Random Label Prediction Heads for Studying Memorization in Deep Neural Networks
Authors: Marlon Becker
Jonas Konrad
Luis Garcia Rodriguez
Benjamin Risse
Venue: ICLR 2026 Poster (2026)
Keywords: Memorization
Random Labels
Overfitting
Generalization
Regularization
Primary area: other topics in machine learning (i.e., none of the above)

Abstract: We introduce a straightforward yet effective method to empirically study memorization in deep neural networks for classification tasks.
Our approach augments each training sample with auxiliary random labels, which are then predicted by a random label prediction head (RLP-head).  
RLP-heads can be attached at arbitrary depths of a network, predicting random labels from the corresponding intermediate representation and thereby enabling analysis of how memorization capacity evolves across layers.
By interpreting the RLP-head performance as an empirical estimate of Rademacher complexity, we obtain a direct measure of both sample-level memorization and model capacity.
We leverage this random label accuracy metric to analyze generalization and overfitting in different models and datasets.
Building on this approach, we further propose a novel regularization technique based on the output of the RLP-head, which demonstrably reduces memorization.
Interestingly, our experiments reveal that reducing memorization can either improve or impair generalization, depending on the dataset and training setup.
These findings challenge the traditional assumption that overfitting is equivalent to memorization and suggest new hypotheses to reconcile these seemingly contradictory results.
The source code is available at https://github.com/MarlonBecker/RandomLabelHeads

Published as a conference paper at ICLR 2026
RANDOM LABEL PREDICTION HEADS FOR STUDYING MEMORIZATION IN DEEP NEURAL NETWORKS
Marlon Becker
Jonas Konrad Luis Gareia Rodriguez
Benjamin Risse
University of Münster, Germany
(marl (marlonbecker,, Jonas konrad, lui garcia, b. risse (assse)eune @un! -muenster.de
ABSTRACT
We introduce a straightforward yet effective method empirically study memo- rization in deep neural networks for classification tasks. Our approach augments each training sample with auxiliary random labels, which are then predicted by a random label prediction head (RLP-head). RLP-heads can be attached at ar- bitrary depths of network, predicting random labels from the corresponding intermediate representation and thereby enabling analysis of how memorization capacity evolves across layers. By interpreting the RLP-head performance as empirical estimate of Rademacher complexity, we obtain direct measure both sample-level memorization and model capacity. We leverage this ran- dom label accuracy metric to analyze generalization and overfitting in different models and datasets. Building on this approach, we further propose a novel regularization technique based the output of the RLP-head, which demon- strably reduces memorization. Interestingly, our experiments reveal that reduc- ing memorization can either improve or impair generalization, depending on the dataset and training setup. These findings challenge the traditional assumption that overfitting is equivalent to memorization and suggest new hypotheses reconcile these seemingly contradictory results. The source code is available at Heads
INTRODUCTION
Modern deep learning models are prone overfitting due to their extreme over-paramettriiation (Nakkiran et al. 2021). A wide range of strategies have been proposed to mitigate this issue, including data augmentation, explicit regularization, and dataset scaling. Although enlarging training datasets has proven particularly effective, this approach is often infeasible in domains where data acquisition or annotation is expensive or requires significant human expertise. Moreover, existing strategies primarily address practical concerns of generalization but provide limited insight into the mechanisms by which overfitting arises.
Recent work highlights the striking memorization capacity of state-of-the-art models. For instance, Zhang et al. (202)) demonstrate that modern architectures can perfectly fit datasets with randomly assigned labels, thereby achieving 100 % training accuracy in the absence of any learnable structure. In such cases, high accuracy is attainable only through memorization of individual training samples, underscoring that contemporary artificial neural networks (ANNs) encode sample-specific and task-irrelevant information to fit each training sample individually.
This ability to memorize arbitrary labels directly connected to the model complexity. In particular, training with SGD on random labels empirically approximates Rademacher complexity, which plays a central role in deriving generalization bounds within the PAC-learning framework.
The primary objective of this work is to assess the accuracy of predicting random labels as a practical metric of memorization. Although direct training on random labels reveals a model's ability to memorize, this procedure does not intrinsically inform how memorization interacts with generalization in real-world tasks and does not allow memorization mitigation. To bridge this gap, we propose a hybrid approach: augment the network with additional Random Label Prediction Head (RLP- head), attached to the feature extractor (i.c., all layers except the final classification layer) in parallel to the original task head, which remains unchanged. This design enables simultaneous measurement and

---

Published as a conference paper at ICLR 2026
regularization of memorization during normal training, thereby providing controlled way study and modulate memorization in deep neural networks. In summary, our contribution as follows:
We propose the use of random label prediction heads (RIP-heads) as a tool for probing layer-wist memorization in deep neural networks.
We validate that the random label accuracy derived from RLPP-heds is an accurate measure for complexity and memorization.
We propose a novel regularizer that explicitly constrains memorization by penalizing the performance of the RLP--hed during training.
Building on our metric and regularizer, we show how memorization can hinder or, in certain scenarios, facilitate generalization. We further hypothesize that this dual role is driven by sampling effects in the training data.
2 RELATED WORK
The phenomenon of data memorization, although not new, gained renewed attention in the era of modern deep learning with the works Zhang et al. (2021) and Arpit et al. (2017). Traditionally, memorization was associated with model capacity and overfitting, and hence viewed primarily as a source of poor generalization. This view of capacity being responsible for overfitting has been challenged by the discovery of the double descent phenomenon (Nakkiran al. 2021), which reveals a more nuanced relationship between capacity and generalization.
Feldman (2019) formalize memorization as the ability of model correctly predict label only if the sample was present in the training data. Their analysis suggests that the key obstacle to generalization not label noise but suboptimal sampling, with many regions of the data distribution undersampled or represented by only a single example. We compare our proposed memorization metric in detail to the work of Feldman & Zhang (2020) [Appendix A.12 Even though these atypical examples in so-called long-tailed data distributions are memorized individually to reach high training performance, this memorization leads to improved generalization of the network (cf.
Feldman & Zhang (2020)).
Building on this perspective, Baldock et al. (2021) observe that deep models first capture simple patterns shared across many examples, before gradually fitting more complex patterns that may be unique to a small subset the data or even example-specific. A similar observation can be found in Liu al. (2020), where the authors develop framework to leverage that property to be able to learn in noisy scenarios. Bayat et al. (2024) argue that memorization is not inherently detrimental, but rather depends on factors such as data quality and learning dynamics. They introduce the notion of an example-specifie feature rate, showing that excessively high rates prevent models from capturing the underlying distribution, while excessively low rates encourage the learning of overly complex representations, leading to catastrophic overfitting.
Subsequent work examined memorization, including studies by Carlini al. (2019) and Yun et al. (2019), with particular attention to the effects of heavy overparameterization (Zhang et al. 2020) and minimal overparameterization (Daniely) 2020). Another line of research examines where memo- rization occurs within network. For instance, Maini et al. (2023) demonstrate that memorization is localized across layers and even within specific neurons. Our approach is closely aligned with this perspective: by attaching RLP-heads at different layers, we obtain direct means of localizing memorization.
Memorization effects are particularly pronounced in large-scale language models, where they raise significant privacy concerns training data can be extracted from the models, as highlighted by Tirumala et al. (2022) and Carlini et al. (2021). Efforts improve generalization and mitigate data memorization have largely focused on general- general-purpose purpose regularization methods, such as dropout (Srivastava et al., 2014) and weight decay (Krogh & Hertz 199T). However, to the best of our knowledge, no existing approach explicitly regularizes memorization itself, as we propose in this work.
Closely related challenges arise in the context of fair AI, where suppression of unwanted spurious features is critical to prevent models from encoding biases related to attributes such as gender, ethnic- ity, religion (Mehrabi et al.) 2021 Tian et al. 2022 Wang et al. 2020 Zhang al. 2018a). We take technical inspiration from this field to develop our memorization suppressing regularizer. Finally, interpretation of random label accuracy proxy for information abstraction bears conceptual
2

