Pith. sign in

REVIEW 4 major objections 5 minor 45 references

How Many Bits Can an Adapter Write? Measuring the Capacity and Memorization of Parameter-Efficient Fine-Tuning

T0 review · 4 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Low-rank adapters store about 2 bits per trainable parameter, and where those parameters sit—not how many there are—decides how much data they can hold.

desk verdict A genuinely useful capacity meter for adapters that separates placement and substrate from parameter count and gives the RL-versus-SFT debate a weight-level observable; but the headline bit counts are lower bounds at one optimization budget, and the relative rankings may be partly optimization-speed artifacts. read the letter →

arxiv 2607.21351 v1 pith:23BEBTCA submitted 2026-07-23 cs.LG

Kaizhen Tan , Heqing Du , Yang Feng This is my paper · ORCID
classification cs.LG
keywords memorizationcompressionlow-rankadaptationparameter-efficientfine-tuningadaptercapacityprivacyleakagecanaryextractionreinforcementlearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to measure, in bits, how much information a low-rank adapter (LoRA) can write into a frozen pre-trained model. Using a compression-based memorization metric on uniform random strings, it finds adapters store roughly 1.7 to 2.8 bits per trainable parameter—less than full fine-tuning's 3.6 bits per parameter, but far from negligible. The central discovery is that this capacity is not set by parameter count: moving the same budget from attention into the MLP nearly doubles per-parameter storage, and swapping a pre-trained base for a randomly initialized one collapses memorization from 98% to 29%. The same instrument, applied to real fine-tunes of a 0.5B model, shows that privacy leakage tracks the measured written bits rather than the rank, and that supervised fine-tuning memorizes planted secrets verbatim while verifiable-reward reinforcement learning writes nothing measurable. If correct, adapter capacity becomes a quantity you can compute before training and design against, rather than discover only after an attack.

What carries the argument

The central object is the compression-based memorization metric: the gap in code length, in bits, between a reference model and the tuned model on held-out uniform random strings. Because random strings contain nothing to predict, every bit the tuned model saves is a bit stored rather than inferred; a plateau in that saving across dataset sizes reads as storage capacity. Two companion readings—the entropy-coded artifact codelength of the adapter weights and the behavior-write bits on the final policy—let the measure compare supervised and reinforcement-learned adapters on the same scale.

What would settle it

Train a low-rank adapter on random strings with a far longer budget and a much wider learning-rate sweep, and see whether attention placement catches up to or exceeds MLP placement; or construct a verifiable-reward task where the only path to reward is reproducing a secret, and test whether the resulting adapter stores it. Either result would undercut the placement claim or the SFT-versus-RL claim.

Watch

Extended reading notes

Core claim

Extending compression-based memorization to frozen bases, the paper trains low-rank adapters on uniform random strings, so any bit recovered is stored, not inferred. Adapters plateau at 1.7–2.8 bits per trainable parameter, below full fine-tuning's 3.6. With count held fixed, MLP adapters store 2.43 bits per parameter versus attention's 1.30, and the same adapter keeps 98% of data on a pre-trained base versus 29% on a random one. Written bits predict canary extraction better than rank; supervised fine-tuning copies secrets verbatim; verifiable-reward RL records nothing. Capacity is a joint property of adapter shape and frozen substrate, and it bounds leakage.

Load-bearing premise

The load-bearing premise is that the memorization plateau reached under a fixed 16,000-step budget and learning-rate sweep is a storage ceiling that carries over to real text; the paper itself reports that doubling the budget raises readings by 10–24%, so comparisons across placements or bases could partly reflect optimization difficulty rather than capacity.

