Research map / Image generation / Fast diffusion sampling
Tracing the Roots: Leveraging Temporal Dynamics in Diffusion Trajectories for Origin Attribution
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a white-box framework that classifies images as training member, model-generated, or external by linear probing on diffusion denoising-loss trajectories and gradient features, challenging the Goldilocks-zone conjecture and extending to ternary origin attribution.
Problem
Verifying whether an image comes from a diffusion model's training set, its own generations, or external sources; existing loss-threshold membership inference fails under distribution shift and cannot separate model-generated from training data.
Approach
Use full-trajectory temporal features (denoising losses across all timesteps plus input and parameter gradients of the loss) with a linear probe, instead of a single intermediate timestep or a threshold, to unify membership inference and model attribution into ternary origin attribution.
Key results
- On CIFAR-10 member-vs-external MIA, the full-trajectory feature set reaches 86.5 AUC and 15.9 TPR@1%FPR, versus 82.7 AUC and 12.5 TPR for GSA.
- On CelebA-HQ 256 under FFHQ distribution shift, the threshold-based PIA attack drops to 62.5 AUC while the model-blind naive baseline reaches 94.4 AUC.
- For ternary origin attribution on CelebA-HQ 256, the full method reaches 99.3 AUC and 86.5 TPR@1%FPR versus 90.0 AUC for the naive baseline.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use loss features sampled uniformly across the full diffusion trajectory rather than sampling only within one timestep region | Trajectory-based MIA on CIFAR-10 · CIFAR-10 | AUC: 68.5, 68.1, 54.7, 50.7 -> 71.2 | Helped |
| Use trajectory loss and gradient features instead of GSA₂ | MIA · CIFAR-10 | TPR @ 1% FPR: 9.1$\pm$1.64 -> 12.0$\boldsymbol{\pm}$2.93 | Helped |
| Use trajectory loss and gradient features instead of GSA₂ | MIA · CIFAR-100 | TPR @ 1% FPR: 2.6$\pm$1.10 -> 9.4$\boldsymbol{\pm}$2.50 | Helped |
| Use loss and both input/model gradient features at every timestep rather than loss alone (ablation) | Origin attribution · CIFAR-10 | AUC: 71.6 -> 86.5 | Helped |
| Use loss and both input/model gradient features at every timestep rather than loss alone (ablation) | Origin attribution · CelebA-HQ 256 | AUC: 95.2 -> 99.3 | Helped |
| Use every timestep rather than every third timestep (ablation) | Origin attribution with loss and both gradient features · CIFAR-10 | AUC: 85.0 -> 86.5 | Helped |
| Use every timestep rather than every third timestep (ablation) | Origin attribution with loss and both gradient features · CelebA-HQ 256 | AUC: 98.8 -> 99.3 | Helped |
| Use loss and gradient features rather than loss alone (ablation) | Model attribution · CIFAR-10 | Average class-balanced accuracy: 64.1 -> 75.5 | Helped |
| Use loss and gradient features rather than loss alone (ablation) | Model attribution · CelebA-HQ 256 | Average class-balanced accuracy: 70.0 -> 76.5 | Helped |
| Replace stochastic trajectory features with deterministic PIA features (ablation) | MIA · CIFAR-10 and CelebA-HQ 256 | MIA performance | Hurt |
| Use threshold-based loss attacks instead of the model-blind baseline | MIA under distribution shift · CelebA-HQ 256 with FFHQ external data | AUC: 94.4 vs. 85.2; 62.5 | Hurt |
| Use the proposed trajectory features rather than the model-blind baseline | Origin attribution · CIFAR-10 | AUC: 51.5 -> 86.5 | Helped |
Surprising findings
- Threshold-based membership inference on CelebA-HQ is outperformed by a model-blind ResNet18 classifier under distribution shift.
- Spreading timesteps over the full diffusion process substantially boosts MIA performance, challenging the Goldilocks-zone conjecture.
Limitations
- Attacks are comparable in time to diffusion inference, making them much slower than existing MIAs.
- Failure cases on DDGAN and DDIM samples in model attribution; conditional accuracy can favor the model-blind baseline.
- Evaluated only on controlled external sets with small DDPM-family models; generalization to large foundation models and intraclass shifts is unexplored.
Experimental setup
Datasets: CIFAR-10 CelebA-HQ 256 CIFAR-10.1 FFHQ CIFAR-100
Benchmarks: CIFAR-10 CelebA-HQ 256 CIFAR-100
Metrics: AUC TPR @ 1% FPR ASR class-balanced accuracy
Baselines: loss thresholding (Carlini-style / Matsumoto-style threshold attack) PIA GSA naive model-blind ResNet18 classifier DDIM WaveDiff DDGAN
Builds on: GSA (gradient subsampling and aggregation) PIA Goldilocks zone conjecture DDPM
Closest papers by meaning
- Hierarchical Koopman Diffusion: Fast Generation with Interpretable Diffusion Trajectory (NeurIPS 2025 · similarity 0.90)
- On the Trajectory Regularity of ODE-based Diffusion Sampling (ICML 2024 · similarity 0.90)
- Cyclic Denoising Reveals Ultrastable Memories in Diffusion Models (NeurIPS 2026 · similarity 0.90)
- Understanding Representation Dynamics of Diffusion Models via Low-Dimensional Modeling (NeurIPS 2025 · similarity 0.90)
- Faster Diffusion: Rethinking the Role of the Encoder for Diffusion Model Inference (NeurIPS 2024 · similarity 0.90)
- Temporal Score Analysis for Understanding and Correcting Diffusion Artifacts (CVPR 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.