The Null Is the Hard Part: Exact Tests for Memorization in Generative Models

Sushovan Majhi; Pramita Bagchi

cs.LGSep 23, 2026

The Null Is the Hard Part: Exact Tests for Memorization in Generative Models

Authors: Sushovan Majhi, Pramita Bagchi

Organizations: Data Science, George Washington University, USA · Statistics, George Washington University, USA

Abstract

Memorization audits of generative models read similarity scores against thresholds, with no null distribution, and the conclusions they support can be wrong. By MemBench's rule, the benchmark's mitigations roughly halve Stable Diffusion's memorization; audited with false-discovery control, two thirds of the certified images are no longer detected under random prompt perturbations, five sixths under attention rescaling, and all of them under embedding optimization. The field's data-copying test, read against its own null, flags ten of twenty-four generators that reproduce nothing. We argue that for memorization the null is the hard part, and supply two. For a whole model, training and held-out images are exchangeable given its samples, and relabelling them is a permutation test, exact for any statistic when the held-out images are a random split; under it, a nearest-neighbour preference still fires on seven of those twenty-four, and a count restricted to the near-duplicate scale on none (McNemar p=0.016). For single images, the natural nulls fail twice, measurably: ranking an image among random images yields 596 false discoveries among 2,365 controls, and resampling independent generations makes the null three times too narrow. Calibrated against matched controls, the audit certifies 36 of 61 MemBench images at 5% false-discovery rate, held-out controls are certified in 0.01% of calibration splits, and on this benchmark two generations per image recover that count. A calibrated maximum, which reads occasional rather than typical copying, certifies 46. As the scale-restricted statistic we recommend the small-scale mass of the Intersection Euler Characteristic Profile, which also counts distinct images copied and tests whether two models copy the same ones.

Figures & tables

Figure 1: The recommended statistic. Left: the three clouds at the near-duplicate scale

r_{0}

; where a generation sits on a training image the two offsets meet, and the dark region is one blob per training image reproduced—this is what

\Delta\chi(r_{0};G,T)

counts. Middle and right: the measured profiles of two CIFAR-10 diffusion models. For the

200

-image memorizer the overlap with the training set has

132

components at

r_{0}

against

7

for the held-out cloud; for the

50{,}000

-image control the two are

13

and

14

, which is what exchangeability looks like. The swap test asks whether the gap between the two curves is larger than relabelling which real images are “training” would produce. (These are the swap statistic’s profiles on its scale grid; the leak counts of Table 1 are read by the readout protocol, at the near-duplicate scale of the real cloud alone, and come out at

131

against

15

and

20

against

19

Figure 2: Pixel-level reproduction. Top two rows: samples of a diffusion model trained on $200$ CIFAR-10 images, above their nearest training images. Bottom two rows: Stable Diffusion v1.4 generations from MemBench trigger prompts, above the verified memorized images they reproduce.

training set	$T_{\mathrm{small}}$	null	$p_{\mathrm{small}}$	copies (of $500$ )	distinct images (NN)	leak count
$100$	$+69.6$	$-0.4\pm 5.1$	$0.005$	$483$	$96$ of $100$	$89$
$200$	$+60.9$	$+0.5\pm 4.7$	$0.005$	$401$	$128$ of $200$	$116$
$200$ , seed 2	$+65.1$	$+0.7\pm 4.8$	$0.005$	$394$	$130$ of $200$	$128$
$500$	$+11.1$	$+0.0\pm 1.8$	$0.005$	$103$	$74$ of $500$	$86$
$1{,}000$	$+0.6$	$+0.0\pm 0.5$	$0.13$	$2$	$2$ of $1{,}000$	$-6$
$1{,}000$ , seed 2	$-0.4$	$-0.0\pm 0.7$	$0.68$	$6$	$6$ of $1{,}000$	$-11$

Table 1: Certified memorization along the training-set size (

100

k steps unless stated; training clouds capped at

2{,}000

images;

B=199

). Copies are samples within a quarter of the training-image spacing of a training image; the leak count is the excess overlap component count over the held-out background (Appendix N ); the nearest-neighbour tally of distinct images reproduced is its ground truth.

