MemBench: Memorized Image Trigger Prompt Dataset for Diffusion Models

## Abstract

Abstract Diffusion models have achieved remarkable success in Text-to-Image generation tasks, leading to the development of many commercial models. However, recent studies have reported that diffusion models often generate replicated images in train data when triggered by specific prompts, potentially raising social issues ranging from copyright to privacy concerns.
To sidestep the memorization, there have been recent studies for developing memorization mitigation methods for diffusion models.
Nevertheless, the lack of benchmarks impedes the assessment of the true effectiveness of these methods.
In this work, we present MemBench, the first benchmark for evaluating image memorization mitigation methods. Our benchmark includes a large number of memorized image trigger prompts in various Text-to-Image diffusion models. Furthermore, in contrast to the prior work evaluating mitigation performance only on trigger prompts, we present metrics evaluating on both trigger prompts and general prompts, so that we can see whether mitigation methods address the memorization issue while maintaining performance for general prompts. This is an important development considering the practical applications which previous works have overlooked.
Through evaluation on MemBench, we verify that the performance of existing image memorization mitigation methods is still insufficient for application to diffusion models. The code and datasets are available at https://github.com/chunsanHong/MemBench_code

## 1 Introduction

Text-to-Image (T2I) generation has shown significant advancements and successes with the advance of diffusion models, such as Stable Diffusion (Rombach et al., ).
Compared to previous generative models, diffusion models excel in generating diverse and high quality images from user-desired text prompts, which has led to the vast release of commercial models such as MidJourney. However, recent studies (Somepalli et al., ; ; Carlini et al., ) have revealed that certain text prompts tend to keep replicating
images in the train dataset
which can cause serious privacy issues. This issue has already triggered controversy
in the real world: specific prompts containing the term “Afghan” have been known to reproduce copyrighted images of the Afghan girl when using MidJourney (Wen et al., ). One of the major issues with such prompts is that, regardless of initial random noise leveraged in the reverse process of the diffusion model, they always invoke almost or exactly same memorized images (Wen et al., ; Carlini et al., ; Webster, ).

To address this matter,
Wen et al. () and Somepalli et al. () have proposed
mitigation methods to prevent the regeneration of identical images in the train dataset
invoked from certain text prompts.
However, the evaluation of these memorization mitigation methods has lacked rigor and comprehensiveness
due to the absence of benchmarks.
As an adhoc assessment method,
the current studies (Wen et al., ; Somepalli et al., ) have adopted the following method:
1) simulating memorization by fine-tuning T2I diffusion models for overfitting on a separate small and specific dataset of {image, prompt} pairs,
and 2) assess whether the images used in the fine-tuning are reproduced from the query prompts. However, it remains unclear whether
such evaluation results can be extended to practical scenarios with the pre-trained existing diffusion models and represent the effectiveness for resolving memorization.

In this work, we present MemBench, the first benchmark for evaluating image memorization mitigation methods for diffusion models. Our MemBench includes the following key features to ensure effective evaluation: (1) MemBench provides a sufficient number of memorized image trigger prompts, with 3000 and 1500 prompts for Stable Diffusion 1 and 2, most popular open-source models, respectively. Previous work (Webster, ) has offered the highest number of prompts at 345 and 218 for Stable Diffusion 1 and 2, respectively; however, we increase the number of prompts to enhance the reliability of the evaluation. We also provide memorized images and trigger prompts for DeepFloydIF (Shonenkov et al., ) and Realistic Vision (CivitAI, ). (2) We take into account a general prompt scenario, which has been overlooked in prior work. The prior mitigation methods
(Wen et al., ; Ren et al., ; Somepalli et al., )
have been evaluated
solely on memorized image trigger prompts. However, to apply
mitigation methods in practice,
they should also maintain performance on general prompts. (3) We suggest rigorous metrics. As previous mitigation works (Wen et al., ; Somepalli et al., ) have measured, MemBench also includes the SSCD (Pizzi et al., ), which measures the similarity between memorized and generated images, and the CLIP Score (Hessel et al., ), which measures Text-Image alignment. Additionally, MemBench involves Aesthetic Score (Schuhmann et al., ) to assess image quality, which has been overlooked by prior work and allows to penalize unuseful trivial solutions.
(4) We propose the
reference performance that mitigation methods should achieve.
In previous works (Ren et al., ; Wen et al., ; Somepalli et al., ), the effectiveness of mitigation methods has been demonstrated by measuring the decrease in SSCD and the extent to which the CLIP Score is maintained before and after applying the mitigation method. However, this does not necessarily confirm whether image memorization has been adequately mitigated.
Therefore, for SSCD and CLIP Score, we provide guidelines on the target value that should be achieved for a mitigation method to be considered effective.

MemBench reveals several key findings:

- 1.
All image memorization mitigation methods result in a reduction of Text-Image alignment between generated images and prompts when applied to the generation process of diffusion models.
- 2.
The mitigation methods affect the image generation capabilities of diffusion models, which can lead to lower image quality and the production of less natural images.
- 3.
The mitigation methods can cause performance degradation in the general prompt scenario, which may pose challenges for practical application.

Our additional contribution lies in offering an effective algorithm to search for memorized image trigger prompts. The absence of such benchmarks originates from the significant challenge of collecting prompts that induce memorized images. Compared to the existing methods (Carlini et al., ; Webster et al., ) that require training data itself (Schuhmann et al., ) for fetching candidate prompts, our proposed based construction method is developed with
Markov Chain Monte Carlo (MCMC) (Metropolis et al., ), which enables
the efficient search for these problematic prompts in an open token space without any dataset.

## 2 Related Work

Memorization Mitigation Methods.
Memorization mitigation methods are divided into two approaches: one is the inference time method, and the other is the train time method. Inference time methods aim to prevent the generation of memorized images that already exist in pretrained diffusion models during the image generation process. Somepalli et al. () propose a rule-based text embedding augmentation to mitigate memorization in diffusion models. This includes adding Gaussian noise to text embeddings or inserting random tokens in the prompt. Wen et al. () propose the loss that predicts if a prompt will induce a memorized image, and present a mitigation strategy that applies adversarial attacks on this loss to modify the text embeddings of trigger prompts. Both of these works evaluate their methods by intentionally overfitting the diffusion model on specific {image, text} pairs to induce the memorization effect, and then checking whether the images are regenerated from the corresponding prompts when their methods are applied. Ren et al. () analyze the impact of trigger prompts on the cross-attention layer of diffusion models and propose a corresponding mitigation method.

Train time methods aim to prevent diffusion models from memorizing training data during model training by employing specific training techniques. Although several methods (Daras et al., ; Liu et al., ) have been proposed, experiments have been conducted only on small models and datasets such as CIFAR-10 and CelebHQ. While some experiments (Somepalli et al., ; Ren et al., ; Wen et al., ) have been conducted on large models such as Stable Diffusion, they only assess whether the fine-tuning dataset is memorized when fine-tuning the model. To date, no train time mitigation method has been tested by training large diffusion models from scratch to evaluate its effectiveness.

