Paper deep dive
Loss Curvature as a Sampling-Free Proxy for Memorization in Diffusion Models
Shashank Sule, Xinyue Yu, Boonam Shin, Yuxuan Liu, Abolfazl Hashemi, Hayden Schaeffer
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 10/15/2026, 4:52:32 AM
Summary
This paper investigates memorization in diffusion models by proposing input loss curvature (the Frobenius norm of the Hessian of the training loss) as a sampling-free proxy. It demonstrates that averaged input curvature tracks model-level memorization onset, where validation curvature diverges from training curvature. Furthermore, it introduces a counterfactual definition of sample-level memorization and proves that this metric is bounded by the input curvature of the leave-one-out model, linking local loss landscape geometry to generation likelihood.
Entities (9)
Relation Signals (6)
Input Loss Curvature → measures → Frobenius norm of Hessian
confidence 98% · input loss curvature, or the Frobenius norm of the Hessian of the diffusion model’s training loss
Input Loss Curvature → isproxiedby → Memorization
confidence 95% · input loss curvature ... is an effective metric for quantifying both perspectives on memorization
DDPM → isusedon → ImageNet
confidence 95% · we train DDPMs to sample two datasets: (1) 64x64 RGB ImageNet-1K
DDPM → isusedon → CelebA
confidence 95% · and (2) 32x32 greyscale CelebA images
Counterfactual Memorization → isboundedby → Input Loss Curvature of Leave-One-Out Model
confidence 93% · counterfactual memorization is controlled by the input curvature of the leave-one-out model
Validation Curvature → divergesfrom → Training Curvature
confidence 90% · the curvature over the validation set starts separating from the training curvature at the onset of memorization
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Understanding the mechanism behind why diffusion models memorize their training data remains an open question in generative modeling. In this paper, we examine this question from two perspectives: (a) the model-level perspective concerning the onset of memorization in a model during training, and (b) the sample-level perspective concerning the proclivity of an individual sample to be memorized by a given model. We show that the so-called input loss curvature, or the Frobenius norm of the Hessian of the diffusion model's training loss, is an effective metric for quantifying both perspectives on memorization. In particular, we empirically demonstrate that input curvatures averaged across training and validation samples can identify when a model is likely to start regurgitating its training data when tracked over training time. However, this metric is not sufficient for measuring an individual sample's likelihood of being memorized. To address this perspective, we introduce a counterfactual definition of memorization in diffusion models, extending the analogous notion from supervised learning proposed by [Feldman, 2019]. We prove that this counterfactual memorization is controlled by the input curvature of the leave-one-out model, thus establishing a direct theoretical link between a sample's local loss landscape and its generation likelihood. We validate our derived bounds through several empirical experiments and show that input-dependent curvature provides a proxy for memorization.
Tags
Links
- Source: https://arxiv.org/abs/2610.19042v1
- Canonical: https://arxiv.org/abs/2610.19042v1
Trouble viewing inline? Open PDF directly →
Full Text
88,973 characters extracted from source content.
Expand or collapse full text
Loss Curvature as a Sampling-Free Proxy for Memorization in Diffusion Models Shashank Sule Xinyue Yu Boonam Shin Yuxuan Liu Abolfazl Hashemi Hayden Schaeffer Abstract Understanding the mechanism behind why diffusion models memorize their training data remains an open question in generative modeling. In this paper, we examine this question from two perspectives: (a) the model-level perspective concerning the onset of memorization in a model during training, and (b) the sample-level perspective concerning the proclivity of an individual sample to be memorized by a given model. We show that the so-called input loss curvature, or the Frobenius norm of the Hessian of the diffusion model’s training loss, is an effective metric for quantifying both perspectives on memorization. In particular, we empirically demonstrate that input curvatures averaged across training and validation samples can identify when a model is likely to start regurgitating its training data when tracked over training time. However, this metric is not sufficient for measuring an individual sample’s likelihood of being memorized. To address this perspective, we introduce a counterfactual definition of memorization in diffusion models, extending the analogous notion from supervised learning proposed by [Feldman, 2019]. We prove that this counterfactual memorization is controlled by the input curvature of the leave-one-out model, thus establishing a direct theoretical link between a sample’s local loss landscape and its generation likelihood. We validate our derived bounds through several empirical experiments and show that input-dependent curvature provides a proxy for memorization. $ $$ $footnotetext: Equal contribution.11footnotetext: Department of Mathematics, University of California, Los Angeles, CA 90095, USA.22footnotetext: Elmore Family School of Electrical and Computer Engineering, Purdue University, West Lafayette, IN 47907, USA. 1 Introduction Diffusion and score-based models are state-of-the-art generative models across domains from vision to drug discovery [40, 21, 44, 45, 35, 31, 1, 32]. Their appeal lies in generating novel yet realistic data, suggesting they estimate the data distribution from finitely many samples. Yet diffusion models sometimes regurgitate training samples, a failure mode called memorization, which poses privacy and copyright risks [12, 41, 42, 20]. Existing work studies memorization at two levels: 1. Model-level memorization asks how closely the trained score matches the minimizer of the empirical denoising score matching loss [48, 5], namely the score of the Gaussian KDE of the training set, whose sampling reproduces the training data exactly. Tracking training time τ, models first generalize (at τgen _gen) and later memorize (at τmem _mem) [8, 7, 50, 2], but these time-scales are known only asymptotically, and measuring the memorized fraction fmem(τ)f_mem(τ) requires costly sampling. 2. Sample-level memorization asks which training points are copied. Previous work attributes sample-level memorization to the presence of duplicates [12, 42, 52, 13]. More generally, sample-level memorization refers to the influence of an individual sample on a model. This connects to to the long-tail theory of [18], which motivates the counterfactual memorization measure of [17] (see also [51]). Extending this measure to diffusion models is nontrivial because the training objective (denoising loss) differs from the test objective (likelihood), and generalization in diffusion models has its own geometric structure [23]. These perspectives motivate sampling-free proxies of memorization which can ideally be measured during training. We propose using input loss curvature from [34] given by Curvϕ(x)=ϕ∼(S)[‖∇x2ℓ(ϕ,x)‖F2], _φ(x)=E_φ (S) [\|∇^2_x (φ,x)\|^2_F ], (1) as such a proxy. We use it for two reasons: (i) it is the leading order term that bounds Feldman’s memorization score, is among the strongest membership-inference signals, and estimates differential privacy [33, 34, 19, 39, 11, 16]; (i) the Hessian of the potential −logp(x)- p(x) governs the local geometry of sampling, with higher curvature confining Langevin trajectories near a minimizer for longer [10, 6]. However, during training it is prohibitively expensive to compute these negative log likelihoods–instead, we investigate whether the second order information on the loss can help predict the properties implied by the second order information of the negative log likelihood. Contributions. (a) Curvature over training image tracks memorization. We demonstrate that on ImageNet 64×6464× 64 and CelebA 32×3232× 32, Curvϕ(x)Curv_φ(x) averaged over the training set corresponds to the fmemf_mem score and rises as the model overfits. Moreover, at the onset of memorization, samples that are copied (i.e appear to be in the training set) have higher curvature than samples that are not copied. (b) Held-out curvature separates from training curvature during memorization. While curvature over training images rises, the curvature over the validation set starts separating from the training curvature at the onset of memorization. Surprisingly, validation curvature hits a minimum during training and starts rising as memorization proceeds, while validation loss continues to decrease. The local minimum of validation curvature provides an early-stopping measure for diffusion models that indicates the prevalence of model-level memorization. (c) A counterfactual notion of memorization. We illustrate that while curvature indicates model-level memorization, it cannot signal the copy frequency of individual samples. To quantify such individual sample influence, we introduce a new notion of memorization, termed counterfactual memorization given by the log-odds of sampling xix_i with and without its inclusion in the training data. (d) Counterfactual memorization is bounded by curvature. By lifting the differences in log-likelihoods to model losses via a decomposition given in [22], we quantify the influence of training dynamics on counterfactual memorization. In particular, we demonstrate that when the model starts overfitting, the log-likelihood difference is captured at the leading order by the curvature of the leave-one-out model and the nearest neighbour distance. 