It is effectively remembering pixels, and we can prove it because it can regenerate some of the training images verbatim, close enough to violate copyright law. It doesn’t matter that it’s compressed.