Research map / Image generation / Fast diffusion sampling

Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models

NeurIPS 2026 · Image generation › Fast diffusion sampling · approach: Denoising diffusion probabilistic models · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes cyclic denoising (repeated partial forward-reverse diffusion at amplitude gamma) as a prompt-free extraction attack that surfaces memorized training images in Stable Diffusion v1.4 and a CIFAR-10 DDPM as long-lived attractors.

Problem

Existing diffusion extraction attacks rely on captions, prompts, training-set lookup, membership inference, or auxiliary detectors to find memorized images; memorized content that standard sampling rarely reaches may be missed.

Approach

Iterate partial forward-reverse diffusion cycles at a controlled noise amplitude, treating sampling as a stroboscopic dynamical system; memorized images appear as ultrastable absorbing attractors (long plateaus of cosine similarity) without prompts or training data access, analogous to random organization/yielding in driven disordered solids.

Key results

• Unconditional cycling of Stable Diffusion v1.4 at gamma=0.86 yields attractors persisting over 2000 cycles, matching e-commerce template scenes that reverse image search and prior work link to duplicated LAION training images.
• On CIFAR-10 DDPM at gamma=0.39, cycling locks onto a car attractor that matches a memorized CIFAR-10 training image reported by prior work, without training-set lookup.
• Prompt-removal test: for the memorized prompt 'Ann Graham Lotz', 4 of 5 seeds remain locked in the same image for 1000 unconditional cycles, while the guessed 'Abbey Road album cover' concept basin decorrelates within a few cycles.

Surprising findings

• Low-amplitude cycling collapses to trivial absorbing fixed points (near-monochromatic images) or limit cycles rather than exploring the landscape.
• A guessed prompt ('Abbey Road album cover') forms a stable concept basin under the prompt that is not verbatim memorized and decorrelates fastest after prompt removal.

Limitations

• Requires sampler-level control (partial noising and denoising), so not applicable to API endpoints exposing only final samples.
• Attractor distribution and coverage of memorized set not systematically characterized; results depend on gamma, scheduler, cycle count, and initialization diversity.
• Verification of attractors relies on post-hoc reverse image search and prior reported memorized examples, not systematic membership evaluation.

Experimental setup

Datasets: ImageNet validation images CIFAR-10

Benchmarks: Stable Diffusion v1.4 unconditional attractors CIFAR-10 DDPM attractors

Metrics: stroboscopic cosine similarity steady-state similarity vs gamma (yielding curve) decorrelation time after prompt removal

Baselines: generate-and-filter extraction (Somepalli et al.) SIDE one-step denoising extraction attack

Builds on: DDPM random organization in driven disordered systems SIDE generate-and-filter extraction (Carlini et al.)

Closest papers by meaning

• Tracing the Roots: Leveraging Temporal Dynamics in Diffusion Trajectories for Origin Attribution (NeurIPS 2025 · similarity 0.90)
• How Diffusion Models Memorize (NeurIPS 2026 · similarity 0.90)
• Adjusting Initial Noise to Mitigate Memorization in Text-to-Image Diffusion Models (NeurIPS 2025 · similarity 0.89)
• Classifier-Free Guidance Inside the Attraction Basin May Cause Memorization (CVPR 2025 · similarity 0.89)
• On the Edge of Memorization in Diffusion Models (NeurIPS 2025 · similarity 0.89)
• Understanding Representation Dynamics of Diffusion Models via Low-Dimensional Modeling (NeurIPS 2025 · similarity 0.89)