Hubble: a Model Suite to Advance the Study of LLM Memorization
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
We present Hubble, a suite of fully open-source large language models (LLMs) for the scientific study of LLM memorization. Hubble models come in standard and perturbed variants: standard models are pretrained on a large English corpus, and perturbed models are trained in the same way but with controlled insertion of text (e.g., book passages, biographies, and test sets) designed to emulate key memorization risks. Our core release includes 8 models -- standard and perturbed models with 1B or 8B parameters, pretrained on 100B or 500B tokens -- establishing that memorization risks are determined by the frequency of sensitive data relative to size of the training corpus (i.e., a password appearing once in a smaller corpus is memorized better than the same password in a larger corpus). Our release also includes 6 perturbed models with text inserted at different pretraining phases, showing that sensitive data without continued exposure can be forgotten. These findings suggest two best practices for addressing memorization risks: to dilute sensitive data by increasing the size of the training corpus, and to order sensitive data to appear earlier in training. Beyond these general empirical findings, Hubble enables a broad range of memorization research; for example, analyzing the biographies reveals how readily different types of private information are memorized. We also demonstrate that the randomized insertions in Hubble make it an ideal testbed for membership inference and machine unlearning, and invite the community to further explore, benchmark, and build upon our work.
Key facts. Cited by 17 papers in the map (data through 14 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. First posted on arXiv 22 Oct 2025.
Builds on
0 of 0 references.
No references here yet.
Built on by
Citing papers per year: 2025: 1; 2026: 16.
17 papers.
Sort:
By area:
- 2026Extracting books from production language modelscited by 17
- 2026Why Larger Models Learn More: Effects of Capacity, Interference, and Rare-Task Retentioncited by 10
- 2025Gaperon: A Peppered English-French Generative Language Model Suitecited by 9
- 2026Alignment Whack-a-Mole : Finetuning Activates Verbatim Recall of Copyrighted Books in Large Language Modelscited by 6
- 2026(How) Learning Rates Regulate Catastrophic Overtrainingcited by 6
- 2026Fractional Rotation, Full Potential? Investigating Performance and Convergence of Partial RoPEcited by 4
- 2026Position: Don't Just "Fix it in Post": A Science of AI Must Study Training Dynamicscited by 3
- 2026Quantifying the Effect of Test Set Contamination on Generative Evaluationscited by 2
- 2026Memorization Dynamics in Knowledge Distillation for Language Modelscited by 2
- 2026Scaling Participation in Modular AI Systemscited by 2
- 2026Temporal Leakage in LLM Backtesting: Measurement, Validation, and Adjusted Scorescited by 2
- 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilitiescited by 1
5 more
- 2026Protecting patient privacy in clinical foundation models: Technical and legal perspectivescited by 1
- 2026SHRED: Retain-Set-Free Unlearning via Self-Distillation with Logit Demotioncited by 0
- 2026Correcting test set contamination by spiking the training datacited by 0
- 2026Clinically Grounded Privacy Evaluation of Medical LMscited by 0
- 2026How Learning Governs Unlearning across the Memorization-Generalization Spectrumcited by 0
- 2026How Learning Governs Unlearning across the Memorization-Generalization Spectrum6 Oct 2026
- 2026Protecting patient privacy in clinical foundation models: Technical and legal perspectives7 Aug 2026
- 2026Temporal Leakage in LLM Backtesting: Measurement, Validation, and Adjusted Scores4 Aug 2026
- 2026Clinically Grounded Privacy Evaluation of Medical LMs8 Jun 2026
- 2026Scaling Participation in Modular AI Systems5 Jun 2026
- 2026Position: Don't Just "Fix it in Post": A Science of AI Must Study Training Dynamics3 Jun 2026
- 2026Why Larger Models Learn More: Effects of Capacity, Interference, and Rare-Task Retention28 May 2026
