Memorization in Self-Supervised Learning Improves Downstream Generalization
Authors: Wenhao Wang
Muhammad Ahmad Kaleem
Adam Dziedzic
Michael Backes
Nicolas Papernot
Franziska Boenisch
Venue: ICLR 2024 poster (2024)
Keywords: self-supervised learning
memorization
encoders
generalization
ssl
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning
TL;DR: We introduce a formal definition for memorization in self-supervised learning and provide a thorough empirical evaluation that suggests that encoders require memorization to generalize well to downstream tasks.

Abstract: Self-supervised learning (SSL) has recently received significant attention due to its ability to train high-performance encoders purely on unlabeled data---often scraped from the internet. This data can still be sensitive and empirical evidence suggests that SSL encoders memorize private information of their training data and can disclose them at inference time. Since existing theoretical definitions of memorization from supervised learning rely on labels, they do not transfer to SSL. To address this gap, we propose a framework for defining memorization within the context of SSL. Our definition compares the difference in alignment of representations for data points and their augmented views returned by both encoders that were trained on these data points and encoders that were not. Through comprehensive empirical analysis on diverse encoder architectures and datasets we highlight that even though SSL relies on large datasets and strong augmentations---both known in supervised learning as regularization techniques that reduce overfitting---still significant fractions of training data points experience high memorization. Through our empirical results, we show that this memorization is essential for encoders to achieve higher generalization performance on different downstream tasks.

Published as a conference paper at ICLR 2024
MEMORIZATION IN SELF-SUPERVISED LEARNING IM- PROVES DOWNSTREAM GENERALIZATION
Wenhao Wang"), Muhammad Ahmad Kaleem 2 Adam Dziedzic*
Michael Backes', Nicolas Papernot Franziska Boenisch
CISPA, University of Toronto and Vector Institute
ABSTRACT
Self-supervised learning (SSL) has recently received significant attention due to its ability to train high-performance encoders purely on unlabeled data -otenn scraped from the internet. This data can still be sensitive and empirical evidence suggests that SSL encoders memorize private information of their training data and can disclose them at inference time. Since existing theoretical definitions of memorization from supervised learning rely on labels, they do not transfer to SSL. To address this gap, we propose SSLMem, a framework for defining memorization within SSL. Our definition compares the difference in alignment of representations for data points and their augmented views returned by both encoders that were trained on these data points and encoders that were not. Through comprehensive empirical analysis on diverse encoder architectures and datasets we highlight that even though SSL relies on large datasets and strong augmentations- both known in supervised learning as regularization techniques that reduce overfitting still significant fractions of training data points experience high memorization. Through our empirical results, we show that this memorization essential for encoders to achieve higher generalization performance different downstream tasks.
INTRODUCTION
In recent years, sulf-suuee learning (SSL) has emerged as new potent learning paradigm. SSL encoders can be trained without reliance on labeled data, which is often hard and expensive to obtain. Instead, SSL leverages the existence of large amounts unlabeled data-often scraped from the internet- to obtain state-of- -tate-of-thheart performance in various domains, ranging from computer
vision (He et al. 2022; Chen et al. 2020 Chen & He 2021 Caron et al. 2021) to natural language
processing (Devlin et al. 20118 Radford et al.))
Empirical studies suggest that SSL encoders can disclose information about their training data at inference time (Meehan et al.) 2023). An unintended revelation of private information is often associated to machine learning models' ability to memorize their training data (Zhang et al.) 2016
Arpit et al. 2017 Chatterjee| 2018 Carlini al. 2019 2021 2022). Studies in supervised learning
revealed that mainly mislabeled samples, outliers (Bartlett et al. 2020; Feldman| |2020] Feldman &
Zhang 2020), or data points that were seen towards the end of training (Jagielski et al. [2022] are
memorized and why memorization is crucial for the success of learning (Feldman 20200] Feldman &
Zhang 2020 Arpit et al. 2017 Tirumala al., 2022). Additionally, it was found that in supervised learning memorization happens in the feature extractor (encoder) layers (Feldman & Zhang 2020 Maini et al. (023). Those are exactly the type of layers that SSL trains. Yet, given that SSL differs significantly from supervised learning in terms of learning objective, data processing, and augmentation strength, it remains unclear whether the trends from supervised learning transfer to the sulf-supe learning.
To date, a key limitation for studying memorization in SSL lies in the fact that the theoretical definitions from supervised learning (Feldman 2020) cannot be applied since they rely class labels which are not available in SSL. Existing empirical approaches to assess privacy leakage in
" Equual contribution. Correspondence to: adam.dziedzis @ @printml.ccmm and boenisch foenisch@cispa.de Part of the work was done while the authors were at the University of Toronto and the Vector Institute.

---

Published as a conference paper at ICLR 2024
2 0.8
3
3 3
4
0.4
3
33
6
L
0
6
0.0
3
3
6
6
6
S 0.0
(a) MNIST: class 3 and 6.
(b) CIFARIO: class automobile and ship.
Figure 1: Examples of data with different levels of memorization. Higher memorization scores indicate stronger memorization. We observe that outliers and atypical examples experience higher memorization than more standard samples. Results are obtained on ViT-tiny, trained with MAE,
SSL are equally unsuited to study general SSL memorization since they still assume the existence of labels (Meehan al., (023). Membership inference attacks (Shokri al., 2017) are highly related to memorization. Yet, to date, membership inference in SSL has been solely used to study privacy risks by answering the question whether or not a particular training data point was used to train a given encoder (Liu et al. 2021). Given that memorization is not binary concept, nor property of a particular trained encoder, our work goes beyond prior considerations and uses memorization to study general properties and behavior of SSL methods, such as their generalization capabilities.
Deriving a definition of memorization tailored to SSL and general over all methods comes with severe challenge. In supervised learning, all methods directly optimize for the same objective (high confidence prediction on correct class labels) which creates a strong direct signal that can be measured assess memorization (Feldman 2020). In contrast, different SSL methods solve different optimization tasks in their respective projection spaces. Some methods, for example, minimize the reconstruction loss on an added decoder (He et al.) 2022). others minimize a contrastive non- contrastive loss in an additional projection space (Chen et al. 2020 Chen & He (. None of the methods directly operates on the encoder's 's representations that are eventually used for downstream tasks, and hence of interest for method-independee address this challenge by identifying training data uugmentations and alignment, i.e., similarity in representations over different augmentations of the same training data point, as common elements over all SSL. methods. To define memorization of data point, we consider the difference in alignment of representations for its augmented views produced by encoders that were trained this point and encoders that were not.
general definition of memorization. We
We empirically analyze memorization based on this definition over multiple datasets, encoder architectures, and SSL training methods including contrastive and non-contrastive approaches. Our results highlight that even though SSL relies large datasets and strong augmentations which are known as regularization techniques against overfitting in supervised learning, a significant fraction of data points still experiences high memorization in SSL. Additionally, while the training process of SSL is substantially different from supervised learning, and while no class labels exist that explicitly make data points "outliers", we still observe that atypical data points experience higher levels of memorization than typical ones, a result similar to the supervised setting (Feldman & Zhang (200)). We demonstrate this effect visually in Figure [ Yet, we also find that while different SSL methods and encoder architectures exhibit high memorization on similar set of data points, the data points that are memorized supervised learning differ substantially.
Finally, we turn to the question: why do SSL models memorize? Our analysis reveals that, in similar vein to supervised learning, also SSL, memorization improves downstream generalization. The key insight from empirical evaluation, and the main difference supervised learning. is that this holds over various downstream tasks, i.c., the encoder memorizing data points from one distribution yields better downstream generalization for another distribution. We even observe this effect on non-clan concclassiiicttion downstream tasks, such as semantic segmentation. This highlights that memorization improves SSL's general success various downstream tasks.
In summary, we make the following contributions.
We propose a formal definition of memorization for SSL encoders (SSLMem) that is independent of the training method, its concrete training loss, and that operates directly on the representations.
We empirically evaluate our definition in practice and find that over different architectures and training methods in SSL, there is significant memorization, especially of atypical data points. While the points with the highest memorization scores align between different SSL training methods,
2

---

Published as a conference paper at ICLR 2024
especially when they share the same architecture, they differ more substantially between SSL and supervised learning.
We show that SSL memorization in the encoder increases the downstream generalization over different downstream data distributions and tasks.
2
BACKGROUND AND RELATED WORK
SSL. Self-Supervised Learning (SSL) trains encoder models to transform unlabeled inputs into useful representations which enable sample-efficient learning of multiple downstream tasks (Bengio ct al. 2013). Recently, many methods were proposed for learning from large amount of unlabeled
data in the vision domain (Chen et al. 2020 Chen & He 2021: Caron et al., 2021 Bardes et al., 2022 He et al. 2022). Since our work is focused on providing a universal definition of memorization in SSL, we consider different approaches that rely on three distinct learning objectives. Contrastive learning was pioneered by work on SimCLR (Chen et al.) 2020) where one trains encoders such that augmented views of the same input, also called positive pairs, obtain representations close each other while representations for dissimilar inputs (negative pairs) are repelled from each other. The key properties of contrastive learning with respect to representations are (1) alignment (closeness) of the representations from positive pairs, and (2) sufficient class center separation (divergence) (Huang al. 2023). The foundations for non-contrastive learning (Pokle et al., 2022) were laid by SimSiam (Chen & He 2021) which showed that negative samples are unnecessary to avoid trivial solutions, such as encoder collapse, where the same representation returned for each input. By training with a projection head applied to only one of its Siamese encoders and preventing the gradient from propagating through the other encoder branch, SimSiam is able to generate representations with high alignment and class center separation. DINO (Caron al. 202I) further extended this strategy by minimizing the cross-entropy loss (on latent classes obtained through the training head) instead of negative cosine similarity and decorrelating the two Siamese branches. Finally, masked autoencoding, such as canonical MAE (He et al., (022), trains an asymmetric encoder-decoder architecture instead of two-branched encoders. MAE learns reconstruct randomly masked patches of an input image. By masking high portions (75%) of inputs, this strategy encourages learning useful features and enables better scalability (faster pre-training and less memory consumption), The distinguishing factor between MAE and other SSL encoders is its reliance on the masking of inputs instead of strong dependence on other data augmentations, such as, random cropping or color jitter.
Membership Inference Attacks. The standard approach for measuring how machine learning models leak private information about their training data is through membership inference (Shokri et al. 2017), where an adversary attempts to determine if a particular data point was used to train a given model. EncoderMI (Liu et al. (02T) detects encoder membership by observing that alignment scores for training data points are higher than for points not used in training. While we leverage similar concept to study memorization, we do not narrow our analysis down to quantifying privacy risks of particular encoder. Instead, we use the concept of memorization to study broader properties of SSL. Above all, we establish how memorization influences the downstream generalization.
Memorization. As an important property of learning algorithms and neural networks, memorization has been actively studied in supervised learning (Zhang et al.) 2016 AApit et al.) 2017 Chatterjee 2018, Carlini et al. 2019 | 2022). The fundamental idea to quantify memorization relies on the impact that a single training data point has on the predictions of the resulting models with a larger impact (or increased "hardness" of learning the data point (Arpit al. 2017 Sadrtdinov et al.
202T)) indicating a higher level of memorization (Feldman 2020). While memorization has been
shown to be important for generalization related properties in supervised learning (Feldman 2020 Feldman & Zhang] 2020) or the supervised downstream classifiers within transfer learning (Bansal
et al. 2020), this aspect has not been studied for SSL. The only work which considers memorization in proposes the concept of Déjà Vu memorization (Meehan et al.) (023) and quantifies how much
SSL encoders associate specific views (for example of background crops) with the foreground objects in training images. To assess whether encoder exhibits Déjà Vu memorization for given training data point, the framework obtains the representation for a crop of the data point, and compares the representation with representations of labeled data points from a public dataset that has the same distribution as the encoder's 's training data. If the labels within the k nearest neighbors of the crop in the representation space are highly consistent, the data point is marked as memorized, Since the
3

