Early Signatures of Memorization in Diffusion Models via Basin Geometry and Cyclic Denoising

Nikhil Verma; Siddharthan Dileep; Anoop Singh; Srikanth Sastry; Ramya Hebbalaguppe; Sayan Ranu; N. M. Anoop Krishnan

cs.LGOct 8, 2026

Early Signatures of Memorization in Diffusion Models via Basin Geometry and Cyclic Denoising

Authors: Nikhil Verma, Siddharthan Dileep, Anoop Singh, Srikanth Sastry, Ramya Hebbalaguppe, Sayan Ranu, N. M. Anoop Krishnan

Organizations: Yardi School of Artificial Intelligence, Indian Institute of Technology Delhi · Department of Computer Science and Engineering, Indian Institute of Technology Delhi · Jawaharlal Nehru Centre for Advanced Scientific Research · TCS Research Labs · Department of Civil and Environmental Engineering, Indian Institute of Technology Delhi

Abstract

Diffusion models generalize early in training and later reproduce individual training samples. Standard tests detect memorization only once one-shot generation produces near-copies, leaving a released model unaudited until its outputs fail. We show that memorization is encoded in the geometry of the learned energy landscape before it appears in generated samples, a state we call latent memorization. Using score divergence and basin volume, we find that localized basins form around training samples and separate them from held-out samples before the first memorized sample appears, with an onset that follows the same $O(n)$ scaling as the memorization time. We probe these basins with cyclic denoising, which repeatedly applies partial noising and denoising. Under the exact empirical score, we prove that cycling started near an isolated training sample recovers it and returns to it over any finite number of cycles with high probability. In trained models, cycling recovers training images from CelebA and CIFAR-10 checkpoints whose one-shot samples contain no copies, and at a CelebA checkpoint with 0.1% one-shot copies, 500 cycles raise the memorized fraction above 30%. Cycling also reveals degenerate attractors that match no single training image and fade as training proceeds, so residence in a basin does not by itself imply memorization. These findings hold on a Gaussian mixture, CelebA, and CIFAR-10 across optimizers, architectures, noise schedules, and training-set sizes, and extend to off-the-shelf Stable Diffusion v1.4, where the cycled conditional-unconditional divergence gap separates memorized from non-memorized prompts with an AUC of 0.944 and a TPR of 0.866 at 1% FPR. More broadly, what a diffusion model has memorized is a property of the geometry and stability of its learned distribution, and assessing it requires examining this structure rather than generated outputs alone.

Figures & tables

Figure 1: Memorization forms sharp, localized basins in the learned score field. ( A,B ) Normalized score divergence $\widehat{\mathcal{A}}_{1}$ for an eight-dimensional Gaussian mixture model (GMM), on a two-dimensional slice of the sample space obtained with the projection of Bihani et al. (2024) (App. G.6 ). ( A ) In the generalized regime, the field is smooth, with no prominent structure around training samples. ( B ) As memorization emerges, strongly negative regions form around training samples. ( C ) Schematic of cyclic denoising: at low noise, trajectories remain within a basin, whereas at sufficiently large noise they jump to neighbouring basins.

Figure 2: Geometric signatures across training on CelebA. ( A ) Training loss (solid), held-out loss (dashed), and FID (dotted, right axis) for $n=1024$ . ( B ) $\widehat{\mathcal{A}}_{1}$ at $\gamma=0.001$ and $f_{\mathrm{mem}}$ (dotted, right axis) for $n=512$ (orange), $1024$ (blue), and $2048$ (green); training (solid), held-out (dashed), and generated (dash-dot) samples. Inset: divergence against $\tau/n$ . ( C ) Mean log basin volume for $n=1024$ over all training samples and an equal number of generated and held-out samples, with line styles as in (B); bands show one standard deviation across samples. Refer Appendix G for equivalent results on Adam Optimizer

Figure 3: Cyclic denoising exposes latent memorization inside the generalization window. CelebA ( $n=4096$ , Adam; A–C ) and CIFAR-10 ( $n=8192$ ; D–F ) at checkpoints from $\tau_{\mathrm{gen}}$ to $\tau_{\mathrm{mem}}$ . ( A,D ) Generated samples at $c_{0}$ and $c_{500}$ ( $\gamma=0.10$ ) with their nearest training images. ( B,E ) $f_{\mathrm{mem}}$ and ( C,F ) $S_{\mathrm{cyc}}^{(k)}$ across cycles for several $\gamma$ .

