arXiv:2605.02908cs.CVcs.AI2026-05中稿 · CVPR

Stable Diffusion记忆现象主要由CLIP的填充标记嵌入驱动,而非提示词。

Memorization In Stable Diffusion Is Unexpectedly Driven by CLIP Embeddings

论文配图:Memorization In Stable Diffusion Is Unexpectedly Driven by CLIP Embeddings
图 1 · 摘自论文原文
  • 发现填充标记嵌入复制了结束标记,导致模型过度依赖特定嵌入
  • 通过替换填充标记和部分屏蔽,可有效抑制记忆但不影响生成质量
  • 方法简单易部署,适合关注模型安全性的开发者

理解文本嵌入如何影响文生图扩散模型中的记忆现象,对模型可解释性与安全性至关重要。本文揭示Stable Diffusion中一个意外行为:模型在记忆生成时过度依赖特定嵌入。将输入标记分为<startoftext>、<prompt>、<endoftext>和<pad>,对应嵌入为$\mathbf{v}^{\mathbf{sot}}$、$\mathbf{v}^{\mathbf{pr}}$、$\mathbf{v}^{\mathbf{eot}}$、$\mathbf{v}^{\mathbf{pad}}$。研究发现,$\mathbf{v}^{\mathbf{pr}}$在记忆案例中贡献极小,而$\mathbf{v}^{\mathbf{pad}}$因结构上复制$\mathbf{v}^{\mathbf{eot}}$(CLIP训练中唯一显式优化的嵌入)而显著增强其影响,导致模型过度依赖$\mathbf{v}^{\mathbf{eot}}$,从而驱动记忆现象。基于此,提出两种简单有效的推理阶段缓解策略:(1) 将tokenizer默认的<pad>从<eot>替换为!符号并屏蔽$\mathbf{v}^{\mathbf{eot}}$;(2) 部分屏蔽$\mathbf{v}^{\mathbf{pad}}$。两者均能抑制记忆且不降低生成质量,无需事前检测即可直接部署。

原文摘要 · Abstract (English)

Understanding how textual embeddings contribute to memorization in text-to-image diffusion models is crucial for both interpretability and safety. This paper investigates an unexpected behavior of CLIP embeddings in Stable Diffusion, revealing that the model disproportionately relies on specific embeddings. We categorize input tokens as <startoftext>, <prompt>, <endoftext> and <pad> with corresponding embeddings $\mathbf{v}^{\mathbf{sot}}, \mathbf{v}^{\mathbf{pr}}, \mathbf{v}^{\mathbf{eot}}, \mathbf{v}^{\mathbf{pad}}$. We discover that $\mathbf{v}^{\mathbf{pr}}$ contribute minimally to generation in memorized cases. In contrast, $\mathbf{v}^{\mathbf{pad}}$ strongly affect memorization due to their structural duplication of $\mathbf{v}^{\mathbf{eot}}$, the only embedding explicitly optimized during CLIP training. This duplication unintentionally amplifies the influence of $\mathbf{v}^{\mathbf{eot}}$, causing the model to over-rely on it, thereby driving memorization. Based on these observations, we propose two simple yet effective inference-time mitigation strategies: (1) Replacing the tokenizer's default <pad> from <eot> to the ! token before embedding, and masking the $\mathbf{v}^{\mathbf{eot}}$; (2) Partial masking of $\mathbf{v}^{\mathbf{pad}}$. Both suppress memorization without degrading quality, and are readily deployable without prior detection.

Stable Diffusion记忆机制CLIP安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。