---

Published as a conference paper at ICLR 2024
core property of SSL is training without labels, the biggest limitation of the Déjà Vu memorization is the assumption about access to labeled data from the same distribution as the training set of the encoder. Additionally, Déjà Vu memorization relies on particular SSL augmentation, namely cropping. However, not all SSL methods use cropping. Finally, SSL encoders are applied to a myriad of downstream tasks other than classification (e.g., multi-label classification, segmentation, depth detection) where the concept of a single class per input does not sxist-rendernng this definition of memorization narrow. Our definition of memorization is based on representations, which are output by all SSL encoders, thus it is independent of particular augmentations, downstream tasks, or the availability of auxiliary information, such as class labels.
3 TOWARDS FORMALIZING MEMORIZATION
Given the absence of labels in SSL, directly applying definitions of general memorization from supervised learning, such as (Feldman 2020), is inadequate. Therefore, we aim at deriving new definition of memorization suitable for SSL and independent of a specific learning framework (e.g., contrastive learning (Chen et al. 2020) or masked autoencoding (He et al. )022
Our definition leverages a common element over all SSL frameworks, namely data augmentations and their alignment. Augmentations refer to different views of data point, generated, for instance, through cropping, masking, or noise addition. Informally speaking, when learning with SSL, the objective is to obtain encoder that achieves low alignment loss different augmented views of a training data point, i.e., an encoder that returns very similar representations on the training data point and its augmentations. Note that different SSL methods, in addition to alignment, optimize implicitly (He et al. 2022, Zhang et al. (2022) or explicitly (Chen et al. 2020) for other objectives, such uniformity. Yet, given that these are not properties of an individual data point but rather of the overall representation space, influenced by multiple data points, we do not include them into the definition of our per-data point memorization] Instead, we use representation alignment between different augmented views of a data point to detect memorization. More concretely, we consider a data point as having a high level of memorization by an encoder / its alignment significantly higher on I than on encoder that was not trained with the considered data point. In the following, we will formalize this intuition and propose our novel definition for memorization in SSL (SSLMem).
3.1 PRELIMINARIES AND PROBLEM SETUP
We present a formal model of SSL learning methods as well as concepts that are relevant to defining memorization, In doing so. we leverage several of the main ideas proposed by recent theoretical work on SSL. (aarulekar et al. 2023 Huang et al. 2023; Wang et al. 2022). Let f I -> R2 be an encoder trained using an SSL. learning algorithm A on an unlabeled training dataset S {x; ) == We assume randomness in the training algorithm, e.g., random weight initializations, such that the final trained encoder f is from a class of possible encoders F. For each data point x, we define an augmentation set Aug(z)= = {a(x)]aa E Aug] where a is an augmentation, i.e., a transformation from R" - R"," and Aug is the set of all possible augmentations. fzx denotes output representation of encoder f for the data point x. We measure the distance between representations of two different augmentations x' and x" of with metric d, e.g., the f2 distance, and define alignment loss over the representations as
E (f.x) xr' Aug((
(df(2)),f(x"))
A standard downstream task for a trained SSL encoder f is classification, where a linear layer Gj is trained to map from the representation space produced by ff to labels (this form of evaluation is also referred as linear probing). With respect to classification, the generalization error of encoder f is defined in terms of the error that classifier Gj achieves. The main connection between a low alignment loss of f over the augmentation set of each training data point and the error of Gy on downstream tasks is based on the overlap of augmentation sets. Considering two data points I1, 22 from the same downstream class, it is likely that they will have overlapping augmentation sets (i.e., 3 d1, ag E Aug s.t. an (21) d2 (x22) (Huang et al. 2023). When the alignment loss decreases, the difference between Aug(#1) and Aug(22) decreases. This will lead to (x((2)) (x2)) also
We provide a formal discussion on the fact that alignment is part of all SSL methods, and what other optimization objectives different methods exhibit in Appendix D.2
4

---

Published as a conference paper at ICLR 2024
decreasing by the triangle inequality Hence 21, 22 will obtain similar representations, facilitating Gy in assigning them the same class label (Huang et al. 2023
3.2 ALIGNMENT AND MEMORIZATION IN SSL
Our definition for memorization in SSL follows the leave-one-out definition of memorization from
supervised learning (Feldman 2020) but instead of focusing on the model behavior w.r.t. ground truth labels (which do not exist in SSL), it is based the alignment loss ( of training data points. Consider a single data point z from dataset S and encoders f E F.9 E 9 trained with SSL algorithm A on S, S \ x (dataset S with removed), respectively. We then define the memorization score m with SS LMeM on x as
(d ((((z))g(a"))) m (x) g~~(()(x)) a" Aug((a)
E. f~A(S)) x' ,"g""
TR
(d (d ((('))
(2)
Here, we take the expectation not only over the set of augmentations of I, but also over two different function classes consisting of all possible encoders f.g which can result from the SSL training algorithm. Specifically, these classes are F = A(S) and g = A(S \ æ). Intuitively, our definition quantifies how the alignment of representations in Aug(z) varies between encoders f and g. Following the intuition from Feldman & Zhang 2020), our memorization score is higher for data point x the alignment changes significantly between J and g. i.e., based on whether x was used for training not. Importantly, alignment and memorization report different concepts: the former is direct property of a given encoder whereas the latter is a result of the relative comparison between different families of encoders. In particular, low alignment loss does not necessarily correspond to high memorization, which we show in Figure 2a (the bottom left corner). To understand why this holds, consider a candidate data point x included in the training set of encoders f E F but not in the one of encoders E G. f can have a low alignment loss but also low memorization on æ. This happens if g has an equally low alignment loss on x as f. for example, because x is easy to learn or similar to other examples in g's training set. Note that we subtract the term for encoders f E F from the term for g E 9 to obtain positive memorization score with the expectation that encoders g which are trained without x usually have higher alignment loss on than encoders f. We provide further theoretical analysis of alignment and memorization for SSL in Appendix D
4 EXPERIMENTAL EVALUATION
To experimentally approximate the memorization score, SSLMem, from Equation (2)
we consider averaging over five random augmentations. We divide the training set S into three disjoint partitions. For example, CIFAR 10, we use 80% of the train data, i.e., 40000 samples as shared training data Ss between encoders I and g. The next 10% of samples, i.e., 5000 are used as candidates Se to evaluate memorization. We add those to the training data of f only, and the remaining 10%, which is another 5000 samples, are used an independent set SJ, on which we do not train f but only g. We also use additional extra set 5g with 5000 samples from the test set, which are data points not used for training of either f or g. Thus encoder f is trained on Sq U USC,, whereas g is trained on Sg U SJ. We measure the memorization on the candidates Se and report their average memorization scores as an aggregate metric. To provide more fine-graines gra-ngr qualitative insights into the memorized samples, we additionally report overviews on the per-data point distributions and zoom into the points that experience the highest memorization. We use 50000 data points as training samples for CIFAR 10, SVHN, and STL10 and 100000 for ImageNet. We set the batch size to 1024 for all our experiments and train for 600 epochs on 10, SVHN, and STL10, and for 300 epochs on ImageNet. As a distance metric to measure representation alignment, we use the & distance. To be able to compare memorization between different SSL methods, we normalize the resulting memorization scores to a range between -1 and 1. A memorization score of 0 denotes no memorization, +1 is the strongest memorization effect on encoder f, and -1 strongest memorization on g. We repeat all experiments with three independent seeds and report the average SSLMem memorization and standard deviation. Our full experimental setup is depicted in Appendix A
We assume that after training Catign (f. 21), Latan x22) < c. When considering the region Aug(æ1) n Aug(2:2).we can find point y in this region so that both of ( f(v) and d(f(22). f(v)) are S c. Now the triangle inequality can be used to obtain (x((), (x2)) < 2c.
5

---

Published as a conference paper at ICLR 2024
Table 1: Higher memorization for more performant encoders. We present the average memo- rization score over the 5000 candidates Sc (SSLMem) and the linear probing accuracy (one layer for classification trained on top of the representations for the respective datasets, Acc.) over various datasets, encoder architectures, and SSL training methods. SimCLR and DINO are trained using ResNet50. MAE and DINO are also trained with the ViT architecture. We use ViT-Tiny for all datasets, apart from ImageNet, for which we use ViT-base.
CIFARIO
SVIE
STLIO
ImtgeNis
metted
Model
Men
Acc. (9))
861Men
Acc. (%)
881Men
Acc. (8)
8.t.eem
Acc. (9)
MAE
67.40%
1.22%
0.271 0-0004
DINO
VET
0,010
76.129
0.998
82.26/8
1.8%%
0.309 1-0.055
68.219
DINO
ReaNe500
0,099
75.39%
11138
0.319
73.02%
1.92%
0,311
68.49
10-
Menurbi Saae
(a) Model Alignment Loss com-
(b) Connection between training loss, downstream accuracy, and
(c) Comparison between memo- rization scores for data subsets Sc, Sr, Sg, and Ss-
puted according to vs. Mem- orization.
memorization scores.
We train an MAE with VIT-tiny on CIFARIO. (a) We plot the alignment loss, computed with the lz distance, of the candidates (with respect to their augmentation) on encoder f and encoder g. The color coding indicates the memorization score with higher scores indicating higher memorization. The lowest alignment loss on f does not yield the highest memorization score, and high memorization can occur at a wide range of aligmment loss values for f. (b) Training loss, downstream accuracy, and memorization over the course of training highlight that memorization is not just an effect of increasing/decrraiinn loss and accuracy stagnate after few hundred epochs, memorization increases. (c) We report the memorization scores for 5000 data points from each subset Sc, S1, Se, and Sş. The encoders exhibit memorization indicated by significantly higher (lower) scores for So (Sy) compared to Sg Sg.
Figure 2: Insights into our memorization score.
accuracy: while
4.1 MEMORIZATION OVER DIFFERENT ARCHITECTURES, SSL METHODS AND DATASETS
We assess memorization over different encoder architectures, SSL training methods, and datasets and report the results in Table 1 Our analysis of memorization shows correlation between downstream task accuracy and the average memorization score. This trend holds for SimCLR on CIFAR1O, SVHN, and STL10, and for DINO on ImageNet, where these methods achieve the highest accuracy and the biggest average SSLMeM memorization score, while MAE exhibits the lowest scores on both measures across all four considered datasets. We present additional results the impact of type and strength of augmentations and the training method on memorization in Appendix BB Overall, greater average SSLMem memorization appears be associated with superior downstream performance. Yet, as we illustrate in Figure 2b alignment and accuracy are distinct metrics. Training loss and accuracy plateau after a few hundred epochs, but memorization continues increasing with longer training. This holds both over the entire candidate-set, and especially for the 10% most memorized homples-highlightee that more epochs lead to higher memorization. This insight decouples the the measures of accuracy and memorization in terms of training dynamics.
4.2 INSIGHTS ON THE MEMORIZATION SCORE
The results shown in Figure 2c demonstrate that our memorization score hehaves as expected. Memo- rization significantly increase above 0 for the candidate samples Se used during training of encoder i for which we want to capture memorization, significantly decrease below O for the independent samples S, used for training of encoder g. while remaining around 0 for the shared samples Sş or extra data points Sg not seen during training. We formally verify that data points from Se (S,) have statistically significantly higher (lower) SSI SSLMem memorization scores m than those from Ss and SE.

