Selective Memorization in Neural Networks

• Selective Memorization is a mechanism in AI where models encode only chosen data subsets, optimizing memory allocation instead of uniformly storing all information.
• It employs techniques like controlled training variables and specialized gating to enhance retention of relevant signals while reducing noise and sensitive details.
• Applications include model fusion, privacy preservation, and efficient training, impacting performance through task-specific memory management and signal prioritization.

Selective memorization is a family of mechanisms and phenomena in which a model, training procedure, or memory system does not encode all information uniformly, but instead retains, amplifies, suppresses, routes, or archives selected subsets of examples, tokens, facts, features, or knowledge objects. Recent work treats memorization as sparse, context-dependent, and architecture-dependent rather than as a single global property. In LLMs, this includes preserving shared knowledge while forgetting model-specific examples under weight fusion, making memorization pressure an explicit training variable, isolating repeated-sequence memory into removable neurons, or intervening only on token positions that appear memorization-dominant (Zaman et al., 2023, Zhang et al., 6 Apr 2026, Ghosal et al., 14 Jul 2025, Zhang et al., 9 Feb 2026).

1. Conceptual scope

The literature uses the term in several related but non-identical senses. In model fusion, selective memorization denotes the tendency of convex weight averaging to preserve knowledge shared across models while suppressing memorized examples that are specific to only one model (Zaman et al., 2023). In controllable-training work, it denotes a parametric axis along which otherwise identical models can be trained to memorize more or less strongly by changing only a scalar control variable $\alpha$ (Zhang et al., 6 Apr 2026). In mechanistic analyses of transformers and deep networks, it denotes sparse storage of atypical examples in specific neurons, channels, or low-dimensional subspaces rather than uniform storage across all layers or parameters (Maini et al., 2023, Dana et al., 2024). In privacy and unlearning work, it denotes targeted removal of sensitive memorized content while preserving surrounding utility, syntax, or general behavior (Chu et al., 17 Sep 2025, Zhang et al., 2024). In systems work, it denotes write-time gating of external memory so that salient knowledge enters the active store while low-salience or superseded content is archived rather than deleted (Zahn et al., 16 Mar 2026).

A closely related usage appears in domains where the objective is not to erase memorization but to make it task-selective. In vision-and-language navigation, COSMO uses state-space modules to filter, compress, and retain only instruction-relevant visual and history information before Transformer-based grounding and action prediction (Zhang et al., 31 Mar 2025). In factual pretraining, selective memorization refers to reallocating a model’s limited factual memory budget toward a smaller and flatter set of facts, rather than diffusing capacity across too many repeated or redundant facts (Ye et al., 9 Apr 2026).

2. Operational definitions and measurement

Because the term spans multiple domains, its operationalization is highly task-specific.

Setting	Operationalization	Representative metrics
Fine-tuned masked LLMs	Training-set reconstruction ability on masked-token prediction	MLM accuracy on own subset, other subsets, shared subset, dev (Zaman et al., 2023)
Controlled LLM training	Recall on deliberately injected seen examples versus held-out unseen examples	Seen/unseen accuracy, suffix NLL (Zhang et al., 6 Apr 2026)
Code LLMs	Exact extractability of sensitive strings from a prefix	Memorization Accuracy, Extraction Likelihood $EL_n$ (Chu et al., 17 Sep 2025)
Constrained NLG / NMT	Exact reference generation from an insufficient source prefix	Prefix ratio threshold $l/n \le 0.75$, neighborhood effect $N$ (Raunak et al., 2022)
Semi-supervised node classification	Performance gap between models trained with versus without a node	$\mathcal{M}(v_i)$, memorization rate $MR$ (Jamadandi et al., 26 Aug 2025)
Diffusion and GAN generation	Near-duplication or unusually high similarity to training samples	SSCD, nL2, $C_T$ (Chen et al., 2024, Bai et al., 2022)

In "Fuse to Forget" (Zaman et al., 2023), memorization is defined operationally as masked-token prediction accuracy on training examples after fine-tuning bert-base with MLM on small overlapping subsets of CNN/DailyMail. The evaluation masks $15\%$ of tokens and reports accuracy on a model’s own subset, other models’ subsets, a shared subset, and a held-out dev set; the table caption states that “Higher scores represent higher memorization.” The fused model sharply reduces accuracy on unshared subsets while increasing accuracy on the shared subset, which makes the operational meaning explicitly selective.

