Cyclic denoising exposes latent memorization in diffusion models before any copy appears
A new IIT Delhi-led preprint reports that diffusion checkpoints encode training samples in the geometry of their score landscape while one-shot copy tests still read clean — and that a repeated partial-noise/denoise probe surfaces the state.
Diffusion models can memorize training images in the geometry of their learned score field before any generated copy appears. A team from IIT Delhi, JNCASR, and TCS Research reports this "latent memorization" in an arXiv preprint (2610.11670, cs.LG, 8 Oct 2026), along with a probe that surfaces it: at a CelebA checkpoint where one-shot generation produced copies for only 0.1% of samples, 500 rounds of partial noising followed by denoising raised the memorized fraction above 30%.
What shipped
The paper (full text) is 42 pages and ships no code — a research result, not a tool. The result is a new auditing capability: detecting that a diffusion checkpoint has memorized training data before one-shot sampling reproduces any of it.
The state being detected. Diffusion models train a neural score — the gradient of the log-density of noised data — which acts as a force field steering samples from noise back to data. That score defines a time-dependent energy landscape E_t(x) = −log p_t(x), whose local minima are the centers of basins: regions where sampled trajectories get pulled toward a single low-energy point. The authors report that as training proceeds, sharp, localized basins form around individual training samples and separate them from held-out samples. They measure this with two quantities — score divergence (more negative means stronger local contraction toward a point) and a recovery-based estimate of basin volume (how large a neighborhood can get before it stops denoising back to its target) — and both separate training from held-out samples before one-shot output contains a single near-copy.
The onset of these geometric signatures scales with training time divided by dataset size n — the same O(n) scaling already known for the memorization time τ_mem, the point beyond which generated samples reproduce training examples (Bonnaire et al. 2025, Favero et al. 2025, cited in the paper). Concretely, in one CelebA run with n=1,024, the held-out loss bottoms out at step 45,000, score-divergence curves for training versus held-out samples separate at step 65,000, and the first nonzero one-shot memorization appears only at step 90,000 — a 25,000-step gap during which the standard copy test reads "clean" (page-by-page reading).
The probe. Cyclic denoising (CD) repeatedly applies partial noising and then denoising: each cycle perturbs the current sample within a neighborhood set by noise amplitude γ (a normalized timestep, not a fixed standard deviation), denoises it back, and feeds the result into the next cycle. Where a single draw from pure noise rarely lands inside a training-sample basin, cycling keeps a trajectory inside a basin long enough to settle in it. The authors prove a recovery bound: under the exact empirical score (the score of the finite training set convolved with Gaussian noise), cycling started near an isolated training sample recovers it over any finite number of cycles with high probability, with the bound controlled by the cycling noise and the sample's separation from competing training samples.
The numbers. All figures are the authors', as reported in the preprint. The paper defines "memorized" as a nearest-neighbor criterion: a sample counts when (distance to nearest training example) ÷ (distance to second-nearest) < 1/3. Then:
- CelebA: cycling recovered training images from checkpoints whose one-shot samples contained no copies. At a checkpoint with 0.1% one-shot copies, 500 cycles pushed the memorized fraction above 30% (one run with n=4,096, Adam, γ=0.10).
- Stable Diffusion v1.4, off the shelf, no retraining: the cycled conditional–unconditional score-divergence gap separates memorized from non-memorized prompts with AUC 0.944 and TPR 0.866 at 1% FPR — flagging ~87% of memorized prompts while mislabeling only 1% of clean ones.
- Scope: a Gaussian mixture, CelebA, and CIFAR-10, across two optimizers, three architectures, two noise schedules, and a range of training-set sizes.
CD also reveals degenerate attractors — stable basins that match no single training image. In a CIFAR-10 run (n=8,192, γ=0.05) they appear in 50.9% of trajectories at step 49,500 and fade to 16.0% by step 83,000. Residence in a basin alone does not establish memorization.
Why it matters
Standard memorization audits are post-hoc. Generate-and-filter extraction attacks (Carlini et al. 2023) and nearest-neighbor copy analysis (Somepalli et al. 2023) only fire once one-shot generation already produces near-copies. Prior geometric detectors (score-conditioning differences, Hessian sharpness, anisotropy) were validated only on models whose memorization was already visible in generated samples. And the training-time analyses that do predict memorization (τ_gen/τ_mem) require the training curve, which a released checkpoint rarely ships with.
This work changes the audit question from "what does the model output?" to "what is the geometry of what it learned?" The CD probe runs on the checkpoint alone, no training curve and no retraining. For anyone releasing, validating, or buying diffusion checkpoints, that is the difference between discovering a training-data reproduction problem after release and checking for it beforehand — the question copyright, privacy, and sensitive-data exposure in image models turns on. It also answers the practical question "when did it start memorizing?": the geometric footprint precedes the output copies, so copy tests at any point in the generalization window [τ_gen, τ_mem] can look clean while the landscape is already memorizing.
Caveats
- This is an unreplicated preprint; every number above is what the authors report, not an independent measurement.
- The headline 0.1% → >30% is one CelebA run at one noise amplitude — a demonstration, not a guarantee.
- The proof assumes the exact empirical score, not the learned score in the latent regime the paper is actually about, and it bounds recovery only for cycles that already start near the training point. It does not explain how a distant start finds the basin.
- The audit is not fully model-only: labeling an attractor as a memorized training image still requires training/reference examples to compare against.
- CD is computationally expensive — tens to hundreds of cycles per trajectory — which matters if you plan to run it across a large prompt set.
- Degenerate attractors mean the probe needs the nearest-neighbor threshold test to distinguish real copies from spurious basins.
- No public code or project page was located as of this writing, so the method is not yet runnable as shipped.