# An Explainable Scheme for Memorization of Noisy Instances by Downstream Evaluation
## 2 Related Work  
Making a model inference explainable is a key demand in machine learning. Some earlier research tried to analyze this by perturbing the test data to see how the prediction changes ([PERSON] [10], [PERSON] [11], [PERSON] [12]) and explained the prediction mainly in terms of fixed models with less consideration of training instances. In machine learning, memorization refers to any possible features that might be good or bad when a model memorizes during the training process. While some studies explored the phenomenon of forgetting ([PERSON] [13]; [PERSON] [14]), many studies [15; 16; 17; 18; 19; 20; 21; 22; 23] tended to focus on memorization analysis to understand what a model memorizes. Model memorization often occurs in situations where the model is overly complex and the amount of training data is insufficient, leading the model to rely on specific image features while neglecting to learn more representative characteristics. As noted in a study by [PERSON] [15], when data is assigned randomly generated labels or incorrect labels, most modern deep learning models have the capacities to fit (i.e., memorize) the data effectively. But excessive memorization of data with incorrect labels could lead to overfitting and be detrimental to model generalization. [PERSON] [16; 17] revealed that model memorization is a necessity for generalization if the data follows long-tail distribution. A number of studies, including [PERSON] [18], [PERSON] [19], and [PERSON] [20], indicate how good memorization could improve generalization.  
For methods of evaluating memorization, [PERSON] [21] used self-influence functions, a classic technique of robust statistics proposed by [PERSON] [24], showing how model parameters change when upweighting a training point by an infinitesimal amount. It allows differentiation through training to estimate the effect of a variety of training perturbations. [PERSON] [23] extended the self-influence functions to derive a memorization attribution method that further explained which individual tokens (e.g., a small region of image pixels) require the most memorization by the model. [PERSON] [22] applied theories relative to self-supervised learning ([PERSON] [25]; [PERSON] [26]; [PERSON] [27]) to introduce memory evaluation into the field of self-supervised learning. Since self-supervised learning is generally divided into upstream unsupervised learning without labels and downstream supervised fine-tuning or linear evaluation with a small number of labels, it is crucial to evaluate how the performance of downstream models or tasks is affected by the memorization of the upstream model.  
In addition to many model attacks that are similar to noisy data or adversarial attacks, such as gradient-based training-set attacks revealed by [PERSON] [28] and [PERSON] [29], mem bership inference attacks explored by [PERSON] [30] pose another threat to the data privacy of deep learning models. This type of attack exploits the model overfitting to training data, resulting in poorer performance on the data that are not included in the training set. Attackers can leverage this characteristic to infer whether certain data was used for training by observing the model's responses to different inputs, potentially leading to privacy breaches. Memory scores can help identify training data with high memorization that may contribute to model overfitting, allowing for model adjustments to mitigate such risks.  
As with some state-of-the-art tools of explainable model inference, such as GradCam [31] and GradCam++ [32], our method could yield similar results for the same experimental noisy inputs. However, by default these tools only support the classes provided by the pre-trained dataset, whereas our method can observe the explainability of the classes based on the downstream application dataset classes (for example, the 100 classes of CIFAR-100) without being limited by the original classes of the pre-trained dataset used by the upstream model.