{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,30]],"date-time":"2026-04-30T17:34:22Z","timestamp":1777570462200,"version":"3.51.4"},"reference-count":132,"publisher":"Association for Computing Machinery (ACM)","issue":"4","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2026,3,31]]},"abstract":"<jats:p>Deep Learning (DL) powered by Deep Neural Networks (DNNs) has revolutionized various domains, yet understanding the details of DNN decision-making and learning processes remains a significant challenge. Recent investigations have uncovered an interesting memorization phenomenon in which DNNs tend to memorize specific details from examples rather than learning general patterns, affecting model generalization, security, and privacy. This raises critical questions about the nature of generalization in DNNs and their susceptibility to security breaches. In this survey, we present a systematic framework to organize memorization definitions based on the generalization and security\/privacy domains and summarize memorization evaluation methods at both the example and model levels. Through a comprehensive literature review, we explore DNN memorization behaviors and their impacts on security and privacy. We also introduce privacy vulnerabilities caused by memorization and the phenomenon of forgetting and explore its connection with memorization. Furthermore, we spotlight various applications leveraging memorization mechanisms. This survey offers the first-in-kind understanding of memorization in DNNs, providing insights into its challenges and opportunities for enhancing AI development while addressing critical ethical concerns.<\/jats:p>","DOI":"10.1145\/3769076","type":"journal-article","created":{"date-parts":[[2025,9,22]],"date-time":"2025-09-22T11:33:36Z","timestamp":1758540816000},"page":"1-35","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["Memorization in Deep Learning: A Survey"],"prefix":"10.1145","volume":"58","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-7180-4268","authenticated-orcid":false,"given":"Jiaheng","family":"Wei","sequence":"first","affiliation":[{"name":"RMIT University","place":["Melbourne, Australia"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5611-3483","authenticated-orcid":false,"given":"Yanjun","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science, University of Technology Sydney","place":["Sydney, Australia"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9330-2662","authenticated-orcid":false,"given":"Leo Yu","family":"Zhang","sequence":"additional","affiliation":[{"name":"Griffith University","place":["Brisbane, Australia"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3690-0321","authenticated-orcid":false,"given":"Ming","family":"Ding","sequence":"additional","affiliation":[{"name":"Data61","place":["Eveleigh, Australia"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1355-3870","authenticated-orcid":false,"given":"Chao","family":"Chen","sequence":"additional","affiliation":[{"name":"RMIT University","place":["Melbourne, Australia"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4688-7674","authenticated-orcid":false,"given":"Kok-Leong","family":"Ong","sequence":"additional","affiliation":[{"name":"RMIT University","place":["Melbourne, Australia"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2189-7801","authenticated-orcid":false,"given":"Jun","family":"Zhang","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Software Engineering, Swinburne University of Technology","place":["Hawthorn, Australia"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5252-0831","authenticated-orcid":false,"given":"Yang","family":"Xiang","sequence":"additional","affiliation":[{"name":"Swinburne University of Technology","place":["Hawthorn, Australia"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,10,25]]},"reference":[{"key":"e_1_3_1_2_2","doi-asserted-by":"crossref","unstructured":"Martin Abadi Andy Chu Ian Goodfellow H Brendan McMahan Ilya Mironov Kunal Talwar and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 308\u2013318.","DOI":"10.1145\/2976749.2978318"},{"key":"e_1_3_1_3_2","unstructured":"Josh Achiam Steven Adler Sandhini Agarwal Lama Ahmad Ilge Akkaya Florencia Leoni Aleman Diogo Almeida Janko Altenschmidt Sam Altman Shyamal Anadkat et\u00a0al. 2023. Gpt-4 technical report. arXiv:2303.08774. Retrieved from https:\/\/arxiv.org\/abs\/2303.08774"},{"key":"e_1_3_1_4_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Achille Alessandro","year":"2018","unstructured":"Alessandro Achille, Matteo Rovere, and Stefano Soatto. 2018. Critical learning periods in deep networks. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01012"},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.3390\/app11020796"},{"key":"e_1_3_1_7_2","volume-title":"Proceedings of the 11th International Conference on Learning Representations","author":"Anagnostidis Sotiris","year":"2022","unstructured":"Sotiris Anagnostidis, Gregor Bachmann, Lorenzo Noci, and Thomas Hofmann. 