cs.LGOct 8, 2026

Early Signatures of Memorization in Diffusion Models via Basin Geometry and Cyclic Denoising

Authors: Nikhil Verma, Siddharthan Dileep, Anoop Singh, Srikanth Sastry, Ramya Hebbalaguppe, Sayan Ranu, N. M. Anoop Krishnan

Organizations: Yardi School of Artificial Intelligence, Indian Institute of Technology Delhi · Department of Computer Science and Engineering, Indian Institute of Technology Delhi · Jawaharlal Nehru Centre for Advanced Scientific Research · TCS Research Labs · Department of Civil and Environmental Engineering, Indian Institute of Technology Delhi

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Diffusion models generalize early in training and later reproduce individual training samples. Standard tests detect memorization only once one-shot generation produces near-copies, leaving a released model unaudited until its outputs fail. We show that memorization is encoded in the geometry of the learned energy landscape before it appears in generated samples, a state we call latent memorization. Using score divergence and basin volume, we find that localized basins form around training samples and separate them from held-out samples before the first memorized sample appears, with an onset that follows the same O(n)O(n) scaling as the memorization time. We probe these basins with cyclic denoising, which repeatedly applies partial noising and denoising. Under the exact empirical score, we prove that cycling started near an isolated training sample recovers it and returns to it over any finite number of cycles with high probability. In trained models, cycling recovers training images from CelebA and CIFAR-10 checkpoints whose one-shot samples contain no copies, and at a CelebA checkpoint with 0.1% one-shot copies, 500 cycles raise the memorized fraction above 30%. Cycling also reveals degenerate attractors that match no single training image and fade as training proceeds, so residence in a basin does not by itself imply memorization. These findings hold on a Gaussian mixture, CelebA, and CIFAR-10 across optimizers, architectures, noise schedules, and training-set sizes, and extend to off-the-shelf Stable Diffusion v1.4, where the cycled conditional-unconditional divergence gap separates memorized from non-memorized prompts with an AUC of 0.944 and a TPR of 0.866 at 1% FPR. More broadly, what a diffusion model has memorized is a property of the geometry and stability of its learned distribution, and assessing it requires examining this structure rather than generated outputs alone.

Figures & tables

Figure 1: Memorization forms sharp, localized basins in the learned score field. ( A,B ) Normalized score divergence A^1\widehat{\mathcal{A}}_{1} for an eight-dimensional Gaussian mixture model (GMM), on a two-dimensional slice of the sample space obtained with the projection of Bihani et al. (2024) (App. G.6 ). ( A ) In the generalized regime, the field is smooth, with no prominent structure around training samples. ( B ) As memorization emerges, strongly negative regions form around training samples. ( C ) Schematic of cyclic denoising: at low noise, trajectories remain within a basin, whereas at sufficiently large noise they jump to neighbouring basins.
Figure 2: Geometric signatures across training on CelebA. ( A ) Training loss (solid), held-out loss (dashed), and FID (dotted, right axis) for n=1024n=1024 . ( B ) A^1\widehat{\mathcal{A}}_{1} at γ=0.001\gamma=0.001 and fmemf_{\mathrm{mem}} (dotted, right axis) for n=512n=512 (orange), 10241024 (blue), and 20482048 (green); training (solid), held-out (dashed), and generated (dash-dot) samples. Inset: divergence against τ/n\tau/n . ( C ) Mean log basin volume for n=1024n=1024 over all training samples and an equal number of generated and held-out samples, with line styles as in (B); bands show one standard deviation across samples. Refer Appendix G for equivalent results on Adam Optimizer
Figure 3: Cyclic denoising exposes latent memorization inside the generalization window. CelebA ( n=4096n=4096 , Adam; A–C ) and CIFAR-10 ( n=8192n=8192 ; D–F ) at checkpoints from τgen\tau_{\mathrm{gen}} to τmem\tau_{\mathrm{mem}} . ( A,D ) Generated samples at c0c_{0} and c500c_{500} ( γ=0.10\gamma=0.10 ) with their nearest training images. ( B,E ) fmemf_{\mathrm{mem}} and ( C,F ) Scyc(k)S_{\mathrm{cyc}}^{(k)} across cycles for several γ\gamma .
Figure 4: Cyclic denoising reveals degenerate attractors. CIFAR-10 ( n=8192n=8192 , γ=0.05\gamma=0.05 ) at τgen=49,500\tau_{\mathrm{gen}}=49{,}500 ( A–C ) and τ=83,000\tau=83{,}000 ( D–F ). ( A,D ) Three trajectories from c0c_{0} to c500c_{500} with the nearest training image to the final state; no attractor matches a single training image. ( B,E ) A1\mathcal{A}_{1} and ( C,F ) Scyc(k)S_{\mathrm{cyc}}^{(k)} across cycles. Markers show the residence onset, which does not indicate memorization.
Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

