Privacy Attacks on Image AutoRegressive Models
Authors: Antoni Kowalczuk
Jan Dubiński
Franziska Boenisch
Adam Dziedzic
Venue: ICML 2025 poster (2025)
Keywords: image autoregressive models
diffusion models
dataset inference
membership inference
data extraction
Primary area: deep_learning->generative_models_and_autoencoders
TL;DR: We design new methods to assess the privacy leakage from the image autoregressive models and show that they provide better performance, however, also leak more private information than diffusion models.

Abstract: Image AutoRegressive generation has emerged as a new powerful paradigm with image autoregressive models (IARs) matching state-of-the-art diffusion models (DMs) in image quality (FID: 1.48 vs. 1.58) while allowing for a higher generation speed.
However, the privacy risks associated with IARs remain unexplored, raising concerns regarding their responsible deployment. 
To address this gap, we conduct a comprehensive privacy analysis of IARs, comparing their privacy risks to the ones of DMs as reference points. 
Concretely, we develop a novel membership inference attack (MIA) that achieves a remarkably high success rate in detecting training images (with a True Positive Rate at False Positive Rate = 1% of 86.38% vs. 6.38% for DMs with comparable attacks). 
We leverage our novel MIA to provide dataset inference (DI) for IARs, and show that it requires as few as 6 samples to detect dataset membership (compared to 200 for DI in DMs), confirming a higher information leakage in IARs. 
Finally, we are able to extract hundreds of training data points from an IAR (e.g., 698 from VAR-*d*30). 
Our results suggest a fundamental privacy-utility trade-off: while IARs excel in image generation quality and speed, they are *empirically* significantly more vulnerable to privacy attacks compared to DMs that achieve similar performance. 
We release the code at https://github.com/sprintml/privacy_attacks_against_iars for reproducibility.

Privacy Attacks on Image AutoRegressive Models
Antoni Kowalczuk"
Jan Dubiński 23 Franziska Boenisch Adam Dziedzic
Abstract
1. Introduction
The field of visual generative modeling has seen rapid ad- vances in recent years, primarily due to the rise of Diffusion Models (DMs) (Sohl-Dickstein et al., 2015) that achieve impressive performance in generating highly detailed and realistic images. For this ability, they currently act as the backbones of commercial image generators (Rombach et al., 2022; Team, 2022; Saharia et al., 2022). Yet, recently, their performance was closely matched further surpassed through novel image autoregressive models (IARs). Over the last months, IARs have been achieving new state-of- the-art performance for class-conditional (Tian et al., 2024; Yu et al., 2024; Li et al., 2024) and text-conditional (Han et al., 2024; Tang et al., 2024; Fan et al., 2024) generation. The crucial improvement of their training cost and gener- ation quality results from the scaling laws that previously were observed for large language models (LLMs) (Kaplan et al., 2020) with which they share both training paradigm and architectural foundation. As a result, with more com- pute budget, and larger datasets, IARs can achieve better performance than their DM-based counterparts.
Image AutoRegressive generation has emerged as new powerful paradigm with image autore- gressive models (IARs) matching state-of-the-art diffusion models (DMs) in image quality (FID: 1.48 vs. 1.58) while allowing for a higher generation speed. However, the privacy risks associated with IARs remain unexplored, raising concerns regarding their responsible deployment. To address this gap, we conduct a comprehensive privacy analysis of IARs, comparing their privacy risks to the ones of DMs as reference points. Concretely, we develop a novel membership inference attack (MIA) that achieves a remarkably high success rate in detecting training images (with a True Positive Rate at False Positive Rate = 1% of 86.38% vs. 6.38% for DMs with comparable attacks). We leverage our novel MIA to provide dataset inference (DI) for IARs. and show that it requires few as 6 samples detect dataset membership (compared to 200 for DI in DMs), confirming a higher information leakage in IARs. Finally, we are able to extract hundreds of training data points from an IAR (e.g., 698 from VAR-d30). Our results suggest a fundamental privacy-utility trade-off: while IARs excel in image generation quality and speed, they are empirically significantly more vulnerable to privacy attacks compared to DMs that achieve similar performance. We release the code at https:// httccchuu.coomeee sprnntlr privacy_atee attacks attaattckaaaaiittttttt aww.aaatainnaaaaaaaa reproducibility.
At the same time, the privacy risks of IARs remain largely unexplored, posing challenges for their responsible deploy- ment. While privacy risks, such as the leakage of training data points at inference time, have been demonstrated for DMs and LLMs (Carlini et al., 2021; 2023; Duan et al., 2023a;b; Hanke et al., 2024; Huang et al., 2024; Wen et al., 2024; Hayes et al., 2025), no such evaluations currently exist for IARs. As result, the extent to which IARs may simi- larly expose sensitive information remains open question, underscoring the necessity for rigorous privacy investiga- tions in this context.
for
To address this gap and investigate the privacy risks associ- ated with IARs, we conduct a comprehensive analysis using multiple perspectives on privacy leakage. First, we develop new membership inference attack (MIA) (Shokri al., 2017), which aims determine whether specific data point was included in IAR's 's training set-a widely used approach for assessing privacy risks. We find that existing MIAs developed for DMs (Carlini et al., 2023; Duan et al., 2023c; Kong et al., 2023; Zhai et al., 2024) or LLMs (Mat- tern et al., 2023; Shi et al., 2024), are ineffective for IARs, as they rely on signals specific their target model. We com-
"qqual contribution 'CIPAA Helmholtz Center for Infor- mation Security, Germany Warssw University of Technology, Poland "NASK National Research Institute, Poland. Correspon- dence to: Antoni Kowalczuk <antoon kowalczkk @errrudddiisad...... Jan Dubiáski <jan.dubinski.doke www.ki....t@p............ Franziska Bocnisch dziennidiediiceeeec ciss..de>..
creenschhcispa.ee..
Adam Dziedzic
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 20255 by the author(s).

---

Privacy Attacks on Image AutoRegressive Models
[ARs
Architecture
3.5
VAR
[AR
FID Gowerr -btttrr
KAR
DM4
1.0
BAR
PID Gower
DMs
<2000
2.
2.0
1,5
101 TPR@ 1% (higher less private)
10
1p Latency (shmage) (Lower taster to generate)
10-
[AMR
trade-off' for IARs compared to DMs. 1) IARs achieve better and faster image generation, but reveal more information to potential training data identification attacks. 2) In particular, large IAR models are most vulnerable. 3) In case of large IARs, even the identification of individual training samples (MIAs) has a high success rate. 4) MAR models are more private than other IARs. We attribute it to the inclusion of a diffusion module in this architecture.
Figure 1: Privacy-utilityy and generation
bine elements of MIAs from DMs and LLMs into our new MIA based on the shared properties between the models. For example, we leverage the fact that IARs, similarly to LLMs, perform per-token prediction to obtain signal from every predicted token. However, while LLMs' training is fully self-supervised (e.g.. by predicting the next word), the train- ing of IARs can be conditional (based on a class or prompt) as in DMs. We exploit this property, previously leveraged for DMs (Zhai al., 2024), and compute the difference in outputs between conditional and unconditional inputs as input to MIAs. This approach allows us to achieve remarkably strong performance of 86.38% % TPR @ FPR=1 %.
these approaches form a comprehensive framework for em- pirically evaluating the privacy risks of IARs.
Our empirical analysis of state-of-the-arr IARs and DMs across various scales suggests that IARs that match their DM-counterparts in image generative capabilities are no- tably more susceptible to privacy leakage. We also explore the trade-offs between privacy risks and other model prop- erties. Specifically, we find that, while IARs are more cost-efficient, faster, and more accurate in generation than DMs, they empirically exhibit significantly greater privacy leakage (see Figure/ 1) measured against SOTA privacy at- tacks tailored against the respective model types. These findings highlight a critical trade-off between performance, efficiency, and privacy in IARs.
We employ our novel MIA to provide an efficient dataset inference (DI) (Maini al., 2021) method for IARs. DI gen- eralizes MIAs by assessing membership signals over entire datasets, providing more robust measure of privacy leak- age. Additionally, we optimize DI for IARs by eliminating the stage of MIA selection for given dataset, which was necessary for prior DIs on LLMs (Maini et al., 2024; Zhao et al., 2025) and DMs (Dubiński et al., 2025). Since our MIAS for IARs consistently produce higher scores for mem- bers than for non-members, all MIAs can be utilized without any selection. This optimizations reduced the number of samples required for DI in IARs which is significantly fewer than at least 200 samples re- quired for DI in DMs. Finally, we examine the privacy leakage from IARs through the lens of memorization (Feld- man, 2020; Wen et al., 2024; Huang et al., 2024; Wang et al., 2024a;b; Hintersdorf et al., 2024; Wang et al., 2025). Specificallyy we assess the IARs' ability to reproduce ver- batim outputs from their training data during inference. We experimentally demonstrate that the evaluated IARs have substantial tendency to verbatim memorization by extracting 698 training samples from VAR-d30, 36 from RAR-XXL, and 5 from MAR-H. These results highlight the varying degrees of memorization across models and reinforce the importance of mitigating privacy risks in IARs. Together,
In summary, make the following contributions:
Our new MIA for IARs achieves extremely strong perfor- mance of even 86.38% % TPR @ FPR=1% %, improving over naive application of MIAs by up to 69%
We provide potent DI method for IARs, which requires as few as 6 samples to assess dataset membership signal.
few as 6 samples,
We propose an efficient method of training data extraction from IARs, and successfully extract up to 698 images.
IARs can outperform DMs in generation efficiency and quality but suffer order-of- -f-amn-tu- higher privacy leakage in MIAs, DI, and data extraction compared to DMs that demonstrate similar FID.
2. Background and Related Work
Notation. We first introduce the notation used throughout the remainder of this paper:
2

---

Privacy Attacks on Image AutoRegressive Models
Symbol
Deseription
MAR (Li et al., 2024) uses a small DM to model p(x) from
C, H. ROXHXW
Channels, height, width, sequence length
Equation (1), and samples tokens from it during inference.
Original image
MAR is trained with the following loss objective:
A ROXNXX
Generated image
E EENN
Tokenized image
EE N
Generated token sequence
Lom = Ee,s [|le co (t s. s. [19]
(3)
Image AutoRegressive modeling. Originally, Chen et al. (2020) defined image autoregressive modeling as:
where E ~N(O, I), ca is the DM, E = Vagtn + vI āie and c₂ is DDIM's (Song al., 2020) noise schedule, is the timestep for diffusion process, and is conditioning imput, obtained from the autoregressive backbone, from the previous tokens. This loss design allows MAR to operate with continuous-valued tokens, contrary to VAR and RAR, which use discrete tokens. MAR also integrates masked prediction strategies from MAE (He al., 2022), into the IAR paradigm. Specifically, MAR predicts masked tokens, based unmasked ones, formulated as p(æ -M x M), where M E [0, 1 is random binary mask. Like to RAR, MAR utilizes bidirectional attention during training. Its autoregressive backbone differs from other IARs, as MAR employs a ViT (Dosovitskiy et al., 2021) backbone.
N = II p(t | t1, (h.t2)...,f,11))) ==1
p(x)
(1)
where N the number of pixels in the image, 4 is the value of 7th pixel of image x ~ Dirain (training data), where pixels follow raster-scan order, row-by-row, left-to-right. During training, the goal is to minimize negative log- ligelekeoohoo::
LAR = Daw [-log (p (I))].
(2)
However, learning pixel-level dependencies directly is computationally expensive. To address the issue, VQ- GAN (Esser et al., 2020) transforms the task from next- pixel to next-token prediction. First, the VQ-GAN's encoder maps an image into (lower resolution) latent feature vector, which is then quantized into a sequence of tokens, by a learnable codebook. In effect, the sequence length is short, which enables higher-resolution and high-quality generation. Then, tokens are generated and projected back to the im- age space by VQ-GAN's decoder. All the subsequent IARs we introduce, utilize tokens from VQ-GAN. This token- based formulation aligns image generation more closely with natural language processing. Additionally, similarly to autoregressive language models such as GPT-2 (Radford et al.), which generate text by sequentially predicting tokens, modern IARs also employ transformer-based (Vaswani et al., 2017) architectures model dependencies between image tokens. We focus on the recent state-of-the-art IARs.
Sampling for IARs is based on p(x)), which models the distribution of the next token conditioned on the previous ones in the sequence. For VAR and RAR, operating on discrete tokens, the next token can be predicted via greedy or top-k sampling. In contrast, MAR samples tokens by the DM module, which performs 100 DDIM (Song et al., 2020) denoising steps. During a single sampling step, VAR outputs a 2D token map. RAR predicts a single token, and MAR generates batch of tokens.
3. Privacy Evaluation Frameworks
We assess IARs' privacy risks from the three perspectives of membership inference, dataset inference, and memorization.
3.1. Membership Inference
VAR (Tian et al., 2024) is novel approach to image gen- eration, which shifts the focus of traditional autoregressive learning from next-token to next-scale prediction. Unlike classical IARS, which generate 1D token sequences from images by raster-scan orders, VAR introduces a coarse-to- fine multi-scale approach, encoding images into hierarchical 2D token maps and predicting tokens progressively from lower to higher resolutions. This preserves spacial locality and significantly improves scalability and inference speed.
Membership Inference Attacks (MIAs) (Shokri et al., 2017) aim to identify whether a specific data point was part of the training dataset for a given machine learning model. Many MIAs have been proposed for DMs (Duan al., 2023c; Zhai et al., 2024; Carlini et al., 2023; Kong et al., 2023), but these methods are tailored to DM-specific properties and do not transfer easily to LARs. For instance, some di- rectly exploit the denoising loss (Carlini et al., 2023), while others (Kong et al., 2023), leverage discrepancies in noise prediction between clean and noised samples. CLiD (Zhai et al., 2024) sources membership signal from the difference between conditional and un-conditional prediction of the DM. Since IARs are also trained with conditioning input, we leverage CLiD to design our MIAs in Section 5.1.
RAR (Yu et al., 2024) introduces bidirectional context modeling into IAR. Building on findings from language modeling, specifically BERT (Devlin et al., 2019), RAR highlights the limitations of unidirectional approach, and enhances training by randomly permuting token sequences and utilizing bidirectional attention. RAR optimizes Equa- tion (2) over all possible permutations, enabling the model to capture bidirectional dependencies, resulting in higher quality generations.
MIAs are also popular against LLMs (Mattern et al., 2023; Shi et al., 2024) where they often work with per-token logit outputs of the model. For example, Shi et al. (2024) in-
3

