Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Enhancing Privacy-Utility Trade-offs to Mitigate Memorization in Diffusion Models

T0 review · 3 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Changing which conditioning vector anchors classifier-free guidance can reduce training-image copying in diffusion models while preserving prompt alignment.

desk verdict PRSS is a plausible inference-time tweak to CFG, but the SOTA claim outruns the evidence: no error bars, no seeds, no detector-outcome stratification. read the letter →

arxiv 2504.18032 v1 pith:HKBQTGX7 submitted 2025-04-25 cs.CV

Chen Chen , Daochang Liu , Mubarak Shah , Chang Xu This is my paper · ORCID
classification cs.CV
keywords memorizationdiffusionmodelsclassifier-freeguidanceprivacy-utilitytrade-offpromptre-anchoringsemanticsearchtext-to-imagegenerationSSCDsimilarity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Text-to-image diffusion models can reproduce images from their training sets, creating privacy and copyright risk, but the usual fix of rewriting the user prompt to suppress recall also degrades how well the output matches the prompt. This paper claims the privacy-utility trade-off can be improved by changing the geometry of classifier-free guidance instead of only editing the text. Its PRSS method keeps the original prompt as the guidance anchor and pulls the image away from that anchor toward a paraphrased, semantically similar prompt found by a large language model. In experiments on known memorized prompts, the method reports lower copy-detection similarity at the same text-alignment level as prompt-engineering baselines, for both global and local memorization. If the claim holds, model operators gain an inference-only lever that reduces copying without retraining or training-data access.

What carries the argument

The load-bearing object is a modified classifier-free guidance equation, Eq. (12). In standard CFG the noise prediction is pulled from a null-text prediction toward the prompt-conditioned prediction; PRSS, on detecting memorization, instead anchors at the original prompt's prediction and points toward a semantic alternative's prediction. The detector is the first-step magnitude $m_{T-1} = \|\epsilon_\theta(x_{T-1},e_p) - \epsilon_\theta(x_{T-1},e_{\phi})\|_2$ inherited from prior work, optionally masked to target local memorization. The semantic alternative is found by asking a large language model for paraphrases and picking the first whose magnitude falls below the threshold. The mechanism's work is to make the guidance direction itself privacy-preserving, so the prompt does not have to be distorted to suppress copying.

What would settle it

Build a test set of prompts that are known to reproduce training images but whose first-step conditional-versus-unconditional magnitude stays below the threshold; if such prompts are easy to find, PRSS would produce the same memorized images as the unmodified model, showing that the method's protection is exactly as good as the detector.

Watch

Extended reading notes

Core claim

The paper's central claim is that both legs of the classifier-free guidance update are suboptimal for privacy: the text-conditional leg over-edits the prompt, and the unconditional null anchor does not point away from memorized content. PRSS therefore replaces the null anchor $e_{\phi}$ with the original prompt embedding $e_p$ and replaces the engineered prompt $e^*$ with a language-model-searched semantic alternative $e^{ss}_p$, producing the modified update in Eq. (12). When the first-step magnitude signal exceeds a threshold, PRSS generates along the direction $\epsilon_\theta(x_t,e_p) + s(\epsilon_\theta(x_t,e^{ss}_p) - \epsilon_\theta(x_t,e_p))$; otherwise it keeps standard CFG. The reported experiments show this re-anchored guidance yields higher CLIP alignment at matched SSCD similarity than prompt engineering, and pairing it with the stronger masked detection signal gives the best results. The authors state that this consistently improves the privacy-utility trade-off, establishing a new state of the art.

Load-bearing premise

The whole method switches on a first-step magnitude signal: if that signal fails to flag a memorized prompt, PRSS does nothing and generation follows ordinary Stable Diffusion.

