GSS: Gated Subspace Steering for Selective Memorization Mitigation in LLMs

Paper: 2602.08901 Authors: Xuanqi Zhang, Haoyang Shang, Xiaoxiao Li Categories: cs.CL, cs.LG

Abstract

Large language models memorize and reproduce training sequences verbatim, undermining both generalization and privacy. Existing mitigation methods apply interventions uniformly across all tokens and layers, ignoring the sparse and intermittent nature of memorization. GSS (Gated Subspace Steering) decomposes the intervention into two components: a probe that detects memorization-relevant activations and a steer that applies targeted correction only when the probe signal exceeds a threshold. The optimal probe-steer pair is derived from principled optimization. GSS matches or exceeds state-of-the-art memorization reduction while requiring 100-1000x less compute.

Key Contributions

• Sparse memorization hypothesis: Demonstrates that memorization is not a global property but a sparse, intermittent, token-conditioned phenomenon
• Probe-steer decomposition: Separates detection from correction, enabling selective intervention
• Principled optimization: Derives the optimal probe and steer directions from a formal objective
• Massive compute savings: 100-1000x reduction in computational cost compared to existing methods
• No quality degradation: Maintains or improves generation quality while reducing memorization

Background: The Memorization Problem

LLMs trained on large corpora can memorize and regurgitate training data verbatim. This poses several risks:

• Privacy violations: Reproducing personal information from training data
• Copyright concerns: Generating copyrighted text passages
• **Generalizatio: Memorized responses instead of genuine reasoning

Prior approaches to mitigate memorization include:

• Differential privacy training: Adds noise during training but degrades model quality
• Unlearning methods: Require expensive retraining or fine-tuning
• Activation editing: Apply uniform interventions that waste compute on non-memorized tokens

The GSS Framework

Observation: Memorization is Sparse

GSS begins with a critical empirical observation: memorization does not activate uniformly across all tokens in a sequence. Instead, it manifests as sparse bursts — specific tokens at specific layers trigger the transition from generalization to verbatim recall. This means uniform intervention is wasteful and potentially harmful to non-memorized generation.

The Probe Component

The probe is a linear projection that maps hidden states to a scalar memorization score:

$p(h) = w_{\text{probe}}^T h$

where $h$ is the hidden state at a given layer and token position. When $p(h) > \tau$ (a learned threshold), the model is likely entering a memorization regime.

The Steer Component

The steer is a direction in activation space that, when added to the hidden state, disrupts the memorization pathway:

$h' = h + \alpha \cdot \mathbb{1}[p(h) > \tau] \cdot w_{\text{steer}}$

The indicator function $\mathbb{1}[p(h) > \tau]$ ensures the correction is applied only when memorization is detected, leaving non-memorized tokens untouched.

Joint Optimization

The probe and steer directions are jointly optimized to minimize:

$\mathcal{L} = \mathcal{L}_{\text{mem}}(w_{\text{probe}}, w_{\text{steer}}) + \lambda \mathcal{L}_{\text{quality}}(w_{\text{probe}}, w_{\text{steer}})$

where $\mathcal{L}_{\text{mem}}$ measures residual memorization after intervenn and $\mathcal{L}_{\text{quality}}$ preserves generation quality on non-memorized content.

Why This Works

The key insight is that memorization and generalization occupy different subspaces in the model’s activation space. The probe identifies when the model’s hidden state enters the memorization subspace, and the steer nudges it back toward the generalization subspace. Because these subspaces are largely orthogonal, the steer has minimal impact on non-memorized generation.

Results

• Memorization reduction: Matches or exceeds state-of-the-art methods
• Compute efficiency: 100-1000x less compute than comparable approaches
• Quality preservation: No measurable degradation in generation quality on standard benchmarks
• Generality: Works across different model sizes and architectures

Significance

1. Practical privacy protection: Enables efficient memorization mitigation for deployed models without retraining
2. Mechanistic understanding: Provides evidence that memorization is a localized, detectable phenomenon in activation space
3. Selective intervention paradigm: The probe-steer framework could generalize to other undesirable model behaviors (toxicity, bias, hallucination)
4. Scalability: The massive compute reduction makes this applicable to the largest production models
5. Interpretability connection: The learned probe directions reveal which layers and token positions are most involved in memorization