Figure 4: Cyclic denoising reveals degenerate attractors. CIFAR-10 ( $n=8192$ , $\gamma=0.05$ ) at $\tau_{\mathrm{gen}}=49{,}500$ ( A–C ) and $\tau=83{,}000$ ( D–F ). ( A,D ) Three trajectories from $c_{0}$ to $c_{500}$ with the nearest training image to the final state; no attractor matches a single training image. ( B,E ) $\mathcal{A}_{1}$ and ( C,F ) $S_{\mathrm{cyc}}^{(k)}$ across cycles. Markers show the residence onset, which does not indicate memorization.

Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

Notation	Meaning	Notation	Meaning
Diffusion model
$x_{0}$	Clean data sample.	$x_{t}$	Noisy sample at diffusion timestep $t$ .
$t$	Diffusion timestep.	$T$	Total number of diffusion timesteps.
$\beta_{t}$	Forward-process variance schedule.	$\alpha_{t}=1-\beta_{t}$	Signal-retention coefficient.
$\bar{\alpha}_{t}=\prod_{s=1}^{t}\alpha_{s}$	Cumulative signal-retention coefficient.	$\epsilon\sim\mathcal{N}(0,I)$	Gaussian noise in the forward process.
$\epsilon_{\theta}(x_{t},t)$	Network prediction of injected noise.	$q(x_{t}\mid x_{0})$	Forward diffusion distribution.

Appendix

Table 1: Notation used throughout the paper.

Figure 5: Comparison of the noise standard deviation (

\sigma_{t}=\sqrt{1-\bar{\alpha}_{t}}

) versus the normalized timestep (

\gamma=t/T

) for linear and cosine noise schedulers. The cosine scheduler maintains lower noise magnitude for a significantly broader range of timesteps.

Figure 6: Geometric signatures across training on the GMM. (A) Train loss (solid) and test loss (dashed) at

\gamma=0.01

on the left axis, and

D_{\mathrm{KL}}(P_{\theta}\|P_{0})

(dotted, log scale) on the right axis, versus training step

\tau

, for

n=2048

. (B) Mean normalized score divergence

\widehat{\mathcal{A}}_{1}

on the left axis and

f_{\mathrm{mem}}

(dotted) on the right axis, versus

\tau

. Line style denotes the sample group: train (solid), test (dashed), generated (dash-dot). Colour denotes the training-set size:

n=1024

(orange),

n=2048

(blue),

n=4096

(green). Inset: the same divergence curves against

\tau/n

. (C) Mean log basin volume versus

\tau

for

n=2048

, with the line styles of (B); bands show one standard deviation across samples.

Figure 7: Cyclic denoising on the GMM across training. GMM, $n=512$ . Columns are checkpoints of increasing $\tau$ , with their one-shot $f_{\mathrm{mem}}$ . Each panel shows $512$ trajectories per amplitude, coloured by $\gamma$ ( $0.001\leq\gamma\leq 0.35$ ). (A) $f_{\mathrm{mem}}$ versus cycle for trajectories started from generated samples. (B) Mean cosine similarity between each state and its starting sample, computed on the raw $8$ -dimensional vectors, for the same trajectories. (C, D) The same quantities for trajectories started from the training points. Cycling raises $f_{\mathrm{mem}}$ above its one-shot value at small $\gamma$ once basins have formed, while at $\tau=42{,}107$ even training points are not retained.

Figure 8: Cyclic-denoising trajectories on the GMM score-divergence landscape. GMM, $n=512$ . Rows are checkpoints of increasing $\tau$ , with their one-shot $f_{\mathrm{mem}}$ ; columns are cycling amplitudes $\gamma$ . The background is the exact score divergence $\mathcal{A}_{1}$ of the learned score on a two-dimensional plane spanned by the direction joining the two component means and the leading orthogonal principal direction of the training data; red marks negative (contracting) values. Each row has its own colour scale, since the range grows from about $\pm 60$ to $\pm 6{,}000$ during training. The magenta path joins the projected states of one trajectory every $5$ cycles over $200$ cycles, from the start (green dot) to the end (yellow triangle). Because states are projected onto the plane, the path shows direction of motion rather than exact position on the background.

