Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models

# Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models
Source: [https://arxiv.org/html/2606.24000](https://arxiv.org/html/2606.24000)
Rishabh Sharma1,2Stefano Martiniani1,2,3,4 1Simons Center for Computational Physical Chemistry, New York University 2Center for Soft Matter Research, Department of Physics, New York University 3Center for Neural Science, New York University 4Courant Institute of Mathematical Sciences, New York University \{rs10125, sm7683\}@nyu\.edu

###### Abstract

We introduce cyclic denoising—repeated forward and reverse diffusion at controlled noise amplitudes—as an extraction attack for image diffusion models\. Inspired by random organization in disordered solids, where cyclic mechanical perturbations anneal the system into increasingly stable configurations, cyclic denoising exposes regions of the learned distribution that remain largely inaccessible to standard sampling\. We find that these dynamics drive samples toward attractors with a broad stability spectrum, with the deepest attractors exhibiting ultrastability: they can be regenerated from near\-total corruption and sustained through thousands of noising–denoising cycles\. Many of these deep attractors correspond to memorized training images, including stock photographs, brand watermarks, and web\-crawl artifacts\. Our extraction attack requires only sampler\-level control—the ability to partially noise a sample to an intermediate diffusion timestep and denoise it back—but no gradients and no weight inspection\. Crucially, cyclic denoising requires no prior knowledge of training data, captions, or prompts\. In contrast, prior generate\-and\-filter attacks on production\-scale diffusion models commonly rely on large\-scale prompted generation from known or suspected training captions, followed by post\-hoc similarity search or membership\-inference filtering to identify memorized candidates\. While cyclic denoising can also be applied with prompts, our main protocol is fully unconditioned\. We demonstrate the phenomenon in Stable Diffusion v1\.4, a latent diffusion model, and in a smaller pixel\-space DDPM, showing consistent behavior across latent\- and pixel\-space diffusion models\. Across noise amplitudes, we observe a yielding\-like transition: low\-amplitude cycling produces either trivial absorbing fixed points \(featureless, near\-monochromatic images\) or limit cycles \(traveling/oscillating Turing\-like patterns in image space\), while larger amplitudes induce rearrangements, basin hopping, and long\-lived trapping in structured memorized attractor basins\. We further observe hierarchical partial absorption, where coarse scene layout freezes while fine details remain diffusive, as well as prompt\-stabilized basins and cross\-initial\-condition universality of the recovered attractor set\. Together, these results establish cyclic denoising as both a physics\-inspired probe of generative landscapes and a practical tool for memorization auditing, with implications for privacy, copyright compliance, and model fingerprinting\.

## 1Introduction

Large generative models are trained on massive collections of web\-scale data\. Their capabilities depend on these datasets, but so do their risks: models may retain and reproduce specific training examples, including copyrighted artwork, proprietary media, personal photographs, watermarked stock images, and other sensitive artifacts scraped from the web\. Understanding when and how such data can be recovered from a trained model is therefore central to privacy, copyright compliance, and model auditing\.

Existing extraction attacks on diffusion models have shown that memorized images can sometimes be recovered, but they rely in different ways on signals or machinery external to the model’s sampling dynamics\. One canonical, computationally expensive approach is generate\-and\-filter: for text\-conditioned models such as Stable Diffusion, attacks prompt the model with captions known or suspected to correspond to training examples, generate many samples per caption, and apply post\-hoc filtering, clustering, similarity search, or membership\-inference procedures to isolate memorized outputs\(Carliniet al\.,[2023](https://arxiv.org/html/2606.24000#bib.bib4)\)\. For unconditional models, where prompts are unavailable, memorized candidates have instead been identified by comparing large sets of generated samples to the training set, a strategy mainly practical in benchmark\-scale settings where the training set is known and searchable\(Carliniet al\.,[2023](https://arxiv.org/html/2606.24000#bib.bib4)\)\. Subsequent attacks use different signals, such as one\-step denoising behavior\(Webster,[2023](https://arxiv.org/html/2606.24000#bib.bib5)\)or auxiliary classifiers\(Chenet al\.,[2025](https://arxiv.org/html/2606.24000#bib.bib11)\), but still rely on captions, training\-data access, or separately trained detectors\. Cyclic denoising instead uses the sampler’s own long\-time dynamics to propose memorized candidates: absorbing episodes and long residence times, not captions, training\-set lookup, or auxiliary detectors, determine what is inspected\.

Our approach is inspired by the physics of driven disordered systems\(Cortéet al\.,[2008](https://arxiv.org/html/2606.24000#bib.bib1); Sharma and Karmakar,[2025](https://arxiv.org/html/2606.24000#bib.bib3); Munganet al\.,[2025](https://arxiv.org/html/2606.24000#bib.bib2); Zhang and Martiniani,[2026](https://arxiv.org/html/2606.24000#bib.bib14)\)\. The setup is conceptually simple: a disordered solid, for example, has a rugged landscape with many metastable configurations and can be perturbed cyclically at a controlled amplitude, such as by repeated shear\. Configurations change from cycle to cycle until the dynamics reach a state that resists further change, an absorbing state\. The amplitude of the drive controls which absorbing states are reachable\. Weak perturbations leave the system trapped in shallow basins; stronger perturbations dislodge it from those basins and let it explore deeper, more stable regions of the landscape\. At even higher amplitudes, the system yields and ergodically explores the energy landscape\. Thus, an absorbing to diffusive transition is observed with increasing cyclic perturbation amplitude\.

We import this idea into diffusion models through*cyclic denoising*\. Starting from an image or latent, we repeatedly apply forward noising to a controlled amplitudeγ\\gammaand then reverse denoise back toγ=0\\gamma=0, using the output of one cycle to initialize the next\. Viewed stroboscopically, i\.e\., at the end of each completed noising–denoising cycle, the model traces a trajectory through its learned generative landscape\. The diffusion noise levelγ\\gammaplays the role of a drive amplitude: by varyingγ\\gamma, we tune the strength of the cyclic perturbation and probe which states are reached and remain stable\. Long plateaus of near\-unity stroboscopic cosine similarity mark absorbing episodes; decoding these states yields candidate memorized images\.111Supplementary movies:[https://rishabh\-tifr\.github\.io/cyclic\-denoising/movies](https://rishabh-tifr.github.io/cyclic-denoising/movies)

This procedure reveals a yielding\-like stability spectrum\. At low amplitudes, the system cannot explore much and the trajectories collapse into trivial absorbing states\. These are either trivial fixed points consisting of featureless \(near\-monochromatic\) images, or limit cycles consisting of simple Turing\-like oscillating patterns\. At intermediate amplitudes, some exploration of the landscape becomes possible, and the dynamics uncover simple memorized artifacts such as logos and web templates\. At higher amplitudes, the dynamics can escape shallow basins, explore larger regions of the landscape and isolate even deeper attractors that persist for hundreds to thousands of cycles\. We show that many of these attractors are not generic samples: they correspond to memorized training images and repeated web\-crawl artifacts\.

This yields a prompt\-free extraction attack driven by the model’s own dynamics, requiring only sampler\-level control and no prior knowledge of, or access to, the training data\. The signature of memorization is dynamical: when a stroboscopic trajectory locks into a basin and persists there for hundreds to thousands of cycles, the dynamics itself flags the state as a memorization candidate\. We do not generate independent samples and then search for memorized ones after the fact; long\-lived absorption determines which states are inspected\. Furthermore, the protocol is agnostic to the initial condition: cycling can start from a generic image, a model\-generated sample, or pure noise\. We demonstrate the phenomenon in Stable Diffusion v1\.4 and in a pixel\-space DDPM trained on CIFAR\-10\. In both settings, memorized data appears not as isolated rare samples, but as dynamically stable attractors exposed by sustained cyclic perturbation\.

Our results suggest a new dynamical route for probing memorization in diffusion models: training examples that persist as deep basins in the generative landscape, and are rarely encountered by standard sampling, can nevertheless be accessed through cyclic dynamics\. Cyclic denoising therefore provides both a physics\-inspired dynamical probe of diffusion\-model generative landscapes and a practical tool for memorization auditing\.

