Paper deep dive
From Modes to Memories: Characterizing the Scale-Space Dynamics of Diffusion Models
Cristina López Amado, Marco Fumero, Francesco Locatello
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Diffusion models are typically viewed as stochastic processes that transform noise into data. We take a complementary perspective: a diffusion model defines a family of deterministic dynamical systems indexed by noise scale. At each fixed scale $\sigma$, we treat the denoiser as a self-map and study its dynamics. For an exact denoiser, fixed points correspond to critical points of the smoothed data density, while attractors correspond to its modes; as $\sigma$ increases, sample-level modes merge into progressively coarser ones. This suggests a geometric view of memorization: examples that receive excess probability mass due to duplication or overfitting, as well as outliers, should remain distinguishable under stronger smoothing than ordinary examples. We quantify this persistence by the critical scale $\sigma_c$, the largest noise scale at which an example is retained by the fixed-scale dynamics. In conditional models, the same construction extends naturally to image--caption pairs. Experiments in controlled settings and on large-scale models show that $\sigma_c$ tracks memorization arising from duplication, overfitting, and outliers, and identifies both memorized and partially memorized examples in Stable Diffusion. Moreover, $\sigma_c$ yields interpretable measures of the image spatial distribution and caption dependence of memorization.
Tags
Links
- Source: https://arxiv.org/abs/2609.39648v1
- Canonical: https://arxiv.org/abs/2609.39648v1
Trouble viewing inline? Open PDF directly →
Full Text
123,429 characters extracted from source content.
Expand or collapse full text
From Modes to Memories: Characterizing the Scale-Space Dynamics of Diffusion Models Cristina López Amado* Marco Fumero* Francesco Locatello Affiliation: Institute of Science and Technology Austria (ISTA) Abstract Diffusion models are typically viewed as stochastic processes that transform noise into data. We take a complementary perspective: a diffusion model defines a family of deterministic dynamical systems indexed by noise scale. At each fixed scale σ, we treat the denoiser as a self-map and study its dynamics. For an exact denoiser, fixed points correspond to critical points of the smoothed data density, while attractors correspond to its modes; as σ increases, sample-level modes merge into progressively coarser ones. This suggests a geometric view of memorization: examples that receive excess probability mass due to duplication or overfitting, as well as outliers, should remain distinguishable under stronger smoothing than ordinary examples. We quantify this persistence by the critical scale σc _c, the largest noise scale at which an example is retained by the fixed-scale dynamics. In conditional models, the same construction extends naturally to image–caption pairs. Experiments in controlled settings and on large-scale models show that σc _c tracks memorization arising from duplication, overfitting, and outliers, and identifies both memorized and partially memorized examples in Stable Diffusion. Moreover, σc _c yields interpretable measures of the image spatial distribution and caption dependence of memorization. 1 Introduction Diffusion models are typically viewed as stochastic processes that transform noise into data (Ho et al., 2020; Song et al., 2021; Karras et al., 2022; Rombach et al., 2022). They are trained with a local and static criterion, the prediction of a clean signal from a noisy one at each noise level, and are used through a global and dynamic procedure, a sampler that composes these denoisers along a decreasing schedule of noise levels. What a model has learned is then read off the process as a whole, from its samples or from its loss along the schedule. We take a complementary view and interpret a diffusion model as a family of denoisers DσD_σ, one for each noise level σ. Fixing σ and iterating the denoiser on its own output, xk+1=Dσ(xk)x_k+1=D_σ(x_k), turns a single trained network into a one-parameter family of deterministic dynamical systems, whose fixed points and basins are properties of the network alone (Figure 1, left). For an exact denoiser each of these maps is Gaussian mean shift on the smoothed data density pσp_σ(Fukunaga and Hostetler, 1975; Cheng, 1995; Comaniciu and Meer, 2002): its fixed points are the critical points of pσp_σ and its attractors are the modes of pσp_σ. At small σ every training example is its own attractor, at large σ a single attractor remains, and in between the attractors merge into progressively coarser ones (Figures 2–3). Varying σ thus traces a scale space of the attractors of the model. This scale space gives a geometric view of memorization mechanisms (Carlini et al., 2023; Bonnaire et al., 2025; Ross et al., 2025): an example is retained under its dynamics when it carries excess probability mass, as under duplication or overfitting, or when it is isolated from the remaining data, as outliers. We measure this persistence by the critical scale σc _c, the largest noise level at which iterating the fixed-scale denoiser from an example keeps the trajectory close to it (Figure 1). The critical scale requires no labels, applies to conditional models, where it becomes a property of a caption-image pair, and is interpretable. We test it with interventions that cause memorization: on CIFAR-10 we induce memorization by duplication, by overfitting and by planting outliers, and on Stable Diffusion we use image–caption pairs that are known to be memorized, fully or in part. Our contributions are as follows: Figure 1: A diffusion model as a family of dynamical systems. Fixing the noise level σ and feeding the denoiser its own output defines a self map MσM_σ (left). A memorized training image is a fixed point of this map: its orbit stays at the image, whereas the orbit of a control image drifts away and crosses the escape radius r (bottom left). Repeating this retention test at every σ (right) yields the critical scale σc _c, the largest noise level at which the image is still returned; it is 6.7×6.7× larger for the memorized image, effectively detecting it. • We show that a diffusion model can be interpreted as a family of dynamical systems indexed by the noise level: for an exact denoiser the attractors are the modes of the data density smoothed at scale σ, and varying σ traces a scale space in which these attractors merge. • In this framework, we define the critical scale σc _c as a memorization measure: the scale up to which a sample remains an attractor of the dynamics. It extends to conditional models, capturing the caption-image interaction. For the optimal case we prove that σc _c depends on the inter-samples distances and their multiplicity, reflecting memorization induced by data duplication and outliers. • In controlled experiments we show that σc _c detects memorization induced by duplication, by overfitting and by planting outliers, transferring the mechanism from the theory to trained networks. • We show that the critical scale is an effective detector on large-scale conditional models such as Stable Diffusion, for both fully and partially memorized examples and that the measures is interpretable: being able to characterize whether its retention comes from the caption, from the image, or their interaction and where in the image the memorized content localizes. 2 Diffusion models as a family of dynamical systems Let x0∈ℝdx_0 ^d be drawn from a data distribution p, and let y=x0+σεy=x_0+σ , with ε∼(0,I) (0,I), be its observation at noise level σ>0σ>0. Following Karras et al. (2022), a diffusion model is a family of denoisers Dσ:ℝd→ℝdσ>0\D_σ:R^d ^d\_σ>0 trained by minimising ‖Dσ(x0+σε)−x0‖2E\,\|D_σ(x_0+σ )-x_0\|^2 over a range of noise levels. Its minimiser is the posterior mean Dσ(y)=[x0∣y]D_σ(y)=E[x_0 y]. Noise-prediction models such as DDPM (Ho et al., 2020) and Stable Diffusion (Rombach et al., 2022) reduce to this form: a network ϵθ _θ trained to predict ε gives Dσ(y)=y−σϵθ(y)D_σ(y)=y-σ _θ(y), up to a rescaling of the input (see Appendix F). Figure 2: One model, a family of dynamical systems. Orbits of the exact map MσM_σ (Eq. 1) for samples from an 8-mode mixture of gaussians. Left: at small σ each datum carries its own attractor. Middle: at intermediate σ the attractors are the 8 population modes. Right: at large σ a single attractor remains, at the data mean. We study each denoiser by fixing its noise level and iterating it on its own output, so that each noise level defines a deterministic dynamical system on ℝdR^d (Figure 1, left). Definition 1 (Denoising dynamics at scale σ). Fix σ>0σ>0 and let Mσ:=DσM_σ:=D_σ. The denoising dynamics at scale σ is the deterministic dynamical system on ℝdR^d xk+1=Mσ(xk),k=0,1,2,…x_k+1=M_σ(x_k), k=0,1,2,… For x∈ℝdx ^d, the orbit of x is the sequence (Mσk(x))k≥0(M_σ^k(x))_k≥ 0, where MσkM_σ^k denotes the k times composition of MσM_σ. A point x∗∈ℝdx ^d is a fixed point if Mσ(x∗)=x∗M_σ(x )=x . Its basin of attraction is ℬσ(x∗)=x∈ℝd:limk→∞Mσk(x)=x∗,B_σ(x )= \x ^d:\ _k→∞M_σ^k(x)=x \, and x∗x is an attractor if ℬσ(x∗)B_σ(x ) contains an open neighbourhood of x∗x . Letting σ vary, a diffusion model defines the one-parameter family of dynamical systems Mσ>0\M_σ\_σ>0. Throughout the paper our goal will be to characterize the dynamics of MσM_σ as a function of the noise scale σ: see Figures 2 and 3, top row, for a 2D example of the map M at different σs _s and its dynamics. Figure 7 (Appendix A) shows the loop on Stable Diffusion. When the denoiser is exact, i.e. it predicts the posterior mean Dσ(y)=[x0∣y]D_σ(y)=E[x_0 y], the dynamics of MσM_σ admit an explicit description: Proposition 2 ( formal: Proposition B.2). For the exact denoiser, one step of the dynamics is a gradient-ascent step on the smoothed density, Mσ(x)=x+σ2∇logpσ(x)M_σ(x)=x+σ^2∇ p_σ(x). For a training set p=1N∑iδxip= 1N _i _x_i, M is Gaussian mean shift with bandwidth σ, Mσ(x)=∑iwi(x)xi,wi(x)=exp(−∥x−xi∥2/2σ2)∑jexp(−∥x−xj∥2/2σ2).M_σ(x)= _iw_i(x)\,x_i, w_i(x)= \! (-\|x-x_i\|^2/2σ^2 ) _j \! (-\|x-x_j\|^2/2σ^2 ). (1) Its fixed points are the critical points of pσp_σ, its attractors are the modes of pσp_σ, and every orbit increases pσp_σ and converges to a fixed point. The first identity is Tweedie’s formula (Robbins, 1956; Efron, 2011), and the iteration of equation 1 is mean shift (Fukunaga and Hostetler, 1975; Cheng, 1995; Comaniciu and Meer, 2002), the classical mode-seeking clustering algorithm, run at bandwidth σ. The attractors of the denoising dynamics are therefore the modes of the data blurred at scale σ. In the limit σ→0σ→ 0 every training example is an attractor of its own, whereas once σ exceeds half the diameter of the data, a single attractor remains, close to the data mean (Proposition B.7); at intermediate scales the attractors merge progressively, nearby data into cluster modes and cluster modes into coarser ones. Figure 2 shows the three regimes, and Figure 3 traces the merging as a tree, in which the branch of an example terminates where the example ceases to be an attractor of its own. 2.1 Memorization and the critical scale As σ increases, a training example is absorbed into a coarser attractor, and the model reproduces only its cluster. We regard an example as memorized to the extent that it resists this absorption: in Figure 3, non-duplicated examples lose their branch at small σ, whereas the duplicated example retains it until merging with entire groups. To measure the scale of absorption without locating the attractors, we initialize the dynamics at the example and test whether the orbit remains close to it. Figure 3: Scale space of attractors. Exact map MσM_σ on a 2-D training set: three groups of three sub-clusters (black dots), plus one datum repeated 1515 times (red star). Top: basins of attraction at four scales, coloured by the reached attractor (×); arrows are the drift Mσ(x)−xM_σ(x)-x. Bottom left: merge tree of the attractors reached from the data (width == number of data collected). Single data lose their attractor at small σ; the duplicated datum (red) keeps it until merging with the neighbouring sub-clusters. Bottom right: number of attractors. A denoiser trained on the same data reproduces this scale space, basins, merge tree and counts alike (Appendix C, Fig. 8). Definition 3 (Critical scale). Fix an escape radius r>0r>0 and an iteration budget K. The probe x is retained at scale σ if ‖Mσk(x)−x‖≤r‖x‖\|M_σ^k(x)-x\|≤ r\|x\| for every k≤Kk≤ K. The critical scale of x is the largest scale at which it is retained, σc(x)=supσ>0:xis retained at scale σ. _c(x)\;=\; \σ>0:\ x\ is retained at scale σ \. The critical scale is thus the largest noise level at which the model, iterated on its own output, still returns x: below σc _c the example lies in a basin of its own, and above it the orbit is drawn towards an attractor possibly shared with other data. Figure 1 illustrates the definition on a memorized and a control image on Stable Diffusion model: the memorized image is returned over a range of scales an order of magnitude wider than the control, and σc _c marks the upper end of this range (the full grid of scales and iterations is in Figure 14, Appendix G). Being expressed in units of noise, σc _c is comparable across models and noise schedules. What the critical scale captures. For the exact denoiser, the critical scale σc _c responds to the probability mass carried by an example and to its distance from the rest of the data. Theorem 4 (formal: Theorem B.9). Increasing the probability mass on an example, for instance by duplicating it, reduces the displacement ‖Mσ(x)−x‖\|M_σ(x)-x\| at the example at every noise level and can therefore only increase its critical scale. The map is pulled away from the example only by the other