Cue-Resistant Memorization (CRM)

• Cue-Resistant Memorization (CRM) is defined as the property where true memory persists independently of surface cues, isolating intrinsic memorability from attentional and priming effects.
• Empirical studies show that in human experiments, intrinsic memorability accounts for around 50% of recognition variance, while in machine learning, CRM conditions out trivial prompt overlaps to assess memorization.
• In AI applications, CRM employs cue score metrics and controlled reconstruction protocols to distinguish genuine memorization from prompt-induced responses, enhancing privacy risk assessments.

Cue-Resistant Memorization (CRM) refers to a class of effects and formal evaluation protocols that establish whether memory or apparent memorization persists when surface-form or contextual “cues” are strictly controlled. This concept was formalized independently within human memory research as a predictor of observer-invariant memorability effects, and in machine learning as a necessary condition for valid memorization or PII leakage assessment. Across both domains, CRM distinguishes intrinsically memorable content from responses provoked by coincidental, trivial, or strategically provided cues. Empirical studies reveal that true cue-resistant memorization is robust to attentional, encoding, and priming manipulations in humans and vanishingly rare in LLMs under cue-controlled measurement. CRM thus provides both a conceptual and quantitative foundation for assessing what constitutes true memory versus cue-driven behavior.

1. Definition and Formalization

Cue-Resistant Memorization (CRM) is defined in two related contexts:

A. Human Memory and Image Memorability:

CRM is empirically the finding that the likelihood of later recalling an image ($I$) is governed by an intrinsic memorability signal $M(I)$ that (i) is highly consistent across observers and (ii) resists manipulation via bottom-up attention, top-down attention, or priming. The formal model expresses subsequent memory performance as:

$\mathrm{Performance}(I) \approx f(M(I)) + \epsilon$

with the gradients of performance with regard to exogenous attention parameters ($A_\mathrm{exo}$), endogenous attention ($A_\mathrm{endo}$), and priming-related factors ($P_p$) all near zero, i.e., $$\partial \mathrm{Performance}/\partial A_\mathrm{exo} \simeq 0$$, $$\partial \mathrm{Performance}/\partial A_\mathrm{endo} \simeq 0$$, and $$\partial \mathrm{Performance}/\partial P_p \simeq 0$$, where $\epsilon$ denotes individual and trial noise (Bainbridge, 2017).

B. Machine Learning and PII Leakage:

CRM is a principled framework that conditions memorization metrics on the absence of trivial overlap cues between prompt and target. Letting $p\in\Sigma^{*}$ denote a prompt and $s\in\Sigma^{*}$ a secret (e.g., PII string), the cue score is defined as:

$$c(s,p) = \frac{\mathrm{LCS}(\nu(s), \nu(p))}{|\nu(s)|}$$

where $\nu(\cdot)$ normalizes text and LCS denotes the length of the longest common substring. CRM metrics, including the hit rate $HR(\tau)$ and reconstruction log-likelihood $\mathrm{Recon}(\tau)$, are computed exclusively on cases $c(s,p) < \tau$, for user-chosen $\tau\in[0,1)$, ensuring analysis conditions out direct prompting artifacts (Luo et al., 7 Jan 2026).

2. Psychophysical Paradigms and Empirical Results in Human Memory

Multiple experimental designs have demonstrated CRM in human recognition memory, isolating memorability from cue-based effects (Bainbridge, 2017):

• Spatial Cueing (bottom-up attention): Experiments manipulating brightness or displaying memorable versus forgettable images as cues revealed that only physical saliency cues (e.g., brightness) affected reaction time. Memorability itself induced no attentional capture (Bayes Factors $BF_{01}\approx1.1$–$1.08$ for no effect).
• Visual Search: Arrays of memorable and forgettable faces were searched for targets, showing that target memorability aids performance at small set sizes (statistically significant at $p=2.63\times 10^{-4}$) but distractor memorability had no measurable bottom-up attention effect ($p>0.5$; $BF_{01}=4.1$).
• Directed Forgetting (top-down control): Participants instructed to remember or forget images showed that the memorability effect ($\eta_p^2=0.32$) dwarfed the effect of intentional forgetting cues ($\eta_p^2=0.08$), with no interaction ($BF_{01}=7.19$).
• Depth of Encoding: Shallow versus deep judgment tasks altered mean memory but preserved large memorability differences ($\eta_p^2=0.50$).
• Perceptual Priming: Recognition speed for category judgments was robustly affected by repetition (priming) but did not interact with or depend on memorability attributes ($BF_{01}=2.26$ and $4.89$ for no interaction).

A synthesis of these findings yields that intrinsic image memorability accounts for approximately 50% of the variance in recognition memory, unaffected by attention, encoding strategy, or priming manipulation.

