Research map / Image generation / Fast diffusion sampling
Privacy Attacks on Image AutoRegressive Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that image autoregressive models (VAR, RAR, MAR) leak far more training data than diffusion models via a new conditional-vs-unconditional membership inference attack, dataset inference with few samples, and training-data extraction.
Problem
Privacy risks of image autoregressive models (IARs), which match or surpass diffusion models in image quality and speed, have not been studied; existing MIAs for LLMs and DMs transfer poorly to them.
Approach
Adapt CLiD's conditional-minus-unconditional signal to IARs (computed on p(x) per token, parameter-free), add MAR-specific fixes (adjusted mask ratio, fixed timestep, more noise samples), use MinMax-normalized sum of MIA scores for dataset inference without classifier training, and extract memorized training images by prefix-conditioned greedy completion with candidate pre-filtering.
Key results
- VAR-d30 reaches 94.57% TPR@FPR=1% with the new MIA, versus 16.68% for the best naive LLM-MIA baseline and 6.38% for the strongest DM attack.
- Dataset inference on IARs needs as few as 4 samples (VAR-d30), compared with at least 200 for DMs.
- Data extraction recovers 698 training images from VAR-d30, 36 from RAR-XXL and 5 from MAR-H.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace naive LLM MIAs with conditional–unconditional output-difference signals | IAR-tailored MIA on VAR-d30 · ImageNet-1k train/validation | TPR@FPR=1%: 16.68 -> 94.57 | Helped |
| Replace naive LLM MIAs with conditional–unconditional output-difference signals | IAR-tailored MIA on RAR-XXL · ImageNet-1k train/validation | TPR@FPR=1%: 14.62 -> 49.80 | Helped |
| Increase inference masking ratio from 0.86 to 0.95 (ablation) | MAR MIA · ImageNet-1k train/validation | TPR@FPR=1%: +0.19; +0.36; +0.70 | Helped |
| Use fixed diffusion timestep t=500 (ablation) | MAR MIA · ImageNet-1k train/validation | TPR@FPR=1%: +0.00; +0.17; +0.42 | Mixed |
| Increase noise samples from 4 to 64 and average loss (ablation) | MAR MIA · ImageNet-1k train/validation | TPR@FPR=1%: +0.21; +0.20; +0.10 | Helped |
| Replace trained linear DI classifier with MinMax scaling and sum of MIA features | Dataset inference on IARs · ImageNet-1k train/validation | minimum samples P for dataset inference: VAR-d16: 2000 -> 600; VAR-d30: 20 -> 8 | Helped |
| Use IAR-tailored MIAs as DI feature extractors | Dataset inference on IARs · ImageNet-1k train/validation | minimum samples P for dataset inference: VAR-d30: 8 -> 4; VAR-d16: 600 -> 100 | Helped |
| Use a unified loss attack rather than model-tailored attacks | IARs compared with diffusion models · ImageNet-1k train/validation | TPR@FPR=1%: VAR-d30 4.95; RAR-XXL 5.73; DMs 0.84–1.08 | Mixed |
| Use a unified loss attack rather than model-tailored attacks | IARs compared with diffusion models · ImageNet-1k train/validation | minimum samples P for dataset inference: IARs: 40–6000; most DMs: >20000 | Mixed |
| Increase VAR model scale | VAR · ImageNet-1k train/validation | TPR@FPR=1%: 3.05 -> 94.57 | Helped |
Surprising findings
- Using a fixed timestep of t=500 for MAR is most discriminative, unlike t=100 for full-scale diffusion models.
- No memorization was found in token space; memorized images matched only in pixel space.
Limitations
- Evaluated only on ImageNet-1k class-conditional models; larger text-to-image IARs could not be assessed due to unknown training data.
- IAR and DM comparison is confounded by differences in model size, training duration, and objectives.
- Results were revised in this version after a VAR configuration bug; the ICML version numbers differ.
Experimental setup
Datasets: ImageNet-1k
Benchmarks: ImageNet-1k
Metrics: TPR@FPR=1% AUC accuracy dataset inference suspect-set size P number of extracted memorized samples (SSCD >= 0.75)
Baselines: Min-k% Prob Min-k%++ Zlib Hinge SURP CAMIA CLiD Loss Attack
Builds on: CLiD Min-k% Prob Dataset Inference VAR MAR
Closest papers by meaning
- Causal Evaluation of Membership Inference Attacks (NeurIPS 2026 · similarity 0.87)
- Assessing Per-Sample Membership Inference Vulnerability without Retraining (NeurIPS 2026 · similarity 0.86)
- Membership Inference Attacks on Diffusion Models via Quantile Regression (ICML 2024 · similarity 0.86)
- Towards Black-Box Membership Inference Attack for Diffusion Models (ICML 2025 · similarity 0.86)
- Privacy-Preserving Low-Rank Adaptation Against Membership Inference Attacks for Latent Diffusion Models (AAAI 2025 · similarity 0.86)
- Estimating Model-Level Membership Inference Vulnerability Without Reference Models (NeurIPS 2026 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.