Extractable Memorization From First Principles
The monkey at the typewriter hits keys at random: give him long enough and, by chance alone, he would eventually produce any text, even something as long and complex as the complete works of Shakespeare. Some people think language models are just like that. They're non-deterministic, producing all sorts of text, and so, queried enough, a language model will eventually produce anything. And when that anything is its training data, reproduced word for word, the argument goes: it's not "memorization," it's just the monkey getting a lucky draw.
But whether it's possible for a model to produce any string was never the right question. What matters is how many tries it takes. We can actually run that experiment: a model can't have memorized text it never trained on, so however many tries it takes to reproduce that text shows how far prediction gets you.
For instance, we can compare how the model behaves on a book it was trained on versus a closely matched one it wasn't. Llama 3.1 models were trained on Dan Brown's The Da Vinci Code, but not his 2025 Robert Langdon novel, The Secret of Secrets: same author, same main character, same genre, same style — just published after the training cutoff. With the same prompting strategy we use for extracting memorized training data, even the most probable (easiest to generate) passage of that non-training book would take about 3×1021 queries to get out. At one query per second, that'd take over 5,000× the amount of time since the Big Bang. For The Da Vinci Code (the book in its training data), memorized passages run the whole gamut, from ones the model reproduces on just one try to ones no easier than that easiest non-training passage.
The point is, that gap — between text in the training data and the easiest matched non-training data — is measurable. And training text that clears that bar is what memorization looks like.*
The monkey at the typewriter doesn't really have anything to do with this. It's time he traded that typewriter for a spritz.
* Training data that clears this bar can still be very unlikely, so something can be memorized but still not really generated in practice. That's because memorization in the model and extraction of memorized training data in outputs aren't the same thing.
And a perfect match isn't always available. You can't get a new Sherlock Holmes book to use as non-training data, because Sir Arthur Conan Doyle isn't writing anymore. But you can run a best-effort matched comparison (on other short stories, other mysteries), and draw a more conservative line between memorization and predictability.
Actual paper abstract
Recent work on extractable memorization in language models suffers from two contrasting validity problems. Some studies overstate extraction due to tests that don't adequately support the claim, e.g., relying on sequences too short to distinguish memorization from predictability or leaking the target directly in the prompt. Others imply that extraction is unreliable evidence of memorization at all, since models can also reproduce real-world text they weren't explicitly trained on. In different ways and to different degrees, both overlook what makes a valid extraction claim: the model must generate a training sequence with high enough probability to indicate memorization.
To determine what's high enough, one has to perform a matched comparison: measuring the generation probabilities of both the training sequences of interest and comparable non-training sequences. Because non-training sequences cannot have been memorized, their probabilities provide a baseline for predictability, and a training sequence exceeding this baseline provides evidence of memorization. We formalize matched comparisons in two ways: (1) a conformal test that calibrates a threshold to a chosen false-positive rate when training and non-training sequences are sampled from populations, and (2) a census that calibrates against a matched non-training document when the object is a single document (e.g., a specific book).
Our experiments show that matched comparisons enable rigorous, calibrated memorization claims, and reveal where prior setups have validity issues. For instance, on Wikipedia, OLMo 2 32B reproduces non-training 10-token suffixes roughly 24% as often as training ones: that share of the training generation rate reflects false positives, not memorization. For Llama 3.1 70B on books, the thresholds we calibrate are as low as 10−27, supporting memorization claims for sequences that no feasible sampling budget would extract. Based on these results, we refine "extractable memorization" to require both a valid memorization claim and near-certain generation within a realistic budget.
How to cite
@article{cooper2026extractable,
title = {{Extractable Memorization From First Principles}},
author = {Cooper, A. Feder and Swanberg, Marika and Hayes, Jamie and Duesterwald, Lea and
De Sa, Christopher and Ho, Daniel E. and Lemley, Mark A. and Liang, Percy},
journal = {arXiv preprint arXiv:2607.12649},
year = {2026}
}