NotationMeaningNotationMeaning
Diffusion model
x0x_{0}Clean data sample.xtx_{t}Noisy sample at diffusion timestep tt .
ttDiffusion timestep.TTTotal number of diffusion timesteps.
βt\beta_{t}Forward-process variance schedule.αt=1−βt\alpha_{t}=1-\beta_{t}Signal-retention coefficient.
αˉt=∏s=1tαs\bar{\alpha}_{t}=\prod_{s=1}^{t}\alpha_{s}Cumulative signal-retention coefficient.ϵ∼N(0,I)\epsilon\sim\mathcal{N}(0,I)Gaussian noise in the forward process.
ϵθ(xt,t)\epsilon_{\theta}(x_{t},t)Network prediction of injected noise.q(xt∣x0)q(x_{t}\mid x_{0})Forward diffusion distribution.
Appendix
Table 1: Notation used throughout the paper.
Figure 5: Comparison of the noise standard deviation ( σt=1−αˉt\sigma_{t}=\sqrt{1-\bar{\alpha}_{t}} ) versus the normalized timestep ( γ=t/T\gamma=t/T ) for linear and cosine noise schedulers. The cosine scheduler maintains lower noise magnitude for a significantly broader range of timesteps.
Figure 6: Geometric signatures across training on the GMM. (A) Train loss (solid) and test loss (dashed) at γ=0.01\gamma=0.01 on the left axis, and DKL(Pθ∥P0)D_{\mathrm{KL}}(P_{\theta}\|P_{0}) (dotted, log scale) on the right axis, versus training step τ\tau , for n=2048n=2048 . (B) Mean normalized score divergence A^1\widehat{\mathcal{A}}_{1} on the left axis and fmemf_{\mathrm{mem}} (dotted) on the right axis, versus τ\tau . Line style denotes the sample group: train (solid), test (dashed), generated (dash-dot). Colour denotes the training-set size: n=1024n=1024 (orange), n=2048n=2048 (blue), n=4096n=4096 (green). Inset: the same divergence curves against τ/n\tau/n . (C) Mean log basin volume versus τ\tau for n=2048n=2048 , with the line styles of (B); bands show one standard deviation across samples.
Figure 7: Cyclic denoising on the GMM across training. GMM, n=512n=512 . Columns are checkpoints of increasing τ\tau , with their one-shot fmemf_{\mathrm{mem}} . Each panel shows 512512 trajectories per amplitude, coloured by γ\gamma ( 0.001≤γ≤0.350.001\leq\gamma\leq 0.35 ). (A) fmemf_{\mathrm{mem}} versus cycle for trajectories started from generated samples. (B) Mean cosine similarity between each state and its starting sample, computed on the raw 88 -dimensional vectors, for the same trajectories. (C, D) The same quantities for trajectories started from the training points. Cycling raises fmemf_{\mathrm{mem}} above its one-shot value at small γ\gamma once basins have formed, while at τ=42,107\tau=42{,}107 even training points are not retained.
Figure 8: Cyclic-denoising trajectories on the GMM score-divergence landscape. GMM, n=512n=512 . Rows are checkpoints of increasing τ\tau , with their one-shot fmemf_{\mathrm{mem}} ; columns are cycling amplitudes γ\gamma . The background is the exact score divergence A1\mathcal{A}_{1} of the learned score on a two-dimensional plane spanned by the direction joining the two component means and the leading orthogonal principal direction of the training data; red marks negative (contracting) values. Each row has its own colour scale, since the range grows from about ±60\pm 60 to ±6,000\pm 6{,}000 during training. The magenta path joins the projected states of one trajectory every 55 cycles over 200200 cycles, from the start (green dot) to the end (yellow triangle). Because states are projected onto the plane, the path shows direction of motion rather than exact position on the background.
Figure 9: Saturated geometric degeneration on CIFAR-10. τ=49,500\tau=49{,}500 , γ=0.05\gamma=0.05 ; fmemgen=0%f_{\mathrm{mem}}^{\mathrm{gen}}=0\% and full-cohort fmemCD(500)=0%f_{\mathrm{mem}}^{\mathrm{CD}}(500)=0\% . Repeated CD replaces recognizable content with saturated bands and colour blocks. The final column shows the nearest training image to c500.
