Elamur Research⌕
☰
home / papers / 2026 / Exploring Cross-Client Memorization of Training Data in Large Language Models for Federated Learning

Exploring Cross-Client Memorization of Training Data in Large Language Models for Federated Learning

Paper · 2026 · Tinnakit Udsa, Can Udomcharoenchaikit, Patomporn Payoungkhamdee et al.

Summary

Privacy audits of federated learning (FL) usually rely on canary injection, which tests one sample at a time and checks whether a planted string reappears. That approach misses subtler leakage, where a prompt from one client brings out text belonging to another client's training data. The authors adapt cross-sample memorization measurement, previously developed for centralized learning (CL), into a pairwise framework that estimates memorization between every pair of clients. For each client pair, they:

  • sample prefixes from one client and use them to prompt the global model;
  • retrieve the closest suffixes from the other client via Elasticsearch;
  • judge similarity with the PAN2014 plagiarism detector at verbatim, paraphrase and idea levels.

Experiments use Qwen2.5-3B (plus Llama3.2 and GPT2) on four tasks: summarization, dialog, QA and classification. Each task has three domain-specific clients. FL models clearly memorize client data. Leakage within a client is consistently larger than leakage across clients. Memorization depends on decoding strategy, prefix length and the FL algorithm. Contrary to some earlier claims, FL shows no clear reduction in memorization compared with CL. This means federated training alone should not be assumed to protect privacy.

Key points

  • Metrics and default setup: The framework defines a pairwise ratio MR j→k, aggregated into MR Intra and MR Inter.
    • Each estimate uses 4K sampled prefixes/suffixes and the top-10 retrieved candidates.
    • Default setup: Qwen2.5-3B, prefix length 30, top-k decoding, 3 FedAvg rounds.
  • Intra- vs inter-client results (MR Intra / MR Inter, FedAvg):
    • Summarization: 0.342% / 0.046%
    • Dialog: 1.533% / 1.446%
    • QA: 1.450% / 0.813%
    • Classification: 0% / 0%. Its very short outputs fall below the PAN2014 detection threshold.
  • FL algorithm: FedProx raises memorization compared with FedAvg (e.g., QA intra 3.675% vs 1.450%). It even produces slight memorization on classification.
  • Decoding and prefix length: Top-k/top-p decoding increases memorization, while longer prefixes generally reduce it (QA inter drops from 1.383% at length 10 to 0.429% at length 100). No clear trend was found for model size or number of communication rounds.
  • Client effects and limitations: Some clients' suffixes are memorized more than others, such as one dialog dataset. PAN2014 works only for English and is unreliable when model output is incoherent. Code is published on GitHub (FL_memorization_framework).

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Prince of Songkla UniversitySongkhla · Thailand2 works

Also on the byline: Vidyasirimedhi Institute of Science and Technology.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,320 works

Cite

Cite as Tinnakit Udsa, Can Udomcharoenchaikit, Patomporn Payoungkhamdee, Sarana Nutanong and Norrathep Rattanavipanon. 2026. Exploring Cross-Client Memorization of Training Data in Large Language Models for Federated Learning. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-short.56

@inproceedings{udsa2026exploring,
  title = {{Exploring Cross-Client Memorization of Training Data in Large Language Models for Federated Learning}},
  author = {Tinnakit Udsa, Can Udomcharoenchaikit, Patomporn Payoungkhamdee, Sarana Nutanong and Norrathep Rattanavipanon},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-short.56},
  url = {https://doi.org/10.18653/v1/2026.acl-short.56}
}

