Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
Authors: Dongjae Jeon
Dueun Kim
Albert No
Venue: ICML 2025 spotlightposter (2025)
Keywords: Diffusion Model
Memorization
Sharpness Aware
Primary area: deep_learning->generative_models_and_autoencoders
TL;DR: We propose a sharpness-based framework to analyze and mitigate memorization in diffusion models through novel metrics and initial point adjustment strategies.

Abstract: In this paper, we introduce a geometric framework to analyze memorization in diffusion models through the sharpness of the log probability density. We mathematically justify a previously proposed score-difference-based memorization metric by demonstrating its effectiveness in quantifying sharpness. Additionally, we propose a novel memorization metric that captures sharpness at the initial stage of image generation in latent diffusion models, offering early insights into potential memorization. Leveraging this metric, we develop a mitigation strategy that optimizes the initial noise of the generation process using a sharpness-aware regularization term.
The code is publicly available at https://github.com/Dongjae0324/sharpness_memorization_diffusion.

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
Dongjae Jeon
Dueun Kim *2
Albert No 2
Abstract
cerning when models are trained sensitive data, leading to privacy risks (Orrik) 2023 Joseph Saveri (023). Address- ing memorization is critical for ensuring the responsible deployment of generative models in real-world applications.
In this paper, we introduce geometric framework to analyze memorization in diffusion models through the sharpness of the log probability density. We mathematically justify previously proposed score-difference-bass based memorization metric by demonstrating its effectiveness in quantifying sharpness. Additionally, we propose novel memorization metric that captures sharpness at the initial stage of image generation in latent diffusion models, offering early insights into potential memorization. Leveraging this metric, we develop a mitigation strategy that optimizes the initial noise of the generation process using a sharpness-aware regulariza- tion term. The code is publicly available Petps://ggithe com Daw.:///0nnaa000 sharpness Setrppess_memorrre zat fnsion
Previous work has sought to analyze memorization using various approaches, including probability manifold analysis via Local Intrinsic Dimensionality (LID) (Ross et al. 2024
Kamkari al. 2024), spectral characterizations (Ventura ct al. [024 Stanczuk et al.
2024). and score-based based discrep- Additionally, attention-
ancy measures (Wen et al.
2024
based methods have been used to examine memorization at the feature level (Ren al.
2024
Chen et 2024).
In this work, we propose general sharpness based frame- work for understanding memorization in diffusion models. Specifically, we observe that memorization correlates with regions of sharpness in the probability landscape, which can quantified via the Hessian of the log probability. Large negative eigenvalues of the Hessian indicate sharp, isolated regions in the learned distribution, providing a mathemati- cally grounded explanation of memorization. Furthermore, show that the trace-based eigenvalue statistics serve as a robust early-stage indicator of memorization, enabling detection at the initial sampling step of generation.
1. Introduction
Recent advancements in generative models have signifi- cantly improved data generation across various domains, including image synthesis (Rombach et al.
2022), natural
Our framework also provides a justification for score based metric by interpreting through the lens of sharpness, re- inforeing its validity as memorization detection metrie. Building on this, we propose an enhanced sharpness mea- with additional Hessian components, improving sensi- tivity, particularly at the earliest stages of sampling.
language processing (Achiam et al. 2023
Touvron al. 2024). Among
2023), and molecular design (Alakhdar et al.
these, diffusion models (Ho et al. 2020 Song et al. 2021c have emerged as powerful frameworks, achieving state-of- the-art results by iteratively refining noisy samples to ap- proximate complex data distributions (Song et al.) 2021b
Saharia et
2022 Rombach et al., 2022).
Beyond detection, we introduce an inference-time mitiga- tion strategy that reduces memorization by selecting ini- tial diffusion noise from regions of lower sharpness, Our method, Sharpness-Awe Aware Initialization for Latent Diffusion (SAIL), utilizes sharpness metric identify initializa- tions that avoid trajectories leading to memorization. By simply adjusting the initial noise, SAIL steers the diffusion process toward smoother probability regions, mitigating memorization without requiring retraining. Unlike prompt modifications, which can negatively affect generation qual- ity, SAIL reduces memorization by carefully selecting the initial noise while fully preserving the conditioning inputs.
Despite their successes, diffusion models suffer from mem- orization, where they replicate training samples instead of generating novel outputs (Carlini et al.) 2023) Somepalli et al. 2023b Webster 2023). This issue is especially con-
'Equal contribution 'Department of Computer Science, Yonsei University, Seoul, Korea 'Department of Artificial Intelligence, Yonsei University, Scoul, Korca, Correspondence Albert No <albertno@ yonsei.ac.kr
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
We validate our approach through experiments on a 2D toy dataset, MNIST, and Stable Diffusion. Our results show that Hessian eigenvalues effectively differentiate memorized from non- mon-memori samples, and our sharpness measure provides a reliable metric for memorization detection, Addi- tionally, we demonstrate that SAIL mitigates memorization while preserving generation quality, offering a simple yet effective solution for reducing memorization.
our perspective is conceptually aligned with recent geomet- ric interpretations (Ross et al.] 2024 [hhattacharjee et al.) 2023), our methodology diverges fundamentally by ana- lyzing sharpness in the learned density, without relying on assumptions about an inaccessible ground-truth distri- bution. In contrast to manifold -based analyses that track variations individual feature components (Ventura et al., 2024 Achilli et al., 2024), we show that sharpness, treated an aggregated statistie, can be effectively estimated and used for detecting memorization. Moreover, unlike LID- based methods (Ross et al. 2024) that are restricted to the final denoising step, our approach reveals that memorized samples persistently occupy high-sharpness regions through- out the diffusion process. This allows for earlier detection and targeted intervention, enabling a more proactive and interpretable strategy for mitigating memorization.
In summary, our key contributions are:
We propose a sharpness- framework for analyz- ing memorization in diffusion models, examining the patterns of Hessian eigenvalues and their aggregate statistics to characterize memorized samples.
We provide a theoretical justification for the memoriza- tion detection metric introduced by Wen et al. (2024)
through sharpness analysis.
Detecting and Mitigating Memorization. Detecting and mitigating memorization during the generative process re- mains challenging problem. Previous studies have ex- plored various approaches to identify prompts that induce memorization in text-conditional DMs by comparing gener- ated images to training data. For instance. (Somepalli et al. (023a) employed feature-based detectors like SSCD (Pizzi ct al. 2022 and DINO (Caron et al.) 202T). while Carlini et al. 20233 and Yoon et al. (2023) used calibrated lg dis- tance in pixel space to quantify memorization. [Webster (2023) developed both white-box and black-box attacks, analyzing edges and noise patterns in generated images.
We introduce a new sharpness measure that enables early-stage memorization detection during the diffu- sion process.
We propose SAIL, a simple yet effective mitigation strategy that selects initial noise leading to smoother probability regions, reducing memorization without altering model parameters or prompts.
2. Related works
Understanding and Explaining Memorization. The memorization behavior of diffusion models (DMs) has been extensively studied (Somepalli et al., [2036]] Car-
While these methods provide valuable insights, their compu- tational cost makes real-time detection impractical. To ad- dress this limitation, heuristic-based alternatives have been proposed. WWnn et al. (202)) introduced a metric based on the magnitude of text-conditional score predictions, leverag- ing the observation that memorized prompts exhibit stronger text guidance. Similarly, |Ren et al. (2024) identified memo- rization via anomalously high attention scores on specific tokens, while Chen et al. (2024) focused on patterns in end tokens of text embeddings.
Tini et al. 2023 Wen et al., 2024), with prior work ex- amining contributing factors such as prompt condition- ing (Somepalli et al.
2023b), data duplication (Carlini et al.) 2023 Somepalli et al. 2023a), and dataset size or complex- ity (Gu et al. 2023). Some studies have approached this issue from a geometric standpoint, drawing on the mani- fold learning conjecture (Fefferman et al.] 2016 Pope et al.] 202T). where exact memorization is associated with data
points lying on zero-dimensional manifold (Ross al.
Since memorization in DMs is often linked to specific text prompts, most mitigation strategies have focused on modi- fying prompts or adjusting attention mechanisms to reduce their influence (Wen et al. 2024 Ren et al. 2024 Ross et al.) 2024). For example, Ross et al. (2024) rephrased prompts using GPT-4 to mitigate memorization. However, these in- terventions often degrade image quality or compromise user intent by altering model-internal components.
2024 Ventura al. 2024. Pidstrigach 2022).
This geometric perspective has led to efforts to esti- mate Local Intrinsic Dimensionality (LIID) at the sample level (Stanczuk et al. 2024] Kamkari et al. 2024 Hor- vat Phister| 2024, /Weniiag & Moran 2023 Tempezyk ctt al. 2022). which has been used to characterize memoriza- tion (Ross al. 2024 Ventura al. 2024).
While our work is inspired by prior studies, it introduces several key distinctions. Unlike approaches that define mem- orization in terms of overall model behavior (Yoon et al.] 2023 Gu et al. 2023), we focus on sample-specific behav- ior manifested in the learned probability density. Although
In contrast, our approach offers principled and model- agnostic alternative by optimizing the initial noise input instead of modifying the text prompt or trained model pa- rameters. By selecting initial noise that leads to smoother probability regions, our method mitigates memorization
2

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
while preserving both user prompts and model fidelity, en- suring minimal impact on generation quality.
flatness in those directions. The magnitude of an eigenvalue reflects the steepness of the curvature, with larger absolute values indicating steeper changes in f.
3. Preliminaries
In this work, we examine the memorization by analyzing the Hessian of log pa (xx), which corresponds to the Jacobian of the score function. We denote as (x,) = V2, log Pa (x:) for the unconditional case and H (x,, c) == V2, log Px (c) for the conditional case. The Hessian estimated by the model is denoted as Hx(x;) and Hø(x,,))
Score-based Diffusion Models. Diffusion models (DMs) (Sohi-Dickstinn et al. 2015: Ho et al., 2020; Song al. 2021c) generate images by iteratively refining random noise into samples that approximate the data distribution Pu(x)). The process begins with the forward process, where the training data is progressively corrupted by the addition of Gaussian noise. At each timestep t, the conditional distribution of the noisy data is given by:
4. Understanding Memorization via Sharpness
4.1. Memorization: Sharpness in Probability Landscape
q: (xx = (xx//x//vxxx (1 (1-aa) a))),
Sharpness quantifies the concentration of learned log density log p(x) around point x, which can be analyzed through the eigenvalues of its Hessian matrix. Large negative eigenval- ues indicate sharp peaks in the distribution, suggesting mem- orization of specific data points. Conversely, small magni- tude or positive eigenvalues characterize broader, smoother regions that facilitate better generalization.
where represents the noisy data at timestep i, and og de- creases monotonically over time in the arriacc--peesevving case, with at becoming sufficiently small such that the re- sulting distribution closely resembles pure Gaussian noise:
Qr (xr Xo) R (O.
Local Intrinsic Dimensionality (LID) (Kamkari et al. 2024) quantifies the effective dimensionality of point its local neighborhood, characterizing local sample space geometry. At the final generation step (t = 0), LID serves memo- rization indicator (Ross al. 2024). Exact Memorization (EM) shows near-zero LID, indicating pure reproduction of training samples, while Partial Memorization (PM) exhibits small but nonzero LID, reflecting limited stylistic variations. In contrast, properly generalized samples demonstrate mod- erate LID values, indicating more diverse representations.
This process can be equivalently represented as a stochastic differential equation (SDE):
dx fxx, t)dt + g(t)dwe,
where w, is standard Brownian motion.
The reverse process, which reconstructs the data distribution (x())) from noise, is then formulated as:
dx:- = -) (1) (x:)) dt + g(!)dwe:
While both sharpness and LID characterize curvature prop- erties of probability density, LID is limited to analyzing sample space at = 0, where the generated image emerges. In contrast, we extend memorization detection across all timesteps by leveraging sharpness via Hcssian cigenvalues as a more versatile metric, enabling continuous monitoring throughout the generative process rather than relying solely final output characteristics.
where w, denotes a standard Brownian motion in reverse time, and (x,) is the marginal distribution at timestep t.
The only unknown term in the reverse process the score function over timesteps, Vx, lo := sxx,), which is often parameterized by neural network with sp (x²).
In many applications the data Xn is often represented with an associated label e (c.g., prompts or class labels). In these scenarios, the additional condition e is incorporated into the model as (x,,, c), allowing it to estimate the score of the conditional density Vx, logp: /c) == 8(xe, c) via classifier free guidance (Ho & Salimans, 202T).
2200
Sharpness and Hessian. For given function f a point I, the Hessian V2 represents the matrix of second- order derivatives, encapsulating the local curvature of f around v. The eigenvectors of the Hessian define the princi- pal axes of this curvature, while the corresponding eigenval- ues characterize the curvature along these directions. Posi- tive eigenvalues indicate local convexity, negative eigenval- ues indicate local concavity, and zero eigenvalues indicate
(a)
(b)
Figure 1: (a) Learned score vectors at final sampling step (t = 1), with training data points marked in blue. (b) Evolu- tion of eigenvalues throughout the sampling process for memorized (red) and non memorizdd (blue) sample.
3

