Data Compressibility Quantifies LLM Memorization
Authors: Yizhan Huang
Zhe YANG
Meifang Chen
HUANG Nianchen
Jianping Zhang
Michael R. Lyu
Venue: Accepted by TMLR ()

Abstract: Large Language Models (LLMs) are known to memorize portions of their training data, sometimes even reproduce content verbatim when prompted appropriately. Despite substantial interest, existing LLM memorization research has offered limited insight into how training data influences memorization and largely lacks quantitative characterization. In this work, we build upon the line of research that seeks to quantify memorization through data compressibility. We analyze why prior attempts fail to yield a reliable quantitative measure and show that a surprisingly simple shift from instance-level to set-level metrics uncovers a robust phenomenon, which we term the \textit{Entropy--Memorization (EM) Linearity}. This law states that a set-level data entropy estimator exhibits a linear correlation with memorization scores.

We validate the EM Linearity through extensive experiments across a wide range of open-source models and experimental configurations. We further investigate the role of the token space—an implicit yet pivotal factor in our method—and identify an additional variant of the EM Law. Besides, we made a side observation that EM Linearity enables a simple application to distinguish between LLM train data and test data.

Published in Transactions on Machine Learning Research (04/2026)
Data Compressibility Quantifies LLM Memorization
Yizhan Huang
ychuang220cse.c culk. edu.hk
The Chinese University of Hong Kong
Zhe Yang
she01 2w..i20eenn...o aat..edu.ss..
Nongang Technological University
Mcifang Chen
11551 Blink. culk. edu.hk
The Chinese University of Hong Kong
Huang Nianchen
luvongnia@usc.oo edu
University of Southern California
Jianping Zhang Meta
jiangingghang@rmett.ccom com
Michael R. Lyu
Lyu Cese. cuhk. edu. hk
The Chinese University of Hong Kong
Reviewed OpenReview: https: // openreview. net/ forum? id= 6L4UXc7P3h
Abstract
Large Language Models (LLMs) are known to memorize portions of their training data and sometimes reproduce content verbatim when appropriately prompled. Despile substantial interest, existing LLM memorization research has offered limited insight into how training data influences memorization and largely lacks quantitative characterization. this work, we build upon the line of research that seeks to quantify memorization through data compressibility. We analyze why prior attempts fail to yield reliable quantitative measure and show that surprisingly simple shift from instance-level to set-level metrics uncovers robust empirical phenomenon, which we term the Entropy-Memoriaation (EM) Linearity. This relationship establishes that a set-level data entropy estimator exhibits linear correlation with memorization scores.
We validate our findings through extensive experiments across a wide range open-source models and experimental configurations. We further investigate the role of the token space an implicit yet pivotal factor in our method and identify variant of the EM Linearity. Tn addition, we make side observation that finding enables simple application to distinguish between LLM train data and test data.
1 Introduction
Large Language Models (LLMs) are shown to memorize and reproduce verbatim sequences from their training corpora (Carlini et al. 2019 2020 Such memorization behavior has raised growing concerns, particularly regarding privacy leakage and intellectual property protection. For example, studies have shown that LLMs can inadvertently generate personally identifiable information (PII) (Carlini et al. 2020 or proprietary data from books (USAulh 2023: LLMLitigation, 2023 Cooper al.) 2025) and news articles (Michael
2023). Most recently, Anthropic reached USD 1.5 billion settlement with authors over the unauthorized use
of copyrighted books, undcrscoring the growing legal risks surrounding LLM training data Thh New York
Times 2025
*Corresponding author. Work done in CUHK.

---

Published in Transactions on Machine Learning Research (04/2026)
As the scaling law (Kaplan et al. 2020) drives LLM developers to expand model capacity and training data for performance improvements, research (Wang et al. 2025 Ippolito et al., 2023 has demonstrated that memorization scales with model size. Broader data exposure in LLM training elevates the risk of leakage for all internet-sourced content. Therefore, advancing the theoretical understanding of the factors that shape memorization has become a crucial and urgent issue in LLM development. In general, factors can be categorized into three types: prompting strategy (Carlini et al. 2020; Schwarzschild et al., 2024), model training (Chu et al., 2025), and training data.
The existing memorization literature is limited in two respects. First, comparing the first two factors, the role of training data in memorization is under-explored. Existing rescarch limits the scope to data duplication. where researchers find out that data duplication significantly increases memorization (Kandpal et al. 2022;
Biderman et al. 2023bb. Beyond that, with the belief that highly compressible text is casier to memorize, some attempts have been made to link training data compressibility to memorization (Carlini et al. 2020 Prashanth ct al. 2025). However, such attempts fail to identify significant patterns between compressibilig and memorization. Second, most. existing memorization explorations are limited to qualitalive studies. Most. research work typically regards memorization within a binary framework (Carlini et al., 2020) Zhang et al.
2023 Prashanth et al.
2025 Schwarzschild ct al. 2024h. The only quantitative studies are by Carlini et al.
(2023) and Zhou et al.
2024 and Morris et al. 2025 which investigate model scale, data duplication, and
context length.
Concerning the above limitations, this paper tackles an open question: How to characterize memorization by the compressibility of training data in LLMs quantitatively? Previous quantitative studies fail to address this. This paper formulates memorization using an integer-valued memorization score (between LLM response and golden answer). In this work, we adopt two metries related to compressibility: 1) zlib compression, which is inspired by prior work (Deutsch & Gailly] 1996; Carlini et al. 2020) and 2) an entropy (estimator) motivated by their theoretical connection with compressibility in information theory.
This paper identifies a significant defect of previous attempts: metrics are evaluated instance-wise, Each instance provides limited and noisy information, since the underlying token space is much smaller than the overall token space. Motivated by this, we instead work on set-level. Our set-level approach is also inspired by recent "dataset inference", set-level membership inference attack (MIA) approaches (Maini et al. 2021 2024], where researchers found that instance-level MIA shows limited robustness and works on set-leve! approaches.
With a simple modification from instance-level approaches to set-level, we demonstrate that the set-level entropy estimator accurately approximates the memorization score. Measuring fitness using linear regression, we achieve the Pearson Correlation r > 0.9 across a wide range of popular LLMs. We dub this core finding of the study as Entropy Memorization Linearity. It suggests that training sequences with higher entropy are strongly correlated with higher memorization scores (i.e., lower proximity between the model's response and ground truth data itself). Such linear correlation is empirically validated on a wide range of pre-trained models, including the OLMo family (Groeneveld et al.) 2024), OpenLlama (Geng & Liu 2023). and Pythia [Biderman et al. 2023b). We also explore EM Linearity in various experimental setups, including continuation length and inference sampling strategy.
Our entropy estimator enjoys twofold benefits: 1) the motric gives a quantitative description of memorization. The quantitative metric advances beyond the traditional binary setting of memorization with qualitative empirical observations. A quantitative metric facilitates the assessment of privacy risks for LLM providers. 2) the metric is model-agnostic. A model-agnostic approach is compute-cfficient. It does not require backpropagation with large number of model weights. In contrast, model-aware approaches, such as influence functions (Koh & Liang. 2017 Feldman & Zhang 2020), typically require high computation like Hessian operation or retraining on LLMs.
We conduct thorough investigations into EM Linearity under several dimensions. First, we consider an implicit factor that shapes EM Linearity: token space, the support set over which entropy is defined. We identify that lower memorization-score data comprises exponentialll-iinen linerr fewer unique tokens, and achieves linearly higher entropy values given the support size. Second, by applying our findings to addtional test
2

---

Published in Transactions on Machine Learning Research (04/2026)
data, uncover simple yet effective method for distinguishing training data from test data, This leads to simple dataset inference attack, enabling privacy auditing.
To summarize, our EM Linearity advances beyond existing research in the following ways:
For the first time, we step beyond inslance-level statistics in LLM memorization and oblain a sel-level statistics that approximates LLM memorization well 3$3) We term this as Eutropy-Nor Memorization Linearity.
This pattern is preserved under various experimental sctups (S and Appendix C and D
Different from previous measures that heavily depend on model prompting, our set-based entropy estimator is characterized by the training data. To understand this data-centric metric, we explore the token space, an implicit factor within the training data, and identify variant of EM Lincarity (55).
Our set- base entropy estimator provides a quantitative characterization of memorization. Leveraging this quantitative nature-which most prior work lacks-we further show that the EM Lincarity naturally induces simple dataset inference atlack, enabling practical auditing of privacy risks ($ 6).
2
Preliminaries
To provide background for the study, we first review the efforts link compressibility to memorization Section 2.1
Then in Section 2.2. establish the required notation and explain the experimental setup that we follow throughout the paper.
2.1 LLM Memorization and its link to compressibility
Prior work on characterizing memorization can be broadly grouped into three categories: (i) model-centric factors, such training paradigms and model scale (e.g., larger models tend to memorize more (Ippolito ct al. 2023)): ;; (ii) prompt-centric factors, such prompting strategics (c.g., longer prompts tend to clicit more memorization (Carlini et al. 2023 ); and (iii) data-centric factors, which focus on properties of the training data itself. For a comprehensive review, we refer readers to Section 7
Regarding data-centric factors, a line of seminal work (Kandpal et al. 2022 Carlini el al. 2023 proposes that data repetition significantly increases the chances of memorization. Another line of research tries to link data comprossibility to memorization based an implicit suspicion in the community: highly compressible text corresponds to lower memorization difficulty. Such efforts started from the very first LLM data reconstruction work done by Carlini et al. (2020), where researchers use zlib compression to filter out repetitive text. Later, under binary framework of memorization (i.e., memorization v.s. non-memorizztion) Prashanth et al. 2025 measured the link between text compressibility and memorization, but they did not observe a significan
pattern. Note that perplexity, as explored by previous studies (Aerni el al. 2025 Prashanth et al. 2025 Huang al. 2024), does not fall under the scope of data-centric factors, since it measures the uncertainty of models. So far, rescarchers have yet to establish satisfactory connection between memorization and compressibility.
Metrics of compressibility In this paper, we adopt two compressibility metrics: 1) zlib compression ratio Deutsch & Gailly, 1996), and 2) estimated entropy [ based on empirical point probabilities (Carlton 1969 The use of zlib compression follows Carlini et (2020); while the second entropy-based metric is inspired by the close relationship of compressibility and entropy proved by the source coding theorem [Shannon 2001). Note that two metrics correspond to two types of lossless coding algorithms in information theory: coding schemes for sources with memory and without memory, i.c., memoryless.
Previous work fails to characterize memorization through data compressibility. Since prior work explores memorization with different experiment setups, we reproduce the result under a unified setup.
We assume base-2 logarithm entropy calculations throughout the work.
3

---

Published in Transactions on Machine Learning Research (04/2026)
Mem. Score zlib compression
Levenshtein Distance vs Answer Entropy
Intercept: 0,422
Slope: 0.006
Pearson 0.609
Dota Count: 219186
Entroyy
Interceat:
Peanson 0.581
Data Count:: 240000
Fit Line
10
30
40
50
10
20
Levenshiein Distarce
Mem. Score
(a) entropy estimator v.s. memorization score.
(b) zlib compression rate 8.s. memorization score.
Figure Existing compressibility metrics fail to capture memorization on OLMo-1B. In this figure, each point represents sampled text sequence from the LLM training corpus, and sampling is repeated N = 240,000 times.
Figure 1 presents the result of instanco-level entropy estimator and zlib compression ratio. The algorithms are detailed in the Appendix B and the experimental sctup will be explained in Section 2.2 In general, we observe a positive, yet weak, linear Pearson correlation, with r around 0.6.
2.2 Experimental Setup
Threat Model This paper assumes hypothetical engineer who studies the characterization of training data LLM. Therefore, it is necessary for the engineer to have full access to the LLM and its training data. This engineer controls for other potential confounders in the memorization score, including prompt strategy and training paradigm.
Consistent with the prevailing literature on memorization, this work focuses on pre-trained ("basc") LLMs optimized via cross-entropy loss. We also evaluate post-trained models (e.g., "instruct" variants) the appendix C.6
Choices of LLM and Training Corpus We selected four LLMs: (1) OLMo Groeneveld et al., 2024 pre-trained on Dolma (Soldaini et al.
2024 datasot, and (2) OLMo-2 (OLMo al. 2024) pre-trained on OLMo-2-1124-Mix OOMMo al. 20244) dataset; (3) OpenLlama (Geng & Liu 2023) pre-trained on Redpajama
Computer 2023
(4) Pythia (Biderman al. 2023b) pre-trained the Pile (Gao al. 2020
Prompting Strategies In this study, we consider a Discoverable Memorization (DM) scenario (Nasr et al.
2025 Carlini al. 2023 Kandpal al. 2022 Ippolito al. 2023). Formally, DM denotes the following: we sample N token sequences from the training dataset. Each sequence is partitioned into (p, s), where p (first lpl tokens) serves the prompt and (remaining tokens) serves the answer for model 0. Afterwards, LLM 0 generates response r = (p)) The memorization score measures the difference between two sequenocs r and s. By default, we set [p] = 100 and | |rl 50, following the popular setup in the community (Al-Kaswan) et al. 2023). However, variants continuation length will be discussed in Section ! We defer the detailed statistics of the sampled datasets to Appendix [A2] The token sequence sampling strategy as follows: we repeatedly randomly sample a sequence (with length lp + s|) from the dataset until the number reaches the required number.
4

