Separating Knowledge and Perception with Procedural Data
Authors: Adrian Rodriguez-Munoz
Manel Baradad
Phillip Isola
Antonio Torralba
Venue: ICML 2025 poster (2025)
Keywords: computer vision
visual memory
procedural data
deep learning
Primary area: applications->computer_vision
TL;DR: Improve on visual memory approaches by training on procedural data, ensuring compartmentalisation and control over all real data.

Abstract: We train representation models with procedural data only, and apply them on visual similarity, classification, and semantic segmentation tasks without further training by using visual memory---an explicit database of reference image embeddings. Unlike prior work on visual memory, our approach achieves full compartmentalization with respect to all real-world images while retaining strong performance. Compared to a model trained on Places, our procedural model performs within 1\% on NIGHTS visual similarity, outperforms by 8\% and 15\% on CUB200 and Flowers102 fine-grained classification, and is within 10\% on  ImageNet-1K classification. It also demonstrates strong zero-shot segmentation, achieving an $R^2$ on COCO within 10\% of the models trained on real data. Finally, we analyze procedural versus real data models, showing that parts of the same object have dissimilar representations in procedural models, resulting in incorrect searches in memory and explaining the remaining performance gap.

Separating Knowledge and Perception with Procedural Data
Adrián Rodriguez-Murozz
Manel Baradad
Phillip Isola'
Antonio Torralba'
Train procedural vision model...
a.. solve tasks with real visual memory...
for unlearning and privacy guarantees
Procedural data
Classification
Data unleaming
Stmilar examolesin memary
Majorit
"Dog'
Memory
"arboge truck"
X
"Orgenn
Segmentation
Data privacy
Query
Ground Truth
Zeca-bot prediction
Memory
SSL
Embedding model
fo
Figure 1: Our approach is follows: first, embedding model is trained procedural data generated with OpenGL code using sulf-suee learning (SSL).
stage, unlearning and attribution difficult, but procedural data much less exposed to privacy/bias risk and real- world semantics. Next, we use the embedding model on real world tasks using only a visual memory of reference image embeddings, without extra training. When working with real instead of procedural data, there is high privacy/bias risk and real world semantics. However, isolating all real data to only the memory makes efficient data unlcarning and privacy analysis possible. The overall system has perfect control over all real world data, while approximating the performance of standard training.
Abstract
fine- fine-grained classification, and is within 10% on ImageNet-IK classification. It also demonstrates strong zero-shot segmentation, achieving an R² COCO within 10% of the models trained real data. Finally, we analyze procedural versus real data models, showing that parts of the same object have dissimilar representations in procedu- ral models, resulting in incorrect searches in mem- ory and explaining the remaining performance gap.
We train representation models with procedural data only, and apply them on visual similarity, classification, and semantic segmentation tasks without further training by using visual memory- explicit database of reference image embed- dings. Unlike prior work visual memory, approach achieves full compartmentallzztion with respect to all real-world images while retaining strong performance. Compared to a model trained on Places, our procedural model performs within 1% on NIGHTS visual similarity, outperforms by 8% and 15% on CUB200 and Flowers 102
1. Introduction
'Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology, Cambridge, USA. Corre- spondence to: Adrian Rodríguez-Muüozz <adrianım@ @ mit.edu>.
Modern vision systems learn by digesting images into weights via gradient descent. While offering strong perfor- mance, this approach carries concerns about interpretabilityy privacy, and bias. Moreover, it makes adding and removing data difficult, since weights store knowledge in a black-box manner. To alleviate this issue, prior work proposed the
Proceedings of the 4nnd International Conference on Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Separating Knowledge and Perception with Procedural Data
Procedural data
Realistic data
Stylegan Learnin by Looking in Noke froddeden al 2022
+ Procedural image Program for Bap Segpreaaatttonnomm Leeriin foradid ot 2022
Masked Shaders
1 Places
Imagehiet
Macm: A 10 Bian Image Databuse for scans Becogation Thout al 2016
Imagehat Large Scale
Gura
Viual leeegn tion Challenge
Russalonnity et 2015
Stylegan
Shaders
S. Mixup
Mavied Shaders
KMI Mixup
Places
Imagehett
Figure 2: Examples of procedural data from prior work, our new Masked Shaders: Shaders KML and Shaders KML Mixup, and the real datasets Places and ImageNet. Masked Shaders have higher diversity and consistently beat prior processes downstream tasks.
Classification...
remains just one problem, the feature embeddings also parametric model trained on data. While adding and re- moving training samples from the memory is easy, doing so from the feature embeddings is not. In this work, we propose training the embedding model with procedural data. Unlike real world data, procedural data is non-realistic and is generated via simple code, and thus is much less exposed to the privacy bias risks that motivate unlearning. Figure 2 compares examples of procedural and real images. Prior work focused on combining procedural embeddings with linear classifiers trained on real data (Baradad et al., 2021; 2022), and only very briefly mentioned using a neighbors approach. this work, we delve deeper into this ability and explicitly make the connection visual memory perception.
w,tttt visual memory
with classifier
"Tench"
"Iench"
Classifier
KNN
Embeddiing madel
Embeddiing model
fo
fo
R
Query
Memory
Query
Adding and removing data...
...tith visual memory
...with a classifier
Our contributions are follows:
Add/remove from memory
X Requires retraining
1. We demonstrate that procedural embeddings with vi- sual memory allow perfect unlearning and privacy guar- antees w.r.t. all real data, while retaining strong perfor- mance.
datast
Wlemory
Classifer
Figure 3: Classification with visual memory uses k- k-nearest neigh- bours (KNN) w.r.t. a database of embeddings rather than a para- metric classifier (top). This allows efficient adding and removal of data through modification of the database (bottom).
2. We introduce the new procedural data processes Shaders KML and Shaders KML Mixup, which yield stronger embeddings than those of prior work.
We show that procedural embeddings possess remark- able zero-shot and in-context semantic segmentation abilities, on the same order of magnitude as embed- dings trained on real data.
idea of explicitly separating how knowledge is represented, the feature embeddings, from what knowledge is stored, the visual memory (Geirhos et al., 2024; Weston et al., 2015; Chen et al., 2018; Iscen et al., 2022; 2024: Gui et al., 2024: Silva et al., 2024). Depicted in Figure 3, they called this approach "perception with visual memory"'
2. Related work
Unlike a traditional network which feeds the query embed- ding through classifier to obtain the output, perception with visual memory works by taking the query embedding, retrieving its k-nearest neigbhours (KNN) from the mem- ory, and outputting the majority label. This in turn makes adding and removing knowledge easy and efficient: while the classifier would need to be fine-tuned or retrained, the visual memory can simply add and drop data samples. There
Visual memory marries the compartmentalizzatoo and in- terpretability of databases with the effectiveness of neural methods. This is done by applying k-nearest neighbours al- gorithms on trained neural embedding databases (Papernot & McDaniel, 2018). Prior work has proposed employing this technique for shw- learning (Wang et al., 2019; Yang et al., 2020; Bari et al., 2021), adversarial robustness (Sitawarin Wagner, 2019; Papernot McDaniel, 2018:
2