---

Published as a conference paper at ICLR 2026
resemblance mutual information frameworks, which have been applied to analyze ANNs (Gabrié
et al. 2018
3 BACKGROUND: RADEMACHER COMPLEXITY
We take inspiration from the Rademacher complexity measure to motivate our empirical metric. Rademacher complexity is fundamental tool in statistical learning theory, quantifying the expressive power of a model (or hypothesis class) by measuring its ability to fit random labels. In the case of binary classification, it can be defined as follows:
(Empirical) Rademacher complexity for Binary Classification (Mohri et al.) 2012): Given a
hypothesis class H and train data S (1) ... (Im: mm)), where di,.... nn E {{1}} are i.i.d. uniform random variables:
1 Σ o,n(
Rs(H) Eg
sup NEW
(1)
In binary classification, the agreement between a model's prediction and the true label can be quan- tified by the product of the label and the model output. While this measure is closely related to accuracy, it is inherently restricted to the binary setting and does not naturally extend to multi-class classification. The hypothesis h is chosen as a supremum over the hypothesis class, which in practice can be approximated via empirical risk minimization (e.g.. with optimizers such as SGD or Adam). However, the presence of the supremum makes the exact evaluation of Rademacher complexity intractable in practical settings.
Importantly, it is model-agnostic, and therefore explicitly independent of architectural details includ- ing depth, width, and the total number of parameters. Instead, it captures the capacity of model through its ability to fit random labels. Within the PAC-Iearnigg framework, this quantity is central to deriving bounds on the generalization error. In particular, for binary classification, the generalization error can be bounded as:
Theorem Given a hypothesis class H. training data S {(11, (Ims Fm)) }, with 01, ..., Fm E {+1}, then for any å > O, with probability at least - 5 for any h E H it holds
that
log(2/0)
R(h)= < (s(h)) RH) +
2m
Where Rs(h) denotes the empirical error the training dataset (oohri et al. 2012 This bound implies that, for fixed training performance, a reduction in Rademacher complexity directly translates into improved test performance bounds and thus tightens limits the generalization error. While Rademacher complexity provides a theoretically powerful framework for characterizing the capacity of hypothesis classes, its exact computation for state-of-the-art deep learning models is infeasible. Inspired by this theoretical foundation, we will derive an empirical alternative to Rademacher complexity, suited for real-world training tasks, thereby enabling the study of the relation between memorization and generalization in practical deep learning settings.
4 RANDOM LABEL PREDICTIONS AND REGULARIZATION
Rather than training an entire network on random labels, as explored in prior work, we introduce an auxiliary Random Label Prediction Head (RLP-head) that predicts randomly assigned label in parallel with the standard classification task. Concretely, the proposed architecture outputs both the task prediction vector p e R.V and an additional random label prediction vector á R". While the number of task classes N is determined by the dataset, the number of possible random labels n can be chosen arbitrarily. The RLP--ead may be attached at different locations within the network. Unless otherwise specified, we place it after the penultimate layer, in parallel with the standard classification head. This choice natural since the penultimate activations correspond to the final stage of the feature extractor, and the RLP-head thereby probes the extent of memorization within the learned final representation.
Random labels are generated once at the beginning of the training and remain fixed across epochs for each sample. Only the RLP-head receives gradients from the random label objective, ensuring that the normal classification head is unaffected. Consequently, our method enables probing memorization
3

---

Published as a conference paper at ICLR 2026
without affecting normal task performance.
In order to train the RLP-head introduce an auxiliary cross-entropy loss on the random labels, T.rnd in addition to the standard classifi- cation loss, L class, where y denotes the correct class label and y the assigned random label:
CLASSIFICATION IAAIIATTION
L class
CLASS
CLASS
N
class
Σ
bg log(p;) = log(
(2)
INPUT
FEATURE NET
i=1
L ZTeg
HEAD
PAD PAED
L Lnnd Σ Kig log(ds) = log(dg)
(3)
Here:
L Trnd
IND. FRED
# Claasees N=3 # HRD labels n=4
By default, we implement the RLP-head single fully-connected layer followed by soft- max activation. Nevertheless, the architecture of the RI.P-head is flexible, and more complex variants can used (see Apppndix A.6 for re- sults with two-layer head).
Figure I: An additional Random Label Prediction Head (RLP-head) is added after the feature extrac- tor of the network. Only the RLP-head receives Land the random label prediction loss, whereas the regularizing loss I is calculated on the RLP- head but acts on the feature extractor only.
Training the RLP-head on random labels par- allel with the main task enables directly regu- larize memorization during standard training. Since we interpret the accuracy of the random label prediction head an empirical proxy of the Rademacher complexity, regularizing the random label predictions provides a means of constraining the effective complexity of the model. Therefore, we introduce regularization loss term that penalizes correct predictions of the random labels by the RLP-head. Specifically, this loss is derived from the standard cross- cross-entropy formulation:
I reg Σ deg log(1 - p.:) = log(1 - (g))
Compared with standard cross-entropy, we invert the sign of the loss, since the regularizer designed to prevent the network from learning the random labels. Furthermore, we replace P; with 1 p; inside the logarithm, which amplifies the penalty when P. Rs This ensures that highly confident predictions of random labels penalized more strongly. The resulting regularization term is scaled by a tunable hyperparameter À and added to the loss of the feature extractor.
Although the regularization loss is computed using the RLP-head, its gradients restricted the feature extractor. Accordingly, the classification head remains unaffected during Ru.P-reuularization schematic of the proposed architecture is provided in Figure Conceptually, the RLP-head and the feature extractor form two adversarial components: the RLP-head attempts to fit the random labels, while the feature extractor regularized prevent this from happening. This adversarial setup encourages the feature extractor to produce representations that are less example-specifes and do not allow memorization of specific inputs. The proposed regularizer is, therefore, used here as tool to investigate the effects of memorization in different parts of the network.
5 EXPERIMENTS
Details of our experimental setup can be found in Appendix A.I
5.1 LEARNING RANDOM LABELS
Throughout this section, we analyze the training of the RLP-head, such that it serves solely metric and does not influence network performance (i.e., X = 0). Figure 2A] the test and train accuracy of the classification head alongside the random label accuracy extracted from the RLP-head for ViT-B/32 trained on ImageNet. Around epoch 20, test and train accuracies begin to diverge, indicating the beginning of overfitting. Notably, the random label accuracy starts to rise slightly earlier, reaching approximately 70 % by the end of training. This shows that, even when trained exclusively correct class labels, the model memorizes substantial portion of the dataset enough
4

---

Published as a conference paper at ICLR 2026
for single fully-con mully-connected layer to correctly predict random labels. The fact that random label accuracy does not approach 100 may reflect that the chosen network architecture does not have sufficient capacity to fully memorize the dataset, consistent with the training accuracy plateauing roughly 93 %.
Since we train the RLP-head together with the main classifier, we cannot tell whether its low early-epoch accuracy is due to the RLP-head not having been trained long enough or because the network has not yet memorized many samples. To disentangle these effects, performed an
A
B
Tsot
Trazs
Kesden Labe Necusry
RCP
2/
080
892
680
Figure 2: VIT-B/32 on ImageNet. A: The proposed single fully-connected layer RLP-head is sufficient to correctly predict approx. 70 % of the random labels, indicating that the feature extractor memorizes substantial portion of the training set. B: Even after freezing the feature extractor, RLP-head attains low accuracy in the early epochs, confirming that the default RLP-head approach reliably tracks the evolution of memorization dynamics during training. C: Random label accuracy when attaching the RlP-head at various network depths. The higher accuracy observed deeper layers indicates that increasingly abstract representations still retain sample-specific information allowing for memorization.
additional experiment with two different modes of training the RLP-head shown in Figure 2B Default refers to training the RLP-head in parallel with the main task, as described previously. Frozen refers freezing all layers except the RLP-head at checkpoints saved after each epoch, and subsequently training (only) the RLP-head from scratch. For all frozen runs, the RLP-head is initialized with the same parameters and trained on the same fixed set of random labels. This setup ensures that the RLP-head receives sufficient and equal training capacity at each epoch. Ar epoch 0 (random weights), the frozen training fails to fit the random labels, indicating that the signal measured by the default training actually stems from memorization learned by the feature extractor during training and not from limitations of the RLP-head. Although this frozen training does not allow for regularization and is computationally very demanding, it is shown here to validate the suitability of our proposed default training method.
We further investigate where memorization occurs within the network by attaching separate RLP-head consisting of a normalization layer, a fully-connected layer and softmax layer after each transformer block of VIT-B/32 trained on ImageNet (Figure 2C). The random label accuracy increases with the network depth: After the first layer nearly 0% of the random labels can be predicted correctly, while high accuracies are reached in later layers. Similar to the previous experiment, this dependency shows that the RLP-head does not itself memorize the input sample but instead reflects the representational properties of the network. After the first layer, where only minimal processing occurred, the activations retain significant amount of sample-specific information. Interestingly, this does not lead to an increased random label accuracy. Instead, high random label accuracies are reached only after sufficient abstraction of the features, showing that the abstracted features are still sample-spectie and lead to memorization.
5.2 RELATION TO OTHER COMPLEXITY REGULARIZERS
We propose to use the accuracy of the RLP-head as a proxy for model complexity, providing an empirical approximation to Rademacher complexity. To validate this interpretation, we evaluate our metric under three well-established regularization strategies, namely dropout, weight decay, and label smoothing, As illustrated in Figure each of these regularizers consistently suppresses random label accuracy, confirming the correlation of the random label accuracy with model complexity.
We further support this correlation by studying the impact of the model size the random label accuracy in Amppendix A.9 We also use the random label accuracy to demonstrate that mixup reduces but does not fully eliminate memorization in Appendix A.16 Additional experiments with ViT-S/32
5

