When Diffusion Models Memorize: Inductive Biases in Probability Flow of Minimum-Norm Shallow Neural Nets
Authors: Chen Zeno
Hila Manor
Greg Ongie
Nir Weinberger
Tomer Michaeli
Daniel Soudry
Venue: ICML 2025 poster (2025)
Keywords: Probability flow
Score flow
Diffusion models
Memorization
Denoising
Neural networks
Primary area: deep_learning->theory
TL;DR: We analyze when diffusion probability flow converges to training data or more general manifold points, using shallow ReLU denoisers with minimal L2 norm.

Abstract: While diffusion models generate high-quality images via probability flow, the theoretical understanding of this process remains incomplete. A key question is when probability flow converges to training samples or more general points on the data manifold.
We analyze this by studying the probability flow of shallow ReLU neural network denoisers trained with minimal $\ell^2$ norm. For intuition, we introduce a simpler score flow and show that for orthogonal datasets, both flows follow similar trajectories, converging to a training point or a sum of training points. However, early stopping by the diffusion time scheduler allows probability flow to reach more general manifold points.
This reflects the tendency of diffusion models to both memorize training samples and generate novel points that combine aspects of multiple samples, motivating our study of such behavior in simplified settings. We extend these results to obtuse simplex data and, through simulations in the orthogonal case, confirm that probability flow converges to a training point, a sum of training points, or a manifold point. Moreover, memorization decreases when the number of training samples grows, as fewer samples accumulate near training points.

When Diffusion Models Memorize: Inductive Biases in Probability Flow of Minimum-Norm Shallow Neural Nets
Chen Zeno Hila Manor! Greg Ongie?
Nir Weinberger Tomer Michaeli Daniel Soudry'
Abstract
function of coussian-blurred version of the data distribution. The connection between the score function and the denoiser, often called Tweedie's 's identity (Robbins, 1956; Miyasawa et al., 1961; Stein, 1981), holds only un- der optimal Bayes estimation. Moreover, for the estimated score to be a true gradient field, the denoiser must have symmetric positive semidefinite Jacobian matrix (Chao et al., 2023; Manor & Michaeli, 2024). However, in practice, neural network denoisers are used, and their Jacobian matrix is generally non-symmetric, raising open questions about the convergence of the sampling process in ccore-based diffusion algorithms.
While diffusion models generate high-quality im- ages via probability flow, the theoretical under- standing of this process remains incomplete. key question is when probability flow converges training samples more general points the data manifold. We analyze this by studying the probability flow of shallow ReLU neural network denoisers trained with minimal e norm. For in- tuition, we introduce a simpler score flow and show that for orthogonal datasets, both flows fol- low similar trajectories, converging to a training point sum of training points. However, early stopping by the diffusion time scheduler allows probability flow to reach more general manifold points. This reflects the tendency of diffusion models to both memorize training samples and generate novel points that combine aspects of mul- tiple samples, motivating our study of such behav- ior in simplified settings. We extend these results to obtuse simplex data and, through simulations in the orthogonal case, confirm that probability flow converges to training point, sum of training points, or manifold point. Moreover, memo- rization decreases when the number of training samples grows, as fewer samples accumulate near training points.
Diffusion models typically use a stochastic sampling pro- cess, which can be described by a stochastic differential equation (SDE) (Song al., 2021b). Alternatively, a deter- ministic version of the sampling process can also be used, formulated as an ordinary differential equation (ODE) (Song et al., 2021a), called the probability flow ODE. We aim to theoretically analyze the probability flow, in order to illu- minate this complex sampling process. However, practical diffusion architectures are typically deep and not fully con- nected, making it difficult to obtain theoretical guarantees without making additional strong assumptions (e.g., assum- ing linearized regime, like the neural tangent kernel (Jacot et al., 2018)). Therefore, in this paper, we focus on diffusion models based on shallow ReLU neural network denoisers. Such networks are simple enough to allow for a thcoretical investigation yet rich enough to offer valuable insights.
1. Introduction
To gain insight into the dynamics of the probability flow ODE, we also explore simpler ODE, which corresponds to flowing in the direction of the score of the noisy data distribution, for a fixed noise level. We call this the score- flow ODE. The score flow aims to sample from one of the modes of the noise-perturbed data distribution. We explore both the probability flow and the score flow ODEs for denoisers with minimal representation cost that perfectly fit the training data. Our analysis reveals that, for small noise levels, the trajectories of both flows are similar for given initialization. However, the diffusion time scheduler induces "early stopping", which determines whether the probability flow converges to training samples or to other points on the data manifold. This analysis provides insights into the stability and convergence properties of these processes.
In diffusion models (Sohl-Dickstein al., 2015: Ho al., 2020; Song et al., 2021b), new images are sampled from the data distribution through iterative process. Beginning with random initialization, the model gradually denoises the image until final image emerges. At their core, dif- fusion models learn the data distribution by estimating the
Equal contribution 'llectrical and Computer Engineering, Technion, Haifa, Israel Maathematical and Statistical Sciences, Marquette University, Marquette, USA. Correspondence Chen Zeno <chenzeno @ campus cawpus.techmioi.....o www.nion..c.il........
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

When Diffusion Models Memorize
Our Contributions We investigate the probability and the score flow of shallow ReLU neural network denoisers in the context of interpolating noisy samples with minimal cost, that is, when the denoiser maps each noisy sample exactly to its corresponding clean training point, resulting in zero empirical loss. Our focus is on the low-noise regime, where noisy samples are well clustered.
the N clean data points Vn such that yo.m I. + En,m n 1,.... N, m ,.... M. Then, one typically aims to minimize the loss
N
(
Σ
h (3n.m) - =nll + +XC00)
MN
Theoretical: We prove that when the clean training points are orthogonal to one another, the probability flow and score flow follow similar trajectory for given initialization point. However, while the score flow converges only to a training point or to sum of training points, the probability flow can also converge to a point on the boundary of the hyperbox whose ver- tices are all partial sums of the training points. This happens due to "early stopping" induced by the diffu- sion time scheduler. We generalize this result to the case where the training points are the vertices of an obtuse simplex.
where are the parameters of the denoiser model he and C(²) is a regularization term. We focus shallow ReLU network with skip connection the parametric model of interest (Ongie et al., 2020; Zeno et al., 2023), given by
K
ho(v)
Σ k=
as [
+ bk]+ + Vy+c. (4)
where 0 (10m) V) with O2 (ba, ax wx) R x R x Rd and C Rd V Rddd and the regularization term is la penalty on the weights, but not on the biases and skip connections, i.e.
We train shallow denoisers that inter- polate the training data with minimal representation cost on orthogonal datasets. We start by empirically demonstrating that the score flow ODE corresponding to a single such denoiser typically converges either to sum of training points, which we call virtual training points, to general point on the boundary of the hyperbox (it converges to training point only in rare occasions). We then show that the probability flow ODE, which uses a sequence of denoisers for varying noise levels, also converges to virtual points and to the boundary of the hyperbox, albeit at somewhat lower frequency compared to the training points. Finally, we show that generalization improves as the number of clean data points increases.
Experimental:
K Σ (1axx12+ + ||wxxl1)) R=1
1
C(0)
(5)
2
Zeno et al. (2023) showed that in the "low-noise regime", i.e. when the clusters of noisy samples around each clean data point are well-separated" there are multiple solutions mini- mizing the empirical MSE (first term in equation 3). Each of these solutions has different generalization capability. They studied the solution at which the l regularization of equation 5 is minimized.
Definition 2.1. Let hg Rdd - IR denote shallow ReLU network of the form of equation 4. For any function h Rd - Rd realizable as a shallow ReLU network, we define its representation cost as
R(h)- = inf ( 6: h=
2. Setup and Review of Previous Results
We study the denoising problem, where we observe a vector y E Rd that is a noisy observation of x E Rdd i.e. y = x+c, such that x and e are statistically independent and is Gaussian noise with zero mean and covariance matrix o² I. The MSE loss of denoiser h(y) is
inf 8: h-h
Σ Elax s.t. ||ws||| 1, Vk, (6)
and a minimizer of this cost, i.c. 'min-cost' solution, as
h" E argmin R(h) s.t. h(yn.)) In Vn, m.
MSE (h) = Ex,y |/ (y) x
(1)
h
where the expectation is over the joint probability distri- bution of x and y. The minimizer of the MSE loss is the
In the multivariate case, finding an exact min-cost solution for finitely many noise realizations is generally intractable. Therefore, Zeno et al. (2023) simplified equation 7 by as- suming that h(y) = 2,, for all in an open ball centered at Cn. Specifically, letting B(æ,, p) denote the ball of radius
MMSE estimator
hMMSE (y) Exyy [x|y= y)
In practice, since the true data distribution is unknown, we use empirical risk minimization with regularization. Con- sider dataset consisting of M noisy samples for each of
'The noise level in the low-noise regime, though small, is not negligible and has heen noted practically "useful" (Zeno al., 2023), e.g. for diffusion sampling (Raya Ambrogioni, 2023).
2

---

When Diffusion Models Memorize
o centered at Zn we simplify notations by writing this con- straint as h( (ar,, p)) {. Consider minimizing the representation cost under this constraint, that is, solving
Additionally, we will also analyze the score flow, which is a simplified case of equation 12 where p does not depend on t.
Analyzing the score flow can be helpful in understanding the dynamics of the probability flow. The score flow represents the sampling process from one of the modes of the (multi- modal) distribution of y. The score flow is initialized at yo and for > 0 follows
h2 (y) E argmin R((h) s.t. h(B(Fn, p)) = ( Vn.
h
(8) Even this surrogate problem is still challenging to solve explicitly in the general case. Nonetheless, it can be solved for two specific configurations of training data points, which serve as prototypes for more general configurations. The first case is when all the data points form an obtuse simplex, i.., the generalization of an obtuse triangle to higher dimen- sions, and the second case is when the data points form an equilateral triangle (see Appendix D).
dyt dt
logp (y)
(13)
Using the estimated score function and time re-scaling r d we obtain the score flow
dy dr
--)((y)))) yr-
(14)
3. The Probability Flow and the Score Flow
Notably, in contrast to the probability flow ODE, the min- cost denoiser here is independent of t.
Given an explicit solution for the neural network denoiser, we estimate the score function by leveraging the connec- tion between the MMSE denoiser and the score function (Robbins, 1956; Miyasawa et al., 1961; Stein, 1981),
4. The Probability and Score Flow of Min-cost Denoisers
MMMSE (3) y + o² log
(9)
In this section, we consider training sets that model different types of data manifolds, and state for each type the possible convergence points of the score and probability flows of min- cost solutions. As the score flow is a specific instance of probability flow (after time re-scaling) in which the variance profile is fixed, the difference between the convergence points of these two flows thus illuminates the effect of the variance reduction scheduling o; (and thus the Pe schedule) on the generated sample.
where p (3) is the probability density function of the noisy observation. From this relation, we can estimate the score function V log (y) as
() y
(y)
(10)
where (1) is the minimum norm denoiser. In diffusion models, a stochastic process is typically used to sample new images. However, to generate unseen images from the data distribution, Song et al. (2021a) introduced a deterministic sampling process-tth probability flow ODE (Song al., 2021b; Karras et al., 2022).
We begin with the following simple, yet general, observation on the dynamics of score flow. For this dynamics, the stabil- ity condition for stationary point y is that any eigenvalue of the Jacobian matrix of the score function with respect to the input y. i.e., A (J (y)) satisfies
We assume in this paper the variance exploding (VE) case, for which the probability flow ODE is given by
Re(A (J (v)) <0.
(15)
dy di
1 do? v (y), a)), (11) di
We next show that in any model that perfectly fits an open ball of radius p > 0 around the training points (and thus also interpolates the training set), the clean data points are stable stationary points of the score flow. This implies that, when initialized near these points, the process can converge to the clean data points.
11 E [0, T]:
where the score is estimated using the neural network de- noiser V log p (z) z s (yt, oy), and og = vt is the diffusion time scheduler. The minus sign in the probabil- ity flow ODE arises due to the reverse time variable: we initialize at yr, and finish at you a sample from the data distribution. In Appendix A we show that by using time re-scaling arguments the probability flow ODE is equivalent to the following ODE
Let p > O be arbitrary. Let h (y) be a denoiser that satisfies h(B(wn, p)) = {xa} for all n e [N] (and thus interpolates the training data). Then, any training point y E {æn) NN is stable stationary point of equation 13 where we estimate the score using (y) h(y)
Proposition 4.1.
dyr
= h (yr) - yr:: dr
(12)
where gr = log dr, assuming the radius of the noise balls satisfies P: = aa, for some a > 0.
Proof. For all y E { we get that s (3) = 0 since the denoiser interpolates the training data, In addition, for
3

---

When Diffusion Models Memorize
all y int (B(z p})) the Jacobian matrix is
This implies that the stationary points are the vertices of hyperbox (an n-dimensional analog of rectangular). Next, we prove (in Appendix D.2) that the score flow converges to the vertex of the hyperbox closest to the initialization yo- Also, for some yo. score flow first converges to the hyperbox boundary, then to a specific vertex.
1
J (ÿ) 1
(16)
therefore the stability condition of equation 15 holds.
This result implies that, when the score function is differen- tiable and the training points are the only stationary points, the score flow will converge to the training points with prob- ability 1.
Theorem 4.3. Suppose that the training points {20, 11, 22,,.., .N, C Rd are orthogonal. Con- sider the score flow where we estimate the score using 8 (y) = h- and an initialization point yo- If
E E [N 1]: u yo + -all then
4.1. Flow Properties on Analytically Solvable Datasets
Zeno et al. (2023) found the min-cost solution h; analyti- cally in three cases: (1) orthogonal points, (2) points that form an obtuse angle with one of the points, and (3) a spe- cific case of 3 training points forming an equilateral triangle.
We converge to the closest vertex of the hyperbox to the initialization yo-
If the closest point yo the hyperbox is point on its boundary which is not a vertex, then for any E < min; |u, yol there exists po (e) and To (e. p) Ti (p) such that for all p < po (e) and all T E [To (E, p) ,Ti (p)], the point yr is not a stable stationary point and at most at distance from the boundary of the hyperbox.
For simplicity, we consider the case of dataset composed of orthogonal points, and defer to the appendices of other types of datasets. Specifically, suppose that we have N training points {I,, Jn=o where Zo = 0 and the remaining training points are orthogonal, i.e., x; zy- = 0 for all j.j > 0 with + j.² This approximates the behavior of data many generic distributions (e.g., standard normal), which becomes more orthogonal in higher dimensions (Saxe et al., 2014; Boursier et al., 2022). For example, for standard i.i.d. Gaus- sian data F,, it can be shown using the analysis in Section 3.2.3 of Vershynin (2018) along with a union bound, that the largest cosine similarity between two distinct datapoints
Next, we consider the probability flow. For tractable anal- ysis, we approximate the score estimator for small noise levels (i.c., for all min T. proximation to obtain (See Figure 16 in Appendix J for a comparison of the exact and approximated score function trajectories, which are nearly identical at low noise levels)
et < 1) via Taylor's 's ap-
satisfies mf Therefore, in the realistic regime cxp(d) > N d >> 1, most pairs are nearly orthogonal. Let u,, / ||,,,] || for all 1,....N N 1. A minimizer of equation 8, h is given by (Zeno et al., 2023, proof of Theorem 3)²
N with high probability.
2m
N
(1
N-1
8 (y, 1)
?
Σ n=11
Un E U1, v)
Σ n=1
Un U
of
(18)
where
N-1
|| | ||
hz(1)= = Σ
[ y - pl+
< Pt
n=1
2p
(02)
Pt
||..|| 11 | 1-2
Pt
| || Pt (19)
2 >> | Pr.
- |u y - (1| - -p)l+) 2e1
(17)
With this approximation, one can show the probability flow and the score flow have a similar trajectory (for small p), if they have the same initialization point. However, the pa di diffusion time scheduler in probability flow induces "early stopping". This can lead to the probability flow to converge to a non-vertex boundary point (in contrast score flow), or to influence the speed of convergence to stationary point. We show this in the following result for the probability flow (proved in Appendix D.3)
We prove (Appendix D.1) the set of stationary points is the set of all possible sums of training points.
Theorem
4.2. Suppose that the training points {ar, 11 (2.....
2N-1) C Rd are orthogonal. Then, the set of the stable stationary points of equation 13 is A = 1Ener In I [ [N- - 1]}. -1].
"The result holds for the general case where &n is non-zero, provided that (x, - 2o0) (xc, xa) 0.
Theorem 4.4. Suppose that the training points (an, 3F, 22, ..., 1N) C Rdd are orthogonal. Con- sider the probability flow where o+ = vt, we estimate the score using equation 18, and yr is the initialization point.
'The same arguments used in the proof of Theorem 3 in (Zeno et al., 2023) can be applied to for strictly obtuse angles (i.e.. x;" x, 0 instead of x æ; S 0) in (Zeno et al., 2023) is only made specifically to ensure the uniqueness of the solution.
equation 17. The requirement
Vf E IN - 1]: :u. yr # æ.
2 then
4

