arXiv CSopen access

Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models

Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models Rishabh Sharma1,2∗

Stefano Martiniani1,2,3,4

1

arXiv:2606.24000v1 [cs.LG] 22 Jun 2026

2

Simons Center for Computational Physical Chemistry, New York University Center for Soft Matter Research, Department of Physics, New York University 3 Center for Neural Science, New York University 4 Courant Institute of Mathematical Sciences, New York University {rs10125, sm7683}@nyu.edu

Abstract We introduce cyclic denoising—repeated forward and reverse diffusion at controlled noise amplitudes—as an extraction attack for image diffusion models. Inspired by random organization in disordered solids, where cyclic mechanical perturbations anneal the system into increasingly stable configurations, cyclic denoising exposes regions of the learned distribution that remain largely inaccessible to standard sampling. We find that these dynamics drive samples toward attractors with a broad stability spectrum, with the deepest attractors exhibiting ultrastability: they can be regenerated from near-total corruption and sustained through thousands of noising–denoising cycles. Many of these deep attractors correspond to memorized training images, including stock photographs, brand watermarks, and web-crawl artifacts. Our extraction attack requires only samplerlevel control—the ability to partially noise a sample to an intermediate diffusion timestep and denoise it back—but no gradients and no weight inspection. Crucially, cyclic denoising requires no prior knowledge of training data, captions, or prompts. In contrast, prior generate-and-filter attacks on production-scale diffusion models commonly rely on large-scale prompted generation from known or suspected training captions, followed by post-hoc similarity search or membershipinference filtering to identify memorized candidates. While cyclic denoising can also be applied with prompts, our main protocol is fully unconditioned. We demonstrate the phenomenon in Stable Diffusion v1.4, a latent diffusion model, and in a smaller pixel-space DDPM, showing consistent behavior across latent- and pixel-space diffusion models. Across noise amplitudes, we observe a yielding-like transition: low-amplitude cycling produces either trivial absorbing fixed points (featureless, near-monochromatic images) or limit cycles (traveling/oscillating Turing-like patterns in image space), while larger amplitudes induce rearrangements, basin hopping, and long-lived trapping in structured memorized attractor basins. We further observe hierarchical partial absorption, where coarse scene layout freezes while fine details remain diffusive, as well as prompt-stabilized basins and cross-initial-condition universality of the recovered attractor set. Together, these results establish cyclic denoising as both a physics-inspired probe of generative landscapes and a practical tool for memorization auditing, with implications for privacy, copyright compliance, and model fingerprinting.

∗ Corresponding author

Preprint.

1

Introduction

Large generative models are trained on massive collections of web-scale data. Their capabilities depend on these datasets, but so do their risks: models may retain and reproduce specific training examples, including copyrighted artwork, proprietary media, personal photographs, watermarked stock images, and other sensitive artifacts scraped from the web. Understanding when and how such data can be recovered from a trained model is therefore central to privacy, copyright compliance, and model auditing. Existing extraction attacks on diffusion models have shown that memorized images can sometimes be recovered, but they rely in different ways on signals or machinery external to the model’s sampling dynamics. One canonical, computationally expensive approach is generate-and-filter: for textconditioned models such as Stable Diffusion, attacks prompt the model with captions known or suspected to correspond to training examples, generate many samples per caption, and apply post-hoc filtering, clustering, similarity search, or membership-inference procedures to isolate memorized outputs [Carlini et al., 2023]. For unconditional models, where prompts are unavailable, memorized candidates have instead been identified by comparing large sets of generated samples to the training set, a strategy mainly practical in benchmark-scale settings where the training set is known and searchable [Carlini et al., 2023]. Subsequent attacks use different signals, such as one-step denoising behavior [Webster, 2023] or auxiliary classifiers [Chen et al., 2025], but still rely on captions, training-data access, or separately trained detectors. Cyclic denoising instead uses the sampler’s own long-time dynamics to propose memorized candidates: absorbing episodes and long residence times, not captions, training-set lookup, or auxiliary detectors, determine what is inspected. Our approach is inspired by the physics of driven disordered systems [Corté et al., 2008, Sharma and Karmakar, 2025, Mungan et al., 2025, Zhang and Martiniani, 2026]. The setup is conceptually simple: a disordered solid, for example, has a rugged landscape with many metastable configurations and can be perturbed cyclically at a controlled amplitude, such as by repeated shear. Configurations change from cycle to cycle until the dynamics reach a state that resists further change, an absorbing state. The amplitude of the drive controls which absorbing states are reachable. Weak perturbations leave the system trapped in shallow basins; stronger perturbations dislodge it from those basins and let it explore deeper, more stable regions of the landscape. At even higher amplitudes, the system yields and ergodically explores the energy landscape. Thus, an absorbing to diffusive transition is observed with increasing cyclic perturbation amplitude. We import this idea into diffusion models through cyclic denoising. Starting from an image or latent, we repeatedly apply forward noising to a controlled amplitude γ and then reverse denoise back to γ = 0, using the output of one cycle to initialize the next. Viewed stroboscopically, i.e., at the end of each completed noising–denoising cycle, the model traces a trajectory through its learned generative landscape. The diffusion noise level γ plays the role of a drive amplitude: by varying γ, we tune the strength of the cyclic perturbation and probe which states are reached and remain stable. Long plateaus of near-unity stroboscopic cosine similarity mark absorbing episodes; decoding these states yields candidate memorized images.2 This procedure reveals a yielding-like stability spectrum. At low amplitudes, the system cannot explore much and the trajectories collapse into trivial absorbing states. These are either trivial fixed points consisting of featureless (near-monochromatic) images, or limit cycles consisting of simple Turing-like oscillating patterns. At intermediate amplitudes, some exploration of the landscape becomes possible, and the dynamics uncover simple memorized artifacts such as logos and web templates. At higher amplitudes, the dynamics can escape shallow basins, explore larger regions of the landscape and isolate even deeper attractors that persist for hundreds to thousands of cycles. We show that many of these attractors are not generic samples: they correspond to memorized training images and repeated web-crawl artifacts. This yields a prompt-free extraction attack driven by the model’s own dynamics, requiring only sampler-level control and no prior knowledge of, or access to, the training data. The signature of memorization is dynamical: when a stroboscopic trajectory locks into a basin and persists there for hundreds to thousands of cycles, the dynamics itself flags the state as a memorization candidate. We do not generate independent samples and then search for memorized ones after the fact; long-lived absorption determines which states are inspected. Furthermore, the protocol is agnostic to the initial 2 Supplementary movies: https://rishabh-tifr.github.io/cyclic-denoising/movies

