Research map / Image generation / Autoregressive and latent generation
CDI: Copyrighted Data Identification in Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CDI, a dataset-inference framework that lets data owners test with statistical significance whether a collection of their publicly exposed images was used to train a diffusion model, using MIA signals plus new handcrafted features.
Problem
Data owners need to verify whether their copyrighted images were used to train diffusion models, but existing membership inference attacks give too weak a signal on individual images of large state-of-the-art DMs.
Approach
Aggregate membership signals over a dataset owner's multiple samples rather than single points: combine existing MIA scores with three new features (gradient masking, multiple loss, noise optimization), fit a logistic-regression scorer on control splits, and apply a one-tailed Welch t-test aggregated over 1000 random trials.
Key results
- CDI confidently (p<0.01) identifies training-set membership of a suspect collection with as few as 70 samples for U-ViT256-T2I-Deep on COCO.
- Set-level MIA without t-test reaches only 10.2-33.4% TPR@FPR=1% on several models, while CDI reaches 93-100% on DiT256, U-ViT256-Uncond, and text-conditioned U-ViT models.
- Existing MIAs achieve mean TPR@FPR=1% of at most 2.18% across 8 DMs, close to random guessing.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add statistical testing to set-level MIA (ablation) | CDI · U-ViT256 | TPR@FPR=1%: 22.90 -> 62.74 | Helped |
| Add statistical testing to set-level MIA (ablation) | CDI · DiT256 | TPR@FPR=1%: 10.50 -> 93.00 | Helped |
| Add statistical testing to set-level MIA (ablation) | CDI · U-ViT256-Uncond | TPR@FPR=1%: 33.40 -> 100.00 | Helped |
| Add Gradient Masking (GM) feature (ablation) | CDI · U-ViT512 | minimum suspect samples needed to reject H0: 20000 to 2000 | Helped |
| Use only existing MIA features instead of adding novel features (ablation) | CDI · U-ViT512 | minimum suspect samples needed to reject H0: 2000 to 20000 | Hurt |
| Remove Noise Optimization (NO) while retaining GM and ML (ablation) | CDI · U-ViT512 | minimum suspect samples needed to reject H0 | Hurt |
| Add Multiple Loss (ML) feature (ablation) | CDI · diffusion models evaluated in Figure 3 | minimum suspect samples needed to reject H0 | Helped |
| Use CDI with only original MIA features and Multiple Loss (ablation) | CDI · 8 diffusion models | minimum suspect samples needed to reject H0 | Hurt |
| Allow non-member samples in the suspect set (ablation) | CDI · diffusion models evaluated in Figure 4 | p-value | Mixed |
| Test a suspect set containing only non-members (ablation) | CDI · 8 diffusion models | false positive rate | Helped |
Surprising findings
- Existing MIAs (Denoising Loss, SecMI, PIA, PIAN) perform near random guessing on large state-of-the-art DMs, contrary to prior reports on toy datasets.
- CDI produced no false positives when P contained only non-members (p-values around 0.38-0.40).
Limitations
- Requires many suspect samples (e.g., thousands) for large-dataset models like ImageNet-trained ones.
- Gray-box access needs roughly one-third more samples than white-box access.
- Assumes suspect and unpublished samples are i.i.d. from the same distribution.
Experimental setup
Datasets: ImageNet-1k COCO-Text
Benchmarks: ImageNet-1k COCO-Text
Metrics: p-value TPR@FPR=1% AUC accuracy
Baselines: Denoising Loss SecMI PIA PIAN set-level MIA
Builds on: dataset inference SecMI PIA Denoising loss membership inference Degrade Restore Compare (DRC)
Closest papers by meaning
- Leveraging Model Guidance to Extract Training Data from Personalized Diffusion Models (ICML 2025 · similarity 0.88)
- Towards Black-Box Membership Inference Attack for Diffusion Models (ICML 2025 · similarity 0.87)
- The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright BreachesWithout Adjusting Finetuning Pipeline (ICML 2024 · similarity 0.87)
- Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancy (NeurIPS 2024 · similarity 0.87)
- Membership Inference Attacks on Diffusion Models via Quantile Regression (ICML 2024 · similarity 0.87)
- CGI-DM: Digital Copyright Authentication for Diffusion Models via Contrasting Gradient Inversion (CVPR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.