---

Separating Knowledge and Perception with Procedural Data
Rajani et al., 2020), medical image classification (Zhuang al., 2020), confidence calibration (Papernot & McDaniel, 2018), interpretability (Papernot& & McDaniel, 2018: Ra- jani et al., 2020; Wallace et al.. 2018; Lee et al.. 2020), image denoising (Plötz& & Roth, 2018), retrieval- augmented learning (Khandelwal et al., 2020; Drozdov et al., 2022), anomaly and out-of-distributin detection (Bergman et al., 2020; Sun et al., 2022), and language models (Wu et al., 2022; Khandelwal et al., 2020; Min al., 2024). In our work, we specifically build on top of (Nakata et al., 2022) and (Geirhos et al., 2024), which showed the effectiveness of visual memory at large scale. Different from them, we use procedural data to train the embeddings, thus making all real data used be under database-like control.
Reference
Option A
Option B
Reference
Option A
Option B
Realetic
Proceduca
Randors brit
Figure 4: Examples from the NIGHTS dataset, along with human, realistic model, and procedural model judgments.
NIGHTS Va Human Visual Simi arity Alignment
% Alignment with Humans (2AFC)
100
90
Stacer
Faubiic
Syn to real 0.9%
Sryer wwwtotttn//aaeeeeeeeeee mit
Procedural data approaches train networks on non-realistic data generated via code. The benefits of this are several fold: it makes the process more interpretable and optimizable (Sun et al., 2021), can be used to improve the privacy-utility tradeoff of differentially private gradient descent (SGD) (Abadi et al., 2016; Tang et al., 2023; Choi et al., 2024), and provides insights on the human visual system. Prior work has explored using fractals (Kataoka et al., 2020; An- derson& & Farrell, 2022: Nakashima et al., 2022), untrained generative networks (Baradad al., 2021), and recently, openGL. programs (Baradad et al., 2022). We contribute two new processes that obtain higher performance, and show the semantic segmentation ability of procedural models.
80
Random init.
S. KML Mixup
70
Stylegan
ImageNet
Shaders
S. Mixup
60
PS/RR
S
S. KML
Places
LPIPS
DISTS
50
Figure 5: Models performance on the NIGHTS- Val benchmark.
The best procedural model, trained on Shaders KML. has a high % alignment with humans of 82.4%, within 0.9% of the Places model, trained on realistic data without domain overlap.
not only low-level colors and textures, which are easily captured by simple white-box metries, but also on mid-level similarities in layout, pose, and content, that are harder to define. Figure 4 shows examples from the dataset with human and model answers. Results in Figure 5 show that procedural data metrics have performance within 1% of the Places model, trained on real data without domain overlap. The ImageNet model has class overlap with NIGHTS, and thus is only for reference. White-box metrics like PSNR and SSIM barely perform above chance.
3. Train procedural embeddings
We train an embedding model using procedural data, sim- ilarly to (Baradad et al., 2021; 2022). Unlike typical syn- thetic data which approximates the target distribution using a complex generative model, procedural data is created with simple programs. See Figure 2 for the procedural and real datasets considered in this work. We train vision transform- ers (ViT) (Dosovitskiy et al., 2021) using the local-to-glos to-gblba similarity objective of DINO (Caron et al., 2021). On real data, this objective teaches models to have similar represen- tations for parts of objects existing in reality, leaking biases and personal identities in the process. In contrast, the same objective but with procedural data teaches to have similar representations for parts of abstract shapes and textures, with much less risk of biases and privacy leakage. Procedu- ral embeddings lack knowledge of real world entities, yet surprisingly strong.
3.1. The Shaders KML Mixup process
The prior best procedural dataset is Shaders Mixup from (Baradad et al., 2022). They observed that models trained on the raw Shaders dataset learned short-cut solutions with poor generalization, but interpolating multiple samples in pixel space with Mixup (Zhang et al., 2018) alleviated the issue and achieved new state-of-the-art.
In our work, we derive stronger approach that extracts mixing masks from the Shaders images, rather than always
We evaluate the procedural networks on Human Visual Similarity (HVS) task using the NIGHTS dataset (Fu et al., 2023), an analysis missing in prior work. This benchmark consists of a Two Alternative Forced Choice (2AFC) on trios of images: given a reference and two options, which option has greater embedding cosine similarity with the reference? The test measures ability to match human judgments
Mask from Mixup
Masks extracted from shaders using K-Means
Figure 6: Constant mixing mask used by mixup (left) vs data driven mixing masks obtained using KMeans (right). Using the latter leads much greater diversity.
3

---

Separating Knowledge and Perception with Procedural Data
Sample shaders
Extract mask RR (Mronn(ss
Compute mixture
m) 5g
Realistic
Procedural
Random init.
ImageNet-1K 1K
Imagehett
Places
5. KVL Mixu
S. Mbup
Stylegan
Random
Query
Figure 7: Diagram of the Shaders KML process, First, three shaders $1, 82, and 8a are sampled. Next, $1 used to obtain mask m using KMeans in RGB space. Finally, we mix 82 and $3 using mn to obtain the Shaders KML. sample.
NX mnmomrry
using a constant mixing mask like in Mixup, As seen in Fig- ure 6 this has the effect of increasing dataset diversity, found in (Baradad et al., 2021) to be one of the biggest drivers of performance for non non-realistic data. We call this process, shown visually in Figure 7, Shaders K-Means Leaves (S. KML). Shaders KML obtains comparable performance to Shaders Mixup. Applying Mixup on Shaders KML to su- press short-cut solutions yields the Shaders KML Mixup process, obtaining a new state-of-the-art as seen in Table 1.
CUB200
ImagaNiet
KMR Misup
Misup
Stylegan
Random
Query
NN in memory
4. Classification and segmentation with visual memory
We apply the procedural models on classification and seg- mentation tasks without further training using visual mem- ory. We compare procedural data with training on Places, dataset of natural images different to the evaluation dis- tribution, which acts as an upper bound to procedural data.
Flowers 102
ImageNet
Places
Mixup 4 S. Misup
Stylegan
Rendom
Qutry
Results for training on ImageNet, which is either the target dataset or has high overlap, is included only for reference.
Classification is qualitatively more challenging than the similarity task from Section 3: going from mid-level con- cepts in a small three image set, to higher-level seman- ties in large and diverse look-up pool of up to O(I)) images. However, procedural models still obtain strong performance. Table I shows KNN classification accuracy on various fine-grained datasets and ImageNet-IK K (Rus- sakovsky et al., 2015). Remarkably, the best procedural model actually beats the model trained on Places (Zhou et al., 2018) on the fine-grained classification datasets, by 15%, 8%, and 1% Flowers 102 (Nilsback & Zisserman, 2008), CUB200 (Wah et al., 2011), and Food101 (Bossard et al., 2014) respectively. We posit that this is due to the little or no semantic overlap between Places and the three fine-grained datasets, which means the Places model spends capacity on semantic associations that are not useful. In contrast, the procedural models learn foundational skills from abstract shapes and textures that may better generalize. As sanity check, all procedural models are worse than the ImageNet model which has semantic overlap with all three fine-grained datasets. On ImageNet-IK K classification, the best procedural model is within <10% of the Places model. Figure& 8 shows a query image and its nearest neighbors (NNs) for three datasets, visually showing the abilities of procedural models.
NN in memorrs
Visual comparison of query images from various datasets and their neareast neighbours according to each of the models. Procedural models can effectively search for perceptually similar images wide variety of datasets, despite not seeing real-world data during training.
Figure 8:
Duta type
Dataset
Fine-grained CUB
General ImageNet-IK IK
Flowers
Food
Tanget
ImageNet
83.43
55.20
64.45
68.89
Realistic
Places
59.51
19.09
47.78
47.30
KML Mixup
75.20
27.08
48.70
37.88
KML
71.86
24.02
46.00
35.38
Procedural
Mixup
73.33
19.85
47.78
35.45
Shaders
66.18
15.59
38.05
30.69
Stylegan
41.86
8.61
22.73
13.73
Random init.
11.18
1.93
5.32
1.84
White-box
SIFT
3.08
Table 1: Performance on KNN classification with visual memory. The best procedural model, trained on Shaders KMI. Mixup, beats the realistic Places model on Flowers, CUB, and Food fine-grained classification, and has gap of only 10% on ImageNet- IK.
4

---

Separating Knowledge and Perception with Procedural Data
Realistic
Procedural
Random init.
Image
Ground Truth
ImageNet
Places
S. KML
Shaders
Stylegan
Random
Zero-shot (PC resemmnntan
Figure 9: Zero-shot segmentation on COCO (Lin et al., 2015) using principal component analysis (PCA) features. Procedural models clearly separate the bike and zebra from the background. However, visually distinct parts of the bike, such as the center and spokes of the wheel, have similar and dissimilar representations in real and procedural models respectively. This is duc to procedural models not having seen bikes before, while real madels learn they parts of the object.
Prompt
Image
Ground Truth
ImageNet
Places
S. KML
Shaders
Stylegan
Random
In-context segmentation
Figure In-context segmentation Ade20k (Zhou al., 2017). Procedural models can segment arbitrary classes given a single exemplar prompt. This holds even in the second image, where there are many distractors of the same color.
IONN Segmentation
Image
Ground Truth
ImageNet
Places
S. KMLL
Data type
Dataset
cocO
ImageNet
63.7
Realistic
Places
62.1
S. KML Mixup
53.7
Figure 11: KNN segmentation Pascal (Everingham al., 2010). Procedural models are limited at segmenting with KNN. to not seeing real-world objects during training, representations of individual parts can be very dissimilar. This leads spurious simi- larities with object parts of other classes, harming performance.
S. KML
55.9
Procedural
S. Mixup
51.4
Shaders
55.0
Stylegan
48.5
Random init.
36.7
Segmentation:
Procedural models have remarkable seman- tic segmentation ability. Figure 9 qualitatively shows how procedural features clearly separate the bike and zebras from their surroundings. Quantitatively, Table 2 shows numerical R2 (ratio of explained variance total variance) between principal component analysis (PCA) features and human labels. The best procedural model is within 10% of real data models and highly above random and RGB features. Proce- dural models are also capable of in-context segmentation: given prompt image and a prompt mask representing a concept, they can effectively search for in new query image, even in the presence of equally colored distractions like in the second row of Figure 10. However, they struggle at KNN semantic segmentation with large visual memory, as seen in Figure I1. As explained in Section 3, the DINO
White-box
RGB
19.4
Table R² of PCA features and human label segmentations.
objective on real data teaches models to have similar rep- resentations for parts of real world objects, even when the parts are visually dissimilar. In contrast, procedural models, having never seen the object during training, will have dis- similar representations for the parts. We can observe this in Figure 9: the center and spokes of the wheel colored the same in real models and differently in procedural models. Procedural models have excessively local representations which are vulnerable to spurious similarities with object parts of other classes.
5