Editorial extensions

If this is right

  • At a matched level of copy-detection similarity, PRSS reports higher CLIP text-alignment than prompt-engineering baselines on both global and local memorization prompts.
  • Combining PRSS with the stronger masked detection signal yields the best privacy-utility trade-off, and even the weaker detection signal lets PRSS match the baseline that uses the stronger signal.
  • Ablations show prompt re-anchoring alone raises privacy at the cost of utility, semantic search alone raises utility with limited privacy, and together they dominate the baseline trade-off curve.
  • Prompt re-anchoring keeps diverting generation across the whole denoising trajectory, preventing memorization from reappearing in later steps.
  • The method is inference-only: it requires no retraining, fine-tuning, or search over the training set, only a modified CFG noise-prediction equation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the same re-anchoring move could be applied to any undesired conditioning direction, such as negative prompts, copyrighted styles, or protected attributes, making the choice of CFG anchor a general design axis rather than a memorization-only fix.
  • Beyond the paper: because PRSS inherits its trigger from the detection signal, any improvement in first-step memorization detection accuracy should translate directly into better mitigation, making detection and mitigation complementary rather than competing.
  • Beyond the paper: with the reported search cost of about 0.9 seconds and $0.02 per prompt, alternatives could be cached or generated offline for frequent prompts, making the per-generation overhead negligible in deployment.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes PRSS, an inference-time memorization mitigation method for text-to-image diffusion models. PRSS refines classifier-free guidance: when a first-step magnitude signal indicates memorization risk, the usual null anchor of CFG is replaced by the original user-prompt embedding (prompt re-anchoring, PR), and the conditional embedding is replaced by an LLM-searched semantically similar alternative (semantic prompt search, SS). The method is designed to plug into existing detection signals from Wen et al. [36] and Chen et al. [8]. The authors evaluate on Stable Diffusion v1-4 using the 500-prompt dataset of Webster [34], reporting privacy-utility trade-off curves (CLIP score vs. SSCD average, SSCD 95th percentile, LS, and percent memorized) for global and local memorization, with comparisons against the two prompt-engineering baselines and ablations of PR and SS. They claim consistent improvement over the baselines and a new state of the art.

Significance. If the empirical claim holds, PRSS is a practically attractive contribution: it requires no retraining or training-data search, alters only the guidance equation at inference, and leverages a cheap LLM-based prompt search. The conceptual move of using the memorized prompt itself as a negative anchor is intuitive and distinct from prior prompt-engineering approaches. However, the paper's central claim is empirical, and the reported evidence is currently insufficient to establish a consistent, statistically reliable Pareto improvement. The strength of the paper is its simple and seemingly effective recipe; the weakness is the absence of repeated-seed uncertainty quantification, stratification by detector outcome, and transparency about baseline reimplementation. The authors also explicitly acknowledge sensitivity to the detection mechanism, which is a known limitation but one that the experiments do not quantify. The result is plausible but not yet convincingly supported as stated.

major comments (3)
  1. [Sec. 4.2, Figs. 6-7 and 9-11] The central claim of a consistent privacy-utility improvement is supported only by aggregate trade-off curves without error bars, without the number of seeds used, and without significance tests. Diffusion sampling is stochastic, and the curves in Fig. 6 show a smaller margin for local memorization, so the observed dominance could in principle be within seed noise. The authors should report repeated-seed intervals (e.g., mean and variance over 3-5 seeds) or per-prompt scatter plots, and where possible a paired significance test (e.g., Wilcoxon signed-rank) at matched privacy levels.
  2. [Sec. 4.2 and Sec. 6] The trade-off curves aggregate over the detection gate: at a given threshold lambda, some memorized prompts are false negatives (reverting to standard Stable Diffusion) and some safe prompts are false positives (modified unnecessarily). Because of this, a shift in the curve could reflect a different distribution of gated prompts rather than a better per-prompt mitigation trade-off. The conclusion acknowledges the dependence on detector accuracy, but the paper never quantifies detector false-positive and false-negative rates at the thresholds used, nor reports results stratified by detection outcome. The authors should report detector accuracy on the evaluated prompt set and present trade-off curves or tables for true-positive, false-negative, false-positive, and true-negative subsets separately.
  3. [Sec. 4.1 and Figs. 6-11] The baselines from [36] and especially from [8] are self-reimplemented, and the paper does not state whether official code or checkpoints were used or how hyperparameters were matched. Since the strongest comparison is against the authors' own prior work [8], the reader needs more detail on the reimplementation (e.g., exact prompt-engineering loss, optimization steps, and stopping criterion) and on the lambda values used to produce each curve point. Without this, the fairness of the comparison and the reproducibility of the trade-off curves are hard to verify.
minor comments (6)
  1. [Eq. (6)] The definition of LS is notationally awkward: the indicator 1_{SSCD>0.5} should be a scalar factor multiplying the norm, not a dot product, and the subscript is typeset without an underscore.
  2. [Eq. (8)] The denominator in the definition of m'_t is garbled in the text ('N~ 1 N Nÿ i=1 mi'); please rewrite it as a clear normalized sum, e.g., ||...||_2 / (1/N * sum_i m_i).
  3. [Sec. 11.1, Eqs. (15)-(16)] The adaptive guidance strength s_1 is said to depend on 'the real-time magnitude at timestep t', but it is not specified which magnitude (e.g., between e_p and e_phi, or between e^{ss}_p and e_p) is used at later timesteps. Please define m_t in this context and clarify whether it is recomputed at every denoising step.
  4. [Sec. 11.2] The text says the search generates 'up to n_s = 25 semantically similar prompts' in Sec. 4.1, but the implementation details say 'n=1 generates a single prompt per call'; please reconcile the notation and explain how the 25 alternatives are collected.
  5. [Sec. 4.2] The phrase 'astonishingly large improvements' is informal for a journal report; please replace it with a quantitative statement, e.g., the observed reduction in average SSCD at matched CLIP score.
  6. [Sec. 4.1] The paper states that 'over 300' of the 500 prompts are memorized; please give the exact counts for the global and local memorization subsets, as these are the denominator for the reported percentages in Fig. 11.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: PRSS's trade-off claims are evaluated with external SSCD/CLIP metrics, not with the magnitude signal the method optimizes.

