{"id":"141e7b99-29f5-4c42-88eb-0b29c661aa84","arxiv_id":"2411.16738","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Delaying classifier-free guidance until a 'transition point' in the denoising process reduces verbatim memorization in diffusion models, with a new 'opposite guidance' variant to escape memorization basins sooner.","lead":"A new study shows that memorization in image-generation diffusion models can be reduced by turning off the text-guidance signal during the early steps of generation and switching it on later. The method is simple, requires no model retraining, and works across several memorization scenarios, but with some trade-offs in image quality and text alignment.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The transition-point rule is not independently validated: static points are selected on the evaluation data, and the dynamic detector's local-minimum test may not mark the actual memorization boundary.","rationale":"The reader's weakest assumption focused on the dynamic transition-point detector, which is indeed a load-bearing concern: Algorithm 1's local-minimum rule is not shown to coincide with the memorization boundary and is validated only on a few hand-picked examples. I extend this to the static transition points, which are selected on the evaluation data, making the reported improvements potentially in-sample. More importantly, the paper never compares against a baseline with matched total CFG strength or a randomly placed switch, so the central claim that a specific transition point exists and is detectable is not yet separated from the trivial explanation that less early guidance causes less conditioning and hence less copying. The paper's own quantitative results further weaken the 'non-memorized' claim, since several post-mitigation 95th-percentile SSCD scores exceed the 0.5 memorization threshold used in the paper. These issues do not refute the empirical observation that late CFG reduces copying, but they make the attraction-basin mechanism and the transition-point detector conditional on additional validation. The reader's CONDITIONAL verdict remains appropriate, so I recommend no change to the verdict.","tokens_in":14328,"tokens_out":8452,"duration_ms":82336,"concrete_test":"Run Scenario 1 with a matched-guidance control: apply constant CFG weight s = lambda * (T - tau) / T for the whole trajectory (and, separately, a randomly chosen switch time per prompt), then report SSCD 95pc, CLIP score, FID, and the fraction of outputs with SSCD > 0.5. If the matched-guidance or random-switch control matches Ours (STP) within error bars, the transition point is not causally special and the attraction-basin explanation is unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that a transition point separates CFG starts that yield memorized outputs from those that do not, and that this point is detectable from the magnitude of the conditional noise prediction. The evidence for this is vulnerable in two ways. First, in Scenarios 1 and 2 the static transition points (t=500, t=700/600) are chosen after inspecting the evaluation data (Figs. 3 and 10, Table 2), so the reported similarity/FID improvements are in-sample rather than predictive. No held-out split or cross-validation is reported. Second, Algorithm 1 (line 5) triggers on a strict local minimum of ||eps_theta(xt, ep) - eps_theta(xt, e_empty)||^2, but the phenomenon described in Section 4 and Figure 2 is a steep monotone fall followed by a plateau; on such a curve a strict local minimum may occur much later, or not at all, so the detected switch time need not coincide with the memorization boundary. The paper's own tables also show residual high similarity after mitigation (e.g., Table 3: 95pc SSCD 0.5885 and 0.6915; Table 4: 0.8722 and 0.8680, all above the 0.5 threshold used elsewhere), so the claim that outputs are 'non-memorized' is not consistently supported by the paper's own metric. Finally, no baseline with matched total guidance or a randomized switch time is reported; the observed benefit could simply reflect reduced early CFG, i.e., a dose-response effect of guidance, rather than a special transition point or attraction basin.