PaperlayerView exact revision on arXiv

Source-linked AI summary

Early Signatures of Memorization in Diffusion Models via Basin Geometry and Cyclic Denoising

Nikhil Verma, Siddharthan Dileep, Anoop Singh, Srikanth Sastry, Ramya Hebbalaguppe, Sayan Ranu, N. M. Anoop Krishnan

arXiv:2610.11670v1cs.LG

TL;DR

Standard one-shot tests detect memorization only after generated outputs reproduce training examples, although a model may encode sample-specific structure earlier. The paper probes that structure through score geometry and cyclic denoising, finding training-sample basins before one-shot copies appear and showing that cycling can recover memorized examples while also revealing degenerate attractors.

  • Problem

    One-shot near-copy tests detect memorization only after training examples appear in outputs, leaving a gap in auditing released checkpoints for earlier sample-specific structure.

    Source: §1 · p. 2

  • Method

    The paper tracks score divergence and basin volume across training and uses cyclic denoising to probe the learned energy landscape.

    Source: §1 · p. 3

  • Results

    Training-sample basins form before one-shot generation reproduces those samples, and cyclic denoising exposes latent memorization while also revealing degenerate attractors.

    Source: §1 · p. 3

  • Takeaways & Limitations

    Memorization is reflected in the geometry and stability of the learned distribution, and basin residence alone does not establish that an attractor matches a training image.

    Source: §4 · p. 9

    The basin-volume measure is an isotropic proxy and does not equal the exact basin volume.

    Source: §2.1 · p. 4

Abstract

from arXiv · show

Diffusion models generalize early in training and later reproduce individual training samples. Standard tests detect memorization only once one-shot generation produces near-copies, leaving a released model unaudited until its outputs fail. We show that memorization is encoded in the geometry of the learned energy landscape before it appears in generated samples, a state we call latent memorization. Using score divergence and basin volume, we find that localized basins form around training samples and separate them from held-out samples before the first memorized sample appears, with an onset that follows the same $O(n)$ scaling as the memorization time. We probe these basins with cyclic denoising, which repeatedly applies partial noising and denoising. Under the exact empirical score, we prove that cycling started near an isolated training sample recovers it and returns to it over any finite number of cycles with high probability. In trained models, cycling recovers training images from CelebA and CIFAR-10 checkpoints whose one-shot samples contain no copies, and at a CelebA checkpoint with 0.1% one-shot copies, 500 cycles raise the memorized fraction above 30%. Cycling also reveals degenerate attractors that match no single training image and fade as training proceeds, so residence in a basin does not by itself imply memorization. These findings hold on a Gaussian mixture, CelebA, and CIFAR-10 across optimizers, architectures, noise schedules, and training-set sizes, and extend to off-the-shelf Stable Diffusion v1.4, where the cycled conditional-unconditional divergence gap separates memorized from non-memorized prompts with an AUC of 0.944 and a TPR of 0.866 at 1% FPR. More broadly, what a diffusion model has memorized is a property of the geometry and stability of its learned distribution, and assessing it requires examining this structure rather than generated outputs alone.

1 INTRODUCTION

The paper asks whether diffusion models reveal memorization before one-shot outputs contain copies, and studies this through score geometry and cyclic denoising. It finds localized training-sample basins before one-shot reproduction and shows that cycling can expose both memorized images and non-memorizing attractors.

