Technical Summary: Detecting Functional Memorization in Code Language Models

Problem Statement

Large Language Models (LLMs) trained on code corpora are increasingly used for code generation. Prior research has extensively investigated "training data extraction," where models reproduce training examples verbatim or near-verbatim. However, existing auditing methods rely almost exclusively on textual similarity metrics (e.g., BLEU, edit distance). This approach fails to capture a critical risk: functional memorization.

Code can be functionally equivalent while being textually dissimilar. Variables may be renamed, control flow restructured, comments added or removed, or entirely different algorithms employed to achieve the same logic. If an LLM internalizes proprietary functional logic (e.g., trading algorithms, recommendation rules) from its training data and reproduces it in a restructured form, standard text-based metrics will fail to detect the leakage. This paper addresses the gap in detecting and quantifying this "functional memorization" beyond surface-level token overlap.

Methodology

The authors propose a counterfactual setup to distinguish memorization from generalization, leveraging the training transparency of the open-source Olmo-3-32B model.

1. Experimental Setup

• Target Model ($M_T$): The midtrained checkpoint of Olmo-3-32B, which has been exposed to the target code (CraneCode, a filtered subset of the-stack-v2-smol).
• Reference Model ($M_R$): The pretrained checkpoint of Olmo-3-32B, which shares the same architecture and pretraining but has not been exposed to the specific midtraining data.
• Data: 7,422 Python functions from the CraneCode corpus, filtered to contain "meaningful functional logic" (business rules, proprietary algorithms) using an LLM-as-a-judge.
• Procedure: Both models are prompted with function signatures and up to 250 preceding tokens. The models generate continuations using greedy decoding. The generated output ($x^*$) is compared against the ground truth training data ($x$).

2. Definition of Counterfactual Functional Memorization

A sample is defined as counterfactually functionally memorized if:

1. Low Textual Overlap: The target generation has low textual similarity to the ground truth ($SIM_{text} < \tau_{text}$).
2. High Functional Overlap: The target generation is functionally equivalent to the ground truth ($SIM_{func} \ge \tau_{func}$).
3. Counterfactual Divergence: The reference model (unexposed) does not produce a functionally equivalent output for the same prompt.

3. Evaluation Metrics

The study employs a comprehensive suite of metrics to measure similarity, categorized as follows:

• Textual Metrics: Exact match, BLEU, Edit similarity, and Longest Common Substring (LCS).
• Structural Metrics: CodeBLEU (syntax and data-flow variants) and Tree-Edit Distance (TSED).
• LLM-as-a-Judge: Three distinct prompts (Song et al., Nikiema et al., and a custom functional equivalence prompt) to assess semantic similarity.
• Execution-Based: HyClone, a two-stage detector that generates test inputs, executes both functions, and compares outputs to verify functional equivalence.

Key Contributions

1. Formalization of Functional Memorization: The paper defines and operationalizes the concept of extracting functional logic from LLMs without verbatim copying, distinguishing it from generalization.
2. Counterfactual Framework for Code: It adapts the counterfactual memorization framework (previously used for natural language) to code, utilizing the specific training transparency of Olmo-3 to create a rigorous "exposed vs. unexposed" comparison.
3. Comprehensive Metric Suite: The work evaluates a broad spectrum of similarity metrics, demonstrating that text-based metrics are insufficient for detecting functional leakage.
4. Empirical Evidence: It provides the first large-scale evidence that code LLMs exhibit functional memorization at a significant rate, even when textual overlap is low.

Results

The study analyzes 7,422 functions and finds systematic shifts in similarity from the reference to the target model across all metrics.

• Verbatim Memorization: Consistent with prior work, the target model produces exact matches (0.11%) and near-verbatim matches (BLEU $\ge$ 0.75, 0.58%) that the reference model does not.
• Functional Memorization:
  • Structural Metrics: CodeBLEU (DFG) and TSED identified 1.8% and 2.1% of samples as counterfactually memorized, respectively, despite low BLEU scores.
  • LLM-as-a-Judge: Using the authors' conservative functional equivalence prompt, 3.9% of samples were identified as functionally memorized (low BLEU, high functional similarity, and counterfactual divergence). Other prompts yielded higher rates (up to 14.0%), suggesting sensitivity to prompt design.
  • Execution-Based: Under the most stringent HyClone testing, 0.28% of generations were verified as functionally identical to training data while the reference model failed to do so. This is considered a lower bound due to execution challenges (e.g., missing dependencies, class state).
• Metric Correlation: Textual metrics (BLEU, Edit) are highly correlated with each other but weakly correlated with execution-based metrics (HyClone), confirming they capture distinct signals.

Example: The paper highlights a case where the target model reproduced hard-coded commission logic from training data using a restructured implementation (different variable names and control flow), while the reference model hallucinated unrelated logic. Textual metrics (BLEU = 0.26) failed to flag this, while functional metrics (LLM-judge = 0.8, Execution = 0.95) succeeded.

Significance and Claims

The paper claims that current auditing regimes relying solely on textual overlap are insufficient for code models. The results demonstrate that functional memorization occurs at a similar order of magnitude to near-verbatim memorization when measured by appropriate functional metrics.

The authors assert that:

• Models can internalize and reproduce proprietary logic even when the surface form is significantly altered.
• Existing privacy and IP protections based on text similarity are likely underestimating the risk of training data leakage.
• There is an urgent need for auditing metrics that go beyond textual overlap, incorporating structural analysis, LLM-based semantic judgment, and execution-based verification.

The work concludes by motivating the development of more robust auditing regimes and improved measurement techniques for functional similarity, noting that current execution-based methods are still limited by the complexity of real-world code environments.