Can Neural Network Memorization Be Localized?
Not on the map. Why?
Abstract (arXiv)
Recent efforts at explaining the interplay of memorization and generalization in deep overparametrized networks have posited that neural networks textitmemorize "hard" examples in the final few layers of the model. Memorization refers to the ability to correctly predict on textitatypical examples of the training set. In this work, we show that rather than being confined to individual layers, memorization is a phenomenon confined to a small set of neurons in various layers of the model. First, via three experimental sources of converging evidence, we find that most layers are redundant for the memorization of examples and the layers that contribute to example memorization are, in general, not the final layers. The three sources are textitgradient accounting (measuring the contribution to the gradient norms from memorized and clean examples), textitlayer rewinding (replacing specific model weights of a converged model with previous training checkpoints), and textitretraining (training rewound layers only on clean examples). Second, we ask a more generic question: can memorization be localized textitanywhere in a model? We discover that memorization is often confined to a small number of neurons or channels (around 5) of the model. Based on these insights we propose a new form of dropout -- textitexample-tied dropout that enables us to direct the memorization of examples to an apriori determined set of neurons. By dropping out these neurons, we are able to reduce the accuracy on memorized examples from 100%→3%, while also reducing the generalization gap.
Key facts. Cited by 69 papers in the map (data through 14 Oct 2026). Builds on 30 of its 39 references that are in the map. First posted on arXiv 18 Jul 2023.
Builds on
30 of 39 references.
References · 30
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
- 2022Locating and Editing Factual Associations in GPTcited by 2,691
- 2020Extracting Training Data from Large Language Modelscited by 2,189
- 2016Understanding deep learning requires rethinking generalizationcited by 1,674
- 2017A Closer Look at Memorization in Deep Networkscited by 942
- 2018An Empirical Study of Example Forgetting during Deep Neural Network Learningcited by 678
- 2017The Implicit Bias of Gradient Descent on Separable Datacited by 655
- 2015Cyclical Learning Rates for Training Neural Networkscited by 629
- 2019Benign Overfitting in Linear Regressioncited by 549
- 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 497
- 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 460
18 more
- 2020Early-Learning Regularization Prevents Memorization of Noisy Labelscited by 416
- 2016Expert Gate: Lifelong Learning with a Network of Expertscited by 372
- 2020The Pitfalls of Simplicity Bias in Neural Networkscited by 351
- 2020Modifying Memories in Transformer Modelscited by 224
- 2021On the Origin of Implicit Regularization in Stochastic Gradient Descentcited by 184
- 2020Editable Neural Networkscited by 155
- 2021Deep Learning Through the Lens of Example Difficultycited by 141
- 2022Reconstructing Training Data from Trained Neural Networkscited by 133
- 2020The Early Phase of Neural Network Trainingcited by 115
- 2019Are All Layers Created Equal?cited by 94
- 2020Characterizing Structural Regularities of Labeled Data in Overparameterized Modelscited by 93
- 2022Robust Training under Label Noise by Over-parameterizationcited by 93
- 2021On the geometry of generalization and memorization in deep neural networkscited by 73
- 2019Superposition of many models into onecited by 64
- 2019Distribution Density, Tails, and Outliers in Machine Learning: Metrics and Applicationscited by 43
- 2020Coherent Gradients: An Approach to Understanding Generalization in Gradient Descent-based Optimizationcited by 41
- 2022Characterizing Datapoints via Second-Split Forgettingcited by 37
- 2021Understanding Invariance via Feedforward Inversion of Discriminatively Trained Classifierscited by 11
Built on by
Citing papers per year: 2023: 6; 2024: 30; 2025: 20; 2026: 13.
69 papers.