---

Published as a conference paper at ICLR 2026
on ImageNet comparing the proposed random label accuracy against measuring memorization via noisy labels for different regularizers can be found in Appendix A.14
Coe
475
37%
375
75
052
No
Momnehee
0.1
0.6
Disport Tlate
Wriglt Doiay Strter
Lakel Stneetligg
Figure 3: WRNI6-4 on CIFAR-100. The effect common complexity regularizers can be measured with the proposed metrie. A: Dropout. B: Weight decay. C: Label smoothing.
5.3 REGULARIZING RANDOM LABELS
We use the RLP-head to explicitly regularize the memorization of the network. To accomplish this, we apply the loss term defined in Egqution 4 and search for an optimal regularization factor We report results for ViT-B/32 ImageNet in Figure 4 and WideResNet-16-- on CIFAR-100 in Figure 5
We find that Rl.P-regularization effectively suppresses memorization both experimental
56%
Diaken take sccnss
03%
66.95
2004
47%
09
Menoolaadirr
010
15 Dig Pactue
Bog Pactor
Racte
Figure 4: ViT-B/32 on ImageNet. Random label, train and test accuracy under RLP-regularization for different regularization factors X. Ri.-rregulaiizationn effectively reduces memorization, and leads to better generalization (smaller test-train gap) and test performance.
A
B
075
375
21.55%
175
take.
975
435
2356%
4/5
31%
08 No Memorfaatbrr by
375
Figure 5: 164 on CIFAR-100. Random label, train and test accuracy under RLP- regularization for different regularization factors Here, RI.P-regularization effectively reduces memorization, but does not improve generalization.
settings reducing the random label accuracy down to the level expected from random guessing. ImageNet with VIT. this effect translates into improved generalization: while training accuracy decreases, test accuracy increases, reaching peak of 68.5 % at À = 10 which corresponds to gain of 1.5 % over the baseline. The simultaneous drop training accuracy further narrows the train-ter gap, confirming the effectiveness of reerragulaiizzttoo to reduce overfitting, These observations align with predictions from PAC-learning theory based on Rademacher complexity, as well as the intuition that memorization causes overfitting and harms generalization.
Interestingly, these findings do not hold for our experiments for WideResNet- 16-4 on CIFAR-106 Instead, the training accuracy remains unaffected, while the test accuracy deteriorates even for small regularization factors. These deviations from classical theory are consistent with recent findings, e.g., by (Nakirran al. 2021), which highlight the distinct dynamics of modern overparameterizee

---

Published as a conference paper at ICLR 2026
networks. Our results suggest that the relationship between memorization and generalization is more nuanced than traditional theory predicts, which we study further in the following sections.
5.4 UNDERSAMPLED DATASETS BENEFIT FROM MEMORIZATION
Based on findings and drawing insights from Feldman 2019) and Bayat et al. (2024), hypothesize two distinct memorization scenarios that reconcile the apparent contradictions with the classical view of overfitting.
Memorization corresponds to the adoption of features that are highly specific to individual samples. Suppressing memorization prevents the learning of sample-specifie features, foreing instead focus on features shared across examples of the same class. When sufficient samples are available, this results in learning features of the underlying true data distribution leading increased generalization (cf. Figure 6A). Without memorization, training accuracy decreases because the network may fail to fit atypical samples, especially those that share few features with other samples in the same class, such as noisy or mislabeled samples. We hypothesize that this mechanism explains the observed behavior on ImageNet FFiuure 4). However, when the dataset undersampled and memorization suppressed,
Sufficiently Sampled
Undersampled
High Memorization
Low Memorization
High Memorization
Low Memorization
** Samplen
Improved Generalization
Reduced Generalization
Distribution
Learned Solution
Figure 6: Schematic illustration of how memorization be either detrimental benign depending on dataset sampling. Under memorization, the model learns sample-specific solutions (depicted as small isolated regions around individual samples). In contrast, suppressing memorization encourages the discovery of single connected solution space that better captures class-level structure while excluding outliers such noisy mislabeled samples.
the shared features learned across class samples may fail to reflect the true data distribution and instead capture arbitrary artifacts of the insufficient sampling. In this case, suppressing memorization forces the network to rely on these spurious shared features, which degrades generalization. New, unseen samples may still resemble individual memorized training examples but are unlikely share the learned spurious features shared by training examples from undersampled regions of the true data distribution (cf. Figure 6B). We hypothesize that this mechanism explains the behavior observed on (1FAR-100 FFigure 5p. In line with this view, we find the same effect (reduced random label accuracy, stable training accuracy, and degraded test accuracy) when applying the Rr.-rreglrrr to ViT trained on CIFAR-100 (Appendix A.3).
To further test this hypothesis, we study the impact of dataset size by training ViT-B/32 on subsets of ImageNet while keeping the experimental setup fixed. As shown in Figure test accuracy only when large fractions of the dataset are available. The conventional intuition that memorization is always detrimental would suggest that reducing memorization should be even more beneficial on smaller datasets, where higher memorization (as observed by higher random label accuracy) occurs. Our experiment thus provides evidence in support of our hypothesis of beneficial memorization effects for undersampled datasets.
regularizer improves
We perform an additional experiment where we inject label noise into the training dataset and apply the RLP- reguulaaarr Since noisy labels cannot contribute positively to generalization and can only be fit through memorization, our regularizer should consistently improve test performance this setting. This prediction is confirmed in Figure 7C]
Related findings were also reported by [Feldman (2019), who argue that memorization sparsely sampled regions of the data distribution (i.e., the long tail) can actually enhance generalization. Because the proposed Reguragulrrizer directly suppresses memorization, we apply it to the ImageNet- LT dataset (Liu et al. 2019b) to demonstrate in Amppendix A.19 that classes in the long tail (i.e., those with few training samples) can no longer be predicted correctly when memorization is inhibited.
Taken together, experiments highlight both detrimental and beneficial aspects of memorization
7

---

Published as a conference paper at ICLR 2026
and demonstrate that RLP-heads, along with the derived regularizer, provide effective framework for probing and controlling these dynamics.
197%
70%
875
43%
19655
075
475
107
107
107
107
107
Reg Ractir
Reg Factoe
Reg Ractor
Figure 7: ViT-B/32 on ImageNet. A+B: Random label and test accuracy when training on reduced dataset fractions (DF) of ImageNet. Although smaller training sets lead stronger memorization (higher random label accuracy), suppressing memorization on them does not improve test accuracy. Test accuracy with added label noise under ILP-regllarization. Since memorization of noisy labels hinders generalization, our regularizer yields substantial improvements.
C:
5.5 RLP-REGULLRIIZATION SHIFTS MEMORIZATION
To further understand the effects of the RLPrregularizer, we analyze memorization across different layers of the network. We attach additional RL.P-heads after each layer of vision transformer, as described above. Figure 8A shows the resulting random label accuracy across layers for varying regularization strengths.
97%
B 975
Bosten Lanal heuross
07%
16
TTxk
375
+7%
05
310
00
12'
107
107
Lager
Bog Saettc
Figure 8: ViT-B/32 on ImageNet. A: Random label accuracy of RLP-heads at different layers when only the final (12th) layer is used for RL.Pregularizztion. Memorization shifts toward earlier layers. B+C: Ri.-rregulii is calculated based on RI.-hhadds attached to all 12 transformer layers. While this effectively suppresses memorization and prevents the shift, neither test accuracy generalization improve.
The RLP-regularizztion is only applied based on the RLP-head attached to the final (12th) layer. Consequently, the random label accuracy drops rapidly for this last layer with increasing regularization. RLP-heads near the regularized final layer, particularly layers 10 and 11, are also affected. In contrast, earlier layers exhibit the opposite effect: RLP-heads attached to layers 2 to 6 achieve higher random label accuracies under regularization. This indicates that while memorization is mitigated in the last layer, shifted earlier layers rather than eliminated. We hypothesize that, in response to the Ri.-rrgularizeer the network transforms sample-specific features into class-relevant information in earlier layers, thereby enabling memorization persist while being undetected by the regularizing RLP-head attached to the final layer.
To test this hypothesis, we conduct an additional experiment, adding a classification head to each transformer layer trained to predict the class label. This setup enables tracking the transformation from sample-specific features to class information throughout the network. Figure 9 shows the resulting class, train, and test accuracies under reuuragalarization based on the final layer. While class accuracy decreases in the last layer and the penultimate layer (11), we observe increased accuracy in earlier layers for both training and test data. Remarkably, test accuracies at layers 10 and even surpass those of layer 12 (Figure 9C), indicating that regularization not only shifts memorization and classification capabilities but also improve generalization in earlier layers.
8

---

Published as a conference paper at ICLR 2026
This supports the hypothesis that RLP-regularization shifts the transformation into class-specife information to earlier layers.
Next, we examine the effect of suppressing memorization when using all attached RLP-heads for regularization. As shown in Figure 8B this effectively reduces random label accuracy at all layers, even for modest regularization strengths. However, this does translate into improved test accuracy (Figure 8C). We hypothesize that applying RLP-regularization to all layers constitutes an overly harsh intervention: Extraction of sample-specific features in early layers may be useful even when these features do not lead to direct memorization. Moreover, some degree of memorization may persist within transformer block itself, being hidden the respective RLP-head attached its end. We further study this hypothesis in Apppendix A.20
Additionally, we study the influence of the regularizer when the loss term constructed from single RLP-heaad attached to intermediate layer in Appendix A.10
B
0..%
67%
Heuf%
40%
UPP
Bog Porter
Bog Retor
Beg Porter
Figure 9: ViT-B/32 on ImageNet. Similar to the RLP-heads, we attach additional classification heads to the outputs of all layers in VIT to track the transformation from sample-specifie features to class predictions throughout the network. When applying reP-ragularization to the final (12th) layer only, class prediction accuracy increases in the earlier layers and test performance improves across all layers. A: Train accuracy. B: Test accuracy. C: Zoomed-in view of test accuracy.
CONCLUSION
We have introduced an effective method to measure and regularize memorization in deep neural networks: random layer prediction heads (RIP-heads), which can be attached to any (intermediate) network activation. Motivated as an empirical approximation of Rademacher complexity, we demon- strated that random label accuracy serves This metric enables the study of both the temporal (i.e., during optimization) and spatial (i.e., across layers) dynamics of memorization within network. Based on the RLP-heads derived regular- ization method to explicitly mitigate learning of sample-specing features and in consequence stop memorization.
valid metric for network complexity and memorization.
Our experiments show that memorization can be either beneficial or detrimental for generalization deep neural networks. We propose hypothesis explain this counterintuitive effect based dataset sampling and support it with targeted experiments. Moreover, applying the memorization regularizer the final layer shifts both abstraction of class-level representations and memorization into earlier layers, resulting in a network that achieves better generalization after fewer layers.
Our findings highlight the value of RLP-heads and re.-rreuuarizzttoon for studying memorization and suggest their broader potential for empirical analysis of deep learning mechanisms.
ACKNOWLEDGEMENTS
This work was funded by the German Research Foundation (DFG CRC 1459 Intelligent Matter Project-ID 433682494).
Calculations for this publication were performed on the HPC cluster PALMA of the University of Münster, subsidised by the DFG (INST 21 1/667-1).