Therefore, we consider inference time methods as the primary approaches applicable to foundation models like Stable Diffusion. However, due to the absence of a proper benchmark that contains sufficient number of memorized image trigger prompts, evaluation remains inadequate. MemBench addresses this gap by providing sufficient test data and appropriate metrics for the comprehensive evaluation of these inference time methods.

Training Data Extraction Attack.
Carlini et al. () propose a method to search for memorized image trigger prompts involving two stages. In the pre-processing stage, they embed the entire training set of Stable Diffusion into the CLIP (Radford et al., ) feature space and cluster these embeddings to identify the most repeated images. In the post-processing stage, Stable Diffusion is used to generate 500 images for each prompt corresponding to these clustered images. The similarity among these 500 generated images is measured, and only those prompts that produce highly similar images are sampled. Finally, image retrieval is performed on the training data using generated images from these selected prompts to verify if the generated images match the training data images. The pre-processing involves CLIP embedding and clustering of 160M images, while the post-processing involves generating 175M images. Webster () propose an advanced searching algorithm. In the pre-processing stage, an encoder is trained to compress CLIP embeddings. Then, 2B CLIP embeddings are compressed and clustered using KNN (Webster et al., ). In the post-processing stage, Webster
introduces an effective method that performs a few inferences of the diffusion model to predict whether a prompt will induce memorized images. This method is applied to 20M prompts acquired from the pre-processing stage.

Both methods share common bottlenecks: they are memory inefficient and require extremely high computational costs. Additionally, the most fundamental problem is their reliance on training data as candidate trigger prompts. With LAION becoming inaccessible(^1^11[https://laion.ai/notes/laion-maintenance/](https://laion.ai/notes/laion-maintenance/)), these methods can no longer be reproducible and utilized. However, our method can search more for trigger prompts efficiently than those methods even without any pre-processing steps and any dataset.

Benchmark Dataset.
Since the only existing dataset that can be used for evaluating mitigation methods is the small dataset released by Webster (),
Ren et al. () evaluate their method on the Webster dataset, while the Webster dataset is not originally purposed as a benchmark dataset.
The dataset is constructed by the training data extraction attack method proposed by Webster, which is not scalable; thus, the dataset remains a small scale.
Also, Ren et al. did not measure the loss of semantic preservation after mitigation, which is an important criterion but overlooked.
Our benchmark is also constructed by a novel and efficient data extraction method, and the first benchmark for evaluating those mitigation methods with carefully designed metrics.

## 3 Searching Memorized Image Trigger Prompt Leveraging MCMC

### 3.1 Preliminary

#### Diffusion Models.

Denoising Diffusion Probabilistic Model (DDPM) (Ho et al., ) is a representative diffusion model designed to approximate the real data distribution $q({\mathbf{x}})$ with a model $p_{\bm{\theta}}({\mathbf{x}})$. For each ${\mathbf{x}}_{0}\sim q({\mathbf{x}})$, DDPM constructs a discrete Markov chain $\{{\mathbf{x}}_{0},{\mathbf{x}}_{1},\ldots,{\mathbf{x}}_{T}\}$ that satisfies $q({\mathbf{x}}_{t}|{\mathbf{x}}_{t-1})=\mathcal{N}({\mathbf{x}}_{t};\sqrt{1-
\beta_{t}}{\mathbf{x}}_{t-1},\beta_{t}{\mathbf{I}})$. This is referred to as the forward process, where $\{\beta_{t}\}_{t=1}^{T}$ is a sequence of positive noise scales. Conversely, the reverse process generates images according to $p_{\bm{\theta}}({\mathbf{x}}_{t-1}|{\mathbf{x}}_{t})=\mathcal{N}({\mathbf{x}}_
{t};\mu_{\bm{\theta}}({\mathbf{x}}_{t},t),\Sigma_{\bm{\theta}}({\mathbf{x}}_{t
},t))$.
DDPM starts by sampling ${\mathbf{x}}_{T}$ from a Gaussian distribution, and then undergoes a stochastic reverse process to generate the sample ${\mathbf{x}}_{0}$, *i.e*. an image.
With a parametrized denoising network ${\bm{\epsilon}}_{{\bm{\theta}}}$, this generation process can be expressed as:

$$ $\displaystyle{\mathbf{x}}_{t-1}=\tfrac{1}{\sqrt{\alpha_{t}}}\left({\mathbf{x}} _{t}-\tfrac{1-\alpha_{t}}{\sqrt{1-\bar{\alpha}_{t}}}{\bm{\epsilon}}_{\bm{ \theta}}({\mathbf{x}}_{t},t)\right)+\sigma_{t}{\mathbf{w}},$ (1) $$

where $\alpha_{t}=1-\beta_{t}$, $\bar{\alpha}_{t}=\prod_{i=1}^{t}\alpha_{t}$, $\sigma_{t}$ can be $\sqrt{\beta}$ or $\sqrt{\frac{1-\bar{\alpha_{t-1}}}{1-\bar{\alpha}_{t}}\beta_{t}}$, and ${\mathbf{w}}\sim\mathcal{N}(0;{\mathbf{I}})$.
The equations may vary depending on hyper-parameter choices and the numerical solver used (Song et al., ; ).

#### Classifier Free Guidance (CFG).

In T2I diffusion models such as Stable Diffusion (Rombach et al., ), CFG (Ho & Salimans, ) is commonly employed to generate images better aligned with
the desired prompt. Given a text prompt ${\mathbf{p}}$ and the text encoder ${\mathbf{f}}(\cdot)$ of the pre-trained CLIP (Radford et al., ), predicted noise is replaced as follows:

$$ $\displaystyle\tilde{{\bm{\epsilon}}}_{{\bm{\theta}},{\mathbf{f}}}({\mathbf{x}} ,{\mathbf{p}},t)={\bm{\epsilon}}_{\bm{\theta}}({\mathbf{x}},{\mathbf{f}}( \emptyset),t)+s\cdot({\bm{\epsilon}}_{\bm{\theta}}({\mathbf{x}},{\mathbf{f}}({ \mathbf{p}}),t)-{\bm{\epsilon}}_{\bm{\theta}}({\mathbf{x}},{\mathbf{f}}( \emptyset),t)),$ (2) $$

where $\emptyset$ denotes the empty string, and $s$ is the guidance scale.

#### Memorized Image Trigger Prompt Prediction.

Wen et al. () proposed an efficient method to predict whether a prompt will generate an image included in the training data. Prior to presenting this method, we present the definition of image memorization suggested in
(Somepalli et al., ; Carlini et al., ).

