An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initialization
Authors: Fei Kong
Jinhao Duan
RuiPeng Ma
Heng Tao Shen
Xiaoshuang Shi
Xiaofeng Zhu
Kaidi Xu
Venue: ICLR 2024 poster (2024)
Keywords: MIA
Diffusion Model
Text-To-Speech
Primary area: societal considerations including fairness, safety, privacy

Abstract: Recently, diffusion models have achieved remarkable success in generating tasks, including image and audio generation. However, like other generative models, diffusion models are prone to privacy issues. In this paper, we propose an efficient query-based membership inference attack (MIA), namely Proximal Initialization Attack (PIA), which utilizes groundtruth trajectory obtained by $\epsilon$ initialized in $t=0$ and predicted point to infer memberships. Experimental results indicate that the proposed method can achieve competitive performance with only two queries that achieve at least 6$\times$ efficiency than the previous SOTA baseline on both discrete-time and continuous-time diffusion models. Moreover, previous works on the privacy of diffusion models have focused on vision tasks without considering audio tasks. Therefore, we also explore the robustness of diffusion models to MIA in the text-to-speech (TTS) task, which is an audio generation task. To the best of our knowledge, this work is the first to study the robustness of diffusion models to MIA in the TTS task. Experimental results indicate that models with mel-spectrogram (image-like) output are vulnerable to MIA, while models with audio output are relatively robust to MIA. Code is available at https://github.com/kong13661/PIA.

Published as a conference paper at ICLR 2024
AN EFFICIENT MEMBERSHIP INFERENCE ATTACK FOR THE DIFFUSION MODEL BY PROXIMAL INITIALIZTIONN
Fei Kong' Jinhao 2uan Ruipeng Ma!
Hengtao Shen'
Xiaoshuang Shi!
Xiaofeng Zhu
Kaidi Xu?*
'University of Electronic Science and Technology of China
Drexel University kong136 www.eeeeeoooooo.oooooooooooo com kx46@drexel.edi
ABSTRACT
Recently, diffusion models have achieved remarkable success in generating tasks, including image and audio generation. However, like other generative models, diffusion models are prone to privacy issues. In this paper, we propose an efficient query-based membership inference attack (MIA), namely Proximal Initialization Attack (PIA), which utilizes groundtruth trajectory obtained by initialized in = O and predicted point infer memberships. Experimental results indicate that the proposed method can achieve competitive performance with only two queries that achieve at least 6x efficiency than the previous SOTA baseline on both discrete- and continuous- diffusion models have focused on vision tasks without considering audio tasks. Therefore, also explore the robustness of diffusion models MIA in the text-to- speech (TTS) task, which is an audio generation task. To the best of our knowledge, this work is the first study the robustness of diffusion models MIA in the TTS task. Experimental results indicate that models with mel-spectrogram (image-like output are vulnerable to MIA, while models with audio output are relatively robust to MIA. Code is available at httpt::: /:g:::/gtttttt com con:/Kong13661/P11
diffusion models. Moreover, previous works on the privacy
INTRODUCTION
Recently, the diffusion model Ho et al. (2020); Song et al. (2021b); Song & Ermon (2019) has emerged as a powerful approach in the field of generative tasks, achieving notable success in image
generation Rombach et al. (2022); Saharia et al. (2022), audio generation Popov et al. (2021); Kong et al. (2021), video generation Yang et al. (2022); Ho et al. (2022), and other domains. However, like other generative models such as GANs Goodfellow al. 2020) and VAEs Kingma & WWeling (2013): Xu et al. (202T), }, the diffusion model may also be exposed to privacy risks) Bommasani et al.
12021 and copyright disputes Hristov (2016). Dangers such privacy leaks Phham & Le (2020) and data reconstruction Zhang et al. (020) may compromise the model. Recently, some researchers have
explored this topic Duan et al. (2023): Matsumoto et al. (2023): Hu & Pang] (2023); Carlini al.
(2023), demonstrating that diffusion models are also vulnerable to privacy issues.
Membership Inference Attacks (MIAs) are the most common privacy risks Shokri al. 2017). MIAS can cause privacy concerns directly and can also contribute to privacy issues indirectly as part of data reconstruction. Given pre-trained model, MIA aims determine whether a sample is in the training set or not.
Generally speaking, MIA relies on the assumption that a model fits the training data better Yeom et al. (2018); (hookri et al. (2017), resulting in smaller training loss. Recently, several MIA techniques have been proposed for diffusion models Duan et al. (2023); Matsumoto et al. (2023) Hu & Pang (2023). We refer to the query-based methods proposed in Matsumoto al. (2023) Hu & Pang (2023) as Naive Attacks because they directly employ the training loss for the attack. However, unlike GANs
Hu
VAEs, the training loss for diffusion models is not deterministic because it requires the generation of Gaussian noise. The random Gaussian noise may not be the one in which diffusion models fit best.
"qqual corresponding author

---

Published as a conference paper at ICLR 2024
member sample
non- member sample
metrics. Eq.(9) Eq.(14)
Target model
Generated output
Threshold
c
member
non- non-member
A overview of PIA. First, a sample is an input into the target model to generate at time Next, we combine the original sample with and input them into the target model to generate at time t. After that, we input all three variables into metric and use threshold determine the sample belongs to the training set.
Figure I:
This can negatively impact the performance of the MIA attack. To address this issue, the concurrent work SecMI et al. (2023) adopts an iterative approach to obtain the deterministic æ at a specific time f, but this requires more queries, resulting in longer attack times. As models grow larger, the time required for the attack also increases, making time an important metric to consider.
To reduce the time consumption, inspired by DDIM and SecMI, we proposed Proximal Initialization Attack (PIA) method, which derives its name from the fact that we utilize the diffusion model's s output time 0 as the noise PIA is query-based MIA that relies solely the inference results and can be applied not only to discrete time diffusion models Ho et al. 2020); |Rombach et al. (2022) but also to continuous time diffusion models Song et al. (2021b). We evaluate the effectiveness of our method on three image datasets, CIFAR 10 Krizhevsky et al. (2009), CIFAR 100 and TinyImageNet for DDPM and on two images dataset, COCO2017 [in al. (014) and Laion5B Schuhmann et al. (2022) for Stable DIffuion, well three audio datasets, SSSeeech Ito & Johnson (2017). VCTK
Junichi al. 2019), and LibriTTS Zen et (2019).
To our knowledge, recent research on MIA of diffusion models has only focused on image data, and there has been no exploration of diffusion models the audio domain. However, audio, such as music, encounters similar copyright and privacy concerns those in the image domain CNN (2022); WashingtonPost (2022). Therefore, it is essential to conduct privacy research in the audio domain to determine whether audio data is also vulnerable to attacks and to identify which types of diffusion models are more robust against privacy attacks. To investigate the robustness conduct experiments using Naive Attack, SecMI[Duan et al. (2023), and proposed method on three audio models: Grad-TTS Popov et al. (2021). Wave Kong et al. (2021). and FastDiff Huang al. (2022). The results suggest that the robustness of MIA on audio depends the output type of the model.
MIA on audio data,
Our contributions can be summarized as follows:
We propose query-based MIA method called PIA. Our method employs the output at t = 0 as the initial noise and the errors between the forward and backward processes as the attack metric. We generalize the PIA on both discrete-time and continuous-time diffusion models.
Our study is the first to evaluate the robustness of MIA audio data. We evaluate the robustness of MIA on three TTS models (Grad-TTS, DiffWave, FastDiff) and three TTS datasets (LJSpeech, VCTK, Libritts) using Naive Attack, SecMI, and our proposed method.
Our evaluations show that PLA matches SecMI's AUC performance and outperforms it in TPR 1% FPR, while being 5-10 times faster. Moreover, our data imply that in text-to- speech tasks, models producing audio image-like mel-spectrsgramss We therefore suggest using audio-output generation models minimize privacy risks in audio creation tasks.
resistant to MIA attacks than those generating
2