Our main contributions are:

- •Cyclic denoising as a dynamical probe of diffusion\-model generative landscapes\.We introduce cyclic denoising, a repeated forward–reverse diffusion protocol for traversing the generative landscape\. By feeding the output of one cycle into the next, the protocol turns sampling into a stroboscopic dynamical system controlled by a cycling amplitudeγ\\gamma\. Inspired by random organization and mechanical annealing in driven disordered systems, it probes the stability structure of the learned generative landscape rather than drawing independent samples from it\.
- •Absorbing states, limit cycles, basin hopping, and ultrastable attractors\.We show that diffusion models exhibit rich long\-time dynamics under repeated noising–denoising cycles\. At low amplitudes, trajectories can collapse into trivial absorbing fixed points or simple limit cycles; at larger amplitudes, the dynamics become intermittent, with long residence times in attractor basins separated by transient exploratory hops between basins\. Some basins confine trajectories for hundreds to thousands of cycles, and the deepest attractors are ultrastable, regenerating after severe corruption and persisting under sustained cyclic perturbation\.
- •A yielding\-like transition and amplitude\-dependent stability spectrum\.Varying the cycling amplitudeγ\\gammareveals a dynamical transition from non\-yielded low\-amplitude behavior to intermittent exploration as the amplitude increases, with trajectories hopping between basins and becoming temporarily trapped in long\-lived attractors\. The recovered attractor set depends systematically onγ\\gamma: low amplitudes produce trivial fixed points or limit cycles, intermediate amplitudes recover simple logos and web\-crawl artifacts, and higher amplitudes isolate deeper, richer memorized images\. Thus,γ\\gammaacts as a stability filter, selecting different subsets of the model’s attractor set\.
- •A prompt\-free, training\-data\-agnostic extraction attack\.We show that many non\-trivial attractors correspond to memorized training images, yielding an extraction attack that requires only sampler\-level control—the ability to partially noise a sample to an intermediate diffusion timestep and denoise it back\. The attack requires no prior knowledge of the training data, captions, or prompts, and uses no gradients, weight inspection, post\-hoc clustering, or membership inference to propose candidates: memorized candidates appear directly as persistent states in the cyclic dynamics\.
- •Stability as a memorization diagnostic for prompted models\.We extend cyclic denoising to prompt\-conditioned sampling and measure stability after the prompt is removed\. Post\-removal stability correlates positively with memorization: prompt\-stabilized concept basins decorrelate fastest, while genuinely memorized training images span a wide range of stabilities, with the deepest remaining ultrastable\. This makes the post\-removal decorrelation time aγ\\gamma\-dependent dynamical test for memorization of candidate prompt–image pairs\.

![Refer to caption](https://arxiv.org/html/2606.24000v1/x1.png)Figure 1:Unconditional cyclic denoising drives latents toward attractors in the Stable Diffusion v1\.4 landscape\.\(a\) Decoded snapshots from a10410^\{4\}\-cycle unconditional cycling trajectory atγ=0\.86\\gamma=0\.86, starting from a single ImageNet test image; the15×1515\\times 15grid shows every 44th cycle, in reading order, starting from the top\-left\. After an initial transient \(snapshots change cycle\-to\-cycle\), the dynamics lock into the first attractor — a room with a yellow chair — that persists for over 2000 cycles\. A brief transient carries the trajectory into a second attractor \(white\-couch scene, paintings on a gray wall\), which survives for a comparable number of cycles before another, longer transient returns the trajectory to the same second basin\. \(b\) Cosine similarity between consecutive latentsznz\_\{n\}andzn−1z\_\{n\-1\}along the trajectory\. Plateaus near unity correspond to residence within a basin; sharp drops mark inter\-basin transitions, matching the qualitative changes in \(a\)\. Cosine similarities throughout this work are measured stroboscopically — at the end of each completed cycle\. \(c\) A single forward–reverse cycle,γ=0→0\.86→0\\gamma=0\\rightarrow 0\.86\\rightarrow 0, for an example latent drawn from each attractor\. The room layout is regenerated after near\-total corruption, while fine details such as wall artwork fluctuate stochastically—the signature of an attracting basin in which the dominant scene template is locked while peripheral content remains diffusive\. Right column: reverse image search retrieves near\-duplicate web images for both attractors, corresponding to e\-commerce template scenes in which different artworks are repeatedly composited onto the same room layout\. These templates recur across many vendor websites, making them very likely to be duplicated in the web\-scale training crawl\. Independently,Somepalliet al\.\([2023](https://arxiv.org/html/2606.24000#bib.bib10)\)flag these same two scenes \(their Fig\. 2\) among the most heavily replicated Stable Diffusion v1\.4 generations and trace them to duplicated LAION training images—training\-set\-grounded confirmation that the attractors recovered here by cycling alone, with no training\-set access, are genuine memorized content\. The two scenes also appear under similar product captions referring to the displayed artwork rather than the room itself, suggesting a possible mechanism for their proximity in the learned generative landscape\. Cyclic denoising thus exposes these memorized templates from the model’s dynamics alone\. The URLs for the reverse image search are listed in the Appendix \(Table[1](https://arxiv.org/html/2606.24000#A1.T1)\)\.
## 2Related work

### 2\.1Dynamical views of diffusion and generative models

Recent work has begun to treat generative models not only as samplers, but also as dynamical systems whose trajectories reveal structure in the learned distribution\. For diffusion models, the forward noising process and learned reverse denoising process provide a natural perturb\-and\-reconstruct experiment\.Sclocchiet al\.\([2025](https://arxiv.org/html/2606.24000#bib.bib6)\)showed that a single forward–backward diffusion setup, or a single u\-turn, can probe the hierarchical organization of data: in a hierarchical generative model, the probability of reconstructing high\-level features such as class identity drops sharply beyond a threshold diffusion time, while lower\-level details evolve smoothly across the whole diffusion process\. Their results frame diffusion time as a scale\-resolved probe of learned structure, with different levels of the data hierarchy being modified at different noise amplitudes\. Our work builds on this forward–backward viewpoint but changes the experiment qualitatively\. Rather than performing a single noising–denoising pass, we iterate the partial forward–reverse map for thousands of cycles\. This turns diffusion sampling into a stroboscopic dynamical system\. The resulting long\-time dynamics reveal phenomena that are invisible to one\-shot reconstruction experiments: absorbing states, limit cycles, basin hopping, cyclic yielding\-like transitions, and ultrastable attractors\. Thus, while prior forward–backward studies ask which features survive one corruption–reconstruction pass, cyclic denoising asks which states are reached and remain stable under repeated perturbation\.

A complementary line of work studies memorization through the*training*dynamics of diffusion models\.Bonnaireet al\.\([2025](https://arxiv.org/html/2606.24000#bib.bib7)\)identify two characteristic timescales over the course of training: a generalization timeτgen\\tau\_\{\\mathrm\{gen\}\}, at which the model begins to produce high\-quality samples, and a later memorization timeτmem\\tau\_\{\\mathrm\{mem\}\}, beyond which memorization emerges\. They show thatτmem\\tau\_\{\\mathrm\{mem\}\}grows approximately linearly with the training\-set sizenn, whileτgen\\tau\_\{\\mathrm\{gen\}\}remains approximately constant, opening a generalization window\[τgen,τmem\]\[\\tau\_\{\\mathrm\{gen\}\},\\tau\_\{\\mathrm\{mem\}\}\]that widens withnn\. Stopping training in this window lets even highly overparameterized models generalize before eventually memorizing, a form of implicit dynamical regularization\. Our focus is orthogonal: we hold a trained model fixed and ask whether memorized examples persist in its post\-training sampling dynamics\. Cyclic denoising probes this post\-training stability structure, revealing memorized images as long\-lived attractors even when they are rarely encountered by standard sampling\.

A closely related dynamical perspective is the work ofFumeroet al\.\([2026](https://arxiv.org/html/2606.24000#bib.bib8)\), who interpret autoencoder\-based neural models as defining latent vector fields by iterating the encode–decode map\. In their setting, an autoencoder induces a discrete\-time map in latent space, and the resulting trajectories and attractors can be used to analyze generalization, memorization, prior knowledge encoded in the network, and out\-of\-distribution behavior\. This is conceptually aligned with our view that model dynamics can expose learned structure\. However, the extension to diffusion models is not direct\. If one fully noises a diffusion sample to the terminal time before denoising, the previous state is erased and the reverse process becomes a fresh draw from the learned generative distribution\. In this full\-noising limit, iterating forward–reverse diffusion does not produce a meaningful trajectory with memory; it degenerates into repeated resampling\. Cyclic denoising operates instead in the partial\-memory regime with noise levelγ<1\\gamma<1\. Each cycle noises the current state only to an intermediate amplitude and then denoises it back, so the intermediate state retains partial information about the previous sample\. Crucially, diffusion models provide a natural control knob: by varyingγ\\gamma, we tune how strongly the current state is perturbed before reconstruction\. Inspired by cyclic yielding in disordered systems, where changing the drive amplitude qualitatively changes the states explored by the dynamics, we useγ\\gammato probe the stability hierarchy of the learned generative landscape\. Low amplitudes reveal shallow or trivial absorbing states and limit cycles; intermediate amplitudes uncover simple memorized artifacts such as logos and web templates; and higher amplitudes isolate deeper attractors corresponding to richer memorized images\. Thus, varyingγ\\gammais central to the method: it turns diffusion time \(or equivalentlyγ\\gamma\) into a stability\-resolved probe of memorization\.

