Publikation
Finding Dori: Memorization in Text-to-Image Diffusion Models Is Less Local Than Assumed
Antoni Kowalczuk; Dominik Hintersdorf; Lukas Struppek; Kristian Kersting; Adam Dziedzic; Franziska Boenisch
In: Computing Research Repository eprint Journal (CoRR), Vol. abs/2507.16880, Pages 1-49, Computing Research Repository, 2025.
Zusammenfassung
Text-to-image diffusion models (DMs) have achieved remarkable success in image
generation. However, concerns about data privacy and intellectual property remain
due to their potential to inadvertently memorize and replicate training data. Recent
mitigation efforts have focused on identifying and pruning weights responsible
for triggering verbatim training data replication, based on the assumption that
memorization can be localized. We challenge this assumption and demonstrate that,
even after such pruning, small perturbations to the text embeddings of previously
mitigated prompts can re-trigger data replication, revealing the fragility of such
defenses. Our further analysis then provides multiple indications that memorization
is indeed not inherently local: (1) replication triggers for memorized images are
distributed throughout text embedding space; (2) embeddings yielding the same
replicated image produce divergent model activations; and (3) different pruning
methods identify inconsistent sets of memorization-related weights for the same
image. Finally, we show that bypassing the locality assumption enables more robust
mitigation through adversarial fine-tuning. These findings provide new insights
into the nature of memorization in text-to-image DMs and inform the development
of more reliable mitigations against DM memorization