---

Published as a conference paper at ICLR 2024
2 RELATED WORKS AND BACKGROUND
Generative Diffusion Models Generative diffusion models have recently achieved significant
success in both image Ramesh al. (0022); ; Rombach al. (2022): Yuan al. (2023a) and audio
generation tasks Huang et al. (2022); Chen el al. (2021); Popov et al. (202I). Unlike GANs Good fellow al. (2020): Yuan & Moghaddam (0200] Yuan et al. (2023b), which consist of generator
and a discriminator, diffusion models generate samples by fitting the inverse process of a diffusion
process from Gaussian noise. Compared to GANs, diffusion models typically produce higher quality
samples and avoid issues such checkerboard artifacts [Salimans et al. (2016); Donahue et al. (2117) Dumoulin et al. 2017). A diffusion process is defined as a; = Va + ViLE,,, Er ~ NO, where Ct 3 I and Br increases gradually as increases, that eventually, Tt approximates a random Gaussian noise. In the reverse diffusion process, x/ still follows a Gaussian distribution, assuming the variance remains the same as in the forward diffusion process, and the mean is defined
8, 2t VI-a. Eo E0(22,, t)). where āg = II aj and ā₂ + B, = 1. The reverse diffusion
as f4
Vit
process becomes Iz-1 f4, + VBCc, (O,I)). One can obtain loss function Eq. (1) by minimizing the distance between the predicted and groundtruth distributions. [Song et al. (2021b)
transforms the discrete-time diffusion process into a continuous-time process and uses SDE Stochas- tic Differential Equation) to express the diffusion process. To accelerate the generation process, several methods have been proposed, such as Salimans & Ho/ (2022); Dockhorn et al. (2022); Xiao jet al. (2022). DDIM Song et al. (202Ta) is another popular method that proposes a forward process different from diffusion process with the same loss function as DDPM, allowing reuse the model trained by DDPM while achieving higher generation speed.
L = E [|e - (Vārzo + VT tt,,)))))
(1)
Membership Inference Privacy Different from conventional adversarial attacks Xu et al. (2018) 2020); et al. (2022), Membership inference attack (MIA)SSokriii et (2017) ais to determine whether a sample part of the training data. It can be formally described as follows: given two sets, the training set D, and the hold-out set Dr, target model m, and a sample æ that either belongs to Dj or Dr, the goal of MIA is to find classifier or function fax m) that determines which set belongs to, with f(x, m) E {0, 1} and f(x, = 1 indicating that æ Dj and f m) 0 indicating that x E Dj., If a membership inference attack method utilizes a model's output obtained through queries to attack the model, it is called query-based attac&Duan et al. (2023): Matsumoto et al. 20 Hu & Pang (2023). Typically, MIA is based on the assumption that training data has a smaller loss compared to hold-out data. MIA for generation tasks, such GANs (Phmm & Le (2020)
and VABs Hilprecht et al. 2019); Chen et al. 22000), has also been extensively researched.
Recently, several MIA methods designed for diffusion models have been proposed. Matsumoto et al. (2023) proposed a method that directly employs the training loss Eq. (1) and find a specific / with maximum distinguishability. Because they directly use the training loss, we refer to this method as
Naive Attack. DecM[Duan et al. (2023) improves the attack effectiveness by iteratively computing the f-error, which is the error between the DDIM sampling process and the inverse sampling process at certain toment
Threat model We follow the same threat model as Duan al. 2003)) which needs to access intermediate outputs of diffusion models. This is a query-based attack without the knowledge of model parameters but not fully end-to-end black-box. (2022), and classification Li et al. (2023), they also employ the intermediate output of the diffusion model. These works utilize a pre-trained model on a huge dataset to do other tasks, such as inpainting. and classification without fine-tuning. To meet these requirements, future service providers might consider opening up APIs for intermediate outputs. Our work is applicable to such scenarios.
scenarios such as inpainting Lugmayr et al.
3 METHODOLOGG
In this section, we introduce DDIM, a variant of DDPM, and provide a proof that we know any two points in the DDIM framework, æ& and æu, determine any other point x;, We then propose new MIA method that utilizes this property to efficiently obtain øz- and its corresponding predicted sample 2/ d/-q. We compute the difference between these two points and use it to determine if a sample
3