2

condition: cycling can start from a generic image, a model-generated sample, or pure noise. We demonstrate the phenomenon in Stable Diffusion v1.4 and in a pixel-space DDPM trained on CIFAR10. In both settings, memorized data appears not as isolated rare samples, but as dynamically stable attractors exposed by sustained cyclic perturbation. Our results suggest a new dynamical route for probing memorization in diffusion models: training examples that persist as deep basins in the generative landscape, and are rarely encountered by standard sampling, can nevertheless be accessed through cyclic dynamics. Cyclic denoising therefore provides both a physics-inspired dynamical probe of diffusion-model generative landscapes and a practical tool for memorization auditing. Our main contributions are: • Cyclic denoising as a dynamical probe of diffusion-model generative landscapes. We introduce cyclic denoising, a repeated forward–reverse diffusion protocol for traversing the generative landscape. By feeding the output of one cycle into the next, the protocol turns sampling into a stroboscopic dynamical system controlled by a cycling amplitude γ. Inspired by random organization and mechanical annealing in driven disordered systems, it probes the stability structure of the learned generative landscape rather than drawing independent samples from it. • Absorbing states, limit cycles, basin hopping, and ultrastable attractors. We show that diffusion models exhibit rich long-time dynamics under repeated noising–denoising cycles. At low amplitudes, trajectories can collapse into trivial absorbing fixed points or simple limit cycles; at larger amplitudes, the dynamics become intermittent, with long residence times in attractor basins separated by transient exploratory hops between basins. Some basins confine trajectories for hundreds to thousands of cycles, and the deepest attractors are ultrastable, regenerating after severe corruption and persisting under sustained cyclic perturbation. • A yielding-like transition and amplitude-dependent stability spectrum. Varying the cycling amplitude γ reveals a dynamical transition from non-yielded low-amplitude behavior to intermittent exploration as the amplitude increases, with trajectories hopping between basins and becoming temporarily trapped in long-lived attractors. The recovered attractor set depends systematically on γ: low amplitudes produce trivial fixed points or limit cycles, intermediate amplitudes recover simple logos and web-crawl artifacts, and higher amplitudes isolate deeper, richer memorized images. Thus, γ acts as a stability filter, selecting different subsets of the model’s attractor set. • A prompt-free, training-data-agnostic extraction attack. We show that many non-trivial attractors correspond to memorized training images, yielding an extraction attack that requires only sampler-level control—the ability to partially noise a sample to an intermediate diffusion timestep and denoise it back. The attack requires no prior knowledge of the training data, captions, or prompts, and uses no gradients, weight inspection, post-hoc clustering, or membership inference to propose candidates: memorized candidates appear directly as persistent states in the cyclic dynamics. • Stability as a memorization diagnostic for prompted models. We extend cyclic denoising to prompt-conditioned sampling and measure stability after the prompt is removed. Post-removal stability correlates positively with memorization: prompt-stabilized concept basins decorrelate fastest, while genuinely memorized training images span a wide range of stabilities, with the deepest remaining ultrastable. This makes the post-removal decorrelation time a γ-dependent dynamical test for memorization of candidate prompt–image pairs.

2

Related work

2.1

Dynamical views of diffusion and generative models

Recent work has begun to treat generative models not only as samplers, but also as dynamical systems whose trajectories reveal structure in the learned distribution. For diffusion models, the forward noising process and learned reverse denoising process provide a natural perturb-and-reconstruct experiment. Sclocchi et al. [2025] showed that a single forward–backward diffusion setup, or a single u-turn, can probe the hierarchical organization of data: in a hierarchical generative model, the probability of reconstructing high-level features such as class identity drops sharply beyond a threshold diffusion time, while lower-level details evolve smoothly across the whole diffusion process. Their results frame diffusion time as a scale-resolved probe of learned structure, with different levels 3

(a)

(b)

γ=0

(c)

γ = 0.86

γ=0

Reverse image search

Figure 1: Unconditional cyclic denoising drives latents toward attractors in the Stable Diffusion v1.4 landscape. (a) Decoded snapshots from a 104 -cycle unconditional cycling trajectory at γ = 0.86, starting from a single ImageNet test image; the 15 × 15 grid shows every 44th cycle, in reading order, starting from the top-left. After an initial transient (snapshots change cycle-to-cycle), the dynamics lock into the first attractor — a room with a yellow chair — that persists for over 2000 cycles. A brief transient carries the trajectory into a second attractor (white-couch scene, paintings on a gray wall), which survives for a comparable number of cycles before another, longer transient returns the trajectory to the same second basin. (b) Cosine similarity between consecutive latents zn and zn−1 along the trajectory. Plateaus near unity correspond to residence within a basin; sharp drops mark inter-basin transitions, matching the qualitative changes in (a). Cosine similarities throughout this work are measured stroboscopically — at the end of each completed cycle. (c) A single forward–reverse cycle, γ = 0 → 0.86 → 0, for an example latent drawn from each attractor. The room layout is regenerated after near-total corruption, while fine details such as wall artwork fluctuate stochastically—the signature of an attracting basin in which the dominant scene template is locked while peripheral content remains diffusive. Right column: reverse image search retrieves near-duplicate web images for both attractors, corresponding to e-commerce template scenes in which different artworks are repeatedly composited onto the same room layout. These templates recur across many vendor websites, making them very likely to be duplicated in the web-scale training crawl. Independently, Somepalli et al. [2023] flag these same two scenes (their Fig. 2) among the most heavily replicated Stable Diffusion v1.4 generations and trace them to duplicated LAION training images—training-set-grounded confirmation that the attractors recovered here by cycling alone, with no training-set access, are genuine memorized content. The two scenes also appear under similar product captions referring to the displayed artwork rather than the room itself, suggesting a possible mechanism for their proximity in the learned generative landscape. Cyclic denoising thus exposes these memorized templates from the model’s dynamics alone. The URLs for the reverse image search are listed in the Appendix (Table 1).

of the data hierarchy being modified at different noise amplitudes. Our work builds on this forward– backward viewpoint but changes the experiment qualitatively. Rather than performing a single noising–denoising pass, we iterate the partial forward–reverse map for thousands of cycles. This turns diffusion sampling into a stroboscopic dynamical system. The resulting long-time dynamics reveal phenomena that are invisible to one-shot reconstruction experiments: absorbing states, limit cycles, basin hopping, cyclic yielding-like transitions, and ultrastable attractors. Thus, while prior forward–backward studies ask which features survive one corruption–reconstruction pass, cyclic denoising asks which states are reached and remain stable under repeated perturbation. A complementary line of work studies memorization through the training dynamics of diffusion models. Bonnaire et al. [2025] identify two characteristic timescales over the course of training: a generalization time τgen , at which the model begins to produce high-quality samples, and a later memorization time τmem , beyond which memorization emerges. They show that τmem grows approximately linearly with the training-set size n, while τgen remains approximately constant, opening a generalization window [τgen , τmem ] that widens with n. Stopping training in this window lets even highly overparameterized models generalize before eventually memorizing, a form of implicit dynamical regularization. Our focus is orthogonal: we hold a trained model fixed and ask whether memorized examples persist in its post-training sampling dynamics. Cyclic denoising probes 4

this post-training stability structure, revealing memorized images as long-lived attractors even when they are rarely encountered by standard sampling. A closely related dynamical perspective is the work of Fumero et al. [2026], who interpret autoencoderbased neural models as defining latent vector fields by iterating the encode–decode map. In their setting, an autoencoder induces a discrete-time map in latent space, and the resulting trajectories and attractors can be used to analyze generalization, memorization, prior knowledge encoded in the network, and out-of-distribution behavior. This is conceptually aligned with our view that model dynamics can expose learned structure. However, the extension to diffusion models is not direct. If one fully noises a diffusion sample to the terminal time before denoising, the previous state is erased and the reverse process becomes a fresh draw from the learned generative distribution. In this full-noising limit, iterating forward–reverse diffusion does not produce a meaningful trajectory with memory; it degenerates into repeated resampling. Cyclic denoising operates instead in the partial-memory regime with noise level γ < 1. Each cycle noises the current state only to an intermediate amplitude and then denoises it back, so the intermediate state retains partial information about the previous sample. Crucially, diffusion models provide a natural control knob: by varying γ, we tune how strongly the current state is perturbed before reconstruction. Inspired by cyclic yielding in disordered systems, where changing the drive amplitude qualitatively changes the states explored by the dynamics, we use γ to probe the stability hierarchy of the learned generative landscape. Low amplitudes reveal shallow or trivial absorbing states and limit cycles; intermediate amplitudes uncover simple memorized artifacts such as logos and web templates; and higher amplitudes isolate deeper attractors corresponding to richer memorized images. Thus, varying γ is central to the method: it turns diffusion time (or equivalently γ) into a stability-resolved probe of memorization. 2.2