Sort:
By area:
- 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modificationscited by 231
- 2023On Memorization in Diffusion Modelscited by 125
- 2024Demystifying Verbatim Memorization in Large Language Modelscited by 56
- 2023SoK: Memorization in General-Purpose Large Language Modelscited by 37
- 2024Finding NeMo: Localizing Neurons Responsible For Memorization in Diffusion Modelscited by 37
- 2023Do Localization Methods Actually Localize Memorized Data in LLMs? A Tale of Two Benchmarkscited by 29
- 2024Robust Concept Erasure Using Task Vectorscited by 27
- 2024Learnable Privacy Neurons Localization in Language Modelscited by 27
- 2024PII-Compass: Guiding LLM training data extraction prompts towards the target PII via groundingcited by 24
- 2024PreCurious: How Innocent Pre-Trained Language Models Turn into Privacy Trapscited by 23
- 2024When does compositional structure yield compositional generalization? A kernel theorycited by 20
- 2024Causal Estimation of Memorisation Profilescited by 20
38 more
- 2025Uncovering Memorization Effect in the Presence of Spurious Correlationscited by 20
- 2024Decomposing and Editing Predictions by Modeling Model Computationcited by 19
- 2024The Pitfalls of Memorization: When Memorization Hurts Generalizationcited by 19
- 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 18
- 2024Memorization in Self-Supervised Learning Improves Downstream Generalizationcited by 18
- 2024Memorization in deep learning: A surveycited by 15
- 2024Memorized Images in Diffusion Models share a Subspace that can be Located and Deletedcited by 13
- 2024Mitigating Memorization In Language Modelscited by 12
- 2024Towards Natural Machine Unlearningcited by 11
- 2024Generalisation First, Memorisation Second? Memorisation Localisation for Natural Language Classification Taskscited by 9
- 2024Localizing Memorization in SSL Vision Encoderscited by 9
- 2024The Phantom Menace: Unmasking Privacy Leakages in Vision-Language Modelscited by 8
- 2024FLARE: Toward Universal Dataset Purification against Backdoor Attackscited by 7
- 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted datacited by 7
- 2025Memorization Sinks: Isolating Memorization during LLM Trainingcited by 7
- 2023What do larger image classifiers memorise?cited by 6
- 2024CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attackscited by 6
- 2024Improved Localized Machine Unlearning Through the Lens of Memorizationcited by 6
- 2025Trustworthy Machine Learning via Memorization and the Granular Long-Tail: A Survey on Interactions, Tradeoffs, and Beyondcited by 6
- 2024MemControl: Mitigating Memorization in Diffusion Models via Automated Parameter Selectioncited by 4
- 2024Sequence-Level Leakage Risk of Training Data in Large Language Modelscited by 4
- 2025Tensorization is a powerful but underexplored tool for compression and interpretability of neural networkscited by 4
- 2024MUSO: Achieving Exact Machine Unlearning in Over-Parameterized Regimescited by 3
- 2024Detecting Memorization in Large Language Modelscited by 3
- 2024How Do the Architecture and Optimizer Affect Representation Learning? On the Training Dynamics of Representations in Deep Neural Networkscited by 2
- 2024More Experts Than Galaxies: Conditionally-overlapping Experts With Biologically-Inspired Fixed Routingcited by 2
- 2024MemHunter: Automated and Verifiable Memorization Detection at Dataset-scale in LLMscited by 2
- 2025A Lightweight Method to Disrupt Memorized Sequences in LLMcited by 2
- 2025Demystifying Foreground-Background Memorization in Diffusion Modelscited by 2
- 2025From Memorization to Reasoning in the Spectrum of Loss Curvaturecited by 2
- 2026Compressed Sensing for Capability Localization in Large Language Modelscited by 2
- 2026Natively Unlearnable Large Language Modelscited by 2
- 2023SoK: Memorisation in machine learningcited by 1
- 2024SubRegWeigh: Effective and Efficient Annotation Weighing with Subword Regularizationcited by 1
- 2025FairDropout: Using Example-Tied Dropout to Enhance Generalization of Minority Groupscited by 1
- 2025How Does Overparameterization Affect Machine Unlearning of Deep Neural Networks?cited by 1
- 2025Understanding Fact Recall in Language Models: Why Two-Stage Training Encourages Memorization but Mixed Training Teaches Knowledgecited by 1
- 2025Spurious Privacy Leakage in Neural Networkscited by 1
50 most cited of 69 All 69 (JSON)
- 2026Encoding Context into LLM Weights: What Makes It Context?13 Oct 2026
- 2026Don't Forget! Decomposing the Training Dynamics of Memorization in Language Models28 Sep 2026
- 2026SpecDrop: Parameter-Free Category-Conditioned Routing for Modular Specialization4 Aug 2026
- 2026Where Grokking Happens: Distributed Utility and Fourier Recoding Without a Module Switch29 Jul 2026