---

Published as a conference paper at ICLR 2024
in the training set. Specifically, samples with small differences more likely to belong to the training set. An overview this proposed method is shown in Fig.
3.1 PRELIMINARY
Denoising Diffusion Implicit Models To accelerate the inference process of diffusion models, DDIM defines a new process that shares the same loss function as DDPM. Unlike the DDPM process, which adds noise from 2g PT, DDIM defines diffusion process from øT I1 by using 2g. The process is described in Eq. and Eq. (3) The distribution (ær æo) is the same as in DDPM.
T
(RI.T To) = 2o (IT Fo II
to (Ft-1
Fe; vo)
1=
Ga (2 me; 00 mo) =N (Var-180 v 04-1 of
vatt0
.o
vI Ct.
The denoising process defined by DDIM is described below: p(av xz)= = (
Iz, Tu
= p (xx)
=N
Te;
Vār
V1
al
dr
of co (1t,
.0.1 (
(4)
V
v Vay
3.2 FINDING GROUNDTRUTH TRAJECTORY
In this section, will first demonstrate that if we know 2y and To. determine any other æt. Then, we will provide the method for obtaining æk-
Theorem The trajectory of {2t} is determined if we know Dy and any other point zg when or under DDIM frumework.
Proof In DDIM definition, if standard deviation or = 0, the process adding noise becomes deter-
mined. So Eq. (3) can be rewritten to Eq. (5)
Lt-1 v 00- 180 VI ūt-1
VI Ctt
Assuming that we know any point æs. applying this equation recurrently, we oblain except øk.
Eq. (5)
can be rewritten as Ee-1 R1-1- -a.-1
Rc J0 By
VI-ae-1
VI-ai
Eq. (6) In other words, we can obtain any point Te
Th ag.00
Ft = Va + v1 aj
(6)
II ag.
call the trajectory obtained from ag groundtruth trajectory.
Assuming that the point is Vāgzo + -i- 0 to find a better groundtruth trajectory, we choose l: 0 since the choice is arbitrary, and approximate ég using Eq. (7)
Eo (Vūgat + vI ageo, 0) ~ Eg (Fo. 0).
This choice is intuitive. First, ag is very close to 1, making the approximation in Eq. (7) valid. Second, the time t = is the closest timing to the original sample, the model is likely to fit it better.
3.3 EXPOSING MEMBERSHIP VIA GROUNDTRUTH TRAJECTORY AND PREDICTED POINT
Our approach assumes that the training set's samples have a smaller loss, similar many other MIAs. meaning that the training samples align more closely with the groundtruth trajectory. We measure the distance between any groundtruth point æ;-r and the predicted point ai-ę using the norm, which can be expressed by [q. Here, æ/-, denotes the point predicted by the model from w+. To apply this attack, need to select specific time l', and choose the time l' = t 1 since it is
4

---

Published as a conference paper at ICLR 2024
the closest. However, will demonstrate later that the choice of t' is not significant in discrete- diffusion.
der
| z/-rlpp-
To predict - from the groundtruth point 2t, we apply the deterministic version (Ø; = 0) of the DDIM denoising process Eq. (4)
We use method described Section 3.2 to obtain the groundtruth point o; and zt- We then insert these points into Eq. (8) giving us simpler formula:
vI āiyan-l
[ Ee Eo (Vāzoo vI agEo,
Vāa
we ignore the coefficient, disappears. Finally, the metric ignoring the coefficient reduces to Eq. (9) where samples with smaller Re. are more likely to be training samples.
Re.p = sg (ro. 0) - Eo (Vara + vT 0.50 (ro. 0) .).
(9)
Since is initialized in time
call our method Proximal Initialization Attack (PIA).
Normalization The values of eg (zo: 0) may not conform to a standard normal distribution, so we use FEq. (10) to normalize them. N represents the number of elements in the sample, such as h x for an image. We refer to this method as PIAN (PIA Normalized). Although this normalization deem it reasonable since each element of & in the training loss Eq. (1) is identically and independently distributed.
cannot guarantee that ég (mo, 0) (0, I),
E ( 0)
ক Eg 6Ø(00) (oo 0)
éo (wo, 0) (0 ([x1)) ee (zg O]1l:
Ny
(10)
|co (o. 0)llı
To apply attack, first evaluate the value of R. sample, and an indicator function:
fæx m) 1 [ < <]
(11)
This indicator means we consider whether a sample is in the training set if Re, is smaller than threshold r. Re, is obtained from eg (æto, 0) (PIA) or éo (æo, 0) (PIAN).
3.4 FOR CONTINUOUS-TING DIFFUSION MODEL
Recently, some diffusion models are trained with continuous time. As demonstrated in Song et al. (2021b), the diffusion process with continuous time can be defined by stochastic differential equation (SDE) as dx, (z, dt + g.dw,, where w, is Brownian process. One of the reverse processes dæ; (z, 1/2 (g) + of Væ, log Pe (x:)) dt ordw. When o, 0, this formula becomes an ordinary differential equation (ODE): da: = (fr( - 19ř V., (ogp;(x:)) dt. Continuous-time diffusion model train an sy approximate Va. log Pe (xx. so the loss function will be:
Ex mmpa (mo))(()))
||ss (Ie, t) Va log (xx x0))l
Replacing Vas log Pt (ax) with (x,, t), the inference procedure become the following equation:
1 dx; f((x)) 3 (0 dt.
(12)
The distribution p(æ;|w0) is typically
be the same as in DDPM for continuous-time diffusion models. Therefore, the loss of the continuous-ting time diffusion model and the loss of the concrete- diffusion model [Eq. (I)are are similar. Since DDPM and the diffusion model described by SDE share similar loss, our method can be applied to continuous-time diffusion models. However, due to the
different diffusion process, Rt,p differs from Eq. (9) From Eq. (12) we obtain the following equation:
2t-r' x; dx, (xx 2 so (at,, t)) dr. By substituting this equation into
Eq. (8) we
obtain the following equation:
| 2/-ell2 (f((zz)
o (z), dt x, x Z/-11
(13)
5

---

Published as a conference paper at ICLR 2024
Table Performance of different methods Grad-TTS. TPR @ x% is the abbreviation for TPR x FPR.
LJspeech
VCTK
LibrTTTS
Method
AUC
TPR@ 1% FPR
AUC
TPR @ 1% FPR
AUC
TPR@ 1% FPR
Query
NA Matsumoto et Dean et al 2023
2023
99.4
93.6
83.4
6.1
90.2
9.1
1
99.5
94.0
87.0
14.8
93.9
19.7
60+2
PIA PIAN
94.2
87.8
95.4
30.0
1+1
99.3
95.7
88,1
93.4
44.7
1+1
Table 2: Performance of the different methods on DDPM.
CIFARIO
TN-IN
CIFAR100
Method
AUC
TPR@ 1% FPR
AUC
TPR@ 1% FPR
AUC
TPR@ 1% FPR
Query
NA
84.7
6.85
84.9
10.0
82.3
9.6
SoeMI
88.1
9.11
89.4
12.7
87.6
11.1
10+2
PIA
88.5
13.7
89.6
17.1
89.4
19.6
I+1
PIAN
87.8
31.2
88.2
32.8
86.5
22.2
1+1
Solving this ODE incurs truncation error that is positively correlated with At. Therefore, we take the limit 0. this case, higher-order infinitesimals can be neglected [Eq. (13) so, we can obtain || zzpellp = (f,( 2 so (2), dt. Since the t' is same when comparing two sampling, can neglect dt and the following attack metrie:
1 1 se (x,,
R, f((xz))
(14)
where is obtained from the output of sa(wo, 0), similar to the discrete-time diffusion case.
EXPERIMENT
In this section, evaluate the performance of PIA and PIAN and robustness of TTS models across various datasets and settings. The detailed experimental settings, including datasets, models, and hyper-parameter settings can be found in Appendix B.
4.1 EVALUATION METRICS
We follow the most convineing metrics used in MIAs Carlini al. (2023), including AUC, the True Positive Rate (TPR) when the False Positive Rate (FPR) is 1%, i.c., TPR @ 1% FPR, and TPR @ 0.1% FPR.
4.2 PROXIMAL INITIALIZATION ATTACK PERFORMANCE
We train TTS models on the LJSpeech, VCTK, and LibriTTS datasets. We summarize the AUC and TPR @ 1% FPR results on GradTTS, continuous diffusion model, in Table 1 We employ NA denote Naive Attack. Compared to SecMI, PIA and PIAN achieve slightly better AUC performance, and significantly higher TPR @ % FPR performance, i.e., 5.4% higher for PIA and 10.5% higher for PIAN on average. However, our proposed method only requires + queries, just one more query
Table 3: Performance of different methods stable diffusion.
Laion5
LaionS w/o
Laion5 Blip
Method
AUC
TPR
FPR
AUC
TPR@
AUC
T
Query
66.3
65.2
68.2
16.2
SccMI
69.1
71.6
14.5
71.6
10+2
PIA
70.5
18.1
73,9
19.8
73.3
20.2
I+1
PIAN
56.7
4.8
58.8
3.2
55.3
3.2
1+1