### 2\.2Energy landscapes and associative\-memory views of diffusion models

A complementary line of work interprets diffusion models through the lens of associative memory\.Phamet al\.\([2025](https://arxiv.org/html/2606.24000#bib.bib15)\)recasts diffusion training as memory encoding and generation as memory retrieval, drawing an analogy to Hopfield and Dense Associative Memory systems in which stored patterns correspond to attractors of an energy landscape\. Across the memorization–generalization transition, they distinguish memorized samples, emergent*spurious*attractors absent from the training data, and generalized samples, and characterize these states using basin\-volume estimates and energy\-curvature spectra\. This provides strong support for an attractor\-based view of diffusion memorization: memorized examples can behave as deep, large\-basin states of the learned landscape\. Our contribution is complementary\. The associative\-memory analysis identifies and characterizes attractors, but does not by itself specify a cyclic dynamical route for reaching or discovering memorized basins in a fixed sampler\. We import that route from the physics of periodically driven disordered systems—random organization and yielding—where finite\-amplitude cycling is the canonical probe of a rugged landscape\. Their basin probes, by contrast, start from candidate states already in hand and test whether these reconstruct after a single perturbation; cyclic denoising instead drives the sampler repeatedly from arbitrary initial conditions and lets attractors emerge from the dynamics themselves\. The cycling amplitude is the control parameter: at small amplitude the dynamics remain non\-yielded, settling into trivial absorbing states or simple limit cycles, while at larger amplitude they hop intermittently between basins and dwell in long\-lived attractors, among them memorized images\.

### 2\.3Training\-data extraction from diffusion models

Training\-data extraction attacks ask whether a trained generative model can be made to reproduce examples from its training set\. In diffusion models, this has been studied as both a privacy risk and a copyright/compliance problem\. Using retrieval\-based comparisons between generated samples and training images,Somepalliet al\.\([2022](https://arxiv.org/html/2606.24000#bib.bib9)\)showed that text\-to\-image diffusion models, including Stable Diffusion, can directly replicate training content\. Follow\-up work showed that such copying is not explained by image duplication alone: the model’s text conditioning plays a comparably important role, with replication common in text\-conditional models but much less frequent in unconditional ones\(Somepalliet al\.,[2023](https://arxiv.org/html/2606.24000#bib.bib10)\)\.

The canonical extraction attack on diffusion models was introduced byCarliniet al\.\([2023](https://arxiv.org/html/2606.24000#bib.bib4)\)\. Their text\-to\-image attack follows a generate\-and\-filter paradigm: generate many samples, identify candidate near\-duplicates, and verify memorization using similarity or membership\-inference\-style tests\. For Stable Diffusion, they target captions associated with highly duplicated training examples: they select the350,000350\{,\}000most\-duplicated examples, generate500500samples per caption, and then filter the resulting175175million generations for near\-identical cliques\. A prompt is flagged when at least1010of its500500generations collapse to near\-duplicates under a patch\-based image distance, and candidates are then verified against the training set\. This large\-scale pipeline yields9494confirmed Stable Diffusion extractions under their strict\(ℓ2,0\.15\)\(\\ell\_\{2\},0\.15\)criterion, rising to109109near\-copies under manual inspection\. For unconditional CIFAR\-10 diffusion models, where prompts are unavailable,Carliniet al\.\([2023](https://arxiv.org/html/2606.24000#bib.bib4)\)use a different controlled setup: they train1616diffusion models, each on a random half of the CIFAR\-10 training set, generate2202^\{20\}unconditional samples \(≈1\.05\\approx 1\.05million\) in total, and identify memorized examples by direct comparison to the training set using calibrated nearest\-neighbor distances\. This recovers1,2801\{,\}280unique CIFAR\-10 training images, but relies on a known, searchable training set and multiple models trained on different data subsets\. Thus, while prior work demonstrated that diffusion models can leak training data, these pipelines rely on auxiliary information or procedures such as prompts, captions, training\-set access, membership\-inference criteria, multi\-model training, or large\-scale post\-hoc filtering\. In contrast, cyclic denoising proposes candidates*from the model’s own long\-time dynamics*\. In both Stable Diffusion and CIFAR\-10, we operate on a single fixed checkpoint trained on the full dataset and surface candidates from the dynamics alone—none of these signals required\.

Webster \([2023](https://arxiv.org/html/2606.24000#bib.bib5)\)take a different route from large\-scale generate\-and\-filter attacks by exploiting one\-step synthesis behavior in text\-to\-image diffusion models\. They observe that some prompts corresponding to memorized images can reproduce them near\-verbatim after only a single denoising step, and turn this into fast scoring rules for candidate captions: a denoising confidence score in the white\-box setting and an edge\-consistency score in the black\-box setting\. This reduces the number of network evaluations by orders of magnitude relative to sampling hundreds of full trajectories per prompt, but the attack remains driven by known captions—candidates are generated from captions, scored, and then labeled by matching to the corresponding training image, or, for template verbatims, by retrieval and masking against the training set\. In contrast, cyclic denoising neither scores captions nor tests one\-step reconstruction; it surfaces candidates as attractors of the long\-time cyclic dynamics, without any conditioning\.

Unconditional diffusion models are harder to attack because there is no prompt with which to steer the model toward memorized samples\. SIDE addresses this setting with*surrogate conditioning*: it generates synthetic samples from the target model, clusters them in a pretrained feature space to form data\-driven pseudo\-labels, and uses these surrogate labels to guide extraction from the original model\(Chenet al\.,[2025](https://arxiv.org/html/2606.24000#bib.bib11)\)\. In practice, this guidance is implemented through additional learned machinery, such as a time\-dependent classifier or LoRA\-based fine\-tuning\. Cyclic denoising instead uses the original sampler dynamics alone\. To propose candidates, it requires only sampler\-level control—the ability to partially noise a sample to an intermediate diffusion timestep and denoise it back—and none of SIDE’s surrogate\-conditioning machinery: no pretrained feature extractor, no clustering of generated samples, no auxiliary classifier or LoRA fine\-tuning, and no classifier\-guidance gradients\.

Across these attacks, candidates are found by generating large pools of samples—from known or suspected training captions in the conditional case, and unconditionally where no captions are available—that are then clustered, scored, or verified after the fact\. Cyclic denoising instead follows a single correlated trajectory: memorized candidates reveal themselves as attractors, long\-lived basins, or high\-similarity plateaus under repeated noising–denoising cycles\.

## 3Methods

We use two open\-weight diffusion models without modifying their architectures or weights: Stable Diffusion v1\.4, a latent diffusion model operating in a4×64×644\\times 64\\times 64VAE latent space\(Rombachet al\.,[2022](https://arxiv.org/html/2606.24000#bib.bib12)\)\([https://huggingface\.co/CompVis/stable\-diffusion\-v1\-4](https://huggingface.co/CompVis/stable-diffusion-v1-4)\), and an unconditional pixel\-space DDPM trained on CIFAR\-10\(Hoet al\.,[2020](https://arxiv.org/html/2606.24000#bib.bib13)\)\([https://huggingface\.co/google/ddpm\-cifar10\-32](https://huggingface.co/google/ddpm-cifar10-32)\)\. Stable Diffusion is run unconditionally \(empty prompt, guidance scale0\) withN=50N=50inference steps, and the CIFAR\-10 DDPM withN=250N=250inference steps\.

![Refer to caption](https://arxiv.org/html/2606.24000v1/x2.png)Figure 2:Basin hopping in latent space under unconditional cyclic denoising in Stable Diffusion v1\.4\.The same trajectory shown in Fig\.[1](https://arxiv.org/html/2606.24000#S1.F1), here visualized as a two\-dimensional PCA projection of its latent trajectory; the top two components are fit on this trajectory alone, and line color encodes cycle number\. A single ImageNet test\-set image \(green circle, cycle 0, inset\) is cycled through Stable Diffusion v1\.4 atγ=0\.86\\gamma=0\.86for 10,000 cycles \(unconditional cycling\)\. After a short transient, the trajectory is captured by a first attractor in which it dwells for many cycles, before escaping and hopping to a second, well\-separated attractor; it then briefly leaves this second basin but is recaptured by it, ending at cycle 10,000 \(red square\)\. Black stars mark two individual states along the trajectory — cycle 2000 \(c2000\), in the first basin, and cycle 9000 \(c9000\), in the second; panels \(c\) and \(b\) show these two states decoded to pixels, as representative examples from each basin\. Rather than decorrelating, the dynamics dwell for long stretches in deep absorbing states and hop between them, revealing the model’s ultrastable memories\. See Supplementary Movie 1 for the complete trajectory\.Starting from a stateznz\_\{n\}, one cycle of*cyclic denoising*consists of noising the state up to an intermediate noise level and then denoising it fully back to a clean state; the output becomes the input to the next cycle, defining a stroboscopic trajectory observed at the end of each noising–denoising cycle\. The control parameter is the cycling amplitudeγ∈\[0,1\]\\gamma\\in\[0,1\], the fraction of the inference trajectory traversed per cycle, which sets how much noise is added before denoising\. Smallγ\\gammaadds little noise and gives a near\-identity perturbation, whileγ=1\\gamma=1corresponds to near\-complete noising followed by a full denoising pass; in every case we denoise all the way back to a clean state, soγ\\gammacontrols only how high each cycle climbs\. We use the DDPM sampler throughout, with fresh Gaussian noise drawn both when noising and during denoising, so that cycling is a diffusion analogue of stochastic cyclic driving rather than a deterministic map\.