---

Published in Transactions on Machine Learning Research (04/2026)
Filtering Trivial Memorization We exclude trivial memorization cases where the model's response exhibits high lexical overlap with the prompt p. For example, the LLM may copy a long URL from the prompt to its response. Such cases are outside the scope of our interest, as memorization is shaped by the prompt rather than the training data. We devise a Longest Common Subsequence (LCS)-based filtering approach. We establish thresholding strategy based on LCS: samples for which LCS(p, s) z are excluded from further memorization analysis, while samples below the threshold are retained.
[s| "
We adopt the notion of memorization score d(r, s) to mcasure the differences between response r and answer at the token level. Following previous memorization work (Dong et al.) 2024). we use Levenstein distance, or edit distance (Levenshtein et al. 1966), i.e., d(r, s) = (r, It is defined by the minimal number of single-token edit operations insertions, deletions, and substitutions required transform one sequence into another. A higher memorization score indicates lower similarity between two sequences. Such definition offers two key properties to our memorization score: 1) It functions as an interval scale, allowing for more nuanced quantification of the memorization; and 2) It captures verbatim sub-soquences even when they are offsct by minor variations. A detailed discussion of the intuition underlying the memorization score is provided in Section A.1
Memorization Score
Note that we choose not to use a semantic-based memorization score, as semantic-level memorization does not have clear or direct social implications. For example, authors are suing LLM providers over the use of copyrighted books because model outputs exhibit substantial verbatim or near- gear-verbatin overlap with their texts, not because the models generate passages that merely semantically similar.
To summarize, the research question in this paper is formulated as follows:
Assumption. A fixed pre-trained LLM 0, a fixed prompting strategy DM to generate p, LLM response r = (p), and a memorization score d(r, s) = (r,
Goal of the study. Find an approximator function (s) of memorization score d(r, s).
3 Methodology
3.1 Limitation of prior instance-wise compressibility metrics
As demonstrated in Section 2.1 prior approaches fail to reliably approximate memorization. We altribute this limitation to the sparsity inherent in instance-level computation: a single sample covers only a negligible fraction of the full token space, rendering such metries fundamentally incapable of capturing distributional characteristies. Formally, given fixed memorization score e, the objective is to estimale a statistic (entropy) of distribution conditioned single instance s; = (s!, s?...,, s,"', ( as a sufficient representation this conditional distribution p(s e), hence induces a large variance estimation.
memorization score e, i.e, p(s e). Previous methods essentially treat
In practice, under our experimental setup, single instance s; spans most |s;| 50 tokens. This is orders of magnitude smaller than the full vocabulary [T]. For example, for OLMo-1B (B, |T| x 50, 000, hence |s,| is the 0.1% of the available token space. Even saturating the context window limit (e.g., 4,000 tokens for OLMo-1B) does not bridge this gap. Consequently, instancc-level compressibility measures remain highly noisy, failing to provide a robust estimate in real-world regimes where per-instance support is critically sparse.
3.2 Set-level compressibility metrics
In this work, address the limitation of previous work by substantially expanding the size of the token space - We consider "level-set" based method that uses all possible token samples with memorization score e. Specifically, we expand the token space from the tokens of one instance to all instances with the same memorization score e. In math notations, for a fixed memorization score the new token space is defined as:
To = U( d(r,, 8i) = =, "..........- NN (0, ... ,,18 [1]]
(1)
5

---

Published in Transactions on Machine Learning Research (04/2026)
By adopting the above heuristics to construct set-level estimates, aim to obtain token space whose scale is comparable to that of the full vocabulary. Next, we describe how we implement the zlib-based and entropy-based methods at the set level.
zlib method. We adopt zlib compression for the concatenation of sequences with the same memorization score e:
Se
d(r 84) e, e (0, ... 1..j E (0, .......----111 1)].
(2)
where @ denotes string concatcnation. Then, zlib-based compressibility is calculated by the compression rate of zlib:
Mant(se)= [zlib(s.)l
(3)
|se
Entropy method. The empirical probabilities (x( are now calculated within the new space Te:
Px(x) A p(xle) |s] kddr, s,) = eHl ((i.j) sy x, d(ri, 8:) = =
(4)
We then use new empirical probabilities to derive new level-set-bass entropy estimate to approximate the memorization score e.
Ment (se) 2
Σ
fe(x) log (e
(5)
ZET.
We provide the complete algorithm in Alg.
Algorithm 1: Compute set-level compressibility metrics.
Input: LLM 8, and training corpus D.
Output: Plot of (e, (s=))
Sample N prompt-answer (pirs((p,, s:)} from D; // Section 2.2
for +- to N - do
ri - (p.)) Prompt for response
8i) + (r,,)))) // Xemorization score
end
for
e to 1
// zlib method
1}.j - (0....,ll , ,1s|-11 1}} // Prepare sequence. + + { d(rr, 8t) = i (0.... N N
Ref:
Eq
2
Manb(Se) balib(s]ll // Obtain zlib compression rate. Ref Eq. lael
// Entropy estimator method
Pe - Nol ((i,]) of = d(ri s1) c e) // Obtain empirical probabilities. Ref:
Eq.
10
Mont(s.) + -E Exer, (x( (x) // Calculate Entropy. Ref: Eq.
5
Plot (e, Mema(s)) and (e, Maub(se)).
12 end
Note other plausible set-level approaches. In addition our primary method, we further investigate variation involving more aggressive expansion of the token space. This approach, which denote n-width- width--binning memorization scoring, is detailed in Appendix C.4 Notably, our primary method represents the special case where n = within this broader framework.
4 Entropy-Memorizttion Linearity
We run algorithm I on an extensive range of open-dataset LLMs and present the empirical results in Fig, It turns out that the level-set-based entropy estimator is a better approximator of the memorization score than the zlib method.
We observe powerful linear empirical results (r 0.972 and 0.945 respectively) on both plots. It indicates that the level-set-base based entropy estimator is effective linear approximation of memorization

---

Published in Transactions on Machine Learning Research (04/2026)
Levenshtein Distance vs Entropy
Intercept: 3,724
Stppe 0.142
0.52
11
Pearson 0.45
Data Caunt: 790300000
Pearson 0.264
10
0.50
9-
Entopy
8-
7-
0.44
6-
0.42
5-
Dota Points
Fit Line
0.40
Points
0
10
20
30
40
50
Levenshtein Distance
20
Levenshtein Distance
(b) level-set-based entropy estimator n.s. memorization Score.
(a) zlib compression rate v.s. memorization score.
Figure 2: At the set level, compared to zlib compression rate, entropy-based method achieves good approxi- mation of memorization score. The experiments are conducted on OLMo-2-1124-7B.
score. We name this discovery as Entropg-Memorization Linearity. Here is a formal description of the linearity:
Entropy Memorization Lincarity. Given fixed pre-trained LLM 0, fixed prompting strategy DM to generate and a memorization score d(r, s) diev (0(p), s). Ment(s) serves as linear approximator of the memorization score (0()))
In Figure g provide extensive results OpenLlama, Pythia-77m-ddcuupel
Leweerteir Cerawics oc Everany Se0 BroDaed moerrppaee
Detnnce Entragy EEW
momedoo Servece Entropy
Mouml:
115
E.00 Beostee tanageaa
35-
Dat
26
10
%
28
30
(a) OLMo-1B
(b) OpenLlama-1330
(c) dyddea-77m-ddddpped
Figure 3: Entropy-Memmoriattin Lincarity open-datasct LLMs.
We explore various LLM inference sampling strategies, including temperature, top-p and top-k sampling in Appendix C. Experiments a broader range of models are available in Appendix C.2 In appendix D we also separate the whole datasets into N semantic clusters, and then validate our finding within each cluster. Next, to showcase the validity of EM Linearity, we present our evaluation under varying continnation lengths.
Entropy-Meen Memorization Linearity is preserved under varying continuation lengths We explore different continuation token lengths, inchuding (10, 20, 30, 40, 50). As demonstration, we use OLMo-2-1124- 7B and its training dataset OLMo-2-1124-MP to the range [0, 1] in the plot for better presentation.
this experiment. Note that we rescaled the memorization

---

Published in Transactions on Machine Learning Research (04/2026)
gen10
11
Intorcept=6.21)
gen20
gen20 fit (r=0.97, intercepttoct-
10
gen30
gen30 intercept=4..222
fit (r=0.96, intercept=3399)
gen50
Entropy
(r-0.95, intercept-3.72))
7-
6-
5
4-
0.0
Normalized Levenshtein Distance
Figure 4: Fntropy-Memorization Linearity under varying generation token lengths.
Figure presents the experimental result when the generation token length varies. The Pearson correlation coefficients (r) remain very high (ranging from 0.92 to 0.98) across all settings, indicating robust fitness under varying token lengths. Although regression lines have different slopes and intercepts, the y-value reaches about when the memorization score e = 50, i.c., ((5o) = 11.
Another observation is that there a monotonic increase in the intercept values of the fitted regression lines as the generation token length increases. Information theory may help to justify this: Denote the vocabulary size [T], n-sequence has |T|" potential outcomes; hence, when gets larger, the maximum entropy of the n-sequence increases.
Besides, we observe that EM Linearity weakens under out-of-distribution data. We also explored a boundary case of EM Lincarity, where the correlation weakens on a biomodical research data subset. We provide a detailed description the Appendix C.5
5 Normalized Entropy-Memorrzattin Linearity
Our method effectively enlarges the token space and provides reliable proxy for the memorization However, we have not yet conducted detailed investigation of the underlying token space itself. In fact, token space size plays an implicit yet crucial role in EM Linearity. In information theory, the maximum entropy is bounded by outcome space cardinality. In fact, the maximum entropy of discrete random variable is Ei 1 log 1 log n, where n is the cardinality of the outcome space (i.c., token space size). The upper bound is achieved when the random variable follows a uniform distribution.
In this subsection, for each memorization score e, we report the corresponding token space size Te. The results are shown in Fig. 5a] The statistic is calculated following the same experimental setup OLMo- 1ollo-2-112--11 1124-7B. The experimental result indicates that the token space size, or unique token count, grows exponentially the memorization score incrcases. Low-score memorization occurs within a limited token space. Remarkably, while the full dataset contains tens of millions of tokens, perfect memorization (score=0) occurs within merely 2'0 unique tokens, namely 1/50 of the vocabulary size. While we do not provide a further theoretical justification, we suspect that tokens appearing with higher froquency in the training corpus are more likely be memorized, Further investigation may require another line of rescarch: measuring memorization at the token level. In the context of membershippinffeence attacks, there explorations like Tao Shokri 2025

---

Published in Transactions on Machine Learning Research (04/2026)
Levenshtein Distance vs Unique Token Count
Levenshtein nis vs Normalized Entropy
226
Unique Token Count
Normalized Entropy
Fit Line (Nerm. Entro
234
Unique Token Count
222
Normalized
0.80
2/0
0.75
2-
KGroups:
Instances:
Intercept: Pearson
Slope: Groups:
Instances:
2'
0.70
10
30
50
30
Levenshtein Distance
Levenshtein Di stance
(a) Memorization score u.s. token space on OLMo-2-1122
(b) Memorization score v.s. normalized entropy on OLMo
7B. Note: the scale of the y-axis exponentiol.
2-1124-7B.
Figure Memorization score v.s. normalized entropy OLMo-2-1124-7B.
Given a fixed outcome--ppace cardinality, our entropy estimator characterizes how the empirical probability mass distributed. To factor out the influence of token-space size, we normalize the observed entropy by the maximum attainable entropy under the same token-space cardinality, and refer the resulting ratio as the normolized entropy:
M(se) A M(s.). (se) Hmax, log Te
(6)
where (s.) normalizes the entropy estimate (se) by its theoretical maximum Hmax.e- Values approaching indicate a near-uniform distribution over the token set Te: while lower values suggest greater non-uniformity.
Following the same setup on OLMo-2-1124-7B, we plot (e, M(z)) using blue dots on Figure 5b to observe how the normalized entropy estimator changes with the memorization score. Interestingly, we observe another linear trend it indicates that normalized entropy (negatively) linearly decreases as the memorization score increases. In appendix C.3 we discuss the pattern with different sequence lengths.
Although theoretical justification is not available for the phenomenon, potential explanation is that bongh-mmmmrizaioonsssoooo samples tend to follow more "natural" language distribution, which is known to be long-tailed (Zipf 2016) and therefore exhibits lower entropy. In contrast, low-memorzzation-son samples may contain more specialized content- such as code snippets or numerical values whose distributions deviate from typical natural language regularities.
Summary. By decoupling the entropy estimator to outcome-space cardinality and randomness of distribution, we reveal that 1) lower memorization-scoro data comprises exponentiallyy linear fewer unique tokens, and 2) achieves linearly higher eutropy values given the oulcome space.