1 INTRODUCTION

  • Standard near-copy tests detect memorization only after one-shot generation reproduces training images, although a released checkpoint may encode sample-specific structure before producing copies.The paper calls this state latent memorization and frames early detection as auditing the model in hand without its training curve.Source: §1 · p. 2
  • Localized basins develop around training samples while capturing little probability mass from pure noise during the generalization window, which cyclic denoising probes through repeated partial noising and denoising.At sufficiently large noise, trajectories can jump to neighboring basins.Source: Figure 1 · p. 2, §1 · p. 3
  • Training-sample basins form before one-shot generation reproduces those samples, and their onset scales with τ/n like the memorization time.Score divergence and recovery-based basin volume distinguish training from held-out samples in this latent-memorization regime.Source: §1 · p. 3
  • Cyclic denoising exposes latent memorization, raising the memorized fraction from at most 0.1% to over 30%, while also revealing degenerate attractors that fade during training.Degenerate attractors match no single training image, so residence under cycling alone does not establish memorization.Source: §1 · p. 3
  • Under exact stochastic reversal with the empirical score, a lower bound on repeated returns to a training point depends on cycling noise and its separation from competing points.This is a theoretical result under an idealized score.Source: §1 · p. 3
  • The study evaluates signatures on a Gaussian mixture, CelebA, and CIFAR-10 across optimizers, architectures, noise schedules, and training-set sizes, and tests Stable Diffusion v1.4 without retraining.The supplied passage states the evaluation scope but gives no Stable Diffusion detection metrics.Source: §1 · p. 3

2 METHOD

The method characterizes diffusion-model memorization through local score geometry, recovery-based basin volume, and trajectories under cyclic denoising. It also analyzes repeated recovery under an exact empirical score, with the guarantee depending on noise and separation from competing training points.

2.1 GEOMETRIC SIGNATURES OF THE ENERGY LANDSCAPE

  • Score divergence measures local contraction around a point, while basin volume is estimated from the neighborhood whose perturbed samples are recovered by deterministic DDIM denoising.The basin-volume estimate is an isotropic proxy, not the exact basin volume.Source: §2.1 · p. 4
  • More negative score divergence near a basin centre indicates stronger local concentration; normalized divergence captures the mean outward alignment of unit-normalized boundary scores.The reported statistics are evaluated at the final denoising step unless stated otherwise.Source: §2.1 · p. 4

2.2 CYCLIC DENOISING AS AN ENERGY LANDSCAPE PROBE

  • Each cyclic-denoising step partially noises the current sample and denoises it, with cycling amplitude setting exploration scale: small amplitudes favor basin residence and larger ones make transitions more likely.Residence onset tracks when consecutive-cycle similarity reaches a sustained crossing; an attractor is degenerate when it matches no single training image under the memorization criterion.Source: §2.2 · pp. 4–5

2.3 THEORETICAL ANALYSIS OF BASIN RESIDENCE UNDER CYCLIC DENOISING

  • Under exact empirical reversal, a trajectory starting within distance R of a training point has a lower-bounded probability of returning to it for M cycles, with the bound given by [1 − Ai(R)][1 − Ai(0)]^(M−1).The analysis assumes distinct training points and independent forward and reverse randomness across cycles.Source: §2.3 · p. 5
  • The residence bound strengthens with greater separation from competing points and weakens with greater cycling noise or a larger starting neighborhood; it covers residence after reaching a nearby training point, not reaching it from afar.For any fixed number of cycles, the lower bound approaches one as cycling variance tends to zero.Source: §2.3 · p. 5

3 EXPERIMENTS

Across training regimes, geometric signatures and cyclic denoising reveal training-sample structure before one-shot generation produces copies. The experiments also show that basin residence can occur without matching a training image and extend the analysis to Stable Diffusion v1.4.

3.1 EXPERIMENTAL SETUP

  • The experiments train models on a Gaussian mixture, CelebA, and CIFAR-10 and evaluate Stable Diffusion v1.4 without retraining; cyclic denoising uses repeated partial noising and denoising.Training configurations span multiple optimizers, architectures, schedules, and dataset sizes, with checkpoints spanning pre-generalization, generalization, and memorization.Source: §3.1 · p. 6

3.2 EVOLUTION OF GEOMETRIC SIGNATURES ACROSS TRAINING

  • On CelebA, score divergence separates training from held-out samples at τdiv = 65,000, 25,000 steps before the first nonzero fmem at τmem = 90,000.Basin volume separates in the same direction: its mean grows for training and generated samples and decreases for held-out samples; generated-sample divergence follows training-sample divergence with mean absolute difference 0.015 from τ = 5,000 onward.Source: §3.2 · p. 7
  • Across training-set sizes n ∈ {512, 1024, 2048}, replotted separation and fmem onsets collapse against τ/n, matching the O(n) scaling of τmem.The divergence signal is strongest at small noise, where it resolves individual basins.Source: §3.2 · p. 7

