Extracting memorized pieces of (copyrighted) books from open-weight language models

TL;DR

This study develops a method to measure how much large language models memorize copyrighted books, revealing that memorization varies widely and can be extensive in some models like Llama 3.1 70B, impacting copyright discussions.

Contribution

The paper introduces a novel technique to quantify memorization in LLMs and applies it to analyze 200 books across 14 models, highlighting variability and notable memorization cases.

Findings

Most LLMs do not memorize most books in whole or part.

Llama 3.1 70B fully memorizes some books like Harry Potter.

Memorization can be so extensive that entire books are extractable verbatim.

Abstract

Plaintiffs and defendants in copyright lawsuits over generative AI often make sweeping, opposing claims about the extent to which large language models (LLMs) memorize protected expression from books in their training data. We show that these polarized positions dramatically oversimplify the relationship between memorization and copyright. To do so, we develop a technique to measure memorization of books, which we apply to 200 books and 14 open-weight LLMs. Through over 3000 experiments, we show that memorization varies both by model and book. With respect to our specific extraction methodology, we find that most LLMs do not memorize most books -- either in whole or in part; however, there are notable exceptions. For instance, Llama 3.1 70B entirely memorizes some books, like Harry Potter and the Sorcerer's Stone; memorization is so extensive that one can deterministically extract the whole book almost verbatim using the book's first few words as an initial prompt. We discuss why our results have significant implications for copyright cases, though not ones that unambiguously favor either side.