---

Published as a conference paper at ICLR 2026
REPRODUCIBILITY STATEMENT
For all experiments, we report complete results, including the outcomes of all hyperparameter searches. Details on training configurations are provided in AApeeddx A. The source code is available at http:////shhtcaooooooaooaa//anaa
Heads
LLM USAGE
Large language models (LLMs) were used exclusively to assist refining the phrasing of certain sentences and improving the clarity of formulations in this manuscript. At no point were LLMs employed for data analysis, generation of scientific content, or drawing conclusions. All scientific claims, results, and interpretations are the sole work of the authors.
REFERENCES
Devansh Arpit, Stanislaw Jastrzebski, Nicolas Ballas, David Krueger, Emmanuel Bengio, Maxinder Kanwal, Tegan Maharaj. Asja Fischer, Aaron Courville, Yoshua Bengio, and Simon Lacoste-Julien. A Closer Look at Memorization in Deep Networks. International Conference on Machine Learning. 2017.
Robert J. N. Baldock, Hartmut Maennel, and Behnam Neyshabur. Deep learning through the lens of example difficulty. Advances in Neural Information Processing Systems, 2021.
Björn Barz and Joachim Denzler. Do we train on test data? purging cifar of near-duplicates. Journal of Imaging, 6(6), 2020.
Reza Bayat, Mohammad Pezeshki, Elvis Dohmatob, David Lopez-Paz, and Pascal Vincent. The pitfalls of memorization: When memorization hurts generalization. arXiv:2412.07664 [cs], 2024.
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: evaluating and testing unintended memorization in neural networks, In USENIX Conference Security Symposium, pp. 267-2662222 284, 2019.
Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert- Vorbert-Voss,, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. Ex- tracting training data from large language models. USENIX Conference on Security Symposium, pp. 2633-2650, 2021.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks. In Proceedings of the 37th International Conference on Machine Learning, 2020.
Amit Daniely. Neural networks learning and memorization with (almost) no over-paramettrizzaion.. Advances in Neural Information Processing Systems, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. Conference Computer Vision and Pattern Recognition, 2009.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x 16 words: Transformers for image recognition at scale. International Conference Learning Representations, 2021.
Vitaly Feldman. Does learning require memorization? A short tale about a long tail. In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, volume abs/1 htts/190.052271 2019.
Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. Advances in Neural Information Processing Systems, 2020.
10

---

Published as a conference paper at ICLR 2026
Marylou Gabrié, Andre Manoel, Clément Luneau, Jean Barbier, Nicolas Macris, Florent Krzakala, and Lenka Zdeborová. Entropy and mutual information in models of deep neural networks. Advances in Neural Information Processing Systems, 2018.
lan Goodfellow, Jonathon Shlens, and Christian Szeged. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2018.
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images.
Technical report, University of Toronto, 2009.
Anders Krogh and John Hertz. A simple weight decay improve generalization. Advances in Neural Information Processing Systems, 1991.
Sheng Liu, Jonathan Niles- Weed, Narges Razavian, and Carlos Gernandzz-Granda Early-learning regularization prevents memorization noisy labels. Advances in Neural Information Processing Systems, 2020.
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer. and Veselin Stoyanov. Roberta: A robustly optimized BERT pretraining approach. arXiv: [es]. 2019a.
Ziwei Liu, Zhongqi Miao, Xiaohang Zhan, Jiayun Wang, Boqing Gong, and Stella Yu. Large-scale long-tailed recognition in an open world. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019b.
Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. International Conference on Learning Representations, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018.
Pratyush Maini, Michael C. Mozer, Hanie Sedghi, Zachary C. Lipton, Zico Kolter, and Chiyuan Zhang. Can neural network memorization be localized? International Conference on Machine Learning, 2023.
Ninareh Mehrabi, Fred Morstatter, Nripsuta Saxena, Kristina Lerman, and Aram Galstyan. A survey bias and fairness in machine learning. ACM Comput. Surv., 54(6):35, 2021.
Mehryar Mohri, Afshin Rostamizadeh, and Ameet Talwalkar. Foundations of machine learning. Adaptive Computation and Machine Learning series. MIT Press, 2012.
Prectum Nakkiran, Gal Kaplun, Yamini Bansal, Tristan Yang, Boaz Barak, and Ilya Sutskever, Deep double descent: Where bigger models and more data hurt. Journal of Statistical Mechanics: Theory and Experiment, 2021(12): 2021.
Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. Dropout: A simple way prevent neural networks from overfitting. Journal of Machine Learning Research, 15(56):1929-1958 2014.
Huan Tian, Tianqing Zhu, Wei Liu, and Wanlei Zhou. Image faimesss in deep learning: problems, models, and challenges. Neural Computing and Applications, 34:12875-12893, 2022.
Kushal Tirumala, Aram Markosyan, Luke Zettlemoyer, and Armen Aghajanyan. Memorization without overfitting: Analyzing the training dynamics of large language models. Advances Neural Information Processing Systems, 2022.
Zeyu Wang, Klint Qinami, loannis Christos Karakozis, Kyle Genova, Prem Nair, Kenji Hata, and Olga Russakovsky. Towards Fairness in Visual Recognition: Effective Strategies for Bias Mitigation. In Conference on Computer Vision and Pattern Recognition, 2020.
Chulhee Yun, Suvrit Sra. and Ali Jadbabaie. Small relu networks are powerful memorizers: a tight analysis of memorization capacity. Advances in Neural Information Processing Systems, 2019.

---

Published as a conference paper at ICLR 2026
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. British Machine Vision Confer- ence, 2016.
Brian Hu Zhang, Blake Lemoine, and Margaret Mitchell. Mitigating unwanted biases with adversarial learning. In Proceedings of the 2018 AAAT/ACM Conference on Al, Ethics, and Society, pp. 335-340. ACM, 2018a
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Michael C. Mozer, and Yoram Singer. Identity crisis: Memorization and generalization under extreme overparameterization. International Conference on Learning Representutions, 2020.
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning (still) requires rethinking generalization. Commun. ACM, 64(3):077-15,, 2021.
Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In International Conference on Learning Representations, 2018b.
Xiang Zhang and Yann LeCun. Text understanding from scratch. 15Xiv:1502.01710 [cs), 2016.
12

---

Published as a conference paper at ICLR 2026
APPENDIX
A.1 EXPERIMENTAL SETUP
In the main text we focus on two evaluation scenarios:
1. WideResNet- 16-4 (Zagoruyko & Komodakis 2016 on CIFAR-100 (Krizhevsky & Hinton
2009) trained with SGD with momentum μ 0.9, linear learning rate warm up in the first epoch followed by cosine decay with base learning rate of 7) 0.5 and a batch size of 256 trained for 200 epochs without additional regularization or data augmentation. We use 10,000 the number of (different) random labels.
71
2. ViT-B/32 (Dosovitskiy al. 2021 ImageNet-IK Ik (Deng et al. 2009) trained with A
(Loshchilov & Hutter 2019) and learning rate warm up for eight epochs followed by a cosine decay with base learning rate of 1) 0.001 and batch size of 1024 trained for 90 epochs with flipping augmentation, gradient clipping (L = 1.0) and weight decay of 0.1. We use 100,000 random labels.
A full implementation comprising all models and configuration files is available at https: /Randerraaaadddaaaaaaaaa Heads
gi thub.
A.2 SANITY CHECK: SHUFFLED RANDOM LABELS
To validate that the observed increase of generalization actually stems from the mitigated memo- rization and is not mere artifact, e.g., caused by effects on the scale of the feature activations, we perform simple sanity check. We reshuffle all random labels in each epoch. Thus, the random labels cannot be learned and cannot serve as a metric for memorization. Consequently, the RLP-regularizer also does explicitly reduce the memorization, while all other implicit effects of the regularizer remain. Results compared to our initially proposed RLP ILL-rreularizztion are shown in Figure A. As expected, the random label accuracy remains approximately at the chance of random guessing 1/n. The train accuracy exhibits only a minor drop for high regularization factors. The test accuracy does not improve and only affected by high regularization factors where the performance drops. This validates that the observed regularization is effect of the mitigated memorization.
A
Food airetied
Baacke Lake beeway
67%
66.75
67.75
37%
Beg
Figure A.1: VIT-B/32 on ImageNet. As sanity check compare the regularization results for fixed random labels (as before) to random labels shuffled in each epoch.
A.3 VIT ON CIFAR-100
section 5.3 we found opposing effects caused by memorization mitigation for our two experiments performed with ViT on ImageNet and with WideResNet on CIFAR-100. To clarify if the two ob- served effects are caused by the different model architectures or datasets, we perform an additional experiment where study ViT-S/4 trained on CIFAR-100. Results are shown in Figure A.2 Mem- orization effectively stopped for regularization factors > 10-1, Similarly to our experiments with WideResNet CIFAR- 100, observe detrimental effect of reducing memorization (unaffected training accuracy and reduced test accuracy) indicating the dataset to be pivotal for the different effects of memorization further examine in section 5.4
13