---

When Diffusion Models Memorize
If the closest point to yr on the hyperbox is a vertex, then we converge to this vertex.
converges the triangle's is face before ultimately reaching a vertex.
the closest point to yr on the hyperbox is not a vertex, then there exists T (yrr, PT) such that we converge to the closest vertex to the initialization point yr if > T(yr. pr), and we converge to a point on the boundary of the hyperbox if < -(yT.PT)
5. Simulations
5.1. Probability Flow and Score Flow
In this section, we demonstrate the findings of Theorems 4.2, 4.3 and 4.4 in shallow neural networks. In practical settings, the continuous probability flow ODE given by equation 11 is discretized to S timesteps, as
Theorem 4.4 shows that the probability flow converges to vertex of the hyperbox point on the boundary of the hyperbox. We consider this hyperbox boundary as an implicit data manifold-the diffusion model samples from this hyperbox boundary even though we did not assume an explicit sampling model that generated the training data, such as distribution supported on the manifold. However, in some cases probability flow ODE can converge specific points in this manifold: the training points, or sums of training points ("virtual points"). We view these virtual points as representing a form of generalization, as they go beyond the empirical data distribution and form novel combinations not present in the training set.
yt-1 = y + 10, - o2-1) (fpp, (3r) y1)
= 1,
20
(20)
where h (yr) is modeled as series of S denoisers (usually with weight sharing), which are applied consecutively to gradually denoise the signal. In this setting, the sampling should theoretically be initialized at T = xc, however in practice is initialized from a finite timestep T, which is chosen such that or >> ||x,|| for all Similarly, the score-flow of equation 13 is discretized as
This result aligns well with empirical findings that diffusion models memorize individual training examples and gen- erate them during sampling (Carlini et al,, 2023). In addition, an empirical result shows that Stable Diffusion (Rombach et al., 2022) can reproduce training data by piecing together foreground and background objects that it has memorized (Somepalli et al., 2023). This behavior resembles our re- sult that the probability flow can also converge sums of training points. In Stable Diffusion we observe "semantic sum" of training points; however, our analysis focuses the probability flow of a simple lhideen-layer model, while in deep neural networks summations in deeper layers can translate into more intricate semantic combinations.
(h Ptg
(y:) yt) t= 0, 0,,,..., (21)
y = y: +
o
where y is some step size and here to is fixed timestep (so that all iterations are with the same denoiser). Note that here t increases along the iterations, and since we use a single denoiser, there is no constraint on the number of iterations we can perform.
It should be noted that while our theorems characterize only the low-noise regime, here we simulate more practical sampling process, which starts the sampling from large noise. Namely, the initialization (UT in equation 20 and yo in equation 21) is drawn from a Gaussian with large o. Thus, our theoretical analysis becomes relevant only once the dynamics enter the low-noise regime.
In Appendices and C, we extend our results to non- orthogonal datasets. In Appendix B, we analyze training points forming an (N - 1)-simplex, where Zn forms obtuse angle with all other vertices. We prove that the set of stable stationary points is subset of all partial sums of the training points. Additionally, we show that when angles be- tween data points are nearly orthogonal, a stable stationary point corresponding to the sum of all points exists. We then prove that the score flow first converges to point along a chord connecting the origin another training point before settling edge of the chord. Similarly, the probability flow converges either to a point on the chord or to one of its edges. In Appendix C, we consider training points forming an equilateral triangle. We show that the score flow first
To demonstrate our results for the case of an orthogonal dataset, we use orthonormal training samples, set a; Vi. and choose T 100 to ensure an effectively high noise at the beginning of the sampling process. We train a set of S = 150 denoisers, ensuring 50 equally-spaced noise levels in the "low-noise regime" and 100 equally-spaced noise levels outside it. Note that since we are discretizing an ODE, using sufficiently small timesteps ensures that the discretization does not affect the results. In practical models, some denoisers are guaranteed to operate in the low-noise regime, as the final sampled point is obtained when / x 0, where the noise level is inherently small. We train our networks on data in dimension d = 30, with M = 500 noisy samples per training sample, taking the dimension of the hidden layer of the networks be K 300.
'Note that, unlike the score flow, the probability flow ODE reaches the point exactly. Since this is a special case of conver- gence, and maintain consistent terminology, we the term
"converge to a point" in both cases.
5

---

When Diffusion Models Memorize
Lx Distance <
0.2
and 10 fixed-point iterations on all the predicted virtual points that consist of combinations of pairs, triplets and quadruplets of the training points. In Figure I we plot the percentage of these runs that converged within an Loo dis- tance of 0.2 to the predicted virtual point. As can be seen, 98.6% of the predicted virtual points composed of pairs of training points are stable practice, and the stability of virtual points decreases as higher-numbert of combinations are considered. Nevertheless, the absolute number of stable virtual points increases substantially as higher-numbers of combinations are considered. Specifically, in the same ex- ample a total of 429, 3390, and 6965 stationary points were found for the pairs, triplet and quadruplet combinations. The increase in the absolute numbers due to the higher number of higher-order sums. The decrease in percentages is due to small deviations in the ReLU boundaries of the trained de- noiser compared to the theoretical optimal denoiser. These deviations have a greater impact on stationary points that involve sums of more training points.
Pairs
Triplets
Quadruplets
0%
20%
40%
60%
80%
100%
Figure/ I: Existence of stable virtual training points. We run fixed-point iterations on single denoiser, starting from all possible pair-wise, triplet-wise, and quadruplet-wis combinations of training samples. The plot shows the per- centage of points that converged within an Loo distance of 0.2 to the original, virtual, input point.
To be consistent with our theory, which assumes the denoiser achieves exact interpolation over the noisy training samples, we use a non-standard training protocol to enforce close- to-exact interpolation. Specifically, we pose the denoiser training as the equality constrained optimization problem
Next, we explore the full dynamics of the diffusion pro- cess. We start with the score flow for a single denoiser from timestep tu. which corresponds noise level 0 = 0.095. We randomly sample 500 points from NO, 100T), ) and ap- ply 3000 score-flow iterations to each, with step size of 7 = 5 10-4 The right hand side of Figure 2a shows the percentage of points that converged within an Loo distance of 0.2 to either virtual points, training points, or a boundary of the hyperbox. On the left hand side of Figure 2a, we plot aa || the projection of all samples on three dimensions. Out of 500 samples, almost all points converged virtual points, which is expected in random initialization due to their larger number, compared to the training points. The rest of the points converged to the hyperbox's 's boundaries. The path the points take towards the hyperbox first draws them to the closest boundary, and then they drift along the boundary towards the closest stable stationary point.
min C(O) s.l. he ho(yn,m) = Un, Vn, m 9
(22)
which we optimize using the Augmented Lagrangian (AL) method (see, e.g., (Nocedal & Wright, 2006)). Specifically, we define
M
QA)(O.Q.1): + 1
ho (Jn,))
MN
2
+ +1 (m.)) hg (Jn,m) Fnd
(23)
where E R20. (nm E Rd represents vector of La- grange multipliers, and Q E Rdx is the matrix whose columns are (fn.m) for all m = 1...., M, n =
N.
Then, starting from an initialization of Ho > 0 and Qu = 0, for k- = 0, I,... we perform the iterative updates:
Finally, examine full diffusion process with the prob- ability ODE. Here we follow equation 20 using S = 150 trained denoisers, starting again from 500 randomly sam- pled points from (0, oT Our results hold where the noise level is small compared to the norm of the training samples. Therefore, denoisers of large noise levels are not expected have stable virtual points. In probability flow, most noise levels are large compared to this norm, as the sampling process begins with large variance (in the VE case). Specifically, in our example only the last 50 denois- ers have small noise levels. Yet, as can be seen on the right hand side of Figure 2b, a large percentage of the sam- ples produced are virtual points. In contrast to the score flow case, the start of the sampling process here attracts most samples towards the mean of the training points, as any optimal- -MSE denoiser would, which creates biased starting point to the sampling process in the "low-noise
0++1 = arg min (0k. (k+)
(24)
0
(n.m) (n.m) us (ho (Hn.m) In), Vn, m
4 4
(25)
M&+1 = MH
(26)
where > is a fixed constant. The solution of equation 24 is approximated by following standard training using the Adam optimizer (Kingma & Ba, 2015) with learning rate of 10 for 10 iterations. We additionally take 7) 7==3 3 and K. 7, and decrease the learning rate by 0.5 after each iterative update.
We start by demonstrating the existence of virtual training points, that is, stable stationary points that are sums of train- ing points, as predicted by Theorem 4.2. We take a denoiser from the "low-noise regime" (a, = 0.095 this example)
6

---

When Diffusion Models Memorize
regime". From this regime onwards, the points travel along the boundaries of the hyperbox towards their nearest stable points, which is usually training point. This behavior is demonstrated on the left side of Figure 2b, where the pro- jected path of a random point is drawn starting from the 90th step. See Appendix E for comparisons of additional thresholds and Appendix F for experiments where neural denoisers are trained using the standard Adam optimizer, with and without weight decay regularization. We show that without weight decay, the probability flow converges only to training points or boundary points of the hyperbox. In con- trast, with weight decay, it also converges to virtual points, aligning with the results obtained using the Augmented La- denoiser.
training points. Then, we expect our analysis to effectively hold, but only for the training points that are well-fitted and their associated virtual points. Therefore, this mirrors the case of decreasing N. and will cause more convergence to the duplicated training points and increase memorization. Next, we augment the original orthonormal dataset used in Figure with additional random data points drawn from the boundary of the hyperbox. We then retrain the denoisers using the AL method for two values: N = 40 and N = 50. In these cases, the probability flow still almost exclusively converges to the hyperbox boundary. Further details appear in Appendix G.
grangian method for training the minimum- We conduct additional experiments on the effect of adding dropout to the training process. This results in higher MSE loss, leading to fewer denoisers in the "low-noise regime" to perfectly fit the training data, and thus to more samples be- ing generated outside the boundary of the hyperbox. Please see Appendix H for further details. Finally, Appendix in- cludes a comparison to detection metrics for memorization, spuriousness, and generalization as proposed by Pham et al. (2024), using the same setup as in Figure 2.
6. Related Work
Memorization and Generalization in Deep Generative Models Several recent works have sought to explain the transition from memorization to generalization in deep gen- erative models, both from theoretical and empirical per- spective. One early line of work in this vein studied memo- rization in over- aver-parametrized (non-denoising) autoencoders (Radhakrishnan et al., 2019; 2020). This work shows that wver-parameterized autoencoders trained low cost are locally contractive about each training sample, such that training images can be recovered by iteratively applying the autoencoder to noisy inputs. A theoretical explanation of this phenomenon using a neural tangent kernel analysis is given in (Jiang & Pehlevan, 2020). More recent work has also shown that state-of-the-art diffusion models ex- hibit similar form of memorization, such that extraction of training samples is possible by identifying stable station- ary points of the diffusion process (Carlini et al., 2023), Additionally, when trained on few images, several works have shown that the outputs of diffusion models are strongly biased towards the training set, and thus fail to generalize (Somepalli et al., 2023; Yoon et al., 2023; Kadkhodaie et al., 2024). A recent empirical study suggests that memorization and generalization in diffusion models are mutually exclu- sive phenomenon, and successful generation occurs only when memorization fails (Yoon et al., 2023; Zhang et al., 2024). Beyond these empirical studies, recent work has put forward theoretical explanations for generalization in score- based models. In (Pidstrigach, 2022), the authors show that score-based models can learn manifold structure in the data generating distribution. A complementary perspective is provided by Kadkhodaie et al. (2024), which argues that diffusion models implicitly encode geometry aadattrv har- monic representations. Ross et al. (2025) propose the Man- ifold Memorization Hypothesis as a geometric framework for understanding memorization in deep generative mod- els. Using local intrinsic dimension to compare the model's learned manifold with the data manifold, they distinguish between overfitting- and data-driven memorization.
5.2. The Effect of the Number of Training Samples
The effect of the training set size has been explored in sev- eral past works (Somepalli al., 2023; Kadkhodaie al., 2024), surveyed in detail in Section 6. Here we con- tinue the analysis to investigate the effect of changing N, the training set size, on the full dynamics of the diffusion process with the probability ODE. Specifically, we repeat the experiment while reducing N. All the hyperparameters are kept the same, except for M which we increase to 2000 for N 10 only, to prevent over-fitting in the large-noise regime. Figure 3 shows the percentage of points that con- verged within an Lo distance of 0.2 to either virtual points, training points, or a boundary of the hyperbox, for the differ- ent N values. The generalization increases with N, drawing a larger percentage of samples to converge in the vicinity of virtual points, or to boundaries of the hyperbox. This aligns with the results of Kadkhodaie et al. (2024).
As in the case of strictly orthogonal data it is impossible to have N > d + 1, we consider here two additional cases to explore similar setups: oversampling duplications from the training set, and augmenting the training set with sam- ples randomly drawn from the boundary of the hyperbox. When considering the effect of oversampling duplications, previous works observed that diffusion models tend to over- fit more to duplicate training points than to other training points (Somepalli et al., 2023). However, here we study the regime in which the model perfectly fits all the training points. In practice, duplicate training points would cause the neural network to fit them better, at the expense of the other
7