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
t = -
t =
1
603
0333
0.00
400
400
Exact Mem
200
200
0.50
4094
0192
12218
10354
4038
0192
32386
38360
Pantal
1.00
595t Pel.
Partial Mem
200
200
13730
14130
14330
4794
01992
12258
16354
4034
8192
32388
18386
0.25
see0 30
Non Mem
-0.75
Partil
200
200
-1.00
400
600
500
13800
L1000
Figure 3: Left: Eigenvalue distribution of Ho (Xe: c) across memorization categories in Stable Diffusion v1.4 at initial sampling step (t T - 1) with range clipped. (top) 30 prompts per category with identical initialization. (bottom) Fixed prompt set with three different initializations. Both plots reveal stronger memorization correlates with fewer non-negative eigenvalues. Right: Eigenvalue distribution Hg(x,, c) across memorization categories in Stable Diffusion v1.4 at final sampling step (f 1). Generated images shown with original training counterparts (outlined in red). Eigenvalues are approximated via Arnoldi iteration (Amoldi 195I). details Appendix A.2
q
q
q
9
9
Memerizel (Digk 9)
validate our approach on real data, we conduct exper- iments on MNIST by inducing memorization through re- peated exposure
9
9
9
9
9
9
9
9
9
-0.95
Porcentle
9
-1.00
single "9" image while maintaining all "3" images general class (Figure The eigenvalue dis- tributions at f = 1 clearly differentiate memorized from non- memorized samples: memorized samples show consistently large negative eigenvalues indicating sharp peaks, while menmmeerrized samples exhibit positive eigenvalues, re- flecting locally convex regions that allow sample variations. Notably, these clear distributional differences emerged even at the initial sampling step (t T 1), confirming that sharpness- memorization detection is effective from the very beginning of the generation process.
9
9
1.05
9
7
9
9
9
7
9
9
Mem
3
1000
1000
Maroomoed (iggi
3
3
1001
Non-meneriod
3
3
3
3
3000
3
_
3
3
3
5000
-7000
Non-mem
200
000
690
730
784
Figure 2: Left: Generated images for memorized (digit "9"" and non-mes non-memorized (digit "3") samples. Right: Eigenvalue distributions for memorized (red) and mon-mzerr (blue) samples at initial (top) and final (bottom) sampling steps, revealing more and larger negative eigenvalues in memo- rized cases. Experimental details in Appendix C
We further validate our approach on Stable Diffusion Rom bach et al., 2022). analyzing its 16, 384 384-dimensional latent space. Figure reveals distinct patterns in both the number of non-negative eigenvalues and the magnitude of negative eigenvalues across different memorization categories (EM, PM, and non-memorized) at both initial and final sampling step. These patterns not only align with LIDD-bsed anal- ysis at but also demonstrate sharpness as a more generalizable memorization measure, capturing distinctive characteristics at generation onset.
Figure [
demonstratss our approach using a mixture of 2D Gaussians, where sharp peaks represent memorized dis- tributions. From the mid stage of the denoising process, the memorized sample (red) exhibits large negative eigenvalues, indicating highly localized distributions, while the generic sample (blue) maintains near-zero cigenvalues, characteriz- ing broader, smoother regions. Importantly, the memorized sample exhibits sharp characteristics even at intermediate timesteps, making early-stage detection possible.
4.2. Score Norm as a Sharpness Measure
While sharpness serves as a fundamental measure of mem- orization generative models, directly computing the full spectrum of Hessian eigenvalues in high-dimensional distri-

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
butions, such as those in Stable Diffusion, is computation- ally intractable. A practical alternative is approximate sharpness using the trace of the Hessian, a single scalar quan- tity that represents the sum of all eigenvalues, where large negative traces indicate sharp. highly localized regions.
even in the later stages of the diffusion process, suggesting that score norm can serve computationally efficient sharpness measure throughout generation. This perspective provides a theoretical foundation for interpreting sharpness in generative models through score norm based statistic, en- abling efficient memorization detection and analysis without requiring costly Hessian eigenvalue decompositions.
A key observation is that the norm of the score function [|s(x)]] inherently encodes information about the probability landscape's s curvature. In Gaussian distributions, the score norm is directly connected to the Hessian trace, shown in the following result. (Appendix B.2).
4.3. Wen's 's Metric as a Sharpness Measure
Wen et al. (2024) characterized memorization through the norm of difference between conditional and unconditional score functions:
Lemma 4.1. For Gaussian vector X ~ Nu, Σ),
E [[s (x)(H(x)),
|| (xx) = [|5 c) so (xx)]l--
where (x) = - is the Hessian of the log density.
This difference vector s (xp) determines the sampling di- rection in classifier-free guidance. Their approach is based on the observation that memorized prompts consistently guide generation toward specific images, resulting in larger magnitudes of s (x,) due to stronger text-driven guidance. While the theoretical foundations of this heuristic remain to be fully understood, it has proven to be one of the most effective detection metrics thus far.
This result extends to non-Gaussian distributions under mild regularity assumptions (Appendix [B.)). For theoretical clar- ity and ease of analysis, however, we focus on the Gaussian case. While the distribution x; in diffusion processes is not strictly Gaussian at every timestep, recent studies show that at moderate to high noise levels, corresponding to the early and middle stages of the reverse process the learned score is predominantly governed by its Gaussian compo- nent (Wang& & Vastola 2024). This approximation is further justified in latent diffusion models, where the latent variable z; is explicitly regularized toward a Gaussian prior (Kingma 2013 Rombach et al. (022), despite the complexity of the original data distribution.
Notably, the structure of [sz((x,) bears a strong resem- blance to the score norm, which we previously identified as measure of sharpness. This similarity hints at the possi- bility of interpreting Wen's 's metric sharpness measure, encapsulating the impact of conditioning the probability distribution's 's curvature. To rigorously establish this connec- tion, we proceed to analyze the Hessian of the log- following the same approach as in the preceding analysis.
Under this Gaussian assumption at relevant sampling steps, the score norm [x00(xx))] (x2 provides unbiased estimate of the negative Hessian trace (H)(()))) offering an efficient measure of the sharpness of the probability landscape.
Lemma 4.2. Forx ~ NN,, E) and x/e ~ N(He Ee):
Ex-pixle) [11s(x,, c) sxx)]
MNIST 1012
10a
=||H(x)((1 pc) + tr( (H Hx(x))²H (x)),
(X.)))
10
10º
oll
595th Percentle
108
5R5th Percentle
where H(x) - and Hx = -
10
10
10
Additionally, when E and E. commute (i.e., ΣΣ, = E)E) and mean vectors are the same (μ = Mcc,, this reduces to
1000 (7')
500
1000 (7)
Stable Diffusion v1.4
10a
tr| o)
10!1
=(Hofx.ci)) <i))
Ex-p(xle) (xxx)e))sxx)11+ = (As - Nr,0²
10
Ai,
5995th Percentile
5755th Percentle
10
10
10a
where Xe, di, are eigenvalues of H(x) and Hx(x).
(7)
500
(F')
This result demonstrates that Wen's metric measures sharp- ness differences through squared eigenvalue differences of the conditional and unconditional Hessian. During early timesteps, when the latent distribution remains close to an isotropic Gaussian, this metric directly captures the extent to which conditioning induces sharpness. At later timesteps, when Σ, and Σne do not generally commute, the metric
Figure 4: Empirical alignment in MNIST and Stable Diffu- sion between: (left) -tr( (xx, e)) and [xs I) and (right) tr (x,, e) and [] (x), c)
Figure 4 empirically confirms that this approximation holds reliably across datasets, including MNIST and Stable Diffu- sion's latent space. Surprisingly, this relationship persists
5

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
can be interpreted through generalized eigenvalues, reveal- ing how conditioning sharpens the learned distribution in similar manner. The details are provided in Appendix A.3
regions more distinguishable within a smooth probability landscape. This approach significantly improves the eigen- value gap at the earliest generation stage, advancing mem- orization detection in the diffusion process. The following lemma shows that the Hessian-score product provides an amplified measure of the Hessian trace, thereby increasing sensitivity to distributional sharpness.
403
200
-30
-30
Lemma 4.3. For Gaussian vector x (N,,,,) E),
Exact Mem
JPM
RIVG 1230
16/90
4095
$192
13386
18394
600
E (x) (t((((()))))
400
200
where (x)) = - is the Hessian of the log density.
-331
This relationship, empirically verified in Figure demon- strates the curvature-sensitiv sealing effect of the Hessian score product. Building on this principle, we propose an enhanced version of Wen's metric that improves early-stage sensitivity through second-order sharpness characterization:
Partial Mem
-77
8192
1228
18394
4295
$192
12255
18354
601
200
-200
Non-mem
1245 $190 13788
16381
$245
8190
13288
16311
11 (xx, c)s (xx,
20
Figure 5: Eigenvalue differences between the conditional and unconditional Hessians. Memorized samples exhibit a significantly larger gap, while non-memorized samples show near-zero differences throughout. At intermediate timesteps (t- 20), the gap remains small but detectable, and at the final stage (L = 1), it widens further.
where H6 (xt, c) Ho c) Ho(xi), and o (x+, se [x,, c) - 36 (Xx).
To provide intuition, assuming identical means (μ = pd) and that E, and Σ., commute, the expected value of our metric simplifies to:
Figure shows the eigenvalue disparities between condi- tional and unconditional Hessians across timesteps, reveal- ing how conditioning shapes the probability distribution's 's geometry. For memorized samples, the eigenvalue gap is notably large, showing that conditioning creates more con- strained probability landscape. At intermediate timesteps (t 20), the differences are subtle but noticeable, indi- cating early conditioning effects. Near the end (t = 1), the eigenvalue gap widens substantially, demonstrating con- ditioning's 's growing influence on the learned density. In contrast, memorized samples show minimal eigenvalue variations throughout, indicating little conditioning influ- ence. These findings support our theoretical framework and confirm Wen's metric effectively measures sharpness.
()i )ee)
(xpxp(()) ( (x,, (x,, e)
where Xj Ai, eigenvalues of (xx)) and ((x,,))
Compared to Wen's metric in Lemma 4.2 this refinement substantially improves sensitivity by amplifying the differ- ence in sharpness, thereby enabling more effective detection of memorization at earlier stages.
4.5. Detecting Memorization in Stable Diffusion
Experimental Setup. To evaluate our metric, we use 500 memorized prompts identified by Webster (2023) for Stable Diffusion v1.4, and 219 prompts for v2.0. As a complemen- tary set, we include 500 non-memorized prompts sourced from COCO (Lin et al. (004)), Lexica (Lexica 2024), Tuxe- mon (HuggingFace 2024). and GPT-4 (Achiam al. 2023).
4.4. Upscaling Eigenvalue Statistics via Hessian
While Wen's metric reveals eigenvalue disparities inter- mediate timesteps, identifying and mitigating memorization during the initial generation stage remains challenging. The probability landscape maintains a nearly uniform charac- ter since the latent distribution approximates an isotropic Gaussian, making structural sharpness differences subtle. Conventional metrics struggle to capture these fine-grate fine-grained distributional variations, limiting early-stage applications.
Following Wen et al. (2024). we apply the DDIM (Song ct al. 2021a) la) sampler with 50 inference steps.
Detection performance is assessed with two standard met- ries: the Area Under the Receiver Operating Characteristic Curve (AUC) and the True Positive Rate 1% False Posi- tive Rate (TPR @ 1%FR) with higher values preferable.
For comparison, we implement six baseline methods. Among them, Carlini et al. (202)) analyzed generation density by measuring pixel-wise &g distances across non- overlapping image tiles, aiming to detect memorized con- tent based on local similarity patterns. Ren et al. (0244)
To address this limitation, we introduce curvature-aware scaling that enhances Wen's 's metric through Hessian- based weighting. By multiplying the Hessian with the score func- tion, we amplify high-curvature directions, rendering sharp
6