---

Published in Transactions on Machine Learning Research (04/2026)
6 Application: Dataset Inference using EM Linearity
6.1 Entropy Memorization Linearity Test Data
Running algorithm I on training dataset of LLMs, discovered the Entropy-Memorization Linearity, This section then explores another question that naturally arises what happens if we the same algorithm test dataset? It turns out that the plot behaves very differently from training datasets.
Figure presents the plot of applying the entropy estimator and the normalized ent ropy estimator to test data. To maintain consistency throughout the paper, we use the terms used for memorization with slight abuse. For example, the memorization score still measures the distance between the ground truth and the modcl's response, but the model is actually "memorizing" training data. Following the same setup described in the main body, select data from LiveBench (White et al., 2025 from 2024-06-23 25 to 2024-11- 11-2-1 The time property guarantees that LiveBench is non-member data for OLMo-2-1124-7B. LiveBench is licensed under the CC BY-SA 4.0 International License.
Levenshtein Distance vs Normalized Entropy
Levenshtein Distance Entrapy 10
Normalized Entropy
Pearsin 0.965
Data Countt: 2063/3011
0.96
Line (Norm. Entropy!
Unique
211
Nomaltia Entray
Unique Tolon Count
Enorery
0.88
0.86
0.84
Intercept 0.958
Slope: 00.002
-22
Data Points
Pearson 00.634
Data Count: 2063/3011
Levensiteein Distance
Levenshtein Distance
(a) Entropy estimator u.s. memorization
(b) Normalized entropy u.s. memorization
Figure 6: Pntropy-Memoriiee Linearity on OLMo-2 with LiveBench dataset.
With around 3k samples from LiveBench, observe that: (1) Level-set-based entropy is still good indicator of LLM performance, demonstrated by the high Pearson's r. The sample space also approximately grows exponentially as the memorization score increases. (2) Compared to the training data, the intercept. is lower, and the slope is higher. There is less coverage of low memorization scores, especially for memorization scores within the range of 0-10. (3) In the low-distance set, it is obscrved that OLMo-2 produces low-entropy text. The entropy is much lower than what we observed in the train data.
Here case study on 2-distance memorization:
Prompt. Please create valid join mapping between CSV Table A and CSV Table B. Each column in A maps to 0 or columns in B. Return your response as Python dictionary, formatted col name in df : name in df b. Please return only the dictionary. CSV Table A: freas,freq 1,freq 2,freq 3,freq 4,freq 5,freq 6 0.0,0.0,0 Response.
0,0.0..0.0,00..0000
100000000000000000000000 2.0
Given the prompt in this case study, OLMo-2 generates repeated numbers, exhibiting low entropy. Based on the observations above, derive simple strategy to distinguish between train data and test data for LLM.
10

---

Published in Transactions on Machine Learning Research (04/2026)
6.2 Data Inference Methodology
Dataset Inferences Dataset Inference (DI) MMaini et al. 2024 2021 builds on the idea of membership inference attacks (MIA) (Song & Shmatikov 2019 Galli et al. 2024 Carlini et al. 2022: Mattern et al.) 2023
Jagannatha et al. 2021). Both MIA and DI aim to identify whether some suspect data was part of the training data, but they differ on the amount data required. MIA operates at instance (sentence) level; however, DI operates on a collection of instances
reality, the suspect data used for DI could be a book.
In practice, DI can identify potential test set contamination to provide calibrated performance evaluation of LLMs. DI may also detect umauthorized usage of copyrighted training data, thus promoting the protection of intellectual properties. Moreover, by using more data to determine membership, DI is deemed to be more realistic than MIAs. As several works Duan et al. (2024); ; Maini et al. (022)): Hayes et al. presented, as the size of the training set increases, the success of membership inference degrades to random chance. Our DI method is inspired by several empirical observations. First, over- wver-parametiizaionn of LLMs may lead overfitting on training data, resulting in a generalization gap between training data and testing data; then, LLMs may perform well low-entropy lesting data, resulting in low intercept in EM Linearity. Besides, given fixed dataset and LLM, empirical evidence suggests that the intercept and slope generated by Algorithm are dependent. This inspires us to develop the following strategy for dataset inference:
Given an LLM and dataset D, run Algorithm ! and get intercept k. Compare with a pre-defined threshold Tk. Assign label (i.e., member) if k Tk, assign label 0 otherwise.
Amount of data required for our DI method Effective dataset inference requires reliable entropy estimation and diverse memorization score distributions. In the main body, we have revealed that the frequency of low memorization score is exponentially smaller than that of a high memorization score. Therefore, we set the minimum sample size to n = 1,500, with each sample being a 150-token sequence. Appendix discussos how we determine the minimum size through a scnsitivity test.
6.3 Experimental Results on Dataset Inference
Table 1 Dataset inference result
LLM
Dataset
Intercept
Slope
Prediction
Ground-truth
OLMo-2
LiveBench MIMIR. cc
2.202
0.155
0
0
Pythia
-2.048
0.251
Pythia
MIMIR cc
3.992
0.091
1
1
OLMo-2
OLMo---1124-Mix
3.724
0.142
Pythia
MIMIR full
6.297
0.092
O
Pythia
MIMIR full
6.166
0.095
Pythia
MIMIR tarxiv
1.156
0.174
Pythia
MIMIR tarxiv
-0.910
0.0227
0
Pythia
MTMIR wiki
3.006
0.131
Pythia
MTMIR_
2.894
0.133
1
Selected LLMss. We select OTMo-2-1124-7B ("OLMo-2"), Pythia-6.9B-deeupee Biderman al. 2023b ("Pythia").
Selected Datasets. We select LiveBench (White al. 2025 and MIMIR (Duan et al 2024. For LiveBench, we use data from 2024-06-25 to 2024-11-25. MIMIR is a public dataset originally for evaluating MIAs on the Pythia suite by re-compiling the Pile (Gao et al.) 2020) train/test splits. For MIMIR, we use Pile CC ("ce"), temporal aixiv ("tarxiv"), "wiki" subset, and full dataset (*full") for evaluation. Note that. LiveBench and Temporal Xiv are temporal-cutoof-baseee while the remaining dataset based.
Threshold for each LLM. In our method, we assign a threshold for each LLM. We empirically set Ty to 0 and for Pythia and OLMo-2, respectively.
11

---

Published in Transactions on Machine Learning Research (04/2026)
Table 1 presents the overall results of our method on the dataset inference task. In general, it achieves desirable accuracy. For more discussions on detailed comparison with baseline methods, we refer the reader to the appendix E.2
6.4 Practical Use of the Dataset Inference Method
In practice, our DI method provides a practical tool for auditing the privacy of training data. An external auditor may apply the dataset inference method follows:
1. Using a known subset of the training data, the auditor applies the set-level entropy method to obtain reference results. This sctup is realistic, as only part of the training data is required.
2. The auditor determines an appropriate intercopt threshold based on step 1.
3. The auditor collects candidate dataset that is pending for dataset inference audit, and runs the set-level entropy method on the dataset.
4. Using the threshold from Step 2, the auditor makes binary decision on the dataset membership.
Advantages of our data inference method It compute-effciiet- it only requires LLM inference on n samples. It does not require any additional shadow or reference models.
7
Related Work
Since the discovery of the memorization phenomenon in the late 2010s (Zhang et al. 2017 Carlini et al.
2019
2020 Feldman 2020), the AT Security and Privacy research community has maintained a strong interest in the phenomenon and its implications. The following paragraphs examine how memorization in language models is influenced by key factors, including training data, model paradigm, and prompting strategy.
Data shapes memorization. Several studies suggest that (Kandpal et al.) 2022 Biderman et al. 2023b)
duplicated data significantly increases memorization. Larger models trained on larger datasets show increased memorization (Biderman et al., 2023a bb. Other studies (Tirumala et al. 2022 Wang et al. 2025) investigate
how memorization manifests across data with varying semantics and sources.
Model Paradigm shapes memorization. Beyond pro-trained language models, recent work has explored memorization in post-training stages. Chu el al. 20255 demonstrate that supervised fine-tuned (SFT) LLMs exhibit stronger memorization tendencies than those trained with reinforcement learning (RL). Additionally, Nasr et al. (2025) reveals that aaiety-aligned models still retain memorized data.
Prompting Strategy shopes memorization. Researchers employ three main types of prompting strategies for language models, categorized by threat models. A significant. body of work relies on manual efforts or template-based approaches to generate prompts at scale, as seen in Carlini et al. (2019 2020 Kim
cet al. (002)). Studies such as Carlini et al. (2020): ; Kandpal et al. ( McCoy et al. (2021) demonstrate
that longer prompts substantially increase the likelihood of reproducing memorized training data sequences. Another line of rescarch constructs prompts dircctly from existing data sources, such as training corpora or web data (Nasr et al. 2025 Carlini et al., 2023: Kandpal et al.) 2022 Ippolito et al. 2023 Aerni al., 2025). Recent advances involve more sophisticated strategies that leverage synergies between LLMs and training data. For example, Zhang et al. (2023) quantifies how the performance of model depends on whether an example x was included in the training data. Additionally, Schwarzschild et al.
2024
adapts a prompt
optimization tool to generate elfective extraction prompts.
Comparison with other qualitative studies. While established literature Carlini et al. 2023 Zhou et al. (2024), and Morris al. (2025) examine memorization quantitatively, our work differs from them, focusing on training data compressibility rather than factors such model scale, data duplication, and context. length.
12

