Divergent Repetitions Training Data Extraction Attack

What is Divergent Repetitions Training Data Extraction Attack?

A divergent repetitions training-data extraction attack coaxes an LLM into emitting long, repetitive, or slightly varied sequences that can reveal memorized training samples or other sensitive strings the model should not reproduce verbatim.

What this looks like in production

Attackers ask the model to repeat a token forever or continue a high-entropy prefix until private emails, code, or PII fragments appear. The failure mode is memorization leakage.

What teams usually do about it

• Cap output length and detect pathological repetition loops.
• Probe for verbatim regurgitation in red-team suites.
• Keep secrets out of fine-tunes when possible.

Related Giskard articles

• OWASP Top 10 for LLM 2025
• Cross Session Leak

Test extraction loops with Giskard

Use Giskard disclosure and unbounded-consumption style probes to catch repetition-driven extraction. See adversarial attack coverage.

Further reading

Authority reference: OWASP LLM02 Sensitive Information Disclosure.