---

Published as a conference paper at ICLR 2024
61/
601
6335
3000
030
140
Hunber of Farsovdd Samples
Samples
Sunder Nemovet Samples
(a) On CIFARIO
(b) On CIFAR100
(c) On STLIO
Figure 3: The influence of memorization on downstream generalization (CIFAR1O). We train an MAE model based on the VIT-tiny architecture on CIFARIO 10 and remove [500, 1k. 2k, 4k, 8k. 16k] most memorized vs. random data points from the encoder's training data. We measure downstream accuracy through linear probing on CIFARIO, 10, CIFAR 100, and STL10. The removal of memorized data points harms accuracy over all downstream tasks more than the removal of random data points.
Table 3: Evaluating the effect of memorization on semantic segmentation downstream task.
Without removing
Removing 10000
Removing 20000
Memorized
Random
Memorized
Random
mIoU
45.4 69,89% + 0.84%
44.8 13% = 0.92%
45.1
43.8 66.51% + 1.03%
44.4 67.58% = 0.82%
Acc. (%)
68.91% + 0.77%
The mean memorization scores are as follows for each of the subsets: 0.30723 for Sc, -0.00136 for Ss, 0.09958 for Sg, and -0.31182 for Sy. Using a t-test with 5000 memorization scores per each data subset, we test the null hypothesis Ho m((c) S m(Ss). Rejecting this hypothesis (p-value < 0.01) indicates the memorization m is significantly higher for points in Sc than for points in Sg. Our results reject Ho with small p-value near O and large effect size of 86.82, which indicates that observed difference is not only statistically significant but also meaningful. We show the results of the statistical tests for all the considered data subsets in Table [ They support the claim that Sc (S)) is substantially more (less) memorized than Sş and Sg. We also observe that memorization scores for both Sg and Sş have their peaks close to O. There is a difference in the mean scores between Sg than Sş since data points from Sg are not seen during training of neither f g while data points from Ss are used for the training of both and g. We present further analysis in Appendix C
Table 2: Results of statistical t-tests.
Nuil By Mithheis
p-talla: cffis sioc
No mn Se) mm(8g)
86.32
76. mi (8p) (8a)
60:44
No m8)8)
(8))
85.46
He mL8e) mm))))
113.56
4.3 MEMORIZED DATA POINTS
Additionally, we analyze what types of data points are memorized. In Figure I we already showed visually that, similar to supervised learning, atypical examples experience higher memorization in SSL than standard data points. Additionally, we show in Figure aand Table 13 in Appendix [B. thatt SSL and supervised learning differ notably in the data points that they assign the highest memorization scores to while the SSL setups memorize in a more similar way. Especially, the SSL setups that share the same training method or the same encoder architecture are most consistent.
4.4 MEMORIZATION IN SSL. REQUIRED FOR DOWNSTREAM GENERALIZATION
Classification. We empirically analyze how memorization impacts downstream generalization to classification tasks by removing the most memorized data points from the training data of an encoder and assessing its linear probing accuracy on downstream tasks. More concretely, we train f and encoders with MAE using the ViT-tiny architecture on disjoint 25k data points from the CIFARIO 10 training dataset. Then, we measure the memorization scores over encoder and remove the [500, 1k, 2k, 4k, 8k, 16k] data points with the highest memorization scores from training. We do the same for randomly chosen [500, 1k, 2k, 4k, 8k, 16k] data points from encoder f and compare downstream accuracy on multiple downstream tasks through linear probing on both these setups. Our results in Figure highlight that removing the memorized data points harms downstream accuracy stronger
7

---

Published as a conference paper at ICLR 2024
than removing random data points. This does not only hold when the SSL encoder was trained with the same dataset as the downstream task but also when the downstream task comes from a different distribution (STL10) or has a different number of classes (CIFARI00) In Appendix [B.2 and Appendix B.5, we show that this trend holds over different training and downstream datasets.
Semantic Segmentation. In a similar evaluation setup, for semantic segmentation downstream tasks, we pre-train a ViT-base with MAE on ImageNet, evaluate memorization, and remove the top [10k, 20k] memorized vs. random data points from the encoder's 'ss pre-training data. We end-to-end fine-tune the resulting encoders with UperNet (Xiao et al. (2018) on the ADE20K dataset. We measure downstream aceuracy on ImageNet for the fine-tuned encoder through linear probing and the semantic segmentation performance with the mean Intersection of Union (mloU). Removing memorized samples from pre- ure-training harms downstream performance on the semantic segmentation more than removing random samples, even after independent end-to-end fine-tuning. In Appendix B.2 we show similar results for the downstream task of depth estimation.
The observations on the interplay between memorization in SSL and its impact on the performance on diverse downstream tasks is a core result of this work. highlighting the importance of memorization for generalization of encoders, beyond the encoders own training distribution. To further validate the result, we investigate the effect of limiting alignment during the encoder training on both memorization and downstream accuracy. With alignment limited through regularization, the difference between encoders f and on data points that were in the training set of f but not of should decrease, which would result in decreased memorization score. To implement this intuition, we extend the loss function during training with an additional term as:
Lioaal (J, (1 X) (J,z) ー
(d (J(())
ar. Aug(ar)
The additional term
E
(d((())) directly penalizes representations of a data point
and its augmentation set for being too close. The parameter À quantifies regularization strength with smaller values representing weaker regularization. Note that this regularization term does not directly invert the effect of SSL training which does not optimize directly on the representation space. For example, MAE training loss is calculated on the decoder output space for the reconstructed samples. Other SSL methods, such as SimSiam and SimCLR, map representations to the output space of the projection head where the loss is applied. In contrast, our reg- ularization term operates directly on the representations themselves, in order to ensure an explicit control of the alignment.
0064
We evaluate the effect of the additional loss term in Figure tiny model, trained with MAE on CIFAR 10 (solid lines) and SVHN (dashed lines) under different values for A. In the implementation, we instantiate d with the & distance and take the expectations over two random augmentations of the original data point. We calculate both loss terms over a whole mini-batci batch, not single data point, with a mini-batchy size of 256. Our results demonstrate that increasing regularization strength (higher X) reduces model memorization. Concurrently, downstream accuracy from linear probing also decreases. This aligns with previous work showing that better alignment enables better generalization on downstream tasks (Huang al. 2023). We expand upon these analyses by highlighting that limiting memorization capabilities negatively impacts encoder performance.
4 for a VIT-
Figure 4: Limiting memo- rization harms downstream accuracy.
4.5 COMPARISON TO PRIOR WORK
The Déjà Vu memorization and our memorization score capture different phenomena and measure memorization in distinct ways. Déja Vu memorization reports the fraction of data points classified as memorized based on label consistency with nearby points from the labeled dataset. Our method measures per-point memorization scores and reports the average score over the candidates. Despite the divergent methodologies underpinning each memorization score, we nonetheless endeavor to analyze whether the two scores show similar trends. We report our results in Table We observe that both memorization scores are higher on CIFARIO than on ImageNet. We reason that the memorization is easier CIFAR10 due to lowes--iiensionallty of CIFAR10 10 than ImageNet, smaller number of
8

---

Published as a conference paper at ICLR 2024
Table 4: Comparing our average SSLMem memorization score with Déjà Vu memorization. We train different model types and measure the memorization with our framework (SSLMem) and the Déjà Vu memorization (Déjà Vu Mem.) (Meehan et 2023
CIFARIO
ImageNet
Model
S30Nem
Doja Vo Mem.
Acc (8)
98 Lee
Doja Vo Mem.
Acc (%)
MAE
0.307 + 0.013
27.36% 1.50%
67.40% +: 1.10%
0.271 + 0.004
21.30% + 0.31%
60.43% 1.18%
DINO
0.334 + 0.010
25.52% + 0.98%
76.12% + 0.79%
0,309 + 0.015
20.08% + 0.62%
68.21% = 1.55%
VICReg
0.012
25.20% 0.49%
76.46% +:
+: 0.010
20.62% + 1.11%
69.05% 1.08%
training data points, and using encoders with the same number of parameters for both datasets. We observe key divergence between the two memorization scores MAE encoders. Specifically, Déjà Vu produces much higher memorization scores for MAE compared to other SSL methods. In contrast, our SSLMem memorization score yields lower scores for MAE than for other SSL methods. We hypothesize that this is due to MAE's training approach which heavily masks input patches, and thereby creates a strong correlation between some background fragments and a foreground object which can be exploited by Déjà Vu. The other SSL methods rely on additional or different augmentations that cannot be so effectively leveraged by Déjà Vu. Our analyses indicate that the specific augmentations employed do not show statistically significant effect on our SST.em.
4.6 DIFFERENTIAL PRIVACY
Differential privacy (Dwork 2006) provides mathematically rig- orous protections against privacy leakage. This framework for- malizes the intuition that any individual data point should have negligible influence on the analysis of an entire dataset. In ma- chine learning, differential privacy is often implemented through the DP-SGD algorithm (Abadi et al. 2016). which introduces controlled noise during training and bounds the influence of each individual data point on model updates. However, DP-SGD has a limited compatibility with many self-supervised learning paradigms, wherein individual samples influence model updates across their entire mini-batch. Nonetheless. Yu et al. (2023) recently proposed a differentially private training framework for MAE encoders. Our analysis shows that indeed encoders trained with DP-SGD demonstrate reduced memorization. To assess its effect our SSLMeM memorization score, train SSL encoders with the framework by Yu et al. (2023) on MAE and the ViT-tiny architecture. We train for 1000 epochs CIFAR10 using all default parameters from that work Yu et al.) 2023) apart from their large mini- sizes that do not match the limited availability of data in CIFARIO. To report standard, non- non-private baseline, i.e., E 00, train standard MAE. Our results in Table 5 show that whilst differential privacy indeed reduces memorization depending on the privacy parameter e, it also substantially reduces downstream accuracy. This can be seen as another indicator that learning abilities in SSL suffer without memorization.
Table 5: Effect of differential privacy.
3StMem
Acc. (%)
0.307 1 0.013
69.40% 1.12%
20 0.182 + 0.009
54.22% 0.98%
8
0,107 + 0.012
33.66% 1.76%
5 CONCLUSION
SSL has emerged dominant paradigm for training encoders, since it can leverage the abundant amounts of available unlabeled data to create high-quality feature extractors. However, despite their unprecedented performance, the memorization property of self-supervised encoders remain unexplored. Due to the lack of labels, a structured assessment of memorization, as commonly done in supervised learning, could not be conducted previously. We close this gap by providing an analysis of encoder memorization in SSL. Therefore, we first propose a definition for memorization based on augmentations and alignment of positive pairs-the the common elements throughout all SSL. methods. Our SS SSLMem definition reflects SSL's lack of ground-truth labels, generalizes across different encoder architectures and SSL training algorithms, and is independent of any downstream task. Crucially, we demonstrate that self-supervised encoders do memorize training data points, especially atypical examples. Further, we empirically show that memorization improves generalization on various downstream tasks, even beyond the encoder's pre-training data and its distribution, and beyond simple single label classification tasks. This establishes memorization as a key property of self-supervieed feature learning.

