Detecting and Mitigating Memorization in Diffusion Models through Anisotropy of the Log-Probability
Authors: Rohan Asthana
Vasileios Belagiannis
Venue: ICLR 2026 Poster (2026)
Keywords: Memorization
Diffusion Models
Primary area: generative models
TL;DR: Detecting and mitigating memorization in diffusion models through angular alignment of score estimates in low-noise anisotropic regime of denoising process.

Abstract: Diffusion-based image generative models produce high-fidelity images through iterative denoising but remain vulnerable to memorization, where they unintentionally reproduce exact copies or parts of training images. Recent memorization detection methods are primarily based on the norm of score difference as indicators of memorization. We prove that such norm-based metrics are mainly effective under the assumption of isotropic log-probability distributions, which generally holds at high or medium noise levels. In contrast, analyzing the anisotropic regime reveals that memorized samples exhibit strong angular alignment between the guidance vector and unconditional scores in the low-noise setting. Through these insights, we develop a memorization detection metric by integrating isotropic norm and anisotropic alignment. Our detection metric can be computed directly on pure noise inputs via two conditional and unconditional forward passes, eliminating the need for costly denoising steps. Detection experiments on Stable Diffusion v1.4 and v2 show that our metric outperforms existing denoising-free detection methods while being at least approximately 5x faster than the previous best approach. Finally, we demonstrate the effectiveness of our approach by utilizing a mitigation strategy that adapts memorized prompts based on our developed metric. The code is available at https://github.com/rohanasthana/memorization-anisotropy.

Published as a conference paper at ICLR 2026
DETECTING AND MITIGATING MEMORIZATION IN DIFFUSION MODELS THROUGH ANISOTROPY OF THE LOG-PROBABILITY
Rohan Asthana, Vasilcios Belagiannis Friedrihh-Alexande--niiee Erlangen-Nümbergg
Germany
Irohan.ast ast asthana, vasileios bet.aaaos....lllaaaaiiieeaa.aaa
ABSTRACT
Diffusion-based image generative models produce high-fidelity images through iterative denoising but remain vulnerable to memorization, where they uninten- tionally reproduce exact copies parts of training images. Recent memorization detection methods are primarily based on the norm score difference as indica- tors of memorization. We prove that such norm-based metrics mainly effective under the assumption of isotropic log-prohability distributions, which generally holds at high medium noise levels. contrast, analyzing the anisotropic regime reveals that memorized samples exhibit strong angular alignment between the guidance vector and unconditional scores in the low-noise setting. Through these insights, we develop memorization detection metric by integrating isotropic norm and anisotropic alignment. Our detection metric can be computed directly pure noise inputs via two conditional and unconditional forward passes, elimi- nating the need for costly denoising steps. Detection experiments on Stable Diffu- sion v v..4 and v2 show that metric outperforms existing denoising ffren detec- tion methods while being at least approximately 5x faster than the previous best approach. Finally, demonstrate the effectiveness of approach by utiliz- ing a mitigation strategy that adapts memorized prompts based on our developed metric. The code is available at httpt:::////// htttps://github.cccm com http://....omooooaaatttttttt memor zat ion anisotropy
INTRODUCTION
Recent advances in diffusion models (Ho et al. 2020: Ho & Salimans, 2021;
Rombach al. 2022)
especially score-based models (Song et al.) 2021). have positioned them as the dominant class of
generative models. synthesizing various types of data, for instance, images (Rombach et al. 2022
Saharia et al., 2022), videos (Ho et al.] 2022 Gupta et al.) (024). graphs (Vignac et al. 2023
Liu et al. 2025), and neural network architectures (Asthana al. 2024). Score-based dif- fusion models progressively corrupt data with Gaussian noise and then learn score estimates that approximate the gradients of the perturbed log-density transform noise back into data. This en- ables high-quality generation in complex data domains. However, despite the tremendous success of these models, they are susceptible memorization, where the model generates an exact near replica of training images. This phenomenon is similar to overfitting in artificial neural networks and has important implications related data privacy, copyright issues, bias of evaluation benchmarks, and assumptions about generalization. Hence, detection and mitigation of memorization in these high-fidelity generative models has been a growing body of research (Somepalli et al.) 2023b) Wen al. 2024 Chen et al. 2024 Jeon et al., 2025 Jain et al. 2025 Ross et al.) (2025). Since the de- noising process explicitly interpolates between Gaussian noise and the data manifold, the associated score estimates help to understand the underlying dynamics of diffusion models. This perspective motivates the use of score estimates as powerful tool to characterize memorization diffusion models.
Inspired by this perspective, Wen et al. (2024) characterized memorization in text-to-inne text-to-image diffusion models utilizing the norm of the difference of the score between the unconditional and conditional

---

Published as a conference paper at ICLR 2026
estimates. This characterization was supported by the observation that memorized samples exhibit stronger text-driven guidance, which guides the generation towards specific memorized images. Later, multiple works adopted this perspective and developed novel methods for detecting and miti- gating memorization. For pastance,[Jeon et al. (2025) improved the metric from Wen et al. (2024) by incorporating the Hessian of the log-probabiligg lity. Moreover, Jain al. (2025) utilized Wen's metric to deploy opposite guidance until the denoising trajectory steers away from the memorized sample.
In this work, we demonstrate that such norm-based metrics are effective only when the underlying log-probability is isotropic, which is typically satisfied at high or mid noise levels. This is because the norm of the score function encodes information about the overall curvature of the log log-oobbability. While the overall curvature is strong signal for memorization in isotropic distributions, it fails in the anisotropic case, as the curvature is different across different directions. This issue is relevant in scenarios where the access to anisotropic diffusion regime is easier/more efficient compared to image level memorization task (Jiang et al., (025). the aim
the isotropic regime. For example, is to detect memorized images (or parts of them) only through access generated images. These generated images are far from the high-noise isotropic regime and are at the data manifold. Thus, utilizing metric that works under the anisotropic regime should be preferable in this case. To over- come this issue, we additionally account for the anisotropy of the log-probability in the low-noise regime and leverage more informative distribution that better captures memorization than isotropic metrics alone. We explore the anisotropic low-noise regime and reveal that memorization manifests as a stronger alignment between the guidance vector and the unconditional score estimate in the anisotropic low-noise regime. We utilize this phenomenon to develop a simple yet effective mem- orization detection metric, which is the weighted sum of a) cosine similarity between the guidance vector and the unconditional score estimate in the anisotropic regime, and b) norm of the guidance vector the isotropic regime. Importantly, our developed metric denoising faree (meaning that does not require costly denoising steps) and utilizes only two conditional and unconditional forward passes, hence detecting memorization at a rapid pace. We finally integrate our detection metric into prompt augmentation scheme to mitigate memorization effectively during inference.
To evaluate the performance and efficiency of our developed metric, we follow the standard eval- uation protocol (Wen et al.] 2024 Jeon et al., 2025) and conduct experiments Stable Diffusion v1.4 and v2.0 (Rombach et al.) 2022). We show that our method outperforms existing denoising- free metrics while being at least approximately 5x faster than the previous best method. Moreover, our mitigation experiments on MemBench (Hong et al. (2055) showcase that our developed metric makes the generations highly dissimilar to the memorized training sample, while exhibiting strong text-image alignment and high aesthetic quality. Lastly, we conduct three ablation studies in the Appendix Section A.2 comparing alternative formulations of our proposed metric, analyzing the contribution of each component of our metric, and ablating normalization and timestep choices.
In summary, our contributions are as follows:
We identify that norm-based memorization detection metrics are effective only under the assumption of isotropic log- po-probability distributions. To rectify this, we consider both the isotropic (high-noise) and anisotropic (low-noise) regimes of the log-probability for memorization detection.
We show that in the anisotropic regime, memorization manifests as strong alignment between the guidance vector and the unconditional score estimate. Thus, we develop our denoising-fiee frre detection metric by combining the score-based alignment in anisotropy with the norm of the score difference in isotropy.
Through our experiments, we demonstrate that our metric achieves superior denoising detection performance compared to existing metrics while being efficient. We further vali- date the performance of our developed metric by performing inference-time memorization mitigation through the benchmark MemBench (Hong et al. 2025
2 RELATED WORK
Detecting and mitigating memorization in diffusion models has gained substantial interest in recent years (Somepalli et al., 20236] Wen et al.) 2024 Chen et al.)
Memorization in Diffusion Models
2024 Jeon et al. 2025 Jain al. 2025 Ross
al." 2025). In text-to-image diffusion models,
2

