Localizing and Mitigating Memorization in Image Autoregressive Models
This work addresses privacy concerns for users of image generative models by providing insights and mitigation strategies, though it is incremental as it builds on existing memorization analysis in autoregressive models.
The paper tackled the problem of memorization in image autoregressive models, which poses privacy risks, by localizing where memorization occurs in different architectures and intervening on key components to reduce data extraction capacity by a significant amount with minimal impact on image quality.
Image AutoRegressive (IAR) models have achieved state-of-the-art performance in speed and quality of generated images. However, they also raise concerns about memorization of their training data and its implications for privacy. This work explores where and how such memorization occurs within different image autoregressive architectures by measuring a fine-grained memorization. The analysis reveals that memorization patterns differ across various architectures of IARs. In hierarchical per-resolution architectures, it tends to emerge early and deepen with resolutions, while in IARs with standard autoregressive per token prediction, it concentrates in later processing stages. These localization of memorization patterns are further connected to IARs' ability to memorize and leak training data. By intervening on their most memorizing components, we significantly reduce the capacity for data extraction from IARs with minimal impact on the quality of generated images. These findings offer new insights into the internal behavior of image generative models and point toward practical strategies for mitigating privacy risks.