---

When Diffusion Models Memorize
100%
100%
Noar Boundary Nesr Virtual Pt.
Boundary
Near Training Pt.
Boumlary
Vartual Pts.
Near Boundary
Sampling Path
90%
Near Vartual Pt.
8055
Sampling Path
2.0
1.5
8002
1.0
6075
Virtual Pts.
0.5
1
60%
0.0
40%
Traizing Pts.
2.0
2.0
2.0
20%
1,5
20%
1.5
1.0
1.0
1.5
0.0
11.5
03.5
0.5
0.0
0.0
Eyg Distance <
1.5
2.0
0.0
0%
bx Distamux <.0.2
(a) Score Flow.
(b) Probability Flow.
Figure 2: Projection to three dimensions and convergence types frequency of randomly sampled points. We run the discrete ODE formulation of equation 20 for 500 randomly sampled points from RR300 for both sampling using the score flow (2a) and a regular diffusion process (2b). For each, we plot on the right the percentage of points that converged to either virtual point, training point, to the boundaries of the hyperbox, out of all points. On the left, we plot the sampling results projected to three dimensions, along with the path single point took until convergence. In score flow, all points converged to either virtual points or to boundaries of the hyperbox, which is evident in the point clusters in the locations of the projected virtual points. For probability flow, the bias induced by the "large-noise regime" denoisers diffusion causes more samples to converge around the training points and their adjacent boundaries. Nevertheless, a large percentage of samples still converge in the vicinity of virtual points. The paths the points take towards the hyperbox draws them first to the closest boundary, and then, if the step sizes and amount permit, travel along the edges towards the closest stable stationary points.
Representation Costs and Neural Network Denoisers Several other works have investigated overparameterized autoencodinngddeooisnng networks with minimal representa- tion cost (i.c., minimial e-norm of parameters). Function space characterizations of min-norm solutions of shallow fully connected neural networks are given in (Savarese et al., 2019; Ongie al., 2020; Parhi & Nowak, 2021; Shenouda et al., 2024); extensions to deep networks and emergent bottleneck structure are considered in (Jacot, 2022; Jacot et al., 2022: Jacot, 2023; Wen & Jacot, 2024). The present work relies on the shallow min-norm solutions derived by Zeno et al. (2023) for specific configurations of data points, but goes beyond this work in studying the dynamics of its associated flows.
versus Langevin dynamics). Our results focus on high- dimensional data belonging to a simplex, while Zhang & Pilanci (2024) give convergence guarantees only in the case of univariate data.
7. Discussion
Conclusions. We explored the probability flow ODE of shallow neural networks with minimal representation cost, We showed that for orthogonal dataset and obtuse-angle dataset the probability flow and the score flow follow the same trajectory given the same initialization point and small noise level. The diffusion time scheduler probability flow induces "carly stopping". which results in converging to boundary point instead of specific vertex (as in score flow) or speed up convergence to specific vertex. Simu- lations confirm these findings and show that generalization improves as the number of clean training points increases. In practice, natural images often lie on a low-dimensional linear subspace due to their approximate low-rank structure (see Zeno et al. (2023), Appendix D3). As result, the denoiser first contracts the data towards this subspace (see Theorem 2 in Zeno et al. (2023)). If the subspace has sufficiently high dimension, then data points become ap- proximately orthogonal. Thus, the geometric structure of high-ding digh-dimensional image spaces may resemble the hyper- box studied in our work. One possible extension of this work is analyze the probability flow ODE in the case of variance- processes. This is important case
A recent study investigates properties of shallow min-norm solutions to score matching objective (Zhang& & Pilanci, 2024), building off of a line of work that studies min-norm solutions from a convex optimization perspective (Pilanci Ergen, 2020; Ergen & Pilanci, 2020; Sahiner et al., 2021; Wang & Pilanci, 2021). In the case of univariate data, an explicit min-norm solution of the score-matching objective is derived, and convergence results given for Langevin sampling with the neural network-learedd score function. Additionally, in the multivariate case, general min-norm solutions to the score-mase moteemat loss are characterized as minimizers of a quadratic program. Our results differ from (Zhang& Pilanci, 2024) in that we study different optimiza- tion formulations (denoising loss versus score-matching loss) and inference procedures (probability- and score-flow
8

---

When Diffusion Models Memorize
100%
Boundary
100%
Boundary
100%
Boundaay
100%
Boundary
100%
Boundary
80%
80%
80%
80%
800%
Training Pts.
Virinal Pls.
60%
60%
Trining Pts.
60%
Virtual Pts.
60%
Virtual Pts.
60%
Virtual Pts.
Trainnng Pts.
Training Pts.
10%
10%
40%
10%
10%
Training Pts.
20%
20%
20%
20%
20%
0%
0%
0%
0%
1. Distance <, 0.2
1oc Distance < 0.2
1:g Distance < 0.2
Fip Distance < 0.2
Top Distance 0.2
N 10.
(b) . 15.
(c) N 20.
(d) 25.
(c) N 30.
Figure 3: Convergence types frequency of randomly sampled points in diffusion sampling for different N. We run the discrete ODE formulation of equation 20 for 500 randomly sampled points from TR:00 for diffusion sampling, using different training set sizes, N. We plot the percentage of points that converged to either a virtual point, a training point, or to the boundaries of the hyperbox, out of all points. The generalization increases with N, drawing a larger percentage of samples to converge in the vicinity of virtual points and the boundaries of the hyperbox.
since practical diffusion models more often use variance- preserving forward and backward processes.
Impact Statement
This paper presents a theoretical analysis of diffusion mod- els under specific constraints, aiming to enhance the under- standing of generative models. This may lead to greater transparency when using these models. Moreover, ticipate that insights gained from these simpler cases will shed light on the memorization and generalization behav- iors in large-scale diffusion models, which pose privacy concerns. Lastly, we note the neural network examined in this paper is a shallow one, whereas practical contempo- rary implementations almost always involve deep networks. Naturally, addressing deep networks from the outset would pose impassable barrier. In general, our guiding principle for research works that aim to understand new not-yet understood phenomena is that we should first study it in the simplest model that shows it, so as not to get distracted by possible confounders, and to enable a detailed analytic understanding. For example, when exploring or teaching statistical problem issues, we would typically start with linear regression, understand the phenomena in this simple case, and then move on to more complex models. Thus, we hope the example we set in this paper will help promote this guiding principle for research and teaching.
Limitations. A key limitation of our analysis the as- sumption (inherited from Zeno et al. (2023)) that the de- noiser interpolates data across full d-dimensional ball centered around each clean training sample, where d rep- resents the input dimension. In real-world scenarios, the number of noisy samples is typically smaller than the in- put dimension d. more accurate approach might involve assuming that the denoiser interpolates over an (M 1)- dimensional disc around each training sample, reflecting the norm concentration of Gaussian noise in high-dimensions spaces. Furthermore, for mathematical tractability, our anal- ysis focuses on single hidden layer model.
Acknowledgements
The research of DS was Funded by the European Union (ERC, A-B-C-Deep, 101039436). Views and opinions ex- pressed are however those of the author only and do not nec- essarily reflect those of the European Union or the European Research Council Executive Agency (ERCEA). Neither the European Union nor the granting authority can be held re- sponsible for them. DS also acknowledges the support of the Schmidt Career Advancement Chair in AI. The research of NW was partially supported by the Israel Science Foun- dation (ISF), grant no. 1782/22. The research of TM was partially supported by the Israel Science Foundation (ISF), grant no. 2318/22. The research of GO was partially sup- ported by the US National Science Foundation (NSF), grant no. 2153371.
9

---

When Diffusion Models Memorize
References
Kadkhodaie, Z., Guth, F., Simoncelli, E. P., and Mallat, S. Boursier, E., Pillaud- L., and Flammarion, N. Gra- dient flow dynamics of shallow relu networks for square loss and orthogonal imputs. In Koyejo, S.. Mohamed, S., Agarwal, A., Belgrave, D., Cho, K., and Oh, A. (eds.), Advances in Neural Information Processing Systems, vol- ume 35, pp. 20105-201 Curran Associates, Inc., 2022.
Generalization in diffusion models arises from geometry- adaptive harmonic representations. In The Twelfth In- ternational Conference on Learning Representations, 2024. https:/ pettttps://ppeeevvvieeee /eppneeeeeeeeeeeeeeeeeeeeeeeeeee net/ nww.//rummf forum? ANvYVV22Y.
Karras, T., Aittala, M.. Aila, T., and Laine, S. Elucidating the design space of diffusion-based generative models. In Proc. NeurlPS, 2022.
Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramer, F., Balle, B.. Ippolito, D., and Wallace, E. Extracting training data from diffusion models. 32nd USENIX Security Symposium (USENIX Security 23). pp- 5253-5270, 2023.
Kingma, D. P. and Ba, J. Adam: A method for stochastic optimization. In International Conference on Learning Representations, volume 3, 2015.
Chao, C.-H., Sun, W.-F., Cheng, B.-W., and Lee, C.-Y. On investigating the conservative property of score-based generative models. In International Conference on Ma- chine Learning (ICML), 2023.
Manor, H. and Michaeli, T. On the posterior distribution in denoising: Application to uncertainty quantification. In The Twelfth International Conference Learning Representations, 2024. URL https:://////..... http:::///peeeeviiccc net / forum? id=adSGeudidddd
Ergen, T. and Pilanci, M. Convex geometry of two-layer ReLU networks: Implicit autoencoding and interpretable models. In International Conference on Artificial Intelli gence and Statistics, pp. 4024 4033. PMLR, 2020.
Miyasawa, K. al. An empirical bayes estimator of the mean of a normal population. Bull. Inst. Internat. Statist, 38(181-188))1-4 1961.
Ho, J., Jain, A., and Abbeel, P. Denoising diffusson proba- bilistic models. Advances in neural information process- ing systems, 33:6840-658 68568, 2020.
Nocedal, and Wright, S. Penalty and augmented la- grangian methods. Numerical Optimization, pp. 497-528, 2006.
Jacot, A. Implicit bias of large depth networks: a notion of rank for nonlinear functions. The Eleventh Interna- tional Conference on Learning Representations, 2022.
Ongie, G., Willett, R., Soudry, D., and Srebro, N. A func- tion space view of bounded norm infinite width relu nets: The multivariate case. In International Confer- ence Learning Representations, 2020. URL https: / /ppenreviewweo net/ (ewrrummiddHHINPPPP
Jacot, A. Bottleneck structure in learned features: Low- dimension vs regularity tradeoff. In Advances in Neural Information Processing Systems, volume 36, pp. 23607- 23629, 2023.
Parhi, R. and Nowak, R. D. Banach space representer the- orems for neural networks and ridge splines. Journal of Machine Learning Research, 22(43):1 40, 2021.
Jacot, A., Gabriel, F., and Hongler, C. Neural tangent kernel: Convergence and generalization in neural networks. In Bengio, S., Wallach, H., Larochelle, H., Grauman, K., Cesa-Bianchi, N., and Gamett, R. (eds.), Advances in Neural Information Process- ing Systems, volume 31. Curran Associates, Inc., 2018. URL https://proceedingg neereeerpdinnnnn.n...peee...se cc
Pham, B., Raya, G., Negri, M., Zaki, M. J., Ambrogioni, L., and Krotov, D. Memorization to generalization: The emergence of diffusion models from associative memory. In NeurIPS 2024 Workshop on Scientific Methods for Understanding Deep Learning, 2024. URL. httpst::: openreview.o net forum? id z ZVMMaVyBBY.
Sa4bel aaabeeeffa33e22bbb66666660000.. pdf.
Paper.
Pidstrigach, J. Score-based generative models detect mani- folds. Advances Neural Information Processing Sys- lems, 35:35852-35865. 2022.
Jacot, A., Golikov, E., Hongler, C., and Gabriel, F. Feature learning in l2-regularized DNNs: Attraction/repulsion and sparsity. In Advances in Neural Information Process- ing Systems, volume 35, pp. 6763 6774, 2022.
Pilanci, M. and Ergen, T. Neural networks are convex regu- larizers: Exact polynomial- convex optimization for- mulations for two-layer networks. International Con- ference on Machine Learning, pp. 7695-7705. PMLR, 2020.
Jiang, Y. and Pehlevan, C. Associative memory in iterated overparameterized sigmoid autoencoders. In Interna- tional conference on machine learning, pp. 4828 4838. PMLR, 2020.
Radhakrishnan, A., Yang, K. Belkin, M., and Uhler, C. Memorization in overparameterized autoencoders. In
10

---

When Diffusion Models Memorize
Deep Phenomena Workshop, International Conference on Machine Learning, 2019.
Somepalli, G., Singla, V., Goldblum, M., Geiping, J., and Goldstein, T. Diffusion art digital forgery? investigat- ing data replication in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6048 6058, 2023.
Radhakrishnan, A., Belkin, M., and Uhler, C. Overparame- terized neural networks implement associative memory. Proceedings of the National Academy of Sciences, 117 (14):27162-2717,) 2020.
Song, J., Meng, C., and Ermon, S. Denoising diffu- sion implicit models. In International Conference on Learning Representations, 2021a. URL https:// openreview, forum?? sd= wiw.iiiistttggaitio.. giaarCHLP.
Raya, G. and Ambrogioni, L. Spontaneous symmetry break- ing in generative diffusion models. In Thirty-sevnnth Conference on Neural Information Processing Systems, 2023, URL https: /tts:://ppeeeee wttp///wppeeeeeeeee/e/eeee net forum? id=1xGFGMMSVI.
Song. Y., Sohl-Dickstein, J., Kingma, D. P., Kumar, A.,
Ermon, S., and Poole, B. Score-based generative mod- eling through stochastic differential equations. In In- lernational Conference on Learning Representations, 2021b. URLhttpss / //ppp//eveew.eeeee....eeeeeeeeee /et/ferunr? forum? Ad-PXTIG12RRiS
Robbins, H. An empirical bayes approach to statistics. In Proceedings of the Third Berkeley Symposium on Mathe- matical Statistics and Probability, 1954-1955, volume 1,
pp. 157-163. Berkeley and Los Angeles: University of California Press, 1956.
Stein, C. M. Estimation of the mean of multivariate normal distribution. The Annals of Statistics, 135-1115,,,,,,, 1981.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-rews fiightresolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition, pp. 10684-10695, 2022.
Vershynin, R. High-dimensional probability: An introduc- tion with applications in data science, volume 47. Cam- bridge university press, 2018.
Ross, B. L., Kamkari, H., Wu, T., Hosseinzadeh, R., Liu, Z.,
Wang. Y. and Pilanci, M. The convex geometry of back- propagation: Neural network gradient flows converge to extreme points of the dual convex program. In Interna- tional Conference on Learning Representations, 2021.
Stein, G., Cresswell, J. C., and -aniim G. A geo- metric framework for understanding memorization in gen- erative models. In The Thirteenth International Confer- ence on Learning Representations, 2025. URL https: //openreview net nwt/ /ttpf/dddiiddd// a21 NNJu8w0.
Wen, Y. and Jacot, A. Which frequencies do enns need? emergent bottleneck structure in feature learning. In In- ternational Conference Machine Learning, pp. 52779- 52800. PMLR, 2024.
Sahiner, A., Ergen, T., Pauly, J., and Pilanci, M. Vector- output ReLU neural network problems copositive programs: Convex analysis of two layer networks and polynomial-time algorithms. In International Conference on Learmining Representations (ICLR), 2021.
Yoon, T., Choi, J. Y., Kwon, S., and Ryu, E. K. Diffusion probabilistic models generalize when they fail to memo- rize. In ICML 2023 Workshop on Structured Probabilistic Inference/Generaaiie Modeling, 2023.
Savarese, P., Evron, I., Soudry, D., and Srebro, N. How do infinite width bounded norm networks look in function space? In Conference on Learning Theory, pp. 2667- 2690. PMLR, 2019.
Zeno, C., Ongie, G., Blumenfeld, Y., Weinberger, N., and Soudry, D. How do minimum-norm shallow de- noisers look in function space? In Thirt--eventth Conference on Neural Information Processing Systems, 2023. URL https: http:///pppeeeeeeeeeeeeee.eeeeep net forum? i #FgddxWGGGMi
Saxe, A. M., McClelland, J. L., and Ganguli, S. Exact solu- tions to the nonlinear dynamics of learning in deep linear neural networks. In The Second International Conference on Learning Representations. 2014.
Zhang, F. and Pilanci, M. Analyzing neural network-based generative diffusion models through convex optimization. arXiv preprint arXiv:2402.0100 2024.
Shenouda, J., Parhi, R., Lee, K., and Nowak, R. D. Varia- tion spaces for multi-output neural networks: Insights on multi-task learning and network compression. Journal of Machine Learning Research, 25(231):1-40, 2024.
Zhang, H., Zhou, J., Lu, Y., Guo, M., Wang, P., Shen, L., and Qu, Q. The emergence of reproducibility and con- sistency in diffusion models. In Forty-first International Conference on Machine Learning, 2024. URL https: / //openreview net/ forum? wtt.eiidhhssssssoo.
Sohl-Dickstein, J., Weiss, E., Maheswaranathan, N., and Ganguli, S. Deep unsupervised learning using nonequi- librium thermodynamics. In International conference on machine learning, pp. 2256 2265. PMLR, 2015.

---

When Diffusion Models Memorize
A. Proofs of Results in Section 3 The probability flow ODE is given by
dy:
1 do
logg (y),
(27)
dt
2 di
do:
0t dt
V Vloog (y:, 01)
(28)
First, we apply change of variable as follows
r g (t)
log 01
(29)
dr do.
(30)
dt dt dt
1 dot dr at
dt
(31)
dl
Therefore,
dy
dr dt dr = (-o, do,
dy df
- dt
v log (yr, (i)
(-2r
oz
(32)
dai df
o V log (Ut, 0z)
(33)
Next, we estimate the score function using neural network denoiser, and substitute ( g- (r) to obtain dy, dr h((o-(())((r)) - Dr
(34)
B. Obtuse-Angle Datasets
In this section we consider the case of non-orthogonal dataset. Specifically, suppose the convex hull of the training points {æo, Ø1. ..... - } C Bd is (N - 1) -)sspleeex such that 2o forms an obtuse angle with all other vertices; we assume WLOG that Zo = 0. We refer to this as an obtuse simplex. Let u. = .n. || || for all I,.., N - 1. In this case, the minimizer h is still given by equation 17.
In Figure 4, we illustrate the normalized score flow for the case of an obtuse 2-simplex (see Figure 15 in Appendix for the unnormalized score flow). The normalized score function is the score function multiplied by the log of the norm of the score and divided by the norm of the score. As shown, the training points are stationary points. Next, we prove (in Appendix D.4) that, in the general case of N training points, the of stable stationary points is subset of the set of all partial sums of the training points. Additionally, demonstrate that when the angles between data points are nearly orthogonal, stable stationary point corresponding to the sum of the points exists.
Theorem B.1. Suppose the convex hull of the training points (æo, T1, ..., IN-1) C Rd is an obtuse simplex. Then, the set of the stable stationary points of equation 13 satisfies {a, I== C A C (Ener an I C {0, 10..,,.., NN 1}}-
In addition, the point Enez In, where I (0, .N- - 1} and [I] 2 i $ I and I > if0 I, is a stable stationary point if minser (iEETi(N) u u, [|xaal]] > -p-
The condition minRez ΣiEZYAR) T un |x; -p holds for almost orthogonal dataset (and p 0).
Next, we prove (in Appendix D.5) that in the general case with N training points, for small noise levels (i.e., small p) and an initialization point close to the chords connecting the origin each training point (æ,)). the score flow first converges to point along chord connecting the origin and another training point, and then to an edge of the chord (0 or æn, depending on initialization).
Theorem B.2. Suppose the convex hull of the training points {wo. Ø2 NN1 C. Rdd is an obtuse simplex. Given an initial point yo such that p < u. Yo < ||>:|| - and u.) yo < for all j + i, consider the score flow where we estimate the (x)- Then we converge to the closest edge of the chord. In addition, for all E (0, u, yo) there exists Po (c) and Tole, T1. such that for all p < Po (e) the point yr is not a stable stationary point and at most at distance e from the line between Di and n; for To p) T < Ti(p).
score using $ ( =
h 6²
12

---

When Diffusion Models Memorize
133
1.0
-10-
-1.3
-2.-
-20
-15
-10
-05
0.0
0.5
1.0
1.5
2.0
Figure 4: The normalized score function of obtuse simplex. The red dots are the training points 3 22 Dg. The black lines are the ReLU boundaries.
We next turn to the probability flow. To this end, we assume that the initial point yr is such that pr < u yr < ||x]|| - pr and u, yr < p for all j # i. We again use Taylor's approximation the small-noise level regime (specifically, for all
i E NN 1] æ. < 1), to obtain the following score estimation at point y such that Pt < u. y < || - Pe and
uj y < Pt for all j * is
(z), oi ((1++
2 |<>;|] Pt i -1) y preli
(35)
We now have the following result regarding probability flow (proved in Appendix D.6)
Theorem B.3. Suppose the convex hull of the training points {wo, Ø2...., IN-1 C. IRd is an obtuse simplex. Given an initial point yr such that pr < u. yr < ||æ: - pr and u.J yr < pr for all j + Consider the probability flow where = Vi and we estimute the score using equation 35. Then, 3r(yT,Pr)) such that converge to a point on the line connecting I and 2; I < <TYT,PT) and if 2 T(yT, PT) we converge to the closest point in the set { 2.} to yr.
Theorem B.3 shows that the probability flow converges to a point the chord to one of the edges of the chord. In this scenario, we consider the chords as the implicit data manifold.
C. An Equilateral Triangle Dataset
In this section we consider the score flow in the case where the training points form the vertices of an equilateral triangle (as this is the last remaining dataset case for which the min-cost denoiser is analytically solvable (Zeno al., 2023)). In Figure we illustrate the normalized score flow for the case of equilateral triangle dataset.
We prove (in Appendix D.7) that, given an initialization point near the edge of the triangle. the score flow first converges to the face of the triangle (the implicit data manifold here) and then to the vertex closest to the initialization point yo-
Proposition C.1. Suppose the convex hull of the training points 3i, 22, Ø3 E Rd is equilateral triangle. Given an initial point yo such that [1,2) ||m:
p. consider the score flow where we estimate the score using (y) h Then we converge to the closest vertex the yo. In addition, for all 0 < < (un + u2) Yo |||| there exists po (c) and To (p. e), Ti (p) such that for all < (e) the point yr is not stable stationary point and at most distance from the line between æ and x for To (p. c) < T < T1 (p).
p u. Yo ||>a|| || - p and un! y ||
2
a²
Without loss of generality, this case can be also analyzed, similarly to what we did in previous cases.
permute the training points indices (1,2,3) 3} in the above result. The probability flow for
D. Proofs of Results in Section 4
In this section we use the following Propositions from (Zeno et al., 2023).
13

---

When Diffusion Models Memorize
133
1.0
-10-
-13-
-2.-
-20
-55
-10
-0.5
0.0
0.5
1.00
1.5
2.0
Figure 5: The normalized score function of equilateral triangle. The red dots are the training points #1, 22 033 The black lines are the ReLU boundaries.
Proposition D.1. Suppose that the convex hull of the training points (2.., EN C IRd is a (N 11-simplex such that æ forms an obtuse angle with all other vertices, i.e., (2t 22) (æ, - -0,) < 0 for all i + with i, > 1. Then the minimizer he of equation 8 is unique and is given by
k2 = I6 +
Σ n=
Un Un (u (y - -x1))
(36)
where u, 2n
00n 2.1" (n(() sn ( anl++ ft- bnl+), with an = p, bn 1|xnn-I11 x1ll -p.
and 8n 112n/<111/((r, an)
for all n ..., N.
Proposition D.2. Suppose the convex hull of the training points 11 22 03 E Rdd an equilateral triangle. Assume
the horm-balls Bn B( p) centered each training point have radius p < I| zoll/2, n 1,2,3, where 20 (2) + 22 + x33) is the centroid of the triangle. Then minimizer h of equation 8 is given by
hz) un undi(ai (u] (y moo) + uzd2 (uz (y ar)) + ugrhs (ng (y o0)) 20s
(37)
where (t) 8n (|t anl+ - [t bm]+) with un
Zn-wa a0a |0a-= On - xoll + b, || xoll p. and
8n = |n 2o /oll//o (b,, an)-
D.1. Proof of Theorem 4.2
Proof. In the case of orthogonal dataset where for all j x. m. = and 2g = 0, the score function
h hz(y)- y
s (v)
(38)
0²
Σ i=
N en
||2.
(lvi
pl+
lua (1|2;] p)]+) y
æc
22
(39)
The Jacobian matrix
|
A (3)
62. - 8
Joy (y)
m:
(40)
o²
where A, (y) indicates if only one of the ReLU functions is activated. In matrix form, we obtain
[ ||
|
AN-1 (0) 1)
J ( o² diag
A (v)
(41)
||>1|| - 2p
|| - 2p
where A, (y) E {0, 1}. In this case, the stability condition is
Re(X (J (w))
(J <0.
(42)
14

---

When Diffusion Models Memorize
Note that for A, (y)= =1
||=||| A (3) -1> 0.
(
(43)
||,||| 2p
Therefore, stationary point is stable if and only if for all i E [N - 1] A, (v) = O. We define the set A= = {Enez Fn II E P([N- - -])). Note that the set of points where the score is zero and A; (y) = 0 for all E [N - is A.
D.2. Proof of Theorem 4.3
Proof. We assume WLOG that for all i [N - 1] 14 = eş. We can analyze the ODE equation 14 along each orthogonal direction separately. In each direction, we divide the ODE into the following cases:
If y 5 or i N- - 1, the score function is
8, (y:)
y/ σ²
(44)
Therefore, according to Lemma D.3,
(yi): (yo))e +
(45)
and we converge to zero.
If y 2 | p, the score function is
(v:) |
(46)
σ²
Therefore, according to Lemma D.3,
(y:); = (Yo))e 2/ + +|,x;|1 (1
11- 20
(47)
(yo - ||x:1]) - + |
(48)
and we converge to ||a=|||-
Finally, if ya |x,||| p, the score function is
8, (v:) 0² ((
x0; (1
-1
1) y:
||00|| p ||x;;|
(49)
|
2p
2p
Therefore, according to Lemma D.3,
||ee||| ||اe||--1 -1 -1)
2/2
||a:
(
||
- 2/
(yr): = (yo)re ||eill
+
6
||==|l 20
(50)
2
(86)): - [
l|e
1)
+x
[
e
||
+
(51)
2
Here, if (yo): zero.
||=,]|| 2 we converge
||=,||| if (grn);
2
w then converge
||>>;||: if (yo);
||x
then we converge
There are multiple initializations in which the closest point on the hyperbox is point on the boundary which is not a vertex. We first consider the case where there exist non empty set C IN - -1] such that for all i E I p < (yo); < ||a::|| p. and for all j E [N] I (yo), < p or (yo), > æ.|| -p. We define AT; (p) time to reach the edge of the partition, i.c. ||>,|| - (when (Yo); > |a,|| pp) starting from the initialization point, and AT; (p. é) time to reach distance from zero or | starting from the initialization point:
AT, (p) = 0² ||a0a|1 2p log
m
(52)
2p
(20):
2
(200)s
AĪ, (p, e) o² =21og
(53)
E
15

---

When Diffusion Models Memorize
Since p oo we get that
|
2p
||
AT; (p)
log
2
(54)
2a²
(30);
||a |1
2
Ał, (p.e)
(L)
2
log
(30)
(55)
Note that 3p (e)
such that Vp < Po (e,)
To max AT, (p.c) <<<< min AT; (p)
(56)
since 3p (e) such that
Po a
log
(yo)s
< Po
||:;1| 2po log
||=:|| ||
2
Pa
(57)
2a²
(yo))
21: ||
(yo)
xr ||
2p0
Po
log
log
(58)
2po
(yo):
2
We can similarly derive the time interval during which yr is at most distance from the boundary of the hyperbox and is not at a stationary point for additional initializations. Specifically, for all E [N - 1) < (yo); < ||>:|| - is such an initialization point.
D.3. Proof of Theorem 4.4
First, we prove the following lemma.
Lemma D.3. consider the following affine ODE
dye dt
ate + b
(59)
with initial point yr, where a + O. The solution is
y att--))
yT (
b (e-a(t-T)
(60)
a
Proof. We verify directly that this is indeed the solution, since
dy: dt
= TT-
yr (e (e-at-1) -1) + col--Ti -ale----0
(61)
= ((1-T)
yT
(-11-T10-11 + = azs +
(62)
yr = yr
(1 - 1) = yr
(63)
Next, prove the main Theorem.
Proof. We assume WLOG that for all i [N 1] u, e, We can analyze the score flow along each orthogonal direction
separately. In each direction, we divide the ODE to the following cases:
i & [N - 1]. then equation 12 is
dy dr
y.
(64)
16

---

When Diffusion Models Memorize
Note that the initial point is ro log VT Using Lemma D.3, we obtain
(g-); (gr) e ((++oR
(65)
Since log Vt, further obtain
(wi); = (ur), (log (log vT) = (yr)) (10g (1x = (ur);
V T
(66)
Therefore, we obtain (yo), = 0.
We now consider now the case where i [NV - 1].
In the case where Y: Pt. equation 12 is
dy, y. dr
(67)
So, similarly to the previous case, we obtain (yo), = 0.
In the case where yı ||>م||| - Ps. equation 12 is
dy:
= ||x;|| y.
(68)
dr
Note that the initial point is at ro = -log VT Using Lemma D.3 we obtain
(yr); = = -1 vT) (WTT), + ||زح|| (e (-(rttogv)))
11)
(69)
= ||>:||| + ((UT); ||>;|]) -1
(70)
Since r = - log Vt, we further obtain
(y:); = ||0::|| + ((UT); - ||0:;1) ( (log log VT)
(71)
||a + ((rr); - -1=2211) V T
(72)
Therefore, obtain (yo), =|a=:||-
In the case where Pa ys [x;|]] - Pt. equation 12 is
dy
| y (-1) 1)
dr Pg.
(73)
Note that
= 00; avi
(74)
9T 2r
(75)
Therefore,
Pr = ae
(76)
obtain the following ODE:
dy -r
( 2
||00||| [1 1)
(77)
17

