Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Models

1. Introduction

• Web-scale datasets enable commercial models such as DALL·E [52] and Stable Diffusion [54], while opaque data origins and memorization raise legal and ethical concerns [7] [9] [10] [22].The paper frames the central concern as diffusion outputs reproducing training data directly or presenting collages of training images.Source: §1 · pp. 1–2
• The paper defines content replication as reproducing training images in whole or in part, while focusing on whether it occurs and to what degree rather than resolving its ethical boundaries.Replication may be acceptable or desirable in some situations and considered stealing in others.Source: §1 · p. 2
• The study benchmarks self-supervised and retrieval-based image features on real and synthetic datasets, finding that state-of-the-art instance retrieval models work well for detecting replication.The authors use these tools to search diffusion models trained on datasets with different properties.Source: §1 · p. 2
• Replication occurs frequently in models trained on small and medium datasets, appears undetectable on ImageNet, but is clear in Stable Diffusion.The authors note that the Stable Diffusion rate likely underestimates replication because they search a 12M-image subset of its 2B-image LAION training split.Source: §1 · p. 2
• Because replication thresholds are subjective and some cases fall into a gray area, the authors present quantitative and qualitative results rather than impose an arbitrary definition.Whether replication counts may depend on image-class diversity and the observer.Source: §1 · p. 2

Image retrieval and copy detection

• DINO [12] provides a competitive self-supervised descriptor for instance retrieval, while SSCD [47] optimizes descriptors for copy detection using entropic regularization and task-specific augmentations.Retrieval seeks database images sharing reference features; inexact copy detection requires high semantic similarity.Source: §2 · p. 2

Memorization in deep learning

• A generative model that memorizes data might permit model inversion or membership inference, yet might never spontaneously generate training data by accident; therefore these behaviors are not equivalent to replication.Source: §2 · p. 2

Diffusion models

• Diffusion transforms Gaussian noise into samples from complex distributions, and this study analyzes Stable Diffusion v1.4, a text-conditional latent model trained on LAION [54] [57].The model was initially trained on over 2B images and fine-tuned on 600M LAION Aesthetics v2 5+ images; matching was limited to the 12M-image 6+ split.Source: §2 · pp. 2–3

Related work

• Meehan et al. [39] test population-level closeness, Feng et al. [24] find pixel-space GAN replication inversely related to dataset complexity and size, and Webster et al. [63] report occasional face-GAN copies.Webster et al. also find novel images of known training identities without verbatim copies; FID can favor memorizing models [4], while diffusion researchers have explored de-duplication and nearest-neighbor checks.Source: §2 · p. 3

• Replication means a generated image contains a foreground or background object appearing identically in a training image, aside from minor augmentation-related variations.Source: §3 · p. 3
• The authors prioritize object-level similarity because it is more relevant to potential intellectual-property disputes, while disregarding augmentation-related appearance differences as typically irrelevant to copyright claims.Source: §3 · p. 3
• Style-wise and semantic similarity are excluded because they are subjective, typically not infringement, and many images lack a well-defined style.Source: §3 · p. 3

4. Detecting Content Replication

• The evaluation compares 10 feature-extractor prototypes across 10 curated datasets, including real benchmarks for landmarks, products, general-purpose retrieval, and fine-grained birds.The real datasets are Oxford, Paris, INSTRE, GPR1200, and CUB-200.Source: §4 · pp. 3–4
• Five synthetic datasets model replication through pasted patches, diffusion-outpainted square or triangular regions, and augmented object or background segments from MS COCO and VOC.The diagonal-outpainting dataset retains half of an original image, while segmentation-based examples also randomize object scale and position.Source: §4 · p. 3

4.1. Choosing the Best Replication Detector

• DINO [12] with split-product ranked best across all 10 datasets; Swin Transformer [36] won on real datasets and SSCD [47] on synthetic datasets.The methods showed a similar ranking order under MRR and Recall@1/5.Source: Table 1 · p. 4, §4.1 · p. 5

4. Detecting Content Replication

• Candidate detectors include retrieval specialists, supervised pretrained backbones, and SSL models such as DINO [12], VICRegL [5], and MoCo v3 [15], including a CutMix-finetuned variant.The study addresses the lack of a rigorous comparison of multiple SSL models and retrieval-specialist models across multiple datasets.Source: §4 · p. 4
• Split-product compares corresponding feature chunks and takes their maximum, allowing separate local matches without making two unrelated source images appear similar.The split-product metric is qualitatively more semantic, while standard inner product enforces stricter pixel-wise similarity; both metrics returned suitable, often differing matches.Source: §4 · pp. 4–5

