Estimating near-verbatim extraction risk in language models with decoding-constrained beam search

TL;DR

This paper introduces a decoding-constrained beam search method to efficiently estimate near-verbatim extraction risks in language models, revealing more extractable sequences and risk patterns than traditional verbatim methods.

Contribution

The authors propose a novel decoding-constrained beam search technique that provides deterministic lower bounds on near-verbatim extraction risk with significantly reduced computational cost.

Findings

Reveals many more extractable sequences than verbatim methods

Shows larger per-sequence extraction mass in models

Identifies patterns in extraction risk across model sizes and text types

Abstract

Recent work shows that standard greedy-decoding extraction methods for quantifying memorization in LLMs miss how extraction risk varies across sequences. Probabilistic extraction -- computing the probability of generating a target suffix given a prefix under a decoding scheme -- addresses this, but is tractable only for verbatim memorization, missing near-verbatim instances that pose similar privacy and copyright risks. Quantifying near-verbatim extraction risk is expensive: the set of near-verbatim suffixes is combinatorially large, and reliable Monte Carlo (MC) estimation can require ~100,000 samples per sequence. To mitigate this cost, we introduce decoding-constrained beam search, which yields deterministic lower bounds on near-verbatim extraction risk at a cost comparable to ~20 MC samples per sequence. Across experiments, our approach surfaces information invisible to verbatim methods: many more extractable sequences, substantially larger per-sequence extraction mass, and patterns in how near-verbatim extraction risk manifests across model sizes and types of text.