---

Published as a conference paper at ICLR 2024
0.80
AUC
AUC
0.60
0.60
0.50
TPR @ 1% FPR
0.40
0.30
method
FIA
dataset
OFFR10
TPR @ 1% FPR
0.30
method dataset
PIA
CFAR10
0.20
PIAN
CIFAR100
0.29
PANN
0FA110
0.10
TN-N
0.10-
CHAR10
0.00
0.00
500
750
1000
250
500
750
1000
The results of PIA and PIAN on DDPM for different values of and different datasets.
(b) The results of PIA and PIAN on DDPM for different values of and different CIFARIO splits.
The performance of PIA and PIAN as t varies. The top row shows the results for AUC, and the bottom row shows the results for TPR @ 1% FPR.
Figure 2:
than Naive Attack, and has computational consumption of only 3.2% of SecMI. Both methods outperform SecMI and Naive Attack.
For this model, PIA performs slightly better than SecMI in terms of AUC but has a distinctly higher TPR @ 1% FPR than SecMI. i.e. 5.8% higher average than SecMI. For PIAN, the AUC performance is slightly lower than PIA, but higher than SecMI, and the TPR 1% FPR performance significantly better than SecMI, i.e. 17.8% higher average than SecMI. Similar to the previous case, our attack only requires two queries on DDPM and the computational consumption 17% of SecMI. Both methods outperform SecMI and Naive Attack.
For DDPM, discrete-time diffusion model, we present the results in lable 2
We evaluated stable diffusion on Laion5 (training dataset) and COCO (evaluation dataset). Details are put into A.2. We tested three scenarios: knowing the ground truth text (Laion5), not knowing the ground truth text (Laion5 w/o text). and generating text through blip (Laion5 Blip text). PIA achieved the best results. PIA performs slightly better than SecMI in terms of AUC, i.e. 1.8% higher on average, but has distinctly higher TPR @ 1 %% FPR than SecMI, i.e. 3.2% higher on average. Besides, our attack only requires two queries on DDPM and the computational consumption is 17% of SecMI.
For stable diffusion, we present the results in Table 3
However, PIAN does not work well stable diffusion. PIAN based on the fact that we added noise that follows normal distribution during training, and we use [g. (10) to rescale the to normal distribution. However, rescaling a rough operation and may not always transform into normal distribution. Thus, some other transforms might have better performance. Additionally, the model's output might be more accurate before the rescaling.
We highly recommend using PLA the preferred method for conducting attacks, because it is directly derived. It will always yield the desired results. But PIAN can be another choice, since it has better performance at TPR @ 1 % FPR metric than PIA some models.
4.3 ABLATION STUDY
Our proposed method has three prrerr-praamttes: t and the f,-norm used in the attack metrics R.p presented in Eqs. (9) and (14) The threshold t presented in [Bq. (1I)
Impact of I. To evaluate the impact of I,, we attack the target model at intervals of 0.01 x T from 0 to T and report the results across different models and datasets.
We demonstrate the performance of our proposed method on two different models: GradTTS, a continuous-time diffusion model used for audio; and DDPM, a discrete-time diffusion model employed for images. The results indicate that our method produces a consistent pattern in the same model across different datasets, whether PIA or PIAN. Specifically, for DDPM, both AUC and TPR @ 1% FPR exhibit rapid increase the beginning as t increases followed by decline around t = 200 from Fig. 2al In Fig. 2b) we randomly partition the CIFARIO dataset four times and compare the performance of each partition. Consistent with the previous results, method exhibits similar
7

---

Published as a conference paper at ICLR 2024
1.00
0.93-
0.90
AUC
0.83
0.83
TPR @ 1% FPR
1.00
1.00-
0.75
TPR 1%
0.50
0.50
0.25
0.25
0.00
method
dataset
method
dataset
PlA
PIAN
LSoceech
LiiTTSS
-
VCTK
PIA
PIAN
CIFARID
GIRRICO
TN
(a) The results of PIA and PIAN on Grad-TTS for different values of no-mr
(b) The results of PIA and PIAN on DDPM for different values of nn-rm..
Figure 3: The performance of our method as l fn-norm varies. The top row shows the results for AUC, and the bottom row displays the results for TPR @ 1% FPR.
Table 4: The variation of Attack Success Rate (ASR) and TPR/FPR on the victim model with the threshold determined by the surrogate model.
PIA
PIAN
LibriTTS
CIFARIO
LibriTTS
CIFARIO
ASR
TPR/FPR
ASR
TPR/FPR
ASR
TPR/FPR
ASR
TPR/PPR
Surrogate model
89.5
32.2/1
78.5
16.5/1
88.3
26.2/1
76,9
19.0/1
Victim model
89.1
32.6/1.1
78.3
16.8/1.1
88.2
24.5/0.9
76.8
19.0/1
trend across the different splits. For GradTTS, a similar phenomenon can observed in Appendix Fig. 6
Impact of (,.norm Fig. we compare the results obtained on f--norm using the p = to with the choice of being the same as in Section 4.2 The results indicate increase in performance at fo-ormm followed by a decline after the = 5. reveals that the combined effect of both large and small differences exhibits synergistic influence when present in appropriate ratio.
Determining the value of In Table we present the variation of Attack Success Rate (ASR) and TPR/FPR on the victim model with the determined by the surrogate model. Specifically, will randomly split the corresponding dataset into two halves four times, resulting in four different train-test splits. We will train four models using these splits. One of the models will be selected the surrogate model, from which we will obtain the threshold. We will then use this to attack the other three victim models and record the average values. The results indicate that method achieves promising results when using the selected from the surrogate model.
4.4 WHICH TYPE OF MODEL OUTPUT IS MORE ROBUST?
According to Zhang et al. (2023), the TTS pipeline consists three stages: text to mel-spectrogram, text to audio, and mel spectroggaa to audio. Our experiments tested models for each stage: Grad-TTS for text to mel-spectrogram, Diff'Waee for mel-spectrogram to audio, and FastDiff for text to audio. There generally forms of output: mel-spectrograms and audio. In Table 5] summarize the model details and best results of our proposed method on three TTS models using the LJSpeech
Table Comparison different models. AUC is the result on the L.Speech/TinylmageNNe dataset.
Model
Size
Oulput
Segmentation Length
Best AUC
DDPM
35.9M
1000
Image
N/A
92.6
GradTTS
56.7M
[0. 1]
Mel-spectrogram Audio
2s
99.6
DiffWave
30.3M
0.25s
52.4
FastDiff
175.4M
1000
Audio
1.2s
54.4
8

