Towards Black-Box Membership Inference Attack for Diffusion Models

## Abstract

Abstract Identifying whether an artwork was used to train a diffusion model is an important research topic, given the rising popularity of AI-generated art and the associated copyright concerns.
The work approaches this problem from the membership inference attack (MIA) perspective. We first identify the limitations of applying existing MIA methods for copyright protection: the required access of internal U-nets and the choice of non-member datasets for evaluation.
To address the above problems, we introduce a novel black-box membership inference attack method that operates without needing access to the model’s internal U-net. We then construct a DALL-E generated dataset for a more comprehensive evaluation.
We validate our method across various setups, and our experimental results outperform previous works.

## 1 Introduction

Recently, there has been a surge in the popularity of generative models, with diffusion models in particular, gaining huge attention within the AI community [, , ]. These models have demonstrated remarkable capabilities across various tasks, including unconditional image generation [, ], text-to-image generation [, , ] and image-to-image generation []. This surge has given rise to powerful AI art models such as DALL-E 2 [], Stable Diffusion [] and Imagen []. The field of AI-generated art holds a promising future and is expected to have widespread impact.

Effective training of diffusion models requires high-quality data. It is thus crucial to design an algorithm that can identify whether a specific artwork has been used during the training of a model, thereby providing protection for these artworks and detecting misuse of data. This is a classic problem in the field of machine learning, first introduced by [] and named “membership inference attack”.

A series of studies have been conducted on membership inference attacks against diffusion models. [] was the first to examine this issue, utilizing the loss function values of diffusion models to determine whether an image is in the training set. [] and [] extended this work by relaxing the assumptions about model access requirements.

Despite great progress, previous methods are not yet ready for copyright protection in diffusion models for two reasons. First, most existing approaches heavily rely on checking whether the U-net of the model predicts noise accurately, which is not practical since most commercial diffusion models available today offer only API access, while the U-net remains hidden. We refer to MIA with access only to generated images as the *Black-Box MIA*. Second, existing evaluations for stable diffusion models primarily focus on content shifts in the data, while the shifts in art styles are not covered (illustrated in Figure 3).

To address the above issues, we propose a black-box membership inference attack method that does not require access to the U-net of the model. We posit that if we alter an image using the target diffusion model’s variation API, the sampling process will be captured by a region of “attraction” if the model has seen this image during training (illustrated in Figure 2). By quantifying the disparity between the resulting reconstructed image with the original, we can effectively determine whether the image was part of the training dataset.

We also construct a new evaluation dataset named LAION by DALL-E reflecting style shifts in data rather than content shifts. In addition to evaluating our methods on existing datasets across multiple models, we test MIA on the stable diffusion model to classify LAION by DALL-E from the ground truth training data LAION-5B.

The main contributions of this work are listed as follows:

- 1.
We propose a black-box membership inference attack method that does not require access to the model’s internal structure. Instead, we leverage the unique properties of diffusion models. Our method only involves using the model’s variation API to alter an image and compare it with the original one. We name our method ReDiffuse.
- 2.
We evaluate our method using DDIM and Stable Diffusion models on classical datasets, including CIFAR10, STL10-Unlabeled [], LAION-5B [], etc. Our method is shown to be effective and robust across datasets, and it outperforms the previous methods.
- 3.
We propose a new MIA evaluation dataset which is complementary to previous work. We use the image titles from LAION-5B as prompts for DALL-E’s API [] to generate images of the same contents but different styles. Under this setup, previous membership inference attack algorithms are no longer effective, while our method remains robust.

## 2 Related Works

#### Diffusion Model

The diffusion model, initially proposed by [], has achieved remarkable results in producing high-quality samples across a variety of domains. This ranges from image generation [, , ], audio synthesis [, , ], and video generation [, , ], etc. Among existing diffusion models, the Denoising Diffusion Probabilistic Model (DDPM) [] is one of the most frequently adopted. This approach introduces a dual-phase process for image generation: initially, a forward process gradually transforms training data into pure noise, followed by a reverse process that meticulously reconstructs the original data from this noise. Building on this model, there have been numerous follow-up studies, such as Stable Diffusion [], which compresses images into a latent space and generates images based on text, and the Denoising Diffusion Implicit Models (DDIM) [], which removes Gaussian randomness to accelerate the sampling generation process. These advancements demonstrate the versatility and potential of diffusion models.

#### Data Safety and Membership Inference Attack

In the era of big data, preserving data privacy is paramount, especially in training diffusion models using sensitive datasets like artists’ artworks, which are protected by copyright laws. Membership inference attacks, initially introduced by [], serve as an effective means to detect potential misuse of data without proper authorization.
Its objective is to ascertain whether a particular data sample participated in the training phase of a target model. This approach is instrumental in probing privacy breaches and identifying illicit data utilization. Researchers primarily focus on membership inference attacks for classification models [, , , ], embedding models [, , ], and generative models [, , ].

In the domain of membership inference attacks against diffusion models, [, ] use a white-box approach, which assumes access to the entire diffusion model and utilizes loss and likelihood to determine whether a sample is in the training set. More recently, [, , ] have relaxed these requirements, eliminating the need for the entire model. They leverage the insight that samples within the training set yield more accurate noise predictions, thereby achieving high accuracy in membership inference attack tasks. However, they also require the outputs of the U-net, as it is necessary to obtain the noise predictions of intermediate steps.

## 3 Preliminary

In this section, we begin by discussing several popular diffusion models. We first introduce the Denoising Diffusion Probabilistic Model (DDPM) []. Then, we extend to the Denoising Diffusion Implicit Model (DDIM) [], which is a variant of DDPM used to accelerate image generation. Lastly, we discuss the Stable Diffusion [], a model that condenses images into a latent space and generates images grounded in text descriptions.

#### Denoising Diffusion Probabilistic Model (DDPM)

A diffusion model provides a stochastic path between an image
and noise.
The forward process (denoted as $q$) iteratively incorporates Gaussian noise into an image, while the reverse process (denoted as $p_{\theta}$) gradually reconstructs the image from noise.

$$ $\displaystyle q(x_{t}\mid x_{t-1})$ $\displaystyle=\mathcal{N}(x_{t};\sqrt{1-\beta_{t}}x_{t-1},\beta_{t}\mathbf{I})\,,$ $\displaystyle p_{\theta}(x_{t-1}\mid x_{t})$ $\displaystyle=\mathcal{N}(x_{t-1};\mu_{\theta}(x_{t},t),\Sigma_{\theta}(x_{t}, t))\,,$ $$

where $\mu_{\theta}(\cdot)$ and $\Sigma_{\theta}(\cdot)$ are the mean and covariance of the denoised image parameterized by the model parameters $\theta$, and $\beta_{t}$ is a noise schedule that controls the amount of noise added at each step.

#### Denoising Diffusion Implicit Model (DDIM)

DDIM modifies the sampling process to improve efficiency while maintaining high-quality image generation. Unlike DDPM, which requires a large number of denoising steps, DDIM uses a non-Markovian process to accelerate sampling.

$$ $\displaystyle x_{t-1}=\phi_{\theta}(x_{t},t)=\sqrt{\bar{\alpha}_{t-1}}\left( \frac{x_{t}-\sqrt{1-\bar{\alpha}_{t}}\epsilon_{\theta}(x_{t},t)}{\sqrt{\bar{ \alpha}_{t}}}\right)+\sqrt{1-\bar{\alpha}_{t-1}}\epsilon_{\theta}(x_{t},t)\,,$ (1) $$

where $\bar{\alpha}_{t}=\prod_{k=0}^{t}\alpha_{k}$, $\alpha_{t}+\beta_{t}=1$ and $\epsilon_{\theta}(x_{t},t)$ is the noise predicted by the model at step $t$. This formulation requires fewer sampling steps without compromising the quality of the generated images.

#### Stable Diffusion

Stable Diffusion leverages a variational autoencoder (VAE) [] to encode images into a latent space and perform diffusion in this compressed space. The model uses a text encoder to guide the diffusion process, enabling text-to-image generation:

$$ $\displaystyle z_{t-1}\sim p_{\theta}(z_{t-1}\mid z_{t},\tau_{\theta}(y))\,, \quad x=\text{Decoder}(z_{0})\,,$ $$

where $x$ represents the output image, $z_{t}$ represents the latent variable at step $t$, and the text conditioning $\tau_{\theta}(y)$ is incorporated into the denoising process to generate the image. This approach significantly reduces computational costs and allows for high-quality image synthesis from textual descriptions.

## 4 Algorithm Design

In this section, we introduce our algorithm. We begin by discussing the definition of black-box API and the limitations of previous membership inference attack methods. In our formulations we assume DDIM as our target model. The formulations for DDPM is highly similar and we omit it for brevity. We will discuss the generalization to the latent diffusion model in Section 5.

### 4.1 Towards Black-Box MIA for Diffusion Models

Most previous works on membership inference attacks against diffusion models aim to prevent data leakage, and hence can rely on thresholding the model’s training loss. For instance, [] involves a direct comparison of image losses, while [, ] evaluates the accuracy of the model’s noise prediction at initial or intermediate steps. However, the required access to the model’s internal U-net structure prevent applications to copyright protection because most servers typically provide only black-box API access.

We denote a model API as black-box if it only requires the input image and returns the output image. Specifically, we do not have access to the internal structure of the model. Below we formulate the definition of the black-box variation API used in our algorithm.

###### Definition 1 (The black-box variation API) .

We define the variation API $V_{\theta}(x,t)$ of a model as follows. Suppose we have an input image $x$, and the diffusion step of the API is $t$. The variation API randomly adds $t$-step Gaussian noise $\epsilon\sim\mathcal{N}(0,I)$ to the image and denoises it using the DDIM sampling process $\phi_{\theta}(x_{t},t)$ as described in Equation 1, returning the reconstructed image $V_{\theta}(x,t)=\hat{x}$. The details are as follows:

$$ $\displaystyle x_{t}=\sqrt{\bar{\alpha}_{t}}x+\sqrt{1-\bar{\alpha}_{t}}\epsilon \,,\quad\hat{x}=\Phi_{\theta}(x_{t},0)=\phi_{\theta}(\cdots\phi_{\theta}(\phi_ {\theta}(x_{t},t),t-1),0)\,.$ (2) $$

This definition aligns with the image-to-image generation method of the diffusion model, making access to this API practical in many setups [, , ]. Some APIs provide the user with a choice of $t$, while others do not and use the default parameter. We will discuss the influence of different diffusion steps in Section 6.4, showing that the attack performances are relatively stable and not sensitive to the selection of $t$.
We also note that the for the target model, we can substitute $\phi_{\theta}(x_{t},0)$ with other sampling methods, such as the Euler-Maruyama Method [] or Variational Diffusion Models [].

Figure: Figure 1: The overview of ReDiffuse. We independently input the image to the black-box variation API $n$ times with diffusion step $t$. We take the average of the output images and compare them with the original ones. If the difference is below a certain threshold, we determine that the image is in the training set.
Refer to caption: extracted/5619526/figures/method.png

###### Definition 1 (The black-box variation API) .

### 4.2 Algorithm

In this section, we present our algorithm for black-box MIA. Our key intuition comes from the reverse SDE dynamics in continuous diffusion models [, ].
Specifically, one simplified form of the reverse SDE (i.e., the denoise step) has the formulation below:

$$ $\displaystyle\dot{X_{t}}=(X_{t}/2-\nabla_{x}\log p(X_{t}))+dW_{t}\,,\quad t\in [0,T]\,.$ (3) $$

where $W_{t}$ denotes a standard Brownian motion (with abuse of notation $t$) and $T$ is the generation time.