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGMENTS
We would like acknowledge our sponsors, who support our research with financial and in-kind contributions:
Amazon, Apple, CIFAR through the Canada CIFAR AI Chair, DARPA through the GARD project, Intel, Meta, NSERC through the Discovery Grant, the Ontario Early Researcher Award, and the Sloan Foundation. Resources used in preparing this research were provided, in part, by the Province of Ontario, the Government of Canada through CIFAR, and companies sponsoring the Vector Institute.
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Sanjeev Arora, Hrishikesh Khandeparkar, Mikhail Khodak, Orestis Plevrakis, and Nikunj Saun- shi. A theoretical analysis of contrastive unsupervised representation learning. arXiv preprint 19XV::1902.09229. 2019.
Devansh Arpit, Stanislaw Jastrzebski, Nicolas Ballas, David Krueger, Emmanuel Bengio, Maxinder Kanwal, Tegan Maharaj, Asja Fischer, Aaron Courville, Yoshua Bengio, et al. A closer look at memorization in deep networks. In Interaational conference on machine learning, pp. 233-242.
PMLR, 2017.
Yamini Bansal, Gal Kaplun, and Boaz Barak. For self-supervised learning, rationality implies generalization, provably. In International Conference on Learning Represeniations, 2020.
Adrien Bardes, Jean Ponce, and Yann LeCun. VICReg: Variane-iivariinc--ovvaaane regularization for self-supervised learning. In International Conference Learning Representations, 2022. URL
net www.eeeetouuueeeee
forum? Picimmmiiixeeeee 6 6D 2D1Ubb
Peter L Bartlett, Philip M Long, Gábor Lugosi, and Alexander Tsigler. Benign overfitting in linear regression. Proceedings of the National Academy of Sciences, 117(499:30063-30070 2020.
Yoshua Bengio, Aaron Courville, and Pascal Vincent. Representation learning: A review and new perspectives. IEEE Transactions on Pattern Analysis and Machine Intelligence, 35(8):1798-1888 2013. doi: 10.11099/PMM...00135555
Vivien Cabannes, Bobak Kiani, Randall Balestriero, Yann LeCun, and Alberto Bietti. The ssl interplay: Augmentations, inductive bias, and generalization. International Conference on Machine Learning, pp. 3252-3298. PMLR, 2023.
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. 28th USENIX Security Symposium (USENIX Security 19), pp. 267-284, 2019.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. 30th USENIX Security Symposium (USENIX Security 21), pp- 2633-2650, 2021.
Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nicolas Papernot, Andreas Terzis, and Florian Tramer. The privacy onion effeet: Memorization is relative. Advances in Neural Information Processing Systems, 11111363--32766 2022.
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties self-supervised vision transformers. In Proceedings of the IEFF/CVF international conference computer vision, pp. 9650-9660, 2021.
Satrajit Chatterjee. Learning and memorization. International conference on machine learning, pp. 755-763. PMLR, 2018.
10

---

Published as a conference paper at ICLR 2024
Ting Chen, Simon Korblithh, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning, pp- 1597-1607. PMLR, 2020.
Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 15750-15758, 2021.
Adam Coates, Andrew Ng. and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. Proceedings of the fourteenth international conference on artificial intelligence and statistics, pp. 215 223. JMLR Workshop and Conference Proceedings, 2011.
Jacob Devlin, Ming-Wo Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint 1rXiv:1810.0400 2018.
Cynthia Dwork. Differential privacy. In International colloquium on automata, languages, and programming, pp. 1-12. Springer, 2006.
Vitaly Feldman. Does learning require memorization? a short tale about long tail. In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, pp. 954-959, 2020.
Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. Advances in Neural Information Processing Systems, 33:2881-2891 2020.
Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 16000-16009, 2022.
Tianyu Hua, Wenxiao Wang, Zihui Xue, Sucheng Ren, Yue Wang, and Hang Zhao. On feature decor- relation in self-supervised learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 9598-9608, 2021.
Weiran Huang, Mingyang Yi, Xuyang Zhao, and Zihao Jiang. Towards the generalization of contrastive self-supervised learning. In The Eleventh International Conference on Learning Representations, 2023.
Matthew Jagielski, Om Thakkar, Florian Tramer, Daphne Ippolito, Katherine Lee, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradeep Guha Thakurta, Nicolas Papernot, al. Mcasuring forgetting of memorized training examples. In The Eleventh International Conference on Learning Representations, 2022.
Li Jing, Pascal Vincent. Yann LeCun, and Yuandong Tian. Understanding dimensional collapse in contrastive self-supervised learning, In International Conference on Learning Representations, 2022. URL httpt::::///// /tttps:://ppnzeeiee.. net http://www...eeeooe.eeeeeeeeesSe
Zach Jorgensen, Ting Yu, and Graham Cormode. Conservative or liberal? personalized differential privacy. In 2015 IEEE 3/St international conference on data engineering, pp. 1023-1034. IEEE, 2015.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Hongbin Liu, Jinyuan Jia, Wenjie Qu, and Neil Zhenqiang Gong. Encodermi: Membership inference against pre-trained encoders in contrastive learning. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 2081-2095, 2021.
Pratyush Maini, Michael C Mozer, Hanie Sedghi, Zachary C Lipton, J Zico Kolter, and Chiyuan Zhang. Can neural network memorization be localized? arXiv preprint 2rXiv:2307.09542, 2023.
Casey Meehan, Florian Bordes, Pascal Vincent, Kamalika Chaudhuri, and Chuan Guo. Do ssi models have déjà vu? case of unintended memorization in sele-supe learning. arXiv e-prints, pp. arXiv-2304, 2023.
Pushmeet Kohli Nathan Silberman, Derek Hoiem and Rob Fergus. Indoor segmentation and support inference from rghd images. In ECCV, 2012.

---

Published as a conference paper at ICLR 2024
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Advait Parulekar, Liam Collins, Karthikeyan Shanmugam, Aryan Mokhtari, and Sanjay Shakkottai, Infonce loss provably learns cluster-presen preservni representations. arXiv preprint arXiv:2302.07920, 2023.
Mansheej Paul, Surya Ganguli, and Gintare Karolina Dziugaite. Deep learning on a data diet: Finding important examples early in training. Advances in Neural Information Processing Systems, 34: 20596-20607, 2021.
Ashwini Pokle, Jinjin Tian, Yuchen Li, and Andrej Risteski. Contrasting the landscape of contrastive and non-contrastive learning. In Gustau Camps-Vale Francisco R. Ruiz, and Isabel Valera (eds.), Proceedings The 25th International Conference on Artificial Intelligecce and Statistics, volume 151 of Proceedings of Machine Learning Research, pp. 8592-86886 8618. PMLR, 28 Mar 2022. URL http:s:://poceedeeeeeeeeee .mr.rngsmmm.....mmmm...m....mmmm htt.oeedddnn.........rrs////////
html
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. The Journal of Machine Learning Research, 21 211))548555555 2020.
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Medical Image Computing and Computer-Assistee Intervention-MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part III 18, pp. 234 234-241. Springer, 2015.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang. Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 11::211-252 2015.
Ildus Sadrtdinov, Nadezhda Chirkova, and Ekaterina Lobacheva. On the memorization properties of contrastive learning. arXiv preprint arXiv:2107.10113, 2021.
Ozan Sener and Silvio Savarese. Active learning for convolutional neural networks: A core-set approach. In International Conference on Learning Representations, 2018.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium security and privacy (SP), pp. 3-18. IEEE, 2017.
Kushal Tirumala, Aram Markosyan, Luke Zettlemoyer, and Armen Aghajanyan. Memorization without overfitting: Analyzing the training dynamics of large language models. Advances in Neural Information Processing Systems, 35:38274-38290, 2022.
Ivor W Tsang, James T Kwok, Pak-Ming Cheung, and Nello Cristianini. Core vector machines: Fast svm training on very large data sets. Journal of Machine Learning Research, 6(4). 2005.
Yifei Wang, Qi Zhang, Yisen Wang, Jiansheng Yang, and Zhouchen Lin. Chaos is ladder: A new theoretical understanding of contrastive learning via augmentation overlap. arXiv preprint arXiv:2203. 13457, 2022.
Tete Xiao, Yingeheng Liu, Bolei Zhou, Yuning Jiang, and Jian Sun. Unified perceptual parsing for scene understanding, In Proceedings of the European conference computer vision (ECCV), pp. 418-434, 2018
Yaodong Yu, Maziar Sanjabi, Yi Ma, Kamalika Chaudhuri, and Chuan Guo. Vip: A differentially private foundation model for computer vision. arXiv preprint arXiv:2306. 08842, 2023.
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understand- ing deep learning requires rethinking generalization. In International Conference on Learning Representations, 2016.
12

---

Published as a conference paper at ICLR 2024
Qi Zhang, Yifei Wang, and Yisen Wang. How mask matters: Towards theoretical understandings of masked autoencoders. Advances in Neural Information Processing Systems, 35:27127-2711 12999 2022.
Bolei Zhou, Hang Zhao, Xavier Puig, Tete Xiao, Sanja Fidler, Adela Barriuso, and Antonio Torralba. Semantic understanding of scenes through the ade20k dataset. International Journal of Computer Vision, 127:302-321,
A EXPERIMENTAL SETUP
We validate algorithms mainly on four state-of-art SSL. encoders: MAE (He al. 2022).
SimCLR (Chen et al., 2020), DINO (Caron et al. (021), and VicReg (Bardes et al. 2022) We train
these encoders for 300 epochs with ImageNet ILSVRC-2012 (Russakovsky al. 2015) and 600
epoch with CIFAR 10 (Krizhevsky et al.
2009), CIFAR 100 (Krizhevsky et al. 2009) SVHN (Netzer
al., 201T), and STLIO(Coates et al.
2011). All other settings for model training and evaluating
(linear-rrobing) are shown in Table 6 The ImageNet and STL10 based encoders are trained on a server with NVIDIA-A 100 GPUs. CIFARIO, CIFAR 100, and SVHN-based encoders and
linear probing evaluation are performed on 4090 GPU server with an Intel 13700K processor and 64G RAM. To measure memorization, we divide the datasets as follows: For CIFARIO, CIFARI00, SVHN, and STL10 dataset, use 40000 shared training samples Sş and 2 sets of 5000 non- overlapping training samples as Sc and Sy. For ImageNet, Ss comprises 85000 samples and Sc and Sy comprise again 5000 samples each.
Normalization. We normalize the representations output by encoders f and g in the by norm. Then, calculate the differences in alignment loss per data sample z over both encoders. Afterwards, normalize these differences by dividing them by the range (largest minus smallest difference), and report the memorization score the average of the resulting scores over all data points in Sc.
Semantic Segmentation Setup. To evaluate the effect of our memorization on semantic segmenta- tion, we end-to-end fine-tune ImageNet-basee MAE encoders (ViT-base) the ADE20K (Zhoul et al. 2019) dataset with UperNet (Xiao et al., 2018) for semantic segmentation. We perform 100 epochs of fine-tuning with batch size of 16. The learning rate follows the "poly" learning rate
schedule with initial learning rate of 0.02. The relative position bias (Raffel et al. 2020 is only applied during end-to-end fine-tuning.
Depth Estimation Setup. In a similar vein to the semantic segmentation, for depth estimation experiment, we end-to-end fine-tune our ImageNet-based MAE encoders (ViT-base) with UNet convolutional neural network (Ronneberger et al., 2015) on the NYU-Depth v2 (Nathan Silberman & Fergus 2012). We report the quality of the depth estimation through the Root Mean Square Error (RMSE), which is defined as:
m
Σ p=1
)2
71
where Up is the true depth from the NYU-Depth v2 dataset and yp is the predicted depth from the model. The smaller the RMSE, the better the performance of the model.
Measuring Memorization. We calculate the memorization score on the full representations re- turned by the encoders. Especially, for the ViT-based experiments, we concatenate the patch- based representations into one representation vector. This yields the following dimensionalties for ViT-tiny: 192x257 = 49344, for ViT-base: 197*768 151296, 296, for ResNet50: 49*2048 100352. Note that particular downstream tasks with the ViT encoders use different parts of the representations. For example, for classification, only the representation of the CLS-token (the first of the 257 outputs) is used. For semantic segmentation, only outputs 2-257 are used. Even though increases compute time, decided to compute the memorization score over the entire returned representation make our score independent of the downstream task. As a consequence of the significant difference in output dimensionality, and the fact that calculate alignment loss with the l distance,
13