---

Published as a conference paper at ICLR 2026
this phenomenon was firstly identified in the works by (Somepalii et al. (2023a). where they show that factors such as training set size affect the scale memorization. Concurrently, Carlini et al. (023) demonstrated the extraction of training data (which were essentially memorized samples)
from diffusion models. Subsequent work investigated dataset properties that drive memorization
(Kadkhodaie al.] [023 Pavlova & Weil (025). while others proposed guidance-basee strategies
for mitigation (Jain et al. 2025| Chen et al. (024). Since the denoising process follows trajectories
through the log-probability landscape, another line of work has approached memorization from geometric perspective. For example, Ross et al. (2025) analyzed the geometry via Local Intrinsic Dimensionality (LID) at the sample-level, and Wen et al. (2024) connected memorization to the norm of score difference, which was later shown byJJeon et al. (2025) to approximate pog-probabylity sharpness in the early denoising phase. Moreover, Chen al. (2025) utilize this norm-based metric to perform localized memorization detection. While our work also analyses the geometry of the log-prool probability, it differs fundamentally from previous work because it studies the anisotropic low- noise regime in the context of denoising- frree memorization detection. Lastly, concurrent to work, [Brokman et al. (0025) propose a curvature- -based criterion that tracks curvature evolution throughout the diffusion trajectory. On the other hand, approach focuses first-order angular alignment between conditional and unconditional scores in the anisotropic low-noise regime. Thus, the method from Brokman al. (2225) can be seen as higher-order extension of our framework.
Low-noise regime of Difffusion Models Several works have analyzed the behavior of diffusion models in the low-noise regime, where the score estimates transition from modeling coarse global structure to capturing fine-gram tineggrined, data-dependent details (Song et al.] 2021 Qian et al.) 2024). Recent work shows that the low-noise regime both carries most of the perceptual fidelity and is the regime in which models are most sensitive to dataset overfitting (Qian et al. 2024). Moreover, Pavlova & Wei (2025) systematically study denoising near the data manifold and report that inde- pendently trained denoisers can diverge significantly in the low-noise regime. This reveals local inconsistencies that do not appear at high noise levels. Together, these findings suggest that the low-noise regime is a highly informative phase of the denoising process, and thus is natural setting for studying memorization. Our work builds on this line of research by explicitly characterizing memorization in the low-noise regime and leveraging this for efficient denoising-fire memorization detection.
3 PRELIMINARIES
Score-based Diffusion Models Diffusion models (Sohl-Dickstein et al., 2015 Ho et al. 2020 Song et al.] T02T synthesize data by learning reverse gradual noising process. The core idea is to represent data generation as the inversion of a forward stochastic process that maps a complex data distribution, namely px(x). to a tractable prior, typically Gaussian, denoted by NO I). Let Xo ~ (x() be a training data sample. The forward process sequentially corrupts Xo using the noise model q until the sample reaches a state of pure noise XT (N( where T the number of noising timesteps. Formally, noising step is defined as:
((x.|xo)= = (xx Varxo, (1 (1-6,)I) GI)
where x, denotes the noisy data sample timestep t E T, a, II, Ba), and B, is the diffusion noise schedule at timestep t. In the continuous- time formulation, this process is governed by the forward stochastic differential equation (SDE):
dx, = f(x,, t)dt + g())
(2)
where f()) is the drift coefficient, g(.) is the diffusion coefficient, and w, denotes the standard Brownian motion. The reverse process follows the reverse-time SDE, and is formulated as:
dx. = [f(x,,t) ((Vx, log lx.))(x.)] di + g((( dw.,
where px(x,) is the marginal density of x, at time t, and w, is Brownian motion in reverse time. The term Vx, log (x:: is the gradient of the log-probability density and is defined score function
3

---

Published as a conference paper at ICLR 2026
t) == Vx, log Px which is approximated by neural network sa (x t). Upon training, new samples can be generated by simulating the reverse- time SDE using the learned score estimate Sg-
Additionally, for conditional generation, as in Stable Diffusion (Rombach et al. 2022). one aims to sample from the distribution pr(x/lc), where is the imposed condition (e.g. text prompt or
a class label). This can be done by estimating the score of the conditional log-probability density
6(,,, L c) == Xx, log Pt (xe(c) through incorporating the condition c in the denoising network se using classifier-free guidance (Ho & Salimans) 202T). The resulting score estimate is thus defined
as:
5(x,, t, c) = sx(xx, Ø) + [so(X,, t,c) (x+,, Ø)
(4)
conditioning term
where w 2 1 controls the strength of the conditioning, so(x,, t, @)) is the unconditional score esti- mate, *x(x,, c) is the conditional score estimate and [so(X,, () sx,,,, L, Ø)) is the conditioning term. Through Bayes' Theorem, this conditioning term (or guidance vector) essentially corresponds to the gradient of the log-probability Vx, log (c(xx, (Ho & Salimans 2021
Norm-based Memorization Detection Memorization in diffusion models occurs when the model reproduces data from the training either exactly or with only minor variations. In text-to-image diffusion models, this behavior is usually tied to particular text prompts and noise seeds, and can be mitigated by altering the prompt embedding or adjusting the noise initialization utilized in the gen- eration. Most of the recent breakthroughs in prompt-based memorization detection uti utilize the norm of the score function (Wen et al. 2024 Jeon al. 2025 Jain et al. 2025). Jeon al. (2025) showed that such norm-based methods essentially approximate the overall curvature of the underlying log- probability. This is because at medium or high noise levels, the norm of a score function provides an estimate of the trace of the Hessian, which is the sum of all Hessian eigenvalues. This is equal to the overall curvature of the log- trg--rbbbbblit... One popular metric, utilized by many approaches (Wen eet al.) 20244 Jain et al.) 2025 Jeon et al.) 20225), is the norm of the conditioning term, which is the difference between the conditional and unconditional score functions:
|| (x,, t, e)ll = [x,, f, -0((x, t)ll-
(5)
This metric builds on the observation that text prompts that lead to memorized sample (referred to as memorized prompts) exhibit stronger text-driven guidance, quantified by || (x,, f, c)]l Large val- ues of this norm are therefore indicative of memorization. [Jenn et al. (2025) further demonstrate that || (xt, f, eI reflects the extent to which guidance amplifies the curvature of the log-probability. Intuitively, for memorized cases, guidance sharpens the fog-probability landscape more aggressively than for non- non-meeorized cases. This results in a sharp peak in the log bog-prbbability. which is observed as signature of memorization.
4 METHOD
Consider a conditional diffusion model comprising a neural network and trained on the training set 'D = (== J= where N is the number of training samples. This network is learned estimate the gradient of the conditional log-probability density Vx, log.: (x+lc). using the score function 5(x,, c). Let me denote the text prompt, for which denoising through the trained network pe will lead to generating memorized sample, i.e., an identical sample in the training set associated with the same text prompt. Our objective is detect me without denoising through exploiting the anisotropy of log (x. Furthermore, we aim to mitigate memorization through a prompt augmentation scheme based on our proposed detection metric. To this end, we first motivate our method by explaining the relevance of anisotropy in memorization detection (Sec. 4.1). Next, we demonstrate the emergence of anisotropy in the low-noise regime, along with discussing the failure of previous norm-based detection metrics in anisotropy (Sec. 4.1 To rectify this, we first discuss the signatures of memorization in anisotropy (Sec. 4.2) and propose a novel memorization detection metric using the isotropic curvature and anisotropic angular alignment between the conditional and unconditional score estimates in the low-noise regime (Sec. 4.3). We finally utilize the proposed
metric in memorization mitigation strategy (Sec. 4.3
4