---

Published as a conference paper at ICLR 2024
Figure 4: An example of -nel-spectrogram.
100
100
90
Model
Dataset
TPR @ 1% FPR
75
80
DDPM
CIFAR10
AUC
DiffWave
IJSpeach
50
70
FastDiff
LIbrITTS
60
GradTTS
TN-IN
25
50
Random Gauss
0-
30
50
100
100
Proportion
Proportion
(a) The results of PIA and PIAN Grad-TTS TTS for different training and evaluation sample numbers.
(b) The results of PIA and PIAN on DDPM for different training and evaluation sample numbers.
Figure 5: The performance of our method different training and evaluation sample numbers. The top row shows the results for AUC, and the bottom row displays the results for TPR @ 1% FPR.
dataset and the DDPM model on the TinyImageNet dataset. We only report the results of our method since it achieves better performance most of the time.
with the same training and hold-out data, GradTTS achieves an AUC close to 100. while Wiff and FastDiff only achieve the performance slightly above 50, which close to random guessing. However, DiffWave has a similar size to DDPM and GradTTS, and FastDiff has similar with DDPM. Additionally, FastDiff has similar segmentation length to GradTTS. Thus, we believe that these hyperparameters are not the decisive parameters for the model's robustness. obvious that the output of GradTTS and DDPM is image-like. Fig. 4lprvvid an example of mel-spectrogram. The deep reasons why these models exhibit robustness can be further explored. We report these results hoping that they may inspire the design models with MIA robustness.
As shown in Table 5]
We also explore the attack performance with various training and evaluation sample numbers. We select 10%. 30%, 50%, and 100% the samples from the complete dataset. In each split, half of all samples are used for training, and the other half are utilized as hold-out set. The results presented in Fig. 5) As we can see, when only 10% of the data used, relatively high AUC and TPR @ 1% FPR be achieved. Additionally, proportion of selected samples in the total dataset increases. However, for GradTTS and DDPM, the decrease relatively gentle, while for Dive and FastDiff, the decrease is rapid. In other words, the robustness increases rapidly with the increase of training samples.
find that the AUC and TPR @ 1% FPR decrease the
CONCLUSION
In this paper, we propose an efficient membership inference attack method for diffusion models. namely Proximal Initialization Attack (PIA) and its normalized version, PIAN. We demonstrate its effectiveness on a continuous-time diffusion model, GradTTS, and two discrete-time diffusion models, DDPM and Stable Diffusion. Experimental results indicate that our proposed method can achieve similar AUC performance to SecMI and significantly higher TPR @ % FPR with the cost of only 2 queries, which is much faster than the 12-62 queries required for SecMI in this paper. Additionally, we analyze the vulnerability of models in TTS, an audio generation task. The results suggest that diffusion models with the image-liks like output (mel-spectrogram) those with the audio output. Therefore, for privacy concerns, we recommend employing models with audio outputs in text-to-speech tasks.
more vulnerable than

---

Published as a conference paper at ICLR 2024
6 ACKNOWLEDGMENT
Xiaofeng Zhu was supported in part by the National Key Research & Development Program of China under Grant (No. 0022YFA1004000 Fei Kong and Xiaoshuang Shi were supported by the National Natural Science Foundation of China (No.62276052).
REFERENCES
Rishi Bommasani, Drew A Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney Arx, Michael S Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, et al. On the opportuni- ties and risks of foundation models. arXiv preprint orXiv:2108.077
2021.
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In IEEE Symposium on Security and Privacy, pp. 1897-1914. IEEE, 2022.
Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. arXiv preprint arXiv:2301. 23X1:22311.31888 13188, 2023.
Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of membership infer- ence attacks against generative models. In SIGSAC Conference on Computer and Communications Security, pp. 343-362, 2020.
Nanxin Chen, Yu Zhang. Heiga Zen, Ron Weiss, Mohammad Norouzi, and William Chan. Wave- grad: Estimating gradients for waveform generation. In International Conference on Learning Representations, 2021.
CNN. Ai won art contest, and artists are furious. Website, 2022. https://www cnn. com/ 2022//9/03ttech/// ott.:aae........a.a.a..eeearonrr hte///ndexxccm/ html
Tim Dockhorn, Arash Vahdat, and Karsten Kreis. Score-based generative modeling with critically- damped langevin diffusion. International Conference on Learning Representations, 2022.
Jeff Donahue, Philipp Krähenbühl, and Trevor Darrell. Adversarial feature learning. In International Conference on Learning Representations, 2017.
Jinhao Duan, Fei Kong, Shiqi Wang, Xiaoshuang Shi, and Kaidi Xu. Are diffusion models vulnerable to membership inference attacks? International Conference on Machine Learning, 2023.
Vincent Dumoulin, Ishmael Belghazi, Ben Poole, Alex Lamb, Martín Arjovsky, Olivier Mastropietro, and Aaron C. Courville. Adversarially learned inference. In International Conference Learning Representations, 2017.
Ian Goodfellow, Jean Pouget-Abadic, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, (3(11):139-144 2020.
Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. Monte carlo and reconstruction member- ship inference attacks against generative models. Proceedings on Privacy Enhancing Technologies, 2019(4):222-249, 2019.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems, volume 33, pp. 6840-6851, 2020.
Jonathan Ho, Tim Salimans, Alexey Gritsenko, William Chan, Mohammad Norouzi, and David J.
Fleet. Video diffusion models. In Advances in Neural Information Processing Systems, 2022.
Kalin Hristov. Artificial intelligence and the copyright dilemma. Idea. 57:431, 2016.
Hailong Hu and Jun Pang. Membership inference of diffusion models.
arXiv preprint
TrXii=2301.09955 2023.
10

