Extractable Memorization From First Principles
The monkey at the typewriter hits keys at random: give him long enough and, by chance alone, he would eventually produce any text, even something as long and complex as the complete works of Shakespeare. Some people think language models are just like that. They're non-deterministic, producing all sorts of text, and so, queried enough, a language model will eventually produce anything. And when that anything is its training data, reproduced word for word, the argument goes: it's not "memorization," it's just the monkey getting a lucky draw.
But whether it's possible for a model to produce any string was never the right question. What matters is how many tries it takes. We can actually run that experiment: a model can't have memorized text it never trained on, so however many tries it takes to reproduce that text shows how far prediction gets you.
For instance, we can compare how the model behaves on a book it was trained on versus a closely matched one it wasn't. Llama 3.1 models were trained on Dan Brown's The Da Vinci Code, but not his 2025 Robert Langdon novel, The Secret of Secrets: same author, same main character, same genre, same style — just published after the training cutoff. With the same prompting strategy we use for extracting memorized training data, even the most probable (easiest to generate) passage of that non-training book would take about 3×1021 queries to get out. At one query per second, that'd take over 5,000× the amount of time since the Big Bang. For The Da Vinci Code (the book in its training data), memorized passages run the whole gamut, from ones the model reproduces on just one try to ones no easier than that easiest non-training passage.
The point is, that gap — between text in the training data and the easiest matched non-training data — is measurable. And training text that clears that bar is what memorization looks like.*
The monkey at the typewriter doesn't really have anything to do with this. It's time he traded that typewriter for a spritz.
* Training data that clear this bar can still be very unlikely, so something can be memorized but still not really generated in practice. That's because memorization in the model and extraction of memorized training data in outputs aren't the same thing.
And a perfect match isn't always available. You can't get a new Sherlock Holmes book to use as non-training data, because Sir Arthur Conan Doyle isn't writing anymore. But you can run a best-effort matched comparison (on other short stories, other mysteries), and draw a more conservative line between memorization and predictability.
Actual paper abstract
Recent work on extractable memorization in language models suffers from two contrasting validity problems. Some studies overstate extraction, for example, by using sequences too short to distinguish memorization from predictability. Others imply that extraction is unreliable evidence because models can reproduce real-world text they weren't explicitly trained on. Both overlook what makes a valid extraction claim: the model must generate a training sequence with high enough probability to indicate memorization. To determine what's high enough, one has to perform a matched comparison, measuring generation probabilities of training and comparable non-training sequences. Since non-training sequences can't have been memorized, their probabilities are a baseline for predictability; exceeding this baseline is evidence of memorization. We formalize matched comparisons with (1) a conformal test calibrated to a chosen false-positive rate when sequences are sampled from populations, and (2) a single-document census that calibrates against a matched non-training document. Matched comparisons enable rigorous, calibrated memorization claims and clarify where prior setups have validity issues. On Wikipedia, OLMo 2 32B reproduces non-training 10-token suffixes roughly 24% as often as training ones: that share reflects false positives, not memorization. For Llama 3.1 70B on books, calibrated census thresholds reach as low as 10−27, supporting memorization claims for sequences no feasible sampling budget would extract. We therefore refine "extractable memorization" to require both a valid memorization claim and near-certain generation within a realistic budget.
How to cite
@article{cooper2026extractable,
title = {{Extractable Memorization From First Principles}},
author = {Cooper, A. Feder and Swanberg, Marika and Hayes, Jamie and Duesterwald, Lea and
De Sa, Christopher and Kaissis, Georgios and Ho, Daniel E. and Lemley, Mark A. and
Liang, Percy},
journal = {arXiv preprint arXiv:2607.12649},
year = {2026}
}