Energy landscapes and associative-memory views of diffusion models

A complementary line of work interprets diffusion models through the lens of associative memory. Pham et al. [2025] recasts diffusion training as memory encoding and generation as memory retrieval, drawing an analogy to Hopfield and Dense Associative Memory systems in which stored patterns correspond to attractors of an energy landscape. Across the memorization–generalization transition, they distinguish memorized samples, emergent spurious attractors absent from the training data, and generalized samples, and characterize these states using basin-volume estimates and energycurvature spectra. This provides strong support for an attractor-based view of diffusion memorization: memorized examples can behave as deep, large-basin states of the learned landscape. Our contribution is complementary. The associative-memory analysis identifies and characterizes attractors, but does not by itself specify a cyclic dynamical route for reaching or discovering memorized basins in a fixed sampler. We import that route from the physics of periodically driven disordered systems— random organization and yielding—where finite-amplitude cycling is the canonical probe of a rugged landscape. Their basin probes, by contrast, start from candidate states already in hand and test whether these reconstruct after a single perturbation; cyclic denoising instead drives the sampler repeatedly from arbitrary initial conditions and lets attractors emerge from the dynamics themselves. The cycling amplitude is the control parameter: at small amplitude the dynamics remain non-yielded, settling into trivial absorbing states or simple limit cycles, while at larger amplitude they hop intermittently between basins and dwell in long-lived attractors, among them memorized images. 2.3

Training-data extraction from diffusion models

Training-data extraction attacks ask whether a trained generative model can be made to reproduce examples from its training set. In diffusion models, this has been studied as both a privacy risk and a copyright/compliance problem. Using retrieval-based comparisons between generated samples and training images, Somepalli et al. [2022] showed that text-to-image diffusion models, including Stable Diffusion, can directly replicate training content. Follow-up work showed that such copying is not explained by image duplication alone: the model’s text conditioning plays a comparably important role, with replication common in text-conditional models but much less frequent in unconditional ones [Somepalli et al., 2023]. The canonical extraction attack on diffusion models was introduced by Carlini et al. [2023]. Their textto-image attack follows a generate-and-filter paradigm: generate many samples, identify candidate near-duplicates, and verify memorization using similarity or membership-inference-style tests. For Stable Diffusion, they target captions associated with highly duplicated training examples: they 5

select the 350,000 most-duplicated examples, generate 500 samples per caption, and then filter the resulting 175 million generations for near-identical cliques. A prompt is flagged when at least 10 of its 500 generations collapse to near-duplicates under a patch-based image distance, and candidates are then verified against the training set. This large-scale pipeline yields 94 confirmed Stable Diffusion extractions under their strict (ℓ2 , 0.15) criterion, rising to 109 near-copies under manual inspection. For unconditional CIFAR-10 diffusion models, where prompts are unavailable, Carlini et al. [2023] use a different controlled setup: they train 16 diffusion models, each on a random half of the CIFAR10 training set, generate 220 unconditional samples (≈ 1.05 million) in total, and identify memorized examples by direct comparison to the training set using calibrated nearest-neighbor distances. This recovers 1,280 unique CIFAR-10 training images, but relies on a known, searchable training set and multiple models trained on different data subsets. Thus, while prior work demonstrated that diffusion models can leak training data, these pipelines rely on auxiliary information or procedures such as prompts, captions, training-set access, membership-inference criteria, multi-model training, or large-scale post-hoc filtering. In contrast, cyclic denoising proposes candidates from the model’s own long-time dynamics. In both Stable Diffusion and CIFAR-10, we operate on a single fixed checkpoint trained on the full dataset and surface candidates from the dynamics alone—none of these signals required. Webster [2023] take a different route from large-scale generate-and-filter attacks by exploiting one-step synthesis behavior in text-to-image diffusion models. They observe that some prompts corresponding to memorized images can reproduce them near-verbatim after only a single denoising step, and turn this into fast scoring rules for candidate captions: a denoising confidence score in the white-box setting and an edge-consistency score in the black-box setting. This reduces the number of network evaluations by orders of magnitude relative to sampling hundreds of full trajectories per prompt, but the attack remains driven by known captions—candidates are generated from captions, scored, and then labeled by matching to the corresponding training image, or, for template verbatims, by retrieval and masking against the training set. In contrast, cyclic denoising neither scores captions nor tests one-step reconstruction; it surfaces candidates as attractors of the long-time cyclic dynamics, without any conditioning. Unconditional diffusion models are harder to attack because there is no prompt with which to steer the model toward memorized samples. SIDE addresses this setting with surrogate conditioning: it generates synthetic samples from the target model, clusters them in a pretrained feature space to form data-driven pseudo-labels, and uses these surrogate labels to guide extraction from the original model [Chen et al., 2025]. In practice, this guidance is implemented through additional learned machinery, such as a time-dependent classifier or LoRA-based fine-tuning. Cyclic denoising instead uses the original sampler dynamics alone. To propose candidates, it requires only sampler-level control—the ability to partially noise a sample to an intermediate diffusion timestep and denoise it back—and none of SIDE’s surrogate-conditioning machinery: no pretrained feature extractor, no clustering of generated samples, no auxiliary classifier or LoRA fine-tuning, and no classifier-guidance gradients. Across these attacks, candidates are found by generating large pools of samples—from known or suspected training captions in the conditional case, and unconditionally where no captions are available—that are then clustered, scored, or verified after the fact. Cyclic denoising instead follows a single correlated trajectory: memorized candidates reveal themselves as attractors, long-lived basins, or high-similarity plateaus under repeated noising–denoising cycles.

3

Methods

We use two open-weight diffusion models without modifying their architectures or weights: Stable Diffusion v1.4, a latent diffusion model operating in a 4 × 64 × 64 VAE latent space [Rombach et al., 2022] (https://huggingface.co/CompVis/stable-diffusion-v1-4), and an unconditional pixel-space DDPM trained on CIFAR-10 [Ho et al., 2020] (https://huggingface.co/google/ ddpm-cifar10-32). Stable Diffusion is run unconditionally (empty prompt, guidance scale 0) with N = 50 inference steps, and the CIFAR-10 DDPM with N = 250 inference steps. Starting from a state zn , one cycle of cyclic denoising consists of noising the state up to an intermediate noise level and then denoising it fully back to a clean state; the output becomes the input to the next cycle, defining a stroboscopic trajectory observed at the end of each noising–denoising cycle. The 6

(a)

(b)

c9000

(c)

c2000

Figure 2: Basin hopping in latent space under unconditional cyclic denoising in Stable Diffusion v1.4. The same trajectory shown in Fig. 1, here visualized as a two-dimensional PCA projection of its latent trajectory; the top two components are fit on this trajectory alone, and line color encodes cycle number. A single ImageNet test-set image (green circle, cycle 0, inset) is cycled through Stable Diffusion v1.4 at γ = 0.86 for 10,000 cycles (unconditional cycling). After a short transient, the trajectory is captured by a first attractor in which it dwells for many cycles, before escaping and hopping to a second, well-separated attractor; it then briefly leaves this second basin but is recaptured by it, ending at cycle 10,000 (red square). Black stars mark two individual states along the trajectory — cycle 2000 (c2000), in the first basin, and cycle 9000 (c9000), in the second; panels (c) and (b) show these two states decoded to pixels, as representative examples from each basin. Rather than decorrelating, the dynamics dwell for long stretches in deep absorbing states and hop between them, revealing the model’s ultrastable memories. See Supplementary Movie 1 for the complete trajectory.

