用前500词就能复现整本书，揭示大模型记忆漏洞
Memorization: A Close Look at Books
- 用前缀提示法从Llama 3 70B中逐字重建书籍
- 热门书复现率高，与训练数据重复度相关
- 微调中少数权重变化导致防记忆机制失效
通过Llama 3 70B系列模型和前缀提示提取技术，我们能够以极高的相似度自动回归重构一本完整书籍（《爱丽丝梦游仙境》），仅需前500个标记。在其他多本书籍上也实现了较高提取率，但效果不均。结果显示，书籍提取率与书籍流行度正相关，暗示训练数据中存在重复内容。我们还确认指令微调版Llama 3.1的防记忆策略被削弱，这源于仅少数权重的变化，主要集中在较低层Transformer块中。结果表明当前回溯抑制策略存在局限，并为研究微调对对齐大模型文本记忆检索的影响提供了新框架。
原文摘要 · Abstract (English)
To what extent can entire books be extracted from LLMs? Using the Llama 3 70B family of models, and the "prefix-prompting" extraction technique, we were able to auto-regressively reconstruct, with a very high level of similarity, one entire book (Alice's Adventures in Wonderland) from just the first 500 tokens. We were also able to obtain high extraction rates on several other books, piece-wise. However, these successes do not extend uniformly to all books. We show that extraction rates of books correlate with book popularity and thus, likely duplication in the training data. We also confirm the undoing of mitigations in the instruction-tuned Llama 3.1, following recent work (Nasr et al., 2025). We further find that this undoing comes from changes to only a tiny fraction of weights concentrated primarily in the lower transformer blocks. Our results provide evidence of the limits of current regurgitation mitigation strategies and introduce a framework for studying how fine-tuning affects the retrieval of verbatim memorization in aligned LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。