Memorization is Language-Sensitive: Analyzing Memorization and Inference Risks of LLM s in a Multilingual Setting (2025)

Abstract: Large Language Models (LLMs) are known to memorize and reproduce parts of their training data during inference, raising significant privacy and safety concerns. While this phenomenon has been extensively studied to explain its contributing factors and countermeasures, its implications in multilingual contexts remain largely unexplored.In this work, we investigate cross-lingual differences in memorization behaviors of multilingual LLMs.Specifically, we examine both discoverable memorization and susceptibility to perplexity ratio attacks using Pythia models of varying sizes, evaluated on two parallel multilingual datasets.Our results reveal that lower-resource languages consistently exhibit higher vulnerability to perplexity ratio attacks, indicating greater privacy risks. In contrast, patterns of discoverable memorization appear to be influenced more strongly by the model’s pretraining or fine-tuning phases than by language resource level alone.These findings highlight the nuanced interplay between language resource availability and memorization in multilingual LLMs, providing insights toward developing safer and more privacy-preserving language models across diverse linguistic settings.

## introduction current transformer-based large language models (llms) have billions of parameters and are trained on massive datasets @xcite . this scaling has increased the ability of llms to process and mimic fluent human language, as well as to perform a wide range of other tasks @xcite . recent advancements have shown remarkable performance of models in diverse applications, from machine translation and summarization to question answering and planning @xcite . when trained on datasets containing multiple languages, llms learn multilingual capabilities and can understand and generate text in different languages. although english continues to dominate the training data for language models, multilingual models have also emerged in recent years, driven by growing global interest in making language technologies more accessible across different languages. however, the development of multilingual models presents several challenges @xcite : the vast majority of languages worldwide are underrepresented and mid-and lowresource languages receive less attention from the nlp community @xcite . lowerresource languages also constitute a small fraction of the labeled data available for finetuning popular llms, leading to poorer performance on typical downstream nlp tasks compared to high-resource ones @xcite . it has been shown that prompting chatgpt foot_1 in a lower-resource language, can circumvent the model's safety and security mechanisms, triggering it to produce responses that would not be possible in english or other high-resource languages. this highlights a cross-language vulnerability, most likely arising from differences in the availability of training data @xcite . this indicates that llm privacy and security need to be studied in a multilingual context. research suggests that llms have the potential to expose training data through memorization @xcite . this undesirable phenomenon can occur either accidentally or through deliberate extraction by adversaries @xcite , who attempt to recover individual training examples by querying the model @xcite . when the training data, user prompts, or model responses contain sensitive information that can be traced back to individuals, either in isolation or in combination @xcite , it becomes an issue of privacy and ethical implications @xcite . if the training dataset is confidential, any exposure through a training data extraction attack constitutes a privacy breach, regardless of the nature of the data or context @xcite . what we observe here are models exhibiting privacy vulnerabilities that can be exploited through adversarial prompting or data extraction attacks, all of which stem from the memorization issue @xcite @xcite . while memorization and the associated privacy risks in llms have been extensively studied, their comparison in multilingual model scenarios remains unexplored. in light of this, in this work, we analyze and compare the memorization rates in multilingual llms between lower-resource and high-resource languages. to this end, we conduct two different experiments on a set of pythia models @xcite with different model sizes. the pythia models were trained on predominantly english data, but they are capable of generating other european languages. with 'lowerresource' we refer to medium-sized languages that the pythia models were not explicitly trained on. our results provide empirical evidence that lower-resource languages show higher perplexity ratio values, suggesting that they would be more susceptible to membership inference attacks (mia) based on this method. on the other hand, our discoverable memorization test shows that lowerresource language datasets are memorized more if those are contained in the pretraining dataset, while they are less memorized if introduced during the finetuning. our experiments and results underline the significance of having more balanced datasets when training a multilingual dataset, otherwise model owners should be aware of the risks associated with introducing lower-resource datasets during model training. memorization can be studied through discoverable or extractable methods @xcite . discoverable memorization accounts for the samples that are correctly generated when the model is prompted with the first part of those samples. this requires that we have access to the training data and interact with the model through prompting, expecting the generation of the training samples. in the case ofextractable memorization, interaction with the model is performed by an adversary, without having access to the training data. extractable memorization is potentially more problematic in real-world scenarios, as the training data is not known to end-users interacting with the llms. the phenomenon of memorization in llms occurs due to repeated instances of near-duplicate examples and long repetitive sub-strings in the training corpus @xcite , where the model assigns greater importance to more frequent instances, making them more likely to be memorized @xcite . apart from repeated instances of training data, other factors that influence memorization in llms include the size of the dataset, the complexity of the data, and the size of the model @xcite @xcite @xcite . ## experiments in this section, we first provide details about our experimental setup including the employed llms and the data sets. we then motivate the choice of the languages and summarize the used metrics. ## discussion firstly, selecting appropriate models and datasets for our experiments posed several challenges. there are few parallel datasets available across multiple languages that include samples long enough to support discoverable memorization experiments. additionally, only few models are available at multiple scales with accessible pretraining checkpoints. while pythia is primarily trained on english data, it demonstrates sufficient language understanding and generation capabilities in the language subset we experimented with. therefore, we argue that our chosen model and datasets are reasonably well aligned for the purposes of this study. secondly, our finetuning experiments were limited to model sizes up to 1b parameters. since we finetune each language-dataset pair for up to 8 epochs and subsequently run discoverable memorization and perplexity ratio tests on the entire dataset, the process was computationally intensive, requiring 160 independent runs on an a100 nvidia gpu. however, we believe this limitation does not significantly affect our conclusions. the observed trends were robust and consistently distinguishable between the lower-resource languages and english. nonetheless, since a relation exists between memorization and model size @xcite future work should further explore this space using larger models, different datasets and various training regimes. ## conclusions and future work we studied the discoverable memorization and the susceptibility of pythia models to mia over two different parallel datasets comparing memorization related behaviour of these models in the cases of lower-resource languages and higher-resource languages. we observe that in both cases of pretraining and finetuning data, the lower-resource languages show more vulnerability to mia according to the perplexity ratio method. however, in the case of discoverable memorization, while pretraining data shows higher memorization rates for lower-resource languages, the finetuning data behaves differently, showing more memorization for english dataset. at the same time, our fine-tuning experiments raise an interesting question: while lower-resource languages exhibit higher susceptibility to mia, they demonstrate less discoverable memorization. although we proposed some initial hypotheses to explain this observation, a deeper analysis of the relationship between discoverable memorization and mia susceptibility is indeed an interesting direction for future research. in quantifying the susceptibility of llms, in particular pythia models, to mia, we employed perplexity ratio tests and as mentioned, lower-resource languages prove to be more prone to privacy attacks and disclosure of private data. these findings underscore the need for stronger privacy-preserving strategies in multilingual llms, particularly during both pretraining and finetuning phases. future work should further investigate the root causes of the difference between higher and lower resource languages, whether and to what extent inherent characteristics of different languages play a role in memorization related issues and privacy vulnerabilities. while balancing the data across different languages would be a possible solution, it might not always be feasible. we believe that this direction of language-sensitive privacy needs to be further explored to make sure that multilingual models do not exhibit privacy risks regardless of the different linguistic settings. in our study, we focused on lower-resource languages, and we leave a broader examination across a wider range of linguistic settings for future research. in addition, exploring possible countermeasures against the observed phenomenon would be an important next step. we believe that this line of language-sensitive privacy research is crucial to ensure that multilingual models do not exhibit uneven