3.3 CYCLIC DENOISING DYNAMICS

  • At CelebA τ = 20,000, cycling at γ = 0.10 raises fmem from 0.1% in one-shot samples to above 30% by cycle 500; at other reported checkpoints, one-shot fmem is 0%.The experiments test whether cycling reaches basins that one-shot sampling misses on CelebA and CIFAR-10.Source: §3.3 · p. 7, Figure 3 · p. 8
  • At γ = 0.40 on CelebA, neither fmem nor S(k)cyc rises appreciably, while CIFAR-10 fmem at γ = 0.30 continues rising through cycle 500.The paper attributes the lack of residence at γ = 0.40 to perturbations exceeding the stability range of accessible basins; along trajectories, A1 often drops before persistent memorization classification and S(k)cyc later plateaus.Source: §3.3 · pp. 7–8
  • On CIFAR-10 at γ = 0.05, degenerate attractors hold 50.9% of trajectories at τgen, 16.0% at τ = 83,000, and 0.98% by τ = 200,000.Residence can occur while fmem stays near zero; the share of degenerate attractors falls as cycling fmem rises, and their appearance changes from stripes or colour patterns to some recognizable but nonmatching objects.Source: §3.3 · p. 8

3.4 EXPERIMENTS ON STABLE DIFFUSION

  • On Stable Diffusion, chains can recover a training image from a nonmatching initial image, while arrival varies with cycling amplitude and seed and can be transient.Across six chains, SSCD(x, p) and ΔA1 change together at arrival and departure; across prompts, memorized cases show rising seed agreement and increasingly negative ΔA1, unlike non-memorized prompts and plain-English controls.Source: §3.4 · pp. 8–9
  • At 1% FPR, cycled ΔA1 reaches TPR 0.866 at c60 versus 0.526 at c0, while the single-shot detector reaches 0.838 on the same prompts and seeds.Its AUC rises from 0.811 at c0 to 0.944 at c60; against LAION negatives, cycled ΔA1 reaches TPR 0.820 versus 0.740 for the single-shot detector, which remains stronger against COCO, Lexica, and random-token negatives.Source: §3.4 · p. 9

4 CONCLUSION

The conclusion frames memorization as structure in the learned energy landscape that can precede visible copies, while the extended related work distinguishes this training-time analysis from prior studies of data regimes, trained-model detectors, and cyclic-denoising dynamics.

4 CONCLUSION

  • Localized basins form around training examples before one-shot copies appear, and cycling can reach those basins; residence alone is insufficient evidence of memorization because degenerate attractors also occur.The paper reports these behaviors across a Gaussian mixture, CelebA, CIFAR-10, and off-the-shelf Stable Diffusion v1.4.Source: §4 · p. 9
  • The authors frame the findings as relevant to future work on privacy auditing, training-data protection, and mitigating unintended memorization, while noting that experiments use public datasets and models in controlled research settings.The appendix is identified as the location of limitations and future work.Source: §4 · p. 9, ETHICS STATEMENT · p. 10

A NOTATION

B EXTENDED RELATED WORKS

  • Bonnaire et al. (2025) and Favero et al. (2025) describe O(n) training-time scaling for memorization-related events; the related work notes that training and test losses can separate while fmem remains near zero.Both works motivate early stopping.Source: B EXTENDED RELATED WORKS · p. 13
  • Prior geometric studies vary data regimes or detect trained-model signatures, whereas this paper follows basin geometry during training for a fixed model and dataset.The cited studies include basin-volume comparisons by Pham et al. (2025) and score-, sharpness-, anisotropy-, or p-Laplacian-based detectors.Source: B EXTENDED RELATED WORKS · pp. 13–14
  • Kang et al. (2026) analyze cyclic-chain exploration and ergodicity, while Sharma & Martiniani (2026) use cyclic denoising for extraction; the stated gap is how its behavior changes as memorization develops during training.Source: B EXTENDED RELATED WORKS · pp. 14–15

C LIMITATIONS AND FUTURE WORKS

The paper identifies limits on where its findings and theoretical guarantees apply, while noting that cyclic denoising can expose training-associated samples and may be used for privacy attacks. Its appendix reviews diffusion-model basics and frames a finite-cycle residence guarantee under an exact empirical score.