Figure: Figure 2: The intuition of our algorithm design. We denote $x$ as the target image, $x_{i}$ as the $i$-th image generated by the variation API, and $\hat{x}$ as the average image of them. For member image $x$, the difference $v=x-\hat{x}$ will be smaller after averaging due to $x_{i}$ being an unbiased estimator.
Refer to caption: extracted/5619526/figures/intuition.png

For a training data $x$, a score-based model $s_{\theta}(x)$ can be trained to fit $\nabla_{x}\log p(x)$ for image generation. The distribution $x_{0}\sim p_{0}\approx\delta_{x}$ is a delta distribution supported on the trained image $x$.

Then for a given image $x$, we generate $n$ noisy images $\{y_{i}\}_{i\leq n}$, $y_{i}=\beta_{T}x+(1-\beta_{T})\epsilon_{i}$, and then denoise to get $n$ reconstructed image $\{\hat{x}_{i}\}_{i\leq n}$. If the score function $s_{\theta}(x)$ is learned properly, we will generate the image satisfying the following distribution:

$$ $\displaystyle\hat{x}_{i}\sim\mathcal{N}(x,\sigma_{T}I),$ $$

where $\sigma_{T}$ is a constant determined by the injected noise level $\beta_{T}$.

The key guarantee is that when the score function is learned for a data point $x$, then the reconstructed image $\hat{x}_{i}$ is an unbiased estimator of $x$. Hence, averaging over multiple independent samples $\hat{x}_{i}$ would greatly reduce the estimation error (see Theorem 1). On the other hand, for a non-member image $x^{\prime}$, the unbiasedness of the denoised image is not guaranteed. We illustrate the intuition in Figure 2.

With the above intuition, we introduce the details of our algorithm. We independently apply the black-box variation API $n$ times with our target image $x$ as input, average the output images, and then compare the average result $\hat{x}$ with the original image. We will discuss the impact of the averaging number $n$ in Section 6.4. We then evaluate the difference between the images using an indicator function:

$$ $\displaystyle f(x)=\mathbf{1}[D(x,\hat{x})<\tau]\,.$ $$

Our algorithm classifies a sample as being in the training set if $D(x,\hat{x})$ is smaller than a threshold $\tau$, where $D(x,\hat{x})$ represents the difference between the two images. It can be calculated using traditional functions, such as the SSIM metric []. Alternatively, we can train a neural network as a proxy. In Section 6, we will introduce the details of $D(x,\hat{x})$ used in our experiment.

Our algorithm is outlined in Algorithm 1, and we name it ReDiffuse. The key ideas of our algorithm are illustrated in Figure 1, and we also provide some theoretical analysis in Theorem 1 to support it.

Figure: Algorithm 1 Black-Box MIA through ReDiffuse

### 4.3 Theoretical Analysis

To be concise, we denote $\|\cdot\|$ as the $L_{2}$ operator norm of a vector.
We have the following theorem showing that if we use the variation API to input a member $x\sim D_{\text{training}}$, then the error $\|\hat{x}-x\|$ from our method will be small with high probability.

###### Theorem 1 .

Suppose the DDIM model can learn a parameter $\theta$ such that, for any $x\sim D_{\text{training}}$, the prediction error $\|\epsilon-\epsilon_{\theta}(\sqrt{\bar{\alpha}_{t}}x+\sqrt{1-\bar{\alpha}_{t}
}\epsilon,t)\|$ is a centered random variable $X$ with finite cumulant-generating function []. We also assume the sampling interval $k$ is equal to the variation API diffusion step $t$. Let $\hat{x}$ be the average of $n$ output images of $x$ using the variation API. Then we have

$$ $\displaystyle\mathbb{P}(\|\hat{x}-x\|\geq\beta)\leq\exp(-n\Psi^{*}_{X}(\frac{ \beta\sqrt{\bar{\alpha}_{t}}}{\sqrt{1-\bar{\alpha}_{t}}}))\,,$ $$

where $\beta>0$ and $\Psi^{*}_{X}$ is the Fenchel-Legendre dual of the cumulant-generating function $\Psi_{X}$.

The theorem suggests that averaging the randomly variational data from a training set will result in a smaller relative error with high probability when we use a large $n$. We defer the proof of this theorem to Appendix C.

###### Theorem 1 .

## 5 MIA on Latent Diffusion Models

In this section, we discuss how we can generalize our algorithm to latent diffusion models. We will focus on stable diffusion [], as it is one of the most popular choices.

### 5.1 The Variation API and Modification to ReDiffuse

We note that the variation API for stable diffusion is different from DDIM, as it includes the encoder-decoder process. Again we denote $\hat{x}=V_{\theta}(x,t)$, and the details are as follows:

$$ $\displaystyle z=\text{Encoder}(x)\,,\quad z_{t}=\sqrt{\bar{\alpha}_{t}}z+\sqrt {1-\bar{\alpha}_{t}}\epsilon\,,\quad\hat{z}=\Phi_{\theta}(z_{t},0)\,,\quad\hat {x}=\text{Decoder}(\hat{z})\,.$ (4) $$

This definition aligns with the image generation process of the stable diffusion model.

Then we introduce the modification of our algorithm in this setup.
For DDPM or DDIM, we evaluate the difference between the reconstructed image and the original image. However, for images processed by the stable diffusion model, which are typically larger in size, directly comparing the restored image with the original may lead to drastic differences. To enhance our algorithm, we modify the decision function, by independently adding random noise to the original image twice and then comparing the differences between the two restored images $\hat{x}_{1}$ and $\hat{x}_{2}$:

$$ $\displaystyle f(x)=\mathbf{1}[D(\hat{x}_{1},\hat{x}_{2})<\tau]\,.$ $$

This modification has shown promising experimental results, as detailed in Section 6.3.
We refer to this improved version as “ReDiffuse+”.