---

Published as a conference paper at ICLR 2024
Table Experimental Setup. We provide details on our setup for encoder training and evaluation.
Model Training
Lincar Probing
MAF
SimCT R
DINO
VicReg
MAR
SimCI R
DINO
VicRef
Truining Epoch
(Imagenet/ athers)
300
300 600
600
990
45/90
Warm-up Epoch
(Imagenet/ others)
30/ 60
30 60
30/ 60
30 60
1/10
5/
5/10
5/10
Batch Size
2048
4096
1024
256
4096
4096
4096
4096
Optimizer
Adam
LARS
AdamW
SGD
LARS
LARS
LARS
LARS
Learning rale
1.2e-3
4.8
2e-3
30-3
1.6
4.8
1.6
1.6
Learning rate Schedule
Cos. Decay
Cos. Decay
Cos. Devay
Cos. Decay
Cos. Decay
Cos. Decay
Cos. Decuy
Cos. Decay
format for epoch number ImageNet/ Other
Table 7: Impact of the fraction of overlap between f and g. We repeated experiments from Table 1 with ResNet50 trained with SimCLR on CIFARIO with different splits for the overlap (70% overlap. and 85% overlap). For the best comparability, we made sure to have the same number of training data points over all setups (45k).
Sg. and
Sc
S
SSLMem
Acc. (%)
35k (70%)
10k
10k
0.325 + 0.008
77.95% + 1.23%
40k (80%)
5k
5k
0.339 = 0.011
77.12% + 1.42%
42.5 (85%)
2.5k
2.5k
0.337 + 0.010
76.84% + 0.85%
A.1 EXPERIMENTALLI APPROXIMATING OUR MEMORIZATION SCORE
A completely faithful assessment of our definition of memorization (Equation would involve, per data point, training multiple encoders with and without this data point and evaluating their representations. Given the large number of parameters and the high number of training epochs required to train in SSL, this is computationally prohibitive. This suggests that, for our experimentation, we have to approximate the memorization score. There are multiple ways do so with their own advantages and drawbacks. We present the possibility in the following and motivate the choice of our approximation.
Disjoint subsets between if and g. In as similar vein to Meehan et al. (2023) we could train f and g completely disjoint subsets of the original training dataset (e.g.. 25k+25k in the CIFARI0 case). Yet, in this setup, given that the two encoders' training data differs in all data points, it becomes increasingly hard attribute the difference in their behavior to individual data points. This motivates our choice to have joint training set Sş between f and and make them differ only in a subset of samples. Ideally, this subset would be small as possible more faithfully assess the impact of each individual data point. However, choosing smaller subsets leaves us with less samples to evaluate. To address this trade-off, we decided to make f and g overlap in 80% and differ in 10% of their data sets' initial size, and take this 10% data only used for f as candidates. We carried out additional experiments to showcase that the memorization score does not change with higher overlapping ratios (85%) but decreases for smaller ratios (70%) in Table 7 Thus, the ratios below 80% do not provide us with a sufficiently precise measure of memorization and that our choice of 80% is sufficient to well approximate the metric while being computationally efficient and allowing assess the largest possible number of training data points at the same time.
Removing or replacing data points in g. After deciding in how many data points f and should differ, the next choice is regarding how to modify the training data of g. Our definition of memorization indicates that the candidates should be removed without replacement in g. This enables to clearly measure their effect on training without having potentially different data point interfere. However, we empirically observed that removing 10% of the training data leaves y with generally worse alignment than f. This would skew the memorization score (because the alignment loss of would be generally higher). As solution, decided not simply remove the candidates for training g. but to replace them with an independent data subset S, of same size from the same distribution.
14

---

Published as a conference paper at ICLR 2024
8/
20 CA
60
(a) ImageNet
CIFARIO
(c) MNIST
Figure 5: Influence of the memorization threshold. Using the MAE- model, we depict what fraction of data points from the respective candidate dataset would be classified as memorized by our definition when choosing the memorization threshold according to the number depicted on the x-axis.
Table 8: Impact of measuring memorization with different augmentations than the ones used during training. We train ResNet50 on CIFARIO with SimCLR and measure the memorization score with different augmentations.
Augmentation for Measurement
Average SSLMem Memorization
SimCLR original
0.339 = 0.011
GaussianNoise (mean=0 and std=0.2)
0.321 0.014
Rotate 90"
0.308 = 0.009
Rotate 270'
0.328 0.011
ColorDrop 0.25
0.298 # 0.006
A.2 THRESHOLDING OF OUR MEMORIZATION SCORE
One important consideration regarding the memorization score concerns the question When a data point memorized? This question could be addressed by setting threshold the memorization score that categorizes samples into memorized and non-memorized. Yet, this would indicate that memorization is binary concept, and it would involve the choice of threshold. Since this threshold would have to be set arbitrarily (with respect to some desired outcome, like obtaining a certain fraction of memorized data points), refrain from this choice and rather report the continuous memorization scores. The continuous scale captures nuanced differences in how strongly various data points affect each encoder. Additionally, we show Figure SegureeJhor how the number of samples classified as memorized would change for different memorization value thresholds. This further illustrates that our memorization score forms continuous spectrum. We present additional structured insights into our memorization score in Appendix C
B ADDITIONAL EXPERIMENTAL RESULTS
B.1 THE INFLUENCE OF AUGMENTATIONS
We study the impact of the type of augmentations used for training the average memorization and the linear probing accuracy at the example for SimCLR with ResNet50 encoder on the CIFARIO dataset. We show that cropping causes larger average memorization than noise addition or masking. Intuitively, this makes sense given that our memorization score relies on representation alignment where the noised version of red and a blue car are still far away in input space and, therefore, might result in different representations, whereas a crop of their window or tire might be very similar, resulting in well-aligned representation (Huang et al. 2023). Again, we observe that this closely related to the linear probing accuracy.
We additionally study the impact of augmentation strength in form of the masking ratio MAE. We observe that average memorization peaks at 75% masking ratio, again, aligned with the highest linear probing accuracy.. We present our results in Table
Finally, in Table 8 we depict the impact of measuring memorization with different set of augmen- tations than the ones used during training. We experimented with ResNet50 trained on CIFARIO by SimCLR (77.12% accuracy the downstream classifier). SimCLR originally uses the follow- ing augmentations: RundomReesizedCrop(22 Handlommorizontaallipp----000 ColorJitter(O.4 0.4, 0.4, 0.1. p=0.8), and Random(Grgyscale(00022.) The results indicate that using the same original
15

---

Published as a conference paper at ICLR 2024
Table The effect of different type and strength of augmentations on memorization. We train on the CIFARIO 10 dataset and measure the effect of different augmentation types (for SimCLR) and augmentations strengths (in the form of the masking ratio in MAE) on the average memorization score and linear probing accuracy.
masking
Mom Frac.
Tincur probing
Arg. Mem.
linesr prohing ace (9)
50%
0.283 4: 0.010
62.09% 0.43%
crop (unly)
74.51%
75%
1:
random Goussaan nouse
cruperesize
0.319 + 0.006
0.326 1: 0.014
71.94%
75.22%
0.96%
1.62%
80%
90%
0.249 1: 0.009
0.500 + 0.001
65 06% + 1. 1.35%
58.77% à: 1.26%
random masking (75% MAD)
0,288 0,012
63.71%
1.06%
(b) Different augmentation strengths implemented
(a) Different augmentation types for SimCLR trained with ResNet50.
through different masking ratios in MAE with the VIT Tiny architecture.
Table 10: Evaluating the effect of memorization on a depth estimation. We pre-train a ViT-base with MAE on ImageNet and remove the top [10k, 20k] memorized vs. random data points. We end-to-end fine-tune the resulting encoders on the NYU-Depth v2 (Nathan Silberman & Fergus 2012). We report the quality of the depth estimation through the Root Mean Square Error (RMSE).
Without removing
Removing 10000
Removing 20000
Memorized
Random
Memorized
Random
RMSE Acc. (%)
0.289 70.22% + 1.15% 69.10% 0. 0.88%
0.295
0.292 69.61% + 0.98%
0.311
0.302
67.31% + 1.36%
68. 18.28% + 1.02%
augmentations that were used during training also for measuring memorization yields the highest memorization score, i.e, gives the strongest signal to measure memorization. Yet, the other aug- mentations' scores are not significantly different, and hence can be used equally to approximate the degree of memorization.
B.2 LINK BETWEEN MEMORIZATION AND GENERALIZATION
Classification. In similar vein Figure 3 in the main paper, we repeat the experiment and pretrain the encoder on STL Figure 6 and CTFAR 100 Figure 7 We remove the top memorized vs. random data points and measure linear probing accuracy on CIFARIO. CIFARIO0, and STL10. Our results show that over all datasets, even though they have different numbers of classes, or come from different distributions, it holds that the removal of memorized data points has a more detrimental effect to accuracy than the removal of random points. Results for more fine-grained datasets (ImageNet, Food- 101, and Flower102) can be found in Appendix B.5
Depth Estimation. In similar vein to the segmentation downstream task, we pre-train ViT-base with MAE on ImageNet, evaluate memorization, and remove the top [10k, 20k] memorized vs. random data points from the encoder's pre-training data. We end-to-end fine-tune the resulting encoders on the NYU-Depth v2 (Nathan Silberman & Fergus 2012). We measure downstream accuracy on ImageNet for the fine-tuned encoder through linear probing and the quality the depth estimation through the Root Mean Square Error (RMSE). Smaller RMSE indicates a better depth estimation. Our results in Table TO highhight that removing memorized samples from pre-training harms downstream performance on the depth estimation more than removing random samples.
B.3 MEMORIZATION IN SUPERVISED LEARNING AND SSL
Analyzing supervised models' internal representations with SSIMem. To analyze memorization in supervised learning with our score, we train a ResNet50 in a supervised way on CIFAR10, using the cross-entropy loss. Then, we turn the resulting model in into an encoder by removing the last (classification) layer. We train the supervised model for a numbers of epochs. After 10 epochs, the accuracy of the model roughly matches the linear probing accuracy of the encoder trained with DINO. After 100 epochs of supervised training, the training loss plateaus. We repeat the experiment three times and report the average and standard deviation. The results are reported in Table [ Our results highlight the supervised models trained until convergence have the highest memorization score,
16

---

Published as a conference paper at ICLR 2024
340
(a) On CIFARIO
(b) On CIFARI00
(c) On STL10
Figure 6: The influence memorization on downstream generalization (STL10), We train an MAE model based on the VIT-tiny architecture STL10 and remove [500, 1k, 2k, 4k, 8k, 16k] most memorized vs. random data points from the encoder's training data. We measure downstream accuracy through linear probing CIFARIO, CIFARIO0 and STL10. The removal of memorized data points harms accuracy over all downstream tasks more than the removal of random data points.
(a) On CIFARIO
(b) On CIFAR100
(c) On STL10
Figure The influence of memorization on downstream generalization (CIFARI00). We train an MAE model based on the VIT-tiny architecture on CIFAR 100 and remove (500, 1k, 2k, 4k, 8k, 16k] most memorized vs. random data points from the encoder's training data. We measure downstream accuracy through linear probing on CIFARIO, CIFAR 100, and STL1O. The removal of memorized data points harms accuracy over all downstream tasks more than the removal of random data points.
which is direct consequence of the high number of training iterations over the training data points. Encoders trained with SSL for the same number of epochs experience a significantly lower average memorization. When considering models that are aligned in downstream performance (supervised 10 epochs, vs. SSL 300 epochs), the computed memorization scores are comparable. Yet, as we will show in Appendix Bnpendix[B.4]sseee section, the two learning paradigms differ significantly in what types of data points they memorize.
Comparing most memorized points from SSLMem and supervised learning. We also assessed whether our score highlights the same data points as highly memorized as the metric proposed for supervised learning by (Feldman) 2020).. Therefore, we trained a model f and a model y (both ResNet50 CIFAR10) in supervised manner. For best comparability with 40k data points overlap between the two models and 5k difference. On the 5k data points used to train ff but not g. calculated the difference in softmax outputs between f and g. The data points with the highest difference are the ones with the highest memorization according to /Feldman (2020). To calculate our metric on the same models, we removed the classification layer and then calculated our metric on the output representations. We present the ten most memorized data points identified by both methods in Figure g Additionally, we analyze the overlap between both methods in Table [2 The results indicate that there is a roughly 50% overlap between the most memorized samples Identified by both methods, and that the ranking between the samples similarly consistent as the rankings by our SSLMem method over different SSI. frameworks (see Table (3).
results, chose
B.4 ANALYSIS OF MEMORIZED SAMPLES
We set out to perform an in-depth analysis of the memorized samples. In particular, we compare the samples memorized by different SSL. frameworks and architectures, and the difference in mem-
17

