Diffusion models can reveal memorized images before copies

A released diffusion model may come without its training data or training history, and checking generated images for copies can miss training-specific structure that has not yet surfaced in those outputs.

Can the model itself provide an earlier signal that it has learned details tied to individual training images?

The authors pair local landscape measurements with repeated partial noising and denoising to detect training-image memorization in diffusion models.

In a CelebA model trained on 1,024 images, researchers compared training and held-out samples using normalized score divergence, a measure of whether nearby score directions point inward or outward. Their group means separated at about 65,000 optimization steps, after coinciding until about 45,000.

One-shot generation first produced a nonzero measured memorization fraction at 90,000 steps. A generated sample counted as memorized when its nearest training image was less than one-third as far away as its second-nearest training image.

Because the geometric difference appeared earlier, the result supports the idea that training-specific structure can form before generated samples meet the study’s match criterion.

These results come from small image datasets and one released Stable Diffusion checkpoint. The theory assumes an exact score for the training set and explains repeated recovery only after a trajectory is already near a training point.