\section{Discussion}
\label{sec:discussion}

\subsection{Why Do Structural Tokens Leak?}
Structural tokens (bar lines, positions, tempo) encode the \emph{hierarchical lattice} of musical phrasing—the skeleton organizing notes into coherent phrases, measures, and sections.
During training, models implicitly memorize these phrasing patterns, which are tightly correlated with compositional style and piece-specific structure.
At inference, training pieces evoke low-loss predictions at structural transitions (e.g., bar boundaries, tempo changes), while novel structures from non-members induce higher uncertainty. Note tokens, by contrast, are more uniformly distributed and subject to data augmentation (transposition, velocity perturbation), diffusing memorization signals.
This asymmetry explains the stark efficacy gap between structural and note-only attacks.

\subsection{Implications for Copyright Auditing}

\paragraph{Practical Use.}
Rights holders can query suspected models with their works (converted to the model's tokenization) and apply TS-RaMIA.
High scores (e.g., above 95th percentile of a reference non-member corpus) provide statistical evidence of training-set inclusion, supporting copyright claims or licensing negotiations.

\paragraph{Limitations.}
False positives remain (14\% at 1\% FPR threshold); auditing should combine TS-RaMIA with other evidence (e.g., stylistic similarity, timestamp analysis).
API access to per-token probabilities is required; generation-only APIs require sampling-based approximations~\citep{carlini2021extracting}, which increase query cost and variance.


% [Disc-Check]
% - Mechanistic explanation + practical guidance
% - Reframed for copyright auditing
% - Condensed from 45→40 lines