2 Background 2.1 Diffusion Models A diffusion model is a generative algorithm for sampling from an unknown density p by transforming noise into clean data. To learn such a model we first establish the following forward process: dYt=f(t,Yt),dt+g(t),dWt,Y0=x∼p, dY_t=f(t,Y_t),dt+g(t),dW_t, Y_0=x p, (2) When f(t,y)=f(t)yf(t,y)=f(t)y, the transition kernel is Gaussian: Yt|Y0=x∼(m(t)x,σ(t)2I)Y_t Y_0=x (m(t)x,σ(t)^2I). The schedules (m,σ)(m,σ) and the coefficients (f,g)(f,g) thus determine each other: f(t)=m′(t)m(t),g(t)2=dtσ(t)2−2m′(t)m(t),σ(t)2. f(t)= m (t)m(t), g(t)^2= ddtσ(t)^2-2 m (t)m(t),σ(t)^2. (3) Anderson’s theorem [3] gives the backward SDE, whose law at time t is that of YT−tY_T-t: dX¯t d X_t =(g¯(t)2∇logpT−t(X¯t)−f¯(t,X¯t)),dt = ( g(t)^2∇ p_T-t( X_t)- f(t, X_t) ),dt (4) +g¯(t),dBt + g(t),dB_t (5) where f¯(t,x)=f(T−t,x) f(t,x)=f(T-t,x) and g¯(t)=g(T−t) g(t)=g(T-t). Thus, given f and g, sampling from p reduces to knowing the score ∇logpt∇ p_t and running the backward SDE from t=0t=0 to t=Tt=T. Via the Tweedie-Miyasawa formula [X∣Yt=y]=y+σ2(t)∇logp(t,y)m(t), [X Y_t=y]= y+σ^2(t)∇ p(t,y)m(t), (6) we can instead parameterize the denoiser [X∣Yt=y]E[X Y_t=y] and recover the score by rearranging (6). We therefore train a model DϕD_φ by MMSE denoising: ℓ(ϕ,x):=t∈[0,T],yt∼Yt[λ(t)∥x−Dϕ(yt,t)]∥22∣Y0=x]. (φ,x):=E_t∈[0,T],y_t Y_t [λ(t)\|x-D_φ(y_t,t)]\|_2^2 Y_0=x ]. (7) Here λ(t)λ(t) is a choice of weighting function. Substituting the learned score sϕ=σ(t)−2(m(t)Dϕ−y)s_φ=σ(t)^-2(m(t)D_φ-y) gives the plug-in SDE: dXt=(g¯(t)2s(t,Xt)−f(t,Xt)¯)dt+g¯(t)dBt. dX_t=( g(t)^2s(t,X_t)- f(t,X_t))\,dt+ g(t)\,dB_t. (8) The plug-in SDE has density pϕ(y,t)p_φ(y,t). At generation time we integrate (8) forward, obtaining the terminal distribution pϕ(⋅,T)p_φ(·,T) as an approximation to the true distribution p. 2.2 DDPMs In this paper, we use Denoising Diffusion Probabilistic Models (DDPMs) [21] corresponding to taking f(t)=−12β(t)f(t)=- 12β(t) and g(t)=β(t)g(t)= β(t) for some non-negative rate function β. Writing α¯(t):=exp(−∫0tβ(u)du) α(t):= (- _0^tβ(u)\,du ), one finds Φ(t)=α¯(t) (t)= α(t) and, using dsα¯(s)−1=β(s)α¯(s)−1 dds α(s)^-1=β(s) α(s)^-1, m(t)=α¯(t),σ(t)2=1−α¯(t). m(t)= α(t), σ(t)^2=1- α(t). (9) To sample from DDPMs, we use an accelerated non-Markovian sampler given in [43]. More generally, note that the sampling process via (8) is implemented by discretizing the SDE via Euler-Maruyama, leading to a stochastic sampling trajectory. A deterministic sampling, using the probability flow ODE or flow-matching may also be used [45, 25]. In Appendix B, we provide experimental details and additional details on flow matching. 2.3 Log-Likelihoods via the Denoising Loss Diffusion models are trained by using the loss (7). However, at test time, their performance is measured by the fidelity of p(⋅,T)p(·,T) to the true distribution p. Therefore, their training and test tasks are rather different. However, an evidence lower bound (ELBO) shows that the denoising loss bounds the negative log-likelihood of the distribution pϕ(⋅,T)p_φ(·,T). In fact, [22] described the gap between the ELBO and −logpϕ(⋅,T)- p_φ(·,T) exactly under the likelihood weighting λ(t)=g2(t)λ(t)=g^2(t): Proposition 2.1 (Theorem 4 in [22]). Let ℓ(ϕ,x) (φ,x) be the denoising loss (7), pϕ(x,T)p_φ(x,T) the distribution of the plug-in SDE (8) at time T and sϕs_φ the learned score function in (8). Then −logpϕ(x,T)−ℓ(ϕ,x)=C - p_φ(x,T)- (φ,x)=C +∫0T[g2(t)‖sϕ(Yt,t)−∇logϕ(Yt,T−t)‖22∣Y0=x]dt⏟Gapϕ(x), + _0^TE [g^2(t)\|s_φ(Y_t,t)-∇ _φ(Y_t,T-t)\|_2^2 Y_0=x ]\,dt_Gap_φ(x), (10) where C is a constant independent of x or ϕφ but dependent on the data dimension d, and the noise schedules f,gf,g. The RHS in (10) is purely a self-consistency gap, i.e it measures how close the score of the reversed plug-in SDE is to the original forward SDE. 2.4 Memorization Here we summarize the framework of [18, 17]. Let A be a training algorithm, possibly randomized, and write hSϕh^φ_S for the model with parameters ϕ∼(S)φ (S). Let ℓ(hSϕ,z) (h^φ_S,z) be its loss on an example z, and let S∖i=S∖ziS i=S z_i. The memorization of ziz_i is the change in expected loss at ziz_i caused by its inclusion in the training set, M(zi,S) M(z_i,S) =|,ϕ∼(S)[ℓ(hSϕ,zi)]−ϕ′∼(S∖i)[ℓ(hS∖iϕ′,zi)]|. = |,E_φ (S)[ (h^φ_S,z_i)]\ -E_φ (S i)[ (h^φ _S i,z_i)] |. A large value means the model only fits ziz_i because it was trained on ziz_i. 3 Empirical Results We begin with an empirical investigation of curvature as a proxy for memorization in diffusion models. To do so, we train DDPMs to sample two datasets: (1) 64×6464× 64 RGB ImageNet-1K [14, 37], and (2) 32×3232× 32 greyscale CelebA images, also used in [8]). To further isolate the memorization phenomenon, we train six distinct DDPMs on datasets of size n=2kn=2^k for 7≤k≤127≤ k≤ 12 for ImageNet-1k and two distinct DDPMs on datasets of size n=128,10240n=128,10240 for CelebA, noting that for CelebA, n=128n=128 corresponds to a memorizing model while n=10240n=10240 corresponds to a generalizing model. Across the training time τ, we track the mean curvature over the training samples and validation samples: Avg. train curvature =x∼train[‖∇x2ℓ(ϕ(τ),x)‖F2], =E_x [\|∇^2_x (φ(τ),x)\|^2_F], (11) Avg. val curvature =x∼val.[‖∇x2ℓ(ϕ(τ),x)‖F2]. =E_x .[\|∇^2_x (φ(τ),x)\|^2_F]. (12) We also generate 10,00010,000 samples to compute the fmemf_mem score. Following [20, 50, 9], a generated sample x is considered memorized if [‖x−aμ1‖2‖x−aμ2‖2<k], [ \|x-a _1\|_2\|x-a _2\|_2<k ], (13) where aμ1a _1 and aμ2a _2 are the nearest and second nearest neighbors in the training set to x. We say that a training sample xix_i is copied if it appears in the generated set. Its copy count F(i)F(i) refers to the frequency of occurrences of xix_i in the generations. In Appendix C we visualize the samples generated from our various models. Here we assess the input loss curvature of our models during training. Evolution of input curvature during training. In Figure 1, we report our experiments on CelebA. We find that: 1. Mean training curvature rises over training together with fmem(τ)f_mem(τ) (panel (C)). The rise alone does not mark the onset: training curvature is already increasing while fmemf_mem is still flat. 2. The onset shows up in the validation curvature. It stays with the training curvature and then diverges, in both panels (A) and (B), at the step where fmem(τ)f_mem(τ) starts to accelerate. The same split appears for the generalizing model (panel (D)), where memorization is delayed until τ≈105τ≈ 10^5. This motivates defining the relative change in avg. train and validation curvatures as a stopping criterion: ΔCurv(τ) (τ) (14) :=|Avg. train curvature−Avg. val. curvature||Avg. train curvature| := |Avg. train curvature-Avg. val. curvature||Avg. train curvature| we may consider stopping training when ΔCurv(τ)≥ε (τ)≥ , where ε modulates the threshold required to limit memorization. Notably this estimator does not need to generate any samples during training, saving significant computational cost. 3. Once memorization is heavy, every training image is reproduced but at different frequencies. However, the curvature of an individual image does not predict its copy count (Panel (F)). In Figure 2, we repeat these experiments for ImageNet, observing patterns consistent with CelebA. In Panel (F), we confirm that fmem(τ)f_mem(τ) rises and reaches 100% by τ≈106τ≈ 10^6 for every model except n=4096n=4096. The validation loss, a zeroth-order quantity, falls throughout training for every n (Panel (E)), so the held-out loss alone does not detect memorization. However, in panel (A), we find that input curvature for training samples rises with τ, but the average validation curvature reaches a local minimum and then rises once the model begins to memorize heavily. In Panel (D), we show that ΔCurv(τ) (τ) reaches a local maximum at around τ=105τ=10^5, where most models are memorizing. Appendices D and E provide additional numerical experiments. Figure 1: (A) Train vs. validation input curvature for CelebA, n=128, (B) Val. curvature starts to diverge from train curvature when fmem(τ)f_mem(τ) starts accelerating, (C) fmem(τ)f_mem(τ) values for n=128,10240n=128,10240 on CelebA, (D) and (E) Same experiment for CelebA, n=10240. Note that this model undergoes generalization, and memorization sets in much later at τ≈105τ≈ 10^5, (F) Curvature of an individual sample is not a good predictor of its copy count. Figure 2: (A) Input (11) curvatures consistently rise but validation (12) curvatures reach a local minimum at approximately peak memorization for DDPMs on different data sizes, (B) Sizes of gradients of validation loss also display local minima, (C) Input curvature on training data tracks the largest frequency of memorized samples, (D) Relative error between train and validation curvatures exhibits a local maximum, leading to an early stopping criterion, (E) Memorization cannot be detected just based on validation loss, (F) Memorization rises as models train further. 4 Sample-Level Memorization Our results in Section 3 show that while curvature, aggregated over either training or held-out sets, is a good indicator of model-level memorization, it is not a good signal for whether a given sample will be memorized more than another one. To address this gap, we introduce a counterfactual memorization, analogous to what was defined in [52]. Before we begin, we establish the relevant notation. 