###### Definition 1 ( $\tau$ -Image Memorization)

Given a train set $\mathcal{D}_{train}=\{({\mathbf{x}}_{train,i},{\mathbf{p}}_{train,i})\}_{i=1}^
{N}$, a generated image ${\mathbf{x}}$ from a diffusion model ${\bm{\epsilon}}_{\bm{\theta}}$ trained on $\mathcal{D}_{train}$, and a similarity measurement score SSCD (Pizzi et al., ), image memorization of ${\mathbf{x}}$ is defined as:

$$ $\displaystyle\mathcal{M}_{\tau}(\mathbf{x},\mathcal{D}_{train})=\mathbb{I} \left[\exists\,\mathbf{x}_{train}\in\mathcal{D}_{train}\;\text{s.t.}\;\text{ SSCD}(\mathbf{x},\mathbf{x}_{train})>\tau\right],$ (3) $$

where $\tau$ is a threshold, $\mathbb{I}$ is indicator function, and $\mathcal{M}(\cdot)$ indicates whether the image is memorized.

The prior works (Carlini et al., ; Wen et al., ; Webster, ) found that prompts inducing memorized images do so regardless of the initial noise, ${\mathbf{x}}_{T}$, *i.e*., repeatedly generating the same or almost identical images despite different ${\mathbf{x}}_{T}$. To quickly identify this case, Wen et al. () propose a measure to predict whether a prompt will induce a memorized image using only the first step of the diffusion model, without generating the image. This measure, referred to as $D_{\bm{\theta}}$, is formulated as follows:

$$ $\displaystyle D_{\bm{\theta}}({\mathbf{p}})=\mathbb{E}_{{\mathbf{x}}_{T}\sim \mathcal{N}(0,{\mathbf{I}})}[||{\bm{\epsilon}}_{\bm{\theta}}({\mathbf{x}}_{T}, {\mathbf{f}}({\mathbf{p}}),T)-{\bm{\epsilon}}_{\bm{\theta}}({\mathbf{x}}_{T},{ \mathbf{f}}(\emptyset),T)||_{2}].$ (4) $$

In this context, the larger $D_{{\bm{\theta}}}({\mathbf{p}})$, the higher the probability that the image generated by the prompt is included in the training data. Denoting image ${\mathbf{x}}$ generated from diffusion model ${\bm{\epsilon}}_{\bm{\theta}}$ with prompt ${\mathbf{p}}$ as ${\mathbf{x}}({\bm{\epsilon}}_{\bm{\theta}},{\mathbf{p}})$, we re-purpose it by expressing as
$D_{\bm{\theta}}({\mathbf{p}})\propto\mathbb{E}[\mathcal{M}({\mathbf{x}}({\bm{
\epsilon}}_{\bm{\theta}},{\mathbf{p}}),\mathcal{D}_{train})]$, where we omit $\tau$ for simplicity.
The AUC for measuring whether a prompt is a memorized image trigger prompt is reported as 0.960 and 0.990 when the number of initial noises is 1 and 4, respectively.

###### Definition 1 ( τ 𝜏 \tau italic_τ -Image Memorization)

### 3.2 Memorization Trigger Prompt Searching as an Optimization Problem

Our objective is to construct a memorized image trigger prompts dataset and verify corresponding memorized images, *i.e*. to construct $\mathcal{D}_{mem}=\{{\mathbf{p}}\mid\mathbb{E}[\mathcal{M}({\mathbf{x}}({\bm{
\epsilon}}_{\bm{\theta}},{\mathbf{p}}),\mathcal{D}_{train})]>\kappa,{\mathbf{p
}}\in\mathcal{T}\}$ where $\kappa$ is the threshold and $\mathcal{T}$ is space of all possible prompts. As mentioned in Section 2, the prior works (Carlini et al., ; Webster, ) utilized $\mathcal{D}_{train}$ to search for candidate prompts that could become $\mathcal{D}_{mem}$. They then generated images from these candidate prompts and conducted image retrieval to find memorized images within $\mathcal{D}_{train}$ which is expensive. Moreover, since the training dataset, LAION, is no longer accessible,
this approach becomes infeasible.
Thus, we
approach the problem from a different perspective. We search for candidate prompts that could become $\mathcal{D}_{mem}$ without using $\mathcal{D}_{train}$. Then, we generate images from these candidate prompts and use a Reverse Image Search API(^2^22[https://tineye.com/](https://tineye.com/))
to find images on the web akin to generated ones by regarding the web as the training set.
Finally, we perform a human verification process.

Given that $D_{\bm{\theta}}({\mathbf{p}})\propto\mathbb{E}[\mathcal{M}({\mathbf{x}}({\bm{
\epsilon}}_{\bm{\theta}},{\mathbf{p}}),\mathcal{D}_{train})]$, constructing $\mathcal{D}_{mem}$ can be conceptualized as an optimization problem where we treat the prompt space as a reparametrization space and aim to find prompts yielding high $\mathcal{D}_{\bm{\theta}}({\mathbf{p}})$.
To formulate the optimization problem, we define the prompt space. Given a finite set $\mathcal{W}$ containing all possible words (tokens), where $|\mathcal{W}|=m$, we model a sentence ${\mathbf{p}}$ with $n$ words as an ordered tuple drawn from the Cartesian product of $\mathcal{W}$, represented as $\mathcal{P}=\mathcal{W}^{n}$. To solve the optimization problem, we treat $D_{\bm{\theta}}(\cdot)$ as a negative energy function and model the target Boltzmann distribution $\pi$ such that higher values of $D_{\bm{\theta}}(\cdot)$ correspond to higher probabilities as

$$ $\displaystyle\pi({\mathbf{p}})=\tfrac{e^{D_{\bm{\theta}}({\mathbf{p}})/K}}{Z},$ (5) $$

where $Z=\sum_{{\mathbf{p}}\in\mathcal{P}}{e^{D_{\bm{\theta}}({\mathbf{p}})/K}}$ is a regularizer and $K$ is a temperature constant. By sampling from modeled target distribution $\pi({\mathbf{p}})$ in a discrete, finite, multivariate, and non-differentiable space $\mathcal{P}$, we can obtain prompts that maximize $D_{\bm{\theta}}({\mathbf{p}})$, which are likely to be memorized image trigger prompts.