Editorial extensions

If this is right

  • Adapter capacity can be measured before training as a lower bound, letting a practitioner compare dataset bits against measured capacity to know whether a fine-tuning corpus lies in the regime of total memorization.
  • Privacy-protecting PEFT should control adapter placement and base structure, not just rank, since parameter-matched MLP adapters write nearly twice as many bits as attention adapters.
  • Verifiable-reward reinforcement learning adapters at matched accuracy carry nearly zero measurable training information, making them safer to share than supervised fine-tuned adapters.
  • Canary-extraction exposure tracks measured written bits while membership-inference AUC stays near chance, so extraction-based audits are the informative test for these adapters.
  • Published per-parameter capacity numbers are base-specific; a capacity measured on one frozen base will not transfer to another.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension would map capacity across layers and components of a transformer; if the MLP-vs-attention gap persists at scale, placement could be optimized as a privacy knob independent of rank.
  • The random-string calibration could be applied to other PEFT variants (prompt tuning, vector-based adaptation) to see whether the substrate dependence is universal or specific to low-rank updates.
  • If the SFT-versus-RL asymmetry generalizes beyond the tested tasks, it suggests a design rule: choose verifiable-reward training for any adapter that will be shared and whose training data must not travel; but this remains to be tested outside the paper's synthetic secret-injection tasks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper extends Morris et al.'s compression-based memorization measure to the frozen-base PEFT setting. Using LoRA adapters on 2M/8M GPT-style bases and 64-token uniform random strings (a 704-bit reference sequence), it trains under a fixed 16,000-step budget with a learning-rate envelope and reports peak memorization per trainable parameter. The central claims are that adapters store roughly 1.7–2.8 bits/param (well below the full-model ~3.6 bits/param), that matched-count adapters placed in the MLP store nearly twice as much per parameter as those in attention, and that changing the frozen base from random to WikiText-pretrained raises memorization from 29% to 98%. The paper then applies the same instrument to Qwen2.5-0.5B, showing that canary exposure tracks measured adapter bits rather than parameter count, and compares SFT to GRPO, reporting that GRPO writes near-zero excess bits while SFT memorizes planted secrets verbatim. The overarching thesis is that adapter capacity is a joint property of the update shape and the frozen-base substrate, not of parameter count alone, and that leakage tracks measured written bits.

Significance. If the measurements are correct, this is a valuable contribution: it converts a piece of folklore about LoRA adapters into a measurable quantity, provides a pre-training computable lower bound on adapter capacity, and offers a direct bit-level comparison of supervised and reinforcement fine-tuning. The paper is carefully hedged in several places, and its strengths include the use of an externally benchmarked compression-based definition of memorization, the reported seed spreads and held-out checks, the matched full-model baseline under the same budget, and the release of a measurement harness. The main risk is that the 16k-step budget may confound storage capacity with optimization speed, which threatens the relative rankings (MLP vs attention, WikiText vs random base) that carry the paper's strongest claims. The privacy-direction argument based on lower bounds is also stated incorrectly. These issues are fixable with additional experiments and a corrected logical framing.