For Stable Diffusion, we use three initialization ensembles: ImageNet validation images encoded into the VAE latent space, model\-generated latents, and i\.i\.d\. Gaussian latents\. For CIFAR\-10, we initialize from randomly sampled CIFAR\-10 training images\. We run10,00010\{,\}000cycles per trajectory while sweepingγ\\gammaover a range of amplitudes; Stable Diffusion uses 10 seeds per initialization ensemble and CIFAR\-10 uses 50 training\-image seeds, with the seed set held fixed across all amplitudes in both cases\. At each cycle, we compute the cosine similarity between consecutive stroboscopic states \(in the VAE latent for Stable Diffusion and in pixel space for CIFAR\-10\),cos⁡\(zn,zn−1\)\\cos\(z\_\{n\},z\_\{n\-1\}\)\. The steady\-state similarity reported in yielding curves is the average over the final10001000cycles of each trajectory, followed by an average across seeds\. Absorbing episodes are identified by long plateaus of near\-unity stroboscopic similarity, and their decoded states are inspected as candidate attractors\. Stable Diffusion attractors are verified post hoc using public reverse\-image search\. CIFAR\-10 attractors are verified post hoc by cross\-checking against memorized examples reported byCarliniet al\.\([2023](https://arxiv.org/html/2606.24000#bib.bib4)\)\. These verification steps are not used to generate candidates\. For prompted experiments, we use the same cyclic protocol with classifier\-free guidance\. Trajectories are first cycled with a candidate prompt; in prompt\-removal experiments, we then continue cycling unconditionally, tracking the cosinecos⁡\(zt,z0\)\\cos\(z\_\{t\},z\_\{0\}\)between each cycle and the image absorbed at the moment of removal to measure how long the recovered state remains stable without conditioning\.

Compute resources\.Each cycling run is an independent single\-GPU job on one NVIDIA L40S \(48 GB VRAM\); the only parallelism is running separate amplitudes concurrently, with no multi\-GPU or distributed execution within a run\. Per\-run time scales roughly linearly with the cycling amplitude, since a cycle at amplitudeγ\\gammaruns proportionally more denoising steps: across the swept amplitudes, a10,00010\{,\}000\-cycle Stable Diffusion run \(10 seeds batched through the UNet\) ranges from a few hours at lowγ\\gammato ten or eleven hours nearγ=1\\gamma=1, with an intermediate amplitude \(γ≈0\.7\\gamma\\approx 0\.7\) taking about eight hours\. The CIFAR\-10 DDPM \(N=250N=250, 50 seeds\) follows the same linear\-in\-γ\\gammascaling\. Prompt\-conditioned cycling with classifier\-free guidance doubles the per\-step UNet cost, since each step requires conditional and unconditional predictions, but uses only 5 seeds, keeping wall\-clock time comparable\. The total compute footprint of all results in this paper is within10001000L40S\-GPU\-hours, substantially below large\-scale caption\-based extraction pipelines that rely on generating and filtering millions of images\. We stress that this budget quantifies the full dynamical phenomenology rather than extraction alone: it spans the entire amplitude range needed to map the yielding diagram \(Fig\.[3](https://arxiv.org/html/2606.24000#S3.F3)\), including low\-γ\\gammaruns where the dynamics settle into trivial absorbing states or simple limit cycles and do not produce non\-trivial memorized candidates in our runs\. Extraction does not require this full coverage; an attack could focus on the intermediate\-to\-large amplitudes where memorized attractors, basin hopping, and long residence times occur\. Thus, the compute required for extraction alone can be substantially lower than the totals reported here\.

