Reconstructing Template-Memorized Images from Natural Prompts

Recent advances in generative models, such as diffusion models, have raised concerns related to privacy, copyright infringement, and data curation. Prior work has shown that training data can be reconstructed from such models, but existing attacks typically rely on substantial computational resources, access to the training set, or carefully engineered prompts. In this work, we present a low-resource reconstruction attack that operates through seemingly benign prompts and requires little to no access to the training data. Our attack targets template-memorized images (TMI), where recurring layouts and visual structures are memorized during training. We show that such memorization manifests under potentially realistic usage. This raises a possibility of unintentional reconstruction by naive users that don't carry explicit adversarial intent. For example, we observe that a simple prompt such as "blue Unisex T-Shirt" can reproduce visual content depicting a real individual. Beyond extraction, we observe novel phenomena occurring in TMI (e.g., interpolation), raising questions about the novelty of generated content and the effectiveness of established methods for detecting memorized content. Our code is available at \url{https://github.com/TheSolY/lr-tmi}.

Modern AI image generators are trained on massive collections of images scraped from the internet. While these models are designed to create new images, prior research has shown that they can sometimes memorize real training images and reproduce them when given carefully engineered prompts. In many e-commerce websites, the same image template, such as a t-shirt mockup or product background, appears repeatedly together with slightly different text descriptions and designs. This repeated coupling between parts of the prompt and parts of the image can lead models to memorize recurring visual templates rather than only full images. This paper shows that such memorized content can be reconstructed using ordinary prompts such as “Galaxy Area Rug” or “Abstract Art T-Shirt,” similar to prompts a regular user might naturally enter. The authors introduce a low-resource, black-box attack that requires no access to the training set and targets these “template-memorized images.” The paper also identifies subtler forms of memorization, including interpolation, where models combine memorized elements from multiple training images, as well as perturbations and template leakage. These outputs are often difficult to detect automatically, yet human participants in a user study could still clearly recognize the copied visual elements. Overall, a broad theme presented by the paper is that memorization risks may emerge during ordinary, non-adversarial use of generative AI systems.