2022. The curious case of benign memorization. In Proceedings of the 11th International Conference on Learning Representations."},{"key":"e_1_3_1_8_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Ansuini Alessio","year":"2019","unstructured":"Alessio Ansuini, Alessandro Laio, Jakob H. Macke, and Davide Zoccolan. 2019. Intrinsic dimension of data representations in deep neural networks. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc."},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.5555\/3305381.3305406"},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1907378117"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-44581-1_15"},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1162\/153244302760200704"},{"key":"e_1_3_1_13_2","first-page":"25237","article-title":"Benign overfitting in two-layer convolutional neural networks","volume":"35","author":"Cao Yuan","year":"2022","unstructured":"Yuan Cao, Zixiang Chen, Misha Belkin, and Quanquan Gu. 2022. Benign overfitting in two-layer convolutional neural networks. Advances in Neural Information Processing Systems 35(2022), 25237\u201325250.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","unstructured":"Nicholas Carlini Steve Chien Milad Nasr Shuang Song Andreas Terzis and Florian Tram\u00e8r. 2022. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP). 1897\u20131914. DOI:10.1109\/SP46214.2022.9833649","DOI":"10.1109\/SP46214.2022.9833649"},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","unstructured":"Nicholas Carlini \u00dalfar Erlingsson and Nicolas Papernot. 2019. Distribution density tails and outliers in machine learning: Metrics and applications. arXiv:1910.13427. DOI:10.48550\/arXiv.1910.13427","DOI":"10.48550\/arXiv.1910.13427"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.5555\/3620237.3620531"},{"key":"e_1_3_1_17_2","unstructured":"Nicholas Carlini Daphne Ippolito Matthew Jagielski Katherine Lee Florian Tramer and Chiyuan Zhang. 2022. Quantifying memorization across neural language models. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_18_2","first-page":"13263","article-title":"The privacy onion effect: Memorization is relative","volume":"35","author":"Carlini Nicholas","year":"2022","unstructured":"Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nicolas Papernot, Andreas Terzis, and Florian Tramer. 2022. The privacy onion effect: Memorization is relative. Advances in Neural Information Processing Systems 35(2022), 13263\u201313276.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_19_2","unstructured":"Nicholas Carlini Chang Liu \u00dalfar Erlingsson Jernej Kos and Dawn Song. 2019. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX Security Symposium (USENIX Security 19). 267\u2013284."},{"key":"e_1_3_1_20_2","first-page":"2633","volume-title":"Proceedings of the 30th USENIX Security Symposium.","author":"Carlini Nicholas","year":"2021","unstructured":"Nicholas Carlini, Florian Tram\u00e8r, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, \u00dalfar Erlingsson, Alina Oprea, and Colin Raffel. 2021. Extracting training data from large language models. In Proceedings of the 30th USENIX Security Symposium.2633\u20132650."},{"key":"e_1_3_1_21_2","first-page":"755","volume-title":"Proceedings of the 35th International Conference on Machine Learning","author":"Chatterjee Satrajit","year":"2018","unstructured":"Satrajit Chatterjee. 2018. Learning and memorization. In Proceedings of the 35th International Conference on Machine Learning. PMLR, 755\u2013763."},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","unstructured":"Xinyun Chen Chang Liu Bo Li Kimberly Lu and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv:1712.05526. DOI:10.48550\/arXiv.1712.05526","DOI":"10.48550\/arXiv.1712.05526"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","unstructured":"Peng Chu Xiao Bian Shaopeng Liu and Haibin Ling. 2020. Feature space augmentation for long-tailed data. In Proceedings of the Computer Vision.Andrea Vedaldi Horst Bischof Thomas Brox and Jan-Michael Frahm (Eds.) Lecture Notes in Computer Science Springer International Publishing Cham 694\u2013710. DOI:10.1007\/978-3-030-58526-6_41","DOI":"10.1007\/978-3-030-58526-6_41"},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","unstructured":"Yin Cui Zeqi Gu Dhruv Mahajan Laurens van der Maaten Serge Belongie and Ser-Nam Lim. 2019. Measuring Dataset Granularity. arxiv:1912.10154 [cs] DOI:10.48550\/arXiv.1912.10154","DOI":"10.48550\/arXiv.1912.10154"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2104.08696"},{"key":"e_1_3_1_26_2","doi-asserted-by":"crossref","unstructured":"Nicola De Cao Wilker Aziz and Ivan Titov. 