---

Published as a conference paper at ICLR 2026
4.1 ANISOTROPY IN LOG-PROBABILITY
We start by explaining the relevance of anisotropic log-probability in memorization detection. We know that in isotropic distributions, the curvature is the same in every direction. Hence, in the isotropic case, measuring the overall curvature of the log- pig-obbbbblltyy (such as in norm- based meth- ods) is sufficient for memorization detection, as there no directional variation exploit. This symmetry means that norm-based methods are inherently unable to extract any additional infor- mation beyond how curved or sharp the prg-pbbbbillty is. However, in anisotropic distributions, curvature varies by direction, meaning that some directions in the log-probability are much sharper than others. Thus, we hypothesize that including anisotropic information in memorization detection should yield better characterization of memorization.
Anisotropy in Low-Noise Regime We now analyze the anisotropy of the conditional log- probability density log Pt (x/(c) the denoising diffusion process. The curvature of this distribution can be characterized using the Hessian H (x,, c) == V2 log (xx]ec) (Jeon et al. 2025 We define an isotropic distribution as one that exhibits rotational invariance, implying that H (x, c) is propor- tional to the identity matrix I, i.e.. Hxx, c) - AI, where is constant representing the curvature. In this case, all eigenvalues of H (X,, c) are equal to A, mcaning that all directions in X, space have identical curvature. Therefore, the variance of the Hessian eigenvalues is almost zero in the isotropic case. Conversely, in the anisotropic casc, the curvature H (x,, c) varies across directions in the X; space, i.e. (x,, eigenvalues. Therefore, the anisotropic case exhibits high variance in the Hessian eigenvalues.
- A, where A is not proportional the identity, and therefore has unequal
We study in Figure 1 the anisotropy of log (x,lc) by analyzing the variance of the eigenvalues of (x,,,c) c) for each time step in pre-trained Stable Diffusion model (Rombach et al. 2022) given random prompt. We ob- serve that the variance of eigenvalues stays minimal dur- ing the high-noise regime when t is large, but exhibits larger variance in the low-noise regime, when t close to 0. This suggests that in the high-noise regime, the log- probability is mostly isotropic, but low noise, when the density closely estimates the data distribution, the log- probability steers towards anisotropy. The emergence of anisotropy in the low-n regime motivates our of score estimates in low noise as indicators of memoriza- tion.
Veriance of Eigenvalues for conditional leg-prebsbiilty
0.06
0.04
Eigemello
00.02
-0.04
50
Timestep
Figure 1: Variance of eigenvalues of the Hessian during denoising.
Failure of Norm-Based Methods in Anisotropy We now demonstrate that norm-based mem- orization detection methods only work effectively when the underlying log-probability density log (xx)ec) is isotropic in nature. Consider the case of simple conditional isotropic Gaussian Log-probabilit, density. In this case, log (x(: is defined as:
(x (c) = 20
|X Hc(e)]
(6)
where (c( and of are the mean and variance of the log- bog-probability at time t, and C' a constant. The score function s(x,,,, estimates the gradient of this distribution, which is:
1 (x, (r(c)).
8(x,, t, c) = Vx (x, (c)
of
Jeon et al. (2025) show that we can utilize the norm of the score function to characterize curvature, which is defined as:
1 ||x (c())l
|8xx,,,,, f, c)ll
o?
We observe that the norm [|o(x;, f, c) in the isotropic case only depends on the variance of and the distance from the mean ||x; pu (c)]l and not the direction. Thus, if memorized sample exhibits a very narrow, peaked density (exhibiting sharp curvature) around some data point, the gradient norm sensitive and direct indicator of memorization.
5

---

Published as a conference paper at ICLR 2026
Norm-Based (Wen's) Metric in Isetropy
Norm-Based (Wen's) Metric Anisstropy
2.-
Memorized
Memorizee
15
Dive sence 8, 8.1664
KL Dieergence 0.024
05
0.0
0.6
0.8
1.3
1.2
3.4
1.5
3.0
20
Figure 2: Histograms and Kernel Density Estimation (KDE) curves of Wen's norm-based metric ||s (x,, f, e)ll (Wn et al. 2024) in isotropy (t = T) and anisotropy (t = 0) under denoising free inputs (xr). We observe larger overlap of KDE curves in anisotropy compared isotropy, which indicates poor discrimination capabilities between memorized and non-memorized samples.
Now consider the anisotropic log-probability distribution of the form:
log (x, (c) - (c(c)) (x. pe(c)) +
(9)
where E, is the covariance matrix with non-identionl eigenvalues. Calculating the score function by taking the gradient of the heg-pobbability. we get:
8 L(x,, c) Vx, po = -i -xt((x-- (xx-<<((c))
(10)
Finally, taking the norm the score function, we get:
55xx, t, c)ll V (xt (,(c))² 2x, Mc(c)).
(11)
Since the covariance matrix has non-identical eigenvalues, we observe that [|5(x,, 6, e) depends on both the direction and the distance from the mean. Thus, in anisotropy, high norm in one direction can be compensated by a low norm another direction. Hence, the overall norm may not spike even if memorization is present, which might lead to false negatives. Therefore, norm- based methods are only effective under the assumption of isotropy in the underlying log-pre probability distribution. We experimentally validate this finding through plotting the histograms and Kernel Density Estimation (KDE) curves of the norm- norm-based metric by Wen et al. (2024). i.e., || (x, t, c for memorized and non-memorized cases in both isotropy and anisotropy. We additionally compare the Kullback-Leibler (KL) divergence of memorized and non-memorized distributions in each case. We observe from Figure that in isotropy, KDE curves have less overlap with a high KL Divergence (=0.166), indicating better discriminating capabilities of [| (x,,t, c) In contrast, this overlap is higher in anisotropy with a low KI. Divergence (=0.022), thus depicting the failure of norm-based metrics in the low-noise anisotropic case.
4.2 MEMORIZATION THROUGH ANGULAR ALIGNMENT
We now discuss memorization signatures in the low-noise anisotropic regime of the denoising pro- cess. Consider the denoising process of diffusion model using score estimates (Eq. By score decomposition, the denoising score under guidance can be written as
s9(X,, t, c; w) Xx, log (xx) + Vx, Px
(12)
Wen et al. 2024) show that in memorized cases, the conditioning term Vx, Pe has sig- niticantly larger norm than in non-memorized cases. Under guidance, this term is amplified by the guidance weight w, meaning that for memorized samples, the denoising trajectory is dominated by the conditional score rather than the unconditional score. Thus, the reverse process biased toward the memorized mode instead of the broader data distribution. This behaviour is also evident in the work from et al. (2025) where they show that applying guidance after certain timestep prevents memorization. This is because if the guidance is climinated during the early stages of denoising of a memorized case, the unconditional gradient Vx, log Pt (x;) steers the trajectory away from the memorized mode until the nearest mode for Vx, log (c(x:) is not memorized one.
This means that in the later stages denoising (low-noise regime) of memorized cases, the nearest mode for both lo (x,) and log Po (c|x,) should correspond to the memorized mode, hence the conditioning should merely reinforce the direction of the unconditional gradient without introducing new directions. To this end, consider the following theorem:

---

Published as a conference paper at ICLR 2026
Theorem Consider the anisotropic low-noise regime of diffusion and let Σ., Di be symmetric positive definite and vt := x, and := Pe denote the sample displacement from the unconditional mode and the relative displacement between the guidance mode and unconditional mode. Then,
sx(x;, t) = Xx log Pt (xx) == --, ot; Let and constants E, 2 0. Assume
(x t) Vxe loger(d = (2,' -2; )uz +2 " 8.
|| 2i Yyve - aos (x,, (x+, 1)ll S [x11s00(x,,1) ()]l and set r T 1. Then the cosine similarity satisfies
|| 51l S (x),)s0(xx,)))1
1-r
cos(se (Xt, t), sy (xe, (xx,t,c)
(13)
1+
The proof of this theorem provided in the Appendix Section A.11 This theorem provides lower- bound for the cosine similarity between Vx, log Pa (x+) and Vx, log (c(xx) using the relative dis- placement (6) between the guidance mode and the unconditional mode. Specifically, both the unconditional and guidance modes nearly coincide (6 - 0), the only deviation between sq (Xe, L, c) and scaled 5e (X,, 1) arises from differences in covariance, which are controlled by the approxima- tion error The resulting error term
+ I simplifies to r and the cosine similarity lower Itf' Thus, if E is small, the alignment between Vx, log (x) and Vx, log (c((x,) becomes high.
bound in the theorem becomes 1-
Remark Memorized cases exhibit small 5 and thus higher angular alignment between Xx, (xx)) and Vx, log in the anisotropic low-noise regime compared to non- memorized cases.
We empirically verify this by examining the angular alignment between the conditioning term xVx, log (c)))))) and unconditional log-probability (Vx, log (x.)) in the anisotropic low-noise regime (t ss 0) for both memorized and non-memorized samples. We utilize Stable Diffusion v1.4 for this analysis and plot the directions of respective gradients (Figure 3D) and the cosine similarity between these gradients in the form of a heatmap (Figure 3p). We observe that memorized sam- ples exhibit significantly higher alignment, and thus, intuitively. higher cosine similarity between the conditioning term and the unconditional score estimates. This means that for the memorized cases anisotropy, conditioning does not introduce new directions to the unconditional gradient. In contrast, non-memorized cases generally exhibit misaligned directions, implying weak or ran- dom angular correlation between Vx. log Pr (x.: and Vx, log Pe(c)x.) This behavior aligns with our theoretical prediction: in anisotropic neighborhoods surrounding memorized data, the condi- tional log org-robbabylity mode coincides with the mode of unconditional log- ogg-robabbility, producing high angular alignment.
4.3 DETECTION METRIC AND MITIGATION
Detection We know that memorization diffusion models manifests differently across the anisotropic and isotropic regimes of the denoising trajectory. Combining these regimes should allow us to exploit a more informative log-probability, which in turn should improve the characterization of memorization. Hence, formulate our denoising-free memorization detection metric incor- porating both regimes of the denoising process. For the case of the isotropic high-noise regime, we utilize the norm of the score difference I|s (x1, t, c)ll (Wen al. 2024), and for the case of anisotropic fow-n regime, we utilize the angular alignment (calculated using cosine similarity) between the conditioning term sg (x,, e) and the unconditional score estimate so s0(x,, f). Finally, we combine both metrics through weighted sum:
5 [XT, t 0),), s0(XT, t 0) 1
M(xr.c) = 71
+ 7/2
| ~ T, c)]l,
(14)
XT, (XT, t 0, sx(,x,, 0)||
norm score difference in isntropy
cosine similarity anisotropy
where 7/1 and 7/2 are parameters controlling the weight of each term, and (..-) denotes the dot prod- uct. Importantly, calculate metric artificially set timesteps 0 and = T using the same initial Gaussian noise sample Xy ~ (O, I), i... we do not run a reverse denoising trajectory and simply query the model at different noise levels.

