Localizing Memorization in SSL Vision Encoders
Not on the map. Why?
Abstract (arXiv)
Recent work on studying memorization in self-supervised learning (SSL) suggests that even though SSL encoders are trained on millions of images, they still memorize individual data points. While effort has been put into characterizing the memorized data and linking encoder memorization to downstream utility, little is known about where the memorization happens inside SSL encoders. To close this gap, we propose two metrics for localizing memorization in SSL encoders on a per-layer (layermem) and per-unit basis (unitmem). Our localization methods are independent of the downstream task, do not require any label information, and can be performed in a forward pass. By localizing memorization in various encoder architectures (convolutional and transformer-based) trained on diverse datasets with contrastive and non-contrastive SSL frameworks, we find that (1) while SSL memorization increases with layer depth, highly memorizing units are distributed across the entire encoder, (2) a significant fraction of units in SSL encoders experiences surprisingly high memorization of individual data points, which is in contrast to models trained under supervision, (3) atypical (or outlier) data points cause much higher layer and unit memorization than standard data points, and (4) in vision transformers, most memorization happens in the fully-connected layers. Finally, we show that localizing memorization in SSL has the potential to improve fine-tuning and to inform pruning strategies.
Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Builds on 41 of its 55 references that are in the map. First posted on arXiv 27 Sep 2024.
Builds on
41 of 55 references.
References · 41
- 2017Attention Is All You Needcited by 60,361
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
- 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 12,049
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
- 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,513
- 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,403
- 2021Emerging Properties in Self-Supervised Vision Transformerscited by 6,968
- 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,750
- 2020Exploring Simple Siamese Representation Learningcited by 2,866
- 2016Deep Learning with Differential Privacycited by 2,728
- 2022Locating and Editing Factual Associations in GPTcited by 2,691
29 more
- 2013Visualizing and Understanding Convolutional Networkscited by 2,290
- 2020Extracting Training Data from Large Language Modelscited by 2,189
- 2016Understanding deep learning requires rethinking generalizationcited by 1,674
- 2020Transformer Feed-Forward Layers Are Key-Value Memoriescited by 1,336
- 2021VICReg: Variance-Invariance-Covariance Regularization for Self-Supervised Learningcited by 1,057
- 2017A Closer Look at Memorization in Deep Networkscited by 942
- 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
- 2023Extracting Training Data from Diffusion Modelscited by 732
- 2017Network Dissection: Quantifying Interpretability of Deep Visual Representationscited by 708
- 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 497
- 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 460
- 2020Modifying Memories in Transformer Modelscited by 224
- 2021Deep Learning Through the Lens of Example Difficultycited by 141
- 2022The Privacy Onion Effect: Memorization is Relativecited by 136
- 2022Chaos is a Ladder: A New Theoretical Understanding of Contrastive Learning via Augmentation Overlapcited by 105
- 2018On the importance of single directions for generalizationcited by 99
- 2021Towards the Generalization of Contrastive Self-Supervised Learningcited by 99
- 2022How Mask Matters: Towards Theoretical Understandings of Masked Autoencoderscited by 86
- 2021On the geometry of generalization and memorization in deep neural networkscited by 73
- 2021EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learningcited by 73
- 2023Can Neural Network Memorization Be Localized?cited by 69
- 2023Explaining black box text modules in natural language with language modelscited by 62
- 2018Revisiting the Importance of Individual Units in CNNs via Ablationcited by 32
- 2023Do Localization Methods Actually Localize Memorized Data in LLMs? A Tale of Two Benchmarkscited by 29
- 2022Contrasting the landscape of contrastive and non-contrastive learningcited by 24
- 2023Do SSL Models Have D'ej`a Vu? A Case of Unintended Memorization in Self-supervised Learningcited by 19
- 2024Memorization in Self-Supervised Learning Improves Downstream Generalizationcited by 18
- 2023ViP: A Differentially Private Foundation Model for Computer Visioncited by 17
- 2021On the Memorization Properties of Contrastive Learningcited by 4
Built on by
Citing papers per year: 2025: 6; 2026: 3.
9 papers.
- 2025Privacy Attacks on Image AutoRegressive Modelscited by 15
- 2025Trustworthy AI: Safety, Bias, and Privacy -- A Surveycited by 5
- 2025Exploring Structural Degradation in Dense Representations for Self-supervised Learningcited by 5
- 2025Captured by Captions: On Memorization and its Mitigation in CLIP Modelscited by 4
- 2025Demystifying Foreground-Background Memorization in Diffusion Modelscited by 2
- 2025Localizing and Mitigating Memorization in Image Autoregressive Modelscited by 1
- 2026Batch Normalization Amplifies Memorization and Privacy Riskscited by 1
- 2026Mitigating Membership Inference in Intermediate Representations with Differentially Private Trainingcited by 0
- 2026MultiMem: Measuring and Mitigating Memorization in Multi-Modal Contrastive Learningcited by 0
- 2026MultiMem: Measuring and Mitigating Memorization in Multi-Modal Contrastive Learning20 Jun 2026
- 2026Batch Normalization Amplifies Memorization and Privacy Risks23 May 2026
- 2026Mitigating Membership Inference in Intermediate Representations with Differentially Private Training26 Feb 2026
- 2025Exploring Structural Degradation in Dense Representations for Self-supervised Learning20 Oct 2025
- 2025Localizing and Mitigating Memorization in Image Autoregressive Models30 Aug 2025
- 2025Demystifying Foreground-Background Memorization in Diffusion Models16 Aug 2025
- 2025Trustworthy AI: Safety, Bias, and Privacy -- A Survey11 Feb 2025
- 2025Captured by Captions: On Memorization and its Mitigation in CLIP Models11 Feb 2025
- 2025Privacy Attacks on Image AutoRegressive Models4 Feb 2025