### 3.3 Constructing MCMC Leveraging D θ subscript 𝐷 𝜃 D_{\theta} italic_D start_POSTSUBSCRIPT italic_θ end_POSTSUBSCRIPT

To tackle the aforementioned challenging optimization problem, we propose to use Markov Chain Monte Carlo (MCMC) (Hastings, ) to sample from the target distribution $\pi({\mathbf{p}})$. This method allows us to efficiently explore the discrete prompt space and find prompts likely to induce memorized images, effectively navigating $\mathcal{P}$ to identify optimal prompts. From any arbitrary distribution of sentence, $\pi_{0}$, Markov Chain with transition matrix ${\mathbf{T}}$ can be developed as follows:

$$ $\displaystyle\pi_{i+1}=\pi_{i}{\mathbf{T}}.$ (6) $$

It is well known that Markov Chains satisfying irreducibility and aperiodicity converge to certain distribution $\pi^{*}$ (Robert et al., ), which can be formulated as $\pi_{n}=\pi_{0}{\mathbf{T}}^{n}\rightarrow\pi^{*}$ independent of $\pi_{0}$. In this context, the transition matrix can vary depending on the algorithm used to solve the MCMC. By carefully choosing the sampling algorithm, we can ensure that the final distribution $\pi^{*}$ reached by the transition matrix converges to desired target distribution $\pi$ (Robert et al., ; Geman & Geman, ; Hastings, ).
Considering the multi-dimensional nature of our parameter space, we employ the Gibbs sampling algorithm (Geman & Geman, ) for simplicity.
Gibbs sampling is an MCMC sampling algorithm method where, at each step, only one coordinate of the multi-dimensional variable is updated to transition from the current state to the next state. Gibbs sampling algorithm has proven the convergence of the transition matrix and is known for fast convergence in multi-dimensional problems (Johnson et al., ; Terenin et al., ; Papaspiliopoulos & Roberts, ).
We adopt random scan Gibbs sampling, which involves randomly selecting an index and updating the value at that index. This process can be expressed as the sum of $n$ transition matrices, as follows:

$$ $\displaystyle{\mathbf{T}}$ $\displaystyle=\sum_{i=1}^{n}{\frac{1}{n}\cdot{\mathbf{T}}_{i}},$ (7) $\displaystyle[{\mathbf{T}}_{i}]_{{\mathbf{p}}^{j}\rightarrow{\mathbf{p}}^{j+1}}$ $\displaystyle=\left\{\begin{array}[]{cl}\pi({\mathbf{p}}^{j+1}_{i}|{\mathbf{p} }^{j}_{-i})&\text{if }{\mathbf{p}}_{-i}^{j}={\mathbf{p}}^{j+1}_{-i}\\ 0&\text{else},\end{array}\right.$ (10) $$

where ${\mathbf{p}}_{-i}=\{{\mathbf{p}}_{1},{\mathbf{p}}_{2},...,{\mathbf{p}}_{i-1},{
\mathbf{p}}_{i+1},...,{\mathbf{p}}_{n}\}$ and ${\mathbf{p}}^{j}$ is a $j$-th state prompt. Integrating Equation 5 into the above formulas, the final transition matrix is obtained as follows:

$$ $\displaystyle[{\mathbf{T}}]_{{\mathbf{p}}^{j}\rightarrow{\mathbf{p}}^{j+1}}= \left\{\begin{array}[]{ll}\frac{1}{n}\cdot(\frac{e^{D_{\bm{\theta}}(\mathcal{P }_{i}={\mathbf{p}}_{i}^{j+1},\mathcal{P}_{-i}={\mathbf{p}}_{-i}^{j})/K}}{\sum_ {\mathbf{w}\in\mathcal{W}}e^{D_{\bm{\theta}}(\mathcal{P}_{i}=\mathbf{w}, \mathcal{P}_{-i}={\mathbf{p}}_{-i}^{j})/K}})&if\;{\mathbf{p}}_{-i}^{j}={ \mathbf{p}}_{-i}^{j+1},\\ 0&else,\\ \end{array}\right.$ (13) $$

where detailed derivation is provided in Appendix. Since it is impractical to compute $D_{\bm{\theta}}(\cdot)$ for all ${\mathbf{w}}\in\mathcal{W}$, we approximate $\mathcal{W}$ as top $Q$ samples obtained from BERT (Devlin et al., ). This means that the $i$-th element of the prompt ${\mathbf{p}}$ is masked and BERT is used to predict the word, from which the top Q samples are selected as candidate words. Mathematical derivation is complex, but the algorithm is straightforward: the process iteratively 1) selects and replace a word into [MASK] token from the sentence, 2) predicts top $Q$ words via BERT and computes proposal distribution, and 3) stochastically replaces it according to the proposal distribution. Please refer to Algorithm 1 for details.

Figure: Algorithm 1 Memorized Image Trigger Prompt Searching via Gibbs sampling

### 3.4 Dataset Construction Leveraing MCMC

We conduct dataset construction in two stages: 1) using a masked sentence as the prior and employing MCMC to find memorized image trigger prompts, and 2) using the memorized image trigger prompts as the prior for augmentation through MCMC.

#### Using Masked Sentence as Prior.

This stage aims to discover new memorized images. The sentence is initialized with sentence of length $n$ [MASK] token, *i.e*. ${\mathbf{p}}_{0}=$ {[MASK], [MASK], … , [MASK]}. We then employ Algorithm 1 initialized with ${\mathbf{p}}_{0}$ to obtain the candidate prompt. Similar to the conventional approach (Carlini et al., ) to extract train images, we then generate 100 images for this prompt and leverage DBSCAN (Ester et al., ) clustering algorithm with SSCD (Pizzi et al., ) to extract images forming at least 20 nodes. Those images are employed to Reverse Image Search API to find train image sources and human verification is conducted.

#### Using Found Trigger Prompts as Prior.

This stage aims to augment memorized image trigger prompts. We leverage the prompts found in the previous stage or those provided by Webster () as the prior, $\pi_{0}$.
In this process, we employ a slightly modified algorithm to enhance diversity. Instead of running a single chain for one prompt, we run $n$ separate chains for each word position in an $n$-length sentence, treating each position as the first updating index in Gibbs sampling. This method ensures a varied exploration of the prompt space. We then save the top 100 prompts with the highest $D_{\bm{\theta}}(\cdot)$.
We retained all prompts generated during the MCMC sampling process and then selected 20 augmented prompts per original prompt, considering diversity.
The detailed process is provided in Appendix.