---

Privacy Attacks on Image AutoRegressive Models
troduce the MIN-K% PROB metrie, which computes the mean of lowest -%-loo-likellhoodd in the sequence, where k is hyperr-arameter. Zlib (Carlini et al., 2021) leverages the compression ratio of predicted tokens using the zlib li- brary (Gailly& & Adler, 2004) to adjust the metric to the level of complexity of the input sequence. Hinge (Bertran et al., 2024) metric computes the mean distance between tokens' ligeleilihood and the maximum of the remain- ing log-likelihoods. SURP (Zhang& & Wu, 2024) computes the mean of log- logllikelihood of the tokens with the lowest -%-loo-llkelihoodd in the sequence, where & is some pre- defined threshold. MIN-K%++ (Zhang et al., 2024b) is based on MIN-K% PROB, but the per-token log-likelihoode are normalized by the mean and standard deviation of the bog-liiclihoods of preceding tokens. CAMIA (Chang et al., 2024) computes the mean of log-likelihoods that are smaller than the mean log- ligelikli,,,d, and the mean of log-likelihoods that are smaller than the mean of the log-likelihoods of preceding tokens, as well as the slope of log-likelihoods. More detailed description of MIAs can be found in Appendix D.2. While LLM MIAs seem to be a natural choice for membership inference on IARs, it is completely unclear whether approaches from the language domain transfer to IARs. In our work we show that the success of this transferability is limited (see Section 5.1), hence, we design novel MIAs, by exploiting unique proper- ties of TARs. Our methods achieve significant improvements over initial MIAs with up to 69% higher TPR @ @FP=11% compared to the baselines.
test data, and then to LLMs (Maini et al., 2024; Zhao et al., 2025) and DMs (Dubińíki al., 2025) identify the train- ing datasets in large generative models. Since DI relies on model-specifte properties, it is unclear how it can be ap- plied to IARs. We propose how to make DI applicable and effective for IARs.
Setup for DI. DI relies on two data sets: (suspected) mem- ber and (confirmed) non-member sets. First, the method extracts features for each sample using MIAs. Next, it aggregates the features for each sample, and obtains the final score, which is designed so that it should be higher for members. Then, it formulates the following hypothesis test: Ho : mean(score: of suspected member samples) s mean(scores of members),, and uses the Welch's t-test for evaluation. If we reject Ho at a confidence level = 0.01, we claim that we confidently identified suspected members as actual members of the training set.
Since the strength of the I-test depends on the size of both sample sets, the goal is to reject Hg with as few samples as possible. Intuitively, as the difference in a model's behav- ior between member and non-member samples increases, rejecting Ho becomes easier. A larger difference also indi- cates greater information leakage, allowing us to use DI to compare models in terms of privacy risks. For instance, if model A allows rejection of Ho with 100 samples, while model B requires 1000 samples, model A exhibits higher leakage than model B. Throughout this paper, we refer to the minimum number of samples required to reject the null hypothesis as P.
3.2. Dataset Inference
Assumptions about Data. For the hypothesis test to be sound, the suspected member set and non-member set must be independently and identically distributed. Otherwise, the result of the t-test will be influenced by the distribution mismatch between these two sets, yielding a false positive prediction.
Dataset Inference (DI) (Maini et al., 2021) aims to deter- mine whether a specific dataset was included in a model's training set. Therefore, instead of focusing on individual data points like MIAs, DI aggregates the membership signal across a larger set of training points. With this strong signal, it can uniquely identify whether a model was trained on a given (private) dataset, leveraging strong statistical evidence. Similarly to MIAs, DI can serve as a proxy for estimating privacy leakage from a given machine learning model: DI provides insight into how easily one can determine which datasets were used to train model, for instance, by analyz- ing the effect size from statistical tests. A higher success rate in DI indicates greater potential privacy leakage.
3.3. Memorization
Memorization in generative models refers to the models' ability to reproduce training data exactly or nearly indistin- guishably at inference time. While MIAs and DI assess if given samples were used to train the model, memorization enables extracting training data directly from the model (Car- lini et al., 2021; (9223)-highlight an extreme privacy risk.
Previous DI Methods. For supervised models, DI involves the following three steps: (1) obtaining specific features from data samples, based on the observation that training data points are further from decision boundaries than test samples, then (2) aggregating the extracted information through a binary classifier, and (3) applying statistical tests to identify the model's train set. This approach was later extended to self-supervised learning models (Dziedzic et al., 2022a;b), where training data representations differ from
In the vision domain, a data point x is memorized, if the distance 1(x, 2) from the original æ and the generated image is smaller than a pre-defined threshold 7 (Carlini et al., 2023). We use the same definition when evaluating our extraction attack in Section 5.3.
Intuitively, in LLMs, memorization can be understood as the model's ability to reconstruct a training sequence t when given a prefix e (Carlini et al., 2021). Specifically,
4

---

Privacy Attacks on Image AutoRegressive Models
1 argmax Pa (f]c), where pe is the probability dis- tribution of the sequence t', parameterized by the LLM's weights 0, akin to Equation (I). This formulation states we can extract the training sequence t by constructing a prefix e that makes the model output I, with greedy sampling.
increase, the membership signal strengthens, improving MIAs' performance in identifying member samples. Even in the best case (CAMIA with TPR@ 1 of 16.69% on the large VAR- d30), the results indicate that the problem of reliably identifying member samples remains far from being solved. These findings align with results reported for other types of generative models, as demonstrated by Maini et al. (2024); Zhang al. (2024a); Duan et al. (2024) in their evaluation of MIAs on LLMs and by (Dubiñísk et al., 2024; Zhai et al., 2024) for DMs, where the utility of MIAs for models trained on large datasets was shown to be severely limited.
Similarly to LLMs, IARs complete an image given an initial portion of it (a prefix), which we leverage for designing our data extraction attack. In contrast, extraction from DMs can rely only on the conditioning input (class label or text prompt), which is both costly and highly inefficient, e.g,, work by Carlini et al. (2023) requires to generate 175M images in order to find just 50 memorized images, and no memorization has been shown for other large DMs. In contrast, we extract up to 698 training samples from IARs by conditioning them on a part of the tokenized image, requiring only 5000 generations.
Our MIAS for VARs and RARs. To provide powerful MIAs for TARs, we leverage the models' key properties. Specifically, we exploit the fact that IARs utilize classifier- free guidance (Ho & Salimans, 2022) during training, i.e., in the forward pass, images are processed both with and without conditioning information, such as class label. This distinguishes IARs from LLMs, which are trained without explicit supervision (no conditioning). Consequently, MIAs designed for L.MSs fail to take advantage of this additional conditioning information present in IARs. We build on CLiD (Zhai et al., 2024), and compute p(arle) - (Cmutt) where claass label, Cual--uull class, and use this differ- ence as an input to MIAs, instead of per-token logits. We differ from CLiD in the following way: (1) Our method works directly on p(z). whereas CLiD uses model loss to perform the attack. (2) Our attack is parameter free-CLiD requires hyperparameter search and set of samples to fit Robust-Scaler to stabilize the MIA signal. We provide more generalized approach, moreover ble I demonstrate even up to a 69.69% increase in the TPR @ @FP=1% % for the VAR-d30 model.
4. Experimental Setup
We evaluate state-of-the art IARs: 16, 20, 24, 30} (d = model depth), RAR-(B, (B. L, XL, XXL), MAR-(B, L, H]. trained for class-oonditioned generation. The IARs" sizes cover broad spectrum between 208M for MAR-B, and 2.1B parameters for V3R-d30. We use IARs shared by the authors of their respective papers in their repositories, with details in Appendix E. As these models were trained on ImageNet- k (Deng et al., 2009) dataset, we use it to perform our privacy attacks. For MIA and DI, we take 10000 samples from the training set as members and also 10000 samples from the validation set as non-members. To perform data extraction attack, we use all images from the training data. Additionally, we leverage the known validation set to check for false positives.
results in Ta-
Our MIAs for MARs. Many MIAS for LLMs (Hinge, MIN- K *%++, SURP) require logits to compute their membership scores. However, we cannot apply these MIAS MAR since MAR predicts continuous tokens instead of logits. We instead use per-token loss values obtained from Equation (3) to adapt other L.M MIAS (Loss, Zlib, MIN-K% PROB, CAMIA). As the tokens for MAR are generated using a small diffusion module, we can apply insights from MIAs designed for DMs and target the diffusion module directly in our attack. We detail our MIA improvements for MAR, which counter randomness from the diffusion process and binary masks.
5. Our Methods for Assessing Privacy in IARs
In the following we investigate privacy risks of IARs. We start from baseline, LLM- approaches, and show how to tailor them to IARs to increase privacy leakage. As we find that IARs leak more than DMs we provide insights to explain why does it happen.
5.1. Tailoring Membership Inference for IARs
Baselines. We comprehensively analyze how existing MIAs designed for LLMs transfer to IARs. Our results in Table (detailed in Appendix H) ) indicate that off-tf MIAS for LLMS perform poorly when directly applied to IARs. We report the TPR @ FPR=1% metric to measure the true positive rate at a fixed low false positive rate, which standard metric to evaluate MIAs (Carlini et al., 2022). For smaller models, such as VAR-d16, MAR-B, and RAR-B, all MIAs exhibit performance close to random guessing (~ 1%). As model size and the number of parameters
Improvement 1: Adjusted Binary Masks. MAR extends the IAR framework by incorporating masked prediction strategies, where masked tokens are predicted based on visible ones. We hypothesize that adjusting the masking ratio during inference can amplify membership signals. We increase this parameter from 0.86 (training average) 0.95, which improves MIA and suggests that an optimal masking
5

---

Privacy Attacks on Image AutoRegressive Models
Table I: Performance of our MIAs vs baselines. We report the standard TPR (PR@PP==1% % for best MIAs per model.
Baselines refers to a unmodified naive application of LLM-specifie MIAs to IARs.
Model
VAR-/16
VAR-d20
VAR-/24
VAR-d30
MAR-B
MAR-L
MAR-H
RAR-B
RAR-I
RAR-XI
RAR-XXI
Baselines
1.62
2.21
3.72
16:68
1.69
1.89
2.18
2.36
3.25
6.27
14.62
Our Methods
2.16
5.95
24.03
86,38
2.09
2.61
3,40
4.30
8.66
26.14
49,80
Improvement
+0.54
+3.73
+20.30
+69.69
+0.40
+0.73
+1.22
+1.94
+5.41
+19.87
+35.17
rate exposes more membership information.
TARs emerging as a less private alternative to DMs, we in- vestigate the causes behind that phenomenon. First, we ask if IARS inherently leak more because of their design. We identify three key characteristics of IARs that cause greater leakage: (1) Access to p(x) IARs expose it at the out- put, contrary DMs. (2) AutoRegressive training exposes IARs to more data per update. (3) Each token predicted by an IAR leak unique information about the model, ampli- fying leakage. We provide more details in Appendix A. Next, we scrutinize architecture-agnosti causes of leakage: training duration, and model size. Our results in Table 5 in Appendix A.2 show that indeed, these two factors cor- relate with the leakage metries. Interestingly, for TARs the vulnerability differs with model size, while for training duration. We also test a binary factor "Is IAR" (1 if the model is IAR, O otherwise), which also correlates with metrics, further confirming our intuitions about the inherent causes of leakage in IARs. We note taht MIAs are significantly less effective at identifying member samples in MARS. We attribute this to MAR's 's use of diffusion loss function (Equation (3)) for modeling per-token probability, which replaces categorical cross-entropy loss and eliminates the need for discrete-valued tokenizers.
Improvement& 2: Fixed Timestep. Carlini et al. (2023) re- ported that MIAs on DMs perform best when executed for a specific denoising step f. Since tokens in MAR are gener- ated using a small diffusion module, we can take advantage of this by executing MIAs at fixed timestep rather than randomly chosen one. Interestingly, we find that = 500 is the most discriminative, differing from the findings for full-scale DMs, for which I = 100 gives the strongest sig- nal Carlini et al. (2023).
Improvement 3: Reduced Diffusion Noise Variance. The MAR loss in Equation (3) exhibits high variance due to its dependence on randomly sampled noise c. To mitigate this, we increase the noise sampling count from the default 4 used during training to 64, computing the mean loss to obtain a more stable signal.
More detailed description of these improvements can be found in Appendix G. Our results in Table 2 highlight the importance of our changes evaluate MAR's privacy leak- age correctly. Thanks to our improved MIAs do not under-report the privacy leakage they exhibit.
Table 2: Ablation of improvements to MAR MIAs. Each modification further strengthens the membership signal. We report TPR FPR=1% % values and gains.
Vulnerability of IARs Through a Lens of a Unified MIA Finally, we look into the DM- and IAR-specific MIAs used in our study. We acknowledge that because DMs and IARs are two different classes of models, the MIAs that target each of the architectures also differ. Effectively, that vari- ability might be the root cause of the observed discrepancy in MIA success. To evaluate that idea, we design a Uni- fied MIA-an identical MIA for DMs and IARs-based on model- and architecture-agnosti. Loss Attack (Yeom et al., 2018). We discard any IAR specific improvements intro- duced in this section, and any DM-specific improvements from prior work (Carlini et al., 2023). Effectively, with Uni- fied MIA we mitigate the potential intluence of discrepancy in the MIA design on the final privacy assessment. Our results in Table 7 show that Unified MIA performs better than random guessing against IARs, while DMs show no leakage from that attack.
Method
MAR-B
MAR-L
MAR-H
Baseline
1.69
1.89
2.18
+ Adjusted Binary Mask
1.88 (40.19)
2.25 (+0.36)
2,88 (40.70)
+
Fixed Timestep
1.88 (+0.00)
2.41 (+0.17)
3,30 (+0.42)
Reduced Noise Variance
2.09 (+0.21)
2.61 (+0.20)
3,40 (+0.10)
Overall Performance and Comparison to DMs We
present our results in Figure 1, evaluate overall privacy leak- age and compare IARs to DMs based on the TPR TPR@FPR=1%% of MIAs. For DMs we use the strongest attack available at the time of writing this saper-CLiD. (Zhai et al., 2024). In general, smaller and less performant models exhibit lower privacy leakage, which increases with model size. Notably, VAR-d30 and RAR-XXX achieve TPR @ @FPR=1 1% values of 86.38% and 49.49998.9 99.8%% respectively, indicating substantially higher privacy risk in IARs compared to DMs. In contrast, the highest TPR @ FPR=1% 1%% observed for DMs is only 6.38% for SLT-XL/2 (see also Table 18).
5.2. Dataset Inference
While our results in Table demonstrate impressive MIA performance for large models (such as VAR-230 with 2.1B parameters), privacy risk assessment for smaller models
Possible Reasons Behind Higher Leakage of TARs With
6