full rationale

The central claim is an empirical Pareto improvement in the privacy–utility trade-off, measured by SSCD similarity (Eq. 5) and CLIP score. The method's detection and prompt-selection machinery uses the first-step magnitude m or m' from [36,8] as a proxy, but the evaluation metrics are external to that proxy: the paper does not fit parameters to SSCD or CLIP, nor does it rename the optimized magnitude as the privacy outcome. PRSS's modification of CFG in Eq. (12) replaces the null anchor e_phi with the original prompt e_p and substitutes an LLM-searched alternative e^ss_p, but the claimed benefit is not true by construction; it is supported by comparison curves in Figs. 6, 7, 9-11. The self-citations [36,8] supply the detection trigger and the strongest baselines, but those are published, peer-reviewed results, and the paper re-implements the baselines and uses the same detection signal for both arms, so the comparison isolates the PR/SS guidance change rather than relying on the cited papers' conclusions as evidence. The acknowledged limitation that detector accuracy affects all methods is a correctness risk, not a logical circularity. Thus no step in the derivation reduces to its own inputs.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

PRSS introduces no new physical or model-level entities; it modifies the CFG noise-prediction update. The free parameters lambda, n_s, and s_1 are hand-chosen or swept, not fitted to the evaluation data, so they are not hidden fit parameters for the central result. The main unproved input is the reliability of the detection signal and the validity of the SSCD/CLIP metrics.

free parameters (3)
  • lambda (detection threshold) = swept to generate curves; exact value not reported
    Controls when mitigation triggers in Eq. (12). The central trade-off curves in Figs. 6-7 are produced by varying this threshold.
  • n_s (number of GPT-4 alternatives) = 25
    Maximum number of semantic alternatives searched per prompt (Sec. 4.1). Chosen by hand; affects the chance of finding a low-magnitude alternative.
  • s_1 (PR guidance strength) = varies in [1, s] with magnitude
    Supplementary Eq. (16) schedules the re-anchoring strength between 1 and the CFG scale s, capped by lambda_max. This schedule is hand-designed and shapes the trade-off curves.
assumptions (5)
  • domain assumption The first-step magnitude m_{T-1} (or masked m') is a reliable memorization detector.
    PRSS trusts the indicator in Eq. (12); inaccurate detection means PRSS does not engage. The authors flag this limitation in the conclusion.
  • domain assumption SSCD similarity to training images and CLIP score measure privacy and utility.
    The central claim is evaluated with these external metrics; if they misrepresent memorization or alignment, the trade-off claim is not established.
  • domain assumption GPT-4 paraphrases preserve the semantics of the original prompt.
    Semantic prompt search (Sec. 3.3) relies on LLM paraphrases being semantically close; CLIP scores are used to confirm this for tested prompts.
  • domain assumption The 500-prompt benchmark from [34] is representative of memorization-prone prompts.
    All experiments use one model (Stable Diffusion v1-4) and this benchmark; generality to other models or prompt distributions is not demonstrated.
  • standard math Standard DDPM and classifier-free guidance equations hold.
    The method is built on Eqs. (1)-(4) from the diffusion literature; it assumes the model is a standard CFG-trained denoiser.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing Privacy-Utility Trade-offs to Mitigate Memorization in Diffusion Models." pith.science (2026). https://pith.science/paper/HKBQTGX7

@misc{pith2026250418032,
  author       = {Pith},
  title        = {Pith review of: Enhancing Privacy-Utility Trade-offs to Mitigate Memorization in Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HKBQTGX7}},
  note         = {Machine review of arXiv:2504.18032}
}
read the original abstract