## 4 Dataset Analysis and Efficiency of Trigger Prompt Searching Algorithm

### 4.1 Dataset Analysis

**Table 1: Comparison of the number of memorized images and trigger prompts provided in each dataset. Our dataset is significantly larger in terms of the number of trigger prompts across all models. Please note that images sharing the same layout, as depicted in Figure 4, have been counted as a single image.**
|  | Stable Diffusion 1 | Stable Diffusion 2 | DeepFloydIF | Realistic Vision |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Trigger<br>Prompt # | Mem.<br>Image # | Trigger<br>Prompt # | Mem.<br>Image # | Trigger<br>Prompt # | Mem.<br>Image # | Trigger<br>Prompt # | Mem.<br>Image # |
| Webster () | 325 | 111 | 210 | 25 | 162 | 17 | 354 | 119 |
| MemBench | 3000 | 151 | 1500 | 55 | 309 | 51 | 1352 | 148 |

Figure: Figure 1: Components of Memorized Images in Stable Diffusion 1
Refer to caption: x1.png

Table 1 presents the number of memorized images and trigger prompts obtained using the methodology described in Section 3. For both Stable Diffusion 1 and 2, the number of prompts has increased more than fivefold for each model and more than 9 times in total compared to those reported by Webster (). The number of memorized images included in the dataset has also increased, with Stable Diffusion 2 showing an increase of over twofold. Additionally, we provide memorized images and trigger prompts for DeepFloydIF (Shonenkov et al., ), which has a cascaded structure, and Realistic Vision (CivitAI, ), an open-source diffusion model. For these two models as well, we provide a greater number of memorized images and trigger prompts than Webster et al. We have also applied our algorithm to the more recent model, Stable Diffusion 3 (Esser et al., ). Please refer to Appendix for the results. The composition of the images included in MemBench is shown in Figure 1, illustrating that the memorized images encompass a substantial number of commercial product images and human images. It also includes artwork such as brand logos.

### 4.2 Efficacy of Memorized Image Trigger Prompt Searching

**Table 2: Comparison of the efficiency of our method and other prompt space optimization methods. Experiment was done on 1 A100 GPU**
|  | Greedy Search | ZeroCap | PEZ | ConZIC | Ours |
| --- | --- | --- | --- | --- | --- |
| Hours/Memorized Image | 5.7 | None | None | 3.81 | 2.08 |

In this section, we validate the efficiency of our method in discovering memorized images without access to $\mathcal{D}_{train}$. The task of finding memorized image trigger prompts without $\mathcal{D}_{train}$ is defined as follows: without any prior information, the method must automatically find trigger prompts that induce memorized images. This involves: 1) selecting candidate prompts, 2) generating 100 images for each candidate prompt, 3) applying DBSCAN (Ester et al., ) clustering with SSCD to get candidate images and using a Reverse Image Search API to verify those images’ presence on the web. To the best of our knowledge, this task is novel, so we provide naive baselines. As the first baseline, we perform a greedy search by measuring $D_{\theta}$ for all prompts in the prompt dataset and selecting the top 200 prompts as candidate prompts. For the prompt dataset, we leveraged DiffusionDB, which contains 13M prompts collected from diffusion model users. Additionally, we provide three other baselines, all of which are algorithms that solve optimization problems in the prompt space. For two of these baselines, we adapt ZeroCap (Tewel et al., ) and ConZIC (Zeng et al., ), methods designed to maximize the CLIP Score for zero-shot image captioning, by replacing their objective function with $D_{\theta}$. Similarly, we also adapt PEZ (Wen et al., ) by substituting its objective function with $D_{\theta}$ to serve as another baseline. For each of these three methods, we conducted 200 iterations and obtained prompts. For our method, we performed 200 MCMC runs with 150 iterations each, and selected the resulting prompts as candidate prompts. For more detailed implementation, please refer to Appendix.

The results are shown in Table 2. Our method significantly outperforms other methods. Comparing with baselines (Carlini et al., ; Webster, ) that leverage LAION itself is challenging, as the dataset is no longer available and the elements for reimplementation are omitted in the corresponding papers. However, as mentioned in Section 2, their memory-inefficient and computationally intensive methods provided only few memorized images and trigger prompts. Please refer to Appendix for the performance of augmenting the memorized image trigger prompts through MCMC.

## 5 MemBench: Metrics, Scenarios and Reference Performance

Figure: Figure 2: The necessity of measuring the Aesthetic score. Images generated with the mitigation method applied are not desirable but achieve a low SSCD while maintaining a high CLIP Score.
Refer to caption: x2.png

#### Metrics.

We present rigorous metrics for correctly evaluating mitigation methods, which include similarity score, Text-Image alignment score, and quality score. Firstly, following previous works, we adopt SSCD (Pizzi et al., ) as the similarity score and measure max SSCD between a generated image using trigger prompt and memorized images. In detail, if a prompt ${\mathbf{p}}^{*}$ triggers images $\{{\mathbf{x}}_{1}^{*},...,{\mathbf{x}}_{k}^{*}\}$ included in $\mathcal{D}_{train}$, we measure $\max_{{\mathbf{x}}\in\{{\mathbf{x}}_{1}^{*},...,{\mathbf{x}}_{k}^{*}\}}SSCD({
\mathbf{x}}({\mathbf{p}}^{*},{\bm{\epsilon}}_{\theta}),{\mathbf{x}})$. Secondly, we adopt CLIP Score (Hessel et al., ) to measure Text-Image alignment between prompt and generated images. Lastly, We adopt an Aesthetic Score (Schuhmann et al., ) as the image quality score. While previous works did not measure image quality scores, we observed issues shown in Figure 2. When memorization mitigation methods are applied, we observed that
image quality degrades, the rich context generated by the diffusion model is destroyed, or distorted images are formed. An ideal memorization mitigation method should be able to preserve the image generation capabilities of the diffusion model.

#### Scenarios.

To ensure that memorization mitigation methods can be generally applied to diffusion models, we provide two scenarios: the memorized image trigger prompt scenario and the general prompt scenario. First, the memorized image trigger prompt scenario evaluates whether mitigation methods can effectively prevent the generation of memorized images. This scenario uses the memorized image trigger prompts we identified in Section 3. In this scenario, we generate 10 images for each trigger prompt and measure the Top-1 SSCD and the mean values of the Top-3 SSCD. We also measure the proportion of images with SSCD exceeding 0.5. For CLIP Score and Aesthetic Score, we calculate the average value across all generated images. Second, the general prompt scenario ensures that the performance of the diffusion model does not degrade when using prompts other than trigger prompts. We leverage the COCO (Lin et al., ) validation set as general prompts. In this scenario, images are generated once per prompt, and the average CLIP Score and Aesthetic Score are measured.

#### Reference Performance.

We propose a reference performance for interpreting the performance of mitigation methods.
An effective mitigation method should be able to reduce SSCD while maintaining CLIP Score. However, although SSCD is a metric designed to compare the structural similarity of images for copy detection tasks, it inevitably includes semantic meaning due to the self-supervised nature of the trained neural network. On the other hand, the semantic meaning of the trigger prompt should still be reflected in the generated image to maintain CLIP Score even when a mitigation method is applied.
Therefore, it is uncertain how much the SSCD between memorized images and generated images can be reduced while maintaining the CLIP Score between trigger prompts and generated images.
In this regard, we provide a reference performance to indicate how much SSCD can be reduced while maintaining a high CLIP Score. We assume querying images with trigger prompts via the Google Image API(^3^33[https://developers.google.com/custom-search](https://developers.google.com/custom-search)) as a strong proxy model for the generative model and provide the reference performance based on this approach. Please refer to Appendix for details.

