MemBench: Memorized Image Trigger Prompt Dataset for Diffusion Models
Authors: Chunsan Hong
Tae-Hyun Oh
Minhyuk Sung
Venue: Accepted by TMLR ()

Abstract: Diffusion models have achieved remarkable success in Text-to-Image generation tasks, leading to the development of many commercial models. However, recent studies have reported that diffusion models often repeatedly generate memorized images in train data when triggered by specific prompts, potentially raising social issues ranging from copyright to privacy concerns. To sidestep the memorization, recent studies have been conducted to develop memorization mitigation methods for diffusion models. Nevertheless, the lack of benchmarks hinders the assessment of the true effectiveness of these methods. In this work, we present MemBench, the first benchmark for evaluating image memorization mitigation methods. Our benchmark includes a large number of memorized image trigger prompts in various Text-to-Image diffusion models. Furthermore, in contrast to the prior work evaluating mitigation performance only on trigger prompts, we present metrics evaluating on both trigger prompts and general prompts, so that we can see whether mitigation methods address the memorization issue while maintaining performance for general prompts. Through our MemBench evaluation, we revealed that existing memorization mitigation methods notably degrade the overall performance of diffusion models and need to be further developed.

Published in Transactions on Machine Learning Research (06/2025)
MemBench: Memorized Image Trigger Prompt Dataset for Diffusion Models
Chunsan Hong
hoorer@kaist.ooc.
KAIST
School of Electrical Engineering
Tac-Hyun Oh
thoh, kaist. ac. for @graai com
KAIST
School of Computing
Minhyuk Sung
mhsung
KAIST
School of Computing
Reviewed on OpenReview:
https: //tp://ppppe openreview. net/ forum? o1700/000000000/0011111111111111
Abstract
Diffusion models have achieved remarkable success in Text-to-Image generation tasks, leading lo the development of many commercial models. However, recent studies have reported that diffusion models often repeatedly generate memorized images in train data when triggered by specific prompts, potentially raising social issues ranging from copyright to privacy concerns. sidestep the memorization, recent studies have been conducted to develop memorization mitigation methods for diffusion models. Nevertheless, the lack of benchmarks hinders the assessment of the true effectiveness of these methods. In this work, we present MemBench, the first benchmark for evaluating image memorization mitigation methods. Our benchmark includes a large number of memorized image trigger prompts in various text-to-Image diffusion models. Furthermore, in contrast to the prior work evaluating mitigation performance only on trigger prompts, we present metrics evaluating on both trigger prompts and general prompts, so that we can see whether mitigation methods address the memorization issue while maintaining performance for general prompts. Through our MemBench evaluation, we revealed that existing memorization mitigation methods notably degrade overall performance of diffusion models and need to be further developed. The code and datasets are available at
ccode code
1 Introduction
Text-to-lmage (T2I) generation has shown significant advancements and successes with the advance of diffusson models. Compared to previous generative models, text-conditional diffusion models excel in generating diverse and high quality images from user-desired text prompts, which has led to the vast. release of commercial models such as MidJourney. However, recent studies (Somepalli et al. 2023a by Carlini et al, 2023 have revealed that certain text prompts tend keep replicating images the train dataset which can cause private data leakage leading to potentially serious privacy issues. This issue has already triggered controversy in the real world: specific prompts containing the term "Afghan" have been known reproduce copyrighted images of the Afghan girl when using MidJourney (Wen et al. 2024b). One of the major issues with such prompts is that, regardless of initial random noise leveraged in the reverse process of the diffusion model, they
always invoke almost or exactly same memorized images (Wen et al. 2024b Carlini et al. 2023 Webster
2023
"Co-corresponding authors.

---

Published in Transactions on Machine Learning Research (06/2025)
To address this matter, Wen et al. 2024b) and Somepalli et al. (2023b) have proposed mitigation methods to prevent the regeneration of identical images in the train dataset invoked from certain text prompts. However, the evaluation of these memorization mitigation methods has lacked rigor and comprehensiveness due to the absence of benchmarks. As an adhoc assessment method, the current studies (Wen et al.) 2024b Somepalli et al. 2023b) have adopted the following workaround: 1) simulating memorization by fine-tuning T2l diffusion models for overfitting on a separate small and specific dataset of (image, prompt] pairs, and 2) assessing whether the images used in the fine-tuning are reproduced from the query prompts after applying mitigation methods. However, it remains unclear whether such results can be extended to practical scenarios with the existing large-scale pre-trained diffusion models and can represent the effectiveness for resolving memorization.
In this work, we present MemBench, the first benchmark for evaluating image memorization miligation methods for diffusion models. Our MemBench inchudes the following key features to ensure effective evaluation:
(1) MemBench provides 3,000, 1, 1,500, 309, and 1,352 memorized image trigger prompts for Stable Diffusion 1, 2, DecpFloydIF (Shonenkov et al. (023), and Realistic Vision (CivitAI 2023), respectively. In contrast, previous work (Webster 2023) only provided 325, 210, 162, and 354 prompls. By increasing the number of prompls, we enhance the reliability of the evaluation. (2) We take into account a general prompt scenario to assess the side- effects of mitigation methods, which has been overlooked in prior work. The prior mitigation methods (Wen)
et al. 2024b Ren et al.) 2024 Somepalli et al., 2023b) have been evaluated solely on memorized image trigger prompts, but has often exposed the side-effect of performance degrading. Ideally, the performance on general prompts should be maintained even after mitigation methods are deployed. (3) We suggest to use multiple metries. As previous mitigation works (Wen et al.) 2024b Somepalli et al. 2023b] have measured, MemBench includes SSCD (Pizzi et al. 2022), which measures the similarity between memorized and generated images, and CLIP Score (Hessel ct al. 2021), which measures Text-Image alignment. Additionally, MemBench involves Aesthetic Score (Schuhmann et al. 2022) to assess image quality, which has been overlooked by prior work and allows to penalize unuseful trivial solutions. (4) We propose the reference performance that mitigation methods should achieve to be considered effective. In previous works (Ren et al.) 2024 Wen et al. 2024b; Somepalli et al. 2023b), the effectiveness of mitigation methods has been demonstrated by measuring the decrease in SSCD and the exlent. to which the CLIP Score is maintained before and after applying the mitigation method. However, this does not necessarily confirm whether image memorization has been adequately mitigated. Therefore, we provide guidelines on the target values.
Benchmark Contributions. We observe several limitations of current mitigation methods by evaluating those in MemBench, which consists of large test. data, diverse metrios, and scenarios. We confirm that mitigation methods decrease Image alignment when applied to the image generation of trigger prompts. We found that even when accepting a significant sacrifice in Text-Image alignment and applying a mitigation method with very high strength, its SSCD value still fails to reach the reference performance we proposed. Furthermore, we reveal a new observation that these methods significant decrease Aesthetic Score, which highlights the generation of low-quality images. We clarify that while previous work (Ren et al. 2024) measured FID, FID does not effectively measure image quality. We also found that in addition to lower general quality, the variance in the quality of generated images increases. Tn the general prompt scenario, mitigation methods degrade generation performance, making practical application difficult.
Technical Contributions. Our additional contribution lies in offering an effective algorithm to search for memorized image trigger prompts. The absence of such benchmarks originates from the significant challenge of collecting prompts that induce memorized images. Existing searching methods (Carlini et al. 2023 Webster et al. 2023) require extensive computational resources, large system memory, and accoss to the diffusion model's 's training data to function. Furthermore, with the LAION dataset now private these methods have become unusable. In contrast, our proposed searching algorithm, based on Markov Chain Monte Carlo (MCMC), offers a more efficient approach to searching for problematic prompts directly within an open token space, without relying on any datasot. Notably, our method is currently the only available approach that can operate under these constraints.
Emperical Findings. We analyzed the memorized images found by our method and confirmed that these include commercial products that are actually being sold. Furthermore, we provide possible explanation for
http:://laion..s/nntee//lbiaa
2

---

Published in Transactions on Machine Learning Research (06/2025)
why diffusion models trained on LAION-5B, where image deduplication has been applied, still exhibit image memorixation: layout duplication.
2 Related Work
Memorization in Diffusion Models. Recently, diffusion models have been reported to replicate the images in the Irain dataset (Somepalli et al. 2023a Carlini el al., 2023). Empirically, previous works (Somepalli let al.
2023b Gu al. [023] attribute image memorization duplicated images in the training data. Biroli
ct al.
2024) thcorotically analyze the training dynamics of diffusion models and suggest that memorization
arises from transitions into feature-space fixed point regime.
Memorization Mitigation Methods. Memorization mitigation methods are divided into two categories: the inference time methods and the training time methods. The inference time methods aim to prevent the generation of images that are already memorized in pretrained diffusion models during the generation process. Somepalli et al. (2023b) propose a rule-basod text embedding augmentation to mitigate memorization. This includes adding Gaussian noise to text embeddings or inserting random tokens in the prompt. [Wen al. (2024b) propose loss that predicts if a prompt will induce a memorized image, and present mitigation strategy that applies adversarial attacks on this loss to modify the text embeddings of trigger prompts. Both of these works evaluate their methods by intentionally overfitting the diffusion model on specific small (image, text} pairs lo induce the memorization elfect, and then checking whether the images are regenerated from the corresponding prompts when their methods are applied. Ren et al. (2024) analyze the impact of trigger prompts on the cross-attention layer of diffusion models and propose a corresponding mitigation method.
Train time methods aim to prevent diffusion models from memorizing training data during model training by employing specific training techniques. Although several methods (Daras et al. 2024 Liu et al.) 2024 have been proposed, experiments have been conducted only on small models and datasets such as CIFAR-10 and CelebHQ. While some experiments (Ren et al. 2024 Wen et al. 2024b) have been conducted on large models such as Stable Diffusion, they only assess whether the fine-tuning dataset is memorized when fine-tuning the model. To date, no train time mitigation method has been tested by training large-scale diffusion models from scratch to evaluate its effectiveness.
In this work, we focus on the inference time methods, considering the practical scenarios of utilizing existing large-scale pre-trained diffusion models, such Stable Diffusion. To effectively evaluate these methods, we introduce MemBenchh which provides sufficient test data and appropriate metrics for comprehensive assessment.
Training Data Extraction Attack. Our MemBench is constructed by our proposed computational method that shares a similar vein with the following atlack methods. Carlini et al. (2023) propose a method to search for memorized image trigger prompts in Stable Diffusion. In the pre rrepprccssiing stage, they embed the entire training set of Stable Diffusion into the CLIP (Radford et al. 2021 feature space and cluster these embeddings to identify the most repeated images. In the post-processing stage, Stable Diffusion is used to generate 500 images for each prompt corresponding to these clustered images. The similarity among these 500 generated images is measured, and only those prompts that produce highly similar images are sampled. Finally, image retricval is performed on the training data using generated images from these selected prompts to verily if the generated images match the training data images. The pre-processing involves CLIIP embedding and clustering of 160M images, while the post-processing involves generating 175M images, í.e., compulationally demanding. Websste (2023) propose an advanced searching algorithm. In the pre-processing stage, encoder is trained to compress CLIP embeddings. Then, 2B CLIP embeddings are compressed and clustered using KNN (Webster et al. 2023). In the post-processing stage, Webster introduces an effective method that performs& a few inferences of the diffusion model to predict whether a prompt will induce memorized images. This method is applied to 20M prompts acquired from the pre-processing stage.
Both methods share common bottlenecks: they are memory inefficient and require extremely high computa- tional costs. Moreover, the most fundamental problem is their reliance on training data as candidate trigger prompts. With LAION becoming inaccessibled, these hods can no longer be reproducible and utilized.
3