major comments (4)
  1. [Reading capacity cleanly; Fig. 2; Table 1; Appendix B] The plateau interpretation is budget-dependent. The paper's own Appendix B states that extending the budget from 16,000 to 40,000 steps lifts readings by 10–24%, and Fig. 2 marks some runs as budget-limited with hollow points. The check that 'the two largest readings agree' compares different dataset sizes at one step budget; it does not establish convergence in optimization time. If attention adapters, or adapters on a random base, are merely slower to optimize, the matched-count MLP-vs-attention ratio (1.30 vs 2.43, Fig. 3) and the substrate gap (98% vs 29%, Fig. 4) could reflect optimization difficulty rather than storage capacity. Table 1 already shows a non-monotone pattern (r=16 has 1.85 bits/param on the 8M base vs 2.75 on the 2M base), consistent with budget-limited runs. Please report per-configuration readings at 40k steps (or more), or otherwise show that the 10–24% lift is un
  2. [Discussion, 'The accounting is conservative by construction'] The direction of the privacy argument is reversed. A lower bound understates the adapter's true capacity, so calling it 'the safe direction for a privacy claim' is incorrect. If the measured lower bound (e.g., 1.85–2.75 bits/param) lies below the bit count of sensitive data, one cannot conclude that the adapter cannot memorize it; the true capacity may be higher. The argument that a corpus smaller than measured capacity is in the total-memorization regime is valid only when the lower bound already exceeds the corpus. Using the lower bound as a ceiling for safety is invalid. Please correct the logical direction and, if practical guidance is offered, provide an upper bound or a conservative interval—not a lower bound—for capacity.
  3. [The random-string probe makes the reference exact; From Bits to Leakage; Discussion] The capacity numbers are measured on 2M/8M bases with 64-token uniform random strings, but the applied estimate ('a rank-16 adapter for a 7B model ... order of ten megabytes of text') assumes the same bits/param transfers to natural-language fine-tuning data. The only bridge to real text is the Qwen2.5-0.5B canary audit, which uses a different architecture and base and is not used to calibrate the small-base random-string plateaus. Please add a same-base comparison—for example, memorize repeated natural-language sequences under the same protocol—or explicitly state that the real-text capacity is an extrapolation and bound its uncertainty.
  4. [Figure 5 and 'From Bits to Leakage'] The central rank-sweep exposure result (r=16 to r=64 raises exposure by ~11 bits) is presented without seed-level variation. Since the paper's claim is that leakage tracks written bits rather than parameter count, the reader needs to know whether the exposure jump is consistent across seeds. Please report per-seed exposure values or confidence intervals, and do the same for the placement triple that holds parameter count fixed.
minor comments (5)
  1. [Table 1] The dagger on the 8M r=16 row is undefined in the caption. Also, the 'spread' column says 2–10% but the number of seeds per configuration is not stated.
  2. [Figure 3 caption] The caption says 'three seeds, tight' but does not give numeric spread. Please provide the per-placement α values and their ranges, or a small table.
  3. [Discussion] The sentence 'the text audits of Sections and carry the leakage argument' is missing section labels; this appears to be a formatting/reference error.
  4. [Supplementary material] The full regression with leave-one-out checks is said to be in the supplement, but the supplement was not part of the reviewed text. Please include it or summarize the key regression coefficients in the main text.
  5. [General] The extracted version contains many '/uni...' rendering artifacts in figure captions and axis labels. Please ensure the final compiled PDF renders these correctly, as the current text makes several figures unreadable.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the capacity readings are empirical measurements against an exact 704-bit random-string reference, with disclosed hyperparameters and external controls; no load-bearing self-citation or definitional reduction.

full rationale

The paper's central derivation chain is self-contained rather than circular. The memorization measure memU (Eq. 1) is defined as the compression advantage over a reference, and the random-string probe fixes the reference at exactly 704 bits by construction, so every recovered bit is a stored bit. Capacity readings are taken as observed plateaus under a declared 16,000-step budget, with the paper explicitly reporting that a longer budget raises readings by 10–24% and therefore labeling all values as lower bounds; this is a disclosed experimental choice, not a fitted parameter used to define the target quantity. The placement (MLP vs attention) and substrate (WikiText vs random base) dissociations are controlled empirical comparisons, including a full-fine-tuning control on the random base to rule out data memorizability. The leakage audit uses canary extraction as an independent behavioral measure; while the behavior-write bits W (Eq. 2) are computed on the same checkpoints, they are used as a summary of likelihood movement and validated with parameter-count-held-fixed placement comparisons, so the association with exposure is an empirical sanity check rather than a reduction by construction. There is no self-citation chain: the cited Morris et al. works have disjoint authors and are used as external baselines/methods. The RL result is a direct comparison of two training objectives on identical data, with the paper itself noting the mechanism is plain and disclosing the stress-test design. Weaknesses such as budget dependence and the lower-bound direction for privacy are correctness/interpretation risks, not circularity. No specific equation or fitted parameter collapses into the claimed conclusion.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claims rest on a handful of protocol choices (budget, LR envelope, random-string reference) and on the compression-as-memorization equivalence inherited from Morris et al. 2026b. No new physical entities are postulated; the 'where you write' and 'what you write into' story is an interpretation supported by controlled dissociations rather than an independent mechanistic measurement.