2021. Editing factual knowledge in language models. arXiv:2104.08164. Retrieved from https:\/\/arxiv.org\/abs\/2104.08164","DOI":"10.18653\/v1\/2021.emnlp-main.522"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-023-16438-y"},{"key":"e_1_3_1_28_2","first-page":"8780","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Dhariwal Prafulla","year":"2021","unstructured":"Prafulla Dhariwal and Alexander Nichol. 2021. Diffusion models beat GANs on image synthesis. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc., 8780\u20138794."},{"key":"e_1_3_1_29_2","unstructured":"Yi Dong Ronghui Mu Gaojie Jin Yi Qi Jinwei Hu Xingyu Zhao Jie Meng Wenjie Ruan and Xiaowei Huang. 2024. Building guardrails for large language models. arXiv:2402.01822. Retrieved from https:\/\/arxiv.org\/abs\/2402.01822"},{"key":"e_1_3_1_30_2","unstructured":"Yinpeng Dong Ke Xu Xiao Yang Tianyu Pang Zhijie Deng Hang Su and Jun Zhu. 2022. Exploring memorization in adversarial training. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/3357713.3384290"},{"key":"e_1_3_1_32_2","first-page":"2881","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Feldman Vitaly","year":"2020","unstructured":"Vitaly Feldman and Chiyuan Zhang. 2020. What neural networks memorize and why: Discovering the long tail via influence estimation. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc., 2881\u20132891."},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.400"},{"key":"e_1_3_1_34_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Frankle Jonathan","year":"2019","unstructured":"Jonathan Frankle, David J. Schwab, and Ari S. Morcos. 2019. The early phase of neural network training. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_35_2","unstructured":"Isha Garg Deepak Ravikumar and Kaushik Roy. 2023. Memorization through the lens of curvature of loss function around samples. arXiv:2307.05831. Retrieved from https:\/\/arxiv.org\/abs\/2307.05831"},{"key":"e_1_3_1_36_2","doi-asserted-by":"crossref","unstructured":"Mor Geva Avi Caciularu Kevin Ro Wang and Yoav Goldberg. 2022. Transformer feed-forward layers build predictions by promoting concepts in the vocabulary space. arXiv:2203.14680. Retrieved from https:\/\/arxiv.org\/abs\/2203.14680","DOI":"10.18653\/v1\/2022.emnlp-main.3"},{"key":"e_1_3_1_37_2","doi-asserted-by":"crossref","unstructured":"Mor Geva Roei Schuster Jonathan Berant and Omer Levy. 2021. Transformer feed-forward layers are key-value memories. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 5484\u20135495.","DOI":"10.18653\/v1\/2021.emnlp-main.446"},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/3422622"},{"key":"e_1_3_1_39_2","unstructured":"Ian J. Goodfellow Jonathon Shlens and Christian Szegedy. [n.d.]. Explaining and harnessing adversarial examples. ([n.d.]). arXiv:1412.6572v3. Retrieved from https:\/\/arxiv.org\/abs\/1412.6572v3"},{"key":"e_1_3_1_40_2","doi-asserted-by":"publisher","unstructured":"Jindong Gu and Volker Tresp. 2019. Neural network memorization dissection. arXiv:1911.09537. DOI:10.48550\/arXiv.1911.09537","DOI":"10.48550\/arXiv.1911.09537"},{"key":"e_1_3_1_41_2","doi-asserted-by":"crossref","unstructured":"Akshat Gupta Dev Sajnani and Gopala Anumanchipalli. 2024. A unified framework for model editing. arXiv:2403.14236. Retrieved from https:\/\/arxiv.org\/abs\/2403.14236","DOI":"10.18653\/v1\/2024.findings-emnlp.903"},{"key":"e_1_3_1_42_2","first-page":"3929","volume-title":"Proceedings of the 37th International Conference on Machine Learning","author":"Guu Kelvin","year":"2020","unstructured":"Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Mingwei Chang. 2020. Retrieval augmented language model pre-training. In Proceedings of the 37th International Conference on Machine Learning. PMLR, 3929\u20133938."},{"key":"e_1_3_1_43_2","first-page":"3950","volume-title":"Proceedings of the 37th International Conference on Machine Learning","author":"Hacohen Guy","year":"2020","unstructured":"Guy Hacohen, Leshem Choshen, and Daphna Weinshall. 2020. Let\u2019s agree to agree: Neural networks share classification order on real datasets. In Proceedings of the 37th International Conference on Machine Learning. PMLR, 3950\u20133960."},{"key":"e_1_3_1_44_2","first-page":"8536","volume-title":"Proceedings of the 32nd International Conference on Neural Information Processing Systems.","author":"Han Bo","year":"2018","unstructured":"Bo Han, Quanming Yao, Xingrui Yu, Gang Niu, Miao Xu, Weihua Hu, Ivor W. Tsang, and Masashi Sugiyama. 2018. Co-teaching: Robust training of deep neural networks with extremely noisy labels. In Proceedings of the 32nd International Conference on Neural Information Processing Systems.Curran Associates Inc., Red Hook, NY, USA, 8536\u20138546."},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","unstructured":"Tyler L. Hayes Kushal Kafle Robik Shrestha Manoj Acharya and Christopher Kanan. 