---

Published in Transactions on Machine Learning Research (04/2026)
8 Limitations and Broader Impacts
Limitations Predictive power of the Entropy-Memortzation Linearity Due the limitation of the sample space as discussed in Section B strategy does not enable memorization score prediction at the instance level. However, we see promising results on set-level memorizatiio--reltee tasks, such as Dataset Inference.
Empirical experiments. Our work adopts a single set of prompting strategy (DM) and memorization score (edit distance) in our memorization experiments. Although the setup is commonly used by other studies, other combinations exist. We want to explore adversarial compression (Schwarzschild et al. 2024). and non-adversarial reproduction (Aerni et al. 2025 in our future work.
Implications and Societal Impact For the research community, we believe the EM Lincarity provides a useful foundation for icalretical understanding the factors that drive memorization LLMs. Moreover, it enables a simple and scalable approach for privacy auditing, For practitioners training LLMs, our method allows pre-screening of training datasets assess potential memorization risks. External auditors may also employ our dataset inference method to detect test-set contamination and identify potential copyright infringement issues in deployed models.
This paper uses existing open-research LLMs and their corresponding training datasets. To the best of the authors' knowledge, this research does not introduce any additional negative societal impacts.
9 Conclusions
This paper presents the Eetropy-Memooizzatio Linearity: a level-sot-based entropy estimator of training data chunks linearly approxinales the edit-distannce-aseed memorization score. Further investigation indicates that this correlation is robust acrosss different sequence lengths, sampling strategies, and data clusters with different semantics. By examining vocabulary size, it is revealed that lower memorization-ssorr data comprises exponentiallly-liee fewer unique tokens, and achieves linearly higher entropy values given the support size.
For future work, we plan to explore why the proposed level-set-based entropy estimator fits the memorization score so well. Potential theoretical tools include the long-tail theory of Feldman et al [Feldman 2020 Feldman & Zhang 2020), and calibiiialibitooon in LLMs (Detommaso al. 2024). Such efforts may also shed light on the interpretation of slope and intercept resulting from the EM Linearity.
Acknowledgement
The work described in this paper was supported by the Research Grants Council of the Hong Kong Special Administrative Region, China (No. CUHK 14209124) of the General Research Fund, and RGC Grant for Theme-based Research Scheme Project (RGC Ref. No. T43-513/23-N).
We thank Farzan Farnia for his insightful comments and discussions.
References
Michael Acrni, Javior Rando, Edoardo Debenedetti, Nicholas Carlini, Daphne Ippolito, and Florian Tramèr. Measuring non-adversarial reproduction of training data in large language models. In The Thirteenth International Conference on Learning Represendations, 2025. URL https:://pperreiier http::///ppaarrreeeeeeeeerrrrtod fnt/
590yfqz1LE
Ali Al-Kaswan, Maliheh Izadi, and Arie Van Deursen. Targeted attack on gpt-neo for the satml language model data extraction challenge. arXio preprint Tfi:2332.07733 2023.
Stella Biderman, Usvsn Prashanth, Lintang Sutawika, Hailey Schoelkopf, Quentin Anthony, Shivanshu Purohit, and Edward Raff. Emergent and predictable memorization in large language models. Advances in Neural Information Processing Systems, 36:28072 36:28072-28099, 2023a.
13

---

Published in Transactions on Machine Learning Research (04/2026)
Stella Biderman, Hailey Schoelkopf, Quentin Anthony, Herbie Bradley, Kyle O'Brien, Eric Hallahan, Mo- hammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, Aviya Skowron, Lintang Sutawika, and Oskar Van Der Wal. Pythia: a suite for analyzing large language models across training and scaling. In Proceedings of the 40th International Conference on Machine Learning. ICML 223. JMLR.org, 2023b.
Ricardo Campos, Vitor Mangaravile, Arian Pasquali, Alípio Jorge, Célia Nunes, and Adam Jatowt. Yake! keyword extraction from single documents using multiple local features. Information Sciences, 509:257- 289, 2020.
N. Carlini, C. memorization in neural networks. In USENIX Securily, 2019. URL usenixsecuris usenixsecurity19/pppe. http:////i./.ppeeeaaaiaooooo//aa carlini
Lin, U. Erlingsson, J. Kos, and D. Song. The secret sharer: Evaluating and testing unintended
usenix org/conference/
N. Carlini, F. Tramèr, E. Wallace, M. Jagielski, A. Herbert- Voss, K. Lee, A. Roberts, T. B. Brown, D. Song, U. Frlingsson, A. Oprea, and C. Raffel. Extracting training data from large language models. In USENIX Security Symposium, pp. 2633 2650, 2020. URL httpp://www http://wwwwwwwww...e//// ort///stet////tillss//////
sec21 Soc21-carlimg cecarlinneeeen wwwiiiiiiettttnngggneee extracting....................te pdf
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference atacks from first principles. In 2022 IEEE symposium on securily and privacy (SP); pp. 1897-19144 IEEE, 2022.
Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Represenlations, 2023. URL http:////ppeeeeeeeeeeeeeftrrrrra
_ck
AG Carlton. On the bias of information estimates. Psychological Bulletin, 71(2):108, 1969.
Tianzhe Chu, Yuexiang Zhai, Jihan Yang, Shengbang Tong, Saining Xie, Sergey Levine, and Yi Ma. SFT memorizes, RL generalizes: A comparative study of foundation model post-training, In The Second Conference on Parsimony and Learning (Recent Spotlight Track), 2025. URL https://oppurrriee..ettt net/ forum?1d=d333LNnTT
Together Computer. Redpajama-data: An open source recipe to reproduce Ilama. training dataset, 2023.
URL attpep///gggbbbb.oooooogeeeeeeee
A Foder Cooper, Aaron Gokaslan, Ahmed Ahmed, Amy B Cyphert, Christopher De Sa, Mark A Lemley, Daniel Ho, and Percy Liang. Extracting memorized pieces of (copyrighted) books from open-weight language models. arXiv preprint ar Xrxv::2505. 10155.125.4 12546, 2025.
Gianluca Detommaso, Martin Andres Bertran, Riccardo Fogliato, and Aaron Roth. Multicalibration for PMI.R,
confidence scoring in Mms. In International Conference on Machine Learning, pp. 2024.
P. Deutsch and J.-L. Gailly. Rfc1950: Zlib compressed data format specification version 3.3, 1996.
Yihong Dong, Xue Jiang, Huanyu Liu, Zhi Jin, Bin Gu, Mengfei Yang, and Ge Li. Generalization or memorization: Data contamination and trustworthy evaluation for large language models. In Lun-We Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Pindings of the Associalion for Comyyulational Linguislies: ACL 2024. Association for Computational Linguistics, August 2024. URL https://aclanthoon org// org/ 2024. findings--giii aaadiings-al.716//
M. Duan, A. Suri, N. Mireshghallah, S. Min, W. Shi, L. Zettlemoyer, and H. Hajishirzi. Do membership inference attacks work on large language models?, 2024. arXiv preprint.
Vitaly Feldman. Does learning require memorization? a short tale about long tail. In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, STOC 2020, pp. 954-959, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 47834503997 doi: 11.14///357771333342900
14

---

Published in Transactions on Machine Learning Research (04/2026)
Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. Advances in Neural Information. Processing Systems, 33:2881-2885 1-291, 2020.
F. Galli, L. Melis, and T. Cucinotta. Noisy neighbors: Efficient membership inference attas against llms. arXiv preprint (rXit:2406.16565, 2024.
Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, al. The pile: An 800gb datasel of diverse lext for language modeling. arXiv preprint ar.Xt:2101.0000 2020.
Xinyang Geng and Hao Liu. Openllama: An open reproduction of Ilama, May 2023. URL cca/oppenln-reserrch/oooooo aamm 11ama
Dirk Groeneveld, Iz Beltagy, Pete Walsh, Akshita Bhagia, Rodney Kinney, Oyvind Tafjord, Ananya Harsh Jha, Hamish Ivison, Ian Magnusson, Yizhong Wang, et al. Olmo: Accelerating the science of language models. arXiv preprint 802:00002.00838, 2024.
Jamie Hayes, Ilia Shumailov, Christopher A Choquette-Chovd Matthew Jagielski, Georgios Kaissis, Milad Nasr, Meenatchi Sundaram Muthu Selva Amnamalai, Niloofar Mireshghallah, Igor Shilov, Matthicu Mceus, et al. Exploring the limits of strong membership inference atlacks on large language models. In The Thirty-ninth Annual Conference on Newral Information Processing Systems.
Jing Huang, Diyi Yang, and Christopher Potts. Demystifying verbatim memorization large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp- 10711-10732, 2024.
huggingface. all-mpned-base-22, 2025. all sal-mpnet-base v2
URL httppp//wwgggigfcccccccceeeettts
Daphne Ippolito, Florian Tramer, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christopher Choquette Choo, and Nicholas Carlini. Preventing generation of verbatim memorization in language models gives false sense of privacy. In C. Maria Keet, Hung-Y Yi Lee, and Sina Zarrieß (eds.), Proceedings of the 16th International Natural Language Generation Conference, pp. 28 53, Prague, Czechia, September 2023. Association for Computational Linguistics. URL https://aclaatthology org/2023. inlg-main.3)
A. Jagannatha, B. P. S. Rawat, and H. Yu. Membership inference attack susceptibility of clinical language models, April 2021. URL https://arxit: wttp:/wwwwwg//b///.......0
arXiv preprint arXiv:2104.08305
Nikhil Kandpal, Eric Wallace, and Colin Raffel. Deduplicating training data mitigates privacy risks language models. In International Conference on Machine Learning, pp. 10697-10707. PMLR, 2022.
Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scaling laws for neural language models. arXiv preprint ar arXiv:2001.0880 2020.
Siwon Kim, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and Seong Joon Oh. Propile: Probing privacy leakage in large language models. Advances in Neural Information Processing Systems, 36: 2023.
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In Proceedings of the 34th International Conference on Machine Learning Volume 70, ICML'17, pp. 1885-1894. JMLR.org 2017.
Vladimir I Levenshtein et al. Binary codes capable correcting delctions, insertions, and reversals. In Soviet plysics doklady, volume 10, pp. 707 710. Soviet Union, 1966.
LLMLitigation. Kadrey, silverman, golden meta platforms, inc. http:://aaalttaaaiiooooooooo//oo kadrey-meta-come wowptaccolllitt....mmmm .df 2023.
15

---

Published in Transactions on Machine Learning Research (04/2026)
Stuart Lloyd. Least squares quantization in pem. IEEE transactions on information theory, 28(2):129-137, 1982.
Pratyush Maini, Mohammad Yaghini, and Nicolas Papernot. Datasel inference: Ownership resolution in machine learning. In International Conference on Learning Representations, 2021. URL https 7/openreview. httprr/wwww..ett/oooorrrraaaaaae mot:/oorrumm/daavkkk22777777
Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. LLM dataset inference: Did you train on my dataset? In The Tiihth Annual Conference on Neural Information Processing Systems, 2024.
URL https://openreevie htt.://r....tooommmmd//o/11111
Justus Mattern, Fatemehsadat, Mireshghallah, Zhijing Jin, Bernhard Schoelkopf, Mrinmaya Sachan, and Taylor Kirgpiirk.....c. Membership inference attacks against language models via neighbourhood comparison. Pindings of the Association for Compulational Linguistics: ACL 2023, pp. 11330 11343, 2023.
R. T. McCoy, P. Smolensky, T. Linzen, J. Gao, and A. Celikyilmaz. How much do language models copy from their training data? evaluating linguistic novelty in text generation using raven, Nov 2021. arXiv preprint, available at https: org/ aa////bb/211111 09509
Michael. The times sues OpenAT and microsoft over A.I. use of copyrighted work. The New York Times, December 2023. URL https::/www.ntte www.wwwttims...mmm com//202//12/27//usssssss//s//
new -ot--ooo-ttiis--e--------a------ www.aioooooooooooat.....o lawsuit.
John X. Morris, Chawin Sitawarin, Chuan Guo, Narine Kokhlikyan, G. Edward Suh, Alexander M. Rush, Kamalika Chaudhuri, and Saeed Mahloujifar. How much do language models memorize?, 2025. URL
https://arxi: orgg/ba///0s 24832
Milad Nasr, Javier Rando, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A. Feder Cooper, Daphne Ippolito, Christopher A. Pioquctte-Choo, Florian Tramèr, and Katherine Lec. Scalable extraction of training data from aligned, production language models. In The Thirleenth International Conference on Learning Representations, 2025. URL kttps://openreviiet net netf/forru/iivvjelslrr22
T. OLMo, P. Walsh, L. Soldaini, D. Groeneveld, K. Lo, S. Arora, and H. Hajishirzi. 2 olmo 2 furious. arXiv preprint X5i:25510000666 2024.
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models follow instructions with human feedback. Advances in neural informalion processing systems, 35:27730 27744, 2022.
USVSN Sai Prashanth, Alvin Deng, Kyle O'Brien, Jyothir S V, Mohammad Aflah Khan, Jaydeep Borkar, Christopher A. Choquette-Chon Choo, Jacob Ray Fuehne, Stella Biderman, Tracy Ke, Katherine Lee, and Naomi Saphra. Recite, reconstruct, recollect: Memorization in LMs as a multifaceted phenomenon. In The Thirteenth International Conference on Learning Representations, 2025. URL hatps:///pperevieew.ne
forum?id=33EYMWvHH]]]
PyPI. Spacy, 2025. URL
Avi Schwarzschild, Zhili Feng, Pratyush Maini, Zachary Chase Lipton, and J Zico Kolter. Rethinking LLM memorivation through the lens of adversarial compression. In The Thirly-eighth Annoual Conference Neural Information Processing Systems, 2024. URL
Claude Elwood Shannon. A mathematical theory communication. In ACM SIGMOBILE Mobile Computing and Communications Review, volume 5, pp. 3-55, 2001. doi: 10.1145/588499..88-0000
L. Soldaini, R. Kinney, A. Bhagia, D. Schwenk, D. Atkinson, R. Authur, and et al. Dolma: An open corpus of three trillion tokens for language model pretraining research. arXiv preprint arxiv:240 00159, 2024.
C. Song and V. Shmatikov. Auditing data provenance in cext-generation models. In Proceedings of the 25th ACM SIGKDD International Conference Knowledge Discovery 6 Data Mining, pp. 196-206, 206, July 2019.
16