---

Published as a conference paper at ICLR 2026
B PRA005
$1.00%
595
Rosilos Eatel
e/%
$1.7%
125
47%
0.75
21.054
No Meroontaa
100 0077 30
10
0.0"1 10
10'14
107
310m
1077
16m1
107
100
Bog
Dig
Figure A.2: ViT-S/4 on CIFAR-100 with RL RLP-regularization
A.4 NUMBER OF RANDOM LABELS
In Figure A.3 we analyze the effect of the number of different random labels when using linear RLP-head. The input to the random prediction head, i.e., the feature dimension, stays constant and since the output of the linear layer is given by the number of random labels n, the capacity of the prediction head is directly tied to the number of random labels. Two intuitive implications can be directly observed from Figure A.3] The probability to reach high values by chance decreases with increasing n, i.e., the task to predict the random labels gets harder, and the capacity of the RLP-head grows with increasing n, ie., the capability of the RLP-head to solve the given task increases. As result, the reached random label accuracy undergoes minimum before approaches full memorization and saturates. From this experiment, we conclude that the number of random labels must be sufficiently large ensure that the RLP-head has enough capacity measure the models memorization. However, increasing the number of random labels n also substantially raises computational costs. Balancing these considerations, on CIFAR- 100 and n = 100,000 for ViT experiments on ImageNet. To further validate our design choice on ImageNet, we additionally study the case where each training sample is assigned unique random label (i.e., n = m 1,281,167). and analyze the resulting effect of RR.P-regularization in Appendix A.5
10,000 for WideResNet experiments
0075
Ruskee Eake
40%
42%
Xoedhe
127
107
107
32a
117
100
307
Randon Caloda
Bansives Tabech
Figure A.3: Linear RLP-head. A sufficiently large number of random labels and thus head size has to be chosen. A: WRN16-4 on 1IFAR-100. B: ViT-B/32 on ImageNet. The minimum is barely observable because the data starts at 256.
A.5 UNIQUE LABEL PER SAMPLE
We compare our proposed random label formulation with the alternative of assigning a unique label to each sample. While the latter is computationally very expensive, it provides direct measure of single- sample memorization. As shown in Figure A.4 unique labels yield higher memorization accuracy, due to the increased predictive capacity of the linear RLP-head. However, observe qualitative differences compared to our proposed approach with n = 100,000 labels. For computational efficiency, adopt the latter approach in our experiments.
14

---

Published as a conference paper at ICLR 2026
A 197%
50%
a7%
re//6
07.95
07.75
0.19
100
010
107
100
Bog
Figure A.4: VIT-B/32 on ImageNet. Using unique label per sample when applying RLP-
regularization (i.e., m 1,281,167 compared to 100,000 used in the main paper.
A.6 TWO-LAYER HEAD
As shown in the last section (Appendix A.4) the RLP-head capacity and the number of random labels are tied together for linear head. To disentangle these two effects, we extend the RLP-head by adding hidden fully-connected layer. keep the number of labels constant a rather small value in the experiment depicted in Figure A.5 (n 10), and only influence the RL.Phead capacity by varying its hidden feature dimension dą, As can be seen, the RLP-head is now able to recover a much higher amount of random labels from the output of the corresponding feature extractor for sufficienlly large da, compared to the setting without a hidden layer in the RLP-head.
A Audh
B
JCR
3//
No Menoricatioe
No Momorbnntien
Figure A.5: A: WideResNet-16-4 on CIFAR-100. B: VIT-B/32 ImageNet. RLP-head with one hidden layer. Number of random labels n 10. Increasing the capacity of RLP-head leads to correctly predicted random labels.
Additionally, we do a sensitivity analysis on both the regularization strength controlled by À and the hidden layer size da for 1ide on CIFAR-100. As shown Figure A.6C small hidden layer dimensions have less impact on the test accuracy; however, the RLP-head is not capable to correctly predict the random labels under these conditions (see Figure A.6A). Larger RLP-heads do predict the random labels correctly and are thus sufficiently powerful to measure the network's 'ss memorization, but are similarly detrimental to the models generalization. Adding hidden layer to the RI P--headd used for regularization neither improves generalization nor yields qualitatively new insights. We therefore use linear Rh.-hhad.
AJa
B
C as%
Rastea Lake tecuse
47%
Pars
5%
No Memootaatbroe
No 18:56
256
2004 2045
36364
60026
300
0100
33785
100000
Figure A.6: 1 on C0FAR-10. RLP-head with one hidden layer, 100.
15

---

Published as a conference paper at ICLR 2026
A.7 DATASET SIZE
Having studied the influence the RL.P-hedd in previous sections (Appendix A.4 and Appendix A.6 we aim to study the influence of the dataset size while maintaining the number of random labels and the capacity of the RLP-head constant now. We thereby ablate the influence the dataset size on the difficulty of random label prediction task. We randomly sample subsets from CIFAR-100 in order to construct several smaller datasets and use a small RLP-head with n = 1024. As shown in A.7 the RLP-head is only able to predict the random labels correctly for small dataset sizes. Since showed before that a large RLP-head can reach 100 % random label accuracy on the full dataset, the reduced random label accuracy is caused by the limited size of the RLP-head. We conclude from this experiment, that the needed RI.P-head size to obtain adequately measure the memorization in the network grows with the dataset size.
975
075
Stenoctestion
1990
3300
Figure A.7: 4 on CIFAR-100. Dependence of random label accuracy the dataset size for a small linear RLP-head of size n = 1024. The original dataset size of 50,000 training samples of CIFAR-100 is reduced by sampling random subsets.
A.8 MULTI-HEAD RLP
While we aim to measure single-sample memorization, we chose to generate a number of n random labels for total training samples, i.e., "/n samples per random label, where usually < m. For instance, we chose n = 100,000 for the m 1, 281, 167 samples approx. 12 images which attain the same random label. This results in the RI.--regularizer only be able to effectively suppress features which are shared by parts of these random subsets input images. While setting
ImageNet leading to
m (that learning an individual random label per sample) is studied in Appendix A.5) this is not computationally feasible in practical scenarios. However, in the setting < m, is harder for the RLP-head to identify sample-specific features (as opposed those shared in the random groups of images with the same random labels). This might allow the network to memorize -specfie features even though the RLP--rgullrrier is applied. To eircumvent this problem, we add multiple parallel RLP-heads receiving different sets of random labels. The total regularization loss the average of the individual regularization losses per RLP-head. This way, Multi-Head-Rul RLP is developed which hypothesize to be more powerful in identifying the networks memorization. However, is computationally more demanding. As shown in Figure A.8, the number of heads in multi-head setting does not impact the random label or train accuracy, but interestingly, yields even higher test accuracy, reaching 69.2 % for 10 heads and 10a
B
dur
15%
47%
R2%
k7.5%
315
0%
Block
Block
Blokk
Figure A.8: ViT-B/32 ImageNet. RLP-head used for regularization comprised of multiple parallel linear layers, each receiving a different mapping from random labels to input images. The multi-head structure results in improved generalization.
16

