Supplementary Movies

Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models

Rishabh Sharma, Stefano Martiniani

New York University

🌀 Never sheared a glass? Start with the visual primer on the physics that inspired our extraction attack ↓

Stroboscopic cyclic-denoising trajectories in Stable Diffusion v1.4, shown as decoded latents at the end of each forward–reverse cycle. Each movie corresponds to a trajectory discussed in the paper.

Movie 1 — Basin hopping under unconditional cyclic denoising (γ = 0.86). Animated version of the basin-hopping trajectory in Fig. 1: a single ImageNet test image cycled at γ = 0.86 for 10,000 cycles. The two-dimensional PCA projection of the latent trajectory (color encodes cycle number) is shown alongside the simultaneously decoded latent. After a short transient the trajectory is captured by a first attractor, escapes and hops to a second, well-separated attractor, then briefly leaves and is recaptured — dwelling for long stretches in deep absorbing states rather than decorrelating. The two memorized scenes the trajectory hops between appear among the thumbnails in the left-hand column of this page, found with a simple Google image search.
Movie 2 — Collapse into a trivial absorbing state (γ = 0.2). A low-amplitude trajectory collapsing into a featureless, near-monochromatic basin. The PCA trajectory is shown alongside the decoded latent; once the trajectory enters this trivial basin it only jitters within a small region, and the decoded image stays near-monochromatic from cycle to cycle rather than rearranging.
Movie 3 — Limit cycle (γ = 0.1). A low-amplitude trajectory settling onto a closed orbit. The decoded latent is a traveling, Turing-like wave that returns periodically in cycle number — the real-space signature of the closed orbit traced in the PCA projection.
Movie 4 — Approximate limit cycle (γ = 0.1). A second low-amplitude trajectory, from a Gaussian seed, that settles onto an approximate (less clean) closed orbit in the PCA space. As in Movie 3, the decoded latent develops a striped pattern that recurs periodically in cycle number as the trajectory approaches the limit cycle — indicating that such striped real-space patterns might be a generic signature of the limit-cycle regime reached under cyclic denoising at low amplitudes.

The physics behind the protocol

Cyclic denoising imports a protocol from the physics of driven disordered systems. A disordered solid sheared back and forth at a fixed strain amplitude either settles into an absorbing state — returning to the same configuration at the end of every cycle — or, above a critical amplitude, yields and keeps rearranging forever. Diffusion models show the same two phases under cyclic denoising, with the noise amplitude γ playing the role of the strain amplitude.

Low amplitude, below yielding — the solid anneals into an absorbing state. A disordered solid is sheared back and forth at a fixed strain amplitude (left). Its particles rearrange for a few cycles, then it settles into an absorbing state—returning to the very same configuration at the end of every cycle, even as the driving continues. The energy trace (right) is stroboscopic—one snapshot per completed shear cycle—and, seen this way, the energy steps down the rugged landscape and locks into a minimum. Cyclic denoising applies exactly this idea to a diffusion model, with noising and denoising in place of shearing.
High amplitude, above yielding — the solid never settles. Drive the same solid harder, at a larger strain amplitude, and it no longer settles. Its particles rearrange on every cycle (left), and the stroboscopic configuration keeps exploring the landscape rather than locking into one minimum (right): a yielded, diffusive state instead of an absorbing one. The two behaviors are separated by a sharp yielding transition at a critical strain amplitude; below it the system gets stuck, above it the system flows.
The same protocol, on a diffusion model. One image is repeatedly noised and denoised—the noise amplitude γ (the slider) plays the role of the strain amplitude above. At a small amplitude (left) the image is only lightly perturbed and drifts only slightly from cycle to cycle—too little to explore the landscape in any meaningful sense. Such trajectories eventually end in trivial fixed points (Movie 2), which return to the same state every cycle, or limit cycles (Movies 3 and 4), which keep moving but only retrace a closed orbit; neither uncovers memorized images. At a large amplitude (right) the model yields: the image forgets its initial state and re-forms from cycle to cycle, exploring the generative landscape. Over enough cycles, these wandering trajectories get trapped in deep, long-lived basins, many of which decode to memorized training images—Movie 1 follows one such trajectory, dwelling in a basin for thousands of cycles before hopping onward. Noise is added in one shot (the slider snaps up) and removed gradually (it glides back). The camera that appears each time the image is denoised back to γ = 0 marks the stroboscopic snapshot: one frame captured per completed cycle. The trajectories in Movies 1–4 above are sequences of exactly these snapshots.

↑ Back to Supplementary Movies 1–4