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
SD v1.4
SD v2.0
Method
Sieps
AUC
AUC
TPR PROIISIR ISFPR
Tiled 22 Carlini et al.
2023
50
0.908
0.088
0.792
0.114
16
0.94
0.232
0.907
0.114
0.846
0.116
0.848
0
(Ren
2024
0.839
0.13
0.853
16
0,832
0.124
0.851
D
0.606
0
0.809
O
AB
Ren 20244
0.628
0
0.82
16
0.598
0
0.817
0
0.986
0.95
0.983
0.908
BE
Chen al.
2024
50
0.997
0.98
0.99
0.945
16
0.947
0,982
0.99
0.949
0.976
0.896
0.739
0.992
0.944
0.98
0.876
16
0.99
0.928
0,983
0.881
0.991
0.932
0.969
0.885
(x+)]] WWn ct
2024
0.997
0.978
0.984
0.917
16
0.998
0.982
0.987
0.931
0.983
0.948
0.982
0.904
0.996
0.982
0.99
16
0.998
0.98
0.991
0.945
1 (xr)) (1l) (Ours)
0.987
0.908
0.959
0.74
0.998
0.982
0.991
0.895
Table 1: AUC and TPR @ 1%FPR across detection strategies and sampling steps for Stable Diffusion (SD) v1.4 and v2.0. Here, n denotes the number of generations per prompt, with results averaged over n. "Steps" indicates the stage along the diffusion sampling path, ranging from step 1 (t = T 1) to step 50 (1 = 1).
detected memorized samples by identifying anomalous at- tention score patterns in lext-conditioning during sampling. Chen et al. (2024) refined WWn et al. (2024)'s 's metric for partial memorization by incorporating end-token masks that empirically highlight locally memorized regions.
T' - 1: note that sampling proceeds in reverse order, starting from T). This is substantiated by the strong detection performance of both Wen's 's metric and our metric at the initial sampling step, which quantifies the sharpness gap between pr (x+lc) and (x(x))
We report detection results at sampling steps 1, 5, and 50, but only include 50-step results for methods requiring full sampling or showing significant performance gains. Addi- tional experimental details provided in Appendix D.I
This phenomenon, linked to the deterministic nature of ODE samplers (a one-to-one mapping between noise and image), implies that initializations from sharper densities remain in sharper regions each intermediate timestep of the gen- eration process, thereby increasing the likelihood of pro- ducing memorized images. In contrast, initializations from smoother regions tend to yield non-memorized images.
Results. Table I demonstrates our metric's strong per-
formance on Stable Diffusion v1.4 and v2.0 using just single sampling step. By upscaling curvature information via H (x+), we significantly enhance Wen et al. (2024)'s s metric. With merely four generations, we achieve an AUC of 0.998 and TPR @ 1FPR of 0.982, matching Wen al.) (2024's 's performance using five steps and 16 generations. Similarly, in v2.0, our approach attains an AUC of 0.991 without full-step sampling, underscoring its effectiveness.
Thus, we argue that sampling with noise from smoother densities could effectively mitigate memorization. While manually searching for such initializations is a straightfor- ward approach, it becomes infeasible in high-dimensional Gaussian space due to the sheer size and complexity of the search domain. Consequently, we propose to directly opti- mize the initial noise X as more scalable and systematic way to address this challenge.
Importantly, our metric can be efficiently computed using Hessian-vector products without explicitly forming the full Hessian matrix. Leveraging automatic differentiation frame- works such as PyTorch, single Hessian-vectte vector product suffices for detection, incurring minimal overhead.
Sharpness Aware Initialization. We propose Sharpness- Aware Initialization for Latent Diffusiio (SAIL), an inference-time mitigation strategy that optimizes initializa- tions X7 by minimizing the sharpness gap at the starting step (t = T 1). SAIL identifies initial seeds on non-memorized sampling trajectories by selecting Xy from smoother regions while maintaining a reasonable density under the isotropic Gaussian prior. The objective function defined as:
5. Sharpness Aware Memorization Mitigation
5. Sharpness Aware Initialization Sampling
Motivation. In Section 4 we observed that memorized samples exhibit a sharp conditional density, (x(xx(c), even at the very beginning of the generation process (i.e., at
[1 (1))( (XT)s (xT))l a log pa (XT),
7

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landseapes
Who Strigpaaee
Original
Ours
Ren et al.
Wen et al.
RNA
RTA
ctsl.
6.00
Colbert
KNA
Oun
0.23
0.30
Björk
0:3
CLIP
Mitgation
1.31
Netflix
KEFELI
Ren al.l.
TCHIN
XEA
5SCD Sinitaa
VLI MTTLION
NETRLOFX
NETMLIN
1.0
South Park
THU PARIK]
6.20
2.30
0.31
0.33
0.2
Figure 6: Left: Comparison of inference-time mitigation methods on SD v1.4 (top) and v2.0 (bottom), evaluated across five hyperparameter configurations per method. Lower SSCD scores indicate reduced memorization, while higher CLIP scores show better prompt-image alignment. Right: Qualitative comparison demonstrating SAIL's effectiveness in preserving key image details (shown adjacent to the original image), whereas baseline methods exhibit quality degradation due to modified text conditioning. Images are generated using identical random seeds, with full prompts in Appendix D.2
where pc is the density of an isotropic Gaussian distribution.
at. 2022). which quantifies memorization by comparing model-based features of generated images to their corre- sponding training data, and the CLIP score (Radford et al.) 2021), which evaluates prompt-image alignment. Results are averaged over five generations per prompt.
While (xT) >s (xr))l 2| can be efficiently computed us- ing Hessian-vector products, the gradient backpropagation required for optimization introduces computational over- head. To overcome the burden, we approximate the term using a Taylor expansion around XT:
For comparison, we implement four recent mitigation al- gorithms. (Somepalii et al. (2023b) propose Random To- ken Addition (RTA) and Random Number Addition (RNA), which perturb original prompts to mitigate memorization. Wen et al. (2024) introduce method that optimizes text em- beddings reduce the influence of memorization-inducin tokens. Ren al.) (2024) propose strategy that adjusts attention scores of text embeddings for mitigation.
(xT + de (XT)) - og s (xT)
| (T) )sa') (x
82
This leads to the final objective for SAIL:
LsAn. (xT) = || (x + (xT)) o (I+) + |l
where a balances the sharpness of the density and the origi- nal likelihood. To ensure initializations remain close to the Gaussian distribution, we employ early stopping based on a threshold Chees limiting number of optimization steps.
For a fair comparison, all methods are evaluated using five distinct hyperparameter settings and optimized with the Adam optimizer at a learning rate of 0.05. For a detailed experimental settings, refer to Appendix D.2
5.2. Mitigating Memorization in Stable Diffusion.
Experimental Setup. To evaluate mitigation strategies, we use the same memorized prompt set employed in the detection experiments described in Section 4.3 However, since verifying mitigation effects requires access to training images, we exclude prompts whose corresponding training samples are unavailable. Further details are in Appendix D
Results. Figure 6 (left) demonstrates that SAIL signifi- cantly improves both SSCD and CLIP metries for Stable Dif- fusion v1.4 and v2.0. By optimizing the noise initialization Xr without altering model components like text embeddings or attention weights, SAIL effectively mitigates memorized content while preserving model behavior and user prompts, ensuring high-quality, non- mom-mozre outputs.
We employ two key metrics following (Wen et al., 2024
Somepalli et al. 2023ap: the SSCD similarity score Pizzi
The advantage of SAIL. evident Figure 6 (right), where
8

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
generates images that faithfully preserve key prompt de- tails, such celebrity names and primary objects. In con- trast, methods that modify text-conditional components of- ten reduce the influence of those components during mitiga- tion, leading to degraded alignment with the original prompt and potentially diminishing user utility. Additional qualita- tive results for algorithms are provided Appendix E
Aleman, F. L.,, Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al. Gpt-4 technical report. arXiv preprint arXiv:2303.0877 2023.
Achilli, B., Ventura, E.,, Silvestri, G., Pham, B., Raya, G., Krotov, D., Lucibello, C., and Ambrogioni, L. Losing dimensions: Geometric memorization in generative diffu- sion, 2024.
6. Conclusion
Alakhdar, A., Poczos, B., and Washburn, N. Diffusion models in de novo drug design. Journal of Chemical Information and Modeling. 2024.
We propose a charpness-based framework for detecting and mitigating memorization in diffusion models. Our analysis identifies Hessian-bar based sharpness as a reliable indicator of memorization and introduces an efficient proxy based on the score norm. This perspective also provides a theoretical in- terpretation of the memorization detection metric proposed by Wen et al. (2024). Building on this foundation, we in- troduce Perppness-Aware Initialization for Latent Diffusion (SAIL), an inference-time method that reduces memoriza- tion by selecting low-sharpness initial noise. Experiments on synthetic 2D data, MNIST, and Stable Diffusion demon- strate that our approach enables early detection and effective mitigation, all without degrading generation quality.
Amoldi, W. E. The principle of minimized iterations in the solution of the matrix eigenvalue problem. Quarterly of Applied Mathematics, 1951.
Bhattacharjee, R., Dasgupta, S., and Chaudhuri, K. Data- copying in generative models: a formal framework. In ICMI., 2023.
Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramèr, F,, Balle, B., Ippolito, D., and Wallace, E. Ex- tracting training data from diffusion models. In USENIX Security, 2023.
Caron, M., Touvron, H., Misra, I., Jégou, H., Mairal, J., Bojanowski, P., and Joulin, A. Emerging properties in self supervised vision transformers. In CVPR, 2021.
Acknowledgement
This work was supported in part by Institute of Informa- tion & communications Technology Planning & Evaluation (IITP) grant funded by the Korea (MSI) (No. R8-2024-00457882, AI Research Hub Project), the Min- istry of Science and ICT (MSIT), South Korea, under the Information Technology Research Center (ITRC) Support Program (ITT-2205--RS-202200013 funded by the Korean Government (MSIT) (No. RS-2020- 11201361, Artificial Intelligence Graduate School Program (Yonsei University)).
Chen, C., Liu, D., Shah, M., and Xu, C. Exploring lo- cal memorization in diffusion models via bright ending attention. arXiv preprint arXiv:2410.21666, 2024.
Fefferman, C., Mitter, S., and Narayanan, H. Testing the manifold hypothesis. Journal of the American Mathemat- ical Society, 2016.
and IITP grant
Gu, X., Du, C., Pang, T., Li, C.,, Lin, M., and Wang, Y. On memorization in diffusion models. arXiv preprint arXi::2310002664 2023.
Impact Statement
Ho, J. and Salimans, T. Classifier-free diffusion guidance. In NeurlPS 2021 Workshop on Deep Generative Models and Downstream Applications, 2021.
Our work aims to advance the understanding and mitigation of memorization in diffusion models, a phenomenon closely tied to potential privacy risks. By proposing a framework to detect and reduce memorization, we seek to enhance the responsible deployment of generative models, especially when they are trained on sensitive data. This approach could contribute positively by lowering the risk of unintentionally revealing private information.
Ho, J., Jain, A., and Abbeel, P. Denoising diffusion proba- bilistic models. In NeurlPS, 2020.
Horvat, C. and Pfister, J.-P. On gauge freedom, conserva- tivity and intrinsic dimensionality estimation in diffusion models. In JCLR, 2024.
HuggingFace.
Tuxemon, 2024. URL https:
References
A. Micchelli, C. and Noakes, L. Rao distances. Journal of Multivariate Analysis, 92(1):97-115, 2005.
tuxemon
Hyvärinen, A. Estimation of non-normalized statistical models by score matching. Journal of Machine Learning Research, 6(24))695-709, 2005.
Achiam, J., Adler, S., Agarwal, S., Ahmad, L.., Akkaya, I.,

