[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-149159-105":59,"doc-detail-149159-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","finding-dori-discovery-of-retained-images-in-diffusion-models","Finding DoRI - Discovery of Retained Images in Diffusion Models","","Text-to-image diffusion models achieve strong image generation performance, yet they can memorize and verbatimly replicate training data, creating privacy and intellectual property risks. Prior work mitigates replication by pruning weights tied to prompt-driven memorization, assuming memorization is localized. This study refutes that assumption: even after pruning, small perturbations to text embeddings can re-trigger replication. Evidence shows replication triggers span embedding space, identical outputs yield divergent activations, and different pruning methods select inconsistent memorization weights. Adversarial fine-tuning enables more robust mitigation and informs future defenses.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/finding-dori-discovery-of-retained-images-in-diffusion-models/149159/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/finding-dori-discovery-of-retained-images-in-diffusion-models/149159.png","ImageObject",300,407,{"name":92,"@type":93},"Fahsai","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-17","2026-08-27",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",11,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What problem does this paper address in text-to-image diffusion models?","Question",{"text":113,"@type":114},"It addresses undesired memorization and verbatim replication of training data, which can lead to privacy and intellectual property risks during inference.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"Why do the authors challenge the effectiveness of pruning-based mitigation?",{"text":118,"@type":114},"They show that even after pruning weights linked to memorization for specific prompts, small perturbations in text embeddings of previously mitigated prompts can still re-trigger data replication.",{"name":120,"@type":111,"acceptedAnswer":121},"What is DoRI, and what does it demonstrate?",{"text":122,"@type":114},"DoRI (Discovery of Retained Images) uses adversarial embeddings to trigger generation of memorized images beyond the original prompt space, revealing that pruning can conceal memorization rather than remove it.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},149159,1787794878,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":140,"language":141,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":67,"update_tm":130,"read_time":145,"preview_page_count":4},549768702563,"https://ap-avatar.wpscdn.com/avatar/8000c4aa63b76e948b?x-image-process=image/resize,m_fixed,w_180,h_180&k=1786536092046926083","Finding DoRI : Discovery of Retained Images in Diffusion Models  \nAntoni Kowalczuk 1 * Dominik Hintersdorf 2 3 * Lukas Struppek 4 * † Kristian Kersting 2 3 5 6 Adam Dziedzic 1 Franziska Boenisch 1  \nAbstract  \nText-to-image diffusion models (DMs) have achieved remarkable success in image generation. However, concerns about data privacy and intellectual property remain due to their potential to inadvertently memorize and replicate training data. Recent mitigation efforts have focused on identifying and pruning weights responsible for triggering verbatim training data replication, based on the assumption that memorization can be localized. We challenge this assumption and demonstrate that, even after such pruning, small perturbations to the text embeddings of previously mitigated prompts can re-trigger data replication, revealing the fragility of such methods. Our further analysis then provides multiple indications that memorization is indeed not inherently local: (1) replication triggers for memorized images are distributed throughout text embedding space; (2) embeddings yielding the same replicated image produce divergent model activations; and (3) different pruning methods identify inconsistent sets of memorization-related weights for the same image. Finally, we show that bypassing the locality assumption enables more robust mitigation through adversarial fine-tuning. These findings provide new insights into the fundamental nature of memorization in text-to-image DMs and inform the future development of more reliable mitigation methods against DM memorization. Our code is available at [https://github.com/sprin](https://github.com/sprin)tml/finding_dori.  \n*Equal contribution . †Work mainly done at DFKI/Technical University of Darmstadt. 1 CISPA Helmholtz Center for Information Security 2 German Research Center for Artificial Intelligence (DFKI) 3Technical University of Darmstadt 4Far.AI 5Hessian Center for AI (Hessian.AI) 6 Centre for Cognitive Science, Technical University of Darmstadt. Correspondence to: Antoni Kowalczuk \u003C[antoni.kowalczuk@cispa.de](antoni.kowalczuk@cispa.de)>, Dominik Hintersdorf \u003Cdo[minik.hintersdorf@dfki.de](minik.hintersdorf@dfki.de)>, Lukas Struppek \u003C[firstname@far.ai](firstname@far.ai)>.  \nProceedings of the 43 rd International Conference on Machine Learning, Seoul, South Korea. PMLR 306, 2026 . Copyright 2026 by the author(s) .  \n1. Introduction  \nGenerating high-quality images with diffusion models (DMs) enjoys great popularity. However, undesired memorization and verbatim replication of training data in textto-image DMs (Somepalli et al., 2023 ; Carlini et al., 2023) poses significant risks to privacy and intellectual property, as it can favor the unintended replication of sensitive or copyrighted data points during inference. In response, various detection and mitigation strategies have been proposed (Somepalli et al., 2023 ; Webster, 2023 ; Wen et al., 2024 ; Ren et al., 2024) . Most existing mitigation techniques either aim to identify and filter out highly memorized samples during training (Somepalli et al., 2023 ; Ren et al., 2024) or modify inputs at inference time (Somepalli et al., 2023 ; Wen et al., 2024 ; Ren et al., 2024) to reduce memorizationinduced data replication. While the training-based methods require computationally expensive retraining, the inferencetime methods are useful deployment defenses for models accessed via API, but do not offer permanent mitigation for open-weight models.  \nTo overcome both limitations, recent approaches (Hintersdorf et al., 2024 ; Chavhan et al., 2024) observe that the text prompts of memorized images elicit distinct activation patterns in the DMs. Based on these activations, the methods prune a small set of weights, effectively reducing the risk of verbatim data replication, while preserving overall image quality. However, since these methods work with a single prompt per memorized image, it remains an open question whether they prevent the replicat","cbCaih04odLABy9C","https://ap.wps.com/l/cbCaih04odLABy9C","pdf",19822124,57,"English","# Introduction\n## Memorization and replication risks in diffusion models\n## Existing detection and mitigation strategies\n## Discovery of Retained Images (DoRI) beyond the prompt space\n## Limitations of locality-based pruning and experimental motivation","[{\"question\":\"What problem does this paper address in text-to-image diffusion models?\",\"answer\":\"It addresses undesired memorization and verbatim replication of training data, which can lead to privacy and intellectual property risks during inference.\"},{\"question\":\"Why do the authors challenge the effectiveness of pruning-based mitigation?\",\"answer\":\"They show that even after pruning weights linked to memorization for specific prompts, small perturbations in text embeddings of previously mitigated prompts can still re-trigger data replication.\"},{\"question\":\"What is DoRI, and what does it demonstrate?\",\"answer\":\"DoRI (Discovery of Retained Images) uses adversarial embeddings to trigger generation of memorized images beyond the original prompt space, revealing that pruning can conceal memorization rather than remove it.\"}]","Finding DoRI - Discovery of Retained Images in Diffusion Models | PDF",144]