The past few years have witnessed substantial advancement in text-guided
image generation powered by diffusion models. However, it was shown that
text-to-image diffusion models are vulnerable to training image memorization,
raising concerns on copyright infringement and privacy invasion. In this work,
we perform practical analysis of memorization in text-to-image diffusion
models. Targeting a set of images to protect, we conduct quantitive analysis on
them without need to collect any prompts. Specifically, we first formally
define the memorization of image and identify three necessary conditions of
memorization, respectively similarity, existence and probability. We then
reveal the correlation between the model's prediction error and image
replication. Based on the correlation, we propose to utilize inversion
techniques to verify the safety of target images against memorization and
measure the extent to which they are memorized. Model developers can utilize
our analysis method to discover memorized images or reliably claim safety
against memorization. Extensive experiments on the Stable Diffusion, a popular
open-source text-to-image diffusion model, demonstrate the effectiveness of our
analysis method.

对文本引导的图像生成模型进行了记忆化分析，提出三个必要条件进行定量分析，并利用反演技术验证目标图像的安全性，同时对稳定扩散模型进行了有效性实验证明。

文本到图像扩散模型中的记忆化分析实践

Could It Be Generated? Towards Practical Analysis of Memorization in  Text-To-Image Diffusion Models

A discriminatively trained neural net classifier can fit the training data
perfectly if all information about its input other than class membership has
been discarded prior to the output layer. Surprisingly, past research has
discovered that some extraneous visual detail remains in the logit vector. This
finding is based on inversion techniques that map deep embeddings back to
images. We explore this phenomenon further using a novel synthesis of methods,
yielding a feedforward inversion model that produces remarkably high fidelity
reconstructions, qualitatively superior to those of past efforts. When applied
to an adversarially robust classifier model, the reconstructions contain
sufficient local detail and global structure that they might be confused with
the original image in a quick glance, and the object category can clearly be
gleaned from the reconstruction. Our approach is based on BigGAN (Brock, 2019),
with conditioning on logits instead of one-hot class labels. We use our
reconstruction model as a tool for exploring the nature of representations,
including: the influence of model architecture and training objectives
(specifically robust losses), the forms of invariance that networks achieve,
representational differences between correctly and incorrectly classified
images, and the effects of manipulating logits and images. We believe that our
method can inspire future investigations into the nature of information flow in
a neural net and can provide diagnostics for improving discriminative models.

本篇文章研究神经网络分类器的信息流动及其影响因素，包括模型结构，训练目标（特别是鲁棒性损失），正确和错误分类图像之间的表征差异，以及对 logits 和图像进行操作的效果，提出了一种基于 BigGAN 的前馈反演模型，可以生成高保真重建的图像。