---

Published as a conference paper at ICLR 2024
Rongjie Huang, Max W. Y. Lam, Jun Wang, Dan Su, Dong Yu, Yi Ren, and Zhou Zhao. Fastdiff: A fast conditional diffusion model for high-quality speech synthesis. In European Conference on Artificial Intelligence, pp. 4157-4163, 2022.
Keith Ito and Linda Johnson. The Ij speech dataset.
https://keithito.com
LJ- Sopeech-Dataser// 2017.
Yamagishi Junichi, Veaux Christophe, and MacDonald Kirsten. Cstr vetk corpus: English multi- speaker corpus for estr voice cloning toolkit. htttps://datashare wwwpaaaaaaareeedaa..oooo acd.ac.uk/handll
10283/3442 3443 2019.
Diederik Kingma and Max Welling. arXiv:1312.61 14, 2013.
Auto-encoding variational bayes. arXiv preprint
Zhifeng Kong, Wei Ping, Jiaji Huang, Kexin Zhao, and Bryan Catanzaro. Diffwave: A versatile diffusion model for audio synthesis. In International Conference on Learning Representations. 2021.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images, 2009.
Alexander Li, Mihir Prabhudesai, Shivam Duggal, Ellis Brown, and Deepak Pathak. Your diffusion model is secretly a zero-shot classifier. arXiv preprint arXiv:2303. /6203, 2023.
Tsung- Yi Lin, Michael Maire, Serge J. Belongie, Lubomir D. Bourdev, Ross B. Girshick, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick. Microsoft COCO: common objects in context. CoRR, abs/1405.0311 0,,103 2014. URL httt:://taxii...../ wwtp/bbi.rr///bs....
1.05.0312
Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. Repaint: Inpainting using denoising diffusion probabilistic models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 11461-11471, 2022.
Tomoya Matsumoto, Takayuki Miura, and Naoto Yanai. Membership inference attacks against diffusion models. arXiv preprint 23X2::2302.032622 2023.
Dang Pham and Tuan M. V. Le. Auto-encoding variational bayes for inferring topics and visualization. In International Conference on Computational Linguistics, pp. 5223-5234, 2020.
Vadim Popov, Ivan Vovk, Vladimir Gogoryan, Tasnima Sadekova, and Mikhail Kudinov. Grad-tts: diffusion probabilistic model for text-to-speech. In International Conference on Machine Learning. pp. 8599-86088 2021.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. bber-5/6fffi922-79b222bbcbe 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In IEEE Conference Computer Vision and Pattern Recognition, pp. 10674-10685, 2022.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, al. Photorealistic text- to-image diffusion models with deep language understanding. In Advances in Neural Information Processing Systems, volume 35. pp. 36479-36494, 2022.
Tim Salimans and Jonathan Ho. Progressive distillation for fast sampling of diffusion models. In International Conference on Learning Representations, 2022.
Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In Advances in Neural Information Processing Systems, volume 29, 2016.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarezyk, and Jenia Jitsev. Laion-5b: An open large-scale dataset for training next generation image-text models, 2022.

---

Published as a conference paper at ICLR 2024
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE Symposium on Security and Privacy, pp. 3-18. IEEE, 2017.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- lional Conference on Learning Representations, 2021a.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution.
In Advances in Neural Information Processing Systems, pp. 11895-11907 2019.
Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. International Conference on Learning Representations, 2021b.
WashingtonPost. site, 2022.
He made children's book using ai. then came the rage. Web-
ai 11t-al..eeaaaop000---ooooooerea0
Zhisheng Xiao, Karsten Kreis, and Arash Vahdat. Tackling the generative learning trilemma with denoising diffusion gans. In International Conference Learning Representations, 2022.
Jie Xu, Yazhou Ren, Huayi Tang, Xiaorong Pu, Xiaofeng Zhu, Ming Zeng, and Lifang He. Multi- VAE: Learning disentangled view-common and view tiew-peculiar visual representations for multi-view clustering. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 9234-9243, 2021.
Kaidi Xu, Sijia Liu, Pu Zhao, Pin-Yu Chen, Huan Zhang, Quanfu Fan, Deniz Erdogmus, Yanzhi Wang, and Xue Lin. Structured adversarial attack: Towards general implementation and better interpretability. In International Conference on Learning Representations, 2018
Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin- Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in physical world. In European conference on computer vision, pp. 665-681. Springer, 2020.
Ruihan Yang, Prakhar Srivastava, and Stephan Mandt. Diffusion probabilistic modeling for video generation. arXiv preprint arXiv:2203. 09481,, 2022.
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection overfitting. In IEEE Computer Security Foundations Symposium, pp. 268-282. IEEE, 2018.
Chenxi Yuan and Mohsen Moghaddam. Attribute-aware generative design with generative adversarial networks. JEEE Access, 8: 8:190710-190720 2020.
Chenxi Yuan, Jinhao Duan, Nicholas J Tustison, Kaidi Xu, Rebecca A Hubbard, and Kristin A Linn. Remind: Recovery of missing neuroimaging using diffusion models with application to alzheimer's disease. medRxiv, 2023a.
Chenxi Yuan, Tucker Marion, and Mohsen Moghaddam. Dde- diee Integrating data-driven design evaluator into generative adversarial networks for desirable and diverse concept generation. Journal of Mechanical Design, 145(4):041407 2023b.
H. Zen, V. Dang, R. Clark, Y. Zhang, R. Weiss, Jia, Chen, and Wu. Libritts: corpus derived from librispeech for text-to-speech. In Proceedings of Interspeech, September 2019. 2oi/00221437ntterspechh000199999
Chenshuang Zhang, Chaoning Zhang, Sheng Zheng, Mengchun Zhang, Maryam Qamar, Sung-Ho Bae, and In So Kweon. survey on audio diffusion models: Text to speech synthesis and enhancement in generative ai. CoRR, abs/2303. 13336, 2023.
Huan Zhang, Shigi Wang, Kaidi Xu, Yihan Wang, Suman Jana, Cho-Jui Hsieh, and Zico Kolter. A branch and bound framework for stronger adversarial attacks of relu networks. In International Conference Machine Learning, pp. (6591-26604 PMLR, 2022.
12

---

Published as a conference paper at ICLR 2024
Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversion attacks against deep neural networks. In IEEE Conference on Computer Vision and Pattern Recognition, pp. 253-261, 2020.
13