---

Published as a conference paper at ICLR 2024
Table 11: Impact of training paradigm on memorization. We train ResNet50 in supervised manner with CIFARIO, IO, and then remove the classification head to keep only the encoder part. We also train the ResNet50 with DINO an SSL manner. We compare the average memorization and the linear probing accuracy of both resulting encoders.
Training Method
Avg. Mem.
Linear Probing Acc. (%)
Supervised (100 epoch)
0.398 + 0.010
90.10% + 1.34%
SSL (100 epoch)
0.314 + 0.011
69.12% + 0.87%
SSL (300 epoch)
0.327 = 0.009
75.39% = 1.15%
Supervised (10 epoch)
0.327 = 0.014
75.16% + 0.99%
Ours
Horse /T
Dog /T Cat T
Frog /
Cat /T
Ship
Truck
Frog /T
Cat /T
Bird F
Feldman
Frag /
Dog T Frog / Truck
Bird
Horse
Cat
Car TT
Frog /T
Cat
Figure 8: Most memorized data points identified with our SSLMem (Feldman 2020). We plot ten data points from CIFARIO with the highest memorization according to our memorization score and the metric for memorization in supervised learning proposed by |ellmaan (2020). We observe a high overlap between the most memorized samples identified by both methods.
orized samples between SSL and supervised learning. To obtain the highly memorized samples from supervised learning according to our score, we rely on the process described in the previous Section
We first visually inspect the samples that experience the highest memorization over all frameworks in Figure 9 Overall, the highest memorized samples seem be more consistent between the different SSI. frameworks than between SSI. and supervised learning. This holds for both the supervised models, the one that is trained 100 epochs and the one that trained 10 epochs, and thereby matches downstream performance of the SSL encoders (see Table IT). To quantify this visual impression, analyze the rankings memorization scores over the 5000 candidates for all different setups with pairwise Kendall's Tau test. We present the results in Table 13 The null-hypothesis of the test an absence of association between the two rankings, which means that when we have a p-value below 0.05, i.e., when can reject the null-hypothesis, there is association in the ranking. In the table, we indeed observe that the consistency between the rankings of memorization scores between different SSL frameworks is higher than the consistency between SSL and supervised models. In addition, among different SSL frameworks, the ones that share the same architecture (or training method) have higher consistency.
B.5 EXTENDED ANALYSIS ON MORE DATASETS AND MODEL. ARCHITECTURES
We present empirical evaluation the effect of removing memorized random samples more fine- fine-graing grained datasets in Table 14
Additionally, in Table 15 different depths (ResNet50 vs ResNet30), and widths (Wide-ResNil ResNet). Our results show how the memorization score differs for various number of parameters and their arrangement and how it can influence the memorization score. We observe that with more parameters, encoders have higher memorization capacity.
also report results for the same architectural family (ResNet) with
C MEMORIZATION SCORES
We make the following observations based Figure 2c Table and Table 16
18

---

Published as a conference paper at ICLR 2024
Table 12: Consistency between most memorized data points identified with our SSIMem vs (Feldman 2020) We depict the consistency between the [10,20,50,75,] 15.50,,,,,00,1555 150, most memorized data points identified by our metric and the metric for supervised learning proposed by Feldman (2020). The first row shows the percentage of overlap and the second one the results of the statistical Kendall's Tau Test as r-Statistic p-value.
Within first X samples
10
20
50
75
100
1.0
200
Overlap
50.0%
35.0%
48.0%
42.0%
39.0%:
41.3%
44.0%
Kendall's s Tau Test
0.099 / 0.584 0.124 1224/0.30 0.332 0.162/ 0.2//.000 107 0.158 4158/5422.2
0.188 / 33211..2 0.174/9.66e-
0.192/ 5.4ee4
Table 13: Results of Kendall's Tau Test. We test consistency of the rankings statistically of 5000
candidates over all models used for evaluation in this paper. Note that the score symmetrie, We repeat the values in gray for the reader's convenience.
MAE ViT-tiny
DINO VIT-riny
DINO
SimCLR ResNet
Supervised
Supervised
ResNet
ResNer, 100 epochs ResNet, 10 epochs
MAE (VIT-iay)
1,0/0
0.235/2.264
0.218/8.7e99
0.207
5.1e
0.083 5.6e-5
0.104 / 1.3e 0.092/ 3.2e-5
DINO tin)-
0.225
1,0/0
0.258/9.8e-12
0.214/ 1.0e:8
0.074/9.8e.4
DINO (ResNet)
0.218/8.769 8.76-9
2.8811
1,0/0
0.255 1,99c11
0.091 3.44--
7.7766
SimCLR (ResNet)
0.207 5.1c-8
0.214/1000
05.551
1.0/0
0,104/ 1,20-5
0.096 1.226/2..2e-
Supervised (ResNet), 100 epochs
0.083 5.6e-
49874/9.e-4
0,104
0.131
Supervised (ResNet), 10 epachs
0.104/ 1.3e-5
0.092/3.2e5
0.112/9.7e.6
0.096/2.2e /2.2e.5
0,131
/2.3e-
1.0/0
the format for all data r-Statistic/ p-value
If the shared set Ss is used in both f and g encoders, then the distribution of memorization scores for the data points from Sş approximately follow Gaussian distribution with O-mean. The memorization scores for the data points from Ss are close to (concentrates at)
The memorization scores for the candidates Se used only in the training of encoder f are significantly above O.
3. The memorization scores for the independent Sy data points included in the training of only g are significantly below 0.
4. Data points from Sc have statistically significantly and meaningfully higher memorization scores than those from Sy and Sg-
Data points from S have statistically significantly and meaningfully lower memorization scores than those from Sg and Sg.
Memorization scores are close to for both Sg and Ss and they approximately follow the Gaussian distribution. There is difference in the mean scores between SE than Ss since data points from Sg are seen during training of neither f nor g while data points from Sg are used for the training of both f and
D EXTENDED ANALYSIS OF MEMORIZATION IN SSL
D.1 ADDITIONAL. BACKGROUND ON SSI.
Many theoretical works SSL., perform their analyses under the assumption that the training dataset S in SSL comes from an underlying unlabeled data distribution D which is modeled as having K disjoint latent classes fi,....," I'K (Arora information about 'D and the latent classes is not known during training. However, the concept of latent classes helps define structure of the data distribution and is helpful for analyzing the performance of f, e.g., on downstream tasks. A commonly used assumption is that augmentations preserve the latent classes, iee,, if x Н', Aug(z: (x) C Tx (Wang et al. 2022).
2019). Owing to the unlabeled nature of S,
D.2 ANALYSIS OF SSL FRAMEWORKS AND ALIGNMENT
Standard SSL loss functions like the InfoNCE loss (see Equation alignment and uniformity terms.
5 can be decomposed into
19

---

Published as a conference paper at ICLR 2024
MAE ViT-tiny
ship
airplane
deer
frog
airplane deer
frog
frog
DINO ViT-tiny
ship
cat
airplane frog
frog
bird
cat
airplane frog cat
DINO Resnet50
cat
ship
deer
deer bird
frog
bird
frog airplane cat
SimCLR Resnet50
frog
cat
cat
airplane ship bird
frog deer bird airplane
Supervised Resnet50
(100 epoch)
horse
GAt
frog
cat
ship
truck
frog
cat
bird
Supervised Resnet50
(10 epoch)
airplane
frag
airplane
ship
airplane
truck
cat
bird
cat
frog
Figure 9: Samples with highest memorization over different SSL frameworks and encoder architectures. We depict per setup the top 10 data points with the highest memorization scores and their ground-truth labels.
Table 14: Evaluating the effect of memorization downstream tasks. We pre-train ViT-base
with MAE on ImageNet and remove the top [10k, 20k] memorized vs. random data points. We casure downstream accuracy through linear probing on ImageNet, Food-101, and Flower102. The removal of memorized data points harms accuracy over all downstream tasks more than the removal of random data points.
Without removing
Removing 10000 Random
Removinn 20000
Memorized
Memorized
Random
ImageNet
68.21% 0.98%
64.33% 0.56==0..80 0.84%
66.82 66.82% 0.77%
58.90s I 1.05%
62.88% 0.77%
Food-101
58.96% 1.33%
15.15%%
36.83% 1.13%
50.07% 0.76%
53.14% 1.21
Hlwer102
60.11% 1.12%
56.27% 1.14%
58.08% 0.89%
$1.482 1.01%
55.29z 0.93%
<(f.)) -
g Augtt)
B
log expls(a) (6))
(6>)))
Σ (x) (((7)))
(5)
stmAug(s):da, 1
alignment
uniformity
Zhang et al. (2022) show that MAE also implicitly aligns the mask-induced positive pairs. This is done through the masking, where the autoencoder is forced to reconstruct the same original image from two potentially disjoint (differently masked) views. MAE aligns explicitly in the output space, however, the decoder part is very shallow (< 10% of the encoder) and translates to the alignment in the latent feature space. This directly applies to other SSI. frameworks which also append the additional shallow projection heads the encoders and explicitly align only the final outputs instead of representations. The main difference between MAE and other SSL frameworks is a lack of the uniformity in the representation space, where the learned features lic in low dimensional subspace (Hua et al. 2021 Jing et al. (022). The recovery of uniformity in MAE requires further is negative pair of x (different data points than 4). This reduces our definition of memorization to alignment (with augmentations) the common property of the representations across all the considered SSL
enhancement of its loss with the additional term E, (z)=(( fx==))((=>)))))))))>) })}² where
methods.
D.3 INTUITION BEHIND OUR MEMORIZATION SCORE
To provide intuition behind why it is meaningful to define memorization based on the alignment loss of data points and one-dimensional input and latent space (so that the data can be defined with the a coordinate and the representation with the y coordinate) which visualize in Figure The example highlights how
the leave-one-out style definition, present simple example with
20

---

Published as a conference paper at ICLR 2024
Table 15: Evaluation of memorization on different architectures. We train encoders with different backbone architectures using SimCLR on CIFARIO. We report the average memorization of SSLMem together with the resulting linear probing accuracy and the number of model parameters.
Architecture
SäLKem
Acc.
# of Parameterrs
Wide-ResNer50-2
0.350 + 0,008
81.23%
1.01%
69M
ResNer50
0.339 + 0.011
77.12% * 1.2%%
25M
ResNett8
0.315# 0.013
71.07% 1.08%
Table 16: More results of statistical t-tests. We provide evidence that the memorization scores are: for Sc significantly above 0, for Sy significantly below O. The test is inconclusive for the hypothesis that scores for Ss are equal or below O. This indicates that the scores are not significantly different from We also observe that the scores for Sg are significantly above 0 but still significantly below the scores for Sc.
Null Hypothesis
p-value
effect
Ho = m((c) <
101.24
Ho m(Sr)
0
100.42
No = 0 m[5p] Ss)
0.471
0.821
m(Sg)
Ho = (Se) m(5))
0
60.44
data point x selected either as a standard in in-distribution or outlier data point impacts the training algorithm and can cause different levels of memorization.
Reprosmattor
(a) Case 1: x is a standard data point.
(b) Case 2: x is an outlier data point.
Figure 10: Intuition for the memorization of data points. We provide simple one-dimensional example to build the intuition behind our definition memorization. On the x-axis, we depict the input dimension and on the y-axis the representations returned by encoders f and g. In (a), the data point x which / is trained on and g is not, is a standard "inlier" data point. In (b), x is an atypical data point or "outlier".
Assume without the loss of generality that there are two latent classes, I1, I2 in the data space. The augmentation sets form regions around the training data points which are represented by circles around the points in Figure 10 We assume that the latent classes have central clusters where all data points have augmentation sets which overlap with at least one other augmentation set (this is similar to (Huang et al. (223)). Let these central clusters be 1 C Pi and 1 C I'2 respectively. To further simplify the example, we will assume that the overlap is such that for any x; in T or r2, the whole augmentation set Aug(r;) is involved in the overlap.
In our example, we consider the effect of training encoders f E L.e. encoders trained on S including x. and encoders G, i.e., encoders trained on S We assume that encoders f and g trained until their respective training losses (over all training datapoints individually) are smaller than some constant Specifically, we assume stronger notion of alignment, namely c-strong alignment:
Definition 1 (c-Strong Alignment). We say that an encoder J satisfies e-strong alignment on datapoint xr; if x', x" E Aug( d(I())), S
The difference between this definition and the standard definition of alignment is that the expected value has been replaced with a for all operator. We also assume that all possible functions ff and T.-Lipschitz continuous iee, d(f(x:) ((z) Tl|a xall Van, 22. This assumption has been
21