---

Privacy Attacks on Image AutoRegressive Models
Table 3: DI for IARs. We report the reduction in the number of samples required to carry out DI. Our improvements allow to successfully run DI on IARs even with fewer than 10 samples. Baseline refers to LLM DI (Maini et al., 2024).
Model
VAR-16
VAR-420
VAR-424
VAR=400
MAR-B
MAR-I
MAR-H
RAR-B
RAR-I
RAR-XL
RAR-XXI.
Baseline
2000
300
60
5000
2000
900
500
200
40
30
Optimized Procedurre
600
200
40
4000
2000
800
80
30
10
Improvement
1400
-100
-20
-12
-1000
-100
-200
-120
-10
-20
+Our MIAs for IARs
200
40
20
2000
600
300
80
30
20
8
Improvement
4000
160
-20
2000
1400
5000
-200
-50
-10
-2
(such as VAR-d16 with 310M parameters) needs improve- ment. To address this, we draw on insights from previous work on DI (Maini et al., 2024; Dubiński et al., 2025), which has proven effective when MIAs fail to achieve satisfac- tory performance. The advantage of DI over MIAs lies in its ability to aggregate signals across multiple data points while utilizing a statistical framework to amplify the overall membership signal, yielding more reliable privacy leakage assessment. We find that while the framework of DI ap- plicable IARs, its crucial parts must be improved to boost DI's effectiveness on IARs. In the following we detail these improvements.
data. Building on the performance gains of our tailored MIAs (Table 1) we apply them to the DI framework as the more powerful feature extractors to further strengthen DI for IARs. Our improvements through stronger MIAs further enhance DI, fully exposing privacy leakage in IAR models. As a result, the number of required samples to execute DI drops to a few hundred, for example, down to only 200 for VAR-d16. Overall, as shown in Table 3, replacing the linear classification model with summation and transitioning to our MIAs for IARs as feature extractors significantly reduces the number of samples required to reject Ho-
Improvement 1: Optimized DI Procedure. Exist- ing DI techniques for LLMs (Maini et al., 2024) and DMs (Dubiński et al., 2025) follow a four-stage process, with the third stage involving the training of linear classi- fier. This classifier is used to weight, scale, and aggregate signals from individual MIAs, where each MIA score serves as a separate feature. This step is crucial for selecting the most effective MIAs for a given dataset while suppressing ineffective ones that could introduce false results. However, we observe that MIA features for IARs are well-behaved, meaning that, on average, they are consistently higher for members than for non-members. Thus, instead of training linear classifier on MIA features, which requires additional auditing data, we adopt a more efficient approach: we first normalize each feature using MinMax to the [0,1] in- terval, and then we sum them to obtain the final per-sample score, used by the t-test. This eliminates the need to allocate scarce auditing data for training a linear classifier.
Architecture
3.5-
PiD flover botter)
3.5
DMs
Size
LBM
<D01M
2.0-
UNST
200 s000
500M.18
1.5-
101
160
P (lowwer - lasss private))
Figure 2: DI success for LARs vs DMs. We report the gen- erative quality expressed with the FID score vs the number of suspect samples P required to carry out DI.
Overall Performance and Comparison to DMs. We present our results in Figure 2. evaluating the overall privacy leakage and comparing IARs to DMs based on the number of required samples (P) to perform DI. Recall that a lower P under the DI framework indicates greater privacy vulner- ability, it means fewer data points are needed to reject the null hypothesis Ho- Our findings indicate that the same trend observed in MIAS extends to DI. Overall, models with higher TPR @ FPR=1 % in Table for MIAS also require smaller suspect sets P for DI. Specifically, DI shows that larger models exhibit greater privacy leakage, with VAR- d30 and RAR-XXI being the most vulnerable. Crucially, our results clearly demonstrate that IARs are significantly more susceptible to privacy leakage than DMs. While MDT shows lower generative quality (as indicated by higher FID score), it requires substantially more samples for DI (higher P value), resulting in much lower privacy leakage.
Our results for the optimized DI procedure are presented in Table 3. We observe a significant reduction in the number of samples required to perform DI for smaller models, with reductions of up to 70% for VAR-d16.
Improvement 2: Our MIAS for IARs. Our results in Ta- ble 3 indicate that as model size increases, the membership signal is amplified, enabling DI achieve better perfor- mance with fewer samples. However, the main problem is the mixed reliability of DI when utilizing baseline MIAs as feature extractors. This issue is especially evident for smaller models, such as VAR-d16 and MAR-B, where DI requires thousands of samples to successfully reject the null hypothesis when the suspect set is part of the training
Why do We (Again) Observe Higher Leakage of LARs? MIAS are the backbone of the DI framework, extracting
7

---

Privacy Attacks on Image AutoRegressive Models
features from the samples to capture differences between members and non-members. When they succeed more for one class of the models, we expect that DI will also per- form better for that class. With MIAs, we observe higher leakage of IARs, which stems from the increased differ- ence between the distributions of the -IA-specific score for member and non-member samples. Because we use these scores to perform the t-test, when the difference between these distributions increase, Ho- Importantly, all insights about leakage from MIAs (Sec- tion 5.1) also hold for DI. Results for correlation (Table 5) and DI performance with Unified MIA as the feature extrac- tor (Table 7) corroborate the ones for MIA, and provide an alternative perspective into the privacy of TARs.
blocks of the attack.
1) Candidate Identification. To reduce the computational costs, we do not simply generate large pool of images, but identify promising candidate samples that might be mem- orized, before generation. Specifically, we feed an entire tokenized image into the IAR, which predicts the full token sequence f in single step. Then, we compute the distance between original and predicted sequence, d(t, f), which we use to filter promising candidates. This approach is efficient, since for IARs the entire token sequence can be processed at once, significantly faster than if we sampled them itera- tively. For VAR and RAR we use per-token logits, and apply
need a smaller P to reject
greedy sampling, with d(t, t) = 100 100 -0.E.. C,",,(((=()) an average prediction error. For MAR, we sample 95% of the tokens from the remaining 5% unmasked in a single step, and set d(t, 8) = ||t l12 as MAR's tokens are continuous. Following the intuition that f is memorized if f = t, for each model, for each class we select top-5 samples with the smallest d, and obtain 5000 candidates per model. Our can- didate identification steps greatly improves the extraction efficiency over previous approaches (Carlini et al., 2023). We show the success of our filtering in Appendix K.3.
N
VAR-U30
BAR-XNL
MAR-H
Ociiaal
2) Generation. Then, following the methodology estab- lished for LLMs by (Carlini et al., 2021). for each candidate we select the first tokens prefix. The parameter i is hyperparameter and present our best choices for the models in Table 21. We perform iterative greedy sampling of the remaining tokens in the sequence for VAR and RAR, and for MAR we sample from the DM batch by batch. We do not use classificr-fre guidance during generation. We note that our method does not produce false positives, iee, we do not generate samples from the validation set.
Extestel
Figure 3: Extracted Training Samples. We note that IARs can reconstruct verbatim images from their training data. The first row shows the original training samples and the second one presents the extracted images.
5.3. Extracting Training Data from LARs
3) Assessment. Finally, decode the obtained i into images, and assess the similarity to the original t. Follow- ing Wen et al. (2024), we use SSCD (Pizzi et al., 2022) score to calculate the similarity, and set the threshold r = 0.75 such that every sample with a similarity 2 will be consid- ered as memorized.
To analyze memorization in IARs, we design novel train- ing data extraction attack for IARs. This attack builds on elements of data extraction attacks for LLMs (Carlini et al., 2021) and DMs (Carlini et al., 2023). Integrating elements from both domains is required since IARs operate on tokens (similarly to L.Mss), which are then decoded and returned as images (similarly to DMs). In particular, we make the observation that, on the token level, IARs exhibit similar behavior that was previously observed for LLMs (Carlini et al., 2021). Namely, for memorized samples, they tend to complete the correct ending of a token sequence when prompted with the sequence's prefix. We exploit this behav- ior and 1) identify candidate samples that might be mem- orized, 2) generate them by starting from prefix in their token space, and sampling the remaining tokens from the IAR, and finally 3) compare the generated image with the original candidate image. We report a sample as memorized when the generated image is near identical to the original image. In the following, we detail the individual building
Table 4: Count of Extracted Training Samples per IAR.
Model
VAR-d30
MAR-H
RAR-XXI.
Count
698
5
36
Results. In Figure 3 we show example memorized samples from VAR-d30, RAR-XXL, and MAR-H. We are not able to extract memorized images from smaller versions of these IARs. In Table 4 we see that the extent of memorization is severe, with VAR-d30 memorizing 698 images. We observe lower memorization for MAR-H and RAR-XXL, which is intuitive, as results from Sections 5.1, and 5.2 show that VAR-d30 d30 is the most vulnerable to MIA and DI. Surpris- ingly, there is no memorization in token space, i.e., t + i,
8

---

Privacy Attacks on Image AutoRegressive Models
observe it only in the pixel space. We provide more examples of memorized images in Appendix K.1.
IARs empirically exhibit significantly higher privacy risks than DMs, given the current state of privacy attacks against the respective model types. Concretely, we develop novel MIA for IARs that leverages components of the strongest MIAS from LLMs and DMs to reach an extremely high 86.38 % TPR @ FPR=1%; %, as opposed to merely 6.38% for the strongest DM-specific MIAs in respective DMs. Our DI method further confirms the high privacy leakage from IARs by showing that only 6 samples are required to detect dataset membership, compared to at least 200 for reference DMs of comparable image generation utility. We also create a new data extraction attack for LARs that reconstructs even up to 698 training images from VAR-d30 while previous work showed only 50 images extracted from DMs. Our results indicate the fundamental privacy-utility trade-off for IARs, where their higher performance comes at the cost of more severe privacy leakage. We explore preliminary mitigation strategies inspired primarily by diffusion- -baeed approaches, however, the initial results indicate that dedicated privacy- preserving techniques are necessary. Our findings highlight the need for stronger safeguards in the deployment of LARs, especially in sensitive applications.
Memorization Insights. Many memorized samples follow pattern: their backgrounds deviate from the "default" or typical scene, as shown in Figure 8 and Appendix K.1. We hypothesize that when a prefix contains part of this "unusual" background, the LAR is conditioned to reproduce the spe- cific training image that originally featured it. Additionally, several extracted images appear as poorly executed center crops with skewed proportions-set for instance, the wine bottle in Figure 7. These findings suggest memorization is driven by distinct visual cues in the prefix and can lead to the generation of replicas of its training data. Moreover, the same 5 samples were extracted from both VAR-d30 and RAR-XXL, i.e., the same 5 training images are memorized by both models. One sample is memorized by both VAR- d30 and MAR-H (Fig. 8 and S)suuggst some images are more prone to memorization across architectures,
Our results contrast with findings on DMs (Carlini et al., 2023), where extracting training data requires far more com- putation. The high memorization in IARs likely stems from their size, as VAR-d30 has 2.1B parameters-mon than twice the number of parameters in DMs investigated in prior work. Importantly, our results also show link between IAR size and memorization, with bigger IARs memorizing more. Scaling laws suggest that as IARs grow larger, their perfor- mance improves, but so does their tendency to memorize, making privacy risks more severe in high-capacity models.
Impact Statement
Image autoregressive models (IARs) have rapidly gained popularity for their strong image generation abilities. How- ever, the privacy risks that come associated to these ad- vancements have remained unexplored. This work makes a first step towards identifying and quantifying these risks. Through our findings, we highlight that IARs empirically experience significant leakage of private data. These find- ings are relevant to raise awareness of the community and to steer efforts towards designing dedicated defenses. This enables a more ethical deployment of these models.
6. Mitigation Strategies
Our privacy assessment methods rely on precise outputs from IARs to be effective. We exploit this insight to design defenses that mitigate privacy risks by perturbing model outputs, e,g, with random noise. For VAR and RAR, we noise the logits, while for MAR, we add noise to contin- uous tokens after sampling. Our preliminary evaluation in Appendix J shows that the defenses are insufficient for VAR and RAR, as reducing the success of privacy attacks is achieved at the cost of substantially lower performance. In contrast, our proposed defense helps to protect MAR even more, with a relatively low drop in performance. However, MAR already exhibits the lowest success rate of the privacy attacks. This further emphasizes that leveraging diffusion techniques is promising direction towards strong privacy safeguards for IARs, though further investigation is needed to confirm its effectiveness.
Acknowledgments
This work was supported by the German Research Founda- tion (DFG) within the framework of the Weave Programme under the project titled "Protecting Creativity: On the Way to Safe Generative Models" with number 545047250. We also gratefully acknowledge support from the Initiative and Networking Fund of the Helmholtz Association in the framework of the Helmholtz AI project call under the name "PAFMIM", funding number ZT-I-PF-5-2277 Responsibility for the content of this publication lies with the authors. This research was also supported by the Polish National Science Centre (NCN) within grant no. 2023/51 1/1/ST6/02854 and by Warsaw University of Technology within the Excellence Ini- tiative Research University (IDUB) programme. We would like to also acknowledge our sponsors, who support our research with financial and in-kind contributions, especially the OpenAl Cybersecurity Grant.
7. Discussion and Conclusions
IARs are an emerging competitor to DMs, matching or sur- passing them in image quality at higher generation speed. However, our comprehensive analysis demonstrates that
9

