright compliance and output quality.", "weaknesses": "While the fusion of multiple models appears to improve copyright protection, it may introduce potential inefficiencies, especially at inference time. However, the paper lacks experimental results that measure the efficiency or computational cost of CP-Fuse compared to single-model approaches. Such evaluations are important to gauge the method's practicality in real-world applications.\n\nThe paper evaluates utility on task-specific datasets but does not test CP-Fuse on general benchmarks like MMLU. Adding such benchmarks could provide a more comprehensive view of the trade-offs in generalization and utility across diverse language tasks.\n\nAs an inference-time approach, CP-Fuse cannot prevent malicious users from extracting model parameters to obtain copyrighted content. If a model has already been trained on multiple datasets containing copyrighted material, an attacker could use a single dataset-focused fine-tuned model to retrieve specific copyrighted documents easily. This limitation suggests that CP-Fuse may not provide sufficient protection against all types of copyright violations, particularly those involving parameter access or model reuse by adversaries.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vNgX7chhza", "reviewer": "Reviewer_87cP", "summary": "The paper introduces Copyright-Protecting Model Fusion (CP-Fuse), a technique designed to reduce the likelihood of language models reproducing copyrighted material during text generation. CP-Fuse combines outputs from different language models, each trained on distinct copyrighted datasets, using an adaptive fusion mechanism. This method mitigates the risk of copyright infringement by limiting memorization without compromising content quality.", "questions": "I was not sure if this should be added as a weakness or question, but have you considered that your approach might not be effective for adversarial prompts? How does CP-Fuse handle cases of minor text modifications where the original structure is still recognizable? Did you try any adversarial extraction methods (similar to the goldfish paper)?\n\nI recommend specifying the duration of each experiment, the hardware (e.g., type of GPU) employed, and the overall computation time to provide clarity on the method's computational feasibility and sustainability. \n\nIt is also necessary to address any anticipated risks or ethical concerns associated with this work. The prerequisite of having a dataset with copyright material and a model trained on such data needs to be further discussed.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "This is a very well-written paper that is easy to follow. It introduces a new, adaptable method for copyright protection that can be combined with other training techniques to further increase its efficacy. A big strength is that the authors provide an extensive evaluation across multiple methods to measure memorization and they also evaluate the fluency/quality of the model outputs.", "weaknesses": "The approach assumes that copyrighted material can be effectively separated into distinct datasets, a process that becomes challenging at larger scales and real-world scenarios. This limitation is noted in the Appendix, but the authors only address the practical challenges of creating copyrighted datasets, and not the potential ethical issues and dual-use concerns that may arise from using such data and models.\n\nMoreover, even though the authors mention how previous works are computationally heavy, they do not include a statement detailing the computational resources used in their experiments.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "V9tyuTY6TY", "reviewer": "Reviewer_BxKD", "summary": "This paper presents the CP-Fuse algorithm, a decoding-time strategy to reduce the amount of verbatim memorization (of copyright data) during LLM decoding. The algorithm operates in two simple steps:\n\n1. Two models are trained on potentially overlapping subsets of the training data, as long as the copyright part is well separated between the two subsets.\n\n2. The two models are interpolated during inference, with a dynamic per-token weighting scheme that ensures an equal contribution from each model towards the output.\n\nThe authors conduct experiments in a number of domains (writing, coding, math abstracts) and find that models trained with CP-Fuse are significantly less prone to verbatim memorization. Moreover, the fused models continue to preserve the quality of the overfit models which did not undergo any interpolation.", "questions": "1. It wasn't super clear to me if the CP-Fuse theoretically guarantees copyright prevention to some n-gram threshold (example: 5-gram sequences will NEVER be copied irrespective of the learnt distributions). Looking at some examples (Figure 13) and Figure 3, I'm guessing this is not true --- But I'm wondering if the authors did any analysis on this / have any insights.\n\n2. How does the method interact with RLHF? Would you suggest splitting RL prompts in a similar manner as done on SFT data? RLHF model outputs are known to be more deterministic than SFT model outputs (https://arxiv.org/pdf/2310.06452) --- does this mean the fusing algorithm will be less effective on RLHF'ed models?\n\n3. Nit: L107: does not assign non-negligible probability --> assigns negligible probability", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The paper presents good contributions in an important research area: preventing verbatim reproduction of copyright information. This topic is getting extremely important recently due to the presence of copyright data in frontier models, which has led to many multi-million dollar lawsuits.\n\n2. The proposed algorithm is intuitive and effective --- it reduces reproduction of copyright material by 25x, and outperforms competing algorithms like CP-delta and MemFree. Experiments are conducted in four different domains using a variety of pretrained models (LLAMA2, GPT-2 XL, Phi)\n\n3. Beyond the main experiments, the paper has a lot of good analysis including (1) a combination of CP-Fuse with training time copyright protection methods; (2) robustness to long prefix probing attacks; (3) different decoding strategies; (4) interpolation of three models; (5) analysis of the chosen interpolation weights.\n\n4. The paper has a great appendix with a lot details and model outputs from both the overfitted model and CP-Fuse. Overall, the paper was well presented, and the figures were clear and easy to understand.", "weaknesses": "I had no concerns regarding the copyright prevention aspect of the algorithm, and thought the experiments were well designed. However, almost all my concerns were regarding the potential quality / utility drop due to interpolation of LLM probabilities during inference. Please let me know if some subset of the weaknesses / questions was covered somewhere in the appendix.\n\n1. **Measuring the quality loss due to CP-Fuse on stronger baselines** would make the paper stronger. In Table 2, currently all models have a HumanEval pass@1 score of less than 29%, which is far lower than the state-of-the-art (Claude 3.5 Sonnet reached 93.7% recently). My hypothesis is that the quality drop due to LLM interpolation maybe higher / more visible with stronger LLMs. Could this method be applied to the larger LLAMA-3 or Gemma-2 family of models?\n\n2. **Unclear quality tradeoff between multitask learning and fusing during decoding**. A lot of the model merging suggests a quality drop from multitask learning to merging models trained on individual datasets. What is the performance difference between a single model trained on `D1+D2` vs CP-Fuse of a model trained on `D1` with a model trained on `D2`?\n\n3. **Experimental settings of overfitting on a small dataset a bit artificial**. The current experimental setting of overfitting on a single small domain-specific dataset seems a bit artifical. In practice, SFT models are trained on a large mixture of multiple tasks (like TULU-v2 https://arxiv.org/abs/2311.10702) and not overfit on any particular task. I would be curious to better understand: (i) what is the recommended strategy for dataset splitting when many source datasets are involved? (ii) Same question as weakness 2, what is the quality tradeoff between multi-tasking and running CP-Fuse on two models?\n\n4. **Is there a slowdown in decoding time?** The algorithm involves sampling from two LLMs at inference, and estimating interpolation weights. How much does this slow down decoding time vs a vanilla single LLM sampling? What is the relative time taken between sampling and interpolation weight grid search?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Oral)