There is a comforting story about how AI models handle the enormous quantities of text and images they are trained on: they do not store any of it, they merely learn general patterns, and once training is done the original data is gone in any meaningful sense. It is a reassuring account, and it is not quite true. Large models memorise fragments of their training data — verbatim, recoverable fragments — and a decade of research has produced reliable ways to detect and extract them.
The answer-first version: if your data was in a model’s training set, the model may have memorised identifiable pieces of it, and those pieces can leak. Two families of attack make this concrete. Membership inference works out whether a specific record was in the training data at all. Data extraction pulls memorised content back out word-for-word. Neither is exotic; both are well documented against production systems. This is the mechanism underneath both the newspaper lawsuits alleging near-verbatim reproduction of their articles and the quieter privacy research showing that models leak the people in their training sets. Understanding it is the difference between trusting the comforting story and knowing its limits.