Experimental setup

• The study trains DDPMs on Celeb-A sets of 300 and 3,000 images plus a full-data checkpoint, and Oxford Flowers sets of 100, 1,083, and 8,189 images.Models use random flip and crop augmentation, train for at least 300,000 steps until FID is below 50, and are evaluated on 10,000 Celeb-A or 5,000 Flowers generations.Source: §5 · p. 5

Qualitative observations

• Celeb-A models trained on 300 or 3,000 images blatantly copy training images, whereas full-dataset generations are similar but not identical; Oxford Flowers shows the same trend, with minor unique variations at 1,083 images.The illustrated samples were selected from the 20 generations with highest top-1 similarity, not cherry-picked.Source: Figure 3 · p. 5, Figure 4 · p. 5, §5 · p. 6

Quantitative observations

• Generated-image similarity is compared with a baseline of each random training image’s similarity to its closest other training image; scores mostly above that baseline indicate greater closeness to training samples.Figure 5 plots top-1 similarities for generations and training-image self-similarity across models trained with different data amounts.Source: §5 · p. 6, Figure 5 · p. 6
• Most generations from the 300-image model are extremely similar to training data; at 3,000 images, such copies are infrequent, while full-dataset similarity aligns with training-set self-similarity.The full-dataset model’s similarity histogram lacks a long right tail, suggesting exact copies are unlikely; some training images themselves have near-duplicates.Source: §5 · p. 6, Figure 5 · p. 6

Experimental setup

• The study used the official pre-trained ImageNet class-conditional Latent Diffusion Model checkpoint, sampling 100 randomly selected classes and generating 1,000 images per class.The sample count per class was comparable to the ImageNet training-data size per class.Source: §6 · p. 6

Observations

• Generated-to-training similarity never exceeded 0.65; high-scoring examples were similar but never exact copies, indicating a very low chance of replication.The authors manually inspected high-similarity examples across 100 classes; they suggest low intra-class diversity may explain some matches.Source: §6 · pp. 6–7, Figure 6 · p. 7
• Class-level self-similarity and generation-to-training similarity correlated at 0.6, with a best-fit slope of 0.39.The classes with the highest generated-to-training similarity were theater curtain, peacock, and bananas; those at the lower end included sea lion, shopping cart, bee, and swing.Source: §6 · pp. 6–7, Figure 6 · p. 7

7. Case Study: Stable Diffusion

• The study evaluates Stable Diffusion v.1.4 [54] using a 12M-image LAION Aesthetics v2 6+ subset because searching the full 2-billion-plus-image LAION dataset was beyond its computational capacity.The initial experiment sampled 9,000 source images, retrieved their captions, and generated images from those captions.Source: §7 · p. 7
• SSCD and DINO often flagged the same generations, but DINO found a more diverse range of matches with lower pixel similarity by emphasizing semantic rather than pixel-level similarity.The top-10 SSCD matches shown for one generation were identical copies of the same training image.Source: §7 · p. 7, Figure 9 · p. 9
• Among roughly 170 high-similarity generations (>0.5; top 1.88 percentile), the study found verbatim copying of objects and backgrounds and local copying of backgrounds.The first row shows an object and background retained while the painting changes; other examples recycle only the background.Source: §7 · p. 7, Figure 7 · p. 8
• None of 9,000 generations from LAION-sourced captions matched its respective source image, and 1,000 random generations had much lower mean similarity to training data than their caption-source images.This suggests caption sampling does not typically reproduce the image from which a caption was taken.Source: §7 · pp. 7, 9, Figure 11 · p. 10
• The phrase “Canvas Wall Art Print” prompted generations containing a particular LAION sofa, while prompts reduced to “painting” and “wave” still produced a wave resembling Hokusai’s Great Wave.The study reports that the wave structure persisted as words were gradually removed from the prompt.Source: §7 · pp. 7, 9, Figure 10 · p. 9
• With prompts naming an artist, generations frequently reproduced known paintings; content copying decreased across Figure 8 examples while style copying remained prevalent.The authors tried prompts for around 20 classical and contemporary artists.Source: §7 · p. 9, Figure 8 · p. 9
• LAION captions can contain key phrases associated with dataset images that conjure memorized content, potentially making LAION-based sampling yield more replication than other sampling methods.The authors note there is no baseline sampler for “typical” captions, and experienced users often exploit phrases such as “art station,” “35mm,” or an artist’s name.Source: §7 · p. 9
• Very close matches (>0.5 SSCD) were duplicated an average of 34.1 times, compared with 3.1 times for typical matched images and 11.6 times for typical random images.The authors conclude that replicated content tends to come from training images duplicated more than a typical image.Source: §7 · p. 10, Figure 11 · p. 10