Text-to-image diffusion models have demonstrated remarkable capabilities in creating images highly aligned with user prompts, yet their proclivity for memorizing training set images has sparked concerns about the originality of the generated images and privacy issues, potentially leading to legal complications for both model owners and users, particularly when the memorized images contain proprietary content. Although methods to mitigate these issues have been suggested, enhancing privacy often results in a significant decrease in the utility of the outputs, as indicated by text-alignment scores. To bridge the research gap, we introduce a novel method, PRSS, which refines the classifier-free guidance approach in diffusion models by integrating prompt re-anchoring (PR) to improve privacy and incorporating semantic prompt search (SS) to enhance utility. Extensive experiments across various privacy levels demonstrate that our approach consistently improves the privacy-utility trade-off, establishing a new state-of-the-art.

Figures

Figures reproduced from arXiv: 2504.18032 by the authors.

Figure 1
Figure 1. Examples of Local Memorization: Stable Diffusion generations (columns 2–4) can replicate local regions of train￾ing images (column 1). Our PRSS method effectively mitigates memorization while maintaining strong alignment with the input prompts (columns 5-7) [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Examples of Global Memorization: Stable Diffusion generations (columns 2–4) can replicate the entire training images (column 1). Our PRSS method effectively mitigates memoriza￾tion while maintaining strong alignment with the input prompts (columns 5-7). demonstrate high efficiency but only moderate effective￾ness, leaving a substantial gap in optimizing the privacy￾utility trade-off. In particular, these methods oft… view at source ↗
Figure 3
Figure 3. Illustration of the logic behind how λ in Eq. (10) governs the privacy-utility trade-off. Currently, the privacy-utility trade-off is governed solely by how extensively the prompt is modified. detection can be achieved efficiently by evaluating the mag￾nitude mT ´1 at the first denoising step (timestep T ´ 1, highlighting the method’s computational efficiency. The contemporary work [8] extends this detection method … view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Illustration of our proposed strategy (PRSS) compared to the baseline prompt engineering (PE) method. [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: Both the baseline approach and our method effectively [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Comparison with baselines. Across different detection [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Ablation studies of PRSS components. Using PR alone [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Left and Right: Our prompt re-anchoring (PR) strategy allows continuous memorization diversion throughout the entire in￾ference process, effectively reducing magnitude and enhancing privacy. Right: Should the alternative prompt identified by the semantic prompt search …
Figure 9
Figure 9. Figure 9: Comparison with baselines using localized memoriza [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Comparison with baselines using the 95 percentile of [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 12
Figure 12. Figure 12: Qualitative comparisons for global memorization using the same random seeds. The baseline’s prompt engineering approach [PITH_FULL_IMAGE:figures/full_fig_p016_12.png]
Figure 13
Figure 13. Figure 13: Qualitative comparisons for local memorization using the same random seeds. The baseline’s prompt engineering approach [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Finding DoRI: Discovery of Retained Images in Diffusion Models

    cs.CV 2025-07 conditional novelty 7.0 of 10

    Adversarially optimized text embeddings re-trigger supposedly removed memorized images in pruned diffusion models, showing memorization is distributed rather than local.

Reference graph

Works this paper leans on

41 extracted references · 33 canonical work pages · cited by 1 Pith paper

  1. [36]

    De- tecting, explaining, and mitigating memorization in diffusion models

    Yuxin Wen, Yuchen Liu, Chen Chen, and Lingjuan Lyu. De- tecting, explaining, and mitigating memorization in diffusion models. In ICLR, 2024. 1, 3, 5, 6, 7, 8

    work page 2024

  2. [8]

    Exploring local memorization in diffusion models via bright ending attention

    Chen Chen, Daochang Liu, Mubarak Shah, and Chang Xu. Exploring local memorization in diffusion models via bright ending attention. ICLR, 2025. 1, 3, 7, 8

    work page 2025

  3. [34]

    A reproducible extraction of training images from diffusion models

    Ryan Webster. A reproducible extraction of training images from diffusion models. arXiv preprint arXiv:2305.08694 ,

    arXiv

  4. [1]

    https://www.midjourney.com/

    Midjourney. https://www.midjourney.com/. 1

    work page

  5. [2]