control parameter is the cycling amplitude γ ∈ [0, 1], the fraction of the inference trajectory traversed per cycle, which sets how much noise is added before denoising. Small γ adds little noise and gives a near-identity perturbation, while γ = 1 corresponds to near-complete noising followed by a full denoising pass; in every case we denoise all the way back to a clean state, so γ controls only how high each cycle climbs. We use the DDPM sampler throughout, with fresh Gaussian noise drawn both when noising and during denoising, so that cycling is a diffusion analogue of stochastic cyclic driving rather than a deterministic map. For Stable Diffusion, we use three initialization ensembles: ImageNet validation images encoded into the VAE latent space, model-generated latents, and i.i.d. Gaussian latents. For CIFAR-10, we initialize from randomly sampled CIFAR-10 training images. We run 10,000 cycles per trajectory while sweeping γ over a range of amplitudes; Stable Diffusion uses 10 seeds per initialization ensemble and CIFAR-10 uses 50 training-image seeds, with the seed set held fixed across all amplitudes in both cases. At each cycle, we compute the cosine similarity between consecutive stroboscopic states (in the VAE latent for Stable Diffusion and in pixel space for CIFAR-10), cos(zn , zn−1 ). The steady-state similarity reported in yielding curves is the average over the final 1000 cycles of each trajectory, followed by an average across seeds. Absorbing episodes are identified by long plateaus of nearunity stroboscopic similarity, and their decoded states are inspected as candidate attractors. Stable Diffusion attractors are verified post hoc using public reverse-image search. CIFAR-10 attractors are verified post hoc by cross-checking against memorized examples reported by Carlini et al. [2023]. These verification steps are not used to generate candidates. For prompted experiments, we use the same cyclic protocol with classifier-free guidance. Trajectories are first cycled with a candidate prompt; in prompt-removal experiments, we then continue cycling unconditionally, tracking the cosine cos(zt , z0 ) between each cycle and the image absorbed at the moment of removal to measure how long the recovered state remains stable without conditioning. 7

1.0

⟨cos sim(zn, zn − 1)⟩ss

0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2

SD v1.4 (ImageNet seeds) SD v1.4 (model-generated seeds) SD v1.4 (Gaussian seeds) CIFAR-10 DDPM (training-image seeds)

0.2

0.4 0.6 Perturbation amplitude γ

0.8

1.0

Figure 3: Yielding diagram for cyclic denoising. Steady-state stroboscopic similarity ⟨cos(zn , zn−1 )⟩ss between consecutive cycles versus the perturbation (cycling) amplitude γ. Each trajectory is run for 10,000 cycles; for each seed we average the similarity over the final 1000 cycles, then report the mean across seeds with ±SEM error bars. Stable Diffusion v1.4 is shown for ImageNet, model-generated, and Gaussian initializations (10 seeds per γ each); the CIFAR-10 DDPM is initialized from CIFAR-10 training images (50 seeds per γ). At low γ the dynamics are absorbing — consecutive cycles return to essentially the same state (⟨cos⟩ss ≈ 1), the signature of the fixed points and limit cycles of the stroboscopic map. Beyond a model-dependent critical amplitude the similarity drops sharply: a yielding-like transition in which cycling drives rearrangements, basin hopping, and exploration of the landscape. The three Stable Diffusion initialization ensembles collapse onto a common master curve, indicating that the transition is a property of the learned generative landscape rather than of the initial condition. The CIFAR-10 DDPM yields at markedly lower γ than Stable Diffusion; we attribute this partly to the models’ different noise schedules, under which the step-fraction γ maps nonlinearly — and differently — onto signal-to-noise ratio, so γ is comparable only within a model and not across the two. The qualitative absorbing-to-exploratory transition is nonetheless shared across latent- and pixel-space diffusion. Also note that even at γ = 1 the similarity does not fall to zero: Stable Diffusion’s noise schedule has a non-zero terminal SNR, so a small fraction of the previous latent is still carried over each cycle rather than a true reset to pure noise.

Compute resources. Each cycling run is an independent single-GPU job on one NVIDIA L40S (48 GB VRAM); the only parallelism is running separate amplitudes concurrently, with no multi-GPU or distributed execution within a run. Per-run time scales roughly linearly with the cycling amplitude, since a cycle at amplitude γ runs proportionally more denoising steps: across the swept amplitudes, a 10,000-cycle Stable Diffusion run (10 seeds batched through the UNet) ranges from a few hours at low γ to ten or eleven hours near γ = 1, with an intermediate amplitude (γ ≈ 0.7) taking about eight hours. The CIFAR-10 DDPM (N = 250, 50 seeds) follows the same linear-in-γ scaling. Promptconditioned cycling with classifier-free guidance doubles the per-step UNet cost, since each step requires conditional and unconditional predictions, but uses only 5 seeds, keeping wall-clock time comparable. The total compute footprint of all results in this paper is within 1000 L40S-GPU-hours, substantially below large-scale caption-based extraction pipelines that rely on generating and filtering millions of images. We stress that this budget quantifies the full dynamical phenomenology rather than extraction alone: it spans the entire amplitude range needed to map the yielding diagram (Fig. 3), including low-γ runs where the dynamics settle into trivial absorbing states or simple limit cycles and do not produce non-trivial memorized candidates in our runs. Extraction does not require this full coverage; an attack could focus on the intermediate-to-large amplitudes where memorized attractors, basin hopping, and long residence times occur. Thus, the compute required for extraction alone can be substantially lower than the totals reported here.

4

Results

Unconditional cyclic denoising produces absorbing attractors. Figure 1 shows the basic phenomenon in Stable Diffusion v1.4. A single unconditional cyclic trajectory does not produce indepen8

(a) Memorized brand logos and web-crawl artifacts recovered as attractors of unconditional cycling at moderate amplitudes (Stable Di usion v1.4) Cycle #10,000

Cycle #4,300 γ = 0.58

Cycle #4,999

Cycle #3,200 γ = 0.64

Cycle #9,999

Cycle #8,940 γ = 0.66

Cycle #9,029

Cycle #3,010 γ = 0.70

Cycle #3,574

Cycle #8,400 γ = 0.70

Cycle #10,000

(b) Reverse image search

ff

Cycle #1,000 γ = 0.5

Figure 4: Moderate-amplitude cycling recovers memorized logos and web-crawl artifacts. (a) Selected basins recovered by unconditional cyclic denoising in Stable Diffusion v1.4 at moderate noise amplitudes. Each row shows ten equispaced stroboscopic snapshots from a single cycling trajectory during the residence time of one basin, with the corresponding cycle range and cycling amplitude indicated. At very low γ, the dynamics collapse to trivial absorbing states—saturated patterns, monotonic fills, and simple geometric shapes—as the trajectory becomes trapped after iterating on local details, lacking the perturbation amplitude needed to rearrange the latent at larger scales, see Supplementary Fig. 8. In the intermediate regime shown here, the perturbation is large enough to escape these trivial fixed points; the resulting attractors are simple, highly repeated visual templates, including brand logos, product-page placeholders, and web-crawl artifacts. (b) Reverse image search retrieves close web matches for each recovered attractor, indicating that these states correspond to memorized image templates rather than generic samples. These attractors are recovered across multiple random seeds and nearby values of γ, but typically become transient at larger amplitudes, placing them at intermediate depth in the basin-stability spectrum: more structured than trivial low-amplitude absorbing states, but less stable than the deep memorized scenes that survive high-amplitude cycling.