---

Published as a conference paper at ICLR 2024
APPENDIX
A LIMITATION AND BROADER IMPACTS
The purpose of our method to identify whether a given sample is part of the training set. This capability can be leveraged to safeguard privacy rights by detecting instances of personal information being unlawfully used for training purposes. However, it is important to note that our method could also potentially result in privacy leaking. For instance, this could occur when anonymous data is labeled by determining whether sample is part of the training set or part of data reconstruction attack. It is worth mentioning that our method solely relies on the diffusion model's ' output as we discussed in the threat model, but it does require the intermediate output. This dependency on the intermediate output may pose a limitation to our method.
B DATASETS AND DIFFUSION MODELS
For TTS, we evaluate three commonly used datasets: IJSpeech, VCTK, and subset of LibriTTS called libritts-lean 100. We test three models: GradTTS ! FastDiff and Diff For image generation, evaluate the CIFARIO, CIFARI00 and TinyImageNet datasets using the same DDPM model as Duan et al. (2023), and Laion5, COCO for stable diffusion Rombach et al. (2022). Unless otherwise specified, randomly select half of the samples training set and the other half as the hold-out set.
B.1 IMPLEMENTATIONS DETAILS
For the audio generation models, default hyperparameters for all models except for the hyperparameters we mentioned. The training iterations were
their codes from the official repositories and apply the
1,000,000, due to the default value for the three audio generative models are all around this. For DDPM, all settings are the same as those in Duan et al. (2023). For various experiments, due to the absence of corresponding trials by the baseline, we employ a grid-search approach to identify the optimal parameters attainable by the method.
Table 6 demonstrate the setting for different attacks. On GradTTS, because SecMI is not designed for continuous-time diffusion, we discretize [0, 1] into 1000 steps and then apply SecMI. We chose 4ormm to compute Re.p-
To conduct the experiment on stable diffusion, we download the vable-diffusion-vl.. from without any further fine-tuning or any other modification. We select 2500 sample from 600M laion- -esthetitss v2-5plus as the member set, since suble-diffusion-vl-- is trained on this dataset as mentioned by HuggingFace. We randomly select 2500 images from the COCO2017-v0 as the hold-out set, since COc02017-val is one of the official validation set to examine the performance of stable diffusion. The prompt generate Laion5 Blip text in BLIP is "A picture of
C PIA AND PIAN ON GRAD-TTS ACROSS VARIOUS t
Fig. ddemonsttttes results of PIA and PIAN on Grad-TTS different values of and different datasets. For GradTTS, consistent with the DDPM, both AUC and TPR @ 1% FPR exhibit rapid increase at the beginning as increases followed by a decline around = 0.5.
14

---

Published as a conference paper at ICLR 2024
Model
Attack Methol
Attack Time (f)
Naive Attack
200
DDPM
SecMI
100
PIA/PIAN
200
Naive Attack
0.8
GradTTS
SecMI
0.6
PIA/PIAN
0.3
Naive Attack
500
Stable Diffusion
SecMI
100
PIA/PIAN
500
Table 6: Summary of attack settings
1.00
AUC
TPR @ 1% FPR
1.00
method dataset
USpeeech
0.50
PIAN
LibrITT
0.25
VCTK
0.00
0.25
0.50
0.75
Figure 6: The results of PIA and PIAN on Grad-TTS for different values of t and different datasets.
D MORE EXPERIMENTAL RESULTS
D.1 ROBUSTNESS ON FASTDIFF AND DIVEWAVE
Table 7 shows the AUC of different methods at FastDiff and DiffWave model on three datasets. The
performance of three MIA methods is very poor.
Table 7: Performance of AUC on FastDiff and DiffWave across three datasets.
FistDiff
DiffWave
Method
LJSpeech
VCTK
LibriTTS
LJSpeech
VCTK
LibriTTS
NA Matsumoto 2023
52.6
55.1
53.7
52.7
53.8
51.2
Dua et al. 2023
51.6
56.3
53.7
53.2
54.3
52.4
PTA PIAN
51.6
57.1
54.1
54.4
54.2
50.8
52.4
57.0
54.6
50.0
50.5
50.7
D.2 DISTRIBUTION FOR SAMPLES FROM TRAINING SET AND HOLD-OUT SET.
Fig. 7 shows the 0.3, distribution for samples from training set and hold-out set at GradTTS on different datasets of PIAN.
D.3 LOG-SCALED ROC CURVE
As suggested by Carlini et al. 2022 Fig. and Fig. 9 curves demonstrate that the proposed method outperforms NA and SecMI most of times.
display the loa-sc ROC curves. These
15

---

Published as a conference paper at ICLR 2024
1500
2000
hold-outt
hold-out set
3000
hold-out set training
training
count
1500
count
1000
count
2000
1000
1000
500
0
0-
5000
10000
15000
20000
10000
20000
10000
20000
Ro.3.4
Ro3.4
Ro3.4
(a) Distribution on LJSpeech.
(b) Distribution on VCTK.
(c) Distribution on LibriTTS.
Figure 7: 0.3 p=d distribution for samples from training set and hold-out set at GradTTS different datasets PIAN.
1
10-1
TPR
1e-2
method
TPR
method
NA
NA
10.3
PIA
PIA
1c.4
SecMl
1e-4
SecMi
Random Guess
Random Guess
16-4
16-2
1e-1
1e-4
1e-3
1e-2
1e-1
FPR
FPR
(a) Log-scaled ROC on CIFARIO.
(b) Log-scaled ROC on TinyImageNet.
Figure 8: The log-scaled ROC at DDPM of different methods on CIFARIO and TinylmageNet.
D.4 VISUALIZATION OF RECONSTRUCTION
Note Eq. (9) is equal to the distance between Co (Zo, 0) and the predicted one cæ (xx, t) where Zt Vālzo + VI- āقب9 (Zo, 0). Fig. 10 and Fig. 11 show the reconstructed sample 2 a,c from 2; using the predicted
DDPM on CIFARIO of PIAN. The reconstructed samples from t = 100 are clear for both the training set and the hold-out set. The reconstructed samples from = 400 are blurry for both sets. However, for / 200, the reconstructed samples clear for the training set but blurry for the hold-out set.
vār
For GradTTS, but we just use it to give a visualization. Fig. 12 and Fig. show the reconstructed samples on LJSpeech from PIA. The observed pattern consistent with DDPM.
use Eq. (12) reconstruct samples from 24. This reconstruction is not rigorous,
16

---

Published as a conference paper at ICLR 2024
1e-1
TPR
TPR
16.2
method
method
NA
NA
PIA
10.3.
PIAN
PIAN
Random Guess
16:4
Random Guess
1e.3
1e-2
16-3
1e-2
le-1
FPR
FPR
(a) Log-scaled ROC on IJSpeech.
(b) Log-scaled ROC on VCTK.
1e:1
TPR
1e:2
method
16-3
PIA
PIAN
SecMI
10.4
Random Guess
16.3
1e-2
16-1
FPR
(c) Log-scaled ROC on LibriTTS.
Figure 9: The log-scaled ROC at GradTTS of different methods on LJSpeech, VCTK and LibriTTS.
17

---

Published as a conference paper at ICLR 2024
(a) Samples in training set.
(b) Samples reconstructed from
100.
(c) Samples reconstructed from 200.
(d) Samples reconstructed from = 400.
Figure 10: Samples in training set and the reconstructed samples DDPM CIFARIO from PIAN.
18

