Detection of Memorization in Diffusion Models Through Thermodynamic Singularity

Iljung Kim; Kangwoo Park; Yung-Kyun Noh; Daniel D. Lee

cs.LGOct 20, 2026

Detection of Memorization in Diffusion Models Through Thermodynamic Singularity

Authors: Iljung Kim, Kangwoo Park, Yung-Kyun Noh, Daniel D. Lee

Organizations: Hanyang University Seoul 04763, Rep. of Korea. · Cornell Tech New York, NY 10044, USA

Abstract

In diffusion models, proper distributional learning entails reversing a diffusion process over underlying density functions, whereas a key failure is memorization, in which the reverse process instead learns diffusion from individual training samples. We provide an analytical characterization of such memorized reverse processes, along with a criterion that detects the associated thermodynamic singularity. The proposed criterion reliably distinguishes between properly learned and memorizing networks across a range of neural network models designed to promote or mitigate memorization.

Figures & tables

Figure 1: 2D Gaussian generation. (A) The rate of Helmholtz free energy dissipation for an affine network, a small MLP, and a large MLP, plotted on a logarithmic scale over time steps. (B) K-L divergence between the generated samples and the true density as a function of training sample size. (C–E) Generated samples from the affine network, small MLP, and large MLP models, respectively. After sufficient training, the failure of the low-capacity model to capture free energy dissipation until a certain time leads to the successful reproduction of the underlying Gaussian structure.

Figure 2: CIFAR-10 pixel-space fine-tuning. (A) Catastrophic corruption. Pretrained networks are fine-tuned using a fixed subset of size $N_{s}$ . (B) Non-catastrophic corruption. Pretrained networks are fine-tuned using a fixed subset of size $N_{s}=100$ , with occasional training on additional samples from the full dataset.

Figure 3: CelebA-HQ latent-space fine-tuning. (A) Catastrophic corruption. (B) Non-catastrophic corruption with occasional training on additional samples from the full dataset.

Catastrophic Corruption			Non-Catastrophic Corruption
$N_{s}$	CIFAR-10	CelebA-HQ	$\tau$	CIFAR-10	CelebA-HQ
100	99.80%	57.71%	0	0.00%	0.00%
200	94.53%	8.01%	10	0.78%	0.00%
1,000	3.71%	0.00%	20	5.08%	0.00%
2,000	0.78%	0.00%	50	18.95%	6.35%
10,000	0.49%	0.00%	100	32.52%	25.88%

Table 1: Memorization with fine tuning. Percentage of memorized samples during fine-tuning whose nearest neighbor in the training set falls below the LPIPS threshold.

N_{s}

denotes the subset size used in catastrophic corruption, and

\tau

denotes the number of consecutive epochs for which the

N_{s}=100

subset is used during fine-tuning.

Figure 4: Generated samples from fine-tuned networks and their nearest neighbors. The first two rows show CIFAR-10 generated samples and their nearest neighbors in the training data, while the next two rows show CelebA-HQ generated samples and their nearest neighbors. We present samples obtained after catastrophic corruption with $N_{s}=100$ and $N_{s}=20{,}000$ , as well as after non-catastrophic corruption with subset training for $\tau=100$ and $\tau=10$ consecutive epochs. Ordered from least to most memorization, the settings are $N_{s}=20{,}000$ , $\tau=10$ , $\tau=100$ , and $N_{s}=100$ .

Method	Time step	AUC	TPR@1%FPR
$\left\\|\mathbf{s}_{\theta}^{\Delta}(\mathbf{x}_{t})\right\\|$	1,000	0.937 $\pm$ 0.012	0.771 $\pm$ 0.027
$=\\|\mathbf{s}_{\theta,\mathrm{cond}}-\mathbf{s}_{\theta,\mathrm{uncond}}\\|$ [ 19 ]	1	0.972 $\pm$ 0.005	0.909 $\pm$ 0.020
$\left\\|H_{\theta}^{\Delta}(\mathbf{x}_{T})\mathbf{s}_{\theta}^{\Delta}(\mathbf{x}_{T})\right\\|^{2}$ [ 7 ]	1,000	0.962 $\pm$ 0.008	0.856 $\pm$ 0.024
	1	0.970 $\pm$ 0.005	0.874 $\pm$ 0.021
$\\|\widehat{\mathbf{v}}_{\mathrm{cfg}}\\|^{2}-\\|\widehat{\mathbf{v}}_{\mathrm{uncond}}\\|^{2}$ (Ours)	1	0.982 $\pm$ 0.003	0.905 $\pm$ 0.019