data, and additional mass on the example dilutes this pull. The following theorem makes the rate explicit. Theorem 5 (formal: Thm. B.11). Consider an example of mass θ≤12θ≤ 12 whose only neighbour, carrying the remaining mass, lies at distance d. The example keeps an attractor of its own exactly below a critical scale, which increases with θ. For small θ this scale grows linearly in the distance and only logarithmically in the mass, as d/2log(1/θ)d/ 2 (1/θ). Doubling the distance to the neighbour therefore doubles σc _c, whereas doubling the copies raises it by a few percent. The critical scale thus captures both duplicated examples and outliers. At σc _c the attractor disappears in a saddle-node bifurcation, which the escape test detects (Proposition B.12). Conditional models and the caption gap. A text-to-image model defines one family of dynamics Mσ(⋅,c)M_σ(·\,;c) for each caption c, with c=∅c= the unconditional model. Memorization is then a property of a caption–image pair, and we measure the change that the caption induces in the σc _c of the image. Definition 6 (Caption gap). With σc(x,c) _c(x;c) the critical scale computed with Mσ(⋅,c)M_σ(·\,;c), the caption gap of the pair (x,c)(x,c) is Δlogσc(x,c)=logσc(x,c)−logσc(x,∅) _c(x;c)= _c(x;c)- _c(x; ). Subtracting the unconditional value removes the retention that the image exhibits on its own. For the exact denoiser, the caption enters the mean shift equation 1 only through the prior weights of the training images, like a duplication count, and Theorem 4 gives the following. Corollary 7 (formal: Corollary B.14). For a single iteration, and when the caption leaves the relative weights of the other examples unchanged, the caption gap of (xi,c)(x_i,c) is positive if and only if the caption raises the model’s mass on that example. From the exact denoiser to trained networks. The results above concern the exact denoiser, of which a trained network is only an approximation, and we do not expect a trained network to reproduce their values. We expect the mechanism to carry over: an example retains a basin of its own when it carries mass or lies far from the rest of the data, and σc _c measures the width of that basin. The experiments of Section 3 verify if memorization from duplicated data and outliers transfers to real data scenarios. On the exact denoiser of a real training set the theory holds quantitatively (Appendix D), and Appendix D.2 examines how closely trained networks approach it. 3 Controlled experiments We first evaluate the critical scale in a controlled setting, with DDPM (Ho et al., 2020) models on the CIFAR-10 dataset (Krizhevsky, 2009). An example can be memorized for different reasons, but these mechanisms are confounded in pretrained models. We therefore isolate them through controlled training interventions and test whether critical scale detects the memorization induced by each. In all experiments σc _c is computed by bisection in logσ σ on the escape event of Definition 3. Training and evaluation details, and additional results are given in Appendices F and E. • Duplication (§3.1). An example is repeated m times in the training set, so the empirical distribution places mass m/Nm/N on it. • Rarity (§3.2). An atypical example is added a few times. It has no training neighbours with which to share a basin, but it also receives almost no probability mass. • Overfitting (Appendix E.2). The training set is reduced at fixed model capacity and training budget, moving the model from generalization to memorization. σc _c tracks this transition and detects memorization at training-set sizes where sampling no longer finds copies. Figure 4: Duplication on full CIFAR-10. (a) σc _c of each image, grouped by multiplicity, in the model trained with duplicates (circles) and in the released model trained on the same images without duplicates (triangles). (b) σc _c as a function of the iteration budget K (median per group): constant for images with m≥8m≥ 8, which are fixed points, and decreasing as 1/K1/K for held-out and m=1m=1 images, which are transients. (c) Orbits Mσk(x)M_σ^k(x) of a memorized training image (m=400m=400) and of a training image seen once (m=1m=1), with σ fixed along each row and k along the columns; the dashed line marks the σc _c of each image (K=50K=50, r=0.5r=0.5; 1.621.62 and 0.140.14). The memorized image is still reproduced after 5050 iterations at σ=1σ=1, where the other one has already vanished. 3.1 Memorization from data duplication Setup. We study memorization induced by duplication, and ask whether σc _c detects it and how it depends on the number of copies. To isolate the effect of duplication from that of membership, we compare two models trained on the same images: one with duplicates and one without. We train the improved-diffusion CIFAR-10 model (Nichol and Dhariwal, 2021) (5050M parameters, 500500k steps) on the full training set, in which eight images are repeated at each multiplicity m∈2,8,25,50,100,200,400,800m∈\2,8,25,50,100,200,400,800\. As control we use the publicly released checkpoint of the same model, trained on the same data without duplicates. We evaluate σc _c on the 6464 duplicated images, on 200200 training images that appear once (m=1m=1), and on 200200 held-out images. Duplication does induce copying: 16 60516\,605 of 50 00050\,000 generated samples are copies of a duplicated image. Results. Figure 4a shows that σc _c responds to the intervention rather than to the images. In the model trained with duplicates, the median σc _c is 0.1370.137 on held-out images and 0.1420.142 at m=1m=1, against 1.041.04–1.431.43 for m≥8m≥ 8. In the control model the same images have σc _c between 0.120.12 and 0.270.27 at every multiplicity, and the rank correlation with m drops from ρ=0.70ρ=0.70 to 0.190.19. Used as a detector, σc _c separates m≥8m≥ 8 from m=1m=1 with Area Under the Curve (AUC) 1.0001.000. The duplicated images are fixed points: at m=800m=800 the median σc _c is the same for K=50K=50 and K=500K=500 iterations, while for held-out and m=1m=1 images it decreases by more than two orders of magnitude over the same range (Figure 4b). Above m=8m=8, σc _c increases by only a factor 1.381.38 while m increases a hundredfold, the saturation expected of a width in which mass enters logarithmically (Appendix E.1). Takeaway. The critical scale captures memorization from data duplication, which turns transient states in the image orbits into stable fixed points. Additional copies increase σc _c only slightly. 3.2 Memorization of rare samples Figure 5: Rarity: detection thresholds of σc _c and of sampling. Fraction of added images detected as a function of their multiplicity m, for sources of increasing atypicality. Orange: the image appears at least once among 10510^5 samples; the threshold is m≈8m≈ 8 for every source. Blue: σc _c exceeds the 9595th percentile of the images of the same source not added to the model; the threshold decreases to m=1m=1 as the images become more atypical. The shaded region is memorization detected by σc _c but not by sampling. Setup. We study memorization of outliers, which Theorem 5 predicts to be retained with few copies because of their distance to the other samples. We train two models, A and B, on the same subset of N=104N=10^4 CIFAR-10 images, to which we add images from 4 datasets of increasing atypicality: CIFAR-10 test images, CIFAR-100 classes with no CIFAR-10 counterpart, SVHN digits, and colourised MNIST digits. The added images statistics are matched to the CIFAR-10. From each source, 3636 images are added to A, 3636 other images to B, and 100100 images to neither, with six images at each multiplicity m∈1,2,4,8,16,32m∈\1,2,4,8,16,32\. Each image is thus memorized in one model and not in the other, and the images added to neither model serve as a reference distribution. We draw 10510^5 samples from each model and count near-copies of the added images. Results. Sampling and σc _c have different detection thresholds (Figure 5). Sampling detects added images only from m≈8m≈ 8, for every source; below this multiplicity no image is generated. We flag an image with σc _c when its value exceeds the 9595th percentile non-added images from the same source, which gives a false-positive rate of 5%5\% without using labels. The resulting threshold decreases with atypicality: m=8m=8 for CIFAR-10 and CIFAR-100, m=4m=4 for SVHN and m=1m=1 for colour MNIST. The paired design confirms that the effect is due to training on the image and not to the image itself. Among the added images that were never sampled in the 10510^5 drawns, σc _c flags 88.2%88.2\% (MNIST), 48.6%48.6\% (SVHN), 25.6%25.6\% (CIFAR-10), and 22.0%22.0\% (CIFAR-100). Additional analysis on how σc _c depends on distance and on multiplicity in these models is in Appendix E.3. Takeaway. The critical scale can detect memorized samples that are unlikely to be generated: σc _c depends also on distance, generation only on mass. An isolated example (outlier) can be memorized, since it has room for its own basin, yet not be sampled, since it carries little probability mass. 4 Detecting Memorization in Stable Diffusion Table 1: Memorization-detection on Stable Diffusion v1.4. AUC for distinguishing MV and TV examples from controls, caption-swapped pairs, and MV from TV. Our global scores use r=0.25r=0.25, and local |Δlogσc|| _c| uses r=0.1r=0.1. For both variants of Wen et al. (2024), we report its best-performing configuration (Appendix F). Score MV vs. control MV vs. swap TV vs. control TV vs. swap MV vs. TV ‖ϵc−ϵ∅‖\| _c- _ \| Wen et al. (2024) 0.9990.999 0.6060.606 0.9990.999 0.1840.184 0.9020.902 ‖ϵc(x0)−ϵ∅(x0)‖\| _c(x_0)- _ (x_0)\| 0.9990.999 0.8870.887 0.9960.996 0.6960.696 0.8680.868 σc _c, K=16K=16 0.9170.917 0.9040.904 0.6950.695 0.8030.803 0.9090.909 Δlogσc _c, K=16K=16 0.85690.8569 0.9080.908 0.8240.824 0.9390.939 0.8200.820 |Δlogσc|| _c|, K=16K=16 0.9840.984 0.8600.860 0.8790.879 0.3540.354 0.9050.905 local |Δlogσc|| _c|, K=16K=16 0.9970.997 0.8650.865 0.9930.993 0.4580.458 0.9350.935 We evaluate Stable Diffusion v1.4 (Rombach et al., 2022) on memorized LAION training examples identified by Webster (2023): matching verbatim (MV) examples, whose generations reproduce the paired training image, and template verbatim (TV) examples, whose generations preserve only part of its content or structure. After removing duplicates and mismatched image–caption pairs (Appendix F), we retain 7070 MV and 2424 TV examples. As controls we use 9494 training images from LAION-MI(Dubiński et al., 2024), drawn from LAION Aesthetics v2 5+(Schuhmann et al., 2022), so that all images are training members and differ only in their degree of memorization. Each memorized image is evaluated with its own caption, a swap caption (captions randomly permuted across memorized images) and the empty caption; each control with its own and the empty caption. Scores. From these runs we compute the critical scale σc _c under the own caption and the caption gap Δlogσc _c of Definition 6, which measures how much the caption increases the retention of that image (Figures 21–25 in Appendix G.5). Both are global and do not say where in the image memorization occurs. We therefore also apply the retention test separately at each latent location u∈Uu∈ U, which gives a local gap Δlogσcu _c^u and the local score 1|U|∑u∈U|Δlogσcu| 1|U| _u∈ U| _c^u| (see Appendix F). To separate the benefit of spatial resolution from that of discarding the sign, we also report the absolute global gap |Δlogσc|| _c|. We first evaluate critical-scale scores for detecting memorized examples (§4.1), then examine whether local gaps identify memorized regions (§4.2), and finally use mismatched captions to identify images memorized in the unconditional branch (§4.3). 4.1 Critical scale detects memorization Setup. We report AUC for separating: (i) MV and TV examples from controls, (i) caption-swapped pairs, and (i) MV from TV. We compare our scores with the prompt-level memorization score ‖ϵθ(xt,c)−ϵθ(xt,∅)‖\| _θ(x_t,c)- _θ(x_t, )\| of Wen et al. (2024). Since this measure depends only on the caption, we also consider an image-dependent variant: xtx_t is obtained by adding noise to the candidate image x0x_0. This provides a stronger baseline for testing if a particular image-caption pair is memorized. Results. Table 1 reports the detection results (see Appendix G.1 for an ablation on K and r). All scores separate memorized examples from control, with local |Δlogσc|| _c| performing best among our variants. It achieves AUCs of 0.9970.997 for MV and 0.9930.993 for TV, nearly matching the prompt-level baseline (0.9990.999). Its largest gain occurs for TV, where it raises the AUC from 0.8790.879 to 0.9930.993, consistent with partial memorization being localized. It also best separates MV from TV (0.9350.935). For caption swaps, the signed gap performs best because a mismatched caption can reduce conditional retention below unconditional retention, reversing the gap’s sign (Figure 17, Appendix G.2). Taking the absolute value discards this directional information. This advantage is most pronounced for TV, where Δlogσc _c achieves 0.9390.939 AUC versus 0.6960.696 for the image-dependent baseline. Takeaway. Critical scale is an effective global measure of memorization at scale, and computing it per spatial location improves detection. Comparing unconditional retention with retention under a mismatched caption further reveals whether an image was memorized with a particular caption. 