---

Published as a conference paper at ICLR 2026
A.9 FEATURE EXTRACTOR SIZE
To validate the proposed random label accuracy as a capacity metric, we analyze the impact of the feature extractor size on this measure. Specifically, we report the random label accuracy when training WideResNet- 16- models with varying widening factors w on CIFAR-100, without applying seu-araguaaiiztton (see Figure A.9p. For small values of ur, the models exhibit insufficient capacity to fully memorize the training data, which is directly reflected in lower random label accuracy. As w increases, the models progressively achieve higher random label accuracy. until reaching plateau at 100 %, indicating complete memorization of the dataset. These results support the use of random label accuracy, as measured by the RLP-head, as reliable indicator of model capacity and complexity.
3075
+77
No Menowbaattin
Figure A.9: WideResNet-16-u on CIFAR-100, n 10,000.
A.10 REGULARIZING INTERMEDIATE LAYERS
Our proposed RLP RLP-regularizer enables control over memorization in a layer-selective manner. To demonstrate this, we attach RLP-heads to all layers of a ViT trained on ImageNet (as in the main paper's secciion 5.5) to be able monitor memorization across all layers, while we exclusively use the RLP-head at layer for regularizing the full feature extractor. As can be seen in FFgurre A. the effect of the regularizer is highly localized: the random label accuracy at layer 8 is strongly suppressed, approaching zero under large regularization strengths. In contrast, adjacent layers exhibit only minor reductions in random label accuracy, and quickly recover beyond the regularized layer. Interestingly, despite employing single intermediate layer for regularization, the test accuracy improves to degree comparable to using RuP-regularizztton with final layer, indicating enhanced generalization.
A
Rostent are Noweo
8/%
m7.%%
375
05
Figure A.10: ViT-B/32 on ImageNet. Only layer 8 is used for regularization.
A.11 TEST-TRAIN DUPLICATES
Barz & Denzler 2020) show that CIFAR-100 contains numerous duplicates between the training
and test sets. This phenomenon provides a plausible explanation for the negative effect of the RLP-regularizer's memorization reduction on test performance: duplicated
samples implicitly
reward memorization of the training set. To address this issue, BBrz & Denzler 2020) introduce de-duplicated variant, ciFAIR- 100, which all duplicated test images are replaced by newly sampled datapoints.
We evaluate the RLP-regularizer in CIFAR-I00 vs ciFAIR 100 in Figure A. While the random label accuracy and training accuracy remain similar across the two datasets, the reduction in memorization induced by the RLP-regularizer less detrimental on the train accuracy on ciFAIR- 100 than on CIFAR-100 This indicates that the degraded generalization performance observed on CIFAR-100 is, at least in part, driven by train-test duplicates. Overall, this experiment further demonstrates that the proposed RLP metric and regularizer are effective tools for analyzing memorization phenomena.
17

---

Published as a conference paper at ICLR 2026
A197
B PRAD05S
93%
$1.00%
8/%
CIEARIOO
51.7%
47%
05
Memonlaattion
.FABLIGG
1071
10"1
107
100
107
10
1077
107
Bog Bactoc
Statte
Figure A.1I: WideResNet-16-4 CIFAR-I00 and ciFAIR (Bar & Denzler 2020 Random
label (A) train (B) and test (C) accuracy under RLP-regularization for different regularization factors A.
A.12 FELDMAN SCORES
We compare the random label accuracy measure of memorization to the memorization score proposed by /Fllmann & Zhang (2020).
Feldman & Zhang (2020) define memorization per sample by testing whether model needs to be trained on a specific sample in order to correctly classify it. Concretely, they consider the change in model's accuracy on each training dataset when the sample is either included in excluded from the training set. Since an exact evaluation of this metric necessitates full training run for each sample, the authors approximate it by removing 30 % of the training data once and averaging results over multiple subsampled training runs to obtain per-sample score. Even with this approximation, hundreds to thousands of full training runs are required. The resulting scores for ResNet-50 trained on CIFAR-100 100 are publicly available.
To compare against this method, we compute the random-label prediction accuracy per sample by averaging over 50 independently initialized training runs. Figure A.12 shows the distributions of the original Feldman scores, our reimplementation of their method, and random-label accuracy on CIFAR-100 100. The distributions differ clearly: the Feldman scores bimodal, whereas the random- label accuracy is approximately Gaussian. Moreover, we find low correlation between the two measures (Pearson's r 0.08 with p < 10-$).
Despite this, we validate that the random label accuracy is highly sample-specific. We performed an Anderson-Darling test to reject the hypothesis that all samples share the same underlying distribution, and repeated independent estimates of random- accuracy per sample exhibit high correlation (Pearson's 's 0.9). This confirms that random- accuracy indeed a stable property of each sample.
Although the lack of correlation between the two measures counterintuitive, we argue that consistent with the previously observed lack of correlation between memorization and generalization for CIFAR-100.
Rather than directly measuring memorization. the Feldman score effectively measures whether the model can correctly classify a sample without having seen it, i.e., whether the model can generalize from the rest of the training set that sample. It can be interpreted constructing samlle validation set and comparing the model's performance on this sample to its performance on the training set. In this sense, the Feldman score directly measures generalization. can also be viewed as quantifying the uniqueness of a sample within the dataset. For example, two very similar samples of the same class that are distinct from the rest of the dataset (similar to duplicates found between test and train sets by Barz& & Denzler (2020) discussed in Appendix A.I will not receive a high Feldman score even if these samples are memorized.
In contrast, generalization does not affect the random label accuracy due to the non-existent correlation between label and sample, thus providing a measure of memorization independent of a possible link between memorization and generalization. The random label accuracy measures whether memorization occurs, irrespective of whether that memorization is beneficial.
Thus, the initially surprising lack of correlation between random label accuracy and the Feldman scores in fact supports the hypothesis that reduced memorization and improved generalization are not directly coupled.
18

---

Published as a conference paper at ICLR 2026
Bozskes pelgioa pape))
0.0
Figure A.12:
Distribution of memorization scores proposed by Feldman & Zhang (2020) and distribution of per-sample random label accuracy on CIFAR-100. The original data from Feldman Zhang (2020) were computed for ResNet-50, whereas our recomputed scores and random-labee label accuracy were derived using 1666
A.13 NOISY LABELS
To further analyze the effects of RLP-regularization on memorization, we examine the training accuracy randomly labeled samples within the training dataset. These datapoints can only be predicted correctly through memorization. As shown in Figure A.13] the RLP-regularizer reduces the training accuracy samples with noisy labels, while the accuracy on samples with intact labels remains high even for large regularization strengths. The proposed regularizer thus targets memorized samples specifically. This is particularly true for À 10a, where at the same time the test accuracy simultancously reaches its maximum. By limiting the memorization of incorrectly labeled examples, the generalization gap is reduced. This experiment highlights the strong connection between the random label accuracy of the RLP-head and training performance on noisy labels, as well as the effectiveness of the RLP-regularizer in mitigating memorization of noisy labels.
A
B
C
$75
67%
475
0.5
47%
4.%
415
33%
Jatect Lahda
AI Lalab
05 No Menostoatione Sa
Neay Labda
Figure A.13: ViT-B/32 ImageNet with 10% % label noise. Random label accuracy (A), train accuracy (B), and test accuracy (C) for increasing regularization factors A.
A. 14 MEMORIZATION UNDER OTHER REGULARIZERS
We compare the effectiveness of the random label accuracy as measure of memorization against the more direct approach of measuring memorization via training accuracy on noisy labels. We conduct this comparison under several common regularizers: label smoothing (Figure A.14), dropout (Figure A.15), and weight decay (Figure 16 Consistent with our observations in section 5.2 all regularizers lead to reduced random label accuracy, supporting the validity of this metric as indicator of network complexity. At the same time, the random label accuracy proves to be reliable measure of memorization when compared with the training accuracy labee-d datapoints. Our proposed memorization measure is fully non-intrusive and can be applied without altering the training data, unlike noisy label injection.
Comparing these results with those obtained when the RLP-regularizer is applied (shown for the same training setup in Figure A.13), we observe similar improvements in test performance. However, the primary purpose of the RLP-regularizer is not to specifically improve generalization, but to explicitly control memorization order to study and better understand its underlying mechanisms and identify when and where reducing memorization leads to improved generalization. While other regularizers also reduce memorization effectively (e.g., weight decay, which drives both random label accuracy and noisy label training accuracy close to 0%, as seen in Figure A.16), the RLP RLP-regularizer allows targeted application to arbitrary layers. This makes it particularly well-suited for studying the evolution of memorization within the network, e.g. explored in section 5.5
19

---

Published as a conference paper at ICLR 2026
A
B
Boslosta ale Noneay
46%
475
925
47%
37%
Eabds
025
30
0.4
0.0
0.2
Stawnhiig
Staoeikka
Labe
Figure A.14 ViT-B/32 on ImageNet with 10 % label noise and varying label smoothing strength.
475
C 02%
Duadber Labe becuur
575
8.%
435
375
2/6
L-bele
09
0.4
3.0
Disport Rate
Deppont Rate
Desport Bate
Figure A.15: VIT-B/32 on ImageNet with 10 % label noise and varying dropout strength.
A
B
C
k/4
+.75
87%
875
475
375
Jabar Labole
Labele
k5%
09
No Menwolaatbrn
Saay Eabit
325
Figure A.16: ViT-B/32 on ImageNet with 10 % label noise and varying weight decay strength.
A.15 FULL NETWORK RANDOM TRAINING
To further support the connection between the random label accuracy empirical memorization measure and Rademacher complexity. we compare the random label accuracy the proposed RLP- head with the training accuracy achieved when training entire network random labels across varying network widths.
The training accuracy obtained under fully random labels closely resembles the Rademacher plexity. The only approximations involved include using SGD to obtain an approximately optimal model instead of taking the supremum over all models, extending the binary-label definition multi-class accuracy setting, and estimating the expectation over random labelings via a finite number of independent training runs.
When varying the width of a WideResNet- 16-w, we observe a strong correlation between the perfor- mance on random labels when the full network trained end-to-end on these labels and the random label accuracy measured using the RLP-head only while the main network is trained correctly labeled data as done the rest of this manuscript.
This comparison also demonstrates that the aandom-labd accuracy of the RLP-head is primarily determined by the capacity of the feature extraction network, rather than by the capacity the head itself as long as the Rea- is chosen to be sufficiently large.
20

