PaperlayerView exact revision on arXiv

Source-linked AI summary

Valid Early Detection of Memorization in Diffusion Models

Yixiao Jing, Chia-Yu Hsu, Milad Hoseinpour, Zekai Zhang

arXiv:2610.34617v1cs.LGstat.ML

TL;DR

Prompt-free detectors for unconditional diffusion models often require a preselected denoising time, while sequential monitoring raises trajectory-level false-alarm control concerns. This paper combines sequential monitoring with split conformal calibration, and finds it improves the power–timing tradeoff over fixed-time detection; trajectory-level calibration enables earlier detection than Bonferroni while maintaining comparable power.

  • Problem

    Prompt-free detection for unconditional diffusion models has typically used preselected timesteps, while sequential monitoring requires control of false alarms across the trajectory.

    Source: §1 · p. 2

  • Method

    The paper combines sequential monitoring with split conformal calibration using per-step Bonferroni thresholds or calibration of the trajectory’s maximum score.

    Source: §1 · p. 2, §2.2 · p. 3

  • Results

    Sequential monitoring improves the power–timing tradeoff over fixed-time detection, and trajectory-level max calibration enables earlier detection than Bonferroni with comparable power.

    Source: §5 · p. 6

  • Takeaways & Limitations

    Calibrating the monitoring event at the trajectory level provides adaptive alarm times while controlling trajectory-level false alarms under the stated validity assumptions.

    Source: §1 · p. 2, §5 · p. 6

    Evaluation is limited to an unconditional CIFAR-10 EDM with well-separated endpoint-similarity thresholds and requires an auxiliary causal scoring model trained on labeled trajectories.

    Source: §5 · p. 6

Abstract

from arXiv · show

Diffusion models can sometimes reproduce examples from their training data, a phenomenon known as memorization. Existing memorization detection methods for unconditional diffusion models typically operate at a pre-selected timestep and therefore cannot adapt the detection time to the evolving denoising trajectory. Sequential monitoring enables adaptive detection but repeated testing across timesteps complicates trajectory-level false-alarm control. We study two ways of combining split conformal calibration with sequential monitoring for prompt-free memorization detection: per-step Bonferroni calibration and direct trajectory-level calibration of the maximum memorization score. The former controls repeated testing by splitting the false-alarm budget across timesteps, whereas the latter calibrates the event of ever crossing a threshold directly through the trajectory-level maximum. We evaluate this formulation on an unconditional CIFAR-10 EDM using two complementary per-step statistics based on geometry and representation spikiness. Experiments show that sequential monitoring improves the power-timing tradeoff over fixed-time detection. Compared with Bonferroni calibration, trajectory-level calibration achieves comparable detection power while using the false-alarm budget less conservatively and enabling earlier detection at higher noise levels.

1 Introduction

Memorization can compromise the novelty and privacy of diffusion-model outputs, while prompt-free detectors for unconditional models have generally relied on fixed denoising times. This work combines split conformal calibration with sequential monitoring to adapt alarm times while controlling trajectory-level false alarms.

1 Introduction

  • Memorization can reduce the novelty and privacy of generated content, despite diffusion models’ ability to generate diverse, novel images.The cited work describes memorization as reproducing training samples.Source: §1 · p. 2
  • Research suggests memorization signals are most pronounced at an intermediate denoising stage, while their effects become apparent near the end.This work motivates looking for informative statistics before those effects become apparent [Dodson et al., 2026, Kaiser and Kollmann, 2026; Biroli et al., 2024].Source: §1 · p. 2
  • Prior prompt-free detectors require a fixed noise level or timestep and typically operate relatively late in denoising.Prompt-based approaches can detect early but do not apply to unconditional diffusion; early detection may enable mitigation before generation ends.Source: §1 · p. 2
  • Sequential monitoring adapts detection time to individual trajectories but introduces repeated-testing effects that complicate false-alarm control.Earlier work monitored similarity through denoising with time-dependent thresholds but did not statistically control trajectory-level false alarms [Chen et al., 2024].Source: §1 · p. 2
  • The paper combines split conformal calibration with sequential monitoring, comparing fixed-time, per-step Bonferroni, and trajectory-level maximum-score calibration.It establishes finite-sample false-alarm control for all three strategies.Source: §1 · p. 2

2 Problem Formulation

The paper formulates prompt-free memorization detection as sequential testing over denoising trajectories, assigning generalized and memorized labels using endpoint similarity thresholds. It uses per-step geometry and representation statistics with a causal scoring model to estimate memorization from the observed history.

