Setups
Datasets and models. For the fine-tuning setting,
we select 416/417 samples on Pokémon [ 27 ] , 2500/2500 samples on MS-COCO [ 29 ] and 10,000/10,000 samples on Flickr [ 57 ] as the member/hold-out dataset, respectively. These three datasets involve diverse data distributions and dataset sizes.
We use the most widely used text-to-image diffusion model, Stable Diffusion v1-4 1 1 1 https://huggingface.co/CompVis/stable-diffusion-v1-4 [ 8 ] , as the target model to fine-tune it on these three datasets.
For the pre-training setting,
we utilize LAION dataset [ 45 ] to conduct experiments on Stable Diffusion v1-5 2 2 2 https://huggingface.co/runwayml/stable-diffusion-v1-5 [ 41 ] .

Training setups. Previous membership inference on text-to-image diffusion models usually relies on strong overfitting settings. To evaluate the performance more realistically, we consider the two following setups for fine-tuning: (1) Over-training. Following the previous works [ 11 , 23 , 13 ] , we fine-tune 15,000 steps on Pokemon datasets, and 150,000 steps on MS-COCO and Flickr (with only 2500/2500 dataset size). (2) Real-world training. Considering that trainers typically do not train for such high steps, we recalibrate the steps based on the
training steps/dataset size ratio (approximately 20) of official fine-tuning scripts on Huggingface [ 19 ] . Thus, we train 7,500 steps, 50,000 steps and 200,000 steps for the Pokémon, MS-COCO and Flickr datasets, respectively. Additionally, we employ the default data augmentation (Random-Crop and Random-Flip [ 20 ] ) in training codes [ 20 ] to simulate real-world scenarios.

Baselines. We broadly consider existing member inference methods applicable to text-to-image diffusion models as our baselines: Loss-based inference [ 32 ] , SecMI {}_{\text{stats}} (SecMI) [ 11 ] , PIA [ 23 ] , PFAMI {}_{\text{Met}} (PFAMI) [ 13 ] and an additional method of directly conducting Monte Carlo estimation (M. C.) on Eq. ( 15 ) for comparison. For all baselines, we use the parameters recommended in their papers.
We omit some membership inference methods for generative models [ 30 , 5 , 14 ] , as they have been shown ineffective for diffusion models in previous works [ 11 , 13 ] .

Evaluation metrics. We follow the widely used metrics of previous works [ 3 , 4 , 11 , 23 , 13 ] , including ASR (i.e., the accuracy of membership inference), AUC and the True Positive Rate (TPR) when the False Positive Rate (FPR) is 1% (i.e., TPR@1%FPR).

Implementation details. Our evaluation follows the setup of representative membership inference works [ 3 , 4 ] .
It is important to note that some implementations [ 21 , 24 ] of previous works assume access to a portion of the exact member set and the hold-out set to obtain a threshold for calculating ASR or to train a classification network [ 21 ] . This assumption does not align with real-world scenarios. Therefore, we strictly adhere to the fundamental assumption of membership inference [ 3 , 13 ] : knowing only the overall dataset without any knowledge of the member set and the hold-out set data points. Hence, we firstly train a shadow model to obtain the \alpha for Eq. ( 16 ), classifiers for Eq. ( 18 ) and the threshold \tau for
calculating ASR with auxiliary datasets of the same distribution. Then we perform the test on the target models.
Other implementation details are provided in Appendix D .