---

Published as conference paper at ICLR 2026
Generated Images
Score Alignment
Cosine Similarity
S Pimins
Soe Pimiti
0.55
Memorized
Business
Business
so
0.0
WoRTOn
Wordin
20-
0.5
0
0.00
No a. B.nusss
No Bonuts Business
0225
Business
Worma
10
Non- Memorized
1,00
6.73
0.50
40
60
+3.00
(b)
Figure 3: Comparison of angular alignment between Vx. lx,);(x)) and Vx, (c(xx)) along with the heatmap of cosine similarity between them, for memorized and non-memorizer cases. (a) We observe a larger number of highly-aligned vectors for the memorized case compared to the non- memorized case, indicated through orange rings. (b) We observe generally a higher cosine similarity (indicated red regions) in the memorized case compared to the con-memorized case.
Inference-tinge time Mitigation Similar to Wen et al. (2024); Ross al. (2025), we mitigate memoriza- tion during inference through the prompt augmentation technique proposed by Wen et al. (2024). Specifically, we optimize text prompt embeddings at initialization through gradient descent using detection metric loss. Thus, our loss is defined as:
C(xT, c) M(xx,e)
(15)
After optimization, we obtain a prompt embedding et, which we utilize for generating non- memorized data through the denoising process.
5 EXPERIMENTS
Following the related work (Jeon et al. 2025 Ross et al. 2025 Jain et al. 2025), we evaluate our method under two standard tasks, namely memorization detection and inference-time mitigation. Stable Diffusion (SD) v1.4 and v2.0 (Rombach) ct al. 2022), whereas our mitigation evaluation performed through the recently developed mem- orization benchmark MemBench (Hong et al. 2025). Additionally, conduct ablation study in Appendix Section A.2 where we compare different formulations of our metric.
Our detection evaluation includes experiments
5.1 MEMORIZATION DETECTION
Experimental Setup Following Jeon et 2025), perform detection experiments by uti-
lizing 500 memorized text prompts for SD v1.4 and 219 memorized prompts for SD v2 provided
by Webster (2023). We additionally include 500 non- memorized prompts from Lexica (Shen al.
2024). GPT-4 (Achiam et al. 2023). COCO (Ln et al. 2014), and Tuxemon (Tsaban & Paul 2024). deettiaal to Jeon et al. (2025). Through these prompts, we calculate our detection metrie (Eq. 14] using two forward passes of the model (for t = 1 and t = T) for different runs, each with differ- ent seed and report the mean and Standard Deviation (StD) our results. We assess our detection metric through two standard measures, namely the Area Under the Receiver Operating Characteris- tie Curve (AUC) and the True Positive at 1% False Positive Rate (TPR @ 1%FPR). Additionally, we also report the time taken to caleulate the metries for 10 prompts in seconds. We consider cases for our experimentation, each with a different number generations (n). We compare our method with several denoising-free detection baselines, including the metric proposed by Ren al. (2024)
8

---

Published as a conference paper at ICLR 2026
Table 1: Comparison of denoising-free memorization detection methods on SD v1.4 and SD v2.0. We calculate our metric for 3 runs, each with different seed, and report the mean + standard deviation (StD). Here, n represents the number of generations and Time (sec.) represents the time taken to calculate the metric for 10 prompts in seconds. All results except Time are taken from Jeon jet al. (2025). The best numbers are indicated as bold and the second best numbers are indicated as underline.
vI.4
SD v2.0
Method
AUC
TPR @ SSPR
Time (sec.)
AUC
TPR @ SPFR 1
Time (sec.)
Ren 2024
0.846
0.116
0.05
0.848
0.07
Wen al
2024
0,976
0.896
0.40
0.948
0.739
0.80
Joon et al 2025
0.987
0,908
5,40
0,959
0,740
14.60
0.994
+40.000
0.935-0.002
1.10
0.953--0.016
0.791=:0.015
2.20
P.
4
Ren et al.
2014
0.839
0.130
0.05
0.853
0
0.07
Wen 2025
0,992
0,944
1,20
0,980
0.876
2.70
Jeon el al
0.998
0.982
19.40
0.991
0,895
56.40
M(xr,e c
(ours)
0.999=0.0011
0.984=0.002
3.40
0.981:1:00033
0.890 d: 0.009
7.30
utilizing cross-attention in text-conditioning. the norm-based metric proposed by Wen et al. (2024),
and lastly the sharpness-bar metric by [Jeon et al.] (2025). We perform additional experiments
on Realistic Vision (CivitAl 2023 in Appendix Section A.6 Additional experimental details are
provided in Appendix Section A.3
Discussion of Results Table I presents a comparison of denoising-frve memorization detection methods on SD v1.4 and SD v2.0 across different numbers of generations n. On SD v1.4, our method consistently surpasses previous methods across all metrics for both n = and n = 4. Specifically. it achieves state-of-the-art AUC scores of 0.994 (n = 1) and 0.999 (n 4), along with the highest TPR @ FPPP values of 0.935 (n = 1) and 0.984 (n = 4). Furthermore, it provides speedup of 4.91x (n = 1) and 5.71x (n = 4) over the next best method (Jeon et al.) 2025). This because, unlike the method from Jeon et al. (2025), ours does not require costly calculations of the Hessian of the log- peg-obbabiilty. On SD v2.0, Jeon et al. (2025) attains slightly higher AUC scores of 0.959 (n 1) and 0.991 (n 4) compared to our method's ' 0.953 (n 1) and 0.981 (n 4). However, our approach improves TPR &FPR by 5.1% in n = 1 case. In addition, offers a runtime speedup of 6.63x (n = 1) and 7.73x (n 4) over the previous best method. This showcases that our method possesses stronger detection capabilities under strict false-positive constraints and is very efficient. Moreover, we observe that the StD values of TPR @ FPPR are generally higher than AUC, indicating that TPR @ 1%FP is more sensitive to random seed. Lastly, although the approach from Wen et al. (2024) is on average Re 0.2 seconds faster per prompt than our approach, our method shows improvements of TPR @1 %PPR by up to 5.2% (average improvement of 3.6%) compared Wen et al. (2024), indicating better discriminating capabilities in edge cases. This is because our method combines independent predictors of memorization and thus, is more robust to these edge cases. We argue that this increment is critical, especially in scenarios where minimizing false negatives is more important than compromising the detection speed by Rs 0.2 seconds. Overall, these results demonstrate that incorporating anisotropy for memorization detection significantly improves the detection performance and offers more reliable approach under strict false-positive constraints, while also exhibiting a rapid pace.
5.2 MEMORIZATION MITIGATION
Experimental Setup We conduct our quantitative and qualitative evaluation on inference- mitigation through MemBench (Hong al., 2025). It utilizes a standardized prompt augmentation approach (as described in Section 4.3) for fair comparison of memorization mitigation strategies. We assess the mitigation strategy on SD v1.4 and SD v2.0 through our proposed metric by computing several metrics, namely SSCD Similarity Score (Pizzi et al. (022) to estimate the similarity between the generated sample and the memorized training sample, CLIP Score (Radford et al. 2021 1) to assess the text-imme mext-image alignment, and Aesthetic Score (Schuhmann et al. (022) to evaluate the quality of the generated image. For SD v1.0, we consider 3000 memorized prompts provided by Hong et al. (2025) and for SD v2.0, utilize 219 prompts provided by Webster (2023). We conduct our mitigation

