Extractable Memorization from First Principles

Recent studies on large language models (LLMs) frequently make broad claims regarding privacy harms and copyright infringement based on supposedly "extracted" training data. However, many of these extraction procedures are imprecise because they fail to distinguish between true memorization and the model's general predictive capabilities. We establish a formal framework for extractable memorization from first principles. We demonstrate that all valid extraction procedures must be grounded in a conformal test that calibrates memorization claims by comparing the generation probabilities of candidate training sequences against matched non-member controls. By establishing a calibrated threshold that controls the false-positive rate, our framework reveals why some existing extraction claims are statistically invalid, particularly for short sequences where verbatim generation of non-training data is common. This rigorous definition is essential for accurately evaluating and communicating the legal and privacy risks of LLMs.