### 5.2 LAION by DALL-E: A Style-shift Evaluation Dataset

Figure: Figure 3: Comparison of data used in our new experiment versus the previous work. It shows that our dataset, *LAION by DALL-E*, achieves minimal content differences from the original LAION-5B images. In contrast, the COCO dataset images used in previous works show significant content differences from the LAION-5B images, which could potentially impact the evaluation results.
Refer to caption: extracted/5619526/figures/dataset.png

The dataset used for evaluation of stable diffusion in prior studies [, ] possesses certain limitations. In the context of attacking stable diffusion, LAION-5B served as the in-training-set data, while the COCO dataset was designated as the out-of-training-set data. However, the inherent content disparities between these two datasets are considerable, shown in Figure 3. Therefore, the MIA algorithm’s capability to differentiate between them may not solely stem from whether the data was employed during training, but also from their content disparities.

Complementary to previous work, we propose a new evaluation dataset aimed at making the out-of-training-set data contain the same content as the training data but with different styles. Concretely, we use the textual descriptions from the LAION-5B dataset (which was used for training) to generate new images with the DALL-E model. We refer to this new dataset as “LAION by DALL-E” (shown in Figure 3). These generated images will serve as images that the stable diffusion model has not seen during training. By including this dataset in the evaluation, we achieve a more comprehensive evaluation of MIA methods for stable diffusion.

## 6 Experiments

In this section, we evaluate the performance of our methods across
various datasets and settings. We follow the same experiment’s setup in previous papers [, ]. The detailed experimental settings, including datasets, models, and
hyper-parameter settings can be found in Appendix A.

### 6.1 Evaluation Metrics

We follow the metrics used in previous papers [, ], including Area Under Receiver Operating
Characteristic (AUC), Attack Success Rate (ASR), the True Positive Rate
(TP) when the False Positive Rate is 1%. We also plot the ROC curves.

### 6.2 MIA with DDIM Models

We train a DDIM model on the CIFAR-10/100 [], STL10-Unlabeled [] and Tiny-Imagenet [] dataset, using the image generation step $T=1000$ and sampling interval $k=100$ (explained in Section 6.4).
For all the datasets, we randomly select 50% of the training samples to train the model and denote them as members. The remaining 50% are utilized as nonmembers. We take [], [], [] as our baseline method. We fix the diffusion step at $t=200$, and independently call the variation API 10 times to take the average of the output images as $\hat{x}$. We will discuss the impact of the diffusion step and the average number in Section 6.4.

**Table 1: Comparison of different methods on four datasets for the DDIM model. We use AUC, ASR and TP as the metrics, TP refers to the True Positive Rate when the False Positive Rate is 1%.**
| Method | CIFAR10 | CIFAR100 | STL10 | TINY-IN |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Algorithm | U-Net | AUC | ASR | TP | AUC | ASR | TP | AUC | ASR | TP | AUC | ASR | TP |
| Loss [] | $\Box$ | 0.88 | 0.82 | 14.2 | 0.92 | 0.84 | 20.9 | 0.89 | 0.82 | 15.6 | 0.94 | 0.87 | 29.4 |
| SecMI [] | $\Box$ | 0.95 | 0.90 | 40.7 | 0.96 | 0.90 | 44.9 | 0.94 | 0.88 | 26.9 | 0.97 | 0.94 | 48.4 |
| PIA [] | $\Box$ | 0.95 | 0.89 | 48.7 | 0.96 | 0.90 | 47.0 | 0.94 | 0.87 | 29.8 | 0.98 | 0.94 | 73.0 |
| PIAN [] | $\Box$ | 0.95 | 0.89 | 50.4 | 0.91 | 0.85 | 39.2 | 0.92 | 0.86 | 28.5 | 0.95 | 0.93 | 78.4 |
| ReDiffuse | $\blacksquare$ | 0.96 | 0.91 | 40.7 | 0.98 | 0.93 | 48.2 | 0.96 | 0.90 | 31.9 | 0.99 | 0.96 | 78.8 |

For the difference function $D(x,\hat{x})$, following the setup in [], we take the
pixel-wise absolute value of $x-\hat{x}$ to obtain a difference vector $v$ for each image. Using the ResNet-18 network [] and denoting it as $f_{R}$, we perform binary classification on these difference vectors. We use 20% of the data as the training set and obtained the label of each difference vector being classified as a member or nonmember. The difference function is obtained by the negative value of the probability predicting as member by the neural network: $D(x,\hat{x})=-f_{R}(v)$.

The result is shown in Table 1. Our method achieve high performance, surpassing several baseline algorithms in most setups, and does not require access to the internal structure of the model. This demonstrates that our algorithm is highly effective and robust.

### 6.3 MIA with the Stable Diffusion Model

We conduct experiments on the original Stable Diffusion model,
i.e., stable-diffusion-v1-5 provided by Huggingface, without further fine-tuning or modifications.
First, we follow the experiment setup of [, ], use the LAION-5B dataset [] as member and COCO2017-val [] as non-member. We randomly select 2500 images in each dataset. We test two scenarios:
Knowing the ground truth text, which we denote as Laion5 vs COCO; Generating text through BLIP [], which we denote as Laion5 BLIP vs COCO.

Next, given the inherent content differences between the COCO dataset and the LAION dataset, as discussed in Section 4, we also include a new evaluation dataset. We randomly generated 500 images using DALL-E 3, using prompts derived from the captions associated with each image in LAION-5. We refer to this new dataset as “LAION by DALL-E”. This dataset serves as the non-member set, while the corresponding 500 images from LAION-5 serve as the member set. This evaluation focuses on style shift rather than content shift between the datasets, enabling a more comprehensive evaluation of Stable Diffusion.