"Memory Dial" (Zhang et al., 6 Apr 2026) replaces post-hoc diagnosis with a controlled training variable. For each benchmark, 50 examples are selected as seen examples and explicitly injected into training via a dedicated leak data loader, while the remaining 950 examples are held out entirely and never seen during optimization. Across all 30 model-benchmark combinations, seen-example accuracy increases monotonically with $\alpha$, whereas unseen accuracy remains essentially unchanged, so memorization pressure is measured by a controlled seen/unseen separation rather than by a single aggregate score.

In code models, "Scrub It Out!" (Chu et al., 17 Sep 2025) formalizes memorization at the level of exact extractability. A string $s$ is memorized if there exists a prefix $EL_n$0 such that the model’s most likely continuation is exactly $EL_n$1, and $EL_n$2 appears in the training set. The paper uses Memorization Accuracy and Extraction Likelihood $EL_n$3 for $EL_n$4, derives thresholds from a truly unseen dataset, and defines successful forgetting as bringing the forgotten sample below those thresholds.

Other settings adopt more localized criteria. "Finding Memo" (Raunak et al., 2022) defines extractive memorization in NMT as exact reference generation from a source prefix whose length ratio satisfies $EL_n$5. "GSS" (Zhang et al., 9 Feb 2026) uses a token-level signal

$EL_n$6

treating token $EL_n$7 as memorization-dominant when $EL_n$8. "NCMemo" (Jamadandi et al., 26 Aug 2025) adapts leave-one-out memorization to graphs through

$EL_n$9

with memorization rate defined as the fraction of nodes whose score exceeds $l/n \le 0.75$0.

3. Mechanisms and theoretical accounts

A recurring mechanism is the separation between shared and idiosyncratic information. "Fuse to Forget" (Zaman et al., 2023) uses simple convex averaging,

$l/n \le 0.75$1

and argues that shared knowledge is enhanced while unshared knowledge is usually forgotten. In its memorization experiments, the fused model has $l/n \le 0.75$2 accuracy on the unshared A/B/C subsets, $l/n \le 0.75$3 on the shared subset, and $l/n \le 0.75$4 on dev; larger fusions such as $l/n \le 0.75$5 forget even more unshared memorized examples while reaching the best dev score among fused variants. The same paper ties this to Fisher-overlap analysis: shared knowledge corresponds to more similar weights across models, whereas model-specific memorization is diluted by averaging.

Controlled-training work supplies a complementary mechanism. "Memory Dial" (Zhang et al., 6 Apr 2026) shows that interpolating standard cross-entropy with a temperature-sharpened objective creates a rich-get-richer effect: when $l/n \le 0.75$6, confident predictions receive amplified updates. The consequence is selective pressure toward repeated or already-easy sequences. The paper reports positive seen-accuracy slopes from $l/n \le 0.75$7 to $l/n \le 0.75$8, average seen-accuracy slope $l/n \le 0.75$9 for OPT-27B versus $N$0 for DistilGPT2, and a stable frequency ordering in which high-frequency sequences are easier to memorize than rare ones at every $N$1. This suggests that selective memorization is partly a frequency-allocation phenomenon.

Mechanistic localization studies reject the idea that memorization is simply a late-layer effect. "Can Neural Network Memorization Be Localized?" (Maini et al., 2023) finds that memorization is not confined to the final few layers and is often confined to a small number of neurons or channels, around $N$2. More than $N$3 of memorized examples can be flipped by removing fewer than $N$4 neurons or channels, with an average of $N$5 removed units for memorized examples versus $N$6 for clean examples. The same work proposes example-tied dropout, reducing accuracy on memorized examples from $N$7 while also reducing the generalization gap. "GSS" (Zhang et al., 9 Feb 2026) reaches a related conclusion at token granularity: memorization is sparse, intermittent, and token-conditioned, with a heavy-tailed $N$8 distribution, mean burst length $N$9 tokens, and $\mathcal{M}(v_i)$0 single-token bursts.