C LIMITATIONS AND FUTURE WORKS

  • The study of training-time memorization covers small 32 × 32 datasets trained from scratch; whether the same signatures hold at web scale is untested.Stable Diffusion is evaluated only at one released checkpoint, and linking a cycling basin to training data requires the training set or candidate images.Source: C LIMITATIONS AND FUTURE WORKS · p. 15

D BROADER IMPACT

  • Cyclic denoising may expose training-associated samples for model extraction or privacy attacks, so the authors recommend access controls and responsible evaluation.The paper frames these methods primarily as diagnostic tools and argues that reliability assessment should include learned geometry and dynamical stability.Source: D BROADER IMPACT · pp. 15–16

E.1 DIFFUSION MODELS

  • Diffusion models reverse progressive corruption by learning a score field that guides noisy samples toward data.The appendix describes forward Gaussian noising and reverse denoising, with sampling understood as dynamics governed by the learned score.Source: §E.1 · p. 16

F.1 BACKGROUND

  • Under the exact empirical score, cycling from sufficiently near an isolated training point recovers it and gives high-probability residence over any prescribed finite horizon when noise is sufficiently small.The guarantee concerns clean endpoints, not permanent trapping or discovery from distant initializations; increasing noise weakens its bounds.Source: §F.1 · p. 17

F.2 PROOF OF THEOREM 1

The proof bounds one-cycle recovery under exact empirical-score denoising, then uses the Markov property and fresh randomness to bound repeated residence at a training point. The resulting guarantee depends on separation, initialization, and cycling noise.

F.2 PROOF OF THEOREM 1

  • Each cycle adds fresh forward noise and samples a clean endpoint from the exact empirical posterior, making the clean endpoints a time-homogeneous Markov chain on the training set.The endpoint law is posterior sampling, not the posterior mean or an arbitrary finite-step reverse sampler.Source: §F.2 · p. 18
  • The recovery bound weakens as cycling noise increases, while greater separation from competing samples supports reliable recovery from a sufficiently close initialization.The theorem’s competitor sum accounts for both intersample distances and the number of competing points.Source: §F.2 · p. 18
  • For an initial state within radius R of training point x_i, the probability that M clean cycle endpoints all equal x_i is at least [1 − A_i(R)][1 − A_i(0)]^(M−1).The condition is 4R < min_{j≠i} d_ij; the bound applies with exact empirical-score reversal and fresh independent randomness each cycle.Source: §F.2 · p. 18
  • The proof first bounds recovery of a competing training point, sums those bounds over competitors, and then applies the Markov property to obtain finite-cycle residence.After the first cycle, every clean endpoint belongs to the training set, and subsequent transitions use the same cycle law.Source: §F.2 · pp. 18–19

F.3 EXPERIMENTAL VERIFICATION

Exact empirical cycling supports the theorem’s quantitative residence prediction, and a fully memorized CelebA checkpoint recovers proximity to training targets more reliably than an early checkpoint. The learned-model residence rates depend strongly on the reconstruction tolerance.