## 6 Deeper Analysis into Image Memorization

Figure: (a)
Refer to caption: x3.png

Figure: Figure 4: Results of images found by leveraging Reverse Image Search API to the images generated from trigger prompts. The shared layout suggests the occurrence of image memorization.
Refer to caption: x7.png

In this section, we provide a deeper analysis of the memorized images and trigger prompts in MemBench. Firstly, we have found that Stable Diffusion regenerates commercial products currently on sale. While the possibility that diffusion models could memorize commercial images has been suggested (Carlini et al., ; Somepalli et al., ), we are the first to confirm this. Unlike the previous studies (Carlini et al., ; Webster, ) that used image retrieval from LAION to find memorized images, we leverage a Reverse Image Search API to find those, which enable us this verification. As shown in Figure 3.b, Stable Diffusion replicates images of commercially available shirts when given a specific prompt. Figure 3.d further illustrates the replication of layouts; for a commercially sold carpet, all layouts have been reproduced.

Secondly, we explore the cause of image memorization in Stable Diffusion 2, trained on LAION-5B, whose duplicates are removed. Previous works (Somepalli et al., ; Gu et al., ) suggested that image memorization issues arise from duplicate images in the training data. Webster et al. () confirmed that the LAION-2B dataset contains many duplicate images likely to be memorized. However, Stable Diffusion 2 still exhibits image memorization issues while reduced. We hypothesize that this memorization arises due to layout duplication. Figure 4 shows the images found by Reverse Image Search API that are memorized by Stable Diffusion. We found that there are often over 100 images on the web with the same layout but different color structures. LAION-5B underwent deduplication based on URLs(^4^44[https://laion.ai/blog/laion-5b/](https://laion.ai/blog/laion-5b/)), but this process may not have removed these images.
These layout memorizations are also obviously subject to copyright, posing potential social issues. Additional examples are provided in Appendix.

## 7 Evaluation of Image Memorization Mitigation Method on MemBench

**Table 3: Performance evaluation of image memorization mitigation methods in MemBench. Please refer to Appendix for the details of hyper-paramters.**
|  |  | MemBench | COCO |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  |  | Top-1 SSCD $\downarrow$ | Top-3 SSCD $\downarrow$ | SSCD > 0.5 $\downarrow$ | CLIP $\uparrow$ | Aesthetic $\uparrow$ | CLIP $\uparrow$ | Aesthetic $\uparrow$ |
| Base |  | 0.641 | 0.605 | 0.451 | 0.273 | 5.25 | 0.321 | 5.37 |
| Reference Performance | (API search) | 0.088 | - | - | 0.310 | - | - | - |
| RNA(Somepalli et al., ) | n = 1 | 0.479 | 0.425 | 0.241 | 0.270 | 5.18 | 0.314 | 5.34 |
| n = 2 | 0.389 | 0.338 | 0.165 | 0.270 | 5.14 | 0.310 | 5.33 |  |
| n = 3 | 0.329 | 0.280 | 0.121 | 0.267 | 5.13 | 0.307 | 5.30 |  |
| n = 4 | 0.287 | 0.239 | 0.089 | 0.264 | 5.10 | 0.304 | 5.29 |  |
| n = 5 | 0.254 | 0.213 | 0.074 | 0.262 | 5.08 | 0.302 | 5.28 |  |
|  | n = 6 | 0.228 | 0.189 | 0.055 | 0.258 | 5.06 | 0.298 | 5.24 |
| RTA (Somepalli et al., ) | n = 1 | 0.497 | 0.446 | 0.265 | 0.269 | 5.20 | 0.316 | 5.34 |
| n = 2 | 0.397 | 0.347 | 0.175 | 0.268 | 5.19 | 0.314 | 5.32 |  |
| n = 3 | 0.330 | 0.285 | 0.129 | 0.266 | 5.17 | 0.310 | 5.29 |  |
| n = 4 | 0.282 | 0.240 | 0.094 | 0.264 | 5.15 | 0.306 | 5.27 |  |
| n = 5 | 0.257 | 0.217 | 0.080 | 0.262 | 5.14 | 0.302 | 5.26 |  |
|  | n = 6 | 0.228 | 0.190 | 0.056 | 0.258 | 5.10 | 0.299 | 5.27 |
| Wen et al. () | l = 7 | 0.410 | 0.346 | 0.134 | 0.270 | 5.16 | 0.321 | 5.37 |
| l = 6 | 0.355 | 0.289 | 0.089 | 0.270 | 5.15 | 0.321 | 5.37 |  |
| l = 5 | 0.312 | 0.246 | 0.059 | 0.269 | 5.14 | 0.321 | 5.37 |  |
| l = 4 | 0.259 | 0.199 | 0.035 | 0.268 | 5.13 | 0.321 | 5.37 |  |
| l = 3 | 0.181 | 0.139 | 0.015 | 0.264 | 5.11 | 0.321 | 5.37 |  |
|  | l = 2 | 0.096 | 0.075 | 0.001 | 0.242 | 4.97 | 0.321 | 5.37 |
| Ren et al. () | c = 1.0 | 0.289 | 0.247 | 0.083 | 0.263 | 5.17 | 0.316 | 5.33 |
| c = 1.1 | 0.283 | 0.239 | 0.071 | 0.260 | 5.17 | 0.313 | 5.31 |  |
| c = 1.2 | 0.278 | 0.232 | 0.058 | 0.257 | 5.15 | 0.309 | 5.28 |  |
| c = 1.3 | 0.275 | 0.227 | 0.050 | 0.254 | 5.14 | 0.304 | 5.26 |  |

In this section, we evaluate image memorization mitigation methods on our MemBench in Stable Diffusion 1. For results of Stable Diffusion 2, please refer to Appendix.

#### Baselines.

We use Stable Diffusion 1.4 as the base model. The image memorization mitigation methods evaluated include: 1) RTA (Somepalli et al., ), which applies random token insertion to the prompt, 2) RNA (Somepalli et al., ), which inserts a random number between $[0,10^{6}]$ into the prompt, 3) method proposed by Wen et al. () that applies adversarial attacks to text embeddings, and 4) method proposed by Ren et al. () that rescales cross-attention. Image generation is performed using the DDIM (Song et al., ) Scheduler with a guidance scale of 7.5 and 50 inference steps.