---

Published in Transactions on Machine Learning Research (04/2026)
Jiashu Tao and Reza Shokri. (token-level) informia: Stronger membership inference and memorization assessment for lmss, 2025. URL.
05582
The New York Times. Authropic agrees to pay $1.5 billion to settle lawsuit with book authors. atttps:/vve html September 2025.
nytimes. syttmee.comm20222. Accessod: 2025-09-24.
Kushal Tirumala, Aram Markosyan, Luke Zeltlemoyer, and Armen Aghajanyan. Memorization without overfitting: Analyzing the training dynamics of large language models. Advances in Neural Information Processing Systems, 35:38274-38290, 2022.
USAuthorSGuild. More than 15,000 authors sign authors guild letter calling on ai industry leaders to protect writers. authons-guild-ppee--lllee 2023.
Laurens van der Maaten and Geoffrey Hinton. Visualizing data using I-sne. Journal of Machine Learning Research, ((86):2579-2600) 2008. URL http::///hlll.oooooop///s//////a
Xinyi Wang, Antonis Antoniades, Yanai Flazar, Alfonso Amayuelas, Alon Albalak, Kexun Zhang, and William Yang Wang. Generalization v.8. memorization: Tracing language models' capabilities back to pretraining data. In The Thirteenth International Conference on Learning Representations, 2025. URL
httpp:://penrrevieu nett/forunn?dd=DDxBDDiiY
Colin White, Samuel Dooley, Manley Roberts, Arka Pal, Benjamin Feuer, Siddhartha Jain, Ravid Shwartz Ziv, Neel Jain, Khalid Saifullah, Sreemanti Dey, Shubh-Agrawal, Sandoep Singh Sandha, Siddartha Venkat Naidu, Chinmay Hegde, Yann LeCun, Tom Goldstein, Willie Neiswanger, and Micah Goldblum. Livebench: A challenging, contamination- limited LLM benchmark. In The Thirteenth International Conference on Learning Representations, 2025. URL https: www.::eeeeetttoooddddd/d/oo
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning requires rethinking generalization. In International Conference on Leorning Representations, 2017. URL http:////pppaaeereeeeeeeerrrrrrs
Chiyuan Zhang, Daphne Ippolito, Katherine Lee, Matthew Jagielski, Florian Tramer, and Nicholas Carlini. Counterfactual memorization in neural language models. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.), Advances in Neural Information Processing Systems, volume 36, pp. 39321 39362. Curran Associates, Inc., 2023. URL hhtp::/225.tt///c772222662422333 Paper- Conferenceeeeeeeeeccccce pdf
www.rri..ccpppppeeeeeeeeeeeeeeee files/
Jingwei Zhang, Mohammad Jalali, Cheuk Ting Li, and Farzan Farnia. Unveiling differences in generative models: A scalable differential clustering approach. In Proceedings of the Computer Vision and Patlern Recognition Conference, pp. 8269 8278, 2025.
Zhenhong Zhou, Jiuyang Xiang, Chaomeng Chen, and Sen Su. Quantifying and analyzing entity-level memorization large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 19741-19749, 2024.
George Kingsley Zipf. Human behavior and the principle of least effort: An introduction to human ecology. Ravenio books, 2016.
A Details on Experimental Setup
A.1 Justification on Memorization Score
We adopt a Lovensheeindditanncc-aasdd memorization score. The score offers two key properties: (1) it functions as an interval scale, allowing for a more nuanced quantification of memorization; and (2) it captures verbatim sub-sequences even when they are offset by minor variations.
17

---

Published in Transactions on Machine Learning Research (04/2026)
abc@example com" and the ground truth is "The email is abc@example. com". These sequences differ only by single colon (*:"). Edit distance can still capture the match of the email address, since one operation (removing ":") leads to an exact match. In contrast, position-dependee
For instance, suppose the LLM contimation is "The email is:
distance metrics, which compare strings index by index, fail to capture the shared email address substring. This makes our approach significantly more robust for detecting training data leakage in real-world, noisy scenarios.
A.2 Composition Sampled Dataset
We constructed datasets with sizes 240,000 and 300,000, respectively, for Dolma and OLMo-2-1124-Mix. Table and present the composition of sampled datasets after LCS filtering.
Table 3: Source Counts of ALMo-2-1124-Mix
Dataset
Count
algebraic-stack
797
arxiv
1,464
Table 2: Source Counts of Dolma
delm1
28,130
delm2
27,984
Source Datasct
Count
delm3
28,014
pes2o 39,777
dclm4
28,163
0C
39,743
dclm5
28,049
books
39,598
dclm6
28,065
reddit
39,373
dclm7
28,060
stack
38,865
dclm8
28,091
wiki
23,115
dclm9
28,040
Total
219,186
dclm10
28,032
open-web-maate
499
pes2o
4,364
starcoder
5,280
wiki
276
Total
293,308
18

---

Published in Transactions on Machine Learning Research (04/2026)
B Implementation details of instance-wise compressibility metrics.
Zlib method. For each instance we apply the zlib library to compress the sequence and report its compression rate, computed as the compressed length divided by the original length.
Entropy method. An instance 8; = (s), sy,... s. is a sequence, where sf a token. All tokens within st form the sample space Ti Then for each loken æ Tí, the empirical point probabilities (a()) are calculated as:
1 [
(x)x)
(7)
(x) is the relative frequency of x in the observed sequence. this attempt, we use entropy estimated by the empirical point probabilities as our approximator M(ss):
M(s)) A Σ log)
(8)
2ET;
In practice, the distribution for language is unknown. We instead learn from samples. The above estimator approximates entropy by viewing the point probability samples from the empirical distribution itself.
With the established M(s),, we are interested in whether M(s)) is good approxinator of the memorization score d(r;,,;) 8;). To achieve this, we gather all (M(s), d(r;,s;)) pairs obtained by empirical observations in a scatter plot, and further study their correlation. The detailed algorithm is as follows:
Algorithm 2: Instance-wise entropy estimator.
Input: LLM and its training corpus D
Output: Plot of (d(ri, M (s:)) Sample N prompt-answer (pirs((p: (p:, from D;
for i + 0 to N - do
3
Fi f ((p:);
P. - EmpProb((, 8\// Eq.
M(s:) t - E.En, (z) Eq.
6
d(ri, + (1e
Plot (()
end
We am on the OLMo-1B model, and obtain the scatter plot illustrated in Fig.
C Extended Results on Entropy-Memorization Linearity
C.1 Additional Results with various sampling strategy of LLMs
In the main body of the paper, we assume a fixed temperature of 0.8. this subsection, we adopt different. sampling strategies LLMs and discuss how these strategies might shape EM Linearity. Due to computation constraints, we conduct our experiments on subset "DCLM1" " with OLMo-2-1124-7B. The size of the subsct is around 28,000.
We consider combinations of temperature, top-k sampling, and nucleus sampling (top-p). The experimental results are summarized in Tab. ! and details are shown in Fig. 7 12 Under all sampling strategics that we have explored, we empirically observe that EM Linearity holds with > 0.92. Beyond that, we make few observations here:
The zero-distance point (0, (so)) exhibits a significant deviation from the regression line in both plots. When the memorization score 50, M(50)) zs 11.
Intercept and slope are dependent we fix the LLM and the dataset. The general pattern is that when the intercept increases, the slope decreases. This might indicate that the intercept and slope may have degree of freedom 1.
19

---

Published in Transactions on Machine Learning Research (04/2026)
With fixed temperature, enabling top-k or top-p sampling increases intercept and decreases slope.
The estimated normalized entropy decreases with the memorization score increasing.
The first two obscrvations are consistent with obscrvation points 2 and 3 in Section 5.
Table 4:
Entropy-Memorizatie Linearity under different LLM sampling strategy
Strategy
Intercept
Slope
Temp=0
0.933
5.490
0.106
Temp=0.5
0.936
5.474
0.106
Temp=0.8
0.926
5.011
0.113
Temp=0.8, top top_p=0.5
0.935
5.599
0.103
Temp=1
0.944
4.646
0.118
temp=0.8, top_k-pp_- k-10
0.944
5.138
0.111
Levenshtein Distance vs Normalized Entropy
Levenshtein Distance vs Entropy
Intercapt: 5,490
Pearson r. 0.933
Slope: 0.106
Data Count: 29275/28537
dp do Ropo
Normallzed Entropy Fit Line (Norm. Entrapy)
Unique
0.95
10f
Normalzed Entroey
Unique Toean Count
20x
0.85
0.80
X
10a
Intercopt:
0.004 28275/28537
Data Points Rt Line
10
30 Levenshheein Distance
20
40
10
20
30
40
50
Levenshtein Distance
(a) Entropy estimator.
(b) Normalized entropy.
Figure 7: Sampling strategy: Temp-0.
Levenshtein Distance vs Normallzed Entropy
Levenshtein Distance Entropy
Intercept: 5,474 Slope 0.106
da 9g 90o00
Entropy
29276/25377
Fit Line (Norm, Entrapy)
Unique Count
30
10
Nomallzed Entropy
Unique Tokon Count
0.90
0.85
X
102
0.75
Pearson I52
Data Count: 28276/28537
At Line
10
20
30
0
10
20
30
40
50
Levenshteii Distance
Levensitein Distance
(a) Entropy estimator.
(b) Normalized entropy.
Figure 8: Sampling strategy: Temp=0.5.
20

---

Published in Transactions on Machine Learning Research (04/2026)
Levenshtein Distance Normalized Entropy
Levenshtein Entropy
Pearson Count: 29278/28537
000000
Fit Line (Norm, Entrapy)
Normallzed Entropy.
Unique Tiken Count
10
0.95
Nomalbee Entrayy
Unique Tokan Count
0.90
Entrayy
100
X0
100
Points
0.75
x/c
Maatenn 0.995
it -0.82 R27
Stope: 0.004
Data Count: 28278/2853
Levenshteii Distance
Levenshtein Distance
(a) Entropy estimator.
(b) Normalized entropy.
Figure 9: Sampling strategy: Temp-0.8.
Levenshtein Distance vs Normalized Entropy
Levenshtein Distance Entrapy
1.00
11
Intercept: 5.590
Pearson r. 0.935
Slape: 0.103
Data Couni:: 28275/28537
Be HoRpnes
Normalized Entropy
Line (Norm, Entropy)
Unique
10*
Nomvalied Entropy
Unique Tokan Count
0.90
30*
00
0.80
10R
Intercept: 0.553
Stope: 0,004
Data Paints
Pearson 86]
Data Count 28275/28537
30
20
50
(a) Entropy estimator.
(b) Normalized entropy.
Figure 10: Sampling strategy: Temp=0.8, top-p=0.5.
Levenshtein Distance vs Normalized Entropy
Levenshtein Distance Entropy
Intercept: 4,848 Sinpe 0.118
tige 0000000
Entropy
Pearson
28300/28537
Fit Line (Norm, Entrapy)
Unique Token Count
Normelped Entrony
Unique T5kan Count
100
0.85
0.80
207
0.75
Peagon uu
Data Count: 300/28533
Rit Line
10
20
30
50
0
20
30
40
50
Levenshteii Distance
Levensttein Distance
(a) Entropy estimator.
(b) Normalized entropy.
Figure Sampling strategy: Temp=1.
21

---

Published in Transactions on Machine Learning Research (04/2026)
Levenshtein Distance vs Normalized Entropy
Levenshtein Distance Entrapy
Intercept: 5.138
Slape: 0.111
8800 0eo00000
Normalized Entropy.
Pearson r. 0.944
Data Count: 28272/28537
Line (Norm, Entropy)
Unique
0.95
Nomralzed Entropy
Unique Token Count
0.90
+
100
0.80
102
Data Paints
0.75
Mitorcop:: 9,999
Pearson
Stope: 0,004 Data 28272/28537
30
20
50
(a) Entropy estimator.
(b) Normalized entropy.
Figure 12: Sampling strategy: Temp=0.8, top-k=10.
22

