memorization and generative ai
published: November 14, 2025
on this page
i’m keeping a running list of papers and resources on memorization, recital, membership inference, and training data extraction in generative AI. this is by no means exhaustive, but it’s a starting point for my own research and for anyone else interested.
if you see something missing, please let me know.
papers
| Year | Authors | Title | Publication | Link |
|---|---|---|---|---|
| 2016 | Shokri, R., et al. | Membership Inference Attacks against Machine Learning Models | arXiv:1610.05820 | arXiv |
| 2020 | Feldman, V. | Does Learning Require Memorization? A Short Tale about a Long Tail | STOC 2020 | arXiv |
| 2020 | Brown, T., et al. | Language Models are Few-Shot Learners | arXiv:2005.14165 | arXiv |
| 2020 | Feldman, V., & Zhang, C. | What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimation | NeurIPS 2020 | arXiv |
| 2020 | Khandelwal, U., et al. | Generalization through Memorization: Nearest Neighbor Language Models | ICLR 2020 | arXiv |
| 2021 | Carlini, N., et al. | Extracting Training Data from Large Language Models | 30th USENIX Security Symposium | USENIX |
| 2021 | Jagannatha, A., et al. | Membership Inference Attack Susceptibility of Clinical Language Models | arXiv:2104.08305 | arXiv |
| 2021 | Lee, K., et al. | Deduplicating Training Data Makes Language Models Better | arXiv:2107.06499 | arXiv |
| 2023 | Biderman, S., et al. | Emergent and Predictable Memorization in Large Language Models | arXiv:2304.11158 | arXiv |
| 2023 | Carlini, N., et al. | Extracting Training Data from Diffusion Models | USENIX Security 2023 | arXiv |
| 2023 | Diera, A., et al. | Memorization of Named Entities in Fine-tuned BERT Models | CD-MAKE 2023 | arXiv |
| 2023 | Nasr, M., et al. | Scalable Extraction of Training Data from (Production) Language Models | arXiv:2311.17035 | arXiv |
| 2023 | Webster, R. | A Reproducible Extraction of Training Images from Diffusion Models | arXiv:2305.08694 | arXiv |
| 2023 | Yeticstiren, B., et al. | Evaluating the Code Quality of AI-Assisted Code Generation Tools | arXiv:2302.06590 | arXiv |
| 2023 | Nguyen, N., & Nadi, S. | An Empirical Evaluation of GitHub Copilot’s Code Suggestions | arXiv:2302.04728 | arXiv |
| 2024 | Bharucha, F. G., et al. | Generation or Replication: Auscultating Audio Latent Diffusion Models | ICASSP 2024 | IEEE |
| 2024 | Dana, L., et al. | Memorization in Attention-only Transformers | arXiv:2411.10115 | arXiv |
| 2024 | Epple, P., et al. | Watermarking Training Data of Music Generation Models | arXiv:2412.08549 | arXiv |
| 2024 | Mahdavi, S., et al. | Memorization Capacity of Multi-Head Attention in Transformers | ICLR 2024 | arXiv |
| 2024 | Meeus, M., et al. | Recite, Reconstruct, Recollect: Memorization in LMs as a Multifaceted Phenomenon | arXiv:2406.17746 | arXiv |
| 2024 | Meeus, M., et al. | Copyright Traps for Large Language Models | ICML 2024 | arXiv |
| 2024 | Patronus AI | Introducing CopyrightCatcher, the first Copyright Detection API for LLMs | Patronus AI | Announcement |
| 2024 | Qu, X., et al. | Automatic Jailbreaking of the Text-to-Image Generative AI Systems | arXiv:2405.16567 | arXiv |
| 2024 | Shilov, I., et al. | Mosaic Memory: Fuzzy Duplication in Copyright Traps for Large Language Models | arXiv:2405.15523 | arXiv |
| 2024 | Su, E., et al. | Extracting Memorized Training Data via Decomposition | arXiv:2409.12367 | arXiv |
| 2024 | Wang, W., et al. | Image Copy Detection for Diffusion Models | NeurIPS 2024 | arXiv |
| 2024 | Wang, Z., et al. | Could It Be Generated? Towards Practical Analysis of Memorization in Text-To-Image Diffusion Models | arXiv:2405.05846 | arXiv |
| 2024 | Wei, J., et al. | Memorization in deep learning: A survey | arXiv:2406.03880 | arXiv |
| 2024 | Chen, Y., et al. | Extracting Training Data from Unconditional Diffusion Models | arXiv:2406.12752 | arXiv |
| 2025 | Chen, C., et al. | Exploring Local Memorization in Diffusion Models via Bright Ending Attention | ICLR 2025 Spotlight | arXiv |
| 2025 | Cooper, A. F., et al. | Extracting memorized pieces of (copyrighted) books from open-weight language models | arXiv:2505.12546 | arXiv |
| 2025 | Gupta, T., & Pruthi, D. | All That Glitters is Not Novel: Plagiarism in AI Generated Research | ACL 2025 | arXiv |
| 2025 | Messina, F., et al. | Mitigating data replication in text-to-audio generative diffusion models through anti-memorization guidance | arXiv:2509.14934 | arXiv |
| 2025 | Morris, J. X., et al. | How much do language models memorize? | arXiv:2505.24832 | arXiv |
| 2025 | Ruan, Z., et al. | Unveiling Over-Memorization in Finetuning LLMs for Reasoning Tasks | arXiv:2508.04117 | arXiv |