---

Published in Transactions on Machine Learning Research (06/2025)
However, our method can search more for trigger prompts efficiently than those methods even without any pre-processing steps and any dataset.
In another line of research, Chen et al. (2024) propose & method for extracting training data from unconditional
diffusion models. In contrast, several studies Somepalli et al. 2023b Gu et al. 2023) indicate that conditioning
plays a critical role memorization, with unconditional models being less susceptible it. Furthermore, since T21 diffusson models are the ones widely applied in real-world scenarios, our work focuses on constructing memorization benchmark for T2I diffusion models.
Since the only existing dataset that can be used for evaluating mitigation methods is the small dataset released by Webster (2023), Ren et al. (2024) evaluate their method on the Webster dataset, while it is not originally purposed as a benchmark dalaset. The dataset is constructed by the training data extraction attack method proposed by Webster, which is not scalable; thus, the dataset remains a small scale. Also, Ren et al. did not measure the loss of semantic prescrvation after mitigation, which is an important criterion but overlooked. Our benchmark is the first benchmark for evaluating those miligation methods with carefully designed metrics and sufficient test data.
Benchmark Dataset.
3 Searching Memorized Image Trigger Prompt with MCMC
We present our proposed scalable computational method to construct our MemBench dataset. Given a pre-trained diffusion model, we computationally search memorized image trigger text prompt. In this section, we first brief the preliminaries, formulate the search as an optimization problem, and propose a Markov Chain Monte Carlo algorithm.
3.1 Preliminary
Diffusion Models. Denoising Diffusion Probabilistic Model (DDPM) (Ho et al. 2020 is representative
diffusion model designed to approximate the real data distribution ((x) with model (x)).. For each (x),, DDPM constructs a discrete Markov chain (Xo. xi....; Xr) that satisfies ((xx(xx-1) N(x;; v1 1, I.T. This is referred to as the forward process, where { is sequence of positive noise scales. Conversely, the reverse process generates images according to Po ( 1xx, = (o t), Ex(,,, t)). DDPM starts by sampling xy from a Gaussian distribution, and then undergoes a stochastic reverse process to generate the sample Xo, f.e. an image. With a parametrized denoising network cø, this generation process can be expressed as:
x
you Xx
(x(: + o,w, vI-a.
I-as
(1)
where or - Br, ā. II at, 0, can be vB V م B,, and w (O;11). The equations may vary depending on hyper-parameter choices and the numerical solver used (Song et al. 2021a
Classifier Free Guidance (CFG). In T2I diffusson models such as Stable Diffusion (Rombach al., 2022), CFG (Ho & Salimans 2022) commonly employed to generate images better aligned with the desired prompt. Given text prompt p and the text encoder f(.) of the pre-trained CLIP (Radford et al. 2021 predicted noise is replaced follows:
é0.r p) () (x f(0), + (ea(x, f(p). ((),
where 0 denotes the empty string, and s the guidance scale.
Image Memorization and Similarity Measurement Score. We follow the definition of image memorization suggested by Carlini et al. (2023):
Definition 1 (r-Image Memorization) Given a train set Divain = ((Xtrain,ss P(rain.))).. 1 a generated image x from a difffusion model co trained on Dtrain, and a similority measurement score p, image memo- rization of is defined as: M, Derain) Xtrain E Derain s.t, p(x, Xtrain) 7].
(3)
4

---

Published in Transactions on Machine Learning Research (06/2025)
where is a threshold, I is indicator function, and M(-) indicates whether the image is memorized.
As in prior works (Wen et al. 2024b Ren et al. 2024 Somepalli et al. 2023b), we utilize SSCD (Pizzi et al. 2022) score as a similarity measurement score, p. SSCD model designed identify copied or manipulated images by learning robust image representations through self-supervised learning. SSCD score is defined as the cosine similarity between the features extracted from two images using the SSCD model. The model ensures effective image copy detection across diverse scenarios, such as cropping or filtering.
Memorized Image Trigger Prompt Prediction. Wen et al. (0024b) proposed an efficient method to predict whether a prompt will generate an image included in the training data. The prior works found that prompts inducing memorized images do so regardless of the initial noise, xr (Carlini al.) 2023 Webster 2023), l.e., repeatedly generating the same almost identical images despite different Xy. To quickly identify this case, Wen et al. (0024b) propose measure to predict whether a prompt will induce a memorized image
using only the first step of the diffusion model, without generating the image. This measure, referred to as
dg, is formulated as follows:
dp = Wop.lllllll ((p) - ((0), [)
(4)
In this context, the larger Do(p), the higher the probability that the image generated by the prompt is included in the training data. Denoting image x generated from diffusion model Ep with prompl p x(Eo. P), we re-purpose it by expressing as (p) x E[M(((Ee.P)) P). Dtrain),, where we omit t for simplicity. To validate the effectiveness of detecting whether a prompt is memorized image trigger prompt, Wen et al. construct a dataset containing memorized prompts provided by Webster (0233 and non-memorized prompts from LATON (Schuhmann et al. 2022). COCO (Lin et al. 2014), lexica.art (Santana 2022) and randomly generated strings. The reported area under the curve (AUC) of the receiver operating characteristic (ROC) curve 0.960 and 0.990 when the number of initial noises is 1 and 4, respectively.
3.2 Memorization Trigger Prompt Searching as Optimization Problem
Our objective is to construct a memorized image trigger prompts dataset and verify corresponding memorized images, f.e. to construct Dinm {p| E[M(((ce.))) Dirain)) )] > K.P T) where is the threshold and T is space of all possible prompts. As mentioned in Section 2 the prior works (Carlini et al. 2023 Webster
2023) utilized Derain to search for candidate prompts that could become D They then generated images from these candidate prompts and conducted image retrieval to find memorized images within Derain which is expensive. Moreover, since the training dataset, LAION, is no longer accessible, this approach becomes infeasible. Thus, we approach the problem from different perspective. We search for candidate prompts that could become Pem without using Ptrain. Then, we generate images from these candidate prompts and use a Reverse Image Search A to find images on the web akin generated ones by regarding the web the training set. Finally, we perform a human verification process.
Given that do(p) x E[M(x(E0. p), Dlr constructing D can be conceptualized as an optimization problem where we treat the prompt space as a reparamet space and aim to find prompts yielding high de(p), To formulate the optimization problem, we define the prompt space. Given a finite set W containing all possible words (tokens), where [W]= = m, we model a sentence p with n words as an ordered tuple drawn from the Cartesian product of W, represented as P W" To solve the optimization problem, we treat d- negative energy function and model the target. Boltzmann distribution æ such that higher values of do correspond to higher probabilities as
Ao(Pi/K
(p)
where = =pEE (p() is a regularizer and K is a temperature constant. By sampling from modeled target distribution T(p) in a discrete, finite, multivariate, and non-differentiable space P, we can obtain prompts that maximize do(p), which are likely to be memorized image trigger prompts.
httpps//ttineee.cmm
5

---

Published in Transactions on Machine Learning Research (06/2025)
3.3 Constructing MCMC by Leveraging dg
To lackle the aforementioned challenging optimization problem, we propose to use Markov Chain Monte Carlo (MCMC) (Hastings) 1970) to sample from the target distribution T()). This method allows us to efficiently explore the discrete prompt space and find prompts likely to induce memorized images, effectively navigating P to identify optimal prompts. From any arbitrary distribution of sentence, To, Markov Chain with transition matrix can be developed as follows:
T++1 T.
(6)
It is well known that Markov Chains satisfying irreducibility and aperiodicity converge to certain distribution x² (Robert et al., 1999), which can be formulated as nn Tm TT" independent of Tu- The transition matrix can vary depending on the algorithm used to solve the MCMC. By carefully choosing the sampling algorithm, we can ensure that the final distribution n² reached by the transition matrix converges to desired target distribution æ (Robert et al., 1999 Geman & Geman 1984 Hastings 1970.. Considering the multi- dimensional nature of our parameter space, we employ the Gibbs sampling algorithm (Geman & Geman 1984) for simplicity. Gibbs sampling is an MCMC sampling algorithm method where, at each step, only one coordinate of the multi-dimensional variable is updated to transition from the current state to the next state. Gibbs sampling algorithm has proven the convergence of the transition matrix and is known for fast convergence in multi-dimensional problems (Johnson et al.) 2013 Terenin et al. 2020; Papaspiliopoulos & Roberts 2008). We adopt random scan Gibbs sampling, which involves randomly selecting an index and updating the value at that index. This process can be expressed as the sum of n transition matrices, as follows:
T Σn >
1 Tr
(7)
π (pF (
p2L else,
5+1 p²
pl -pt+1
(8)
where p-; = {Pi, .2.... Pi-1, ... } and p is a j-th state prompt. Integrating Equation into the above formulas, the final transition matrix is obtained as follows:
" "P(P. 1 P_
if
p" i-1
pl pp-1
Ewer do17
else,
where detailed derivation is provided in Appendix B Since it is impractical to compute do(.) for all w E W, we approximate W as top Q samples obtained from BERT (Devlin et al., 2018). This means that the i-th clement of the prompt is masked and BERT is used to predict the word, from which the top Q samples are selected as candidate words. Additionally, this approximation can induce the generated prompts to be more semantically fluent. Mathematical derivation is complex, but the algorithm is straightforward: the process iteratively 1) selects and replace a word into [MASK] token from the sentence, 2) predicts top Q words via BERT and computes proposal distribution, and 3) replaces it according to the proposal distribution. Please refer to Algorithm for details.
3.4 Dataset Construction by Leveraging MCMC
We conduct dataset construction in two stages: 1) using a masked sentence as the prior and employing MCMC to find memorized image trigger prompts, and 2) using the memorized image trigger prompts as the prior for augmentation through MCMC.
This stage aims to discover new memorized images. The sentence is initialized with sentence of length n [MASK] token, í.e. Po = [MASK), [MASK],
Using Masked Sentence as Prior.
[MASK]]. We then employ Algorithm [ initialized with Po to obtain the candidate prompt. Similar to the conventional approach CCalini et al. 2023) to extract train images, we then generate 100 images for this prompt and
leverage DBSCAN (Ester al. 1996) clustering algorithm with SSCD (Pizzi et al. 2022 to extract images

---

Published in Transactions on Machine Learning Research (06/2025)
Algorithm Memorized Image Trigger Prompt Searching via Gibbs sampling
Input: Diffusion model 0, BERT model Φ, imitial sentence pd with length n, iteration number N, number of proposal words Q, termination threshold K, hyperparameter K, 7, {f1,...,fn)
p" + p"
3: while do(p") < do for j = 0 to N do
4:
5:
Randomly select index E (1....,n) n. We f arg topo Pw p²,))
6:
p(p!*1 Ip_x) t P
7:
Emewa
No
1/
pft + Sample from p(p ++1 p².))
8:
p pit + (2 P p4
9:
10: end for
11: p" c arg pa dp(p)
12: end while
13: return p'
Table 1: Comparison of the number of memorized images and trigger prompts in each dataset. Our dataset is significantly larger in terms of the number of trigger prompts across all models. Please note that images sharing the samne layout, as shown in Figure have been counted as single image.
Stable Diffusion 1
Stable Diffuusio 2
DeepFloydIF
Realistic Vision
Trigger Prompt #
Mem. Image #
Trigger Prompt
Mem. Image #
Trigger Prompt #
Mem. Image #
Trigger Prompt #
Mem. Image #
Webster (2023
325 3000
111
210
25
162
17
354
119
MemHench
151
1500
309
51
1352
148
forming least 20 nodes. Those images are employed to Reverse Image Search API to find train image sources and human verification is conducted.
Using Found Trigger Prompts as Prior. This stage aims to augment memorized image trigger prompts. We leverage the prompts found in the previous stage or those provided by Webster (2023) as the prior, To- In this process, we employ a slightly modified algorithm to enhance diversity. Instead running a single chain for one prompt, we run n separate chains for each word position in an n-length sentence, treating each position as the first updating index in Gibbs sampling. This method ensures varied exploration of the prompt space. We then save the top 100 prompts with the highest de(-). We retained all prompts generated during the MCMC sampling process and then selected 20 augmented prompts per original prompt, considering diversity. The detailed process is provided in Appendix C
4 Dataset Statistics and Efficiency of the Proposed Algorithm
4.1 Dataset Statistics
Table [ presents the mumber of memorized images and trigger prompts obtained using the methodology described in Section 3 For both Stable Diffusion 1 and 2, the number of prompts has increased more than fivefold for each model and more than 9 times in total compared to those reported by Webster (2023). The number of memorized images included in the dataset has also increased, with Stable Diflusion 2 showing an increase of over twofold. Additionally, we provide memorized images and trigger prompts for DecpFloydIF (Shonenkov al.) 2023). which has cascaded structure, and Realistic Vision (CivitAT 2023). an open-source diffusion model. For these two models, we provide larger number of memorized images and trigger prompts than Webster et al. We have also applied our algorithm to the more recent. model, Stable
7