Figure 9: Saturated geometric degeneration on CIFAR-10. $\tau=49{,}500$ , $\gamma=0.05$ ; $f_{\mathrm{mem}}^{\mathrm{gen}}=0\%$ and full-cohort $f_{\mathrm{mem}}^{\mathrm{CD}}(500)=0\%$ . Repeated CD replaces recognizable content with saturated bands and colour blocks. The final column shows the nearest training image to c500.

Figure 10: Fading structure on CIFAR-10. $\tau=83{,}000$ , $\gamma=0.05$ ; $f_{\mathrm{mem}}^{\mathrm{gen}}=0\%$ and full-cohort $f_{\mathrm{mem}}^{\mathrm{CD}}(500)=3.1921\%$ . Six appearance-selected trajectories lose semantic structure and approach nearly monochromatic blue configurations.

Figure 11: Stripe-like and monochromatic degeneration on CIFAR-10. $\tau=49{,}500$ , $\gamma=0.05$ ; $f_{\mathrm{mem}}^{\mathrm{gen}}=0\%$ and full-cohort $f_{\mathrm{mem}}^{\mathrm{CD}}(500)=0\%$ . Trajectories develop repeated spatial bands or nearly monochromatic fields.

Figure 12: CelebA CD trajectories across training checkpoints, $\gamma=0.05$ . Top, middle and bottom pairs correspond to $\tau=5{,}200$ , $10{,}000$ and $20{,}000$ , respectively. Their logged $f_{\mathrm{mem}}^{\mathrm{gen}}$ values are $0\%$ , $0\%$ and $0.1308\%$ ; full-cohort $f_{\mathrm{mem}}^{\mathrm{CD}}(500)$ values are $0\%$ , $9.8\%$ and $21.12\%$ . At $\tau=5200$ the images move towards mere monochromatic darkness and remain stable there. For $\tau=10000$ and $\tau=20000$ more facial structure emerges for these non memorized basins.

Figure 13: Cyclic denoising from training samples. Memorization fraction

f_{\mathrm{mem}}

across 500 cycles for trajectories initialized from training images in (A) CelebA (

n=4096

, Adam, linear noise schedule) and (B) CIFAR-10 (

n=8192

, Adam, cosine noise schedule). Although

f_{\mathrm{mem}}

starts at

100\%

, it drops sharply under cycling. At

\tau_{\mathrm{gen}}

, it remains near zero, whereas later checkpoints retain or recover a larger fraction, depending on

\gamma

. Classification is against the full training set and does not require returning to the initial training image. Shaded bands combine the reported bootstrap standard errors with variation within each cycle bin. The memory of the initial train samples can be lost under cycling, basin residence only remains in a subset of train samples that become attractors(subject to cycling amplitude). Cycling moves trajectories to other stronger attractor basins.

Figure 14: Trajectories discover and reside in basins corresponding to training samples. ( A ) CelebA trajectories ( $n=4096$ , Adam, $\gamma=0.10$ ) from $c_{0}$ to $c_{500}$ , with the nearest training image to each final state. The marked onset is the first cycle at which a trajectory satisfies the $f_{\mathrm{mem}}$ criterion and remains classified as memorized for the rest of the run. ( B ) Score divergence $\mathcal{A}_{1}$ decreases as the trajectories approach these states; the decline can begin before the marked onset. ( C ) Consecutive-state LPIPS cosine similarity $S_{\mathrm{cyc}}^{(k)}$ increases and reaches a high plateau, consistent with residence after the approach. ( D–F ) The corresponding CIFAR-10 trajectories ( $n=8192$ , Adam, $\gamma=0.05$ ) and measurements. Colors identify trajectories across panels. Dotted lines and markers show their onsets. Divergence and similarity are displayed with a centered 50-cycle moving average. Annotations above A and D give the training step $\tau$ , one-shot $f_{\mathrm{mem}}$ , and FID.

