NAMESAKES

Probing Identity Memorization in Text-to-Image Models

Morris Alper1 Vasudha Varadarajan1 Moran Yanuka2 Angelina Wang3 Hadar Averbuch-Elor3

1Carnegie Mellon University  ·  2Tel Aviv University  ·  3Cornell University

arXiv 2026

Paper Code 🤗 Dataset 🌐 Explore Examples
Real Face
Text-to-Image Generations
Ground-truth photo of Jodie Foster SDXL generation for Jodie Foster SDXL generation for perturbed name Jolie Fuster
“Jodie Foster”
“Jodie Foster”
“Jolie Fuster”
Ground-truth photo of Idris Elba SDXL generation for Idris Elba SDXL generation for perturbed name Idrus Elga
“Idris Elba”
“Idris Elba”
“Idrus Elga”

TL;DR: T2I models memorize the faces of some individuals and reproduce their likeness when prompted with their name, but fabricate a plausible, unrelated face for an unfamiliar or orthographically similar perturbed name (shown in red). We introduce a fully black-box probe that tells these cases apart without ever needing a reference photo, along with NAMESAKES, a benchmark of 1,269 public figures spanning the full spectrum of fame for evaluating it.

Abstract

Text-to-image (T2I) models generate realistic likenesses of some individuals when prompted with their names, raising privacy concerns. However, distinguishing whether a generated face is memorized or fabricated currently requires ground-truth photos, access to training data, or white-box access to model internals, limiting applicability…

Method Overview

Given a T2I model and a name, we predict whether the model has memorized the associated identity or fabricates a plausible but ungrounded face, without ever accessing a ground-truth photo—using only the model's own generations. We propose two complementary black-box scores: dispersion (δ), how consistent multiple generations of the same name are with each other, and centroid similarity (scen), how similar a name's average generation is to those of other names. Memorized identities tend to produce tightly clustered, distinctive faces (low δ, low scen), while fabricated ones are more varied yet converge toward generic, demographically-driven defaults.

Qualitative gallery spanning the memorization spectrum
Qualitative examples spanning the memorization spectrum (SDXL-Base). Each row shows a name's Wikipedia ground-truth photo alongside four generated images, plus probe values for dispersion (δ) and centroid similarity (scen). Rows are ordered from high to low reference similarity: top rows show memorized identities that resemble the ground truth and each other; bottom rows show fabricated identities.

The NAMESAKES Dataset

NAMESAKES pairs 1,269 public figures (names, ground-truth photos, and fame estimates from Wikipedia pageviews) with perturbed names—plausible but fictitious names that orthographically resemble the original (e.g., Jodie Foster → Jolie Fuster). Names are sampled to span a full spectrum of fame, from figures likely to be memorized by T2I models to obscure ones likely to be fabricated.

Sample entries from the NAMESAKES dataset spanning the fame spectrum
Samples from the 1,269 items in NAMESAKES, spanning fame levels from highly well-known (left) to relatively obscure (right). Each real name is paired with a perturbed name designed to orthographically resemble it.

Citation

If you use NAMESAKES in your work, please cite:

@article{alper2026namesakes,
  title         = {NAMESAKES: Probing Identity Memorization in Text-to-Image Models},
  author        = {Morris Alper and Vasudha Varadarajan and Moran Yanuka and Angelina Wang and Hadar Averbuch-Elor},
  year          = {2026},
  eprint        = {2606.20155},
  archivePrefix = {arXiv}
}