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landseapes
Joseph Saveri, B. M. Stable diffusion litigation, 2023. URL https: ffssiioooo com/
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In CVPR, 2022.
Kamkari, H., Ross, B. L.,, Hosseinzadeh, R., Cresswell, J. C., and Loaiza-Ganem, G. A geometric view of data complexity: Efficient local intrinsic dimension estimation with diffusion models. In 2024 Workshop on Struc- tured Probabilistic Inference & Generative Modeling, 2024.
Ross, B. L., Kamkari, H., Wu, T., Hosseinzadeh, R., Liu, Z., Stein, G., Cresswell, J. C., and Laiza-Ganent G. geometric framework for understanding memorization in generative models. arXiv preprint arXiv:2411.00113, 2024.
Saharia, C., Chan, W., Saxena, S., Li, L.., Whang. Denton, E. L., Ghasemipour, K., Gontijo Lopes, R., Karagol Ayan, B., Salimans, T., et al. Photorealistic text-to- to--t dif- fusion models with deep language understanding. In NeurlPS, 2022.
Kingma, Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114, 2013.
Lanezos, C. An iteration method for the solution of the eigenvalue problem of linear differential and integral op- erators. J. Res. Natl. Bur. Stand. B, 1950.
Sohl-Dickstein, J., Weiss, E., Maheswaranathan, N., and Ganguli, Deep unsupervised learning using nonequi- librium thermodynamics. In ICMI., 2015.
Lexica Lexica dataset, 2024.
URL https
//huggingface.co htt.gaace..o/ataattss/eeeeee htt/d/taates//eera3353
lexica dataset
Somepalli, G., Singla, V., Goldblum, M., Geiping, J., and Goldstein, T. Diffusion art or digital forgery? investi- gating data replication in diffusion models. In CVPR, 2023a.
Lin, T.-.., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P., and Zitnick, C. L. Microsoft coco: Common objects in context. In ECCV, 2014.
Lu, C., Zheng, K., Bao, F., Chen, J., Li, C.,, and Zhu, J. Maximum likelihood training for score-based diffusion odes by high order denoising score matching. ICML, 2022.
Somepalli, G., Singla, V., Goldblum, M., Geiping. J., and Goldstein, T. Understanding and mitigating copying in diffusion models. In NeurIPS, 2023b.
Meng, C., Song, Y., Li, W., and Ermon, S. Estimating high order gradients of the data distribution by denoising. In NeurlPS, 2021.
Song, J., Meng, C., and Ermon, S. Denoising diffusion implicit models. In ICLR, 2021a.
Song. Y., Durkan, C., Murray, I., and Ermon, S. Maximum likelihood training of score-based diffusion models. In NeurIPS, 2021b.
Orrick, W. H. 2023. URL. /ctps://casetext cwm cco/ccaee////cccccccccccccccoo/c case/ andersen- V- ww-sttabiitty ai Itd
Andersen
Stability AI Ltd.,
Song, Y., Sohl-Dickstein, J., Kingma, D. P., Kumar, A., Er- mon, S., and Poole, B. Score-based generative modeling through stochastic differential equations. In ICLR, 2021c.
Pidstrigach, J. Score-based generative models detect mani- folds. In NeurlPS, 2022.
Pizzi, E., Roy, S. D., Ravindra, S. N., Goyal, P., and Douze, M. A self-supervised descriptor for image copy detection. In CVPR, 2022.
Stanezuk, J., Batzolis, G., Deveney, T., and Schönlieb, C.-B. Diffusion models encode the intrinsic dimension of data manifolds. In ICML,,
Pope, P., Zhu, C., Abdelkader, A., Goldblum, M., and Gold- stein, T. The intrinsic dimension of images and its impact learning. In ICLR, 2021.
Tempezyk, P., Michaluk, R., Garncarek, L., Spurek, P., Tabor, J., and Golinski, A. Lidl: Local intrinsic dimension estimation using approximate likelihood. ICMI., 2022.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J.. Krueger, G., and Sutskever, Learning transferable visual models from natural language supervision. In ICML, 2021.
Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.-A., Lacroix, T., Rozière, B., Goyal, N., Hambro, E., Azhar, F., et al. Llama: Open and efficient foundation lan- guage models. arXiv preprint arXiv:2302. 13971, 2023.
Ren, J., Li, Y., Zeng, S., Xu, H., Lyu, L., Xing, Y., and Tang, J. Unveiling and mitigating memorization text- to-image diffusion models through cross attention. In ECCV, 2024.
Ventura, E., Achilli, B., Silvestri, G., Lucibello, C., and Ambrogioni, L. Manifolds, random matrices and spectral gaps: The geometric phases of generative diffusion. arXiy preprint 200i::440000500 2024.
10

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
Wang, B. and Vastola, J. The unreasonable effectiveness of gaussian score approximation for diffusion models and its applications. Transactions on Machine Learning Research, 2024.
Webster, R. A reproducible extraction of training images from diffusion models. arXiv preprint arXiv:2305.08694 2023.
Wen, Y., Liu, Y., Chen, C., and Lyu, I.. Detecting, explain- ing, and mitigating memorization in diffusion models. In ICLR, 2024.
Wenliang, L. K. and Moran, B. Score-based generative models learn manifold-like structures with constrained mixing. In NeurIPS Workshop SBM, 2023.
Yoon, T., Choi, J. Y., Kwon, S., and Ryu, E. K. Diffusion probabilistic models generalize when they fail to memo- rize. ICML 2023 Workshop on Structured Probabilistic Inference & Generative Modeling, 2023.

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
A. Additional Mathematical Details
A.I. Second-Order Score Function
Since the Hessian of interest is simply the Jacobian of the score function, it can be directly computed using automatic differentiation from a trained diffusion model (DM). While a well-trained DM that accurately estimates scores should theoretically yield accurate Hessian via automatic differentiation, this is not always the case in practice. Therefore, to achieve more accurate estimation of the Hessian, the model should be parameterized and incorporate a second-order score matching loss that estimates V log Pa (x+) 2 V xx, (xx) Hx(x,) ) as demonstrated by Meng et al. (2021). This can be interpreted as implicit correction of the parametrized score function. To enhance numerical stability in the loss function, we adopt the loss proposed by [u et al. (2022), an improved version of the loss utilized by Meng et al. (021). For fixed and given trained score function, this loss is defined as:
0" arg min Ex Ex.,5
1
||] +1 1
where (1(, == (x)) + c, X2 0x o,e, (O,.I. The proposed objective is
c cS (0) = Etxo,.e (10o))((x) +I- -
GET ---
To obtain more accurate Hessian estimate in the Toy experiment, we used C = LDS (0) + DS (0), which was simultancously optimized using a weighted sum format. For Stable Diffusion, no additional training was performed because the original training data were not publicly available, making it difficult retrain or fine-tune. Nevertheless, as noted the main text, we still obtained sufficiently good results with the existing pretrained model.
A.2. Numerical Eigenvalue Algorithm
For high-resolution image data with very large dimensions, such as in Stable Diffusion, calculating the exact Hessian and finding its eigenvalues are computationally complex and mememory inefficient. As an alternative, we employ Arnoldi iteration (Amoldi [95T), numerical algorithm that leverages the efficient computation of Hessian- vectoor products via torch. aut ograd. funct ional. jvp to approximate some leading cigenvalues without forming the Hessian explicitly. In more detail, we can compute the action of the Hessian on vector v efficiently using automatic differentiation. Arnoldi iteration is an algorithm derived from the Krylov subspace method that constructs an orthonormal basis Q... [q1. 42...., qm] of the Krylov subspace Km, and an upper Hessenberg matrix Hm, such that the following relationship holds:
AQ.. = Hm + hm+1.m 4m+10
where em is the m-th canonical basis vector. Since we can compute Aq without forming A explicitly, using the function (p_func(qu)) the Arnoldi iteration proceeds as follows. First, we normalize the starting vector b to obtain qi [blla" Then, for each iteration le 1 to m, compute:
b
[y]_fun((qx);
which represents the action of A on qa. We then orthogonalize v against the previous basis vectors q....., 9k. updating h and v:
11 = 9 V, v = v - hy for j I,...,k. After orthogonalization, compute h4+1,A = ||v||2. If h4+ is greater than small threshold E, normalize obtain the next basis vector qk++1 1 the m eigenvalues of A. For details on the computational process of Amnoldi iteration, Please refer the algorithm pesudo code below. The Arnoldi iteration tends to find eigenvalues with larger absolute values first because components associated with these eigenvalues dominate within the Krylov subspace. If the input matrix is symmetrie, Arnoli iteration can be simplified to Lanczos iteration (Lanczos) 1950). However, since the Lanczos iteration is very sensitive to small numerical errors breaking the symmetry, we use the general version. The computational complexity of the algorithm is O(m²d) with space complexity ((nd), compared to (dd)) with (dd)) of exact derivation and eigendecomposition of Hessian. We calculate all eigenvalues for several samples for clear justification. But with just few(m < d) iterations, the difference between memorized samples and mo-meeerieed samples reveals enough.
Otherwise, the iteration terminates. The eigenvalues of H,, (Ritz values) approximate
12

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
Algorithm I Arnoldi Iteration using hecotian-Vector Products
Require:
Starting vector b E RR number iterations m S d,
function jvp_func(v) that computes Av, threshold g
Ensure: Orthonormal basis Qm [u....:9m) 4m.
upper Hessenberg matrix Hn m |m
1: Initialize Q E Rdx(m+1), h E R (m++1))
2: Normalize the starting vector: q1 |
b
do 4: Compute +- jvp_func(qss)
3: for k ==
5: for j 1 to k do
6: Compute h f 9,
7: Update v t v 96
8: end for
9: Compute 1 + l|v|12
if h2+1& > then
11: Normalize 9x+11 1,
else
break (Terminate iteration]
14: end if
15: end for
16:
Adjust Hm, by removing the last row of h
17: return Qm = (q)...,,mm) qm).
Hm
j=1.........
A.3. Generalized Eigenvalue Analysis of Score Difference
In the main text, we demonstrated that Wen et al. (2024)* 's metric can be expressed in terms Hessian eigenvalue differences. Here, we provide a more detailed derivation, including the non-commuting case, which requires the use of generalized eigenvalues.
Consider two Gaussian distributions: the unconditional distribution
Nu,, Er),
and the conditional distribution
Nu,, Er,c).
For simplicity, we assume the means are identical (μ = H..) and focus on the effect of covariance differences. Wen's 's metric approximately measures
s((x,,)) c) s(x))]|
Through direct calculation, the expected squared difference in these scores is
Ex Expxpixx a) s(xx,,) c) - s(x,)) I|]] = tn [Σ, -Erd) Ie.]
When E,E, Er, this trace simplifies to sum of squared eigenvalue differences:
(A: )2,e)²
Ai.
However, when E, and Σ,ec do commute, their respective eigen-decompositions cannot be directly aligned. In this case, introduce generalized eigenvalues by solving
Σ- AI-Iy.
13