![Refer to caption](https://arxiv.org/html/2606.24000v1/x3.png)Figure 3:Yielding diagram for cyclic denoising\.Steady\-state stroboscopic similarity⟨cos⁡\(zn,zn−1\)⟩ss\\langle\\cos\(z\_\{n\},z\_\{n\-1\}\)\\rangle\_\{\\mathrm\{ss\}\}between consecutive cycles versus the perturbation \(cycling\) amplitudeγ\\gamma\. Each trajectory is run for10,00010\{,\}000cycles; for each seed we average the similarity over the final10001000cycles, then report the mean across seeds with±\\pmSEM error bars\. Stable Diffusion v1\.4 is shown for ImageNet, model\-generated, and Gaussian initializations \(1010seeds perγ\\gammaeach\); the CIFAR\-10 DDPM is initialized from CIFAR\-10 training images \(5050seeds perγ\\gamma\)\. At lowγ\\gammathe dynamics are absorbing — consecutive cycles return to essentially the same state \(⟨cos⟩ss≈1\\langle\\cos\\rangle\_\{\\mathrm\{ss\}\}\\approx 1\), the signature of the fixed points and limit cycles of the stroboscopic map\. Beyond a model\-dependent critical amplitude the similarity drops sharply: a yielding\-like transition in which cycling drives rearrangements, basin hopping, and exploration of the landscape\. The three Stable Diffusion initialization ensembles collapse onto a common master curve, indicating that the transition is a property of the learned generative landscape rather than of the initial condition\. The CIFAR\-10 DDPM yields at markedly lowerγ\\gammathan Stable Diffusion; we attribute this partly to the models’ different noise schedules, under which the step\-fractionγ\\gammamaps nonlinearly — and differently — onto signal\-to\-noise ratio, soγ\\gammais comparable only within a model and not across the two\. The qualitative absorbing\-to\-exploratory transition is nonetheless shared across latent\- and pixel\-space diffusion\. Also note that even atγ=1\\gamma=1the similarity does not fall to zero: Stable Diffusion’s noise schedule has a non\-zero terminal SNR, so a small fraction of the previous latent is still carried over each cycle rather than a true reset to pure noise\.![Refer to caption](https://arxiv.org/html/2606.24000v1/x4.png)Figure 4:Moderate\-amplitude cycling recovers memorized logos and web\-crawl artifacts\.\(a\) Selected basins recovered by unconditional cyclic denoising in Stable Diffusion v1\.4 at moderate noise amplitudes\. Each row shows ten equispaced stroboscopic snapshots from a single cycling trajectory during the residence time of one basin, with the corresponding cycle range and cycling amplitude indicated\. At very lowγ\\gamma, the dynamics collapse to trivial absorbing states—saturated patterns, monotonic fills, and simple geometric shapes—as the trajectory becomes trapped after iterating on local details, lacking the perturbation amplitude needed to rearrange the latent at larger scales, see Supplementary Fig\.[8](https://arxiv.org/html/2606.24000#A1.F8)\. In the intermediate regime shown here, the perturbation is large enough to escape these trivial fixed points; the resulting attractors are simple, highly repeated visual templates, including brand logos, product\-page placeholders, and web\-crawl artifacts\. \(b\) Reverse image search retrieves close web matches for each recovered attractor, indicating that these states correspond to memorized image templates rather than generic samples\. These attractors are recovered across multiple random seeds and nearby values ofγ\\gamma, but typically become transient at larger amplitudes, placing them at intermediate depth in the basin\-stability spectrum: more structured than trivial low\-amplitude absorbing states, but less stable than the deep memorized scenes that survive high\-amplitude cycling\.![Refer to caption](https://arxiv.org/html/2606.24000v1/x5.png)Figure 5:High\-amplitude cycling isolates deep memorized attractors\.\(a\) Memorized images recovered by unconditional cyclic denoising in Stable Diffusion v1\.4 at high noise amplitudes\. Each row shows ten equispaced stroboscopic snapshots from a single cycling trajectory during the residence time of one attractor, with the cycle range andγ\\gammaindicated\. As in random organization, cyclic forcing drives the system toward states that resist change under the applied drive\. At higher amplitudes, the trajectory escapes shallow basins and explores more of the learned distribution, revealing only deeper attractors as long\-lived states\. The recovered attractors include richer memorized images than the intermediate\-amplitude logos and web artifacts in Fig\.[4](https://arxiv.org/html/2606.24000#S3.F4), including product photographs, stock\-style object renderings, and recurring room templates\. \(b\) Reverse image search retrieves close web matches for the recovered attractors, indicating that these states correspond to memorized training images or templates\. These deep attractors recur across random seeds, initial conditions, and nearby values ofγ\\gamma, with some basins—especially the living room \(with the white sofa and yellow chair\) scenes—capturing many trajectories for long residence times\. Including Fig\.[4](https://arxiv.org/html/2606.24000#S3.F4), the recovered attractor set forms a dynamical fingerprint of Stable Diffusion v1\.4: a model\-specific signature of memorized training content exposed by unconditional cycling alone\. Representative reverse\-image\-search source URLs are listed in the Appendix \(Table[1](https://arxiv.org/html/2606.24000#A1.T1)\)\.![Refer to caption](https://arxiv.org/html/2606.24000v1/x6.png)Figure 6:Unconditional cyclic denoising drives CIFAR\-10 DDPM samples toward memorized attractors\.\(a\) Snapshots from a10410^\{4\}\-cycle unconditional cycling trajectory in a pixel\-space DDPM trained on CIFAR\-10, initialized from a CIFAR\-10 training image\. The15×1515\\times 15grid shows every fourth cycle from cycles 2000–2896\. After a short transient, the trajectory locks into a car\-like attractor, briefly leaves it, and then enters a nearby mirror\-image attractor, where it persists for many cycles, before ultimately escaping again\. \(b\) Cosine similarity between consecutive cycle\-end samplesznz\_\{n\}andzn−1z\_\{n\-1\}along the full trajectory, measured stroboscopically at the end of each completed cycle\. \(c\) Zooming into cycles 2000–3000 reveals the plateau–drop–plateau structure corresponding to residence in one basin, transient hopping, and residence in the mirror\-related basin\. The paired attractors suggest that horizontal\-flip augmentation during training may encode symmetry\-related memorized states as nearby basins\. This resembles two\-level systems in disordered solids, where two nearly degenerate configurations are separated by a small barrier and the system can switch between them\. \(d\) A single forward–reverse cycle,γ=0→0\.39→0\\gamma=0\\rightarrow 0\.39\\rightarrow 0, for representative samples from the two basins\. \(e\) Matching CIFAR\-10 training image reported in\(Carliniet al\.,[2023](https://arxiv.org/html/2606.24000#bib.bib4)\)\. The memorized candidate appears directly as persistent high\-similarity plateaus in the cyclic trajectory\. Unlike prior CIFAR\-10 extraction, which required training\-set lookup to identify memorized samples, cyclic denoising recovers the candidate from the model dynamics alone\. See Supplementary Fig\.[12](https://arxiv.org/html/2606.24000#A1.F12)for additional recovered CIFAR\-10 attractors\.![Refer to caption](https://arxiv.org/html/2606.24000v1/x7.png)Figure 7:Stability of prompt\-conditioned image attractors under cyclic denoising\.\(a–d\) Prompt\-conditioned cycling in Stable Diffusion v1\.4 atγ=0\.78\\gamma=0\.78using classifier\-free guidance and prompts previously associated with memorized samples\(Carliniet al\.,[2023](https://arxiv.org/html/2606.24000#bib.bib4); Webster,[2023](https://arxiv.org/html/2606.24000#bib.bib5)\)\. Rows show: \(a\) “Freddy Adu Signs For Yet Another Club You Probably Don’t Know”; \(b\) “Aretha Franklin Files $10 Million Suit Over Patti LaBelle Fight Story On Satire Website”; \(c\) the same Freddy Adu prompt as in \(a\), initialized from a different Gaussian seed; and \(d\) “Prince Reunites With Warner Brothers, Plans New Album\.” Each trajectory rapidly converges to the corresponding known memorized image and remains absorbed; the convergence of \(a\) and \(c\) to the same image from different seeds demonstrates seed\-independent attraction\. \(e,f\) Stability of the “Ann Graham Lotz” memory, following one example trajectory \(one of five Gaussian seeds\)\. \(e\) With the prompt present, the trajectory converges to the memorized image and remains locked for the full50005000\-cycle run; all five seeds converge to the same image, with convergence times that vary across seeds\. \(f\) Continuing the same trajectory unconditionally after prompt removal, it stays locked in the same image for the full additional10001000cycles we ran—still absorbed at the end rather than decorrelating; of the five seeds, four remain locked, indicating that the prompt steered the system to a state that is itself ultrastable under the unconditional dynamics\. \(g,h\) A prompt\-stabilized concept attractor—stable under the prompt but not unconditionally absorbing—again following one example trajectory\. \(g\) Cycling with the guessed prompt “Abbey Road album cover”—not known to correspond to any training image—the trajectory reaches a steady prompted state that preserves the iconic zebra\-crossing composition without collapsing to a single image, a crude rather than verbatim rendering \(Supplementary Fig\.[13](https://arxiv.org/html/2606.24000#A1.F13)\)\. \(h\) After prompt removal it decorrelates within a few cycles, as do all five seeds—the fastest decay among the prompts tested \(Supplementary Fig\.[14](https://arxiv.org/html/2606.24000#A1.F14)\)\.
## 4Results

Unconditional cyclic denoising produces absorbing attractors\.Figure[1](https://arxiv.org/html/2606.24000#S1.F1)shows the basic phenomenon in Stable Diffusion v1\.4\. A single unconditional cyclic trajectory does not produce independent samples; instead, it exhibits long\-lived attractor residence, basin hopping, and partial absorption, where coarse scene structure remains stable while fine details fluctuate\. Reverse image search confirms that the recovered attractors correspond to memorized web templates\. Figure[2](https://arxiv.org/html/2606.24000#S3.F2)visualizes the basin\-hopping and transient\-exploration phases in the PCA space, with clear clusters corresponding to the two memorized images\. An animated version of this basin\-hopping trajectory—its latent dynamics in PCA alongside the decoded images—is provided as Supplementary Movie 1\.

Different amplitudes expose different memories\.Figures[4](https://arxiv.org/html/2606.24000#S3.F4)and[5](https://arxiv.org/html/2606.24000#S3.F5), along with Supplementary Fig\.[8](https://arxiv.org/html/2606.24000#A1.F8), show that the complexity of recovered attractors depends onγ\\gamma\. Intermediate amplitudes recover simple, highly repeated artifacts such as logos, product placeholders, and web\-crawl remnants, whereas higher amplitudes isolate richer memorized images such as product photographs, object renderings, and recurring room templates\. Supplementary Fig\.[11](https://arxiv.org/html/2606.24000#A1.F11)shows some additional examples of how individual trajectories traverse the landscape across intermediate\-to\-high amplitudes, sometimes collapsing into deep basins and, at others, wandering between semantically coherent shallow basins via inter\-basin hops\. At very high noise levels \(γ→1\\gamma\\to 1\) successive cycles become essentially independent draws: memorized images may still recur—as they do across repeated independent generations in generate\-and\-filter attacks—but they no longer form the temporally contiguous dwelling episodes \(connected runs of consecutive cycles within a single basin, colored coherently by cycle number\) seen at intermediateγ\\gamma\. We also note that the same memorized images recur across different seeds, initialization ensembles, and nearby amplitudes \(Supplementary Fig\.[10](https://arxiv.org/html/2606.24000#A1.F10)\), so our recurrent attractor set forms a dynamical fingerprint of Stable Diffusion v1\.4\. Figure[3](https://arxiv.org/html/2606.24000#S3.F3)quantifies thisγ\\gamma\-dependence as a yielding diagram: at low amplitudes the dynamics are absorbing, returning to essentially the same state each cycle as the system settles onto a fixed point or, more rarely, a limit cycle that repeats with a fixed period in cycle number \(Supplementary Fig\.[9](https://arxiv.org/html/2606.24000#A1.F9)\); beyond a critical amplitude the cycle\-to\-cycle return drops sharply as cycling induces rearrangements and basin hopping\. This mirrors the yielding transition seen routinely in disordered solids under cyclic drive, where increasing the drive amplitude takes the system from a stuck phase—trapped in an absorbing state that returns to itself each cycle—to an \(initial\-state independent\) fluidized phase that explores configuration space\. In our cyclic denoising, trajectories in this exploratory regime are intermittently captured by deep attractors for hundreds to thousands of cycles before escaping and continuing to explore the landscape\.