---

concentrated in Published in Transactions on Machine Learning Research (06/2025)
Commercial
Product
Human
prompe
48
Artwork
Etc.
03
82
2.4
2.
0.
Moan
(a) Data Component Visualization
(b) SSCD Histogram
Figure 1: (a) Components of memorized images in Stable Diffusion 1. (b) A histogram of SSCD values for the trigger prompts discovered by Webster (0023) and those in MemBench. For each trigger prompt, images were generated, and the SSCD values were measured against the memorized image and then averaged. Using these averaged SSCD values, we constructed histogram with SSCD bins for all trigger prompts from Webster 2023 and performed the same procedure for trigger prompts. As shown, the mean SSCD values of our trigger prompts are significantly more diverse, whereas those from Webster (0023 the higher SSCD range.
Table 2: Comparison of the efficiency of our method and other prompt space optimization methods. Experiment was done on 1 A100 GPU. s_" denotes the failure of the valid search.
Greedy Search
ZeroCap
PEZ
ConZIC
Ours
Hlous/Meeorrte Image
5.7
3.81
2.08
Diffusion [Esse al. 2024). Please refer to Appendix F. for the results. The composition of the images included in MemBennc is shown in Figure Ia] illustrating that the memorized images encompass substantial number of commercial product images and human images. Specifically, commercial products include phone cases, furniture, clothing, and baggage; artwork includes cartoons and brand logos; and human-related images include radio albums, actors, bands, movie posters, and soccer players. Please refer to Appendix C.3 for the data component of other models.
Furthermore, observe that the degree of memorization in the trigger prompts found by Webster 2023 E[M(x(co. p), Drrain)), is excessively high. This presents drawback for their direct use as benchmarks, they consist only of prompts that are particularly difficult for miligation methods to handle. As result, when mitigation methods are applied with limited strength, their effectiveness may not be clearly observed, making comparisons between diffcrent approaches more challenging. This problem ariscs because the prompts are taken directly from the training of diffusion models. In contrast, our method searches trigger prompts through MCMC sampling in an open prompt space, allowing us to obtain a much broader range of memorization levels. We validate this by measuring the SSCD values of images generated by trigger prompts and visualizing them in histogram, as shown in Fig. 1b
4.2 Efficacy of Memorized Image Trigger Prompt Searching
In this section, we validate the efficiency our method in discovering memorized images without access to Dtrain- The task of finding memorized image trigger prompts without Dtrain is defined as follows: without any prior information, the method must automatically find trigger prompts that induce memorized images. This involves: 1) selecting candidate prompts, 2) generating 100 images for each candidate prompt, 3) applying DBSCAN (Ester et al. 1996) clustering with SSCD to get candidate images and using a Reverse Image Search API to verify those images' presence on the web. To the best of our knowledge, this task is novel, so we provide naive baselines. As the first baseline, we perform greedy search by measuring D, for all prompts in the prompt dataset and selecting the top 200 prompts as candidate prompts. For the prompt dataset, we leveraged DiffusionDB, which contains 13M prompts collected from diffusion model users. Additionally, we provide three other basclines, all of which are algorithms that solve optimization problems in the prompt space. For two of these baselines, we adapt ZeroCap TTeeel et al. 2022) and ConZIC (Zeng et. al. 2023
8

---

Published in Transactions on Machine Learning Research (06/2025)
Vo Pimits
No Limits
Shin Pinits
Business Worria
Business Woman
Business Womrn
(a) Images in LAION
(b) Stable Diffusion Generated
(c) Mitigation Applied
Figure 2: The necessity of measuring the Aesthetic score. Images generated with the mitigation method applied are not desirable but achieve a low SSCD while maintaining a high CLIP Score. The trigger prompts used to generate the images were: "the no limits business woman podcast", "wall view 003", and "united states throw blanket", respectively.
methods designed to maximize the CLIP Score for zero-shot image captioning, by replacing their objective function with Dg. Similarly, we also adapt PEZ (Wen et al. 2024a) by substituting its objective function with Dg to serve as another baseline. For each of these three methods, we conducted 200 iterations and obtained prompts. For our method, we performed 200 MCMC runs with 150 iterations cach, and selected the resulting prompls as candidate prompts. For more detailed implementation, please refer to Appendix G
The results are shown in Table 2 Our method significantly outperforms other methods. The results in Table 2 demonstrate that our method significantly outperforms others. To generate 200 candidate prompts, ZeroCap and PEZ required 44 and 33 hours, respectively, on an A100 GPU but failed to identify any memorized image trigger prompts. ZeroCap's sequential prediction hindered the prompt being optimized to have higher Da values than general prompts. For PEZ, we observed that the prompts were optimized to produce images with a specific color (e.g., sunflower fields, grassy fields), and the prompts themselves were very unnatural. ConZIC identified 6 memorized images in 24 hours but struggled with local minima and lacked diversity its optimization process, resulting in lower efficiency compared to our method.
Comparing with baselines (Carlini et al. 2023 Webster 2023 that leverage LAION itself is challenging,
the dataset is no longer available and the elements for reimplementation are omitted in the corresponding papers. However, as mentioned in Section 2 their memory-inefficien and computationally intensive methods provided only a few memorized images and trigger prompts.
5 MemBench: Metrics, Scenarios and Reference Performance
Metrics. We present rigorous metrics for correctly evaluating mitigation methods, which include similarity score, Text-Image alignment score, and quality score. Following previous works, we adopt SSCD (Pizzi et al. 2022 as the similarity score and measure max SSCD between a generated image using trigger prompt and memorized images. In detail, a prompt p' triggers images {xi,..., included in Dtrains we measure maaxxe(xi....> SSCD(x(P" x). Secondly, we adopt CLIP Score (Hessel al. 2021) measure Text- Image aligmment between prompt and generated images. Lastly, We adopt an Aesthetic Score (Schuhmann et al. 2022) the image quality score. While previous works (Wen et al. 2024b Somepalli et al.) 2023b) did not assess image quality scores, we observed issues shown in Figure 2 When memorization mitigation methods are applied, we observe that image quality degrades, the rich context generated by the diffusion model is destroyed, or distorted images are formed. While Ren et al. (0024) measured FID, they reported that FID docreases when mitigation mothods are applied. They attribute this phenomenon to the mitigation method preventing memorized images from being generated, thereby increasing the diversity of generated images. As a result, compared FID which focuses on diversity, Aesthetic Score offers more straighttfrward way to evaluate individual image quality and highlight image quality degradation issues.
Sccnarios. To ensure that memorization mitigation methods can be generally applied to diffusion models, we provide wwo scenarios: the memorized image trigger prompl scenario and the general prompt scenario. First, the memorized image trigger prompt scenario evaluates whether mitigation methods can effectively prevent the generation of memorized images. This scenario uses the memorized image trigger prompts we identified in Section 3 We generate 10 images for each trigger prompt and measure the Top-1 SSCD and the mean values of the Top-3 SSCD. We also measure the proportion of images with SSCD exceeding 0.5.
9

---

Published in Transactions on Machine Learning Research (06/2025)
Rea Rog Hoadlrd
(b)
(d)
Figure 3: Examples of memorized images found using the Reverse Image Search API. (a), (c) Shirt/rug
currently sold commercially, (b), (d) four images generated by Stable Diffusioon
Figure 4: Results of images found by leveraging Reverse Image Search API to the images generated from trigger prompts. While prior works (Carlini et al. 2023 Webster 2023) have attributed memorization in dilfusion models to image repetition, this does not explain why memorization still occurs in LAION-5B, where image deduplication has been applied. We suggest that layout duplication shown the figure may account for such remaining cases of memorization.
For CLIIP Score and Aesthetic Score, we calculate the average value across all generated images. Second, the general prompt scenario ensures that the performance of the diffusion model does not degrade when using prompts other than trigger prompts. We leverage the COCO (Lin al.] 2014)) validation set as general prompts. In this scenario, images generated once per prompt, and the average CLIP Score and Aesthetic Score are measured.
Reference Performance. We propose a reference performance for interpreting the performance of mitigation methods. An effective mitigation method should be able to reduce SSCD while maintaining CLIP Score. However, although SSCD is a metric designed to compare the structural similarity of images for copy detection tasks, it inevitably includes semantic meaning due to the self-supervised nature of the trained neural network. On the other hand, the semantic meaning of the trigger prompt should still be reflected in the generated image to maintain CLIP Score even when miligation method is applied. Therefore, it is uncertain how much the SSCD between memorized images and generated images can be reduced while maintaining the CLIP Score between trigger prompts and generated images. In this regard, we provide a reference performance to indicate how much SSCD can be reduced while maintaining a high CLIP Score. We assume querying images with trigger prompts via the Google Image AP as a strong proxy model for the generative model and provide the reference performance. Please refer to Appendix D for details.
6 Deeper Analysis into Image Memorization
In this section, we provide deeper analysis of the memorized images and trigger prompts in MemBench Firstly, we have found that Stable Diffusion regenerates commercial products currently on sale. While prior works (Carlini et al. 2023 Somepalli et al.) 2023a have suggested the possibility that diffusson models could memorize commercial images, we are the first to confirm this. Unlike the previous studies that
used image retrieval from LATON to find memorized images (Carlini et al.) 2023 Webster 2023 we leverage
Reverse Image Search API to find those, which enable us this verification. As shown in Figure 3 b, Stable
httpp:///aeveloarrrgggglll com
10

---

Published in Transactions on Machine Learning Research (06/2025)
Table 3: Performance evaluation of image memorization mitigation methods in MemBench. n, I and c are hyperparameters that control the strength of their corresponding mitigation methods. Please refer Appendix G.3 for the details of syper-parameters.
MemBench
COCO
Hyper-parana Tog-1 8SCD J Tep-3 SSCD
SSCD D.
CLPP
Aesth.
Aosth. str..
CLIP 1
Ansth. 1
Ansth, std.
Base Reference Performance
0.641
0.605
0.451
0.273
5.25
0.43
0.321
5.37
0.36
0.088
0.310
0.479
0.425
0.241
0.270
5.18
0.53
0.314
5.34
(1.3
RNA Somepall 202ab
0.338
0.165
0.270
5:14
0.55
0.329
0.20 1.200
0.121
0.267
5.13
0.56
0.307
5.30
0.37
0:267
0.230
0.089
0.254
5.10
0.58
0.304
6.29
0.39
0.213
0.074
0.202
5.08
0.30
0.302
5.28
0.39
0.228
0,189
0.055
0.258
5,06
0.30
0.296
5.24
01.3
0.497
0.245
0.380
5.20
0.52
5.34
RIA Soneppali et sl.
20236
0.397
0.347
0.175
0,268
5.19
0.53
0,314
5.32
0.35
0.330
0.285
0.129
0. 0.256
5.17
0.54
0.310
5.29
0.96
0.282
0.240
0.004
0.294
5.15
0.55
0.306
6.27
0.37
0.257
0.217
0,080
0.262
5.14
0.53
0.300
5.26
0.57
0.228
0.056
0.56
7
0.410
0.346
0.134
0,270
5,18
0.54
0.321
5.37
0.36
Wen et
6
0.355
0.289
0.089
0:270
5.15
0.55
0.321
5:37
0.55
0.009
0.209
5.14
0.259
0,199
0.035
0.268
5.13
0.57
0.321
5.37
0.35
0.181
0,
0.015
0.264
5.11
0.39
0.321
6:37
0.36
0.096
0.075
0.001
0,242
4.97
0.64
0.321
5.37
0.38
1.0
0.289
0.247
0.083
0.263
5.17
0.57
0.316
5.33
0.38
2014
0.071
0.290
5.17
0.57
5.31
1.2
0.278
0.232
0.058
0:257
5.15
0.58
0.309
6.98
0.39
0.275
0.227
0.050
0.254
5.14
0.58
0.304
Diffusion replicates images of commercially available shirts when given specific prompt. Figure 3 further illustrates the replication of layouts; for a commercially sold carpet, all layouts have been reproduced.
Secondly, we explore the cause of image memorization in Stable Diffusion 2, trained on LAION-5B, whose duplicates are removed. Previous works (Somepalli et al.) 2023b Gu et al. 2023) suggested that image memorization issues arisc from duplicate images in the training data. Webster et al. (2023 confirmed that the LAION-2B dataset contains many duplicate images likely to be memorized. However, Stable Diffusion 2 still exhibits image memorization issues while reduced. We hypothesize that this memorization arises due to layout duplication. Figure 4 shows the images found by Reverse Image Search API that are memorized by Stable Diffusion. We found that there are often over 100 images on the web with the same layout but different color structures. LATON-5B underwent deduplication based on URL but this process may not, have removed these images. These layout memorizations are also obviously subject copyright, posing potential social issues. Additional examples provided in Appendix H
7 Evaluation of Image Memorization Mitigation Methods
In this section, we evaluate image memorization mitigation methods on our MemBench in Stable Diffusion For results of Stable Diffusion 2, please refer to Appendix
Baselines. We use Stable Diffusion 1.4 as the base model. The image memorization mitigation methods evaluated include: 1) RTA (Somepalli et al.) (023b), which applies random token insertion to the prompt, 2) RNA (Somepalli et al. 2023b), which inserts a random number between [o, 10 into the prompt, 3) method
proposed by Wen et al. (2024b) that applies adversarial attacks to text embeddings, and 4) method proposed by Ren et al. (2024) that rescales cross-attention. Image generation is performed using the DDIM (Song
et al.
2021a Scheduler with a guidance scale of 7.5 and 50 inference steps.
Results. We present the experimental results in Table 3 As shown in Table 3 for all methods, lowering the SSCD significantly reduces both the CLIP Score and the Aesthetic Score. This indicates a degradation in text-image alignment and image quality. In particular, upon examining images with low Aesthetic Scores, we observe that issues in Figure? occur across all methods. Moreover, when peramesss are set as high
httt:::/haiion.a/bbbg/aaaa
11

