Research map / Adversarial robustness and security / Attacks on text and graphs
Membership Inference Attacks on Diffusion Models via Quantile Regression
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a white-box membership inference attack on diffusion models that learns tiny quantile regression models over the t-error reconstruction loss on public data, aggregated by bagging into a "bag of weak attackers."
Problem
Membership inference against trained diffusion models: determining whether a target image was in the training set, with low false-positive rates, without costly shadow-model training.
Approach
Instead of a uniform threshold on the marginal loss distribution or many diffusion shadow models, learn sample-conditioned quantile regression models of the t-error on public data, threshold each target against its predicted alpha-quantile, and bag many tiny quantile regressors by majority vote.
Key results
- On CIFAR-10, the bag of weak attackers reaches 99.94% TPR at 1% FPR and 99.86% at 0.1% FPR, versus 82.90% at 0.1% FPR for GSA with shadow models.
- On CIFAR-100, Tiny-ImageNet and STL-10 the bag of weak attackers achieves above 99.75% TPR at 0.1% FPR, while the marginal baseline gets 0.32% to 5.76%.
- Preparing the attack takes about 40 minutes on a single V100 for 8 quantile regressors versus about 12 days for 6 GSA shadow models on Tiny-ImageNet.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use sample-conditioned quantile thresholds instead of a single marginal threshold | Quantile-regression membership inference attack · CIFAR-10, 1% FPR | TPR: 9.6% -> 99.94% | Helped |
| Use sample-conditioned quantile thresholds instead of a single marginal threshold | Quantile-regression membership inference attack · CIFAR-10, 0.1% FPR | TPR: 0.7% -> 99.86% | Helped |
| Use sample-conditioned quantile thresholds instead of a single marginal threshold | Quantile-regression membership inference attack · CIFAR-100, 1% FPR | TPR: 11.06% -> 99.89% | Helped |
| Use sample-conditioned quantile thresholds instead of a single marginal threshold | Quantile-regression membership inference attack · CIFAR-100, 0.1% FPR | TPR: 5.76% -> 99.75% | Helped |
| Use sample-conditioned quantile thresholds instead of a single marginal threshold | Quantile-regression membership inference attack · Tiny-ImageNet, 1% FPR | TPR: 8% -> 99.99% | Helped |
| Use sample-conditioned quantile thresholds instead of a single marginal threshold | Quantile-regression membership inference attack · Tiny-ImageNet, 0.1% FPR | TPR: 0.32% -> 99.98% | Helped |
| Use sample-conditioned quantile thresholds instead of a single marginal threshold | Quantile-regression membership inference attack · STL-10, 1% FPR | TPR: 5.78% -> 99.98% | Helped |
| Use sample-conditioned quantile thresholds instead of a single marginal threshold | Quantile-regression membership inference attack · STL-10, 0.1% FPR | TPR: 0.55% -> 99.98% | Helped |
| Use Bag of Weak Attackers instead of GSA shadow models | Diffusion-model membership inference attack · CIFAR-10, 0.1% FPR | TPR: 82.90% -> 99.86% | Helped |
| Increase the number of weak attackers from 1 to 7 (ablation) | Bag of Weak Attackers · Four diffusion-model datasets; low FPR | TPR | Helped |
| Increase the number of weak attackers from 1 to 7 (ablation) | Bag of Weak Attackers · Four diffusion-model datasets; low FPR | TPR | No clear effect |
| Use majority-vote bagging over weak quantile regressors (ablation) | Bag of Weak Attackers · Four diffusion-model datasets | Prediction variance | Helped |
Surprising findings
- The marginal (uniform threshold) baseline performs very poorly at low FPR, with TPR at 0.1% FPR as low as 0.32% on Tiny-ImageNet.
Limitations
- Attack assumes white-box access to diffusion model parameters and public auxiliary data from the same distribution.
- Relies on a single t-error choice (t=50) and does not explore black-box settings.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 STL-10 Tiny-ImageNet
Benchmarks: CIFAR-10 CIFAR-100 STL-10 Tiny-ImageNet
Metrics: TPR at 1% FPR TPR at 0.1% FPR
Baselines: GSA Marginal Baseline LiRA
Builds on: LiRA GSA quantile regression membership inference DDPM bagging
Closest papers by meaning
- Towards Black-Box Membership Inference Attack for Diffusion Models (ICML 2025 · similarity 0.92)
- Privacy-Preserving Low-Rank Adaptation Against Membership Inference Attacks for Latent Diffusion Models (AAAI 2025 · similarity 0.89)
- An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initialization (ICLR 2024 · similarity 0.88)
- TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors (ICML 2024 · similarity 0.88)
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.87)
- CDI: Copyrighted Data Identification in Diffusion Models (CVPR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.