Figure 10: Fading structure on CIFAR-10. τ=83,000\tau=83{,}000 , γ=0.05\gamma=0.05 ; fmemgen=0%f_{\mathrm{mem}}^{\mathrm{gen}}=0\% and full-cohort fmemCD(500)=3.1921%f_{\mathrm{mem}}^{\mathrm{CD}}(500)=3.1921\% . Six appearance-selected trajectories lose semantic structure and approach nearly monochromatic blue configurations.
Figure 11: Stripe-like and monochromatic degeneration on CIFAR-10. τ=49,500\tau=49{,}500 , γ=0.05\gamma=0.05 ; fmemgen=0%f_{\mathrm{mem}}^{\mathrm{gen}}=0\% and full-cohort fmemCD(500)=0%f_{\mathrm{mem}}^{\mathrm{CD}}(500)=0\% . Trajectories develop repeated spatial bands or nearly monochromatic fields.
Figure 12: CelebA CD trajectories across training checkpoints, γ=0.05\gamma=0.05 . Top, middle and bottom pairs correspond to τ=5,200\tau=5{,}200 , 10,00010{,}000 and 20,00020{,}000 , respectively. Their logged fmemgenf_{\mathrm{mem}}^{\mathrm{gen}} values are 0%0\% , 0%0\% and 0.1308%0.1308\% ; full-cohort fmemCD(500)f_{\mathrm{mem}}^{\mathrm{CD}}(500) values are 0%0\% , 9.8%9.8\% and 21.12%21.12\% . At τ=5200\tau=5200 the images move towards mere monochromatic darkness and remain stable there. For τ=10000\tau=10000 and τ=20000\tau=20000 more facial structure emerges for these non memorized basins.
Figure 13: Cyclic denoising from training samples. Memorization fraction fmemf_{\mathrm{mem}} across 500 cycles for trajectories initialized from training images in (A) CelebA ( n=4096n=4096 , Adam, linear noise schedule) and (B) CIFAR-10 ( n=8192n=8192 , Adam, cosine noise schedule). Although fmemf_{\mathrm{mem}} starts at 100%100\% , it drops sharply under cycling. At τgen\tau_{\mathrm{gen}} , it remains near zero, whereas later checkpoints retain or recover a larger fraction, depending on γ\gamma . Classification is against the full training set and does not require returning to the initial training image. Shaded bands combine the reported bootstrap standard errors with variation within each cycle bin. The memory of the initial train samples can be lost under cycling, basin residence only remains in a subset of train samples that become attractors(subject to cycling amplitude). Cycling moves trajectories to other stronger attractor basins.
Figure 14: Trajectories discover and reside in basins corresponding to training samples. ( A ) CelebA trajectories ( n=4096n=4096 , Adam, γ=0.10\gamma=0.10 ) from c0c_{0} to c500c_{500} , with the nearest training image to each final state. The marked onset is the first cycle at which a trajectory satisfies the fmemf_{\mathrm{mem}} criterion and remains classified as memorized for the rest of the run. ( B ) Score divergence A1\mathcal{A}_{1} decreases as the trajectories approach these states; the decline can begin before the marked onset. ( C ) Consecutive-state LPIPS cosine similarity Scyc(k)S_{\mathrm{cyc}}^{(k)} increases and reaches a high plateau, consistent with residence after the approach. ( D–F ) The corresponding CIFAR-10 trajectories ( n=8192n=8192 , Adam, γ=0.05\gamma=0.05 ) and measurements. Colors identify trajectories across panels. Dotted lines and markers show their onsets. Divergence and similarity are displayed with a centered 50-cycle moving average. Annotations above A and D give the training step τ\tau , one-shot fmemf_{\mathrm{mem}} , and FID.
Figure 15: Basin residence and jumping under repeated cycling at τ=40,000\tau=40{,}000 (run: CelebA32, UNet, n=4096n=4096 , Adam). Both sets begin in the basin associated with the same memorised training example. At γ=0.1\gamma=0.1 (top), trajectories remain in this basin. At γ=0.2\gamma=0.2 (bottom), stronger perturbations induce basin jumping, followed by sustained residence in another attractor, consistent with greater stability under cycling.
