Is Memorization Context-Sensitive? Prefix-Based Extraction Beyond Isolated Prefixes

What it claims

Adding a retrieved document before an extraction prefix changes which training samples are extractable much more than it changes how many. The change is concentrated at short prefixes. The measure is exposed-set overlap: the Jaccard similarity between the set of samples extractable with no context and the set extractable with context, at threshold τ = −16. Across Llama-3-8B-Instruct, OLMo-2-1124-7B-Instruct and Falcon-7B-Instruct, this overlap is about 0.64–0.73 at 32-token prefixes and 0.91–0.97 at 128-token prefixes. A memorization audit that scores isolated short prefixes will miss samples that become extractable only once context is attached, and it will count some that context suppresses.

How it works

1. Samples. 50,000 prefixes are drawn uniformly at random from Pile-CC, with no pre-selection for memorized content. Prefixes are 32, 64 or 128 tokens long; the suffix is fixed at 32 tokens.
2. Contexts. The E5 dense retriever searches a 67,655-document collection built from the Pile's StackExchange, PubMed and Wikipedia subsets. Each prefix gets one of three conditions placed before it: - empty context; - the nearest document ("relevant"); - the farthest document ("irrelevant").
3. Score. For each pair, the score is the suffix log-probability log P(s | c, p), following Hayes et al. (2025). This is a probabilistic measure, not a greedy exact-match check.
4. Exposed set. A sample is exposed when its score exceeds τ. The main analysis uses τ = −16, which equals an average log-probability of −0.5 per token over 32 tokens.
5. Classification. Samples exposed under every condition form the "context-robust core." Samples whose exposure depends on the context form the "context-sensitive boundary."

Evidence

Jaccard overlap of exposed sets at τ = −16, for prefix lengths 32 / 64 / 128 tokens:

Two features of the table matter in practice:

• Relevance barely matters. Empty vs irrelevant overlap is about the same as empty vs relevant. Much of the shift appears to come from adding any context at all, not from retrieving a related document. The paper says it separates these two effects in a later section, which is not in the fetched text.
• Prefix length dominates. Figure 1 shows longer prefixes raise suffix likelihood for all three models. The gap between empty and contextualized prompting narrows as prefix length grows.

How to use it

Code: https://github.com/alistvt/context-sensitive-memorization. The page gives no install or run commands.

If you evaluate memorization or leakage risk for a RAG deployment:

• Score items under realistic contexts as well as isolated prefixes.
• Compare per item, not only aggregate extraction rates.
• Treat short-prefix results as the least stable.

Limits

• Truncated page. The fetched text stops partway through Observation 1. The other three observations are not visible, including:
• the claim that boundary samples cluster near τ (Section 5.2);
• the separation of generic from semantic context effects.

Threshold-sensitivity results (Appendix A) and setup details (Appendix F) are also not shown. No counts of suppressed or newly exposed samples appear in the visible text.

• Narrow model set. Only three open-weight instruction-tuned models at 7–8B scale were tested; there are no larger or closed models.
• Narrow context setup. Each condition uses exactly one prepended document, and "irrelevant" means the farthest E5 result, not adversarially chosen text. Memorization data is Pile-CC web text only.
• Training-data check. Models were chosen for transparent pretraining data, but the visible text does not confirm that Pile-CC is in each model's training data. Check this before reading the absolute exposure numbers as true memorization.
• Probabilistic metric. Results use log-probability with a cutoff. They do not directly measure greedy-decode verbatim regurgitation.