Two known results, combined
Two things about transformers have been established separately. Theoretical work treats attention heads as a form of associative memory. Empirical work on pruning shows that a large share of heads can be removed with little loss in language modelling performance.
A paper posted to arXiv on 29 October by Aryan Chowdhury and Riza Batista-Navarro puts the two together and asks the obvious question: if heads store associations, and most heads are redundant, does removing the redundant ones remove stored training text?
The numbers
The experiment runs on GPT-2-XL, a 1.5-billion-parameter model, evaluated on sequences known to be memorised. The authors zero out 729 attention heads identified as task-redundant, at inference time, before the model generates anything.
Memorisation count fell by 91.5%.
The second number is what stops this being a trivial result. Perplexity on WikiText-103 did not degrade — it improved by 0.92. Suppressing nine tenths of the verbatim output cost nothing measurable in language modelling quality on the benchmark used to identify the redundant heads in the first place.
That last clause is the caveat the authors are explicit about: the heads were selected as redundant on a benchmark, and the quality was then measured on the same benchmark. A head that is redundant for WikiText-103 is not necessarily redundant for code, for translation, or for long-context retrieval.
Why it matters beyond the architecture
The operational appeal is that it is cheap. There is no retraining, no dataset filtering, no machine unlearning procedure and no change to the weights that remain — just a mask applied at inference. Every other approach to the memorisation problem is expensive: retraining a model to forget something costs what training cost, and curating a corpus has to happen before the model exists.
That matters because memorisation is now a legal exposure, not only a research curiosity. Litigation over model output has repeatedly turned on whether a system reproduces training text verbatim. A technique that suppresses most of that behaviour at serving time, without touching the model’s general quality, would be worth a great deal to a defendant — which is also a reason to want it tested by somebody with no stake in the answer.
The limits are large
This is a seven-page paper with five tables, one figure and one model. GPT-2-XL is seven years old and three orders of magnitude smaller than current frontier systems, and nothing here shows the effect survives at scale, or on a model trained with modern deduplication already applied. The memorisation metric is a count on known-memorised sequences rather than an adversarial extraction attack.
The test that would settle it is straightforward and someone will run it: the same head-pruning procedure on an open-weight model from this year, with extraction attempted rather than counted, and quality measured on benchmarks other than the one used to pick the heads.