---

Privacy Attacks on Image AutoRegressive Models
References
Devlin, Chang, M.-W., Lee, K., and Toutanova, K. Bert: Pre-training of deep bidirectional transformers for lan- guage understanding, 2019. URL https://arxit org/ aaaaabs/11111 04805.
Code repository for torchprofile python library., 2021. URL https: //gtthub.t com/ zhij shin-inn-ie 1iu/ torchprofile.
Bao, F., Nie, S., Xue, K., Cao, Y., Li, C., Su, H., and Zhu, J. All are worth words: A vit backbone for diffusion models. In CVPR, 2023.
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer,
M., Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale, 2021. URL https: / /aaxiiv. org. hbsp//bs///2 2ttps/211..19990
Bertran, M., Tang, S., Roth, A., Kearns, M., Morgenstern, H., and Wu, S. Z. Scalable membership inference attacks via quantile regression. Advances in Neural Infor- mation Processing Systems, 36, 2024.
Duan, H., Dziedzic, A., Papernot, N., and Boenisch, F. Flocks of stochastic parrots: Differentially private prompt learning for large language models. In Thirty-seventh Conference on Neural Information Processing Systems (NeurIPS), 2023a.
Carlini, N., Tramèr, F., Wallace, E., Jagielski, M., Herbert- Voss, A., Lee. K., Roberts, A., Brown, T., Song, D., Erlingsson, Ú., Oprea, A., and Raffel, C. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 2/). pp. 2633-2650. USENIX Association, August 2021. ISBN 978-1-939133-24-3. URL http:://:///ww usenix. wwwpofferenneeusssiieeeeeeeeeeee aresentatioon/cariniieetttt
Duan, H., Dziedzic, A., Yaghini, M., Papernot, N., and Boenisch, F. On the privacy risk of in-context learning, In The 6l Annual Meeting Of The Association For Com- putational Linguistics, 2023b.
Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., and Tramèr, Membership inference attacks from first prin- ciples. In 2022 IEEE Symposium on Security and Privacy (SP), pp. 1897-1914, 2022. doi: 10. N0.1109/SP46244.022 9833649.
Duan, J., Kong, F., Wang, S., Shi, X., and Xu, K. Are diffu- sion models vulnerable to membership inference attacks? In Proceedings of the 40th International Conference on Machine Learning, volume 202 Proceedings of Ma- chine Learning Research, pp. 8717-8730. PMLR, 23-29 Jul 2023c.
Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramer, F., Balle, B., Ippolito, D., and Wallace, E. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pp- 5253-5270, 2023.
Duan, M., Suri, A., Mireshghallah, N., Min, S., Shi, W., Zettlemoyer, L., Tsvetkov, Y., Choi, Y., Evans, D., and Hajishirzi, H. membership inference attacks work on large language models? arXiv preprint arXiv:2402.078:: 2024.
Chang, H., Shamsabadi, A. S., Katevas, K., Haddadi, H., and Shokri, R. Context-aware membership inference attacks against pre-trained large language models. arXiv preprint KKV::2409.13745 2024.
Dubiński, J., Kowalezuk, A., Pawlak, S., Rokita, P., Trzciñski, T., and Morawiecki, P. Towards more realistic membership inference attacks on large diffusion models. Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 4860, 2024.
Chen, M., Radford, A., Child, R., Wu, J., Jun, H., Luan, D., and Sutskever, I. Generative pretraining from pixels. In International conference machine learning, pp. 1691 1703. PMLR, 2020.
Dubiński, J., Kowalczuk, A., Boenisch, F., and Dziedzic, CDI: Copyrighted Data Identification in Diffusion Models. In The IEEE CVF Computer Vision and Pattern Recognition Conference (CVPR), 2025.
Dao, Q., Phung, H., Nguyen, B., and Tran, A. Flow match- ing in latent space. arXiv preprint arXiv:2307.0860 2023.
Dwork, C. Differential privacy. In International colloquium on automata, languages, and programming, pp. 1-12. Springer, 2006.
Das, D., Zhang, J., and Tramèr, F. Blind baselines beat mem- bership inference attacks for foundation models. arXiv preprint ar Xiv::22006. 0et.00066622... 16201, 2024.
Deng, J., Dong, W., Socher, R., Li, L.-J., K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255 leee, 2009.
Dziedzic, A., Dhawan, N., Kaleem, M. A., Guan, J., and Pa- pernot, N. On the difficulty defending supersuue learning against model extraction. In ICML (International Conference on Machine Learning). 2022a.
10

---

Privacy Attacks on Image AutoRegressive Models
Dziedzic, A., Duan, H., Kaleem, M. A., Dhawan, N., Guan, J., Cattan, Y., Boenisch, F., and Papernot, N. Dataset inference for self-supervised models. In NeurlPS (Neural Information Processing Systems), 2022b.
Hintersdorf, D., Struppek, L.., Kersting, K., Dziedzic, A., and Boenisch, F. Finding nemo: Localizing neurons responsible for memorization in diffusion models. In Thirty-Eights Conference on Neural Information Process- ing Systems (NeurIPS), 2024.
Esser, P., Rombach, R., and Ommer, B. Taming transformers for high-resolution image synthesis, 2020.
Ho, and Salimans, T. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12544 2022.
Fan, L., Li. T., Qin, S., Li, Y., Sun, C., Rubinstein, M., Sun, D., He, K., and Tian, Y. Fluid: Scaling autoregressive text- to-image generative models with continuous tokens, 2024. https:/ / / a org/ /210 13863.
Huang, J., Yang, D., and Potts, C. Demystifying verbatim memorization in large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 10711-10732, 2024.
Fei, Z., Fan, M., Yu, C., Li, D., and Huang, J. Scaling diffusion transformers to 16 billion parameters, 2024.
Kaplan, J., McCandlish, S., Henighan, T., Brown, B., Chess, B., Child, R., Gray, S., Radford, A., Wu, J., and Amodei, D. Scaling laws for neural language models. arXiv preprint arXiv:2001 003361, 2020.
URL httptttpp/// /tts://aaxxee http/axxvv.oooo org/ abs 11633.
Feldman, V. Does learning require memorization? a short tale about long tail. In Proceedings of the 52nd Annual ACM SIGACT Symposium Theory of Computing, pp. 954-959, 2020.
Kong. F., Duan, J., Ma, R., Shen, H., Zhu, X., Shi, X., and Xu, K. An efficient membership inference attack for the diffusion model by proximal initialization, arXiv preprint arXiv: 20l::3335..5555 18355, 2023.
Gailly, J.-L. and Adler, M. zlib compression library. 2004. URL http:/ / www.dspace cam.ac. aan.aac.kk handle/1810/340
Li, T. Tian, Y., Li, H., Deng, M., and He, K. Autoregressive image generation without vector quantization, 2024. URL https: /tcpps//arree http///xxvvv../// org abs 2406 11838.
Gao. S., Zhou, P., Cheng, M.-M,, and Yan, S. Masked diffusion transformer is strong image synthesizer, 2023.
Liu. Q. Zeng, Z., He. J., Yu, Q. Shen, X., and Chen, L.-C. Alleviating distortion in image generation via multi-resolution diffusion models. arXiv preprint 2024.
Han, J., Liu, J., Jiang, Y., Yan. B., Zhang, Y., Yuan, Z., Peng, B., and Liu, X. Infinity: Scaling bitwise autoregressive modeling for high-resolution image synthesis, 2024. URL https: //trx//a.vvv////////////ee/aaaa .ww. abs///b////// 2412 2, 04431
Ma, N., Goldstein, M., Albergo, M. S., Boffi, N. M., Vanden- Fijnden, E., and Xie, S. Sit: Exploring flow and diffusion- based generative models with scalable interpolant trans- formers. 2024.
Hanke, V., Blanchard, T. Boenisch, F,, Olatunji, E., Backes, M., and Dziedzic, A. Open Iims are necessary for current private adaptations and outperform their closed alternatives. In Vhirty-Eighth Conference on Neural In- formation Processing Systems (NeurIPS), 2024.
Maini, P., Yaghini, M., and Papernot, N. Dataset infer- ence: Ownership resolution in machine learning. In Pro- ceedings of ICLR 2021: 9th International Conference on Learning Representationsn, 2021.
Hayes, J., Shumailov, I., Choquette-Choo C. A., Jagielski, M., Kaissis, G., Lee, K., Nasr, M., Ghalebikesabi, S., Mireshghallah, N., Annamalai, M. S. M. S., Shilov, I., Meeus, M. de Montjoye, Y.-A., Boenisch, F., Dziedzic, A., and Cooper, A. F. Strong membership inference attacks on massive datasets and (moderately) large lan- guage models. 2025.
Maini, P., Jia, H., Papernot, N., and Dziedzic, A. Llm dataset inference: Did you train my dataset?, 2024. URL htwptttts///ae //arxiv .rgg abs 2406. 003006066440 06443.
Mattern, J., Mireshghallah, F., Jin, Z., Schoelkopf, B., Sachan, M., and Berg-Kirkpatrick. Membership in- ference attacks against language models via neighbour- hood comparison. In Rogers, A., Boyd-Graber, J., and Okazaki, N. (eds.), Findings of the Association for Com- putational Linguistics: ACL 2023, pp. 11330-11343, Toronto, Canada, July 2023. Association for Computa- tional Linguistics. doi: 10. 10.18653/v1/203. findings-nnnnddd 719. URL https: /aa//aaaathhhec org/ 2023. f Findings-acl- 719.
He, K., Chen, X., Xie, S., Li, Y., Dollár, P., and Girshick, R. Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 16000-16009, 2022.
Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., and Hochreiter, S. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017.

---

Privacy Attacks on Image AutoRegressive Models
Nasr, M., Hayes, J., Steinke, T., Balle, B., Tramèr, F., Jagiel- ski, M., Carlini, N., and Terzis, A. Tight auditing of differentially private machine learning. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 1631- 1648, 2023.
Song, J., Meng, C., and Ermon, S. Denoising diffu- sion implicit models. In International Conference on Learning Representations (ICLR), 2020. URL https: / //openreview. wwweet/ooommiiiee 1ot.:rrrrrr---ttliairiii
Tang, H., Wu, Y., Yang, S., Xie, E., Chen, J., Chen, J., Zhang, Z., Cai, H., Lu, Y., and Han, S. Hart: Effi- cient visual generation with hybrid autoregressive trans- former, 2024. URL https: htt///axxvv....gaa/// 2410 10812.
Peebles, W. and Xie, S. Scalable diffusion models with transformers. XrXiv preprint arXiv:2212.09748, 2022.
Pizzi, E., Roy, S. D., Ravindra, S. N.. Goyal, P., and Douze, M. A sulf-supe descriptor for image copy detection. In Proceedings of the IEEE/CVF Conference on Com- puler Vision and Patlern Recognition, pp. 14532-14542, 2022.
Team, M. https::tt///...... /twp///wwwwww// http///wwwwddooore...././ com/, 2022.
Tian, K., Jiang, Y., Yuan, Z., Peng, B., and Wang, L. Visual autoregressive modeling: Scalable image generation via next-scale prediction, 2024. URL petpss:/arrxot
Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I., et al. Language models are unsupervised multitask learners.
org/ hag/abs/// / 2404. 2404.02905.
02905.
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., and Polosukhin, I. At- tention is all you need. In Advances in Neural In- formation Processing Systems (NeurlPS), volume 30, pp. 5998-6008, 2017. URL https:// abs/ / 07776607762.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In JEEE/CVF Conference on Computer Vision and Puttern Recognition, 2022.
Wang. W., Dziedzic, A., Backes, M., and Boenisch, F. Lo- calizing memorization in ssl vision encoders. In Thirty- Eighth Conference on Neural Information Processing Systems (NeurIPS), 2024a.
Ronneherger, O., Fischer, P., and Brox, T. U-net: Convolu- tional networks for biomedical image segmentation. In Navab, N., Hornegger, J., Wells, W. M., and Frangi, A. F. (eds.), Medical Image Computing and Computer-Assisted Intervention - -MCCAI 2015, pp. 234-241, Cham, 2015. Springer International Publishing.
Wang. W., Kaleem, M. A., Dziedzic, A., Backes, M., Paper- not, N., and Boenisch, Memorization in self-supervised learning improves downstream generalization. In The Twelfth International Conference on Learning Represen- tations (ICLR), 2024b.
Saharia, C., Chan, W., Saxena, S., Li, L., Whang, J., Denton, E., Ghasemipour, S. K. S., Ayan, B. K., Mahdavi, S. S., Lopes, R. G., et al. Photorealistic text-to-image diffusion models with deep language understanding. arXiv preprint arXiv:2205. 1 187, 2022.
Wang, W., Dziedzic, A., Kim, G. C., Backes, M., and Boenisch, F. Captured by captions: On memorization and its mitigation in CLIP models. In The Thirteenth International Conference on Learning Representations (ICLR), 2025.
Shi, W., Ajith, A., Xia, M., Huang, Y., Liu, D., Blevins, T., Chen, D., and Zettlemoyer, L. Detecting pretrain- ing data from large language models. In The Twelfth International Conference on Learning Representations, 2024. URL https:////..........
Wen, Y., Liu, Y., Chen, C.,, and Lyu, L. Detecting, explain- ing, and mitigating memorization in diffusion models. In The Twelfth International Conference on Learning Repre- sentations, 2024.
Shokri, R., Stronati, M., Song, C., and Shmatikov, V. Mem- bership inference attacks against machine learning mod- els. In 2017 IEEE Symposium on Security and Pri- vacy (SP), pp- 3-18, Los Alamitos, CA, USA, may 2017. IEEE Computer Society. doi: 10.1109/SP.217. 41. URL https: //ti:.////////// ieecompttersocietty org/10.
Yeom, S., Giacomelli, I., Fredrikson, M., and Jha, S. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st Com- puter Security Foundations Symposium (CSF), pp. 268-282, Los Alamitos, CA, USA, jul 2018. IEFE Computer Society. doi: 10.1109/CSF:2218.00007 URL https://doi. www.coattteeeeeeciiiee........ee 10. 10.1109/CSF. 2018 00027.
2017. .1.
Sohl-Dickstein, J., Weiss, E., Maheswaranathan, N., and Ganguli, S. Deep unsupervised learning using nonequi- librium thermodynamics. In International Conference on Machine Learning, 2015.
Yu, Q., He, J., Deng, X., Shen, X., and Chen, L.-C. Ran- domized autoregressive visual generation, 2024. URL https: httpss//errrvv.orrgaabb/// 00776.
12

---

Privacy Attacks on Image AutoRegressive Models
Zarifzadeh, S., Liu, P., and Shokri, R. Low-cost high-power membership inference attacks. In Forty-first International Conference Machine Learning, 2024.
Zhai, S., Chen, H., Dong, Y., Li, J., Shen, Q., Gao, Y., Su, H., and Liu, Y. Membership inference on text-to- image diffusion models via conditional likelihood discrep- ancy. In The ehirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL https: / //openreview net/forum 1d=DztaBt4wP5.
Zhang, A. and Wu, C. Adaptive pre-training data detection for large language models via surprising tokens. arXiv preprint 2272222407.2/248, 2024.
Zhang. J., Das, D., Kamath, G., and Tramèr, F. Membership inference attacks cannot prove that model was trained your data. arXiv preprint arXiv:2409. 19798, 2024a.
Zhang. J., Sun, J., Yeats, E., Ouyang, Y., Kuo, M., Zhang, J., Yang. H. F., and Li, H. Min-k%++: Improved baseline for detecting pre-training data from large language models. arXiv preprint arXi::4404.02936 2024b.
Zhang, Q., Dai, X., Yang, N., An, X., Feng, Z., and Ren, X. Var-clip: Text-to-image generator with visual auto- regressive modeling, 2024c. URL https:://///// //axxi.. org/abs/2400 01181.
Zhao, B., Maini, P., Boenisch, F. and Dziedzic, A. Un- locking post-hoc dataset inference with synthetic data. 2025.
13