4.2 Local critical scale localizes memorized regions Figure 6: Critical-scale gaps reveal spatial and image-driven memorization. Left: A TV example: the training image, generations from its training caption, and the local gap |Δlogσcu|| _c^u|. The gap is large where all generations copy the training image (the room) and near zero where they vary (the curtain pattern). Right: A wrong caption exposes images already retained by the unconditional model. Center: wrong-caption gap Δlogσc _c against unconditional inpainting RMSE (top) and unconditional σc _c (bottom); bars include std deviation over 5 captions. Side: a negative-gap image is retained by unconditional dynamics but lost when conditioning on a wrong caption; unconditional inpainting restores the masked region. Setup. We qualitatively assess if the local gap |Δlogσcu|| _c^u| identifies memorized regions in TV examples. As a reference, we generate five samples from each training caption: consistently reproduced regions indicate memorized content, whereas variable regions indicate non-memorized content. Results. Figure 6 (left) shows that large values of |Δlogσcu|| _c^u| concentrate in regions reproduced consistently across generations. By contrast, regions that vary across samples generally have gaps close to zero. Thus, the spatial variation of the critical-scale gap aligns with the apparent boundary between memorized and non-memorized content. The trajectories in Figures 22 and 23 provide complementary evidence: in partially memorized images, non-memorized content disappears at smaller noise scales, whereas memorized regions persist longer. Additional qualitative examples are provided in Figure 18 in Appendix G.3. Takeaway. The local critical-scale gap provides an interpretable spatial measure of where memorized content appears within an image. 4.3 Critical-Scale Gap Identifies Image-Driven Memorization Setup. We aim to find images that the unconditional branch has memorized by itself, and not only through their captions. A strongly negative Δlogσc _c indicates stronger retention under unconditional than conditional dynamics. However, since unconditional memorization is rare, searching the full training set for such examples is computationally prohibitive. We therefore use the MV examples under five unrelated captions drawn from LAION-MI, and compute Δlogσc _c for each image-caption pair. This allows us to rank images by evidence of unconditional retention. Since finding an image through unconditional sampling is not feasible, we evaluate this ranking through inpainting. We mask each image quadrant in turn, reconstruct it from the remaining three, and report the mean latent RMSE to the ground-truth region. For each image, we generate 10 samples per quadrant. Low reconstruction error provides evidence that the image is retained independently of its caption. Results. Figure 6 (right) shows an example with a strongly negative gap. Its unconditional dynamics retain the image more strongly than the mismatched-caption dynamics, and unconditional inpainting accurately reconstructs the missing content. This provides qualitative evidence that the image is memorized by the unconditional branch. This reconstruction is consistent with the memorized image acting as an attractor and the masked image lying within its basin of attraction (see Figure 7 in Appendix A). Across images, strongly negative gaps are associated with lower inpainting RMSE (top center) and larger unconditional σc _c (bottom center), supporting their use as evidence of unconditional retention. Gaps near zero are less informative because they can arise when either both dynamics retain the image or neither does. Figure 19 in Appendix G.4 illustrates both near-zero regimes, while Figure 20 provides additional examples with strongly negative gaps. Takeaway. A strongly negative critical-scale gap provides evidence that an image is retained independently of its caption, identifying cases in which the image itself contributes to memorization and can be reconstructed by the unconditional branch. 5 Related work Dynamical and multiscale views of diffusion models. Mean shift turns gradients of kernel density estimates into mode-seeking dynamics (Fukunaga and Hostetler, 1975; Cheng, 1995; Comaniciu and Meer, 2002); with Gaussian kernels, it equals posterior-mean denoising of the empirical distribution, whose smoothed-density critical points are fixed points and modes are attractors. The link between denoising and the score, established for denoising autoencoders (Alain and Bengio, 2014), underlies score-based diffusion via reverse-time SDEs/ODEs (Song et al., 2021). These dynamics reveal how structure emerges across noise scales: global high-variance features precede low-variance details (Wang and Vastola, 2023), a speciation transition marks the emergence of broad structure (Biroli et al., 2024), and high- and low-level features evolve differently, reflecting the data hierarchy (Sclocchi et al., 2025). These works follow generation trajectories: instead, we fix the noise scale and iterate the denoiser, obtaining a family of dynamical systems whose attractors and persistence across scales describe the learned structure. Memorization and generalization in diffusion models. The empirical optimum of denoising score matching reproduces the training data: Gu et al. (2025) study when learned models approach it, and Baptista et al. (2025) how explicit and implicit regularization in the reverse dynamics prevent it. Kadkhodaie et al. (2024) attribute generalization to geometry-adaptive inductive biases, Shah et al. (2025) tie memorization mainly to low-noise denoising, and Bonnaire et al. (2025) show that good generation precedes memorization during training. Closest to us, Fumero et al. (2026a) iterate an autoencoder’s map, whose latent fixed points and attractors reflect memorization and generalization. A diffusion model instead induce a family of dynamical systems, so attractor persistence can be tracked along a scale axis. Pham et al. (2025) view diffusion models as associative memories, and Jain et al. (2025) argue that classifier-free guidance steers reverse trajectories into the basins of memorized images. Both study the reverse generation trajectory, while our fixed-scale dynamics measure how strongly a given image-caption pair is retained across noise scales. Detecting memorization in diffusion models. Early work detected replication by matching generations to training data (Somepalli et al., 2023) or extracting training examples (Carlini et al., 2023; Webster, 2023). Later methods avoid exhaustive generation. Wen et al. (2024) detect memorized prompts from the conditional–unconditional noise-prediction gap. Jeon et al. (2025) use probability-landscape sharpness and Ross et al. (2025) the local geometry of model generations to detect memorization. Jiang et al. (2025) address image-level detection without the paired prompt and Chen et al. (2025) localize memorized regions. Our score instead depends jointly on a candidate image–caption pair, testing whether that pair is memorized rather than whether the caption alone elicits memorization. Comparing conditional and empty-caption critical scales further detects memorization in the unconditional branch. Membership inference (Carlini et al., 2023; Hu and Pang, 2023; Zhai et al., 2024; Duan et al., 2023; Matsumoto et al., 2023) instead asks whether an example was used in training, not whether it is retained strongly enough to be reproduced. 6 Conclusions In this paper we proposed to interpret a diffusion model as a family of dynamical systems indexed by the noise level, whose attractors form a scale space of the data. Memorization then becomes the persistence of an example as an attractor, measured by the critical scale σc _c. On Stable Diffusion, σc _c detects fully and partially memorized image–caption pairs and offers two forms of interpretation: comparing conditional and unconditional critical scales isolates the caption-image interaction in memorization, while local variants of σc _c can identify which regions within an image are memorized. Further analysis is needed to quantify the precision and generality of this localization, which in principle can be extended also to the caption parts. Our theory holds for the exact denoiser. While the mechanism transfers to trained networks (see Section 3), closing this gap formally–for instance via analytic models of the inductive biases of trained diffusion models Kamb and Ganguli (2024)–is a natural direction for future work. Beyond memorization, the orbits and basins of the denoising maps may reveal broader structure in what a model has learned Sclocchi et al. (2025), and locating where individual examples are retained in the weights Hintersdorf et al. (2024) suggests a route towards targeted unlearning. Acknowledgements M.F. was supported by the project “Building Energy Systems on causal reasoning (BOSS)“, funded within the “Technologies and Innovations for the Climate-Neutral City” (TIKS) Programme of the Austrian Research Promotion Agency (FFG). AI use statement We used generative AI tools as coding assistants when implementing and modifying the codebase, and for language editing. They were not used to produce research results on their own or to replace the authors’ scientific judgment. The authors designed the methodology and experiments, and reviewed and validated all AI-assisted code and text. Ethics statement This work is primarily theoretical and methodological, focusing on the dynamics of denoising maps and on memorization in diffusion models. All datasets and models are publicly available (CIFAR-10, MNIST, SVHN, LAION-5B (Schuhmann et al., 2022) and Stable Diffusion (Rombach et al., 2022), and the memorized prompts we study were identified in prior work (Webster, 2023). No human subjects are involved and no new data is collected. Our detectors probe which training images a model has memorized. In principle, such insights could be misused to recover training data from pretrained models. However, our experiments score images that are already public, we release no new private or copyrighted content, and the techniques should be applied responsibly, for instance to audit and reduce memorization. We hope our findings contribute to a better understanding of how diffusion models generalize and memorize. Reproducibility statement All formal statements and proofs are reported in Appendix B. We implement all experiments in PyTorch (Paszke et al., 2019) and the HuggingFace diffusers library (von Platen et al., 2022). We use only publicly released checkpoints, and the CIFAR-10 models we train follow the public recipe of Nichol and Dhariwal (2021). Models, datasets, training recipes, noise schedules, estimator hyperparameters and the filtering of the memorization set are listed in Appendix F. We will open-source our codebase for all experiments upon acceptance. References Alain and Bengio (2014) G. Alain and Y. Bengio What regularized auto-encoders learn from the data-generating distribution. Journal of Machine Learning Research 15 (110), p. 3743–3773. Cited by: §5. Baptista et al. (2025) R. Baptista, A. Dasgupta, N. B. Kovachki, A. Oberai, and A. M. Stuart Memorization and regularization in generative diffusion models. arXiv preprint arXiv:2501.15785. Cited by: §5. Biroli et al. (2024) G. Biroli, T. Bonnaire, V. de Bortoli, and M. Mézard Dynamical regimes of diffusion models. Nature Communications 15 (1). External Links: Document Cited by: §5. Bonnaire et al. (2025) T. Bonnaire, R. Urfin, G. Biroli, and M. Mézard Why diffusion models don’t memorize: the role of implicit dynamical regularization in training. In Advances in Neural Information Processing Systems, Cited by: §1, §5. Carlini et al. (2023) N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V. Sehwag, F. Tramer, B. Balle, D. Ippolito, and E. Wallace Extracting training data from diffusion models. In 32nd USENIX security symposium (USENIX Security 23), p. 5253–5270. Cited by: §E.1, Appendix F, §1, §5. Chen et al. (2025) C. Chen, D. Liu, M. Shah, and C. Xu Exploring local memorization in diffusion models via bright ending attention. In International Conference on Learning Representations, Vol. 2025, p. 29827–29841. Cited by: §5. Cheng (1995) Y. Cheng Mean shift, mode seeking, and clustering. IEEE Transactions on Pattern Analysis and Machine Intelligence 17 (8), p. 790–799. External Links: Document Cited by: §1, §2, §5. Comaniciu and Meer (2002) D. Comaniciu and P. Meer Mean shift: a robust approach toward feature space analysis. IEEE Transactions on Pattern Analysis and Machine Intelligence 24 (5), p. 603–619. External Links: Document Cited by: §B.1, §1, §2, §5. Duan et al. (2023) J. Duan, F. Kong, S. Wang, X. Shi, and K. Xu Are diffusion models vulnerable to membership inference attacks?. In Proceedings of the 40th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 202, p. 8717–8730. Cited by: §5. Dubiński et al. (2024) J. Dubiński, A. Kowalczuk, S. Pawlak, P. Rokita, T. Trzciński, and P. Morawiecki Towards more realistic membership inference attacks on large diffusion models. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, p. 4860–4869. Cited by: §4. Efron (2011) B. Efron Tweedie’s formula and selection bias. Journal of the American Statistical Association 106 (496), p. 1602–1614. External Links: Document Cited by: §B.1, §2. Fukunaga and Hostetler (1975) K. Fukunaga and L. Hostetler The estimation of the gradient of a density function, with applications in pattern recognition. IEEE Transactions on Information Theory 21 (1), p. 32–40. External Links: Document Cited by: §1, §2, §5. Fumero et al. (2026a) M. Fumero, L. Moschella, E. Rodolà, and F. Locatello Navigating the latent space dynamics of neural models. In International Conference on Learning Representations, C. Vondrick, B. Hariharan, C. Raffel, L. Pinto, D. Yang, and A. Faust (Eds.), Vol. 2026, p. 24765–24793. Cited by: §5. Fumero et al. (2026b) M. Fumero, L. Moschella, E. Rodolà, and F. Locatello Navigating the latent space dynamics of neural models. In International Conference on Learning Representations, Cited by: §E.2. Gu et al. (2025) X. Gu, C. Du, T. Pang, C. Li, M. Lin, and Y. Wang On memorization in diffusion models. Transactions on Machine Learning Research. Cited by: §5. Hintersdorf et al. (2024) D. Hintersdorf, L. Struppek, K. Kersting, A. Dziedzic, and F. Boenisch Finding nemo: localizing neurons responsible for memorization in diffusion models. In Advances in Neural Information Processing Systems, Vol. 37. Cited by: §6. Ho et al. (2020) J. Ho, A. Jain, and P. Abbeel Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §1, §2, §3. Hu and Pang (2023) H. Hu and J. Pang Loss and likelihood based membership inference of diffusion models. In Information Security – 26th International Conference, ISC 2023, Lecture Notes in Computer Science, Vol. 14411, p. 121–141. Cited by: §5. Jain et al. (2025) A. Jain, Y. Kobayashi, T. Shibuya, Y. Takida, N. Memon, J. Togelius, and Y. Mitsufuji Classifier-free guidance inside the attraction basin may cause memorization. In 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 12871–12879. Cited by: §5. Jeon et al. (2025) D. Jeon, D. Kim, and A. No Understanding and mitigating memorization in generative models via sharpness of probability landscapes. In Proceedings of the 42nd International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 267, p. 27091–27112. Cited by: §5. Jiang et al. (2025) Y. Jiang, H. Lin, Y. Bai, B. Peng, Z. Liu, Y. Lyu, Y. Yang, X. Zheng, and J. Dong Image-level memorization detection via inversion-based inference perturbation. In International Conference on Learning Representations, Cited by: §5. Kadkhodaie et al. (2024) Z. Kadkhodaie, F. Guth, E. P. Simoncelli, and S. Mallat Generalization in diffusion models arises from geometry-adaptive harmonic representations. In International Conference on Learning Representations (ICLR), Cited by: §E.2, §5. Kamb and Ganguli (2024) M. Kamb and S. Ganguli An analytic theory of creativity in convolutional diffusion models. arXiv preprint arXiv:2412.20292. Cited by: §6. Karras et al. (2022) T. Karras, M. Aittala, T. Aila, and S. Laine Elucidating the design space of diffusion-based generative models. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §1, §2. Krizhevsky (2009) A. Krizhevsky Learning multiple layers of features from tiny images. Technical report University of Toronto. Cited by: §3. Matsumoto et al. (2023) T. Matsumoto, T. Miura, and N. Yanai Membership inference attacks against diffusion models. In 2023 IEEE Security and Privacy Workshops, Cited by: §5. Nichol and Dhariwal (2021) A. Q. Nichol and P. Dhariwal Improved denoising diffusion probabilistic models. In International conference on machine learning, p. 8162–8171. Cited by: Appendix F, §3.1, Reproducibility statement. Paszke et al. (2019) A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Köpf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala PyTorch: an imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems, Cited by: Reproducibility statement. Pham et al. (2025) B. Pham, G. Raya, M. Negri, M. J. Zaki, L. Ambrogioni, and D. Krotov Memorization to generalization: emergence of diffusion models from associative memory. arXiv preprint arXiv:2505.21777. Cited by: §E.2, §5. Robbins (1956) H. Robbins An empirical Bayes approach to statistics. In Proceedings of the Third Berkeley Symposium on Mathematical Statistics and Probability, Volume 1: Contributions to the Theory of Statistics, p. 157–163. Cited by: §B.1, §2. Rombach et al. (2022) R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer High-resolution image synthesis with latent diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Cited by: §1, §2, §4, Ethics statement. Ross et al. (2025) B. L. Ross, H. Kamkari, T. Wu, R. Hosseinzadeh, Z. Liu, G. Stein, J. C. Cresswell, and G. Loaiza-Ganem A geometric framework for understanding memorization in generative models. In International Conference on Learning Representations, Cited by: §1, §5. Schuhmann et al. (2022) C. Schuhmann, R. Beaumont, R. Vencu, C. Gordon, R. Wightman, M. Cherti, T. Coombes, A. Katta, C. Mullis, M. Wortsman, et al. Laion-5b: an open large-scale dataset for training next generation image-text models. Advances in neural information processing systems 35, p. 25278–25294. Cited by: §4, Ethics statement. Sclocchi et al. (2025) A. Sclocchi, A. Favero, and M. Wyart A phase transition in diffusion models reveals the hierarchical nature of data. Proceedings of the National Academy of Sciences 122 (1), p. e2408799121. Cited by: §5, §6. Shah et al. (2025) K. Shah, A. Kalavasis, A. Klivans, and G. Daras Does generation require memorization? creative diffusion models using ambient diffusion. In Proceedings of the 42nd International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 267, p. 54143–54166. Cited by: §5. Somepalli et al. (2023) G. Somepalli, V. Singla, M. Goldblum, J. Geiping, and T. Goldstein Diffusion art or digital forgery? investigating data replication in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 6048–6058. Cited by: §5. Song et al. (2021) Y. Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations (ICLR), Cited by: §1, §5. von Platen et al. (2022) P. von Platen, S. Patil, A. Lozhkov, P. Cuenca, N. Lambert, K. Rasul, M. Davaadorj, D. Nair, S. Paul, W. Berman, Y. Xu, S. Liu, and T. Wolf Diffusers: state-of-the-art diffusion models. GitHub. Note: https://github.com/huggingface/diffusers Cited by: Reproducibility statement. Wang and Vastola (2023) B. Wang and J. J. Vastola Diffusion models generate images like painters: an analytical theory of outline first, details later. arXiv preprint arXiv:2303.02490. Cited by: §5. Webster (2023) R. Webster A reproducible extraction of training images from diffusion models. arXiv preprint arXiv:2305.08694. Cited by: Appendix F, §4, §5, Ethics statement. Wen et al. (2024) Y. Wen, Y. Liu, C. Chen, and L. Lyu Detecting, explaining, and mitigating memorization in diffusion models. In International Conference on Learning Representations, Cited by: Appendix F, Appendix F, §4.1, Table 1, Table 1, §5. Zhai et al. (2024) S. Zhai, H. Chen, Y. Dong, J. Li, Q. Shen, Y. Gao, H. Su, and Y. Liu Membership inference on text-to-image diffusion models via conditional likelihood discrepancy. In Advances in Neural Information Processing Systems, Vol. 37. Cited by: §5. Appendix A Denoising dynamics in Stable Diffusion Figure 7 shows Definition 1 on Stable Diffusion v1.4. The image is encoded once into the latent space, where the map is iterated; the decoder is used only to display the iterates. Figure 7: Definition 1 on Stable Diffusion. Top: the map MσM_σ. The image is encoded once into the latent x0x_0; the U-Net is evaluated with the caption at noise level σ, and its output xk−σϵ^x_k-σ ε is fed back as the next input. Bottom: each row is an orbit (Mσk(x))k≥0(M_σ^k(x))_k≥ 0, decoded for display, of a memorized image under its own caption (w=1w=1). First row: started at the image, the orbit does not move; the image is a fixed point x∗x . Second row: started with part of the image replaced by a grey square, the orbit restores it and converges to the same x∗x . The occluded image lies in the basin ℬσ(x∗)B_σ(x ), so x∗x is an attractor. Third row: the same start at a larger σ, which defines a different map in the family Mσ>0\M_σ\_σ>0. There the start is no longer in the basin, and the orbit leaves. Appendix B Proofs Setting and notation. Throughout, p is a probability measure supported in a compact convex set S⊂ℝdS ^d of diameter R<∞R<∞. This covers image data in [−1,1]d[-1,1]^d and, taking S to be its convex hull, any finite training set. Write φσ(u)=(2πσ2)−d/2e−∥u∥2/2σ2 _σ(u)=(2πσ^2)^-d/2e^-\|u\|^2/2σ^2. The smoothed density pσ(x)=∫φσ(x−x0)p(dx0)p_σ(x)= _σ(x-x_0)\,p(dx_0) is C∞C^∞ and strictly positive, and derivatives may be taken under the integral because S is bounded. The posterior over clean signals given x is πx(dx0)=φσ(x−x0)p(dx0)/pσ(x) _x(dx_0)= _σ(x-x_0)\,p(dx_0)/p_σ(x). [⋅∣x]E[\,· x] and Cov[⋅∣x]Cov[\,· x] denote its mean and covariance, so Dσ(x)=[x0∣x]D_σ(x)=E[x_0 x]. A fixed point x∗x of MσM_σ is an attractor if every eigenvalue of ∇Mσ(x∗)∇ M_σ(x ) has modulus less than 11. A mode is a local maximum of pσp_σ, and it is nondegenerate if ∇2logpσ∇^2 p_σ is negative definite there. Two elementary facts are used throughout. Lemma B.1. For every x∈ℝdx ^d: (F1) Dσ(x)∈SD_σ(x)∈ S; (F2) 0⪯Cov[x0∣x]⪯R24I0 [x_0 x] R^24I. Proof. (F1): Dσ(x)D_σ(x) is the mean of a probability measure on the convex set S. (F2): for a unit vector v, v⊤x0v x_0 lies in an interval of length at most R, and a random variable confined to an interval of length ℓ has variance at most ℓ2/4 ^2/4. ∎ B.1 The exact map (Section 2) Intuition. The exact denoiser averages the training data, weighting each clean signal by how plausible it is as the source of x. Moving to that average moves x uphill on the smoothed density: the step is the score (Tweedie). How sharply the output reacts to the input is the spread of the plausible sources, i.e. the posterior covariance. So a point is held in place when the posterior at it is narrower than the noise, which is exactly a mode of pσp_σ. Proposition B.2 (Exact denoisers are mean shift; formal version of Proposition 2). Let Dσ(x)=[x0∣x]D_σ(x)=E[x_0 x] be the exact denoiser. Then MσM_σ is Gaussian mean shift with bandwidth σ on the smoothed density pσp_σ: (i) Mσ(x)=x+σ2∇logpσ(x)M_σ(x)=x+σ^2∇ p_σ(x), and for p=1N∑iδxip= 1N _i _x_i it is given by equation 1. (i) The fixed points of MσM_σ are the critical points of pσp_σ. A fixed point x∗x is an attractor iff Cov[x0∣x∗]≺σ2ICov[x_0 x ] σ^2I, i.e. iff it is a nondegenerate mode of pσp_σ. (i) Every step increases pσp_σ. The map has no cycles, and every orbit converges to a fixed point when the fixed points are isolated. Proposition B.2 combines four statements, which we prove in turn: Tweedie’s identities (Proposition B.3), the fixed points and their stability (Proposition B.4), the ascent property (Lemma B.5) and its consequence for orbits (Corollary B.6). Proposition B.3 (Tweedie). Dσ(x)=x+σ2∇logpσ(x)D_σ(x)=x+σ^2∇ p_σ(x) and ∇Dσ(x)=σ−2Cov[x0∣x]∇ D_σ(x)=σ^-2Cov[x_0 x]. Proof of Proposition B.3. This is Tweedie’s formula [Robbins, 1956, Efron, 2011]. Since ∇xφσ(x−x0)=σ−2(x0−x)φσ(x−x0) _x _σ(x-x_0)=σ^-2(x_0-x) _σ(x-x_0), integrating against p gives ∇pσ(x)=σ−2pσ(x)(Dσ(x)−x)∇ p_σ(x)=σ^-2p_σ(x)(D_σ(x)-x), which is the first identity. For the second, note that ∇xlog[φσ(x−x0)/pσ(x)]=σ−2(x0−Dσ(x)) _x [ _σ(x-x_0)/p_σ(x)]=σ^-2(x_0-D_σ(x)). Differentiating Dσ(x)=∫x0πx(dx0)D_σ(x)= x_0\, _x(dx_0) under the integral therefore gives ∇Dσ(x)=σ−2[x0(x0−Dσ(x))⊤∣x]=σ−2Cov[x0∣x]∇ D_σ(x)=σ^-2E[x_0(x_0-D_σ(x)) x]=σ^-2Cov[x_0 x]. ∎ Combining the two identities of Proposition B.3, ∇2logpσ(x)=σ−2(∇Dσ(x)−I)=σ−4Cov[x0∣x]−σ−2I.∇^2 p_σ(x)=σ^-2 (∇ D_σ(x)-I )=σ^-4Cov[x_0 x]-σ^-2I. (2) For a finite p=∑iμiδxip= _i _i _x_i, where μi∝mi _i m_i and mim_i is the multiplicity of xix_i, the posterior is discrete and its mean is Mσ(x)=∑iwi(x)xi,wi(x)=mie−∥x−xi∥2/2σ2∑jmje−∥x−xj∥2/2σ2.M_σ(x)= _iw_i(x)\,x_i, w_i(x)= m_i\,e^-\|x-x_i\|^2/2σ^2 _jm_j\,e^-\|x-x_j\|^2/2σ^2. (3) This is equation 1 when all mi=1m_i=1. The weighted form is the one used for σcemp _c^emp. Proposition B.4 (Fixed points and stability). x∗x is a fixed point of MσM_σ iff ∇pσ(x∗)=0∇ p_σ(x )=0. The Jacobian ∇Mσ∇ M_σ is symmetric positive semidefinite everywhere, so the linearised map neither rotates nor oscillates. A fixed point is an attractor iff Cov[x0∣x∗]≺σ2ICov[x_0 x ] σ^2I, equivalently iff x∗x is a nondegenerate mode of pσp_σ. Saddles of pσp_σ carry the basin boundaries. Proof of Proposition B.4. Fixed points. By Proposition B.3, Mσ(x)−x=σ2∇logpσ(x)M_σ(x)-x=σ^2∇ p_σ(x). Since pσ>0p_σ>0, Mσ(x∗)=x∗M_σ(x )=x iff ∇pσ(x∗)=0∇ p_σ(x )=0. Jacobian. ∇Mσ=σ−2Cov[x0∣x]∇ M_σ=σ^-2Cov[x_0 x] is symmetric positive semidefinite. Its eigenvalues are therefore real, so the linearised map has no rotation, and non-negative, so it has no sign-reversing (oscillating) direction. Stability. Because the eigenvalues are non-negative, they all lie in [0,1)[0,1) iff Cov[x0∣x∗]≺σ2ICov[x_0 x ] σ^2I. By equation 2 this holds iff ∇2logpσ(x∗)≺0∇^2 p_σ(x ) 0. At a critical point, that is a nondegenerate local maximum. Saddles. If ∇2logpσ(x∗)∇^2 p_σ(x ) has a positive eigenvalue, equation 2 gives ∇Mσ(x∗)∇ M_σ(x ) an eigenvalue greater than 11, so x∗x repels along that direction. A saddle attracts along some directions and repels along others. By Corollary B.6 below, a point in no attractor’s basin converges to such a non-maximal critical point. Generically this is a saddle, and the sets converging to saddles separate the basins. ∎ The linearisation is local. The global behaviour comes from the classical ascent property of Gaussian mean shift [Comaniciu and Meer, 2002]: each step climbs pσp_σ by at least its own squared length. Lemma B.5 (Ascent). For every x, logpσ(Mσ(x))−logpσ(x)≥‖Mσ(x)−x‖2/2σ2\ p_σ(M_σ(x))- p_σ(x)≥\|M_σ(x)-x\|^2/2σ^2. Proof. For any y, pσ(y)/pσ(x)=[exp(‖x−x0‖2−‖y−x0‖2)/2σ2∣x]p_σ(y)/p_σ(x)=E [ \(\|x-x_0\|^2-\|y-x_0\|^2)/2σ^2\ x ]. Jensen’s inequality bounds its logarithm below by the posterior mean of the exponent. That mean equals (‖x‖2−‖y‖2−2(x−y)⊤Dσ(x))/2σ2 (\|x\|^2-\|y\|^2-2(x-y) D_σ(x) )/2σ^2, which at y=Dσ(x)y=D_σ(x) is ‖x−Dσ(x)‖2/2σ2\|x-D_σ(x)\|^2/2σ^2. ∎ Corollary B.6 (Orbits of the exact map). Let xk+1=Mσ(xk)x_k+1=M_σ(x_k). Then (i) MσM_σ has no periodic orbit other than fixed points; (i) every limit point of (xk)(x_k) is a fixed point, and if the fixed points are isolated, (xk)(x_k) converges; (i) every attractor is a local maximum of pσp_σ. Proof. (i) By Lemma B.5, pσp_σ strictly increases along any step that moves, so an orbit cannot return to its starting point. (i) Summing Lemma B.5 over k and using pσ≤(2πσ2)−d/2p_σ≤(2πσ^2)^-d/2 gives ∑k‖xk+1−xk‖2<∞ _k\|x_k+1-x_k\|^2<∞, so the steps tend to 00. By (F1) the orbit is bounded. If xkj→zx_k_j→ z, then also xkj+1→zx_k_j+1→ z, and continuity of MσM_σ gives Mσ(z)=zM_σ(z)=z. The limit set of a bounded sequence whose steps tend to 00 is connected, and a connected set of isolated points is a single