---

Separating Knowledge and Perception with Procedural Data
Classified by procedural models
ImageNet
Places
KML
Stylegan
Random
Query PCA
NN-1 1 /PCA
x
NN-1 /PCA Query PCA
Not classified by procedural models
ImageNet
Places
KML
Stylegan
Random
Query /CA
NN-1 /PCA
NN-1 /PCA Query PCA
X
X
03:
Figure 12: Feature PCAs of images correctly (top) and incorrectly (bottom) classified by the Shaders KML Mixup model. PCAs for correctly classified images separate distinct objects and join parts of the same object (fish, face). In the other hand, in incorrectly classified images they fail separate distinct objects (wall and body of the plugs) fail to join parts of the same object (hand and face of the dial).
5. Analysis of limitations
parts of the same object (the hand and face of the dial have different colors), problems which are not the case in the feature embeddings trained ImageNet.
Despite their good performance, procedural models still lag behind models trained on real data. this section, we develop insights on why and how this gap occurs. Figure shows feature PCAs of images and their nearest neighbor in memory according to each model. We observe that correctly classified images have feature PCAs close the natural segmentation: distinct objects are clearly separated, and parts of the same object such as the fish and the face share a single distinct color. contrast, for images classified incorrectly PCAs fail to separate distinct objects (the switch cable and casing have very similar colors) or fail join
Due to never having seen them during training, procedural models do not know to identify the object that defines the class (e.g. dial, switch) as a single entity, leading to incorrect nearest neighbours. For example, in the balance image (first incorrect example), the S. KML Mixup model separates the metallic balance, dial face, and dial hand in green, yellow, and purple respectively. The nearest neighbour correctly has similar looking regions, but is the wrong class. We leave finding ways of addressing these limitations to future work.
6

---

Separating Knowledge and Perception with Procedural Data
Receive legal privacy takedown request from
Procedural training
Realistic training
Realistic training
Realistic memory
Realistic memory
Realistic classifier
Can remove from memory
Can remove from memory
Requires retraining
used in memory
Memory
Memory
X
Can't occur!
X
Requires retraining
X
Requires retraining
used train embeddings
Embedding model
Embedding model
Embedding model
Unlearning procedure response legal privacy takedown request. Prior visual memory approaches can efficiently unleam data in the memory, hut not data used train the embedding model. Our proposal use procedural data makes the latter case much likely, as procedural data has drastically lower exposure to privacy risk.
Figure 13:
6. Efficient unlearning and privacy guarantees
80
Stylegan
Accuracy (%)
Lastly, we explore how our approach can efficiently unlearn data and compute privacy guarantees, two problems that are expensive and difficult for prior approaches.
60
Shaders
S. KML Mixup
40
Masked Shaders
S. Mixup
Data unlearning is the problem of eliminating a piece of data from the weights of model. This is important issue especially when it comes to images of humans, NSFW, or illegal content, and has received widespread attention in generative models. Prior work has focused on editing the weights to suppress the concept, but current methods are not infallible and still use the "contaminated" weights initial point, which wouldn't 't satisfy a legal request. Visual memory (Geirhos et al., 2024) offers compelling solution: simply remove the offending data from the memory. How- ever, this approach fails when the offending data was used to train the embeddings, as seen in Figure 13. Training on pro- cedural data solves this problem elegantly by suppressing this possibility, as it has little privacy risk.
20
Stylegan
Shaders
S. KML
0.35%
0.40%
0.45%
0.50%
0.55%
Fraction non-private images in memory (%)
Non-private training samples (%) versus KNN classifi- cation accuracy on ImageNet for the procedurally trained models. A linear relationship between accuracy and privacy observed, though only 0.6% training samples are non-private.
Figure 14:
when removed from the memory, change the prediction of at least one test image) on ImageNet-IK, K. It shows linear trend between performance and privacy, although the mod- els are quite private as less than 0.6% of the samples are non-private.
Differential privacy characterizes anonymity of individ- ual samples in training set (Dwork & Roth, 2013; Dwork et al., 2006; Dwork, 2011). ). For a deterministic model, the definition is: let be the learning algorithm, the training set, and A(D) the model predictions. Then A has differ- ential privacy for x D if A(D {x)) A(D). This expensive compute when was used to train the em- beddings: the latter change, so re-training is required. In contrast, for procedural embeddings with visual memory we can simply compare test set predictions with and without any real image z in the memory, which takes little time to compute. Figure 14 plots KNN classification accuracy vs the fraction of non-private training images (those which,
Sensitive data information that legally or ethically needs to be handled with high standards of care and control, such as facial identity medical data. In this scenario, directly training on the data is often not acceptable; procedural mod- els with memory thus offer an elegant solution. Figure 15 shows CelebA (Liiu et al., 2015) query images and nearest neighbours according to the S. KML Mixup model. The latter effectively matches appearance and facial expressions despite never training on faces. Table shows classification accuracy on the MedMNIST datasets (Yang al., 2021). where see that the procedural models match exceed the best result from the paper in 7 out of the 10 datasets studied, and obtain good performance otherwise.

---

Separating Knowledge and Perception with Procedural Data
Query
memory
Query
NN memory
Query
NN memory
Figure 15: Despite never training faces, the Shaders KML Mixup model can match for appearance and facial expressions CelcbA
Data type
Dataset
Path
Derma
OCT
Pneum
Breast
Blood
Tissue
OrganA
OrganC
OrganS
Best from original paper
91.1
76.8
77.6
94.6
86.3
96.6
70.3
95.1
92.0
81.3
ImageNet
98.34
82.05
95.11
95.23
91.03
96.79
57.00
94.33
93.81
85.89
Realistic
Places
98.21
80.96
94.52
96.18
91.03
95.85
54.83
90.09
92.56
82.26
S. KML Mixup
98.60
81.36
92.85
96.56
93.59
95.09
55.62
83.76
81.48
74.43
KML
99.30
82.15
92.12
96.56
91.03
96.26
58.02
85.07
85.37
81.57
Procedural
Mixup
98.88
81.56
89.14
96.56
92.31
96.73
53.27
81.96
82.53
74.10
Shaders
98.96
81.26
92.09
95.61
92.31
97.72
58.74
86.83
86.04
81.69
Stylegan
98.05
77.67
85.04
95.04
87.18
91.59
53.10
76.81
77.30
76.06
White-box
Random init.
73.05
67.50
66.39
84.54
83.33
85.51
44.27
75.07
68.94
60.93
Table 3: KNN classification accuracy on the MedMNIST datasets. Procedural models match or exceed the best result from the original paper (Yang et al., 2022) (a normally trained ResNet) in 7/10 datasets.
Top-1 Accuracy (%)
Training cost: First and foremost is the computational cost of training. Training the linear classifier required 4 GPU- days on an 8-V100 node, while computing the embeddings of KNN classification required just 1.5 GPU-hours and doable on single GPU. The ratio ~64X. If the set of classes (the "world") static, then the initial training is a one-time cost that may be acceptable. However, the real world is anything but static, and re-training costs can quickly spiral.
70
ImageNer
+9.33
Target distribution
Realistic
Procedural
Places
+3:21
00800
40
+5.79
+1 +1118
S. KML Mixup
ViT-Tiny
VIT-Small
ViT-Base
VIT size
Figure 16: KNN classification accuracy ImageNet-1K IK as Vi- sion Transformer (ViT) size is scaled. Procedural models dont as size increases; higher capacity yields higher performance.
Inference cost: costs of the KNN classifier were about double of the lin- ear classifier's (1min52s vs 4min for the entire ImageNet validation set of 50k). However, dedicated efficient near- neighbour search libraries such faiss (Douze al., 2024; Johnson et al., 2019) make search much more efficient in production setting i.e. with queries within 10M database taking <0.03ms.
On the original research code, the inference
7. Model size scaling
Figure 16 plots classification accuracy on ImageNet- 1K versus model size. We observe that models do not overfit to procedural data capacity increases, suggesting that with larger models performance increases.
Memory cost: The storage requirements is where the memory-based approach is most demanding compari- son with the classifier approach, as the former scales with the number of examples while the latter with the number of classes. On ImageNet, this ratio is about 1000X. However, modern storage technology is incredibly cheap especially compared to GPUs. Storing the entire ImageNet embed- dings (384 floats x 1.3M examples) would require ~2GiB and 1000GiB SSDs may be purchased online for 100USSD In contrast for GPUs, single V100 has MSRP around
8. Storage, computation, and accuracy trade-offs of memory-based versus parametric classifier-based approaches in practical deployments
Choosing between a memory- approach and a paramet- ric classifier- based parametric approach in practice involves a number of trade-offs.
8