2.1 Diffusion Trajectories and Memorization

  • A denoising trajectory is indexed as x1:T, with x1 the initial noisy sample and xT the final image; experiments use an 18-step EDM sampler.Noise levels decrease from σ1 = 80.0 to σT = 0.002, so higher noise corresponds to an earlier, less-denoised stage.Source: §2.1 · p. 2
  • Detection is framed as sequential testing of generalized versus memorized trajectories, labeled by endpoint SSCD cosine similarity below 0.5 or above 0.9.The intermediate similarity band is excluded, and no guarantee is claimed for it.Source: §2.1 · pp. 2–3

2.2 Detection Statistics and Memorization Scoring

  • Two per-step scalar statistics capture distinct mechanisms, so the framework is not tied to a single statistic.The generic statistic at timestep t is denoted Mt.Source: §2.2 · p. 3
  • The trF statistic is the trace of the Jacobian of the raw EDM network output with respect to its preconditioned input.It is motivated by a density-sharpness characterization of memorization [Jeon et al., 2025].Source: §2.2 · p. 3
  • StD measures representation spikiness using channel-wise standard deviation after spatial global-max pooling of an intermediate representation.The pooled representation is ht at timestep t.Source: §2.2 · p. 3
  • Labeled trajectories are split into fitting, validation, and test sets, with held-out generalized test trajectories used for conformal calibration.False alarms and detection power are evaluated on the remaining generalized and memorized test trajectories, respectively.Source: §2.2 · p. 3
  • A causal GRU maps statistics observed through timestep t to a memorization score using only information available up to that time.It is trained with binary cross-entropy against the final label, and its score represents the probability that the trajectory ends memorized given the observed statistics.Source: §2.2 · p. 3

3 Valid Sequential Detection

The paper compares fixed-time calibration with two sequential conformal strategies: per-timestep Bonferroni thresholds and a common threshold calibrated on each trajectory’s maximum score. Under exchangeability and a scoring function fixed before calibration, all three control the probability of a false alarm over the trajectory.

3.1 Calibration Strategies

  • Trajectory-level max calibration treats ever crossing a common threshold as one statistic, the maximum score across the trajectory.The alarm time is the first timestep exceeding that common threshold; no alarm is represented by τ = +∞.Source: §3.1 · pp. 3–4
  • Fixed-time conformal detection calibrates the score at a preselected timestep t⋆ using the null calibration scores at that timestep.The detector alarms at t⋆ when the test trajectory’s score exceeds the calibrated threshold.Source: §3.1 · p. 3
  • Bonferroni sequential calibration sets each timestep’s significance level to α/T and applies the corresponding per-step threshold.This distributes the target trajectory-level false-alarm level across T timesteps.Source: §3.1 · p. 4

3.2 Validity

  • All three strategies control the probability of ever falsely flagging a generalized trajectory at or below α under exchangeability and a scoring function fixed before calibration.The proof uses empirical-quantile exceedance control; Bonferroni then applies a union bound across timesteps.Source: §3.2 · p. 4

4 Experiments

Sequential monitoring improves the power–timing tradeoff over fixed-time detection, and trajectory-level max calibration generally enables earlier decisions than Bonferroni while maintaining comparable power. The experiments assess detection timing, cumulative detection, and sequential calibration on an unconditional CIFAR-10 EDM.