---

When Diffusion Models Memorize
Next, we apply additional time re-scaling
-a -
(78)
dk ae T Pr
(79)
dr
dr
-'e" Pr
(80)
dk
So, we get the following ODE:
dy, dy. dr ae (112 1110 -c--
| y
(81)
dk dr dk
dy:: 2
r; 1/ 1.
(82)
dk
Note that the initial point is at ko = av T.
T. Using Lemma D.3 we obtain
(yn), = e [w: (k+aVT) ((Br)), +
|2::||
2 Tw:
-
(ktavT)
-1))
(83)
|لام||| + (gT),
|0:||
-لll (B+aVT)
(84)
2
Since - and r = logg vt, we obtain
|x|||
|
e [ (aa *taVT)
(y-); 2
+
(yr),
(85)
2
ll
|
To: (-avitavT)
(y:); 2
(yr);
(86)
2
So, we obtain (Bo); |ail| + (BT),
2
e TF:Il
Given an initialization point yr. let I S [N - -1] be non empty set
such that < (yr); < |æ;|| - for all E I and either (yT); < p or (yT); > | for all j E [N 1] \z Z. Then, if
|
T >
log"
(87)
2a
(UT).
we converge to the closest point in the set A = (Enez En I IN - 1}} to the initialization point yr, where {xn ) the training set. We instead converge to the closest boundary of the hyperbox to the initialization point yr if
||a:|]
2
||=.||
max T
log²
(88)
1E2
2a
(yT),
[m 2
D.4. Proof of Theorem B.1
Proof. In the case where the convex hull of the training points is an (N - 1)-simplex, such that æo forms an obtuse angle with other vertices and 3g = the score function
h hy) y
(1)
(89)
g²
. -V
Ur (lu, y
pl+
[u 3/ (11 -p]]+) y
Ie 2p
(90)
The Jacobian matrix
Σ N
Σm=
Ir.
(un): ); (un),
On (y) 66.5
Júj (y)
2p
(91)
o²
18

---

When Diffusion Models Memorize
where A (y) indicates if only one of the ReLU functions is activated. In matrix form we obtain
1 J ( 02 (UU -1)
-1)
(92)
where
U (Ai (y) Viuu, AN-1 (v) ViN-iuN-1)
(93)
|
In x 2p
(94)
An (g) {0, 1}
(95)
Note that the Jacobian matrix is a real and symmetric matrix therefore it has real eigenvalues. In this case, the stability condition
Re(A (J (y))) = X <0.
(96)
For any E IRd
a J [y) S Amax (J)) aTa.
(97)
This holds in particular for E 86-1, therefore
Amax (J) 2 a T 0²
(UUT- - 1)
(98)
0² (Ia U12 -1)
1
(99)
we choose a = Un such that A, (y) * 0, then a Ul] > 1, since nn. > 1. Therefore, a stationary point is stable if and
only if for all n E - 1} A, (y) = 0. Note that y such that A, (y) = for n E {I, ,N 1}. then there exists I 1..,1,....
1) such that
(y) Σ on.
(100)
Therefore, y² = Ener Dr is stationary point if and only if for all E {1, ,N - (v") A = =0 Note that the set stable stationary points is not empty, since for all E [N] the point y² = æ; a stable stationary point because f (y") = I;, and thus A, (y") = for all fI,..., N W--1 1}.
The condition for the point ΣnEz n. where I [N] and [ 2 2if0 & I and |Z| if 0 I to be stable stationary point, is that for all Vk: I
Σ
>
|x P.
(101)
IEI
which is equivalent to that for all Ak e I
Σ
U 2; > pp
T
(102)
(EZ
This set of incquality equivalent to the condition
min
Σ
us us
||zi||
>pp
(103)
RET.
iEZ
19

---

When Diffusion Models Memorize
D.5. Proof of Theorem B.2
First, we prove the following lemma.
Lemma D.4. Consider the following system of affine ODE
dy:
Ay: + b,
(104)
dt
with the initial condition you where A Rdxd is a non singular matrix. The solution is
y: = At (yo - 1 (e 1) ())
(105)
In the case where A also symmetric, the solution can be writlen as
d
y/ Σ us (n. yo) Adt Σ vr (0, (1 Exit),
(106)
where Eim Noaoay is the eigenvalue decomposition of the matrix A.
Proof. We verify directly that this is indeed the solution, since
dy: Ae At (yo- - A- (e - -)) + e-ee-Attg --be-bb--- Ay: + b
(107)
df
yo = I yoo - A (I 1)bb = =yo
(108)
In the case where A also symmetric.
Σ k=
k! (At)* V
Σ
th A
V
(109)
k!
km
Vdiag (etrt
, .... , V
Σ
(110)
e At
Act 1,v7
(111)
1=1
Therefore,
y:
At (y0 A (E-Ar-1)
(112)
Σ
22 cti
Yo Σ
1 x/ Eou (6- 11) (1)
(113)
km
020; Ast
y0 Σ ux U/2 T (e - det -1)
(114)
Ui (v. yo)
det
Σ
vi (v. b) x;² - e1e)
(115)
im1
Next, we prove Theorem B.2.
20

---

When Diffusion Models Memorize
Proof. We assume WLOG that æe O. Given the initial point Yo such that yo such that p ui yo < |
p and
u yo p for all * i, the score is given by
a0
8 (g)
σ²
|
2p
U1
(u.
y
p)
-
(116)
x P
i
11 y
u4
(117)
[
||
2p
xc 2p
According to Lemma D.4, the score flow in the partition
<
u y <
| and ui y < p for all j # is
y: Σ
Uk (vg yo) e 22 U ( b) Ao² (1 (1- edn
(118)
k=1
where the matrix
||
U, !
1). The eigenvalue decomposition of A is
mi
2p
A = VAVT
(119)
V Un
W1
wd-1)
(120)
2p
A = diag
1,,,,,,,,
1
,11
(121)
| 2p
where wy E u. Since,
|
||0:
u;u,
- 1) u.
1
(122)
[ ||
2p
2p
2p
(123)
||a:;
2p
|
1) wj = wi
u,
(124)
||c;|| |l
- 2p
and b-
||, le [_ 2p
u. So, we get
y:
u: ((u)) yo)
-1
20 2x
|,:|||
(I- T
2/2
Σ
Uk (o) yo) *
(125)
Note that we can analyze the score flow along each orthogonal direction separately. Next, we divide it into the following
cases:
||.1|| then 2
u, yo
|
y1
(v) yo) + Σ
(126)
2
2=2
Therefore, we converge to the point you = ||=
u 9o |||||| then we converge Yoo u. | and if ut yo
[x then we converge to yoo. = 2 (since then
the score function is || ll
We assume WLOG that u yo > from the initialization point, and ÁTg (p, e) time to reach distance from zero (the data manifold) starting from the initialization point.
|
z We define AT.. (p) time to reach the edge of the partition, i.e. ||>;|| p starting
AT,, (p) = = 21:11] 2
2p
p
log
(127)
2p
u yo
| mm
VT[ y0
Ar. (p. E) = o² log
(128)
21

---

When Diffusion Models Memorize
Since p oo, we get that
||
[+:]
2p
p
ATu, (p) =
log
(129)
20
u
Y/u
82
2
1x yo
AT,, (p,6) =
log
(130)
Similarly to D.2, we get that 3po (e) > 0 such that Vp < po (E,)
To max oT (e) <T ATv (p)
(131)
D.6. Proof of Theorem B.3
Proof. The estimated score function at the initialization is
s (y. ((1
11+1 110.1101) u - -1) y piui
2 |
(132)
Next, project the estimated score along u, and the orthogonal direction, get
((1 +
u.u. of (y.1)
Pt
u
uu:u? y - pret;
(133)
[
2
= uipt
u y -1)
(134)
||=;||
II - u.u 07 (3 (I - u.uu,)
1+
||a0a||
Pr
U.u. T -
y - Pr. (I -u;u, u
(135)
((1
2
+
||>:|||
Pt
u
y
Pt. u.u. u.u. y
(136)
+
Pr
u
T
y
Pr. 2u
(137)
|
|
I)
(138)
P:
|
2 uo. 1-
Therefore, the projected score onto u, is get the same estimated score as Theorem 4.4 (we can analyze the score flow along each orthogonal direction separately). Therefore, along w we get
and the projected score function onto w, u is
of
1 T w.. y: w. eloe Vi-lOR vT) w/ ure (188 v+) -(T))
(139)
So, we obtain w. yo = 0. Along u, we get
|
||aa|||
|ل e (-avi+arT)
u
T y:
+
u; yr
(140)
2
2
so we obtain w. you =
|| 2
+
u yr
||
Then, if
2
||Tل|||
2
xr ||
T
log²
(141)
2a
(HT):
10:
2
22

---

When Diffusion Models Memorize
converge the closest point in the set (oo 3 to the initialization point yr since the estimated score is equal o; or m: y and we converge to 0 or ||ass]| (as in Theorem 4.4), and if
| 2a
2
m2 |I
T
log²
2
(142)
(yr),
we converge point on the line connecting 2g and z;--
D.7. Poof of Proposition C.I
Proof. We assume WLOG that zo = 0. Note that since the convex hull of the training points is an equilateral triangle, then
|æ = ||= Given the initial point Yo such that i E f1, 2 + u y given by
||||||
< | p and ug [=]
+ p. the score
|
s (g)
T y + 2: uip y u
(143)
2p
1
(une) + u2221] - -1)
(144)
2²
2
2p
+
1
(1
|||||| -P) un +
||>|||
2p 2 |2:|| -P) u2
(145)
|
2p
||>|||
According Lemma D.4, the score flow in the partition E {1,2]
|||||
+ < u y < ||:||| P and ug y
|||||
+
2
2
y: Σ Uk (vg yo) ex Σ Uh (o b) Ar= (1- -
(146)
where the matrix A
20
uu 2 u2ue)) - II) The eigenvalue decomposition of A is
|| 2p
A VAVT
(147)
V
(Q(I-u]uu
/2(1+ u2)
(148)
||=|||
x
(1+ + ue u2) -1) -
A = diag
2p (1- - us U2)
1,
(149)
|
|
2p
since,
|x]
|
(uiu) + -uuu)) - -1) (u1 uz)
(u1
(ui
+
u2 u1 u2 un u2 - U2) - -wu - U2)
2
|
2p
||=|||
2p
(150)
|
(1 un uzui) ui) -1) (2) u2)
(151)
|
2p
||||
[
(n + =zuu) - 1) (u) + uz)
(ul + Uz 21 + u, ue u2 + u2) [[u + U2)
[
2p
[
2p
(152)
x
(1 + uz u.) - 11 (ui + uz)
(153)
x
2p
and b-
|-|||
2p
(1 ||=||| p)
+
1 x 2p (
|||||||
|||||
p)
u2.
We assume WLOG that,
0
u1
U2
U3
(154)
23

---

When Diffusion Models Memorize
and we get
1
(un
422
(155)
v3
21 + U2 = 223
(156)
||>|||
X
1>00 0
(157)
3 2
|
2p
||21
A2
0.
(158)
||0||
2p
2
(1 (u) 22)
y: v3 (n1 -22)
yo c
|||=||
(159)
v3
|al
+
+ (u) u2)
uu + =22) y/
|
(160)
(n) uz)
|
||0||| p)
|0|||
-1]
-1
1 1-
(1- (1~310n--0)
3100-200 2o
(161)
x 2p
- 2p
Note that,
[
|,0|||
))
|
1)
-1
-
(1
| - p)
3
||>|||
- 2p
(162)
2p
2
[
2p
||0||
2p
+ 2p
|a>|
||>|||
p)
|
(163)
2p
2
Therefore,
3 lel 11
-1
y1
(1 u2)
(ui u22
y00 e
(164)
v3
V
(u + (22) T y00) e: -(1
$ |=1 T -26
+/2
+ (m) + (2n
(165)
||2:|]
2 ) 1 1 -(1
1 1mll
-(u1 + uz)
|||||| 2p
(166)
1el 2/2
v3 (m
u2)
V3 (u uz)
T
11
(167)
(11) + uz)) ) Yo
[
- Teel 2 2 +/2
- 2
+ (m + uz)
(168)
Note that we can analyze the score flow along each orthogonal direction separately. Next, we divide it into the following
cases:
V3 [1 - u2)) T yo = 0. then
y: = (u) + u2) (((u) + u2)
yo
x 2
-(1 (11-
-11
T
1 1/2
20
+
[
(169)
2
and we converge to the point you = (ut + U2)
|z||
2
If v3 (ui uz)" yo >> then we converge to yoo œτ. and if
(n)
T²)T 80 < 0, then we converge to yoo T22
v3
24

---

When Diffusion Models Memorize
L2 Distance < 0.2
Pairs
Triplets
Quadruplets
0%
20%
40%
60%
80%
100%
Figure 6: Existence of stable virtual training points. We run fixed-point iterations on a single denoiser, starting from all possible pair-wise, triplet-wise, and quadruplet- combinations of training samples. The plot shows the pereentage of points that converged within an L2 distance of 0.2 to the original, virtual, input point.
We assume WLOG that manifold (the line connecting the training points æ and Ø2) starting from initialization point yo. and AT, (p) the time to reach the edge of the partition starting from initialization point yo- We assume WLOG that (ut + u2) yo | and
v3 (u1 (41- u2) yo 0. We define ATa (p, the time reach distance from the data
(u1 + u2)
yo
|=]|| >E
d²
ATa (p,c)=
log
(170)
(uı + u2)
2/0
2p
d2
z |
(T)
log
(171)
2 ||
v3 (ul) 2222
y/
2p
Since p = aa, we get that
p²
ATa (p.c)=
log
(172)
||
(u) + u2) T
a²
||
-2p
40
2
p²
||
P
AT, (p)
log
(173)
a²
||
1)
v3 [1) u22)
3/0
3 2
-2
20
Similar to D.2 get that 3o (e) > 0 such that Vp Po (E,)
To (p,
=
(174)
E. Exploration of Different Thresholds
We next repeat the statistical analysis done in Section for different thresholds. Figure 6 demonstrates the existence of virtual points, in an analogous way to Figure 1, for the L2 metric. Figures and 8 offer additional insights to the right side of Figure 2a. Specifically, in Figure 7 we compare the results of the convergence types frequency of randomly sampled points with score flow when using different thresholds of the Loo distance. Figure 8 we instead use the Le metric. Similarly, Figures 9 and 10 depict additional comparisons the right side of Figure 2b, for both the Loc and Le distance metries.
25

---

When Diffusion Models Memorize
100%
100%
100%
Boundary
Boundary
Boundary
80%
Virtual Pts.
80%
Virtual Pts.
80%
Virtnal Pts.
60%
60%
60%
10%
40%
10%
20%
20%
0%
0%
0%
Lsp Distanoe < 0.15
Isc Distance 0.2
Loe Distance < 0.3
Figure 7: Convergence types frequency of randomly sampled points for score flow based on Loo proximity. We run the discrete ODE formulation of equation 20 for 500 randomly sampled points from R for sampling using the score flow. We plot the percentage of points that converged to either virtual point, training point, or to the boundaries of the hyperbox, out of all points, based on their Lx proximity for different thresholds.
100%
100%
100%
Boundary
Boundary
Boundary Vircual Pts.
Virtual Pts.
Virtual Pis.
80%
80%
80%
60%
60%
60%
40%
40%
40%
20%
20%
0%
0%
0%
Lg Distance < 0.15
1g Distancc < 0.2
1g Distance < 0.4
Figure 8: Convergence types frequency of randomly sampled points for score flow based L2 proximity. We the discrete ODE formulation of equation 20 for 500 randomly sampled points from 1230 for sampling using the score flow. We plot the percentage of points that converged to either virtual point, training point, or to the boundaries of the hyperbox, out of all points, based on their L2 proximity for different thresholds.
26