- 2026Random Label Prediction Heads for Studying Memorization in Deep Neural Networks13 Jul 2026
- 2026Discard the Dross and Select the Essential: Pre-query Sample Selection for Black-box Membership Inference Attacks29 Jun 2026
- 2026Output Vector Editing for Memorization Mitigation in Large Language Models17 Jun 2026
- 2026Natively Unlearnable Large Language Models11 Jun 2026
- 2026Rethinking Federated Unlearning via the Lens of Memorization23 May 2026
- 2026Batch Normalization Amplifies Memorization and Privacy Risks23 May 2026
- 2026Anatomy of a failure: When, how, and why deep vision fails in scientific domains5 May 2026
- 2026Mitigating Membership Inference in Intermediate Representations with Differentially Private Training26 Feb 2026
38 more
- 2026Compressed Sensing for Capability Localization in Large Language Models11 Feb 2026
- 2025Subtract the Corruption: Training-Data-Free Corrective Machine Unlearning using Task Arithmetic24 Nov 2025
- 2025On Measuring Localization of Shortcuts in Deep Networks30 Oct 2025
- 2025From Memorization to Reasoning in the Spectrum of Loss Curvature28 Oct 2025
- 2025Early Detection and Reduction of Memorisation for Domain Adaptation and Instruction Tuning13 Oct 2025
- 2025Localizing and Mitigating Memorization in Image Autoregressive Models30 Aug 2025
- 2025Memorization in Graph Neural Networks26 Aug 2025
- 2025Demystifying Foreground-Background Memorization in Diffusion Models16 Aug 2025
- 2025Memorization Sinks: Isolating Memorization during LLM Training14 Jul 2025
- 2025ReMem: Mutual Information-Aware Fine-tuning of Pretrained Vision Transformers for Effective Knowledge Distillation29 Jun 2025
- 2025One Period to Rule Them All: Identifying Critical Learning Periods in Deep Networks19 Jun 2025
- 2025Tensorization is a powerful but underexplored tool for compression and interpretability of neural networks26 May 2025
- 2025Spurious Privacy Leakage in Neural Networks26 May 2025
- 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted data23 May 2025
- 2025What is the role of memorization in Continual Learning?23 May 2025
- 2025Understanding Fact Recall in Language Models: Why Two-Stage Training Encourages Memorization but Mixed Training Teaches Knowledge22 May 2025
- 2025How Does Overparameterization Affect Machine Unlearning of Deep Neural Networks?11 Mar 2025
- 2025Trustworthy Machine Learning via Memorization and the Granular Long-Tail: A Survey on Interactions, Tradeoffs, and Beyond10 Mar 2025
- 2025FairDropout: Using Example-Tied Dropout to Enhance Generalization of Minority Groups10 Feb 2025
- 2025A Lightweight Method to Disrupt Memorized Sequences in LLM7 Feb 2025
- 2025Uncovering Memorization Effect in the Presence of Spurious Correlations1 Jan 2025
- 2024Sequence-Level Leakage Risk of Training Data in Large Language Models15 Dec 2024
- 2024The Pitfalls of Memorization: When Memorization Hurts Generalization10 Dec 2024
- 2024MemHunter: Automated and Verifiable Memorization Detection at Dataset-scale in LLMs10 Dec 2024
- 2024Improved Localized Machine Unlearning Through the Lens of Memorization3 Dec 2024
- 2024CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attacks2 Dec 2024
- 2024Detecting Memorization in Large Language Models2 Dec 2024
- 2024FLARE: Toward Universal Dataset Purification against Backdoor Attacks29 Nov 2024
- 2024MUSO: Achieving Exact Machine Unlearning in Over-Parameterized Regimes11 Oct 2024
- 2024More Experts Than Galaxies: Conditionally-overlapping Experts With Biologically-Inspired Fixed Routing10 Oct 2024
- 2024Mitigating Memorization In Language Models3 Oct 2024
- 2024Localizing Memorization in SSL Vision Encoders27 Sep 2024
- 2024SubRegWeigh: Effective and Efficient Annotation Weighing with Subword Regularization10 Sep 2024
- 2024Generalisation First, Memorisation Second? Memorisation Localisation for Natural Language Classification Tasks9 Aug 2024
- 2024The Phantom Menace: Unmasking Privacy Leakages in Vision-Language Models2 Aug 2024
- 2024Demystifying Verbatim Memorization in Large Language Models25 Jul 2024
- 2024PII-Compass: Guiding LLM training data extraction prompts towards the target PII via grounding3 Jul 2024
- 2024Causal Estimation of Memorisation Profiles6 Jun 2024
50 newest of 69 All 69 (JSON)
- 2024PreCurious: How Innocent Pre-Trained Language Models Turn into Privacy Trapscited by 23
- 2024Mitigating Memorization In Language Modelscited by 12
- 2024Towards Natural Machine Unlearningcited by 11
- 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted datacited by 7
- 2024Improved Localized Machine Unlearning Through the Lens of Memorizationcited by 6
- 2024MUSO: Achieving Exact Machine Unlearning in Over-Parameterized Regimescited by 3