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that memorization in text-conditioned diffusion models arises because classifier-free guidance (CFG), when applied inside an \"attraction basin\" early in denoising, steers trajectories toward training images. It proposes that there is a \"transition point\" in the denoising process after which CFG no longer causes memorization, and introduces mitigation strategies: applying zero guidance until a static or dynamic transition point, and a new \"opposite guidance\" variant that pushes trajectories out of the basin sooner. The method is evaluated in four memorization scenarios using SSCD similarity, CLIP score, and FID, and the authors report reductions in similarity with training images at modest computational overhead.","tokens_in":14644,"tokens_out":2876,"duration_ms":29262,"significance":"If the central claim holds, this would be a useful inference-time memorization mitigation requiring no retraining, no prompt modification, and no access to training data, which would distinguish it from several prior approaches. The paper also ships public code and includes a broad set of scenarios, and the qualitative phenomenon—that delaying CFG onset changes whether a generated sample is memorized—is plausible and visually striking. However, the load-bearing validation is currently weak: the transition-point rule is selected and evaluated on the same data, the dynamic detector is validated only on a few curves, the reported residual similarities remain above the paper's own memorization threshold in two scenarios, and no matched-control ablation rules out a simple dose-response effect of reduced early guidance.","major_comments":[{"comment":"The static transition points t=500 (Scenario 1) and t=700/600 (Scenario 2) are selected after inspecting the evaluation data, and the reported similarity/FID improvements are therefore in-sample performance rather than predictive validation. Because the existence of a universal static transition point is a central claim, the authors need a selection procedure that does not use the evaluation prompts or a held-out split, and they should report the sensitivity of the results to the chosen time step around the selected value.","section":"Sections 6.1 and 6.2, Figures 3 and 10, Tables 1 and 2"},{"comment":"The dynamic transition-point detector triggers on the first strict local minimum of d_t = ||eps_theta(x_t, ep) - eps_theta(x_t, e_empty)||_2^2, but the phenomenon described in Section 4 and shown in Figure 2 is a steep fall followed by a plateau; on such a curve the first strict local minimum can occur much later than the visually identified transition, or may not occur at all. The paper provides no quantitative validation that the detected switch time coincides with the memorization boundary, e.g., by comparing detected t* against a per-prompt sweep of CFG start times, and it reports no error bars or detection success rates over prompts and initializations.","section":"Algorithm 1, line 5, and Section 4, Figure 2"},{"comment":"The paper states that SSCD scores above 0.5 can suggest memorization, but after mitigation the 95th-percentile similarities in Scenario 3 are 0.5885 (DTP) and 0.6915 (OG+DTP), and in Scenario 4 they are 0.8722 and 0.8680, all above that threshold. The repeated characterization of these outputs as \"non-memorized\" is therefore not supported by the paper's own metric; the authors should report per-prompt rates of samples below the threshold, quantify the residual risk, and discuss why the 95th-percentile values remain so high.","section":"Tables 3 and 4; Section 2.2"},{"comment":"No control with matched total guidance or randomized switch time is reported. A method that simply applies zero CFG for the first portion of the denoising process and standard CFG afterward would likely produce a similar dose-response reduction in training-set similarity, regardless of whether the switch time marks a special attraction-basin boundary. The authors should add ablations using random switch times matched to the distribution of detected transition points, and compare against existing CFG-weight schedulers (including Refs. [13] and [26]), to show that the specific transition point rather than reduced early guidance is responsible for the improvement.","section":"Section 5 and Tables 1-4"}],"minor_comments":[{"comment":"The limitations paragraph says memorization must be detected before applying the method, but the threshold on the magnitude of conditional guidance is not specified, and the two proposed detection modes (run twice vs. threshold at t=0) are not evaluated; please provide concrete detection thresholds and accuracy numbers.","section":"Section 5, Limitations paragraph"},{"comment":"Figure 2 labels the vertical axis \"L2 Norm\" while Algorithm 1 uses the squared L2 norm d_t = ||...