Figure 16: Distribution of the membership score (the sign-flipped normalized score divergence A^1\widehat{\mathcal{A}}_{1} ) for training (blue), held-out test (red), and generated (green) samples, at increasing training steps τ\tau (left to right), for GMM (top row) and CelebA (bottom row). The three distributions overlap in the generalized regime and separate—with training and generated moving together, away from test—as the model memorizes.
τ\tauAUCTPRFPRTPR@1%FPR
60,0000.5220.8750.8350.035
115,0000.8870.9100.3250.315
200,0001.0000.9250.0000.995
430,0001.0000.9800.0001.000
Appendix
Table 2: Membership inference from the normalized score divergence A^1\widehat{\mathcal{A}}_{1} at a single noise level, on CelebA , without any access to training labels. AUC is threshold-free. TPR and FPR are reported at a moderate 5%5\% false-positive budget; TPR@ 1%1\% FPR is the true-positive rate at a strict 1%1\% budget. All operating points are read directly off the ROC curve.
τ\tauAUCTPRFPRTPR@1%FPR
4,7500.5310.0660.0470.012
42,1070.5100.0470.0450.012
97,4660.9090.6070.0490.490
315,6041.0001.0000.0001.000
Appendix
Table 3: Membership inference from the normalized score divergence A^1\widehat{\mathcal{A}}_{1} at a single noise level, on the GMM . Conventions are identical to Table 2 .
Figure 17: CelebA width-64 U-Net trained with Adam, number of training samples - n=512,1024,2048,4096n=512,1024,2048,4096 . A: FID and memorization fraction, fmemf_{\mathrm{mem}} , versus training step τ\tau . B: The normalized score divergence A^1\hat{\mathcal{A}}_{1} for train and held-out test samples versus τ\tau ; bands show ±1 standard deviation across samples. Consistent lag between train-test A^1\hat{\mathcal{A}}_{1} split and onset of fmemf_{mem} C: The same A^1\hat{\mathcal{A}}_{1} curves and fmemf_{\mathrm{mem}} versus normalized training steps τ/n\tau/n . D: For the n=4096n=4096 run, mean log basin-volume proxy for training and test images versus τ\tau , with ±1 standard deviation.
Figure 18: FID and memorization ratio of CIFAR-10 DiT-S runs with Adam optimizer and Cosine Noise Scheduler with n=2048, 4096,8192.
Figure 19: Visualised for the GMM dataset - As γ\gamma decreases from left to right, the two-basin structure sharpens from a single merged attractor into two well-separated basins. The generalization window (row 2) already shows some sign of attractor formation, but this sharpening becomes more pronounced and localized only in the memorized regime (row 3), compared to the generalized regime (row 1) – directly quantifying its effect on the cyclic denoising dynamics.
Figure 20: Normalized score divergence versus noise amplitude γ\gamma across all training checkpoints , for CelebA (a) and the GMM (b) . Each curve is one checkpoint, coloured by training regime: blue for the generalized regime and orange for the memorized regime, with lighter to darker shades as the training step τ\tau increases within each regime. Line style distinguishes train, test, and generated samples. In the generalized regime (blue) the curves are shallow and cluster together across all γ\gamma . In the memorized regime (orange) the normalized divergence is strongly negative at small γ\gamma and rises toward zero as γ\gamma increases, with the effect deepening as τ\tau grows.
rowpromptidxγ\gammaseed
hippoMothers influence on her young hippo12620.92
laurainsights with laura unknown670.12
laurainsights with laura unknown670.92
air-conair conditioners set for2150.91
air-conair conditioners set for2150.90
label tapeset of nine brother tze 231 offlight white p-touch label6620.92
Appendix
Table 4: The six chains of Fig. 21 A, verbatim. idx is the row index in the MemBench SD v1.4 prompt table ( Hong et al., 2024 ) , which also supplies the matched training image. The two laura rows share a prompt, and seed differing only in γ\gamma ; the two air-con rows share a prompt and γ\gamma and differ only in seed.