---

Published as a conference paper at ICLR 2026
Can
REVeTA A4 St Spation
(a) v1.4
041
Qat
623
Prange Octoga Suetice ng. Thrca Miliae
(b) SD v2.0
(c) Qualitative results on SD vl.4
Figure 4: (a,b) Quantitative comparison of inference-tingg time mitigation methods SD v1.4 and SD v2.0. The evaluation is done across five distinct hyperparameter configurations. Lower values of SSCD Similarity and higher values of CLIP Score and Aesthetic Score desirable. (c) Qualitative comparison of inference-time mitigation strategies on SD) v1.4.
experiment total of five times, each with a different hyperparameter configuration. We compare the mitigation strategy through our metric with no mitigation, along with mitigation methods from Wen ct al. 2024) Ren et al. 2024), and Jeon et al. (2025). Additional details can be found in Appendix Section A.3
Discussion of Results The results of our mitigation experiments are shown in Figure Our quantitative results show a general trend demonstrated by all metrics that higher SSCD Similarity corresponds to a higher CLIP and Aesthetic Score, thus exhibiting a tradeoff between these metrics. Ideally, lower SSCD similarity with higher CLIP and Acsthetic score is favourable. For both SD vl.4 and SD v2.0, similarity, as well as between Aesthetic score and SSCD similarity. In particular, our method attains significantly lower similarity score than Wen et al. (2024) and Ren et al. (2024) while maintaining the same text-image alignment (CLIP score) as well as image quality (Aesthetic Score). Morover, Jeon al. 2025)) attains similar CLIP and worse Aesthetic score in SD v1.4, while attaining slightly higher CLIP and Aesthetic score in SD v2.0, but is also at least 7x slower (as shown in Table [T. In general, our results prove the effectiveness of our method in producing non memorizee high-quality images that are well-aligned with the text prompt. Additionally, our qualitative results demonstrate that our approach mitigates memorization more effectively than prior methods, generating high- quality images that are aligned with the text prompt and clearly distinct from the training image. We provide an exhaustive set of qualitative comparisons of our mitigation approach with the baselines in the Appendix Section
proposed metric achieves good trade-off between CLIP score and SSCD
6 CONCLUSION
In this work, we demonstrated that norm-based memorization detection metrics are only reliable under the assumption of isotropic log-probability distributions, which generally holds high or medium noise levels. This is because the norm-based metrics encode the overall sharpness of the log prg-rbbbbillty, while in anisotropic settings, the sharpness varies across directions, making the norm-based metrics ineffective. To address this, we proposed a denoising- detection metric that leverages both the isotropic and anisotropic nature of the log-probability. Our metrie is composed of the weighted sum of a) the norm of the guidance vector in isotropy and b) the cosine similarity between the guidance vector and unconditional score estimates anisotropy. Results from detection experiments Stable Diffusion v vl.4 ..4 and v2 show that our method outperforms prior denoising free approaches while remaining at least approximately 5x faster than the previous best approach. Lastly, inference-ting time mitigation experiments achieves a more favorable CLIP/Acsthetic and SSCD similarity trade-off, generating high-quality, non-memorized images that remain well aligned with the input text prompt.
Stable Diffusion v1.4 and v2 reveal that approach
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENT
We are sincerely thankful to the German National Science Foundation (DFG) for supporting and funding this work under the project Always-on Deep Neural Networks (grant number BE 7212/7-1 OR245/19-1). We additionally acknowledge the Erlangen National High Performance Com- puting Center (NHR@FAU) of the Friedrich-Alexan Alexander- Universität Arlangen-Nümbery (FAU) for providing computing resources.
Alexander-Universstäät
REFERENCES
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Ale- man, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023.
Rohan Asthana, Joschua Conrad, Youssef Dawoud, Maurits Ortmanns, and Vasileios Belagian- nis. Multi-conditioned graph diffusion for neural architecture search. Transactions on Machine Learning Research, 2024. ISSN 2835-8856. URL https: https://ppeerreieeew opw.reveeeeeeeeeeeeeeeeeee.ee..e net/ forum?
id 5VotySkajj
Jonathan Brokman, Itay Gershon, Omer Hofman, Guy Gilboa, and Roman Vainshtein. Track- ing memorization geometry throughout the diffusion model generative process. NeurlPS 2025 Workshop on Symmeiry and Geometry in Neural Reprexentations, 2025. URL https:
Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 5253-5270, Anaheim, CA, August 2023. USENIX Association. ISBN 978-1-999113337-33 URL https: /www. usenix org/
Chen Chen, Daochang Liu, and Chang Xu. Towards memorization-ffre diffusion models. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8425- 8434, 2024.
Chen Chen, Daochang Liu, Mubarak Shah, and Chang Xu. Exploring local memorization in diffu- sion models via bright ending attention. In The Thirleenth International Conference on Learning Representations, 2025. URL https:
net /tte//ormmmmmimmmmtaetaaa
CivitAI, Realistic vision. bttps://civitai:
2023. Accessed: 2025-11-20.
Agrim Gupta, Lijun Yu, Kihyuk Sohn, Xiuye Gu, Meera Hahn, Fei-Fei Li, Irfan Essa, Lu Jiang, and José Lezama. Photorealistic video generation with diffusion models. In European Conference Computer Vision, pp.
Springer, 2024.
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. In NewrIPS 2021 Workshop on Deep Generative Models and Downstream Applications, 2021.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-688 -855, 2020.
Jonathan Ho, Tim Salimans, Alexey Gritsenko, William Chan, Mohammad Norouzi. and David J Fleet. Video diffusion models. Advances in neural information processing systems, 35:8633- 8646, 2022.
Chunsan Hong, Tae-Hyun Oh, and Minhyuk Sung. Membench: Memorized image trigger prompt dataset for diffusion models. Transactions on Machine Learning Research, 2025. ISSN 2835- 8856. URL (tRttttps::/// pectpss:/openreviiee
forumm w
Anubhav Jain, Yuya Kobayashi, Takashi Shibuya, Yuhta Takida, Nasir Memon, Julian Togelius, and Yuki Mitsufuji. Classifier-free guidance inside the attraction basin may cause memorization. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 12871 2025.
11

---

Published as a conference paper at ICLR 2026
Dongjae Jeon, Dueun Kim, and Albert No. Understanding and mitigating memorization in genera- tive models via sharpness of probability landscapes. In Forty-second International Conference on Machine Learning. 2025.
net
Yue Jiang, Haokun Lin, Yang Bai, Bo Peng, Zhili Liu, Yueming Lyu, Yong Yang, Xingzheng, and Jing Dong. Image-level memorization detection via inversion- based inference perturbation. In The Thirteenth International Conference on Learning Representations, 2025. URL https:
7/ //openzeview.o //geeneeveee.net//oronnng http://ww......orooooo/ooo//////
Zahra Kadkhodaie, Florentin Guth, Eero P Simoncelli, and Stéphane Mallat. Generalization in diffusion models arises from geometry-adaptivv harmonic representations. arXiv preprint arXiv:2310.02555 2023.
Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision, pp. 740-755. Springer, 2014.
Xinyang Liu, Yilin He, Bo Chen, and Mingyuan Zhou. Advancing graph generation through beta diffusion. In The Thirleenth International Conference on Learning Representations, 2025. URL htttps://operree wttp://wwwee//oooomddiiiiiio
net/ www.rooroouuiiiiiomee x1nnmii--11AA
Elizabeth Pavlova and Xue-Xin Wei. Diffusion models under low-noise regime. arXiv preprint arXiv:2506.0784/ 2025.
Ed Pizzi, Sreya Dutta Roy, Sugosh Nagavara Ravindra, Priya Goyal, and Matthijs Douze. self- supervised descriptor for image copy detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14542, 2022.
Yurui Qian, Qi Cai, Yingwei Pan, Yehao Li, Ting Yao, Qibin Sun, and Tao Mei. Boosting diffusion models with moving average sampling in frequency domain. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8911-8920, 2024.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 8748-8763. PmLR, 2021.
Jie Ren, Yaxin Li, Shenglai Zeng, Han Xu, Lingjuan Lyu, Yue Xing, and Jiliang Tang. Unveiling and mitigating memorization in text-to-image diffusion models through cross attention. In ECCV (77), 2024.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Brendan Leigh Ross, Hamidreza Kamkari, Tongzi Wu, Rasa Hosseinzadeh, Zhaoyan Liu, George Stein, Jesse C. Cresswell, and Gabriel Loaiza-Ganes Ganem. geometric framework for understanding memorization in generative models. In The Thirteenth International Conference on Learning Representations, 2025. URL wwt.httpss.. : operrevi ew net/ corummiiiaaa 1aarummmm--222ll
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Bureu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural informa- fion processing systems, 35:36479-36494, 2022.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in neural in- fformatio processing systems, 35:25278-2555 2022.
Xinyue Shen, Yiting Qu, Michael Backes, and Yang Zhang. Prompt Stealing Attacks Against Text- to- Image Generation Models. In USENIX Security Symposium (USENIX Security). USENIX, 2024.
12

---

Published as a conference paper at ICLR 2026
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International conference on machine learn- ing. pp. 2256-2265, pmlr, 2015.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 6048-6055 2023a.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Under- standing and mitigating copying in diffusion models, Advances in Neural Information Processing Systems, 36:47783-47803, 2023b.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502. 2020.
Yang Song. Jascha Sohl-Dickstein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In Interna- tional Conference on Learning Representations, 2021. URL /ttpp:://pperrevieew.. net/
Linoy Tsaban and Sayak Paul. Tuxemon, 2024. Sstaaetts/diffuueess//teexeee
URL https://huginggaceee
Clement Vignac, Igor Krawczuk, Antoine Siraudin, Bohan Wang, Volkan Cevher, and Pascal Frossard. Digress: Discrete denoising diffusion for graph generation. In The Eleventh Inter- national Conference on Learning Representations, 2023.
Ryan Webster. A reproducible extraction of training images from diffusion models. arXiv preprint arXiv:2305.08694 2023.
Yuxin Wen, Yuchen Liu, Chen Chen, and Lingjuan Lyu. Detecting, explaining, and mitigating memorization in diffusion models. In The Twelfth International Conference Learning Repre- sentations, 2024. URL httpp:://peerevieee net htt.://www....eeoooomoooa//aaaaa
13