Formal capacity results sharpen this picture. "Memorization in Attention-only Transformers" (Dana et al., 2024) proves that a one-layer attention-only Transformer can memorize at least $\mathcal{M}(v_i)$1 associations in the exact association setting, improving the earlier $\mathcal{M}(v_i)$2 bound and removing the unrealistic $\mathcal{M}(v_i)$3 context restriction. The same paper distinguishes exact association memorization from approximate memorization of next-token distributions, and shows a rank bottleneck: if $\mathcal{M}(v_i)$4, there exist target distributions $\mathcal{M}(v_i)$5 for which exact distributional memorization is impossible. Selectivity therefore appears not only in what is stored, but in whether the target is deterministic, high-probability, low-entropy, or distributional.

Geometric analyses extend the idea beyond discrete token associations. "Losing dimensions" (Achilli et al., 2024) argues that diffusion models on manifold-supported data can undergo selective loss of dimensionality: different tangent subspaces are lost at different critical times and dataset sizes, with critical behavior depending on local variance. The paper’s counterintuitive result is that, under some conditions, subspaces of higher variance are lost first due to memorization effects. In graph learning, "Memorization in Graph Neural Networks" (Jamadandi et al., 26 Aug 2025) shows an inverse relation between memorization and graph homophily, with memorization rates on synthetic syn-cora graphs dropping from about $\mathcal{M}(v_i)$6 at $\mathcal{M}(v_i)$7 to $\mathcal{M}(v_i)$8 at $\mathcal{M}(v_i)$9. The same paper introduces Label Disagreement Score,

$MR$0

and shows that nodes with higher label inconsistency in their feature-space neighborhoods are significantly more prone to memorization. Taken together, these results suggest that selective memorization is often driven by anisotropy, atypicality, or structural mismatch rather than by uniform overfitting.

4. Training-time control and architectural design

A central shift in recent work is from observing memorization after training to engineering it during training. "Memory Dial" (Zhang et al., 6 Apr 2026) is explicit on this point: architecture, training data, optimization hyperparameters, and exposure protocol are held constant within each sweep, and only the scalar $MR$1 changes. The framework therefore treats memorization pressure as an independent experimental variable. Its main result is that seen-example accuracy rises monotonically with $MR$2 while unseen accuracy remains stable across six architectures and five benchmarks.

Several papers instead route memory into designated structures. "Memorization Sinks" (Ghosal et al., 14 Jul 2025) argues that under standard pretraining, memorization of natural repeated sequences becomes mechanistically entangled with general language abilities, making post-hoc removal difficult. MemSinks assigns a sequence identifier that activates a unique set of memorization neurons for each sequence across repetitions. In the small-scale setup, a GPT-2-medium-like model with about $MR$3M parameters uses $MR$4, so $MR$5 of MLP neurons are shared and $MR$6 form the memorization pool, with memorization dropout ratio $MR$7. The paper reports effective isolation and strong generalization at the billion-parameter and billion-token scale, and states that MemSinks closes the gap between training loss and validation loss by at least $MR$8.

Selective learning can also be imposed at the gradient level. "Beyond Memorization" (Kothandaraman et al., 12 Dec 2025) reframes diffusion-model memorization control as concept-level selective learning. For each sensitive example, it computes a main gradient $MR$9 for the desired concept and a feature gradient $C_T$0 for the forbidden attribute, then projects away the aligned component: $C_T$1 The projected update preserves useful scene or semantic information while blocking the prohibited concept signal. The paper integrates this into a two-stage pipeline—general pretraining followed by constrained fine-tuning—and reports reduced SSCD with maintained CLIP similarity.