4.1 Evaluation Metrics

  • Detection timing is reported as mean decision noise under H1, with larger values indicating earlier detection; cumulative detection probability at the final step equals overall power.The evaluation also estimates false-alarm probability on generalized trajectories and detection power on memorized trajectories.Source: §4.1 · p. 4

4.2 Power–Timing Tradeoff Across Settings

  • Across all six settings, sequential calibration achieves high detection power at relatively high mean decision noise levels, corresponding to earlier denoising stages; max calibration is generally earlier than Bonferroni, particularly for StD.Sequential monitoring attains high power while deciding earlier than fixed-time procedures with comparable power.Source: §4.2 · pp. 4–5, Figure 2 · p. 5

4.3 Cumulative Detection Probability Along the Denoising Trajectory

  • For StD at α = 0.05, max calibration accumulates detections at higher noise levels than Bonferroni, while both eventually achieve near-perfect detection power.Fixed-time procedures cannot detect a trajectory before reaching their pre-selected noise level; sequential monitoring adapts alarm timing to each trajectory.Source: Figure 3 · p. 5, §4.3 · pp. 5–6

4.4 Sequential Calibration Strategies

  • At α = 0.05, trajectory-level max calibration uses more false-alarm budget and detects earlier than Bonferroni while maintaining comparable power; StD mean decision noise rises from 4.900 to 7.678.Bonferroni empirical FPRs were 0.021 for trF and 0.017 for StD; nearby timestep scores are strongly dependent, so per-step crossing events overlap. Bonferroni requires ncal ≥ 359 (the experiment used 383), versus ncal ≥ 19 for trajectory-level calibration.Source: Table 1 · p. 6, §4.4 · p. 6

5 Conclusion

The paper formulates prompt-free early memorization detection as sequential testing and finds that sequential monitoring improves the power–timing tradeoff over fixed-time detection. Its evaluation is limited to an unconditional CIFAR-10 EDM with well-separated endpoint similarity thresholds.

5 Conclusion

  • On an unconditional CIFAR-10 EDM, sequential monitoring improves the power–timing tradeoff over fixed-time detection; trajectory-level max calibration enables earlier detection than Bonferroni with comparable power.The result is under exchangeability and a scoring function fixed before calibration; the procedures provide finite-sample false-alarm control.Source: §5 · p. 6
  • The evaluation is limited to an unconditional CIFAR-10 EDM and uses well-separated endpoint similarity thresholds to distinguish clearly memorized from generalized trajectories.The approach also requires an auxiliary causal scoring model trained on labeled trajectories; future work includes larger, more heterogeneous models and less separated regimes.Source: §5 · p. 6

A.1 Per-step Statistics

The per-step statistics capture geometry and representation spikiness, while separate GRU scoring models process each statistic over the denoising trajectory.

A.1 Per-step Statistics

  • trF uses the raw EDM output and preconditioned input; under EDM preconditioning, it is affinely related at each noise level to the score-Jacobian trace, equivalently the log-density Laplacian.The trace is estimated with Hutchinson’s estimator using 10 Rademacher probes.Source: §A.1 · p. 9
  • For StD, following Zhang et al. [2026], the activation at 8x8_block3.norm0 is used as ht in Eq. 4; after spatial global-max pooling, channel-wise standard deviation is computed.Source: §A.1 · p. 9

A.2 Scoring Model

  • Each statistic has a separate one-layer GRU scoring model with hidden dimension 64 and a linear head with sigmoid activation.Its input concatenates the scalar statistic with a 16-dimensional Fourier time embedding of log σt.Source: §A.2 · p. 9

A.3 Experimental Setup

The setup evaluates prompt-free detection on trajectories from an unconditional CIFAR-10 EDM, labels clearly generalized and memorized outputs using SSCD similarity, and tests calibration on held-out trajectories. Its exchangeability argument relies on common sampling and labeling procedures and a scoring model fixed before testing.