---

Separating Knowledge and Perception with Procedural Data
10,000USD while single H100 has MSRP 30,000 USD, which are needed train the models. Essentially, storage costs are almost negligible compared to training and infer- ence costs.
References
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. Deep Learn- ing with Differential Privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communica- tions Security, pp. 308-318, October 2016. doi: 10.1145/ 2976749. 28.8318. URL http: / aaxiv.iiiii.......aaaaaaaaaaavva wwwp:ii..orrgaeooooooooo org//bgg///... arXiv: Sati:::60070001333 [stat].
9. Conclusion
Deep learning is an extremely powerful framework, capable of learning with very little explicit structure by optimiz- ing weights on data. However, representing knowledge via weights has some important drawbacks. In particular, it is very difficult to add, remove, and edit knowledge once its been put into weights. As models scale, retraining or fine- tuning becomes more and more costly, especially a future where data is licensed instead of bought, as most digital goods are right now. Correcting mistakes or eliminating out- dated data as understanding of reality grows is also of high interest. Privacy-wise, regulations currently limit many Al tools in the EU. To this end, prior work proposed an explicit separation between how knowledge is represented, the feature embeddings, and what knowledge is stored, the visual memory. Taking the form a database of instances, editing knowledge in the visual memory is as simple as adding or dropping data. However, problem remained: the feature embeddings themselves were generated through weights trained on real-world data, where unlearning re- mained difficult. In this work, we proposed training the embeddings with procedural data. Unlike real-world data, procedural data is non-realistic and generated via simple code, and thus is much less exposed to the privacy or bias risks that necessitate unlearning. Combining procedural embeddings and visual memory results in system where all real world data can be flexibly added, removed, and provably evaluated for privacy, while approximating the performance of standard methods.
Anderson. C. and Farrell, R. Improving fractal pre-training, 2022 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp. 2412-2421, 2022. doi: D0.1009/NACVS145.22222000
Baradad, M., Wulff, J., Wang, T., Isola, P., and Torralba, A. Learning to See by Looking at Noise. In Advances in Neural Information Processing Systems, volume 34, 2021.
Baradad, M., Chen, R., Wulff, J.. Wang, T., Feris, R., Tor- ralba, A., and Isola, P. Procedural image programs for representation learning, In Koyejo, S., Mohamed, S., Agarwal, A., Belgrave, D., Cho, K., and Oh, A. (eds.), Advances in Neural Information Processing Systems, vol- ume 35, pp. 1450-6462 Curran Associates, Inc., 2022.
Bari, M. S., Haider, B., and Mansour, S. Nearest Neigh- bour Few-Shot Learning for Cross-lingual Classifica- tion. In Moens, M.-F., Huang, X., Specia, L., and Yih, S. W.-t. (eds.). Proceedings of the 2021 Confer- ence on Empirical Methods Natural Language Pro- cessing, pp. 1745-1753, Online and Punta Cana, Domini- can Republie, November 2021. Association for Computa- tional Linguistics. doi: 10.186533 131. URL emn i 131/.
org 2021.
Acknowledgements
Bergman, L.,, Cohen, N., and Hoshen, Y. Deep Near- est Neighbor Anomaly Detection, February 2020. URL http: / htt/aaiivv..../ wttpg//////......//// 10445.
This work was supported by the Defense Science and Technology Agency, Singapore. Additionally, Adrian Rodriguez-Mufooz was supported by the LaCaixa fellowship 1CCFB///EU22/11930000)
arXiv:2002.10445 [cs].
Bossard. L., Guillaumin, M., and Van Gool, L. Food- 101 Mining Discriminative Components with Ran- dom Forests. In Fleet, D., Pajdla, T., Schiele, B., and Tuytelaars, T. (eds.), Computer Vision ECCV 2014, volume 8694, pp. 446-461. Springer International Pub- lishing, Cham, 2014. ISBN 978-3-319-10598-1 978- 3-319-10599-4, doi: 111007/978--3319-0009999 URL http: springer. 1007//
Impact Statement
Our work contributes towards Al models that are more trans- parent, controllable, and applicable in domains with strict data regulations. Moreover, minimizing fine-tuning or re- training significantly reduces power demands and allows remaining power be allocated in more useful ways.
1-8-3-319-20 1009--0999--200 2_2.. Series Title: Lecture Notes in Computer Science.
Caron, M., Touvron, H., Misra, I,, Jégou, H., Mairal, J., Bojanowski, P., and Joulin, A. Emerging properties in self-supervised vision transformers. In Proceedings of
9

---

Separating Knowledge and Perception with Procedural Data
the IEEE/CVF International Conference on Computer Vision (ICCV), pp- 9650-9660, October 2021.
Everingham, M., Van Gool, L., Williams, C. K. I., Winn, J., and Zisserman, A. The Pascal Visual Object Classes (VOC) Challenge. International Journal of Computer Vision, 88(2):303-338, June 2010. ISSN 1573-1405, doi: 10.1007/s1 1110077/111255-009-077-5--444 URL https:/
Chen, Y. Zhu, X., and Gong, S. Semi-Supervised
Deep Learning with Memory. pp. 268-283, 2018. URL https: /ctps://opette http://pppaaccsssceeeeeeo thecff. com/
009 0275-4.
content_Eccv_ 20lev_2201111 Semi
Fu, S., Tamir, N., Sundaram, S., Chai, L.,, Zhang, R., Dekel, T., and Isola, Dreamsim: Learning new dimensions of human visual similarity using synthetic data. In Advances in Neural Information Processing Systems, volume 36, pp. 50742-50768. 2023.
2018 8 wa___aaprhttm.m html.
Choi, Y., Park, J., Byun, J., and Lee, Leveraging Program- matically Generated Synthetic Data for Differentially Pri- vate Diffusion Training, December 2024. URL http:// arxiv. org/ abs/ 2412 09842. arXiv:2412.09842 [es].
Geirhos, R., Jaini, P., Stone, A., Medapati, S., Yi, X., Toderici, G., Ogale, A., and Shlens, J. To- wards flexible perception with visual memory, Septem- ber 2024. URL. http: / aaxiii wwxivorrg arggabs//208. 08172. arXiv:2408.08117 [cs].
Dosovitskiy, A., Beyer, L.,, Kolesnikov, A., Weissenborn,
D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M.. Heigold, G., Gelly. S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2021. URL https:// openreview / htt///oommndaaiaaamaa.
Gildenblat, J. and contributors. Pytorch library for cam methods. https: htttps://githien //ggttu..bb...////////ggg....... jac/jaccbgll/ pytorch grad-cam, 2021.
Gui, Z., Sun, S., Li, R., Yuan, An. Z., Roth, K., Prabhu, A., and Torr, P. kNN-CLIP: Retrieval Enables Training- Free Segmentation Continually Expanding Large Vo- cabularies, August 2024. URL http: .org//.rr///.oo abs / 24 04. 09447. arXiv:2404.09447 [cs].
Douze, M., Guzhva, A., Deng, C., Johnson, J., Szilvasy, G., Mazaré, P.-E., Lomeli, M., Hosseini, L., and Jégou, H. The faiss library. 2024.
Drozdov, A. Wang, S., Rahimi, R., McCallum, A., Zamani, H., and lyyer, M. You can't pick your neighbors, or can you? When and How to Rely on Retrieval in the KNN-LM. In Goldberg, Y., Kozareva, Z., and Zhang, Y. (eds.), Findings of the Association for Computational Linguistics: EMNLP 2022, pp. 2997-3007, Abu Dhabi, United Arab Emi- rates, December 2022. Association for Computational Linguistics. doi: 10.18653/v1/0022..fg 218. URL https: ac aac waclannhhlooyyy. org/2022. f Eindings-ennie 218.
Iscen, A., Bird, T., Caron, M., Fathi, A., and Schmid, C. A memory transformer network for incremental learning. 33rd British Machine Vision Conference 2022, BMVC 2022, London, UK, November 21-24, 2022. BMVA Press, 2022. URL https:ttp//// //bmve/2222.22 mp1 -nnf mpg. de/0388.
Iscen, A., Caron, M., Fathi, A., and Schmid, C. Retrieval- enhanced contrastive vision-text models. In The Twelfth International Conference on Learning Representations, 2024. URL https:
emnlp.
/ /oppnrevieneeeeeeeeeeeeeeee net/ forum? id=b201HeyyCO.
Dwork, C. A firm foundation for private data analysis. Com- mun. ACM, 54(1):86-95, January 2011. ISSN 0001-0782. doi: 10.1145//6673991166677 acm. wtt.:///....1111116688 011.6777..16665...
Johnson, J., Douze, M., and Jégou, H. Billion-scale similar- ity search with GPUs. IEEE Transactions on Big Data, 7 (3):535 547, 2019.
URL h/dl.
Dwork, C. and Roth, A. The Algorithmic Foundations of Differential Privacy. Foundations and Trends@ in Theoretical Computer Science, 9(3-4):211-4)) 1-477, 2013. doi: 10. 10.100/00400000042.
Kataoka, H., Okayasu, K., Matsumoto, A., Yamagata. E., Yamada, R., Inoue, N., Nakamura, A., and Satoh, Y. Pre- training without natural images. In Proceedings of the Asian Conference Computer Vision (ACCV), Novem- ber 2020.
ISSN 1551-305X, 1551-3068.
Dwork, C., McSherry, F., Nissim, K., and Smith, A. Cali- brating Noise to Sensitivity in Private Data Analysis. In Halevi, S. and Rabin, T. (eds.), Theory of Cryptography, pp. 265-2844 Berlin, Heidelberg, 2006. Springer. ISBN 978-3-540-32732-5. doi: 10. 10.1007/1 1681878 14.
Khandelwal, U., Levy, O., Jurafsky, D., Zettlemoyer, L., and Lewis, M. Generalization through Memorization: Nearest Neighbor Language Models. In International Conference on Learning Representations (ICLR), 2020.
10