dent samples; instead, it exhibits long-lived attractor residence, basin hopping, and partial absorption, where coarse scene structure remains stable while fine details fluctuate. Reverse image search confirms that the recovered attractors correspond to memorized web templates. Figure 2 visualizes the basin-hopping and transient-exploration phases in the PCA space, with clear clusters corresponding to the two memorized images. An animated version of this basin-hopping trajectory—its latent dynamics in PCA alongside the decoded images—is provided as Supplementary Movie 1. Different amplitudes expose different memories. Figures 4 and 5, along with Supplementary Fig. 8, show that the complexity of recovered attractors depends on γ. Intermediate amplitudes recover simple, highly repeated artifacts such as logos, product placeholders, and web-crawl remnants, whereas higher amplitudes isolate richer memorized images such as product photographs, object renderings, and recurring room templates. Supplementary Fig. 11 shows some additional examples of how individual trajectories traverse the landscape across intermediate-to-high amplitudes, sometimes collapsing into deep basins and, at others, wandering between semantically coherent shallow basins via inter-basin hops. At very high noise levels (γ → 1) successive cycles become essentially independent draws: memorized images may still recur—as they do across repeated independent generations in generate-and-filter attacks—but they no longer form the temporally contiguous dwelling episodes (connected runs of consecutive cycles within a single basin, colored coherently by cycle number) seen at intermediate γ. We also note that the same memorized images recur across different seeds, initialization ensembles, and nearby amplitudes (Supplementary Fig. 10), so our recurrent attractor set forms a dynamical fingerprint of Stable Diffusion v1.4. Figure 3 quantifies this γ-dependence as a yielding diagram: at low amplitudes the dynamics are absorbing, returning to essentially the same state each cycle as the system settles onto a fixed point or, more rarely, a limit cycle that repeats with a fixed period in cycle number (Supplementary Fig. 9); beyond a critical amplitude 9

(a)

More complex memorized images recovered as deep attractors of unconditional cycling at high noise amplitudes (Stable Di usion v1.4)

(b) Reverse image search

Cycle #7,750 γ = 0.72

Cycle #10,000

Cycle #7,750 γ = 0.80

Cycle #10,000

Cycle #3,050 γ = 0.84

Cycle #3,399

Cycle #2,699

Cycle #1,900 γ = 0.86

Cycle #5,950 γ = 0.86

Cycle #6,099

Cycle #1,100 γ = 0.88

ff

Cycle #2,329

Figure 5: High-amplitude cycling isolates deep memorized attractors. (a) Memorized images recovered by unconditional cyclic denoising in Stable Diffusion v1.4 at high noise amplitudes. Each row shows ten equispaced stroboscopic snapshots from a single cycling trajectory during the residence time of one attractor, with the cycle range and γ indicated. As in random organization, cyclic forcing drives the system toward states that resist change under the applied drive. At higher amplitudes, the trajectory escapes shallow basins and explores more of the learned distribution, revealing only deeper attractors as long-lived states. The recovered attractors include richer memorized images than the intermediate-amplitude logos and web artifacts in Fig. 4, including product photographs, stock-style object renderings, and recurring room templates. (b) Reverse image search retrieves close web matches for the recovered attractors, indicating that these states correspond to memorized training images or templates. These deep attractors recur across random seeds, initial conditions, and nearby values of γ, with some basins—especially the living room (with the white sofa and yellow chair) scenes—capturing many trajectories for long residence times. Including Fig. 4, the recovered attractor set forms a dynamical fingerprint of Stable Diffusion v1.4: a model-specific signature of memorized training content exposed by unconditional cycling alone. Representative reverse-image-search source URLs are listed in the Appendix (Table 1).

the cycle-to-cycle return drops sharply as cycling induces rearrangements and basin hopping. This mirrors the yielding transition seen routinely in disordered solids under cyclic drive, where increasing the drive amplitude takes the system from a stuck phase—trapped in an absorbing state that returns to itself each cycle—to an (initial-state independent) fluidized phase that explores configuration space. In our cyclic denoising, trajectories in this exploratory regime are intermittently captured by deep attractors for hundreds to thousands of cycles before escaping and continuing to explore the landscape. The phenomenon is not specific to latent diffusion. Figure 6 shows the same absorbing-state dynamics in a pixel-space DDPM trained on CIFAR-10, confirming that these absorbing basins are not an artifact of the latent space or the VAE decoder. Starting from a CIFAR-10 training image and cycling at γ = 0.39, the dynamics lock onto a memorized car as a persistent attractor, read off directly from the high-similarity plateau with no training-set lookup; the recovered image matches a CIFAR-10 example independently flagged as memorized by Carlini et al. [2023] (Fig. 6(e)). After freezing on the car for many cycles, the trajectory passes through a brief transient into a nearby, horizontally mirrored variant, freezes there as well, and then escapes (Fig. 6(c))—the same basin hopping between long-lived absorbing states we observe in the latent-space model (Figs. 1 and 2). These nearby attractors—a car and its mirror image—are reminiscent of the two-level systems of disordered solids, where a system hops between two nearly degenerate configurations separated by a small barrier; the pairing here is probably a consequence of the horizontal-flip augmentation used in training. As in Stable Diffusion, the same attractors recur throughout our experiments from very different initial seeds and cycling amplitudes, and the candidates emerge from a single public checkpoint through the model’s own dynamics, without the large-scale sample-and-search or the retraining of multiple models used by some prior CIFAR-10 extraction attempts. The attractors 10

(a)

(b)

(c)

(d)

γ=0

γ = 0.39

γ=0

(e)

CIFAR-10 training image

Figure 6: Unconditional cyclic denoising drives CIFAR-10 DDPM samples toward memorized attractors. (a) Snapshots from a 104 -cycle unconditional cycling trajectory in a pixel-space DDPM trained on CIFAR-10, initialized from a CIFAR-10 training image. The 15 × 15 grid shows every fourth cycle from cycles 2000–2896. After a short transient, the trajectory locks into a car-like attractor, briefly leaves it, and then enters a nearby mirror-image attractor, where it persists for many cycles, before ultimately escaping again. (b) Cosine similarity between consecutive cycle-end samples zn and zn−1 along the full trajectory, measured stroboscopically at the end of each completed cycle. (c) Zooming into cycles 2000–3000 reveals the plateau–drop–plateau structure corresponding to residence in one basin, transient hopping, and residence in the mirror-related basin. The paired attractors suggest that horizontal-flip augmentation during training may encode symmetry-related memorized states as nearby basins. This resembles two-level systems in disordered solids, where two nearly degenerate configurations are separated by a small barrier and the system can switch between them. (d) A single forward– reverse cycle, γ = 0 → 0.39 → 0, for representative samples from the two basins. (e) Matching CIFAR-10 training image reported in [Carlini et al., 2023]. The memorized candidate appears directly as persistent highsimilarity plateaus in the cyclic trajectory. Unlike prior CIFAR-10 extraction, which required training-set lookup to identify memorized samples, cyclic denoising recovers the candidate from the model dynamics alone. See Supplementary Fig. 12 for additional recovered CIFAR-10 attractors.

in Fig. 6 and Supplementary Fig. 12 are a non-exhaustive selection: cycling exposes many more memorized attractors across seeds and amplitudes than we report here, both for CIFAR-10 and for Stable Diffusion (Figs. 4 and 5). One caveat to keep in mind when comparing yield values across methods: training multiple models, each on a different subset of the data [Carlini et al., 2023], produces several independent landscapes, each with its own memorized minima. We therefore expect the yield of cyclic denoising to grow with the number of independently trained models it is applied to, so any direct comparison of recovery rates should control for the number of models. Prompt-conditioned attractors and ultrastability after prompt removal. Figure 7 applies the same protocol with classifier-free guidance, using prompts previously associated with memorized Stable Diffusion images [Carlini et al., 2023, Webster, 2023]. Each such prompt rapidly drives the dynamics onto the corresponding known memorized image and holds it there, with different Gaussian seeds for the same prompt reaching the same attractor (Fig. 7(a,c)). Because these prompts target images independently known to be memorized, their recovery as attractors is a positive control: it confirms directly that cyclic denoising can drive the dynamics onto genuinely memorized content. Removing the prompt and continuing to cycle unconditionally then probes their stability: for “Ann Graham Lotz”, four of five trajectories remain locked in the same image for the entire 1000-cycle unconditional continuation we ran—still absorbed when we stopped, rather than decorrelating—an ultrastable basin (Fig. 7(e,f)). A guessed prompt—one not known to correspond to any training image—behaves differently. With “Abbey Road album cover” the dynamics still reach a basin that is stable under the prompt, but the decoded state varies slightly from cycle to cycle and never settles on the actual cover: it captures the concept rather than a stored image, and decorrelates within a few cycles once conditioning is removed (Fig. 7(g,h)). A second guessed prompt, “Mona Lisa”, likewise settles under its prompt into a recognizable but non-verbatim, fluctuating concept attractor; not every 11