2020. REMIND your neural network to prevent catastrophic forgetting. In Proceedings of the Computer Vision.Andrea Vedaldi Horst Bischof Thomas Brox and Jan-Michael Frahm (Eds.) Lecture Notes in Computer Science Springer International Publishing Cham 466\u2013483. DOI:10.1007\/978-3-030-58598-3_28","DOI":"10.1007\/978-3-030-58598-3_28"},{"key":"e_1_3_1_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01712"},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01712"},{"key":"e_1_3_1_48_2","unstructured":"Andrew Ilyas Shibani Santurkar Dimitris Tsipras Logan Engstrom Brandon Tran and Aleksander Ma\u0327dry. 2019. Adversarial examples are not bugs they are features. In Proceedings of the 33rd International Conference on Neural Information Processing Systems. 125\u2013136."},{"key":"e_1_3_1_49_2","volume-title":"Proceedings of the 11th International Conference on Learning Representations","author":"Jagielski Matthew","year":"2022","unstructured":"Matthew Jagielski, Om Thakkar, Florian Tramer, Daphne Ippolito, Katherine Lee, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradeep Guha Thakurta, Nicolas Papernot, and Chiyuan Zhang. 2022. Measuring forgetting of memorized training examples. In Proceedings of the 11th International Conference on Learning Representations."},{"key":"e_1_3_1_50_2","first-page":"2304","volume-title":"Proceedings of the 35th International Conference on Machine Learning","author":"Jiang Lu","year":"2018","unstructured":"Lu Jiang, Zhengyuan Zhou, Thomas Leung, Li-Jia Li, and Li Fei-Fei. 2018. MentorNet: Learning data-driven curriculum for very deep neural networks on corrupted labels. In Proceedings of the 35th International Conference on Machine Learning. PMLR, 2304\u20132313."},{"key":"e_1_3_1_51_2","first-page":"5034","volume-title":"Proceedings of the 38th International Conference on Machine Learning","author":"Jiang Ziheng","year":"2021","unstructured":"Ziheng Jiang, Chiyuan Zhang, Kunal Talwar, and Michael C. Mozer. 2021. Characterizing structural regularities of labeled data in overparameterized models. In Proceedings of the 38th International Conference on Machine Learning. PMLR, 5034\u20135044."},{"key":"e_1_3_1_52_2","first-page":"10697","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Kandpal Nikhil","year":"2022","unstructured":"Nikhil Kandpal, Eric Wallace, and Colin Raffel. 2022. Deduplicating training data mitigates privacy risks in language models. In Proceedings of the International Conference on Machine Learning. PMLR, 10697\u201310707."},{"key":"e_1_3_1_53_2","volume-title":"Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing","author":"Kassem Aly M","unstructured":"Aly M Kassem, Omar Mahmoud, and Sherif Saad. [n.d.]. Preserving privacy through dememorization: An unlearning technique for mitigating memorization risks in language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing."},{"key":"e_1_3_1_54_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Khandelwal Urvashi","year":"2020","unstructured":"Urvashi Khandelwal, Angela Fan, Dan Jurafsky, Luke Zettlemoyer, and Mike Lewis. 2020. Nearest neighbor machine translation. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_55_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Khandelwal Urvashi","year":"2019","unstructured":"Urvashi Khandelwal, Omer Levy, Dan Jurafsky, Luke Zettlemoyer, and Mike Lewis. 2019. Generalization through memorization: Nearest neighbor language models. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_56_2","doi-asserted-by":"publisher","unstructured":"Eugene Kharitonov Marco Baroni and Dieuwke Hupkes. 2021. How BPE Affects Memorization in Transformers. arXiv:2110.02782. DOI:10.48550\/arXiv.2110.02782","DOI":"10.48550\/arXiv.2110.02782"},{"key":"e_1_3_1_57_2","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1611835114"},{"key":"e_1_3_1_58_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Krizhevsky Alex","year":"2012","unstructured":"Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. 2012. ImageNet classification with deep convolutional neural networks. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc."},{"key":"e_1_3_1_59_2","unstructured":"David Krueger* Nicolas Ballas* Stanislaw Jastrzebski* Devansh Arpit* Maxinder S. Kanwal Tegan Maharaj Emmanuel Bengio Asja Fischer and Aaron Courville. 2017. Deep nets don\u2019t learn via memorization. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_60_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.577"},{"key":"e_1_3_1_61_2","first-page":"1605","volume-title":"Proceedings of the 29th USENIX Security Symposium.","author":"Leino Klas","year":"2020","unstructured":"Klas Leino and Matt Fredrikson. 2020. Stolen memories: Leveraging model memorization for calibrated {white-box} membership inference. In Proceedings of the 29th USENIX Security Symposium.1605\u20131622."},{"key":"e_1_3_1_62_2","first-page":"18470","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Lewis Mike","year":"2020","unstructured":"Mike Lewis, Marjan Ghazvininejad, Gargi Ghosh, Armen Aghajanyan, Sida Wang, and Luke Zettlemoyer. 