Research map / Image generation / Autoregressive and latent generation
An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initialization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Proximal Initialization Attack (PIA) and its normalized variant PIAN, a two-query membership inference attack on diffusion models that uses the t=0 noise estimate as the initialization for a ground-truth trajectory, and also studies MIA robustness of TTS diffusion models by output type.
Problem
Membership inference against diffusion models is costly (SecMI needs many queries) and the naive loss-based attack is noisy because the diffusion training loss is stochastic; prior work also ignores audio/TTS diffusion models.
Approach
Uses the model's output at t=0 as the noise epsilon to build a deterministic ground-truth trajectory under DDIM (sigma=0), then measures the discrepancy between this trajectory point and the model's denoised prediction at time t; members should have smaller discrepancy. Needs only two queries and extends to continuous-time SDE/ODE models.
Key results
- On Grad-TTS, PIA reaches AUC 99.6 on LJSpeech and 95.4 on LibriTTS with 1+1 queries, versus SecMI's 99.5 and 93.9 with 60+2 queries.
- On DDPM CIFAR10, PIAN achieves TPR@1% FPR of 31.2 versus SecMI's 9.11 and naive attack's 6.85, using 1+1 queries.
- On stable diffusion (Laion5), PIA achieves AUC 70.5 and TPR@1% FPR 18.1, versus SecMI's 69.1 and 16.1; PIAN performs poorly there (AUC 56.7).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use PIA instead of SecMI | Membership inference attack on GradTTS · LJSpeech, VCTK, and LibriTTS | TPR@1% FPR: 94.0 -> 94.2; 14.8 -> 20.6; 19.7 -> 30.0 | Helped |
| Use PIA instead of SecMI | Membership inference attack on GradTTS · LJSpeech, VCTK, and LibriTTS | AUC: 99.5 -> 99.6; 87.0 -> 87.8; 93.9 -> 95.4 | Helped |
| Use PIA instead of SecMI | Membership inference attack on DDPM · CIFAR10, TinyImageNet, and CIFAR100 | TPR@1% FPR: 9.11 -> 13.7; 12.7 -> 17.1; 11.1 -> 19.6 | Helped |
| Use PIA instead of SecMI | Membership inference attack on DDPM · CIFAR10, TinyImageNet, and CIFAR100 | AUC: 88.1 -> 88.5; 89.4 -> 89.6; 87.6 -> 89.4 | Helped |
| Use PIA instead of SecMI | Membership inference attack on Stable Diffusion · Laion5, Laion5 w/o text, and Laion5 Blip text | TPR@1% FPR: 16.1 -> 18.1; 14.5 -> 19.8; 17.8 -> 20.2 | Helped |
| Use PIA instead of SecMI | Membership inference attack on Stable Diffusion · Laion5, Laion5 w/o text, and Laion5 Blip text | AUC: 69.1 -> 70.5; 71.6 -> 73.9; 71.6 -> 73.3 | Helped |
| Normalize the PIA initialization (PIAN) instead of using unnormalized PIA (ablation) | Membership inference attack on GradTTS · LJSpeech, VCTK, and LibriTTS | TPR@1% FPR: 94.2 -> 95.7; 20.6 -> 19.6; 30.0 -> 44.7 | Mixed |
| Normalize the PIA initialization (PIAN) instead of using unnormalized PIA (ablation) | Membership inference attack on DDPM · CIFAR10, TinyImageNet, and CIFAR100 | TPR@1% FPR: 13.7 -> 31.2; 17.1 -> 32.8; 19.6 -> 22.2 | Helped |
| Normalize the PIA initialization (PIAN) instead of using unnormalized PIA (ablation) | Membership inference attack on Stable Diffusion · Laion5, Laion5 w/o text, and Laion5 Blip text | TPR@1% FPR: 18.1 -> 4.8; 19.8 -> 3.2; 20.2 -> 3.2 | Hurt |
| Use an audio-output TTS model instead of a mel-spectrogram-output model | Membership inference attack on TTS models · LJSpeech | AUC: 99.6; 52.4; 54.4 | Hurt |
| Increase the selected training/evaluation data proportion (ablation) | PIA membership inference attack · TTS and image datasets | AUC | Hurt |
| Vary attack time t (ablation) | PIA and PIAN · GradTTS and DDPM datasets | AUC | Mixed |
Surprising findings
- PIAN, the normalized variant that works best on DDPM and Grad-TTS TPR, performs substantially worse than the naive baseline on stable diffusion (AUC 56.7 vs 66.3).
- Audio-output diffusion models (DiffWave, FastDiff) are near random guessing (AUC about 50-57) while mel-spectrogram models (Grad-TTS) reach AUC near 100.
Limitations
- Requires access to intermediate model outputs (not fully black-box), as the threat model acknowledges.
- PIAN normalization is a heuristic and fails on stable diffusion.
- Hyperparameter t is chosen per model using the evaluation set, and the audio-model robustness explanation remains unexplained.
Experimental setup
Datasets: CIFAR10 CIFAR100 TinyImageNet LJSpeech VCTK LibriTTS LAION-5B subset (laion-aesthetics-v2-5plus) COCO2017 val
Benchmarks: CIFAR10 CIFAR100 TinyImageNet LJSpeech VCTK LibriTTS LAION-5B subset COCO2017
Metrics: AUC TPR@1% FPR TPR@0.1% FPR attack success rate
Baselines: Naive Attack SecMI
Builds on: DDIM SecMI DDPM Score-based SDE
Closest papers by meaning
- Towards Black-Box Membership Inference Attack for Diffusion Models (ICML 2025 · similarity 0.89)
- Membership Inference Attacks on Diffusion Models via Quantile Regression (ICML 2024 · similarity 0.88)
- Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancy (NeurIPS 2024 · similarity 0.87)
- RAPID: Retrieval Augmented Training of Differentially Private Diffusion Models (ICLR 2025 · similarity 0.87)
- Toward effective protection against diffusion-based mimicry through score distillation (ICLR 2024 · similarity 0.87)
- Anti-Diffusion: Preventing Abuse of Modifications of Diffusion-Based Models (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.