    Do gans learn the distribution? some theory and empirics

    Sanjeev Arora, Andrej Risteski, and Yi Zhang. Do gans learn the distribution? some theory and empirics. In International Conference on Learning Representations, 2018. 8

    work page 2018

  6. [3]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In USENIX Secu- rity Symposium, 2021. 8

    work page 2021

  7. [4]

    Quan- tifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quan- tifying memorization across neural language models. arXiv preprint arXiv:2202.07646, 2022. 8

    arXiv 2022

  8. [5]

    The pri- vacy onion effect: Memorization is relative

    Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nico- las Papernot, Andreas Terzis, and Florian Tram `er. The pri- vacy onion effect: Memorization is relative. In Advances in Neural Information Processing Systems (NeurIPS), 2022. 8

    work page 2022

Show all 41 references
  1. [6]

    Extracting training data from diffusion models

    Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagiel- ski, Vikash Sehwag, Florian Tram `er, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In USENIX Security Symposium , pages 5253–5270, 2023. 1, 8

    2023

  2. [7]

    Towards memorization-free diffusion models

    Chen Chen, Daochang Liu, and Chang Xu. Towards memorization-free diffusion models. In CVPR, 2024. 1, 3, 8

    2024

  3. [9]

    Investigating memorization in video diffusion models

    Chen Chen, Enhuai Liu, Daochang Liu, Mubarak Shah, and Chang Xu. Investigating memorization in video diffusion models. ICLR 2nd Workshop on Navigating and Addressing Data Problems for Foundation Models (DATA-FM), 2025. 8

    2025

  4. [10]

    Towards a theoretical understanding of memorization in dif- fusion models

    Yunhao Chen, Xingjun Ma, Difan Zou, and Yu-Gang Jiang. Towards a theoretical understanding of memorization in dif- fusion models. arXiv preprint arXiv:2410.02467, 2024. 8

    2024 arXiv

  5. [11]

    Gans trained by a two time-scale update rule converge to a local nash equilib- rium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilib- rium. In Advances in Neural Information Processing Sys- tems, 2017. 8

    2017

  6. [12]

    Classifier-free diffusion guidance

    Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv:2207.12598, 2022. 1, 3

    2022 arXiv

  7. [13]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. In NeurIPS, pages 6840–6851,

  8. [14]

    H. H. Jiang, L. Brown, J. Cheng, M. Khan, A. Gupta, D. Workman, A. Hanna, J. Flowers, and T. Gebru. AI Art and Its Impact on Artists. In Proceedings of the 2023 AAAI/ACM Conference on AI, Ethics, and Society , pages 363–374. ACM, 2023. 8

    2023

  9. [15]

    Large language models struggle to learn long-tail knowledge

    Nikhil Kandpal, Haikang Deng, Adam Roberts, Eric Wal- lace, and Colin Raffel. Large language models struggle to learn long-tail knowledge. arXiv preprint arXiv:2211.08411,

    arXiv

  10. [16]

    Deduplicat- ing training data mitigates privacy risks in language models

    Nikhil Kandpal, Eric Wallace, and Colin Raffel. Deduplicat- ing training data mitigates privacy risks in language models. In International Conference on Machine Learning, 2022. 8

    2022

  11. [17]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009. 8

    2009

  12. [18]

    Deduplicating training data makes language models better

    Katherine Lee, Daphne Ippolito, Andrew Nystrom, Chiyuan Zhang, Douglas Eck, Chris Callison-Burch, and Nicholas Carlini. Deduplicating training data makes language models better. In Proceedings of the Association for Computational Linguistics, 2022. 8

    2022

  13. [19]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), 2015. 8

    2015

  14. [20]

    Memorization in nlp fine-tuning methods

    Fatemehsadat Mireshghallah, Anish Uniyal, Tianhao Wang, David Evans, and Taylor Berg-Kirkpatrick. Memorization in nlp fine-tuning methods. arXiv preprint arXiv:2205.12506,

    arXiv

  15. [21]

    Memory triggers: Unveiling memorization in text-to-image genera- tive models through word-level duplication

    Amir Naseh, Jaemin Roh, and Amir Houmansadr. Memory triggers: Unveiling memorization in text-to-image genera- tive models through word-level duplication. arXiv preprint arXiv:2312.03692, 2023. 8

    2023 arXiv

  16. [22]

    Under- standing (un)intended memorization in text-to-image gener- ative models

    Ali Naseh, Jaechul Roh, and Amir Houmansadr. Under- standing (un)intended memorization in text-to-image gener- ative models. arXiv preprint arXiv:2312.07550, 2023. 8

    2023 arXiv

  17. [23]