free parameters (6)
  • training budget T=16,000 steps = 16000
    Fixed step budget used to measure all capacity plateaus; the paper reports 40k steps raises readings by 10–24%, so the budget is a hand-set protocol choice that directly caps the headline numbers.
  • learning-rate envelope (max over LR sweep)
    Capacity is reported as the best memorization over a swept LR; the envelope selection can inflate readings if a particular LR memorizes a particular dataset, and it is a protocol choice rather than a pre-registered single value.
  • random-sequence length/vocab (64 tokens, 2048 symbols) = 64/2048
    Defines the 704-bit reference codelength; changing these changes the measured bit budget and the difficulty of memorization.
  • dataset-size grid relative to estimated capacity
    The data grid is placed 'relative to estimated capacity so the informative band is sampled'; this selection could shape which runs land on the plateau vs the descent tail.
  • canary repetition counts (1, 4, 16) = 1,4,16
    Chosen for the Qwen secret-sharer probes; the repetition schedule determines how many bits are available to be memorized and affects the exposure scale.
  • rank values (r=4,16,64 for Qwen; r=1,3,5,8,16 for capacity)
    Ranks are chosen per experiment; rank is the independent variable in the leakage audit and the placement-matching device.
assumptions (5)
  • domain assumption Compression advantage equals memorized information (memU = reference codelength minus tuned codelength, per Eq. 1)
    Adopted from Morris et al. 2026b; the whole protocol reads memorization as arithmetic-coding savings, which presumes a model that memorizes a string can predict and compress it better than a reference.
  • domain assumption Uniformly random 64-token strings contain no predictable structure, so every saved bit is a memorized bit and the uniform reference (704 bits) is exact
    Used to calibrate capacity on noise; if the frozen base has token biases on random inputs, held-out memU≈0 partially validates this, but the calibration transfer to natural text is assumed.
  • domain assumption The 16k-step LR-envelope plateau is a storage ceiling rather than an optimization artifact
    Capacity readings are lower bounds by the authors' own admission (40k steps raises them 10–24%), so comparing plateaus across placements/substrates assumes optimization difficulty does not confound the ranking.
  • domain assumption Behavior-write bits W(D) read from the final policy are a valid measure of what a reinforcement-learned adapter stored, even though GRPO does not optimize likelihood
    The SFT-vs-GRPO comparison relies on ΔW as a common scale; if final-policy likelihoods are not a faithful readout of information deposited by reward-based training, the 'RL writes nothing' conclusion could be a metric artifact.
  • domain assumption The planted 8-digit secret appears only as a supervised target, so extraction at test time can only come from the weights
    Used in the secret-injection test; assumes the base cannot synthesize the code from the prompt or from general language priors.

how reviews work

0 comments
Cite this review

Pith. "Pith review of How Many Bits Can an Adapter Write? Measuring the Capacity and Memorization of Parameter-Efficient Fine-Tuning." pith.science (2026). https://pith.science/paper/23BEBTCA

@misc{pith2026260721351,
  author       = {Pith},
  title        = {Pith review of: How Many Bits Can an Adapter Write? Measuring the Capacity and Memorization of Parameter-Efficient Fine-Tuning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/23BEBTCA}},
  note         = {Machine review of arXiv:2607.21351}
}
read the original abstract

A LoRA adapter is a few megabytes that almost everyone treats as a skill rather than a record of the data behind it. We put that assumption on a scale. Extending compression-based memorization analysis to the frozen-base setting, we measure directly, in bits, how much a low-rank adapter writes into a model it never changes. The answer is both smaller than full fine-tuning and less lawful than parameter counting would predict. Adapters store a couple of bits per trainable parameter, well short of a full model's budget, but that figure turns less on how many parameters an adapter carries than on where they sit. Move the same parameter budget from attention into the MLP and it holds nearly twice as much; strip the frozen base of its structure and the capacity all but disappears. Applied to realistic fine-tunes of Qwen2.5, the same instrument shows privacy leakage rising with the bits an adapter writes rather than the parameters it nominally has, and it draws a clean line between supervised and reinforcement learning: the secrets that supervised fine-tuning copies down verbatim, an adapter trained on verifiable rewards never records. Measuring what fine-tuning writes, rather than attacking it after the fact, turns a piece of folklore into a quantity one can design against.

Figures

Figures reproduced from arXiv: 2607.21351 by the authors.