		detected	rejected, test split		rejected, random split
statistic	null	(of $4$ )	diffusion ( $11$ )	other ( $13$ )	diffusion ( $11$ )	other ( $13$ )
$Z_{U}$	normal ref.	$4$	$7$	$5$	$6$	$4$
$T_{\mathrm{NN}}$	swap	$4$	$4$	$3$	$4$	$3$
$Z_{U}$	swap	$4$	$4$	$1$	$4$	$1$
$C_{T}$	swap	$4$	$4$	$2$	$4$	$0$
$T_{\mathrm{mass}}$	swap	$4$	$0$	$4$	$1$	$1$

Table 2: What a rejection means, on

29

generators with ground truth:

4

that reproduce (at least a fifth of samples within

r_{0}

of a training image) and

24

that reproduce essentially nothing (

11

diffusion models with at most six copies;

13

autoencoders and adversarial networks with none), at level

0.05

. Statistics as defined in Section 2 ;

C_{T}

is the cell-weighted

Z_{U}

. Held-out images come from CIFAR-10’s test split, or from training images the model never saw, a random split that makes the swap null hold by design (

26

models; the three full-data models have no unused training images and keep the test split). Detection is

4

4

under both. Under the swap null every rejection of a non-reproducer is a correct rejection of that null, and none is reproduction.

Figure 3: The calibrated audit of Stable Diffusion v1.4. Left: per-image median SSCD similarity of a caption’s generations to its own source image, for the

300

control captions (the matched null) and the

61

memorized images; the benchmark’s fixed rule is the dashed line. Right: the per-image calibrated

p

-values against the Benjamini–Hochberg line at

q=0.05

; the floor at

1/301

is the null’s size.

Figure 4: Scoring MemBench’s mitigations on Stable Diffusion v1.4. Blue: memorized images the audit certifies at

5\%

false-discovery rate, each arm against a control null generated under the same mitigation. Orange: images the benchmark’s rule flags, a generation above similarity

0.5

. By the rule, mitigation roughly halves the flagged images; under the audit, two thirds to all of the certified images are no longer detected.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: The training-set-size sweep. Left: the certified small-scale overlap statistic in null standard deviations (red where

p_{\mathrm{small}}\leq 0.05

; triangles are second seeds, the square is the

300

k-step run). Right: the leak count (red) against the nearest-neighbour tally of distinct training images reproduced (open markers).

experiment	$T_{\mathrm{small}}$ (null SDs)	$p_{\mathrm{small}}$	$p_{\mathrm{scale}}$	$p_{\mathrm{NN}}$	$p_{Z_{U}}$	$p_{\mathrm{SSCD}}$
synthetic memorizer	$+20.6$	$0.0050$	$0.0050$	–	–	–
synthetic 20% memorizer	$+6.3$	$0.0050$	$0.0050$	–	–	–
synthetic non-memorizer	$-0.0$	$0.56$	$0.74$	–	–	–
DDPM, 100 images	$+13.8$	$0.0050$	$0.0050$	$0.0005$	$0.0005$	–
DDPM, 200 images	$+12.8$	$0.0050$	$0.0050$	$0.0005$	$0.0005$	–
DDPM, 200 images, seed 2	$+13.4$	$0.0050$	$0.0050$	$0.0005$	$0.0005$	–

Appendix

Table 3: Every model-level test of Sections 3 and 4 in one place.

T_{\mathrm{small}}

in null standard deviations;

p_{\mathrm{scale}}

is for the first interaction scale

T_{\mathrm{scale}}=r^{\ast}(G,H)-r^{\ast}(G,T)

, with

r^{\ast}(X,Y)

half the smallest distance between the two clouds;

p

-values from

B=199

relabellings (

1{,}999

for the nearest-neighbour,

Z_{U}

and SSCD statistics;