For the difference function $D(x,\hat{x})$, since the images in these datasets better correlate with human visual perception, we directly use the SSIM metric [] to measure the differences between two images. Additionally, because the image sizes in these datasets are relatively large, the differences between the original and reconstructed images are generally significant. Therefore, besides the basic algorithm, we also propose a simple variant of our algorithm (named ReDiffuse+) based on methods discussed in Section 4, involving altering the image by API twice independently and directly measuring the differences between the two variational images, rather than comparing the variational images to the original images.

**Table 2: Comparison of different methods for Stable Diffusion using the same set of metrics as Table 1. Again, previous methods require access to U-Net, whereas our methods do not.**
| Method | Laion5 vs COCO | Laion5 vs COCO with BLIP | Laion5 vs Laion5 by DALL-E |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| AUC | ASR | TP | AUC | ASR | TP | AUC | ASR | TP |  |
| Loss [] | 0.62 | 0.61 | 13.2 | 0.62 | 0.62 | 13.3 | 0.52 | 0.55 | 7.6 |
| SecMI [] | 0.70 | 0.65 | 19.2 | 0.71 | 0.66 | 19.8 | 0.66 | 0.64 | 15.2 |
| PIA [] | 0.70 | 0.66 | 19.7 | 0.73 | 0.68 | 20.2 | 0.65 | 0.62 | 14.9 |
| PIAN [] | 0.56 | 0.53 | 4.8 | 0.55 | 0.51 | 4.4 | 0.53 | 0.52 | 3.4 |
| ReDiffuse | 0.79 | 0.72 | 14.4 | 0.80 | 0.74 | 14.8 | 0.74 | 0.70 | 15.3 |
| ReDiffuse+ | 0.81 | 0.75 | 20.6 | 0.82 | 0.75 | 22.1 | 0.73 | 0.71 | 13.6 |

The results, presented in Table 2, demonstrate that our methods achieve high accuracy in this setup, outperforming baseline algorithms by approximately 10%. Notably, our methods do not require access to U-Net. In addition, previous methods perform poorly on the new evaluation dataset, failing to achieve effective membership inference attack detection. In contrast, our methods still achieve robust performance, indicating their ability to distinguish images in the training set even when differences in image content are excluded.

We also plot ROC curves for the Stable Diffusion model trained on Laion5 setups and the DDIM trained on CIFAR-10 in Figure 4. These curves further demonstrate the effectiveness of our algorithm.

Figure: Figure 4: The ROC curves of various methods trained on DDIM and Stable Diffusion. Left: Trained DDIM model on CIFAR-10. Right: Trained Stable Diffusion model on the LAION-5B dataset with the ground truth text from LAION-5B caption. Non-members are sampled from COCO. The curves show that our algorithm outperforms the baseline algorithms.
Refer to caption: extracted/5619526/figures/roc_cifar.png

### 6.4 Ablation Studies

In this section, we alter some experimental parameters to test the robustness of our algorithm.

#### The Impact of Average Numbers

We use different average numbers $n$ and test the influence on the results. The results are shown in Figure 5. We observe that in the DDIM setup, due to the smaller image size in the dataset (32x32), there is a certain variance in the images obtained from each reconstruction. Averaging the images from multiple independent samples as the output $\hat{x}$ can further improve accuracy. In the stable diffusion setup, since the image size in the dataset is larger (512x512), the reconstructed images are more stable and not influenced by perturbations at specific coordinates. Therefore, averaging multiple images is not necessary. The figures of ASR are also plotted in Appendix B.

Figure: Figure 5: The impact of average numbers. Left: DDIM model on CIFAR-10. Averaging can further improve the performance of our algorithm. Right: Stable Diffusion model on LAION-5. In the latter case, averaging does not improve performance.
Refer to caption: extracted/5619526/figures/auc_average_ddim.png

#### The Impact of Diffusion Steps

We adjust the diffusion step $t$ to examine its impact on the results. The experiments are conducted using the DDIM model trained on CIFAR-10 with diffusion steps for inference, ranging from 10 to 500, and the outcomes are presented in Figure 6. Our findings indicate that as long as a moderate step (50-300) is chosen, the attack performance remains excellent, demonstrating that our algorithm is not sensitive to the choice of $t$. This further underscores the robustness of our algorithm. We also plot the change of diffusion step for other datasets in the Appendix B.

Figure: Figure 6: The impact of diffusion steps. We train a DDIM model on the CIFAR-10 dataset and use different diffusion step for inference. We find that high accuracy can be achieved as long as a moderate step number is chosen. This opens up possibilities for practical applications in real-world scenarios.
Refer to caption: extracted/5619526/figures/noise_cifar10.png

#### The Impact of Sampling Intervals

In DDIM and the internal structure of Stable Diffusion, the model use a set of steps denoted by $\tau_{1},\tau_{2},\ldots,\tau_{T}$. It samples at each of these steps to create the image. The spacing between these steps is referred to as the sampling interval.

We change the sampling interval $k$ and check the influence on the results. As shown in Figure 7, we adjust this parameter for attacks on both DDIM and stable diffusion. We find that our method achieve high AUC values across different sampling intervals, demonstrating that our detection capabilities are not significantly limited by this parameter. Additionally, in Appendix B, we plot the effect of different sampling interval on ASR and find that the impact is minimal.