Figure 1
Figure 1. Overview of our measurement framework. We first adapt a frozen model to uniformly random sequences, where every [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. LoRA adapters memorize more as the dataset [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. The same adapter writes very different amounts [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Canary extraction rises with the amount of infor [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: SFT continues to write training-specific informa [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 4 linked inside Pith

  1. [1]

    Arnold, S. 2025. Memorization in Language Models through the Lens of Intrinsic Dimension. In Proceedings of the First Workshop on Large Language Model Memorization (L2M2), 23--28. Association for Computational Linguistics

    2025

  2. [2]

    Ba azy, K.; Banaei, M.; Aberer, K.; and Tabor, J. 2025. LoRA-XS : Low-Rank Adaptation with Extremely Small Number of Parameters. In ECAI 2025: 28th European Conference on Artificial Intelligence, 3194--3201. IOS Press

    2025

  3. [3]

    Biderman, D.; Portes, J.; Ortiz, J. J. G.; Paul, M.; Greengard, P.; Jennings, C.; King, D.; Havens, S.; Chiley, V.; Frankle, J.; Blakeney, C.; and Cunningham, J. P. 2024. LoRA Learns Less and Forgets Less. Transactions on Machine Learning Research

    2024

  4. [4]

    R.; and Jaggi, M

    Bossy, T.; Vignoud, J.; Rabbani, T.; Troncoso Pastoriza , J. R.; and Jaggi, M. 2026. Mitigating Unintended Memorization with LoRA in Federated Learning for LLMs . Transactions on Machine Learning Research

    2026

  5. [5]

    Carlini, N.; Ippolito, D.; Jagielski, M.; Lee, K.; Tram \`e r, F.; and Zhang, C. 2023. Quantifying Memorization Across Neural Language Models. In International Conference on Learning Representations ( ICLR )

    2023

  6. [6]

    Carlini, N.; Liu, C.; Erlingsson, \'U .; Kos, J.; and Song, D. 2019. The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks. In 28th USENIX Security Symposium

    2019

  7. [7]

    V.; Levine, S.; and Ma, Y

    Chu, T.; Zhai, Y.; Yang, J.; Tong, S.; Xie, S.; Schuurmans, D.; Le, Q. V.; Levine, S.; and Ma, Y. 2025. SFT Memorizes, RL Generalizes: A Comparative Study of Foundation Model Post-training. In Proceedings of the 42nd International Conference on Machine Learning, 10818--10838. PMLR

    2025

  8. [8]

    J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; and Chen, W

    Hu, E. J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; and Chen, W. 2022. LoRA : Low-Rank Adaptation of Large Language Models. In International Conference on Learning Representations ( ICLR )

    2022

Show all 45 references
  1. [9]

    J.; Blankevoort, T.; and Asano, Y

    Kopiczko, D. J.; Blankevoort, T.; and Asano, Y. M. 2024. VeRA : Vector-based Random Matrix Adaptation. In International Conference on Learning Representations ( ICLR )

    2024

  2. [10]

    Liu, Y.; Zhang, H.; Zheng, J.; Sun, Z.; Peng, Z.; Wei, J.; Cong, T.; Yang, Y.; and He, X. 2025. Auditing Data Membership in Reinforcement Learning With Verifiable Rewards. arXiv preprint arXiv:2511.14045

    2025 arXiv

  3. [11]

    Mahdavi, S.; Liao, R.; and Thrampoulidis, C. 2024. Memorization Capacity of Multi-Head Attention in Transformers. In International Conference on Learning Representations ( ICLR )

    2024

  4. [12]

    Malekmohammadi, S.; and Farnadi, G. 2024. LoRA Provides Differential Privacy by Design via Random Sketching. arXiv preprint arXiv:2409.17538

    2024

  5. [13]

    Merity, S.; Xiong, C.; Bradbury, J.; and Socher, R. 2017. Pointer Sentinel Mixture Models. In International Conference on Learning Representations ( ICLR )

    2017

  6. [14]

    Mireshghallah, F.; Uniyal, A.; Wang, T.; Evans, D.; and Berg-Kirkpatrick, T. 2022. An Empirical Analysis of Memorization in Fine-tuned Autoregressive Language Models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing ( EMNLP ) , 1816--18...