||_2^2; please make the definition consistent and state which quantity is plotted.","section":"Figure 2 and Algorithm 1"},{"comment":"The definition of a transition point appears to have a typo in the second probability condition, which should presumably assert that the trajectory at (x_tau, tau) is unlikely to land in the perceptual ball; please correct the inequality and the surrounding prose.","section":"Definition 3"},{"comment":"The comparison with Wen et al. at l_target=1 shows a lower similarity (0.6038) than the proposed DTP (0.5885) at substantially better CLIP score only for Wen et al.; the discussion should acknowledge that similarity, alignment, and FID all trade off and that no method dominates on every metric.","section":"Table 3"},{"comment":"The FID for 'Ours (STP)' (19.85) is worse than no mitigation (16.84) and the FID for 'Ours (OG + STP)' (15.67) is best; this trade-off deserves explicit discussion because the abstract and conclusion emphasize high image quality across all scenarios.","section":"Section 6.1, Table 1"}],"recommendation":"major_revision","confidential_remarks":"The paper's empirical phenomenon is worth pursuing, but the current version is at the stage of a strong workshop paper rather than a fully supported journal claim. The authors should be pushed to validate the transition-point heuristic out-of-sample, provide per-prompt detection accuracy, and include a randomized-switch control; without those, the causal interpretation of the attraction basin is not established. The framing that prior methods 'do not generalize' also requires care, since the proposed method itself depends on scenario-specific static points and a detector that is not independently validated."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core observation is real and worth taking seriously: applying CFG early in denoising drives memorized prompts into an attraction basin, while switching CFG on after a transition point yields non-memorized, reasonably aligned outputs. That finding is new relative to prior CFG-scheduler work, which targets quality and diversity rather than memorization, and the paper backs it with qualitative examples across four different memorization scenarios. The simple zero-CFG-until-transition method, plus the opposite-guidance variant, needs no retraining and no prompt access, and the code is public. Credit where due: the paper also shows that several prior prompt-level methods fail to generalize, and it is honest about needing a memorization detector upfront.\n\nThe soft spots are real but not fatal. The static transition points (t=500, t=700/600) are chosen after inspecting the evaluation data, so the reported similarity/FID numbers are in-sample rather than predictive. The dynamic detector in Algorithm 1 triggers on a strict local minimum of the conditional-guidance norm, but the figures mostly show a steep fall followed by a plateau; a strict local minimum on that curve need not coincide with the actual memorization boundary, and the detector is only validated on a handful of visualizations. The paper also overstates \"non-memorized\" in places: several post-mitigation SSCD scores remain above 0.5 (Tables 3 and 4), and there are no error bars. A matched-guidance baseline or a randomized switch-time control would have helped show the benefit comes from the transition point rather than simply from reduced early CFG. These are fixable in revision.\n\nThe attraction-basin framing is more metaphor than formal dynamical-systems result, but the definitions are coherent and the empirical phenomenon stands on its own. This is a solid, useful paper for anyone working on diffusion memorization or copyright-safe generation. It deserves a serious referee and likely publication after revision. I would engage with it and probably cite it. Bring it to reading group if you want a good discussion about what counts as validation for an inference-time heuristic.","headline":"A genuinely new inference-time angle on diffusion memorization, with an honest but under-validated transition-point detector and some in-sample evaluation choices.","tokens_in":15200,"tokens_out":1314,"would_cite":true,"duration_ms":13782,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Applying CFG only after the diffusion trajectory leaves a memorization attraction basin avoids verbatim training-image reproduction, and the switch point is marked by a steep drop in conditional-noise magnitude.","keywords":["diffusion models","memorization","classifier-free guidance","attraction basin","transition point","opposite guidance","text-to-image generation","training data extraction"],"falsifier":"Find a memorized prompt where the conditional-guidance magnitude $\\|\\epsilon_\\theta(x_t, e_p) - \\epsilon_\\theta(x_t, e_\\emptyset)\\|_2$ collapses at some $t^*$, but starting CFG at $t^*$ or a few steps later still yields an image with SSCD similarity above 0.5 to a training image; one such counterexample, reproduced across initializations or models, would invalidate the dynamic-transition-point rule as a general mitigation.","tokens_in":14120,"feed_emoji":"🧲","tokens_out":4758,"duration_ms":41418,"temperature":0.7,"pith_summary":"The