The phenomenon is not specific to latent diffusion\.Figure[6](https://arxiv.org/html/2606.24000#S3.F6)shows the same absorbing\-state dynamics in a pixel\-space DDPM trained on CIFAR\-10, confirming that these absorbing basins are not an artifact of the latent space or the VAE decoder\. Starting from a CIFAR\-10 training image and cycling atγ=0\.39\\gamma=0\.39, the dynamics lock onto a memorized car as a persistent attractor, read off directly from the high\-similarity plateau with no training\-set lookup; the recovered image matches a CIFAR\-10 example independently flagged as memorized byCarliniet al\.\([2023](https://arxiv.org/html/2606.24000#bib.bib4)\)\(Fig\.[6](https://arxiv.org/html/2606.24000#S3.F6)\(e\)\)\. After freezing on the car for many cycles, the trajectory passes through a brief transient into a nearby, horizontally mirrored variant, freezes there as well, and then escapes \(Fig\.[6](https://arxiv.org/html/2606.24000#S3.F6)\(c\)\)—the same basin hopping between long\-lived absorbing states we observe in the latent\-space model \(Figs\.[1](https://arxiv.org/html/2606.24000#S1.F1)and[2](https://arxiv.org/html/2606.24000#S3.F2)\)\. These nearby attractors—a car and its mirror image—are reminiscent of the two\-level systems of disordered solids, where a system hops between two nearly degenerate configurations separated by a small barrier; the pairing here is probably a consequence of the horizontal\-flip augmentation used in training\. As in Stable Diffusion, the same attractors recur throughout our experiments from very different initial seeds and cycling amplitudes, and the candidates emerge from a single public checkpoint through the model’s own dynamics, without the large\-scale sample\-and\-search or the retraining of multiple models used by some prior CIFAR\-10 extraction attempts\. The attractors in Fig\.[6](https://arxiv.org/html/2606.24000#S3.F6)and Supplementary Fig\.[12](https://arxiv.org/html/2606.24000#A1.F12)are a non\-exhaustive selection: cycling exposes many more memorized attractors across seeds and amplitudes than we report here, both for CIFAR\-10 and for Stable Diffusion \(Figs\.[4](https://arxiv.org/html/2606.24000#S3.F4)and[5](https://arxiv.org/html/2606.24000#S3.F5)\)\. One caveat to keep in mind when comparing yield values across methods: training multiple models, each on a different subset of the data\(Carliniet al\.,[2023](https://arxiv.org/html/2606.24000#bib.bib4)\), produces several independent landscapes, each with its own memorized minima\. We therefore expect the yield of cyclic denoising to grow with the number of independently trained models it is applied to, so any direct comparison of recovery rates should control for the number of models\.

Prompt\-conditioned attractors and ultrastability after prompt removal\.Figure[7](https://arxiv.org/html/2606.24000#S3.F7)applies the same protocol with classifier\-free guidance, using prompts previously associated with memorized Stable Diffusion images\(Carliniet al\.,[2023](https://arxiv.org/html/2606.24000#bib.bib4); Webster,[2023](https://arxiv.org/html/2606.24000#bib.bib5)\)\. Each such prompt rapidly drives the dynamics onto the corresponding known memorized image and holds it there, with different Gaussian seeds for the same prompt reaching the same attractor \(Fig\.[7](https://arxiv.org/html/2606.24000#S3.F7)\(a,c\)\)\. Because these prompts target images*independently*known to be memorized, their recovery as attractors is a positive control: it confirms directly that cyclic denoising can drive the dynamics onto genuinely memorized content\. Removing the prompt and continuing to cycle unconditionally then probes their stability: for “Ann Graham Lotz”, four of five trajectories remain locked in the same image for the entire10001000\-cycle unconditional continuation we ran—still absorbed when we stopped, rather than decorrelating—an ultrastable basin \(Fig\.[7](https://arxiv.org/html/2606.24000#S3.F7)\(e,f\)\)\. A*guessed*prompt—one not known to correspond to any training image—behaves differently\. With “Abbey Road album cover” the dynamics still reach a basin that is stable under the prompt, but the decoded state varies slightly from cycle to cycle and never settles on the actual cover: it captures the concept rather than a stored image, and decorrelates within a few cycles once conditioning is removed \(Fig\.[7](https://arxiv.org/html/2606.24000#S3.F7)\(g,h\)\)\. A second guessed prompt, “Mona Lisa”, likewise settles under its prompt into a recognizable but non\-verbatim, fluctuating concept attractor; not every prompt induces such ready absorption, but among several candidate prompts we tried, these two absorbed readily\. The two cases differ on two signatures: first, under the prompt, the known memories are sharp and verbatim, returning to essentially the same image from cycle to cycle, whereas the guessed prompts give softer, fluctuating renditions of the concept \(Supplementary Fig\.[13](https://arxiv.org/html/2606.24000#A1.F13)\); and second, after prompt removal, decorrelation time correlates positively with memorization, with the guessed concept basin decorrelating the fastest and the memorized images spanning a range of stabilities up to the ultrastable basins \(Supplementary Fig\.[14](https://arxiv.org/html/2606.24000#A1.F14)\)\. Our unconditional extraction relies on this signal—long\-lived, ultrastable absorption—to flag memorized candidates without any prompt; that the deepest known memories stay ultrastable without the prompt is a ground\-truth check that the signal is sound\.

## 5Discussion

Cyclic denoising changes how we should think about memorization in diffusion models\. Prior extraction attacks largely treat the model as a generator of independent samples and then search for memorized examples by prompting, clustering, or comparing against the training set\. Our results show that memorized images can instead appear as dynamical attractors: not merely rare outputs, but stable states that the model can repeatedly regenerate under cyclic perturbation\. Standard sampling may therefore substantially underestimate memorization risk, because some training examples are hidden in deep basins that are rarely visited unless the model is driven\.

More broadly, our results suggest that memorization should be studied as a stability property of the learned generative dynamics\. In prompt\-conditioned settings, stability after prompt removal already provides a targeted test: images that remain locked without conditioning are more strongly memorized than concept basins stabilized only by the prompt\. Training examples that survive strong cyclic perturbations behave like deep basins in the model landscape\. Preventing memorization may therefore require more than reducing the probability of reproducing a training image under ordinary sampling; it may require eliminating or weakening the ultrastable attractors that store those images\.

## 6Limitations

Our attack requires sampler\-level control over the noising and denoising steps, and therefore does not apply directly to standard text\-to\-image API endpoints that expose only final samples\. Coverage requires a more quantitative investigation: while some basins clearly capture more trajectories than others in our runs, we have not systematically characterized the shape of the attractor distribution or the fraction of the memorized set that any single sweep recovers\. The recovered attractors depend on choices such as the cycling amplitude, scheduler, number of cycles, and diversity within initialization ensembles; systematic optimization of these choices is an important direction for future work\.

## 7Broader Impacts

As an auditing tool, cyclic denoising lets practitioners and third parties identify training images that a deployed diffusion model has memorized, including copyrighted photographs, watermarked content, brand logos, and privacy\-sensitive material scraped from the open web\. The recovered attractor set provides a model\-specific fingerprint of repeatedly encoded images that reveals information about the data distribution and the training pipeline\. Because the protocol uses no captions, training\-set access, or weight inspection, it can be applied as a dataset\-agnostic audit of open\-weight diffusion models that would otherwise be hard to inspect\.

The same protocol is also an extraction attack\. An adversary with sampler\-level access could recover sensitive training content without the prompts, captions, or training\-set lookups that bound caption\-based pipelines, and the attack does not depend on knowing what to look for: any sufficiently deep basin will surface its memorized content under sustained cyclic forcing\. Memorization rates measured under ordinary sampling may therefore understate the leakage that a determined adversary can elicit through cyclic perturbation, and absorbing\-state structure should be treated as part of the threat model for diffusion\-model deployment\.

## Acknowledgments

This work was supported by a grant from the Simons Foundation \[MPS\-T\-MPS\-00839534, MET\] \(RS, SM\)\. We gratefully acknowledge the use of computational resources and consultation support provided by NYU IT High Performance Computing\. We also thank Prof\. David J\. Heeger for many fruitful discussions\.

