A Non-Parametric Test to Detect Data-Copying in Generative Models
The paper proposes CT, a three-sample nonparametric Mann–Whitney test for detecting generative-model data-copying.
Key Findings
Methodology
The test uses the training set T, an independent target sample Pn, and generated samples Qm. For each point it computes d(x)=mint∈T||x−t||₂, then compares the distance distributions L(P) and L(Q). The Mann–Whitney U statistic and standardized score ZU quantify whether generated distances are unusually small. Because copying may be regional, k-means partitions the space; cell-wise tests are combined into CT using Pn-based weights.
Key Results
- On the two-dimensional moons dataset, Gaussian KDE bandwidths ranged from σ=0.001 to 10. FID, Binning, and Precision–Recall were nearly unchanged for σ≤σMLE, whereas CT was near zero around σMLE and sharply distinguished both σ≪σMLE copying and σ≫σMLE underfitting.
- Across MNIST, a VAE, and an ImageNet GAN, CT was more sensitive than the two-sample nearest-neighbor baseline. Figure 1c shows that the MNIST VAE copied in one region while underfitting another, demonstrating why a global average can conceal local memorization.
- Theoretically, (mn)⁻¹UQm consistently estimates ΔT(P,Q), with error probability bounded by exp(−2t²mn/(m+n)). If Q=P and the distance distribution is nonatomic, E[U/(mn)]=1/2 and E[ZU]=0.
Significance
The paper converts the vague concern of memorization into a testable statistical hypothesis. It addresses the practical absence of tractable likelihoods in GANs and the lower-bound-only likelihoods of VAEs by requiring only samples and a meaningful distance. Crucially, it separates data-copying from over-representation: a model can reproduce a bootstrap sample of the training set without changing aggregate mode frequencies, so FID, IS, and Precision–Recall may miss the failure.
Technical Contribution
The contributions are a model-agnostic three-sample distance test; a global Mann–Whitney statistic; a local k-means, threshold-τ, Pn-weighted score CT; and complementary NDB-over/NDB-under representation statistics. Theorem 1 proves consistency and a concentration bound for estimating ΔT(P,Q), Theorem 2 gives the Q=P null expectation, and Lemma 3 connects maximum-likelihood Gaussian KDE bandwidth selection with distance-balance conditions.
Novelty
Unlike most prior metrics, which compare aggregate training and generated distributions to detect mode collapse or dropping, this work systematically asks whether generated points are closer to the training set than independent target points. Its fundamental innovation is a model-independent, interpretable three-sample rank test, extended from global detection to regional diagnosis.
Limitations
- The method depends on a meaningful distance. For high-dimensional images, Inception-style embeddings may be necessary, but embedding distance need not equal semantic similarity or privacy relevance.
- Local CT depends on k-means partitions, threshold τ, and roughly 20 or more observations per cell. Poor partitions or sparse cells weaken the Gaussian approximation and statistical stability.
- The paper does not provide a complete power theory for the averaged local statistic, and it does not systematically quantify power across dimension, sample size, or copying fraction.
Future Work
Future work should derive power and multiple-testing guarantees for local CT, learn robust semantic distances and partitions, and study privacy leakage, near-duplicates, conditional generators, diffusion models, and language models. Coupling CT with training-time monitoring could enable early stopping, regularization selection, and data-governance alarms.
AI Executive Summary
Generative models can produce convincing samples while quietly memorizing their training data. Existing measures such as Inception Score, FID, Precision–Recall, and MMD mainly target mode collapse or mode dropping. A model that reproduces training examples with small perturbations may preserve aggregate modes and therefore appear successful. This paper formalizes that failure as data-copying: in some region, generated samples are systematically closer to the training set than fresh samples from the target distribution.
The proposed CT framework uses three independent sources: the training set T, a held-out sample Pn from the target distribution, and generated samples Qm. It maps every point to its nearest-training-set distance and compares the resulting real and generated distance distributions with the Mann–Whitney U test. The standardized score ZU is centered at zero under the null Q=P; negative values indicate copying and positive values indicate underfitting. k-means partitions make the test sensitive to regional behavior, where copying and underfitting can coexist.