---

Published as a conference paper at ICLR 2026
Tatel
Fall
055
201
40%
b3%
53%
RIP-Hoal Biasken Labed Anornyy (Deleat))
Figure A.17: WideResNet- 16-w on -IFAR-100,11 10,000. Training the RLP-head only on random labels while the rest of the network is trained on class labels as performed in the rest of this manuscript compared against training the full network on random labels. Each datapoint represents a varying width factor w similar to Figure A.9
A.16 MEMORIZATION WITH MIXUP
We evaluate the effect mixup (Zhag et al, 2018b) on the random label accuracy. To do so, we apply mixup to the input images, class labels, and random labels during training, and then perform an additional epoch on the training set without mixup and without updating the weights in order to measure both the training accuracy and the random label accuracy. Since mixup is intended to reduce memorization, increasing the mixup strength (i.e., larger a:) indeed lowers the random-label accuracy. However, still observe substantial memorization even 10.
A 1974
B LUU
C
Bunkon Labe beuner
ax%
00377
47%
Tian
315
107*
10
1014
185
10
10"1
10
Miog
Milcp
Marqo
Figure A.18: 1 trained on CIFAR-100 with varying mixup strength a.
A. 17 ADVERSARIAL ROBUSTNESS
We evaluated the adversarial robustness of ViT-B/32 trained on ImageNet with the RLP-regularizer under attacks by PGD (Madry et al., 2018), FGSM Goodfellow et al. (2018) and PPGDTCrroc & Hein 2020). We used default hyperparameters and 0.1 for gaussian noise and 1/255 for the other attack methods. We report results for the difference of the accuracy under attack to the baseline (i.e., RL.-regularizer; À 0) for various regularization factors À in Figure A.19 and the exact accuracies under attack for optimal 10a in Table A. The RI.-rregularizrr improves the adversarial robustness in all scenarios.
Table A.I: Accuracy under adversarial attack of RLP-regularized models.
Gaussian Noise
PGD
FGSM
APGDT
baseline (A 0)
120.3
16.6202
23.420.3
17.620.2
reg-aagulrrized 10*)
26.2
18.0+0.4
24.9
18.5+04
21

---

Published as a conference paper at ICLR 2026
1.50
0.3
-1.8%
Heg
Figure A.19: Accuracy difference of RLP-regularized models to unregularized models under adver- sarial attacks.
A.18 MEMBERSHIP INFERENCE ATTACKS
We perform membership inference attacks on our ViT-B/32 trained on ImageNet to assess the RLP-regularizer leads improved membership robustness. We use an MLP with 2 hidden layers (dimensions 512 and 256) to perform binary classification on the sorted logits of the models to determine if a sample was part of the training data or not. We train our attack model on the logits of the original model and create a balanced test dataset to evaluate the accuracy of the membership prediction. The attack model is trained for epochs using the Adam optimizer with learning rate of 10 and a batch size of 256. We evaluate three independently initialized VIT models attacked by five independently initialized attack models each. While the model is not very vulnerable membership inference attacks without RLP- -LP-regularization (64.27 % + 0.05 %), the RLP-regularizer further increases the robustness the model reducing the membership accuracy to 62.27 % + 0.06 % for the regularization factor of optimal generalization À 10 Full results reported in Figure A.20)
$4.85
3106%
53.05
22,00
Figure A.20: Membership Inference Accuracy for ViT-B/32 models trained under RLP-regularization.
A. MEMORIZATION OF LONG-TAI SAMPLES
To test our hypothesis that memorization is beneficial for undersampled data distributions but for sufficiently sampled ones, we conduct an additional experiment using a ViT-B/32 model trained on the ImageNet-LT (long-tail) dataset Liu al. (2019b). ImageNet-LT a subset of the original ImageNet dataset in which certain classes are deliberately undersampled in the training set, while the test set remains unchanged.
We compare test performance as a function of the number of training samples per class, evaluating models trained with and without RLP-regularization Figure A.21 Under RLP-regularizztion, where memorization is stopped, lower test performance is reached for classes with low sample counts, ie. classes with fewer than 80 training samples are not learned. For classes with higher sample counts, performance sometimes improves and sometimes does not.
These results support our hypothesis that memorization is useful undersampled regimes and may may not be in oversampled regimes.
22

---

Published as a conference paper at ICLR 2026
1009
The hecewyy
4050
2t1. Boo No Rix
Figure A.21: VIT-B/32 trained for 300 epochs on ImageNet-LT without RLP-regularizer and with regularizer (A = 10"). Average test accuracy per class count.
A.20 RLP-HEADS INSIDE TRANSFORMER LAYERS
To test our hypothesis that memorization shifted into the transformer blocks under RLP- regularization applied to the output of all transformer blocks, insert additional RLP-heads inside the transformer blocks: after the attention mechanism, after the first fully connected layer, and after the second fully connected layer of each transformer block. The corresponding results are shown in Figure A.22
Although all additional heads detect memorization within the network, the largest values still appear at the output of each transformer block as measured in the rest of this manuscript. When applying RuP-regularization only the final block head, memorization is reduced in the components of later transformer blocks, as illustrated in Figure A.22A
However, when regularizing based on all RLP-heads, as Figure 8B
we observe non-zero memoriza- tion in the last four transformer blocks after the attention mechanism and after the first fully connected layer (see Figure A.22B). Additional memorization may also be encoded within the representations inside the attention mechanism itself.
67%
Ahte Loger
85%
Afte Loger
Stadee Aenuacy
After Mtttion
Aht Ateerion
After EC
07%
Alte EF
After
408
am
Rodien
307%
12
Tager
Tager
Figure A.22: Random label accuracy inside transformer blocks. A: Regularization based on the RLP-head attached after block 12 only. B: Regularization based on the RLP-headh attached after all blocks.
A.21 FROZEN FEATURE EXTRACTOR AFTER REGULARIZATION
To verify that memorization is genuinely mitigated by the RLP regularizer- and not merely concealed from the specific ViT-B/32 setup on ImageNet. We train a new RLPPhead as before, but keep the feature extractor frozen using the weights obtained from previous training with Rl.-regullariztiinn (in the default setup). This setup tests whether a newly trained RLP-head can recover the random labels using the representations learned under regularization. Importantly, the random-label mapping between samples remains unchanged across the two runs. With a regularization strength of À = 10 applied during training the feature extractor, the newly trained RLP- achieves random label accuracy of only 14.6 6.65557 % (the baseline is approx. 70 %, compare Figure 2A). This provides further evidence that the Ree-regglrrr effectively mitigates memorization rather than merely obscuring
trained alongside it. we conducted additional experiment using
A.22 TEXT CLASSIFICATION
We the RLP-heads study memorization in language tasks. Our experiments conducted on Yahoo! Answers (Zhang & LeCun 2016) using RoBERTa- base (Liu et al. 2019a) trained with Adam and learning rate of 2 10" with cosine scheduling for 50 epochs. Results shown in Figure A.23
23

---

Published as a conference paper at ICLR 2026
Interestingly, without regularization observe pronounced memorization in the early layers, peaking at layer and decreasing in later layers. This suggests that the model may be oversized for the given dataset.
While RIP-regularization applied via the RIP-head on the final (12th) transformer layer reduces memorization across all layers, do not observe shift of memorization towards later layers unlike the ViT results on ImageNet shown in Figure 8
Furthermore, accuracy does improve with RLP-regularization, indicating that memorization may actually benefit generalization for the studied model and dataset.
15.055
40%
12.6%
Toe
60.055
Figure A.23: RoBERTa-base trained on Yahoo! Answers with RLP-regularization based the RLP-head attached to the final (12th) transformer layer only. A: Random label accuracy of hee-heads at different layers. Memorization occurs in early layers and is reduced in later layers. B: The test accuracy does not improve when memorization is suppressed.
24


