Detecting and Mitigating Memorization in Diffusion Models through Anisotropy of the Log-Probability
Rohan Asthana, Vasileios Belagiannis
TL;DR
This paper introduces a novel detection metric for memorization in diffusion models based on anisotropy analysis of log-probability, which outperforms existing methods and enables effective mitigation strategies.
Contribution
We develop a new memorization detection metric leveraging anisotropic properties of log-probability distributions, improving detection accuracy and speed without requiring denoising.
Findings
Our metric outperforms existing detection methods on Stable Diffusion models.
Detection is at least 5 times faster than previous approaches.
Mitigation using the metric effectively reduces memorization in generated images.
Abstract
Diffusion-based image generative models produce high-fidelity images through iterative denoising but remain vulnerable to memorization, where they unintentionally reproduce exact copies or parts of training images. Recent memorization detection methods are primarily based on the norm of score difference as indicators of memorization. We prove that such norm-based metrics are mainly effective under the assumption of isotropic log-probability distributions, which generally holds at high or medium noise levels. In contrast, analyzing the anisotropic regime reveals that memorized samples exhibit strong angular alignment between the guidance vector and unconditional scores in the low-noise setting. Through these insights, we develop a memorization detection metric by integrating isotropic norm and anisotropic alignment. Our detection metric can be computed directly on pure noise inputs via…
Peer Reviews
Decision·ICLR 2026 Poster
1. The paper is well-organized, making it easy to follow. The visualizations clearly illustrate the messages and insights it wishes to deliver. 2. This paper contributes to privacy-preserving text-to-image diffusion models, which are practically significant for preventing copyright risks. 3. The proposed metric’s efficiency (denoising-free and fast) makes it appealing for large-scale model auditing. 4. The paper introduces a new theoretical and empirical perspective on diffusion model memorizat
1. The paper could benefit from additional discussion on whether the proposed metric generalizes across architectures beyond SD v1.4/v2.0. 2. Although Appendix A.4 shows some robustness, the weights are empirically tuned per model, suggesting potential calibration issues when scaling to new settings. 3. The proposed cosine-similarity measure is intuitive but may be sensitive to normalization choices. A sensitivity analysis on score normalization or noise schedule parameters would strengthen the
1. Sound theoretical framing. The analysis clearly connects memorization signatures to the isotropy and anisotropy regimes of the log-probability, filling a conceptual gap in prior isotropic norm-based methods. 2. Efficient and simple metric. The proposed anisotropy-aware score is computationally cheap (two model steps, no actual denoising) yet achieves higher detection accuracy. 3. The method is not limited to detection, it also demonstrates practical mitigation by optimizing prompt embeddings,
1. The reported “speed-up” is only shown relative to one denoising-free baseline, while simpler existing methods remain faster with no meaningful loss in performance, limiting the practical efficiency benefit of the proposed approach. 2. Incremental improvement weakness: AUC/TPR gains are marginal because prior methods already near saturation, making the contribution incremental rather than substantively advancing the state of the art, even if the method itself is technically sound. 3. No code t
• The identification of anisotropy as a key factor in memorization detection is conceptually strong and empirically supported (variance of Hessian eigenvalues increasing toward low noise). • The method is denoising-free, computationally efficient, and integrates both magnitude and directional cues. • Experiments follow prior evaluation standards and report competitive or superior results. Using new designated bencharks such as MemBench is also a bonus.
• The section titled “Failure of Norm-Based Methods in Anisotropy” starts with “We now prove…” However it does not constitute a formal proof. Rephrase to “demonstrate” or “show analytically” or similar. • In Table 1, please report standard deviations or confidence intervals. With 500 prompts, small improvements (such as the +0.001 AUC over Jeon et al. at n = 4, SD v1.4) may fall within statistical noise. • Fig. 3 (a), (b) should be key visualizations supporting the main hypothesis - howev
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsGenerative Adversarial Networks and Image Synthesis · Digital Media Forensic Detection · Cell Image Analysis Techniques