4.1 Notation The notation will be borrowed from [33]. Let X be the space of inputs, Y the space of outputs, and h a model h:→h:X . The joint distribution in the input-output pair z=(x,y)z=(x,y) will be denoted pZp_Z and its X and Y marginals will be the input and output distributions. The model will be drawn from some parametric function class C parameterized by Φ⊆ℝP ^P where P represents the total number of parameters. To mark its dependence on parameters, the model will therefore be denoted as hϕh^φ. In practice, we draw a finite number of samples S=zii=1n=(xi,yi)i=1nS=\z_i\_i=1^n=\(x_i,y_i)\_i=1^n from n=(×)nS^n=(X×Y)^n and train to fit a loss c:×′c:Y×Y on the data. We assume the n-data points are sampled i.i.d; therefore pZp_Z induces a distribution (via independence) on nS^n, termed pZnp^n_Z. Given S∼pZnS p^n_Z, the training process is quantified by some algorithm :n→ℳA:S^n , where ℳ⊆2(Φ)M _2( ) and 2(Φ)P_2( ) is the class of square integrable random m on Φ . A model trained with data S with parameters ϕφ is thus denoted hSϕh^φ_S. We may define the loss over the model hSϕh^φ_S and z as ℓ(hSϕ,z)=c(hSϕ(x),y). (h^φ_S,z)=c(h^φ_S(x),y). (15) Wherever necessary we will abuse notation and identify the function ϕ,z→ℓ(hSϕ,z)φ,z→ (h^φ_S,z) with ℓ . Given a dataset S we will also define the losses on S as follows: ℓ(ϕ,S):=1|S|∑i=1|S|ℓ(hSϕ,zi). (φ,S):= 1|S| _i=1^|S| (h^φ_S,z_i). (16) We also set ℓ∗(S):=infϕ∈Φℓ(ϕ,S) ^*(S):= _φ∈ (φ,S). 4.2 The Counterfactual Log-Odds of Sampling We may simplify the notation above in the specific case of diffusion models. In particular, the training objective (7) is unsupervised, and thus zi=xiz_i=x_i. Moreover, we assume hϕh^φ is produced via score matching/denoising and that it is then used to drive the SDE (8). We now define the counterfactual memorization: Definition 4.1. Let zi∈Sz_i∈ S be a training example and ϕ∼(S),ϕ′∼(S∖i)φ (S),φ (S i) be parameter distributions after optimization on the datasets S,S∖iS,S i. Let pϕ(⋅,T),pϕ′(⋅,T)p_φ(·,T),p_φ (·,T) be the time marginals of the distributions produced by driving the plug-in SDE (8). Then the sampling time memorization of ziz_i is given by: m(zi,S):=ϕ,ϕ′[logpϕ(zi,T)−logpϕ′(zi,T)]. m(z_i,S):=E_φ,φ [ p_φ(z_i,T)- p_φ (z_i,T)]. (17) Note that m(zi,S)m(z_i,S) represents the log-odds of sampling ziz_i with and without its presence in the training data. Large m implies that the model would be much less likely to sample ziz_i if it wasn’t included in the dataset. We also introduce a difference in the counterfactual losses, borrowed from [34, 33, 18, 17]: M(zi,S) M(z_i,S) =ϕ∼(S)[ℓ(hSϕ,zi)] =E_φ (S)[ (h^φ_S,z_i)] (18) −ϕ′∼A(S∖i)[ℓ(hS∖iϕ′,zi)]. -E_φ A(S i)[ (h^φ _S i,z_i)]. (19) We now use the decomposition (10) to write m in terms of M: Proposition 4.2. Let ϕ,ϕ′φ,φ be parameter distributions as defined in 4.1 and m, M be defined as in (17) and (19). Fix xi∈Sx_i∈ S. Then: −ϕ′[Gapϕ′(xi)]−M(xi,S)≤m(xi,S)≤ -E_φ [Gap_φ (x_i)]-M(x_i,S)≤ m(x_i,S)≤ (20) M(xi,S)+ϕ[Gapϕ(xi)]. M(x_i,S)+E_φ[Gap_φ(x_i)]. (21) We now bound M purely in terms of the properties of the leave-one-out model hϕ′h_φ . We establish a number of mathematical preliminaries. 4.3 Mathematical Preliminaries For a pair zi∈Sz_i∈ S, zj∈S∖iz_j∈ S i we use four scalar quantities throughout: dij d_ij :=‖zi−zj‖2,γj:=‖∇xℓ(ϕ,zj)‖2, :=\|z_i-z_j\|_2, _j:=\| _x (φ,z_j)\|_2, (22) κi _i :=ϕ′∼(S∖i)[‖∇z2ℓ(ϕ′,zi)‖F2] :=E_φ (S i)[\|∇^2_z (φ ,z_i)\|_F^2] (23) Cij C_ij :=|ϕ∼(S)ℓ(ϕ,zi)−ϕ′∼(S∖i)ℓ(ϕ′,zj)|. := |E_φ (S) (φ,z_i)-E_φ (S i) (φ ,z_j) |. (24) Assumption 1. (ℓ has ρ-Lipschitz hessians) The Hessian of the loss ℓ is Lipschitz in the z-variable, i.e for every ϕ∈Φφ∈ , there exists ρ (possibly dependent on ϕφ) such that: ‖∇z2ℓ(ϕ,z′)−∇z2ℓ(ϕ,z)‖2≤ρ‖z′−z‖2, \|∇^2_z (φ,z )-∇^2_z (φ,z)\|_2≤ρ\|z -z\|_2, (25) for every z,z′∈z,z . Assumption 2. (Loss behaves like MSE) We assume that the cost function c(x,y)c(x,y) satisfies ‖∇yc(x,y)‖22≤2βc(x,y). \| _yc(x,y)\|^2_2≤ 2β c(x,y). (26) Note that any c that is β-Lipschitz in the y-variable satisfies (26) [46]. For instance, the MSE c(x,y)=‖x−y‖22c(x,y)=\|x-y\|_2^2, or c(x,y)=‖h(x)−y‖22c(x,y)=\|h(x)-y\|_2^2 where h(x)h(x) is itself Lipschitz satisfy (26). Assumption 3. (The underlying function is neural network-like) We assume that all hϕ=g(ϕ1x,ϕ2)h^φ=g( _1x, _2) where ϕ=(ϕ1,ϕ2)φ=( _1, _2). Most neural network architectures satisfy this assumption. Note that the term in (28) is not quite M(zi,S)M(z_i,S) because the second term in the absolute value involves zjz_j (which is part of S∖iS i) and not ziz_i. Assumption 4. We assume that A is a first order optimizer in the parameters, i.e there exist εgrad _grad and εloss _loss such that ϕ∼(S)[‖∇ϕℓ(ϕ,zj)‖2]≤εgrad,ϕ∼(S)[l(ϕ,zj)]≤εloss, _φ (S)[\| _φ (φ,z_j)\|_2]≤ _grad,E_φ (S)[l(φ,z_j)]≤ _loss, (27) for every zj∈Sz_j∈ S. Note that condition (27) is typically met by most deterministic and stochastic optimizers like SGD, Adam, or even full batch gradient descent. Assumption 5. We assume that under (S)A(S), the weights ϕφ are almost surely bounded by B. Assumption 6. There exists a constant C independent of xi,xjx_i,x_j in the leading order (i.e C=O(1)C=O(1) in xi,xjx_i,x_j) such that with high probability in pZnp^n_Z, for any zi∈S,zj∈S∖iz_i∈ S,z_j∈ S i the following difference is uniformly bounded by C: |ϕ∼(S)[ℓ(hSϕ,zi)]−ϕ′∼(S∖i)[ℓ(hS∖iϕ′,zj)]|≤C. _φ (S)[ (h^φ_S,z_i)]-E_φ (S i)[ (h^φ _S i,z_j)]|≤ C. (28) Assumption 4 models (S)A(S) as a first order optimizer that leads to bounded weights upon optimization. In the context of neural networks the weight-boundedness under standard optimization algorithms has been observed in several contexts, from deep linear models [38], feedforward ReLU (or leaky ReLU) networks [15] to transformers [4]. 4.4 Training-Time Memorization is Controlled by Leave-One-Out Curvature Theorem 4.3. Under Assumption 1, for every zi∈Sz_i∈ S and every zj∈S∖iz_j∈ S i, |M(zi,S)|≤Cij+γjdij+32κidij2+2ρ3dij3.|M(z_i;S)|\;≤\;C_ij+ _j\,d_ij+ 32\, _i\,d_ij^2+ 2ρ3\,d_ij^3. (29) If Assumptions 2–5 hold, then γj≤Bεgrad‖zj‖2+εloss, _j\;≤\; B\, _grad\|z_j\|_2+ _loss, (30) and if Assumption 6 holds as well, then with dNN(i):=minj≠idijd_N(i):= _j≠ id_ij, |M(zi,S)|≤ |M(z_i;S)|\;≤\; C+dNN(i)2(32κi+2ρ3dNN(i)) C+d_N(i)^2 ( 32\, _i\,+ 2ρ3\,d_N(i) ) +(Bεgradminj‖zj‖+εloss)dNN(i). + ( B _grad _j\|z_j\|+ _loss )d_N(i). (31) Corollary 4.4. Let Assumptions 1–6 hold and additionally suppose εgrad,εgrad≪dNN(i) _grad, _grad d_N(i). Set C(i):=(C+ϕ′[Gapϕ′(xi)])C(i):=(C+E_φ [Gap_φ (x_i)]). Then: −(C(i)+o(1))−dNN(i)2(32κi+2ρ3dNN(i)) -(C(i)+o(1))-d_N(i)^2 ( 32\, _i\,+ 2ρ3\,d_N(i) ) (32) ≤m(xi,S)≤dNN(i)2(32κi+2ρ3dNN(i))+C(i)+o(1). ≤ m(x_i,S)≤ d_N(i)^2 ( 32\, _i\,+ 2ρ3\,d_N(i) )+C(i)+o(1). (33) The proofs are provided in Appendix A. We make the following comments regarding Theorem 4.3: 1. Under Assumption 1 alone, (29) is a cubic expansion about an arbitrary second training point zjz_j. Each coefficient can be large and can depend on the query point ziz_i: the training-loss gap CijC_ij, the leave-one-out input gradient γj _j, the leave-one-out curvature κi _i, and the Hessian Lipschitz constant ρ. 2. Assumptions 2–5 put a neural network and a first-order method into the bound. When the algorithm overfits, εgrad _grad and εloss _loss can be considered to be comparably small against κidij _i\,d_ij, the curvature of the leave-one-out loss ℓ(ϕ′,zi) (φ ,z_i). Curvature thus bounds counterfactual memorization at the leading order, during overfitting. 3. Assumption 6 asks for a uniform C that is O(1)O(1) in x. We can undertake a splitting argument to show that this C=O(n)C=O(n)–this is comparable to an analogous bound obtained in [34] (Theorem 5.1) which is also O(n)O(n). 4. [33] obtain C=O(n)C=O(n) using β-uniform stability and remove the first order terms γi _i by comparing (S)A(S) with (S′)A(S ) on υ -adjacent datasets, where any two points lie at most a distance of υ apart, for small υ . [34] remark that a training set must be augmented post-hoc to make it υ -adjacent. Here Assumption 6 replaces the uniform stability assumption. Moreover, we do not require such a condition on the data–instead we restrict the model class to be structured like a neural network in order to use its inductive biases to make the first order terms negligible. Overall, our bound does not require uniform stability, υ -adjacency, or bounded loss as is required by Theorem 5.1 in [34]–however, we make more structural but nonetheless realistic assumptions on the model class and the algorithms at hand. 4.5 Application to Diffusion Models We can make further specifications with additional assumptions for the denoising loss (7) and the fact that typically, the hypothesis class hϕh^φ contains linear functions. Assumption 7. We assume that for any M∈ℝd×mM ^d× m and b∈ℝmb ^m there exists some ϕφ such that hϕ=Mx+bh^φ=Mx+b. In objective (7) we train a denoiser Dϕ:ℝd×ℝ→ℝdD_φ:R^d×R ^d. Thus we require that the underlying function class contain at least all linear denoisers. This assumption is satisfied by ReLU networks or ReLU U-Nets. Next we state the PL-inequality assumption used for simplifying the analysis of first-order methods in non-convex optimization. Note that neural network loss landscapes have been known to satisfy the local-PL inequality below for the parameter regions of most commonly used neural networks [26]. Assumption 8. Let ϕφ be the parameters and ∇ϕℓ(ϕ,S) _φ (φ,S) the parameter gradient of the empirical loss. We assume that there exists μ>0μ>0 such that almost surely under (S)A(S), (ℓ(ϕ,S)−ℓ(S∗))≤12μ‖∇ϕℓ(ϕ,S)‖22 ( (φ,S)- (S^*))≤ 12μ\| _φ (φ,S)\|^2_2 (34) Proposition 4.5. Under assumptions 1–8, if ℓ is given by (7), there exists A(T)A(T) depending on f,g,Tf,g,T such that the constant C in assumption 6 is of the form: C≤nμεgrad+nA(T). C≤ nμ _grad+nA(T). (35) We provide a proof in Appendix A. Note that in this setting the constant C is comparable to the constant c1c_1 given in Eq. 8 in [34]. 