(a) (b) (c) (d)

(e)

(g)

(f)

(h)

Figure 7: Stability of prompt-conditioned image attractors under cyclic denoising. (a–d) Promptconditioned cycling in Stable Diffusion v1.4 at γ = 0.78 using classifier-free guidance and prompts previously associated with memorized samples [Carlini et al., 2023, Webster, 2023]. Rows show: (a) “Freddy Adu Signs For Yet Another Club You Probably Don’t Know”; (b) “Aretha Franklin Files $10 Million Suit Over Patti LaBelle Fight Story On Satire Website”; (c) the same Freddy Adu prompt as in (a), initialized from a different Gaussian seed; and (d) “Prince Reunites With Warner Brothers, Plans New Album.” Each trajectory rapidly converges to the corresponding known memorized image and remains absorbed; the convergence of (a) and (c) to the same image from different seeds demonstrates seed-independent attraction. (e,f) Stability of the “Ann Graham Lotz” memory, following one example trajectory (one of five Gaussian seeds). (e) With the prompt present, the trajectory converges to the memorized image and remains locked for the full 5000-cycle run; all five seeds converge to the same image, with convergence times that vary across seeds. (f) Continuing the same trajectory unconditionally after prompt removal, it stays locked in the same image for the full additional 1000 cycles we ran—still absorbed at the end rather than decorrelating; of the five seeds, four remain locked, indicating that the prompt steered the system to a state that is itself ultrastable under the unconditional dynamics. (g,h) A prompt-stabilized concept attractor—stable under the prompt but not unconditionally absorbing—again following one example trajectory. (g) Cycling with the guessed prompt “Abbey Road album cover”—not known to correspond to any training image—the trajectory reaches a steady prompted state that preserves the iconic zebra-crossing composition without collapsing to a single image, a crude rather than verbatim rendering (Supplementary Fig. 13). (h) After prompt removal it decorrelates within a few cycles, as do all five seeds—the fastest decay among the prompts tested (Supplementary Fig. 14).

prompt induces such ready absorption, but among several candidate prompts we tried, these two absorbed readily. The two cases differ on two signatures: first, under the prompt, the known memories are sharp and verbatim, returning to essentially the same image from cycle to cycle, whereas the guessed prompts give softer, fluctuating renditions of the concept (Supplementary Fig. 13); and second, after prompt removal, decorrelation time correlates positively with memorization, with the guessed concept basin decorrelating the fastest and the memorized images spanning a range of stabilities up to the ultrastable basins (Supplementary Fig. 14). Our unconditional extraction relies on this signal—long-lived, ultrastable absorption—to flag memorized candidates without any prompt; that the deepest known memories stay ultrastable without the prompt is a ground-truth check that the signal is sound.

5

Discussion

Cyclic denoising changes how we should think about memorization in diffusion models. Prior extraction attacks largely treat the model as a generator of independent samples and then search for memorized examples by prompting, clustering, or comparing against the training set. Our results show that memorized images can instead appear as dynamical attractors: not merely rare outputs, but stable states that the model can repeatedly regenerate under cyclic perturbation. Standard sampling 12

may therefore substantially underestimate memorization risk, because some training examples are hidden in deep basins that are rarely visited unless the model is driven. More broadly, our results suggest that memorization should be studied as a stability property of the learned generative dynamics. In prompt-conditioned settings, stability after prompt removal already provides a targeted test: images that remain locked without conditioning are more strongly memorized than concept basins stabilized only by the prompt. Training examples that survive strong cyclic perturbations behave like deep basins in the model landscape. Preventing memorization may therefore require more than reducing the probability of reproducing a training image under ordinary sampling; it may require eliminating or weakening the ultrastable attractors that store those images.

6

Limitations

Our attack requires sampler-level control over the noising and denoising steps, and therefore does not apply directly to standard text-to-image API endpoints that expose only final samples. Coverage requires a more quantitative investigation: while some basins clearly capture more trajectories than others in our runs, we have not systematically characterized the shape of the attractor distribution or the fraction of the memorized set that any single sweep recovers. The recovered attractors depend on choices such as the cycling amplitude, scheduler, number of cycles, and diversity within initialization ensembles; systematic optimization of these choices is an important direction for future work.

7

Broader Impacts

As an auditing tool, cyclic denoising lets practitioners and third parties identify training images that a deployed diffusion model has memorized, including copyrighted photographs, watermarked content, brand logos, and privacy-sensitive material scraped from the open web. The recovered attractor set provides a model-specific fingerprint of repeatedly encoded images that reveals information about the data distribution and the training pipeline. Because the protocol uses no captions, training-set access, or weight inspection, it can be applied as a dataset-agnostic audit of open-weight diffusion models that would otherwise be hard to inspect. The same protocol is also an extraction attack. An adversary with sampler-level access could recover sensitive training content without the prompts, captions, or training-set lookups that bound captionbased pipelines, and the attack does not depend on knowing what to look for: any sufficiently deep basin will surface its memorized content under sustained cyclic forcing. Memorization rates measured under ordinary sampling may therefore understate the leakage that a determined adversary can elicit through cyclic perturbation, and absorbing-state structure should be treated as part of the threat model for diffusion-model deployment.

Acknowledgments This work was supported by a grant from the Simons Foundation [MPS-T-MPS-00839534, MET] (RS, SM). We gratefully acknowledge the use of computational resources and consultation support provided by NYU IT High Performance Computing. We also thank Prof. David J. Heeger for many fruitful discussions.

