Localizing and Mitigating Memorization in Image Autoregressive Models

• URL: http://arxiv.org/abs/2509.00488v1
• Date: Sat, 30 Aug 2025 13:04:36 GMT
• Title: Localizing and Mitigating Memorization in Image Autoregressive Models
• Abstract summary: Image AutoRegressive (IAR) models have achieved state-of-the-art performance in speed and quality of generated images.<n>However, they also raise concerns about memorization of their training data and its implications for privacy.<n>This work explores where and how such memorization occurs within different image autoregressive architectures by measuring a fine-grained memorization.
• Score: 25.67535929806252
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Image AutoRegressive (IAR) models have achieved state-of-the-art performance in speed and quality of generated images. However, they also raise concerns about memorization of their training data and its implications for privacy. This work explores where and how such memorization occurs within different image autoregressive architectures by measuring a fine-grained memorization. The analysis reveals that memorization patterns differ across various architectures of IARs. In hierarchical per-resolution architectures, it tends to emerge early and deepen with resolutions, while in IARs with standard autoregressive per token prediction, it concentrates in later processing stages. These localization of memorization patterns are further connected to IARs' ability to memorize and leak training data. By intervening on their most memorizing components, we significantly reduce the capacity for data extraction from IARs with minimal impact on the quality of generated images. These findings offer new insights into the internal behavior of image generative models and point toward practical strategies for mitigating privacy risks.

Related papers

• You Don't Need All That Attention: Surgical Memorization Mitigation in Text-to-Image Diffusion Models [8.429432661292964]
  Generative models have been shown to "memorize" certain training data, leading to verbatim or near-verbatim generating images.<n>We introduce Guidance Using Attractive-Repulsive Dynamics (GUARD), a novel framework for memorization mitigation in text-to-image diffusion models.<n>GUARD adjusts the image denoising process to guide the generation away from an original training image and towards one that is distinct from training data.
  arXiv  Detail & Related papers  (2026-02-23T17:20:40Z)
• Understand Before You Generate: Self-Guided Training for Autoregressive Image Generation [110.03631978640298]
  We present the first systematic investigation into the mechanisms of applying the next-token prediction paradigm to the visual domain.<n>We identify three key properties that hinder the learning of high-level visual semantics.<n>We show that these issues can be effectively addressed by introducing self-supervised objectives during training.
  arXiv  Detail & Related papers  (2025-09-18T17:47:40Z)
• Finding Dori: Memorization in Text-to-Image Diffusion Models Is Not Local [55.33447817350623]
  Recent mitigation efforts have focused on identifying and pruning weights responsible for triggering verbatim training data replication.<n>We challenge this assumption and demonstrate that, even after such pruning, small perturbations to the text embeddings of previously mitigated prompts can re-trigger data replication.<n>Our findings provide new insights into the nature of memorization in text-to-image DMs and inform the development of more reliable mitigations against DM memorization.
  arXiv  Detail & Related papers  (2025-07-22T15:02:38Z)
• Retrospective Memory for Camouflaged Object Detection [18.604039107883317]
  We propose a recall-augmented COD architecture, namely RetroMem, which dynamically modulates camouflage pattern perception and inference.<n>In the recall stage, we propose a dynamic memory mechanism and an inference pattern reconstruction.<n>Our RetroMem significantly outperforms existing state-of-the-art methods.
  arXiv  Detail & Related papers  (2025-06-18T08:22:19Z)
• Privacy Preserving Properties of Vision Classifiers [3.004632712148892]
  We evaluate the privacy-preserving properties of vision classifiers across diverse architectures.<n>Our analysis highlights how architectural differences, such as input representation, feature extraction mechanisms, and weight structures, influence privacy risks.<n>Our findings provide actionable insights into the design of secure and privacy-aware machine learning systems.
  arXiv  Detail & Related papers  (2025-02-02T11:50:00Z)
• LoyalDiffusion: A Diffusion Model Guarding Against Data Replication [6.818344768093927]
  Diffusion models can replicate training data, particularly when the training data includes confidential information.<n>We propose a replication-aware U-Net architecture that incorporates information transfer blocks into skip connections that are less essential for image quality.<n>Experiments demonstrate that LoyalDiffusion outperforms the state-of-the-art replication mitigation method achieving a 48.63% reduction in replication while maintaining comparable image quality.
  arXiv  Detail & Related papers  (2024-12-02T04:41:30Z)
• Exploring Local Memorization in Diffusion Models via Bright Ending Attention [62.979954692036685]
  "bright ending" (BE) anomaly in text-to-image diffusion models prone to memorizing training images.<n>We propose a simple yet effective method to integrate BE into existing frameworks.
  arXiv  Detail & Related papers  (2024-10-29T02:16:01Z)
• Embedding Space Selection for Detecting Memorization and Fingerprinting in Generative Models [45.83830252441126]
  Generative Adversarial Networks (GANs) and Diffusion Models have become cornerstone technologies, driving innovation in diverse fields from art creation to healthcare. Despite their potential, these models face the significant challenge of data memorization, which poses risks to privacy and the integrity of generated content. We study memorization scores calculated from encoder layer embeddings, which involves measuring distances between samples in the embedding spaces.
  arXiv  Detail & Related papers  (2024-07-30T19:52:49Z)
• Unveiling and Mitigating Memorization in Text-to-image Diffusion Models through Cross Attention [62.671435607043875]
  Research indicates that text-to-image diffusion models replicate images from their training data, raising tremendous concerns about potential copyright infringement and privacy risks.<n>We reveal that during memorization, the cross-attention tends to focus disproportionately on the embeddings of specific tokens.<n>We introduce an innovative approach to detect and mitigate memorization in diffusion models.
  arXiv  Detail & Related papers  (2024-03-17T01:27:00Z)
• CoSeR: Bridging Image and Language for Cognitive Super-Resolution [74.24752388179992]
  We introduce the Cognitive Super-Resolution (CoSeR) framework, empowering SR models with the capacity to comprehend low-resolution images. We achieve this by marrying image appearance and language understanding to generate a cognitive embedding. To further improve image fidelity, we propose a novel condition injection scheme called "All-in-Attention"
  arXiv  Detail & Related papers  (2023-11-27T16:33:29Z)
• Improving Image Recognition by Retrieving from Web-Scale Image-Text Data [68.63453336523318]
  We introduce an attention-based memory module, which learns the importance of each retrieved example from the memory. Compared to existing approaches, our method removes the influence of the irrelevant retrieved examples, and retains those that are beneficial to the input query. We show that it achieves state-of-the-art accuracies in ImageNet-LT, Places-LT and Webvision datasets.
  arXiv  Detail & Related papers  (2023-04-11T12:12:05Z)
• More Is Better: An Analysis of Instance Quantity/Quality Trade-off in Rehearsal-based Continual Learning [3.9596068699962315]
  Continual Learning has become that of addressing the stability-plasticity dilemma of connectionist systems. We propose an analysis of the memory quantity/quality trade-off adopting various data reduction approaches to increase the number of instances storable in memory. Our findings suggest that the optimal trade-off is severely skewed toward instance quantity, where rehearsal approaches with several heavily compressed instances easily outperform state-of-the-art approaches.
  arXiv  Detail & Related papers  (2021-05-28T21:05:51Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.