Figure 15: Basin residence and jumping under repeated cycling at $\tau=40{,}000$ (run: CelebA32, UNet, $n=4096$ , Adam). Both sets begin in the basin associated with the same memorised training example. At $\gamma=0.1$ (top), trajectories remain in this basin. At $\gamma=0.2$ (bottom), stronger perturbations induce basin jumping, followed by sustained residence in another attractor, consistent with greater stability under cycling.

Figure 16: Distribution of the membership score (the sign-flipped normalized score divergence

\widehat{\mathcal{A}}_{1}

) for training (blue), held-out test (red), and generated (green) samples, at increasing training steps

\tau

(left to right), for GMM (top row) and CelebA (bottom row). The three distributions overlap in the generalized regime and separate—with training and generated moving together, away from test—as the model memorizes.

$\tau$	AUC	TPR	FPR	TPR@1%FPR
60,000	0.522	0.875	0.835	0.035
115,000	0.887	0.910	0.325	0.315
200,000	1.000	0.925	0.000	0.995
430,000	1.000	0.980	0.000	1.000

Appendix

Table 2: Membership inference from the normalized score divergence

\widehat{\mathcal{A}}_{1}

at a single noise level, on CelebA , without any access to training labels. AUC is threshold-free. TPR and FPR are reported at a moderate

5\%

false-positive budget; TPR@

1\%

FPR is the true-positive rate at a strict

1\%

budget. All operating points are read directly off the ROC curve.

$\tau$	AUC	TPR	FPR	TPR@1%FPR
4,750	0.531	0.066	0.047	0.012
42,107	0.510	0.047	0.045	0.012
97,466	0.909	0.607	0.049	0.490
315,604	1.000	1.000	0.000	1.000

Appendix

Table 3: Membership inference from the normalized score divergence

\widehat{\mathcal{A}}_{1}

at a single noise level, on the GMM . Conventions are identical to Table 2 .

Figure 17: CelebA width-64 U-Net trained with Adam, number of training samples -

n=512,1024,2048,4096

. A: FID and memorization fraction,

f_{\mathrm{mem}}

, versus training step

\tau

. B: The normalized score divergence

\hat{\mathcal{A}}_{1}

for train and held-out test samples versus

\tau

; bands show ±1 standard deviation across samples. Consistent lag between train-test

\hat{\mathcal{A}}_{1}

split and onset of

f_{mem}

C: The same

\hat{\mathcal{A}}_{1}

curves and

f_{\mathrm{mem}}

versus normalized training steps

\tau/n

. D: For the

n=4096

run, mean log basin-volume proxy for training and test images versus

\tau

, with ±1 standard deviation.

Figure 18: FID and memorization ratio of CIFAR-10 DiT-S runs with Adam optimizer and Cosine Noise Scheduler with n=2048, 4096,8192.

Figure 19: Visualised for the GMM dataset - As $\gamma$ decreases from left to right, the two-basin structure sharpens from a single merged attractor into two well-separated basins. The generalization window (row 2) already shows some sign of attractor formation, but this sharpening becomes more pronounced and localized only in the memorized regime (row 3), compared to the generalized regime (row 1) – directly quantifying its effect on the cyclic denoising dynamics.

Figure 20: Normalized score divergence versus noise amplitude $\gamma$ across all training checkpoints , for CelebA (a) and the GMM (b) . Each curve is one checkpoint, coloured by training regime: blue for the generalized regime and orange for the memorized regime, with lighter to darker shades as the training step $\tau$ increases within each regime. Line style distinguishes train, test, and generated samples. In the generalized regime (blue) the curves are shallow and cluster together across all $\gamma$ . In the memorized regime (orange) the normalized divergence is strongly negative at small $\gamma$ and rises toward zero as $\gamma$ increases, with the effect deepening as $\tau$ grows.

row	prompt	idx	$\gamma$	seed
hippo	Mothers influence on her young hippo	1262	0.9	2
laura	insights with laura unknown	67	0.1	2
laura	insights with laura unknown	67	0.9	2
air-con	air conditioners set for	215	0.9	1
air-con	air conditioners set for	215	0.9	0
label tape	set of nine brother tze 231 offlight white p-touch label	662	0.9	2

Appendix

Table 4: The six chains of Fig. 21 A, verbatim. idx is the row index in the MemBench SD v1.4 prompt table ( Hong et al., 2024 ) , which also supplies the matched training image. The two laura rows share a prompt, and seed differing only in

\gamma

; the two air-con rows share a prompt and

\gamma

and differ only in seed.