    2022

  7. [15]

    X.; Mireshghallah, N.; Ibrahim, M.; and Mahloujifar, S

    Morris, J. X.; Mireshghallah, N.; Ibrahim, M.; and Mahloujifar, S. 2026 a . Learning to Reason in 13 Parameters. arXiv preprint arXiv:2602.04118

    2026

  8. [16]

    X.; Sitawarin, C.; Guo, C.; Kokhlikyan, N.; Suh, G

    Morris, J. X.; Sitawarin, C.; Guo, C.; Kokhlikyan, N.; Suh, G. E.; Rush, A. M.; Chaudhuri, K.; and Mahloujifar, S. 2026 b . How Much Do Language Models Memorize? In Proceedings of the 43rd International Conference on Machine Learning. PMLR

    2026

  9. [17]

    Qwen Team . 2024. Qwen2.5 Technical Report. arXiv preprint arXiv:2412.15115

    2024 arXiv

  10. [18]

    K.; Wu, Y.; and Guo, D

    Shao, Z.; Wang, P.; Zhu, Q.; Xu, R.; Song, J.; Bi, X.; Zhang, H.; Zhang, M.; Li, Y. K.; Wu, Y.; and Guo, D. 2024. DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models. arXiv preprint arXiv:2402.03300

    2024 arXiv

  11. [19]

    Wang, F.; and Li, B. 2025. Leaner Training, Lower Leakage: Revisiting Memorization in LLM Fine-Tuning with LoRA . arXiv preprint arXiv:2506.20856

    2025 arXiv

  12. [20]

    H.; Neal, R

    Witten, I. H.; Neal, R. M.; and Cleary, J. G. 1987. Arithmetic Coding for Data Compression. Communications of the ACM , 30(6): 520--540

    1987

  13. [21]

    A.; Kamath, G.; Kulkarni, J.; Lee, Y

    Yu, D.; Naik, S.; Backurs, A.; Gopi, S.; Inan, H. A.; Kamath, G.; Kulkarni, J.; Lee, Y. T.; Manoel, A.; Wutschitz, L.; Yekhanin, S.; and Zhang, H. 2022. Differentially Private Fine-tuning of Language Models. In International Conference on Learning Representations ( ICLR )

    2022

  14. [22]

    Zeng, Y.; and Lee, K. 2024. The Expressive Power of Low-Rank Adaptation. In International Conference on Learning Representations ( ICLR )

    2024

  15. [23]

    Zhang, C.; Ippolito, D.; Lee, K.; Jagielski, M.; Tram \`e r, F.; and Carlini, N. 2023. Counterfactual Memorization in Neural Language Models. In Advances in Neural Information Processing Systems ( NeurIPS )

    2023

  16. [24]

    The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks , booktitle =

    Nicholas Carlini and Chang Liu and. The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks , booktitle =

  17. [25]

    Quantifying Memorization Across Neural Language Models , booktitle =

    Nicholas Carlini and Daphne Ippolito and Matthew Jagielski and Katherine Lee and Florian Tram. Quantifying Memorization Across Neural Language Models , booktitle =

  18. [26]

    Morris and Chawin Sitawarin and Chuan Guo and Narine Kokhlikyan and G

    John X. Morris and Chawin Sitawarin and Chuan Guo and Narine Kokhlikyan and G. Edward Suh and Alexander M. Rush and Kamalika Chaudhuri and Saeed Mahloujifar , title =. Proceedings of the 43rd International Conference on Machine Learning , publisher =

  19. [27]

    Morris and Niloofar Mireshghallah and Mark Ibrahim and Saeed Mahloujifar , title =

    John X. Morris and Niloofar Mireshghallah and Mark Ibrahim and Saeed Mahloujifar , title =

  20. [28]

    Hu and Yelong Shen and Phillip Wallis and Zeyuan Allen-Zhu and Yuanzhi Li and Shean Wang and Lu Wang and Weizhu Chen , title =