paper argues that memorization in text-to-image diffusion models is not merely a data problem: it is a dynamical one. During denoising with classifier-free guidance (CFG), a memorized training image acts as an attractor, and any trajectory that applies CFG while inside its attraction basin is steered toward that exact reproduction. The authors show that each memorized prompt has a transition point, visible as a sharp fall in the L2 magnitude of the conditional guidance term, after which CFG no longer reproduces the training image. Their mitigation is to run the early part of denoising with zero CFG, or with negative opposite guidance, and switch to standard CFG only after the transition point. Across four memorization scenarios, this simple switch reduces similarity to training data while keeping image quality and text alignment, with no retraining and no prompt edits.","feed_headline":"Applying CFG after a transition point stops diffusion memorization","feed_subtitle":"A sharp drop in the guidance signal marks when to switch it on, cutting exact copies without retraining.","key_machinery":"The central object is the attraction basin: the set of points (x, t) in the denoising state space from which CFG inference converges, in perceptual distance, to a memorized training image $x_a$ at time zero. The argument is carried by the transition point, the boundary time step at which the zero-CFG trajectory leaves the basin; it is detected by a steep fall in $d_t = \\|\\epsilon_\\theta(x_t, e_p) - \\epsilon_\\theta(x_t, e_\\emptyset)\\|_2^2$, the squared L2 norm of the conditional guidance term. Opposite guidance is the companion mechanism: during early denoising it replaces positive CFG with its negative form, $\\epsilon_\\theta(x_t, e_\\emptyset) - s(\\epsilon_\\theta(x_t, e_p) - \\epsilon_\\theta(x_t, e_\\emptyset))$, so the trajectory exits the basin sooner before standard CFG is applied.","core_discovery":"The central claim is that applying CFG before the transition point tends to force the trajectory into an attraction basin and produce a memorized sample, whereas applying CFG after the transition point does not. The transition point coincides with a steep fall in $\\|\\epsilon_\\theta(x_t, e_p) - \\epsilon_\\theta(x_t, e_\\emptyset)\\|_2$, the squared L2 norm of the difference between text-conditioned and unconditional noise predictions; for memorized samples this magnitude stays high during early denoising and collapses exactly when the zero-CFG trajectory exits the basin. The paper proposes detecting this collapse online as the first local minimum of that norm (Algorithm 1) and starting CFG from that step. In models where the transition is universal, a static cutoff (t = 500 for SDv2.1 fine-tuned on LAION-10k) suffices; in pre-trained SDv1.4 the transition is dynamic per prompt and initialization, with the same prompt showing t = 779 versus t = 759 under different noise. The same attraction-basin reasoning motivates opposite guidance, which subtracts the conditional guidance term to push the trajectory out of the basin earlier before switching to positive CFG.","pith_inferences":["The first-local-minimum heuristic could be tested against an analytic criterion based on the Jacobian of the score function; if the norm collapse marks a separatrix crossing in the denoising ODE, the transition point might be predicted per prompt without sampling.","The same basin picture suggests that CFG schedulers which are zero early and positive late form a general anti-memorization family, and existing fidelity-motivated schedulers could be reinterpreted as moving the transition point earlier.","Opposite guidance on a non-memorized prompt could plausibly push the trajectory toward low-quality or adversarial regions; the transition-point guard is what makes it safe, and that safety deserves separate stress-testing.","If the correlation between norm collapse and the end of memorization holds broadly, a one-pass adaptive sampler could start with zero CFG and switch on guidance mid-trajectory, avoiding the cost of a separate memorization detection run."],"forward_implications":["Memorization can be mitigated at inference time without retraining, without modifying weights, and without editing the prompt, which extends the approach to class-conditional and other non-text conditioning.","Tracking the magnitude of the conditional guidance term during sampling gives a single signal for both detecting memorization and deciding when to start applying CFG.","Combining the dynamic transition point with opposite guidance reduces similarity to training data while maintaining competitive FID and CLIP scores in all four studied scenarios.","Transition-point