---

Privacy Attacks on Image AutoRegressive Models
A. Why IARs (seem to) leak more privacy than DMs?
In the following we provide insights explaining the higher leakage observed in IARs. First, we focus on differences in architectures and models' internals. Then, we switch explore architecture- agnostic factors like model size.
A.I. Inherent differences between IARs and DMs
We note that DMs have inherently different characteristics than IARs, and we link them to the privacy risks they exhibit. We identify three key factors:
1. Access to p(x) boosts MIA (Zarifzadeh et al., 2024). We note that IARs inherently expose the full information about p(z) at the output (per-token logits, see Equation (1)). In contrast, DMs do not, as they learn to transform (O, I) to the data distribution (xx) by iterative denoising process. This difference is expressed with varying MIA designs for DMs and IARs the former exploit the predicted noise, while the latter work with p(æ), by focusing on the logits. Our results confirm this premise-M MAR less prone to all privacy risks, and it does not output p(x). It outputs continuous tokens, sampled from a diffusion module.
2. AugeRegee training exposes IARs to more data per update. For each training sample passed through the IAR, the model "sees" N different sequences to predict. Conversely, DMs only "sees" a single, noisy image. This influences two factors: a) training time of the model DDMs require to be trained two times longer than IARs, on average. b) privacy leakage-IARs are exposed to more information per each update step, which translates to increased vulnerability for privacy attacks like MIAs, DI, and data extraction. VAR outputs 10 sequences of tokens, and is less prone to MIA than RAR, which outputs 256 sequences, e.g., VAR-d-20 vs. RAR-L (models of similar sizes).
3. Multiple independent signals amplify leakage. Previous works (Maini al., 2024; Dubiáski al., 2025) aggregate signal from many MIAs to yield a stronger attack. Notably, each token predicted by IARs leaks unique information from the model, as it is generated from a (slightly) different prefix. Thus, per-token losses/logits that IAR-specific MIAs use, when aggregated, add up to a more informative signal, which in turn yields stronger MIAs. In contrast, DMs outputs provide a general direction for the denoising process, and are strongly correlated. In effect, predictions at different timesteps do not provide enough novel information to the MIA to boost its strength.
We believe that these reasons are behind greater privacy leakage that we observe for IARs than for DMs.
A.2. Architecture-agoosti differences between the models
The models evaluated in our work differ in many factors. Two of them, model size and training duration, are mostly architecture-agee aggnosti, which means they are less related to the design choices of the specific models. As the efficacy of privacy attacks is directly related to these factors (Shokri et al., 2017), we want to assess if our results really show that IARs leak more than DMs. To this end, we collect five variables: TPR @ FPR=1% % (MIA), P (DI metric), model size, training duration, and Is IAR for every model we evaluate in the paper (11 IARs, 8 DMs). For the first two (MIA, DI) we take them directly from Tables 1, 3 and 18. We obtain the model sizes from Tables 8 and 10. Training duration is expressed by a number of data points passed through the model at training, e-g., for RAR-B we have 400 epochs of ImageNet- I train set, which amounts to 400 x 1.27M 0.5B samples seen. Is IAR factor is 1 if the model is IAR, 0 otherwise. We take these variables and compute pairwise Pearson's 's correlation between them, using values for all the models.
In Table 5 we show correlations between factors (columns) and privacy metrics (rows). We identify the following insights:
1. Training duration is a factor that increases vulnerability for MIA and DI for DMs the most.
2. Model size influences leakage more for IARs than for DMs.
3. Is IAR factor plays the most significant role for the DI performance. It also correlates with MIA performance.
Our results show that while these two against the models, the results strengthen our notion that IARs tend to leak more privacy than LARs due to their inherent characteristics.
size and training duration-inffuencce the performance of our attacks
14

---

Privacy Attacks on Image AutoRegressive Models
Table 5: Correlation between different factors and privacy leakage. Our results show that while the model-agnostic factors correlate with the performance, the fact that the model is IAR or not also correlates with the leakage.
Architecture
Training Duration
Model Size
Is IAR
(DI) P (DI)
IAR
0.24
-0.39
DM
-0.58
-0.32
P (DI)
All
-0.04
-0.28
-0.46
@ FER@FPR=11% %
IAR
0.17
0.93
TPR FPR=1
DM
0.31
0.11
TPR FPR=1
All
-0.2
0.87
0.38
B. Limitations
We acknowledge our privacy analysis of the novel IARs, and comparison to DMs suffers from two limitations. We do not evaluate our attacks on the biggest available models (like Infinity (Han et al., 2024)) trained on massive (over IB samples), messy datasets. Secondly, there are many factors crucial for MIA and DI performance, which differ in values between almost all the models. The following explains these issues more detail.
B.1. On the infeasibility of high-scale experiments on extremely big models
We do not assess how our attacks perform when applied to models trained on datasets of the scale higher than 1M samples. may raise concerns about the scalability of the attacks and the insights they provide to the real-world applications. Unfortunately, IARs trained on bigger datasets than ImageNet-IK (Infinity (Han et al., 2024), HART (Tang et al., 2024)) do not disclose fully what their training data exactly is. Because of that, the privacy attacks. We lack the ability to assess MIA's and DI's performance correctly, as these methods rely two assumptions: (1) we know a part of the training data (members), (2) we have access to non-members that are independent and identically distributed (IID) with members. When we fail to satisfy (2) the methods would collapse to dataset detection (Das et al., 2024). Moreover, without satisfying (1) we cannot run MIA and DI at all.
unable to perform sound evaluation of
While methodologically correct evaluation of the cutting-edge models is out of our reach, we aim to provide more insight into text-to-images IARs, and see how much they leak. To this end, we run our attacks on VAR-CLIP (Zhang al., 2024c), VAR-d16 model trained captioned ImageNet-lk. Our results in Table show that this model leaks significantly more data than its class-to- -moee counterpart of the same size. Moreover, the leakage is level similar to VAR-d20's model of double the size of VAR-CLIP We argue that the increased leakage stems from the model overfitting more to the conditioning information, which is richer for textual data than for the class labels.
Table 6: Leakage of VAR-CLIP compared to class-conditional VARs. We observe increased privacy leakage over class-conditioned models, expressed by a stronger performance of our attacks.
Model
TPR@FPR=155
P (DI)
VAR-CLIP
6.30
60
VAR-d16
2.18
200
VAR-d20
5.92
40
B.2. On the impossibility of fully standardized experimental setup between the models
In the ideal scenario we are able to isolate only the factors inherent to the models' architecture, and consequently, are able to draw insights which design choices lead to what privacy risks. We would call such setup standardized, meaning that the models are almost identical, and differ only in factors we want to explore (like architecture). However, in reality we deal with too few models, each one being trained differently, which allows only for limited insights.
We note the models vary in the following ways:
15

---

Privacy Attacks on Image AutoRegressive Models
1. Training duration, expressed by number of data points seen during training, e.g. RAR-B sees 400 1.27M R 0.5B samples. In DMs evaluate the training duration varies between 0.21 to 1.79B samples seen, whereas IARs trained with between 0.26B and 0.5IB samples.
2. Training objectives. DMs minimize Equation (3), while IARs- Equation (2). Importantly, DMs minimize the expected error over timesteps and data, which necessitates a twice as long training duration for DMs than IARs (on average) to achieve comparable FID.
3. Model sizes. IARs benefit from scaling laws (Kaplan et al., 2020), and that allows them to be scaled up sizes greater than DMs, before their performance plateaus, DMs cannot be scaled that well-the performance gains diminish faster with the increase of size. In effect, the biggest IARs we evaluate-VAR-deee VAR-d30 and RAR-XXL- are on average 2-3 times bigger than DMs. Since the size of the model impacts its vulnerability to privacy attacks, our analyses do not fully accommodate for that factor.
4.
Two stage architectures. All models incorporate an encoder-decoder network for training and inference, e.g., VQ- VAE (Esser et al., 2020). Importanll, these encoders differ between models. VAR's 's next-scale prediction paradigm requires training of specialized encoder that understands how to process residual token maps, used during encoding an image to the sequence of discrete tokens. Moreover, VAR and RAR work with discrete tokens, i.e., the encoder-decoder network additionally contains quantizer module, which translates the continuous latent representations of the images to a 2D integer-only maps.
Unfortunately, these factors directly prohibit standardized comparison of the privacy risks between DMs and LARs. We not able to fix the training duration for all models-the generation quality of DMs would be significantly subpar than IARs (as DMs require twice the training time of IARs), and thus the results would be unsound. We incorporate the size of the models in Figures 1, 2 and 5, however, we acknowledge that the sizes vary between the models, and this limits our ability to fully disentangle this factor from the privacy results.
However, we are able to fix one factor for all the models: utility. We know the models we source are trained to the maximum of the potential each architecture allows, we utilize models from papers that aim for exactly that-the best performance. We compare models that are the upper boundary of what is possible within the inherent limitations and trade-offs each architecture has to offer. We are deeply aware that privacy vs utility is a balancing act: better models tend to be less private. uutumtttrs-utllit---ee
Thus, our study fixes one of these condition we evaluate how much it leaks. We believe our results provide strong empirical evidence that DMs constitute a Pareto optimum when it comes to image generation- are comparable in FID, while being significantly more private than the novel IAR models.
be the highest possible for a given model, and under that
C. Privacy leakage under a unified attack
We acknowledge that the field of privacy attacks against image generative models like IARs or DMs is constantly evolving. Since our work aims to provide the current empirical insights into differences in privacy leakage between these architectures, we use the strongest available attacks to provide an upper boundary on the privacy leakage, following literature on privacy auditing (Nasr et al., 2023; Dwork, 2006).
However, IARs and DMs are two different classes of models. In consequence, the attacks we employ are tailored their inherent properties, and thus the attacks vary. This might raise concerns of the following nature: what if the field progresses and new, very potent attack is designed for DMs? Will our current empirical results hold, i.e., can we really claim IARs leak more privacy than DMs, or is it just the current MIAS against DMs that are less powerful than for IARs?
We believe our insights in Appendix A provide reasons why IARs inherently leak more than DMs. To strengthen our results, we perform an architecture-agnasti unified attack against all models- -Loss Attack (Ycom et al., 2018).
C.1. Loss Attack
Loss Attack is defined as follows: (1) For each sample we perform a forward pass through the model as it would be during the training (2) We compute the model loss (specific to each model) for the samples. (3) We use the losses to perform MIA (as in Appendix D.2), and we use the losses to perform Dataset Inference (see Appendix D.3).
16

---

Privacy Attacks on Image AutoRegressive Models
Table 7: Unified attack results. We employ Loss Attack (Yeom et al., 20, discarding any model-specific modifications that might strengthen the signal, to ensure a fair comparison between different model classes and architectures. The results strongly support our notion that TARs leak more privacy than DMs.
Model
Architecture
P (Dataset Inference)
(PR@FPR=110 % (MIA)
AUC (MIA)
Accuracy (MIA)
VAR-d16
IAR
3000
1.50
52.35
50.08
-2R-
IAR
1000
1.67
54.54
VAR-d24
IAR
300
2.19
59.5620.9
50.15
VAR-d30
IAR
40
4.95 10:40
75.46:10.5
50.32.10.05
MAR-B
IAR
6000
1.43
51.31 +0:30
50.48
MAR-L
TAR
3000
1 1,5220.1
22.35
50.70 18
MAR-H
TAR
2000
1.61 20.17
53.6620.0
51.07
RAR-B
IAR
800
1.77
54.92::041
50.25
RAR-L
IAR
400
2.10+0.27
58.03
50.39+
RAR-XI
IAR
80
2.40
65.58=0.k
50.81 10.10
RAR-XXL
IAR
40
5.73
24.44.0.34
51.64
LDM
DM
20000
1.08
50.13
50.13
U-VIT-H/2
DM
20000
0.85
50.1 10.0
50.07
DiT-XL/2
DM
20000
0.84
50.09
50.15
MDTv1-XL/2
DM
> 20000
0.85
50.05
50.08
MDTv2-XL/2
DM
> 20000
0.87
50.142005
50.164114
DiMR-XL/2R
DM
> 20000
0.89
49.55=0066
49.70=t014
DiMR-G/2R
DM
20000
0.85
49.54_0006
49.69
SiT-XL/2
DM
6000
0.95 #0.16
48.22++026
49.97 +0.09
Loss Attack differs from MIAS against DMs in the following way: instead of fixing the timestep to the most optimal one (L = 100 (Carlini al., 2023)), and averaging the loss over 5 different input noises (Carlini al., 2023), we sample t ~ 2[[0, 1000), and compute the per-sample loss for single random noise.
For MAR, we roll back the modifications to the diffusion module, explained in Appendix G. We do not fix the timestep to the most optimal one (1 = 500), we compute the loss over 5 (default for training), instead of 64 (optimal) input noises, and we sample the masking ratio for each sample following the distribution used during training, instead of fixing it to 0.95 the optimal value.
For VAR and RAR, this attack is identical the one in Table 14 (first row).
Since the DI framework relies on features obtained from different MIAs, we run DI only with the single feature Loss Attack. We unify DI to be the same for DMs and IARs by removing the scoring function for DM-specific DI-CDI (Dubiáski et al., 2025). In effect, the procedure is identical for DMs and IARs.
C.2. IsRs are empirically more prone to the unified attack than DMs
Our results in Table 7 are consistent with the results achieved with DM- and IAR-specific attacks (Tables I and 3) Empirical data shows IARs are more vulnerable to MIAs and DI. Loss Attack does not yield TPR @ FPR=1% greater than random guessing (1%) for DMs, whereas all IARs perform above random guessing. Moreover, with such a weak signal, DI ceases to be successful for DMs, requiring above 20,000 samples (P) to reject the null hypothesis (no significant difference between members and mem-emsers)), with one exception: SiT. Conversely, IARs retain their high vulnerability to DI, with the most private -AR-MAR-B M-n- similarly vulnerable the least private DM-SIT.
We believe results obtained under the unified attack strengthen our message that current IARs leak more privacy than DMs.
D. Additional Background
In the following we provide additional background on Diffusion Models used for comparison to IARs, details on MIAs, and precise definition of the DI procedure, as well as deseription of the sampling strategies used by IARs during generation.
17