99

for the topological statistics of the SSCD-space row);

p_{Z_{U}}

is the data-copying statistic of Meehan et al. (2020) under the same null. Where several control draws were run, the entry is the median

z

and the largest

p

-value over draws. Seeds 3 and 4 at

1{,}000

images and seeds 2 and 3 at

2{,}000

and

5{,}000

were measured for the specificity comparison of Section 3 , with the

2{,}000

- and

5{,}000

-image training clouds capped at

1{,}000

space	scale window	effective rank	variance in $5$ components
SSCD embedding ( $1{,}024$ -d)	$0.04$	$574$	$0.03$
pixels, $32\times 32$	$2.62$	$4.5$	$0.64$
pixels, $64\times 64$	$2.60$	$5.1$	$0.60$

Appendix

Table 4: Concentration diagnostic on the memorized and control images. SSCD space is in the obstructed regime; pixel space at low resolution is not.

mitigation	certified	rule	pixel copies	$p_{\mathrm{small}}$ ( $64$ px)	null mean	memorized median
none	$36$ of $61$	$39$	$39$	$0.005$	$0.064$	$0.329$
RTA	$11$ of $61$	$22$	$3$	$0.255$	$0.052$	$0.056$
RNA	$10$ of $61$	$22$	$3$	$0.025$	$0.058$	$0.066$
Wen, target $1.6$	$0$ of $61$	$21$	$0$	$0.130$	$0.061$	$0.064$
Wen, target $1$	$0$ of $61$	$9$	$0$	$0.315$	$0.048$	$0.046$
Ren, $C_{1}=1.1$	$6$ of $61$	$17$	$1$	$0.150$	$0.057$	$0.068$

Appendix

Table 5: The audit under mitigation. Certified: images at

5\%

false-discovery rate against the matched null generated under the same mitigation (

300

captions,

12

generations each; held-out controls yield a discovery in at most

0.04\%

of splits in every arm, Appendix C ). Rule: images with a generation above the benchmark’s

0.5

own-source threshold. Pixel copies: generations within a quarter of the training-image spacing of a memorized image at

64

pixels.

p_{\mathrm{small}}

: the largest over five control draws; the text gives the number of draws that reject. Null mean: the mean of the

300

control captions’ median own-similarities; memorized median: the median over the

61

images of the same statistic.

model	training set	$p_{\mathrm{mass}}$	$p_{\mathrm{small}}$	$p_{\mathrm{NN}}$	$p_{Z_{U}}$	pixel copies
GAN	$50$	$\mathbf{0.010}$	$0.555$	$\mathbf{0.011}$	$\mathbf{0.017}$	$0/500$
GAN	$100$	$0.235$	$0.540$	$0.111$	$0.390$	$0/500$
GAN	$200$	$\mathbf{0.015}$	$1.000$	$0.064$	$0.123$	$0/500$
GAN	$200$ , seed 2	$0.275$	$1.000$	$0.501$	$0.052$	$0/500$
GAN	$500$	$0.635$	$0.990$	$0.830$	$0.812$	$0/500$
GAN	$1{,}000$	$0.110$	$0.950$	$0.163$	$0.263$	$0/500$

Appendix

Table 6: The same test, unmodified, on two model families it was not designed against, over training sets from

50

50{,}000

images, with the test-split held-out set. Not one of the thirteen places a sample within a quarter of the training-image spacing, so every rejection here is overfitting without reproduction: the all-scale mass rejects on four, the nearest-neighbour fraction on three and the data-copying statistic

Z_{U}

of Meehan et al. (2020) on one, while the small-scale statistic rejects on none of them.

Permutation Testing

See all 12 papers

May 21, 2026

Broken Memories: Detecting and Mitigating Memorization in Diffusion Models with Degraded Generations

While diffusion models excel at generating high-quality images, their tendency to memorize training data poses significant privacy and copyright risks. In this work, we for the first time identify that memorization induces internal numerical instability, often manifesting as visually ``broken'' artifacts. Inspired by stability analysis in numerical methods, we introduce empirical stability regions based on latent update norms to quantitatively characterize stable behavior during generation. Leveraging this, we propose a principled, on-the-fly framework for step-wise detection and adaptive mitigation. Our approach suppresses memorization without altering prompts or guidance, thereby preserving semantic fidelity and image quality. Extensive experiments on Stable Diffusion 1.4 demonstrate that our method achieves an AUC

>0.999

detection performance and a

0.0\%

memorization rate after mitigation with negligible overhead (

\approx0.01

s per image).