---

Published in Transactions on Machine Learning Research (06/2025)
values for mitigation methods, it leads not only to lower Aesthetic Score but also to much larger standard deviation. This indicates that diffusion model outputs become unreliable. Please refer to Appendix F.] for the FID values. As reported by WWen et al. (2024b), all methods exhibit a trade-off between SSCD and CLIP Score. Regarding the reference performance obtained via API scarch, it can be observed that the SSCD can be reduced to 0.088 while maintaining a high CLIP Score. Due to the inherent limitations of the Stable Diffusion baseline model, the CLIP Score cannot exceed 0.273 when mitigation methods are appliod. However, mitigation methods should aim to reduce the Top-1 SSCD to around 0.088 while maintaining at least this level of CLIP Score.
To provide more detailed analysis of cach method, we observe that the approach proposed by Wen et al. achieves the best performance in the trade-off between SSCD and CLIP Score. However, to reduce the proportion of images with SSCD exceeding indiiiivee of image memorization to nearly zero, their method still requires a reduction in CLIP Score by 0.025. Given the scale of the CLIP Score, this drop suggests that the generated images may be only marginally related to the given prompts. Morcover, a significant decrease in the Aesthetic Score is also observed. On the other hand, the method proposed by Wen et al. has additional advantage: it does not result in any performance drop in the general prompt scenario on the COCO dataset, making it the most suitable option for practical applications as of now.
The most recent method proposed by Ren et al. (2024) shows a considerable reduction in the CLIP Score. Even at the lowest hyper-parameter setting (c = 1.0), the reductions in both CLIP Score and Aesthetic Score are substantial, limiting its general applicability to diffusion models. The most basic approaches, RNA and RIA, show a decrease in CLIP Score by 0.015 at the hyper-paramets setting (n 6) that lowers the proportion of images with SSCD exceeding 0.5 to 0.05. This is expected, given the nature of these methods: both attempt to prevent image memorization by adding irrelevant tokens to the prompts. As result, RNA and RTA are unreliable for application to diffusion models.
8 Conclusion
We have presented MemBench, the first benchmark for evaluating image memorization mitigation methods in diffusion models. MemBench includes various memorized image trigger prompts, appropriate metrics, and a practical scenario to ensure that mitigation methods can be effectively applied in practice. We have provided the reference performance that mitigation methods should aim to achieve. Through MemBench, we have confirmed that existing image memorization mitigation methods are still insufficient for application to diffusion models in practical scenarios. The lack of a benchmark may have previously hindered the research of effective miligation methods. However, we believe that our benchmark will facilitate significant vanceements in this field.
Limitations and Future Work. Another contributtio of our work is providing an algorithm for efficiently scarching memorized image trigger prompts based on MCMC. Our approach is faster than other scarching algorithms we have tried, yet it does not exhibit exceptionally high speed. Consequently, due to time constraints, we were unable to provide a larger number of memorized images. However, our method allows for the contimuous search of more memorized images and their corresponding trigger prompts, and we plan to update the dataset regularly. Additionally, we aim to enhance the efficiency our memorized image trigger prompt searching algorithm in the future.
Acknowledgments
The work was supported by GPU resources provided by Artificial Intelligence Industry Cluster (AICA). T.-H. Oh is partially supported by Institute of Information & communications Technology Planning & Evaluation (ITPP) grant funded by the Korea government Research Lab Project;
(No. RSS2024-004558822 National AI Development of Artificial Intelligence Technology for Self- Improving Competency-Aware Learning Capabilities). M. Sung was partially supported by the NRF grant RRS-2023-00209723) and ITTP grants (RS-2022-II20055 RS- 00220222, RS-2024-00380 00399817). all funded by the Korean government (MSIT).
12

---

Published in Transactions on Machine Learning Research (06/2025)
References
Giulio Biroli, Tony Bonnaire, Valentin de Bortoli, and Mare Mézard. Dynamical regimes of diffusion models. Nature Commonmiaations, 15(1), November 2024. ISSN 2041-1723. doi: 10.1088/411.67-024444883333 URL
http://dx.co www.:o............ 0011:/70..108//41444-444-4-5-300
Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), 2023.
Yunhao Chen, Xingjun Ma, Difan Zou, and Yu-Gang Jiang, Extracting training data from unconditional diffusion models. arxiv preprint arXiv:2406. 12752, 2024.
CivitAL CivitAl 2023.
Giannis Daras, Kulin Shah, Yuval Dagan, Aravind Gollakota, Alex Dimakis, and Adam Klivans. Ambient. diffusion: Learning clean distributions from corrupted data. In Advances in Neural Information Processing Systems (NewrIPS), 2024.
Jacob Devlin, Ming- Wei Chang, Kenton Lec, and Kristina Toutanova. Bert: Pro-training of deep bidirectional transformers for language understanding, orXiv preprint arXiv:1810.04880 04805, 2018.
Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, Dustin Podell, Tim Dockhorn, Zion English, Kyle Lacey, Alex Goodwin, Yannik Marek, and Robin Rombach. Scaling rectified flow transformers for high-resolution image synthesis. arXiv preprint arXiv:2403. 08206, 2024.
Martin Ester, Htas-PPter Kriegel, Jörg Sander, Xiaowei Xu, et al. density-based algorithm for discovering clusters large spatial databases with noise. In Proceedings of the 2nd International Conference on Knowledge Discovery and Data Mining (KDD), 1996.
Stuart Geman and Donald Geman Stochastic relaxation, gibbs distributions, and the bayesian restoration of images. IEEE Transactions on Pattern Analysis and Machine Intelligence (TPAMI), (6):721-741, 1984.
Xiangming Gu, Chao Du, Tianyu Pang, Chongxuan Li, Min Lin, and Ye Wang. On memorization in diffussion models. arXiv preprint arXiv:2310.00 0.00666, 2023.
W. K. Hastings. Monte carlo sampling methods using markov chains and their applications. Biometrika, 57 (1):97 109, 1970.
Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. CLIPScore: a reference-free evaluation metric for image captioning. In Conference on Empirical Methods in Notural Language Processing (EMNLP), 2021.
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv preprint vrXim:2207.12595 2022.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
Alicia A. Johnson, Galin L. Jones, and Ronald C. Neath. Component-wise markov chain monte carlo: Uniform and geometric ergodicity under mixing and composition. Statistical Science, 28(3):360-373 2013.
Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft. coco: Common objects in context. Tn Computer Vision-ECCH 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740 755. Springer, 2014.
Xiao Liu, Xiaoliu Guan, Yu Wu, and Jiaxu Miao. Iterative ensemble training with anti graddgrrdenttttct control for mitigating memorization in diffusion models. arXio preprint arXi::2407.1555 15328, 2024.
13

---

Published in Transactions on Machine Learning Research (06/2025)
Omiros Papaspiliopoulos and Gareth O. Roberts. Stability of the gibbs sampler for bayesian hierarchical models. The Annals of Statistics, 36(1):95- 117, 2008.
Ed Pizzi, Sreya Dutta Roy, Sugosh Nagavara Ravindra, Priya Goyal, and Matthijs Douze. A self-supervised descriptor for image copy detection. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pullern Recognition, pp. 14532 14542, 2022.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference Machine Learning (ICML), 2021.
Jie Ren, Yaxin Li, Shenglai Zen, Han Xu, Lingjuan Lyu, Yue Xing, and Jiliang Tang. Unveiling and mitigating memorization in text-lo-image diffusion models through cross attention. arXiv preprinl arviv22403. 11052, 2024.
Christian P Robert, George Casella, and George Casella. Monte Carlo statistical methods, volume Springer, 1999.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In IEEE Conference Computer Vision and Pattern Recognition (CVPR), 2022.
Gustavo Santana. Guudaweett//sabbeedddfssooppppp datasets at hugging face, December 2022. URL Prompts
https: http:s//hhuggingfac..oooo http://www....o.aatttct/t//tttta
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion-5b: An open large-scale datasct for training next generation image-text models. 2022.
Alex Shonenkov et al. Deep image floyd. https://gittubb.oo//ee-fll/////
2023.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In IEEE Conference on Compuler Vision and Pattern Recognition (CVPR), 2023a.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Understanding and mitigating copying in diffusion models. In Advances in Neural Information Processing Systems (NeurIPS), 2023b.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations (ICLR), 2021a.
Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations (TCLR), 2021b.
Alexander Terenin, Daniel Simpson, and David Draper, Asynchronous gibbs sampling. In International Conference on Artificial Intelligence and Statistics, pp. 144-154. PMLR, 2020.
Yoad Tewel, Yoav Shalev, Idan Schwartz, and Lior Wolf. Zerocap: Zero-shot image-to-text generation for visual-semantic arithmetic. In Proceedings of the IEEE/CVF Conference on Compuler Vision and Pallern Recognition, pp.
2022.
Ryan Webster. A reproducible extraction of training images from diffusion models. arXiv preprint ar wrXii:2305.0869, 2023.
Ryan Webster, Julien Rabin, Loic Simon, and Frederic Jurie. On the de-duplication of laion-2b. arXiv preprinl ar Xrxiv2230..12 12733, 2023.
14

---

Published in Transactions on Machine Learning Research (06/2025)
Yuxin Wen, Neel Jain, John Kirchenbauer, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery. Advonces in Neural Information Processing Systems, 36, 2024a.
Yuxin Wen, Yuchen Läu, Chen Chen, and Lingjuan Lyu. Detecting, explaining, and mitigating memorization in diffusion models. In International Conference on Learning Representations (ICLR), 2024b.
Zequn Zeng, Hao Zhang, Ruiying Lu, Dongsheng Wang, Bo Chen, and Zhengjue Wang. Conzic: Controllable zero-shot image captioning by sampling sampling-basod based polishing. In Proceedings of the IEEE/CVF Conference on Compuler Vision and Pallern Recognition, pp. 23465 23476, 2023.
15