Data selection is another training-time route. "Cram Less to Fit More" (Ye et al., 9 Apr 2026) formulates fact memorization as an information-allocation problem. When the factual information in the training data exceeds model capacity, standard training can spread memory too thinly. The proposed LossH and LossHF schemes select facts using training loss alone, aiming to limit the number of facts and flatten their frequency distribution. On annotated Wikipedia pretraining, LossH-Wiki at selection ratio $C_T$2 enables a GPT2-Small model with $C_T$3M parameters to memorize $C_T$4 more entity facts than standard training, matching the performance of a $C_T$5 larger $C_T$6B model pretrained on the full dataset.

The phrase also appears in architectural memory compression. COSMO (Zhang et al., 31 Mar 2025) uses a selective memorization stage built from Round Selective Scan and the Cross-modal Selective State Space Module before a Transformer action-decision stage. RSS constructs a round scan by concatenating a sequence with its flipped copy, while CS3 makes the state update depend on one modality and the readout and gating depend on the other. The model has about $C_T$7M parameters, around $C_T$8 of DUET, and only $C_T$9 of DUET’s FLOPs. In this usage, selective memorization does not mean training-example recall; it means retaining instruction-relevant visual and history information while discarding redundant observations.

An adjacent but cautionary result comes from lifelong learning. "How Relevant is Selective Memory Population in Lifelong Language Learning?" (Araujo et al., 2022) studies seven experience-replay population strategies and finds that methods that randomly store a uniform number of samples from the entire data stream lead to high performances, especially for low memory size. Reservoir sampling is best on text classification with $15\%$0, and Ring Buffer is best on question answering with $15\%$1. In this setting, representativeness often beats ostensibly informative selectivity.

5. Mitigation, forgetting, and privacy preservation

A large portion of the literature uses selectivity to suppress unwanted or sensitive memory while preserving utility. In "Fuse to Forget" (Zaman et al., 2023), the privacy argument is direct: if personal information or rare data appears only in some training subsets, then fusing models trained on different subsets makes it less likely that a single fused model will reproduce that information. The practical implication highlighted in the paper is to split data across multiple models, fuse them afterward, and rely on the tendency of fusion to retain common signal while weakening isolated memorized details.

LLM-specific erasure methods make the selectivity more explicit. "Get Confused Cautiously" (Zhang et al., 2024) introduces EMSO, which combines entropy maximization on the forget set with selective optimization of only a small subset of blocks chosen by a contrastive gradient metric that uses both magnitude and direction. The method updates only top-$15\%$2 blocks, with top-2 performing best in the appendix, and requires no memorized reference model and no retain set. Across GPT-Neo $15\%$3M, $15\%$4B, and $15\%$5B, the paper reports the best overall erasure–utility trade-off, while NLL-based forgetting methods such as GD, KL, and GA often collapse into repetitive text or gibberish.

"Scrub It Out!" (Chu et al., 17 Sep 2025) adapts selective unlearning to code by separating each forgotten sample into sensitive sequences $15\%$6 and non-sensitive context $15\%$7, then applying gradient ascent only to the sensitive parts while preserving surrounding structure. The paper constructs a dataset of $15\%$8 highly memorized sensitive samples and evaluates on CodeParrot, CodeGen-Mono, and Qwen2.5-Coder families. CodeEraser reduces memorization below threshold on all studied CLMs; for Qwen2.5-Coder-7B, it reduces memorization by $15\%$9, retains $\alpha$0 of original performance, and takes $\alpha$1 seconds per sample on average. The selective segmentation is the key claim: code requires erasing the secret fragment without destroying syntax, formatting, or functionality.

"GSS" (Zhang et al., 9 Feb 2026) moves mitigation to inference-time hidden-state steering. It decomposes intervention into a probe $\alpha$2 that detects memorization-relevant activations and a steer $\alpha$3 that is applied only when the probe response exceeds a threshold calibrated on held-out generalization data. The method computes its probe-steer pairs through whitening and SVD, applies per-token intervention with complexity $\alpha$4, and claims $\alpha$5-$\alpha$6 less compute than optimization-based alternatives. On TinyMem, it achieves $\alpha$7 memorization with near-baseline utility; on Pythia-6.9B, it reduces memorization from $\alpha$8 to $\alpha$9.