A.3 Experimental Setup

  • Experiments use a pretrained unconditional CIFAR-10 EDM checkpoint, with trajectories sampled using the deterministic 18-step Heun sampler.The model was trained on the standard 50,000-image training set augmented with 100 duplicated targets.Source: §A.3 · p. 9
  • Pretrained SSCD similarity to training images defines labels: scores below 0.5 are generalized, scores above 0.9 memorized, and intermediate trajectories are excluded.Among 25,000 trajectories, 2,881 were labeled memorized, 5,104 generalized, and 17,015 ambiguous.Source: §A.3 · p. 9
  • After ambiguous trajectories are removed, 7,985 remain and are split by trajectory into fitting, validation, and test sets at 70%/15%/15%, grouping memorized trajectories by nearest training example.The split sizes are 5,572, 1,198, and 1,215; conformal thresholds use held-out generalized calibration trajectories, while FPR and TPR are evaluated on generalized and memorized test trajectories, respectively.Source: §A.3 · p. 10

A.4 Exchangeability by Construction

  • Exchangeability is justified by common sampling and labeling procedures and by applying a scoring map fixed using disjoint fitting and validation data to each trajectory.The trF probes are independently drawn across trajectories and independently of sampling seeds.Source: §A.4 · p. 10

B Sequential Calibration Across False-Alarm Levels

Across the two additional false-alarm levels, trajectory-level max calibration uses more of the available false-alarm budget and shifts decisions toward higher-noise stages than Bonferroni calibration.

B Sequential Calibration Across False-Alarm Levels

  • At α = 0.10 and α = 0.20, Bonferroni has lower empirical FPR, while trajectory-level max uses more of the budget, maintains high detection power, and shifts decisions to higher-noise stages.Table 2 reports FPR, TPR, and mean decision noise level with standard deviations over five random splits.Source: B Sequential Calibration Across… · p. 10, Table 2 · p. 11

C Proofs

The proofs use exchangeability and a scoring function fixed before calibration to establish the conformal bounds for fixed-time and sequential procedures. The sequential arguments treat Bonferroni alarms as a union of timestep events and trajectory-level alarms through a maximum statistic.

C Proofs

  • The proof setup places alarm times in the finite horizon or at +∞ and uses strict rejection inequalities so conformal bounds remain valid with ties.The global proof discussion assumes exchangeability.Source: C Proofs · p. 11

C.1 Validity of Fixed-Time Conformal Detection

  • For a preselected timestep, the fixed-time validity argument uses exchangeable null trajectories and a scoring function fixed before calibration.The passage states these conditions before giving the conformal bound.Source: §C.1 · p. 11

C.2 Validity of Bonferroni Sequential Detection

  • Bonferroni sequential validity treats an alarm by time T as the union of timestep-specific threshold-crossing events.The proof invokes exchangeability at each timestep and bounds the combined alarm event through those individual events.Source: §C.2 · pp. 11–12

C.3 Validity of Trajectory-Level Max Calibration

  • For trajectory-level max calibration, the same fixed score and maximum operator are applied to every trajectory, preserving exchangeability for the maximum statistic.The sequential alarm event is expressed through that trajectory-level maximum.Source: §C.3 · p. 12

C.4 Comparison of Bonferroni and Trajectory-Level Calibration

The comparison explains why direct calibration of the trajectory maximum can be less conservative than Bonferroni and can require fewer null calibration trajectories, particularly when timestep events overlap.

C.4 Comparison of Bonferroni and Trajectory-Level Calibration

  • Strong dependence between nearby timestep scores can make crossing events overlap, leaving slack in Bonferroni’s union bound and lowering realized trajectory-level FPR below α.Directly calibrating the trajectory-level maximum avoids splitting the false-alarm budget across timesteps.Source: §C.4 · pp. 12–13
  • At α = 0.05 and T = 18, the calibration-size bounds are 359 for per-step Bonferroni and 19 for trajectory-level maximum calibration.The maximum-calibration requirement is independent of horizon T.Source: §C.4 · p. 13

Related papers

Loading 2610.34617v1…