## References

- T\. Bonnaire, R\. Urfin, G\. Biroli, and M\. Mezard \(2025\)Why diffusion models don’t memorize: the role of implicit dynamical regularization in training\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=BSZqpqgqM0)Cited by:[§2\.1](https://arxiv.org/html/2606.24000#S2.SS1.p2.7)\.
- N\. Carlini, J\. Hayes, M\. Nasr, M\. Jagielski, V\. Sehwag, F\. Tramèr, B\. Balle, D\. Ippolito, and E\. Wallace \(2023\)Extracting training data from diffusion models\.External Links:2301\.13188,[Link](https://arxiv.org/abs/2301.13188)Cited by:[Figure 12](https://arxiv.org/html/2606.24000#A1.F12),[§1](https://arxiv.org/html/2606.24000#S1.p2.1),[§2\.3](https://arxiv.org/html/2606.24000#S2.SS3.p2.12),[Figure 6](https://arxiv.org/html/2606.24000#S3.F6),[Figure 7](https://arxiv.org/html/2606.24000#S3.F7),[§3](https://arxiv.org/html/2606.24000#S3.p3.5),[§4](https://arxiv.org/html/2606.24000#S4.p3.1),[§4](https://arxiv.org/html/2606.24000#S4.p4.1)\.
- Y\. Chen, S\. Wang, D\. Zou, and X\. Ma \(2025\)SIDE: surrogate conditional data extraction from diffusion models\.External Links:2410\.02467,[Link](https://arxiv.org/abs/2410.02467)Cited by:[§1](https://arxiv.org/html/2606.24000#S1.p2.1),[§2\.3](https://arxiv.org/html/2606.24000#S2.SS3.p4.1)\.
- L\. Corté, P\. M\. Chaikin, J\. P\. Gollub, and D\. J\. Pine \(2008\)Random organization in periodically driven systems\.Nature Physics4\(5\),pp\. 420–424\.External Links:[Document](https://dx.doi.org/10.1038/nphys891),[Link](https://doi.org/10.1038/nphys891),ISSN 1745\-2481Cited by:[§1](https://arxiv.org/html/2606.24000#S1.p3.1)\.
- M\. Fumero, L\. Moschella, E\. Rodolà, and F\. Locatello \(2026\)Navigating the latent space dynamics of neural models\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Zunww3FHPU)Cited by:[§2\.1](https://arxiv.org/html/2606.24000#S2.SS1.p3.5)\.
- J\. Ho, A\. Jain, and P\. Abbeel \(2020\)Denoising diffusion probabilistic models\.External Links:2006\.11239,[Link](https://arxiv.org/abs/2006.11239)Cited by:[§3](https://arxiv.org/html/2606.24000#S3.p1.4)\.
- M\. Mungan, D\. Kumar, S\. Patinet, and D\. Vandembroucq \(2025\)Self\-organization and memory in a disordered solid subject to random driving\.Phys\. Rev\. Lett\.134,pp\. 178203\.External Links:[Document](https://dx.doi.org/10.1103/PhysRevLett.134.178203),[Link](https://link.aps.org/doi/10.1103/PhysRevLett.134.178203)Cited by:[§1](https://arxiv.org/html/2606.24000#S1.p3.1)\.
- B\. Pham, G\. Raya, M\. Negri, M\. J\. Zaki, L\. Ambrogioni, and D\. Krotov \(2025\)Memorization to generalization: emergence of diffusion models from associative memory\.External Links:2505\.21777,[Link](https://arxiv.org/abs/2505.21777)Cited by:[§2\.2](https://arxiv.org/html/2606.24000#S2.SS2.p1.1)\.
- R\. Rombach, A\. Blattmann, D\. Lorenz, P\. Esser, and B\. Ommer \(2022\)High\-resolution image synthesis with latent diffusion models\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 10684–10695\.Cited by:[§3](https://arxiv.org/html/2606.24000#S3.p1.4)\.
- A\. Sclocchi, A\. Favero, and M\. Wyart \(2025\)A phase transition in diffusion models reveals the hierarchical nature of data\.Proceedings of the National Academy of Sciences122\(1\),pp\. e2408799121\.External Links:[Document](https://dx.doi.org/10.1073/pnas.2408799121),[Link](https://www.pnas.org/doi/abs/10.1073/pnas.2408799121),https://www\.pnas\.org/doi/pdf/10\.1073/pnas\.2408799121Cited by:[§2\.1](https://arxiv.org/html/2606.24000#S2.SS1.p1.1)\.
- R\. Sharma and S\. Karmakar \(2025\)Activity\-induced annealing leads to a ductile\-to\-brittle transition in amorphous solids\.Nature Physics21\(2\),pp\. 253–261\.External Links:[Document](https://dx.doi.org/10.1038/s41567-024-02724-5),[Link](https://doi.org/10.1038/s41567-024-02724-5),ISSN 1745\-2481Cited by:[§1](https://arxiv.org/html/2606.24000#S1.p3.1)\.
- G\. Somepalli, V\. Singla, M\. Goldblum, J\. Geiping, and T\. Goldstein \(2022\)Diffusion art or digital forgery? investigating data replication in diffusion models\.External Links:2212\.03860,[Link](https://arxiv.org/abs/2212.03860)Cited by:[§2\.3](https://arxiv.org/html/2606.24000#S2.SS3.p1.1)\.
- G\. Somepalli, V\. Singla, M\. Goldblum, J\. Geiping, and T\. Goldstein \(2023\)Understanding and mitigating copying in diffusion models\.External Links:2305\.20086,[Link](https://arxiv.org/abs/2305.20086)Cited by:[Figure 1](https://arxiv.org/html/2606.24000#S1.F1),[§2\.3](https://arxiv.org/html/2606.24000#S2.SS3.p1.1)\.
- R\. Webster \(2023\)A reproducible extraction of training images from diffusion models\.External Links:2305\.08694,[Link](https://arxiv.org/abs/2305.08694)Cited by:[§1](https://arxiv.org/html/2606.24000#S1.p2.1),[§2\.3](https://arxiv.org/html/2606.24000#S2.SS3.p3.1),[Figure 7](https://arxiv.org/html/2606.24000#S3.F7),[§4](https://arxiv.org/html/2606.24000#S4.p4.1)\.
- A\. Werth \(2015\)Turing patterns in photoshop\.InProceedings of Bridges 2015: Mathematics, Music, Art, Architecture, Culture,K\. Delp, C\. S\. Kaplan, D\. McKenna, and R\. Sarhangi \(Eds\.\),Phoenix, Arizona,pp\. 459–462\.External Links:ISBN 978\-1\-938664\-15\-1,ISSN 1099\-6702,[Link](http://archive.bridgesmathart.org/2015/bridges2015-459.html)Cited by:[Figure 9](https://arxiv.org/html/2606.24000#A1.F9)\.
- G\. Zhang and S\. Martiniani \(2026\)Absorbing state dynamics of stochastic gradient descent\.Phys\. Rev\. E113,pp\. L062103\.External Links:[Document](https://dx.doi.org/10.1103/sbv7-syp7),[Link](https://link.aps.org/doi/10.1103/sbv7-syp7)Cited by:[§1](https://arxiv.org/html/2606.24000#S1.p3.1)\.

## Appendix ASupplementary material

All supplementary videos are available at[https://rishabh\-tifr\.github\.io/cyclic\-denoising/movies](https://rishabh-tifr.github.io/cyclic-denoising/movies)\. Each animates a stroboscopic cyclic\-denoising trajectory in Stable Diffusion v1\.4, showing the 2D PCA projection of the latent \(colored by cycle number\) alongside the simultaneously decoded image:

- •Movie 1— basin hopping atγ=0\.86\\gamma=0\.86, the trajectory of Figs\.[1](https://arxiv.org/html/2606.24000#S1.F1)and[2](https://arxiv.org/html/2606.24000#S3.F2)\.
- •Movie 2— collapse into a trivial absorbing fixed point atγ=0\.2\\gamma=0\.2\(Supplementary Fig\.[9](https://arxiv.org/html/2606.24000#A1.F9)\(a\)\)\.
- •Movie 3— a low\-amplitude limit cycle atγ=0\.1\\gamma=0\.1\(Supplementary Fig\.[9](https://arxiv.org/html/2606.24000#A1.F9)\(b\)\)\.
- •Movie 4— a second, less regular limit cycle atγ=0\.1\\gamma=0\.1\(additional example, not shown in the paper\)\.