---

Published as a conference paper at ICLR 2024
used by prior works on SSL e.g. (Huang et al. assume that they are normalized with I (z,)
2023). Finally, when dealing with representations,
(9(2 r.
To analyze memorization with our leave-one-out definition (Definition22 2). will examine two main cases. First, we consider the case where x is a standard data point from 1 as in Figure 10a Then, we know that every point in Aug(z) is also member of Aug(z;) for some i. Thus, even though there is no explicit constraint on the alignment of g during training, this overlap will mean implicitly that d(g(x"), (xx")) S 6 for any x', ,² Aug(z) that (g) S b c for all g G. Here, b is a constant and is related to the fact that there may be multiple augmentation sets that need to be traversed, when going from x' to z". Meanwhile, by assumption during training, we know directly that Calign (f, z) S c fVfE E F.
Second, we consider the case where data point an outlier as in Figure 10b In this case, the augmentation set Aug(z) does not overlap with other data points from S. Then there is no explicit or implicit constraint in the training objective for encoders g and thus no upper bound on the alignment of g æ. Therefore, the overall function class G consisting of all possible encoders g is now superset of G from the first example. Hence, the alignment of g on æ now has a strictly higher value than in our first example. Meanwhile, encoders / have the same constraint so that F will have the same alignment loss as in the first case. Therefore, considering the difference Egeg Calign (g. x) E (f: x), this case has a strictly higher difference and thus higher memorization scores.
To summarize, in the first case the behaviour of models f F and g E G does not differ significantly on due to the implicit constraints. In contrast, in the second case, there is more significant difference where only model f's behavior is significantly shaped by x, indicating a higher level of memorization.
D.4 THE LINK BETWEEN MEMORIZATION AND GENERALIZATION
In the context of supervised learning. Feldman 2020) has shown that memorization of outlier data points is required to achieve close optimal generalization error natural data distributions, where data often follows long-tailed distribution. Even though the concept of labels does not exist in SSL, we show in this section that memorization of outlier examples is still highly relevant to obtaining good generalization. While we measure memorization on the level of SSL encoders' representations, following prior work, e.g., |Huang et al. (2023); Cabannes et al. (2023), we focus our notion of generalization on the level of downstream lasks, as these types of tasks are typical use-cases of SSL models. To this end, in this section, we consider classification downstream tasks, and, as discussed in the problem setup, we consider the error that classifier Gy achieves on downstream tasks from the same/different distributions as the unlabeled encoder training data. For analysis purposes, assume that Gy is a nearest centroids classifier that Gy (z) arg mi [z) Mkl Il. with μæ E (xz) Huang et al. (2023) has shown that this is a special case of a general linear classifier.
When revisiting the intuition on memorization described in the previous section (Appendix D.3 observe that for encoders E G, the aligmment loss is unlikely to be low in regions of the data space with outliers. In contrast, for encoders f E F, we observe good alignment over regions where outliers are present. We visualize this effect for a synthetic two dimensional data distribution in Figure II
We now describe this property more concretely and provide guarantees for the associated error that the downstream classifier will achieve. Our analysis will be centered around particular outlier datapoint x and the generalization error will be estimated with a testing dataset Suest = {21...... } consisting of points not used during training. We start by presenting some supporting definitions which will be helpful for this analysis.
Definition 2 (o-overlap). We say that the augmentation set of a datapoint z satisfies o-overlap if there exists region Aug (z) C Aug(z) which overlaps with the augmentation set of a training datapoint 2; S and that Plb Aug" (x)] 2 Plb Aug(z)).
Definition 3 (B-close). We say that datapoint z is B-close training datapoint I; S if minz;EAug(r;; | 2|| = 3.
The following lemma presents a simple upper bound on the difference between the representations f() and f(z)) for any test datapoint 2;-
22

---

Published as a conference paper at ICLR 2024
0,000
0.029
5.-
10-
255
0.015
0.015
0.--
-15
dmal
2.010
00000
-5.0
dhos2
outfless a
-5
0,005
-5-
0.005
autteess 12
0,000
0.000
(a) Data distribution.
(b) Model f
(c) Model
Figure 1I: Training with outliers yields lower alignment loss over additional regions of the representation space. (a) We generate two dimensional distribution of data that consists of two latent classes. For each latent class, we have central part and one outlier example. Then, we train two encoders with the InfoNCE loss loss-f with the outliers, and g without-the map from the data to a one dimensional representation space. (b) shows that by training with outliers, the resulting model gets lower alignment loss in locations where there were outliers, whereas see in (c) that when training without outliers, only the alignment loss in the main data cluster regions is decreased.
Lemma 4. Given an encoder f satisfying e-strong alignment over point x and a test datapoint 24 E Steat which satiisfess 3e-closeness point z. f(f( = L3 c
Proof. Follows directly from the triangle inequality. We have ((a))(())=
f(,) where x' is the point obtained from Definition 3 Then (x), = -(a)il [1[(x) - [ax']] | [= (=))ll c+ L- Br where c-strong alignment and the Lipschitz property have been used.
Similarly, we can upper bound the alignment loss Catiga(f, zi) with the following lemma. Lemma 5. Given an encoder I with Lutign (f, S e and point z; which satisfies a-overlap with point H, Latign zi) S - (1 (1-o) L. Eg (d" (ugge))) ="1l
Proof.
Latign (J, 24) E (([('), f(="))
P(b Aug(z) n lb E Aug Aug(=:)] (
Plb E Aug(z;) (Aug(æ) Aug(z:)) Aug(z:)) (egpereeaeecciieeaetneeeeeeeeeed
(a)
x r c + (1 - 0) (
(("))
(b)
I + (1 0) L E.
z"|1
where (a) follows from the definition of Latign x) and (b) follows from Lipschitzness.
Note that for the purpose of these lemmas, we assume that d is the & norm. We are now ready to analyze the relationship between the generalization eтror and memorization. We will compare between two algorithms A1 where A₁ has greater degree memorization on data point x. We will then show that models f1 Fi (S)) will likely have a lower generalization error than models f2 ~ F2 = Az(S). We start by selecting the test points 2; which are 3, close to xr for 3, < B, where 3 is selected upper bound, e.g., f. Without loss of generality, let these points be 21...., Zt. Given that æ is an outlier datapoint, we now treat as being part of a K + 1st latent class, where the only datapoint from this latent class to appear in the training dataset S is In other words, x can be seen as a singleton example (Feldman 2020). On the basis of closeness in the data space, will then also assume that all of 21...., 2, belong to the same latent class i.e. to I T++1-
We now claim that for cases where the complexity of encoders learnt by algorithms AI, is the same and where learning a good representation is not trivial, Es,5,, (f1,
23

---

Published as a conference paper at ICLR 2024
Table 17: Training on the most memorized data points. We traine a ResNet50 on SimCLR with CIFARIO (25k training data points) and calculated the memorization score over all data points. We then train again from scratch with the [25k (all), 24k, 22k, 20k, 16k, 12k] most memorized data points. We report linear probing accuracy on CIFARIO, CIFARIO0 100, and STLIO. Our results highlight that by training on the most memorized data points, we can outperform or match the performance of the encoder trained on the full 25k data points.
Retained Points
CIFARIO
CIFARI00
STL10
25k (full encoder)
63.3% = 0.92%
61.1%#1.14%%
61.6%=0.83%%
24k (most memorized)
64.4% + 1.03%
61.31...8%%
61.7=1.18% %
22k (most memorized)
63.8% + 0.76%
61.8++1.22 1.24%
62.4+ %
20k (most memorized)
63.2% + 1.07%
60.8%+00.68%
61.1+.005%
16k (most memorized)
61.8 1.11%
58.4%10.91%%
59.910.89%
12k (most memorized)
59.7% + 0.74 %
13.6%+1332%
55.24:1.24%
Ejany, Latign (f2, r). This is because for models f2. the point x is not memorized and thus Lalign (/2, x) &s Calign (92, .)) which we can expect will be larger than the alignment loss when including a as a training data point. Note that here we also use the fact that the range of possi- ble values the alignment loss can take are the same for both algorithms since 0 S Lalign 2r as a result of the representations being normalized. With this claim, we can then assume that en- coders fi satisfy c-strong aligmment for some value of c, based on which Lemma will imply that d(íi (ar), (2:)) < L + for 1 I i S t. Meanwhile, encoders f2 do not have such a guarantee and thus while there may exist some encoders f2 which do satisfy this bound, in expectation we will likely have d(f2(x), f2(2)) ((),
We now analyze the error of the linear classifier on the datapoints Z1,.... Zt. From the form of the models GG, we know that the decision rule is to select class K + if [I/(==) px++ < [z. uull Vk S K. In this case, since x is the only training point from latent class K + 1, pK+1 fz)) Now while reasoning about the class centers is difficult based on single datapoint changing and the different algorithms that are used, we note that a smaller value of (ff((z). (z))
can help encoders f1- Given that the upper bound on the alignment (Lemma 4 is certain hold for encoders fi, we can thus have provable guarantees on the error the classifier achieves over these testing datapoints (assuming sufficient class center separation). For encoders f2, it is unlikely that all encoders will lead to good predictive accuracy of the classifiers. Therefore, we can see relationship between memorization of the datapoint x and the (average) error of the classifiers on nearby datapoints (which is component of the overall generalization error). This can thus show a potential correlation between memorization and generalization error. We leave more thorough investigation of this concept to future work.
D.5 PRACTICAL. IMPLICATIONS OF MEMORIZATION
While our work is interested in studying the fundamental properties of SSL memorization deepen our understanding of this learning paradigm and to reveal similarities and dissimilarties with super- vised learning and between different SSL frameworks, it also has some practical implications.
Data Privacy. Our method supports studying which data points experience highest memorization by the encoder. These data points are particularly prone to privacy leakage. Based on the insights from our memorization score, depending on the type of use case of such encoders, appropriate action (such as differential privacy, potentially with stronger guarantees for the memorized data points (Jorgensen jet al. 2015)) can taken during or after the training to limit the leakage.
Coreset Selection. We also show that our method is related to the research line of coreset selec- tion (Paul et al. 2021 Sener & Savarese 2018 Tsang et al. 2005), i.e., the identification of (smaller) data subsets that can be leveraged for training more efficiently while obtaining the same performance. In the same setup as Figure 3 in Section 4.4 4.4, we trained a ResNet50 on SimCLR with CIFAR10 (25k training data points) and calculated the memorization score over all data points. We then trained the model again from scratch with the [25k (all), 24k, 22k, 20k, 16k, 12k] most memorized data
24