---

Published in Transactions on Machine Learning Research (06/2025)
Appendix
Contents
Introduction
1
2
Related Work
3
Searching Memorized Image Trigger Prompt with MCMC
4
3.1
Preliminary
4
3.2
Memorization Trigger Prompt Searching Optimization Problem
5
3.3
Constructing MCMC by Leveraging dg
6
3.4
Dataset Construction by Leveraging MCMC
6
Dataset Statistics and Efficiency of the Proposed Algorithm
7
Datasel Statistios
7
2
Efficacy of Memorized Image Trigger Prompt Searching
8
MemBench: Metrics, Scenarios and Reference Performance
9
Deeper Analysis into Image Memorization
10
Evaluation of Image Memorization Mitigation Methods
11
Conclusion
12
A Broader Impact Statement
18
B Detailed Derivation of Transition Matrix
18
Data Construction Details
18
C.1 Data Augmentation Leveraging MCMC
20
Data Augmentation Performance
20
C.3 Detailed Data Component of MemBench
20
D Reference Performance Based on Image Search API
21
E Extension to Stable Diffusion 3
21
F Evaluation of Image Memorization Mitigation Method on MemBench
21
FID of Mitigation Methods Measured on MemBeecch
21
2 Evaluation of Image Memorization Mitigation Method Other Diffusion Models
22
16

---

Published in Transactions on Machine Learning Research (06/2025)
G Details of Experiments
22
Implementation Details of Baselines in Memorized Image Trigger Prompt Searching Experiment
22
G.2
Papam-Paramcters in Image Memorization Mitigation Methods
24
Hyper-Parametton Parameters in Memorized Image Trigger Prompt Searching Leveraging MCMC
H
Additional Examples of Memorized Images
25
Datasheet
29
Motivation
29
Composition
29
Collection Process
31
L,
Preprocessing, Cleaning, ond/or Labeling
32
Uses
33
Distribution and License
33
Maintenance
34
17

---

Published in Transactions on Machine Learning Research (06/2025)
A Broader Impact Statement
Our work introduces technique for extracting the training data of diffusion models. This could potentially harm the rights of model owners or image copyright holders. Therefore, it is crucial to handle this technique with caution to avoid any infringement issues. For more details, please refer to Appendix y
B Detailed Derivation of Transition Matrix
In this section, we provide a detailed derivation of the transition matrix that was omitted Section 3 To recap, the transition matrix of the random scan Gibbs sampler for sampling the target distribution æ is defined as Tollows:
Tú T
(10)
i=1
T(P
p
if pf, = p s+1 else,
p
(11)
where n is the total length of sentence, p-; (PI. We proceed to derive the conditional probability distribution of the target distribution rpp) "oloi/
-2. Pi-1, (2:.P2.
Pit1,-.. pn} and p is a j-th state prompt.
m(p p²,)) T(P: = p 4+1 p p(.)
(12)
T TPpr,)
T(P, = p/ P_i p²
(13)
Ewew (P, w, W,P_i = p²-))
(14)
Ewew do(P.:..PP..pp...
By substituting Equation into Equation
we ultimately derive the transition matrix as defined earlier
Equation
dp(P.-p!11 p-.111,-11p__110 n Ewew -. 2/1
if pL, -P-11
T pipii
(15)
else.
C Data Construction Details
In this section, we provide a detailed explanation of the data construction process described in Section 3.4 We explain 1) how memorized image trigger prompts and corresponding memorized images for Stable Diffusion and 2 in Table were found, 2) implementation details of the data augmentation algorithm using MCMC, and 3) its efficiency.
For Stable Diffusion and Realistic Vision, we initialized sentences with n-length mask tokens and implemented Algorithm [ to find new memorized image Irigger prompls and corresponding memorized images (please refer to Section 3.4 "Using Masked Sentence as Prior"). We then perform the MCMC process with Po initialized by trigger prompts to perform the augmentation (please refer Scction 3.4 "Using Found Trigger Prompts Prior"). For Stable Diffusion and DecpFloydIF, the process of finding trigger prompts using masked sentences was omitted. This was due to two reasons: firstly, the prediction accuracy
18

---

Published in Transactions on Machine Learning Research (06/2025)
Algorithm Memorized Image Trigger Prompt Auginentation via Gibbs Sampling
Input: Diffusion model 0, BERT model Φ, imitial sentence pd with length n, iteration number N, number of proposal words Q, termination threshold K, early stop counter threshold 8, hyperparameter K.
Initialize early stop counter --- 0
3: Initialize prompt bank B t {p*}
4: for h: = 0 to n. do
5:
for j = to do
if j - 0 then
k
clse
Randomly select index i E n!
10:
end if
We + arg topq Po(w p²-))
11:
p(p +1 p²,))
"elPr-pp" 141
21
12:
E Ewewg
pf#1 + Sample from p(p ++1 p².))
13:
14:
pi+l + (P':.2......
Pb,
15:
Add ((p..22..... p- W. P. Pb) Vw E Wot to B
16:
if (p())))) <k then
17:
c+c+1
18:
else
19:
c+0
20:
end if
21: if s then
22:
break
23:
end if
24: end for
25: end for
26: return
Algorithm Diversity Sampling
1: Input: Text encoder Φ augmented prompts B, return prompts number
Randomly select p* B
Initialize return prompt list R (p")
while [R] N do
p" + arg min PEB maxp,eR
Φ(p) (p=) Tp(p) [pp)]
6: B B+B B\ {p*}
7: R- (p*}
end while
return R
of de for memorized image trigger prompts is lower for these models. Secondly, as Stable Diffusion 2 is trained on the deduplicated LAION-5B and LAION-A, the memorized image trigger prompts are sparser, making optimization from a masked sentence initialization difficult. Therefore, for Stable Diffusion 2 and DeepFloydIF, only the trigger prompt augmentation algorithm was leveraged. The prompts were initialized two ways before undergoing the data augmentation process: 1) using trigger prompts found from Stable Diffusion 1, and 2) using trigger prompts provided by Webster (2023). We further elaborate on the data augmentation process below.
19

---

Published in Transactions on Machine Learning Research (06/2025)
C.1 Data Augmentation Leveraging MCMC
Trigger prompt augmentation was carried out using different approach from trigger prompt searching (Algorithm The process of generating candidate trigger prompts through prompt augmentation is detailed in Algorithm We initialized Po with the trigger prompt itself and then performed MCMC. As explained in Section 3.4 in trigger prompt augmentation, we run n separate chains for each word position in an n-length sentence, treating each position as the first updating index Gibbs sampling. During the MCMC process, all prompts with calculated dø values were stored in the prompt bank. Additionally, we adopted an early stop counter. The prompts returned by Algorithm 2 Lend to have low diversity due to the nature of Gibbs Sampling, Therefore, Algorithm 3 is applied to all returned prompts to create smaller, more diverse subset of prompts. Afterward, these prompts undergo an image gencration process, followed by human verification, before being added to the dataset.
C.2 Data Augmentation Performance
No Limits
No Linits Business Woman
We present an evaluation of Algorithm 2 our proposed method for augmenting memorized image trigger prompts. To assoss the
effectiveness of Algorithm 2 we examine whether the prompts generated during the algorithm's 's execution indeed trigger mem- orized images. Although Algorithm 2 is designed to return only the top T candidate trigger prompts, for this experiment, we investigate all the prompts generated during the execution of Algorithm 2 to mcasure its performance. Given the extensive time required to verify all candidate trigger prompts, we present toy experiment focusing on a specific prompt: "The no limits business woman podcast," " which generates an image identical to Figure 5 a. For the experiment, we set the hyperparameters of Amgorithm 2 as follows: K 1.5, N = 50, Q 200, k = 3, and s= 3. The experiment was conducted using single A100 GPU.
Business
Woman
Podcast
Poccast
(a)
(b)
Figure 5: Memorized image utilized for toy experiment. Each image refers to (a) train data image in Stable Diffusion, (b) gener- ated image using Stable Diffusion. The SSCD between (a) and (b) is measured to be 0.707.
For those prompts generated during Algorithm 2 we filtered only prompts that show do > 5 and generated 10 images for each. Then we measure the Top-1 SSCD (Pizzi et al. 2022) with the image in Figure 5 a. We found that there were 4217 unique prompts with a Top-1 SSCD exceeding 0.7, indicating that they replicate train data image (as seen in Figure 3) Algorithm 2 took 7 minutes on an A100 GPU, producing 4217 augmented trigger prompts within this time frame. In addition, we categorized these prompts basod on the number of words changed from the original prompt. Specifically, there were 753 trigger prompts with one word changed, 1923 with two words changed, 1352 with three words changed, 179 with four words changed, and 10 with five words changed. Interestingly, even with the modification of five out of the six words in the sentence, the altered prompts can still effectively induce memorized images. This demonstrates our method's efficiency in generating a large number of augmented trigger prompts in a short period.
C.3 Detailed Data Component of MemBench
In addition to the component analysis of memorized images in Stable Diffusion 1 presented in Sec. 4.1 we extend this analysis to Stable Diffusion 2, Realistic Vision, and DeepFloydIF. The results are shown in Figure D
Notably, memorized images related to Humans disappear in both Stable Diffusion 2 and DeepFloydIF. We attribute this to the fact that both models were trained on datasets with image duplication removed. As discussed in Sec. image memorization in such cases likely due to layout duplication. Since human-related images are less likely to involve layout-level duplication, they are less prone to being memorized under these conditions.
20

---

Published in Transactions on Machine Learning Research (06/2025)
Commercial
Product
Commercial Product
Commercial Product
Human
47
Artwork
Etc.
Etc.
m Etc.
(a) Realistic Vision
(b) Stable Diffusion 2
(c) DeepFloyddF
Figure 6: Components of memorized images in Realistic Vision, Stable Diffusion 2, and DeepFloydIF.
Reference Performance Based on Image Search API
In Section we posited that the Google Image Search AP serves as strong proxy model for the generative model and presented the measured reference performance. We provide the details of this approach in this section. Before explaining our use of the Google Image Search API, it is important to reiterate our goal in presenting reference performance: to determine the extent to which the SSCD) (Pizzi et al. 2022 between the memorized image and the generated image can be minimized while maintaining the semantic content of the trigger prompt. To address this question, we utilized the Google Image Search API to measure reference performance as follows: 1) Query 100 images using the memorized image trigger prompt via the API. 2) Mcasure the CLIP Score (Hessel et al. (221)) between the 100 images and the trigger prompt. 3) Retain only the image with the Top-1 CLIP Score. 4) Measure the SSCD between this retained image and the memorized image triggered by the prompt in Stable Diffusion.
5) Repeat steps 1-4 for all memorized image trigger prompts in MemBench. After completing these steps, reported the average Top-1 CLIP Score and the average SSCD of images with the Top-1 CLIP Score in Section 7 Our findings show that the SSCD can be reduced to 0.200 while maintaining a CLIP Score of 0.329. This indicates that the minimum achievable SSCD with maintaining CLIP Score is 0.210. Therefore, we should strive to develop mitigation methods that achieve this or better. Please note that we did not measure Aesthetic Score (Schuhmann et al. 2022) and evaluate the reference performance in COCO (Lin al. 2014) settings, since comparing them with the mitigation method is not meaningful.
E Extension to Stable Diffusion 3
We applied our algorithm to Stable Diffusion 3. However, the training data for Stable Diffusion is publicly unknown (no information is available), we unable to perform the verification process, Reverse Image Search API. Thus, the searched images and prompts for Stable Diffusion cannot serve as a memorization benchmark. To be used as memorization benchmark, two critical steps are essential: 1) Candidate Trigger Prompt Search Step and 2) Verification Step, where we confirm whother the repeated images actually exist in the training data, thereby verifying that they are indeed memorized images, as noted Section 3.2 Without, the verification step, we are sure whether the searched images and prompts are memorized. Nevertheless, in Figure 7 present the trigger prompts and duplicated images identified by our MCMC algorithm for Stable Diffusion 3. Although cannot verify them due to the aforementioned limitations, believe they represent strong candidates for memorized images.
F
Evaluation of Image Memorization Mitigation Method on MemBench
F.1 FID of Mitigation Methods Measured on MemBench
In this section, we present the FID values measured on MemBeench when applying mitigation methods to Stable Diffusion 1. As shown in Table 4 FID values increase when mitigation methods are applied. This
httpp::/dawvlloaaregggoos/ httpa///pppp.o.oooooooc//cctotoe
21