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
Intuitively, these À measure how Σg transforms relative Σ along each direction. Note that we rewrite the trace term in the expectation
tr (I, -T,e)²
Et.c] tr
1/2 1/2
[ t,c
-,
1/2
1)
) Lr.c)
(E/ _ 3-15 E//e 1) E
tr
d
(Ae - 1)2 Wk.j.
k=1
where Way are weights induced by D.e.. The das are eigenvalues of 2/ ", 2
1/2
Since
E -1 y xy,
setting v Ei, y yields
E1.2 21
1/2 Vi'v= AE
When Ả < 1, since
Σ
X,
the unconditional covariance Σ, is effectively larger (less sharp) in that eigen-direction, indicating that the conditional distribution sharper by comparison. Consequently, the difference || s(x,,)) c) s(x;)ll encodes how much sharper (or flatter) the conditional distribution is along each generalized eigenvector. This extends the simpler commuting-case result discussed in the main text, providing more general interpretation of Wen's metric in terms of non-commuting covariances.
A.4. Score Difference Norm and Fisher-Rao Equivalence
Here, show that for small perturbations EE,, the local geometry prescribed by the Fisher-Rao metric coincides with that implied by the expected squared norm of the score difference. Specifically, let Σ,,- E, + dE, with || < 1. By expanding both the Fisher-Rao Rao distance and the expected score-difference norm in powers of 8E, up to second order, we find that their expansions match exactly in this limit. Importantly, this matching of expansions implies that the derivatives of the two measures with respect to E, also coincide (i.e., as aΣ, + 0). In other words, the local (infinitesimal) curvature on the covariance manifold-in other words, the Riemannian structure encoded by the second-order terms-is the same whether we measure distance via Fisher-Rao or via the expected score-difference norm. Consequently, both metries capture how conditioning sharpens the learned distribution in precisely the same way under small perturbations, thereby confirming that the approaches share the same local geometry the Gaussian covariance manifold.
The Fisher-Rao (or affine-invariann distance (A. Micchelli & Noakes 2005) between E, and Σi,c is
GeR(E, E,,)² = log D
1/2 E, 2T >3)
In particular, show that for small perturbations in E,, the expected norm of the score difference coincides with this squared Fisher-Rao distance up to second order. Define small perturbation Σ, as SE, where ó can be arbitrarily small. Let Σ M, + dE, with E. > 0 and || << 1 so that Ee remains positive-definite Define
A E.
Since s(xe, c) = -Ei (xt- - u)) and s(x() - E," (x:: - 11), their difference is
(x(x)) HA (x: 11).
Hence,
E Exixpi [102(x))1P]] ur((H+)2 Er.c)
14

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
Next, expand E (E,
) using the Neumann series. Up 0(1)
L ~ E Σ 8Σ: ΣT
which yields
Er 8E, Ei (1 E δE Ej¹ EE; E,
Then,
وΣ, دx¹ E tr }² _.c
(H EE,
so
tn{ sΣ Σj )z.)
On the other hand, consider the Fisher-Rao distance:
de Ej,c) |log{ Σ 1/2 Σ 1T DT
) 1|2
Define A E-11/2 E, Σz11/2
1/2 Since EE, is small, we can write A I X with |X| <
Then,
log(A) X, ||oo((A)]?? ||
be shown (via expansion in dE,) that X matches tr(E," oΣ, Ex oΣe) up second order, leading to PR E Ene) t tn(E Σ--
" jE, Σ )Σ,)
Hence, combining the two expansions shows:
(xxec) [x.4(x))) and dF (Et, Et.e)
coincide to second order in || ||. Thus, in the partu-perturbation limit, the expected value of the squared norm of the score difference encodes the same information as the Fisher-Rao distance, affirming that Wen's 's metric indeed captures how conditioning sharpens the learned distribution from a Riemannian perspective.
B. Proofs
B.1. Proof of Lemma
State. For a Gaussian vector x ~ Wu, E),
EE [x))(( tr(H(xx)),
where H(x) = - is the Hessian of the log-density.
1-11
Proof. A Gaussian log-density has
log (ogp(x)= - 1)) const.,
so (x)) = -- --- and s(x) = = -- --'
(x - 11). Then
2 = (x- T - 4).
Taking expectation, using E[(x 11) TA(x [4]] ()(AE)) we get [x|
(x) || = --
This result generalizes to non non-Gaussian distributions under weak regularity conditions (Hyvärinen, 2005). Although we chose the Gaussian assumption to facilitate theoretical extensions and applications, we will still present the original generalization here.
15

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landseapes
B.2. Generalization of Lemma 4.1
State. For a random vector x p(x) with regularity conditions [|||(
and lim p(x)s(x)
l 100
E [1ss(x)]]]] -R
Proof. Write s;(x) = Öz, l(x) Because 8, p = Ōz.P.
B [||s(x)]
Σ)
sx(x)) 0x.p(x)) dxc
i=1
For each i integrate by parts:
J st s.
/ Ocl[pss] dx dx- pde,s ss dx.
The first term is surface integral over the sphere of radius R: by the assumed boundary condition it vanishes R oc. Hence 8i Or,p - 2r 84- Summing over gives
[|) = p(x) Σ Sx, (x(x) dx= (x)]]
B.3. Proof of Lemma
State. For x N(1, E) and x/e (1 E,):
E Exxp(xlo) [||((x, s(x) =1) pc)11 (+((()))) Hx(x))) H=*(x))
where H(x)= = - and Hx(x) = =-E-.
Additionally, if EE = E.E and Me then
Σ (Ai )1.0
Exxp(xte
Ai,
where Xi, Xi,o are eigenvalues of Hx) and Hx(x).
Proof. Let sxx) --''xx (1) and s(x, c) -E-1(x 14.) denote the Gaussian functions for the unconditional
and conditional distributions. Then
s(x,c) - s((x) -E pc) --- p).
Taking the expectation,
Ex-p(xle) [I] --- (4)) + I- -1)1121 - Ex Exm((xl) 10- (x - 13]
Exxp(xle) [||-] (x []]
Ex-p(xle) [xx 88-M4 Ho) Σ.- E-- - (x 11]
Ex-p(x)e [xx - 11) " " (x u.)]
-tr(E=") tr(E --²2z)) + (14 - 11) T - 1t)
- -tr(2) 1 '26) tr(E urE-'E -'-''-1 >''E))
= = = =1]l + tr((-11 -
16

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landseapes
if c.. and ΣΣ. E.E so that Σ and Σe¹ are simultaneously diagonalizable Σ- QAQ and E QAQQQ T, the trace term becomes
1r(-11 ) (r(QQAA A - AA)
()1 Ace)
Ai,
B.4. Proof Lemma 4.3
State. For a Gaussian vector x ~ (H, E),
E
where Hxx) = - is the Hessian of the log density.
- Proof. As (x) = -- and s(x) - 1- (x 11),
E {[|{(())((x111}) = =E [(x 11) T TS -x 14) =tr(E tr(E-3)- - -x²)H)x))).
C. Details of the Toy Experiments
This section provides additional details on the 2D and MNIST experiments discussed Section 4.1 For both experiments, we use the DDPM (Ho et al. 2020) framework with the DDIM (Song et al. 2021a) sampler, employing 500 sampling steps. Additionally, to obtain more accurate estimate the Hessian (Jacobian the score function), we utilize the second-order score matching loss proposed by Lu et al. (2022) during model training. Refer to Appendix A. for details.
2D Mixture of Gaussian Experiment. We use mixture of Gaussians with two modes equidistant from zero but with differing covariance scales. One mode is designed with extremely small covariance to induce sharp peak, representing memorization, while the other mode has larger covariance for the opposite case.
The mixture ratio between the two modes is 5:95, with dataset comprising 3,000 samples in total. Empirically, we observed that only samples from the mode with extremely small covariance exhibited memorization, indicated by extremely small fz distances between the generated samples and training samples.
MNIST Experiment. the MNIST experiment, we use two digits: "3" for the generalized case and "9" for the memorized case, with 3,000 samples each. Classifier-free guidance (Ho Salimans| (202)) (CFG) is employed, training the unconditional score function s(x;) with a probability p 0.2 using all 6,000 samples.
For s(x,,e) c). all samples of digit "3" are used to enable generalization and diversity, while single sample of digit "9" (duplicated 100 times) is used to collapse the model's output for this digit into single conditioned image. Sampling is performed with a guidance scale of 5. As expected, even with CFG, the model generates only a single image for digit "9," while producing diverse outputs for digit "3."
In Figure 2 for the non-memorized case, we sample 1,000 images and select the top 500 samples with the largest pairwise &g distances from training samples to highlight cases clearly deviating from memorization. For the memorized case, as all images collapse into single image, sample 500 outputs without comparing & distances.
D. Details of the Stable Diffusion Experiments
This section describes the experimental setups for the Stable Diffusion experiments presented Section 4.5 and Section 5
We provide detailed overview of the configurations, including the specific prompts used and the implementation details of the baseline methods.
17

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
We Stable Diffusion v1.4 and v2.0, the same versions in which memorized prompts were identified by (Wen et al. 2024). For both detection and mitigation experiments, use the DDIM sampler (Song et al. 2021a) with 50 sampling Ross et al. (2024).
Models.
steps following Wen et al. 2024);
Prompt Configuration.
Memorized Prompts:
Following recent studies (Wen et al. 2024 Ren et al. 2024 Ross et al. 2024 Chen et al.
2024), we use memorized prompts identified by Webstter (2023) in our experiments. Webster (2023) categorized memorized prompts into three types: 1) Matching Verbatim (MV): Generated images are exact pixel-by-pixel matches with the original paired training image. 2) Template Verbatim (TV): Generated images partially resemble the training image but may differ in attributes like color or style. 3) Retrieval Verbatim (RV): Generated images memorize certain training images but are associated with prompts different from the original captions. The categorization of MV, TV, and RV considers both the memorized portions of generated images and their associations with specific prompt-iman -mage pairs. For instance, prompt generating a pixel-perfect match to a training image is classified as RV, not MV. if the prompt differs from the original training caption. However, in our study, these categories are used to differentiate between images that are exact pixel-level matches and those that replicate specific attributes, such as style or color. For simplicity, we refer exact matches as Exact Memorization (EM) and partial matches as Partial Memorization (PM), without considering their caption associations.
For detection experiments, combine prompts from all categories, resulting in total of 500 memorized prompts for Stable Diffusion v1.4, identical to the prompts used by |Wen et al. (2024), and 219 prompts for v2.0.
While detection experiments only require a prompt set, mitigation experiments necessitate access to the original training images to evaluate SSCD (Pizzi et al. 2022] scores. Consequently, prompts without accessible training images are excluded, resulting in 454 prompts for v1.4 and 202 prompts for v2.0.
Non-memorized Prompts: To ensure diverse distribution of non-memorized prompts, we compile a total of 500 prompts drawn from COCO (Lin et al. 2014), Lexica (Lexica (024). Tuxemon (HuggingFace) (024). and GPT-4 (Achiam et al.
2023). Specifically, the GPT-4 prompts are a random subset of those used by (Ren et al. 2024).
D.1. Memorization Detection
Details for Baseline Methods. We provide details of each baseline detection algorithm.
Tiled lg distance: Building on the insight that memorized prompts produce similar generations regardless of their initializations, Carlini et al.] (2023) propose examining generation density by analyzing multiple generated images for a given prompt using pairwise fg distances in pixel space. To address false positives from similar backgrounds, Carlini et al. (023) divide images into non-overlapping 128 128 tiles and compute the maximum l2 distance between corresponding tiles. We adopt the identical setting for both Stable Diffusion v1.4 and v2.0. As the detection performance of this metric achieves the best after full sampling steps, we only report the complete 50-step results in Table [
(Ren et al. 2024); Based on the empirical observation that patterns in attention scores for specific tokens (termed as "trigger tokens") behaves differently in memorized samples, Ren et al. (2024) introduce the detection score D and layer-specific entropy Ei_r as primary indicators of memorization.
The first metric D, which we refer to Average Entropy (AE) for intuitive notation, is defined as:
Tn-1 E
To
AE
TD
TD
Σ
E
summary
T
summary
where E, represents attention entropy, measuring the dispersion of attention scores across different tokens:
E, ā. log(a.).
In addition, Eeqummary is the entropy computed only on the summary tokens, and Tp = T corresponds to the last T 5
steps of the reverse diffusion process used for memorization detection.
The second metric, layer-specific entropy Fi_T, which we refer to Layer Entropy (LEE,, is computed at the first
18