---

Privacy Attacks on Image AutoRegressive Models
D.I. Diffusion Models
Table 8: DM details. We report the training details for the DM models used in this work.
LDM
UVV
DIT-X/2
MDTv1-XL XL/2
MDTv2-XL/2
DIMR XL/2R
DiMR-G/ER
XLT2
Model parameters
395M
501M
675M
700M
742M
SUSM
1056M
675M
Training steps
178k
500k
400K
2M
6.5M
1M
IM
7M
Ratch size
1200
1024
256
256
256
1024
1024
256
FID
3.60
2.29
2.27
1.79
1,58
1.70
1.63
2.06
We provide brief overview of DMs used in our experiments. All models are class-conditioned latent DMs trained on the ImageNet dataset at 256x256 resolution. Except for LDM, all models utilize Vision Transformers (ViT) (Dosovitskiy et al., 2021) as their diffusion backbones. LDM instead employs the UNet architecture (Ronneberger et al., 2015), being a prior work. We refer the reader to the original publications for more details about their architectures and training strategies.
LDM (Latent Diffusion Model) by Rombach al. (2022) first propose running diffusion in learned latent space rather than pixel space, using U-Net as the denoising backbone.
DiT-XL/2 (Diffusiin Transformer) by Peebles & Xie (2022) replaces the conventional U-Net with VIT backbone.
U-VIT-H/2 by Bao et al. (2023) adopts ViT-based architecture with skip connections inspired by U-Nets. It treats image patches, class labels, and diffusion timesteps as input tokens in a unified transformer space.
MDTv/-XL and MDTv2-XL (Masked Diffusiin Transformer) by Gao et al. (2023) apply masked latent modeling strategy during training enhance contextual learning. The model predicts missing latent tokens, improving training efficiency and sample quality. MDTv2 introduces architectural refinements that lead to further gains fidelity and performance.
and DiMR-G/D G/2R by Liu et al. (2024) propose multi-resolution diffusion framework that processes features across different spatial scales. This design improves detail preservation and reduces distortions, especially when using large patch sizes. The models also incorporate time-aware normalization to enhance temporal conditioning.
SiT-XL/2 (Scalable Interpolant Transformer) by Ma et al. (2024) extends the DiT architecture with an interpolant mechanism that decouples the noise schedule from the model. This allows for greater flexibility in diffusion dynamics without architectural changes.
Besides these models, additionally evaluate emerging DMs: LFM (Dao al., 2023) a flow-matchie model, and DiT-MoE (Fei et al., 2024) mixture-of-experts DM, based on DiT (Peebles & Xie, 2022). We do not include these models for the final comparison for three reasons: (1) the released models are significantly smaller (130M parameters each) than all other models, (2) the released models achieve subpar FID scores (4.46 for LFM, unknown FID for DiT-MoE), (3) unknown details training (number of iterations for DiT-MoE). For completeness, we perform MIA and DI, and report the values Table
Table 9: Results for novel DM architectures. We the leakage is similar the rest of DMs.
Model
1PR
JP (DII)
LFM
1.79
2000 2000
DIT-Mols
1.70
D.2. Membership Inference Attacks
MIAs attempt to identify whether a given input x; drawn from distribution X, part of the training dataset Dirain used to train target model fo. We explore several MIA strategies under gray-box setting, where the adversary has access to the model's loss but no information about its internal parameters or gradients. The goal is to construct an attack function A,. X' + {0, }} that predicts membership.
Threshold- Based attack. Threshold-bee based attack is a key method of establishing membership status a sample. It relies on metric such Loss (Yeom et al., 2018) to determine membership. An input is classified as a member if value of the metric falls below a predefined threshold: A (x) = I[M(fo, x) < 7/,
(4)
18

---

Privacy Attacks on Image AutoRegressive Models
where M is the metric function, and is the threshold.
MIN-K% % PROB Metrie. To address the limitations of predictability in threshold-basee attacks, Shi et al. (2024) introduced the MIN-K% PROB metric. This approach evaluates the least probable K% of tokens in the input x, conditioned on preceding tokens, where K' is a hyperparameter, selected from {10, 20, 30, 40, 50}. By focusing on less predictable tokens, MIN-K% PROB avoids over-reliance on highly predictable parts of the sequence. Membership is determined by thresholding the average negative log-likelihood of these low-probability tokens:
A = 1 MMNNKK% PROB (x) < <7].
The final value reported for the best K.
MIN-K% % PROB ++. MIN-K% PROB ++ refines the MIN-K% PROB method by leveraging the insight that training samples tend to be local maxima in the modeled probability distribution. Instead of simply thresholding token probabilities, MIN-K K%% PROB ++ examines whether a token forms mode or has relatively high probability compared to other tokens in the vocabulary.
Given an input sequence r = (01, 22,..., ......,,T]])) and an autoregressive language model fo. the MIN-K% PROB ++ score is computed as:
1
log logp(xe(<<et) Mrst
SMin-K+++ (x)
(5)
|S|
Tzet
ES
where S consists of the least probable K% tokens in and Ma<t and onct are the mean and standard deviation of log probabilities across the vocabulary. Membership is determined by thresholding:
A (x) = 1 (x) 2 7]-
(6)
Similarly to MIN-K% PROB, MIN-K% PROB ++ sweeps over K E {10, 20, 30, 40, 50}. and the final result is reported for the best hyperparameter K.
zlib Ratio Attacks. A simple baseline attack leverages the compression ratio computed using the zlib library (Gailly & Adler, 2004). This method compares the model's perplexity with the sequence's 's entropy, as determined by its cobb-compeeeedd size, The attack is formalized as:
Pr. (x)
f =
2lib(z)
The intuition is that samples from the training set tend to have lower perplexity for the model, while the zlib compression, being agnessagnostic, does not exhibit such biases.
CAMIA introduces several context-awarn signals enhance membership inference accuracy. The slope signal captures how quickly the per-token loss decreases over time, as members typically exhibit steeper decline. Approximate entropy quantifies the regularity of the loss sequence by measuring the frequency of repeating patterss, while Lempel-Ziv complexity captures the diversity of loss fluctuations by counting unique substrings in the loss trajectory- both of which tend to be higher for non-members. The loss thresholding Count Below approach computes the fraction of tokens with losses below a predefined threshold, exploiting the tendency of members to have more low-loss tokens. repeated-sequenee amplification measures how much the loss decreases when an input is repeated, as non non-members often show stronger loss reductions due to in-context learning.
Surprising Tokens Attack (SURP). SURP detects membership by identifying surprising tokens, which are tokens where the model is highly confident in its prediction but assigns low probability to the actual ground truth token. Seen data tends to be less surprising, meaning the model assigns higher probabilities to these tokens in familiar contexts.
For a given input x = (z1, .r,)..,rr)) surprising tokens are those where the Shannon entropy is low and the probability of the ground truth token is below a threshold:
S s= (t H <ee p( < Tkh.
where He is the entropy of the model's output at position t, Ty is the probability of the bottom k%-th token. l e (10, 20, 30, 40, 50). and 6 E (2,4,8, 16) are hyperparameters. The SURP score the average probability assigned to
19

---

Privacy Attacks on Image AutoRegressive Models
these surprising tokens:
SSURP(Ø)
Σ
p(as x<()).
(8)
|S]
AES
Membership determined by thresholding:
f (2) 1[SuURP (x) 2 7/-
(9)
The SUPR's result for the best combination of l and ée is selected as the final performance.
D.3. Dataset Inference
Prepare data and model
Extract features
Obtain scores
Perform statistical test
Feature Extractor
Statistical Testing
P
IAR Model
decision
samples
features
scores
Figure 4: Dataset Inference for IARs Procedural Steps. The process consists of four main steps: Data Preparation:
Prepare the data verify whether the (suspected) member samples P were used to train the IAR. The (confirmed) nonmember samples U, from the same distribution as P. serve as the validation set. Feature Extraction: Run each individual MIA on all inputs from (P, U) to extract membership features for all data samples. We use our MIAs tailored to TAR models.
Score Computation: Normalize the extracted features using MinMaxScaler to scale them into the [0.1] range and compute a membership score for each sample by summing normalized feature values. Statistical Testing: Apply a statistical t-test verify whether the scores obtained for the public suspect data points are statistically significantly higher than those for U. If so, P is marked being part of the IAR's training set. Otherwise, the test is inconclusive and the IAR's training set is considered independent of P.
Scaling IARs to larger datasets raises concerns about the unauthorized use of proprietary or copyrighted data for training. With the growing adoption and increasing scale of IARs, this issue becoming more pressing. In our work, we use DI quantify the privacy leakage in IAR models. However, DI can be additionaly used establish a dispute-resolution framework for resolving illicit use of data collections in model training, ie. determine specific dataset was used train JAR.
The framework involves three key roles, First, the victim (V) is the content creator who suspects that their proprictary or copyrighted data was used to train a IAR without permission. The victim provides a subset of samples (P) they believe may have been included in the model's training dataset. Second, the suspect (AA) refers to the IAR provider accused of using the victim's 's dataset during training. The suspect model (fo) is examined determine whether it demonstrates evidence of trusted third party, such as regulatory body law enforcement
having been trained on P. Finally, the arbiter agency, tasked with conducting the dataset inference procedure. For instance, consider artist whose publicly accessible but copyrighted artworks have been used without consent to train a IAR. The artist, acting the victim (V), provides small subset of suspected training samples (P). The IAR provider (AA) denies any infringement. An arbiter intervenes and obtains gray-box or white-box access to the suspect model. Using DI methodology, the arbiter determines whether the IAR demonstrates statistical evidence of training on P.
D.4. Sampling Strategies
The greedy approach selects the token with the highest probability. In the top-k sampling, the highest & token probabilities are retained, while all others are set to zero. The remaining non-zero probabilities are then re- re-normalized and used to determine the next token. Notably, when 1, this method reduces to greedy sampling.
20

---

Privacy Attacks on Image AutoRegressive Models
E. Model Details
In our experiments, we use a range models from VAR (Tian et al., 2024), RAR(Yu et al., 2024), and MAR (Li et al., 2024) architectures, each varying model size and architecture. The details these models, including the number of parameters, training epochs, and FID scores, are summarized in Table 10. The models were trained on the class-conditioned image generation the ImageNet dataset (Deng et al., 2009).
Table 10: Model details. We report the training details for IAR the models used in this work.
Models
Models
Models
VAR-516
VAR-d201
VAR-d24
VAR-130
RAR-B
RAR-I
RAR-XT.
RAR-XXI.
MAR-8
MAR-I
MAR-H
Model parameters
310M
600M
261M
462M
955M
1.58
200M
475M
Training epochs
250
FID
3,55
2,95
2.33
1.92
L.95
1,70
1.50
1.48
2.31
L.78
1.55
F. Training and Inference Cost Estimation
IARs
3.5
3.5
FID (lower = -bette))
FID (lower bester))
2.0
RARI
DMs
2.0
2.0
UVIT
Dyi
1.5
1.5
10
10a
10>
109
10l
DIVRR
private)
TPR@FPR (higher private)
SIT
3.5
3.5
Architecture
FID (lower = bettes)
3.0
FID flower better)
3.0
LAR
2.5-
Size
2.0
2.0
200 600-6000
1.5
1.5-
6009: 1B
100
400
500
600
10a
10P
Training
PFLODs) (higher costlier)
Latency (stimage)
generate)
Figure Comprehensive comparison of the trade-offs between IARs and DMs.
Here describe the comprehensive process of training and generation cost estimation of IARs and DMs, which results in the plot Figure 5. We use torchprofile (tor, 2021) Python library to measure GFLOPs used for generation and training.
In order to compute the training cost, the procedure is as follows. (1) We perform single forward pass through the model. (2) We multiply the obtained GFLOPs cost by two, to accommodate for the backward pass cost. (3) We multiply the resulting cost of a single forward and backward pass by the amount of training samples passed through the model during training. The amount of samples is based on the numbers reported the papers for each of the evaluated models. DMs and IARs use different reporting methodology, with the former reporting training steps and batch size, and the latter reporting the number of epochs. For the latter, we assume that a full pass through the ImageNet- 1k training set is performed, thus we multiply the number of epochs by 181 2.221,1663 167.
Time to generate a single sample (referred to as latency) is computed by generating 640 images using code from the original models' repositories. We use the maximum batch size that fits on a single NVIDIA RTX A4000 48GB GPU, to utilize our hardware to the maximum, in order ensure fair comparison. For DMs and IARs follow the settings reported by
21

---

Privacy Attacks on Image AutoRegressive Models
authors of the respective papers that give the lowest FID score, i.e., we use classifier-free guidance for all the models. For MAR we perform 64 steps of patches sampling. For all DMs but U-ViT' we perform 250 steps of denoising, while for U-ViT the reported number is 50, which explains low latency of this model in comparison to others. We acknowledge that, in case of DMs, there are ways to lower the cost of the inference, e.g., by lowering the number of denoising steps. However, we use the default, yet more costly setup for these models, as there is an inherent trade-off between generation quality and cost for DMs, which we want to avoid to make our results sound.
Single generation cost in GFLOPs computed in a similar fashion. We utilize code provided by the authors of the respective papers for the inference, wrap it using torchprofile, and perform a generation of a single sample. Note that here we do not measure time, and can ignore the parallelism of hardware, as the total cost would stay the same. As observe in Figure 1, there is a discrepancy between latency and cost of generation, especially in case of RAR, where we observe an order of magnitude higher generation time than the GFLOPs cost would suggest. This phenomenon originates from the KV-Cache mechanism that is used in case of VAR and RAR during sampling. While the compute cost is lower thanks to the mechanism, the reading operation of the cache mechanism is not effectively parallelized, which results in pordwwre-incurree latency. We, however, acknowledge that this trade-off might become more beneficial in cases of low-power edge devices, as the computational power of these devices more limited than the speed of memory operations.
G. MIAs for MAR
Adjusting Binary Mask MAR extends the IAR framework by incorporating masked prediction strategies, where masked tokens are predicted based on the visible ones. This design choice is inspired by Masked Autoencoders (He et al., 2022), where selectively removing and reconstructing parts of the input allows models to learn better representations. Given that MIAs rely on detecting subtle differences in how models process known and unknown data, we hypothesize that adjusting the masking ratio during inference can amplify membership signals. By increasing the masking ratio from 0.86 (the training average) to 0.95, we create conditions where fewer tokens are available to reconstruct the original image, potentially exposing membership information more prominently.
Our experimental results, reported in Table 11, confirm that this strategy enhances MIAs' effectiveness. Specifically, TPR@ FF0=@FPPR99999 % for MAR-H increases from 2.18 to 2.88 (+0.70), and MAR-L sees an improvement from 1.89 to 2.25 (+0.36), demonstrating that a higher masking ratio strengthens membership signals. Notably, setting the mask ratio too high (e.g.. 0.99) leads to a slight drop in MIA performance, suggesting a balance must be struck between revealing more memhership signal and overly degrading the model's ability to generate images effectively.
Table 11: Impact of varying mask ratio on MIAs for MAR. We report TPR @ FPR=1%. Higher values indicate stronger membership signals. The best-performing setting is highlighted in bold.
Mask Ratio
MAR-B
MAR-L
MAR-H
0.75
1.4 (-0.05)
1.65 (-0.24)
1.81 (-0.37)
0.80
1.74 (+0.05)
(-0.33)
0.85
1.68 (-0.01)
1.83 (-0.00)
2.00 (-0.18)
0.86 (detault)
1.69 (0.00)
1.89 (0.00)
2.18 (0.00)
0.90
1.65 (-0.04)
1.88 (-0.01)
2.22 (+1.05)
0.95
1.88 (+0.19)
2.25 (+0.36)
2.88 (+0.70)
0.99
1.77 (+0.08)
1.86
(-0044)
Fixed Timestep MIAs on DMs have been shown to be most effective when conducted at specific denoising step t (Carlini et al., 2023). Since MAR utilizes a small diffusion module for token generation, we hypothesize that targeting MIAs at a fixed timestep rather than randomly chosen one can similarly enhance MIA effectiveness. Unlike full-scale diffusion models, where the most discriminative timestep is typically around t 100, experiments reveal that for MAR models, the optimal timestep is / 500.
Table 12 illustrates the impact of this adjustment. When MIAs are performed at = 500, MAR-H achieves a TPR @ FPR=1% of 3.30, improving by +0.42 over the baseline random timestep approach. Similarly, MAR-L and MAR-B also see noticeable gains at this timestep. Notably, selecting timestep t = 100 significantly reduces the attack's 's effectiveness, with a drop of -0.38 for MAR-H.
22