#### Results.

We present the experimental results in Table 3. As shown in Table 3, for all methods, lowering the SSCD significantly reduces both the CLIP Score and the Aesthetic Score. This indicates a degradation in text-image alignment and image quality. In particular, upon examining images with low Aesthetic Scores, we observe that issues in Figure 2 occur across all methods. While Ren et al. () measured FID, the Aesthetic Score offers a more straightforward way to evaluate individual image quality and better highlight these issues. As reported by Wen et al. (), all methods exhibit a trade-off between SSCD and CLIP Score. Regarding the reference performance obtained via API search, it can be observed that the SSCD can be reduced to 0.088 while maintaining a high CLIP Score. Due to the inherent limitations of the Stable Diffusion baseline model, the CLIP Score cannot exceed 0.273 when mitigation methods are applied. However, mitigation methods should aim to reduce the Top-1 SSCD to around 0.088 while maintaining at least this level of CLIP Score.

To provide a more detailed analysis of each method, we observe that the approach proposed by Wen et al. achieves the best performance in the trade-off between SSCD and CLIP Score. However, to reduce the proportion of images with SSCD exceeding 0.5—indicative of image memorization—to nearly zero, their method still requires a reduction in CLIP Score by 0.025. Given the scale of the CLIP Score, this drop suggests that the generated images may be only marginally related to the given prompts. Moreover, a significant decrease in the Aesthetic Score is also observed. On the other hand, the method proposed by Wen et al. has an additional advantage: it does not result in any performance drop in the general prompt scenario on the COCO dataset, making it the most suitable option for practical applications as of now.

The most recent method proposed by Ren et al. () shows a considerable reduction in the CLIP Score. Even at the lowest hyper-parameter setting ($c=1.0$), the reductions in both CLIP Score and Aesthetic Score are substantial, limiting its general applicability to diffusion models.
The most basic approaches, RNA and RTA, show a decrease in CLIP Score by 0.015 at the hyper-parameter setting ($n=6$) that lowers the proportion of images with SSCD exceeding 0.5 to 0.05. This result is expected given the nature of these methods: both attempt to prevent image memorization by adding irrelevant tokens to the prompts. As a result, RNA and RTA are unreliable for application to diffusion models.

## 8 Conclusion

We have presented MemBench, the first benchmark for evaluating image memorization mitigation methods in diffusion models. MemBench includes various memorized image trigger prompts, appropriate metrics, and a practical scenario to ensure that mitigation methods can be effectively applied in practice. We have provided the reference performance that mitigation methods should aim to achieve. Through MemBench, we have confirmed that existing image memorization mitigation methods are still insufficient for application to diffusion models in practical scenarios. The lack of a benchmark may have previously hindered the research of effective mitigation methods. However, we believe that our benchmark will facilitate significant advancements in this field.

#### Limitations and Future Work.

Another contribution of our work is providing an algorithm for efficiently searching memorized image trigger prompts based on MCMC. Our approach is faster than other searching algorithms we have tried, yet it does not exhibit exceptionally high speed. Consequently, due to time constraints, we were unable to provide a larger number of memorized images. However, our method allows for the continuous search of more memorized images and their corresponding trigger prompts, and we plan to update the dataset regularly. Additionally, we aim to enhance the efficiency of our memorized image trigger prompt searching algorithm in the future.

## Acknowledgments

T.-H. Oh was partially supported by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT) (No.RS-2021-II212068, Artificial Intelligence Innovation Hub).

## Ethics statement

Our work introduces a technique for extracting the training data of diffusion models.
This could potentially harm the rights of model owners or image copyright holders.
Therefore, it is crucial to handle this technique with caution to avoid any infringement issues.
For more details, please refer to Appendix.

## Reproducibility statement

We provide the code for our training data extraction algorithm, the dataset, and the evaluation in the supplementary material.

## Peer Reviews

confidence: 5
contribution: 2
initial_rating: 5
presentation: 3
questions: Besides providing a larger size of dataset, what is the contribution of the new dataset?
soundness: 2
strengths: 1. The paper reformulates the search for memorized image prompts as an optimization problem, which allows for more efficient prompt discovery.
2. It employs a Markov Chain Monte Carlo (MCMC) method to solve the optimization problem, resulting in a significantly larger set of memorized prompts compared to previous methods.
3. MemBench provides evaluation of existing memorization mitigation methods in diffusion models.
summary: This paper proposes a benchmark to evaluate memorization mitigation methods in text-to-image diffusion models. MemBench includes a large set of trigger prompts that replicate training images, potentially causing privacy or copyright issues. It assesses mitigation methods by examining their effectiveness in preventing memorized images without degrading general prompt performance.
weaknesses: 1. This paper does not consider the detection problem. Wen et al and Ren et al both use detection before mitigation. So they do not always mitigate on general prompts. It does not make sense to compare the generation performance on general prompts.

2. The evaluation metrics are not new. In existing paper like Wen et al and Ren et al, they use all the metrics mentioned in this paper.

3. The dataset construction requires white-box access, which is ineffective to API-based models. In addtion, although it does not use training set, it requires to use an API to search images on the web, which is not efficient.

4. The major problem is the benchmark, which didn't provide a reasonable perspective and new metrics.

---

confidence: 4
contribution: 2
initial_rating: 5
presentation: 3
questions: Please check out the weaknesses section, where the limited contribution and motivation are the major concerns that make me inclined to reject this paper.
soundness: 2
strengths: - This paper is good in presentation, with good clarity, well-structured, and easy to follow.
- This paper addresses an important and practical task: the reverse process of the diffusion model always invokes almost or exactly the same memorized images from training data. This can lead to privacy issues, which are well-discussed and motivated in the introduction section.
- This paper proposes 3,000, 1,500, 309, and 1,352 memorized image trigger prompts for different generative models, compared to a previous benchmark that provides 325, 210, 162, and 354 prompts. Adding additional trigger prompts as a dataset is beneficial for a more comprehensive evaluation of mitigation strategies.
summary: This paper studies the memorization issue in text-to-image diffusion models, where generated images is almost or exactly the same as the training image, which leads to privacy concerns. This paper propose a new triggering prompt dataset that contains prompts that will lead to memorized generations. This paper evaluates several baseline works’ mitigation strategies on the proposed datasets and also non-triggering prompts and have concluded that existing strategies still have room for improvement as they degrade overall performance of diffusion models.
weaknesses: 1. **Limited contribution**. 
- While the additional trigger prompts introduced in this paper can indeed aid in evaluating existing mitigation strategies and provide further assessment of their performance, such contribution remains somewhat incremental. Rather than addressing a critical need in the field, it adds to existing resources that are already robust. For example, prior methods [1, 2] have utilized 500 trigger prompts, which a recent work [3] systematically organized by extracting and categorizing them into three types (Matching Verbatims, Retrieval Verbatims, and Template Verbatims) based on their distinct characteristics. This categorization already offers a comprehensive framework, making the additional prompts in the present work more of an enhancement than a necessary innovation. I understand that this work’s main contribution is proposing a new benchmark trigger prompt dataset; unlike others that focus on proposing strategies to detect and mitigate the memorization problem, such core contribution (the proposed prompt dataset) is still of quite limited contribution.
- I have also carefully read all the claimed contributions in the paper and appreciate the authors’ effort in presenting them in a well-structured way that is easy to follow. However, such concern remains as the other claimed contributions are also trivial. For example, the idea of using general (non-memorized) prompts in addition to those trigger prompts for evaluation is a good point. However, it is more of a good practice for the related work, instead of a significant contribution. Also, the finding of all mitigation methods can result in a reduction of text alignment, reflecting the trade-off nature of all mitigation strategies, which is already well-documented in the related works and is not a new finding.