---

Published in Transactions on Machine Learning Research (06/2025)
Vibrant ebony bmw rising inside steering wheel.
Walmut size lan exclusive jeep operating customs.
Label above aqua pale translucent polo shirt.
Fiery eyes mature female leopard aka tigers.
Figure 7: Trigger prompt scarched by MCMC algorithm and generated images with corresponding prompt. The repeated and very similar images strongly suggest the occurrence of memorization. Notably, the last images show a tendency to repeat specific text at the bottom left. This is a common feature of memorized images generated by diffusion models, where text, URLs, or similar elements from the source image are replicated. This strongly suggests that these repeated images are indoed memorized images.
Table 4: FID scores of mitigation methods measured on MemBench.
Base
Somepalli et al. 2023b
Somepalli al. 2023b
Wen
2024b
2024
116.07
75.33
85.32
61.21
86.79
aligns with the findings reported by Ren et al. 2024). as FID also captures diversity. Since the Stable Diffusion model generates identical images for trigger prompts, the generated images exhibit low diversity, leading to higher FID values. In contrast, when mitigation methods are applied, memorized images are not generated, resulting in increased diversity and consequently lower FID values. Therefore, FID does not effectively measure image quality but rather measures diversity. Image quality should instead be assessed using the Aesthetic Score we propose.
F.2 Evaluation of Image Memorization Mitigation Method on Other Diffusion Models
In this section, we evaluate image memorization mitigation methods on our MemBench in other diffusion models. We present the experimental results of Stable Diffusion 2 in Table 5 When each memorization mitigation method applied, although SSCD (Pizzi et al. 2022) reduced, there is a drop in both CLIP Score (Hessel al. 2021) and Aesthetic Score (Schuhmann et al. 2022). Additionally, compared to the reference performance provided by the Google Image Search API, the performance of these methods is insufficient. The method proposed by Wen et al. (2024b) shows less capability in reducing SSCD while maintaining the CLIP Score compared to RNA (Somepalli et al., 2023b) and RTA (Somepalli et al. 2023b) in the memorized image trigger prompt scenario. However, in the practical scenario of the COCO validation set, its performance remains equivalent to the base Stable Diffusion 2. We present the experimental results of DeepFloydII Table
G Details of Experiments
G.1 Implementation Details of Baselines in Memorized Image Trigger Prompt Searching Experiment
In this section, we provide implementation details of other baselines that we have tried to search the memorized image trigger prompts, presented in Section 4.2 All three algorithms (Wen et al. 2024a Zeng et al. 2023 Tewel et al. (222) that we provide are originally intended to solve various optimization problems the text. space, using specific objective functions. For our experiments to search for memorized image trigger prompts, replaced each method's objective function with Dg.
22

---

Published in Transactions on Machine Learning Research (06/2025)
Table 5: Performance evaluation image memorization mitigation methods in MemoBench for Stable Diffusion
MemBench
COCO
Top-1 SSCD
Top-3
SSCD
CLIP
Austhetic
CLIP
Aestbetic
Base
0.629
0.593
0.448
0.281
5.11
0.333
5.33
Reference Performance
(API search)
0.207
0.301
0.525
0.349
0.278
RNA Somepall 3723b
2
0.539
0.491
0.259
0.276
5.30
0.326
5.31
D 3
0.501
0.446
0.224
0.273
5.24
0.324
5.35
0.395
0.161
0.271
5
0.424
0.368
0.130
0.270
5.19
0.320
5.34
D 1
0.500
0.549
0.385
0.276
5.35
0,332
5.34
Samepall 2023h
0.515
0,275
3
0.529
01.75
012661
0.272
5.26
0.329
5.30
1
0.179
0,128
0.211
0,272
5.21
0.325
5.27
5
0.452
0.393
0.167
0.271
5.17
0.324
5.25
70
0.577
0.535
0.311
0.273
5.30
0.333
5.35
Wen et al.
2024bb
60
0.553
0.502
0.251
0.209
5.26
0.333
5.33
50
0.501
0.423
0.154
0,263
5.19
0.333
5.35
40
0.398
0.322
0.066
0.253
5.15
0.333
5.35
e-
0.556
0.419
0.273
0.331
Reu et al. 2024
0.586
0.548
0.391
0.270
5.39
0.326
5.33
= 1.2
0.580
0.539
0.3:19
0.267
5.37
0.322
5.30
Top-1 SSCD 4
Top-3 SSCD 4
SSCD > 0.5
CLIP
Aesthetic
Base
0.619
0.576
0.467
0.279
5.05
Wen et al. 2024b)
0.614
0.572
0.467
0.266
5.06
RNA (Smeppall et al. 2023b
0.497
0.446
0.280
0.270
4.96
RTA Somepalli al. 2023b
0.476
0.426
0.240
0.276
4.94
Table 6: Evaluation of Memorization Mitigation Method DeepFloydTF. The hyperparameters used are follows: RTA and RNA were set with = 4, Wen et al. (2024b) with / = 1. The method proposed by Wen ct al. (202bb) relies on applying adversarial attacks to the model, but it seems to be less effective due to the structural characteristies of DeepFloydLF, which utilizes a cascaded diffusion architecture.
ZeroCap (Tewel et al., 2022). ZeroCap is an optimization method developed for zero-shot image captioning lasks. This method leverages a pre-trained CLIP (Radford al. 2021) to measure the CLIP similarity between an image and the current caption, and manipulate the prompt maximize this CLIP Score, scarching the best caption that describes the image. ZeroCap predicts the next word using large language model (LLM) and sequentially adds tokens to the prompt in manner that maximizes CLIP similarity. Additionally, Context Cache is introduced for gradient descent, where the Context Cache is set. of key-value pairs derived when the current prompt is embedded into the LLM. The optimization function is consistute of 1) CLIP similarity loss between the image and the prompt, and 2) the cross-entropy (CE) loss between the distribution of the predicted token of the original Context Cache and that of the updated Context Cache. ZeroCap performs gradient descent on the optimization function to update the Context Cache five times, after which the token predicted by this Context Cache is designated as the next token to continue the sentence. Furthermore, beam search is utilized in this process. In our experiments, replaced the CLIP similarity loss with Do and implemented the algorithm accordingly. All hyper-parameters were set. to match those in the original paper.
To generate 200 candidate prompts using ZeroCap, took approximately 44 hours on an A.00 GPU, yet not a single memorized image trigger prompt was found. While Da values were higher compared those of general prompts (captions from COCO validation set), they were still lower than the values for actual trigger prompts. This suggests inherent issue with ZeroCap's sequential prediction method.
23

---

Published in Transactions on Machine Learning Research (06/2025)
PEZ (Wen et al., 2024a). The PEZ algorithm is optimization technique designed to find prompts that will induce a diffusion model to generate a specific desired image. The algorithm operates in two main steps for each iteration: 1) perform gradient descent on the prompt in the continuous space with respect to the diffusion model's CLIP model, and 2) project the updated prompt back into the discrete space of the CLIP's embedding space. In our adaptation of this algorithm, we utilized (p( as the objective function for calculating the gradient. All hyper-parameters were set to match those the original paper.
To generate 200 candidate prompts using PEZ, it took approximately 33 hours similar to ZeroCap, not a single memorized image trigger prompt was found. Although the Dg values were comparable to those of actual trigger prompts, memorized images were not discovered. Upon inspection, we observed that the prompts were optimized to produce images with a specific color (e.g., sunflower fields, grassy fields), and the prompts themselves were very unnatural. This suggests that the optimization process did not result the desired memorized image trigger prompts.
A100 GPU. However,
ConZIC (Zeng et al., 2023). ConZIC, like ZeroCap, is a technique designed to optimize the CLIP Score for zero-shot image captioning tasks. Similar to approach, ConZIC selects single word within the sentence, predicts the word using BERT, and then replace it with the word which shows the highest value of objective function. The objective function here is a sum of the CLIP similarity and the conditional probability distribution from BERT. In our experiments, we substituted the CLIP similarity with Do as the objective function.
To generate 200 candidate prompts using ConZIC, it took approximately 24 hours on an A100 GPU, Unlike the other methods, ConZIC successfully identified memorized images. However, ConZIC's optimization process is designed to consistently update the prompt to maximize the objective function, which tends to result in getting stuck in local minima and the lack of diversity. These lead to less efficiency compared to our method.
G.2 Hyper-Parameter in Image Memorization Mitigation Methods
In Section 7 we evaluated the performance of image memorization mitigation methods on MemBench and presented the results in Table 3 However, due to space constraints, we omitted the explanations of various typer-parameters in the table. Here, we provide detailed explanation of these hyper-parameters. Firstly, RTA (Somepalli et al. 2023b) and RNA (Somepalli et al. 2023b) are methods that insert random words or numbers into the prompt. The parameter n in the table indicates the number of words or numbers inserted. The method proposed by Wen et al. (2024b) involves updating the prompt embedding to minimize Dg- Here, the threshold for lowering (p) denoted as the early stopping loss I, becomes a hyper-parannn parameter, i.e. the prompt p is updated until (p) < All other hyper-parameters followed the settings the original paper: an Adam optimizer with a learning rate of 0.05 and a maximum of 10 steps was used for training, [en et al. (2024) provides method that inversely amplifies the attention score for the beginning token by adjusting the input logits of the softmax operator in the cross-attention. To be precise, let the original input logits be denoted as = (81, 82, SN),, where 8; is the logit of the i-th token. The re-scaled logit vector s' is:
s' (C's1, $2 , SN-S: -o,,... -00).
(16)
Here, the scale factor C' for the beginning token becomes a hyper-parameter. Additionally, as shown in Table 3 when C=11 1, the performance differs significantly from the base Stable Diffusion. This is because the input logits for the summary token are all replaced with negative infinity.
G.3 Hyper-Parametert in Memorized Image Trigger Prompt Searching Leveraging MCMC
In Table 7 we present the hyper- parameeas used in our algorithm for finding memorized image trigger prompts via MCMC.
24

---

Published in Transactions on Machine Learning Research (06/2025)
Table 7: syyper-parameter leveraged in memorized image trigger prompt searching using our algorithm. Here, n represents the sentence length, N is the iteration number, Q denotes the number of proposal words, K stands for the temperature, x is the termination threshold, the early stop counter threshold, and T is the number of return candidate prompts.
Model
Method
m
N
Q
K
8
T
Stable Diffusion
Algorithm Igorithm
8
150
200
0.1
5
20
200
1.5
3
3
100
Stable Diffusion
Algorithm
20
200
5.0
50
3
100
Additional Examples of Memorized Images
In this section, we present the trigger prompts identified by our algorithm along with the generated images from Stable Diffusion using these prompts. Additionally, for each image, we provide the correspouding images presumed be from the training data, identified using the Reverse Image Search API. The layout repetition of the generated images and those found through the API strongly indicate that Stable Diffusion has memorized the training data. Moreover, have confirmed that the majority of these images currently available for commercial sale. We leveraged DDIM (Song et al. 2021a) scheduler to generate images.
(a) Diffusion Generated Images
(b) API Searched Images
Figure 8: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "Cozy kitchen painted".
(a) Diffusion Generated Images
(b) API Searched Images
Figure 9: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "Grey standard wall mural".
25

---

Published in Transactions on Machine Learning Research (06/2025)
(a) Diffusion Generated Images
(b) API Scarched Images
Figure 10: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "Iphone case covered with skull".
(a) Diffusion Generated Images
(b) API Searched Images
Figure 11: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "Iphone case covered with skull".
(a) Diffusion Generated Images
(b) API Searched Images
Figure 12: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "Iphone case covered with skull".
(a) Diffusion Generated Images
(b) API Scarchod Images
Figure 13: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "Knit line Africa American quilt house lace boots
26

---

Published in Transactions on Machine Learning Research (06/2025)
(a) Diffusion Generated Images
(b) API Searched Images
Figure 14: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "Knit line Africa American quilt house lace boots".
(a) Diffusion Generated Images
(b) API Searched Images
Figure 15: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "Travel Iuggage cover".
(a) Diffusion Generated Images
(b) API Searched Images
Figure 16: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "United states throw blanket".
ONTI
(a) Diffusion Generated Images
(b) API Searchod Images
Figure 17: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "United states throw blanket".
27

---

Published in Transactions on Machine Learning Research (06/2025)
(a) Diffusion Generated Images
(b) API Searched Images
Figure 18: Examples of memorized images found using the Reverse Image Search API. The prompt used for image generation is "Uranus center ozone temperature map".
28

