Detecting and Mitigating Memorization in Diffusion Models through Anisotropy of the Log-Probability

AI summary

Overview

Research area: Machine learning, specifically diffusion-based image generative models, data privacy and training-data memorization.

Technical level: Advanced. The paper relies on score-based diffusion theory, Hessian curvature analysis, and classifier-free guidance, though the central intuition (direction versus magnitude of score vectors) is explained geometrically.

Scope: The paper proposes a denoising-free memorization detection metric for text-to-image diffusion models by combining isotropic norm information from the high-noise regime with anisotropic angular alignment information from the low-noise regime, and applies it to inference-time mitigation.

What This Paper Is About

Diffusion models can reproduce exact or near-exact copies of training images when prompted in certain ways, a problem known as memorization. Existing detection methods mostly measure the norm of the difference between conditional and unconditional score estimates, which the authors show works well only when the log-probability is isotropic (roughly equal curvature in all directions, as in high or mid noise). This paper proves that norm-based metrics degrade in the anisotropic low-noise regime and proposes a new metric that also captures angular alignment between score vectors, allowing detection with only two forward passes on pure noise.

Key Contributions

1. A theoretical diagnosis of norm-based metrics. The authors show that norm-based memorization detection is mainly effective under an isotropic log-probability assumption. They derive the score and its norm for both an isotropic Gaussian case (where the norm depends only on variance and distance from the mean) and an anisotropic case (where the norm depends on direction as well), demonstrating that a high norm in one direction can be compensated by a low norm in another, producing false negatives.

2. Identification of angular alignment as a memorization signature. A theorem provides a lower bound, cos(s_θ(x_t,t), s_θ^Δ(x_t,t,c)) ≥ (1−r)/(1+r) with r := ε + τ < 1, on the cosine similarity between the unconditional score and the conditioning term in the anisotropic low-noise regime. The bound tightens when the relative displacement δ between the guidance mode and the unconditional mode is small, which the authors argue is characteristic of memorized cases.

3. A denoising-free detection metric. The proposed metric M(x_T, c) is a weighted sum (weights γ₁ and γ₂) of the cosine similarity between the conditioning term and the unconditional score at t ≈ 0 (anisotropy) and the norm of the score difference at t ≈ T (isotropy). It is computed on pure noise inputs x_T ~ N(0, I) via two conditional and unconditional forward passes, without any denoising trajectory.

4. An inference-time mitigation scheme. Using the metric as a loss, the authors optimize text prompt embeddings by gradient descent to obtain c⋆, then generate with that augmented embedding.

Main Findings

• Anisotropy emerges in low noise. Analysis of the variance of Hessian eigenvalues during denoising in a pre-trained Stable Diffusion model shows minimal variance when t is large (high noise) but larger variance when t is close to 0, indicating a shift toward anisotropy in the low-noise regime.

• Norm-based metrics lose discriminative power in anisotropy. Histograms and KDE curves of Wen et al.'s metric show less overlap between memorized and non-memorized distributions in isotropy, with KL divergence of 0.166, versus more overlap in anisotropy with KL divergence of 0.022.

• Memorized samples show stronger angular alignment. Visual comparison of gradient directions and cosine similarity heatmaps (Stable Diffusion v1.4) shows memorized samples with more highly aligned vectors and generally higher cosine similarity than non-memorized samples.

• Detection performance on SD v1.4 (n = 1): the proposed metric reaches AUC 0.994 ± 0.001 and TPR@1%FPR 0.935 ± 0.002 in 1.10 seconds per 10 prompts, versus Jeon et al. (2025) at AUC 0.987, TPR@1%FPR 0.908, 5.40 seconds; Wen et al. (2024) at 0.976 / 0.896 / 0.40; and Ren et al. (2024) at 0.846 / 0.116 / 0.05.

• Detection performance on SD v1.4 (n = 4): the proposed metric reaches AUC 0.999 ± 0.001 and TPR@1%FPR 0.984 ± 0.002 in 3.40 seconds, versus Jeon et al. at 0.998 / 0.982 / 19.40; Wen et al. at 0.992 / 0.944 / 1.20; and Ren et al. at 0.839 / 0.130 / 0.05.

• Detection performance on SD v2.0 (n = 1): the proposed metric reaches AUC 0.953 ± 0.016 and TPR@1%FPR 0.791 ± 0.015 in 2.20 seconds, versus Jeon et al. at 0.959 / 0.740 / 14.60; Wen et al. at 0.948 / 0.739 / 0.80; and Ren et al. at 0.848 / 0 / 0.07.

• Detection performance on SD v2.0 (n = 4): the proposed metric reaches AUC 0.981 ± 0.003 and TPR@1%FPR 0.890 ± 0.009 in 7.30 seconds, versus Jeon et al. at 0.991 / 0.895 / 56.40; Wen et al. at 0.980 / 0.876 / 2.70; and Ren et al. at 0.853 / 0 / 0.07.

• Speed. The method is reported as at least approximately 5x faster than the previous best approach. Specific speedups over Jeon et al. (2025) are 4.91x (n = 1) and 5.71x (n = 4) on SD v1.4, and 6.63x (n = 1) and 7.73x (n = 4) on SD v2.0, attributed to avoiding Hessian computation.