---

Separating Knowledge and Perception with Procedural Data
Lee, R., Clarke, J., Agogino, A., and Giannakopoulou, D. Improving Trust in Deep Neural Networks with Nearest Neighbors. In AIAA Scitech 2020 Forum, Or- lando, FL, January 2020. American Institute of Aeronau- tics and Astronautics. ISBN 978-1-62410-59551 doi:
cc//appe__iillesppprr///////f/ f15575227055d661177777f84f633333 pdf.
Rajani, N. F., Krause, B., Yin, W., Niu, T., Socher, R., and Xiong, C. Explaining and Improving Model Be- havior with k Nearest Neighbor Representations, Oc- tober 2020. URL http: aaxiv.vvvvvv//vii org/ 20/g/bbs/200... 0 09030. arXiv:2010.09030 [es].
URL https: /atess///rrcccoo /ttp///rr.aaaaaa./// org/doi/10, 2014/5114666 2098.
Lin, T.-Y., Maire, M., Belongie, S., Bourdev, L., Girshick, R., Hays, J., Perona, P., Ramanan, D., Zitnick, C. L.,, and Dollár, P. Microsoft COCO: Common Objects in Context, February 2015. URL http: /wwwiaaxvvvvooo/. org/ 1005 0312. arXiv: 1405.014 [es].
Russakovsky, O., Deng, J., Su, H.,, Krause, J., Satheesh, S., Ma, S., Huang, Z.., Karpathy, A., Khosla, A., Bernstein, M., Berg, A. C., and Fei-Fei, L. Imagenet large scale visual recognition challenge. International Journal of Computer Vision, 115(3)211-252,, 2015. doi: 10.1007/ 11263-015-0816-y
Liu, Z., Luo, P., Wang, X., and Tang, X. Deep learning face attributes in the wild. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), December 2015.
Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R. Parikh, D., and Batra, D. Grad-cam: Visual explana- tions from deep networks via gradient-based localiza- tion. International Journal of Computer Vision, 128 (2):336-359, October 2019. ISSN 1573-1405. doi: 10. 10.1007/111233-01---1222-- URL http: /txx doi. org /rg/10.1100 wtt.:11000111112-111-1-11
Min, S., Gururangan, S., Wallace, E., Shi, W., Hajishirzi, H., Smith, N. A., and Zettlemoyer, L. SILO language models: Isolating legal risk nonparametric datastore. In The Twelfth International Conference on Learning Representations, 2024.
Nakashima, K., Kataoka, H., Matsumoto, A., Iwata, K., Inoue, N., and Satoh, Y. Can vision transformers learn without natural images? Proceedings of the AAAI Con- ference on Artificial Intelligence, 36(2):1990-1999) 2022. doi: 10. 1116///aai.36622220000000 v36i2.20094.
Silva, T., Pedrini, H., and Ramírez Rivera, A. Learn ing from memory: Non-parametrie memory augmented self-supervised learning of visual features. In Salakhut- dinov, R., Kolter, Z., Heller, K., Weller, A., Oliver, N., Scarlett, J., and Berkenkamp, F. (eds.), Proceed- ings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learn- ing Research, pp. 45451-45467. PMLR, 21-27 Jul 2024. URL httst:ps: /ttpcttss://poceoee httpp/ppceeeenggeeeee mlr press/ 2/33//iiva240. html.
Nakata, K., Ng, Y., Miyashita, D., Maki, A., Lin, Y.-C., image classifi- cation system with high-capacity storage. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, pp. 457-474. Springer, 2022.
and Deguchi, J. Revisiting a
Sitawarin, C. and Wagner, D. On the robustness of deep k-nearest neighbors. In 2019 IEEE Security and Privacy Workshops (SPW), pp. 1-7, 2019. doi: 10.1109/SPW. 2019.00014.
Nilsback, M.-E. and Zisserman, A. Automated Flower Classification over Large Number of Classes. In 2008 Sixth Indian Conference Computer Vision, Graph- ics & Image Processing, pp. 722-729, Bhubaneswar, India, December 2008. IEEE. doi: 10. 10.1109/CV 2008.47. URL http:: http///eeeeeelereee//e/e//////ee ieee. /rgg Sccument/4756141
Sun, D., Vlasic, D., Herrmann, C., Jampani, V., Krainin, M., Chang, H., Zabih, R., Freeman, W. T., and Liu, C. Autoflow: Learning better training set for optical flow. In 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10088-10097, 2021. doi: 00.1109CVVPR4444.2200.00om
Papernot, N. and McDaniel, P. Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Leam- ing, March 2018. URL http::tt////rt axxiv.ee org/ abs/ 1803. 04 15. arXiv:1803.04765 [cs].
Sun, Y., Ming. Y., Zhu, X., and Li, Y. Out-of-distribution detection with deep nearest neighbors. In Chaudhuri, K., Jegelka, S., Song, L.. Szepesvari, C., Niu, G., and Sabato, S. (eds.), Proceedings of the 39th International Confer- ence on Machine Learning, volume 162 of P Proceedings of Machine Learning Research, pp. 17-23 Jul 2022. URL ht httpps: http///ceeddace ngs mlr. press/ /v1l/vvvvv 62. 22./suuee sun22d html.
Plötz, T. and Roth, S. Neural nearest neighbors net- works. In Bengio, S., Wallach, H., Larochelle, H., Grauman, K., Cesa-Bianchi. N., and Garnett, R. (eds.), Advances in Neural Information Process- ing Systems, volume 31. Curran Associates, Inc., 2018. URL https: https://procest http///preeennng/e//eee/eee.e..e neurips.
PMLR,