Figure 21: Cyclic denoising on off-the-shelf Stable Diffusion v1.4. Each cycle noises to amplitude γ\gamma and denoises back; ckc_{k} denotes the sample after kk cycles. (A) Six chains, one per row, with the matched LAION training image in the train column; each row label gives the prompt, the setting that varies, and the cycle at which the chain reaches its training image. The two laura rows share a prompt, a seed and a c0c_{0} image and differ only in γ\gamma ; the air-con s1 row leaves its basin and re-enters it. (B,C) The same six chains per cycle: SSCD to the training image and ΔA1\Delta\mathcal{A}_{1} , on a shared axis. (D) ΔA1\Delta\mathcal{A}_{1} after 200200 cycles against γ\gamma , over 7171 completely memorised, 150150 partially memorised and 113113 non-memorised prompts ( Webster, 2023 ) and 150150 plain-English prompts ( Hong et al., 2024 ) . (E) Population means at γ=0.1\gamma=0.1 over the 7171 completely memorised and 113113 non-memorised prompts, 44 seeds each: seed agreement (solid, left) and ΔA1\Delta\mathcal{A}_{1} (dashed, right); bands are ±\pm SEM over prompts.
cycleAUC (95% CI)TPR@1%FPR (95% CI)
00.811 [0.787, 0.836]0.526 [0.482, 0.572]
100.890 [0.864, 0.914]0.804 [0.766, 0.838]
200.935 [0.916, 0.953]0.834 [0.804, 0.872]
400.931 [0.910, 0.950]0.858 [0.824, 0.892]
600.944 [0.926, 0.961]0.866 [0.830, 0.900]
800.934 [0.914, 0.953]0.856 [0.820, 0.888]
Appendix
Table 5: ΔA\Delta A at γ=0.9\gamma=0.9 . Paired difference between c=60c=60 and c=40c=40 : +0.016+0.016 , 95% CI [−0.010,+0.041][-0.010,+0.041] .
Figure 22: AUC and TPR@1%FPR against cycle count, with bootstrap bands.
statisticAUC (95% CI)TPR@1%FPR (95% CI)AP
ΔA\Delta A (ours)0.944 [0.926, 0.961]0.866 [0.830, 0.900]0.933
AcondA_{\mathrm{cond}} alone0.948 [0.939, 0.957]0.194 [0.142, 0.246]0.782
AuncondA_{\mathrm{uncond}} alone0.899 [0.884, 0.914]0.066 [0.030, 0.094]0.623
Wen SDN (single shot)0.990 [0.986, 0.993]0.838 [0.786, 0.882]0.970
Appendix
Table 6: At c=60c=60 , γ=0.9\gamma=0.9 . Paired differences, ΔA\Delta A minus SDN: AUC −0.0456-0.0456 , 95% CI [−0.0633,−0.0287][-0.0633,-0.0287] ; TPR@1%FPR +0.0265+0.0265 , 95% CI [−0.0260,+0.0841][-0.0260,+0.0841] .
Figure 23: ROC (left) and precision–recall (right) at c=60c=60 . Class balance is 1:4; the dotted line in the right panel marks the positive rate.
Figure 24: Raw ΔA\Delta A against cycle, population means with 95% intervals. Memorised prompts move from −1.24×105-1.24\times 10^{5} at c=0c=0 to −3.12×105-3.12\times 10^{5} at c=60c=60 ; non-memorised prompts remain within 0.03×1050.03\times 10^{5} of zero.
  ΔA\Delta A , c=60c=60Wen SDN, single shot
negativesnnAUCTPR@1%FPRAUCTPR@1%FPR
laion5000.9420.8200.9670.740
coco5000.9450.8840.9960.950
lexica5000.9450.8920.9970.976
random5000.9440.8761.0000.998
Appendix
Table 7: Each row scores the 500 positives against one negative source.

Explore similar work

CardsList

  1. Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models

    Jun 22, 2026Rishabh Sharma, Stefano MartinianiDiffusion Model SamplingMemorization in Generative Models

    Simons Center for Computational Physical Chemistry, New York University · Center for Soft Matter Research, Department of Physics, New York University · Center for Neural Science, New York University +1

  2. Localizing Memorized Regions in Diffusion Models via Coordinate-Wise Curvature Differences

    May 26, 2026Gwangho Kim, Sungyoon LeeMemorization in Generative ModelsDiffusion Models

    Department of Computer Science, Hanyang University, Seoul, South Korea.

  3. Broken Memories: Detecting and Mitigating Memorization in Diffusion Models with Degraded Generations

    May 21, 2026Yuanmin Huang, Mi Zhang, Chen Chen +4Memorization in Generative ModelsDiffusion Models

    Fudan University Shanghai, China · East China University of Science and Technology Shanghai, China