---

Published as a conference paper at ICLR 2024
(a) Samples in hold-out set.
(b) Samples reconstrucied from
100.
(c) Samples reconstructed from 200.
(d) Samples reconstructed from = 400.
Figure 11: Samples in hold-out and the reconstructed samples DDPM on CIFARIO from PIAN.
19

---

Published as a conference paper at ICLR 2024
(a) Samples in training set.
(b) Samples reconstructed from 0.1.
(c) Samples reconstructed from 0.6.
(d) Samples reconstructed from t 0.95.
Figure 12: Samples in training set and the reconstructed samples at GradTTS on LJSpeech from PIA.
20

---

Published as a conference paper at ICLR 2024
(a) Samples in hold-out set.
(b) Samples reconstructed from f = 0.1.
(c) Samples reconstructed from f t= 00...
(d) Samples reconstructed from t 0.95.
Figure 13: Samples in hold-out set and the reconstructed samples at GradTTS on LJSpeech from PIA.
21


Reviews:
[{"review_id": "gV5n2Lw64C", "reviewer": "Reviewer_Jy2D", "summary": "This paper proposes a novel query-based membership inference attack (MIA), namely Proximal Initialization Attack (PIA), by using groundtruth trajectory obtained by ϵ initialized in t = 0 and predicted point to infer memberships. Experimental results demonstrate the effectiveness of the proposed method on vision and text-to-speech tasks.", "questions": "1. In Eq. (14), the motivation to ignore the high-order infinitesimal term and dt is not clear.\n2. Why the proposed method can obtain better performance than the best competitors in Tables 1-3?\n3. How to apply the proposed method to discrete-time diffusion models?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "1. This paper is well-written and clear.\n2. The idea is very simple and novel.\n3. Very good experimental results.", "weaknesses": "1. The motivation of some transformations in the method is not very clear.\n2. The third contribution about the experiments is too long and redundant.\n3. There exists some grammar errors or typos, like “MIA for generation tasks … has also been extensively researched” in the related work section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Wy51irDEn9", "reviewer": "Reviewer_7qyp", "summary": "This paper presents a novel approach to membership inference attacks on diffusion models named Proximal Initialization Attack (PIA), focusing on efficiency. The proposed method utilizes the distance between the true trajectory and the estimated trajectory, and the estimated trajectory is obtained by the output of models at $t=0$. With just 2 queries, this approach achieves superior AUC and TPR@1%FPR compared to previous methods.", "questions": "* Why is mel-spectrogram more robust than directly outputting audio? \n* Does the model that directly outputs audio have any other costs compared to outputting mel-spectrogram?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "* This paper is well-written and easy to read.\n* The experiments are conducted extensively across multiple datasets and models in the domains of images and audio, confirming the effectiveness of the proposed method. A thorough ablation study is also conducted to investigate the patterns of various parameters.\n* The results of the experiment are promising, and the experiment is convincing. The proposed method is much faster than the baseline, which is particularly useful for large-scale models.", "weaknesses": "* The experimental results are promising. It would be more convincing if you could provide more details, such as the selection of all experimental parameters, including the comparative methods.\n* Eq.9 is similar to the original loss function. Is there any connection between the proposed method and the loss function? Please provide further analysis.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4SKXxPD7Ul", "reviewer": "Reviewer_Vi3v", "summary": "This paper proposes a novel membership inference attack, Proximal Initialization Attack (PIA), for diffusion models. By using the output at time $t=0$ and calculating the difference between the model outputs at time $t$ and $t-1$, it is possible to determine whether a sample is present in the training dataset. The proposed method is validated for its effectiveness on both image and audio datasets. The results show that compared to the baseline, this method achieves better performance while achieving a 5-10 times speedup.", "questions": "1. How is the query number for the comparison methods determined? Is it possible that the comparison methods used in the article could yield better performance with a lower query number?\n2. For the TTS task, this article explores models that generate output in the form of audio and mel-spectrogram. Are there any other types of outputs for the TTS task? It is interesting to investigate whether the other outputs is robust for the TTS task.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1. This paper aligns with the scope of the conference.\n2. The paper is easy to understand, and its motivation is clear.\n3. The experiments in the paper are extensive. The proposed method is validated on multiple datasets and multiple models in both image and audio domains, demonstrating its effectiveness. Additionally, the results on the audio dataset indicate that the model with audio output exhibits greater robustness.\n4. They demonstrated the scenarios in which the proposed method can be applied (threat model in other word).", "weaknesses": "1. Some of the figures in the paper are difficult to read, due to the fact that too many datasets and models are included in the same figure.\n2. The pipeline of the TTS tasks is not explained in the paper.\n3. Some details of the experimental setup are not clearly described. Specifically, in the experiment on stable diffusion, the checkpoint of BLIP and the specific prompt used are not mentioned in this paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "W99mxEMEci", "reviewer": "Reviewer_nuWm", "summary": "This paper proposes a method for conducting a membership inference attack on a diffusion model. Compared to previous methods (SecMI), the proposed method achieves better results while accelerating the process by 5-10 times. The effectiveness of the method is validated on multiple datasets in the paper. Additionally, this paper also analyzed the MIA robustness of diffusion on speech-to-text task, and the authors suggests using models that directly output audio to enhance the MIA robustness of the model.", "questions": "1. It is not clear how hyperparameters are selected for other methods.\n2. Why audio data is more robust against the proposed method?\n3. It is better to present the procedure of the proposed method in one table.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "This paper proposed a method achieved a 5-10 times improvement compared to previous SOTA method (SecMI) and conducted extensive experiments to evaluate the proposed method. Strengths are listed below:\n\n1.\tThis paper conducted extensive experiments, including three image datasets and three audio datasets. In particular, this paper also conducted experiments on stable diffusion, including scenarios where the ground truth text was unknown.\n2.\tExperiments demonstrated that the proposed method achieved a 5-10 times improvement compared to previous SOTA method (SecMI), while also achieving better results.\n3.\tThis paper analyzed the threat model. When the diffusion model is used for some tasks such as inpainting and classification, it requires the use of intermediate results. In such cases, their method can be employed to attack the model. It’s reasonable.\n4.\tExperimental results showed that diffusion models directly outputting audio are more robust compared to models outputting mel-spectrograms. This paper recommended using models that directly output audio to enhance robustness.", "weaknesses": "The paper is overall clear and sound, but I still have some minor concerns:\n\n1.\tWhen attack audio, this paper also uses these methods proposed from image attacks (NA, SecMI). The methods for attacking audio should be included as well.\n2.\tIn the loss function of the diffusion model, there is a noise term. The proposed method is based on the loss function, but the method to remove the influence of the random seed is not described clearly.\n3.\tFig. 2 is too small to read.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)