Experiments use moons, MNIST, VAEs, and an ImageNet GAN. For Gaussian KDE bandwidths from σ=0.001 to 10, FID, Binning, and Precision–Recall were nearly insensitive to σ≤σMLE, while CT was close to zero near σMLE and responsive on both sides. Theorem 1 shows that U/(mn) consistently estimates ΔT(P,Q); when Q=P, its expectation is 1/2 and E[ZU]=0. CT offers a practical audit for models without likelihoods, although its reliability depends on distance design, partitioning, and sample size.
Deep Analysis
Background
VAEs and GANs expanded unsupervised generation, but GANs generally lack tractable densities and VAEs provide mainly an ELBO lower bound. Inception Score, FID, Precision–Recall, and MMD usually assess mode collapse, mode dropping, or aggregate distributional similarity. These metrics can reward slight perturbations of training samples. A direct, architecture-independent test for memorization therefore remained missing.
Core Problem
Given training data T, independent target samples Pn, and generated samples Qm, the goal is to determine whether Q is unusually close to T globally or in a subset of the instance space. Likelihood-based diagnostics are unavailable for many generators, while global averages can cancel local copying against local underfitting.
Innovation
- ��Define copying through nearest-training-set distances rather than aggregate similarity.
- ��Use a three-sample Mann–Whitney U comparison of L(P) and L(Q), avoiding density estimation.
- ��Use k-means cells and CT to expose regional copying.
- ��Report NDB-over and NDB-under for representation imbalance.
- ��Provide consistency and concentration guarantees for the global statistic and a null calibration when Q=P.
Methodology
- ��Input: T, Pn, Qm, and a distance d, typically d(x)=mint∈T||x−t||₂.
- ��Transform: compute distances for Ai∼Pn and Bj∼Qm.
- ��Rank test: U=Σij1[Bj>Ai], over all mn comparisons.
- ��Normalize: ZU=(U−mn/2)/√[mn(m+n+1)/12]; negative values suggest copying.
- ��Localize: run k-means on T and retain cells with Qm(π)≥τ.
- ��Aggregate: CT=ΣπPn(π)ZU,π/ΣπPn(π). Separately, Zπ tests whether cell frequencies differ.
Experiments
The moons benchmark uses Gaussian KDE with σ from 0.001 to 10 and compares CT with two-sample nearest neighbor, FID, Binning, Precision–Recall, and held-out likelihood. Further experiments use KDEs and a VAE on MNIST and a GAN on ImageNet. k-means creates the partition, while τ is chosen so valid cells contain approximately at least 20 observations, supporting Gaussian approximations for Z statistics.
Results
On moons, FID, Binning, and Precision–Recall were effectively identical for σ≤σMLE. The nearest-neighbor baseline changed only mildly because of training subsampling and bootstrap coverage. CT identified the MLE balance point near zero and reacted strongly to both overfitting and underfitting. The same sensitivity appeared for the MNIST VAE and ImageNet GAN. A three-sample kMMD baseline still treated the MLE model similarly to strongly overfit models.
Applications
CT can audit GANs, VAEs, diffusion systems, and other generators without reliable likelihoods. A practical deployment needs an independent target sample and a semantically defensible embedding distance. Reporting global ZU, local CT, and representation counts can jointly assess memorization, coverage, and underfitting.
Limitations & Outlook
The statistic detects abnormal relative proximity, not legal copying or privacy leakage directly. High-dimensional distances, Inception embeddings, k-means choices, and τ affect conclusions; sparse cells undermine normal approximations. The paper leaves local-average power guarantees open and predates systematic evaluation on modern diffusion and large conditional generation systems.
Plain Language Accessible to non-experts
Imagine a restaurant trying to recreate a city’s favorite dishes. The training set is the collection of recipes the chef has seen. The independent test set is a fresh collection of dishes made by other cooks. The generated samples are the meals served by the restaurant. Ordinary inspections ask only whether the menu looks broadly like the city’s cuisine, so a restaurant that copies a few known dishes with tiny changes may still receive a high score.
