Implementation of CLiD-MI
In practice, calculating Eq. ( 12 ) needs a Monte Carlo estimate for data point by
sampling N times using (t_{i},\epsilon_{i}) pairs, with \epsilon_{i}\sim\mathcal{N}(\mathbf{0},\mathbf{I}) and t_{i}\sim[1,1000] . Performing two Monte Carlo estimations independently incurs high computational costs, resulting in 2\times N query count, where N is typically a large number to ensure accurate estimation. To simplify computation, we instead perform Monte Carlo estimation on the difference of the ELBOs inspired by [ 28 ] :

\mathbb{I}(\mathbf{x},\mathbf{c})=\mathbb{E}_{t,\mathbf{\epsilon}}\left[||\mathbf{\epsilon}_{\theta}(\mathbf{x}_{t},t,\mathbf{c}_{null})-\epsilon||^{2}-||\mathbf{\epsilon}_{\theta}(\mathbf{x}_{t},t,\mathbf{c})-\epsilon||^{2}\right]

In experiments, to further mitigate randomness, we also consider diverse reduced conditions along with \mathbf{c}_{\text{null}} , forming the reduced condition set \mathbb{C}=\{\mathbf{c}^{*}_{1},\mathbf{c}^{*}_{2}...,\mathbf{c}^{*}_{k}\} , where we set \mathbf{c}^{*}_{k}=\mathbf{c}_{\text{null}} . Then we compute multiple condition likelihood discrepancies:

\mathcal{D}_{\mathbf{x},\mathbf{c},\mathbf{c}^{*}_{i}}=\mathbb{E}_{t,\mathbf{\epsilon}}\left[||\mathbf{\epsilon}_{\theta}(\mathbf{x}_{t},t,\mathbf{c}^{*}_{i})-\epsilon||^{2}-||\mathbf{\epsilon}_{\theta}(\mathbf{x}_{t},t,\mathbf{c})-\epsilon||^{2}\right], (14)

where \mathbf{c}_{i}^{*}\in\mathbb{C} . In subsequent parts, we employ their mean or treat them as feature vectors to expose member information. We will introduce how to obtain \mathbb{C} in Sec. 3.5 .

Combining p_{\theta}(\mathbf{x}|\mathbf{c}) for further enhancement. Recall that the practical significance of sample likelihood is the probability that a data point originates from the model distribution, which essentially can also be used to assess membership.
Due to the monotonicity of the log function, we can also use ELBO of Eq. ( 5 ) to estimate p_{\theta}(\mathbf{x}|\mathbf{c}) :

\mathcal{L}_{\mathbf{x},\mathbf{c}}=-\mathbb{E}_{t,\mathbf{\epsilon}}\left[||\mathbf{\epsilon}_{\theta}(\mathbf{x}_{t},t,\mathbf{c})-\epsilon||^{2}\right]

Additionally, this estimation can reuse results from estimating Eq. ( 14 ), thus obviating any additional query counts. Next, we consider two strategies to combine Eq. ( 14 ) and Eq. ( 15 ) to construct the final membership inference method.

Threshold-based attack– \text{CLiD}_{th} . First, we normalize the two indicators to the same feature scale. Due to the outliers in the data, we use Robust-Scaler: \mathcal{S}(a_{i})=(a_{i}-\tilde{a})\big{/}IQR , where a_{i} denotes the i -th value, \tilde{a} denotes the mean and IQR (interquartile range) is defined as the difference between the third quartile (Q3) and the first quartile (Q1) of the feature. Then we have:

\mathcal{M}_{CLiD_{th}}(\mathbf{x},\mathbf{c})=\mathbbm{1}\left[\alpha\cdot\mathcal{S}(\frac{1}{k}\sum_{i}^{k}\mathcal{D}_{\mathbf{x},\mathbf{c},\mathbf{c}^{*}_{i}})+(1-\alpha)\cdot\mathcal{S}(\mathcal{L}_{\mathbf{x},\mathbf{c}})>\tau\right], (16)

where k denotes the total number of reduced \mathbf{c}^{*} (i.e., k=\left|\mathbb{C}\right| ), and \alpha is a weight parameter.

Vector-based attack– \text{CLiD}_{vec} . We combine the estimated values of Eq. ( 14 ) and Eq. ( 15 ) to obtain the feature vectors corresponding to each data point:

\mathbf{V}=\begin{pmatrix}\mathcal{D}_{\mathbf{x},\mathbf{c},\mathbf{c}^{*}_{1}},\mathcal{D}_{\mathbf{x},\mathbf{c},\mathbf{c}^{*}_{2}}\ldots\mathcal{D}_{\mathbf{x},\mathbf{c},\mathbf{c}^{*}_{k}},\mathcal{L}_{\mathbf{x},\mathbf{c}}\end{pmatrix}

We use a simple classifier to distinguish feature vectors in order to determine the membership of the samples:

\mathcal{M}_{CLiD_{vec}}(\mathbf{x},\mathbf{c})=\mathbbm{1}\left[\mathcal{F}_{\mathcal{M}}(\mathbf{V})>\tau\right], (18)

where \mathcal{F}_{\mathcal{M}} denotes the predict confidence of the classifier.