Figure: Figure 7: The impact of sampling intervals. Left: DDIM model on CIFAR-10. Right: Stable Diffusion model on LAION-5. We find that adjusting the sampling interval has a relatively small influence in the first case and does not affect our method in the latter case. This makes our algorithm applicable to more setups.
Refer to caption: extracted/5619526/figures/ddim_auc.png

## 7 Conclusion, Limitations and Future Directions

In this work, we introduce a novel black-box membership inference attack method specifically designed for diffusion models. Our approach only requires access to the variation API of the model, bypassing the need for internal network components such as the U-net. This represents a significant advancement for commercial diffusion models, which typically restrict internal access. We demonstrate the effectiveness of our approach across various datasets, showing that it achieves high accuracy in identifying whether an image was included in the training dataset. Our method offers a practical solution for protecting the copyright of artworks.

However, our method has some limitations, particularly the need for a moderate diffusion step $t$ of the variation API. Our algorithm does not achieve high accuracy if the diffusion step is very high. Additionally, it would be desirable if we could expand the moderate size of our newly proposed evaluation dataset.

Future work could aim to derive more robust algorithms that can be used for a wider range of diffusion step. Improving the interpretability of our method and extending it to other generative models are also valuable directions for further research.

## Appendix A Datasets, Models and Hyperparameters

We run experiments on DDIM and Stable Diffusion models, using an NVIDIA RTX 6000 graphics card for all experiments.

For DDIM, we follow the training hyperparameters of [] to train a DDIM model on the CIFAR-10/100 [], STL10-Unlabeled [], and Tiny-Imagenet [] datasets, using an image generation step of $T=1000$ and a sampling interval of $k=100$. The training iterations are set to 800,000. For all the datasets, we randomly select 50

We take [], [], and [] as our baseline methods. We use their codes from the official repositories and apply the optimal hyperparameters from their papers. For our algorithm, we fix the diffusion step at $t=200$ and independently call the variation API 10 times to take the average of the output images as $\hat{x}$.

For the Stable Diffusion experiments, we use the original Stable Diffusion model, i.e., stable-diffusion-v1-5 provided by Huggingface, without further fine-tuning or modifications. We follow the experimental setup of [, ], using an image generation step of $T=1000$ and a sampling interval of $k=10$. We use the LAION-5B dataset [] as the member set and COCO2017-val [] as the non-member set. We randomly select 2500 images from each dataset. We test two scenarios: knowing the ground truth text, denoted as Laion5 vs. COCO; and generating text through BLIP [], denoted as Laion5 BLIP vs. COCO. For the new dataset, we randomly generated 500 images using DALL-E 3, with prompts derived from the captions associated with each image in LAION-5. This dataset serves as the non-member set, while the corresponding 500 images from LAION-5 serve as the member set.

We use the hyperparameters from the papers [, ] to run the baseline methods. For our algorithms ReDiffuse  and ReDiffuse+, we fix the diffusion step at $t=10$ to call the variation API and directly use the SSIM metric [] to measure the differences between two images. Other hyperparameters remain the same as in the baseline methods.

## Appendix B More Experiment Results

In this section, we show other experiment results which is not in our main paper. We conduct more ablation studies.

#### The Impact of Average Numbers

We use different average numbers $n$ and test the influence on the results. Besides the figures of AUC in the main paper, the figures of ASR are also plotted in Figure 8. We observe that in the DDIM setup, averaging the images from multiple independent samples as the output further improves accuracy. In the Stable Diffusion setup, averaging multiple images is not necessary as it does not improve ASR performance.

Figure: Figure 8: The impact of average numbers. Left: DDIM model on CIFAR-10. Averaging can further improve the performance of our algorithm. Right: Stable Diffusion model on LAION-5. Averaging does not improve performance.
Refer to caption: extracted/5619526/supp_figures/asr_average_ddim.png

#### The Impact of Diffusion Steps

We adjust the diffusion step $t$ to examine its impact on the results. We plot the graphs for CIFAR100 (Figure 9), STL10 (Figure 10), and Laion5 vs. COCO (Figure 11). From the results, we see that our algorithm can achieve high performance over a wide range of diffusion steps, especially for Stable Diffusion. This opens up possibilities for practical applications in real-world scenarios.

Figure: Figure 9: The impact of diffusion steps. We train a DDIM model on the CIFAR-100 dataset and use different diffusion step for inference.
Refer to caption: extracted/5619526/supp_figures/noise_cifar100.png

Figure: Figure 10: The impact of diffusion steps. We train a DDIM model on the STL-10 dataset and use different diffusion step for inference.
Refer to caption: extracted/5619526/supp_figures/noise_stl10.png

Figure: Figure 11: The impact of diffusion steps. We use the Stable Diffusion model with the Laion5 vs. COCO dataset for evaluation and test different diffusion steps for inference. Specifically, using relatively small diffusion steps results in better performance.
Refer to caption: extracted/5619526/supp_figures/noise_stable.png

#### Impact of L p subscript 𝐿 𝑝 L_{p} italic_L start_POSTSUBSCRIPT italic_p end_POSTSUBSCRIPT norm

For the DDIM model, we train a neural network using the pixel-wise absolute value of $x-\hat{x}$ to obtain a difference vector v for each image. This corresponds to the
$L_{1}$ norm. Then we change the $L_{p}$ norm of our neural network classifier to see if it has any influence on the results. The results are in Figure 12:

Figure: Figure 12: The impact of $L_{p}$ norms. Our algorithm remains effective for $p=1,2,3,4$.
Refer to caption: extracted/5619526/supp_figures/auc_norm.png

From the results, we know that our algorithm is effective for $p=1,2,3,4$. We should not choose very large $p$ to train the neural network.

#### Impact of Sampling Intervals

We change the sampling intervals to see if there is any influence on the results. In addition to the AUC figures in the main paper, the ASR figures are also plotted in Figure 13. From the results, we observe that the different sampling intervals have minimal impact on ASR.