Figure 21: Cyclic denoising on off-the-shelf Stable Diffusion v1.4. Each cycle noises to amplitude $\gamma$ and denoises back; $c_{k}$ denotes the sample after $k$ cycles. (A) Six chains, one per row, with the matched LAION training image in the train column; each row label gives the prompt, the setting that varies, and the cycle at which the chain reaches its training image. The two laura rows share a prompt, a seed and a $c_{0}$ image and differ only in $\gamma$ ; the air-con s1 row leaves its basin and re-enters it. (B,C) The same six chains per cycle: SSCD to the training image and $\Delta\mathcal{A}_{1}$ , on a shared axis. (D) $\Delta\mathcal{A}_{1}$ after $200$ cycles against $\gamma$ , over $71$ completely memorised, $150$ partially memorised and $113$ non-memorised prompts ( Webster, 2023 ) and $150$ plain-English prompts ( Hong et al., 2024 ) . (E) Population means at $\gamma=0.1$ over the $71$ completely memorised and $113$ non-memorised prompts, $4$ seeds each: seed agreement (solid, left) and $\Delta\mathcal{A}_{1}$ (dashed, right); bands are $\pm$ SEM over prompts.

cycle	AUC (95% CI)	TPR@1%FPR (95% CI)
0	0.811 [0.787, 0.836]	0.526 [0.482, 0.572]
10	0.890 [0.864, 0.914]	0.804 [0.766, 0.838]
20	0.935 [0.916, 0.953]	0.834 [0.804, 0.872]
40	0.931 [0.910, 0.950]	0.858 [0.824, 0.892]
60	0.944 [0.926, 0.961]	0.866 [0.830, 0.900]
80	0.934 [0.914, 0.953]	0.856 [0.820, 0.888]

Appendix

Table 5:

\Delta A

\gamma=0.9

. Paired difference between

c=60

and

c=40

+0.016

, 95% CI

[-0.010,+0.041]

Figure 22: AUC and TPR@1%FPR against cycle count, with bootstrap bands.

statistic	AUC (95% CI)	TPR@1%FPR (95% CI)	AP
$\Delta A$ (ours)	0.944 [0.926, 0.961]	0.866 [0.830, 0.900]	0.933
$A_{\mathrm{cond}}$ alone	0.948 [0.939, 0.957]	0.194 [0.142, 0.246]	0.782
$A_{\mathrm{uncond}}$ alone	0.899 [0.884, 0.914]	0.066 [0.030, 0.094]	0.623
Wen SDN (single shot)	0.990 [0.986, 0.993]	0.838 [0.786, 0.882]	0.970

Appendix

Table 6: At

c=60

\gamma=0.9

. Paired differences,

\Delta A

minus SDN: AUC

-0.0456

, 95% CI

[-0.0633,-0.0287]

; TPR@1%FPR

+0.0265

, 95% CI

[-0.0260,+0.0841]

Figure 23: ROC (left) and precision–recall (right) at

c=60

. Class balance is 1:4; the dotted line in the right panel marks the positive rate.

Figure 24: Raw

\Delta A

against cycle, population means with 95% intervals. Memorised prompts move from

-1.24\times 10^{5}

c=0

-3.12\times 10^{5}

c=60

; non-memorised prompts remain within

0.03\times 10^{5}

of zero.

		$\Delta A$ , $c=60$		Wen SDN, single shot
negatives	$n$	AUC	TPR@1%FPR	AUC	TPR@1%FPR
laion	500	0.942	0.820	0.967	0.740
coco	500	0.945	0.884	0.996	0.950
lexica	500	0.945	0.892	0.997	0.976
random	500	0.944	0.876	1.000	0.998

Appendix

Table 7: Each row scores the 500 positives against one negative source.