---

When Diffusion Models Memorize
100%
100%
100%
Boundazy
Boundary
Boundary
80%
80%
80%
Virtnal Pts.
60%
60%
60%
Virtual Pts.
Vissual Pts.
Training
10%
40%
Training Pts.
10%
Training Pts.
20%
20%
0%
0%
0%
Lsp Distanoe < 0.15
Isc Distance 0.2
Loc Distance < 0.3
Figure 9: Convergence types frequency of randomly sampled points for probability flow based on Loo proximity. We the discrete ODE formulation of equation 20 for 500 randomly sampled points from R30 for probability flow. We plot the percentage of points that converged to either virtual point, training point, or to the boundaries of the hyperbox, out of all points, based on their Loo proximity for different thresholds.
100%
100%
Boundary
Boundary
Boundary
80%
80%
80%
Virtnal
60%
60%
60%
Training Pts.
Vircual Pts.
40%
40%
Training Pts.
40%
Training Pis.
20%
20%
0%
0%
0%
1g Distance < 0.15
1g Distamoc < 0.2
1g Distance < 0.4
Figure 10: Convergence types frequency of randomly sampled points for probability flow based To proximity. We run the discrete ODE formulation of equation 20 for 500 randomly sampled points from |830 for probability flow. We plot the percentage of points that converged to either virtual point, training point, or to the boundaries of the hyperbox, out of all points, based on their La proximity for different thresholds.
27

---

When Diffusion Models Memorize
100%
100%
100%
Boundary
Boundaay
Boundary
80%
80%
80%
60%
60%
00%
Virtual Pts.
Training Pts.
40%
Training Pts.
40%
40%
Virtual Pis.
Training Pix.
20%
20%
20%
0%
0%
Lo Distance 0.2
Lop Distance <, 0.2
Log Distance < 0.2
(a) AL method, À 1. (b) Weight decay, À 0.25.
(c) No weight decay.
Figure 11: Convergence types frequency of randomly sampled points in diffusion sampling for training with AL method, weight decay, and without weight decay. We run the discrete ODE formulation of equation 20 for 500 randomly sampled points from R:30 for diffusion sampling, using different training configurations. We plot the percentage of points that converged to either a virtual point, a training point, or to the boundaries of the hyperbox, out of all points. The minimum norm constraint necessary for inducing the bias towards virtual training points and the boundaries of the hyperbox. Additionally, standard training protocol using weight decay regularization simulates well the minimum norm denoiser, which is achieved by the use of the AL method.
F. The Minimum Norm Assumption
Theorems C.1, 4.4, B.1, B.2 and B.3 all hold in the case of a minimum norm denoiser, in which the denoiser achieves exact interpolation over the noisy training samples. To enforce consistent denoiser, we used a non-standard training protocol in Section 5. Specifically, we optimize an equality-constraingg optimization problem using the Augmented Lagrangian method. Here we verify the robustness of our results and the necessity of the minimum norm assumption by repeating the experiment from Section 5 when using standard training, with and without the use of weight decay. Specifically, all the hyper parameters and Adam optimizer are kept the same, and only the loss function changes to directly optimize equation 3. Training with weight decay should result in denoiser that is similar to the min-norm solution. Figure 11 shows the percentage of points that converged within an Loo distance of 0.2 to either virtual points, training points, or a boundary of the hyperbox, for the different training configurations. The use of weight decay in a standard training protocol induces a similar bias that achieved by the use of Augmented Lagrangian method.
G. Extension to Orthogonal Data With N > d+1
As in the case of strictly orthogonal data it is impossible to have N > d, we consider here a simliar setup where the training set is augmented with samples randomly drawn from the boundary of the hyperbox. Specifically, for each augmented sample we sample random vector with i.i.d. elements from the uniform distribution Unif[0.3, 0.7]. This choice avoids the degenerate case where no denoisers are active in the low-noise regime. We then project the vector on a random face of the hyperbox to ensure that the new random data points lie on the hyperbox boundary. We train the denoisers following the same experimental setup as in Figure 2, using M 500 noisy samples and the AL method for optimization. We report the the numerical values for the convergence of points for the Los metric with a 0.2 threshold in Table 1. As can be seen from these results, in cases where N > d+1 1 the probability flow almost exclusively converges to the hyperbox boundary. Specifically, either to the boundary, training points (cither old orthogonal points or the new points on the boundary), or to other vertices of the hyperbox (the original virtual points), which aligns with our theory.
28

---

When Diffusion Models Memorize
Orthogomal Training Pts.
Augmenntd Triining Pts.
Virtual Pts.
Hyperbex Boundary
100%
10055
100%
100%
1005E
100%
80%
80%
80%
80%
80%
80%
60%
60%
60%
4095
40%
40%
20%
2075
20%
20%
207
207
0%6
095
0%
0%
00%
0%
Isp Dietance < 0.15
1xc Distance < 0.2
1op Distance < 0.3
11 Distance < 0.15
12 Distance < 0.2
1g Diecanio < 0.4
Figure 12: Convergence types frequency of randomly sampled points in diffusion sampling for training with AL method, with an augmented training set such that N > d d 1, where = 40. We run the discrete ODE formulation of equation 20 for 500 randomly sampled points from IR:0 for probability flow. We plot the percentage points that converged to either a virtual point, training point, new augmented training point from the boundary of the hyperbox, or to the boundaries of the hyperbox, of all points, based on their Loo or L2 proximity for different thresholds.
Orthogoaal Training Pis.
Augmented Trininn Pts.
Viriul Pls.
Hyperbux Boundary
100%
100%
100%
100%
100%
100%
80%
80%
80%
80%
80%
80%
60%
6076
00%
80%
60%
00%
20%
20%
20%
20%
056
0S5
0%
0%
00%
0%
Lvo Distance 0.15
L.. Distance 0.2
Ls. Distance <
Lg Distance 0.15
La Distance 0.2
Distance 0.4
Figure 13: Convergence types frequency of randomly sampled points in diffusion sampling for training with AL method, with an augmented training set such that d, where N 50. We run the discrete ODE formulation of equation 20 for 500 randomly sampled points from 30 for probability flow. We plot the percentage points that converged either a virtual point, training point, new augmented training point from the boundary of the hyperbox, or the boundaries of the hyperbox, of all points, based on their Loz La proximity for different thresholds.
Table 1:
Convergence types frequency of randomly sampled points in diffusion sampling for training with AL method, with an augmented training set such that N > d 1.
N 40
N 50
Hyperbox Boundary
99%
98.21%
Original Virtual Points
2.4%
3.4%
Orthogonal Training Datapoints
32%
19.6%
Augmented Random Data Points
14.6%
19%
Further metrics and thresholds for the two cases can be seen in Figures 12 and 13.
29

---

When Diffusion Models Memorize
XX
Figure 14: Convergence types frequency of randomly sampled points in diffusion sampling for training with AL and dropout. We run the discrete ODE formulation of equation 20 for 500 randomly sampled points from R300 for probability flow. We plot the percentage of points that converged to either a virtual point, a training point, new augmented training point from the boundary of the hyperbox, or to the boundaries of the hyperbox, out of all points, based on their Loo or L proximity for different thresholds.
H. Including Dropout During Training
We conduct additional experiments to assess the effect of incorporating dropout during training. As shown in Figure 14, this results in more samples being generated outside the boundary of the hyperbox. Notably, adding dropout increases the MSE loss during denoiser training, especially in the "low-noise regime", which contributes to this behavior.
I. Connection to Hopfield Models
We compute the detection metrics suggested by Pham al. (2024) for memorization, spurious, and generalization detection, for the same setup in Figure 2. Specifically, the training set contains N 31 orthogonal points, and we use the same 500 sampled points as the evaluation set. Therefore, in the notation of Pham et al. (2024), |S| 31 and gesal = 500. Following the guidelines set by Pham et al. (2024), we ensure the additional required set S' is much larger than the training set by constructing S' such that | = 100 x [S]. Additionally, both S' and gesal were sampled using probability flow.
Table compares the classification evaluation points into memorization, spurious, and generalization categories as described by Pham al. (2024), with our own categorization into training points, virtual points, and hyperbox boundary points. We set 6m L, corresponsing to the thresholds used in experiments, and test both Loc and L2. Additionally, use 8, 0.15. The results suggest that many virtual points are classified spurious under the criteria set by Pham et al. (2024). This aligns with our analysis, as virtual points are stable, stationary points of the score flow; therefore, given large evaluation set, points will cluster near the virtual points, which matches the spurious points definition. However, due to the exponential number of virtual points, we cannot expect cluster to form around each of them. As a result, some virtual points are also classified as "generalization" under these metrics.
Table 2: Comparison of the classification evaluation points between our notations and the notations of Pham et al. (2024).
Classification under
Our Classification
L.0 = 0.2
Loo = 0.15
Loo = 0.3
L2 = 0.2
L2 = 0.4
Pham et al. (2024)
Training Pts.
100%
99.49%
100%
100%
100%
Memorized
Boundary Pts.
0%
0.51%
0%
0%
0%
Virtual Pts.
52.94%
21.57%
78.22%
34.29%
100%
Spurious
Training Pts.
0.98%
0%
0%
0%
0%
Boundary Pts.
46.08%
78.43%
21.78%
65.71%
0%
Virtual Pts.
11.35%
3.98%
31.48%
3.98%
40.22%
Generalization
Training Pts.
4.86%
2.99%
6.79%
3,98%
6.15%
Boundary Pts.
83.78%
93.03%
64.73%
92.04%
53.63%
J. Additional Simulations
Figure shows the normalized score flow for the case of an obtuse 2-simplex. Figure 5 shows the normalized score flow for the case of equilateral triangle. The normalization was done for visualization purposes only, since the norm of the score
30

---

When Diffusion Models Memorize
20
15
15
10
10-
0.-
0.5
00
0.0
-05
-0.5
100
1.0
-20
-15
-100
-0.3
010
0.5
1.0
2.0
-20
1.5
1.0
-0.5
0.0
0.5
1.5
2.0
(a)
(b)
Figure 15: The score function of obtuse and acute simplex. The red dots are the training points I1, Z2 Ez. The black lines are the ReLU boundaries. In figure (a) we plot the score function of obtuse simplex (Proposition D.1). In figure (b) we plot acute simplex (Proposition D.2)
1.0
Exst
6.0
Approcantedd
-0.5
-15
Figure 16: The score function of orthogonal dataset. The purple line is the trajectory of the score flow the exact score function, and the green line is the trajectory of the score flow of the approximated score function (equation 18) in the case where = 0.03, p 0.09. Both trajectories are very similar.
decreases as it approaches the ReLU boundaries. In Figure 15 we illustrate the unnormalized score flow. Figure 16 shows the trajectory score flow of the exact score function, and the green line is trajectory of the score flow of the approximated score function as can be seen the trajectories are practically identical.
31