- 2026Correcting test set contamination by spiking the training data24 May 2026
- 2026SHRED: Retain-Set-Free Unlearning via Self-Distillation with Logit Demotion8 May 2026
- 2026(How) Learning Rates Regulate Catastrophic Overtraining15 Apr 2026
- 2026Alignment Whack-a-Mole : Finetuning Activates Verbatim Recall of Copyrighted Books in Large Language Models21 Mar 2026
- 2026Fractional Rotation, Full Potential? Investigating Performance and Convergence of Partial RoPE12 Mar 2026
5 more
- 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilities29 Jan 2026
- 2026Memorization Dynamics in Knowledge Distillation for Language Models21 Jan 2026
- 2026Quantifying the Effect of Test Set Contamination on Generative Evaluations7 Jan 2026
- 2026Extracting books from production language models6 Jan 2026
- 2025Gaperon: A Peppered English-French Generative Language Model Suite29 Oct 2025
- 2026Extracting books from production language modelscited by 17
- 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilitiescited by 1
- 2026SHRED: Retain-Set-Free Unlearning via Self-Distillation with Logit Demotioncited by 0
- 2026How Learning Governs Unlearning across the Memorization-Generalization Spectrumcited by 0
- 2026How Learning Governs Unlearning across the Memorization-Generalization Spectrum6 Oct 2026
- 2026SHRED: Retain-Set-Free Unlearning via Self-Distillation with Logit Demotion8 May 2026
- 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilities29 Jan 2026
- 2026Extracting books from production language models6 Jan 2026
- 2026Why Larger Models Learn More: Effects of Capacity, Interference, and Rare-Task Retentioncited by 10
- 2025Gaperon: A Peppered English-French Generative Language Model Suitecited by 9
- 2026(How) Learning Rates Regulate Catastrophic Overtrainingcited by 6
- 2026Fractional Rotation, Full Potential? Investigating Performance and Convergence of Partial RoPEcited by 4
- 2026Position: Don't Just "Fix it in Post": A Science of AI Must Study Training Dynamicscited by 3
- 2026Quantifying the Effect of Test Set Contamination on Generative Evaluationscited by 2
- 2026Scaling Participation in Modular AI Systemscited by 2
- 2026Temporal Leakage in LLM Backtesting: Measurement, Validation, and Adjusted Scorescited by 2
- 2026Protecting patient privacy in clinical foundation models: Technical and legal perspectivescited by 1
- 2026Correcting test set contamination by spiking the training datacited by 0
- 2026Clinically Grounded Privacy Evaluation of Medical LMscited by 0
- 2026Protecting patient privacy in clinical foundation models: Technical and legal perspectives7 Aug 2026
- 2026Temporal Leakage in LLM Backtesting: Measurement, Validation, and Adjusted Scores4 Aug 2026
- 2026Clinically Grounded Privacy Evaluation of Medical LMs8 Jun 2026
- 2026Scaling Participation in Modular AI Systems5 Jun 2026
- 2026Position: Don't Just "Fix it in Post": A Science of AI Must Study Training Dynamics3 Jun 2026
- 2026Why Larger Models Learn More: Effects of Capacity, Interference, and Rare-Task Retention28 May 2026
- 2026Correcting test set contamination by spiking the training data24 May 2026
- 2026(How) Learning Rates Regulate Catastrophic Overtraining15 Apr 2026
- 2026Fractional Rotation, Full Potential? Investigating Performance and Convergence of Partial RoPE12 Mar 2026
- 2026Quantifying the Effect of Test Set Contamination on Generative Evaluations7 Jan 2026
- 2025Gaperon: A Peppered English-French Generative Language Model Suite29 Oct 2025
Similar, not cited
Close in wording, no citation either way
- 2025The Landscape of Memorization in LLMs: Mechanisms, Measurement, and Mitigation
- 2024Undesirable Memorization in Large Language Models: A Survey
- 2023SoK: Memorization in General-Purpose Large Language Models
- 2024Rethinking LLM Memorization through the Lens of Adversarial Compression
- 2024Demystifying Verbatim Memorization in Large Language Models
- 2025Analyzing Memorization in Large Language Models through the Lens of Model Attribution
- 2025Memorization in Fine-Tuned Large Language Models
- 2025PerProb: Indirectly Evaluating Memorization in Large Language Models ↗