avoidance generalizes across memorization causes (data duplication, small-dataset fine-tuning, and trigger-token memorization in pre-trained models), whereas trigger-token-based baselines fail outside their original scenario.","The transition-point rule yields a concrete scheduling principle for CFG: keep guidance off until the conditional noise norm collapses, then apply it, giving a principled alternative to hand-designed CFG weight schedulers."],"supporting_citations":[{"why":"Supplies the LAION-10k and Imagenette fine-tuning scenarios, the baselines for prompt perturbation, and the SSCD-based evaluation protocol used throughout.","marker":"[24]"},{"why":"Provides the observation that text-conditioned versus unconditioned noise prediction magnitudes are unusually high for memorized prompts, which the transition-point detector builds on.","marker":"[28]"},{"why":"Supplies the cross-attention mitigation baseline and the memorized-prompt set used in Scenario 4.","marker":"[20]"},{"why":"Supplies the SSCD self-supervised copy detection embeddings used as the similarity metric for judging memorization.","marker":"[18]"},{"why":"Defines classifier-free guidance, the inference mechanism whose application window is the paper's central object of study.","marker":"[10]"},{"why":"Supplies the 500 memorized prompts for pre-trained Stable Diffusion v1.4 used in Scenario 4.","marker":"[27]"},{"why":"Establishes verbatim memorization and membership-inference extraction of training images from diffusion models, the phenomenon the paper aims to mitigate.","marker":"[4]"}],"fun_headline_variants":["Delay CFG until the guidance signal collapses to stop copies","Timing classifier-free guidance avoids diffusion memorization","Switch on CFG only after the attraction basin is escaped","Opposite guidance plus a CFG start point kills memorization","Find the transition, then apply CFG to prevent exact copies"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method's success rests on the assumption that the first local minimum of the squared L2 distance between the conditional and unconditional noise predictions reliably marks the time step after which applying CFG will not cause memorization; this correspondence is shown on a handful of examples, and the static transition points are selected after inspecting the evaluation data.","fun_headline_variants_meta":{"raw":{"variants":["Delay CFG until the guidance signal collapses to stop copies","Timing classifier-free guidance avoids diffusion memorization","Switch on CFG only after the attraction basin is escaped","Opposite guidance plus a CFG start point kills memorization","Find the transition, then apply CFG to prevent exact copies"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000252,"raw_usage":{"total_tokens":1574,"prompt_tokens":969,"completion_tokens":605,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":585,"completion_tokens_details":{"reasoning_tokens":524}},"tokens_in":585,"tokens_out":605,"duration_ms":5832,"temperature":1.0,"reasoning_tokens":524,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T14:07:27.891016+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Find a memorized prompt where the conditional-guidance magnitude $\\|\\epsilon_\\theta(x_t, e_p) - \\epsilon_\\theta(x_t, e_\\emptyset)\\|_2$ collapses at some $t^*$, but starting CFG at $t^*$ or a few steps later still yields an image with SSCD similarity above 0.5 to a training image; one such counterexample, reproduced across initializations or models, would invalidate the dynamic-transition-point rule as a general mitigation.","supporting_citations":[{"cited_title":"Understanding and mitigating copying in diffusion models","cited_arxiv_id":null,"evidence_quote":"Supplies the LAION-10k and Imagenette fine-tuning scenarios, the baselines for prompt perturbation, and the SSCD-based evaluation protocol used throughout."},{"cited_title":"De- tecting, explaining, and mitigating memorization in diffusion models","cited_arxiv_id":null,"evidence_quote":"Provides the observation that text-conditioned versus unconditioned noise prediction magnitudes are unusually high for memorized prompts, which the transition-point detector builds on."},{"cited_title":"A self-supervised descriptor for image copy detection","cited_arxiv_id":null,"evidence_quote":"Supplies the SSCD self-supervised copy detection embeddings used as the similarity metric for judging memorization."},{"cited_title":"Extracting training data from diffusion models","cited_arxiv_id":null,"evidence_quote":"Establishes verbatim memorization and membership-inference extraction of training images from diffusion models, the phenomenon the paper aims to mitigate."}],"review_version":1}