F.3 EXPERIMENTAL VERIFICATION

  • At γ = 0.05, measured 500-cycle residence averaged 66.48%, versus a 66.01% product estimate and a 45.25% mean lower bound.At γ = 0.10, the corresponding values were 9.72%, 9.57%, and 3.06%, supporting the quantitative prediction in the tested low-noise regime.Source: §F.3 · p. 20
  • At 0.10∆i tolerance, 86.88% of late-checkpoint CelebA trajectories remained within the target neighborhood through 100 cycles, versus no observed early-checkpoint survivors.At the stricter 0.05∆i tolerance, late-checkpoint residence was 2.81%; the late checkpoint’s mean relative distance was about 0.07∆i after one and 100 cycles.Source: §F.3 · p. 20
  • The fully memorized checkpoint recovered and sustained proximity to training targets, whereas the low-memorization checkpoint moved away under the same perturbations and cycling noise.The learned-model comparison supports interpreting memorized training images as locally stable basins, while reconstruction tolerance qualifies approximate recovery.Source: §F.3 · p. 20

G.1 RESULTS ON THE GMM

On the GMM, score divergence and basin volume separate training and generated samples from held-out samples as memorization develops. Cyclic denoising exposes training-associated basins, but perturbation size determines whether trajectories retain their starting point.

G.1 RESULTS ON THE GMM

  • Training and generated samples’ score-divergence curves fall below held-out curves, while their basin volumes grow by several orders of magnitude; the signatures separate later for larger n and align when plotted against τ/n.Generated curves follow training curves in both measures.Source: §G.1 · pp. 20–21, Figure 6 · p. 21
  • At τ = 97,466, 100 cycles at γ ∈ [0.02, 0.06] raise fmem from a one-shot 4.3% to about 20%; at τ = 161,268, γ = 0.02 raises it from 45% to 94%.At γ ≥ 0.16, fmem stays near its one-shot value; in the generalized regime, no basin is reached and training points are not retained.Source: §G.1 · p. 21, Figure 7 · p. 22
  • After 100 cycles at γ = 0.02, starting-sample cosine similarity rises from 0.75 at τ = 42,107 to 1.00 at τ = 864,044, while at γ = 0.35 it falls to about zero despite fmem near 85%.At large amplitude, trajectories continue landing on training points but not the one they started from.Source: §G.1 · p. 21
  • After memorization begins, score-divergence magnitude grows by two orders of magnitude and the landscape breaks into strongly negative-divergence regions around individual training points.At small γ trajectories stay near their start; at τ = 864,044 and γ = 0.10, one trajectory enters such a region and remains there, while large γ produces jumps between distant regions.Source: §G.1 · pp. 21–22, Figure 8 · p. 23

G.2 CYCLIC DENOISING

Repeated cyclic denoising can settle into visibly degenerate configurations without meeting the training-image memorization criterion. The accompanying methods distinguish basin residence from memorization and specify how each is measured.

G.2 CYCLIC DENOISING

  • Screened non-memorized degenerate-attractor trajectories on CIFAR-10 decline from 50.87% at τgen = 49,500 to 0.98% at τ = 200,000.At τgen, the fraction falls from 50.87% at γ = 0.05 to 2.54% at γ = 0.10, with none passing at γ = 0.20 or 0.30.Source: §G.2 · p. 23
  • Repeated cycling produces saturated blocks, stripes, monochromatic fields, or lost facial detail even when trajectories fail the memorization screen.On CIFAR-10, six selected examples show substantial visual degeneration despite fmem(500) = 0%.Source: §G.2 · pp. 23–24, Figure 10 · p. 25
  • CelebA examples vary across checkpoints, from darkened or washed-out faces to outputs retaining facial structure; displayed trajectories can remain non-memorized.The reported population estimates are distinct from prevalence among visually selected examples.Source: §G.2 · pp. 24, 27
  • Cycling can erase identification with the starting training image; later basin residence involves only a subset of training samples that become attractors.The trajectories may move into other, stronger attractor basins, depending on cycling amplitude.Source: §G.2 · p. 24, Figure 13 · p. 28

G.3.1 MEMORIZATION FRACTION

  • The memorization fraction is the percentage of evaluated samples meeting a nearest-neighbor criterion based on relative proximity to their two nearest training examples.The criterion does not require exact equality with a training image.Source: §G.3.1 · p. 30

G.3.2 CYCLIC SIMILARITY

  • Cyclic similarity is cosine similarity between consecutive saved states in normalized LPIPS-VGG feature space; a sustained high level is consistent with stable basin residence, not proof of memorization.Degenerate attractors can also yield high similarity.Source: §G.3.2 · p. 30

