Mitigating Memorization in Text-to-Image Diffusion via Region-Aware Prompt Augmentation and Multimodal Copy Detection
Authors: Yunzhuo Chen, Jordan Vice, Naveed Akhtar, Nur Al Hasan Haldar, Ajmal Mian
Organizations: The University of Western Australia, Perth, Australia · The University of Melbourne, Melbourne, Australia · Curtin University, Perth, Australia
State-of-the-art text-to-image diffusion models can produce impressive visuals but may memorize and reproduce training images, creating copyright and privacy risks. Existing prompt perturbations applied at inference time, such as random token insertion or embedding noise, may lower copying but often harm image-prompt alignment and overall fidelity. To address this, we introduce two complementary methods. First, Region-Aware Prompt Augmentation (RAPTA) uses an object detector to find salient regions and turn them into semantically grounded prompt variants, which are randomly sampled during training to increase diversity, while maintaining semantic alignment. Second, Attention-Driven Multimodal Copy Detection (ADMCD) aggregates local patch, global semantic, and texture cues with a lightweight transformer to produce a fused representation, and applies simple thresholded decision rules to detect copying without training with large annotated datasets. Experiments show that RAPTA reduces overfitting while maintaining high synthesis quality, and that ADMCD reliably detects copying, outperforming single-modal metrics.
Figures & tables
Fig. 1: Overview of our framework. (a) RAPTA augments the training caption in an image-grounded way: a detector provides region proposals with classes and coarse positions; a small template set instantiates region-aware variants from the base prompt. One variant is sampled per iteration to condition the conditional diffusion model, injecting grounded diversity while preserving prompt–image alignment. (b) ADMCD is an inference-time, two-step detector. For a generated image G , we compare it against the training set using fused-feature cosine similarity Sfus ; pairs with Sfus>τ1 are flagged as Copy. A similarity-weighted score over three streams (visual, CLIP, texture) with threshold τ2 assigns the copy type.
Fig. 2: RAPTA pipeline. (a) A pretrained detector highlights saliency-based boxes with class/confidence; we keep the top- M with Si>τb and discretize each box center to a 3×3 grid G (top-left ⋯ bottom-right), yielding position tokens posi . (b) From the base prompt p , detected class ci and position posi , a small template set {Tj}j=1J instantiates region-aware variants V={p}∪{Tj(p,ci,posi)} . (c) For image I and each v∈V , CLIP consistency Sv=cos(fI,fv) is converted to weights wv=Svγ and normalized to π(v)=wv/∑u∈Vwu ; we sample a single prompt p~∼π(⋅) to condition training. This preserves prompt–image alignment while injecting grounded diversity.
Fig. 3: ADMCD pipeline. (a) For an image X∈{G,R} , three complementary embeddings are extracted: a patch-level visual descriptor fvis(X) , a global CLIP descriptor fclip(X) , and a texture descriptor ftex(X) . After linear projection, the streams are fused by a lightweight Transformer and ℓ2 -normalized to yield f^fus(X) . (b) Copy decision uses fused cosine similarity Sfus ; we flag Copy if Sfus>τ1 . (c) For flagged pairs we compute stream-wise similarities Svis,Sclip,Stex and the similarity-weighted score Sˉ ; Retrieve/Exact if Sˉ>τ2 , otherwise Style . Thresholds (τ1,τ2) and weights (ω1,ω2,ω3) are fixed from validation sweeps.
TABLE I: Result comparison on one query: a generated image G and the Top-5 retrieved references R1..5 under different methods.
Method
ADMCD (Ours)
FID
CLIP Score
KID
DCR [ 14 ]
3.2
7.9
30.5
2.9
LDM–T2I [ 24 ]
5.3
10.4
33.2
3.1
SD2.1-base [ 25 ]
7.4
8.3
27.8
3.3
RAPTA(Ours)
2.6
8.1
23.1
1.6
TABLE II: Detection vs. conditional diffusion backbones. Copy Rate is computed by ADMCD at threshold τ1 ; generation quality is reported on the same sample set.
Method
Original
Gauss N.
Gauss B.
Poisson
S&P
Speckle
LPIPS [ 20 ]
0.233
0.444
0.335
0.375
0.612
0.569
ORB [ 18 ]
0.276
0.242
0.155
0.282
0.172
0.184
SSIM [ 19 ]
0.677
0.504
0.664
0.591
0.389
0.407
SSCD [ 5 ]
0.680
0.594
0.443
0.429
0.485
0.407
DreamSim [ 22 ]
0.857
0.781
0.714
0.691
0.689
0.707
ADMCD(Ours)
0.974
0.923
0.940
0.929
0.871
0.894
TABLE III: Similarity between a generated image G and a fixed reference R under noise perturbations. Column Original reports the score for (G,R) without any perturbation; the other columns report scores after perturbing only G with Gaussian noise, Gaussian blur, Poisson noise, salt–pepper, and speckle. Higher is better except LPIPS (distance).