---

Published as a conference paper at ICLR 2024
points. We report the downstream accuracy CIFARIO, CIFARIO0, and STLIO in Table 17 Our results highlight that by training only on the subset most memorized data points, we can even outperform the encoder trained the full dataset, match its performance with significantly smaller training dataset (up to 25% smaller). Thereby, our method can lead to new learning strategies that could dramatically (1) reduce training times and (2) reduce data and memory requirements for the SSL encoders (which are both extremely high under current methods).
25


Reviews:
[{"review_id": "codnOxVTwE", "reviewer": "Reviewer_fWKE", "summary": "In this paper the authors propose SSLMem, a framework for defining memorization within Self Supervise Learning (SSL). The authors base their framework analyzing the  difference in alignment of representations for data points and their augmented views returned by encoders. They show an empirical analysis on diverse encoder architectures and datasets, highlighting that significant fractions of training data points experience memorization, and highlight that memorization is essential for encoders to achieve generalization performance on downstream tasks.", "questions": "Does a particular augmentation or a set of augmentations plays a role in this empirical evaluation?\n\nHow does similar data samples play a role with respect to the memorization vs generalization claims?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "-good presentation and writhing\n\n-easy flow of argumentation\n\n-interesting and valuable insights related to the interplay between memorization and generalization", "weaknesses": "-importance and influence of the augmentations, it would have been nice to see does a particular or a set of augmentations plays a role in this empirical evaluation, also instead of the augmentations, how similar data samples play a role it would be interesting to analyze\n\n-regarding the experiment considering differential privacy, only one algorithm was evaluated, I was not able to see other evidence (evaluation using different setups and algorithms) that supports the case about memorization in this context", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6x2QScBiLF", "reviewer": "Reviewer_tPGb", "summary": "The paper proposes a way to measure memorization at the representation level, which is applicable to SSL approaches, in contrast to previous work quantifying memorization in supervised learning. The memorization metric is based on measuring differences in alignment between different views of the same input point, between models trained with and without the specific point.\nWith their new measure, the authors investigate the degree of memorization in encoder models using different architectures, trained on different datasets and using different SSL approaches. They find that SSL-trained models exhibit memorization and that the degree of memorization benefits downstream performance.", "questions": "- Does the metric agree with previous metrics for quantifying memorization in supervised learning? I.e. given a supervised learning model (where you can apply prior supervised learning work), would the metric highlight the same points as memorized as previous metrics for supervised learning?\n- How dependent is the metric on the types of data augmentations used? I.e. if a model was trained with masking, would the metric also be able to quantify memorization under e.g. rotation or noise augmentations?\n- What are atypical datapoints? Is the judgement of typicality just based on visual inspection or are there other indicators as well?\n- The idea behind the metric is that quantifying memorization via alignment differences between different augmentations of the same input point is the common denominator between different SSL approaches (contrastive, non-contrastive, reconstruction-based). Would it be possible to define a \"stronger\" notion of memorization if one were to only consider one family of SSL approaches, e.g. contrastive ones?\n\n### Suggestions:\n- Giving the memorization metric a name would make it easier to refer to it.\n- Given that the proposed metric operates at the representation level, it might be interesting to quantify memorization at intermediate layers in the model, to potentially localize where it is happening.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Relevance: Understanding memorization is an important problem, which is challenging and underexplored in the SSL domain. The paper makes an important contribution in conceptualizing memorization in this space, as well as proposing a corresponding measure. Further, a representation-level measure of memorization is a valuable tool that could be applied in other interesting ways as well, such as localizing memorization in models.\n- Soundness: The experiments are thorough and the methodology is solid.\n- Presentation: The paper is well written and easy to follow.\n\n### Neutral:\n- Novelty: The findings seem to be similar to those made for supervised learning, i.e. that memorization benefits generalization, as well as atypical points exhibiting more memorization. However, SSL approaches use a different learning paradigm, so it is not a priori clear whether one should expect similar trends to hold. It is therefore interesting to see that similar dynamics hold for SSL models as well.", "weaknesses": "- The results seem to show that memorization benefits downstream performance. However, *why* this is happening is not quite clear to me. For instance, when removing points with high memorization scores from the training data, does the performance of the model primarily drop on points \"similar\" to the removed ones? If this was the case, memorization here might actually be more of a long-tail generalization phenomenon.\n- In Section 4.4, Eq. (3) you limit the degree of alignment between representations. However, in addition to reducing memorization, this intervention might also degrade the representations in other ways. Therefore, it's not clear to me whether we can conclude that a reduction in memorization is causing a drop in accuracy, or whether both might just be consequences of a degradation in representation quality due to the regularization.\n- There are some smaller clarity issues:\n    1. In Section 4, first paragraph, what is the normalization procedure applied to constrain memorization scores between -1 and 1?\n    2. You say that experiments are repeated over three independent seeds. Does that mean you use different data splits for each seed or just different weight initializations of the models?\n    3. Table 1, what is \"Frac. Mem.\"? Is it the same as \"Avg. Mem.\" defined in the caption?\n    4. In 4.4, do you remove the 500, 1K, etc. datapoints with highest memorization from the set of 25K points, or from the full CIFAR10 training set?\n    5. In 4.4, why do you use cosine similarity here vs l2 distance earlier?\n    6. In 4.5, what does the term \"exploited\" in the context of Deja Vu mean? Would you expect MAE to exhibit higher memorization?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "aUlVJAb9Wt", "reviewer": "Reviewer_mj5F", "summary": "The authors address an interesting issue in self-supervised learning (SSL): the impact of memorization on both SSL and its effects on downstream tasks. They examine the dissimilarity in the representations alignment between augmented views produced by encoders trained on a specific point and those that were not. This problem statement holds relevance in light of the current privacy concerns surrounding deep learning models", "questions": "- “we consider a data point as having a high level of memorization by an encoder $f$ if its alignment is significantly higher on $f$ than on encoder g that was not trained with the considered data point” – Why is this the case? Are there any exceptions where this doesn't hold true?\n\n- I understand that the memorization score is relative. However, can one freely choose $g$ as our interest primarily lies in $f$? Have you conducted any ablation studies on the choice of model architectures for $g$ while keeping $f$ constant? Is it necessary for both $g$ and $f$ to share the same architecture?\n\n- What if $g$ is pre-trained on a large but distinct dataset instead of being randomly initialized? Would that result in a reduced memorization score?\"\n\n- The training data is divided into 80%, 10%, and 10%. The last two sets do not overlap between $g$ and $f$. How does memorization change when we vary the overlapping ratios from 80% to 70%, 50%, and 30%?\n\n- “We formally verify that data points from Sc (Si ) have statistically significantly higher (lower) memorization scores m than those from Ss and Se.”\n“They support the claim that Sc (Si ) is substantially more (less) memorized than Ss and\nSe”.\nWhy is it the case that Sc is substantially more memorized than Ss? Isn't this because memorization is a relative score, and Ss was used to train both $g$ and $f$?\n\nI find this work quite interesting overall. However, in its current form, it lacks sufficient intuition to answer 'why' questions such as:\n\n- Why does memorization lead to generalization?\n- Why is the proposed metric suitable for measuring memorization?\n- Why were certain design choices made, like training percentages and architecture selections for $g$ and $f$?\n\nThe authors need to provide more comprehensive reasoning for their results. Simply presenting empirical findings is insufficient and can lead to confusion for readers.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- It is true that there are not many works addressing the memorization vs. generalization aspect of SSL. This paper aims to address this important issue.\n\n- The proposed method is agnostic to SSL methods and augmentations, making it applicable in various cases.\n\n- It is an insightful study in the right direction. Understanding memorization significantly impacts the generalization of SSL models. The authors have done an excellent job with their extensive empirical analysis.", "weaknesses": "- There are several works discussing the issue of memorization in self-supervised learning, which haven't received thorough attention in the literature review. While I understand that not all of these works are directly related, a broader discussion of related literature would enhance the paper's readability (e.g., [1, 2]).\n\n- In the machine learning research community, it's generally accepted that there exists a tension between memorization and generalization. However, I would appreciate more clarity and intuition from the authors regarding why memorization leads to improved generalization.\n\n- Although the memorization score is simple, model- and augmentation-agnostic, it lacks intuitive explanations and theoretical background. It would be beneficial for the authors to provide reasons for why this score measures memorization and offer any applicable theoretical support.\n\n- Regarding the statement, \"Our definition compares the difference in alignment of representations for data points and their augmented views returned by both encoders that were trained on these data points and encoders that were not,\" I'd like to seek clarification. It seems that the training sets of g and f overlap. Could you please provide a justification for this design choice? I had expected a distinct encoder with a different training set or random initialization.\n\n- Considering the proposed metric and previous works in supervised learning, it appears that the contributions are more incremental than novel.\n\n[1] Sadrtdinov, Ildus, Nadezhda Chirkova, and Ekaterina Lobacheva. \"On the Memorization Properties of Contrastive Learning.\" arXiv preprint arXiv:2107.10143 (2021).\n\n[2] Bansal, Yamini, Gal Kaplun, and Boaz Barak. \"For self-supervised learning, Rationality implies generalization, provably.\" ICLR 2020.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "meFifnYRr9", "reviewer": "Reviewer_ukN9", "summary": "This paper proposes a novel framework that defines memorization within the context of self-supervised learning (SSL). This definition compares the difference in alignment of representations for data points and their augmented views returned by encoders that were trained on these data points and encoders that were not. Empirical analysis on diverse encoder architectures and data sets demonstrate that significant fractions of training data points experience high memorization in SSL, and memorization is essential for encoders to achieve higher generalization performance on different downstream tasks.", "questions": "- The definition of (per-example) memorization score is a bit strange. From my perspective, a higher memorization score indicates that sample $x$ has larger impact to model performance. As such, it seems natural that pre-trained models with higher memorization perform well on downstream tasks: if not, it means all training samples do not contribute much to pre-training, and it will be strange that pre-training on such data set produces good models. Some more explanations may be needed on why we need to introduce memorization score here, instead of some other performance metrics. \n- Also, it would be better if the authors can show some connections between other metrics on generalization (examples may be found in [1]) and the proposed memorization score. It would be useful to see how good final performance comes from higher memorization scores beyond simply putting them together. \n- While the authors claimed that their experiments cover different architectures and downstream data sets, the experiments seem a bit restricted from my perspective. For architectures, it would be better if the authors can report i) same architecture (e.g., ResNet) with different depths, widths, etc. and ii) similar number of parameters with different architectures (ViT and ResNet here). That will make the experimental results more comprehensive and we may also gain some insights on how memorization differs across different architectural settings\n- Also, downstream data sets used in current paper (CIFAR-10/100, SVHN, STL-10, ImageNet) are all coarse-grained general classification data sets. The authors may consider also adding some experiments on fine-grained data sets (e.g, Food-101 or Flower102, which are popularly used in literature) and see if their conclusions are changed. \n- Regarding experiments on removing samples for downstream tasks, the performance gap seems not so large. What will happen if we directly try to remove some samples to obtain largest performance drop? Will these samples found have larger memorization scores? Some additional experiments are welcome. \n- I also wonder how it is connected to research on coresets [2], which aims to find a (small) subset of training data that can help obtain models with performances close to full training data. The authors may report something opposite to Figure 3 and Table 3: solely train on samples with high memorization scores, and see how the model works.  \n\nReferences: \n\n[1] Fantastic Generalization Measures and Where to Find Them. ICLR 2020\n\n[2] Deep Learning on a Data Diet: Finding Important Examples Early in Training. NeurIPS 2021", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The authors propose a novel definition that generalizes memorization effect to self-supervised learning, which can be useful for understanding model generalization\n- This paper is easy to understand", "weaknesses": "- The proposed framework lacks enough practical implications. It is not so clear how we should treat samples with higher/lower memorization scores differently. \n- Several claims are subject to challenge, as can be found in Questions part. \n- Empirical results may be further improved, including more different architectures and data sets.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)