---

Published as a conference paper at ICLR 2026
A APPENDIX
A.1 PROOF FOR THEOREM
1
By definition,
5g (xx, (c) =E=," Sig
)u4 + Eig 6. "
(16)
By assumption, there exists a > such that
(ET Σ ) ase (x4; A1,
| S (x)
(17)
and
2 8 D2:
| S Tallsa (xc: t)ll.
(18)
Thus,
8. as Xt. + A + 2 (x,, 1) A
(19)
where = + A2 satisfies
|||| S (s+ (=+ = ra]1=a tx/l t)[l-
(20)
The cosine similarity is
(so f), as (asaaxxxx 8) + A)
cos(so t), t) (x),t,)))
(21)
|| t)ll ( t) + All
For the numerator,
(), + A (x t)|1 (se(xe, t),
(x (x, 1)1 || ||
(22)
z (1 r) (x,; 1)
For the denominator,
(x,, + All S axlso((x,))) +|||+ ||||| S (1 + saallsss
(23)
Therefore,
(1 - (1-r)allsa(xx t)|l
1-r
cos(so(2x) t), sht t,))
(24)
|| (x,, 1) + r) s8 (x,, t)l 1 1+r"
This completes the proof.
A.2 ABLATION STUDIES
A.2.1 COMPARING DIFFERENT FORMULATIONS
We now compare different formulations of our detection metric. For this, we perform our detection experiments on SD vl.4 and SD v2.0 (discussed in Section (.I] on various formulations. Specifi- cally, we consider the cosine similarity between a) V log pa (xx) and V log (r(c)).) (original formu- lation); b) V log Pa (x:) and V log P. (x, |c); and lastly V log Pe (x, lc) and V log Doogee(cl (c)x,). Identical to the Section 5.1 we report the Area Under the Receiver Operating Characteristic Curve (AUC), along with the True Positive 1% False Positive Rate (TPR@ 1%FPR) for two cases, namely for number of generations n = and 4. The results are reported in Table
We observe that the formulations cos( V Pe (c), Pe V (clx)) (original formulation) achieve the best overall performance, however the difference between all formulations is only marginal. Importantly, the best two formulations achieve exactly the same performance. This is because as we can observe from Eq. 12 the conditional score (x,, t, w) = V log Pt (x, Ic) differs from the unconditional score Log (Xx) only by the term V log (c)x)x), which has high alignment with V log pı (c/x.). This causes both formulations to end up capturing essentially the same directional information, leading to identical results.
and
14

---

Published as a conference paper at ICLR 2026
Table 2:
Comparison of different formulations of our proposed metric on SD v1.4 and SD v2.0.
Here, represents the number of generations.
SD v1.4
SD v2.0
Method
AUC 1
TPR@ TPR@1%FPR t
AUC 1
TPR @ I&FPRR
cos(
log Pe x V lo (x, c))
0.980
0.908
0.952
0.753
co8(
log Pe x c). v Tog (c(x)))
0.992
0.934
0.952
0.749
cos
V po
log (c/x)) (original)
0.992
0.934
0.952
0.749
cos
po [x] V po X c))
0.993
0,940
0.980
0,904
cos
V log X c). v
log p: (c(x))
0,999
0.984
0.981
0,900
008
log
log (c)x,) (original)
0.999
0.984
0.981
0.900
A.2.2 CONTRIBUTION OF EACH COMPONENT
We perform an ablation study to assess the individual contributions of the two components in our metric, i.e., the norm of the score difference in isotropy and the cosine similarity in anisotropy. Specifically, we evaluate two modified configurations of the metric, one where we set " = 0, and another where we set 72 O. For each configuration, the same protocol described in Section 5.1 We report the AUC and TPR @ 1%FPR for (n = 1) and (n summarized Table We observe that the norm of the better than cosine similarity. However, the combination of the two terms exceeds the performance of both terms individually. Specifically, we find that the cosine similarity performs worse in SD v2.0 compared to SD v1.4. This is because the memorized prompt set for SD v2.0 consists mostly of local memorization cases, where only some parts of training set are memorized. mode displacement ò between log (xx) and log Pt (c(x,) is large because the other non-meoriieed features increase the mode distance. Hence, the cosine similarity becomes lower, and the alignment is no longer reliable metric. Therefore, the combination of these metrics is necessary for robust local memorization detection and mitigation.
run detection experiments following
difference generally performs
these cases, the
Table 3: Comparison of individual components of our proposed metric on SD v1.4 and SD v2.0. Here, represents the number of generations.
SD AUC
SD v2.0
Method
TPR@ I&EPR
AUC
TPR@ 1&FPR 1
Norm of the score difference in isotropy
0.976
0.896
0.948
0.739
Cosine similarity in anisotropy
0.923
0.424
0.779
0.416
Combined (ours)
0.992
0.934
0.952
0.749
n
Norm of the score difference in isotropy
0,992
0.944
0.980
0,876
Cosine similarity in anisotropy
0.939
0.440
0.785
0,401
Combined (ours)
0.999
0.984
0.981
0.900
A.2.3 ABLATING NORMALIZATION AND TIMESTEP
We now conduct ablation where analyze the robustness of our approach when using different normalization methods and different timesteps / for computing cosine similarity. Specifically, we consider L1, I.2 and spatial 1.2 normalization, along with timesteps 1, 3. Here represents the DDIM timestep. We utilize SD v1.4 and SD v2.0 for these experiments for n = 1 case. The results can be observed in Table 4 The results demonstrate that our approach is robust across all the cases in both SD v1.4 4 and SD v2.0.
A.3 EXPERIMENTAL DETAILS
A.3.1 FIGURE 2 EXPERIMENT
To empirically demonstrate the failure of norm norm-based methods in anisotropy, we conduct the Figure 2 experiment comparing Histograms, KDE curves, and KI. Divergence with respect cases,
15

---

Published as a conference paper at ICLR 2026
Table Our metric on different normalizations and timesteps SD v1.4 and SD v2.0 for 1.
SD v1.4
SD v2.0
Method
AUC
TPR 1%FPR
AUCT
TPR 1%FPR
Normalization
L1
0.997
0.950
0,937
0.804
L2
0.997
0.950
0,937
0,804
Spatial L2
0.995
0.934
0.932
0.806
Timesteps
t=1
0.993
0.934
0,953
0.800
0.987
0.862
0.933
0.794
0.985
0.860
0.933
0.805
isotropy and anisotropy. For both isotropy (t R T) and anisotropy (1 Rz 0), we consider a denoising- free scenario, i.e., we utilize pure noise XT inputs to calculate Wen's metric. The experiment conducted on Stable Diffusion vl.4, and we utilize the same 500 memorized prompts and 500 non-memorized prompts in the detection experiments. In anisotropy. metric larger than 2.0 to improve the visibility the visualization. The KDE and KL Divergence calculated using the SciPy library, and plots are generated using Matplotlib.
clip the values of the
A.3.2 DETECTION
We run our detection experiments with Python 3.11.5 on a single NVIDIA RTX A6000 GPU with 48GB VRAM. Moreover, we utilize DDIM Sampler (Song et al. 2020) for denoising. For identify- ing the optimal values 71 and 72 SD 1.44 and SD v2.0, we a simple Logistic Regressor once on small set (of size 20) of memorized prompts. Then, of our detection and mitigation experiments. We utilize the diffusers library with 'Comp Vis/tablle diffusion-vI-4 for loading SD v1.4 and HuggingFace. Our evaluation protocol for detection identical to the one provided by Jeon et al. (2225). For reporting the time taken by metrics, consider the time between the start of the first forward pass of the model and when the metric has been calculated. In Table 5 we provide the hyperparameter values for all of detection experiments.
the found optimal values for all
for loading SD v2.0 from
Table 5: Hyperparameter values for detection experiments.
Hyperparameter
SD v1.4
SD v2.0
?1 ?2 Random Seed
2.0
0.1
1.0
1.0
42
42
Guidance Scale (w)
7.5
7.5
Inference Steps (7)
50
50
A.3.3 MITIGATION
Our mitigation experiments conducted using Python 3.11.5 single NVIDIA RTX A6000 GPU. We utilize the memorization mitigation benchmark MemBench (Hong et al., 2025). which provides a standard evaluation for all the methods for SD vl.4 and SD v2.0. We run the mitigation experiments on our approach with 5 distinct hyperparameter configurations. The configurations are provided in Table
A.4 EXPLANATION ON TIMESTEP MISMATCH
natural concern is why our metric remains informative when we deliberately evaluate the model at ~ O. (low-noise regime) while inputting high-noise latent In principle, this creates mismatch, i.e., the model is conditioned on an early timestep. but the provided input xy is far from the data manifold. We argue that one plausible explanation for why probing model at t while inputting high noise works so well in memorization detection because memorization encoded in the learned loo-boibyyylity of the trained model and is mostly independent of the input sample
16