Method
Crop20%
Flip H
Flip V
Occlude10%
Rotate 30∘
LPIPS [ 20 ]
0.335
0.373
0.519
0.315
0.615
ORB [ 18 ]
0.232
0.221
0.243
0.110
0.276
SSIM [ 19 ]
0.570
0.556
0.427
0.642
0.207
SSCD [ 5 ]
0.577
0.404
0.464
0.391
0.489
DreamSim [ 22 ]
0.617
0.524
0.564
0.691
0.689
ADMCD(Ours)
0.970
0.886
0.857
0.748
0.939
TABLE IV: Similarity between a generated image G and a fixed reference R under geometric perturbations applied only to G : 20% crop, horizontal/vertical flips, 10% occlusion, and 30∘ rotation. Higher is better except LPIPS (distance). G and R are the same as in Table III .
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Fig. 4: Accuracy vs. threshold on fused similarity Sfus . Best accuracy is achieved at τ=0.938 .
Fig. 5: Accuracy heatmap over (wvis,wclip) with wtex=1−wvis−wclip . Peak at (0.24,0.38,0.38) .
Fig. 6: Robustness examples. Top: generated query G . Bottom: the clean retrieved copy R and ten corrupted variants—Gaussian noise, Gaussian blur, Poisson noise, salt–pepper, speckle, 20% crop, horizontal/vertical flips, 10% occlusion, and 30∘ rotation. Our fused-feature similarity Sfus remains high and continues to select the correct match across both photometric and geometric perturbations. Numerical scores for each method appear in Tables III and IV .
Fig. 7: Per-image robustness under ten common image-based attacks. For a query G and its retrieved copy R , we apply Gaussian noise/blur, Poisson, salt–pepper, speckle, 20% crop, horizontal/vertical flips, 10% occlusion, and a 30∘ rotation.
Text-to-image diffusion models often memorize training data, revealing a fundamental failure to generalize beyond the training set. Current mitigation strategies typically sacrifice image quality or prompt alignment to reduce memorization. To address this, we propose Reachability-Aware Diffusion Steering (RADS), an inference-time framework that prevents memorization while preserving generation fidelity. RADS models the diffusion denoising process as a dynamical system and applies concepts from reachability analysis to approximate the "backward reachable tube"--the set of intermediate states that inevitably evolve into memorized samples. We then formulate mitigation as a constrained reinforcement learning (RL) problem, where a policy learns to steer the trajectory away from memorization via minimal perturbations in the caption embedding space. Empirical evaluations show that RADS achieves a superior Pareto frontier between generation diversity (SSCD), quality (FID), and alignment (CLIP) compared to state-of-the-art baselines. Crucially, RADS provides robust mitigation without modifying the diffusion backbone, offering a plug-and-play solution for safe generation. Our website is available at: https://s-karnik.github.io/rads-memorization-project-page/.
Sathwik Karnik, Juyeop Kim, Sanmi Koyejo +2
Stanford University, Stanford, CA, USA · Yonsei University, Seoul, Korea
Generative models have been shown to "memorize" certain training data, leading to verbatim or near-verbatim generating images, which may cause privacy concerns or copyright infringement. We introduce Guidance Using Attractive-Repulsive Dynamics (GUARD), a novel framework for memorization mitigation in text-to-image diffusion models. GUARD adjusts the image denoising process to guide the generation away from an original training image and towards one that is distinct from training data while remaining aligned with the prompt, guarding against reproducing training data, without hurting image generation quality. We propose a concrete instantiation of this framework, where the positive target that we steer towards is given by a novel method for (cross) attention attenuation based on (i) a novel statistical mechanism that automatically identifies the prompt positions where cross attention must be attenuated and (ii) attenuating cross-attention in these per-prompt locations. The resulting GUARD offers a surgical, dynamic per-prompt inference-time approach that, we find, is by far the most robust method in terms of consistently producing state-of-the-art results for memorization mitigation across two architectures and for both verbatim and template memorization, while also improving upon or yielding comparable results in terms of image quality.
Kairan Zhao, Eleni Triantafillou, Peter Triantafillou
Text-to-image diffusion models have achieved remarkable progress in image synthesis, yet can exhibit memorization by closely reproducing individual training examples. Effective mitigation must preserve useful prompt information to guide alternative depictions. We introduce a training-free method that redistributes cross-attention with Gaussian smoothing before reinforcing content-token contributions and attenuating padding contributions, without additional denoiser evaluations. With this intervention, stronger content conditioning can improve prompt alignment at comparable training-image similarity. A local analysis identifies when reinforcement preserves shared value information while redistribution reduces localized attention mass. On Stable Diffusion v1.4 and v2.0, all evaluated smoothing widths lie on the empirical Pareto frontiers for training-image similarity versus both prompt alignment and image preference. A configuration selected on Stable Diffusion reduces template reproduction in DeepFloyd IF without further tuning. These findings support jointly controlling conditioning allocation and strength to generate prompt-consistent alternatives.