point. (i) If every orbit started in a neighbourhood U of x∗x converges to x∗x , then pσ(x)≤pσ(x∗)p_σ(x)≤ p_σ(x ) for all x∈Ux∈ U, because pσp_σ increases along these orbits. ∎ Proof of Proposition B.2. (i) is the first identity of Proposition B.3, and equation 1 is equation 3 with all mi=1m_i=1. (i) is Proposition B.4. (i) is Lemma B.5 together with Corollary B.6(i)–(i). ∎ Both ends of the scale axis. At large σ every posterior is nearly the whole data distribution, so the map barely depends on x and collapses everything to one point. At small σ the posterior near a datum is almost entirely that datum, so the map is nearly constant on a small ball around it, which then holds one attractor. Both statements are contraction arguments. Proposition B.7. (a) If σ>R/2σ>R/2, MσM_σ has exactly one fixed point, and every orbit converges to it. As σ→∞σ→∞ this fixed point tends to p[x0]E_p[x_0]. (b) Let p=∑iμiδxip= _i _i _x_i with pairwise distances at least δ, let Bi=x:‖x−xi‖≤δ/4B_i=\x:\|x-x_i\|≤δ/4\, and let ϵi=1−μiμie−δ2/4σ2 _i= 1- _i _ie^-δ^2/4σ^2. If ϵiR≤δ/4 _iR≤δ/4 and ϵiR2<σ2 _iR^2<σ^2, which holds for all small enough σ, then BiB_i contains exactly one fixed point. It is an attractor, and it lies within ϵiR _iR of xix_i. Proof. (a) By (F2), ‖∇Mσ(x)‖≤R2/4σ2<1\|∇ M_σ(x)\|≤ R^2/4σ^2<1 everywhere, and by (F1) MσM_σ maps S into itself. By Banach’s fixed-point theorem, MσM_σ has a unique fixed point xσ∗x _σ in S. Every orbit enters S after one step, so every orbit converges to it, and by (F1) there are no fixed points outside S. As σ→∞σ→∞, πx→p _x→ p uniformly in x∈Sx∈ S, so xσ∗=[x0∣xσ∗]→p[x0]x _σ=E[x_0 x _σ] _p[x_0]. (b) Let x∈Bix∈ B_i and j≠ij≠ i. Then ‖x−xj‖≥3δ/4\|x-x_j\|≥ 3δ/4 and ‖x−xi‖≤δ/4\|x-x_i\|≤δ/4, so ‖x−xj‖2−‖x−xi‖2≥δ2/2\|x-x_j\|^2-\|x-x_i\|^2≥δ^2/2 and wj(x)wi(x)≤μjμie−δ2/4σ2,hence∑j≠iwj(x)≤1−μiμie−δ2/4σ2=ϵi. w_j(x)w_i(x)≤ _j _i\,e^-δ^2/4σ^2, _j≠ iw_j(x)≤ 1- _i _i\,e^-δ^2/4σ^2= _i. (4) Two bounds follow, using Cov[x0∣x]⪯[(x0−xi)(x0−xi)⊤∣x]Cov[x_0 x] [(x_0-x_i)(x_0-x_i) x] for the second: ‖Mσ(x)−xi‖ \|M_σ(x)-x_i\| =‖∑j≠iwj(x)(xj−xi)‖≤ϵiR≤δ/4, = \| _j≠ iw_j(x)(x_j-x_i) \|≤ _iR≤δ/4, (5) ‖∇Mσ(x)‖ \|∇ M_σ(x)\| ≤σ−2‖∑j≠iwj(x)(xj−xi)(xj−xi)⊤‖≤ϵiR2σ2<1. ≤σ^-2 \| _j≠ iw_j(x)(x_j-x_i)(x_j-x_i) \|≤ _iR^2σ^2<1. (6) The first gives Mσ(Bi)⊂BiM_σ(B_i)⊂ B_i, so MσM_σ is a contraction of the convex set BiB_i into itself, and Banach’s theorem gives a unique fixed point there. Its Jacobian has norm below 11, so it is an attractor, and by the first bound it lies within ϵiR _iR of xix_i. ∎ B.2 The critical scale and mass monotonicity (Sections 2.1–2.1) Proposition B.8 (Critical scale at K=1K=1). For the exact denoiser, the critical scale with a single iteration is σc(1)(x)=supσ>0:σ2‖∇logpσ(x)‖≤r‖x‖. _c^(1)(x)= \σ>0:\ σ^2\,\|∇ p_σ(x)\|≤ r\|x\| \. (7) Proof of Proposition B.8. At K=1K=1 the probe is retained at σ iff ‖Mσ(x)−x‖≤r‖x‖\|M_σ(x)-x\|≤ r\|x\|, and by Proposition B.3 ‖Mσ(x)−x‖=σ2‖∇logpσ(x)‖\|M_σ(x)-x\|=σ^2\|∇ p_σ(x)\|. Take the supremum over the retained scales. ∎ Two direct consequences of Definition 3 are worth recording. σc _c is nonincreasing in K, since retention for K+1K+1 steps implies retention for K. The retention set need not be an interval, which is why we verify it empirically (Appendix C). Theorem B.9 (Mass monotonicity; formal version of Theorem 4). Let pθ=(1−θ)q+θδx∗p_θ=(1-θ)q+θ _x put mass θ on x∗x , with q any distribution of bounded support. Then ‖Dσ(x∗)−x∗‖\|D_σ(x )-x \| is strictly decreasing in θ, and σc(1)(x∗) _c^(1)(x ) is nondecreasing in θ. Duplicating a datum m times among N others corresponds to θ=m/(N+m)θ=m/(N+m). Intuition for Theorem B.9. At the probe, the posterior splits its vote between the probe’s own atom and the rest of the data. Only the rest pulls the probe away, and it pulls with the same force whatever the probe’s mass. More mass on the probe only shrinks the share of the vote the rest receives. The proof makes this exact. Proof of Theorem B.9. Let DqD^q and πxqπ^q_x be the exact denoiser and the posterior of q, and set c=φσ(0)c= _σ(0) and B=∫φσ(x∗−x0)q(dx0)>0B= _σ(x -x_0)\,q(dx_0)>0. At x∗x the posterior of pθp_θ is a mixture of the atom and the posterior of q: πx∗=λθδx∗+(1−λθ)πx∗q,λθ=θcθc+(1−θ)B. _x = _θ\, _x +(1- _θ)\,π^q_x , _θ= θ cθ c+(1-θ)B. (8) Taking means, Dσθ(x∗)−x∗=(1−λθ)(Dq(x∗)−x∗).D_σ^θ(x )-x =(1- _θ) (D^q(x )-x ). (9) The vector Dq(x∗)−x∗D^q(x )-x does not depend on θ, and 1−λθ1- _θ is strictly decreasing in θ. Hence the displacement fθ(σ):=‖Dσθ(x∗)−x∗‖=(1−λθ)‖Dq(x∗)−x∗‖f_θ(σ):=\|D_σ^θ(x )-x \|=(1- _θ)\,\|D^q(x )-x \| (10) is strictly decreasing in θ at every σ with Dq(x∗)≠x∗D^q(x )≠ x , and zero at every other σ. For θ<θ′θ<θ this gives fθ′≤fθf_θ ≤ f_θ, so the K=1K=1 retention sets are nested, σ:fθ(σ)≤r‖x∗‖⊆σ:fθ′(σ)≤r‖x∗‖,\σ:\ f_θ(σ)≤ r\|x \|\\ \ \σ:\ f_θ (σ)≤ r\|x \|\, (11) and their suprema, σc(1)(x∗) _c^(1)(x ) by Proposition B.8, are nondecreasing in θ. ∎ Lemma B.10 (Strict mass monotonicity). In Theorem B.9, suppose x∗≠0x ≠ 0 and σ¯=σc(1)(x∗) σ= _c^(1)(x ) under θ is finite. Then σc(1)(x∗) _c^(1)(x ) under any θ′>θ >θ is strictly larger than σ¯ σ. Proof. Let τ=r‖x∗‖>0τ=r\|x \|>0. The retention set is closed because fθf_θ is continuous, and every σ>σ¯σ> σ escapes, so fθ(σ¯)≤τandfθ(σ)>τ(σ>σ¯)⟹fθ(σ¯)=τ>0.f_θ( σ)≤τ f_θ(σ)>τ\ \ (σ> σ) f_θ( σ)=τ>0. (12) In particular Dq(x∗)≠x∗D^q(x )≠ x at σ¯ σ, and equation 9 gives fθ′(σ¯)=1−λθ′1−λθfθ(σ¯)<τ.f_θ ( σ)= 1- _θ 1- _θ\,f_θ( σ)<τ. (13) By continuity fθ′<τf_θ <τ on an interval above σ¯ σ. ∎ B.3 Two atoms (Theorem 5) Theorem B.11 (Two atoms; formal version of Theorem 5). Let p=θδ+a+(1−θ)δ−ap=θ _+a+(1-θ) _-a with a=d/2a=d/2 and θ≤12θ≤ 12: the probe carries mass θ and its only neighbour sits at distance d. The probe carries its own attractor iff σ<σc(θ)σ< _c(θ), where σc _c is strictly increasing on (0,12](0, 12], σc(12)=d/2 _c( 12)=d/2, and σc(θ)=d2log(1/θ)(1+o(1))as θ→0. _c(θ)= d 2 (1/θ)\,(1+o(1)) θ→ 0. Intuition. With two atoms the map lives on the line through them. There it is a sigmoid of the position, and the sigmoid’s slope is the separation over the noise, β=a2/σ2β=a^2/σ^2, while its offset is the log-mass ratio h. A steep sigmoid crosses the diagonal three times: one attractor at each atom and a saddle between them. As σ grows the sigmoid flattens, and the crossing near the lighter atom disappears by merging with the saddle. The lighter atom survives while the slope beats the offset, which is why separation (through β) enters linearly and mass (through h) only logarithmically. Proof of Theorem B.11. Place the atoms at ±ae± ae for a unit vector e, with the probe at +ae+ae carrying mass θ≤12θ≤ 12. Step 1 (reduction to a line). By (F1) all fixed points lie on the segment [−ae,ae][-ae,ae]. Write x=aue+x⟂x=aue+x_ with x⟂ex_ e. Then ‖x∓ae‖2=‖x⟂‖2+a2(u∓1)2,‖x+ae‖2−‖x−ae‖2=4a2u,\|x∓ ae\|^2=\|x_ \|^2+a^2(u∓ 1)^2, \|x+ae\|^2-\|x-ae\|^2=4a^2u, (14) so the factor depending on x⟂x_ cancels from the weights of equation 3, and w+(x)w−(x)=θ1−θe2a2u/σ2=e2(βu+h),Mσ(x)=a(w+−w−)e=atanh(βu+h)e, w_+(x)w_-(x)= θ1-θ\,e^2a^2u/σ^2=e^2(β u+h), M_σ(x)=a\,(w_+-w_-)\,e=a (β u+h)\,e, (15) with β=a2σ2,h=12logθ1−θ≤0.β= a^2σ^2, h= 12 θ1-θ≤ 0. (16) MσM_σ depends on x only through u, and ∇Mσ∇ M_σ vanishes orthogonally to e. Fixed points and their stability are therefore those of the scalar map g(u)=tanh(βu+h)g(u)= (β u+h) on [−1,1][-1,1]. Step 2 (fixed points). For |u|<1|u|<1, u=g(u)⇔H(u)=h,H(u)=arctanhu−βu,H′(u)=11−u2−β,u=g(u) H(u)=h, H(u)=arctanhu-β u, H (u)= 11-u^2-β, (17) and H→∓∞H→∓∞ as u→∓1u→∓ 1. If β≤1β≤ 1, H is increasing and there is exactly one fixed point. If β>1β>1, let uβ=1−1/βu_β= 1-1/β and h∗(β):=βuβ−arctanhuβ>0.h (β):=β u_β-arctanhu_β>0. (18) Then H increases on (−1,−uβ)(-1,-u_β) up to h∗(β)h (β), decreases on (−uβ,uβ)(-u_β,u_β) down to −h∗(β)-h (β), and increases on (uβ,1)(u_β,1). Step 3 (stability). At a fixed point tanh(βu+h)=u (β u+h)=u, so g′(u)=β(1−u2)≥0,g′(u)<1⇔H′(u)>0.g (u)=β(1-u^2)≥ 0, g (u)<1 H (u)>0. (19) Fixed points on the increasing branches of H are attractors, and a fixed point on the decreasing branch is repelling: it is the saddle between the two basins. Step 4 (the probe’s attractor). On (uβ,1)(u_β,1), H takes every value in (−h∗,∞)(-h ,∞) exactly once. Since h≤0h≤ 0, the probe carries its own attractor iff β>1andh∗(β)>|h|.β>1 h (β)>|h|. (20) Otherwise the unique fixed point has u≤0u≤ 0, on the neighbour’s side or at the midpoint. Step 5 (the critical scale). Using 1/(1−uβ2)=β1/(1-u_β^2)=β, dh∗dβ=uβ+βuβ′−uβ′1−uβ2=uβ>0,h∗(1)=0,h∗(∞)=∞. dh dβ=u_β+β u_β - u_β 1-u_β^2=u_β>0, h (1)=0, h (∞)=∞. (21) So σ↦h∗(a2/σ2)σ h (a^2/σ^2) decreases strictly from ∞ at σ→0σ→ 0 to 00 at σ=aσ=a, and equation 20 holds iff σ<σc(θ)σ< _c(θ), where σc(θ) _c(θ) is the unique solution of h∗(a2/σc(θ)2)=|h(θ)|=12log1−θ.h \! (a^2/ _c(θ)^2 )=|h(θ)|= 12 1-θ. (22) The right-hand side decreases strictly on (0,12](0, 12], so σc(θ) _c(θ) increases strictly, and h(12)=0h( 12)=0 gives σc(12)=a=d/2 _c( 12)=a=d/2. Step 6 (asymptotics). As β→∞β→∞, uβ u_β =1−12β+O(β−2),arctanhuβ=12log1+uβ1−uβ=12log(4β)+O(β−1), =1- 12β+O(β^-2), _β= 12 1+u_β1-u_β= 12 (4β)+O(β^-1), (23) h∗(β) h (β) =β−12log(4β)−12+O(β−1). =β- 12 (4β)- 12+O(β^-1). (24) As θ→0θ→ 0, |h|=12log(1/θ)+O(θ)→∞|h|= 12 (1/θ)+O(θ)→∞, so βc→∞ _c→∞ and equation 24 gives βc=12log(1/θ)(1+o(1)),σc=aβc=d2log(1/θ)(1+o(1)).∎ _c= 12 (1/θ)\,(1+o(1)), _c= a _c= d 2 (1/θ)\,(1+o(1)). (25) Remarks. (i) For θ>12θ> 12 the atoms swap roles, and bistability ends at the same scale: σc(θ)=σc(1−θ) _c(θ)= _c(1-θ). (i) The logβ β term in equation 24 makes the exact σc _c smaller than the leading-order formula: solving Step 5 numerically gives 0.740.74, 0.830.83 and 0.870.87 of the formula’s value at θ=10−2,10−4,10−6θ=10^-2,10^-4,10^-6. So the formula of Theorem 5 gives how σc _c scales (linearly in d, logarithmically in θ), not its value. (i) At σc _c the probe’s attractor and the saddle merge at uβcu_ _c and both disappear: a saddle-node. The attractor is still at distance a(1−uβc)a(1-u_ _c) from the probe when this happens. Theorem B.11 locates the scale at which an attractor ceases to exist, while Definition 3 thresholds a displacement. The next proposition says the two agree whenever the attractor is still within the escape radius when it vanishes. Proposition B.12 (Escape test in the two-atom model). In the setting of Theorem B.11, let K=∞K=∞ and let the escape radius τ=r‖x‖τ=r\|x\| satisfy τ<aτ<a. Then the probe is retained exactly for σ∈(0,σesc]σ∈(0, _esc], with σesc≤σc(θ) _esc≤ _c(θ). Equality holds iff a(1−uβc)≤τa(1-u_ _c)≤τ, where βc=a2/σc(θ)2 _c=a^2/ _c(θ)^2. Proof. g is increasing and g(1)<1g(1)<1, so the orbit started at u=1u=1 decreases monotonically to the largest fixed point u∗(σ)≤1u (σ)≤ 1. Its largest displacement from the probe is its limit, so supk‖Mσk(x)−x‖=a(1−u∗(σ)),the probe is retained⇔a(1−u∗(σ))≤τ. _k\|M_σ^k(x)-x\|=a (1-u (σ) ), probe is retained a (1-u (σ) )≤τ. (26) For σ≤σcσ≤ _c, u∗u is the probe’s attractor, the root of H(u)=hH(u)=h on the rising branch. As σ grows, H increases pointwise on u>0u>0, so this root moves continuously left, down to uβcu_ _c at σc _c. For σ>σcσ> _c, u∗≤0u ≤ 0 and the displacement is at least a>τa>τ. So the retention set is σ≤σc:a(1−u∗(σ))≤τ, \σ≤ _c:\ a (1-u (σ) )≤τ \, (27) an interval, which reaches σc _c iff the displacement at σc _c is at most τ. ∎ Since 1−uβc≈1/(2βc)≈1/log(1/θ)1-u_ _c≈ 1/(2 _c)≈ 1/ (1/θ), the condition holds for any fixed radius once θ is small. The escape test then returns the saddle-node scale. This is a statement about the exact map, not about a trained network. B.4 From two atoms to a training set Intuition. Remark (i) and equation 24 say that, at leading order, the lighter atom keeps its attractor while it wins the posterior vote at its own location, β>|h|β>|h|. For a whole training set the same criterion reads: the probe’s m copies must outweigh the kernel mass of all other rows at the probe, S(σ):=∑jmje−∥x−xj∥2/2σ2<m,S(σ):= _jm_j\,e^-\|x-x_j\|^2/2σ^2<m, (28) the sum running over the other rows. Each term of S increases with σ, so the balance holds on an interval (0,σbal)(0, _bal). This criterion is a heuristic. It is leading-order, it looks only at the probe’s own location, and it has no escape threshold. What can be proved is how the closed forms of Section 2.1 relate to it. Proposition B.13. Let n>mn>m be the number of other rows, dnnd_n the distance to the nearest of them, and σ1 _1 the solution of S(σ1)=1S( _1)=1. Set dkern=σ12lognd_kern= _1 2 n. Then σbal≥dnn2log(n/m)anddkern≥dnn, _bal\ ≥\ d_n 2 (n/m) d_kern\ ≥\ d_n, (29) with equality in both iff all other rows are at distance dnnd_n. Moreover, a single atom of n rows at distance dkernd_kern has the same kernel mass as the actual rows at σ1 _1. Proof. Every other row is at distance at least dnnd_n, so S(σ)≤ne−dnn2/2σ2,S(σ)≤ n\,e^-d_n^2/2σ^2, (30) with equality iff all of them are at distance dnnd_n. The three claims follow from this bound: ne−dnn2/2σ2<m n\,e^-d_n^2/2σ^2<m ⇔σ<dnn2log(n/m) σ< d_n 2 (n/m) ⟹σbal≥dnn2log(n/m), \ \ _bal≥ d_n 2 (n/m), (31) 1=S(σ1)≤ne−dnn2/2σ12 1=S( _1)≤ n\,e^-d_n^2/2 _1^2 ⇔dnn≤σ12logn=dkern, d_n≤ _1 2 n=d_kern, (32) ne−dkern2/2σ12 n\,e^-d_kern^2/2 _1^2 =1=S(σ1). =1=S( _1). (33) So equation 41, with n≈Nn≈ N, is a lower bound on the balance scale: lumping every row at the nearest distance overcounts the competition. Lumping them at dkernd_kern instead gives dkern/2log(n/m)d_kern/ 2 (n/m), which is exact at m=1m=1 and approximate otherwise. In words, dkernd_kern is the distance at which one atom carrying all other rows would weigh as much as the actual neighbours do against a single copy. Because the balance itself is only a heuristic, the ceiling σcemp _c^emp is not taken from either formula. It is computed by running equation 3 through the network’s own escape test (Appendix D). B.5 Conditional models and guidance (Section 2.1) No argument above uses that p is a marginal distribution, so every result holds for p(⋅∣c)p(· c). For p(x0∣c)=∑iwi(c)δxip(x_0 c)= _iw_i(c) _x_i, equation 3 with μi=wi(c) _i=w_i(c) gives the caption-reweighted mean shift Mσ(x;c)=∑iw~i(x,c)xi,w~i(x,c)∝wi(c)exp(−∥x−xi∥2/2σ2).M_σ(x;c)= _i w_i(x,c)\,x_i, w_i(x,c) w_i(c) \! (-\|x-x_i\|^2/2σ^2 ). (34) The Gaussian kernel, which carries σ, is unchanged, and the caption enters only through the prior weights wi(c)w_i(c). Corollary B.14 (Caption gap; formal version of Corollary 7). At K=1K=1, and when the caption changes the weight of xix_i but not the relative weights of the other examples, Δlogσc(xi,c)>0 _c(x_i;c)>0 iff wi(c)>wi(∅)w_i(c)>w_i( ). Intuition for Corollary B.14. A caption acts on the empirical mean shift only through the prior weights, exactly as a duplication count does. If it raises the weight of xix_i and leaves the rest of the data as it was, it is a duplication of xix_i, and Theorem B.9 applies. Proof of Corollary B.14. By assumption, wj(c)/wj(∅)w_j(c)/w_j( ) is the same for every j≠ij≠ i, so the normalized remainder is the same under both conditions: p(⋅∣c′)=wi(c′)δxi+(1−wi(c′))qi,c′∈c,∅,qi=∑j≠iwj(∅)δxj1−wi(∅).p(· c )=w_i(c )\, _x_i+ (1-w_i(c ) )\,q_i, c ∈\c, \, q_i= _j≠ iw_j( )\, _x_j1-w_i( ). (35) These are the family pθp_θ of Theorem B.9 at θ=wi(c)θ=w_i(c) and at θ=wi(∅)θ=w_i( ). By Lemma B.10, applied in whichever direction the weight moves, σc(1)(xi,c)>σc(1)(xi,∅)⇔wi(c)>wi(∅), _c^(1)(x_i;c)> _c^(1)(x_i; ) w_i(c)>w_i( ), (36) when both are finite. ∎ Without the assumption, equation 9 still describes the step, but the caption also changes the pull of the remainder qiq_i. Guidance. With the guided noise prediction ϵw=ϵ∅+w(ϵc−ϵ∅) _w= _ +w( _c- _ ), the map becomes Mσ(w)(x)=x+σ2∇log[pσ(x)1−wpσ(x∣c)w].M_σ^(w)(x)=x+σ^2∇ [p_σ(x)^1-wp_σ(x c)^w ]. (37) It climbs the tilted density pσ(x)(pσ(x∣c)/pσ(x))wp_σ(x) (p_σ(x c)/p_σ(x) )^w, whose critical points for w>1w>1 are not those of pσ(⋅∣c)p_σ(· c). Only Mσ(1)M_σ^(1) describes the fixed points of the conditional model. Lemma B.15 (Guided map). The guided map is equation 37, and its Jacobian is ∇Mσ(w)(x)=(1−w)Cov[x0∣x]+wCov[x0∣x,c]σ2.