Figure: Figure 13: The impact of sampling intervals. Left: DDIM model on CIFAR-10. Right: Stable Diffusion model on LAION-5. We find that adjusting the sampling interval does not significantly affect the ASR.
Refer to caption: extracted/5619526/supp_figures/ddim_asr.png

## Appendix C Proof

In this section, we implement the proof of the theorem.
See 1

###### Proof.

We denote $x^{i}$ as the $i$-th output image of $x$ using the variation API. We denote the $i$-th Gaussian noise as $\epsilon^{i}$ and the forward process incur $x^{i}_{t}=\sqrt{\bar{\alpha}_{t}}x+\sqrt{1-\bar{\alpha}_{t}}\epsilon^{i}$.

As the sampling interval is equal to the variation API diffusion step $t$, we have

$$ $\displaystyle x^{i}-x$ $\displaystyle=\frac{x^{i}_{t}-\sqrt{1-\bar{\alpha}_{t}}\epsilon_{\theta}(\sqrt {\bar{\alpha}_{t}}x+\sqrt{1-\bar{\alpha}_{t}}\epsilon^{i},t)}{\sqrt{\bar{ \alpha}_{t}}}-x\,,$ $\displaystyle=\frac{\sqrt{\bar{\alpha}_{t}}x+\sqrt{1-\bar{\alpha}_{t}}\epsilon ^{i}-\sqrt{1-\bar{\alpha}_{t}}\epsilon_{\theta}(\sqrt{\bar{\alpha}_{t}}x+\sqrt {1-\bar{\alpha}_{t}}\epsilon^{i},t)}{\sqrt{\bar{\alpha}_{t}}}-x\,,$ $\displaystyle=\frac{\sqrt{1-\bar{\alpha}_{t}}}{\sqrt{\bar{\alpha}_{t}}}( \epsilon^{i}-\epsilon_{\theta}(\sqrt{\bar{\alpha}_{t}}x+\sqrt{1-\bar{\alpha}_{ t}}\epsilon^{i},t))\,.$ $$

If we denote the random variable $X_{i}$ represents $\|\epsilon^{i}-\epsilon_{\theta}(\sqrt{\bar{\alpha}_{t}}x+\sqrt{1-\bar{\alpha}
_{t}}\epsilon^{i},t))\|$, then we consider $S_{n}=\sum_{i=1}^{n}X_{i}$. From the assumption we know that all the $X_{i}$ are centered random variable $X$ with finite cumulant-generating function $\Psi_{X}(s)=\log E[e^{sX}]<+\infty$. Using the theorem of Chernoff-Cramer method for sums of IID RV [], we get the following probability inequality for any $\beta>0$:

$$ $\displaystyle\mathbb{P}(S_{n}\geq\beta)\leq\exp(-n\Psi^{*}_{X}(\frac{\beta}{n} ))\,.$ $$

Therefore, taking the definition of $\|\hat{x}-x\|=\|\frac{1}{n}\sum_{i=1}^{n}(x^{i}-x)\|\leq\frac{\sqrt{1-\bar{
\alpha}_{t}}}{n\sqrt{\bar{\alpha}_{t}}}S_{n}$, we get the following bound of the reconstruction error:

$$ $\displaystyle\mathbb{P}(\|\hat{x}-x\|\geq\beta)\leq\exp(-n\Psi^{*}_{X}(\frac{ \beta\sqrt{\bar{\alpha}_{t}}}{\sqrt{1-\bar{\alpha}_{t}}}))\,,$ $$

where $\beta>0$ and $\Psi^{*}_{X}(y)=\sup_{s>0}(sy-\Psi_{X}(s))$ is the Fenchel-Legendre dual of the cumulant-generating function $\Psi_{X}$. So averaging the randomly reconstructed data from a training set will result in a smaller reconstruction error with high probability of $\Theta(1-\exp(-n))$ when we use a large $n$.

∎

###### Proof.

## Peer Reviews

confidence: 4
contribution: 3
initial_rating: 6
presentation: 2
questions: Please refer to weaknesses.
soundness: 3
strengths: 1. This paper introduces a novel black-box MIA method that merely requires access to variation API, which makes it more practical and easy to perform.

2. The core idea of the proposed method is intuitive and effective, as demonstrated through both theoretical and experimental results.

3. The experiments are comprehensive. The proposed method is applied to three diffusion models and experiments are conducted on multiple datasets. Also, further ablation study for several key hyper-parameters and real application to DALL-E’s API are conducted.
summary: To provide protection for the artworks and detect misuse of data, this paper proposes a black-box membership inference attack for diffusion models used in image generation. It first gives a brief introduction to popular diffusion models. Then it introduces the black-box MIA method based on the variation API. The core idea of the method is based on the hypothesis that images used in the training set typically result in smaller reconstruction errors compared to images not in the training set. Experiments are conducted on several datasets, followed by further ablation studies and an application in a real-world setting.
weaknesses: 1. The written of this paper can be further improved. The motivation discussed in Introduction is not solid enough in my opinion.

2. Although many experiments are conducted, the analysis to the results is insufficient. For example, in Table 1, the TP value of REDOFFUSE on CIFAR-10 is much lower than others, while no analysis is provided. Also, there is a lack of analysis on why longer diffusion steps, an important factor affecting performance, seriously degrade the results. Potential solutions for this issue should also be discussed.

3. More cases should be provided to analyze the differences between member and non-member samples. But there is only one case in Sec.6.

---

confidence: 2
contribution: 3
initial_rating: 6
presentation: 3
questions: - Since the proposed idea is quite intuitive, have relevant ideas been proposed in other types of membership inference attack methods?
- Table 4 is vague, how to interpret the L1 and L2 distance as membership inference accuracy? 
- In general, is there a way to provide any confidence to the membership inference results? After all, any mistake could lead to wrong accuse for the diffusion API.
soundness: 3
strengths: - Clear and intuitive method. As someone who does not directly work on membership inference problems, the proposed methodology makes a lot of sense. I am not able to judge if prior works have proposed a similar idea before.
- The paper provides a good theoretical analysis of the effectiveness of the proposed method.
- The performance boost over prior works seems to be quite significant.
summary: This paper introduces a novel membership inference attack method that uses only the image-to-image variation API and
operates without access to the underlying model. The experimental results suggest that the model offers a significant boost over prior works.
weaknesses: - The paper should better discuss the connections between the proposed idea and prior works. For example, have relevant ideas been proposed in other types of membership inference attack methods?
- The abstract is too brief. The paper could benefit from elaborating the abstract with more insights of the proposed method and the key experimental results.