2020. Pre-training via paraphrasing. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc., 18470\u201318481."},{"key":"e_1_3_1_63_2","first-page":"9459","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Lewis Patrick","year":"2020","unstructured":"Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich K\u00fcttler, Mike Lewis, Wen-tau Yih, Tim Rockt\u00e4schel, Sebastian Riedel, and Douwe Kiela. 2020. Retrieval-augmented generation for knowledge-intensive NLP tasks. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc., 9459\u20139474."},{"key":"e_1_3_1_64_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00325"},{"key":"e_1_3_1_65_2","unstructured":"Qiongxiu Li Xiaoyu Luo Yiyi Chen and Johannes Bjerva. 2025. Trustworthy machine learning via memorization and the granular long-tail: A survey on interactions tradeoffs and beyond. arXiv:2503.07501. Retrieved from https:\/\/arxiv.org\/abs\/2503.07501"},{"key":"e_1_3_1_66_2","doi-asserted-by":"crossref","unstructured":"Xiao Li Qiongxiu Li Zhanhao Hu and Xiaolin Hu. 2023. On the Privacy Effect of Data Enhancement via the Lens of Memorization. IEEE Transactions on Information Forensics and Security 19 (2024) 4686\u20134699.","DOI":"10.1109\/TIFS.2024.3381477"},{"key":"e_1_3_1_67_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Li Yuanzhi","year":"2019","unstructured":"Yuanzhi Li, Colin Wei, and Tengyu Ma. 2019. Towards explaining the regularization effect of initial large learning rate in training neural networks. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc."},{"key":"e_1_3_1_68_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2017.2773081"},{"key":"e_1_3_1_69_2","doi-asserted-by":"publisher","unstructured":"Zhu Li Zhi-Hua Zhou and Arthur Gretton. 2021. Towards an Understanding of Benign Overfitting in Neural Networks. arxiv:2106.03212 [cs stat] DOI:10.48550\/arXiv.2106.03212","DOI":"10.48550\/arXiv.2106.03212"},{"key":"e_1_3_1_70_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i10.17049"},{"key":"e_1_3_1_71_2","doi-asserted-by":"publisher","unstructured":"Yunhui Long Vincent Bindschaedler Lei Wang Diyue Bu Xiaofeng Wang Haixu Tang Carl A. Gunter and Kai Chen. 2018. Understanding Membership Inferences on Well-Generalized Learning Models. arXiv:1802.04889. DOI:10.48550\/arXiv.1802.04889","DOI":"10.48550\/arXiv.1802.04889"},{"key":"e_1_3_1_72_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179300"},{"key":"e_1_3_1_73_2","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. [n.d.]. Towards deep learning models resistant to adversarial attacks. ([n.d.]). arXiv:1706.06083v4. Retrieved from https:\/\/arxiv.org\/abs\/1706.06083v4"},{"key":"e_1_3_1_74_2","first-page":"19693","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Maennel Hartmut","year":"2020","unstructured":"Hartmut Maennel, Ibrahim M. Alabdulmohsin, Ilya O. Tolstikhin, Robert Baldock, Olivier Bousquet, Sylvain Gelly, and Daniel Keysers. 2020. What do neural networks learn when trained with random labels?. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc., 19693\u201319704."},{"key":"e_1_3_1_75_2","first-page":"30044","article-title":"Characterizing datapoints via second-split forgetting","volume":"35","author":"Maini Pratyush","year":"2022","unstructured":"Pratyush Maini, Saurabh Garg, Zachary Lipton, and J. Zico Kolter. 2022. Characterizing datapoints via second-split forgetting. Advances in Neural Information Processing Systems 35(2022), 30044\u201330057.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_76_2","doi-asserted-by":"publisher","unstructured":"Pratyush Maini Michael C. Mozer Hanie Sedghi Zachary C. Lipton J. Zico Kolter and Chiyuan Zhang. 2023. Can Neural Network Memorization Be Localized?arxiv:2307.09542 [cs] DOI:10.48550\/arXiv.2307.09542","DOI":"10.48550\/arXiv.2307.09542"},{"key":"e_1_3_1_77_2","first-page":"17359","article-title":"Locating and editing factual associations in GPT","volume":"35","author":"Meng Kevin","year":"2022","unstructured":"Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. 2022. Locating and editing factual associations in GPT. Advances in Neural Information Processing Systems 35 (2022), 17359\u201317372.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_78_2","unstructured":"Kevin Meng Arnab Sen Sharma Alex Andonian Yonatan Belinkov and David Bau. 2022. Mass-editing memory in a transformer. arXiv:2210.07229. Retrieved from https:\/\/arxiv.org\/abs\/2210.07229"},{"key":"e_1_3_1_79_2","unstructured":"Eric Mitchell Charles Lin Antoine Bosselut Chelsea Finn and Christopher D Manning. 2021. Fast model editing at scale. arXiv:2110.11309. Retrieved from https:\/\/arxiv.org\/abs\/2110.11309"},{"key":"e_1_3_1_80_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Morcos Ari","year":"2018","unstructured":"Ari Morcos, Maithra Raghu, and Samy Bengio. 