Possible causes of replication

• Replication is not inevitable: earlier GAN studies found none, and the study found no evidence of significant replication in ImageNet LDM.This contrast motivates the question of what distinguishes Stable Diffusion.Source: §8 · p. 10
• ImageNet LDM and Stable Diffusion use similar update rules, training routines, and parameter counts, ruling out several potential explanations for their differing replication behavior.The passage does not specify which factors these similarities rule out.Source: §8 · p. 10
• Small datasets with unlikely image duplication still produced strong replication, so duplication alone is an incomplete explanation; with equal training updates, unique images should yield the same model as images duplicated 1,000 times.The authors describe the latter as a condition on the comparison, not as a measured experimental result.Source: §8 · p. 10
• The authors speculate that Stable Diffusion’s replication reflects an interaction of text conditioning, highly skewed image repetition, and enough gradient updates to overfit a subset of training data.These are proposed factors, not established causes.Source: §8 · p. 10

9. Limitations & Conclusion

• Approximately 1.88% of random Stable Diffusion generations had dataset similarity ≥.5, showing detectable replication was uncommon but not negligible.Typical images from large-scale models showed no copied content detectable by the study’s feature extractors, but the authors say copies cannot safely be ignored.Source: §9 · p. 10
• The 12M-image search covered only a subset of Stable Diffusion’s 600M-image LAION Aesthetics V2 5+ fine-tuning data, under 0.6% of total training data; pretraining used over 2 billion images.Source: §9 · pp. 10–11
• Examples outside the searched split and copies missed by retrieval mean the results systematically underestimate replication in Stable Diffusion and other models.Source: §9 · p. 11

A. Additional Stable Diffusion results

• The appendix provides prompts for main-paper figures and additional figures accompanying its observations.Source: A. Additional Stable Diffusion results · p. 14
• The source caption and match caption for Fig. 1 are shown in Fig. 13.Source: A. Additional Stable Diffusion results · p. 14
• Prompts for Fig. 10 are listed in Tables 2 and 3, matching the figure’s top and bottom rows, respectively.Source: A. Additional Stable Diffusion results · p. 14, Table 2 · p. 14, Table 3 · p. 14
• The appendix gives 20 hand-curated prompts for famous paintings; the six prompts for Fig. 8 appear at the top of Table 4 in figure order.Source: A. Additional Stable Diffusion results · p. 14

B.1. Hyperparameters for training

• Celeb-A models trained on 300 and 3,000 images ran for 4,000 epochs; the whole-dataset model used the official pretrained checkpoint.The 300-image model used batch size 4, learning rate 5e−5, and 200 warmup steps; the 3,000-image model used batch size 20, learning rate 5e−4, and 200 warmup steps.Source: §B.1 · p. 14
• Oxford Flowers models trained on 100 and 1,000 images ran for 2,000 epochs, while the all-data model ran for 1,000 epochs.The 100-image model used batch size 5, learning rate 5e−5, and 100 warmup steps; the 1,000-image model used batch size 20, learning rate 1e−4, and 400 warmup steps; the all-data model used batch size 32, learning rate 1e−4, and 100 warmup steps.Source: §B.1 · p. 14

C. Stable Diffusion settings

• Stable Diffusion sampled 9,000 captions with replacement from LAION-Aesthetics v.6+, generated once per caption without handpicking, and used guidance scale 7.5, strength 0.5, and 50 steps.Source: C. Stable Diffusion settings · p. 14

C.1. Misc results

• On Celeb-A, Fig. 15 expands DINO split-product retrieval examples across diffusion models trained on 300, 3,000, and 30k images.The text describes the top 10 generations and their matches; the figure caption says it shows the top four matches per image.Source: §C.1 · p. 14, Figure 15 · p. 17
• The ImageNet examples show generations from a pretrained conditional-LDM model alongside their closest training-set matches using DINO split-product.Figure 14 displays a few generations and their top four matches from the ImageNet training set.Source: §C.1 · p. 14, Figure 14 · p. 16
• Figure 13 expands the teaser with the generation caption and the caption of its top match.Source: Figure 13 · p. 15
• Table 4 lists 20 manually curated prompts for examining copying of style versus content; its first six prompts, in order, are used for Fig. 8.Source: Table 4 · p. 16