---

Separating Knowledge and Perception with Procedural Data
Tang, X., Panda, A., Sehwag, V., and Mittal, P. Differ- entially Private Image Classification by Learning Priors from Random Processes. Advances in Neural Information Processing Systems, 01355855-38777 December 2023.
https://ieeexplore leee. wwwp:oooo/ooooooooooooo document//////////////
Conference Name: IEEE Transactions on Geoscience and Remote Sensing.
Wah, C., Branson, S., Welinder, P., Perona, and Belongie, S. The Caltech-UCSD Birds-200-2011 Dataset. Tech- nical Report CNS-TR-2011-000 California Institute of Technology, 2011.
Zhang, H., Cissé, M., Dauphin, Y. N., and Lopez-Paz, D. mixup: Beyond empirical risk minimization. In 6th International Conference Learning Representations,
ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Truck Proceedings. OpenReview.net, / 2018. URL https: httpp/pppnnweeeeeeeeeee net/ forum?
Wallace, E., Feng, S., and Boyd-Graber, J. Interpreting neural networks with nearest neighbors. In Linzen, T., Chrupala, G., and Alishahi, A. (eds.), Proceedings of the 2018 EMNLP Workshop BlackboxNLP: Analyzing and In- terpreting Neural Networks for NLP. pp. 136-144, Brus- sels, Belgium, November 2018. Association for Compu- tational Linguistics. doi: 10.18653/v1/W118544116 URL https: pettts://aclantiii /atpaaaaaanttyyo...aaaa www.aaatiicoocooooo///----------
id-r1Ddp1 DiLD--pp-R.b.. Rb.
Zhou, B., Zhao, H., Puig, X., Fidler, S., Barriuso, A., and Torralba, A. Scene parsing through ade20k dataset. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), July 2017.
Zhou, B., Lapedriza, A., Khosla, A., Oliva, A., and Torralba, A. Places: A 10 Million Image Database for Scene Recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 4066):1552-1444, June 2018. ISSN 1939-3539, doi: 10.1 101100//PAMM..201122222000 URL
Wang, Y., Chao, W.-L., Weinberger, K. Q., and Maaten, L. v. d. SimpleShot: Revisiting Nearest- Neighbor Classification for Few-Shot Learning, Novem- ber 2019. URL http:// arxiv. orggabs/11111 04623. arXiv:1911.0462. [es].
wttg///coee///////oo//o Conference Name: IEEE Transactions on Pattern Analysis and Machine Intelligence.
https: http:/eeeeepppeeeeeeeeeeeeeeeeee ieee.
7968387 /ttp///annnnber7999333 /
Weston, J., Chopra, S., and Bordes, A. Memory networks. In Bengio, and LeCun, Y. (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. URL http: /aaxivivivv./////.//aaaa///aiava org/ abs/ 1410.3. 3916.
Zhuang, J., Cai, J., Wang, R., Zhang, and Zheng, W.- S. Deep kNN for Medical Image Classification. In Martel, A. L., Abolmaesumi, P., Stoyanov, D., Mateus, D., Zuluaga, M. A., Zhou, S. K., Racoceanu, D., and Joskowicz, L. (eds.), Medical Image Computing and Computer Assisted Intervention MICCAI 2020, vol- ume 12261, pp. 127-136. Springer International Pub- lishing, Cham, 2020. ISBN 978-3-030-59709- 978- 3-030-59710-8. doi: 10. 10.10077978-34030-5971100
Wu, Y., Rabe, M. N., Hutchins, D., and Szegedy, C. Memo- rizing transformers. CoRR, abs/2203.0n 08911,, 2022. doi: 10.48550AARXIV.200.002
URL https: //doi. 0trg/10.8855 wtt.aawwwiv.a....aaaaaa..... 2883..
13.
Yang, J., Shi, R., and Ni, B. MedMNIST Classification De- cathlon: A Lightweight AutoMI. Benchmark for Medical Image Analysis. 2021 IEEE 18th International Sympo- sium Biomedical Imaging (ISBI), pp. 191-195, Nice, France, April 2021. IEEE. ISBN 978- 1--66-1---1-6666 doi:
URL httttt/s//Iiidt sprinner.priigrrrr.. www.w/..com.....m 1tt/110.100///
978-3-030-597100 01._ Series Title: Lecture
Notes in Computer Science.
URL https:// ieeexp /ew..e..rrg//cccmmen//////////// 9443066//.
Yang, J., Shi, R., Wei, D., Liu, Z., Zhao, L., Ke, B., Pfister, H.. and Ni, B. MedMNIST v2 A large-scale lightweight benchmark for 2D and 3D biomedical image classifica- tion, September 2022. URL http: /ttp:///aaiivv.eeee waaaaaivvvvooo org/ abs/2110. 14795. arXiv:2110.14795.
Yang, X., Nan, X., and Song, B. D2N4: A Discrim- inative Deep Nearest Neighbor Neural Network for Few-Shot Space Target Recognition. Transactions on Geoscience and Remote Sens- ing. 58(5):3667-3677 May 2020. ISSN 1558- 0644. doi:
IEEE
URL
12

---

Separating Knowledge and Perception with Procedural Data
A. Training details
trained a vision transformers (Small ViT) (Dosovitskiy et al., 2021) for each dataset (ImageNet, Places, Shaders KML Mixup, Shaders KML, Shaders Mixup, Shaders, and Stylegan), using the recipe and architecture the original DINO paper (Caron al., 2021). particular, used the optimal hyperparameters for the model trained on ImageNet for all models, rather than hyper-optimizing for performance each specific dataset. This results in much more rigorous evaluation, as the optimal ImageNet hyperparameters are more likely to be bad than good for procedural non-realistic data. These hyperparameters are: learning rate Ic-3, batch size 512, optimizer Adam W, num epochs 100, and DINO head out dim 65536, All models are then used without any fine-tuning to obtain all the results, including Figure 5, Table 1, Figures 9 and 10, and Tables and
B. Additional results
B.1. Benchmark saturation on NIGHTS
In Figure 5 it visually appears that Shaders-basee procedural models are all quite close in performance each other and to the realistic Places model. To quantitatively test this, we performed a 7-test and determined that Places, S. KMI,, and Shaders are all equivalent to the 5% level. This supports the finding that procedural models have reached the level of real models this benchmark. For the z-test, we used the average NIGHTS results and number of samples in the val dataset (1720). We also include standard deviations of the mean for reference in Table 4.
Dataset Type
Dataset
NIGHTS- Val
Target
ImageNet
0.8733 + 0.0080
Realistic
Places
0,8331 + 0.0090
S. KML Mixup
0,8105 + 0.0095
KML
0.8244 = 0.0092
Procedural
Mixup
0,8110 + 0.0094
Shaders
0.8169 + 0.0093
Stylegan
0.7605 + 0.0103
Table 4: NIGHTS- Val performance with standard deviations.
B.2, Linear decoding performance
Dataset Type
Dataset
KNN
Linear
Target
ImageNet
68.9
73.6
Realistic
Places
47.3
59.6
KML Mixup
37.9
47.3
KML
35.4
47.1
Procedural
S. Mixup
35.4
44.8
Shaders
30.7
43.1
Stylegan
13.7
26.4
Table 5: Top-1 accuracy results for linear decoding on ImageNet- K. With linear decoding, S. KML beats Mixup by 2.2%. despite the KNN performances being equivalent. Morcover, the gains from adding Mixup to both Shaders and KML are much smaller. This suggests that Mixup mainly reduces bad features, which can also be pruned by the decoder. while KML yields either better or a greater amount of useful features. The two approaches complementary, which is why Shaders KML Mixup obtains the strongest performance overall.
13

---

Separating Knowledge and Perception with Procedural Data
B.3. Linear decoding GradCam
Input
ImageNet
Places
S. KML Mixup
S. KML
S. Mixup
Shaders
Stylegan
Figure 17: GradCam (Selvaraju et al., 2019; Gildenblat & contributors, 2021) visualization for linear decoding on random images from ImageNet for each of the models.
B.4. Hard-label unsupervised segmentation with K-Means
14

---

Separating Knowledge and Perception with Procedural Data
ImageNet
S. KML Mixup
Input
Cluster
Cluster
Input
Cluster
Cluster
Query
Query
Figure 18: Hard-level unsupervised segmentation with K-Means on COCO. The procedural S. KML Mixup model makes visually sensible clusters, but that do not reflect real-world objects, unlike the ImageNet model. This results in incorrect class nearest neighbours, seen in Figure 19
ImageNet
S. KML Mixup
Input
Cluster
Cluster
Input
Cluster
Cluster 2
Query
NN-1
Query
NN-1
Figure 19: Hard-level unsupervised segmentation with K-Means on ImageNet of query image and is Nearest Neighbour (NN-1). The procedural KML Mixup model makes visually sensible clusters, but that do not reflect real-world objects, unlike the ImageNet model. clusters the query and NN-1 images visually resemble each other, but since the visual resemblance not aligned with real world objects, the choices are incorret for classification.
15