    Improved denoising dif- fusion probabilistic models

    Alex Nichol and Prafulla Dhariwal. Improved denoising dif- fusion probabilistic models. In ICML, 2021. 2, 8

    2021

  18. [24]

    Automated flower classification over a large number of classes

    Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. In Proceedings of the Indian Conference on Computer Vision, Graphics and Image Processing, pages 722–729, 2008. 8

    2008

  19. [25]

    A self-supervised descriptor for image copy detection

    Ed Pizzi, Sreya Dutta Roy, Sugosh Nagavara Ravindra, Priya Goyal, and Matthijs Douze. A self-supervised descriptor for image copy detection. In CVPR, pages 14532–14542, 2022. 3

    2022

  20. [26]

    Perera, and Vishal M

    Aimon Rahman, Malsha V . Perera, and Vishal M. Patel. Frame by familiar frame: Understanding replication in video diffusion models. arXiv preprint arXiv:2403.19593, 2024. 8

    2024 arXiv

  21. [27]

    Unveiling and mitigating mem- orization in text-to-image diffusion models through cross at- tention

    Jie Ren, Yaxin Li, Shenglai Zeng, Han Xu, Lingjuan Lyu, Yue Xing, and Jiliang Tang. Unveiling and mitigating mem- orization in text-to-image diffusion models through cross at- tention. ECCV, 2024. 1, 3, 8

    2024

  22. [28]

    High-resolution image syn- thesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image syn- thesis with latent diffusion models. In CVPR, pages 10684– 10695, 2022. 1, 8

    2022

  23. [29]

    Stable diffusion liti- gation, 2023

    Joseph Saveri and Butterick Matthew. Stable diffusion liti- gation, 2023. 2023. 8

    2023

  24. [30]

    Laion-5b: An open large-scale dataset for training next generation image-text models

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Worts- man, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev. Lai...

    2022

  25. [31]

    Diffusion art or digital forgery? investigating data replication in diffusion models

    Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In CVPR, pages 6048–6058, 2023. 1, 3, 8

    2023

  26. [32]

    Understanding and mitigating copying in diffusion models

    Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Understanding and mitigating copying in diffusion models. In NeurIPS, 2023. 1, 3, 8

    2023

  27. [33]

    This face does not exist

    Patrick Tinsley, Adam Czajka, and Patrick Flynn. This face does not exist... but it might be yours! identity leakage in generative models. In IEEE/CVF Winter Conference on Ap- plications of Computer Vision, 2021. 8

    2021

  28. [35]

    Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery

    Yuxin Wen, Neel Jain, John Kirchenbauer, Micah Gold- blum, Jonas Geiping, and Tom Goldstein. Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery. In Advances in Neural Information Processing Systems, pages 51008–51025. Curran Associates...

    2023

  29. [37]

    Counterfac- tual memorization in neural language models

    Chiyuan Zhang, Daphne Ippolito, Katherine Lee, Matthew Jagielski, Florian Tram`er, and Nicholas Carlini. Counterfac- tual memorization in neural language models. In Advances in Neural Information Processing Systems (NeurIPS), 2023. 8 Enhancing Privacy-Utility Trade-offs to Mit...

    2023

  30. [38]

    Additional Analysis Fig. 8 demonstrates the shortcomings of the baseline’s prompt engineering strategy in preserving privacy and the advantages of our proposed prompt re-anchoring (PR) and semantic search (SS) strategies. Please check out the main paper for a detailed analysis...

  31. [39]

    4.1, we complement the standard aver- age SSCD similarity score that is reported in Fig

    Additional Quantitative Results As discussed in Sec. 4.1, we complement the standard aver- age SSCD similarity score that is reported in Fig. 6 with ad- ditional metrics for a comprehensive evaluation. These in- clude the localized similarity metric LS (Eq. (6)), designed spec...

  32. [40]

    12 and 13 for comparative analysis in both local and global memoriza- tion scenarios using the same random seeds

    Additional Qualitative Results We present additional qualitative results in Figs. 12 and 13 for comparative analysis in both local and global memoriza- tion scenarios using the same random seeds. These results demonstrate the superior performance of our method in en- hancing p...

  33. [41]

    Controlling the Strength of PR We achieve finer-grained control of the privacy-utility trade- off by adjusting the strength of PR guidance

    Additional Implementational Details 11.1. Controlling the Strength of PR We achieve finer-grained control of the privacy-utility trade- off by adjusting the strength of PR guidance. Specifically, we balance the guidance scales between fully using the re- anchored guidance meth...

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.