G.3.3 BASIN VOLUME

  • The basin-volume estimate uses the last tested noise amplitude at which at least 9 of 10 perturbed copies recover the target, then converts a fresh perturbation’s displacement into an isotropic volume proxy.The fresh perturbation measures displacement but is not separately tested for recovery.Source: §G.3.3 · pp. 30–31

G.3.4 SCORE DIVERGENCE AND ITS ESTIMATION

  • Score divergence is the unscaled mean outward learned-score flux on a sphere, calibrated to 7.5% of median training nearest-neighbor distance; magnitudes do not share scaling across dimensions or radii.The same calibrated radius is used for training, held-out, and generated samples within an experiment.Source: §G.3.4 · p. 32

G.4 MEMBERSHIP INFERENCE FROM SCORE DIVERGENCE

The section turns normalized score divergence into a membership-inference score and evaluates how well it separates training from held-out samples. As memorization develops, training and generated samples shift together away from test samples, making the score useful before one-shot outputs reflect memorization.

G.4 MEMBERSHIP INFERENCE FROM SCORE DIVERGENCE

  • The membership score is sign-flipped normalized score divergence at one small noise amplitude; inward-pointing scores in sharp basins yield higher membership scores.The score averages alignment between unit-normalized boundary scores and outward normals; its original range is [−1, 1].Source: §G.4 · p. 33
  • Generated samples can serve as a reference distribution for members, so the procedure requires neither training-set access nor labels..Source: §G.4 · p. 34
  • The evaluation compares equal numbers of true members and non-members, reporting ROC AUC and TPR/FPR at 5% and 1% false-positive budgets.Operating points are read directly from the ROC curve without choosing a threshold.Source: §G.4 · p. 34
  • AUC rises from close to chance to 1.0 in the memorized regime, while TPR at 1% FPR follows the same trend.The attack becomes effective when geometric signatures first separate, before the generated-output memorization fraction reflects memorization.Source: §G.4 · p. 34

G.5 OTHER TRAIN RESULTS

The other-train-results figures examine training-size effects in CelebA and CIFAR-10, while the landscape visualization projects score divergence onto a data-informed two-dimensional plane. The resulting views contrast broad generalized landscapes with sharp wells around training samples in the memorized regime.

G.5 OTHER TRAIN RESULTS

  • CelebA runs show a consistent lag between the train–test score-divergence split and the onset of the memorization fraction.The figure also plots FID, memorization fraction, train/test divergence, and basin-volume proxies across training sizes.Source: Figure 17 · p. 35
  • CIFAR-10 DiT-S runs plot FID and memorization ratio across training sizes of 2,048, 4,096, and 8,192.The runs use Adam and a cosine noise scheduler.Source: Figure 18 · p. 36

G.6 VISUALIZING THE SCORE-DIVERGENCE LANDSCAPE

  • The visualization uses the top two principal components of sampled points and denoising trajectories to define the plane on which score divergence is evaluated.The plane is intended to capture variation in the sampled region rather than an arbitrary slice.Source: §G.6 · p. 36
  • The projected landscape is broad and featureless during generalization, then develops sharp wells around individual training samples during memorization.Negative divergence values appear as wells, while near-zero values appear as flat regions.Source: §G.6 · p. 36

G.7 HOW THE SCORE FUNCTION EVOLVES ACROSS TRAINING REGIMES

The figures show how basin structure and normalized score divergence vary with noise amplitude across training regimes. As memorization proceeds, the GMM basins sharpen and the divergence response separates from the generalized-regime pattern.

G.7 HOW THE SCORE FUNCTION EVOLVES ACROSS TRAINING REGIMES

  • As γ decreases, the GMM landscape sharpens from one merged attractor into two separated basins, with clearer localization in the memorized regime.The generalization window already shows some attractor formation.Source: Figure 19 · p. 37
  • In the generalized regime, normalized divergence curves are shallow and clustered across γ; in the memorized regime, they are strongly negative at small γ and rise toward zero as γ increases.The effect deepens with training in the memorized regime; the figure covers CelebA and the GMM.Source: Figure 20 · p. 38

H FINER EXPERIMENT DETAILS

The appendix details the datasets, models, sampling procedures, and evaluation settings used for the experiments. It also specifies the Stable Diffusion prompt cohorts and the paired bootstrap procedure used to quantify uncertainty.