Reviews:
[{"review_id": "jMYOFPDc22", "reviewer": "Reviewer_VmuU", "summary": "This paper introduces a novel process for training neural networks using procedural data: Shaders KML and Shaders KML Mixup. Despite relying on simple programs and lacking any direct resemblance to the target distribution, the proposed method achieves impressive results in K-NN-based classification. The paper’s core contribution is K-Means Leaves (KML), a data-driven masking strategy that replaces simplistic masking with k-means clustering to diversify training patterns. This approach significantly enhances the variety of features leveraged during training, addressing a key limitation of traditional procedural data generation. The paper  further demonstrate the versatility of KML by showcasing its benefits across multiple applications, including memory-based classification (via nearest neighbors), semantic segmentation, unlearning tasks, and privacy-preserving scenarios with formal guarantees.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for agreeing that the approach is novel and has broad utility, as well as their insightful comments, questions, and suggestions. We answer the questions and follow up on the suggestions below\n\n## 1 Benefits of KML over Mixup\nWe agree the benefits of KML may initially appear modest (sans CUB). As suggested, we clarify that KML especially improves the variety of visual stimuli the model is exposed to, which leads to higher variety features for downstream tasks. To show this, we compute the Vendi Diversity (VD) with the ImageNet model and the linear classifier performance. These two metrics provide additional evidence of the benefits of KML complementary to KNN classification accuracy. Moreover, the improvements in KNN classification are better observed by looking at the relative reduction in the gap to real data rather than the raw increase.\n\n### 1.1 VD\nVD [1] measures the entropy of the eigenvalues of the similarity matrix of pairs in a dataset. It has been used for generative modelling and dataset curation in many domains such as molecules and images. We use the ImageNet model to create the similarity matrix, acting as a proxy for human vision to measure the diversity of visual stimuli in our procedural datasets. \n- S. KML Mixup 38.6\n- S. KML 36.5\n- S. Mixup 30.6\n- Shaders 22.1\n\nIndeed, while Mixup improves the diversity of Shaders by 8.5, our KML improves it by 14.3. Combining KML and Mixup yields a larger improvement of 16.5. Our intent in line 176 was not to make the claim ourselves but rather to cite [2], which showed that improved diversity is a key driver of performance for non-realistic data, as our motivation for developing KML. We apologize for the confusion\n\n## 1.2 Linear decoding\nWe thank the reviewer for their suggestion of analyzing linear decoding. We had actually trained linear decoders on ImageNet, but did not include them initially as we focused on visual memory perception. We will include these numbers, as well as GradCam [3] visualisations for explainability, in the camera-ready supplementary material\n- S. KML Mixup 47.3\n- S. KML 47.1\n- S. Mixup 44.8\n- Shaders 43.1\n\nWith linear decoding, S. KML beats S. Mixup by 2.2%, despite the KNN performances being equivalent. Moreover, the gains from adding Mixup to both Shaders and S. KML are much smaller. This suggests that Mixup mainly reduces bad features, which can also be pruned by the decoder, while KML yields either better or a greater amount of useful features. The two approaches are complementary, which is why Shaders KML Mixup obtains the strongest performance overall.\n\n### 1.3 Relative gap reduction\nAdditionally, gains in classification accuracy are better observed by looking at the relative reduction in the gap to real data rather than the raw increase. This is because of diminishing returns as we get closer to the performance ceiling of procedural data (given by realistic data). Measured relatively, our KML reduces the gap by 18.5% and 20.5% on Flowers and ImageNet respectively. The relative improvement in CUB is actually a very similar 20.4%. The Food dataset is a special case, as S. Mixup matches the real data Places but our S. KML Mixup beats it. We calculate relative increase as follows\n\n      (s_kml_mixup_accuracy - s_mixup_accuracy) / (real_data_ceiling - s_mixup_accuracy)\n\nusing the ImageNet model as the ceiling for Flowers and CUB classification, and the Places model for ImageNet classification\n\n## 2 Significance values of NIGHTS\nWe agree that differences are minimal. NIGHTS was included as a task where procedural models have reached the level of real models. A z-test determined Places, S. KML, and Shaders are all equivalent to the 5% level. We will add this result and the standard deviations for Fig. 5 to the camera ready\n\nIf the reviewer found these additional experiments and explanations convincing, we kindly ask them to raise their score to Accept.\n- [1] The Vendi Score: A Diversity Evaluation Metric for Machine Learning; Friedman et al\n- [2] Learning to See by Looking at Noise; Baradad et al\n- [3] Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localization; Selvaraju et al", "claims_and_evidence": "The paper compellingly demonstrates the broad utility of the procedural method for classification and segmentation tasks. That said, the performance improvements between Shaders and Shaders Mixup appear modest in most benchmarks (excluding CUB). This suggests the added value of Mixup in this framework may merit further discussion, particularly regarding the claim that increased dataset diversity is a “key driver of performance.” To bolster this argument, it might help to clarify how the KML masking procedure contributes—for example, by highlighting whether specific components (e.g., feature types, training phases) benefit disproportionately, or if certain induced biases (e.g., geometric consistency) play an underappreciated role.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "No theoretical proofs were considered.", "experimental_designs_or_analyses": "I checked the designs for : \n\n* Alignment with humans in the NIGHTS dataset, it would be good to provide significance values on the difference between shaders and the improvement proposed in the paper. \n* K-NN classification, in fine grained and general Imagenet datasets.\n* Segmentation performance", "relation_to_broader_scientific_literature": "The paper contributes to the area of training with procedural data.", "essential_references_not_discussed": "I think the paper cites the most recent work on this domain.", "other_strengths_and_weaknesses": "Strenghts \n\n* The paper shows the application of procedural training on multiple tasks, extending previous papers on the same topic. \n\n* The method is actually quite simple, but it shows promise in improving the frontier on the topic. \n\nWeakness\n* It would strength the paper if more evidence on the benefit or the rational before the masking procedure with respect to previous works in the area.", "other_comments_or_suggestions": "* Perhaps is better to list the method as \"ours\" across to ease readability and clarity.", "questions_for_authors": "* Maybe not super necessary given the approach of visual memory perception, but what is the expected upper bound of these models? i.e.   Linear decoding for classification instead of KNNs\n* If the one above is done, an explainability analysis would give also very interesting insights of what features are learned by these models.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DMRS1MXOUs", "reviewer": "Reviewer_YM9V", "summary": "This paper introduces a memory-based approach to visual perception by training an embedding model solely on procedurally generated data, then using real data embeddings in a separate memory for classification and segmentation tasks. The authors emphasize advantages in unlearning and privacy, aiming to decouple training on real data from downstream usage.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their insightful comments and for agreeing we provide empirical demonstrations on the benefits of our approach. In particular, we appreciate their identification of areas which could be strengthened, such as clarifying the benefits of our approach and additional baselines, which we write below\n\n## 1 Motivation for memory approach\nOur work builds on top of prior research on memory, in particular Geirhos et al. 2024. They argue that precisely because the real world changes; a static model (such as a standard classifier) would require constant retraining or fine-tuning, which is not feasible especially given the scale of modern models. A flexible visual memory allows for efficiently adding even billion-scale data, removing data through unlearning, and an interpretable decision-mechanism.\n\nHowever, prior approaches had a problem: the feature embeddings are themselves trained on data. We identify four consequences. First, while adding and removing data from the memory is easy, doing so from the embeddings is not. Second, a large corpus of data is required to train the embeddings, which could be not available (low-resource setting) or not allowed (privacy setting). Lastly, counterfactual interpretability with data used to train the embeddings is difficult. Our proposal to use procedural data effectively addresses all four.\n\n### 1.1 Efficient unlearning\nProcedural embeddings allow for efficient provable unlearning of all real data used. Classifier unlearning methods fine-tune or retrain the weights, which is expensive and not infallible. Moreover, they also use the ”contaminated” weights as an initial point which wouldn't satisfy a legal request. In these situations where classifier unlearning is not feasible or allowed, procedural data is effective and efficient\n\n### 1.2 Low resource setting\nTraining an embedding model requires lots of data. In situations where it is not available, procedural data yields strong performance. As seen in Table 1, procedural models actually beat the Places model on some fine-grained classification tasks. This shows that procedural data may sometimes perform better than out-of-distribution real data\n\n### 1.3 Privacy setting\nIf directly training on the data is not acceptable, our approach offers an elegant solution. With procedural embeddings, any medical information is non-existent in the model's weights. Moreover, as we see in Table 3, procedural models match or exceed the best result from the original MedMNIST paper [1] in 7/10 datasets\n\n### 1.4 Counterfactual interpretability\nPrior work in AI ethics identified the concept of a “right to explanation” to people affected by automated decisions. The paper [2] showed that a “counterfactual”, defined as the data that, if it were absent, would change the model decision, satisfied key requirements for both people and firms. Computation of counterfactuals requires efficient computation of “what if” scenarios in absence of certain data, which we can obtain with unlearning. Our method enables counterfactual analysis for all real data used. Given a decision, we search for the counterfactual by sequentially unlearning the top neighbour and checking if the answer changes\n\n## 2 Accuracy trade-off\nOur setting is self-supervised learning without labeled data. We use classification only as a proxy task for evaluation. In this setting, training on ImageNet obtains 69% accuracy, while training on realistic data (Places) obtains 47%. Training on procedural data is within 10% of the latter, which is quite significant given it is non-realistic. We are not saying that procedural data should be used when standard classifiers are possible and appropriate, only that in situations like described in point 1, procedural data is highly performant and desirable\n\n## 3 Procedural data domain gap + additional baselines\nWe actually have that discussion in the paper from line 271 to the end of page 5, in Figure 11, and in Section 5. We mention how lack of real-world objects in procedural data leads to the performance gap. The additional baselines requested can be found below. The results are very similar to those in the original paper. On the three