Reviews:
[{"review_id": "N9b6ekgF5q", "reviewer": "Reviewer_BWFD", "summary": "The paper introduces Random Label Prediction (RLP) heads: auxiliary prediction heads attached at various depths that are trained to predict fixed, per-example random labels during standard supervised training. The accuracy of these heads is used as a proxy for memorization/capacity. The authors also propose an RLP regularizer that discourages the feature extractor from confidently fitting the random labels, aiming to limit memorization without changing the task head. Experiments on ViT-B/32 with ImageNet and WRN-16-4 with CIFAR-100 show: (i) RLP accuracy rises early in training and can reach high levels on ImageNet; (ii) standard regularizers like dropout, weight decay, and label smoothing tend to reduce RLP accuracy; (iii) the RLP regularizer can improve ImageNet generalization but can hurt on CIFAR-100; (iv) RLP attached at intermediate layers suggests memorization increases with depth, and regularizing only the last layer can shift memorization earlier.", "questions": "1. CIFAR100 is known to have near duplicates in train and test sets, this could be causing the contrary results on CIFAR100, would de-duplicated CIFAR100 be a better fit?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Simple, general mechanism that is easy to add and interpret: higher random-label accuracy indicates more sample-specific information in the features.\n\n2. Clear empirical phenomena: early rise of RLP accuracy and monotonic increase with depth.\n\n3. Useful bridge from measurement to control: correlation with common capacity controls and a targeted regularizer derived from the same signal.\n\n4. Layerwise analysis reveals memorization shifting under last-layer regularization and provides a way to localize where class information emerges.", "weaknesses": "1. Theoretical grounding is informal. The connection to Rademacher complexity is motivational rather than a formal result; no theorem guarantees RLP accuracy is a calibrated surrogate for capacity in deep nets.\n\n2. Attribution is ambiguous. The metric may conflate memorization in the feature extractor with the auxiliary head’s own capacity, the number of random labels, and optimization budget. Appendix ablations help but a clearer identifiability story would be better.\n\nMinor comments\n1. Please switch to the official ICLR template and fonts; the current submission uses a nonstandard font.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "BTfwlHSimT", "reviewer": "Reviewer_xMP4", "summary": "The paper proposes Random Label Prediction heads (RLP-heads) as a simple mechanism to measure and control memorization in deep nets during standard supervised training. Each training sample is given an auxiliary random label. A small prediction head attached to an intermediate activation is trained to predict these random labels in parallel with the main task. The authors interpret the RLP accuracy as an empirical proxy for Rademacher complexity and use it to study how memorization evolves over time and across layers. They also introduce a regularizer that penalizes correct random-label predictions to suppress memorization while keeping the task head untouched. Formally, the losses are L_{\\text{class}}=-\\log p_y, L_{\\text{rnd}}=-\\log \\hat p_{\\hat y}, and the regularizer L_{\\text{reg}}=\\log(1-\\hat p_{\\hat y}) scaled by \\lambda. \n\nEmpirically, the paper shows:\n1.\tRLP accuracy tracks capacity and overfitting dynamics, rising to about 70 percent when training ViT-B/32 on ImageNet as test and train accuracies begin to separate. \n2.\tStandard regularizers like dropout, weight decay, and label smoothing reduce RLP accuracy, supporting the complexity interpretation. \n3.\tUsing L_{\\text{reg}} can reduce overfitting and improve test accuracy on ImageNet with ViT (about +1.5 points), but on CIFAR-100 with WRN it reduces memorization without helping test accuracy.\n4.\tLayer-wise probes reveal memorization grows with depth and that regularizing the final layer shifts memorization earlier rather than eliminating it. \n5.\tDataset size and noise matter. Suppressing memorization helps when data are well sampled, but can hurt on undersampled datasets. Adding label noise makes the regularizer beneficial, as predicted.", "questions": "•\tCan the authors formalize the connection between RLP accuracy and empirical Rademacher complexity for multiclass settings, perhaps via margin based surrogates or a bound that depends on head capacity and n?\n•\tHow sensitive are results to the random label assignment itself; do multiple seeds produce similar \\lambda optima and layer profiles, and what is the variance?\n•\tCould you compare RLP regularization against mixup or manifold mixup at matched hyperparameter tuning budgets, and report both accuracy and calibration?\n•\tDo RLP metrics predict robustness or privacy leakage; for example, do higher RLP accuracies correlate with membership inference or canary extraction rates?\n•\tOn long tail datasets like iNaturalist or ImageNet LT, does suppressing memorization reduce performance on rare classes; per tail analysis would test the hypothesis directly\n•\tFor the observed shift of memorization to earlier layers, can you probe within blocks to rule out within block hiding; e.g., multiple taps inside the same transformer block\n•\tWhat is the runtime and memory overhead of single head vs multi head vs all layers, and how does this scale with n and hidden size\n•\tDoes RLP regularization interact with self supervised pretraining; does it help fine tuning stability or hurt transfer", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "•\tOriginality: using online random-label heads to continuously estimate per-layer memorization without retraining on random labels is clever and practical\n•\tQuality: solid empirical study across architectures, datasets, head designs, and hyperparameters, including offline sanity checks and dataset subsampling\n•\tClarity: method, losses, and training protocols are well specified, figures communicate dynamics and layer-wise trends\n•\tSignificance: provides a low-overhead diagnostic for memorization and a tunable knob to reduce it, yielding nuanced insights on when memorization helps or hurts generalization; the layer-wise shift phenomenon is especially interesting", "weaknesses": "•\tThe mapping from RLP accuracy to Rademacher complexity is argued empirically; a theoretical bridge or formal bound would strengthen the claim beyond correlation\n•\tImprovements on ImageNet are relatively small and sensitive to \\lambda; practical guidance on choosing \\lambda beyond grid search is limited\n•\tBaseline comparisons are missing to targeted anti memorization methods such as mixup, manifold mixup, early stopping with sharpness awareness, or confidence based noise filtering; the paper mostly compares to generic capacity regularizers\n•\tThe regularizer may alter features in ways that indirectly affect the main head; while gradients are restricted, feature extractor changes can still trade off task signal vs sample specificity; stronger checks isolating collateral effects would help\n•\tThe undersampling hypothesis is compelling but remains somewhat post hoc; additional controlled long tail benchmarks or per class sampling analyses would solidify it\n•\tCompute overhead and wall clock costs from extra heads, multi head variants, and per layer probes are not quantified in detail; practicality at large scale is uncertain\n•\tPrivacy claims are hinted at in motivation but not evaluated; no extraction or canary tests are provided", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rvjPCTUN6b", "reviewer": "Reviewer_hHXA", "summary": "The paper proposes a method to measure memorization in deep models. The method involves a trainable RLP heads that can be attached to any layer of the network. The performance of RLP heads serves as a proxy for sample-level memorization. The authors also propose an RLP-based regularizer that reduces memorization by penalizing confident random-label predictions.", "questions": "Refer to points above", "limitations": "", "rating": 2, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "I think this is a really important problem, especially given the fact that sample-level memorization is expensive. The authors present a light weight solution, that can not only be run with relatively low latency, but can also be adapted to different layers of the model. I think this paper has a lot of potential if the authors can address the concerns below.", "weaknesses": "1. Lack of Suitable Baseline:\n\nRLP approximates sample-level memorization. However, the paper lacks a clear baseline to verify whether the points identified or regularized by RLP are indeed the truly memorized samples. This is a major concern. The authors should validate this by comparing RLP’s behavior against established memorization benchmarks. This can be using Feldman et al.’s methodology or by introducing random noise images or “canary” points into the dataset. This would help determine whether 1) RLP selectively targets memorized data or unintentionally affects well-learned samples 2) It will also help understand how RLP behaves when base points are learned vs memorized. At this point, it is hard to gauge how well this technique performs. However, a good baseline can alleviate those concerns.\n\n2. Limited Comparison with Existing Regularization Methods:\n\nAlthough the authors present preliminary results suggesting that RLP-based regularization reduces memorization, the study lacks *direct* comparisons to standard regularizers (e.g., dropout, weight decay, or label smoothing). Such comparisons are critical for understanding whether RLP provides a distinct benefit beyond existing techniques. Ideally, these evaluations should be performed along two axes: (a) classification accuracy on intentionally mislabeled or noisy points (refer to point 1) to measure memorization control and (b) test accuracy on clean data (to assess generalization). Without these baselines, it is difficult to fully gauge the contribution and novelty of RLP as a regularizer.\n\n3. Narrow Experimental Scope:\n\nThe current experiments are restricted to vision models trained on image datasets. Extending the analysis to text classification models and even LLMs would significantly strengthen the work, demonstrating the generality of RLP as a tool for studying memorization across architectures and domains.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WJdSkO73D1", "reviewer": "Reviewer_Lg7F", "summary": "This work proposes a new mechanism that both measures and regularizes memorization in ML models. The proposes mechanism introduces a loss term that measures how well a learned representation can be used to predict randomly assigned labels. Smaller loss is correlated with stronger memorization in the representation. The loss then can become a regularizer that prevents memorization. Empirical study shows that the  reduced memorization may have different effects on model utility depending on the sample size and the nature of information being memorized.", "questions": "1) Could you use a different metric for memorization, say influence-based heuristic in [1] or a method of your choice, to show that the model has less memorization when regularized more heavily with RLP?\n\n2) Has empirical Rademacher complexity ever been used as regularizer before?\n\n3) There has been literatures showing memorization could be beneficial (long-tail) [2] and detrimental (wrong-label) [3]. What are the key insights in this work's experiment that are different from the previous work?\n\n[1] Feldman, Vitaly, and Chiyuan Zhang. \"What neural networks memorize and why: Discovering the long tail via influence estimation.\" Advances in Neural Information Processing Systems 33 (2020): 2881-2891.\n\n[2] Feldman, Vitaly. \"Does learning require memorization? a short tale about a long tail.\" Proceedings of the 52nd annual ACM SIGACT symposium on theory of computing. 2020.\n\n[3] Liu, Sheng, et al. \"Early-learning regularization prevents memorization of noisy labels.\" Advances in neural information processing systems 33 (2020): 20331-20342.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "This paper proposes an interesting and effective mechanism based on simple principles to detect and control memorization. The design is interesting and the intuition is clear. Well done. The work is technically sound.", "weaknesses": "Despite the smart design of RLP-head and the fairly comprehensive experiments, there seem to be a few missing links in the argument of the paper. Specifically:\n\n1) The paper proposes the loss on random label prediction as **both** the regularizer **and** the measure of memorization. Notice that the RLP loss serves as a proxy of empirical Rademacher complexity, which measures the model's capacity to memorize instead of the amount of memorization. Does a low RLP score necessarily mean less memorization?\n\n2) Given the plethora of work on the pro and cons of memorization, I wonder if the empirical evaluation results and their implications are different from previous work. (See questions.)\n\nIn addition, the pdf file seems not fully follow the template. Some margins between the paragraphs are too small. Hope this can be fixed in future versions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)