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes
diffusion step and focuses on specific U-Net layers:
LE Σ ब. log(a,),
where o; is the average attention score in layer I. For detection experiments, follow the implementation and hyperparameter settings of Ren et al. (2024). The detection performance differences between our results in Table and those reported in Ren et al. (2024) can be attributed to different choices of non-memorized prompts. Specifically, our evaluation uses prompts collected from diverse sources, whereas Ren et al. (2024) utilizes GPT-4 generated prompts that share similar characteristics. For comprehensive experimental details, we refer readers to Ren et al. (2024).
(Wen et al., 2024): Building on the insight that significant text guidance induces memorized samples during sam- pling, Wen et al. (2024) propose using the magnitude of predicted noise difference between conditional and uncondi- tional noise. defined as:
T Σ T
[c,((x,,) c) - co(x,, 0)1I,
where T denotes the number of timesteps, denotes the specific embedded prompt, and @ denotes empty string, equivalent to unconditional case. Recall that diffusion forward process (x)o(x|(xo) = _N(aarxo, (1 ax) and therefore.
[ EX(x)) vI ag
60(x)) so (xx).
Vx, log Pxx.) (x0) Vx, log ((xx(((x)))) [xo]] (x0(
vI at.
Thus,
(x,, - so (x+x) v1 (xo(x c) ca (x,, 0)]-
Consequently, Wen's metric can be defined as the norm of score differences as described in Section 4.3
Building on the observation that the end token exhibits abnormally high attention scores for memorized prompts, specifically highlighting the memorized region, Chen et al. (2024) leverage this attention score as a mask to amplify the detection of the Partial Memorization (PM) cases. We refer this metric as Bright Ending (BE) for short.
(Chen et al., 2024):
In detail, Chen et (2024) multiply the attention mask m on Wen's metrie:
BE
(x) co 0)) mll
m;
T
N
where N denotes for the number of elements in the mask m, therefore the result is normalized by the mean of m. We note that the attention mask m is obtainable the final sampling step (f 1). Therefore, to utilize BE as detection metric, the model requires completion of all sampling steps. Consequently, Table I we report experimental results using the complete 50-step diffusion process.
In addition, following the identical setup as Chen et al. (2024). we average attention scores from the first two downsampling layers of U-Net to obtain m for both Stable Diffusion v1.4 and v2.0. For additional details, refer to the original paper of Chen et al. (2024).
D.2. Memorization Mitigation
Details for Baseline Methods. We provide details for each recent baseline mitigation algorithm. For every mitigation strategy, results are averaged over five generations per memorized prompt. Additionally, each baseline is evaluated using five different hyperparameter settings, which are described in detail below.
Random Token Addition (RTA) & Random Number Addition (RNA): Somepalli et al. 2023b propose mitigation
strategies that perturb prompts by adding arbitrary tokens numbers. Following Wen al. 2024 insert tokens or
numbers in quantities of [1, 2, 4, 6, 8) for both RTA and RNA.
19

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landseapes
(Ren et al. 2024) Ren al. 2024) propose mitigation strategy that involves masking memorizationnindducng tokens
and rescaling the attention scores of the beginning token using hyperparameter C. After token masking, evaluate the approach by varying C' within the range {1.1, 1.2, 1.25, 1.3, 1.5] for both v1.4 and 2.0.
(Wen et al. 2024): As explained Appendix D.1 Wen et al. 2024) propose a differentiable metric based on the norm of the difference between the conditional and unconditional scores. Since memorized prompts empirically exhibit large magnitude for this term, Wen et al. 2024 optimize the text embedding by directly minimizing it.
Wen et al. (2024) introduce largett hyperparameter for early stopping, to prevent the text embedding from deviating significantly from its original semantic meaning. Following Wen et al. (2024), we investigate larget values ranging from in Stable Diffusion v1.4. However, in v2.0, we found the generated results be more sensitive, Therefore, for v2.0, we investigate Larggt values {1, 1.25, 1.5, 2..
Algorithm 2 SAIL pseudo-code
Require: Initialization Xy (0, I), Early stopping threshold fetres, Score function s(-), Loss balancing term a, Step size 17
Ensure: Set LSAu. +- Lo [where Lo > lehres)
while CSAn. > fahrez do
2: Compute A (xT)
s0 (x(, (x(r);;
3: Normalize sØ (xx) with and compute 88 (xr + 5s (xx));
4: Compute SAIL objective:
5: (xAn(xx) || (XT 8. 55 (x7)) ae (xT)ll + a||x>|1?
6: Update initialization: Xr +- XT - Vxy LsAu;
7: end while
Details for Our Method. Algorithm 2 provides pseudo-code for SAIL algorithm. While Algorithm 2 shows the case of optimizing a single Xr, in practice, it can simultaneously search for several memorization-free candidates by collectively optimizing several initializations a batch fashion.
To employ SAIL, we need to set a and ltrres- We set a 0.05 for Stable Diffusion v1.4 and a 0.01 for v2.0. In practice, we observe that the generated results are largely insensitive a, though keeping sufficiently small helps balance the magnitude of two loss terms effectively. In addition, investigate Lihres (7.6, 7.8, 8.2, 8.6, 9} for vl.4 and (4, 4.5, 5, 5.5, 6} for v2.0.
As the metric proposed by Wen et al. (2024) also captures sharpness, one may consider replacing the first term of CsAn. with || (x,, e) - so (x,) However, we empirically find that this alternative fails to converge and is therefore incffective for mitigation. This may due the higher sensitivity of our proposed metric during the initial phase of generation.
Details of prompts Figure We provide full prompt details with a key prompt detail in bold, starting from top image.
<i>The Colbert Report<i> Gets End Date
Björk Explains Decision To Pull <i> Valnicuura From Spotify
Netflix Hits 50 Million Subscribers
<omtSouth Park: The Stick of Truah<em> Review (Multi Plaafo-)
20

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landseapes
E. Additional Qualitative Results for Memorization Mitigation
Original
Ours
Ren et al.
Wen et al.
RNA
RTA
BELL REARMON
<j> Breaking Bad<i> Fans Get a Chance to Call Saul with Albuquerque Billboard
35 Possible Titles for the <i>Mrs. Doubtfire<i> Sequel.
Baby Shower Turned Meteor Shower: Anne Hathaway Fights Off Aliens in Sci-Fi Comedy <i>The Shower<jp
Listen to Ricky Gervais Perform "Slough" David Brent
T
Will Ferrell, John C. Reilly in Talks for <i>Border Guards<i>
Ki
WILL PIGKRGILY RIR
IST
Here's Who Ian McShane May Be Playing in <i>Game of Thrones<i> Season Six
Figure 7: Additional qualitative results comparing SAIL with baseline methods. Original prompts are shown for each row with key elements in bold. All methods use identical initialization per prompt. SAIL effectively mitigates memorization while preserving prompt details, whereas baseline methods that modify text conditioning exhibit quality degradation.
21

---

Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landseapes
Original
Ours
Ren et al.
Wen et al.
RNA
RTA
Amazing Chesapeake Bay Retriever dog Print Car Seat Covers-Free Shipping
Design Art Beautiful View of Paris Paris Eiffel Tower under Red Sky Ultra Glossy Cityscape Circle Wall Art
NRLW
ER
V'SS Siaiegss
HUPPOS
FOTC
INTERVIEW
INTIEOVIEW
Sony Won't Release <i>The Interview<i> on VOD
If Barbie Were The Face of The World's Most Famous Paintings
Full body U-Zip main opening Full body U-Zip main opening on front bag for easy unloading when you get to camp
TIEE
TIME
FRESS
Image of Time Fries when i'm with you Short-Sleeve Unisex T-Shirt CalvinMade
Figure 8: Additional qualitative comparison of SAIL against baseline methods. Each row shows original prompts with key elements bold, and all methods share identical initialization per prompt. SAIL successfully mitigates memorization while preserving prompt details, whereas baseline methods with conditioning modifications either degrade image quality or fail mitigate memorization.
22