---

Published in Transactions on Machine Learning Research (04/2026)
C.2
Linearity
Levenshtein Distance Zibb (bits/takeen)
Levenshtein Distance Entropy
16.5
Pearson n
0.692
Data Counc: 46519/50000
110
Pcarson:: 0.814
Data Count: 46819/50000
10.5
15.5
10.0
Eytopy
Entropy
14.5
14.0
13.5
28b bitstokien
13.0
Levensttein Distance
Levenshtein Distance
(a) Zlib compression memorization for OpenLlama-7B.
(b) Level-set-based entropy estimate u.s. memorization score for OpenLJama-7B.
Figure 13: Comparison of compressibility- and intropy-based measurements memorization for Open 7B.
The experimental results on OpenLlama-7B are shown in Figure 13a. and 13b with the pattern observed the main paper body.
The findings are consistent
C.3
Normalized Entropy-Memorization Linearity
Levenshlein Distance vs Normalized Entropy
Levenshtein Distance vs Normalized Entropy
2
Normallzed Entropy
Entropy
Rt Line INam,, Entropy)
Line (Narm. Entropy)
24
Unique Token Count
0.90
214
0.875
2
Nomelized Entrpy
Unique Token Count
0.030
0.85
212
Unique Raken
Noraaized
0.825
22
Apply Apck
224
A0c
236
Interbent 9t3
Pearson r: r0-0.833
Slope: -3.006
Data Count: 46519/50000
0.750
Pearson r: -0.999
Siope: -0.004
Data Count: 110038/12483)
20
Levenshtein
Lecenshitin
(a) Normalized Entropy-Memorianne Memorization Linearity for Open..ama-7R.
(b) Normalized Entropy Pythia-6.9R-deddu.
Entropy-Memorizattinn Memorization Linearity for
Figure 14: Normalized Entropy-Memorizatee Lincarity across different model families.
Fig. 15 presents the (estimated) normalized entropy u.s. memorization score. The findings are consistent. with the findings that we observed the main paper body. Morcover, |r| increases from 0.82 0.97 generation length decreases.
C.4 Entropy-Memorization Linearity under coarse binning of memorization score
In the main body of the paper, we adopt an exact-score binning method on memorization scores, i.c., we pool all tokens from the sequences within exactly the memorization score. However, will show
23

---

Published in Transactions on Machine Learning Research (04/2026)
Normalized Levenshtein Distance vs Normalized Entropy
1.00
0.95
Normalized Entropy
0.90
levenshtein, gennceegee00
levenshtein, distance gen10 fit (r=-0.97, intercept=0.98)
distance_gen20
0.80
levenshtein, distance gen20 (r=-0.93, Intercept=1.02)
distance_gen30
0.75
levenshtein, distance, gen30 fit (r=-0.87, intercept=1.011
distance_gende
levershtein, distance gen40 fit (r=-0.84, Intercegt=1.01)
levershtein, distance_genee geni0
0.70
levenshtein, distance distancee_ennão fit (r=-0.82, intercept=1.02)
Levenshtain Distance
Figure 15: Normalized entropy vs memorization score.
in this subsection, under a loarser-grained binning of memorization score, EM Linearity preserved. We conducted range of coarse-grained memorization scoring experiments where we varied the number of discrete bins from fine-grained (10 bins) to coarse-grained (3 bins).
n-widtt--inning memorization scoring. We re-binned (exact) memorization scores into na equal-width bins and computed entropy within each bin. For each configuration, we examined both entropy and normalized entropy (relative to the maximum possible entropy for each token's vocabulary size).
Experimental setup. We select na E (3,5, 103. The models and datasets follow the choices in the main body, i.e. O1Mo-2-1124-7B and its training dataset.
Lewershoain Dasanes Ertryy
Ueveralten soance va Introyy
Avsmitta Disance Etbopy
SapE 1-55
13.h Parroo X-2
2dee C227
11.4
J0BC 2.30
Figure 16: Entropy distributions across memorization bins for different gramularities = 3,5, 10). The core relationship between memorization and entropy is preserved across all binning schemes.
Rosults Figures 16 and 17 show the entropy distributions across different binning gramularities. We observe that EM Linearity and Normalized EM Linearity remain preserved across E (3. 5, 10} (r > 0.9). Conclusion
relationship is not sensitive to the specific discretization choice.
C.5 Case study: when does the correlation weaken?
We study when EM Linearity weakens using a case study from Appendix D.1 In Appendix D.1. we segment the sampled data set into 16 clusters with different semantics, and then test the EM law under these
24

---

Published in Transactions on Machine Learning Research (04/2026)
Leveratsen Ciitancc Nor ma bad Extropy
Loveraniat- Dritance Normalzed Ertrppy (KmO)
Loverantath Nermalizee Orirway dee 20)
Horra Chinne
0.00
Herr
Hormaiaed Denogy
uiue ttam Catnoy)
1.4%
cheway bain
0.50
Court
0300
1.00
9722
112
GAE CURE INEENCOREES
(200
Factua G.A Uae Gatt IVEENORREE
Namann KASS baa (RASSSSEE
Figure 17: Normalized entropy distributions across memorization bins. Consistent patterns emerge regardless of binning granularity, demonstrating robustness of our findings.
semantically different data. While the relationship remains robust across most domains, observed that Cluster 13 (" ("Genetic and Biomedical Research") exhibited noticeably weaker correlation (r = 0.75). The results are shown in Figure 20m We suspect that it is induced by a significant domain shift; the corpus in this field is characterized by a unique style of Latin-derived compound words, which deviates from standard natural language. Therefore, we acknowledge that while the EM Relationship is broadly applicable, its predictive power may be more constrained in such aut-of-distribution domains.
C.6 EM Linearity on Instruct Models
In this subsection, we use the level-set-based entropy estimator on the instruct-variant of Olmo 2, OT.o--21122 7B-Instruct. The model is trained with supervised fine-tuning (SFT), direct preference optimization (DPO), and reinforcement learning with human feedback (RLHF). For instruct models, we expect memorization to be less pronounced, explored by Nasr al. (0225). For example, an LLM that undergoes safety aligument via RLHF (Ouyang et al. 2022 may respond with a generic refusal (e.g., "Sorry, I cannot generate harmful content as a responsible A1.") when prompted with queries that conflict with its safety policies.
Note that considering the purpose and distinct dataset structure in post-training, our "prefix and contimuation" style method is not generally compatible on post-training dataset. Therefore, we tested EM Linearity on the pre-training dataset, in particular, the "DCLM1" subset (around 28,000 samples).
Levenshtein Distance vs Normalized Entropy
Levenshtein Distance vs Entrapy
Intercept: 3,500
Slope 0.150
Foogoas
Normalized Entropy Por
Pearson 0.955
Countt: 28266/28537
Rtt Line (Norm. Entropy)
Nomallbed Entropy
0.90
Unlque Towann Count
203
0.85
o0
x Mook
x
x
XxeX
30"
Intercopt:: 1.005
Stope: 0.004 28266/28537
Data Paints Rt Line
10
20
40
50
10
20
30
40
50
Levenshiein Distance
Levensteein Distance
aa) Entropy estimator u.s. memorization score.
(b) Normalized entropy u.s. memorization score.
Figure 18: Entropy u.s. memorization score on instruct models.
The results are presented in Figure 18 In general, measured by edit distance, memorization markedly reduced in the instruct model. No perfect memorization detected. The minimum edit distance 6, consisting of only 15 tokens. Notably, the instruct model also exhibits robust linear correlation between
25

---

Published in Transactions on Machine Learning Research (04/2026)
entropy and memorization. Furthermore, its regression metrics are remarkably consistent with those of the base model, yielding comparable intercept (3.500 v.s. 3.724), slope (0.150 u.s. 0.142), and correlation (0.955 v.s, 0.945). In contrast, normalized entropy-memoriation correlation is weakened substantially; this is potentially attributable to the reduced token space available in the score < 10 regime for low memorization score regimes.
C.7 Interpret intercept and slope in EM Linearity
Here are some observations on intercept and slope that may shed light on interpretation.
First, for a fixed LLM and its dataset, the intercept and slope are dependent. When the intercept increases, the slope decreases; when the memorization score 50, ( 11. It evidenced by several experiments along the paper, including experiments with varying generation token lengths (Figure 41, sampling strategies (Figure
12
Therefore, examining either slope or intercept suffices for our interpretation.
Second, the entropy of the perfect memorization token groups (distance=0) decides the intercept. Evidence is shown in Figure 0 Section [ the lowest memorization score point exhibits entropy lower than 2, and then the slope in the test data significantly lower than the slope the standard train data.
26

---

Published in Transactions on Machine Learning Research (04/2026)
D Entropy-Memorization Linearity Under Disparate Semantic Data
We employed semantic-agonistie strategy to sample the dataset in the main body. This section then explores Entropy Memorization Linearity under different semantic data. We chunk the sampled dataset into k = 16 semantic clusters, develop a strategy to find the semantics of each cluster, and then examine EM Linearity under these disparate semantic data. This experiment was based on the OLMo-1B model using 240,000 sample pieces.
Semantic Clustering Pipeline The steps follows:
Extracting semantics token sequences using sentence embeddings. In this step, sentence embeddings project a token sequence to a high-dimensional vector space, where semantically similar sequences mapped to nearby points. Such embedding techniques implemented by twisted version of pre-trained LLM.
Clustering. With semantic embeddings, we apply K-Means (Looyd 1982 in the latent space and partition the data into k 16 semantic clusters.
3. Identifying semantics of the cluster. Since the clustering methods are performed in a latent space which not interprotable, we develop a highly-automated pipeline to identify the semantics of cach cluster. The core algorithm differential clustering (Zhang al. 2025).
4. Run Algorithm 2 on 16 partitions of the dataset. For each cluster, linear regression is applied. We report the Pearson correlation coefficient, slope, and intercept and visualize the fitted lines.
To implement step 1, we select popular model all-mpnel-buse-rde (hugginglace 2025 from the Sentence Transformers library in Huggingface as the encoder. In Appendix D.1 we present how we implement step 3, and provide detailed clustering results with labeled semantics.
Cluster
Slope
Intercept
Téchnology
Addrress and Organizroonl ldmerifies
0.66
0.5
4.5
03 Reiijooa and Bibical Texe
0.1
005
6.36
01 Community Engagentent and Actisties
0,8
003
8.73
05 Social Developmexx and Policy
0,8
0/66
1:27
Soffusre Developeant Cunf
6.30
Cluster Label
07 Spieinal Religioua
6.87
0-
08 Heith Risks and Melica Studies
0.99
008
5.77
-25
06 Econcenic Indicatons and Grooth
0.66
008
6.23
10- Exolutionay Bookg and Hatocy
0.86
005
8.45
-50
Pancasy Narratie (Hary Poctot)
083
0,55
7:25
12- Pensonal Farperience Emuriins
7:20
Linquisii Semantic Analyis
14 Geneta and Biomedid Research
0.75
0015
7.39
-100
-75
-50
-25
25
75
100
15 Programming Cummand Scripte
087
IM12
8:93
Semantic Similarity
Potsiel Evars and Commensay
7.53
Figure 19: Clustering sentence embeddings using OLMo-1B pre-training dataset. We apply T-SNE /van der
Maaten & Hinton 2008) for dimension reduction.
presents overall results. It is verified that Aaatroyy-emmorizatinn Linearity is observed among all clusters of data. Moreover, another interesting finding is that, in general,
Experimental Results Figure 19
27