References

24 references, 7 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Stella Biderman, USVSN Sai Prashanth, Lintang Sutawika, Hailey Schoelkopf, Quentin Anthony, Shivanshu Purohit, and Edward Raff. 2023. Emergent and predictable memorization in large language models. In Proceedings of the 37th International Conference on Neural Information Processing Systems, NIPS ’23… find
  2. Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. 2022. Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Representations. find
  3. Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019. The secret sharer: evaluating and testing unintended memorization in neural networks. In Proceedings of the 28th USENIX Conference on Security Symposium, SEC’19, page 267–284, USA. USENIX Association.
  4. Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21)…
  5. Franck Dernoncourt and Ji Young Lee. 2017. PubMed 200k RCT: a dataset for sequential sentence classification in medical abstracts. In Proceedings of the Eighth International Joint Conference on Natural Language Processing (Volume 2: Short Papers), pages 308–313, Taipei, Taiwan. Asian Federation of N…
  6. Geiger, R. Stuart. 2020. Arxiv archive: A tidy and complete archive of metadata for papers on arxiv.org. find
  7. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, and 542 o… — The Llama 3 Herd of Models
  8. Daphne Ippolito, Florian Tramer, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christopher Choquette Choo, and Nicholas Carlini. 2023. Preventing generation of verbatim memorization in language models gives a false sense of privacy. In Proceedings of the 16th International Natural Lan…
  9. Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William Cohen, and Xinghua Lu. 2019. Pubmedqa: A dataset for biomedical research question answering. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Proce…
  10. Hirokazu Kiyomaru, Issa Sugiura, Daisuke Kawahara, and Sadao Kurohashi. 2024. A comprehensive analysis of memorization in large language models. In Proceedings of the 17th International Natural Language Generation Conference, pages 584–596, Tokyo, Japan. Association for Computational Linguistics. find
  11. Jooyoung Lee, Thai Le, Jinghui Chen, and Dongwon Lee. 2023. Do language models plagiarize? In Proceedings of the ACM Web Conference 2023, WWW ’23, page 3637–3647, New York, NY, USA. Association for Computing Machinery. find
  12. Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. 2020. Federated optimization in heterogeneous networks. Preprint, arXiv:1812.06127. — [arXiv:1812.06127](https://arxiv.org/abs/1812.06127) find
  13. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-Efficient Learning of Deep Networks from Decentralized Data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, volume 54 of Proceedings of Machine Le… find
  14. Jaehoon Oh, SangMook Kim, and Se-Young Yun. 2022. FedBABU: Toward enhanced representation for federated image classification. In International Conference on Learning Representations. find
  15. Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, and 25 others. 2025. Qwen2.5 technical report. Preprint, arXiv:2412.15115. find
  16. Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners. find
  17. Swaroop Ramaswamy, Om Thakkar, Rajiv Mathews, Galen Andrew, H. Brendan McMahan, and Françoise Beaufays. 2020. Training production language models without memorizing user data. Preprint, arXiv:2009.10031. — [arXiv:2009.10031](https://arxiv.org/abs/2009.10031) find
  18. M. A. Sanchez-Perez, A. Gelbukh, and G. Sidorov. 2015. Adaptive algorithm for plagiarism detection: The best-performing approach at pan 2014 text alignment competition. In Lecture Notes in Computer Science, volume 9283, pages 402–413. Springer. find
  19. Miguel Sanchez-Perez, Grigori Sidorov, and Alexander Gelbukh. 2014. The winning approach to text alignment for text reuse detection at pan 2014. In CLEF2014 Working Notes, volume 1180 of CEUR Workshop Proceedings, pages 1004–1011, Sheffield, UK. CEUR-WS.org. Notebook for PAN at CLEF 2014. find
  20. Chen Tang, Hongbo Zhang, Tyler Loakman, Chenghua Lin, and Frank Guerin. 2023. Terminology-aware medical dialogue generation. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5. IEEE. find
  21. Om Dipakbhai Thakkar, Swaroop Ramaswamy, Rajiv Mathews, and Francoise Beaufays. 2021. Understanding unintended memorization in language models under federated learning. In Proceedings of the Third Workshop on Privacy in Natural Language Processing, pages 1–10, Online. Association for Computational L… find
  22. Kushal Tirumala, Aram H. Markosyan, Luke Zettlemoyer, and Armen Aghajanyan. 2022. Memorization without overfitting: analyzing the training dynamics of large language models. In Proceedings of the 36th International Conference on Neural Information Processing Systems, NIPS ’22, Red Hook, NY, USA. Cur…
  23. Shenglai Zeng, Yaxin Li, Jie Ren, Yiding Liu, Han Xu, Pengfei He, Yue Xing, Shuaiqiang Wang, Jiliang Tang, and Dawei Yin. 2024. Exploring memorization in fine-tuned language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pa… find
  24. Jianqing Zhang, Yang Hua, Hao Wang, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. 2023. Fedala: adaptive local aggregation for personalized federated learning. In Proceedings of the Thirty-Seventh AAAI Conference on Artificial Intelligence and Thirty-Fifth Conference on Innovative Applications… find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/udsa-2026-exploring-cross-client-memorization-training/