∇ M_σ^(w)(x)= (1-w)Cov[x_0 x]+wCov[x_0 x,c]σ^2. (38) For 0≤w≤10≤ w≤ 1 it is positive semidefinite; for w>1w>1 it is a difference of positive semidefinite matrices and may be indefinite. Proof of Lemma B.15. Both denoisers are affine in the noise prediction, Dσ(x)=x−σϵ∅D_σ(x)=x-σ _ and Dσ(x,c)=x−σϵcD_σ(x;c)=x-σ _c, so guidance with ϵw=(1−w)ϵ∅+wϵc _w=(1-w) _ +w _c gives Mσ(w)=(1−w)Dσ(⋅)+wDσ(⋅,c).M_σ^(w)=(1-w)\,D_σ(·)+w\,D_σ(·\,;c). (39) Applying Proposition B.3 to each term gives the map and its Jacobian. For 0≤w≤10≤ w≤ 1 the Jacobian is a convex combination of positive semidefinite matrices; for w>1w>1 the coefficient 1−w1-w is negative. ∎ The consequence for the dynamics: for 0≤w≤10≤ w≤ 1 everything in this appendix carries over to the tilted density pσ1−wpσ(⋅∣c)wp_σ^1-wp_σ(· c)^w. For w>1w>1 a negative eigenvalue lets the map overshoot and oscillate, and a maximum of the tilted density is an attractor only if every eigenvalue of its Jacobian stays above −1-1. Appendix C Remarks on the critical scale Figure 8: A trained denoiser reproduces the scale space of Fig. 3. Same training set and same panels as Fig. 3, with the exact map MσM_σ replaced by Mσ(x)=Dσ(x)M_σ(x)=D_σ(x) for an EDM-preconditioned MLP trained on the 141141 points. Top: basins at the four scales of Fig. 3, coloured by the attractor (×) reached from the data; grey marks the grid points that reach none of them, in the corners of the domain where the network saw no training data. Bottom left: merge tree of the trained map. Bottom right: its attractor count against that of the exact map. The two maps agree: the counts are equal at 80%80\% of the 9090 scales, the partitions of the training set they induce have adjusted Rand index 0.990.99 on average (0.760.76 at worst, at the smallest scales where single data split), and the duplicated datum keeps its attractor over the same range of scales in both. Computing the critical scale. We compute σc _c by bisection in logσ σ on the escape event of Definition 3. The definition is most natural when the set of retained scales is an interval, i.e. when the escape event is monotone in σ; in that case bisection returns σc _c exactly. We do not assume monotonicity but verify it on the trained models, and observe no violation on either model (on Stable Diffusion, none for 1616 images over the noise grid). For K>1K>1 the escape event depends on the whole orbit, and σc _c has no closed form analogous to Proposition B.8. Related iterations. The map of Definition 1 feeds the clean estimate back to the denoiser without adding noise, so that it is deterministic and noise cannot create spurious endpoints. Two related iterations have different fixed points and are not equivalent to MσM_σ. In the renoising iteration xk+1=Dσ(xk+σεk)x_k+1=D_σ(x_k+σ _k) the endpoints depend on the noise realisation, and the round trip xk+1=Sampleσ→0(xk+σεk)x_k+1=Sample_σ→ 0(x_k+σ _k) is a generative operator. Appendix D The exact denoiser and the retention coefficient The theorems of Section 2.1 describe the exact denoiser of a fixed distribution. The exact denoiser of a training set, MσempM_σ^emp, is the multiplicity-weighted mean shift equation 3 over the number of samples: the map of a model that has stored its training set exactly. It costs one softmax over the training set per step, so it can be iterated from the same images and scored with the same escape test as the network (settings in Appendix F). We write σcemp(x)=σc(x)computed with Mσemp in place of the network, at the same K and r. _c^emp(x)\;=\; _c(x)\ computed with M_σ^emp in place of the network, at the same K and r. (40) Section D.1 checks the theory on this map; Section D.2 compares trained networks with it. D.1 The theory on the exact denoiser A bifurcation, not a threshold. For this map a training image is an exact fixed point at every scale below the transition, so its critical scale is the saddle-node of Theorem 5: on the duplication training set σcemp _c^emp is unchanged between escape radii r=0.1r=0.1 and r=0.5r=0.5 and between K=20K=20 and K=500K=500 iterations (largest group-median difference 1%1\%). Distance and multiplicity. With the nearest training image as the only neighbour, Theorem 5 gives, for an example of multiplicity m among N rows, σcemp(x)≈dnn(x)2log(N/m),dnn(x)=minxi≠x‖x−xi‖, _c^emp(x)\;≈\; d_n(x) 2 (N/m), d_n(x)= _x_i≠ x\|x-x_i\|, (41) refined by the balance equation 28 of Appendix B.4. The critical scale should thus grow linearly with distance and only logarithmically with multiplicity. The exact denoiser follows this law without fitting (Figure 9): doubling the kernel distance doubles σcemp _c^emp, whereas 3232 copies increase it by a factor 1.261.26. The log–log slope in distance is 1.031.03 [1.00,1.05][1.00,1.05] for one copy and 0.880.88 [0.79,0.93][0.79,0.93] for 3232 copies, against the predicted 11, and a joint fit over all 288288 images of the rarity experiment gives 1.951.95 per doubling of distance against 1.061.06 per doubling of multiplicity, where the law predicts 22 and 1.051.05. Which distance the theory means. Solving the balance equation 28 image by image predicts σcemp _c^emp at rank correlation 0.990.99–1.001.00 at every multiplicity of the rarity experiment, with an error of 77–10%10\%, and on the duplication training set at ρ=0.99ρ=0.99 with a constant factor 0.830.83. The nearest-neighbour formula equation 41 reaches ρ=0.87ρ=0.87–0.950.95 with an error of 43%43\%, and lies below the computed value, as Proposition B.13 requires. The gaussian kernel distance dkernd_kern, is the notion of distance the theory uses. Figure 9: The exact denoiser follows the law. σcemp _c^emp of the added images of the rarity experiment against their kernel distance dkernd_kern to the training set (Eq. 28), for images added once (grey) and 3232 times (red), under the escape test with K=1K=1, r=0.2r=0.2. The lines are the law σc=dkern/2log(N/m) _c=d_kern/ 2 (N/m) of Theorem 5, drawn without fitting. Doubling the distance doubles the critical scale, whereas 3232 copies increase it by a factor 1.261.26. D.2 Trained networks against the exact denoiser The retention coefficient. A network should not hold an image longer than the memorizing solution does, which suggests reporting κ(x)=σc(x)σcemp(x),κ(x)\;=\; _c(x) _c^emp(x), (42) the fraction of that solution’s retention the network reaches at x: near 00 where the model generalizes through x, approaching 11 where it has stored x. Both terms are measured with the same test and the same threshold r‖x‖r\|x\|. A held-out image has no atom in the training set and leaves the exact map at the first step at every σ, so κ is defined for training images only. The bound holds. We use the 10471047 training images of Section 3: 264264 from the duplication experiment, 495495 from the overfitting experiment (five subsets of 100100, excluding five images that escape at the lower end of the interval), and 288288 from the rarity experiment. No image has κ>1κ>1. The largest values are 0.780.78 (duplication), 0.820.82 (overfitting) and 0.650.65 (rarity). The memorizing solution therefore bounds every trained model we measure, and σc _c can be read as a position between a model that generalizes through the image and one that has stored it. What moves, and what does not. Across the three interventions the ceiling σcemp _c^emp stays within a factor 4.24.2 per image and between 4.94.9 and 10.310.3 in group median, whereas σc _c varies by a factor 335335 (Table 2). Each intervention raises κ, from 0.010.01–0.060.06 for images that are not memorized to 0.20.2–0.60.6 for images that are. The training set fixes the scale on which retention is measured, and training decides how far along it the model goes; this is why the overfitting sweep moves σc _c by two orders of magnitude while the exact denoiser of its subsets barely moves. Table 2: The three interventions on a common scale. σcemp _c^emp is the critical scale of the exact empirical denoiser of the training set of each model under the same escape test, equation 40; κ=σc/σcempκ= _c/ _c^emp is the fraction of this solution that the network implements. Group medians, training images only: the ceiling varies little, and the effect is carried by κ. intervention group σcemp _c^emp σc _c κ duplication m=1m=1 4.994.99 0.1420.142 0.0280.028 m=8m=8 5.605.60 1.0361.036 0.1940.194 m=800m=800 9.919.91 1.4311.431 0.1450.145 m=800m=800, control model 9.919.91 0.2690.269 0.0240.024 overfitting N=5⋅104N=5· 10^4 4.934.93 0.0560.056 0.0120.012 N=2000N=2000 6.116.11 0.2430.243 0.0430.043 N=100N=100 7.847.84 4.6744.674 0.5980.598 rarity model not trained on the image 7.687.68 0.4510.451 0.0580.058 CIFAR-10 added, m=1m=1 7.287.28 0.4470.447 0.0760.076 colour MNIST added, m=1m=1 6.856.85 1.4591.459 0.1820.182 colour MNIST added, m=32m=32 10.3010.30 4.0244.024 0.4320.432 The rarity rows use K=1K=1, r=0.2r=0.2 and the others the settings of Appendix F, so κ is comparable within a block but not across blocks. The two maps release an image for different reasons. On the exact denoiser a training image is a fixed point until the saddle-node, so its critical scale does not depend on the iteration budget. On a network it does, and the dependence itself separates the groups: at m=800m=800 the median σc _c is 1.4311.431 at both K=50K=50 and K=500K=500, whereas for m=1m=1 and held-out images it falls by factors of 165165 and 193193 over the same range. A memorized image is retained because it is a fixed point of the network’s map; an ordinary image is retained only transiently, and a longer iteration releases it. Consequently κ compares two escape scales measured the same way, not two maps: at a fixed budget it is a conservative reading of how much of the memorizing solution the network implements, and for images without a basin it is an upper bound rather than an estimate. Appendix E CIFAR-10: additional results This appendix reports additional results for the experiments of Section 3. Training and evaluation details are given in Appendix F. E.1 Memorization from data duplication (Section3.1) Copying and sample quality. With the copy criterion of Carlini et al. [2023], 16 60516\,605 of 50 00050\,000 samples are copies. The FID increases from 3.903.90 of the control model to 4.704.70 for non duplicated samples (when this are counted in the FID computation FID goes to 26.4626.46). Therefore aside for the planted memorized images the retained model still perform well on quality of generations. Membership. σc _c separates training images that appear once from held-out (test set) images with AUC 0.5280.528, i.e. it does not detect membership in this case: this is due to the fact that not accounting for the memorized content the models have similar FID and fit well the CIFAR data distribution therefore there is few difference between training and test distribution. This is consistent with a model that copies neither group, and agrees with the overfitting experiment at N=5⋅104N=5· 10^4. Figure 10 illustrates this on one image per group. Figure 10: Orbits across scales, one image per group. Orbits of the model trained with duplicates, with σ fixed along each row and the iteration index k along each column, for a memorized image (m=800m=800), a training image with m=1m=1 and a held-out image, each chosen at the median σc _c of its group. The dashed line marks the σc _c of the image (K=64K=64, r=0.5r=0.5). The memorized image is unchanged after 6464 iterations at σ=1.43σ=1.43, whereas the other two converge to a uniform colour at σ=0.24σ=0.24, with nearly identical critical scales (0.1220.122 and 0.1180.118). Dependence on multiplicity. The median σc _c relative to its value at m=8m=8 is: m 88 2525 5050 100100 200200 400400 800800 network 1.001.00 1.121.12 1.181.18 1.341.34 1.241.24 1.261.26 1.381.38 exact empirical denoiser 1.001.00 1.111.11 1.081.08 1.231.23 1.191.19 1.291.29 1.771.77 A