Cyclic Denoising Uncovers Memorized Images in Diffusion Models

Diffusion models, while powerful for image generation, can inadvertently memorize parts of their training data, raising concerns about privacy and copyright. Existing methods to detect memorization often rely on large-scale generation and post-hoc filtering, which can be computationally intensive and require specific prompts or knowledge. This research introduces "cyclic denoising," a new extraction attack inspired by random organization in disordered solids. The technique involves repeatedly applying forward (noising) and reverse (denoising) diffusion steps at controlled noise amplitudes. This process drives samples towards attractors within the learned distribution, many of which correspond to memorized training images. The method is sampler-level, requiring no gradients, weight inspection, prompts, or captions. It effectively uncovers "ultrastable" memories—images that regenerate even after near-total corruption and persist through thousands of cycles. Demonstrated on Stable Diffusion v1.4 and a pixel-space DDPM, cyclic denoising revealed memorized stock photos, brand watermarks, and web-crawl artifacts, highlighting its utility as a practical tool for memorization auditing and its implications for responsible AI development.