![Refer to caption](https://arxiv.org/html/2606.24000v1/x8.png)Figure 8:Trivial absorbing states from low\-amplitude unconditional cycling in Stable Diffusion v1\.4\.Unconditional cyclic denoising initialized from ImageNet test images at low noise amplitudes: \(a\)γ=0\.1\\gamma=0\.1, \(b\)γ=0\.2\\gamma=0\.2, \(c\)γ=0\.3\\gamma=0\.3, and \(d\)γ=0\.4\\gamma=0\.4\. Each trajectory is run for10,00010\{,\}000cycles, with every 100th cycle shown\. At these amplitudes, the perturbation is too weak to induce large\-scale rearrangements, and the dynamics collapse into trivial absorbing states such as saturated patterns, monotonic fills, or simple geometric structures\.![Refer to caption](https://arxiv.org/html/2606.24000v1/x9.png)Figure 9:Two kinds of attractor reached by low\-amplitude unconditional cycling in Stable Diffusion v1\.4: trivial fixed points and limit cycles\.\(a,b\) Two\-dimensional PCA projections of stroboscopic cyclic\-denoising trajectories, each run for10410^\{4\}cycles; line color encodes cycle number, the green circle marks the start \(c0c\_\{0\}\) and the red square the end \(c10000c\_\{10000\}\), and the PCA basis is fit on each trajectory individually\. \(a\) Atγ=0\.2\\gamma=0\.2the trajectory drifts away from its initial latent and collapses into a small region of the PCA plane—a trivial absorbing*fixed point*\(up to small stochastic jitter\), where the decoded image stays near\-monochromatic and stops rearranging from cycle to cycle\. \(b\) Atγ=0\.1\\gamma=0\.1the trajectory instead settles onto a closed orbit, traversing nested, near\-concentric loops in the PCA plane: a*limit cycle*in which the state returns periodically rather than freezing\. \(c–f\) Decoded latents at the start and end of each trajectory\. \(c\) Start and \(d\) end of \(a\): an initial natural image relaxes to a featureless, near\-monochromatic frame\. \(e\) Start and \(f\) end of \(b\): the image converges to a periodic, Turing\-like stripe pattern\. The endpoint in \(f\) is not static: the \(spatially periodic\) stripe pattern travels across the frame as cycling proceeds, and it is this periodicity in cycle number—the wave returning to itself every fixed number of cycles—rather than the spatial periodicity of any single frame, that is the real\-space signature of the closed orbit in \(b\)\. This is reminiscent of the classic observation that repeatedly blurring and then sharpening an image produces Turing\-like patterns through an effective reaction–diffusion dynamics\[Werth,[2015](https://arxiv.org/html/2606.24000#bib.bib16)\]; in cyclic denoising the smoothing and sharpening are instead carried out by the learned diffusion kernel\. Side\-by\-side animations of both trajectories and their decoded latents are provided in Supplementary Movies 2 and 3\. Limit cycles are considerably rarer than decay to trivial fixed points\. In both regimes the low\-amplitude dynamics explore little of the landscape, in contrast to the more space\-filling transients seen at larger amplitudes\.![Refer to caption](https://arxiv.org/html/2606.24000v1/x10.png)Figure 10:Multiple routes to the same attractors\.Cyclic denoising recovering the same memorized states as attractors across different initial conditions and noising amplitudesγ\\gamma\. In each panel, the top trace is the consecutive stroboscopic cosine similarity,cos⁡\(zn,zn−1\)\\cos\(z\_\{n\},z\_\{n\-1\}\), along a 10,000\-cycle trajectory; values near 1 mark an*absorbing region*in which successive cycles return to essentially the same latent\. The red marker indicates a cycle deep within such a region, and the two images below decode the latent at the initial cycle \(c0, left\) and at the marked cycle \(right\)\. Within each column, the two rows begin from different conditions yet are captured by the*same*attractor, isolating one axis of variation at a time:\(a, d\)two distinct ImageNet seeds atγ=0\.70\\gamma=0\.70;\(b, e\)two distinct seed ensembles—Gaussian and model\-generated—atγ=0\.70\\gamma=0\.70;\(c, f\)two distinct amplitudes,γ=0\.80\\gamma=0\.80andγ=0\.84\\gamma=0\.84, both from Gaussian seeds\. “ImageNet”, “model\-gen”, and “Gaussian” denote how the initial seeds were produced—VAE\-encoded ImageNet validation images, samples generated by the model, and pure Gaussian latents, respectively—and “image NNN” is the index of the trajectory within its ensemble\. The same memorized images recur across these independent runs, indicating that the cyclic dynamics explore a single underlying landscape: the seeds act only as starting anchors, while the amplitudeγ\\gammasets the effective step size of the exploration\. A given memorized image can therefore be reached from a range of seeds and amplitudes; for clarity we show only two representative routes to each of the three attractors\.![Refer to caption](https://arxiv.org/html/2606.24000v1/x11.png)Figure 11:How cyclic denoising traverses the generative landscape at intermediate and high noise amplitudes\.For each amplitudeγ\\gammawe show a per\-trajectory 2D PCA projection of a 10,000\-cycle latent trajectory \(color encodes cycle number; the green circle marks the initial latent c0 and the red square the final cycle c10000\) together with a montage of decoded latents sampled along the same trajectory in cycle order\.\(a\)γ=0\.7\\gamma=0\.7: in the PCA projection the trajectory collapses into a single deep attractor and dwells there for the remainder of the run\.\(b\)the corresponding decoded montage \(every 25th cycle\) converges onto, and then repeatedly reproduces, the same memorized bag\.\(c\)γ=0\.74\\gamma=0\.74: no single deep attractor forms, yet the projection resolves into a few diffuse but separated clusters, the trajectory dwelling within one before hopping to the next\.\(d\)the corresponding decoded montage \(every 20th cycle\) shows these clusters to be*semantically coherent*: an early, possibly transient region containing a mix of scenes and human portraits/photographs, followed by a region of sofa images—which change from cycle to cycle but all remain sofas, and therefore collapse into a single PCA cluster—and finally, a region of catalog\-style product images\. Thus, even in the absence of an absorbing state, cyclic denoising traverses the landscape in a semantically segmented fashion, dwelling in shallow basins that each encode a coherent concept and hopping between them\. This semantic structuring of the dynamics is itself intriguing: it holds generically—even on runs that never settle onto a deep memorized attractor—and points to cyclic denoising as a route to new methods for probing the semantic organization of a model’s landscape\.\(e\)γ=0\.84\\gamma=0\.84: the PCA projection shows the trajectory again captured by a deep basin partway through the run before escaping it\.\(f\)the corresponding decoded montage \(every 25th cycle\) identifies this basin as the white\-sofa scene\.\(g\)γ=1\.0\\gamma=1\.0: at the \(almost\) full\-noise limit the projection shows no distinct clusters\.\(h\)the decoded latents \(every 50th cycle\) are essentially independent from cycle to cycle, since each cycle re\-noises the latent almost completely—though not entirely: Stable Diffusion’s noise schedule has a non\-zero terminal SNR, so even atγ=1\\gamma=1a small fraction of the previous latent is carried over rather than a true reset to pure noise\. Across amplitudes, intermediateγ\\gammathus exposes a hierarchy of basins—deep absorbing attractors that correspond to memorized images, and shallow semantic basins between which the dynamics wander—whereasγ→1\\gamma\\to 1essentially erases this structure\.![Refer to caption](https://arxiv.org/html/2606.24000v1/x12.png)Figure 12:Selected CIFAR\-10 attractors recovered by unconditional cyclic dynamics\.Each row shows ten equispaced stroboscopic snapshots from a single10,00010\{,\}000\-cycle trajectory during the residence time of one basin, with the cycle range andγ\\gammaindicated\. Several attractors match CIFAR\-10 training examples previously identified as memorized byCarliniet al\.\[[2023](https://arxiv.org/html/2606.24000#bib.bib4)\]in independently trained diffusion models, suggesting that these are memorization\-prone images that recur across training runs\. Cyclic denoising recovers these images directly from a publicly available CIFAR\-10 DDPM checkpoint, without prior knowledge of \(or access to\) the training set or any post\-hoc training\-set search\.![Refer to caption](https://arxiv.org/html/2606.24000v1/Figures_arxiv/Supplementary_Figure6.png)Figure 13:Prompt\-conditioned cycling settling into two kinds of absorbing states: concept basins \(a,b\) versus verbatim memorized images \(c,d\)\.Each row shows the decoded latent across cycles, from a noise seed \(left\) to the absorbing state\. Concept basins—\(a\)“Abbey Road album cover” and\(b\)“Mona Lisa”—settle into a recognizable but*crude*rendering: conceptually correct, yet not photorealistic to any single training image\. Memorized prompts—\(c\)Aretha Franklin and\(d\)Freddy Adu—settle into a*sharp, verbatim*copy of one specific training image\.![Refer to caption](https://arxiv.org/html/2606.24000v1/x13.png)Figure 14:Decorrelation of prompt\-conditioned absorbing states after prompt removal \(γ=0\.78\\gamma=0\.78\)\.Each prompt is first cycled to a prompt\-conditioned absorbing state; the prompt is then removed and unconditional cyclic denoising continues for 1000 cycles at fixed amplitudeγ=0\.78\\gamma=0\.78, while we track the correlationcos⁡\(zt,z0\)\\cos\(z\_\{t\},z\_\{0\}\)between each cycle and the absorbed image at the moment of removal \(logarithmic cycle axis; 5 seeds per prompt\)\.\(a\)Seed\-averaged correlation for all six prompts\.\(b–g\)The corresponding per\-seed ensembles:\(b\)“Ann Graham Lotz” \(4/54/5seeds survive10310^\{3\}cycles\);\(c\)“Aretha Franklin Files $10 Million Suit Over Patti LaBelle Fight Story On Satire Website” \(1/51/5\);\(d\)“Prince Reunites With Warner Brothers, Plans New Album” \(4/54/5\);\(e\)“Netflix Hits 50 Million Subscribers” \(0/50/5\);\(f\)“Freddy Adu Signs For Yet Another Club You Probably Don’t Know” \(0/50/5\);\(g\)“Abbey Road album cover” \(0/50/5\), a guessed prompt that forms a prompt\-stabilized concept basin rather than a confirmed memorized image\. The concept basin \(g\) has the shortest decorrelation time, decaying fastest once the prompt is removed, while the known memorized images \(b–f\) show a range of stabilities at this amplitude\.Table 1:Reverse\-image\-search matches for recovered Stable Diffusion attractors\.URLs correspond to representative web matches used for post\-hoc attribution and verification\. Accessed May 2026\.