---

Privacy Attacks on Image AutoRegressive Models
Table 12: Impact of using a fixed denoising timestep on MIAs for MAR performance. We report TPR @ -PP=11 %. The most discriminative timestep is highlighted in bold.
Timestep
MAR-B
MAR-L
MAR-H
random
(0.00)
(0.00)
100
1.60 (-0.27)
1.90 (-0.34)
(-0.88))
500
188 (+0,00)
2.41 (+0.17)
3,30 (+0.42)
700
1.85 (-0.03)
2.35 (+0.10)
3.20 (+0.32)
900
1.65 (-0.22)
2.14 (-0.10)
2.97 (+0.09)
Reducing Diffusion Noise Variance The MAR loss function, as defined in Equation (3), exhibits certain variance due to its dependence on randomly sampled noise e. During training, MAR uses four different noise samples per image. We hypothesize that increasing the number of noise samples can provide a more stable loss signal, thereby improving the performance of MIAs.
Our results, summarized in Table 13, confirm that increasing the number of noise samples has positive effect attack performance.
Table 13: Impact of R reducing diffusion noise variance on MIAs for MAR performance. We report (PR@@PR=11% Obtaining loss for random noise sampled multiple times generally improves attack effectiveness. The best-performing setting is highlighted in bold.
Repeats
MAR-B
MAR-L
MAR-H
4 (default)
1.88 (0.00)
2.41 (0.00)
3.30 (0.00)
2.59 (+0.18)
16
2.01 (+0.13)
(+0.09)
3.19 (-0.11)
(+0.11)
(+0.15)
(-0.06)
64
2.09 (40.21)
2.61 (+0.20)
3.40 (+0.10)
H. Full MIA Results
We report TPR@FPR=195 and AUC for each baseline MIA (Table 14, Table 15, each improved MIA for IAR (Table 16, Table 17) and each MIA for DMs (Table 18, Table 19). Results are randomized over 100 experiments.
Table 14: TPR @ FPR=1% for baseline MIAs.
Model
VAR-d16
VAR-d20
VAR-d24
VAR-d30
MAR-B
MAR-L
MAR-H
RAR-B
RAR-L
RAR-XL
RAR-XXL
Loss CYoom et al., 2018)
1.50:1.16
1.67:::20
2.19:0.21
4.95-0388
1.420021
1,8
1.601031
1.762024
2.10:1077
3.3810042
5.7010055
Zlib (Carlini et al., 2021)
1.55
1.74::020
2.24:10.44
5.7710.59
1411022
14990021
1.5910222
1.91
2.4510266
4.2110031
7.52.1077
Hinge (Bertran al., 2024)
1.6240.9
1.724-222
2.14-1025
4.09:00.00
1.81
1.9944.19
2.94:0366
5.16+t08
Min. 5% (Shi al., 2024)
1.5820.16
2.04::255
3.22-10.38
12.23-21.13
16990.18
1.892.16
2.184
2.09:0.24
2.864:332
5.8320.52
13.481098
SURP (Zhang Wa, 2024)
1.5310.17
1.7010000
2.23
5.0211043
1.8420.18
2.124030
3.4610.46
5.821051
Min. K%++ (Zhang et al., 2024b)
1.3400188
2.21
3.73=0.34
14.90=096
2.36:20.29
3.26+40.0
6.27+4055
14.63-087
(Chang 2024)
1.3310188
1.7619.19
3.07.2035
16.69=1.16
1.35
1.38
1.441033
1.51
1.78.0.15
1.9910.34
4.341051
Table 15: AUC for baseline MIAs.
Model
VAR-d16
VAR-d20
VAR-424
VAR-d30
MAR-B
MAR-T
MAR-H
RAR-B
RAR-I
RAR-XI.
RAR-XXI.
2018)
$2.35-4035
54.511034
59.55
75.45-10.0
$3.331036
$5.0640034
54.9244037
58.0440.37
65.59-10.34
74.45+0..0
Zlib (Carlini et al., 2021)
52.38-2038
54.59.038
59.65
75.67:10.34
$1.91
53.32.009
55.05::08
55.27::0:66
58.68:0335
66.85-0034
17:0000
Hinge (Bertran et al., 2024)
53.29:10.99
56.83310.99
62.89:0.39
77.36:1033
57.07:10.4
61.41104
71.48:10.99
82.14:10.9
Min-K K% (Shi al. 2024)
53.774-0.40
57.8440044
65.49110440
83.55-4-020
51.874033
53.294038
55.05-10.8
56.53-4-228
61.21:1366
71.3540332
82,33-4028
SURP (Zhang& & Wa, 2024)
50.4640.25
54.541033
59.604040
75.46::034
52.21::0.00
58.024042
65.5840.1
74.50-20.3
Min- KS+++ (7hang al, 2024h)
54.521041
57.9310338
65.7620338
85.33:2022
57.82:1041
62.48.038
75.61
15.16
CAMIA (Chang al., 2024)
52.44+0044
55.12+004
61,37++042
80.16+:0334
$1.08-0042
51.96:0.43
53.20++038
51.40-4-336
$1,83+0.99
59.28-40.99
66.07-4036
23

---

Privacy Attacks on Image AutoRegressive Models
Table 16: TPR @ FFR=1FFR=199 % for our improved MIAs for IARS.
VAR-d16
VAR
VAR-d24
VAR-d30
MAR-B
MAR-L
MAR-H
RAR-B
RAR-L
RAR-XL
RAR-XXL
(Yoom al., 2018)
2.16:1026
5,9510554
24.03:1191
86.381092
1.54:0.22
1811021
2.2620.25
2.86:1020
5.50..0.39
16.58
40.7611.87
Zlib (Carlini et al., 2021)
1.7540.17
4.8740011
20.37411.99
83,994037
151#0021
1804-023
2:23:0227
2.5240311
4.56+-0.39
13.91+1:02
41.03+1966
Hinge (Bertran et al., 2024)
0.00+0000
0.0000000
0.00:0000
0.00++000
2.50+:200
4.34
10.59.0.8
20.23++..85
Min- K% (Shi al.,
0.05
0.064:002
0.1441004
1.634:0113
2.09
2.6::.288
3.40
4.304:033
8.66--0.99
26.14
49,80
Min +++++ (Zhang al., 2024b)
0.394006
1.40+0.11
4,88++020
37.90+0444
4.19440.0
8.24
23.04=1.14
43.67
CAMIA (Chang al., 2024)
5.4640552
20.92:11114
72.77+1044
1.00=0.17
0.9740.33
1.0620115
1.634021
2.6020.2
6.7740447
17.85
Table 17: AUC for our improved MIAs for IARS.
Model
VAR-d16
VAR-d20
VAR-d24
VAR-d30
MAR-B
MAR-L
MAR-H
RAR-B
RAR-L
RAR-XL
RAR-XXL
2018)
61.7340.3
76.2610.30
12
98.95:1005
52.25+042
54.001041
57.354040
65.61:1035
89.64:021
96.17-0112
Zlib (Carlini et al., 2021)
57.91
70.8610333
88.691:024
98.5110007
52.2311399
54,57:0339
57,3311099
62,22:1042
72.19:0.37
87,51:0:2
95.46-10.13
Hinge (Bertran et al., 2024)
52.67:10.36
56.111:036
62.48:10.36
74.63:1:.10
59.66:10.29
68.09.0.35
81.56:10.99
90.62.1021
Min K' (Shi al., 2024)
59.78+4034
70.434034
83.1040025
90.16+:27
53.31+0400
56.34+039
59.9840.38
66.81+028
78.734032
91.36-+0.20
96,97-00100
Min K (7hang al., 2024b)
57. 37.10
65.441029
78.74:0025
18:18:11116
35.20::0.66
75.37:004
88.29:1023
95.8440014
CAMIA (Chang 2024)
68.184031
8483+0044
51.75+04L
57.95-44.0
83.55+031
Table 18: TPR@FPR=19 of MIAs for DMs.
LDM
U-VIT-H/2
DIT-XL2
MDTvI-XL/2
MDTV2-XL/2
DIMR-XL/2R
DIMR-G22R
SIT-XL/2
Denoising Loss (Carlini al., 2023)
1.3520.14
1.3010.17
1.4210.17
1.55=0.18
1.649.117
0,91
0.8811.15
1.0210.133
SocMLator (Duan et al., 2023c)
1.30-0.20
1.31
1.49::2222
1.35=0.17
1.524.22
1.15#021
105
0.00
(Kong et al., 2023)
1.25=0.16
1.25:0.19
1.5910.00
1.72-0.00
207
1.0.20011
1.09
1.1410.14
PIAN (Kong et al., 2023)
1.03:0.14
L17110.16
0.92:1011
1.22=0.15
1.5010200
1.0410.13
1.0110.12
1,09
GM (Dubiiski et al., 2025)
1.25+0017
1.2440.17
1.34:40.1
1.18=0.16
14474-199
1.13+00115
1.16::0.16
1.38
ML (Duhinski
2025)
1.11
1.3640.00
1.50-t0.18
1.70-0116
198449266
101
1.10::.14
1.14
CLiD (Thai al., 2024)
1.5520.19
1.75
2.08.10.8
2.72-0.39
4.11004
0
0.90:2011
6.3822064
Table 19: AUC for MIAS for DMs.
LDM
U:VIT-222
DIT-XL/2
MDTV1-XL.2
MDTV2-X1/2 DIMR-XI,2R
DiMR G/2R
SIT-XL-2
Denoising Loss (Carlini et al., 2023)
50.531041
50.361142
51.774043
51,25
46.25:20.40
46:01=040
47.25:10.34
SocMLatu (Duan et ol., 2023c)
49.8411.44
53.151043
55.15:10.6
54,4410388
36.80-10336
48.73:10.45
48.73=0.44
50,00:10.00
PIA (Kong et al., 2023)
48.9740043
51.774004
53.1844042
52,6040044
54.68-40.45
47.31:40.22
47.16-0.41
49.13+t0.44
PIAN (Kong al., 2023)
49.562004
50.991006
50.144043
49.9642042
51.52-0.38
49.85=20411
49.79-0.43
50.17-0.37
GM (Dubinick et al., 2025)
51.51
51.19:1042
50.46:1046
50.72:10:99
08.85
45.97:20.45
45.86_0.45
50.94.20.8 38
ML (Dubiñiki
2025)
50.361001
51.1610AL
52.53:1045
50.42:10.19
54.65.1038
46.26.1038
49.37=0.41
49.83:10.17
CLiD (Zhai al., 2024)
52,50+0039
$4,27+00A
56.1664:.411
57.43+40.41
62.54-40440
46,20-00.88
45.93=0.41
78.65++0.00
Full DI Results
We report the outcome of DI for DMs in Table 20. As additional observation, note that contrary to DI for IARs, shifting from the classifier to an alternative feature aggregation increases the number of samples needed to reject Ho. This suggests, that the linear classifier remains necessary for DMs.
Table 20: DI for DMs. We report the minimal number of samples needed to successfully reject Hy.
LDM
U-VIT-H/2
DIT-XL/2
MDTv1-XI.2
MDTv2-X1.2
DIMR-XI/2R DiMR-G/RR
SiT-X1.22
DI for DM
4000
700
400
300
200
2000
200
300
No Classifier
5000
4000
3000
600
400
2000
2000
500
24

---

Privacy Attacks on Image AutoRegressive Models
J. Mitigation Strategy
In this section we detail our privacy risk mitigation strategy,
Membership Inforence Attack
Dataset Inforance
Extraction Attack
Generation Quality
152
189
Model
(PH8-R--1100 190 .)
101
503.5.6
103-400
VAS -24
Count
MAR
5005-5
PAR-D
BAS-L
5A0
13a
0.200
0..03
0.1
1.0
12.0 5.053 0.53
0.1
1.5
10.2
0.001
0.01
3.0
12.0
0.001
0:23
1.5
10.0
Figure 6: Privacy-utility trade-off of our mitigation strategy. We show that successfully defending VAR and RAR against MIA and DI requires adding noise that severely harms the performance. Interestingly, we able to limit the extent of memorization for VAR, and fully defend MAR against MIA and DI.
J.1. Method
Given an input sample 2, we perturb the output of the IAR according to a noise scale o, which we can adjust to balance privacy-utility trade-off. During inference, we add noise sampled from (N0,, o) to the output. For VAR and RAR, we add it to the logits, and for MAR we add them to the sampled continuous tokens.
We measure privacy leakage with our methods from Section 5. Specifically, we perform MIAs, DI, and the extraction attack. To quantify utility, we generate 10,000 images from the IARs, and compute FID (Heusel et al., 2017) between generations and the validation set. Lower FID means better quality of the generations.
J.2. Results
Our results in Figure 6 show that we effectively lower the privacy loss by applying our mitigation strategy, however, this comes at cost of significantly decreased utility, as highlighted by substantially increasing FID score.
We are able to lower the MIAs success by more than half (Fig. 6, left), with the biggest relative drop observed for RAR-XL XL, for which the TPR @ FPR=1% % drops from 26% to 4.4%. Moreover, all MAR models become immune to MIAs after noising their tokens, as @ FPR=1% drops to 1% (random guessing) with a = 0.001. When we apply our defense to DI (Fig. 6, second from the left), we have to increase P. the minimum number required to perform a successful DI attack, by an order of magnitude, with the biggest relative difference for the smallest models: VAR-16, and RAR-B, with an increase from 80 to 3000, and 200 to 8000, respectively. Such increase means that the models are harder to attack with DI, ie., their privacy protection is boosted. Similarly to MIA, DI stops working for MAR models immediately.
Our method achieves limited success in mitigating extraction (Fig. 6, third from the left). We are lowering the success of extraction attack only when adding significant amount of noise. However, for VAR-d30, which exhibits the biggest memorization, with o = 1.0 we successfully protect 93 out of 698 samples from being extracted without significantly harming the utility. Our method, similarly to all defenses, suffers from lowered performance (Fig. 6, right), as signal-to-noise ratio during generation gets worse when a increases.
J.3. Discussion
We show that we can mitigate privacy risks by adding noise to the outputs of IARs, at a cost of utility. Notably, all MARs become fully immune to MIAs and DI with noise scale as small 0.001. This result supports previous insights from Section 5, in which we show that MARs are significantly less prone privacy risks than VARs and RARs. We argue that logits leak significantly more information than continuous tokens, and thus, adding noise to the latter yields significantly higher protection, at a lower performance cost.
We acknowledge that our privacy leakage defense is a heuristic, and more theoretically sound approaches should be explored, e.g., in the domain of Differential Privacy (Dwork, 2006). To the best of our knowledge. we make the first step towards private IARs.
25