2018. Insights on representational similarity in neural networks with canonical correlation. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc."},{"key":"e_1_3_1_81_2","doi-asserted-by":"publisher","unstructured":"Sayan Mukherjee Partha Niyogi Tomaso Poggio and Ryan Rifkin. 2006. Learning theory: Stability is sufficient for generalization and necessary and sufficient for consistency of empirical risk minimization. Advances in Computational Mathematics 25 1\u20133 (2006) 161\u2013193. DOI:10.1007\/s10444-004-7634-z","DOI":"10.1007\/s10444-004-7634-z"},{"key":"e_1_3_1_82_2","unstructured":"Duc Anh Nguyen Ron Levie Julian Lienen Eyke H\u00fcllermeier and Gitta Kutyniok. 2023. Memorization-dilation: modeling neural collapse under noise. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_83_2","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.2015509117"},{"key":"e_1_3_1_84_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-75765-6_11"},{"key":"e_1_3_1_85_2","doi-asserted-by":"crossref","unstructured":"Fabio Petroni Tim Rockt\u00e4schel Patrick Lewis Anton Bakhtin Yuxiang Wu Alexander H. Miller and Sebastian Riedel. 2019. Language models as knowledge bases? arXiv:1909.01066. Retrieved from https:\/\/arxiv.org\/abs\/1909.01066","DOI":"10.18653\/v1\/D19-1250"},{"key":"e_1_3_1_86_2","doi-asserted-by":"publisher","DOI":"10.1038\/nature02341"},{"key":"e_1_3_1_87_2","unstructured":"Alec Radford Karthik Narasimhan Tim Salimans and Ilya Sutskever. 2018. Improving language understanding by generative pre-training. OpenAI technical report\/preprint. https:\/\/cdn.openai.com\/research-covers\/language-unsupervised\/language_understanding_paper.pdf"},{"key":"e_1_3_1_88_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Raghu Maithra","year":"2017","unstructured":"Maithra Raghu, Justin Gilmer, Jason Yosinski, and Jascha Sohl-Dickstein. 2017. SVCCA: Singular vector canonical correlation analysis for deep learning dynamics and interpretability. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc."},{"key":"e_1_3_1_89_2","unstructured":"Deepak Ravikumar Efstathia Soufleri Abolfazl Hashemi and Kaushik Roy. 2024. Memorization and the orders of loss: A learning dynamics perspective. Manuscript submitted for review. https:\/\/openreview.net\/forum?id=lTh7DEJV5WUnderdouble-blindreview"},{"key":"e_1_3_1_90_2","volume-title":"Proceedings of the 42nd International Conference on Machine Learning","author":"Ravikumar Deepak","year":"2025","unstructured":"Deepak Ravikumar, Efstathia Soufleri, Abolfazl Hashemi, and Kaushik Roy. 2025. Towards memorization estimation: Fast, formal and free. In Proceedings of the 42nd International Conference on Machine Learning."},{"key":"e_1_3_1_91_2","doi-asserted-by":"publisher","DOI":"10.1016\/S0165-1765(01)00524-9"},{"key":"e_1_3_1_92_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00780"},{"key":"e_1_3_1_93_2","doi-asserted-by":"publisher","DOI":"10.5555\/3524938.3525687"},{"key":"e_1_3_1_94_2","unstructured":"Hippolyt Ritter Aleksandar Botev and David Barber. 2018. Online Structured Laplace Approximations for Overcoming Catastrophic Forgetting. In Proceedings of the Advances in Neural Information Processing Systems. 31 (2018)."},{"key":"e_1_3_1_95_2","doi-asserted-by":"publisher","unstructured":"Alexandre Sablayrolles Matthijs Douze Cordelia Schmid and Herv\u00e9 J\u00e9gou. 2018. D\\\u2019ej\\\u2018a Vu: An Empirical Evaluation of the Memorization Properties of ConvNets. arxiv:1809.06396 [cs] DOI:10.48550\/arXiv.1809.06396","DOI":"10.48550\/arXiv.1809.06396"},{"key":"e_1_3_1_96_2","volume-title":"Proceedings of the 13th International Conference on Learning Representations","author":"Sakarvadia Mansi","unstructured":"Mansi Sakarvadia, Aswathy Ajith, Arham Mushtaq Khan, Nathaniel C Hudson, Caleb Geniesse, Kyle Chard, Yaoqing Yang, Ian Foster, and Michael W Mahoney. [n.d.]. Mitigating memorization in language models. In Proceedings of the 13th International Conference on Learning Representations."},{"key":"e_1_3_1_97_2","unstructured":"Ali Satvaty Suzan Verberne and Fatih Turkmen. 2024. Undesirable memorization in large language models: A survey. arXiv:2410.02650. Retrieved from https:\/\/arxiv.org\/abs\/2410.02650"},{"key":"e_1_3_1_98_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Schmidt Ludwig","year":"2018","unstructured":"Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. 2018. Adversarially robust generalization requires more data. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc."},{"key":"e_1_3_1_99_2","first-page":"37","volume-title":"Proceedings of the 2025 IEEE 22nd International Conference on Software Architecture.","author":"Shamsujjoha Md","year":"2025","unstructured":"Md Shamsujjoha, Qinghua Lu, Dehai Zhao, and Liming Zhu. 2025. Swiss cheese model for ai safety: A taxonomy and reference architecture for multi-layered guardrails of foundation model based agents. In Proceedings of the 2025 IEEE 22nd International Conference on Software Architecture. IEEE, 37\u201348."