Explore similar work

Jun 22, 2026cs.LG

Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models

We introduce cyclic denoising -- repeated forward and reverse diffusion at controlled noise amplitudes -- as an extraction attack for image diffusion models. Inspired by random organization in disordered solids, cyclic denoising exposes regions of the learned distribution that are largely inaccessible to standard sampling. The dynamics drive samples toward attractors with a broad stability spectrum. The deepest attractors are ultrastable: they regenerate after near-total corruption and persist through thousands of noising-denoising cycles. Many of these attractors correspond to memorized training images, including stock photographs, brand watermarks, and web-crawl artifacts. The attack requires only sampler-level control, with no gradients, weight inspection, prompts, captions, or prior knowledge of the training data. Unlike generate-and-filter attacks, which rely on large-scale prompted generation and post-hoc similarity or membership-inference filtering, our main protocol is fully unconditioned. We demonstrate the phenomenon in Stable Diffusion v1.4 and in a pixel-space DDPM, showing consistent behavior across latent- and pixel-space diffusion models. Across noise amplitudes, we observe a yielding-like transition: low-amplitude cycling produces trivial absorbing fixed points or limit cycles, while larger amplitudes induce rearrangements, basin hopping, and long-lived trapping in structured memorized attractor basins. We also observe hierarchical partial absorption, prompt-stabilized basins, and cross-initial-condition universality of the recovered attractor set. Our results therefore show that cyclic denoising is both a physics-inspired probe of generative landscapes and a practical tool for memorization auditing, with implications for privacy, copyright compliance, and model fingerprinting.

Rishabh Sharma, Stefano Martiniani

Simons Center for Computational Physical Chemistry, New York University · Center for Soft Matter Research, Department of Physics, New York University · Center for Neural Science, New York University +1

Diffusion Model Sampling Memorization in Generative Models Diffusion Models

Ask PDF

May 26, 2026cs.LG

Localizing Memorized Regions in Diffusion Models via Coordinate-Wise Curvature Differences

Diffusion models can unintentionally memorize training samples, raising concerns about privacy and copyright. While recent methods can detect memorization, they often rely on global or model-specific signals and provide limited insight into where memorization appears within a generated image. We provide a geometric characterization of local memorization as a coordinate-wise variance collapse. However, such collapse can also arise from intrinsic data constraints rather than overfitting. To isolate overfitting-driven memorization, we propose curvature-difference methods that subtract the curvature of an underfitted baseline, either the unconditional model or a less-trained version of itself. We further derive a score-difference proxy that provides a geometric explanation for the widely used score-difference-based detection metric. Experiments on Stable Diffusion, evaluated against ground-truth memorization masks, show that our method outperforms the prior attention-based localization method. Code is available at https://github.com/Gwangho99/mem-curv-diff.

Gwangho Kim, Sungyoon Lee

Department of Computer Science, Hanyang University, Seoul, South Korea.

Memorization in Generative Models Diffusion Models

Ask PDF

May 21, 2026cs.CV

Broken Memories: Detecting and Mitigating Memorization in Diffusion Models with Degraded Generations

While diffusion models excel at generating high-quality images, their tendency to memorize training data poses significant privacy and copyright risks. In this work, we for the first time identify that memorization induces internal numerical instability, often manifesting as visually ``broken'' artifacts. Inspired by stability analysis in numerical methods, we introduce empirical stability regions based on latent update norms to quantitatively characterize stable behavior during generation. Leveraging this, we propose a principled, on-the-fly framework for step-wise detection and adaptive mitigation. Our approach suppresses memorization without altering prompts or guidance, thereby preserving semantic fidelity and image quality. Extensive experiments on Stable Diffusion 1.4 demonstrate that our method achieves an AUC

>0.999

detection performance and a

0.0\%

memorization rate after mitigation with negligible overhead (

\approx0.01

s per image).

Yuanmin Huang, Mi Zhang, Chen Chen +4

Fudan University Shanghai, China · East China University of Science and Technology Shanghai, China

Memorization in Generative Models Diffusion Models

Ask PDF