Legal asks you to reduce verbatim memorization of copyrighted text in the next pretraining run, without wrecking benchmark quality. Design the data side plan and specify the evidence you would collect to demonstrate, before and after, that it worked.
Layer near-duplicate and exact substring dedup, cap repeats per source, then prove the result with planted canaries, extraction attacks, and unchanged benchmark scores.
Imagine teaching a student from a giant pile of books. If the same paragraph appears in 50 of those books, the student will memorize that paragraph word for word, even without trying. If it appears once, the student learns the idea but not the exact wording. The fix is to clean the pile before teaching: throw out near-copies, keep only one version of repeated passages, and watch out for the textbooks and lyric sheets that tend to repeat themselves. To prove it worked, you sneak a handful of unique sentences into the pile at known repetition counts, and afterwards you ask the student to recite them. The more times you planted a sentence, the more likely the student is to recite it back. That is your measurement instrument.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Legal's ask is a real engineering problem, not a slogan. Verbatim memorization of copyrighted text is a measurable property of a trained model, and it has a measurable causal driver: how many times the text appeared in the pretraining corpus. The plan exploits that causal link with deduplication, and demonstrates the result with a controlled probe.
This deep dive covers the lever, the layered dedup stack, the failure mode of over-rotation, and the evidence package that turns a dedup change into a defensible legal deliverable. The takeaway is operational: zero memorization is the wrong target and an unachievable one; a sharp reduction at high duplication counts, with held quality on the standard suite, is what the work is actually doing.
Why duplication is the lever
Extraction probability is monotone in duplication count. Carlini and collaborators demonstrated, across multiple model families and scales, that the rate at which a model can verbatim reproduce a training sequence climbs sharply with how often that sequence appeared in training. A passage seen once is rarely extractable. A passage seen sixty times is often extractable.
The mechanism is straightforward. Stochastic gradient descent applies a small update each time a sequence is presented. Repetition compounds the update into the weights that produce that exact continuation. Other learning signals partially overwrite the trace, but at high repetition counts the signal to overwrite ratio is heavily in favour of retention.
This is what makes dedup the principal lever. Filtering does not change the model architecture or the training algorithm; it changes the empirical duplication distribution that drives the memorization rate. Cap the duplication distribution and you cap the extraction rate.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- The Pile and RedPajama documentation reports include explicit MinHash dedup stages and document repetition caps as part of the recipe.
- Carlini et al.'s extraction work established the duplication to extraction relationship that this plan operationalizes.
What an interviewer would ask next. Try answering before peeking at the approach.
QYour canary curve shows extraction at duplication count 4 has dropped but at duplication count 256 is unchanged. What does that tell you?
Dedup is working in the moderate-repetition band but missing the long tail. Either the substring cutoff is too long to catch the heavy repeats, or one source is bypassing the per-source cap. Audit the corpus by source and recount.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Treating dedup as a single threshold dial and over-rotating to zero memorization at the cost of benchmark quality, or skipping the planted-canary probe and relying on vibes.
60 second bullets to scan on the way to the call.
Why does duplication count drive verbatim memorization?
How do near-duplicate and exact substring dedup differ in what they catch?
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.