- 2026Natively Unlearnable Large Language Modelscited by 2
- 2025How Does Overparameterization Affect Machine Unlearning of Deep Neural Networks?cited by 1
- 2026Rethinking Federated Unlearning via the Lens of Memorizationcited by 1
- 2025Subtract the Corruption: Training-Data-Free Corrective Machine Unlearning using Task Arithmeticcited by 0
- 2026Mitigating Membership Inference in Intermediate Representations with Differentially Private Trainingcited by 0
- 2026Discard the Dross and Select the Essential: Pre-query Sample Selection for Black-box Membership Inference Attackscited by 0
- 2026Discard the Dross and Select the Essential: Pre-query Sample Selection for Black-box Membership Inference Attacks29 Jun 2026
- 2026Natively Unlearnable Large Language Models11 Jun 2026
- 2026Rethinking Federated Unlearning via the Lens of Memorization23 May 2026
- 2026Mitigating Membership Inference in Intermediate Representations with Differentially Private Training26 Feb 2026
- 2025Subtract the Corruption: Training-Data-Free Corrective Machine Unlearning using Task Arithmetic24 Nov 2025
- 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted data23 May 2025
- 2025How Does Overparameterization Affect Machine Unlearning of Deep Neural Networks?11 Mar 2025
- 2024Improved Localized Machine Unlearning Through the Lens of Memorization3 Dec 2024
- 2024MUSO: Achieving Exact Machine Unlearning in Over-Parameterized Regimes11 Oct 2024
- 2024Mitigating Memorization In Language Models3 Oct 2024
- 2024Towards Natural Machine Unlearning24 May 2024
- 2024PreCurious: How Innocent Pre-Trained Language Models Turn into Privacy Traps14 Mar 2024
- 2023On Memorization in Diffusion Modelscited by 125
- 2024Finding NeMo: Localizing Neurons Responsible For Memorization in Diffusion Modelscited by 37
- 2024Memorized Images in Diffusion Models share a Subspace that can be Located and Deletedcited by 13
- 2024CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attackscited by 6
- 2024MemControl: Mitigating Memorization in Diffusion Models via Automated Parameter Selectioncited by 4
- 2025Demystifying Foreground-Background Memorization in Diffusion Modelscited by 2
- 2025Demystifying Foreground-Background Memorization in Diffusion Models16 Aug 2025
- 2024CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attacks2 Dec 2024
- 2024Finding NeMo: Localizing Neurons Responsible For Memorization in Diffusion Models4 Jun 2024
- 2024Memorized Images in Diffusion Models share a Subspace that can be Located and Deleted1 Jun 2024
- 2024MemControl: Mitigating Memorization in Diffusion Models via Automated Parameter Selection29 May 2024
- 2023On Memorization in Diffusion Models4 Oct 2023
- 2024Demystifying Verbatim Memorization in Large Language Modelscited by 56
- 2023SoK: Memorization in General-Purpose Large Language Modelscited by 37
- 2023Do Localization Methods Actually Localize Memorized Data in LLMs? A Tale of Two Benchmarkscited by 29
- 2024Robust Concept Erasure Using Task Vectorscited by 27
- 2024Learnable Privacy Neurons Localization in Language Modelscited by 27
- 2024PII-Compass: Guiding LLM training data extraction prompts towards the target PII via groundingcited by 24
- 2024When does compositional structure yield compositional generalization? A kernel theorycited by 20
- 2024Causal Estimation of Memorisation Profilescited by 20
- 2025Uncovering Memorization Effect in the Presence of Spurious Correlationscited by 20
- 2024Decomposing and Editing Predictions by Modeling Model Computationcited by 19
- 2024The Pitfalls of Memorization: When Memorization Hurts Generalizationcited by 19
- 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 18
12 most cited of 44 All 44 (JSON)
- 2026Encoding Context into LLM Weights: What Makes It Context?13 Oct 2026
- 2026Don't Forget! Decomposing the Training Dynamics of Memorization in Language Models28 Sep 2026
- 2026Where Grokking Happens: Distributed Utility and Fourier Recoding Without a Module Switch29 Jul 2026
- 2026Random Label Prediction Heads for Studying Memorization in Deep Neural Networks13 Jul 2026
- 2026Output Vector Editing for Memorization Mitigation in Large Language Models17 Jun 2026
- 2026Batch Normalization Amplifies Memorization and Privacy Risks23 May 2026
- 2026Anatomy of a failure: When, how, and why deep vision fails in scientific domains5 May 2026
- 2025On Measuring Localization of Shortcuts in Deep Networks30 Oct 2025
- 2025Early Detection and Reduction of Memorisation for Domain Adaptation and Instruction Tuning13 Oct 2025
- 2025Localizing and Mitigating Memorization in Image Autoregressive Models30 Aug 2025
- 2025Memorization in Graph Neural Networks26 Aug 2025
- 2025Memorization Sinks: Isolating Memorization during LLM Training14 Jul 2025
12 newest of 44 All 44 (JSON)