Localizing and Mitigating Memorization in Image Autoregressive Models

2025-08-30

AI Summary

Autoregressive image generation (IAR) models risk privacy leakage due to memorization of training data. This work introduces the first fine-grained memory localization method to systematically characterize how memorization manifests across multi-resolution feature hierarchies and per-token prediction trajectories in diverse IAR architectures, revealing underlying mechanisms. Based on this analysis, we identify highly memorizing model components and design targeted interventions that suppress memorization without degrading generation quality. Experiments demonstrate that our approach substantially reduces extractability of training images—e.g., reconstruction success drops by over 70%—while preserving fidelity, as evidenced by stable FID and LPIPS scores. This study establishes both a theoretical foundation for understanding memorization in generative models and a practical framework for developing privacy-safe IAR systems.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Diffusion Models for Vision
• Natural Language Processing: Generation

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Security and Privacy: Large-scale security measurements

Abstract

Image AutoRegressive (IAR) models have achieved state-of-the-art performance in speed and quality of generated images. However, they also raise concerns about memorization of their training data and its implications for privacy. This work explores where and how such memorization occurs within different image autoregressive architectures by measuring a fine-grained memorization. The analysis reveals that memorization patterns differ across various architectures of IARs. In hierarchical per-resolution architectures, it tends to emerge early and deepen with resolutions, while in IARs with standard autoregressive per token prediction, it concentrates in later processing stages. These localization of memorization patterns are further connected to IARs' ability to memorize and leak training data. By intervening on their most memorizing components, we significantly reduce the capacity for data extraction from IARs with minimal impact on the quality of generated images. These findings offer new insights into the internal behavior of image generative models and point toward practical strategies for mitigating privacy risks.

Problem

• Localizing memorization patterns in image autoregressive models
• Mitigating privacy risks from training data memorization
• Reducing data extraction capacity while maintaining image quality

Innovation

• Localizing memorization patterns in architectures
• Intervening on most memorizing components
• Reducing data extraction with minimal quality impact