Filtering Memorization from Parameter-Space in Diffusion Models

Technical Summary: Filtering Memorization from Parameter-Space in Diffusion Models

Problem Statement

Low-Rank Adaptation (LoRA) has become the standard mechanism for customizing diffusion models, allowing users to inject new styles or concepts via lightweight parameter updates. However, a significant risk exists where LoRAs memorize training images, leading to the reproduction of copyrighted or sensitive content. This issue is particularly acute in open ecosystems (e.g., Hugging Face, CivitAI) where users distribute trained LoRA weights without releasing the underlying training data.

Existing mitigation strategies are largely inapplicable in this "black-box" scenario:

• Training-time interventions (e.g., data deduplication, differential privacy) require access to the training pipeline and data, which is unavailable to downstream users or hosting platforms.
• Inference-time defenses (e.g., prompt optimization, anti-memorization guidance) often require knowledge of the memorized content or control over the sampling process, which cannot be enforced at the platform level.
• Parameter-space approaches (e.g., concept erasure) typically require prior knowledge of the specific concepts or prompts to be erased.

The core challenge addressed by this paper is: How can memorization be identified and filtered when only the released LoRA weights and the pretrained backbone are available, with no access to training data, the training procedure, or the specific memorized content?

Methodology: Base-Anchored Filtering (BAF)

The authors propose Base-Anchored Filtering (BAF), a training-free and data-free framework that operates directly in the parameter space. The method relies on a geometric insight regarding the spectral structure of model weights.

1. Geometric Insight
The authors hypothesize that generalizable adaptations (e.g., a new art style) align with the dominant spectral directions (principal subspace) of the pretrained backbone, whereas memorization introduces weakly aligned, instance-specific directions.

• Generalizable Adaptation: Resides in low-dimensional subspaces aligned with the pretrained model's principal directions.
• Memorization: Manifests as spectral channels that are weakly aligned with the pretrained backbone.

2. Anchoring Score
To quantify this alignment, the method decomposes the LoRA update matrix $\Delta W$ via Singular Value Decomposition (SVD) into spectral channels. For each channel $i$ with singular vectors $u_i$ and $v_i$, an anchoring score $a_i$ is calculated:
$$a_i = \|P_L u_i\|_2 \cdot \|P_R v_i\|_2$$
where $P_L$ and $P_R$ are orthogonal projections onto the top-$K$ left and right principal subspaces of the pretrained weight matrix $W^*$.

• A high score ($a_i \approx 1$) indicates the channel lies within the pretrained subspace (generalizable).
• A low score ($a_i \approx 0$) indicates the channel is orthogonal to the pretrained structure (potential memorization).
• A random-projection baseline ($a_{null} = K^2/mn$) serves as a threshold for distinguishing structured alignment from noise.

3. Filtering Algorithm
BAF applies a gating function to the spectral channels of the LoRA update:

• BAF-Hard: A binary gate that removes channels where $a_i < a_{null}$.
• BAF-Soft: A continuous gate $g(a_i) = a_i^\alpha$ that suppresses low-alignment channels rather than removing them entirely, allowing for a trade-off between suppression strength and generation quality.

4. Adaptive Subspace Selection
To handle heterogeneous spectral decay across different layers and architectures, the dimension $K$ of the principal subspace is selected adaptively based on an energy-adaptive rule. $K$ is chosen such that the cumulative energy of the top-$K$ singular values of the pretrained weights exceeds a threshold $\tau_{energy}$.

Key Contributions

1. Problem Formulation: The authors formulate post-hoc memorization mitigation for diffusion LoRAs under strict data-inaccessible constraints, a setting relevant to current model-sharing ecosystems.
2. Geometric Insight: They validate the hypothesis that memorization is concentrated in spectral directions weakly aligned with the pretrained principal subspace, while generalizable adaptations are strongly aligned.
3. BAF Framework: They introduce a training-free, data-free method that selectively suppresses memorization-related spectral directions using only parameter-space structure.
4. Empirical Validation: Extensive experiments demonstrate that BAF reduces memorization while preserving or improving generation quality, outperforming existing strategies that rely on unavailable information.

Experimental Results

The authors evaluated BAF on Stable Diffusion v1.5 and SDXL using LoRAs trained on Pokémon, CelebA-HQ, and LAION-Art datasets. Memorization was simulated by duplicating "canary" images during training.

• Memorization Reduction: BAF variants (Hard and Soft) consistently achieved the lowest SSCD (Similarity to Self-Consistent Detection) scores among comparable methods, significantly reducing the reproduction of training images.
• Generation Quality: Unlike many mitigation strategies that degrade output quality, BAF often improved aesthetic scores (AES) and CLIP scores. The authors suggest that removing weakly anchored channels eliminates noisy parameter directions.
• Comparison: BAF outperformed inference-time baselines (RTA, Prompt Optimization, CFG-Reverse) and training-time baselines (Deduplication, DP-LoRA) in the data-inaccessible setting. It approached the performance of AMG (Anti-Memorization Guidance), which requires access to training images, but without that data dependency.
• Real-World Simulation: On 20 real-world copyrighted LoRAs downloaded from CivitAI (covering anime characters, celebrities, and styles), BAF was rated by human evaluators as the most effective method at suppressing character reproduction while maintaining visual quality, outperforming all inference-time baselines.

Significance and Claims

The paper claims that parameter-space structure alone provides strong signals for distinguishing memorization from useful adaptation. By leveraging the geometric relationship between LoRA updates and the pretrained backbone, BAF offers a practical solution for mitigating copyright and privacy risks in open model ecosystems where training data is unavailable.

The authors position this work as a step toward data-free safety mechanisms for open ecosystems. They emphasize that their approach does not require retraining, access to original data, or knowledge of the specific memorized content, making it directly applicable to both hosting platforms and downstream users who wish to deploy LoRAs safely.