---

Published in Transactions on Machine Learning Research (06/2025)
Datasheet
1.1 Motivation
Q1 For what purpose was the dataset created? Was there specific task in mind? Was there specific gap that needed to be filled? Please provide description.
MemBench is a benchmark designed for evaluating memorization mitigation methods in diffusion models. Recently, many diffusion models have been highlighted for their issues with image memorization, prompting the development of various memorization mitigation methods. However, due to the absence of a benchmark to properly evaluate these methods, their effectiveness has not been adequately assessed. To address this, we developed MemBench, which includes a large number of memorized image trigger prompts and appropriate metrics for evaluation.
Q2 Who created the dataset (e-g., which team, research group) and on behalf of which entity (e.g., company, institution, organization)?
Chunsan Hong, Tac-Hyun Oh, and Minhyuk Sung from KAIST created the dataset.
Q3 Who funded the creation of the dataset? If there is an associated grant, please provide the name of the grantor and the grant name and number.
Please refer to Acknowledgement section (Sec.
Q4 Any other comments?
No.
1.2 Composition
Q5 What do the instances that comprise the dataset represent (e.g., documents, photos, people, countries)? Are there multtile types of instances (e.g., mowies, users, and ralings; people and interactions between them; nodes and edges)? Please provide description.
It includes links to the images memorized by Bext-to-Image diffusion models and the prompts that trigger these images.
Q6 How many instances there in total (of each type, if appropriate)?
Please refer Section
Q7 Does the dataset contain all possible instances is it a sample (not necessarily random) of instances from a larger set? If the dataset is a sample, then what is the larger set? Is the sample representative of the larger set (e.g., geographic coverage)? If so, please describe how this representativeness was validated/verifia describe why not (e.g., to cover a more diverse range of instances, becouse instances were withheld or unavailable).
If it is not representative of the larger set, please
will be sample of all existing trigger prompts that induce memorized images in Stable Diffusion. However, to the best our knowledge, we have secured the largest number of trigger prompts, and we plan to add more in the future.
Q8 What data does each instance consist of? "Raw" data (e.g., unprocessed tezt images) features? In either case, please provide description.
Input trigger prompt and URLs of memorized images triggered by the corresponding prompt.
Q9 Is there a label or target associated with each instance? If so, please provide description.
No.
29

---

Published in Transactions on Machine Learning Research (06/2025)
Q10 Is explaining why this information is missing (e.g., because it was unavailable). This does not include intentionally removed information, but might include, e.g., reducted text.
any information missing from individual instances? If so, please provide description,
No.
Q11 Are relationships between individual instances made explicit. (e-g., users' movie ratings, social network links)? If so, please describe how these relationships are made explicit.
Yes, our benchmark, relationships between individual instances are made explicit. For example, each trigger prompt in our dataset is explicitly linked the memorized image it induces. This is done by including pairs of trigger prompts and their corresponding memorized images, clearly showing the relationship between them. Additionally, each image in the benchmark is linked to the specific Text-to-Image diffusion model that memorized it, providing a clear mapping of model-instance relationships.
Q12 Are there recommended data splits (e.g., training, ceaaloomment/aaiddaatiinn testing)? If so, please provide description of these splits, erplaining the rationale behind them.
No.
Q13 Are there any errors, sources of noise, or redundancies in the dataset? If so, please provide a description.
No.
Q14 Is the dataset self-contained, or does link to or otherwise rely on external resources (e.g., websites, tweets, other datasets)? If it links relies on external resources, a) are there guarantees that they will erist, and remain constant, over time; b) are there official archival versions of the complete dalaset. (i.e., including the external resources they eristed al. the time the dataset was created); e) are there any restrictions (e.g., licenses, fees) associated with any of the ezternal resources that might apply to fulure user? Please provide descriplions of all external resources and any restrictions associated with them, as well as links or other access points, as appropriate.
The dataset includes the URLs of the memorized images.
Regarding (a), we provide multiple URLs for each memorized image to ensure the dataset's longevity, even if one hosting source goes down.
Regarding (b), since the memorized images are not copyrighted by us, we cannot provide the images directly.
Regarding (c), these images should be used solely for evaluating the effectiveness of mitigation methods and should not be used for commercial training or distribution.
Q15 Does the dataset contain data that might be considered confidential (c.g., data that is protected by legal privilege by doctor-patient confidentiality, data that includes the content of individuals' non-public communications)? If so, please provide description.
No.
Q16 Does the dataset contain data that, if viewed directly, might be offensive, insulting, threatening, or might otherwise cause anxiety? If so, please describe why-
No.
Q17 Does the dataset relate people? If not, you may skip the remaining questions in this section.
No.
Q18 Does the dataset identify any subpopulations (e.g., by age, gender)?
No.
30

---

Published in Transactions on Machine Learning Research (06/2025)
Q19 Is it possible to identify individuals (i.e., more natural persons), either directly or indirectly (i.e., in combination with other data) from the dataset? If so, please describe. how.
The memorized images include faces of celebritics, such as Emma Watson.
Q20 Docs the dataset contain data that might be considered sensitive in any way (c-g., data that reveals racial or ethnic origins, sexual orientations, religious beliefs, political opinions union memberships, genetic data; forms of government identification, such as social security numbers; criminal history)? If so, please provide a description.
locations; financial health data; biometric
No.
Q21 Any other comments?
Although the memorized images we discovered do not contain offensive confidential elements, they do include images of currently sold products and faces of celebrities. For instance, there are images of Emma Watson. Therefore, these images should be used solcly for evaluating the effectiveness of memorization miligation methods.
1.3 Collection Process
Q22
How the data associated with each instance acquired? Was the dala directly ob- servoble (e.g., row tert, movic ratings), reported by subjects (e.g., survey responses), indirectly dnterreddeeivee from other data (e.g., part-of-speech tags, model-based guesses for age or language) If dala was reported by subjects or indireclly inferved/deree from other dala, was the dala vali- dated/ dated/verifteds verified? IJ so, please describe how.
-ur method discovers memorized images without any prior information by leveraging BERT models, diffusion models, and the Reverse Image Search API. For more details, please refer to Section 3
Q23 What mechanisms or procedures were used to collect the data (e.g., hardware apparatus or sensor, manual human curation, software program, software API)? How were these mechanisms or procedures validated?
Our method employs the Reverse Image Scarch A and Google Image Scarch AP discover memorized images. For more details, please refer to Section
Q24 If the dataset is sample from larger set,, what the sampling strategy (e.g., deterministic, probabilistic with specific sampling probabilities)?
No.
Q25 Who was involved in the data collection process (e.g., students, crowdworkers, contrac- tors) and how were they compensated (e.g., how much were crowdworkers paid)?
None. The process automated.
Q26 Over what timeframe was the data collected? Does this timeframe match the creation timeframe of the data associated with the instances (e.g., recent crawl of old news articles)? If not, please describe the timeframe in which the data associated with the instances created.
The data was collected from April 2024 to May 2024.
httpp::/tineye..co
http:://avellorrr.goglle..m
31

---

Published in Transactions on Machine Learning Research (06/2025)
Q27 Were any ethical review processes conducted (e.g., by an institutional review board)? If so, please provide description of these review processes, including the outcomes, as well as a link or other access point to any supporting documentation.
No.
Q28 Docs the dataset relate to people? If not, you may skip the remaining questions in this section.
People may appear in the memorized images.
Q29 Did you collect the data from the individuals in question directly, or obtain it via third parties or other sources (e.g., websites)?
Our method employs the Reverse Image Search API and Google Image Search API to discover memorized images. For more details, please refer to Section 3
Q30 Were the individuals question notified about the data collection? Tf so, please describe (or show with screenshots or other information) how notice was provided, and provide a link or other access point to, otherwise reproduce, the eract language of the notification itself.
Our automated memorized image trigger prompt searching algorithm did not involve any partici- pation of individuals.
Q31 Did the individuals in question consent to the collection and use of their data? If so, please describe (or show with screenshots other information) how consent requested and provided, and provide a link or olher access poinl lo, or otherwise reproduce, the exact language to which the individuals consented.
Our automated memorized image trigger prompt searching algorithm did not involve any partici- pation of individuals.
Q32 If consent was obtained, were the consenting individuals provided with mechanism to revoke their consent in the future or for certain uses? If s0, plense provide a description, well as a link or other access point to the mechanism (if appropriate).
Our automated memorized image trigger prompt searching algorithm did not involve any partici- pation of individuals.
Q33 Has an analysis of the potential impact of the dataset and its use on data subjects (e.g., a data protection impact analysis) been conducted? If so, please provide a description of this analysis, including the outcomes, as well as a link or other access point to any supporting documentation.
We discuss the limitation of our current work in Section S and we plan to further investigate and analyze the impact of our benchmark in future work.
Q34 Any other comments?
No.
1.4 Preprocessing, Cleaning, and/or Labeling
Q35
Was any prepooesiing/ceennngg/bbbbbu ing, tokenization, part-of-speech tagging, SIFT fcature extraction, removal of instances, processing of missing values)? If so, please provide a description. If not, you may skip the remainder of the questions in this section.
of the data done (e.g., discretization or bucket-
No.
Q33 Was the "raw" data saved in addition to the preprocessed/ seapeessssdd/leaancll /elcaned////////ea /labeled data (c.g., to support unanticipated future uses)? If so, please provide a link or other access point the "raw"" " dala.
32

---

Published in Transactions on Machine Learning Research (06/2025)
N/A.
Q37 Is the software used to preprooess/ckean/labe the instances available? If so, please provide a link or other access point.
N/A.
Q88 Any other comments?
No.
1.5
Uses
Q39 Has the dataset been used for any tasks already? If so, please provide description.
Not yet. MemBench is new benchmark.
Q40 Is there repository that links to any all papers systems that the dataset? If so, please provide link other access point.
Not yet. We plan to provide links to works that use our benchmark.
Q41 What (other) tasks could the dataset be used for?
Image memorization mitigation in diffusion models.
Q42 Is there anything about the composition of the dataset or the way it was collected and preprocessed/cleaneee /cleaned/labeled that might impact future uses? For ezample, is there anything that a future user might need to know to avoid uses that could result in unfair treatment of individuals or groups (e.g., stereotyping, qualiby of service issues) or other undesirable harms (e.g., financial harms, legal risks) so, please provide description. Is there angthing a fubure user could do to miligale these undesirable harms?
No.
Q43 Are there tasks for which the dataset should not be used? If so, please provide a description.
The images provide must not be used for training generative models. Since these images include faces of celebrities and currently sold products, they should never be used or distributed for the training of generative models.
Q44 Any other comments?
No.
1.6 Distribution and License
Q45 Will the dataset be distributed to third parties outside of the entity (e.g., company, institution, organization) on behalf of which the dataset was created? If so, please provide description.
Yes, this benchmark will be open-source.
Q46 How will the dataset be distributed (e-g., tarball on website, API, GitHub)? Does the dataset have digital object identifier (DOI)?
The code and datasets are available at httpss//gthabb.om//bnnnaaaoogggp Bww.:/onnggMeeBBee__oooooooo
Q47 When will the dataset be distributed?
It. has already been distributed through the above link.
33