4.6 Held-Out Curvature During Training Finally, we validate our bound on the DDPMs on Imagenet, to check whether held-out curvature can stand as a proxy for counterfactual memorization. In order to track it during training, we assume bounded ELBO gaps in (10) and track the counterfactual loss difference (19) instead of the log odds (17). Since training a diffusion model on S∖iS i for every i is prohibitively expensive, we remove the top 10 most memorized examples for the DDPMs corresponding to n=128n=128 and n=1024n=1024. We then estimate M(xi,S)M(x_i,S) for these ten points, with the loss on the S′:=S∖top 10 memorized pointsS :=S \top 10 memorized points\ with parameters ϕ′φ evaluated on xix_i as an estimator for ℓ(hS∖iϕ′,xi) (h^φ _S i,x_i). We present our results in Figures 3 and 4 where we track: Δℓ(τ):=ℓ(hSϕ,zi)−ℓ(hS′ϕ′,zi). (τ):= (h^φ_S,z_i)- (h^φ _S ,z_i). (36) Note that Δℓ is the signed version of (19). We observe the following phenomenon with Δℓ : as training progresses, Δℓ drops sharply at the initial phase of training, showing that the full model attempts to fit at the seen example xix_i. Then the loss stabilizes as both models enter their respective memorization phases. As the fmemf_mem approaches 100%100\% Δ(τ) (τ) starts dropping quickly again. Throughout this whole process, however, the curvature of the held out models at the held out samples roughly corresponds to the drops and stability of Δ(τ) (τ), thus suggesting that our bound (29) is a meaningful proxy for the counterfactual loss. At the very tail of training, the curvature for the held-out models rises, reflecting the local minimum phenomenon seen in Figures 1 and 2. However, Δ(τ) (τ) keeps falling, suggested that the held out point’s influence on Δ(τ) (τ) via curvature breaks down in the highly overfitted regime. Figure 3: Loss difference and curvature for Imagenet (n=128) DDPM noise prediction - leave-10-out training: (left) difference between per sample loss of full model and leave-10-out model vs. training step for each of the 10 left-out training samples, (right) per sample curvature of the leave-10-out model vs. training step for each of the 10 left-out training samples. Figure 4: Loss difference and curvature for Imagenet (n=1024) DDPM noise prediction - leave-10-out-training: (left) difference between per sample loss of full model and leave-10-out model vs. training step for each of the 10 left-out training samples, (right) per sample curvature of the leave-10-out model vs. training step for each of the 10 left-out training samples. 5 Conclusion In this paper, we introduced the input-loss curvature as a sampling-free proxy for fmemf_mem. Averaged over the training set, it tracks fmemf_mem on ImageNet and on CelebA as training proceeds, albeit it is not sufficient to detect the onset or prevalence of memorization. Instead, we find that the step at which the validation curvature separates from the training curvature marks the transition into a memorizing model. However, over individual points, the input loss curvature cannot reflect the copy count of individual samples. For that question, we use a counterfactual definition, the change in loss and in log-likelihood at x when x is removed from the training set, and we prove that this quantity is influenced, to leading order in the displacement of x, by the input-loss curvature of the leave-one-out model. We enumerate the limitations of our findings below: 1. We provide narrow evidence ranging over only two datasets, ImageNet and CelebA. Moreover, a comparison between the various training losses used to train diffusion models merits further investigation that is not performed at length here. 2. We propose using the local maximum of the relative train–validation curvature error as a stopping criterion. However, our experiments show that this local maximum indicates a period of already high memorization. An improved statistic would be needed to locate the onset of memorization. For small datasets, Figure 2 shows that the norm of the loss gradient averaged over the validation data might prove useful, but its role and behaviour for larger datasets is not well-understood. 3. The bound is a plausibility argument and depends on a list of assumptions on the loss, the model, and the optimizer. It is also unsettled whether the curvature term dominates the ELBO gap at x, which is the comparison that decides whether curvature is the leading contribution to (17). Acknowledgment This work was supported in part by NSF DMS 2502561. References [1] J. Abramson, J. Adler, J. Dunger, R. Evans, T. Green, A. Pritzel, O. Ronneberger, L. Willmore, A. J. Ballard, J. Bambrick, et al. (2024) Accurate structure prediction of biomolecular interactions with alphafold 3. Nature 630 (8016), p. 493–500. Cited by: §1. [2] B. Achilli, E. Ventura, G. Silvestri, B. Pham, G. Raya, D. Krotov, C. Lucibello, and L. Ambrogioni (2024) Losing dimensions: geometric memorization in generative diffusion. arXiv preprint arXiv:2410.08727. Cited by: item 1. [3] B. D. O. Anderson (1982) Reverse-time diffusion equation models. Stochastic Processes and their Applications 12 (3), p. 313–326. Cited by: §2.1. [4] M. Aubry, H. Meng, A. Sugolov, and V. Papyan (2024) Transformer block coupling and its correlation with generalization in LLMs. arXiv preprint arXiv:2407.07810. Cited by: §4.3. [5] R. Baptista, A. Dasgupta, N. B. Kovachki, A. Oberai, and A. M. Stuart (2025) Memorization and regularization in generative diffusion models. arXiv preprint arXiv:2501.15785. Cited by: item 1. [6] N. Berglund (2013) Kramers’ law: validity, derivations and generalisations. Markov Processes and Related Fields 19 (3), p. 459–490. Cited by: §1. [7] G. Biroli, T. Bonnaire, V. de Bortoli, and M. Mézard (2024) Dynamical regimes of diffusion models. Nature Communications 15, p. 9957. Cited by: item 1. [8] G. Biroli and M. Mézard (2023) Generative diffusion in very large dimensions. Journal of Statistical Mechanics: Theory and Experiment 2023 (9), p. 093402. Cited by: item 1, §3. [9] T. Bonnaire, R. Urfin, G. Biroli, and M. Mézard (2025) Why diffusion models don’t memorize: the role of implicit dynamical regularization in training. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §3. [10] A. Bovier and F. den Hollander (2015) Metastability: a potential-theoretic approach. Grundlehren der mathematischen Wissenschaften, Vol. 351, Springer. Cited by: §1. [11] N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramèr (2022) Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy, p. 1897–1914. Cited by: §1. [12] N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V. Sehwag, F. Tramèr, B. Balle, D. Ippolito, and E. Wallace (2023) Extracting training data from diffusion models. In 32nd USENIX Security Symposium, p. 5253–5270. Cited by: item 2, §1. [13] N. Carlini, F. Tramèr, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, Ú. Erlingsson, et al. (2021) Extracting training data from large language models. In 30th USENIX Security Symposium, p. 2633–2650. Cited by: item 2. [14] J. Deng, W. Dong, R. Socher, L. Li, K. Li, and L. Fei-Fei (2009) ImageNet: a large-scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, p. 248–255. Cited by: Appendix B, §3. [15] S. S. Du, W. Hu, and J. D. Lee (2018) Algorithmic regularization in learning deep homogeneous models: layers are automatically balanced. Advances in Neural Information Processing Systems 31. Cited by: §4.3. [16] C. Dwork, F. McSherry, K. Nissim, and A. Smith (2006) Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography Conference, p. 265–284. Cited by: §1. [17] V. Feldman and C. Zhang (2020) What neural networks memorize and why: discovering the long tail via influence estimation. Advances in Neural Information Processing Systems 33, p. 2881–2891. Cited by: item 2, §2.4, §4.2. [18] V. Feldman (2020) Does learning require memorization? A short tale about a long tail. In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, p. 954–959. Cited by: item 2, §2.4, §4.2. [19] I. Garg, D. Ravikumar, and K. Roy (2024) Memorization through the lens of curvature of loss function around samples. In Proceedings of the 41st International Conference on Machine Learning, Cited by: §1. [20] X. Gu, C. Du, T. Pang, C. Li, M. Lin, and Y. Wang (2023) On memorization in diffusion models. arXiv preprint arXiv:2310.02664. Cited by: §1, §3. [21] J. Ho, A. Jain, and P. Abbeel (2020) Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems 33, p. 6840–6851. Cited by: Appendix B, §1, §2.2. [22] C. Huang, J. H. Lim, and A. C. Courville (2021) A variational perspective on diffusion-based generative models and score matching. Advances in Neural Information Processing Systems 34, p. 22863–22876. Cited by: item (d), §2.3, Proposition 2.1. [23] Z. Kadkhodaie, F. Guth, E. P. Simoncelli, and S. Mallat (2024) Generalization in diffusion models arises from geometry-adaptive harmonic representations. In International Conference on Learning Representations, Cited by: item 2. [24] D. P. Kingma (2014) Adam: a method for stochastic optimization. arXiv preprint arXiv:1412.6980. Cited by: Appendix B. [25] Y. Lipman, R. T. Q. Chen, H. Ben-Hamu, M. Nickel, and M. Le (2023) Flow matching for generative modeling. In International Conference on Learning Representations, Cited by: Appendix B, Appendix B, §2.2. [26] C. Liu, L. Zhu, and M. Belkin (2022) Loss landscapes and optimization in over-parameterized non-linear systems and neural networks. Applied and Computational Harmonic Analysis 59, p. 85–116. Cited by: §4.5. [27] X. Liu, C. Gong, and Q. Liu (2023) Flow straight and fast: learning to generate and transfer