Research map / Image generation / Fast diffusion sampling

CPSample: Classifier Protected Sampling for Guarding Training Data During Diffusion

ICLR 2025 · Image generation › Fast diffusion sampling · approach: Diffusion theory and design space · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes CPSample, which trains a classifier to memorize random binary labels on training images and uses its guidance during diffusion sampling to steer generations away from training data replicas, without retraining the denoiser.

Problem

Diffusion models replicate training images, especially on small or duplicated datasets, creating privacy and copyright risks; prior protections (DP training, ambient masking) degrade image quality and require retraining.

Approach

Overfit a classifier on random Bernoulli labels attached to training data, then apply classifier guidance at sampling time whenever the classifier confidently assigns a label to the current sample, pushing it toward the opposite label and away from the memorized training set, acting like a built-in rejection sampler.

Key results

• CPSample achieves FID 4.97 on CIFAR-10 and 2.97 on CelebA versus 9.8 for DP-Diffusion (CIFAR-10) and 11.70 for Ambient on CIFAR-10.
• On CIFAR-10, the fraction of generated images with similarity above 0.97 drops from 6.25% (DDIM) to 0.00% with CPSample (alpha=0.001, scale=1).
• CPSample with alpha=0.5 adds little inference overhead: about 26.1 s vs 23.92 s per image for standard Stable Diffusion.

Measured effects reported in the paper

Surprising findings

• A very low alpha yields higher membership-inference p-values, which the authors find counterintuitive and attribute to targeted guidance around training points.
• CPSample with random labels can fail to protect when exact duplicates in training data receive opposite labels.

Limitations

• Hard to train binary-label classifiers on large datasets and maintain Lipschitz control; instability for Stable Diffusion with few training images.
• Exact duplicates with opposing random labels can undermine protection.
• Formal guarantees depend on Lipschitz constants that are hard to measure, so practical bounds are unclear; not strictly differentially private.

Experimental setup

Datasets: CIFAR-10 CelebA LSUN Church

Benchmarks: CIFAR-10 CelebA LSUN Church

Metrics: FID cosine similarity in FAISS/DINO feature space p-value of log-rank test membership inference test statistic (reconstruction error di

Baselines: DDIM Ambient diffusion DPDM DP-Diffusion DP-LDM PACPD Stable Diffusion v1.4

Builds on: DDIM classifier guidance Ambient diffusion DP-SGD FAISS

Closest papers by meaning

• Consistent Diffusion Meets Tweedie: Training Exact Ambient Diffusion Models with Noisy Data (ICML 2024 · similarity 0.87)
• Training-Free Safe Denoisers for Safe Use of Diffusion Models (NeurIPS 2025 · similarity 0.87)
• Sparsely Supervised Diffusion (NeurIPS 2026 · similarity 0.87)
• Elucidating the design space of classifier-guided diffusion generation (ICLR 2024 · similarity 0.87)
• Hiding Images in Diffusion Models by Editing Learned Score Functions (CVPR 2025 · similarity 0.87)
• Shielded Diffusion: Generating Novel and Diverse Images using Sparse Repellency (ICML 2025 · similarity 0.87)