H FINER EXPERIMENT DETAILS

  • The experiments train models from scratch on a Gaussian mixture, CelebA, and CIFAR-10, then evaluate checkpoints spanning pre-generalization, generalization, and memorization using DDIM samples.The Stable Diffusion evaluation instead uses an off-the-shelf checkpoint without retraining or fine-tuning.Source: H FINER EXPERIMENT DETAILS · pp. 38–39
  • The synthetic experiment uses an equally weighted two-component Gaussian mixture with an analytically available population score, while CelebA uses 32 × 32 grayscale images and a 16-million-parameter DDPM U-Net.The GMM is eight-dimensional; CelebA has no data augmentation.Source: H FINER EXPERIMENT DETAILS · p. 38
  • CIFAR-10 experiments use native-resolution RGB images and unconditional DiT-S/2 models; the specified runs vary training-set size and use Adam with a cosine noise schedule.The figure covers sample sizes 2,048, 4,096, and 8,192.Source: H FINER EXPERIMENT DETAILS · pp. 38–39

I DETECTION ON STABLE DIFFUSION

  • Stable Diffusion chains start from 50-step DDIM samples and apply 200 cycles of partial noising and 10-step denoising, with four seeds per prompt.The Stable Diffusion figure tracks SSCD and conditional-unconditional divergence, and compares prompt groups across γ.Source: H FINER EXPERIMENT DETAILS · p. 39, Figure 21 · p. 40

I.1 DATA

  • Prompt cohorts include 71 completely memorized, 113 non-memorized, and 150 partially memorized prompts, plus 150 plain-English prompts without training-image matches.The detection benchmark also uses 500 memorized prompts as positives and 2,000 negatives drawn evenly from four sources.Source: H FINER EXPERIMENT DETAILS · p. 39, §I.1 · p. 40

I.2 UNCERTAINTY

  • Uncertainty intervals use a stratified percentile bootstrap with 4,000 paired resamples, reusing the same indices across cycles and statistics.Positive and negative prompts are resampled independently while preserving the 500/2,000 split.Source: §I.2 · pp. 40–41

I.3 RESULTS BY CYCLE

Raw ∆A shifts strongly for memorised prompts over 60 cycles while remaining near zero for non-memorised prompts. The reported paired ∆A differences cover cycle counts and comparison with SDN.

I.3 RESULTS BY CYCLE

  • At γ = 0.9, the paired ∆A difference between c = 60 and c = 40 is +0.016, with 95% CI [−0.010, +0.041].Figure 22 plots AUC and TPR@1%FPR against cycle count with bootstrap bands.Source: Table 5 · p. 41, Figure 22 · p. 41

I.4 COMPARISON

  • The comparison uses the same prompts and seeds across rows.Source: §I.4 · p. 41
  • At c = 60 and γ = 0.9, ∆A minus SDN is −0.0456 for AUC (95% CI [−0.0633, −0.0287]) and +0.0265 for TPR@1%FPR (95% CI [−0.0260, +0.0841]).Figure 23 shows ROC and precision–recall curves at c = 60; class balance is 1:4.Source: Table 6 · p. 41, Figure 23 · p. 42

I.5 RAW DIVERGENCE

  • Memorised prompts’ raw ∆A moves from −1.24 × 105 at c = 0 to −3.12 × 105 at c = 60, while non-memorised prompts stay within 0.03 × 105 of zero.Figure 24 reports population means with 95% intervals.Source: Figure 24 · p. 42

I.6 BY NEGATIVE SOURCE

  • Each Table 7 row scores the 500 positives against one negative source.Source: Table 7 · p. 42
Loading 2610.11670v1…