},{"key":"e_1_3_1_100_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.143"},{"key":"e_1_3_1_101_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_1_102_2","unstructured":"Cory Stephenson Abhinav Ganesh Yue Hui Hanlin Tang SueYeon Chung et\u00a0al. 2021. On the geometry of generalization and memorization in deep neural networks. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_103_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.trustnlp-1.18"},{"key":"e_1_3_1_104_2","doi-asserted-by":"publisher","unstructured":"Sainbayar Sukhbaatar \u00c9douard Grave Guillaume Lample Herv\u00e9 J\u00e9gou and Armand Joulin. 2019. Augmenting self-attention with persistent memory. arXiv:1907.01470. DOI:10.48550\/arXiv.1907.01470","DOI":"10.48550\/arXiv.1907.01470"},{"key":"e_1_3_1_105_2","first-page":"3319","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Sundararajan Mukund","year":"2017","unstructured":"Mukund Sundararajan, Ankur Taly, and Qiqi Yan. 2017. Axiomatic attribution for deep networks. In Proceedings of the International Conference on Machine Learning. PMLR, 3319\u20133328."},{"key":"e_1_3_1_106_2","first-page":"21831","article-title":"Transformer memory as a differentiable search index","volume":"35","author":"Tay Yi","year":"2022","unstructured":"Yi Tay, Vinh Tran, Mostafa Dehghani, Jianmo Ni, Dara Bahri, Harsh Mehta, Zhen Qin, Kai Hui, Zhe Zhao, Jai Gupta, Tal Schuster, William W. Cohen, and Donald Metzler. 2022. Transformer memory as a differentiable search index. Advances in Neural Information Processing Systems 35(2022), 21831\u201321843.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_107_2","doi-asserted-by":"publisher","unstructured":"Om Thakkar Swaroop Ramaswamy Rajiv Mathews and Fran\u00e7oise Beaufays. 2020. Understanding unintended memorization in federated learning. arXiv:2006.07490. DOI:10.48550\/arXiv.2006.07490","DOI":"10.48550\/arXiv.2006.07490"},{"key":"e_1_3_1_108_2","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180220"},{"key":"e_1_3_1_109_2","first-page":"38274","article-title":"Memorization without overfitting: Analyzing the training dynamics of large language models","volume":"35","author":"Tirumala Kushal","year":"2022","unstructured":"Kushal Tirumala, Aram Markosyan, Luke Zettlemoyer, and Armen Aghajanyan. 2022. Memorization without overfitting: Analyzing the training dynamics of large language models. Advances in Neural Information Processing Systems 35(2022), 38274\u201338290.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_1_110_2","unstructured":"Mariya Toneva Alessandro Sordoni Remi Tachet des Combes Adam Trischler Yoshua Bengio and Geoffrey J. Gordon. 2019. An empirical study of example forgetting during deep neural network learning. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_111_2","unstructured":"Reihaneh Torkzadehmahani Reza Nasirigerdeh Georgios Kaissis Daniel Rueckert Gintare Karolina Dziugaite and Eleni Triantafillou. 2024. Improved localized machine unlearning through the lens of memorization. arXiv:2412.02432. Retrieved from https:\/\/arxiv.org\/abs\/2412.02432"},{"key":"e_1_3_1_112_2","unstructured":"Tao Tu Anil Palepu Mike Schaekermann Khaled Saab Jan Freyberg Ryutaro Tanno Amy Wang Brenna Li Mohamed Amin Nenad Tomasev et\u00a0al. 2024. Towards conversational diagnostic ai. arXiv:2401.05654. Retrieved from https:\/\/arxiv.org\/abs\/2401.05654"},{"key":"e_1_3_1_113_2","article-title":"Memorisation in machine learning: A survey of results","author":"Usynin Dmitrii","year":"2024","unstructured":"Dmitrii Usynin, Moritz Knolle, and Georgios Kaissis. 2024. Memorisation in machine learning: A survey of results. Transactions on Machine Learning Research (2024), 1\u201325.","journal-title":"Transactions on Machine Learning Research"},{"key":"e_1_3_1_114_2","article-title":"Adaptive and learning systems for signal processing communications, and control","author":"Vapnik Vladimir Naumovich","year":"1998","unstructured":"Vladimir Naumovich Vapnik. 1998. Adaptive and learning systems for signal processing communications, and control. Statistical Learning Theory (1998). John Wiley & Sons, New York.","journal-title":"Statistical Learning Theory"},{"key":"e_1_3_1_115_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","author":"Vaswani Ashish","year":"2017","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, \u0141ukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In Proceedings of the Advances in Neural Information Processing Systems. Curran Associates, Inc."},{"key":"e_1_3_1_116_2","doi-asserted-by":"publisher","unstructured":"Pat Verga Haitian Sun Livio Baldini Soares and William W Cohen. 