Table 2: Sample-level detection on SD v1.4. The generated samples from memorizing prompts and non-memorizing prompts are discriminated by various memorization criteria. All measurements are performed on DDPM 1,000-step trajectories. Bold entries are statistically indistinguishable from the best value in each column under an approximate two-sided test. Time step 1,000 corresponds to the beginning of diffusion, and time step 1 to its end.

Condition	LPIPS $\leq 0.1$		LPIPS $\leq 0.3$		FID
Pretrained model	0.00%		0.08%		14.93
No reference scale	28.53%		33.11%		24.33
	Full velocity $\widehat{\mathbf{v}}_{t}=x_{t}+\mathbf{s}_{\theta}(x_{t},t)$ \| $\lambda=10^{-3}$			Score-only $\widehat{\mathbf{v}}_{t}=\mathbf{s}_{\theta}(x_{t},t)$ $\|\ \lambda=10^{-5}$
Condition	LPIPS $\leq 0.1$	LPIPS $\leq 0.3$	FID	LPIPS $\leq 0.1$	LPIPS $\leq 0.3$	FID
$\gamma=1.0$	31.85%	36.79%	26.19	23.14%	31.59%	22.71
$\gamma=0.8$	11.39%	28.14%	17.99	2.47%	18.01%	53.80

Table 3: CelebA-HQ fine-tuning with velocity norm suppression. Norm-suppressing penalty replaced the fine-tuning objective once the norm exceeds a threshold. Suppression is applied to

\widehat{\mathbf{v}}_{t}=x_{t}+\mathbf{s}_{\theta}(x_{t},t)

and to the score

\mathbf{s}_{\theta}(x_{t},t)

alone.

Method	SSCD $>0.7$	Count	CLIP	$\Delta$ CLIP
No mitigation	39.00%	78	0.3019	–
Wen ( $\tau=2$ ) [ 19 ]	0.00%	0	0.2917	-0.0102
Wen ( $\tau=4$ )	0.50%	1	0.2978	-0.0041
Ours ( $\gamma=0.5,\lambda=10^{-3}$ )	0.00%	0	0.2987	-0.0032

Table 4: Memorization mitigation on LAION-Aesthetics-12M-UMAP. Comparison of regularization methods on Stable Diffusion v1.4 using 200 generated samples.

\Delta

CLIP denotes the change in CLIP score relative to the unmitigated model.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 5 — Figure 5: CIFAR-10 generated examples. Top: catastrophic corruption conditions with learned subset size $N_{s}$ . Bottom: non-catastrophic corruption conditions with subset-to-full update ratio $\tau$ . Red boxes indicate that the generated samples are flagged as nearest-neighbor replication under the criterion LPIPS $\leq 0.03$ .

Panel of Figure 6 — Figure 6: CelebA-HQ generated examples. Top: catastrophic corruption conditions with learned subset size $N_{s}$ . Bottom: non-catastrophic corruption conditions with subset-to-full update ratio $\tau$ . Red boxes indicate that the generated samples are flagged as nearest-neighbor replication under the criterion LPIPS $\leq 0.1$ .

Method	Time step	AUC	TPR@1%FPR
$\left\\|\mathbf{s}_{\theta}^{\Delta}(\mathbf{x}_{t})\right\\|$	1,000	0.977 $\pm$ 0.002	0.822 $\pm$ 0.010
$=\\|\mathbf{s}_{\theta,\mathrm{cond}}-\mathbf{s}_{\theta,\mathrm{uncond}}\\|$ Wen et al. [2024]	1	0.996 $\pm$ 0.000	0.967 $\pm$ 0.002
$\left\\|H_{\theta}^{\Delta}(\mathbf{x}_{T})\mathbf{s}_{\theta}^{\Delta}(\mathbf{x}_{T})\right\\|^{2}$ Jeon et al. [2025]	1,000	0.969 $\pm$ 0.002	0.562 $\pm$ 0.028
	1	0.897 $\pm$ 0.002	0.001 $\pm$ 0.001
$\\|\widehat{\mathbf{v}}_{\mathrm{cfg}}\\|_{2}^{2}-\\|\widehat{\mathbf{v}}_{\mathrm{uncond}}\\|_{2}^{2}$ (Ours)	1	0.988 $\pm$ 0.001	0.927 $\pm$ 0.006