Reviews:
[{"review_id": "pVuonV1EhD", "reviewer": "Reviewer_TT7u", "summary": "This paper studies the memorization phenomenon in diffusion models, which is a crucial task that is well-motivated by its practical significance in privacy preservation in the era of GenAI. This paper discovers a new pattern that can differentiate memorized and non-memorized generations of diffusion models that is based on the sharpness of the log probability density, quantified by the Hessian of the log probability, serving as a new detection strategy for the memorized generations. Also, it shows the relevance of this pattern with the existing pattern found by Wen et al. Armed with such a finding, this paper proposes a mitigation strategy named SAIL that can efficiently mitigate memorization while being more effective (better text alignment under the same privacy level) than existing baselines. Experiments are conducted on a 2D toy dataset, MNIST, and Stable Diffusion’s LAION dataset.\n\n## update after rebuttal\n\nI have no further questions, so I keep my original rating of accept.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive review and for recognizing our contributions to this topic. We sincerely appreciate the time and effort you dedicated to reviewing our work. Please do not hesitate to reach out with any further questions or suggestions.", "claims_and_evidence": "This paper’s claims are well-supported by its analysis, either as visualizations or in the form of math proofs, and its superior experimental results.", "methods_and_evaluation_criteria": "The benchmark datasets follow the existing baselines, which makes their comparisons well-justified for the task that they address.", "theoretical_claims": "I have carefully checked the equations and claims in the main paper and observed no issues. Nevertheless, I am uncertain about the detailed proofs in the Supplementary Material.", "experimental_designs_or_analyses": "The design of evaluating the proposed detection and mitigation strategies is sound, which follows the baseline that is shown in Table 1 and Figure 6.", "relation_to_broader_scientific_literature": "This paper specifically contributes to the field of understanding and addressing memorization issues in diffusion models. I believe this paper contributes to both theoretical and empirical aspects.", "essential_references_not_discussed": "The paper has provided a comprehensive discussion of the core related papers.", "other_strengths_and_weaknesses": "Please see the previous sections.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "Overall, this is a solid paper to me and I would like to recommend acceptance.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6bqLKOlRcM", "reviewer": "Reviewer_qYB7", "summary": "To alleviate the memory effect of the diffusion model, this paper proposes a sharpness-based detection metric and develops an effective mitigation strategy based on this metric. The strengths of this paper lie in its clarity and the progressive experiments and theoretical analysis that illustrate the rationale and effectiveness of the proposed method. The proposed mitigation strategy outperforms existing methods, while requiring no additional modifications on texts and model architecture.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Connection to [1].\n\t\nWe thank the reviewer for highlighting the connection to [1], which we will properly acknowledge. While both works study memorization through geometric properties of the density, there are key differences:\n- [1] focuses on first-order smoothness via comparisons between trained and oracle scores, whereas our analysis emphasizes second-order geometry through the trained Hessian and explicitly measures sharpness by observing distribution of eigenvalues.\n- We also demonstrate how specific initial latents lead to memorization by consistently mapping into high-curvature regions, further amplified by text conditioning.\n\nWe believe these distinctions clearly position our contributions as complementary to [1], enriching the understanding of memorization in generative models.\n\n> Evidence of key motivation\n\nWe appreciate the concern about the generalizability of our observed phenomenon. While we use MNIST for clarity and intuition, our experimental design extends well beyond this toy dataset. As shown in Figure 3, the key phenomenon, sharpness correlating with memorization, is present in modern, large-scale models like Stable Diffusion.\n\nThis progression from simple to complex domains actually strengthens our motivation by showing that the behavior persists across different datasets. Figure 5 further supports this finding, revealing consistent patterns in the Hessian spectra between memorized and non-memorized samples.\n\n> Works like [1,2] already used curvature properties to discuss memorization.\n\nWe acknowledge that prior works [1, 2] have explored memorization and data complexity through curvature-related concepts. However, our contribution advances beyond these studies in both scope and methodology. While [2] examines curvature only at the final generation stage, we introduce a dynamic framework that analyzes sharpness throughout the entire diffusion process across all timesteps. This continuous perspective enables earlier detection and mitigation of memorization, which we believe are novel and practically valuable contributions.\n\n> Gaussian Assumptions\n\nEmpirical evidence from recent work [3] shows that diffusion models exhibit approximately Gaussian score behavior in early and intermediate steps, supporting the validity of our Gaussian-based assumptions.\n\nAs shown in Figure 4, key metrics like the negative Hessian trace align well with the score norm and Hessian-score product, confirming that our theoretical approximations hold in practice.\n\n> Small differences in eigenvalues\n\nWe understand your concern. While eigenvalue differences at the initial step are small, they become effective when aggregated (e.g., sum or cubed sum). As shown in Table 1, both our metric and Wen’s metric, which measure these statistics, perform well at Step 1. This confirms the usefulness of early-stage eigenvalue signals.\n\nRegarding LID, we excluded it from our detection experiments since it requires full sampling steps, making direct comparison unfair. For reference, we provide our LID results at Step 50:\n- SD v1.4: AUC = 0.974 (n=1), 0.992 (n=4); TPR@1%FPR = 0.184 (n=1), 0.824 (n=4)\n- SD v2.0: AUC = 0.972 (n=1 and n=4); TPR@1%FPR = 0.470 (n=1), 0.216 (n=4)\n\nCompared to our method in Table 1, LID yields significantly lower TPR@1%FPR, especially in SD v2.0. This highlights the effectiveness of our sharpness-based approach, which is essential to the success of our mitigation strategy (Figure 6).\n\n> Performance \\& Time cost compared to Wen's metric\n\nThank you for pointing this out. While our method involves computing a Hessian-score product, the additional cost is minimal due to efficient JVP implementations in standard libraries.\n\nOur metric provides clear computational benefits. As Table 1 demonstrates, it achieves equal or superior AUC compared to Wen's metric with fewer sampling steps (\"steps\") and generations (\"n\"). Using SD v1.4, we compare the runtime (in seconds) between these metrics below, with **bold** entries indicating where both methods achieve equivalent AUC. \n\n|-|Step 1|Step 5|Step 50|\n|-|-|-|-|\n|Wen et al. (n=1)|0.233|0.431|3.211|\n|Wen et al. (n=4)|0.728|1.323|11.25|\n|Wen et al. (n=16)|1.326|**1.955**|**16.55**|\n|||||\n|Ours (n=1)|0.412|–|–|\n|Ours (n=4)|**0.882**|–|–|\n\nOur metric is also critical for SAIL. While Wen’s metric is effective for detection, we found that using it as SAIL objective (line 360) led to optimization failure. In our case, the amplified early-stage differences enabled stable convergence and effective mitigation.\n\n> SAIL may not be applicable to SDE.\n\nWhile most of prior works focus on ODE samplers for analysis, we believe SAIL can still be applied to SDE samplers in expectation by selecting good initializations. We agree this is a valuable direction for future work.\n\n[1] Wang et al. \"On the discrepancy and connection...\", ICML Workshop, 2024\\\n[2] Kamkari et al. \"A geometric view of data...\", ICML Workshop, 2024\\\n[3] Wang et al. \"The Unreasonable Effectiveness...\", TMLR, 2024.", "claims_and_evidence": "1. The metric analyzed in this paper is almost identical to that in [1], with the main difference being whether it analyzes the first-order properties of the score function or the denoiser. The difference between the two lies only in a constant, resulting in nearly no distinction in properties such as the Jacobian. Additionally, conclusions like \"smoother regions tend to yield non-memorized images\" (line 375) also appear in [1]. However, this paper does not discuss that work, which weakens its contribution.\n\n2. The key motivation of this paper (see Lines 160-164) lacks sufficient evidence. Although the expected phenomenon is observed on toy data such as MNIST, merely observing the phenomenon does not justify the validity of this key motivation. Could additional theoretical explanations or further analysis be provided?\n\n[1] Wang, Hanyu, Yujin Han, and Difan Zou. \"On the discrepancy and connection between memorization and generation in diffusion models.\" ICML 2024 Workshop on Foundation Models in the Wild. 2024.", "methods_and_evaluation_criteria": "1. Works like [1,2] have already used curvature properties to discuss memorization, and this paper seems to upgrade Wen’s metric while introducing the additional assumption that \\( x_t \\) follows a Gaussian distribution.\n\n2. To facilitate the computation of the proposed metric, the authors introduce several approximations. Such as Lemma 4.1, which connects the trace with the norm of the score function, Lemma 4.2, which links Wen’s Metric to the proposed Sharpness Measure, or Lemma 4.3, all assume a Gaussian distribution. These assumptions raise concerns regarding the discrete diffusion model's reverse process and prompt a crucial question: how accurate is the improved metric in real-world scenarios?\n\n[2] Kamkari, H., Ross, B. L., Hosseinzadeh, R., Cresswell, J. C., and Loaiza-Ganem, G. A geometric view of data complexity: Efficient local intrinsic dimension estimation with diffusion models. In ICML 2024 Workshop on Structured Probabilistic Inference & Generative Modeling, 2024.", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "1. The right-side image in Figure 2 shows that the eigenvalues of memorized and non-memorized samples at the initial sampling step are not very large. A similar issue appears in Figure 3, where at \\( t = T-1 \\), the differences between different memorization categories are not significant enough. This undermines the necessity of monitoring memorization throughout the entire sampling process, making the advantage over works like LID less compelling.\n\n2. Table 1 shows that the proposed method performs very similarly to Wen’s metric. For example, at \\( T = 1 \\), the AUC difference is only between \\( 1e{-3} \\) and \\( 1e{-2} \\). Moreover, the proposed metric requires the additional computation of the Hessian matrix.\n\n3. The proposed mitigation strategy may not be applicable to stochastic sampling methods such as SDE.", "relation_to_broader_scientific_literature": "This paper proposes a new metric and method to detect the memorization of diffusion models. The underlying principle, such as the use of sharpness, has appeared in previous work. The authors leverage this property and further improve the existing Wen’s metric, achieving enhancement.", "essential_references_not_discussed": "See Claims And Evidence.", "other_strengths_and_weaknesses": "N/A", "other_comments_or_suggestions": "N/A", "questions_for_authors": "N/A", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "bjOMb3k6RA", "reviewer": "Reviewer_SF4v", "summary": "This paper proposes to understand and mitigate the memorization of diffusion models from the perspective of the sharpness of probability landscapes. More specifically, it first shows that the large negative eigenvalues of the Hessian matrix, which reflects the sharpness, can indicate the risk of memorization. It then proposes a computationally efficient metric (i.e., Hessian trace and score norm) to measure the sharpness. The authors also show that the popular Wen’s metric can be explained from the aspect of sharpness and enhances Wen’s metric to enable the early-stage detection of memorization. Finally, the authors develop a sharpness-aware initialization method to mitigate the memorization. Experimental results on MNIST and Stable Diffusion reveal that the memorization of the diffusion model can be detected and mitigated by the sharpness-based method provided by the authors.\n\n## Update After Rebuttal\nI think my concerns are addressed by the rebuttal. Therefore, I prefer to maintain my original rating of 4, showing that I tend to accept this paper.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Evaluate methods on more datasets.\n\nThank you for the suggestion. For our Stable Diffusion experiments, we adopted the established benchmark of known memorized prompts introduced by [1], which has become a standard dataset in the current literature [2-4]. In line with prior work, we made an effort to comprehensively include all verbatim categories within this benchmark.\n- [1] Webster, \"A reproducible extraction …\" arXiv. 2023. \n- [2] Wen et al. \"Detecting, explaining, and mitigating …\", ICLR. 2024.\n- [3] Ren et al. \"Unveiling and mitigating memorization …\", ECCV, 2024.\n- [4] Chen et al. \"Exploring local memorization …\", ICLR, 2025.\n\n> Empirical results in Table 1 (Comparison with Wen’s metric at step 1)\n\nThank you for the suggestion. We would like to highlight the advantages of our upscaling method from two perspectives: detection and mitigation.\n\n**Computational Cost**\n\nOur metric offers clear computational benefits in detection. As shown in Table 1, our approach consistently achieves comparable or superior performance while requiring substantially fewer sampling steps (“Steps”) and fewer simultaneous generations (“n”) compared to Wen’s metric. This efficiency is especially valuable in practical scenarios such as real-time detection.\n\nBelow, we present a comparison of computation time (in seconds) between Wen’s metric and ours using Stable Diffusion v1.4. We highlight in **bold** the entries where both methods achieve equivalent AUC performance.\n\n|-|Step 1|Step 5|Step 50|\n|-|-|-|-|\n|Wen et al. (n=1)|0.233|0.431|3.211|\n|Wen et al. (n=4)|0.728|1.323|11.25|\n|Wen et al. (n=16)|1.326|**1.955**|**16.55**|\n|||||\n|Ours (n=1)|0.412|–|–|\n|Ours (n=4)|**0.882**|–|–|\n\nAs shown above, our method achieves similar or better performance at a clearly lower computational cost. We also expect further efficiency gains if the JVP operation is optimally integrated into libraries such as Hugging Face. \n\n**Harder Detection Cases in SD v2.0:**\n\nUnlike Stable Diffusion v1.4, which includes both Exact and Partial memorized samples, v2.0 contains only Partial memorized prompts, making the detection task more challenging. The more pronounced performance gap between our method and Wen’s metric in this setting empirically demonstrates the effectiveness of our upscaling approach.\n\n**Mitigation - SAIL Optimization:**\n\nOur metric is also crucial for SAIL. Although Wen's metric works well for detection, using it in the SAIL objective (line 360) resulted in optimization failure. Our approach, however, successfully achieved stable convergence and effective mitigation by amplifying differences in the early stages.\n\n> How to solve SAIL in Section 5.1\n\nThank you for the question. While we provide detailed pseudocode for SAIL in Appendix D.2, we are happy to explain it here as well.