data with rectified flow. In International Conference on Learning Representations, Cited by: Appendix B. [28] Z. Liu, P. Luo, X. Wang, and X. Tang (2015) Deep learning face attributes in the wild. In Proceedings of the IEEE International Conference on Computer Vision, p. 3730–3738. Cited by: Appendix B. [29] C. Ma and L. Ying (2021) On linear stability of SGD and input-smoothness of neural networks. Advances in Neural Information Processing Systems 34, p. 16805–16817. Cited by: Appendix A. [30] Y. Nesterov and B. T. Polyak (2006) Cubic regularization of Newton method and its global performance. Mathematical Programming 108 (1), p. 177–205. Cited by: Lemma A.1. [31] A. Q. Nichol and P. Dhariwal (2021) Improved denoising diffusion probabilistic models. In Proceedings of the 38th International Conference on Machine Learning, p. 8162–8171. Cited by: §1. [32] A. Ramesh, M. Pavlov, G. Goh, S. Gray, C. Voss, A. Radford, M. Chen, and I. Sutskever (2021) Zero-shot text-to-image generation. In International conference on machine learning, p. 8821–8831. Cited by: §1. [33] D. Ravikumar, E. Soufleri, A. Hashemi, and K. Roy (2024) Unveiling privacy, memorization, and input curvature links. In Proceedings of the 41st International Conference on Machine Learning, p. 42192–42212. Cited by: §1, item 4, §4.1, §4.2. [34] D. Ravikumar, E. Soufleri, and K. Roy (2024) Curvature clues: decoding deep learning privacy with input loss curvature. Advances in Neural Information Processing Systems 37. Cited by: §1, §1, item 3, item 4, §4.2, §4.5. [35] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer (2022) High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 10684–10695. Cited by: §1. [36] O. Ronneberger, P. Fischer, and T. Brox (2015) U-Net: convolutional networks for biomedical image segmentation. In Medical Image Computing and Computer-Assisted Intervention – MICCAI 2015, N. Navab, J. Hornegger, W. M. Wells, and A. F. Frangi (Eds.), Lecture Notes in Computer Science, Vol. 9351, p. 234–241. External Links: Document Cited by: Appendix B. [37] O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, A. C. Berg, and L. Fei-Fei (2015) ImageNet large scale visual recognition challenge. International Journal of Computer Vision 115 (3), p. 211–252. Cited by: Appendix B, §3. [38] A. M. Saxe, J. L. McClelland, and S. Ganguli (2019) A mathematical theory of semantic development in deep neural networks. Proceedings of the National Academy of Sciences 116 (23), p. 11537–11546. Cited by: §4.3. [39] R. Shokri, M. Stronati, C. Song, and V. Shmatikov (2017) Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy, p. 3–18. Cited by: §1. [40] J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli (2015) Deep unsupervised learning using nonequilibrium thermodynamics. In Proceedings of the 32nd International Conference on Machine Learning, p. 2256–2265. Cited by: §1. [41] G. Somepalli, V. Singla, M. Goldblum, J. Geiping, and T. Goldstein (2023) Diffusion art or digital forgery? Investigating data replication in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 6048–6058. Cited by: §1. [42] G. Somepalli, V. Singla, M. Goldblum, J. Geiping, and T. Goldstein (2023) Understanding and mitigating copying in diffusion models. Advances in Neural Information Processing Systems 36, p. 47783–47803. Cited by: item 2, §1. [43] J. Song, C. Meng, and S. Ermon (2021) Denoising diffusion implicit models. In International Conference on Learning Representations, Cited by: §2.2. [44] Y. Song and S. Ermon (2019) Generative modeling by estimating gradients of the data distribution. In Advances in Neural Information Processing Systems, Vol. 32. Cited by: §1. [45] Y. Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole (2021) Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, Cited by: §1, §2.2. [46] N. Srebro, K. Sridharan, and A. Tewari (2010) Optimistic rates for learning with a smooth loss. arXiv preprint arXiv:1009.3896. Cited by: Assumption 2. [47] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin (2017) Attention is all you need. In Advances in Neural Information Processing Systems, I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (Eds.), Vol. 30, p. . Cited by: Appendix B. [48] P. Vincent (2011) A connection between score matching and denoising autoencoders. Neural Computation 23 (7), p. 1661–1674. Cited by: item 1. [49] D. Weitzner, M. Delbracio, P. Milanfar, and R. Giryes (2025) The diffusion process as a correlation machine: linear denoising insights. Transactions on Machine Learning Research. Cited by: §A.1. [50] T. Yoon, J. Y. Choi, S. Kwon, and E. K. Ryu (2023) Diffusion probabilistic models generalize when they fail to memorize. In ICML 2023 Workshop on Structured Probabilistic Inference and Generative Modeling, Cited by: item 1, §3. [51] C. Zhang, S. Bengio, M. Hardt, B. Recht, and O. Vinyals (2017) Understanding deep learning requires rethinking generalization. In International Conference on Learning Representations, Cited by: item 2. [52] C. Zhang, D. Ippolito, K. Lee, M. Jagielski, F. Tramèr, and N. Carlini (2023) Counterfactual memorization in neural language models. Advances in Neural Information Processing Systems 36, p. 39321–39362. Cited by: item 2, §4. Appendix A Proofs for Section 4 Lemma A.1 (Lemma 1 from [30]). Suppose ℓ(ϕ,z) (φ,z) satsifies Assumption 1 of ρ-Lipschitz Hessians. Then for any z,z′∈ℝdz,z ^d −ρ6‖z′−z‖23≤ℓ(ϕ,z′)−ℓ(ϕ,z)−⟨∇ℓ(ϕ,z),z−z′⟩−(z′−z)⊤∇z2ℓ(ϕ,z)(z′−z)≤ρ6‖z′−z‖23. - ρ6\|z -z\|_2^3≤ (φ,z )- (φ,z)- ∇ (φ,z),z-z -(z -z) ∇^2_z (φ,z)(z -z)≤ ρ6\|z -z\|_2^3. (37) Using Assumption (1) we can also obtain the following bound on the gradients of ℓ : Lemma A.2. Suppose ℓ(ϕ,z) (φ,z) satisfies Assumption 1 of ρ-Lipschitz Hessians. Then for any z,z′∈ℝdz,z ^d ‖∇zℓ(ϕ,z′)−∇zℓ(ϕ,z)‖2≤‖∇z2ℓ(ϕ,z)‖2→2‖z′−z‖2+ρ2‖z′−z‖22. \| _z (φ,z )- _z (φ,z)\|_2≤\|∇^2_z (φ,z)\|_2→ 2\|z -z\|_2+ ρ2\|z -z\|_2^2. (38) Here ‖∇z2ℓ(ϕ,z)‖2→2\|∇^2_z (φ,z)\|_2→ 2 is the operator norm of the Hessian. Following an argument of Ma & Ying [29] we use the multiplicative nature of neural networks to prove a bound on the input gradients in terms of the parameter gradients. Lemma A.3. Suppose ℓ(ϕ,z)=g(ϕ1z,ϕ2,z) (φ,z)=g( _1z, _2,z) and there exists a constant C2C_2 such that ‖∇cg‖≤C2g\| _cg\|≤ C_2g. Then we have ‖∇zℓ(ϕ,z)‖2≤‖ϕ1‖z‖‖∇ϕ1ℓ(ϕ,z)‖+C2ℓ(ϕ,z). \| _z (φ,z)\|_2≤ \| _1\|\|z\|\| _ _1 (φ,z)\|+C_2 (φ,z). (39) Proof. We compute the gradient with respect to the inputs: ∇zℓ(ϕ,z)=∇zg(ϕ1z,ϕ2,z)=ϕ1⊤∇ag(ϕ1z,ϕ2,z)+∇cg(ϕ1z,ϕ2,z), _z (φ,z)= _zg( _1z, _2,z)= _1 _ag( _1z, _2,z)+ _cg( _1z, _2,z), (40) ∇ϕ1ℓ(ϕ,z)=∇ag(ϕ1z,ϕ2,z)z⊤. _ _1 (φ,z)= _ag( _1z, _2,z)z . (41) Multiplying the first equation on the right by z⊤z we get ∇zℓ(ϕ,z)z⊤=ϕ1⊤∇ag(ϕ1z,ϕ2,z)z⊤+∇cg(ϕ1z,ϕ2,z)z⊤ _z (φ,z)z = _1 _ag( _1z, _2,z)z + _cg( _1z, _2,z)z (42) ⇔∇zℓ(ϕ,z)z⊤=ϕ1⊤∇ϕ1ℓ(ϕ,z)+∇cg(ϕ1z,ϕ2,z)z⊤ _z (φ,z)z = _1 _ _1 (φ,z)+ _cg( _1z, _2,z)z (43) ⇔∇zℓ(ϕ,z)=ϕ1⊤∇ϕ1ℓ(ϕ,z)z‖z‖22+∇cg(ϕ1z,ϕ2,z). _z (φ,z)= _1 _ _1 (φ,z)z\|z\|_2^2+ _cg( _1z, _2,z). (44) Now, taking norms and using our assumption we have: ‖∇zℓ(ϕ,z)‖2≤‖ϕ1‖z‖‖∇ϕ1ℓ(ϕ,z)‖+C2ℓ(ϕ,z). \| _z (φ,z)\|_2≤ \| _1\|\|z\|\| _ _1 (φ,z)\|+C_2 (φ,z). (45) ∎ Before going further, we remark on the significance of Lemma A.3. In machine learning, we optimize the loss with respect to the parameters in the model ϕφ. However, since we are interested in the effect of the inclusion of a single training sample, we are more interested in the behaviour of the loss with respect to its inputs z. Lemma A.3 gives us a way to relate these two, specifically relating the sizes of the input and parameter gradients of the loss. In particular, it says that the input gradients can be (roughly) controlled by the parameter gradients, which we explicitly control via optimization. Using the cubic envelope from Lemma (A.1) we may bound the memorization term M(zi,S)M(z_i,S) from (46). Lemma A.4. Let S be a finite dataset and let S′⊆S S and let zi∈S∖S′z_i∈ S S . Then under assumptions (1) and (6), for any zj≠zi∈S′z_j≠ z_i∈ S we have: ϕ[ℓ(hSϕ,zi)]−ϕ′[ℓ(hS′ϕ′,zj)] _φ[ (h^φ_S,z_i)]-E_φ [ (h^φ _S ,z_j)] ≤C+|⟨ϕ∼(S′)[∇zℓ(hS′ϕ′,zi)],zj−zi⟩| ≤ C+ _φ (S )[ _z (h^φ _S ,z_i)],z_j-z_i +|(zj−zi)⊤ϕ∼(S′)[∇z2ℓ(hS′ϕ′,zi)](zj−zi)|+ρ6‖zj−zi‖23. + (z_j-z_i) E_φ (S )[∇^2_z (h^φ _S ,z_i)](z_j-z_i) + ρ6\|z_j-z_i\|^3_2. (46) Proof. Let ϕ′∼(S′)φ (S ). For zj,ziz_j,z_i, we have, using Lemma A.1 that: −ℓ(hS′ϕ′,zj)≥−ℓ(hS′ϕ′,zi)−⟨∇zℓ(hS′ϕ′,zi),zj−zi⟩−(zj−zi)⊤∇z2ℓ(hS′ϕ′,zi)(zj−zi)−ρ6‖zj−zi‖23, - (h^φ _S ,z_j)≥- (h^φ _S ,z_i)- _z (h^φ _S ,z_i),z_j-z_i -(z_j-z_i) ∇^2_z (h^φ _S ,z_i)(z_j-z_i)- ρ6\|z_j-z_i\|^3_2, (47) ℓ(hS′ϕ′,zj)≤ℓ(hS′ϕ′,zi)+⟨∇zℓ(hS′ϕ′,zi),zj−zi⟩+(zj−zi)⊤∇z2ℓ(hS′ϕ′,zi)(zj−zi)+ρ6‖zj−zi‖23. (h^φ _S ,z_j)≤ (h^φ _S ,z_i)+ _z (h^φ _S ,z_i),z_j-z_i +(z_j-z_i) ∇^2_z (h^φ _S ,z_i)(z_j-z_i)+ ρ6\|z_j-z_i\|^3_2. (48) Using the monotonicity of expectation we therefore get: −ϕ∼(S′)[ℓ(hS′ϕ′,zj)] -E_φ (S )[ (h^φ _S ,z_j)] ≥−ϕ∼(S′)[ℓ(hS′ϕ′,zi)]−⟨ϕ∼(S′)[∇zℓ(hS′ϕ′,zi)],zj−zi⟩ ≥-E_φ (S )[ (h^φ _S ,z_i)]- _φ (S )[ _z (h^φ _S ,z_i)],z_j-z_i (49) −(zj−zi)⊤ϕ∼(S′)[∇z2ℓ(hS′ϕ′,zi)](zj−zi)−ρ6‖zj−zi‖23, -(z_j-z_i) E_φ (S )[∇^2_z (h^φ _S ,z_i)](z_j-z_i)- ρ6\|z_j-z_i\|^3_2, (50) ϕ∼(S′)[ℓ(hS′ϕ′,zj)] _φ (S )[ (h^φ _S ,z_j)] ≤ϕ∼(S′)[ℓ(hS′ϕ′,zi)]+⟨ϕ∼(S′)[∇zℓ(hS′ϕ′,zi)],zj−zi⟩ _φ (S )[ (h^φ _S ,z_i)]+ _φ (S )[ _z (h^φ _S ,z_i)],z_j-z_i (51) +(zj−zi)⊤ϕ∼(S′)[∇z2ℓ(hS′ϕ′,zi)](zj−zi)+ρ6‖zj−zi‖23. +(z_j-z_i) E_φ (S )[∇^2_z (h^φ _S ,z_i)](z_j-z_i)+ ρ6\|z_j-z_i\|^3_2. (52) Plugging these into the two-sided bound implied by Assumption 6 we get: C C ≥ϕ[ℓ(hSϕ,zi)]−ϕ′[ℓ(hS′ϕ′,zj)] _φ[ (h^φ_S,z_i)]-E_φ [ (h^φ _S ,z_j)] (53) ≥ϕ[ℓ(hSϕ,zi)]−ϕ∼(S′)[ℓ(hS′ϕ′,zi)]−⟨ϕ∼(S′)[∇zℓ(hS′ϕ′,zi)],zj−zi⟩ _φ[ (h^φ_S,z_i)]-E_φ (S )[ (h^φ _S ,z_i)]- _φ (S )[ _z (h^φ _S ,z_i)],z_j-z_i (54) −(zj−zi)⊤ϕ∼(S′)[∇z2ℓ(hS′ϕ′,zi)](zj−zi)−ρ6‖zj−zi‖23. -(z_j-z_i) E_φ (S )[∇^2_z (h^φ _S ,z_i)](z_j-z_i)- ρ6\|z_j-z_i\|^3_2. (55) By rearranging, we have ϕ[ℓ(hSϕ,zi)]−ϕ′[ℓ(hS′ϕ′,zj)] _φ[ (h^φ_S,z_i)]-E_φ [ (h^φ _S ,z_j)] ≤C+⟨ϕ∼(S′)[∇zℓ(hS′ϕ′,zi)],zj−zi⟩ ≤ C+ _φ (S )[ _z (h^φ _S ,z_i)],z_j-z_i (56) +(zj−zi)⊤ϕ∼(S′)[∇z2ℓ(hS′ϕ′,zi)](zj−zi)+ρ6‖zj−zi‖23. +(z_j-z_i) E_φ (S )[∇^2_z (h^φ _S ,z_i)](z_j-z_i)+ ρ6\|z_j-z_i\|^3_2. (57) Using the same tactic, we may prove a lower bound for ϕ[ℓ(hSϕ,zi)]−ϕ′[ℓ(hS′ϕ′,zj)]E_φ[ (h^φ_S,z_i)]-E_φ [ (h^φ _S ,z_j)] using the negative of the term above. This yields a bound for the absolute value, and recalling the definition of M yields the bound (46). ∎ We can now and prove our main result 4.3. Proof. First, we construct the high probability event under which the bound should hold. Set the threshold in assumption 4 to be o(n−1/2)o(n^-1/2) where n is the size of the dataset. Then fix a threshold 1−δ(n)1-δ(n) such that both events under which assumptions 6 and 5 hold. In this high probability event we apply Lemma A.4 to the set S′=S∖i:=S∖ziS =S i:=S \z_i\ to obtain (46): M(zi,S) M(z_i,S) ≤C+|⟨ϕ∼(S∖i)[∇zℓ(hS∖iϕ′,zi)],zj−zi⟩|⏟A ≤ C+ _φ (S i)[ _z (h^φ _S i,z_i)],z_j-z_i _A +|(zj−zi)⊤ϕ∼(S∖i)[∇z2ℓ(hS∖iϕ′,zi)](zj−zi)|+ρ6‖zj−zi‖23⏟B. + (z_j-z_i) E_φ (S i)[∇^2_z (h^φ _S i,z_i)](z_j-z_i) + ρ6\|z_j-z_i\|^3_2_B. (46) To bound (A), we use Cauchy-Schwarz and Jensen’s inequality: |⟨ϕ∼(S∖i)[∇zℓ(hS∖iϕ′,zi)],zj−zi⟩|≤ϕ∼(S∖i)[‖∇zℓ(hS∖iϕ′,zi)‖2]‖zj−zi‖2. _φ (S i)[ _z (h^φ _S i,z_i)],z_j-z_i _φ (S i)[\| _z (h^φ _S i,z_i)\|_2]\|z_j-z_i\|_2. (58) We now apply Lemma A.2 on ∇zℓ(hS∖iϕ′,zi)∥2 _z (h^φ _S i,z_i)\|_2 and take expectations to obtain: ϕ∼(S∖i)[‖∇zℓ(hS∖iϕ′,zi)‖2]‖zj−zi‖2 _φ (S i)[\| _z (h^φ _S i,z_i)\|_2]\|z_j-z_i\|_2 ≤ϕ∼(S∖i)[‖∇zℓ(hS∖iϕ′,zj)‖2]‖zj−zi‖2 _φ (S i)[\| _z (h^φ _S i,z_j)\|_2]\|z_j-z_i\|_2 (59) +ϕ′∼(S∖i)[‖∇z2ℓ(hS∖iϕ′,zi)‖2→2]‖zj−zi‖22+ρ2‖zj−zi‖23. +E_φ (S i)[\|∇^2_z (h^φ _S i,z_i)\|_2→ 2]\|z_j-z_i\|_2^2+ ρ2\|z_j-z_i\|_2^3. (60) We now apply Lemma A.3 to (59) and thus get: ϕ∼(S∖i)[‖∇zℓ(hS∖iϕ′,zj)‖2]‖zj−zi‖2 _φ (S i)[\| _z (h^φ _S i,z_j)\|_2]\|z_j-z_i\|_2 ≤(ϕ′∼(S∖i)[‖ϕ1′‖z‖‖∇ϕ1′ℓ(hS∖iϕ′,zj)‖+2βℓ(hϕ′,zj)])‖zj−zi‖2 ≤ (E_φ (S i) [ \|φ _1\|\|z\|\| _φ _1 (h^φ _S i,z_j)\|+2β (h^φ ,z_j) ] )\|z_j-z_i\|_2 (61) OPEN=ϕ′∼(S∖iCLOSE)(Bmink‖zk‖εgrad+2βεloss)‖zj−zi‖2 =E_φ (S i) ( B _k\|z_k\| _grad+2β _loss )\|z_j-z_i\|_2 (62) The last equality follows due to assumption 4 and 5 which results in both the loss and the gradients of the loss of a trained model at a training sample to be small (compared to the parameters and the nearest neighbor distance ‖zj−zi‖\|z_j-z_i\|). Putting (62) with (59) we get: |⟨ϕ∼(S∖i)[∇zℓ(hS∖iϕ′,zi)],zj−zi⟩| _φ (S i)[ _z (h^φ _S i,z_i)],z_j-z_i ≤ϕ′∼(S∖i)[‖∇z2ℓ(hS∖iϕ′,zi)‖2→2]‖zj−zi‖22 _φ (S i)[\|∇^2_z (h^φ _S i,z_i)\|_2→ 2]\|z_j-z_i\|_2^2 (63) OPEN+ϕ′∼(S∖iCLOSE)(Bmink‖zk‖εgrad+2βεloss)‖zj−zi‖2+O(‖zj−zi‖23). +E_φ (S i) ( B _k\|z_k\| _grad+2β _loss )\|z_j-z_i\|_2+O(\|z_j-z_i\|_2^3). (64) To bound (B) we use an operator norm upper bound along with Jensen’s inequality to bound the quadratic term in (46) also by the operator norm of the hessian appearing in (64): |(zj−zi)⊤ϕ′∼(S∖i)[∇z2ℓ(hS∖iϕ′,zi)](zj−zi)| (z_j-z_i) E_φ (S i)[∇^2_z (h^φ _S i,z_i)](z_j-z_i) =|(zj−zi)⊤ϕ′∼(S∖i)[∇z2ℓ(hS∖iϕ′,zi)(zj−zi)]| = (z_j-z_i) E_φ (S i)[∇^2_z (h^φ _S i,z_i)(z_j-z_i)] (65) ≤‖ϕ∼(S∖i)[∇z2ℓ(hS∖iϕ′,zi)(zj−zi)]‖‖zj−zi‖ ≤\|E_φ (S i)[∇^2_z (h^φ _S i,z_i)(z_j-z_i)]\|\|z_j-z_i\| (66) ≤ϕ′∼(S∖i)[‖∇z2ℓ(hS∖iϕ′,zi)‖2→2]‖zj−zi‖22 _φ (S i)[\|∇^2_z (h^φ _S i,z_i)\|_2→ 2]\|z_j-z_i\|_2^2 (67) ≤ϕ′∼(S∖i)[‖∇z2ℓ(hS∖iϕ′,zi)‖F2]‖zj−zi‖22 _φ (S i)[\|∇^2_z (h^φ _S i,z_i)\|^2_F]\|z_j-z_i\|_2^2 (68) Plugging (64) and (68) yields (29). ∎ A.1 Proof of Proposition 4.5 For brevity we set z=zi,z′:=zjz=z_i,z :=z_j, and S′=S∖iS =S i. First, since the function class hϕh^φ contains linear denoisers, the performance of hϕh^φ under (S)A(S) is better than any linear denoiser. However, the best linear denoiser attains an MSE dependent on T,f,gT,f,g [49] that we term A(T)A(T). Thus ℓ∗(S)≤A(T) ^*(S)≤ A(T). We may now decompose the difference in assumption 6 as follows by introducing the rest of the dataset S,S′S,S : ℓ(hϕ,z)−ℓ(hϕ′,z′) (h^φ,z)- (h^φ ,z ) =|S|(ℓ(hϕ,S)−ℓ∗(S))−|S′|(ℓ(hϕ′,S′)−ℓ∗(S′))+|S′|(ℓ∗(S)−ℓ∗(S′)) =|S| ( (h^φ,S)- ^*(S) )-|S | ( (h^φ ,S )- ^*(S ) )+|S | ( ^*(S)- ^*(S ) ) +|S∖S′|ℓ∗(S)+∑zk∈S′,zk≠z′ℓ(hϕ′,zk)−∑zk∈S,zk≠zℓ(hϕ,zk) +|S S | ^*(S)+ _z_k∈ S ,z_k≠ z (h^φ ,z_k)- _z_k∈ S,z_k≠ z (h^φ,z_k) ≤|S|(ℓ(hϕ,S)−ℓ∗(S))−|S′|(ℓ(hϕ′,S′)−ℓ∗(S′))+|S′|(ℓ∗(S)−ℓ∗(S′)) ≤|S| ( (h^φ,S)- ^*(S) )-|S | ( (h^φ ,S )- ^*(S ) )+|S | ( ^*(S)- ^*(S ) ) +|S−S′|ℓ∗(S). +|S-S | ^*(S). Here the inequality on the third line follows because of the following calculation: ∑zk∈S′,zk≠z′ℓ(hϕ′,zk)−∑zk∈S,zk≠zℓ(hϕ,zk) _z_k∈ S ,z_k≠ z (h^φ ,z_k)- _z_k∈ S,z_k≠ z (h^φ,z_k) ≤∑zk∈S′ℓ(hϕ′,zk)−∑zk∈S′ℓ(hϕ,zk)=|S′|(ℓ(hϕ′,S′)−ℓ(hϕ,S′))≤0. ≤ _z_k∈ S (h^φ ,z_k)- _z_k∈ S (h^φ,z_k)=|S |( (h^φ ,S )- (h^φ,S ))≤ 0. Using the PL-inequality in assumption 8, the bound ℓ∗(S)≤A(T) ^*(S)≤ A(T) and the fact that l∗(S′)≥0l^*(S )≥ 0 we get: ℓ(hϕ,z)−ℓ(hϕ′,z′)≤nμεgrad+nA(T). (h^φ,z)- (h^φ ,z )≤ nμ _grad+nA(T). (69) Appendix B Experimental Details Here we describe our experimental details. Note that we also conducted analogous versions of our experiments for flow-matching which we describe below. Flow matching [25, 27] learns a time-dependent velocity field vθ(x,t)v_θ(x,t) whose flow transports a noise distribution p0p_0 to the data distribution p1p_1. Given X0∼p0X_0 p_0 and X1∼p1X_1 p_1, one forms the linear interpolant Xt=(1−t)X0+tX1X_t=(1-t)X_0+tX_1 for t∈[0,1]t∈[0,1], whose conditional velocity is dtXt=X1−X0 ddtX_t=X_1-X_0. The field is trained by regressing onto this target, ℓ(ϕ,x)=t,X0,X1[‖vθ(Xt,t)−(X1−X0)‖22∣X0=x], (φ,x)=E_t,\,X_0,\,X_1 [\, \|v_θ(X_t,t)-(X_1-X_0) \|_2^2\, X_0=x ], (70) and the minimizer is the marginal velocity v⋆(x,t)=[X1−X0∣Xt=x]v (x,t)=E[X_1-X_0 X_t=x]. Samples are then generated by integrating the ODE x˙t=vθ(xt,t) x_t=v_θ(x_t,t) from t=0t=0 to t=1t=1. We conduct numerical experiments on the Imagenet and CelebA datasets. We use ImageNet-1k [14, 37] and convert to RGB downscaled images of size d=64×64d=64× 64. For Imagenet, we train on n∈128,256,512,1024,2048,4096,10240n∈\128,256,512,1024,2048,4096,10240\. We convert the CelebA [28] face images to grayscale and downsample them to size d=32×32d=32× 32. We use a training set size of n∈128,10240n∈\128,10240\ for CelebA, yielding a memorizing vs. generalizing model. All our score models have a U-Net architecture [36] with four resolution levels, base channel width W=64W=64, and channel multipliers 1, 2, 4, and 4 respectively. Self-attention is applied at the two lowest-resolution levels, and each level has two residual blocks in the encoder and three in the decoder. The models are conditioned on diffusion time t through the sinusoidal embedding [47] in every residual block, so a single network serves all noise levels. We train the network in one of three ways: DDPM [21]with either noise prediction (ϵε-prediction) or clean-sample prediction (x0x_0-prediction), or flow matching [25]. The DDPM noise prediction predicts the injected Gaussian noise at diffusion time t using the Adam optimizer [24] with a fixed batch size of 128. DDPM sample prediction takes the noisy images xtx_t and time t and predicts the clean image x0x_0 directly using loss MSE(x0^(xt,t),x0)MSE( x_0(x_t,t),x_0). DDPM models are sampled using DDIM with 100 steps and stochasticity parameter η=0η=0, starting from xT∼(0,I)x_T (0,I). For the noise prediction models, the predicted noise ϵ ε is converted to a clean image estimate x0^=(xt−(1−α¯t)ϵ^)/α¯t x_0=(x_t- (1- α_t) ε)/ α_t before stepping to the next time. The sample prediction models use the same DDIM sampler with the network output taken as the clean image estimate x0 x_0 directly. The flow matching networks predict the velocity u=x0−ϵu=x_0-ε along the linear path xt=(1−τ)ϵ+τx0x_t=(1-τ)ε+τ x_0, where ϵ∼(0,I)ε (0,I) is the noise, x0x_0 is the training image, and τ is the normalized time. Training minimizes MSE(v^(xt,t),u)MSE( v(x_t,t),u), and sampling integrates dxdτ=v dxdτ= v from τ=0τ=0 (noise) to τ=1τ=1 (data) with 100 Euler steps. Appendix C Generated Samples Figures 5-12 shows generated samples at the pre-memorization, beginning of memorization, and full memorization stages with their nearest training neighbor for DDPM noise prediction and flow matching on CelebA with n∈128,10240n∈\128,10240\ as well as the leave-10-out models for Imagenet with n∈128,1024n∈\128,1024\. Figure 5: Generated samples vs. nearest training image for CelebA (n=128) DDPM: generated samples at the pre-memorization, start of memorization, and full memorization stages alongside their nearest neighbor in the training set. Figure 6: Generated samples vs. nearest training image for CelebA (n=128) flow matching: generated samples at the pre-memorization, start of memorization, and full memorization stages alongside their nearest neighbor in the training set. Figure 7: Generated samples vs. nearest training image for CelebA (n=10240) DDPM: generated samples at the pre-memorization, start of memorization, and full memorization stages alongside their nearest neighbor in the training set. Figure 8: Generated samples vs. nearest training image for CelebA (n=10240) flow matching: generated samples at the pre-memorization, start of memorization, and full memorization stages alongside their nearest neighbor in the training set. Figure 9: Generated samples vs. nearest training image for Imagenet (n=128) DDPM leave-10-out model: generated samples at the pre-memorization, start of memorization, and full memorization stages alongside their nearest neighbor in the training set. Figure 10: Generated