---

confidence: 4
contribution: 2
initial_rating: 5
presentation: 3
questions: 1. Can the proposed method further generalize to fine-tuning of diffusion models?

2. Although the DDIM model is widely used and much more effective than DDPM, can you still provide some results regarding the performance in DDPM?
soundness: 3
strengths: Strength:
1. The paper is well written and easy to follow.

2. The paper considers a broad range of model types, including DDIM, Stable Diffusion, and Diffusion Transformers and the proposed method performs well across different models.

3. The paper provides theoretical justification for the proposed method.
summary: This paper introduces a new membership inference attack method for diffusion models. Unlike previous approaches that require direct access to the U-Net component within the diffusion model, this method only needs access to the model’s variation API. Extensive experiments demonstrate the effectiveness of the proposed approach.
weaknesses: 1. **Practicality of the Scenario**: The paper assumes that the variation API allows users to conduct denoising by querying the model with noisy images and receiving denoised outputs. However, in most real-world APIs for diffusion models (e.g., Stable Diffusion 3 API [1]), users typically only have access to final generated images and cannot query intermediate denoising stages. Therefore, while the proposed attack method does not require model parameter access, it may not be feasible for API-only models. If there are any API-only models with accessible variation APIs, it would be helpful if the authors could provide references to these in the rebuttal.

2. **Lack of a Comparison of Computational Requirements**: As mentioned in Weakness 1, although the paper suggests that the method can operate in a black-box setting, its reliance on denoising queries rather than direct image generation could limit its applicability similarly to “white-box” approaches. Therefore, it is reasonable and necessary to have more comparison, particularly of computational resource requirements, because it seems that the proposed method may require more computational resources compared with the baselines.

3. **Clarity of Algorithm Explanation**: The intuition behind the proposed algorithm in Section 4.2 is not clear enough. The statement, “If the noise prediction from the neural network exhibited high bias, the network could adjust to fit the bias term, further reducing the training loss,” is ambiguous. What specifically is meant by “bias” here, and why does this lead to the condition $ \nabla_\theta L(\theta) = 0$ for a well-trained model? While the method itself is intuitive, a more thorough explanation in this section would improve clarity.

[1] Stability AI. (2024). Stable Diffusion 3 API. Stability AI. Available from https://stability.ai/news/stable-diffusion-3-api

---

confidence: 2
contribution: 3
initial_rating: 5
presentation: 2
questions: -Could authors provide more detailed discussion or explanation on the experiemnt results precented in Table 1?
-Could authors clarify the challenges that will be encountered while implementing MIA without accessing to the internal U-net, as well as how the author effectively addresses these challenges?
soundness: 2
strengths: -This article aims to identify whether an artwork was used to train a diffusion model without accessing to the model's internal U-net, which is an Interesting and relevant topic that fits within the scope of the conference.
- Novelty. The article proposes a novel membership inference attack method based on an image-to-image transformation API.
- The author(s) performed several experiments, and try to validate the effectiveness of the proposed method.
summary: This article explores the limitations of SOTA methods in addressing the significant problem of identifying whether an artwork has been used to train a diffusion model, i.e., the required access of internal U-nets. To this end, this paper proposes a new membership inference attack method that is based on an image-to-image transformation API without accessing to the model's internal U-net. The experimental results reflect the effectiveness of this method to some extent.
weaknesses: - A certain part of experimental results reveal that the proposed method can only achieve very limited improvements over the existing SOTA methods. For example, as shown in Table 1, the proposed method only improves by about 1-3% on most metrics, and even performs worse than the SOTA method PIAN on the TP metric for CIFAR10. Unfortunately, the authors did not discuss or explain this in the paper. Therefore, the effectiveness of the proposed method is questionable.
-The organization of this paper lacks clarity. The author does not clarify why it is difficult to implement MIA without access to the internal U-net, what challenges will be encountered, and how the author effectively addresses these challenges. Without this crucial information, it is difficult to evaluate the significance of the authors’ work.
- The organization of this paper is poor. In the ablation experiments, the author attempts to test the impact of experimental parameters on the robustness of the algorithm; however, the evaluation metric is one-sided (i.e., only AUC). Hence, the experiment results are therefore difficult to be convincing. While we note that the author seems to provide more contents in the appendix, but these contents exceed the page limits of the paper and should not be considered.
- The application experiments may have biases, as the author only conducts the evaluations on a single model (DALL-E) and relies on a small dataset (i.e., only 30 famous paintings and 30 generated paintings). Hence, the experiment results are therefore difficult to be convincing. Without comprehensive experiments, the effectiveness of the proposed methods cannot be validly verified.

The paper requires an in-depth editorial review. The authors are recommended to examine structure, argumentation, and language clarity to ensure the paper meets high-quality standards. For example, the equation numbering in the paper is chaotic, and the format of Algorithm 1 lacks indentation

Meta-review: The paper introduces a membership inference attack method that uses only the image-to-image variation API. In terms of overall score, the reviewers were mildly positive (2x) or mildly negative (2x). In terms of strength, the reviewers highlighted that the method was intuitive and comes with a theoretical justification. In terms of weaknesses, the reviewers had concerns regarding the presentation/motivation, experimental evaluation and gain with respect to the state of the art, and computational complexity.  As a consequence, I am unable to recommend acceptance.

Decision: Reject