[1] Detecting, Explaining, and Mitigating Memorization in Diffusion Models.

[2] Unveiling and Mitigating Memorization in Text-to-image Diffusion Models through Cross Attention.

[3] A Reproducible Extraction of Training Images from Diffusion Models.

2. **Concerns regarding motivation**. I find the descriptions (motivations) in lines 46-50 to be misleading, where the paper states: “The current studies (Wen et al., 2024b; Somepalli et al., 2023b) have adopted the following workaround: 1) simulating memorization by fine-tuning T2I diffusion models for overfitting on a separate small and specific dataset of {image, prompt} pairs, and 2) assessing whether the images used in the fine-tuning are reproduced from the query prompts after applying mitigation methods …” In fact, these papers actually fine-tune on constructed non-triggering pairs of image and prompts to mitigate the memorization (overfitting) issue as per the training-time strategies, also they propose inference-time mitigation strategies that does not rely on the construction of prompt datasets. Both are quite practical, contrary to the paper's points.

---

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: My main problem with the paper is the organization of the writing, I like the idea and I think it is novel, however writing does not focus on main contribution and lack to properly refrence some of the things I mentioned in weakness section

1. Language Model Limitations:
   - How do you address the temporal limitation of using BERT (trained pre-2018) for prompt generation? 
   - What percentage of potential memorization cases might be missed due to this limitation?
   - Have you considered using more recent language models or alternative approaches?

2. Methodological Clarity:
   - Could you provide specific details about the computational constraints that prevented certain comparison methods from being included in the main body of the paper not just in the appendix.
   - Can you clarify the source and context of the reported AUC values from Wen et al. 2024 in the main body of the paper?

3. Metric Choices and Evaluation:
   - What empirical evidence supports the choice of aesthetic score over FID? please also include FID in the paper
soundness: 2
strengths: 1. Novel MCMC-based approach for finding memorization triggers
2. Comprehensive evaluation framework for mitigation methods
3. Large-scale trigger prompt discovery
4. Practical insights into mitigation limitations
5. Not requiring training data
summary: This paper introduces MemBench, a benchmark for evaluating memorization mitigation methods in diffusion models. The core technical contribution is an MCMC-based sampling approach that efficiently finds prompts triggering generation of training data, building upon the memorization detection metric (Dθ) from Wen et al. (2024). The benchmark includes both memorized image trigger prompts and evaluation metrics to assess mitigation methods' effectiveness. The authors demonstrate their method finds substantially more trigger prompts than previous work and reveal issues with existing mitigation approaches. 

However, the paper's organization and presentation significantly obscure its contributions. The main technical innovation - using MCMC for efficient prompt sampling - is not clearly highlighted and is buried under various other aspects. The benchmark itself, while valuable, would benefit from clearer exposition of its components and limitations.
weaknesses: 1. Critical Methodological Limitations:
   - The paper relies heavily on pre-trained language models (specifically BERT) for prompt sampling but fails to acknowledge this as a fundamental limitation. This is particularly problematic as such models have a training cutoff date (pre-2018 for BERT), making it impossible to find triggers containing newer terms or concepts.
   - The evaluation framework potentially misses a significant portion of memorization cases due to this temporal limitation.
   - The dependency on pre-trained language models restricts the generalizability of the method.

2. Unclear and Redundant Writing:
   - The paper's findings section contains three nearly identical statements that could be consolidated:
     Quote: "MemBench reveals several key findings:
     1. All image memorization mitigation methods result in a reduction of Text-Image alignment between generated images and prompts...
     2. The mitigation methods affect the image generation capabilities of diffusion models, which can lead to lower image quality...
     3. The mitigation methods can cause performance degradation in the general prompt scenario..."
     These are essentially making the same point about performance degradation.

   - The paper makes claims about metric superiority without proper justification:
     Quote: "while Ren et al. (2024) measured FID, the Aesthetic Score offers a more straightforward way to evaluate individual image quality and better highlight these issues."
     No evidence or explanation is provided for why Aesthetic Score is "more straightforward" or "better."

   - Key metrics are used without proper introduction:
     The paper extensively uses SSCD scores without ever explaining what they measure or their significance.

3. Poor Communication of Technical Contributions:
   - The paper's main technical innovation (efficient prompt sampling) is not clearly highlighted.
   - The findings section contains redundant statements about mitigation methods that could be consolidated.
   - Claims about metric choices (e.g., aesthetic score vs FID) lack proper justification.

---

confidence: 3
contribution: 2
initial_rating: 5
presentation: 3
questions: In Appendix D, the authors mention they cannot do reverse image search on SD3 generated images since its training set is unknown. Have you tried to reverse search on the LAION 5B dataset despite SD3 had no confirmation of using LAION 5B. Given the size and popularity of LAION, I would assume it (partially) overlaps with the training set of many modern text to image diffusion models.
soundness: 2
strengths: The proposed MCMC-based search is a novel idea for quickly searching for problematic prompts.

The design of MemBench is well thought out and is comprehensive in its metrics for wide adoption.
summary: MemBench is a novel benchmark designed to evaluate image memorization issues in text to image diffusion models. This work includes a benchmark dataset that evaluates image memorization in text to image generation models (authors claim to be first). the benchmark itself contains comprehensive metrics on memorization. 

In addition to the benchmark itself, authors provided analysis of the effectiveness of various mitigation approaches.
weaknesses: The work uses Stable Diffusion 2 to show empirical evidence of memorization and how well their benchmark works. However, their proposal seems unable to apply to models like Stable Diffusion 3 (or other newer models than SD2) where training data is unknown. In Appendix D, the authors did not show may evidence of memorization of SD3. This makes me wonder how widely applicable this work is

Meta-review: This paper presents a benchmark dataset featuring memorized image triggers, where several memorization mitigation methods are evaluated. Currently, it has received a mixed score. Unfortunately, after the rebuttal, the negative reviewers maintained their original scores. I resonate with Reviewer `DiJX`'s view that the novelty of this work is a bit constrained. The primary contribution lies in creating a larger prompt dataset and including general (non-memorized) prompts for evaluation; however, it seems to lack depth in motivations, insights, and an exploration of the limitations of existing works.

As a result, I have to recommend rejecting this paper. I encourage the authors to take the time to refine and reorganize their work before submitting it again.

Decision: Reject