Discussion Memorization analysis provides a systematic study which can inform the potential privacy risks in
downstream uses. Importantly, we ﬁnd signiﬁcant reductions in verbatim memorization on average as compared to
PaLM, and in particular for data repeated fewer than three times in the pre-training data. We note that these memorization
rates are an estimate and do not provide a full characterization of what could be recovered by a successful adversary with
access to PaLM 2. For attacks through downstream uses, the threat proﬁle will be different since downstream developers
can use additional procedural and technical safeguards against extraction attacks. And for speciﬁc attack targets, real
adversaries may also be able to exploit additional context like side-channel information. Future work could extend
memorization evaluations to measure potential privacy harms and attacks within uses like dialog or summarization.

5 Responsible usage
PaLM 2 Technical Report