3. CRM as a Paradigm for Evaluating Memorization in LLMs

In the domain of LLMs and PII leakage, CRM provides necessary conditions for attributing any output to memorization rather than surface-cue-driven reconstruction (Luo et al., 7 Jan 2026):

• Overlap Cue Quantification: The cue score $c(s,p)$ strictly quantifies how much of a target string $s$ is “cued” in a prompt $p$. Specialized variants apply for structured PII (e-mail addresses, phone numbers), decomposing cues by local or domain parts.
• CRM Evaluation Protocol: For any prompt–target pair, CRM dictates stratifying evaluation by cue score. Memorization rates and log-likelihoods are computed only for pairs with low overlap ($c(s,p)<\tau$), distinguishing true memorization from prompt-driven predictability.
• Memorization Paradigms:
  • Verbatim completion: The prompt is the literal pre-PII context as found in training data.
  • Associative reconstruction: The prompt omits the target fact but includes related attributes.
  • Cue-free generation: The LLM is tasked with generating plausible instances without contextual clues.
  • Membership inference: The model or attack algorithm attempts to discriminate training members among (p,s) pairs, measured by AUROC.

4. Statistical and Analytical Frameworks

CRM invokes specific statistical protocols and analytical formulations:

Metric	Formula/Definition	Primary Use
Overlap Cue	$c(s,p) = \mathrm{LCS}(\nu(s), \nu(p)) / |\nu(s)|$	Condition on overlap
CRM Hit Rate	$$HR(\tau) = \mathbb{E}[\mathbf{1}_{s\sqsubseteq \hat{s}(p)}|c(s,p)<\tau]$$	Cue-controlled recall
Reconstruction Score	$Recon(\tau) = \mathbb{E}[M(s|p)|c(s,p)<\tau]$	Cue-controlled log-likelihood
AUROC (Membership Inf.)	Normalized to $[0.5,1]$ range	Membership inference efficacy

In both perceptual memory and LLMs, regression analyses and ANOVAs are used to dissociate the contributions of intrinsic memorability from attention, depth, and priming, as well as to estimate population-level Bayes Factors quantifying (non-)effects of cue manipulations.

5. Empirical Findings and Application Domains

Human Memorability:

CRM demonstrates that no experimenter-imposed focus, distraction, or repetition scheme negates the dominant effect of image-driven memorability. This suggests memorability is an orthogonal, robust property—enabling applications in education (designing study materials), interface/layout optimization (icons, signage), marketing (advertising image curation), and media production (storyboarding with lasting impact) (Bainbridge, 2017).

LLM PII Leakage:

CRM analysis across 32 languages and multiple model sizes shows that, under low-cue ($c(s,p) < 0.5$) conditions, hit rates for exact PII extraction are near zero. The true positive rate for membership inference attacks is almost indistinguishable from random guessing (AUROC near 0.5, true positive rates at $FPR=10^{-3}$ near $10^{-3}$ to $10^{-2}$), refuting most prior claims of pervasive memorization under real-world (cue-controlled) prompts.

6. Conceptual and Theoretical Implications

CRM enforces that only memory which survives the removal of confounding cues qualifies as genuine. In perceptual science, CRM isolates the intrinsic predictive value of memorability signals ($M(I)$) relative to all known forms of attention and priming, formalized via regression models with coefficients $\beta_\mathrm{exo}\simeq 0$, $\beta_\mathrm{endo}\simeq 0$, $\beta_p\simeq 0$, but $\alpha\gg 0$ for memorability:

$$\mathrm{Performance}_t(I) = \sigma [\alpha M(I) + \beta_\mathrm{exo}A_\mathrm{exo}(t,I) + \beta_\mathrm{endo}A_\mathrm{endo}(t,I) + \beta_p P(t,I) + \eta_t]$$

In AI privacy evaluation, CRM specifies that privacy risk assessments be predicated only on results that demonstrably exclude prompt-driven pattern completion (Luo et al., 7 Jan 2026). This disambiguation is critical for policy and technical stakeholders to quantify data exposure risk and to design or select memorization evaluation protocols.

7. Prospects and Broader Significance

The CRM framework unifies observer-invariant perceptual memory and cue-controlled model memorization evaluation under a single, operationalizable principle: that true memory can be measured only after conditioning out trivial retrieval cues. In applied settings, this approach enables more valid assessments of model privacy risk, more fine-grained behavioral prediction in cognitive science, and optimized control over which content is likely to persist or propagate within user populations. The adoption of CRM or equivalent cue-controlled standards is advocated as fundamental for future work in both human memory and AI privacy domains (Bainbridge, 2017, Luo et al., 7 Jan 2026).