mlsanityData to 7 Oct 2026

A Reproducible Extraction of Training Images from Diffusion Models

arXiv 2305.08694 ↗First posted 15 May 2023cs.CV cs.AIcited by 60

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Recently, Carlini et al. demonstrated the widely used model Stable Diffusion can regurgitate real training samples, which is troublesome from a copyright perspective. In this work, we provide an efficient extraction attack on par with the recent attack, with several order of magnitudes less network evaluations. In the process, we expose a new phenomena, which we dub template verbatims, wherein a diffusion model will regurgitate a training sample largely in tact. Template verbatims are harder to detect as they require retrieval and masking to correctly label. Furthermore, they are still generated by newer systems, even those which de-duplicate their training set, and we give insight into why they still appear during generation. We extract training images from several state of the art systems, including Stable Diffusion 2.0, Deep Image Floyd, and finally Midjourney v4. We release code to verify our extraction attack, perform the attack, as well as all extracted prompts at urlhttps://github.com/ryanwebster90/onestep-extraction.

Key facts. Cited by 60 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 15 of its 25 references that are in the map. First posted on arXiv 15 May 2023.

Builds on

15 of 25 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Membership Inference Attacks against Diffusion Models7 Feb
  2. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  3. 2023Extracting Training Data from Diffusion Models30 Jan
  4. 2023Membership Inference of Diffusion Models24 Jan

Other references · 11

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  3. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
  4. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,580
  5. 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,231
  6. 2020Extracting Training Data from Large Language Modelscited by 2,144
  7. 2021LAION-400M: Open Dataset of CLIP-Filtered 400 Million Image-Text Pairscited by 1,544
  8. 2022Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Modelscited by 418
  9. 2023SemDeDup: Data-efficient learning at web-scale through semantic deduplicationcited by 295
  10. 2023On the De-duplication of LAION-2Bcited by 47
  11. 2021Copyright in Generative Deep Learningcited by 29

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 22; 2025: 15; 2026: 20.

60 papers.

Sort:

By area:

  1. 2024Detecting, Explaining, and Mitigating Memorization in Diffusion Modelscited by 94
  2. 2024Diffusion Models in Low-Level Vision: A Surveycited by 73
  3. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  4. 2023On the Design Fundamentals of Diffusion Models: A Surveycited by 59
  5. 2024Unveiling and Mitigating Memorization in Text-to-image Diffusion Models through Cross Attentioncited by 57
  6. 2024A Geometric Framework for Understanding Memorization in Generative Modelscited by 40
  7. 2024Finding NeMo: Localizing Neurons Responsible For Memorization in Diffusion Modelscited by 36
  8. 2024Copyright Protection in Generative AI: A Technical Perspectivecited by 35
  9. 2023SurrogatePrompt: Bypassing the Safety Filter of Text-to-Image Models via Substitutioncited by 32
  10. 2024Losing dimensions: Geometric memorization in generative diffusioncited by 28
  11. 2025On the Edge of Memorization in Diffusion Modelscited by 22
  12. 2024Classifier-Free Guidance inside the Attraction Basin May Cause Memorizationcited by 21
38 more
  1. 2024Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapescited by 20
  2. 2024Exploring Local Memorization in Diffusion Models via Bright Ending Attentioncited by 19
  3. 2025Data Unlearning in Diffusion Modelscited by 18
  4. 2025Provable Separations between Memorization and Generalization in Diffusion Modelscited by 14
  5. 2024Memorized Images in Diffusion Models share a Subspace that can be Located and Deletedcited by 13
  6. 2023A Systematic Survey of Prompt Engineering on Vision-Language Foundation Modelscited by 12
  7. 2024Iterative Ensemble Training with Anti-Gradient Control for Mitigating Memorization in Diffusion Modelscited by 12
  8. 2024Replication in Visual Diffusion Models: A Survey and Outlookcited by 11
  9. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  10. 2024SIDE: Surrogate Conditional Data Extraction from Diffusion Modelscited by 7
  11. 2025Adjusting Initial Noise to Mitigate Memorization in Text-to-Image Diffusion Modelscited by 7
  12. 2024An Inversion-based Measure of Memorization for Diffusion Modelscited by 6
  13. 2025How Diffusion Models Memorizecited by 6
  14. 2024MemBench: Memorized Image Trigger Prompt Dataset for Diffusion Modelscited by 5
  15. 2024Investigating Memorization in Video Diffusion Modelscited by 5
  16. 2024CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attackscited by 5
  17. 2025Enhancing Privacy-Utility Trade-offs to Mitigate Memorization in Diffusion Modelscited by 5
  18. 2024CPSample: Classifier Protected Sampling for Guarding Training Data During Diffusioncited by 3
  19. 2024Dual-Model Defense: Safeguarding Diffusion Models from Membership Inference Attacks through Disjoint Data Splittingcited by 3
  20. 2025Demystifying Foreground-Background Memorization in Diffusion Modelscited by 2
  21. 2025A Novel Metric for Detecting Memorization in Generative Models for Brain MRI Synthesiscited by 2
  22. 2026Detecting and Mitigating Memorization in Diffusion Models through Anisotropy of the Log-Probabilitycited by 2
  23. 2025Reconstructing Template-Memorized Images from Natural Promptscited by 1
  24. 2026Steering Away from Memorization: Reachability-Constrained Reinforcement Learning for Text-to-Image Diffusioncited by 1
  25. 2026Conf-Gen: Conformal Uncertainty Quantification for Generative Modelscited by 1
  26. 2026Cyclic Denoising Reveals Ultrastable Memories in Diffusion Modelscited by 1
  27. 2024EnTruth: Enhancing the Traceability of Unauthorized Dataset Usage in Text-to-image Diffusion Models with Minimal and Robust Alterationscited by 0
  28. 2025Redistribute Ensemble Training for Mitigating Memorization in Diffusion Modelscited by 0
  29. 2025Identifying Memorization of Diffusion Models through p-Laplace Analysis: Estimators, Bounds and Applicationscited by 0
  30. 2025Finding DoRI: Discovery of Retained Images in Diffusion Modelscited by 0
  31. 2025CAPTAIN: Semantic Feature Injection for Memorization Mitigation in Text-to-Image Diffusion Modelscited by 0
  32. 2025Beyond Memorization: Selective Learning for Copyright-Safe Diffusion Model Trainingcited by 0
  33. 2026No Caption, No Problem: Caption-Free Membership Inference via Model-Fitted Embeddingscited by 0
  34. 2026You Don't Need All That Attention: Surgical Memorization Mitigation in Text-to-Image Diffusion Modelscited by 0
  35. 2026Language Diffusion Models are Associative Memories Capable of Retrieving Unseen Datacited by 0
  36. 2026Memorization In Stable Diffusion Is Unexpectedly Driven by CLIP Embeddingscited by 0
  37. 2026Broken Memories: Detecting and Mitigating Memorization in Diffusion Models with Degraded Generationscited by 0
  38. 2026Localizing Memorized Regions in Diffusion Models via Coordinate-Wise Curvature Differencescited by 0

50 most cited of 60 All 60 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Towards Irreversible Machine Unlearning for Diffusion Models
  2. 2024Model Integrity when Unlearning with T2I Diffusion Models
  3. 2025Quantifying the Ease of Reproducing Training Data in Unconditional Diffusion Models
  4. 2024Adversarial Examples are Misaligned in Diffusion Model Manifolds
  5. 2023Masked Diffusion Models Are Fast Distribution Learners
  6. 2024Towards Black-Box Membership Inference Attack for Diffusion Models
  7. 2024On Improved Conditioning Mechanisms and Pre-training Strategies for Diffusion Models
  8. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitation