Finding Dori: Memorization in Text-to-Image Diffusion Models Is Less
  Local Than Assumed
Text-to-image diffusion models (DMs) have achieved remarkable success in
image generation. However, concerns about data privacy and intellectual
property remain due to their potential to inadvertently memorize and replicate
training data. Recent mitigation efforts have focused on identifying and
pruning weights responsible for triggering replication, based on the assumption
that memorization can be localized. Our research assesses the robustness of
these pruning-based approaches. We demonstrate that even after pruning, minor
adjustments to text embeddings of input prompts are sufficient to re-trigger
data replication, highlighting the fragility of these defenses. Furthermore, we
challenge the fundamental assumption of memorization locality, by showing that
replication can be triggered from diverse locations within the text embedding
space, and follows different paths in the model. Our findings indicate that
existing mitigation strategies are insufficient and underscore the need for
methods that truly remove memorized content, rather than attempting to suppress
its retrieval. As a first step in this direction, we introduce a novel
adversarial fine-tuning method that iteratively searches for replication
triggers and updates the model to increase robustness. Through our research, we
provide fresh insights into the nature of memorization in text-to-image DMs and
a foundation for building more trustworthy and compliant generative AI.
6881d12ddf7c5aafaf37f109
Antoni Kowalczuk
admin_assigned
2025-07-24T12:07:46.084Z
62f6a0b0ffd6a0853ee51b5c
/avatars/5e0dbe8e122b3106b7799e226cb9a9c7.svg
Antoni Kowalczuk
user
antoniaaa
6881d12ddf7c5aafaf37f10a
Dominik Hintersdorf
6881d12ddf7c5aafaf37f10b
Lukas Struppek
admin_assigned
2025-07-24T12:07:55.382Z
6305ca82d37ce67e0e48aadb
https://cdn-avatars.huggingface.co/v1/production/uploads/6305ca82d37ce67e0e48aadb/gyTcyIURKmXSFXtr07FGu.jpeg
Lukas Struppek
user
lukas-struppek
6881d12ddf7c5aafaf37f10c
Kristian Kersting
6881d12ddf7c5aafaf37f10d
Adam Dziedzic
6881d12ddf7c5aafaf37f10e
Franziska Boenisch
Finding Dori: Memorization in Text-to-Image Diffusion Models Is Less
  Local Than Assumed
Text-to-image diffusion models (DMs) have achieved remarkable success in
image generation. However, concerns about data privacy and intellectual
property remain due to their potential to inadvertently memorize and replicate
training data. Recent mitigation efforts have focused on identifying and
pruning weights responsible for triggering replication, based on the assumption
that memorization can be localized. Our research assesses the robustness of
these pruning-based approaches. We demonstrate that even after pruning, minor
adjustments to text embeddings of input prompts are sufficient to re-trigger
data replication, highlighting the fragility of these defenses. Furthermore, we
challenge the fundamental assumption of memorization locality, by showing that
replication can be triggered from diverse locations within the text embedding
space, and follows different paths in the model. Our findings indicate that
existing mitigation strategies are insufficient and underscore the need for
methods that truly remove memorized content, rather than attempting to suppress
its retrieval. As a first step in this direction, we introduce a novel
adversarial fine-tuning method that iteratively searches for replication
triggers and updates the model to increase robustness. Through our research, we
provide fresh insights into the nature of memorization in text-to-image DMs and
a foundation for building more trustworthy and compliant generative AI.
Pruning-based defenses in text-to-image diffusion models are insufficient as minor adjustments to text embeddings can re-trigger data replication, necessitating methods that truly remove memorized content.
text-to-image diffusion models data privacy intellectual property memorization pruning text embeddings adversarial fine-tuning