---

Published in Transactions on Machine Learning Research (06/2025)
Q48 Will the dataset be distributed under copyright other intellectual property (IP) license, and/or under applicable terms of use (ToU)? If s0, plense describe this license and/or or ToU, and provide a link or other access point to, or otherwise reproduce, any relevant licensing terms or ToU, as well as any fees associated with these restrictions.
The dataset will be distributed under the Creative Commons Attribution 4.0 International (CC BY 4.0) license for the URLs and trigger prompts, not for the images themselves, as the images themselves are not owned by us. We will provide terms of use document specifying that the dataset is intended solely for research and evaluation of memorization mitigation methods and should not be used for training generative models. The GitHub repository, where the benchmark will be distribuled, will contain the code licensed under the MIT License. The terms of use and licensing information will be accessible via the GitHub repository when it becomes available.
Q49 Have any third parties imposed IP-based other restrictions the data associated with the instances? If so, please describe these restrictions, and provide link other access point to, otherwise reproduce, any relevant licensing terms, well any fees associaled with these restrictions.
Yes, third parties own the images referenced by the URLs in our datasct. These images include those of celebrities and currently sold products, which are protected under their respective intellectual property rights. The URLs provided are for reference purposes only and must not be used for training or commercial distribution. Any use of the images must comply with the respective third-party terms and conditions. There are no fees associated with these restrictions, but users must respect the IP rights of the original content owners.
Q50 Do any export controls or other regulatory restrictions apply to the dataset or to individual instances? If so, please describe these restrictions, and provide a link or other access point to, or otherwise reproduce, any supporting documentation.
No.
Q51 Any other comments?
No.
1.7
Maintenance
Q52 Who will be pyrportinghoostin/mmiitttt the dataset?
Chunsan Hong, the first author, will maintain the dataset.
Q53 How can the ovnerr/uratorr/maagge of the dataset be contacted (e.g., email address)?
Through the GitHub discussions that will be opened soon.
Through the email of the author.
Q54 Is there an erratum? If so, please provide link other access point.
No.
Q55 Will the dataset be updated (e.g., to correct labeling errors, add new instances, delete instances)? so, please describe how often, by whom, and how updates will be communicnted to users (e.g., mailing list, Gitllub)?
MemBench will be updated. We plan to search for more memorized image trigger prompts and corresponding memorized images using our continuous algorithm.
Q56 If the dataset relates to people, are there applicable limits on the retention of the data associated with the instances (c.g., were individuals in question told that their data would be retained for a fixed period of time and then deleted)? If so, please describe these limils and explain how they will be enforced.
34

---

Published in Transactions on Machine Learning Research (06/2025)
N//A.
Q57 Will older versions of the dataset continue to be seaporttd//hotte/mminneeee If so, please describe how. If not, please describe how its obsolescence will be communicated users.
We will host other versions.
Q58 If others want to hattenn//agmet//////
on/contribute to the dataset, is there a mech- anism for them to do so? If so, please provide a description. Will these contributions be validated/veriffell If so, please describe how. If not, why not? there a process for communicat- ing/ distiiiirg these contributions to other users? If so, please provide a description.
Through the email of the author.
Q59 Any other comments?
No.
35


Reviews:
[{"review_id": "HYSbL5YRrj", "reviewer": "Reviewer_vYcx", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The paper addresses a clear gap in the literature - the lack of a standard benchmark for evaluating memorization mitigation methods. The proposed benchmark and metrics are beneficial for the future development of image memorization scenarios.\n\n2. The proposed MCMC method to quickly find the memorization trigger prompt is novel.\n\n3. The proposed metrics are highly motivated.\n\nWeaknesses:\n\n1. The authors do not illustrate how to ensure the trigger prompts found are semantically fluent.\n\n2.  It is recommended to highlight the key findings in the experiment in the Introduction, so the readers can better grasp the important conclusion from the paper.\n\n3. More experimental analysis is expected. The authors need to carry out a deeper analysis to provide some valuable insights. For example, do authors explore more types of trigger prompts, e.g., a prompt of a landmark or a highly distinctive scene in a movie? I believe there are more types of trigger prompts can be incorporated.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper introduces MemBench, the first benchmark for evaluating memorization mitigation methods in diffusion models. The authors highlight that diffusion models often regenerate memorized training images when triggered by specific prompts, raising concerns about copyright and privacy. MemBench addresses the lack of rigorous evaluation benchmarks by providing:\n\n1. A large dataset of memorized image trigger prompts for multiple diffusion models (Stable Diffusion 1/2, DeepFloydIF, Realistic Vision).\n\n2. Metrics (SSCD, CLIP Score, Aesthetic Score) to assess memorization mitigation methods.\n\n3. A novel MCMC-based algorithm to efficiently search for trigger prompts without requiring access to training data.\n\n4. Reference performance guidelines for mitigation methods.\n\nUsing the benchmark, the authors evaluate existing mitigation methods and find that current approaches significantly degrade model performance and image quality.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Illustration of how to ensure the trigger prompts found are semantically fluent. If not, please show some examples of the found prompts.\n\n2. Add key findings of experiments in the introduction\n\n3. More analysis of other types of the trigger prompts.", "broader_impact_concerns": "No additional ethical concerns that would require expanding the Broader Impact Statement identified.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "cg14o4UQYk", "reviewer": "Reviewer_G77p", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n\n- The authors efficiently generate and filter trigger prompts, outperforming naive baselines in terms of effectiveness and scalability.\n\n- By evaluating existing memorization-mitigation techniques on MemBench, the paper provides valuable reference performance metrics for future research.\n\n- The figures showing that Stable Diffusion memorizes commercial images and layout patterns are intriguing.\n\nWeaknesses\n\n- The current evaluation of trigger prompts focuses mainly on Stable Diffusion versions 1 and 2. While verifying memorization is impossible for some models, such as Stable Diffusion 3, there are still alternative options. For instance, applying the MCMC approach to models like Pixart [A]—trained on open-source SAM data [B] and using a T5 encoder—or Diffusion-DPO [C]—Stable Diffusion 1.5 fine-tuned on human preferences with pick-a-pic data—would illustrate broader applicability. Showing that trigger prompts can be extracted for such models and used to assess memorization-mitigation techniques would further validate the general utility of the proposed method.\n\n[A] Chen et al., PixArt-α: Fast Training of Diffusion Transformer for Photorealistic Text-to-Image Synthesis, ICLR 2024.\n\n[B] Kirillov et al., Segment Anything, ICCV 2023.\n\n[C] Wallace et al., Diffusion Model Alignment Using Direct Preference Optimization, CVPR 2024.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper addresses the absence of a proper benchmark for evaluating how text-to-image generative models memorize training images. To remedy this, the authors introduce MemBench, a dataset containing several thousand “trigger prompts” that reliably produce memorized images. These prompts are generated and curated using Stable Diffusion, the masked language model BERT, and an MCMC sampling method—an approach that does not require direct access to the training set and is notably more efficient than naive baselines. As a result, MemBench gathers several times more trigger prompts compared to Webster (2023).\n\nFurthermore, the paper leverages MemBench to examine existing memorization-mitigation methods, finding that while these methods attempt to reduce memorization, they also degrade text alignment and image quality. Consequently, the authors argue that further improvements are needed to address memorization in text-to-image generative models.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "As mentioned in the weakness, verifying that trigger prompts can be generated and evaluated for models such as Pixart or Diffusion-DPO would further validate the method’s broader applicability.", "broader_impact_concerns": "The paper includes a Broader Impact Statement in the main text and provides detailed information about the dataset in the appendix through a data sheet section. As a result, there are no significant concerns regarding ethical implications that require further attention.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "YWutx7G0Df", "reviewer": "Reviewer_LXqR", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**S1**: The proposed MemBench tackles a task that might be of interest to some of the researchers in the modeling community, which is the memorization mitigation problem in diffusion models.\n\n**S2**: It makes sense to consider the general quality of the generated images when mitigating the memorization issue, which makes the proposed point of including an additional Aesthetic Score reasonable.\n\n**S3**: The proposed prompt searching does not require direct access to the original LAION dataset and leverages MCMC sampling instead, which is intuitively reasonable.\n\n**W1**: Some of the presentation (e.g., figures and mathematical notations) and writing need further improvement. Please see my detailed comments in the Requested Changes section. \n\n**W2**: The positioning between this work and the previous works (e.g., Webster 2023) is rather vague and unclear. While I hear the authors mention that the existing search methods usually require access to the training dataset LAION, it does not directly impact the target user of this particular benchmark. In other words, as a potential modeling researcher working on mitigation methods, direct access to LAISON in the benchmark construction process does not provide additional value anyway. That being said, I think the authors need to come up with stronger practical values and advantages, such as the quality of the benchmark itself as the key strength to convince the community. And this quality comparison (which should be independent from the downstream task performance) is currently missing, as there are no human evaluations to verify the actual quality of the proposed MemBench, the only dimension emphasized is the size and the search algorithm used to construct the benchmark.\n\n**W3**: Analysis of the proposed benchmark is insufficient. For instance, I believe a model-wise analysis of the dataset statistics would be helpful in Sec. 4.1. The proposed benchmark includes trigger prompts for different diffusion T2I models, and the model-wise breakdown would provide valuable insights on how the memorization is established in different T2I variants. \n\n**W4**: I read Sec. 6 for the deeper analysis into image memorization. While I appreciate the authors' efforts to a deeper understanding of this memorization issue, unfortunately found it does not appear to be very fundamental. Memorization is directly related to diffusion training dynamics embedded in the formulation, several theoretical works [a] have explicitly pointed out the connection between the collapse phase transition in learning dynamics and image memorization, the authors are advised to look into this line of theoretical works to better understand the underlying theoretical mechanisms of memorizations.\n\n**W5**: While I agree that we should look into other dimensions, such as the general quality, when developing mitigation methods, I am not fully convinced of the rationale for replacing FID with Aesthetic Score, can you please also provide the FID scores for the benchmarked methods in Table 3, as comparison to the reported Aesthetic Score.\n\n[a] Dynamical regimes of diffusion models, Nature Communications 2024", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The main contribution of this paper is a benchmark (MemBench) for the memorized image trigger prompt and their retrieved image from the web for several T2I diffusion models; the direct user of this particular benchmark would be the modeling community on memorization mitigation methods. Specifically, this benchmark is larger than the prior works and does not rely on direct access to the LAION dataset. For the evaluation side, the authors propose incorporating several additional metrics for assessing the existing mitigation methods, pointing out that current evaluation often overlooks the side effects of memorization mitigation of sacrificing the general generation quality, measured by Aesthetic Score.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "**In addition** to the major weaknesses pointed out in the previous section, I have several more detailed comments regarding the requested changes.\n\n- Figure 1 should be improved, the current version only has a pie chart with even no unit on the scores. Also, as I have previously mentioned, the statistics breakdown w.r.t. different base models should be included and analyzed.\n\n- In Figure 2, the corresponding text prompts used to generate those figures should also be added.\n\n- The layout and the content from Figure 3 and Figure 4 are somewhat similar, they are expected to be much more informative and should be merged.\n\n- In Table 3, why use different notations for API search? What do n, l, and c mean, and why do they have different numeracy accuracies?\n\n- The mathematical notation in Sec 3.2 has some inconsistencies. For instance, *...to find prompts yielding high $\\mathcal{D}_\\theta$*, should be D$_\\theta$ instead. Also use $\\mathcal{D}$ for ensemble and D for measure is already confusing.\n\n- Can you please also provide the diversity of the prompt in the proposed benchmark?", "broader_impact_concerns": "I reviewed the Datasheet in the appendix and have a few concerns.\n\nFirst, the quality assessment of the proposed benchmark appears to be largely missing. The most apparent advantage over prior work seems to be its larger dataset size, but without a proper evaluation of prompt and image quality, it is difficult to assess its overall reliability. I strongly recommend conducting a comprehensive human evaluation, following properly documented IRB regulations, to ensure the benchmark’s quality and integrity.\n\nAdditionally, the authors provide URLs to memorized images from the web, raising potential copyright and legal risks. It is unclear whether this practice is legally permissible or how such risks might impact future research built upon this benchmark. The editor may want to consider consulting an external ethical reviewer to further assess these concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper addresses a significant and acknowledged gap in the field by providing the standardized benchmark for evaluating memorization mitigation methods in diffusion models. The benchmark includes a substantial dataset of trigger prompts across various diffusion models, curated using a novel and efficient MCMC-based search algorithm that notably does not require access to the original training data. The proposed evaluation framework is comprehensive. The work provides valuable reference performance data for existing mitigation techniques, highlighting their current limitations. The benchmark and accompanying methodology are deemed meaningful, sound, and potentially highly useful for guiding future research.

Several presentation improvements were made. The paper now includes analysis quantifying the diversity of memorization bias in the discovered prompts and discusses human verification results comparing MemBench favorably to prior work in terms of reliability, strengthening the justification for the benchmark's quality beyond just size. Further analysis detailing the types of trigger prompts discovered and a model-wise breakdown of dataset statistics have been added.  All the above improvements  can be included in the final revised version.
Decision: Accept (poster)