13

References Tony Bonnaire, Raphaël Urfin, Giulio Biroli, and Marc Mezard. Why diffusion models don’t memorize: The role of implicit dynamical regularization in training. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. URL https://openreview.net /forum?id=BSZqpqgqM0. Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models, 2023. URL https://arxiv.org/abs/2301.13188. Yunhao Chen, Shujie Wang, Difan Zou, and Xingjun Ma. Side: Surrogate conditional data extraction from diffusion models, 2025. URL https://arxiv.org/abs/2410.02467. Laurent Corté, P. M. Chaikin, J. P. Gollub, and D. J. Pine. Random organization in periodically driven systems. Nature Physics, 4(5):420–424, 2008. ISSN 1745-2481. doi: 10.1038/nphys891. URL https://doi.org/10.1038/nphys891. Marco Fumero, Luca Moschella, Emanuele Rodolà, and Francesco Locatello. Navigating the latent space dynamics of neural models. In The Fourteenth International Conference on Learning Representations, 2026. URL https://openreview.net/forum?id=Zunww3FHPU. Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models, 2020. URL https://arxiv.org/abs/2006.11239. Muhittin Mungan, Dheeraj Kumar, Sylvain Patinet, and Damien Vandembroucq. Self-organization and memory in a disordered solid subject to random driving. Phys. Rev. Lett., 134:178203, Apr 2025. doi: 10.1103/PhysRevLett.134.178203. URL https://link.aps.org/doi/10.1103/P hysRevLett.134.178203. Bao Pham, Gabriel Raya, Matteo Negri, Mohammed J. Zaki, Luca Ambrogioni, and Dmitry Krotov. Memorization to generalization: Emergence of diffusion models from associative memory, 2025. URL https://arxiv.org/abs/2505.21777. Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. Highresolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10684–10695, June 2022. Antonio Sclocchi, Alessandro Favero, and Matthieu Wyart. A phase transition in diffusion models reveals the hierarchical nature of data. Proceedings of the National Academy of Sciences, 122(1): e2408799121, 2025. doi: 10.1073/pnas.2408799121. URL https://www.pnas.org/doi/abs /10.1073/pnas.2408799121. Rishabh Sharma and Smarajit Karmakar. Activity-induced annealing leads to a ductile-to-brittle transition in amorphous solids. Nature Physics, 21(2):253–261, 2025. ISSN 1745-2481. doi: 10.1038/s41567-024-02724-5. URL https://doi.org/10.1038/s41567-024-02724-5. Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models, 2022. URL https: //arxiv.org/abs/2212.03860. Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Understanding and mitigating copying in diffusion models, 2023. URL https://arxiv.org/abs/23 05.20086. Ryan Webster. A reproducible extraction of training images from diffusion models, 2023. URL https://arxiv.org/abs/2305.08694. Andrew Werth. Turing patterns in photoshop. In Kelly Delp, Craig S. Kaplan, Douglas McKenna, and Reza Sarhangi, editors, Proceedings of Bridges 2015: Mathematics, Music, Art, Architecture, Culture, pages 459–462, Phoenix, Arizona, 2015. Tessellations Publishing. ISBN 978-1-93866415-1. URL http://archive.bridgesmathart.org/2015/bridges2015-459.html. Guanming Zhang and Stefano Martiniani. Absorbing state dynamics of stochastic gradient descent. Phys. Rev. E, 113:L062103, Jun 2026. doi: 10.1103/sbv7-syp7. URL https://link.aps.org /doi/10.1103/sbv7-syp7. 14

A

Supplementary material

All supplementary videos are available at https://rishabh-tifr.github.io/cyclic-denoi sing/movies. Each animates a stroboscopic cyclic-denoising trajectory in Stable Diffusion v1.4, showing the 2D PCA projection of the latent (colored by cycle number) alongside the simultaneously decoded image: • Movie 1 — basin hopping at γ = 0.86, the trajectory of Figs. 1 and 2. • Movie 2 — collapse into a trivial absorbing fixed point at γ = 0.2 (Supplementary Fig. 9(a)). • Movie 3 — a low-amplitude limit cycle at γ = 0.1 (Supplementary Fig. 9(b)). • Movie 4 — a second, less regular limit cycle at γ = 0.1 (additional example, not shown in the paper). Table 1: Reverse-image-search matches for recovered Stable Diffusion attractors. URLs correspond to representative web matches used for post-hoc attribution and verification. Accessed May 2026. Match

Source URL

Yellow chair and white sofa scene

https://fineartamerica.com/featured/1-president-john-f-k ennedy-everett.html?product=poster https://www.justdial.com/jdmart/Barmer/Bangalore-Silk-Fab ric/pid-2011643866/9999P2982-2982-190706194132-H2Z4 https://www.fashionsauce.com/brands/set-by-ouiset-stockis ts https://ssl.c.photoshelter.com/img/photoshelter_unavaila ble.jpg https://www.tadashishoji.com/3k896mx-black-embroidered-l ace-v-neck-dress https://www.homify.co.uk/professionals/2824148/sweetpea-a nd-willow-london-ltd https://image.ceneostatic.pl/data/products/113506095/p-t he-north-face-kurtka-damska-apex-flex-shell-gtx-trellis -green.jpg https://procare.gr/6979-large_default/ogio-alpha-convoy-5 25-backpack-charcoal.jpg https://static.golfballs.com/C/800x800/Products/Legacy/47/ Ogio-Shadow-Fuse-304-Stand-Bag_RYL_raw.webp https://fineartamerica.com/featured/midwestern-cotton-can dy-l-p.html?product=tote-bag https://images.squarespace-cdn.com/content/v1/583335f529 94ca7d6adc6f3d/1547569522591-MWE7TCPD2DZN4CVYWA5T/Ogio-c onvoy-320-backpack-review-01.jpg?format=1500w

Nalli SET PhotoShelter unavailable placeholder Tadashi Shoji Sweetpea and Willow (SW logo) Camera Placeholder

Ogio Alpha Convoy 525 backpack Ogio Shadow Fuse stand (Blue golf bag) Tote bag Ogio Convoy 320 backpack (Black bag)

15

Trivial absorbing states reached by unconditional cycling at low noise amplitudes (Stable Di usion v1.4) (a) γ = 0.10

(b) γ = 0.20

(c) γ = 0.30

ff

(d) γ = 0.40

Figure 8: Trivial absorbing states from low-amplitude unconditional cycling in Stable Diffusion v1.4. Unconditional cyclic denoising initialized from ImageNet test images at low noise amplitudes: (a) γ = 0.1, (b) γ = 0.2, (c) γ = 0.3, and (d) γ = 0.4. Each trajectory is run for 10,000 cycles, with every 100th cycle shown. At these amplitudes, the perturbation is too weak to induce large-scale rearrangements, and the dynamics collapse into trivial absorbing states such as saturated patterns, monotonic fills, or simple geometric structures.

16

(a)

(c) c0

(b)

(d) c10000

(e) c0

(f) c10000

Figure 9: Two kinds of attractor reached by low-amplitude unconditional cycling in Stable Diffusion v1.4: trivial fixed points and limit cycles. (a,b) Two-dimensional PCA projections of stroboscopic cyclic-denoising trajectories, each run for 104 cycles; line color encodes cycle number, the green circle marks the start (c0 ) and the red square the end (c10000 ), and the PCA basis is fit on each trajectory individually. (a) At γ = 0.2 the trajectory drifts away from its initial latent and collapses into a small region of the PCA plane—a trivial absorbing fixed point (up to small stochastic jitter), where the decoded image stays near-monochromatic and stops rearranging from cycle to cycle. (b) At γ = 0.1 the trajectory instead settles onto a closed orbit, traversing nested, near-concentric loops in the PCA plane: a limit cycle in which the state returns periodically rather than freezing. (c–f) Decoded latents at the start and end of each trajectory. (c) Start and (d) end of (a): an initial natural image relaxes to a featureless, near-monochromatic frame. (e) Start and (f) end of (b): the image converges to a periodic, Turing-like stripe pattern. The endpoint in (f) is not static: the (spatially periodic) stripe pattern travels across the frame as cycling proceeds, and it is this periodicity in cycle number—the wave returning to itself every fixed number of cycles—rather than the spatial periodicity of any single frame, that is the real-space signature of the closed orbit in (b). This is reminiscent of the classic observation that repeatedly blurring and then sharpening an image produces Turing-like patterns through an effective reaction–diffusion dynamics [Werth, 2015]; in cyclic denoising the smoothing and sharpening are instead carried out by the learned diffusion kernel. Side-by-side animations of both trajectories and their decoded latents are provided in Supplementary Movies 2 and 3. Limit cycles are considerably rarer than decay to trivial fixed points. In both regimes the low-amplitude dynamics explore little of the landscape, in contrast to the more space-filling transients seen at larger amplitudes.