hundredfold increase in the number of copies changes the critical scale by less than a factor 1.41.4, and the memorizing solution of the same training set saturates in the same way: mass enters the width of a basin only logarithmically, so once an image has a basin, further copies cannot widen it much. Copies still change what the sampler does, as the copy rate shows. Accordingly κ does not order the duplicated images by multiplicity (0.0280.028 at m=1m=1, 0.190.19 at m=8m=8, 0.150.15 at m=800m=800; ρ=−0.01ρ=-0.01), but it separates duplicated from non-duplicated images, and in the control model it lies between 0.0140.014 and 0.0370.037 at every m. E.2 From memorization to generalization: memorization from overfitting Figure 11: Overfitting: the same images across training-set sizes. (a) σc _c of the 100100 training images shared by all models (blue) and of 100100 held-out images (orange): medians with interquartile range, individual images in the background. Images that escape at the lower end of the bisection interval are drawn at that end, so the held-out medians for N≤500N≤ 500 are upper bounds. (b) Fraction of generated samples that are copies (orange, left axis; when no copy is found the point is drawn at the 95%95\% upper bound) and AUC of σc _c between training and held-out images (blue, right axis). At N=2000N=2000 sampling no longer detects memorization while σc _c still does. Setup. We study memorization induced by training on a small dataset, and compare σc _c with memorization measured by sampling. We train five models with identical architecture, optimiser and training budget on nested subsets of CIFAR-10 of size N∈100, 500, 2000, 104, 5⋅104N∈\100,\,500,\,2000,\,10^4,\,5· 10^4\ inducing a transition from a memorization (overfitting) to generalization phase (Fumero et al. [2026b], Kadkhodaie et al. [2024], Pham et al. [2025]). Since only N varies, a smaller N means more passes over each image. The first 100100 images of the permutation belong to every subset, so σc _c is evaluated on the same 100100 training images in every model, together with 100100 held-out test images. Independently of σc _c, we measure memorization as the fraction of generated samples that are near-copies of a training image. We also evaluate the public 5050M improved-diffusion model on the same images. Results. The median σc _c of the training images decreases by two orders of magnitude, from 4.674.67 at N=100N=100 to 0.0560.056 at N=5⋅104N=5· 10^4, where it coincides with that of the held-out images (0.0600.060; Figure 11a). The decrease is not a power law: σc _c is nearly constant up to N=500N=500, collapses between N=500N=500 and N=2000N=2000, and is flat afterwards. At both ends σc _c agrees with sampling. For N≤500N≤ 500, 5252–100%100\% of the samples are copies and σc _c separates training from held-out images with AUC 1.001.00; for N≥104N≥ 10^4 and for the public model, no sample is a copy and σc _c is at the held-out level. The two measures differ at N=2000N=2000: only 44 of 5⋅1045· 10^4 samples are copies, yet σc _c separates training from held-out images with AUC 0.8970.897 (Figure 11b). Every image here appears once, so the training set alone changes little across the sweep: what changes by two orders of magnitude is how closely the trained model reproduces the memorizing solution at these images (Appendix D.2). Summary. Retention is lost later than generation: a model can keep its training images as attractors after its sampler has stopped producing them. Since σc _c measures retention, it detects memorization in a regime in which the copy rate is already zero. Comparison to full OpenAi checkpoint. The public model behaves like our models with N≥104N≥ 10^4 (median 0.0680.068 against 0.0720.072, AUC 0.450.45). This is consistent with sampling: an exhaustive search finds no extractable training image, and the number of copies remains at the held-out level up to 3⋅1053· 10^5 samples. The images that sampling does recover from this model belong to clusters of near-duplicates in CIFAR-10, for which σc _c is at the held-out level. Exact denoiser. Every image has m=1m=1, so equation 20 depends on N only through logN N and predicts σc(100)/σc(5⋅104)=1.53 _c(100)/ _c(5· 10^4)=1.53, against a measured ratio of 8383. The exact empirical denoiser of each subset agrees with the formula: its critical scale decreases from 7.847.84 to 4.934.93, a factor of 1.61.6. Held-out images, which have no atom, leave the exact map immediately (9191 to 100100 of 100100 at every N), so their retention by the network is due to generalization. E.3 Memorization of rare samples (Section3.2) Detection by sampling. No added image with m≤4m≤ 4 is copied more than 0.250.25 times per 10510^5 samples for any source. At m=8m=8 the number of copies per image is between 1.31.3 and 13.613.6, and for m≥16m≥ 16 every added image is generated. For colour MNIST, σc _c flags 88 of 1212 images with a single copy and all 1212 with two. Paired comparison. The median ratio between σc _c in the model trained on the image and σc _c in the other model increases from 1.021.02 (CIFAR-10, m=1m=1) through 2.52.5 (SVHN, m=4m=4) and 3.03.0 (MNIST, m=1m=1) to between 3.43.4 and 88 for m≥8m≥ 8. For the two CIFAR sources with m≤4m≤ 4, the unpaired AUC against images of the same source is between 0.360.36 and 0.660.66: these images cannot be detected in a single model, but they are detected by the paired comparison. Figure 12 shows three added images that are never sampled, one per source, chosen at the median of their group. Figure 12: Paired comparison on three images that are never sampled. One added image per source, chosen at the median of its group. Each row shows Mσ(x)M_σ(x), one denoising step applied to the clean image at noise level σ, in the model trained on the image (top, blue) and in the model not trained on it (bottom, grey), together with the relative displacement ‖Mσ(x)−x‖/‖x‖\|M_σ(x)-x\|/\|x\| whose crossing of r defines σc _c. The model not trained on the image moves it towards what it has learned (blur, generic texture) at a much smaller σ. Isolation. Within a source and multiplicity, the increase of σc _c caused by adding an image is correlated with its distance to the nearest training image (Spearman ρ=0.33ρ=0.33, p=5⋅10−5p=5· 10^-5, n=144n=144 for m≤4m≤ 4). An isolated image does not share its basin at low noise with any training image, so a single copy suffices to create it; a typical image is absorbed into the solution that the model generalizes from its neighbours unless m is large. The probability that the sampler reaches the basin from pure noise, by contrast, grows with m and not with isolation, which explains why the two detection thresholds differ. Distance and multiplicity in the trained models. The design spans five doublings of multiplicity and less than one doubling of distance, since the sources were matched in norm and total variation, so the two factors are compared per doubling. A joint fit over the 288288 added images gives a factor 4.254.25 [3.4,5.3][3.4,5.3] per doubling of kernel distance against 1.491.49 [1.44,1.54][1.44,1.54] per doubling of multiplicity: in the trained models, as in the memorizing solution (Appendix D.1), distance is the stronger factor. The network responds to multiplicity more than the exact denoiser does, which is expected, since each copy also adds training steps on the image. Pixel distances are correlated with ‖x‖\|x\| (see Norm below), Agreement with the exact denoiser. Within a source and multiplicity the network orders the images as the exact map does (ρ=0.78ρ=0.78). The ordering of the sources is not an effect of the norm: at equal ‖x‖\|x\|, κ is larger than for CIFAR-100 by a factor 3.13.1 for colour MNIST and 2.22.2 for SVHN (t=13.7t=13.7 and 9.89.8), and by a factor 1.131.13 for CIFAR-10 (t=1.5t=1.5). Escape radius. The radius r=0.02r=0.02 selected in advance on the public model is not suitable for this noise schedule: the escape occurs at σ≈0.025σ≈ 0.025, below the informative range, and all AUCs except that of colour MNIST are close to 0.50.5. The results of Section 3.2 use r=0.2r=0.2, selected from a sweep over (K,r)(K,r). The separation is stable for r∈[0.1,0.5]r∈[0.1,0.5] and K∈[1,20]K∈[1,20]. The paired design determines the direction of the effect independently of this choice, since the same image is evaluated with the same r in two models. Appendix F Experimental details Noise-prediction models as denoisers. DDPM and Stable Diffusion corrupt the data as xt=α¯tx0+1−α¯tεx_t= α_t\,x_0+ 1- α_t\, at discrete steps t and train ϵθ(xt,t) _θ(x_t,t) to predict ε . Dividing by α¯t α_t gives y=x0+σεy=x_0+σ with σ(t)=(1−α¯t)/α¯tσ(t)= (1- α_t)/ α_t, and the denoiser is Dσ(y)=y−σϵθ(α¯ty,t)D_σ(y)=y-σ\, _θ( α_t\,y,t). CIFAR-10 duplication (Section3.1). The model with duplicates is trained with the improved-diffusion CIFAR-10 configuration [Nichol and Dhariwal, 2021], using the model and diffusion definitions of the original implementation: 5050M parameters, T=4000T=4000 steps with a cosine schedule, learned variances, dropout 0.30.3, 128128 channels at three resolutions, learning rate 10−410^-4, batch size 128128, EMA 0.99990.9999, no horizontal flips, and 500500k steps. The control is the released checkpoint cifar10_uncond_50M_500K.pt. Eight images are duplicated at each m∈2,8,25,50,100,200,400,800m∈\2,8,25,50,100,200,400,800\ in addition to the 50 00050\,000 training images, giving 62 61662\,616 training examples. The multiplicities are chosen so that m=800m=800 corresponds to a per-image mass of 1.28%1.28\%. Images in the lowest 5%5\% of nearest-neighbour distance within CIFAR-10, i.e. the near-duplicates already present in the dataset, are excluded from both the duplicated images and the m=1m=1 images. σc _c is computed on the 6464 duplicated images, 200200 training images and 200200 held-out images by bisection on [0.02,12][0.02,12] with r=0.5r=0.5. Copies are counted with the criterion of Carlini et al. [2023] on 50 00050\,000 DDIM samples with 100100 steps, and FID is computed against the training set with 50 00050\,000 samples per model. The two models are not exactly matched: the held-out loss of the model with duplicates is 11–4.5%4.5\% higher than that of the released checkpoint at every t, and its gap between training and held-out loss is about 5%5\%, against 0.8%0.8\% for the released model, although it sees each non-duplicated image 20%20\% less often. The released checkpoint should therefore be regarded as a reference trained without duplicates rather than as an exactly matched control. CIFAR-10 overfitting (SectionE.2). Each model is a 25.825.8M-parameter DDPM trained for 1515k steps at batch size 128128, so the number of passes over the data decreases from 19 20019\,200 at N=100N=100 to 3838 at N=5⋅104N=5· 10^4. The subsets are nested prefixes of a single permutation, so the subset with N=100N=100 is contained in all others. σc _c is computed by bisection on [0.02,20][0.02,20] with 1212 steps, K=120K=120 and r=0.5r=0.5, on the first 100100 images of the permutation and on 100100 CIFAR-10 test images. For the copy rate we draw DDIM samples with 100100 steps, 10410^4 per model for N≤500N≤ 500 and 5⋅1045· 10^4 otherwise. A sample is a copy when the ratio of its distances to the nearest and second-nearest training images is below 1/31/3; the same criterion applied to a held-out set of the same size finds no copies at any N. The public model is the improved-diffusion checkpoint cifar10_uncond_50M_500K, evaluated on the same images with the same settings. CIFAR-10 rarity (Section3.2). The base set consists of N=104N=10^4 images from the same permutation, and the models use the same architecture and 1515k training steps. The added images bring each training set to 11 51211\,512 examples. Since σc _c on CIFAR-10 depends strongly on ‖x‖\|x\| and on typicality, unmatched images would obtain high values for trivial reasons; the added images are therefore matched to the base set in RMS norm and total variation, and images with a near-duplicate in the CIFAR-10 training set are excluded. Colour MNIST cannot be matched exactly (RMS 0.560.56 against 0.490.49, total variation 0.0380.038 against 0.0560.056) and should be regarded as the extreme of the atypicality range. We draw 10510^5 DDIM samples per model (η=1η=1, 100100 steps). A sample is a copy when its nearest image among the CIFAR-10 training set and all images of the four sources is at RMS distance below 0.070.07 on [0,1][0,1], and below 0.450.45 times the mean distance to the next 5050 images; no image that was not added to a model was copied in 2⋅1052· 10^5 samples. σc _c is computed with K=1K=1 and r=0.2r=0.2 by bisection on the range of the noise schedule up to σ=20σ=20, with 1414 steps. Filtering the memorization dataset. For the Stable Diffusion experiments, we use the matching-verbatim (MV) and template-verbatim (TV) examples released by Webster [2023]. The collection contains many duplicate or near-duplicate entries, particularly among the TV examples, where the same memorized template appears with different visual patterns. To prevent these repeated templates from being overrepresented in our evaluation, we manually deduplicate the collection, retaining one MV copy per image and one TV example per template. We additionally remove a small number of mismatched image–caption pairs. The released collection associates each memorized image with its training caption, but does not guarantee that sampling from that caption reproduces that particular image. In several cases, the stored caption instead reproduces a different memorized image. Because our method evaluates memorization at the level of image–caption pairs, we exclude these mismatches. Figure 13 shows representative examples removed by both filtering steps. Duplicated 1 Duplicated 2 Duplicated 3 Duplicated 4 (a) Duplicate examples Training Generation 1 Generation 2 