Retrieval context does not uniformly erase an LLM's ability to reproduce memorized training data. The study fixes known prefix-and-suffix pairs from training examples and measures the probability of the suffix under an empty prompt versus prompts containing relevant or irrelevant retrieved documents. Across three open-weight instruction-tuned models, some…
Inspect the ClaimsCase · DiggingBeagle record
Retrieved context changes which memorized continuations become extractable
Retrieval context changes, rather than uniformly suppresses, the measured likelihood of known training-text continuations. Three open-weight models showed both robust memorization and marginal examples newly extractable with context. The experiment measured probabilities, not production privacy breaches.
Scope
Controlled finding or reported disclosure as of 2026-10-08; Controlled open-weight models; no demonstrated production personal-data breach.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
Desk review of scoped canonical Claims, the pinned SRC-2026-CP3-RAG-CONTEXT-MEMORIZATION Source, and the publicly accessible primary disclosure. The classification applies to the documented setting and prerequisites only. Impact remains unbanded because real victim consequences are not established, and no independent reproduction is claimed. Details: Generated-output disclosure rates and real personal-data exposure were not measured.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP3-RAG-CONTEXT-MEMORIZATION-1 · CLM-CP3-RAG-CONTEXT-MEMORIZATION-2 · CLM-CP3-RAG-CONTEXT-MEMORIZATION-3 · RAG context can surface memorized training continuations hidden in ordinary testing
At a glance
Compare memorization risk with and without realistic retrieval contexts. A lower aggregate extraction score should not hide newly extractable boundary cases or be described as a blanket privacy guarantee.
Read the implicationsGenerated-output disclosure rates and real personal-data exposure were not measured. Results may differ with model training data, retrieval policies, sampling and private RAG deployments.
Limits and uncertaintyFull account
Retrieval context does not uniformly erase an LLM's ability to reproduce memorized training data. The study fixes known prefix-and-suffix pairs from training examples and measures the probability of the suffix under an empty prompt versus prompts containing relevant or irrelevant retrieved documents. Across three open-weight instruction-tuned models, some highly extractable samples remain stable with added context, while marginal samples near the chosen extraction threshold can move in either direction.
This paired experimental design distinguishes a context-robust core from a context-sensitive boundary: adding documents can suppress some measured continuation likelihoods while making others newly detectable. It is not a study of sensitive files actually emitted from a production RAG assistant, nor does it prove that retrieval caused a real personal-data disclosure. The precise finding is that prefix-only memorization tests can miss context-dependent extraction risk.
Mechanism and trust boundary
- 01
Memorized sequence
A model has a target continuation associated with a training-text prefix.
Boundary: A model has a target continuation associated with a training-text prefix.
- 02
Retrieved context
The same prefix is evaluated with task-specific retrieved material varying in relevance.
Boundary: The same prefix is evaluated with task-specific retrieved material varying in relevance.
- 03
Extraction measurement
The model's probability assigned to the known continuation shifts, revealing both persistent and context-enabled threshold crossings.
Boundary: The model's probability assigned to the known continuation shifts, revealing both persistent and context-enabled threshold crossings.
Timeline
- Oct 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-CP3-RAG-CONTEXT-MEMORIZATION-1The study finds both context-robust and context-sensitive memorization when evaluating fixed prefix-suffix pairs with retrieved material.supported
Basis: reported finding
- supportsRAG context can surface memorized training continuations hidden in ordinary testingprimary disclosure
Abstract, paired item-level probabilistic suffix extraction
CLM-CP3-RAG-CONTEXT-MEMORIZATION-2Retrieved contexts in the experiment suppressed some marginal extraction cases but also enabled new extractable continuations relative to prefix-only tests.supported
Basis: reported finding
- supportsRAG context can surface memorized training continuations hidden in ordinary testingprimary disclosure
Abstract, context-sensitive boundary findings
CLM-CP3-RAG-CONTEXT-MEMORIZATION-3The experiments score fixed training-text continuations probabilistically across three open-weight instruction-tuned models, so extractability in the paper does not itself establish emitted production leakage.supported
Basis: reported finding
- supportsRAG context can surface memorized training continuations hidden in ordinary testingprimary disclosure
Abstract, paired prefix-suffix scoring method
Implications
Compare memorization risk with and without realistic retrieval contexts. A lower aggregate extraction score should not hide newly extractable boundary cases or be described as a blanket privacy guarantee.
Controls and mitigations
- Test memorization under representative retrieved context, not just isolated training-text prefixes.
- Report continuation likelihood and actual emitted disclosure separately.
- Restrict sensitive source exposure and output authorization instead of assuming retrieval automatically suppresses training memorization.
Unknowns and contradictions
- Generated-output disclosure rates and real personal-data exposure were not measured.
- Results may differ with model training data, retrieval policies, sampling and private RAG deployments.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 137