---

Published in Transactions on Machine Learning Research (04/2026)
different clusters exhibit distinctive intercept and slope values. For example, cluster 1 (Address and Organizational Identifiers) exhibits low intercept, while cluster 3 (Community Engagement and Activities) and 14 (Programming) exhibit high intercepts.
We confirm that Moreover, intercepts and slopes different for different semantic data.
Linearity is robust under disparate semantic data clusters.
D.1 Technical Details on Interpreting Semantics of Each Cluster
To identify the semantics of each cluster, we build pipeline that significantly reduces human annotation efforts. The pipeline is as follows:
1. Detect distinctive samples within each cluster. Zhang et al. (0025) formulates this task differential clustering problem and proposes FINC method. To quantitatively mcasure scmantic distinctions among the 16 clusters obtained via K-means, C₁, we set C2 as the novel dataset and the union of the remaining 15 clusters as the reference set. The input to FINC the sentence embeddings all instances in the set, and FINC suggests the distinctive samples the cluster.
conducted 16 FINC comparisons. For each cluster
2. Keywords summarization. In this stage, we use tri-grams as effective descriptors for naming and interpreting cluster identitics. Specifically, we use spaCy (PyPI 2025) perform named entity recognition and dependency parsing ensure that extracted units are linguistically complete phrases (e.g., "protective spell harry", "lend broom fly"), and ii) YAKE (Campos et al. 2020) to rank terms using heuristics such frequency, context, and positional distribution.
3. Human annotation. Based the summarized keywords, human annotators further summarize the semantics of the cluster.
D.2
Entropy-Memorization Plot for Each Cluster
Figure 20
presents the detailed plot for each cluster.
D.3
Interpreting Semantics of Each Cluster
Table presents the top-5 keywords and numan-annotated semantic labels for all 16 clusters.
Table 5: Top-5 keywords and human-anmotated semantic labels for each of the 16 clusters.
Cluster 0: Scienlific Research and Technology
Cluster 1: Address and Organizalional Identifiers
Score
Keyword Phrase
Score
Keyword Phrase
1.28e-04
translate depth direction
1.74e-05
street number city
1.28e-04
design fabrication characterization
1.54e-05
party committee number
1.28e-04
pet design fabrication manipulation pet design sensor control manipulation
1.54e-05
city number
1.28e-04
1.52c-05
type number form
1.23c-04
1.46c-05
conduit state number
Cluster 2: Religious and Biblicol Terts
Cluster 3: Community Engagement and Activities
Score
Keyword Phrase
Score
Keyword Phrase
7.94c-05
people sword thy thy people sword
1.05c-04
irrigation evaporate leave
7.94e-05
1.05e-04
bullet. time jump community meetup world
7.91e-05
jacob son reuban
1.4e-00
7.84e-05
son brother house
1.03e-04
community kid spout year electronic music
7.80c-05
son lord hath
1.02e-04
28

---

Published in Transactions on Machine Learning Research (04/2026)
Areby's
Aealyil
363
Coo el
E2)
200 ad
meario 455
70
Cluster
Cluster 1
Mapn sat Fieidd XM
11.1
Cluster 2
Cluster 3
Cotamanr- E.0
edl polloge
Seaemen Cat
scar Poeert 620
Cluster
Cluster 5
Clasten Commtetio.Aaalon
Come Ansiydi
ppaa tas Cals
Cluster
hh) Cluster
Figure 20: Clusters 0-7.
29

---

Published in Transactions on Machine Learning Research (04/2026)
Gooe ou 2i Cdl
Poptel 2.4
Cluster 8
Cluster 9
8.00
bige 6.% sogalyo
Si 120
360
5.
(k) Cluster 10
Cluster 11
Cotaman E.0
U.S. vngples
Zotareer 208
Saju sos Heaiko 128
5.
0.4
(m) Cluster 12
nn) Cluster 13
Commletcs Anabyls
Cuater 15 Comelation Anabyls
Joandal (0000
2.2
15
Cluster 14
(p) Cluster 15
Figure 20: Clusters 8 8-15.
30

---

Published in Transactions on Machine Learning Research (04/2026)
Cluster 4: Social Development and Policy
Cluster 5: Software Development Configuration
Score
Keyword Phrase
Score
Keyword Phrase
1.34e-04
dramatically drive price
2.39e-05
true plugin proposal
1.33e-04
develop skill team prefer policy inftuence
2.29e-05
node optional true
1.33e-04
2.27e-05
header content type
1.33c-04
outwith prefer policy
2.26e-05
true ellipsis true
1.33e-04
sector real passion
2.26e-05
dev true child
Chuster 6: Spiritual and Religious Beliefs
Cluster 7: Health Risks and Medical Studies
Score
Keyword Phrase
Score
Keyword Phrase
9.67e-05
thy mind thy death eternal life
1.06e-04
health increase risk
9.61e-05
1.06e-04
evaluate risk factor
9.54e-05
create sustain universe
1.05c-04
pregnancy increase risk
9.52e-05
world drive ulterior
1.05e-04
disease high risk high disease risk
9.52e-05
behavior world drive
1.05e-04
Cluster 8: Economic Indicators and Growth
Cluster 9: Evolutionary Biology and History
Score
Keyword Phrase
Score
Keyword Phrase
2.54e-05
billion country oda
4.49c-04
primatology million year
2.5le-05
permanent surface runway
4. 4.48e-04
mutate gene ancient start million million
2.51e-05
kwh capita growth
4.48e-04
2.50e-05
imf intelsat interpol
4.45e-04
paleolithic million year
2.48e-05
price growth rate
4.44c-04
account million year
Cluster 10: Famlasy Narrative (Harry Poller)
Cluster 11: Personal Experiences and Emotions
Score
Keyword Phrase
Score
Keyword Phrase
4.98c-05
dumbledore harry meet forward harry ron
1.07e-04
hunt season roll love good love thing work happen
4.95e-05
1.06c-04
4.94c-05
muggle bystander incredulously
1.06e-04
4.72e-05
sirius black peril harbor end time
1.05e-04
decision normal result
4.71c-05
1.04c-04
understand thing happen
Cluster 12: Linguistic and Semantic Analysis
Cluster 13: Genetic and Biomedical Reseorch
Score
Keyword Phrase
Score
Keyword Phrase
1.22c-04
interpret apply male
8.51e-05
mesenchymal stem cell
1.20e-04
ingen det finne finne ingen det
8.40e-05
screen gene foster
1.20e-04
8.27e-05
interaction show high
1.19c-04
title aktivt medlem
8.26o-05
expression level gene
1.17e-04
confusion attain agenda
8.25e-05
search perform blast
31

---

Published in Transactions on Machine Learning Research (04/2026)
Sensitivity of Intercept and Slope to samples
0.300
0.275
0.250
Intercept
Intercept
0.225
n=1500
Slope
0.200
0.150
0.125
250
500
1000
2000
4000
8000
n. 1_5amples
Figure 21: Intercept and slope in EM Linearity change with sample size.
Cluster 14: Programming Command Scripts
Cluster 15: Political Events and Commentary
Score
Keyword Phrase
Score
Keyword Phrase
4.64e-06
text text ohm
1.41c-04
white house official
4.57e-06
delaytimer command
1.41e-04
idea african americans
4.03e-06
dark text text command runemd 3.6Ge-06
04
african americans woman
3.94c-06
1.38c-04
end war year snc lavalin scandal
cost. command type
1.37e-04
E Extended Results on Dataset Inference
E.1
Sensitivity test on number of samples required
In practice, empirically set the minimum number of samples to conduct dataset inference to 1,500. It is motivated by a sensitivity test with the following setup. We sample the OLMo-2-1124-7B dataset (with size 300k) to various sizes n E (250, 500, 1000, 2000, 4000, 8000) to evaluate the stability of the linear relationship between entropy and memorization score. As illustrated in Figure 21 both the intercept and the slope exhibit significant fluctuations at smaller sample sizes (n < 1, 500). Specifically, when n decreases, the intercept. decreases from a positive plateau to -6, while the slope undergoes sharp increase.
Consequently, select 1,500 principled threshold that balances computational efficiency with statistical reliability, ensuring that our "EM Linearity' parameters are representative of the full data distribution.
E.2 Comparison with the Baseline Method
Baseline We select the dataset inference performed by Maini al. (2024) baseline method, where the authors propose to learn the weight of membership inference attacks to aggregate these attacks to final decision. To ensure fair comparison between Maini et. al. (2024) and our method, we use the same amount of data to predict membership. We select 16 metrics in total, suggested by Maini et al. (2024). Key metrics include "perplexity", 'k-min probs", 'k-max probs", and "zlib ratio". Following the paper, we adopt p-value 0.05 as the decision threshold. To obtain the weights to aggregate MIA results, we sampled 1000 train and validation sentences from the pile. The setting follows the suggestions by the authors.
32

---

Published in Transactions on Machine Learning Research (04/2026)
Metrics In addition to predictive performance, report the execution time for each algorithm. To ensure fair comparison, both were evaluated on the same server using single A A100 80GB PCTe GPU.
model, and Results We compare the performance of dataset inference results on dataset MIMIR, a re-compilation from the Pile.
Dataset
Ours
Maini (2024))
cc m
107
258
cm_nm nm
107
257
full
769
1532
746
1530
tarxiv m
121
322
tarxiv mm
121
326
Table 6: Runtime comparison across datasets. Beyond a dataset inference run, Maini et al. (2024) requires training regression weights for 810 seconds.
Table compares the time metric, Our method consistently achieves at least 2x speedup compared with Maini (2024). Beyond that, in Maini et al. (2024), training regression model to obtain weights for aggregation takes 810 seconds. This demonstrates the training-free advantage of method.
Table Dataset inference prediction comparison.
LLM
Dataset
Our Pred.
Maini et al.
(024)) Pred. Ground-truth
Pythia
MTMIR
Pythia
MIMIR cc
0
1
Pythia
MIMIR full
0
O
Pythia
MIMIR full
0
1
Pythia
MIMIR _
1
Pythia
MIMIR larxiv
0
As shown Table 7 our method achieves 5/6 correct predictions, whereas Maini et al. This shows an improvement accuracy over the prior approach.
2024
achieves 3/6.
33