Yuanmin Huang, Mi Zhang, Chen Chen +4

Fudan University Shanghai, China · East China University of Science and Technology Shanghai, China

Memorization in Generative Models Diffusion Models

Ask PDF

Oct 8, 2026

Early Signatures of Memorization in Diffusion Models via Basin Geometry and Cyclic Denoising

Diffusion models generalize early in training and later reproduce individual training samples. Standard tests detect memorization only once one-shot generation produces near-copies, leaving a released model unaudited until its outputs fail. We show that memorization is encoded in the geometry of the learned energy landscape before it appears in generated samples, a state we call latent memorization. Using score divergence and basin volume, we find that localized basins form around training samples and separate them from held-out samples before the first memorized sample appears, with an onset that follows the same

O(n)

scaling as the memorization time. We probe these basins with cyclic denoising, which repeatedly applies partial noising and denoising. Under the exact empirical score, we prove that cycling started near an isolated training sample recovers it and returns to it over any finite number of cycles with high probability. In trained models, cycling recovers training images from CelebA and CIFAR-10 checkpoints whose one-shot samples contain no copies, and at a CelebA checkpoint with 0.1% one-shot copies, 500 cycles raise the memorized fraction above 30%. Cycling also reveals degenerate attractors that match no single training image and fade as training proceeds, so residence in a basin does not by itself imply memorization. These findings hold on a Gaussian mixture, CelebA, and CIFAR-10 across optimizers, architectures, noise schedules, and training-set sizes, and extend to off-the-shelf Stable Diffusion v1.4, where the cycled conditional-unconditional divergence gap separates memorized from non-memorized prompts with an AUC of 0.944 and a TPR of 0.866 at 1% FPR. More broadly, what a diffusion model has memorized is a property of the geometry and stability of its learned distribution, and assessing it requires examining this structure rather than generated outputs alone.

Nikhil Verma, Siddharthan Dileep, Anoop Singh +4

Yardi School of Artificial Intelligence, Indian Institute of Technology Delhi · Department of Computer Science and Engineering, Indian Institute of Technology Delhi · Jawaharlal Nehru Centre for Advanced Scientific Research +2

Memorization in Generative Models Diffusion Models

Ask PDF

Feb 23, 2026

You Don't Need All That Attention: Surgical Memorization Mitigation in Text-to-Image Diffusion Models

Generative models have been shown to "memorize" certain training data, leading to verbatim or near-verbatim generating images, which may cause privacy concerns or copyright infringement. We introduce Guidance Using Attractive-Repulsive Dynamics (GUARD), a novel framework for memorization mitigation in text-to-image diffusion models. GUARD adjusts the image denoising process to guide the generation away from an original training image and towards one that is distinct from training data while remaining aligned with the prompt, guarding against reproducing training data, without hurting image generation quality. We propose a concrete instantiation of this framework, where the positive target that we steer towards is given by a novel method for (cross) attention attenuation based on (i) a novel statistical mechanism that automatically identifies the prompt positions where cross attention must be attenuated and (ii) attenuating cross-attention in these per-prompt locations. The resulting GUARD offers a surgical, dynamic per-prompt inference-time approach that, we find, is by far the most robust method in terms of consistently producing state-of-the-art results for memorization mitigation across two architectures and for both verbatim and template memorization, while also improving upon or yielding comparable results in terms of image quality.

Kairan Zhao, Eleni Triantafillou, Peter Triantafillou

University of Warwick, UK · Google DeepMind, UK

Memorization in Generative Models T2I Diffusion Models Diffusion Model Guidance Attention Control in Diffusion Models

Ask PDF

Abstract

Permutation Testing

Explore similar work

Broken Memories: Detecting and Mitigating Memorization in Diffusion Models with Degraded Generations

Early Signatures of Memorization in Diffusion Models via Basin Geometry and Cyclic Denoising

You Don't Need All That Attention: Surgical Memorization Mitigation in Text-to-Image Diffusion Models