17

Multiple routes to the same attractors

(a)

(b)

c0

c0

c9500

(d)

(c)

c5000

(e)

c0

c3300

c0

c4500

c0

c5100

(f)

c0

c9000

Figure 10: Multiple routes to the same attractors. Cyclic denoising recovering the same memorized states as attractors across different initial conditions and noising amplitudes γ. In each panel, the top trace is the consecutive stroboscopic cosine similarity, cos(zn , zn−1 ), along a 10,000-cycle trajectory; values near 1 mark an absorbing region in which successive cycles return to essentially the same latent. The red marker indicates a cycle deep within such a region, and the two images below decode the latent at the initial cycle (c0, left) and at the marked cycle (right). Within each column, the two rows begin from different conditions yet are captured by the same attractor, isolating one axis of variation at a time: (a, d) two distinct ImageNet seeds at γ = 0.70; (b, e) two distinct seed ensembles—Gaussian and model-generated—at γ = 0.70; (c, f) two distinct amplitudes, γ = 0.80 and γ = 0.84, both from Gaussian seeds. “ImageNet”, “model-gen”, and “Gaussian” denote how the initial seeds were produced—VAE-encoded ImageNet validation images, samples generated by the model, and pure Gaussian latents, respectively—and “image NNN” is the index of the trajectory within its ensemble. The same memorized images recur across these independent runs, indicating that the cyclic dynamics explore a single underlying landscape: the seeds act only as starting anchors, while the amplitude γ sets the effective step size of the exploration. A given memorized image can therefore be reached from a range of seeds and amplitudes; for clarity we show only two representative routes to each of the three attractors.

18

How cyclic denoising traverses the generative landscape at intermediate and high noise (a)

γ = 0.7

(b)

(c)

γ = 0.74

(e)

γ = 0.84

(f)

(g)

γ = 1.0

(d)

(h)

Figure 11: How cyclic denoising traverses the generative landscape at intermediate and high noise amplitudes. For each amplitude γ we show a per-trajectory 2D PCA projection of a 10,000-cycle latent trajectory (color encodes cycle number; the green circle marks the initial latent c0 and the red square the final cycle c10000) together with a montage of decoded latents sampled along the same trajectory in cycle order. (a) γ = 0.7: in the PCA projection the trajectory collapses into a single deep attractor and dwells there for the remainder of the run. (b) the corresponding decoded montage (every 25th cycle) converges onto, and then repeatedly reproduces, the same memorized bag. (c) γ = 0.74: no single deep attractor forms, yet the projection resolves into a few diffuse but separated clusters, the trajectory dwelling within one before hopping to the next. (d) the corresponding decoded montage (every 20th cycle) shows these clusters to be semantically coherent: an early, possibly transient region containing a mix of scenes and human portraits/photographs, followed by a region of sofa images—which change from cycle to cycle but all remain sofas, and therefore collapse into a single PCA cluster—and finally, a region of catalog-style product images. Thus, even in the absence of an absorbing state, cyclic denoising traverses the landscape in a semantically segmented fashion, dwelling in shallow basins that each encode a coherent concept and hopping between them. This semantic structuring of the dynamics is itself intriguing: it holds generically—even on runs that never settle onto a deep memorized attractor—and points to cyclic denoising as a route to new methods for probing the semantic organization of a model’s landscape. (e) γ = 0.84: the PCA projection shows the trajectory again captured by a deep basin partway through the run before escaping it. (f) the corresponding decoded montage (every 25th cycle) identifies this basin as the white-sofa scene. (g) γ = 1.0: at the (almost) full-noise limit the projection shows no distinct clusters. (h) the decoded latents (every 50th cycle) are essentially independent from cycle to cycle, since each cycle re-noises the latent almost completely—though not entirely: Stable Diffusion’s noise schedule has a non-zero terminal SNR, so even at γ = 1 a small fraction of the previous latent is carried over rather than a true reset to pure noise. Across amplitudes, intermediate γ thus exposes a hierarchy of basins—deep absorbing attractors that correspond to memorized images, and shallow semantic basins between which the dynamics wander—whereas γ → 1 essentially erases this structure.

19

Selected CIFAR-10 attractors recovered by cyclic dynamics. Cycle #6,150 γ = 0.26

Cycle #6,357

Cycle #3,250 γ = 0.26

Cycle #5,249

Cycle #1,101 γ = 0.28

Cycle #1,479

Cycle #7,700 γ = 0.28

Cycle #7,899

Cycle #5,920 γ = 0.30

Cycle #6,119

Cycle #3,850 γ = 0.30

Cycle #4,049

Cycle #7,000 γ = 0.31

Cycle #9,999

Cycle #3,937 γ = 0.32

Cycle #4,063

Cycle #6,451 γ = 0.33

Cycle #6,726

Figure 12: Selected CIFAR-10 attractors recovered by unconditional cyclic dynamics. Each row shows ten equispaced stroboscopic snapshots from a single 10,000-cycle trajectory during the residence time of one basin, with the cycle range and γ indicated. Several attractors match CIFAR-10 training examples previously identified as memorized by Carlini et al. [2023] in independently trained diffusion models, suggesting that these are memorization-prone images that recur across training runs. Cyclic denoising recovers these images directly from a publicly available CIFAR-10 DDPM checkpoint, without prior knowledge of (or access to) the training set or any post-hoc training-set search.

20

Figure 13: Prompt-conditioned cycling settling into two kinds of absorbing states: concept basins (a,b) versus verbatim memorized images (c,d). Each row shows the decoded latent across cycles, from a noise seed (left) to the absorbing state. Concept basins—(a) “Abbey Road album cover” and (b) “Mona Lisa”—settle into a recognizable but crude rendering: conceptually correct, yet not photorealistic to any single training image. Memorized prompts—(c) Aretha Franklin and (d) Freddy Adu—settle into a sharp, verbatim copy of one specific training image.

21

(a)

Averaged correlation per prompt

1.0

mean ⟨cos(zt, z0)⟩

0.8 0.6 0.4 0.2 0.0 Ann Graham Lotz (known memorized) Aretha Franklin (known memorized) Prince (known memorized)

−0.2

Netflix (known memorized) Freddy Adu (known memorized) Abbey Road (guessed candidate)

101

100

cycles after prompt removal

102

103

(b)

Ann Graham Lotz

(c)

Aretha Franklin

(d)

Prince

(e)

Netflix

(f)

Freddy Adu

(g)

Abbey Road

1.0

cos(zt, z0)

0.8 0.6 0.4 0.2 0.0 −0.2

1.0

cos(zt, z0)

0.8 0.6 0.4 0.2 0.0 −0.2 100

101 102 cycles after prompt removal

103

100

101 102 cycles after prompt removal

103

100

101 102 cycles after prompt removal

103

Figure 14: Decorrelation of prompt-conditioned absorbing states after prompt removal (γ = 0.78). Each prompt is first cycled to a prompt-conditioned absorbing state; the prompt is then removed and unconditional cyclic denoising continues for 1000 cycles at fixed amplitude γ = 0.78, while we track the correlation cos(zt , z0 ) between each cycle and the absorbed image at the moment of removal (logarithmic cycle axis; 5 seeds per prompt). (a) Seed-averaged correlation for all six prompts. (b–g) The corresponding per-seed ensembles: (b) “Ann Graham Lotz” (4/5 seeds survive 103 cycles); (c) “Aretha Franklin Files $10 Million Suit Over Patti LaBelle Fight Story On Satire Website” (1/5); (d) “Prince Reunites With Warner Brothers, Plans New Album” (4/5); (e) “Netflix Hits 50 Million Subscribers” (0/5); (f) “Freddy Adu Signs For Yet Another Club You Probably Don’t Know” (0/5); (g) “Abbey Road album cover” (0/5), a guessed prompt that forms a prompt-stabilized concept basin rather than a confirmed memorized image. The concept basin (g) has the shortest decorrelation time, decaying fastest once the prompt is removed, while the known memorized images (b–f) show a range of stabilities at this amplitude.

22