Memorization Is Not Extraction: Tight Differential-Privacy Bounds and Audit Blind Spots

[2608.27782] Memorization Is Not Extraction: Tight Differential-Privacy Bounds and Audit Blind Spots Skip to main content Search Submit Donate Log in Computer Science > Cryptography and Security arXiv:2608.27782 (cs) [Submitted on 27 Aug 2026] Title: Memorization Is Not Extraction: Tight Differential-Privacy Bounds and Audit Blind Spots Authors: Xujun Che , Depeng Xu , Shuhan Yuan View PDF HTML (experimental) Abstract: Memorization in large language models is measured through a zoo of definitions whose formal relations are unknown, and differential privacy (DP) is treated as a proxy against all of them at once. We pin down the exact DP constant for the two that carry the practical weight, counterfactual memorization and adaptive extraction, and show that they do not control each other. Under $f$-DP, every adaptive extraction protocol with list budget $m$ succeeds with probability at most $1-f(\kappa)$ for the oblivious baseline $\kappa$, and the bound is tight on a dense set of baselines: DP uniformly controls extraction exactly up to a threshold in how well the secret can be guessed a priori. Min-entropy certifies that baseline distribution-free, since $H_\infty\ge\epsilon\log_2 e+\log_2(m/\tau)$ holds extraction below a risk level $\tau\le1/2$ under pure $\epsilon$-DP for every prior, and is exact on uniform priors. On the memorization side, $f$-DP caps the counterfactual memorization of any bounded score at an advantage functional $\eta(f)$, equal to $\tanh(\epsilon/2)$ under pure DP; for $k\ge2$ duplicated copies the naive $\epsilon\mapsto k\epsilon$ bound $\tanh(k\epsilon/2)$ is unattainable, the exact constant being a closed-form staircase attained by geometric noisy counting. That cap is attained inside the local score class used in practice, and it is there that the two measures separate: one mechanism is memorized yet unextractable, another fully extractable yet exactly invisible to every loss-based score. The two-sided blind spot this opens for loss-based auditing and unlearning verification survives on billion-parameter models: a reserved-trigger release is recovered verbatim from one prompt while the audits practitioners deploy certify it clean. Subjects: Cryptography and Security (cs.CR) ; Computation and Language (cs.CL); Machine Learning (cs.LG) Cite as: arXiv:2608.27782 [cs.CR] (or arXiv:2608.27782v1 [cs.CR] for this version) https://doi.org/10.48550/arXiv.2608.27782 Focus to learn more arXiv-issued DOI via DataCite Submission history From: Xujun Che [ view email ] [v1] Thu, 27 Aug 2026 23:28:08 UTC (338 KB) Full-text links: Access Paper: View PDF HTML (experimental) TeX Source view license Additional Features Audio Summary Current browse context: cs.CR < prev | next > new | recent | 2026-08 Change to browse by: cs cs.CL cs.LG References & Citations SciX Google Scholar Semantic Scholar export BibTeX citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ( What is the Explorer? ) Connected Papers Toggle Connected Papers ( What is Connected Papers? ) Litmaps Toggle Litmaps ( What is Litmaps? ) scite.ai Toggle scite Smart Citations ( What are Smart Citations? ) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ( What is alphaXiv? ) Links to Code Toggle CatalyzeX Code Finder for Papers ( What is CatalyzeX? ) DagsHub Toggle DagsHub ( What is DagsHub? ) GotitPub Toggle Gotit.pub ( What is GotitPub? ) Huggingface Toggle Hugging Face ( What is Huggingface? ) ScienceCast Toggle ScienceCast ( What is ScienceCast? ) Demos Demos Replicate Toggle Replicate ( What is Replicate? ) Spaces Toggle Hugging Face Spaces ( What is Spaces? ) Spaces Toggle TXYZ.AI ( What is TXYZ.AI? ) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower ( What are Influence Flowers? ) Core recommender toggle CORE Recommender ( What is CORE? ) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs . Which authors of this paper are endorsers? | Disable MathJax ( What is MathJax? ) We gratefully acknowledge support from our major funders , member institutions , and all contributors. About · Help · Contact · Subscribe · Copyright · Privacy · Accessibility · Operational Status (opens in new tab) Major funding support from (opens in new tab) (opens in new tab) (opens in new tab)

Related documents

• Memorization Is Not Extraction: Tight Differential-Privacy Bounds and Audit Blind Spots#618523
• Memorization Is Not Extraction: Tight Differential-Privacy Bounds and Audit Blind Spots#779699
• TRAP: Understanding and Mitigating Privacy Memorization in Language Models#1116624
• Privacy-Preserving RAG by Concealing Sensitive Information from External LLMs#973310
• RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution#1110482