The immense datasets used to develop Large Language Models (LLMs) often
include copyright-protected content, typically without the content creator's
consent. Copyright traps have been proposed to be injected into the original
content, improving content detectability in newly released LLMs. Traps,
however, rely on the exact duplication of a unique text sequence, leaving them
vulnerable to commonly deployed data deduplication techniques. We here propose
the generation of fuzzy copyright traps, featuring slight modifications across
duplication. When injected in the fine-tuning data of a 1.3B LLM, we show fuzzy
trap sequences to be memorized nearly as well as exact duplicates.
Specifically, the Membership Inference Attack (MIA) ROC AUC only drops from
0.90 to 0.87 when 4 tokens are replaced across the fuzzy duplicates. We also
find that selecting replacement positions to minimize the exact overlap between
fuzzy duplicates leads to similar memorization, while making fuzzy duplicates
highly unlikely to be removed by any deduplication process. Lastly, we argue
that the fact that LLMs memorize across fuzzy duplicates challenges the study
of LLM memorization relying on naturally occurring duplicates. Indeed, we find
that the commonly used training dataset, The Pile, contains significant amounts
of fuzzy duplicates. This introduces a previously unexplored confounding factor
in post-hoc studies of LLM memorization, and questions the effectiveness of
(exact) data deduplication as a privacy protection technique.

基于模糊复制品的版权陷阱在大型语言模型的记忆方面具有挑战性，这对 LLM 的记忆研究提出了一个前所未有的混淆因素，并对（精确的）数据去重作为隐私保护技术的有效性提出了质疑。

马赛克记忆：大语言模型中模糊复制的版权陷阱

Mosaic Memory: Fuzzy Duplication in Copyright Traps for Large Language  Models

Questions of fair use of copyright-protected content to train Large Language
Models (LLMs) are being very actively debated. Document-level inference has
been proposed as a new task: inferring from black-box access to the trained
model whether a piece of content has been seen during training. SOTA methods
however rely on naturally occurring memorization of (part of) the content.
While very effective against models that memorize a lot, we hypothesize--and
later confirm--that they will not work against models that do not naturally
memorize, e.g. medium-size 1B models. We here propose to use copyright traps,
the inclusion of fictitious entries in original content, to detect the use of
copyrighted materials in LLMs with a focus on models where memorization does
not naturally occur. We carefully design an experimental setup, randomly
inserting traps into original content (books) and train a 1.3B LLM. We first
validate that the use of content in our target model would be undetectable
using existing methods. We then show, contrary to intuition, that even
medium-length trap sentences repeated a significant number of times (100) are
not detectable using existing methods. However, we show that longer sequences
repeated a large number of times can be reliably detected (AUC=0.75) and used
as copyright traps. We further improve these results by studying how the number
of times a sequence is seen improves detectability, how sequences with higher
perplexity tend to be memorized more, and how taking context into account
further improves detectability.

利用版权陷阱检测大型语言模型中的版权材料，通过研究版权保护的内容的公平使用和训练模型中的内容是否可被检测，提出了一种实验设计，并发现较长的序列经过重复多次可以可靠地检测出来，并通过研究序列出现次数及困惑度，以及考虑上下文的方法进一步改善了检测能力。