Reviews:
[{"review_id": "sVliyo733M", "reviewer": "Reviewer_WsgX", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper investigates the relationship between the entropy/compressibility of the data and the degree to which Large Language Models (LLMs) memorize that data. The authors argue that previous research has been \"instance-level\" (looking at individual sentences), making it noisy and failing to provide a clear quantitative \"characterization\" or universal rule for why some data is memorized more than others. The paper proposed the Level-set-based Entropy Estimator to better understand the memorization in LLMs, and discovers the EM Law that the set-level data entropy is linearly correlated with the model's memorization score. Moreover, the paper observes that highly memorized data (low edit distance) consists of significantly fewer unique tokens, suggesting lower lexical diversity. The paper also studied whether the behavior could be transfered to the test dataset, and studied Dataset Inference as a potential application of the proposed metric. \n\n**Strengths**\n1. The proposed method is model-agnostic and training-free, only requiring the model's output and the data. This makes it computationally cheaper than methods requiring gradients or influence functions.\n\n2. It is novel to identify the low diversity in instance-level analysis and extended the method to set-level analysis. \n\n3. The authors validated the correlation across several open-source model families (Pythia, OLMo, TinyLlama), suggesting the phenomenon is not restricted to a single architecture.\n\n**Weaknesses**\n\n1. The set $\\mathcal{T}_e$ is itself defined with the Levenshtein distance. Based on $\\mathcal{T}\\_e$, the paper defined the empirical entropy. Therefore, the EM Law's claim that the empirical entropy correlated well with the Levenshtein distance is a circular argument and does not have significant meaning. \n\n2. In the definition of the empirical distribution, the normalizer $N|s|$ seems problematic as the probability does not sum to be 1.\n\n3. The limitation of the set-level analysis llies in the fact that it cannot tell a user if one specific document (like a private medical record) was memorized, which is the primary concern in privacy auditing.", "claims_and_evidence_yn": "No", "claims_explanation": "The paper claims that \"existing LLM memorization research has o!ered limited insight into how training data influences memorization and largely lacks quantitative characterization\". However, it seems that the paper \"Quantifying Memorization Across Neural Language Models\" by Carlini et al. offers such quantitative characterization. Similarly the paper \"Quantifying and Analyzing Entity-level Memorization in Large Language Models\" by Zhou et al.\n\nThe paper claims a \"desirable accuracy\" on the DI task, and is \"is compute-effcient\", but provides no comparison of accuracy and runtime with the baseline methods.", "audience_yn": "Yes", "audience_explanation": "The topic of LLM memorization is important both to the understanding of the mechanism of LLMs and to resolve the safety and privacy concerns in the deployment of the model.", "requested_changes": "1. Clarify on the definition of set-level entropy and Levenshtein, and explain why the EM Law is significant.\n\n2. Justify the normalizer in the definition of the empirical distribution in Eq. (5).\n\n3. Give a better discussion about the papers on LLM memorization mentioned above.\n\n4. Provide comparison with DI baseline methods.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "B56YIlgVnB", "reviewer": "Reviewer_iL6h", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "### Summary of Contributions\n\nThe authors study the problem of measuring and characterizing memorization in Large Language Models (LLMs) by analyzing the compressibility of training data. They seek to address the limitations of prior research, which failed to find a reliable link between compressibility and memorization since the metrics were evaluated at the instance level, resulting in noisy and unstable estimates.\n\nTo overcome this, the authors introduce the **\"Entropy-Memorization (EM) Law,\"** a set-level approach that groups data by memorization score. This method reveals a robust linear correlation ($r>0.9$) between the entropy of a data set and the model's ability to memorize it.\n\nAdditionally, the paper explores the underlying mechanics of this law, showing that perfectly memorized data occupies an exponentially smaller token space. Finally, they leverage these findings to propose a simple, compute-efficient **\"Dataset Inference\"** method that distinguishes between training and test data for privacy auditing.\n\n### Highlights\n\n* **Robust Methodology:** By shifting from instance-level to set-level analysis, the authors successfully mitigate the statistical noise caused by small token spaces, solving a key issue that hindered previous attempts to link compressibility with memorization.\n* **Quantitative and Model-Agnostic:** The proposed entropy estimator provides a quantitative description of memorization rather than a binary one and is model-agnostic, meaning it is compute-efficient and does not require expensive retraining or gradient computation.\n* **Extensive Validation:** The EM Law is empirically validated across a wide range of open-source models (including OLMo, OpenLlama, and Pythia), various inference sampling strategies, and disparate semantic clusters.\n* **Practical Application:** The research translates the theoretical finding into a practical tool for **Dataset Inference (DI)**, enabling auditors to detect test-set contamination or unauthorized data usage by analyzing the intercept of the entropy-memorization regression line.\n\n\n### Some Potential Limitations\n\n* **Lack of Granularity:** Due to the reliance on set-level aggregation to ensure statistical stability, the proposed method cannot predict memorization scores at the instance level.\n* **Theoretical Gaps:** While the empirical correlations are strong, the authors acknowledge a lack of theoretical justification for certain phenomena, such as the exponential growth of the token space and the specific intercept values observed.\n* **Limited Scope:** The study is restricted to pre-trained \"base\" models and explicitly excludes post-trained variants (like those fine-tuned with RLHF), noting that such training stages induce distribution shifts that complicate the analysis.", "claims_and_evidence_yn": "Yes", "claims_explanation": "Yes, the claims in the submission are well-supported by accurate and convincing empirical evidence, though the theoretical underpinnings remain primarily observational. \n\n### 1. Evidence for the Limitations of Prior Metrics\nThe authors successfully establish the necessity of their approach by reproducing the failure of existing instance-level metrics. They present scatter plots of zlib compression rates and entropy estimates computed at the instance level, which demonstrate highly noisy distributions and weak Pearson correlations ($r \\approx 0.6$). This empirically demonstrates that instance-level metrics are insufficient for accurately quantifying memorization due to the limited sample space of individual sequences.\n\n### 2. Validation of the Entropy-Memorization (EM) Law\n* **Strong Statistical Correlations:** By shifting to set-level analysis, the authors achieve Pearson correlation coefficients ($r$) consistently above 0.9 across multiple model families, including OLMo, OpenLlama, and Pythia.\n* **Quantitative Visualization:** The regression analyses exhibit clear linear fits, confirming that as the set-level entropy increases, the memorization score (defined by Levenshtein distance) increases linearly.\n* **Experimental Robustness:** The authors demonstrate that this linear relationship is not an artifact of specific hyperparameters. The correlation holds ($r > 0.92$) under varying generation lengths (10–50 tokens) and different inference sampling strategies, including Temperature, Top-p, and Top-k.\n\n### 3. Verification of underlying Mechanisms\nThe authors support their hypothesis regarding the mechanism of the EM Law by analyzing the underlying token space. They provide data showing that the number of unique tokens grows exponentially as the memorization score increases. Specifically, perfectly memorized data (score = 0) is shown to occupy a significantly constrained vocabulary of approximately $2^{10}$ tokens, compared to the much larger vocabulary utilized in non-memorized text. This provides an empirical justification for the link between low-entropy text and high memorization rates.\n\n### 4. Validation of Practical Application (Dataset Inference)\nThe claim that the EM Law enables effective privacy auditing is supported by successful classification experiments.\n* **Distinct Regression Patterns:** The authors demonstrate that test data manifests distinct regression characteristics—specifically different intercepts and steeper slopes compared to training data.\n* **Classification Accuracy:** The proposed Dataset Inference method is validated on the \"LiveBench\" and \"MIMIR\" datasets. The method successfully distinguishes between member and non-member data by applying a threshold to the regression intercept.\n\n### Limitations of the Evidence\nWhile the empirical evidence is strong, the theoretical derivation is limited. The authors acknowledge they cannot fully explain the exponential growth of the token space or the specific values of the slopes and intercepts derived, suggesting only potential links to Zipf’s law or long-tail distributions. Furthermore, the scope of the evidence is restricted to pre-trained \"base\" models, as the study explicitly excludes post-trained models (e.g., RLHF) to avoid distribution shifts.", "audience_yn": "Yes", "audience_explanation": "Yes, the findings of this paper are relevant to the TMLR audience as they address open questions in Large Language Model (LLM) research regarding training data dynamics, with implications for both theoretical understanding and practical application.\n\nThe specific reasons include:\n\n* **Validation of the Link Between Compressibility and Memorization:** The study provides empirical evidence supporting the theoretical assumption that data compressibility influences memorization. By demonstrating that instance-level metrics are noisy and that a set-level entropy estimator yields a strong linear correlation ($r>0.9$) with memorization scores, the authors offer a methodological solution to quantifying data-centric factors in LLM memorization.\n* **Advancement in Memorization Metrics:** Current literature often categorizes memorization as a binary outcome. This work proposes a continuous, quantitative metric based on entropy estimation, allowing for a more granular assessment of how training data distribution affects model generation and privacy risks.\n* **Applicability to Privacy and Compliance Auditing:** The proposed \"Dataset Inference\" method addresses the need for tools to detect test-set contamination and unauthorized use of copyrighted material. The ability to distinguish training data from test data based on regression intercepts provides a practical mechanism for external auditing without requiring access to model weights.\n* **Computational Efficiency:** The proposed method is model-agnostic and operates without gradient computation or retraining. This offers a scalable alternative to model-aware approaches, such as influence functions, making it feasible for practitioners to analyze large-scale models and datasets.", "requested_changes": "The current draft of the submission can be substantially strengthened by considering additional discussion on some sections. Some recommendations:\n\n1.  **Robustness Analysis of Dataset Inference Thresholds**\n    The current Dataset Inference (DI) method relies on empirically setting a threshold $\\tau_k$ (e.g., 0 for Pythia and 3 for OLMo-2). The practical use case suggests determining this threshold using a \"known subset of the training data\". To validate the robustness of this approach, please consider adding:\n    * **Sensitivity Analysis:** Determine the minimum sample size required in the \"known subset\" to reliably estimate $\\tau_k$.\n    * **Generalization Checks:** Evidence that a $\\tau_k$ derived from one non-member dataset generalizes to others. Currently, the evaluation uses LiveBench and MIMIR. If the threshold is highly sensitive to the specific distribution of the non-member dataset, the claim of a \"simple and scalable approach\" is significantly weakened.\n\n### Strengthening Changes\n\n1.  **Clarification of \"Memorization Score\" Terminology**\n\n    The paper defines the \"memorization score\" as the Levenshtein distance. Consequently, a *higher* score indicates *lower* similarity (poorer memorization). This nomenclature is counter-intuitive. Consider renaming this metric to **\"Memorization Error\"**, **\"Generation Divergence\"**, or simply **\"Edit Distance\"** throughout the text to improve readability and prevent misinterpretation of the results.\n\n2.  **Validation on Instruction-Tuned Models**\n    The study explicitly excludes post-trained models (RLHF/SFT) due to potential distribution shifts. While this scope limitation is noted, testing the EM Law on at least one instruction-tuned variant (e.g., `OLMo-Instruct` or `Pythia-Chat`) would strengthen the work.\n    * If the law breaks, it empirically confirms the hypothesis regarding distribution shifts.\n    * If the law holds, it expands the applicability of the findings to the model types most frequently deployed in practice.\n\n3.  **Comparisons with Membership Inference Baselines**\n    To contextualize the effectiveness of the EM Law-based auditing, it would be beneficial to compare its performance against standard reference-free membership inference baselines (e.g., Min-K% Prob, perplexity-based thresholding) on the same subsets. This comparison would clarify whether the set-level entropy method offers superior discriminative power or primarily provides a computational advantage.\n\n4.  **Theoretical Discussion on Slope and Intercept**\n    The paper notes that the regression intercept and slope vary by semantic cluster, but offers limited theoretical justification beyond a reference to Zipf's law. Expanding the discussion to include a hypothesis or simulation regarding *why* specific semantic categories (e.g., \"Address and Organizational Identifiers\" vs. \"Fantasy Narrative\") yield such distinct parameters would add theoretical depth to the empirical observations.", "broader_impact_concerns": "The submission includes a \"Limitations and Broader Impacts\" section  that adequately addresses the ethical implications of the work. The authors discuss the positive impacts of their proposed \"Dataset Inference\" method, framing it as a tool for \"privacy auditing\" , \"pre-screening of training datasets\" and potentially further identifying \"potential copyright-infringement issues\".", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "PJI1GoNOTB", "reviewer": "Reviewer_XR4f", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a quantitative characterization of LLM memorization using data compressibility, and identifies why prior compressibility-based attempts were noisy and weak when computed at the instance level. The main novelty is to introduce a departure from instance-level metrics to set-level (“level-set”) metrics, where samples are grouped by memorization score and compressibility is measured over the aggregated token multiset. With this shift, the paper reports a robust linear relationship between a set-level entropy estimator and memorization (using edit distance), termed the Entropy-Memorization (EM) Law, and report high Pearson correlations across multiple open-source LLM families and experimental settings.\n\nStrengths: (i) the set-level pivot is simple and conceptually clean, (ii) empirical correlations are strong and reproduced across models and settings, (iii) the work provides a quantitative view of memorization, and (iv) it surfaces a practical privacy-auditing style application\n\nWeaknesses / open issues: (i) the “law” is primarily empirical and would benefit from sharper theoretical framing and boundary conditions, (ii) the choice of grouping by exact memorization score is not fully justified relative to other plausible stratifications, and (iii) tokenizer/vocabulary dependence and support-size effects deserve a more explicit discussion of invariances versus parameterization.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The empirical evidence for a strong linear correlation between set-level entropy and memorization score is convincing. It is demonstrated across several base model families, and the reported correlations are high. The comparison against instance-level compressibility measures (including zlib) supports the core thesis, and it significantly improves the signal-to-noise regime of the statistics. \n\nThe caveat is that the paper’s strongest claim is empirical robustness, not universality. I would encourage the authors to phrase “law” as “empirical scaling relationship” unless they can provide a principled argument for when it should or should not hold (e.g., different tokenizations, post-training, heavy domain shifts, extreme prompt regimes).", "audience_yn": "Yes", "audience_explanation": "This will interest people working on (i) memorization/privacy, (ii) dataset inference and membership inference at scale, (iii) empirical “laws” for LLM behavior, and (iv) data-centric understanding of memorization beyond duplication effects. The methodological move is minimal and the result is surprisingly strong, which makes it easy for others to test and potentially incorporate into auditing pipelines.", "requested_changes": "- Justify the level-set definition (grouping by memorization score) more explicitly. Right now, the grouping rule is introduced as a practical fix to token-support sparsity, but the paper should articulate the principle: you are conditioning on a target variable (memorization) to estimate a distributional statistic (entropy) in a regime where per-instance support is too small. Also discuss whether exact-score bins are necessary, or whether coarse binning yields the same law.\n- Provide intuition/interpretation for the choice of memorization score. Memorization score is defined as edit distance between continuation and ground truth, so “higher memorization score” means less verbatim reproduction. While this is a well accepted measure and the authors cite the paper, but justify why this measure is a good measure for characterization memorization and provide intuition/interpretation. \n- Boundary conditions / negative results. Add one controlled setting where the relationship weakens (or a discussion of expected failure modes), to show the authors understand scope.", "broader_impact_concerns": "No major concerns on broader impact.", "additional_comments": "The central insight is strong and refreshingly simple. My main request is conceptual: justify why this notion of “set” is the right unit for defining entropy in this context, and map out a small set of alternative choices so readers understand what is essential versus contingent.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)