This paper asks a sharper question: how close is every served meal to a recipe the chef already saw? If the restaurant learned the underlying taste, its meals should be about as close to old recipes as fresh meals from other cooks. If it is copying, its meals will sit suspiciously close to those recipes. The researchers rank all pairwise closeness comparisons and use the ranking to produce a score without assuming a particular recipe distribution.
Because the restaurant may copy desserts but fail at main courses, the menu is divided into regions and checked separately. Experiments on moons, MNIST, and ImageNet show that this catches behavior that broad quality scores can overlook.
ELI14 Explained like you're 14
Imagine a student who must draw new characters for a game. The pictures shown during practice are the training set, a fresh set of characters is the test set, and the student’s drawings are the generated samples. The teacher wants to know more than “does this look good?” The real question is whether the student learned drawing or secretly traced the practice pictures.
The paper acts like a tracing detective. It measures how close each new drawing is to the nearest practice picture, then compares that with drawings made independently by someone who never saw the practice set. If the student’s pictures are always suspiciously close, even with tiny changes, the test says data-copying is happening. If they are much farther away, the student may not have learned the style yet.
The clever part is checking different neighborhoods separately. Maybe the student copies dragons but invents cars badly. A single average could hide that, so the method uses groups of similar examples. It was tested on curved “moons,” MNIST digits, a VAE, and an ImageNet GAN. Older scores sometimes miss tracing, while CT notices it better.
Of course, the detective needs a good ruler. Pixel distance may not match what humans think is similar, and too few examples make the verdict shaky. The test is a warning signal, not proof of wrongdoing—but it tells researchers where to investigate!
Glossary
Data-copying
A generator is data-copying when, in some region, its outputs are systematically closer to the training set than fresh target-distribution samples. It is distinct from ordinary mode collapse.
The central failure mode formalized and tested in the paper.
Mann–Whitney U test
A rank-based nonparametric comparison of two samples that does not require Gaussian densities. Here U/(mn) estimates the probability that a generated distance exceeds a real distance.
Used to construct ZU and CT.
CT statistic
A Pn-weighted average of cell-wise standardized U statistics over sufficiently represented cells. Negative CT values generally indicate local or global copying.
The paper’s main practical summary score.
Over-representation
A generator over-represents a region when its probability mass there is much larger than the target distribution’s mass. This can occur with or without data-copying.
Measured using NDB-over and NDB-under.
Gaussian KDE
A density estimator formed by placing a Gaussian kernel of bandwidth σ at every training point. Very small σ makes it approach a bootstrap sampler of the training set.
The controlled benchmark for varying copying strength.
Open Questions Unanswered questions from this research
- 1 The statistical power of local CT remains unresolved: a unified analysis is needed for how partition count, τ, sample size, and copying fraction determine detection probability.
- 2 Distance design is still the central bottleneck. Future work needs semantic representations that are simultaneously useful for similarity, memorization, and privacy auditing.
- 3 The experiments do not systematically cover diffusion models, language models, conditional generators, or large-scale real-world datasets.
Applications
Immediate Applications
Pre-release generator auditing
Developers can run CT using the training set, an independent validation sample, and fresh model outputs. Reporting global ZU, local CT, and representation statistics can reveal memorization before deployment, provided that a meaningful embedding distance is available.
Training-time monitoring
Teams can periodically sample a GAN or VAE and track CT across epochs. A persistently negative score can trigger early stopping, stronger regularization, better augmentation, or targeted inspection of the affected data regions.
Long-term Vision
Generative privacy-governance platforms
CT could be combined with membership inference, near-duplicate retrieval, and differential-privacy audits to create model-agnostic memory-risk dashboards. Standardized distances, thresholds, and cross-domain calibration remain major obstacles.
Abstract
Detecting overfitting in generative models is an important challenge in machine learning. In this work, we formalize a form of overfitting that we call {\em{data-copying}} -- where the generative model memorizes and outputs training samples or small variations thereof. We provide a three sample non-parametric test for detecting data-copying that uses the training set, a separate sample from the target distribution, and a generated sample from the model, and study the performance of our test on several canonical models and datasets. For code \& examples, visit https://github.com/casey-meehan/data-copying