\n\nThe SAIL objective involves two forward passes at the initial sampling step ($t=T-1$). \n- In the first pass, we compute the score difference $s_{\\theta}^\\Delta(\\mathbf{x}_T) $. \n- We then perturb the initialization slightly in the direction of this score difference, i.e., \n$\\mathbf{x}_T +  \\delta \\cdot s\\_\\theta^\\Delta (\\mathbf{x}_T) $, \n- and perform a second forward pass to obtain \n$s_{\\theta}^\\Delta\\bigl(\\mathbf{x}_T + \\delta \\cdot s\\_{\\theta}^\\Delta(\\mathbf{x}_T)\\bigr) $. \n\nWith these components, we optimize the initial noise $ \\mathbf{x}_T$ sampled from an isotropic Gaussian using the SAIL objective (refer to line 373).\n\nThis optimization is lightweight and typically converges within two to three iterations on average, depending on the threshold hyperparameter  $ \\ell_{\\text{thres}} $. SAIL also supports batch-wise execution, allowing multiple initializations to be optimized in parallel. Please feel free to let us know if any part requires further clarification.\n\n> In Figure 6 (left), for SAIL, why can the CLIP score not reach larger values like the other baselines?\n\nWe appreciate your valuable question. It is indeed possible to achieve higher average CLIP scores with SAIL by adjusting its threshold hyperparameter $\\ell_{\\text{thres}}$. \n\nHowever, we would like to clarify that, empirically, algorithms achieving high CLIP scores alongside high SSCD scores (e.g., > 0.35) often produce outputs that are only superficially altered. These include blurry or partially contaminated memorized images, which are difficult to consider genuinely mitigated.\n\nFor all baseline methods, we carefully selected hyperparameters based on their original papers to ensure a fair comparison. In contrast, for SAIL, we prioritized configurations that provide strong memorization mitigation. Notably, across extensive hyperparameter sweeps, SAIL consistently achieved the lowest points on the SSCD -CLIP performance trade-off curves in both Stable Diffusion v1.4 and v2.0.\n\n>  In the Figure 3 (right), did you miss the negative sign in the y-axis?\n\nThank you for pointing this out. The reviewer is correct and we will revise it accordingly in the final version.", "claims_and_evidence": "I believe that the claims made in the submission are supported by clear and convincing evidence.", "methods_and_evaluation_criteria": "The proposed method and evaluation are reasonable for detecting and mitigating the memorization in diffusion models.", "theoretical_claims": "To the best of my knowledge, I think the proofs for the theoretical claims (Lemma 4.1-4.3) should be correct.", "experimental_designs_or_analyses": "I have checked the experimental designs and analyses. I think the evaluation is valid.", "relation_to_broader_scientific_literature": "I think this paper is highly relevant to Wen’s metric [1] and the LID work [2, 3].    \n     \n[1]. Wen, Y., Liu, Y., Chen, C., and Lyu, L. Detecting, explaining and mitigating memorization in diffusion models. In ICLR, 2024.   \n[2]. Ross, B. L., Kamkari, H., Wu, T., Hosseinzadeh, R., Liu, Z., Stein, G., Cresswell, J. C., and Loaiza-Ganem, G. A geometric framework for understanding memorization in generative models. arXiv preprint arXiv:2411.00113, 2024.    \n[3]. Kamkari, H., Ross, B. L., Hosseinzadeh, R., Cresswell, J. C., and Loaiza-Ganem, G. A geometric view of data complexity: Efficient local intrinsic dimension estimation with diffusion models. In ICML 2024 Workshop on Structured Probabilistic Inference & Generative Modeling, 2024.", "essential_references_not_discussed": "I think the essential references have been covered by the authors.", "other_strengths_and_weaknesses": "The strengths of the paper are listed as follows.     \n1. The paper is well-written and well-developed, making it easy to follow. Even if the readers have little background knowledge, they can easily get the key points of the paper.\n2. All of the important claims in the paper are supported by both theoretical analysis or proof and empirical evaluation.\n3. The idea is novel. To the best of my knowledge, it is the first work to understand and mitigate the memorization of the diffusion model from the perspective of sharpness.\n4. The proposed method is practical. The proposed methods to detect and mitigate memorization are computationally affordable and can be used in real applications.   \n       \nThe other weaknesses of the paper are listed as follows.      \n1. It would be better if the authors could evaluate their methods on more datasets. However, given the theoretical analysis from the authors, I think it is just a minor weakness.\n2. For section 4.4, the existing empirical results in Table 1 do not show an obvious improvement over Wen’s metric at step 1. It would be better if the authors could find a case where Wen’s metric performs badly to support the importance of upscaling.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "1. In Section 5.1, how do you solve the formulated objective problem for sharpness-aware initialization?    \n2. In the right part of Figure 3, did you miss the negative sign for the lower part values in the y-axis?   \n3. In the left part of Figure 6, for the proposed method, why can the CLIP score not reach larger values (e.g., > 0.26) like the other baselines?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "SDSquftK7i", "reviewer": "Reviewer_zVVR", "summary": "The paper presents a geometrical analysis of memorization in generative diffusion models based on the Hessian of their energy function around generated points. The idea follows naturally from recent results on the geometry of generative diffusion, which relate memorization and generalization to the spectrum of eigenvalues of the energy landscape. Based on these ideas, the paper introduces an effective and tractable method to detect memorized samples, which is shown to have high accuracy compared with established baseline. The authors also provide an initialization method that is shown to mitigate the generation of memorized examples.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Relation between the trace of the Jacobian and the norm of the score function in the non-Gaussian case\n\nThank you for the insightful comment regarding the relation between the trace of the Jacobian and the score norm in the non-Gaussian case.\n\nWe found that Lemma 4.1 is indeed generalizable beyond the Gaussian case under mild boundary conditions [1] (e.g., $\\lim_{|\\mathbf{x}| \\to \\infty} p(\\mathbf{x}) = 0$ and $\\lim_{|\\mathbf{x}| \\to \\infty} p(\\mathbf{x}) \\nabla \\log p(\\mathbf{x}) = 0$), under which the identity\n\n$\\mathbb{E}[\\||s(\\mathbf{x}) \\||^2] = -\\mathbb{E}[\\mathrm{tr}(H(\\mathbf{x}))]$\n\nholds in general where the trace is now in expectation. \n\nWe also appreciate the suggestion to consider Tweedie's formula for Lemma 4.3. We are currently revisiting the proof and will consider incorporating it into the formulation. Regarding Lemma 4.2, which quantifies the gap between conditional and unconditional distributions, we chose Gaussian assumption to ensure tractability and interpretability. This choice is supported by prior work [2] and the empirical trends shown in Figure 4, making our approximation both practical and well-justified.\n\n- [1] Hyvärinen, \"Estimation of Non-Normalized Statistical Models by Score Matching\", JMLR, 2005.\n- [2] Wang et al. \"The unreasonable effectiveness of gaussian score approximation for diffusion models and its applications.\" TMLR, 2024.\n\n> Connections with modern Hopfield networks\n\nWe sincerely thank the reviewer for highlighting important theoretical connections between our paper and recent work on modern Hopfield networks. As pointed out by the reviewer, [1] demonstrates that large class of diffusion models asymptotically yield energy landscapes equivalent to modern Hopfield networks, where memorized states correspond to local minima. [2] similarly presents an insightful perspective by interpreting diffusion models as a extension of associative memory retrieval, showing that the iterative denoising process parallels recurrent energy minimization in Hopfield-like networks. Their framework highlights how the dynamic updating of latent variables in diffusion models can be cast as an attractor-based process, reinforcing the broader view of diffusion as a form of associative memory. \n\nOur paper shares the central theoretical idea-that memorized states are sharp minima-but differs in scope and methodology. While these referenced studies focus on establishing theoretical equivalences and analyzing associative memory capacity, our contribution lies in explicitly quantifying sharpness via Hessian eigenvalues and score norms as an early-stage utility tool to detect and mitigate memorization during model inference. We greatly appreciate the reviewer's insightful suggestion to clarify these theoretical connections, as this strengthens the context and clarity of our work.\n- [1] Ambrogioni \"In search of dispersed memories: …\", Entropy, 2024\n- [2] Hoover et al. \"Memory in Plain Sight:...\", NeurIPS Workshop, 2023.\n\n\n> Connection with the eigenbasis framework\n\nWe sincerely appreciate your valuable suggestions, particularly regarding closely related studies that enrich the theoretical context of our work. The concurrent work [1] rigorously characterizes geometric memorization through analysis of the score function's Jacobian eigenstructure. The authors identify memorization onset when spectral gaps between singular values close, indicating the manifold's tangent-space structure has collapsed. This eigenbasis approach aligns with our central idea-that memorization corresponds to increased local curvature, which implies very small local variance in the density. We find their elegant mathematical formulation very insightful and acknowledge the deep theoretical contributions they've made to understanding generative model memorization.\n\nHowever, while their detailed eigenanalysis can be computationally prohibitive for large-scale diffusion models like Stable Diffusion, our approach simplifies the process by using the Hessian score product as a summary statistic. This streamlined method maintains theoretical coherence while efficiently monitoring and mitigating memorization in high-dimensional generative models. \n\nSimilarly, [2] demonstrates how strong generalization naturally emerges through geometry-adaptive harmonic representations. Their work shows that optimal denoisers implicitly operate within a geometry-adaptive basis, explaining how diffusion models achieve generalization without exponentially large datasets. While they characterize the adaptive basis underlying generalization, our contribution focuses specifically on sharpness as a direct, practical measure of memorization, complementing their basis-oriented theoretical analysis. We are grateful for these insightful references to the reviewer and will update our manuscript accordingly.\n- [1] Achilli, Beatrice, et al. \"Losing dimensions: ….\", arxiv, 2024\n- [2] Kadkhodaie et al. \"Generalization in diffusion models arises …\", ICLR, 2024.", "claims_and_evidence": "The main claims are well supported both on an intuitive and on an experimental level. However, some of the theoretical considerations are somewhat handweavy and should be further elaborated. In particular, it would be important to clarify the relation between the trace of the Jacobian and the norm of the score function in the general non-Gaussian case.", "methods_and_evaluation_criteria": "The experimental analysis is comprehensive and it provides robust results in favor of the main claims.", "theoretical_claims": "The intuitive ideas are very well motivated but the paper would have benefited from a more rigorous theoretical approach in the non-Gaussian case. I think it should be possible to obtain general formulas that relate the norm of the score to the trace in the general case, possibly using a second order Tweedie's Formula.\nIt would be nice to see if the authors can derive a general formula. I think it should also be possible to provide more rigorous theoretical motivations for the upscaling formula.", "experimental_designs_or_analyses": "The experiments and well executed and provide solid support to the claims.", "relation_to_broader_scientific_literature": "I do think that the main innovation of the paper is the introduction of the Hessian upscaling method. In general, I appreciated how this work used competently and effectively several ideas that were floating in the geometric analysis of diffusion models through their Jacobian spectra. A very related piece of literature is given in [1], where the onset of (geometric) memorization is identified by the closure of spectral gaps in the Jacobian, which can be connected directly to the onset of sharpness in the trace.\nIt would also be useful to discuss the connections with modern Hopfield networks, which has been shown to be equivalent to diffusion models in the memorization regime [2,3]. Finally, the analysis should be connected with the similar results in [4], which studies the onset of generalization through a similar analysis of the Jacobi matrix.\nI do think that the main innovation of the paper is the introduction of the Hessian upscaling method. In general, I appreciated how this work used competently and effectively several ideas that were floating in the geometric analysis of diffusion models through their Jacobian spectra. A very related piece of literature is given in [1], where the onset of (geometric) memorization is identified by the closure of spectral gaps in the Jacobian, which can be connected directly to the onset of sharpness in the trace.\n\nIt would also be useful to discuss the connections with modern Hopfield networks, which has been shown to be equivalent to diffusion models in the memorization regime [2,3]. These works already highlighted some of the ideas discussed here, for example the fact that memorized states should have sharp energy wells around them. \n\nFinally, the analysis should be connected with the similar results in [4], which studies the onset of generalization through a similar analysis of the Jacobi matrix.", "essential_references_not_discussed": "[1] Achilli, Beatrice, et al. \"Losing dimensions: Geometric memorization in generative diffusion.\" arXiv preprint arXiv:2410.08727 (2024).\n[2] Ambrogioni, Luca. \"In search of dispersed memories: Generative diffusion models are associative memory networks.\" Entropy 26.5 (2024): 381.\n[3] Hoover, Benjamin, et al. \"Memory in plain sight: A survey of the uncanny resemblances between diffusion models and associative memories.\" Associative Memory {\\&} Hopfield Networks in 2023. 2023.\n[4] Kadkhodaie, Zahra, et al. \"Generalization in diffusion models arises from geometry-adaptive harmonic representations.\" arXiv preprint arXiv:2310.02557 (2023).", "other_strengths_and_weaknesses": "The main strengths are in the ideas and in the experimental evaluations and results. The main weakness is in the lack of rigor in several theoretical points. However, I am of the opinion that the main ideas can be fully formalized in a very elegant way and I would encourage the authors to work on obtaining more general theoretical results.", "other_comments_or_suggestions": "None", "questions_for_authors": "None", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper studies the important and interesting problem of memorization in diffusion models using ideas and tools from geometry to analyse the sharpness of the probability landscape. The authors’ ideas build on recent literature that has also taken a geometric approach to understanding diffusion models, and therefore is well-placed in contemporary work. The authors propose a metric that can measure sharpness and relate this to an existing metric to enhance how it can indicate whether an image is likely to be memorized. Methods to mitigate memorization are also given.

The reviewers raised several points about the paper, including some additional papers that could be discussed, request to expand on the experimental results, and demonstrate more clearly where their work improves over Wen’s metrics. However, these points were not major obstacles for the submitted work, and several reviewers replied that they were satisfied by the discussions. Hence, it is clear that this paper should be recommended for acceptance.
Decision: Accept (spotlight poster)