Reviews:
[{"review_id": "kfyuNJwABB", "reviewer": "Reviewer_SMjF", "summary": "The authors analyze memoization of diffusion models in shallow relu networks. To analyze this, they consider the probability flow ode, and obtain additional results by introducing a simpler score flow. Under some assumptions, they show that both ODE's have stationary points corresponding to the training points, and in some cases sums thereof. They verify their theoretical claims through various experiments on small orthogonal datasets and confirm their theory holds\n\n## update after review\nThe authors addressed my concern about N > D well, and I have increased my score from 3 to 4 as a result", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate the reviewer’s positive feedback. \n# Orthogonal Dataset Choice \nFirst, when $N>D$, it is indeed impossible for the dataset to be exactly orthogonal. However, for standard i.i.d. Gaussian data $x_n$, it is easy to show  (e.g., using the analysis in Section 3.2.3 of [R1] and the union bound) that the largest cosine of the angle between two different datapoints is, with high probability,\n$\\max_{n\\neq m} \\frac{x_n \\cdot x_m}{\\|x_n\\| \\|x_m\\|} \\sim \\sqrt{\\frac{\\ln N}{d}}$.\nTherefore, in the realistic regime $\\exp(D) \\gg N>D \\gg 1$, most pairs are nearly orthogonal. We believe this is a main reason why the orthogonality assumption is reasonable and common (e.g., [R2]) in high-dimensional theoretical analysis.\n\nSecond, to make sure we are on the same page, please note that our analysis goes beyond the orthogonal case and covers all the analytically solvable cases found in Zeno et al. 2023, though some of this analysis was relegated to the appendix. For example, in App. D (line 630), we extend our analysis beyond the strictly orthogonal case by considering the scenario where the convex hull of the training points forms an obtuse-angle simplex. We showed there that similar behavior emerges even when strict orthogonality does not hold, supporting the broader relevance of our findings. In the main paper, we indeed focused on orthogonal datasets: this was done to simplify the presentation, and since the solution is qualitatively similar to that in the obtuse angle case.\n# Interpolation Meaning \nYes, by \"interpolates the training data,\" we mean that the denoiser maps each noisy sample to its corresponding clean training point, which leads to a zero empirical loss. Solutions with zero empirical loss are commonly called interpolators in the ML theoretical literature (e.g., \n[R3]). As an approximation to this, we further assume that the denoiser maps the entire open ball centered around each clean data point to that clean point (this was also done and explained in Zeno et al.).\n# Virtual Points & Generalisation \nYes, we view these virtual points as desirable, since they go beyond the empirical data distribution, and create new combinations not seen before in the training data. It is perhaps more accurate to view this on some scale: low-order combinations (e.g., which can be easily observed as “copy-paste”) may seem closer to memorization (“low creativity”), while high-order combinations show a higher degree of generalization (“high creativity”). We will discuss this interesting point in the paper. \n# Generalisation in Orthogonal Datasets\nIn the case of an orthogonal dataset, we interpret the hyperbox boundary as an implicit data manifold, even though we do not assume an explicit sampling model that generates the training data (e.g., a distribution supported on the manifold). In this context, we define generalization as the ability to sample points from the hyperbox boundary.\n# Noise Distribution Modeling \nIn practice, diffusion models are trained for a finite number of iterations using Gaussian noise. Consequently, during training, we effectively observe (different) noisy samples that all lie within an open ball around each clean data point (see additional details in sec. 3 in Zeno et al. 2023).\nIn the multivariate case, finding an exact min-cost solution for finitely many noise realizations is generally intractable. So, we assume that the denoiser maps each open ball to its corresponding clean data point. \n\n[R1] Roman Vershynin. High-Dimensional Probability. 2019.\n\n[R2] Andrew M. Saxe et al. Exact solutions to the nonlinear dynamics of learning in deep linear neural networks. arXiv:1312.6120, 2013.\n\n[R3] Siyuan Ma et al. The Power of Interpolation: Understanding the Effectiveness of SGD in Modern Over-parametrized Learning. ICML, 2018.", "claims_and_evidence": "It seems to me the claims match the evidence.", "methods_and_evaluation_criteria": "The evaluation is on simple datasets, but seems appropriate for the problem setting, i.e. a theoretical analysis of neural networks for diffusion modeling", "theoretical_claims": "The theorems are well explained, and seem (to the best of my ability of judging) to be correct. I checked the correctness of the proofs in Section 3 in appendix A.", "experimental_designs_or_analyses": "I think the choice of orthogonal dataset is interesting, but potentially understandable, please see my question under \"strenghts and weaknesses\"", "relation_to_broader_scientific_literature": "-", "essential_references_not_discussed": "NA", "other_strengths_and_weaknesses": "Overall the paper is well written and good to follow, even for someone with limited knowledge of theoretical analysis of shallow neural networks. The theorems and proofs are well explained, and seem (to the best of my ability of judging) to be correct. While the problem set up is simple, it is understandable to the extent that a rigorous theoretical analysis of anything more complicated quickly becomes intractable, I do have some questions:\n- The authors state that a standard normal distribution becomes more orthogonal under increasing dimension. While this is true, most machine learning datasets have N >> D, and can therefore not be orthogonal. Can the authors defend their choice of orthogonal dataset and why this would be relevant to actual datasets?\n- Can the authors explain what they mean by \"interpolates the training data\"? Do the authors mean that in an open ball around a training point the denoiser maps to the training data? This seems to be what the definitions say but this is not what I would consider \"interpolation\".\n- Can the authors elaborate whether virtual points correspond to generalization? If I understand the argument correctly, the authors interpret the training-data \"copy-pasting\" sometimes observed in diffusion models that way. Is it correct to understand this \"copy-pasting\" as the virtual training points discussed in the theory? Ultimately: are virtual points desirable, or not?\n- Following up on this question, for an orthogonal dataset, what does it mean to \"generalize\"?  Or perhaps a better question is, is the underlying distribution simply a categorical distribution?\n- Is it possible to model the noise distribution as a true noise distribution rather than a fixed collection of points? Why did the authors choose to use a fixed set of points for the noise distribution?", "other_comments_or_suggestions": "NA", "questions_for_authors": "See strengths and weaknesses", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tWtO4zHtJV", "reviewer": "Reviewer_mtjQ", "summary": "The authors analyze the behaviour of score and probability flow ODEs when the score is estimated using min-cost shallow neural networks and restricted datasets. Under these assumptions, they derive theoretical results which find that the stationary points of PF-ODE and score flow ODE consist of summation of training set elements. Empirically, they confirm their theoretical findings by demonstrating the stability of the predicted stationary points and that PF-ODE and score flow ODE sampling converge to these samples.\n\n## Update after Rebuttal\n\nI'd like to thank the authors for performing additional experiments on my behalf. I sincerely appreciate the effort to produce these results in such a short amount of time. \n\nI am fairly conflicted about this paper. I still am skeptical that these results are truly useful to the community. From the authors' latest reply, and simple linear algebra, for $N>=d$, any sample can be decomposed into a linear combination of the training set points so I struggle to determine what takeaways these finding have for practical diffusion applications. However, the theoretical results of this paper are sound, and are empirically well supported by the paper's experimental results. I have decided to update my score to a 3.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their thoughtful feedback.\n# Connection to Semantic Sums\nWe are sorry for the lack of clarity. We did not aim to claim that the virtual points in orthogonal data must be equivalent to combinations of semantic components of images as observed in Stable Diffusion. This is only maintained as a motivation for virtual points. We agree that the current phrasing in the abstract may be confusing, and will change this in the revised paper.\n# Relaxation of Obtuse Angles\nThe same arguments used in the proof of Theorem 3 in Zeno et al. (2023) can be applied to prove equation (17). The requirement for strictly obtuse angles (i.e., $x_i^Tx_j < 0$ instead of $x_i^Tx_j \\leq 0$) in Zeno et al. (2023) is only made specifically to ensure the uniqueness of the solution. The proof of that theorem, therefore, applies to the orthogonal case as well, just without uniqueness. In other words, the function in (17) is a minimizer of (8), but not necessarily the unique minimizer.\n\nSpecifically, the proof of Theorem 3 in Zeno et al. (2023) uses the fact that any unit active along two data points making an obtuse angle can be “split” into two units aligned with each data point with strictly lower representation cost. When the rays are orthogonal, the two “split” units may have the same representation cost as the original unit. So while the interpolant given by equation (17) is still a minimizer, it is no longer necessarily unique in the case of orthogonal data.\n\nWe will clarify this in the paper.\n\n# Constraining Denoisers to Exactly Fit the Training Data Outside the Low-Noise Regime\nIndeed, outside of the low-noise regime, the denoisers would not exactly fit the training data, and the min-norm denoiser in this case is not defined (as we can not get zero loss).\nWe use the same training regime for all denoisers for consistency. To complement that, we conduct additional simulations in App. E, where we train the neural denoisers using a standard training procedure using the Adam optimizer with weight decay, obtaining similar results. We hypothesize that this is because high-noise denoisers primarily influence the initial condition, before the critical noise threshold is crossed, and we start the “useful” final sampling phase [R1].\n# Strength of Assumptions\nIndeed, we make simplifications to allow tractability. Please note, however, that while $N>D$  makes it impossible for the dataset to be exactly orthogonal, in the realistic regime $\\exp(D) \\gg N>D\\gg 1$ most pairs are nearly orthogonal for standard Gaussian data. We believe this is a main reason why the orthogonality assumption is reasonable and common in high-dimensional theoretical analysis.   \nPlease see more details in our response to Reviewer SMjF under “Orthogonal Dataset Choice”.\n# The Constrained Optimization Procedure\nApp. E holds additional simulations where we train the neural denoisers using a standard training procedure with the Adam optimizer, with or without weight decay regularization (which promotes min-norm results, but not forces it). Specifically, for weight decay, we tried $\\lambda=0.25,0.5,1$. All values led to similar results, therefore we included in Fig. 6 only the case of $\\lambda=0.25$. As can be seen, in the case of WD=0 we converge only to the training points or boundary points of the hyperbox, whereas for WD>0 we converge to virtual points as well, which aligns with the results achieved with the Augmented Lagrangian method.\n# Diffusion Time Scheduler\nThanks for this suggestion, we will change the terminology in the revised paper.\n# Min-cost Denoiser Independent of $t$\nThe time dependence of the min-cost denoiser is through $\\rho$. Specifically, in eq.11 (probability flow ODE), the RHS includes a derivative w.r.t  $t$ of $\\sigma_t^2$ times the score function, so by applying time re-scaling arguments, we get a time-dependent $\\rho$, and, therefore, denoiser. In eq. 13, however, the RHS does not include a derivative with respect to $t$, so $\\rho$ and the denoiser are time-independent.\n# Significance of the 0.2 Threshold\nWe show the effect of changing the thresholds values in App. F. Qualitatively, this does not drastically affect the results.\n# Samples Beyond Training/Virtual/Boundary Points\nNo, all points converged to one of the 3 categories, which matches our theoretical analysis.\n# Extending Fig. 3 to $N>d$\nWe thank the reviewer for this suggestion. In strictly orthogonal data, it is impossible to have $N>d$. If the reviewer has a different dataset in mind, we will be happy to train all our denoisers (150) on the relevant $N$ and $d$ on this new dataset, and include our findings in the revised paper. Note also that if we change the dataset, it can become challenging to define and find the virtual points.\n\n[R1] Gabriel Raya & Luca Ambrogioni. Spontaneous symmetry breaking in generative diffusion models. NeurIPS, 2023.", "claims_and_evidence": "The only claim which I take issue with is the implied similarity between convergence to virtual and boundary points under these restrictive assumptions and the combination of semantic components of images as observed in Stable Diffusion outputs (see abstract, L236). This claim is made with little evidence, as to my understanding this work predicts convergence to hyperbox boundaries or vertices. It is not clear to me that \"semantic sums\" are equivalent to the dimension-wise sums of this work.", "methods_and_evaluation_criteria": "The proposed evaluation methods are reasonable tests of their theoretical predictions", "theoretical_claims": "My main concern regarding theoretical claims is regarding equation (17) - the minimizer of the constrained optimization problem when trained on orthogonal data, ie $x_i^\\top x_j = 0$. The authors cite Theorem 3 of Zeno et al. 2023 as the source of this minimzer. However, Theorem 3 of zeno et. has the condition of $x_i ^\\top x_j < 0$. Could the authors please clarify why this relaxation is acceptable?", "experimental_designs_or_analyses": "A key assumption of this work is that the denoiser should fit the training data exactly. While this is completely reasonable for low noise levels where the modes of the dataset do not overlap, I am concerned about the training of the 100 other denoisers outside of the \"low-noise regime\". In this regime, a well trained denoiser should not exactly fit data points, but the posterior mean (ie eq. 2), which for a finite training set is a simple weighted average of the training points. A denoiser in this regime constrained to fit the training points exactly is therefore not a reasonable substitute for a well-trained diffusion model.\n\nI am concerned that constrained optimization of the non \"low-noise regime\" denoisers may affect the conclusions reached from the empirical results. For example in Figure 6, with unconstrained optimization of the denoiser, no convergence to virtual points is observed in contrast to Figure 2 (b).", "relation_to_broader_scientific_literature": "The contributions of this paper are somewhat complementary to the emerging literature on memorization in diffusion models, ie Somepalli et al. 2023 and Kadkhodie et al. 2024. However, the restrictive assumptions made in this paper make it somewhat less relevant to the general case of memorization/generalization in large scale diffusion models.", "essential_references_not_discussed": "The related work presented in this manuscript is to the best of my knowledge not missing any essential references.", "other_strengths_and_weaknesses": "Although I believe that the contributions of this paper are novel and generally well done, its main weakness is the strength of assumptions required to allow analytic tractability.\n\n## Strengths\n\nThe problem of memorization in diffusion models is extremely relevant, and this paper's analysis of the probability flow ODE provides an interesting clue as to how memorization may occur in larger models. In addition, the presentation and writing are generally good. Finally, the empirical results generally confirm the predictions made by the theory and are sensible\n\n## Weaknesses\nThe main weakness of this work are the restrictive assumptions. Specifically, the assumptions regarding orthogonality seem especially restrictive. In most deep learning settings, (ie stable diffusion) the number of data elements far exceeds the data dimensionality. The theoretical results also depend on a constrained optimization procedure which does not reflect the general practices for diffusion training. While I understand these assumptions are required for theoretical analysis, they also limit the contribution. Although the probability flow ODE results are potentially relevant to general diffusion sampling these results are questionable due to the optimization procedure of the denoiser.", "other_comments_or_suggestions": "While first reading this work, I was confused by the term \"scheduler\" which is referenced in the abstract and introduction but is only defined on line 152. I suggest the authors introduce this concept earlier or perhaps replace it with \"diffusion time scheduler\" or similar to avoid confusion with other schedulers such as optimization schedules which can also have early stopping.", "questions_for_authors": "I've repeated the first two questions from prior sections of my review here for clarity\n\n1. Regarding the min-cost solution of equation (17), why is the orthogonal assumption reasonable with Zeno et. al 2023 require obtuse angles between data points?\n2. When training denoisers outside of the low-noise regime, why should denosiers be constrained to exactly fit the training data?\n3. On line 123(R) you state \"Notably, in contrast to the probability flow ODE, the min-cost denoiser here is independent of t\" Could you clarify why the min-cost denoiser is dependent on the choice of ODE you wish to solve? \n4. In your empirical results, you use 0.2 as a threshold for matching. Does this threshold have significance?\n5. Across all of your experiments you find that samples can be categorized as Boundary, Training Pts. or Virtual Pts. Did you find any samples which fell outside of these classes?\n6. In Figure 3 you evaluate the fraction of virtual points for $N \\in [10, 15, 20, 25, 30\\]$. How does the sample distribution change as you extend to $N > d$?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "lf3MIMDV7x", "reviewer": "Reviewer_urF4", "summary": "Commonly, diffusion models use the probability flow ODE to generate high-quality images. Obviously, the score (or reverse) SDE can be used to generate images as well. But the process for the score SDE is understandable, since it is derived from the forward SDE. However, it is unclear on the distinction between the probability flow and the score SDE, regarding their ability to generate high quality images and duplicate training points. To tackle this distinction and to further elucidate on the mechanism of generating from probability flow ODE, this work studies the probability flow of shallow ReLU neural network denoisers trained with minimal $\\ell_2$ norm on datasets, where the actual minimizers can be solved. Interestingly, the work finds that probability flow reaches more general manifold points, while score flow (SF) more often converges to training points or virtual points (sum of training points).", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We greatly appreciate the reviewer’s kind words. We are glad to hear that the paper is presented in an accessible and engaging manner and that it was enjoyable to read. \n# Application to Higher Dimensional Data\nIndeed, we make simplifications to allow tractability. Please note, however, that while $N>D$  makes it impossible for the dataset to be exactly orthogonal, in the realistic regime $\\exp(D)\\gg N>D\\gg 1$ most pairs are nearly orthogonal for standard Gaussian data. We believe this is a main reason why the orthogonality assumption is reasonable and common in high-dimensional theoretical analysis.   \nPlease see more details in our response to Reviewer SMjF under “Orthogonal Dataset Choice”.\n# Manifolds With Curvature\nWe appreciate this insightful suggestion. Our theoretical analysis is based on Euclidean geometry and does not easily extend to nonlinear manifolds with curvature. Investigating how score and probability flows behave in such spaces is indeed an important direction for future research. Additionally, identifying meaningful experimental quantities analogous to those we defined (e.g., virtual points) in curved manifolds poses an interesting challenge.\n# Dropout Effect\nThe impact of dropout on the generation of virtual points depends on several factors, including whether it is applied to the input, hidden layers, or both, as well as the dropout rate. Could the reviewer kindly elaborate on the specific dropout setting they have in mind?