2020. Facts as experts: Adaptable and interpretable neural memory over symbolic knowledge. arXiv:2007.00849. DOI:10.48550\/arXiv.2007.00849","DOI":"10.48550\/arXiv.2007.00849"},{"key":"e_1_3_1_117_2","unstructured":"Bichen Wang Yuzhe Zi Yixin Sun Yanyan Zhao and Bing Qin. 2024. Rkld: Reverse kl-divergence-based knowledge distillation for unlearning personal information in large language models. arXiv:2406.01983. Retrieved from https:\/\/arxiv.org\/abs\/2406.01983"},{"key":"e_1_3_1_118_2","unstructured":"Yuhuai Wu Markus Norman Rabe DeLesley Hutchins and Christian Szegedy. 2022. Memorizing transformers. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_119_2","unstructured":"Alexander Xiong Xuandong Zhao Aneesh Pappu and Dawn Song. 2025. The landscape of memorization in LLMs: Mechanisms measurement and mitigation. arXiv:2507.05578. Retrieved from https:\/\/arxiv.org\/abs\/2507.05578"},{"key":"e_1_3_1_120_2","doi-asserted-by":"publisher","DOI":"10.1145\/3580305.3599381"},{"key":"e_1_3_1_121_2","doi-asserted-by":"publisher","DOI":"10.5555\/3524938.3525938"},{"key":"e_1_3_1_122_2","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2018.00027"},{"key":"e_1_3_1_123_2","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00371"},{"key":"e_1_3_1_124_2","volume-title":"Proceedings of the Advances in Neural Information Processing Systems","volume":"27","author":"Yosinski Jason","year":"2014","unstructured":"Jason Yosinski, Jeff Clune, Yoshua Bengio, and Hod Lipson. 2014. How transferable are features in deep neural networks?. In Proceedings of the Advances in Neural Information Processing Systems, Vol. 27. Curran Associates, Inc."},{"key":"e_1_3_1_125_2","series-title":"Proceedings of Machine Learning Research","first-page":"7164","volume-title":"Proceedings of the 36th International Conference on Machine Learning","volume":"97","author":"Yu Xingrui","year":"2019","unstructured":"Xingrui Yu, Bo Han, Jiangchao Yao, Gang Niu, Ivor Tsang, and Masashi Sugiyama. 2019. How does disagreement help generalization against label corruption?. In Proceedings of the 36th International Conference on Machine Learning(Proceedings of Machine Learning Research, Vol. 97).Kamalika Chaudhuri and Ruslan Salakhutdinov (Eds.), PMLR, 7164\u20137173. Retrieved from https:\/\/proceedings.mlr.press\/v97\/yu19b.html"},{"key":"e_1_3_1_126_2","unstructured":"Chiyuan Zhang Samy Bengio Moritz Hardt Michael C. Mozer and Yoram Singer. 2020. Identity crisis: Memorization and generalization under extreme overparameterization. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_127_2","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Zhang Chiyuan","year":"2017","unstructured":"Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. 2017. Understanding deep learning requires rethinking generalization. In Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_1_128_2","doi-asserted-by":"publisher","unstructured":"Chiyuan Zhang Daphne Ippolito Katherine Lee Matthew Jagielski Florian Tram\u00e8r and Nicholas Carlini. 2021. Counterfactual Memorization in Neural Language Models. arxiv:2112.12938 [cs] DOI:10.48550\/arXiv.2112.12938","DOI":"10.48550\/arXiv.2112.12938"},{"key":"e_1_3_1_129_2","unstructured":"Hongyang Zhang Yaodong Yu Jiantao Jiao Eric Xing Laurent El Ghaoui and Michael Jordan. 2019. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference on Machine Learning. 7472\u20137482."},{"key":"e_1_3_1_130_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i9.26329"},{"key":"e_1_3_1_131_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00239"},{"key":"e_1_3_1_132_2","doi-asserted-by":"crossref","unstructured":"Xiaosen Zheng and Jing Jiang. 2022. An empirical study of memorization in NLP. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics. 6265\u20136278.","DOI":"10.18653\/v1\/2022.acl-long.434"},{"key":"e_1_3_1_133_2","first-page":"27367","volume-title":"Proceedings of the 39th International Conference on Machine Learning","author":"Zhou Zhihan","year":"2022","unstructured":"Zhihan Zhou, Jiangchao Yao, Yan-Feng Wang, Bo Han, and Ya Zhang. 2022. Contrastive learning with boosted memorization. In Proceedings of the 39th International Conference on Machine Learning. PMLR, 27367\u201327377."}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3769076","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,25]],"date-time":"2025-10-25T14:16:14Z","timestamp":1761401774000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3769076"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,25]]},"references-count":132,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2026,3,31]]}},"alternative-id":["10.1145\/3769076"],"URL":"https:\/\/doi.org\/10.1145\/3769076","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10,25]]},"assertion":[{"value":"2024-06-14","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-09-15","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-10-25","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}