ImageNet-v2 variants (INv2 Top Quality, Threshold0.7, and MatchedFrequency), the gap of the best procedural model to Places is still 10%. On ImageNet-Sketch (IN-S) it's even better, as the gap to Places is 3%: procedural models are able to search for similar neighbour sketches. In the fine-grained dataset Stanford Dogs, procedural models again beat Places\n\n| Dataset | INv2-TQ | INv2-Th | INv2-MF | IN-S | Dogs\n| - | - | - | - | - | - \n| ImageNet | 69.9 | 64.4 | 56.6 | 66.5 | 65.6\n| Places | 46.1 | 40.8 | 35.4 | 56.6 | 22.2\n| S. KML Mixup | 35.3 | 30.7 | 26.0 | 52.9 | 29.5\n\n- [1] MedMNIST Classification Decathlon; Yang et al\n- [2] Counterfactual Explanations without Opening the Black Box: Automated Decisions and the GDPR; Wachter et al", "claims_and_evidence": "The authors claim improved control over unlearning and privacy with minimal reliance on real data, and they provide empirical demonstrations supporting these benefits. Evidence for the overall performance is present but could be strengthened with additional baselines.", "methods_and_evaluation_criteria": "Using a memory-based k-nearest neighbors (KNN) approach and various procedural data sources makes sense for testing the proposed unlearning/privacy framework. The paper employs established benchmark tasks for classification and segmentation to illustrate feasibility.", "theoretical_claims": "No formal proofs are offered. The core theoretical motivation revolves around the idea that separating real data from the training process (by relying on procedural data and a memory-based scheme) should mitigate privacy risks. However, the paper does not provide a fully rigorous explanation of how procedural data itself, beyond simpler domain adaptation arguments, translates into enhanced interpretability or privacy guarantees.", "experimental_designs_or_analyses": "The unlearning experiments, where samples can be removed from the memory without retraining the embedding model, fit logically with the proposed method. Nevertheless, a direct comparison to standard classifier-based unlearning methods would help clarify whether the current approach strikes the best balance between accuracy and privacy.", "relation_to_broader_scientific_literature": "This work aligns with existing research on using synthetic data for privacy-preserving machine learning approaches", "essential_references_not_discussed": "Related works are well discussed.", "other_strengths_and_weaknesses": "1. Motivation for memory-based approach: Beyond simplifying unlearning, it is unclear what additional advantages this framework offers; the paper’s rationale would benefit from a more convincing demonstration of its utility beyond privacy concerns.\n\n2. Accuracy trade-offs: The KNN-based classification and segmentation yield relatively low accuracy compared to contemporary classifiers (often exceeding 80% on ImageNet-1K). The paper should compare a “classifier + unlearning” pipeline to demonstrate whether the privacy gains truly justify the performance costs.\n\n3. Procedural data domain gap: The reliance on procedurally generated imagery raises questions about domain shifts, as these synthetic images differ stylistically from real-world data. The authors do not fully analyze how this gap may contribute to reduced accuracy, nor provide ablation studies to quantify its impact.", "other_comments_or_suggestions": "I suggest the authors to additionally evaluate on OOD variants of ImageNet like ImageNet-v2, ImageNet-Sketch, etc.", "questions_for_authors": "See comments above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8hWMQkDpLR", "reviewer": "Reviewer_ZRET", "summary": "The paper introduces a novel method to fully compartmentalize visual memory by training representation models exclusively with procedural data, thus eliminating the risks associated with privacy and bias inherent in real-world data. The main findings include achieving near state-of-the-art performance on standard benchmarks: procedural models perform comparably to or better than models trained on real data on fine-grained classification tasks and show strong zero-shot segmentation abilities. Importantly, the approach enables perfect data unlearning by simply removing images from the visual memory database, without requiring retraining.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their comments and suggestions, and for agreeing that our approach is novel and shows strong abilities with perfect data unlearning. Below, we clarify how to run our baselines. We will also add a new figure to the camera ready that makes the connection between the limitations at KNN segmentation and classification more explicit.\n\n## 1 Clarification of baselines\nWe train a vision transformer (Small ViT) for each dataset (ImageNet, Places, Shaders KML Mixup, Shaders KML, Shaders Mixup, Shaders, and Stylegan), using the recipe and architecture of the original DINO paper [1]. In particular, we used the hyperparameters that yielded the best results on the original DINO on ImageNet for all models, rather than hyper-optimizing for performance on each specific dataset. This results in a much more rigorous evaluation, as the optimal ImageNet hyperparameters are more likely to be bad than good for procedural non-realistic data. These hyperparameters are: learning rate 1e-3, batch size 512, optimizer AdamW, num epochs 100, and DINO head out dim 65536. We will include them in the Supplementary Material of the camera ready.\n\nThese models are then used without any fine-tuning to obtain all the results, including Figure 5, Table 1, Figures 9 and 10, and Tables 2 and 3.\n\n### 1.1 Table 1\nAs mentioned above, we train a single ViT model on each real and procedural dataset. The second column of Table 1 shows the dataset, while the first shows the type of data: target, realistic, and procedural. The white-box models are non-neural approaches included for reference. We obtain the numbers using the nearest networks evaluation method of the original DINO paper [1]. Normalized embeddings are calculated for the train and validation splits, and class predictions for the validation examples are obtained by taking a majority vote of the nearest neighbours in the training set. We evaluate all models using 10, 20, 100, 200 neighbours and keeping the best result.\n\n### 1.2 Table 2 and Figure 9\nFor Table 2, we again take the exact same models (without further training) and compute dense embeddings on the COCO validation dataset. We then apply PCA with 3 channels, which are visualized in Figure 9, and compute their R^2 correlation with the human segmentation labels.\n\n### 1.3 Table 3\nFor Table 3, we do the same as for Table 1 but with the medical MNIST datasets.\n\n### 1.4 Figure 5\nFor Figure 5, we use the original dreamsim [2] code for evaluating baseline models. In particular, they obtain embeddings for the reference, option A, and option B images, and choose option A if it has greater cosine similarity with the reference than B and vice-versa.\n\n## 2 Expanding on excessively local embeddings\nWe will include the hard-label equivalents of Figure 9, which the reviewer thought was insightful, and Figure 12 into the camera ready. In contrast to the soft-label PCA, this figure shows a hard segmentation of the image. The soft-label PCA provides an overview of the model’s internal representation at all granularities, while the hard-label PCA delves deeper into a specific granularity. Combined they offer a more complete analysis of the model’s capabilities.\n\nFrom the hard-label PCA, we gain further evidence that while realistic data models recognize and segment images into objects, procedural data models cannot due to having never seen them during training. This figure makes the link between limitations at KNN segmentation and classification explicit. Excessively local representations that do not encompass whole objects impair searching for similar images both locally for segmentation, and globally for classification (when pooled into a class token).\n\nA potential solution could consist of more sophisticated algorithms than Nearest Neighbours that take into account a larger context and thus can bypass the excessive locality limitation, but we leave this to future work. \n\nIf the reviewer found these additional experiments and explanations convincing, we kindly ask them to raise their score to Accept.\n\n- [1] Emerging Properties in Self-Supervised Vision Transformers; Caron et al.\n- [2] DreamSim: Learning New Dimensions of Human Visual Similarity using Synthetic Data; Fu et al.", "claims_and_evidence": "The paper's claims are well-supported by experimental evidence.", "methods_and_evaluation_criteria": "The methods and evaluation criteria are well-chosen and appropriate.", "theoretical_claims": "The paper makes no explicit formal theoretical claims that require proof verification.", "experimental_designs_or_analyses": "The experimental analyses are generally sound. Specific analyses reviewed include:\n\n1. Classification accuracy across multiple fine-grained and general datasets: Methodology sound; experiments clearly conducted. But the details need to be clarified.\n2. PCA and visual analysis of representations: Provides a helpful and rigorous visual assessment of model embedding qualities and limitations.\n3. Privacy evaluation: The comparison of memory-based model accuracy vs. non-private training images is insightful and convincing.", "relation_to_broader_scientific_literature": "The paper situates itself well within existing literature on procedural data learning, memory-based models, and privacy in AI. It builds explicitly upon previous procedural image generation work and visual memory approaches. The comparison with prior methods is clearly articulated, and contributions such as new procedural data generation methods are well-positioned within the existing literature.", "essential_references_not_discussed": "The paper cites key related work effectively.", "other_strengths_and_weaknesses": "Strengths:\n\n1.  The approach is novel, clearly motivated, and practical in contexts with high privacy concerns.\n2.  Experiments and analyses are thorough, demonstrating effectiveness in multiple domains, including fine-grained classification and segmentation.\n3. Well-organized and clearly written, with useful visualizations (e.g., Figures 9 and 10).\n\nWeaknesses:\n\n1.  Limitations around segmentation due to excessively local procedural embeddings are noted but not deeply addressed. Further insights or solutions could strengthen the paper.", "other_comments_or_suggestions": "See questions.", "questions_for_authors": "Can you clarify all baselines' settings? For example, how to train and fine tune the models in Table 1? What dataset is used?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper proposes a representation learning approach that is trained exclusively on procedurally generated data and applied to a range of computer vision tasks via visual memory, without requiring additional training on real data. The method shows strong performance while addressing important privacy concerns by avoiding the use of real-world data. The paper is well-written, well-organized, and presents a compelling direction for privacy-preserving visual learning.

During the review process, reviewers raised questions regarding the motivation behind the method design, the specific role of local procedural embeddings, and the generalization capabilities under domain shift. The authors addressed these concerns effectively in the rebuttal, leading to a more favorable assessment.

Post-rebuttal, reviewer YM9V introduced a new concern regarding the balance between storage requirements, computational efficiency, and model performance. While this is a valid point for ensuring practical deployment, AC agrees with the majority opinion that the paper’s strengths—especially in terms of innovation, performance, and privacy benefits—outweigh its limitations.

AC recommends acceptance and strongly encourages the authors to include an analysis or discussion of the trade-offs between storage, computation, and accuracy in the final version to further strengthen the practical relevance of the work.
Decision: Accept (poster)