\n# Results for Additional Datasets\nWe thank the reviewer for the suggestion. We will add additional visualizations to the appendix and highlight these distinctions in the revised version of the paper.\n\n# Connection to Hopfield Models\nWe appreciate this insightful suggestion. In the revised version of the paper, we will incorporate the Memorization, Spurious, and Generalization metrics into our experimental results.\n\n\n# Essential References\nWe thank the reviewer for these references; we will discuss these related works in the revised manuscript.", "claims_and_evidence": "## Claim\n\nThe claims made by this paper are theoretical and backed by the simulation results on simple-solvable datasets in conjunction with proofs provided by the authors. These claims are:\n\n(1) On clean and orthogonal data, both score and probability flow samplings follow a similar trajectory for a given initialization point.\n\n(2) However, sampling with probability flow can reach more general manifold points due to the early stopping in the scheduler. In other words, sampling with probability flow can reach both training points and virtual points (which are sums of the training points). In the hyper-box data, such virtual points can exist on the boundary of the hyper-box. Although score flow ODE can converge to training points, it is quite rare for that to happen. In contrast, it is more likely to converge on virtual points. Meanwhile, probability flow ODE tend to converge to virtual points at the boundary.\n\n\n## Evidence\n\n(1) To establish the first claim, strongly following the work of [Zeno et al. (2023)](https://openreview.net/forum?id=gdzxWGGxWE), the authors first define the problem setting and the representation cost $R(\\mathbf{h})$ where $\\mathbf{h}$ is the **predicted training point** given a perturbation $\\mathbf{y}_t$ of a training point $\\mathbf{x}_i \\in \\{ \\mathbf{x}_n \\}^{N}_{n = 1}$ in which it tries to predict.\n\nThis representation cost $R$ focuses on the minimization of the $\\ell_2$ regularization term $C(\\theta)$ from the following MSE loss:\n\n$\\mathcal{L} (\\theta) = \\frac{1}{M N} \\sum^M_{m = 1} \\sum^N_{n = 1} \\lVert \\mathbf{h} (\\mathbf{y}_{n, m}) - \\mathbf{x}_n  \\rVert^2  + \\lambda C(\\theta)$\n\nwhere $\\mathbf{y}_{n,m} = \\mathbf{x}_n + \\epsilon_{n, m}$ in which there are $m = 1, \\dots, M$ perturbations and $n = 1, \\dots, N$ training samples. \n\nThe minimizer of $R$ is: $\\quad \\quad \\mathbf{h}^* \\in \\underset{\\mathbf{h}}{argmin} \\ R(\\mathbf{h}) \\quad $ s.t. $\\quad \\mathbf{h}(\\mathbf{y}_{n, m}) = \\mathbf{x}_n \\quad \\forall n, m$ \n\nbut for the multivariate (more general) case, the constraint $\\mathbf{h}(\\mathbf{y}_{n, m}) = \\mathbf{x}_n$ is modified into $\\mathbf{h}(B(\\mathbf{x}_n, p)) = \\{ \\mathbf{x}_n \\}$. $B(\\mathbf{x}_n, p)$ denotes a ball centered at the training point $\\mathbf{x}_n$ with radius $p$. Thus, the minimizer setup, which the analysis focuses on, is\n\n$\\mathbf{h}_p^* \\in \\underset{\\mathbf{h}}{argmin} \\ R(\\mathbf{h}) \\quad $ s.t. $\\quad \\mathbf{h}(B(\\mathbf{x}_n, p)) = \\{ \\mathbf{x}_n \\} \\quad \\forall n$ \n\nDetailed in section (4), using the hyper-box as the data, the authors demonstrated the score flow converges to the vertex (or training point) of the hyper-box closest to its initialization point (see Theorem 4.3 and Appendix D.2). Based on Eq. (18), it is demonstrated that both of the flows share similar trajectory, in which they can arrive at similar stationary points.\n\n\n(2) In the case of probability flow on the hyper-box, there is a $p_t$​ scheduler which inhibits its guarantee to land on the closest vertex. Thus, it can instead more often land on a boundary point to the vertex. **This directly supports claim (2) that probability flow can reach more general manifold points due to early stopping in the scheduler**. The authors formalize this through theoretical analysis showing that while score flow ODE tends to converge to virtual points (or sums of training points), probability flow ODE has a higher likelihood of converging to points on the boundary of the data manifold.\n\nThe empirical evidence in Figure (2) clearly illustrates this distinction, showing that probability flow sampling more frequently lands on boundary points, whereas score flow predominantly lands on virtual points. This systematic difference in convergence behavior confirms the theoretical prediction that probability flow can reach both training points and a broader set of manifold points (including boundary points), while score flow is biased toward virtual points.\n\nThese aspects are also established in two more data settings, obtuse-angle dataset and equilateral triangle dataset.\n\n(3) The convergence to training points for both flows is further exacerbated as there are more training points. Partly, this is due to the creation of more virtual points. This fact is demonstrated in Figure (3) which details the fraction of training points, boundary points, and virtual points as the training data size $N$ increases. Although the figure only shows up to $N = 30$, as $N \\rightarrow \\infty$ it is likely that there will be more virtual points than training data generated from the models. \n\n## Strength\n\n(1) The methodology of using solvable shallow ReLU networks allows for precise mathematical characterization of the sampling behaviors, leading to provable results rather than just empirical observations. This approach enables the authors to establish clear connections between score and probability flows and their trajectory in generation.\n\n(2) The findings regarding virtual points and boundary points have significant implications for diffusion model's dynamics. Specifically, by revealing how probability flow can reach more general manifold points while score flow more often converges to training or virtual points, the paper provides some insights on memorization and generalization in diffusion models.\n\n(3) Overall, the paper is presented in an accessible and engaging manner, which makes it approachable for both newcomers to the field and experts. Frankly, I did enjoy reading the paper.\n\n## Weakness\n\n(1) The paper's analysis is limited to simplified data distributions and a shallow ReLU network (with a single hidden layer), which may not generalize well to complex, high-dimensional data distributions used in practical applications. This restriction to tractable theoretical settings leaves questions about whether the conclusions apply to modern deep diffusion models which operate at a much higher dimension and learn more complex distributions.\n\n(2) Furthermore, the analysis of this work relies heavily on the work done by [Zeno et al. (2023)](https://openreview.net/forum?id=gdzxWGGxWE), which assumes a full $d-$ dimensional ball centered around each training data. In real-world scenarios, the number of noisy samples is typically smaller than the input dimension $d$.\n\n(3) Moreover, the paper's analysis did not include manifold with curvatures. Many real-world datasets, especially in high-dimensional spaces, exhibit complex geometric properties that cannot be captured by simple Euclidean geometry. It would be important to extend the analysis to account for such manifolds, as this could provide a more accurate and robust understanding of how score and probability flows behave in high-dimensional, non-Euclidean spaces.\n\n## Questions\n\n(1) Can this study be expanded to the hypersphere of low dimension or a circle? Or a manifold with curvatures?\n\n(2) If dropout was to be included to the model, do you think that there will be more virtual points generated?\n\n(3) In the empirical results section, Figure (2) demonstrates the behavior of probability and score flows for the hyper-box dataset. Would it be possible to provide similar visualizations for the obtuse-angle and equilateral triangle datasets to further highlight the distinctions between these flows and how they behave on different data?", "methods_and_evaluation_criteria": "The experiments used to confirm the theoretical claims are sound, and I do not see any problems with them. However, I would like to see experiments on manifold with curvatures.", "theoretical_claims": "Yes, I did check the theoretical claims, which I mentioned above, made by the paper. \n\nSpecifically, I spent a lot of time checking proofs behind Theorems (4.3 and 4.4). Such proofs are located in entirety of Appendix D. \n\nOverall, I do not see any problems with the proofs in the main text and appendix as they were formatted and written decently.", "experimental_designs_or_analyses": "I find no problems with the experimentation, including their designs and analyses. However, I do find the experimentation still somewhat lacking. Also, the experimentation detailed in Figures (12) and (13) feel redundant to me.", "relation_to_broader_scientific_literature": "This work is quite valuable, in my opinion. Firstly, it provides an analysis which differentiate PF and score flow ODEs, regarding their dynamical behavior. This distinction can be related to memorization and generalization (if done correctly). Specifically, the work provides some results on the fractions of sample types (e.g., virtual points and training points) generated from the diffusion model, regarding which flow is utilized.\n\nMoreover, with these findings, I believe the authors can relate them to the aspects of Hopfield models and theory as well. Specifically, both virtual points and boundary points could be seen as spurious patterns, but as the training data size increases, most virtual points become generalized patterns. See [Pham et al. (2024)](https://openreview.net/pdf?id=zVMMaVy2BY).", "essential_references_not_discussed": "A tangential study of memorization in terms of the manifold --- [Ross et al. (2024)](https://arxiv.org/pdf/2411.00113)\n\nA tangential study of the dynamical trajectory in diffusion models --- [Biroli et al. (2024)](https://www.nature.com/articles/s41467-024-54281-3)\n\nA tangential study of generalization in diffusion models via the aspects of convolution --- \n[Kamb and Ganguli (2025)](https://arxiv.org/pdf/2412.20292)\n\nA tangential study of memorization and generalization in diffusion models via the lens of Hopfield models --- [Pham et al. (2024)](https://openreview.net/pdf?id=zVMMaVy2BY)\n\nA tangential study of loss in manifold dimension which leads to generalization in diffusion models --- [Achilli et al. (2024)](https://arxiv.org/abs/2410.08727)", "other_strengths_and_weaknesses": "N/A", "other_comments_or_suggestions": "N/A", "questions_for_authors": "See Above", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "eAdxwZR6Nd", "reviewer": "Reviewer_vy6L", "summary": "The paper rigorously proves that, when the training points are orthogonal and we use the MMSE denoiser, score flow converges to the vertices of a hyperbox, wherein the vertices of the hyperbox are the partial sums of training points. Similarly, they prove that probability flow converges to a vertex on this hyperbox or a point on the boundary of the hyperbox. Both proofs analyze the stable points of the flow under a \"low-noise regime\" showing that, for score flow, the only stable points are the vertices of the hyperbox, whereas for probability flow these stable point include the boundary. They proceed to show that these results hold using a shallow ReLU neural network with a minimal l2 norm with some error wherein some partial sums have become unstable due to the error between the MMSE and neural network denoiser. Finally, they show experimentally that as the number of training points increases, the diffusion process converges to a higher proportion of non-training points thus the generalization is increasing.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate the reviewer’s positive feedback and are glad that they find this a fascinating contribution. The interplay between memorization and generalization is indeed intriguing.\n# Low-Noise Regime Details\nTheoretically, the boundary of the low-noise regime is determined by the diffusion time scheduler, the number of timesteps, $T$, the training data, and the noise realizations. In the experiments, we approximate this boundary by considering a ball radius equal to 4 standard deviations. Specifically, we first calculate the variance schedule of the $T=100$ diffusion timesteps. Then, we check the minimal distance between training points. We consider the low-noise regime boundary to be an eighth of this distance. Once we have this boundary, we extend the variance schedule to include at least $50$ variance values below the boundary.    \nSince we are discretizing an ODE, as long as we are using small enough timesteps, we would get the same results. We will clarify this in the revised manuscript.\nIn practical models, we are guaranteed to have some denoisers in the low-noise regime, since the final sampled point is obtained when $t \\approx 0$, where the noise level is inherently small.\n\nAdditionally, the low-noise regime is practically important for diffusion sampling, as the \"useful\" part of the diffusion dynamics occurs primarily when the noise level drops below a certain critical threshold [R1].\n# Implications for Practical Image Diffusion Models\nIn practice, natural images lie on a low-dimensional linear subspace due to their approximate low-rank structure (see Zeno et al. (2023), Appendix D3). As a result, the denoiser first contracts the data towards this subspace (see Theorem 2 in Zeno et al. (2023)). If the subspace has sufficiently high dimension, the data points become approximately orthogonal (following the $\\exp(D) \\gg N > D \\gg 1$ argument in our response to Reviewer SMjF under “Orthogonal Dataset Choice”). Consequently, the geometric structure in high-dimensional image spaces might resemble the hyperbox studied in our work, though restricted to a subspace, and with slightly acute angles rather than strictly orthogonal ones.\n\n# Reliance on Zeno et al. (NeurIPS 2023) \nWe acknowledge the reliance on Zeno et al. (NeurIPS 2023), but we believe that advancing the understanding of diffusion models remains valuable, even within these constraints. We believe that exploring alternative data arrangements is an interesting and challenging direction for future work.\n# Fig. 3 Points Order\nThanks for this valuable suggestion, we will swap the order in the revised paper.\n# Convergence Inside the Hyper-Box\nWe do not converge inside the hyperbox because, as shown in Fig. 8 (Appendix F), the score function trajectory, both inside and outside the hyperbox, always points toward its boundary. As a result, the probability flow ODE leads to convergence at the hyperbox boundary rather than within its interior.\n\n[R1] Gabriel Raya & Luca Ambrogioni. Spontaneous symmetry breaking in generative diffusion models. NeurIPS, 2023.", "claims_and_evidence": "All claims are stated clearly and have been rigorously proved. Any assumptions made for the theory are well discussed. The theory is then backed by sufficient experiments which extend to a more practical setting.", "methods_and_evaluation_criteria": "The stable point analysis used to prove the claims gives a good intuition for convergence and the approximations used to simplify the analysis are justified.", "theoretical_claims": "I did not check the proofs in the appendix.", "experimental_designs_or_analyses": "The main experiments are with carefully constructed data and models in line with the theory proposed.  There are supplementary experiments which relax the assumptions and demonstrate that the theory still hold with some error.", "relation_to_broader_scientific_literature": "- They move beyond Zhang & Pilanci's (arXiv 2024) work on univariate data by considering high-dimensional data belonging to a simplex and showing convergence using probability flow and score flow instead of Langevin Dynamics; thus showing different convergence guarantees depending on the inference procedure used.\n- Carlini et al. (USENIX Security 2023) empirically showed that training data could be extracted by locating stable points. This work significantly advances this by providing theoretical guarantees that training points are stable points for certain arrangements of data (i.e., orthogonal data).\n- There have been recent studies into the relationship between memorization and generalization. This work suggests that generalization improves with the number of training points, but memorization persists (training points are still stable but we are less likely to converge to them). This is a fascinating contribution as it is often thought that memorisation implies a lack of generalization.\n- The theoretical results rely heavily on Zeno et al. (NeurIPS 2023) which provides an explicit form of the minimum MSE estimator for particular arrangements of data points. This is unfortunate, as extending this work to alternative arrangements than those considered would require also extending the work of Zeno et al. This point is also noted below in weaknesses.", "essential_references_not_discussed": "None that I am aware of.", "other_strengths_and_weaknesses": "Strengths:\n- The paper provides a rigorous analysis of the stable points of probability flow and the score flow, this contributes greatly to our understanding of where a diffusion process consisting of a sequence of denoisers converges to.\n- The results focus on the impact that training data has on the final convergence points of the diffusion process; effectively explaining what forms the new data produced by the diffusion process can take on.\n- The paper presents an interesting view that generalization in diffusion models is the result of having a larger proportion of stable points which are not the training data.\n- The stable point analysis is nice and relatively easy to follow. The diagrams help demonstrate what is happening.\n- Experiments align closely with the theory considered and help consolidate the conclusions.\n\nWeaknesses:\n- Analysis is restricted to the \"low-noise regime\", but this is not mentioned in the limitations section. Specifically, for every experiment the \"low-noise regime\" was supposedly enforced, but it is unclear how. Line 247 mentions 1/3 of the denoisers used are trained with this low-noise regime, but does not allude to how this might differ in practice. Are we guaranteed to have some denoisers in the \"low-noise regime\"?\n- Experiments stick to synthetic data which is orthogonal. Since diffusion models are often used on image data, some mention of how this applies or can be understood on image data would be useful.\n- The paper lacks discussion about the consequences of these results in a practical setting. The results may not precisely hold in such a setting, but what influence do they have? Do they provide intuition about the result of a diffusion process in general?\n- The theoretical results rely heavily on Zeno et al. (NeurIPS 2023). This is unfortunate, as extending this work to alternative arrangements of data than those considered would require also extending the work of Zeno et al.", "other_comments_or_suggestions": "- For the diagrams in Figure 3, if Virtual pts. were above Training pts., I think it would be easier to see that the generalization increases and that a larger percentage of samples converge to the virtual and boundary points.", "questions_for_authors": "1.  Do you have an intuition as to why we never converge inside the hyperbox? What would the data look like there? Is it not meaningful with respect to the training points?\n2.  What intuition can your results tell us about diffusion models used in practice? For example, what does the hyperbox look like for image data, can the results provide intuition about the images diffusion models converges to?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper was reviewed by the four experts in the field. The reviewers agreed that the paper has some important theoretical insights explaning mechanisms of how score and probability flow samplings work. While the problem setup is simple, more complicated theoretical setups could be less tractable. In particular, the authors proved that 
(1) score and probability flow samplings follow similar trajectories in case of orthogonal data, 
(2) probability flow can generate more non-trivial points on a manifold: this sampling can generate both training points and new points being sums of the training points. 

The paper proposes some theoretical insigts on mechanisms of memorization in diffusion models, although due to restrictive assumptions used in this paper the conclusions are less relevant to the general case of memorization/generalization in large scale diffusion models.

The reviewers did raise some valuable concerns that should be addressed in the final camera-ready version of the paper. The authors are encouraged to make the necessary changes to the best of their ability. All additional simulation experiments, provided by the authors during the rebuttal phase, should be included. 

Also, in the revised final version of the paper it is important to discuss
- orthogonal dataset choice and interpolation meaning (reviewers SMjF, mtjQ)
- Relaxation of Obtuse Angles, possibly including the theoretical derivation similar to the derivation from Zeno et al. (2023) (reviewer mtjQ)
- dropout effect on the hidden layers and Connection to Hopfield Models (reviewer urF4)
- Implications for Practical Image Diffusion Models (reviewer vy6L). I would propose to add some experiments confirming the claims, stated in the authors’ rebuttal to this reviewer.

 We congratulate the authors on the acceptance of their paper!
Decision: Accept (poster)