Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models

2026-06-22

AI Summary

Diffusion models may implicitly memorize training data, posing privacy and copyright risks that are difficult to detect through standard sampling. This work proposes a cyclic denoising method—a gradient-free, prior-agnostic, and unconditional extraction attack—that iteratively applies forward and reverse diffusion under controlled noise to drive samples toward hyper-stable attractors. The approach reveals, for the first time, phase-transition-like behavior in the generative landscape analogous to physical systems. Empirically, it successfully recovers stable memorized training images—including product photographs, watermarks, and web artifacts—after thousands of iterations in both Stable Diffusion v1.4 (in latent space) and DDPM (in pixel space), demonstrating its effectiveness as a powerful auditing tool for uncovering memorization in diffusion models.

Abstract

We introduce cyclic denoising -- repeated forward and reverse diffusion at controlled noise amplitudes -- as an extraction attack for image diffusion models. Inspired by random organization in disordered solids, cyclic denoising exposes regions of the learned distribution that are largely inaccessible to standard sampling. The dynamics drive samples toward attractors with a broad stability spectrum. The deepest attractors are ultrastable: they regenerate after near-total corruption and persist through thousands of noising-denoising cycles. Many of these attractors correspond to memorized training images, including stock photographs, brand watermarks, and web-crawl artifacts. The attack requires only sampler-level control, with no gradients, weight inspection, prompts, captions, or prior knowledge of the training data. Unlike generate-and-filter attacks, which rely on large-scale prompted generation and post-hoc similarity or membership-inference filtering, our main protocol is fully unconditioned. We demonstrate the phenomenon in Stable Diffusion v1.4 and in a pixel-space DDPM, showing consistent behavior across latent- and pixel-space diffusion models. Across noise amplitudes, we observe a yielding-like transition: low-amplitude cycling produces trivial absorbing fixed points or limit cycles, while larger amplitudes induce rearrangements, basin hopping, and long-lived trapping in structured memorized attractor basins. We also observe hierarchical partial absorption, prompt-stabilized basins, and cross-initial-condition universality of the recovered attractor set. Our results therefore show that cyclic denoising is both a physics-inspired probe of generative landscapes and a practical tool for memorization auditing, with implications for privacy, copyright compliance, and model fingerprinting.

Problem

• memorization
• diffusion models
• privacy
• ultrastable attractors
• training data extraction

Innovation

• cyclic denoising
• ultrastable attractors
• memorization auditing
• diffusion models
• generative landscapes