Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models

We introduce cyclic denoising—repeated forward and reverse diffusion at controlled noise amplitudes—as an extraction attack for image diffusion models. Inspired by random organization in disordered solids, where cyclic mechanical perturbations anneal the system into increasingly stable configurations, cyclic denoising exposes regions of the learned distribution that remain largely inaccessible to standard sampling. We find that this dynamics drives samples toward attractors with a broad stability spectrum, with the deepest attractors exhibiting ultrastability: they can be regenerated from near-total corruption and sustained through thousands of noising-denoising cycles. Many of these deep attractors correspond to memorized training images, including stock photographs, brand watermarks, and web-crawl artifacts. Our extraction attack requires sampler-level control, including mid-process noise injection, but no gradients and no weight inspection. Crucially, it requires no prior knowledge of training data, captions, or prompts. In contrast, prior generate-and-filter attacks commonly rely on prompted generation using known or suspected training captions, followed by large-scale sampling and post-hoc similarity or membership-inference filtering. While cyclic denoising can also be applied with prompts, our main protocol is fully unconditioned. We demonstrate the phenomenon in Stable Diffusion v1.4, a large latent diffusion model, and in a smaller pixel-space DDPM, showing consistent behavior across latent- and pixel-space diffusion models. Across noise amplitudes, we observe a dynamical transition from trivial fixed points to structured memorized images, hierarchical partial absorption in which coarse scene layout freezes while fine details remain diffusive, basin hopping between memorized states with long residence times, prompt-stabilized memorized templates, and cross-initial-condition universality of the recovered attractor set. Together, these results establish cyclic denoising as both a physics-inspired probe of generative landscapes and a practical tool for memorization auditing, with implications for privacy, copyright compliance, and model fingerprinting.