samples vs. nearest training image for Imagenet (n=1024) DDPM leave-10-out model: generated samples at the pre-memorization, start of memorization, and full memorization stages alongside their nearest neighbor in the training set. Figure 11: Generated samples vs. nearest training image for Imagenet (n=128) flow matching leave-10-out model: generated samples at the pre-memorization, start of memorization, and full memorization stages alongside their nearest neighbor in the training set. Figure 12: Generated samples vs. nearest training image for Imagenet (n=1024) flow matching leave-10-out model: generated samples at the pre-memorization, start of memorization, and full memorization stages alongside their nearest neighbor in the training set. Figures 13–20 show generated samples and their nearest training images for models trained on all n images: DDPM noise prediction with n∈128,256,512,1024,2048,4096n∈\128,256,512,1024,2048,4096\ and flow matching with n∈128,1024n∈\128,1024\. Each row contains five generated–training image pairs. All memorization fractions are measured over 10,00010,000 generations. For models with sustained memorization, pre_mem denotes the last evaluated checkpoint with fmem=0f_mem=0 before onset, and start_mem denotes the first checkpoint after which fmemf_mem stays above zero. Full memorization (full_mem) denotes the first evaluated checkpoint with fmem≥95%f_mem≥ 95\%. For DDPM with n=512n=512 and n=1024n=1024, which never reach this threshold, peak_mem denotes the highest observed memorization fraction. For DDPM with n=4096n=4096, the two rows instead show a zero-copy checkpoint followed by an isolated copy event. Figure 13: Generated samples vs. nearest training image for ImageNet (n=128n=128) DDPM. pre_mem: step 2,0002,000, fmem=0f_mem=0, five random samples. start_mem: step 3,0003,000, fmem=0.10%f_mem=0.10\% (10 copies of 10410^4), five randomly selected copies. full_mem: step 150,000150,000, fmem=99.8%f_mem=99.8\%, five randomly selected copies. Figure 14: Generated samples vs. nearest training image for ImageNet (n=256n=256) DDPM. pre_mem: step 3,0003,000, fmem=0f_mem=0, five random samples. start_mem: step 5,0005,000, fmem=0.04%f_mem=0.04\% (4 copies of 10410^4); the four copies, followed in the rightmost pair by the non-copy with the smallest gap ratio. full_mem: step 200,000200,000, fmem=95.5%f_mem=95.5\%, five randomly selected copies. Figure 15: Generated samples vs. nearest training image for ImageNet (n=512n=512) DDPM. pre_mem: step 5,0005,000, fmem=0f_mem=0, five random samples. start_mem: step 7,0007,000, fmem=0.03%f_mem=0.03\% (3 copies of 10410^4); the three copies, followed in the two rightmost pairs by the non-copies with the smallest gap ratios. peak_mem: step 2,000,0002,000,000, fmem=85.0%f_mem=85.0\%, five randomly selected copies. This model never reaches the full-memorization threshold. Figure 16: Generated samples vs. nearest training image for ImageNet (n=1024n=1024) DDPM. pre_mem: step 15,00015,000, fmem=0f_mem=0, five random samples. start_mem: step 20,00020,000, fmem=0.10%f_mem=0.10\% (10 copies of 10410^4), five randomly selected copies. peak_mem: step 2,000,0002,000,000, fmem=19.9%f_mem=19.9\%, five randomly selected copies. This model never reaches the full-memorization threshold. Figure 17: Generated samples vs. nearest training image for ImageNet (n=2048n=2048) DDPM. pre_mem: step 70,00070,000, fmem=0f_mem=0, five random samples. start_mem: step 100,000100,000, fmem=0.02%f_mem=0.02\% (2 copies of 10410^4); the two copies, followed in the three rightmost pairs by the non-copies with the smallest gap ratios. There is no full_mem row: fmemf_mem peaks at 0.57%0.57\%. Figure 18: Generated samples vs. nearest training image for ImageNet (n=4096n=4096) DDPM. pre_mem: step 300,000300,000, fmem=0f_mem=0, five random samples. start_mem: step 500,000500,000, an isolated checkpoint with fmem=0.03%f_mem=0.03\% (3 copies of 10410^4); the three copies, followed in the two rightmost pairs by the non-copies with the smallest gap ratios. Here start_mem labels the isolated copy event. No sustained memorization is observed, and there is no full_mem row. Figure 19: Generated samples vs. nearest training image for ImageNet (n=128n=128) flow matching. pre_mem: step 1,0001,000, fmem=0f_mem=0, five random samples. start_mem: step 2,0002,000, fmem=0.10%f_mem=0.10\% (10 copies of 10410^4), five randomly selected copies. full_mem: step 10,00010,000, fmem=95.7%f_mem=95.7\%, five randomly selected copies. Figure 20: Generated samples vs. nearest training image for ImageNet (n=1024n=1024) flow matching. pre_mem: step 10,00010,000, fmem=0f_mem=0, five random samples. start_mem: step 15,00015,000, fmem=0.46%f_mem=0.46\% (46 copies of 10410^4), five randomly selected copies. full_mem: step 500,000500,000, fmem=96.2%f_mem=96.2\%, five randomly selected copies. Appendix D Additional Experiments We provide additional experiments on Imagenet and CelebA. Figures 21-25 plot the average training input loss curvature over diffusion time and fraction of generated samples that are considered memorized with memorization threshold k=1/3k=1/3 vs. training step for DDPM noise prediction and flow matching for the datasets CelebA with training set size n∈128,1024n∈\128,1024\ and Imagenet with training set size n∈128,1024,10240n∈\128,1024,10240\, respectively. DDPM and flow matching on CelebA with n=128n=128 is a memorizing model, since fraction memorization starts increasing rapidly to 100%100\% around training step τ=103τ=10^3, whereas DDPM and flow matching on CelebA with n=10240n=10240 is a generalizing model with fraction memorization increasing much later around training step τ=105τ=10^5 and never reaching full memorization of 100%100\% before training ends. We observe that the average input loss curvature increases more drastically for the memorizing model as compared to the generalizing model. A similar trend can be seen for the DDPM and flow matching models for Imagenet as training size n increases. For the flow matching model on CelebA with training size n=128n=128, Figure 26 shows the average training and validation input loss curvatures over diffusion time vs. training step, as well as the relative training and validation curvature gaps, which is calculated as |x∼train[‖∇x2ℓ(ϕ(τ),x)‖F2]−x∼val.[‖∇x2ℓ(ϕ(τ),x)‖F2]|/x∼train[‖∇x2ℓ(ϕ(τ),x)‖F2]|E_x [\|∇^2_x (φ(τ),x)\|^2_F]-E_x .[\|∇^2_x (φ(τ),x)\|^2_F]|/E_x [\|∇^2_x (φ(τ),x)\|^2_F] and |x∼train[‖∇x2ℓ(ϕ(τ),x)‖F2]−x∼val.[‖∇x2ℓ(ϕ(τ),x)‖F2]|/x∼val[‖∇x2ℓ(ϕ(τ),x)‖F2]|E_x [\|∇^2_x (φ(τ),x)\|^2_F]-E_x .[\|∇^2_x (φ(τ),x)\|^2_F]|/E_x [\|∇^2_x (φ(τ),x)\|^2_F], vs. training step. We observe that the training curvature separates from the validation curvature right before training step τ=103τ=10^3, which is around where memorization begins, as shown in Figure 21. Figure 27 shows the fraction memorization score for DDPM noise prediction and flow matching on Imagenet (n=10240)(n=10240) with different values for the memorization threshold k∈1/3,0.8,0.9k∈\1/3,0.8,0.9\. There is no trend in the nearest-neighbor gap ratios for DDPM even when k is increased. However, for flow matching, when k is large, the nearest-neighbor gap ratios increase as training continues. Nonetheless, this pattern in the gap ratios does not indicate that this model is a memorizing model, since for k=1/3k=1/3, the fraction memorized is approximately 0%0\% for all training steps. Figure 28 shows the average training curvature over diffusion time and fraction memorized with k=1/3k=1/3 vs. training step for DDPM sample prediction on Imagenet (n=10240)(n=10240) as well as the fraction memorization with k∈1/3,0.8,0.9k∈\1/3,0.8,0.9\. This model is a generalizing model, since for k=1/3k=1/3, approximately 0%0\% of the generated samples are considered memorized for all training steps, even though for large values of k, the nearest-neighbor gap ratios increase as training steps increase. We also observe that the average input loss curvature barely changes across training steps, validating the connection between memorization and curvature. In Figure 29, the average training input loss curvature over diffusion time vs. training step is plotted for DDPM noise prediction and flow matching on the CelebA and Imagenet datasets with training set size n=10240n=10240. CelebA has larger curvature values than Imagenet for both models, which correspond to higher memorization scores as seen in Figures 22 and 25. In particular, DDPM and flow matching for CelebA (n=10240)(n=10240) have fraction memorization scores of around 23%23\% and 40%40\%, respectively, at the end of training, whereas DDPM and flow matching for Imagenet (n=10240)(n=10240) have fraction memorization scores of around 0%0\% and 0.1%0.1\%, respectively, at the end of training. Figure 30 compares two DDPM noise prediction models on Imagenet, one that is trained on a training set of size n=1024n=1024 and another that is trained on the same training set with the top 1010 memorized samples from the full n=1024n=1024 model removed. The figure plots fraction memorization and average training curvature over diffusion time vs. training step for both the full and leave-10-out models. The leave-10-out model has a lower memorization score at the end of training and lower input loss curvature for all training steps, indicating that it is worthwhile to remove the top memorized samples from a model to improve generalization. Figure 31 shows similar results for flow matching. We repeat these experiments for Imagenet n=128n=128 in Figures 32 and 33. Figures 34 and 35 plot the difference between the per sample losses of the full flow matching models and the leave-10-out models vs. training step, as well as the per sample curvatures of the leave-10-out models, for each of the top 1010 left-out samples. (a) (b) Figure 21: Curvature and memorization for CelebA (n=128): average input loss curvature over diffusion time and training set and fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step for (a) DDPM noise prediction and (b) flow matching. (a) (b) Figure 22: Curvature and memorization for CelebA (n=10240): average input loss curvature over diffusion time and training set and fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step for (a) DDPM noise prediction and (b) flow matching. (a) (b) Figure 23: Curvature and memorization for Imagenet (n=128): average input loss curvature over diffusion time and training set and fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step for (a) DDPM noise prediction and (b) flow matching. (a) (b) Figure 24: Curvature and memorization for Imagenet (n=1024): average input loss curvature over diffusion time and training set and fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step for (a) DDPM noise prediction and (b) flow matching. (a) (b) Figure 25: Curvature and memorization for Imagenet (n=10240): average input loss curvature over diffusion time and training set and fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step for (a) DDPM noise prediction and (b) flow matching. Figure 26: Training vs. validation curvature for CelebA (n=128) flow matching: (left) average input loss curvature over diffusion time and training (blue) / validation (orange) set, (right) relative training/validation curvature gap calculated as |x∼train[‖∇x2ℓ(ϕ(τ),x)‖F2]−x∼val.[‖∇x2ℓ(ϕ(τ),x)‖F2]|/x∼train[‖∇x2ℓ(ϕ(τ),x)‖F2]|E_x [\|∇^2_x (φ(τ),x)\|^2_F]-E_x .[\|∇^2_x (φ(τ),x)\|^2_F]|/E_x [\|∇^2_x (φ(τ),x)\|^2_F] (blue) and |x∼train[‖∇x2ℓ(ϕ(τ),x)‖F2]−x∼val.[‖∇x2ℓ(ϕ(τ),x)‖F2]|/x∼val[‖∇x2ℓ(ϕ(τ),x)‖F2]|E_x [\|∇^2_x (φ(τ),x)\|^2_F]-E_x .[\|∇^2_x (φ(τ),x)\|^2_F]|/E_x [\|∇^2_x (φ(τ),x)\|^2_F] (orange). (a) (b) Figure 27: Memorization for Imagenet (n=10240): fraction memorized (%) with memorization threshold k∈1/3,0.8,0.9k∈\1/3,0.8,0.9\ vs. training step for (a) DDPM noise prediction and (b) flow matching. (a) (b) Figure 28: Curvature and memorization for Imagenet (n=10240) DDPM Sample Prediction: (a) average input loss curvature over diffusion time and training set and fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step, and (b) fraction memorized (%) with memorization threshold k∈1/3,0.8,0.9k∈\1/3,0.8,0.9\ vs. training step. (a) (b) Figure 29: CelebA vs. Imagenet (n=10240) Curvature: average input loss curvature over diffusion time and training set vs. training step for (a) DDPM noise prediction and (b) flow matching. (a) (b) Figure 30: Memorization and curvature for Imagenet (n=1024) DDPM noise prediction - full vs. leave-10-out training: (a) fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step and (b) average input loss curvature over diffusion time and training set vs. training step for full n=1024n=1024 training set and leave-10-out training set with the top 1010 memorized training samples removed. (a) (b) Figure 31: Memorization and curvature for Imagenet (n=1024) flow matching - full vs. leave-10-out training: (a) fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step and (b) average input loss curvature over diffusion time and training set vs. training step for full n=1024n=1024 training set and leave-10-out training set with the top 1010 memorized training samples removed. (a) (b) Figure 32: Memorization and curvature for Imagenet (n=128) DDPM noise prediction - full vs. leave-10-out training: (a) fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step and (b) average input loss curvature over diffusion time and training set vs. training step for full n=128n=128 training set and leave-10-out training set with the top 1010 memorized training samples removed. (a) (b) Figure 33: Memorization and curvature for Imagenet (n=128) flow matching - full vs. leave-10-out training: (a) fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step and (b) average input loss curvature over diffusion time and training set vs. training step for full n=128n=128 training set and leave-10-out training set with the top 1010 memorized training samples removed. Figure 34: Loss difference and curvature for Imagenet (n=128) flow matching - leave-10-out-training: (left) difference between per sample loss of full model and leave-10-out model vs. training step for each of the 10 left-out training samples, (right) per sample curvature of the leave-10-out model vs. training step for each of the 10 left-out training samples. Figure 35: Loss difference and curvature for Imagenet (n=1024) flow matching - leave-10-out-training: (left) difference between per sample loss of full model and leave-10-out model vs. training step for each of the 10 left-out training samples, (right) per sample curvature of the leave-10-out model vs. training step for each of the 10 left-out training samples. (a) (b) Figure 36: Memorization and curvature for Imagenet (n=128) flow matching - full vs. leave-10-out training: (a) fraction memorized (%) with memorization threshold k=1/3k=1/3 vs. training step and (b) average input loss curvature over diffusion time and training set vs. training step for full n=128n=128 training set and leave-10-out training set with the top 1010 memorized training samples removed. Appendix E Additional ImageNet DDPM experiments E.1 Experimental Details We use 64×6464× 64 RGB ImageNet images and nested training sets of size n∈128,256,512,1024,2048,4096n∈\128,256,512,1024,2048,4096\, taking the first n images in a fixed dataset ordering. We evaluate all models on the same disjoint set of 1,0241,024 held-out images. Each training size corresponds to one DDPM trained with the noise-prediction objective. The U-Net has base width 6464 and channel multipliers (1,2,4,4)(1,2,4,4). We use Adam with learning rate 10−410^-4 and a linear noise schedule with 1,0001,000 diffusion steps. We train all models for 10610^6 updates and continue training those with n∈512,1024,2048,4096n∈\512,1024,2048,4096\ for another 10610^6 updates to examine their behavior over longer training. For the curvature, gradient, and loss measurements, we convert the predicted noise to a clean-image estimate x^0 x_0 and evaluate the mean squared reconstruction error ℓτ(x,t,ϵ)=1d‖x^0(xt,t,ϕ(τ))−x‖22,d=3⋅642, _τ(x;t,ε)= 1d \| x_0(x_t,t;φ(τ))-x \|_2^2, d=3· 64^2, where d is the number of scalar image values across the three RGB channels, so 1/d1/d averages the squared error over all channels and pixels. Here x is the clean image after the input normalization used for training, and xtx_t is its noisy version at diffusion step t, obtained using Gaussian noise ϵε. The training checkpoint is indexed by τ, and ϕ(τ)φ(τ) denotes the model parameters at that checkpoint. Derivatives are taken with respect to x, including its contribution through xtx_t. We estimate the input-Hessian trace using 3232 Monte Carlo draws per image. Each draw samples t uniformly from 1,…,999\1,…,999\, Gaussian forward noise ϵε, and a Rademacher vector v, and evaluates v⊤∇x2ℓτ(x,t,ϵ)v _x^2 _τ(x;t,ε)v. The gradient curves average ‖∇xℓτ(x,t,ϵ)‖2\| _x _τ(x;t,ε)\|_2 over 3232 draws, and the loss curves average ℓτ _τ over 6464 draws. Training means use all n images; validation means use the fixed held-out set. These measurements do not require generating samples from the model. At each checkpoint used to evaluate memorization, we generate 10,00010,000 images using 100100 deterministic DDIM steps (η=0η=0). A generated image is classified as a copy when the ratio of its nearest to second-nearest training-image distances is below 1/31/3. We use Euclidean distances in the normalized image space used for training. The copy count F(i,τ)F(i,τ) is the number of generated copies assigned to training image i at checkpoint τ, and fmem(τ)f_mem(τ) is the fraction of generations classified as copies. E.2 Supporting Figures Figure 37 compares the mean curvature of training images copied at a checkpoint with that of the remaining training images. The copied group generally has higher curvature, although the separation varies with training size and checkpoint. Figure 38 compares the maximum copy count with the relative train–validation curvature gap. Smaller training sets tend to exhibit both larger maximum copy counts and larger curvature gaps. Figure 37: Curvature of copied and non-copied training images. Each panel shows one ImageNet DDPM training size. Orange and blue curves average the input-Hessian trace over images with F(i,τ)>0F(i,τ)>0 and F(i,τ)=0F(i,τ)=0, respectively. Group membership is determined separately at each checkpoint; “never copied” in the legend refers only to that checkpoint’s generations. Shading shows one standard error across images in the group, and orange numbers give the copied-group size. A group is plotted only when it contains at least ten images. Dashed vertical lines mark the first evaluated checkpoint with fmem>1%f_mem>1\%, used as a reference threshold. Figure 38: Maximum copy count and relative curvature gap. Each point represents one evaluated checkpoint of an ImageNet DDPM; colors indicate training-set size. The horizontal coordinate is maxiF(i,τ) _iF(i,τ) among 10,00010,000 generations. The vertical coordinate is |Ctrain(τ)−Cval(τ)|/|Ctrain(τ)||C_train(τ)-C_val(τ)|/|C_train(τ)|, where the two means use all training images and the same 1,0241,024 held-out images, respectively. Curvature is the input-Hessian trace estimated as described above. The horizontal scale is logarithmic above one and linear near zero to retain checkpoints with no observed copies.