• Trade-off on SD v2.0. Jeon et al. (2025) attains slightly higher AUC on SD v2.0 (0.959 versus 0.953 at n = 1; 0.991 versus 0.981 at n = 4), while the proposed method improves TPR@1%FPR by 5.1% in the n = 1 case.

• Mitigation. Experiments on the MemBench benchmark (Hong et al., 2025) are reported to produce generations highly dissimilar to the memorized training sample while maintaining strong text-image alignment and high aesthetic quality. The paper text truncates before the full mitigation numbers are shown.

Methodology in Plain English

The authors begin with a geometric argument. A diffusion model's score function points in the direction of increasing probability density, and its magnitude reflects how sharp the density is. Previous detection methods essentially measure that magnitude — the length of the difference between the conditional and unconditional score vectors — as a proxy for how sharply the model is being guided toward a specific image. The authors reason that this only works when the probability landscape is equally sharp in every direction, which is true at high noise levels but not at low ones.

To test this, they inspect the Hessian (the matrix of second derivatives) of the conditional log-probability at each timestep and measure how spread out its eigenvalues are. Low spread means isotropy; high spread means anisotropy. They find the spread grows as the timestep approaches zero, confirming that the low-noise regime is anisotropic.

They then derive the score for a simple isotropic Gaussian and for an anisotropic Gaussian. In the isotropic case the norm depends only on variance and distance from the mean; in the anisotropic case it also depends on direction, so a large value in one direction can be cancelled by a small value in another. This explains why norm-based detection can miss memorized samples at low noise.

Next, they prove a theorem showing that under stated error bounds, the cosine similarity between the unconditional score and the conditioning term is bounded below by (1−r)/(1+r), where r is the sum of two error terms; when the guidance mode and unconditional mode nearly coincide (as expected for memorized samples), the bound approaches 1 minus a small error. They verify this empirically with gradient direction plots and cosine similarity heatmaps on Stable Diffusion v1.4.

The final metric is a weighted sum of two quantities, both computed on the same pure-noise sample without any denoising: cosine similarity at t ≈ 0 and score-difference norm at t ≈ T. For mitigation, this metric becomes the loss used to optimize prompt embeddings via gradient descent, and the resulting embedding is used to generate non-memorized images.

Why This Matters

Impact on research. The paper reframes memorization detection from a purely magnitude-based problem to a directional one, and supplies a formal argument for when existing methods fail. It also shows that detection can be decoupled from the expensive denoising (and Hessian) computations that limit prior approaches, potentially changing how benchmarks report detection cost.

Real-world applications.

• Copyright and provenance auditing for text-to-image services, where operators need to check prompts against a suspect training set without running full generations.
• Dataset licensing and due diligence, allowing model providers to screen for memorized prompts before or after deployment.
• Privacy compliance workflows where regulators or auditors need an efficient test for whether a model regurgitates training images.
• Content moderation pipelines that flag generations that may be near-duplicates of known training data.

Industry relevance. The metric requires only two forward passes on noise, which is cheap relative to generation itself and therefore easier to integrate into serving infrastructure. The inference-time mitigation scheme operates on prompt embeddings, which means it can be applied without retraining the model.

Future Directions

• Extending to image-level memorization. The authors explicitly note image-level memorization detection (Jiang et al., 2025), where only generated images are available and the trajectory sits near the data manifold, as a setting where anisotropic metrics should be preferable. This remains to be demonstrated.
• Full mitigation benchmarking. The truncated content does not report the complete MemBench mitigation results, leaving open how the prompt-augmentation scheme compares quantitatively to prior mitigation methods on text-image alignment and aesthetic quality.
• Relation to higher-order criteria. The authors position Brokman et al. (2025), a curvature-based criterion tracking curvature evolution across the trajectory, as a higher-order extension of their first-order angular alignment framework, suggesting a natural comparison or combination.
• Generalization beyond Stable Diffusion. Detection is evaluated on Stable Diffusion v1.4 and v2.0 with additional experiments on Realistic Vision (CivitAI, 2023) in Appendix A.6; whether the metric transfers to other architectures is not established in the main text.

Target Audience

Researchers working on diffusion model privacy, memorization and data extraction, and generative model safety; practitioners who need efficient memorization auditing for deployed text-to-image systems; and readers with a background in score-based generative modeling who want a geometric account of why norm-based detection fails in low noise.

Authors’ abstract

Diffusion-based image generative models produce high-fidelity images through iterative denoising but remain vulnerable to memorization, where they unintentionally reproduce exact copies or parts of training images. Recent memorization detection methods are primarily based on the norm of score difference as indicators of memorization. We prove that such norm-based metrics are mainly effective under the assumption of isotropic log-probability distributions, which generally holds at high or medium noise levels. In contrast, analyzing the anisotropic regime reveals that memorized samples exhibit strong angular alignment between the guidance vector and unconditional scores in the low-noise setting. Through these insights, we develop a memorization detection metric by integrating isotropic norm and anisotropic alignment. Our detection metric can be computed directly on pure noise inputs via two conditional and unconditional forward passes, eliminating the need for costly denoising steps. Detection experiments on Stable Diffusion v1.4 and v2 show that our metric outperforms existing denoising-free detection methods while being at least approximately 5x faster than the previous best approach. Finally, we demonstrate the effectiveness of our approach by utilizing a mitigation strategy that adapts memorized prompts based on our developed metric. The code is available at https://github.com/rohanasthana/memorization-anisotropy .