Image-generation work adopts analogous selective filters. "Reducing Training Sample Memorization in GANs by Training with Memorization Rejection" (Bai et al., 2022) rejects generated samples whose nearest-neighbor distance to the training set falls below a threshold $s$0, so the generator is updated only on samples that are not near-duplicates. For BigGAN on CIFAR10, the paper reports that when $s$1, $s$2 improves with minimal impact on FID. "Towards Memorization-Free Diffusion Models" (Chen et al., 2024) proposes Anti-Memorization Guidance, which computes similarity to the nearest training image during each denoising step and activates guidance only when $s$3. Its three components—desspecification guidance, caption deduplication guidance, and dissimilarity guidance—are reported to eliminate all memorization cases under the standard threshold in Stable Diffusion and DDPM settings while keeping FID and CLIP close to baseline.

Distillation can also act as a selective filter. "On the Memorization of Consistency Distillation for Diffusion Models" (Jiang et al., 26 Apr 2026) studies transferred memorization from teacher to student and finds that consistency distillation significantly reduces student memorization at matched sample quality. On CIFAR-10, the paper reports a teacher with FID $s$4 and SSCD memorization $s$5 versus a student with FID $s$6 and SSCD memorization $s$7. The theoretical explanation is that the consistency-distillation curvature suppresses unstable feature directions associated with memorization while preserving stable, generalizable modes.

6. Applications, failure modes, and broader implications

Selective memorization is not only a design variable; it is also an evaluation hazard. "The Memorization Problem: Can We Trust LLMs' Economic Forecasts?" (Lopez-Lira et al., 20 Apr 2025) shows that GPT-4o can perfectly recall some historical economic and financial values from before its October 2023 cutoff while failing or refusing on others, creating what the paper calls selective perfect memory. The paper reports pre-cutoff macro recall such as unemployment-rate MAE $s$8 and 10-year Treasury-yield MAE $s$9, along with headline-date year accuracy $EL_n$00 pre-training versus $EL_n$01 post-training. Explicit prompt-level temporal boundaries and masking do not reliably prevent this behavior. The methodological conclusion is that historical forecasting or backtesting inside the training window is fundamentally confounded, and evaluation should use truly post-cutoff data.

At the memory-system level, "Selective Memory for Artificial Intelligence" (Zahn et al., 16 Mar 2026) argues that indiscriminate RAG storage and parametric memory are both poor analogues of biological memory. Its write-time gating scores incoming knowledge objects by source reputation, novelty, and source reliability, admits only objects whose composite salience exceeds a threshold, and places lower-salience or superseded objects in an archive linked by version chains. The reported headline result is $EL_n$02 accuracy for write-gated memory versus $EL_n$03 for ungated stores. Under distractor scaling, the paper reports that at $EL_n$04 distractor ratios, Self-RAG collapses to $EL_n$05 while write gating maintains $EL_n$06, and does so at one-ninth the query-time cost. This broadens selective memorization from an internal-model property to an external-memory design principle.

The same general issue arises in continual learning. "How Relevant is Selective Memory Population in Lifelong Language Learning?" (Araujo et al., 2022) shows that selective storage is not automatically beneficial: high-loss, surprise-based, or feature-centroid heuristics can create imbalanced memories that worsen forgetting, whereas reservoir or naive random sampling better approximate the global stream distribution. A common misconception is therefore that more selective storage necessarily yields better long-term retention. The reported results indicate that what matters is often representativeness rather than hardness.

Taken together, the literature suggests that selective memorization is best understood as controlled allocation of a finite memory budget across levels of abstraction: tokens, sequences, examples, facts, nodes, features, or external knowledge objects. Some methods increase memorization of chosen content, as in fact-focused pruning or controllable $EL_n$07-sweeps; others suppress isolated or sensitive content through fusion, unlearning, steering, rejection, or projection. Across these settings, the recurrent pattern is the same: useful performance is preserved when the retained signal is shared, stable, representative, or semantically aligned, whereas privacy and reliability problems concentrate in content that is rare, repeated, salient in the wrong way, or mechanistically entangled with general computation.