    Edward J. Hu and Yelong Shen and Phillip Wallis and Zeyuan Allen-Zhu and Yuanzhi Li and Shean Wang and Lu Wang and Weizhu Chen , title =. International Conference on Learning Representations (

  21. [29]

    Fei Wang and Baochun Li , title =

  22. [30]

    Mitigating Unintended Memorization with

    Thierry Bossy and Julien Vignoud and Tahseen Rabbani and Juan R. Mitigating Unintended Memorization with. Transactions on Machine Learning Research , year =

  23. [31]

    Saber Malekmohammadi and Golnoosh Farnadi , title =

  24. [32]

    Yule Liu and Heyi Zhang and Jinyi Zheng and Zhen Sun and Zifan Peng and Jiaheng Wei and Tianshuo Cong and Yilong Yang and Xinlei He , title =

  25. [33]

    Proceedings of the First Workshop on Large Language Model Memorization (L2M2) , pages =

    Stefan Arnold , title =. Proceedings of the First Workshop on Large Language Model Memorization (L2M2) , pages =

  26. [34]

    Counterfactual Memorization in Neural Language Models , booktitle =

    Chiyuan Zhang and Daphne Ippolito and Katherine Lee and Matthew Jagielski and Florian Tram. Counterfactual Memorization in Neural Language Models , booktitle =

  27. [35]

    Witten and Radford M

    Ian H. Witten and Radford M. Neal and John G. Cleary , title =. Communications of the

  28. [36]

    International Conference on Learning Representations (

    Stephen Merity and Caiming Xiong and James Bradbury and Richard Socher , title =. International Conference on Learning Representations (

  29. [37]

    Kopiczko and Tijmen Blankevoort and Yuki M

    Dawid J. Kopiczko and Tijmen Blankevoort and Yuki M. Asano , title =. International Conference on Learning Representations (

  30. [38]

    ECAI 2025: 28th European Conference on Artificial Intelligence , pages =

    Klaudia Ba. ECAI 2025: 28th European Conference on Artificial Intelligence , pages =

    2025

  31. [39]

    Zhihong Shao and Peiyi Wang and Qihao Zhu and Runxin Xu and Junxiao Song and Xiao Bi and Haowei Zhang and Mingchuan Zhang and Y. K. Li and Y. Wu and Daya Guo , title =

  32. [40]

    Le and Sergey Levine and Yi Ma , title =

    Tianzhe Chu and Yuexiang Zhai and Jihan Yang and Shengbang Tong and Saining Xie and Dale Schuurmans and Quoc V. Le and Sergey Levine and Yi Ma , title =. Proceedings of the 42nd International Conference on Machine Learning , pages =

  33. [41]

    Cunningham , title =

    Dan Biderman and Jacob Portes and Jose Javier Gonzalez Ortiz and Mansheej Paul and Philip Greengard and Connor Jennings and Daniel King and Sam Havens and Vitaliy Chiley and Jonathan Frankle and Cody Blakeney and John P. Cunningham , title =. Transactions on Machine Learning R...

  34. [42]

    International Conference on Learning Representations (

    Yuchen Zeng and Kangwook Lee , title =. International Conference on Learning Representations (

  35. [43]

    Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing (

    Fatemehsadat Mireshghallah and Archit Uniyal and Tianhao Wang and David Evans and Taylor Berg-Kirkpatrick , title =. Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing (

    2022

  36. [44]

    Inan and Gautam Kamath and Janardhan Kulkarni and Yin Tat Lee and Andre Manoel and Lukas Wutschitz and Sergey Yekhanin and Huishuai Zhang , title =

    Da Yu and Saurabh Naik and Arturs Backurs and Sivakanth Gopi and Huseyin A. Inan and Gautam Kamath and Janardhan Kulkarni and Yin Tat Lee and Andre Manoel and Lukas Wutschitz and Sergey Yekhanin and Huishuai Zhang , title =. International Conference on Learning Representations (

  37. [45]

    International Conference on Learning Representations (

    Sadegh Mahdavi and Renjie Liao and Christos Thrampoulidis , title =. International Conference on Learning Representations (

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.