---

Published as a conference paper at ICLR 2026
Table Five distinct hyperparameter configurations for our mitigation experiments on SD v1.4 and
SD v2.0.
Config
Learning Rate
Iterations
Optimal Loss
Guidance Scale (w)
SD v1.4
1 0.05
50
50
-1.0
7.5
2
0.05
50
-0.4
7.5
3
0.05
50
2
-0.2
7.5
4
0.05
50
1
-0.2
7.5
5
0.03
50
1
-0.2
7.5
SD
v2.0
0.05
50
10
-.0
7.5
2
0.05
50
5
-1.0
7.5
3
0.05
50
3
-1.0
7.5
4
0.05
50
2
-1.0
7.5
5
0.05
50
1
-1.0
7.5
as also demonstrated in Jeon et al. (2025). This means that when the model is conditioned on t= and memorized prompt, the signatures of memorization become prominent even if the input sample X₃ is pure noise (xr). We empirically found that the high angular alignment (which is the signature of memorization in anisotropy) is present regardless which denoised sample we use, i.c. can ideally probe the model at = O and use 2T (without intended mismatch) and could still detect memorization. However, this would require a denoising process which our method does not need. Though this is intuitive explanation of the observed phenomenon, we believe that proving this intuition mathematically is outside the score of the paper and an interesting future work.
A.5 LIMITATIONS AND FUTURE WORK
While our results demonstrate the superior performance and efficiency of the proposed method, there are some limitations to our approach. First, the optimal values of 71 and 72 used to report our results were determined specifically for SD v1.4 and SD v2.0. However, simple choices (c.g., "1 1, 1/2 1) generalize reasonably well across models with only minor performance degradation. To verify this, compare results using values provided in Table [ with the results when using arbitrary y values, specifically 71 = and 72 = 1. The results are available in Table
empirically found that
Table 7: Comparison of different values of and 72 in our proposed metric. Here, represents the number generations.
SD v1.4
SD v2.0
Method
AUC
TPR 1%TPR T
AUC
TPR 1%PPP
n
1
Original 7 values from Table S
0.992
0.934
0.952
0.749
71, 722
0.990
0.918
0.949
0.721
4
Original y values from Table 5
0.999
0.984
0.981
0.900
71, 72
0.997
0.974
0.979
0.868
We observe that the difference in performance between the two hyperparameter configurations is minimal. Hence, simple choices of 71 and 7/2 generalize across models, and our approach does settings, recommend
not heavily rely the configurations of Y and 72. When scaling that one can always start with arbitrary y values to identify some memorized prompts and then later tune these weights maximize the detection performance.
Another limitation of our work that it does not focus on the distinction between local and global memorization. Specifically, the alignment component of metric is less reliable in the cases of local memorization (as observed from Table Therefore, developing a metric for local and global memorization that considers both anisotropy and isotropy, be an interesting future research
17

---

Published as a conference paper at ICLR 2026
direction. Lastly. like previous works, evaluation only covers SD vl.4 and SD v2.0 due the unavailability memorized prompts data for other newer models, such as SD v3. Hence, future work could focus on identifying memorized prompts in newer large-scale models to enable more extensive evaluation.
A.6 ADDITIONAL QUANTITATIVE RESULTS
To demonstrate the generalizability of our proposed metric beyond Stable Diffusion v1.4 and v2, we conduct our detection experiments on Realistic Vision v5.1 (CivitAl, 2023). We utilize the matching verbatim (MV) prompts from Webster (2023) for our experiments and compute our metric for 3 runs, each corresponding to different seed. We report the AUC and TPR @ 1%FPR for number of generations n and n = 4, along with the time taken by our metric for 10 prompts in seconds in Table g
Table 8: Performance of our proposed metric on Realistic Vision v5.1. Here, n represents the number of generations, and Time (sec.) represents the time taken for 10 metric calculations in seconds.
Method
AUC 1 0.967 = 0.003
T 1%PP 1 Time (sec.)
AUC 1
TPR TSPP
Time (sec.)
M(xT. c) (ours)
0.778 + 0.002
1.1
0.975 = 0.002
0.756 = 0.004
3.4
We observe that method retains its detection capabilities in the Realistic Vision model, with AUC above 0.96 and TPR @ 1%PR above 0.75. Hence, these results demonstrate the generalization capabilities of our proposed metric beyond SID v1.4 and SD v2.0.
A.7 ADDITIONAL QUALITATIVE RESULTS
We present additional visual results for our mitigation experiment in Figures 5 and 6 We qualita- tively compare our approach with the methods from Ren et al. (024) and Wen et al. (2024). We observe that our approach mitigates memorization more effectively than previous approaches by producing images of high quality that are well-aligned with the text prompt and distinct from the training image.
18

---

Published as a conference paper at ICLR 2026
Training Image
Ren al.
Wen
Jeon et al.
Ours
Prompt: Emma Watson to play Belle in Disney's <i>Beauty and the Beast</i>
Prompt: Stephen Colbert Gets His Face on a Bottle with Col Brew Coffee
K
Prompt: Octopus Swimming Throw Pillow
PARK STICK
I
Prompt: <em>South Park: The Stick of Truth</ems Review Paati--Paatfrmm
MIZ
DUE CA
By Seeriia
Prompt: <i>Breaking Bad</D Fans Get Chance Call Saul with Albuquerque Billboard
Prompt: If Barble Were The Face of The World's Most Famous Paintings
Figure 5: Qualitative comparison of inference-tima mitigation approaches on SD v1.4. Specifically, visualize the memorized training image (left-most), along with the mitigated generated images by the methods from Ren et al. (2024), Wen et al. (2024). Jeon et al. (2025), and our method (right- most).
19

---

Published as a conference paper at ICLR 2026
Training Image
Ren
Wen al.
Jeon et al.
Ours
Prompt: Björk Explains Decision <i>Vulnicura</i> From Spotify
Prompt: Talks on Precepts Buddhist Ethics
Prompt: Foyer painted WHITE
Prompt: As Punisher Joins <b>Daredevil</>> Season Two, Who Will the New Villain Be?
Prompt: Renegade R5S Laptop Backpack View 41
Prompt: Design Art Beautiful View of Paris Paris Eiffel Towerunder Red Sky Ultra Glossy Cityscape
Circle Wall Art
Figure 6: Qualitative comparison of inference-time mitigation strategies on SD v1.4. We show the memorized training image (left-most) alongside the mitigated generations by the approaches of Ren et al. 2024), Wen et al. (024)) Jeon et al. (2025). and our method (right-most).
20