Generation 3 (b) Mismatched image–caption pairs Figure 13: Examples removed when filtering the memorization dataset. (a) Each row shows a group of duplicate examples, of which we retain only one. (b) The first image in each row is the stored training image, followed by three generations from its training caption. We remove cases in which the caption does not reproduce the stored image. Comparison to Wen et al. [2024]. For the results reported in Table 1, we report the best-performing configuration for both variants of Wen et al. [2024]: n=32n=32 samples with first and first 10 steps for ‖ϵc−ϵ∅‖\| _c- _ \| and ‖ϵc(x0)−ϵ∅(x0)‖\| _c(x_0)- _ (x_0)\|, respectively. Local || | _c|. In order to retain the image local information, we apply the retention test of Definition 3 separately to each 4-dimensional patch xux_u of the latent space, ‖Mσk(xu)−xu‖≤r‖xu‖||M_σ^k(x_u)-x_u||≤ r||x_u||. We first apply the denoising map for K iterations over a logarithmic grid of 24 noise levels. Then, we estimate the local σcuσ^u_c as the geometric midpoint between the noise level that first escapes the radius r and the previous value in the grid, and define local |Δlogσc| _c by averaging over locations. Unless otherwise stated, we use K=16K=16 and r=0.1r=0.1 for the local gap experiments. Appendix G Stable Diffusion: additional experiments Orbits across the (σ,k)(σ,k) grid. Figure 14 expands Figure 1: for the same memorized and control pairs, every row is an orbit at one noise scale, so both the orbit (a row) and the end of the orbit across scales (the last column) can be read off one grid. More qualitative examples are in Appendix G.5. Figure 14: The full (σ,k)(σ,k) grid behind Figure 1: the critical scale on Stable Diffusion v1.4, for the same memorized caption–image pair (left) and control pair (middle), each run with its own caption at guidance scale 11. Each row iterates MσM_σ from the image x at one noise scale σ; a framed iterate Mσk(x)M_σ^k(x) is still within r‖x‖r\|x\| of x. At small σ the model keeps returning x, which therefore sits in a basin of its own; at large σ the orbit drifts away towards content shared with other data. The critical scale σc _c (dashed line) separates the two regimes: the memorized image withstands far more noise than the control before it escapes. Right: the drift ‖Mσk(x)−x‖/‖x‖\|M_σ^k(x)-x\|/\|x\| along the orbit, one curve per scale coloured by σ; the thick curve is a scale above σc _c and the dot marks where it crosses r. Here K=50K=50 and r=0.5r=0.5. G.1 Ablation Figures 15 and 16 assess sensitivity to the number of iterations K and escape radius r. Performance is stable around our primary choices: K=16K=16, with r=0.25r=0.25 for global scores and r=0.1r=0.1 for the local gap. For r=0.25r=0.25, the global scores remain broadly stable through K=64K=64 and deteriorate at larger values. With r=0.1r=0.1, their performance is lower and begins to decline earlier; this sensitivity is particularly pronounced for σc _c on TV examples. By contrast, the local gap performs similarly for both radii across most values of K, with only a modest decline beyond K=128K=128. Noticeably, mean σc _c decreases with K, reducing separation between memorized and control examples and causing the drop in detection performance at large K. The radius ablation shows a similar pattern: global scores are more sensitive to r, especially on TV examples, whereas the local gap maintains strong performance as r varies by an order of magnitude. The main results and the K-ablation estimate σc _c by log-space bisection. To evaluate many radii efficiently, the radius ablation instead uses a logarithmic grid of 24 noise levels and takes the geometric midpoint between the last retained level and the first escaped level. Overall, these results show that the reported performance is not specific to the selected hyperparameters and that the local gap is particularly robust. |Δlogσc|| _c| Local gap σc _c Δlogσc _c Mean σc _c r=0.1r=0.1 r=0.25r=0.25 Figure 15: Ablation on the number of iterations K K. Detection performance as a function of K for escape radii r=0.1r=0.1 and r=0.25r=0.25. The first four columns report AUC for the different critical-scale scores; the final column reports the mean critical scale (solid line) ± one standard deviation (shaded region). Performance is stable around the primary choice K=16,r=0.25K=16,r=0.25. σc _c Δlogσc _c |Δlogσc|| _c| Local |Δlogσc|| _c| Figure 16: Ablation on the escape radius r. Detection performance (AUC) as a function of r using K=16K=16. For this ablation, σc _c is approximated over a logarithmic grid of 24 noise levels rather than estimated by log-space bisection. Performance is stable around the primary choice K=16,r=0.25K=16,r=0.25 (global measures), r=0.1r=0.1 (local |Δlogσc|| _c|). G.2 Further experimental results Figure 17 shows the score distributions for the main detection tasks using the best critical-scale metric in each setting. For separating memorized examples from controls, we use the local |Δlogσc|| _c| with K=16K=16 and r=0.1r=0.1. For distinguishing MV and TV pairs from their caption-swapped counterparts, we use the signed Δlogσc _c with K=16K=16 and r=0.25r=0.25. The caption-swap distributions illustrate why the sign of the gap matters. Most swapped pairs have a negative gap, indicating that an unrelated caption weakens retention relative to the unconditional branch; this behavior is especially frequent for TV examples. Taking the absolute value folds these negative scores onto the positive axis, obscuring the separation between original and swapped pairs. Figure 17: Critical-scale score distributions across evaluation groups. Histograms of the scores used to separate the different groups. Left: Local |Δlogσc|| _c| for MV, TV, and control examples (K=16K=16, r=0.1r=0.1). Center-Right: Signed Δlogσc _c for MV and TV pairs with their original and swapped captions (K=16K=16, r=0.25r=0.25). Swapped pairs frequently have negative gaps. G.3 Detecting memorized regions: additional qualitative examples Figure 18 presents four additional TV examples. As in Figure 6 (left), large local gaps align with content reproduced consistently across generations, whereas regions that vary tend to have gaps near zero. These examples further show that the local critical-scale gap captures the spatial extent of memorized content across different images. Figure 18: Additional examples of localized memorization. Each panel shows a TV training image, generations from its caption, and the corresponding local |Δlogσcu|| _c^u| map. Large gaps align with regions reproduced consistently across generations, whereas variable regions generally have gaps near zero. G.4 Further analysis of mismatched caption gap Ambiguity near zero. As shown in Figure 6 (right), the gap between mismatched-caption and unconditional critical scales is most informative when strongly negative. Values near zero, however, can represent two different regimes. Both branches may retain the image, indicating unconditional memorization and therefore yielding successful inpainting, or neither branch may retain it, indicating the absence of unconditional memorization. Because the gap measures relative retention, it cannot distinguish between these cases. Figure 19 (top) illustrates the first regime and Figure 19 (bottom) the second: despite having similar gaps, the examples have markedly different critical scales and inpainting performance. Further examples with negative gap. Figure 20 provides two further examples with negative gaps. Both show evidence of unconditional memorization, but the example with the more negative gap yields more faithful reconstructions, consistent with stronger relative retention by the unconditional branch. Figure 19: Near-zero gaps are ambiguous. The two examples have similar mismatched-caption gaps but different absolute retention. Top: Both branches retain the image, and unconditional reconstruction succeeds. Bottom: Neither branch retains the image, and unconditional reconstruction fails. Figure 20: Additional examples with negative mismatched-caption gaps. Both examples exhibit unconditional retention and successful inpainting. The more negative gap in the top example corresponds to more faithful reconstructions than the less negative gap in the bottom example. G.5 Further qualitative examples Figures 21–23 provide additional comparisons of fixed-scale trajectories and critical scales for matching-verbatim (MV), template-verbatim (TV), and control training images. Overall, retention is strongest for MV examples, followed by TV examples and then randomly selected controls: MV images remain close to their initial states for more iterations and at larger noise scales than TV images, which in turn persist longer than controls. The TV trajectories also reveal spatial differences in retention. In the bedroom example of Figures 23 and 25, the surrounding room remains stable after the bedsheet pattern has been smoothed, consistent with the memorized and variable regions identified in Figure 18. Similarly, in Figure 22, the non-memorized curtain pattern disappears first, whereas the memorized plant and chair persist longer. These examples provide qualitative evidence that fixed-scale dynamics retain memorized regions longer than non-memorized ones, further motivating a local measure for partially memorized images. Figure 24 illustrates how the caption gap distinguishes memorized image–caption pairs from controls. For the MV example, conditioning on the training caption retains the image to larger noise scales than the unconditional branch, producing a large positive Δlogσc _c. For the control, the two branches escape at similar scales, and the gap is close to zero. Figure 25 further illustrates how retention varies across memorization types and image regions. In the upper comparison, the MV example has the largest σc _c, followed by the TV example and then the control. The lower comparison shows two TV examples: the image with memorized content occupying a larger region has the larger σc _c. Within both TV images, non-memorized content—the floor in the first and the bedsheet pattern in the second—disappears at smaller noise scales than the memorized regions. Figure 21: Trajectory and critical scale MV vs control. Top: critical scale on for a totally memorized caption–image pair (left) and a control pair (right), each run with its own caption at guidance scale 11. Each row iterates MσM_σ from the image x at one noise scale σ; a framed iterate Mσk(x)M_σ^k(x) is still within r‖x‖r\|x\| of x. At small σ the model keeps returning x, which therefore sits in a basin of its own; at large σ the orbit drifts away towards content shared with other data. The critical scale σc _c (dashed colored line) separates the two regimes: the memorized image withstands far more noise than the control before it escapes. Bottom: the drift ‖Mσk(x)−x‖/‖x‖\|M_σ^k(x)-x\|/\|x\| along the orbit, one curve per scale coloured by σ; the thick curve is a scale above σc _c and the dot marks where it crosses r. Figure 22: Trajectory and critical scale TV vs control. Top: critical scale on for a partially memorized caption–image pair (left) and a control pair (right), each run with its own caption at guidance scale 11. Each row iterates MσM_σ from the image x at one noise scale σ; a framed iterate Mσk(x)M_σ^k(x) is still within r‖x‖r\|x\| of x. At small σ the model keeps returning x, which therefore sits in a basin of its own; at large σ the orbit drifts away towards content shared with other data. The critical scale σc _c (dashed colored line) separates the two regimes: the memorized image withstands far more noise than the control before it escapes. Bottom: the drift ‖Mσk(x)−x‖/‖x‖\|M_σ^k(x)-x\|/\|x\| along the orbit, one curve per scale coloured by σ; the thick curve is a scale above σc _c and the dot marks where it crosses r. Figure 23: Trajectory and critical scale MV vs TV. Top: critical scale on for a totally memorized caption–image pair (left) and a partially memorized pair (right), each run with its own caption at guidance scale 11. Each row iterates MσM_σ from the image x at one noise scale σ; a framed iterate Mσk(x)M_σ^k(x) is still within r‖x‖r\|x\| of x. At small σ the model keeps returning x, which therefore sits in a basin of its own; at large σ the orbit drifts away towards content shared with other data. The critical scale σc _c (dashed colored line) separates the two regimes: the memorized image withstands far more noise than the control before it escapes. Bottom: the drift ‖Mσk(x)−x‖/‖x‖\|M_σ^k(x)-x\|/\|x\| along the orbit, one curve per scale coloured by σ; the thick curve is a scale above σc _c and the dot marks where it crosses r. Figure 24: _c for MV and control images. The top row shows an MV image–caption pair and the bottom row a control. The left and center panels show fixed-scale trajectories across noise levels under training-caption and unconditional conditioning, respectively. The right panels plot maxk≤K‖Mσk(x)−x‖/‖x‖ _k≤ K||M_σ^k(x)-x||/||x|| for both branches. Their crossings with the dotted threshold r define the conditional and unconditional critical scales, whose log difference is Δlogσc _c. The MV pair has a large gap because its caption substantially increases retention, whereas the control has nearly equal critical scales and a gap close to zero. Figure 25: Fixed-scale trajectories across noise levels. Each comparison shows the iterate MσK(x)M_σ^K(x) across noise scales (top) and the maximum normalized displacement maxk≤K|Mσk(x)−x|/|x| _k≤ K|M_σ^k(x)-x|/|x| as a function of σ (bottom). The dotted line marks the escape radius r; its crossing determines σc _c. The upper panel compares an MV, a TV, and a control image, ordered from longest to shortest retention. The lower panel compares two TV images with different amounts of memorized content. The image with more memorized content is retained longer.