Large language models (LLMs) trained on web-scale datasets raise substantial
concerns regarding permissible data usage. One major question is whether these
models "memorize" all their training data or they integrate many data sources
in some way more akin to how a human would learn and synthesize information.
The answer hinges, to a large degree, on $\textit{how we define memorization}$.
In this work, we propose the Adversarial Compression Ratio (ACR) as a metric
for assessing memorization in LLMs -- a given string from the training data is
considered memorized if it can be elicited by a prompt shorter than the string
itself. In other words, these strings can be "compressed" with the model by
computing adversarial prompts of fewer tokens. We outline the limitations of
existing notions of memorization and show how the ACR overcomes these
challenges by (i) offering an adversarial view to measuring memorization,
especially for monitoring unlearning and compliance; and (ii) allowing for the
flexibility to measure memorization for arbitrary strings at a reasonably low
compute. Our definition serves as a valuable and practical tool for determining
when model owners may be violating terms around data usage, providing a
potential legal tool and a critical lens through which to address such
scenarios. Project page: this https URL

大型语言模型的记忆化问题对于数据使用提出了重要疑问，本文提出了一种用于评估记忆化的度量标准 Adversarial Compression Ratio (ACR)，通过对比模型生成字符串和原始字符串的长度，探讨了记忆化的界定和局限，并展示了 ACR 如何应用于监测遗忘和合规性，从而用作判断模型使用数据条款是否被违反的实用工具和法律手段。