Reviews:
[{"review_id": "NfMrRJZrz8", "reviewer": "Reviewer_WjxY", "summary": "This paper addresses memorization in text-to-image diffusion models, a phenomenon where models reproduce training samples. The authors argue that existing norm-based memorization detection methods, which rely on the magnitude of score estimates, implicitly assume isotropic log-probability distributions, an assumption that holds mainly in high- or mid-noise regimes. The paper identifies that in low-noise (anisotropic) regimes, memorization manifests instead through strong angular alignment between conditional and unconditional score functions. Based on this insight, the authors propose a new denoising-free memorization detection metric that combines (1) the cosine similarity between guidance and unconditional score vectors in the anisotropic regime and (2) the score-norm difference in the isotropic regime. This metric requires only two forward passes (conditional and unconditional), making it substantially faster than prior methods. Experiments on Stable Diffusion v1.4 and v2.0 show improved AUC and TPR@1%FPR compared to previous denoising-free baselines, with up to 5× speedup. The method is also used for inference-time mitigation via prompt augmentation, demonstrating improved trade-offs between similarity, CLIP, and aesthetic scores on MemBench.", "questions": "See the above strengths and weaknesses.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The paper is well-organized, making it easy to follow. The visualizations clearly illustrate the messages and insights it wishes to deliver.\n2. This paper contributes to privacy-preserving text-to-image diffusion models, which are practically significant for preventing copyright risks.\n3. The proposed metric’s efficiency (denoising-free and fast) makes it appealing for large-scale model auditing. \n4. The paper introduces a new theoretical and empirical perspective on diffusion model memorization by analyzing the anisotropy of log-probability. The conceptual shift from norm magnitude to angular alignment in the low-noise regime is novel and well-motivated. The derived connection between isotropy, anisotropy, and curvature sharpness is mathematically supported and empirically verified.\n5. Experimental results are comprehensive, covering multiple Stable Diffusion versions, standard benchmarks, and ablations. Comparisons include strong baselines and standard metrics.", "weaknesses": "1. The paper could benefit from additional discussion on whether the proposed metric generalizes across architectures beyond SD v1.4/v2.0.\n2. Although Appendix A.4 shows some robustness, the weights are empirically tuned per model, suggesting potential calibration issues when scaling to new settings.\n3. The proposed cosine-similarity measure is intuitive but may be sensitive to normalization choices. A sensitivity analysis on score normalization or noise schedule parameters would strengthen the robustness claims.\n4. Despite being well-organized, there are several equations in the paper that remain unlabelled on page 5 (between equations 5 and 6).\n5. The discussion on Figure 2’s overlap could benefit from quantitative metrics (e.g., KL divergence between distributions).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "qHeeRIET79", "reviewer": "Reviewer_y8dV", "summary": "The paper investigates memorization in text-to-image diffusion models and argues that existing norm-based detection methods only work under isotropic log-probability assumptions, which is the case for high or medium noise levels. It formalizes how anisotropy arises in the low-noise regime and proposes a new denoising-free metric that is defined as the cosine similarity between conditional and unconditional score estimates. This new metric is combined with the known “isotropic term” - norm of the guidance vector. The method requires only two denoising steps (only noise estimation, not real denoising). The method improves AUC and TPR (at 1% FPR) on Stable Diffusion v1.4/v2.0. It also integrates the metric into an inference-time prompt-optimization scheme for mitigation, evaluated on MemBench.", "questions": "1.\tGiven that prior methods already achieve near-saturated AUC/TPR, how do you justify the significance of the contribution beyond small numerical gains (with x2-3 in latency)?\n2.\tSince your claimed speed-up is only relative to a single denoising-free baseline, and simpler non-denoising-free methods remain faster with comparable performance (Wen et al.), can you clarify in what scenarios your method is actually the preferred choice in practice?\n3.\tRegarding the t=0 probe using high-noise latents - the model is inputted a high-noise latent but set with t=0, meaning the model “believes” it is operating at the end of the denoising process, which the authors showed is the low-noise regime. However the actual noise latent is far from the data manifold. Can you explain why a cosine similarity computed under this deliberate mismatch, based on what the model thinks rather than the actual noise level, should remain reliable and theoretically meaningful for detecting memorization (as empirically demonstrated)?\n4.\tAblation - table 3 (in the Appendix) shows that gamma_1 differs is 2 and 0.1in  SD v1.4 and SD v2.0, suggesting that the anisotropy term is unstable and requires model-specific tuning.  Can you explain why such tuning is necessary, and can you provide an ablation where we can understand the individual contribution and necessity of each component (gamma1 =0  and gamma2=0 in separate settings)?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.\tSound theoretical framing. The analysis clearly connects memorization signatures to the isotropy and anisotropy regimes of the log-probability, filling a conceptual gap in prior isotropic norm-based methods.\n2.\tEfficient and simple metric. The proposed anisotropy-aware score is computationally cheap (two model steps, no actual denoising) yet achieves higher detection accuracy.\n3.\tThe method is not limited to detection, it also demonstrates practical mitigation by optimizing prompt embeddings, producing non-memorized images while maintaining text alignment and aesthetic quality.", "weaknesses": "1. The reported “speed-up” is only shown relative to one denoising-free baseline, while simpler existing methods remain faster with no meaningful loss in performance, limiting the practical efficiency benefit of the proposed approach.\n2. Incremental improvement weakness: AUC/TPR gains are marginal because prior methods already near saturation, making the contribution incremental rather than substantively advancing the state of the art, even if the method itself is technically sound.\n3. No code to allow future comparison, and no indication that it will be provided in the future (Wen et al., which the authors compare to, do provide code). I urge the authors to add code so that their work will be maximally helpful to others. \n4. The imporovements are small. For mitigation the improvement looks more consistent, and for detection, Wen et al. are (~3x) faster and slighty worse, while Jeon et al. are on par and much slower (~6x). \n5. Minor - Equation 8 typo: the unconditional score in the cosine similarity term should not have “c” in it.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "76UHL22t1J", "reviewer": "Reviewer_Kb53", "summary": "The paper studies memorization in diffusion models through the lens of anisotropy in the log-probability landscape. It argues that prior norm-based metrics are only effective under isotropy and introduces a denoising-free detection metric that combines (i) cosine alignment between conditional and unconditional scores in the anisotropic regime and (ii) score-norm magnitude in the isotropic regime. The method requires only two forward passes—conditional and unconditional—and is shown to outperform existing denoising-free metrics on Stable Diffusion v1.4 and v2.0 while being significantly faster.", "questions": "Please see weaknesses above.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "•\tThe identification of anisotropy as a key factor in memorization detection is conceptually strong and empirically supported (variance of Hessian eigenvalues increasing toward low noise).\n\n•\tThe method is denoising-free, computationally efficient, and integrates both magnitude and directional cues.\n\n•\tExperiments follow prior evaluation standards and report competitive or superior results. Using new designated bencharks such as MemBench is also a bonus.", "weaknesses": "•\tThe section titled “Failure of Norm-Based Methods in Anisotropy”\t starts with “We now prove…” However it does not constitute a formal proof. Rephrase to “demonstrate” or “show analytically” or similar.\n\n\n\n•\tIn Table 1, please report standard deviations or confidence intervals. With 500 prompts, small improvements (such as the +0.001 AUC over Jeon et al. at n = 4, SD v1.4) may fall within statistical noise.\n\n\n\n•\tFig. 3 (a), (b) should be key visualizations supporting the main hypothesis - however they are insufficiently explained.\n\n\n\n•\tQualitative examples of generations with mitigated memorization are absent. Please provide such a comparison with the competitors. In addition, it is preferable to add an exhaustive set of such generations to the appendix.\n\n\n\n•\tPlease refer to the concurrent [1], which employs a different criterion that similarly emphasizes direction over magnitude. The numerical computation of its curvature criterion sums angles (cosines) between the conditioning score and surface normals. Clarifying how this differs from your approach, and whether it fits within your anisotropic framework, would aid contextualization for future reference.\n\n\n\n•\tPlease acknowledge [2] in the related work. The claim that “this phenomenon was firstly identified by Somepalli et al. (2023a)” overlooks [2], which concurrently with Somepalli et. al, demonstrated training data extraction (memorized samples) from diffusion models. \n\n\n\n•\tThe inference-time mitigation description lacks clarity - reducing reproducibility. Please specify how γ₁ and γ₂ were selected and how the score at ($t \\approx 0$) is obtained without full denoising (a clarification in the Appendix would suffice).\n\n\n\n-----\n\n\n\n[1] Brokman et al. (2025). Tracking Memorization Geometry throughout the Diffusion Model Generative Process. NeurIPS 2025 Workshop on Symmetry and Geometry in Neural Representations.\n\n\n\nLink: https://openreview.net/forum?id=4XSVk26sHj\n\n\n\n[2] Carlini et al. (2023). Extracting Training Data from Diffusion Models. USENIX Security Symposium.\n\n\n\nLink: https://www.usenix.org/conference/usenixsecurity23/presentation/carlini", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Op2gviMx4u", "reviewer": "Reviewer_sxxs", "summary": "The paper proposes a memorization detection (and mitigation) method for Stable Diffusion models that prioritizes angular alignment of scores over their norms, especially in the low-noise (late) phase of generation. It is positioned as a generalization of prior work (e.g., Wen 2024; Jeon 2025): earlier metrics largely emphasize the magnitude of a (conditional - unconditional) score difference, whereas this paper argues that direction (cosine similarity) carries the decisive signal under anisotropic noise. Empirically, the paper reports detection gains and mitigation impacts, but several theoretical claims and some experimental details need strengthening.", "questions": "See weaknesses", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. Conceptually extends prior works (Wen 2024; Jeon 2025) to anisotropic noise settings in diffusion models. \n2. Provides initial empirical evidence suggesting angular features may correlate better with memorization risk.", "weaknesses": "1. The theoretical argument for “angular alignment is important” (Remark 1, Sec. 4.1) lacks rigor; Appendix A.1 remains heuristic without formal derivation or proof.\n2. Confuses the norm of the score with the norm of the score difference; prior methods are not clearly distinguished. \n3. The key computation $s(X_T, t\\approx 0, c)$ is conceptually inconsistent, evaluating the final-time score on the initial noise requires justification or on-manifold correction.\n4. Experimental details (Figure 2 setup, time-step sampling, model version, datasets) are missing, making reproduction difficult. \n5. Comparison with Jeon 2025 mitigation results is absent, weakening empirical completeness. \n6. Overall, the method’s novelty is somewhat limited without stronger theoretical grounding or broader validation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)