Appendix

Table 5: Sample-level memorization detection on Stable Diffusion 2 Base. All measurements are performed on DDPM 1,000-step trajectories. Bold entries are statistically indistinguishable from the best value in each column under an approximate two-sided test at

p=0.05

using the reported standard errors.

Memorization in Generative Models

Memorization in generative models studies when models retain training examples, how to detect their recall, and how to limit it without losing utility.

See all 88 papers

Loss Curvature as a Sampling-Free Proxy for Memorization in Diffusion Models
Oct 13, 2026Shashank Sule, Xinyue Yu, Boonam Shin +3Memorization in Generative Models Diffusion Models
Department of Mathematics, University of California, Los Angeles, CA 90095, USA. · Elmore Family School of Electrical and Computer Engineering, Purdue University, West Lafayette, IN 47907, USA.
Early Signatures of Memorization in Diffusion Models via Basin Geometry and Cyclic Denoising
Oct 8, 2026Nikhil Verma, Siddharthan Dileep, Anoop Singh +4Memorization in Generative Models Diffusion Models
Yardi School of Artificial Intelligence, Indian Institute of Technology Delhi · Department of Computer Science and Engineering, Indian Institute of Technology Delhi · Jawaharlal Nehru Centre for Advanced Scientific Research +2
Language Diffusion Models are Associative Memories Capable of Retrieving Unseen Data
Apr 29, 2026Bao Pham, Mohammed J. Zaki, Luca Ambrogioni +2Memorization in Generative Models Neural Network Memorization
1Rensselaer Polytechnic Institute (RPI) · 2Donders Institute for Brain, Cognition, and Behaviour, Radboud University · 3Dynamical Mind +1

Oct 13, 2026J/K move · Enter open · S save

Loss Curvature as a Sampling-Free Proxy for Memorization in Diffusion Models

Shashank Sule, Xinyue Yu, Boonam Shin, Yuxuan Liu+2

Department of Mathematics, University of California, Los Angeles, CA 90095, USA. · Elmore Family School of Electrical and Computer Engineering, Purdue University, West Lafayette, IN 47907, USA.

Memorization in Generative Models Diffusion Models

Open paper AskPDF arXiv

Understanding the mechanism behind why diffusion models memorize their training data remains an open question in generative modeling. In this paper, we examine this question from two perspectives: (a) the model-level perspective concerning the onset of memorization in a model during training, and (b) the sample-level perspective concerning the proclivity of an individual sample to be memorized by a given model. We show that the so-called input loss curvature, or the Frobenius norm of the Hessian of the diffusion model's training loss, is an effective metric for quantifying both perspectives on memorization. In particular, we empirically demonstrate that input curvatures averaged across training and validation samples can identify when a model is likely to start regurgitating its training data when tracked over training time. However, this metric is not sufficient for measuring an individual sample's likelihood of being memorized. To address this perspective, we introduce a counterfactual definition of memorization in diffusion models, extending the analogous notion from supervised learning proposed by [Feldman, 2019]. We prove that this counterfactual memorization is controlled by the input curvature of the leave-one-out model, thus establishing a direct theoretical link between a sample's local loss landscape and its generation likelihood. We validate our derived bounds through several empirical experiments and show that input-dependent curvature provides a proxy for memorization.

Abstract

Memorization in Generative Models

Explore similar work

Loss Curvature as a Sampling-Free Proxy for Memorization in Diffusion Models

Early Signatures of Memorization in Diffusion Models via Basin Geometry and Cyclic Denoising

Language Diffusion Models are Associative Memories Capable of Retrieving Unseen Data