---

Privacy Attacks on Image AutoRegressive Models
K. More A About Memorization
In this section we provide an extended analysis of memorization phenomenon in IARs. We show more examples of memorized images, highlight the relation between the prefix length and the number of extracted samples, and shed more light on our efficient extraction method, described in Section 5.3.
K.1. More Memorized Images
In Figure 12 we show con-cherry-picken set of images memorized by IARs. Figure we show an example of an image memorized verbatim by VAR-d30 without any prefix, i.e. only from the class label token. In Figure 8 we show an image that has been memorized by both VAR-d30 and RAR-XXL.
Figure 7: Image extracted from VAR-d30 without prefix. (Left) memorized image, (right) generated image.
K.2. Prefix Length vs. Number of Extracted Images
We analyze the effect of the prefix length on the number of extracted samples. As our method leverages conditioning part of the input sequence, in Figure 10 we show an increase of extraction success with the increase in the length of the prefix. Notably, we start experiencing false-pont poast-possssees once the prefix length surpasses 30 for VAR-d30 and RAR-XXL, and for MAR-H. In effect, the results in Table 4 provide an upper bound the success of our extraction method.
Table 21: Prefix length for our data extraction attack. We note that appending longer sequences leads to false positives, i.e., the IARs start to generate images from the validation set.
Model
VAR-d30
MAR-H
RAR-XXL
Prefix length
30
5
30
K.3. Approximate distance vs. SSCD Score
In this section we underscore the effectiveness of our filtering approach. Figure 11 shows that the distances we design for the candidate selection process indeed correlates with the SSCD score. By focusing only on the top-5 samples for each class we effectively narrow our search just 0.5% of the training set, significantly speeding up the whole process.
26

---

Privacy Attacks on Image AutoRegressive Models
Original
VAR-d30
RAR-XXL
HUTTERPOIN
A aa ATEEINAT
Figure 8: Images extracted from both VAR-d30, and RAR-XXL.
27

---

Privacy Attacks on Image AutoRegressive Models
Original
VAR-d30
MAR-H
Figure 9: An image extracted from both VAR-d30, and MAR-H.
700
Model
Number of memmon memmorize samples
RAR-XLL
600
VARtd330
500
400
300
200
100
10
15
20 25
30
Prefix length i
Figure 10: Prefix length and the number of extracted samples. We show that with an increase of the prefix length, the success of our extraction method increases.
60
Distance d
VAR-d30 0.23)
RAR-XXL (p--0.31)
40
MAR-H (0=40.24)
20
0.0
0.2
0.4
0.6
0.8
SSCD score
Figure 11: Distance function d and the SSCD score. We show that d correlates with the final memorization score. This result makes our candidate selection process sound, and reduces the cost of extracting memorized samples.
28

---

Privacy Attacks on Image AutoRegressive Models
Figure 12: Non-cherry- extracted images. Odd columns from the left correspond to the original image, even to extracted, From left, the images are for VAR-d30, RAR-XXL, and MAR-H.
29


Reviews:
[{"review_id": "7CKOPNla6j", "reviewer": "Reviewer_ZL49", "summary": "The paper propose new SOTA methods for membership/dataset inference of image autoregressive models. The authors compare the privacy leakage of the different types of image generation models, and show that autoregressive models showcase important privacy leakage (up to MIA at 86.38% TPR@FPR=1%)", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the Reviewer for the insightful comments. We address individual points below one by one:\n\n>**[...] authors are claiming that IARs are now the gold standard for image generation, while it has not been so widely adopted.**\n\nWe clarify that we position IARs as novel model family that *can* perform on par or slightly better than DMs according to the established benchmarks. Given this, we find investigating the privacy leakage of IARs at the early stage of adoption valuable for the community to support responsible adoption. \n\n>**The proposed MIA/[DI] method is very succinctly explained in page 5. It would have been nice to have a more detailed explanation. [...] I have found that the description of the proposed MIA/DI method is too succinct [...]. An additional figure to explain, or equations, would have made things clearer.**\n\nTo address the Reviewer's suggestion, we further expanded and clarified our methods in the revised manuscript, including visual diagrams and procedular steps. Here, we provide a summary :\n\n1. **MIA for VAR/RAR**: For IARs the output token probabilities are additionally conditioned, e.g., on class labels, yielding $p(x|c)$. We follow CLiD (Zhai et al., 2024) to exploit the conditional overfitting of IARs and provide $p(x|c) - p(x|c_{null})$ as input to MIAs methods (described in more detail in App. B).\n\n2. **MIA for MAR**: we select the optimal *diffusion timestep* and *mask ratio*, perform multiple inferences (to limit the variance of the diffusion process), and obtain per-token losses per pass. We average them across inferences, and input these per-token losses to MIAs (App. B). We use losses, as logits are unavailable for MAR which outputs continuous tokens.\n\n3. **DI improvement**: LLM DI [2] uses a scoring function $s$ to aggregate signals from the features. We note that this increases $P$ (number of samples required for DI), since a subset of samples is used to fit $s$. We replace $s$ with a summation of normalized features instead. Additionally, instead of using the original MIAs from [2], we substitute them with our improved versions (points 1. and 2 above).\n\n>**MIA needs members and non members from the same distribution. The authors do not detail how the non-members are sampled, which is very important in practice if one wants to do an MIA in a realistic setting.**\n\nWe agree members and non-members *have to be* from the same distribution for the MIA/DI results to be sound. In Sec. 4, we state *“For MIA and DI, we take 10000 samples from the training set as members and also 10000 samples from the validation set as non-members.”* (lines 235-237). Because the validation set of ImageNet-1k was selected randomly from the full dataset, members and non-members are IID, which satisfies the requirement.\n\n>**“IARs can achieve better performance than their DM-based counterparts.”—> Its not that clear that IARs will take over the world**\n\nWe fully understand the Reviewer’s concerns and tuned down this sentence to “IARs are an emerging competitor to DMs”.\n\n>**The authors define memorization as verbatim memorization**\n\nWe explore the worst-case memorization, following the setup from [1].\n\n>**“We provide a potent DI method for IARs, which requires as few as 6 samples to assess dataset membership signal.”-> This depends on model size, overfitting etc.**\n\nIndeed, we presented the strongest result. Following the Reviewer's idea, we provide a comparison between two factors: model size and a binary “Is the model an IAR?” factor and $P$ (DI metric) as a Pearson’s correlation:\n\n||Class|Size|Is IAR\n-|-|-|-\nP (DI)|IAR|0.24|-0.39\nP (DI)|DM|-0.58|-0.32\nP (DI)|All|-0.04|-0.28|-0.46\n\n1. **Model size** influences leakage in DMs more than in IARs.\n\n2. **Is IAR** is the factor with the strongest correlation to DI performance.\n\n>**Should be clearer if its a realistic case and that comparison is done apple to apple in terms of FID compared to [DMs].**\n\nFig. 1 (left) and Fig. 2 show direct comparison between DMs and IARs in terms of FID (y-axis), where IARs exhibit greater privacy leakage than DMs, for similar values of FID. For example, in Fig. 1 (left), we observe that VAR-d24 (second blue dot from the right) has a FID of ~2.0, but the TPR@FPR=1% for this model is ~22%. In comparison, SiT achieves FID of also ~2.0, while maintaining the MIA performance of ~6% TPR@FPR=1%. We acknowledge that we do not compare privacy leakage at *a fixed FID*, but we believe these plots serve as privacy-utility trade-off curves.\n\n>**“Interestingly, we find that t = 500 is the most discriminative, differing from the findings for fullscale DMs, for which t = 100 gives the strongest signal.” —> no figure or table to refer to for these results?**\n\nWe apologize for the imprecise formulation. We base the claim about fullscale DMs on [1]. We added the citation to the manuscript.\n\n**References:**\n\n[1] Carlini et al., Extracting Training Data from [DMs], USENIX 2023.\n\n[2] Maini et al.,  LLM Dataset Inference [...], NeurIPS 2024.", "claims_and_evidence": "I did not notice problematic claims, except maybe the fact that the authors are claiming that image autoregressive models are now the gold standard for image generation, while it has not been so widely adopted.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "No theoretical claim", "experimental_designs_or_analyses": "Yes. The experimental design is very good and well explained. However, the proposed MIA / Dataset Inference method is very succintly explained in page 5. It would have been nice to have a more detailed explanation.", "relation_to_broader_scientific_literature": "The paper is well positioned. To the best of my knowledge, the claim on first MIAs for image regressive models is valid. Moreover, it cites the rest of the litterature correctly.", "essential_references_not_discussed": "Not that I am aware of .", "other_strengths_and_weaknesses": "The paper is very clear and well written, and the contribution + results are good.\n\nAs weaknesses:\n\n1) I have found that the description of the proposed MIA/DI method is to succint and not very clear. An additional figure to explain, or equations, would have made things clearer.\n2) MIA needs members and non members from the same distribution. The authors do not details how the non members are sambled which is very important in practice if one wants to do an MIA in a realistic setting.", "other_comments_or_suggestions": "- “IARs can achieve better performance than their DM-based\ncounterparts.”—> Its not that clear that IARs will take over the world\n- The authors define memorization as verbatim memorization\n- “We provide a potent DI method for IARs, which requires as few as 6 samples to assess dataset membership signal.”-> This depends on model size, overfitting etc. Should be clearer if its a realistic case and that comparaison is done apple to apple in terms of FID compared to diffusion models. \n- The details on the MIA arrive late in the paper, in page 5\n- “Interestingly, we find that t = 500 is the most discriminative, differing from the findings for fullscale DMs, for which t = 100 gives the strongest signal.” —> no figure or table to refer to for these results?", "questions_for_authors": "See above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HNyDxxK6IY", "reviewer": "Reviewer_RYDX", "summary": "This paper presents a thorough investigation into the privacy risks of image autoregressive models (IARs), comparing them to diffusion models (DMs). The authors develop novel membership inference attacks (MIAs) and dataset inference (DI) methods tailored to IARs. Besides, they also extract hundreds of training samples from IARs. Overall, this paper is an interesting attempt of privacy attacks towards IARs.\n\n## Update After Rebuttal\n\nWhile the authors have engaged with critiques raised during the review process, the core concern regarding the paper’s central claim—that autoregressive models are inherently more vulnerable to privacy attacks than diffusion models—remains unresolved. My concerns are as follows:\n\n​​The assertion that autoregressive architectures are \"more vulnerable\" to privacy attacks is misleading, as vulnerability in this context is inherently tied to the effectiveness of specific attack methodologies, not the model class itself. The rebuttal fails to provide empirical evidence isolating architectural properties as the primary factor influencing attack success rates. Here, I explain why the experiments provided in the rebuttal fails: The attack performance is associated with intrinsic model vulnerabilities. Without controlling for variables such as attack implementation, training data overlap, or model capacity, the comparison lacks rigor. A poorly tuned diffusion model could exhibit higher vulnerability under certain attacks, rendering the generalized claim untenable. This loose central claim also raises concerns about community impact. Publishing this claim without stronger empirical and theoretical grounding risks misleading the research community’s understanding of privacy risks in generative models such as DMs and IARs. The rebuttal does not address this broader implication or propose nuanced framing to mitigate potential misinterpretation.\n​", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ">**Emerging DMs (e.g. flow-matching)**\n\nWe extend evaluation to 1) latent flow matching (LFM) (Dao et al., 2023), 2) sparse DM (DiT-MoE), 3) flow matching transformer (SiT) (Ma et al., 2024), We report:\n\n||Model|TPR@FPR=1%|P (DI)\n-|-|-|-\nLFM|1.79|2000\nDiT-MoE|1.70|2000\nSiT|6.38|300\n\nWe observe that while LFM and DiT-MoE display privacy leakage comparable to other DMs, SiT is more vulnerable. However, the leakage is still smaller than for IARs.\n\n>**Factors vs MIA efficacy**\n\nWe compare training duration, model size, and a binary “Is the model an IAR?” factor against MIA and DI performance metrics, reporting Pearson’s correlation:\n\n||Class|Duration|Size|Is IAR\n-|-|-|-|-\nP (DI)|IAR|0.24|-0.39\nP (DI)|DM|-0.58|-0.32\nP (DI)|All|-0.04|-0.28|-0.46\n|\nTPR@FPR=1%|IAR|0.17|0.93\nTPR@FPR=1%|DM|0.31|0.11\nTPR@FPR=1%|All|-0.2|0.87|0.38\n\n1. **Duration** influences MIA/DI against DMs the most.\n2. **Model size** influences leakage in IARs more than in DMs.\n3. **Is IAR** factor has the strongest correlation to DI performance.\n\nWe cannot isolate duplicates as a factor without re-training models from scratch. However, all evaluated models (DMs/IARs) are trained on ImageNet-1k (same duplicates).\n\n>**Temper claim**\n\nWe adjust our claims to be more precise and state that the privacy risks for IARs are *empirically* more severe than DMs, given the state of current privacy attacks.\n\n>**Dataset - scalability**\n\nWe acknowledge this concern, however:\n\n1. IARs trained on >1M images (Han et al., 2024) do not specify their training data. Thus, a sound MIA/DI evaluation is impossible, as they need a) train data (members), b) IID non-members. Failure to satisfy b) leads to dataset detection (Das et al., 2024), and without a) we have no data to perform the attacks.\n\n2. These are far from “toy models”, as ImageNet-1k allows for high quality, diverse generation.\n\n3. The dataset is widely used as a benchmark; most cutting-edge DMs and IARs are trained on it.\n\nWe believe our setting is useful for practitioners, while ensuring **full methodological correctness**.\n\n>**Novelty**\n\nWe gladly clarify the novelty:\n\n1. **First empirical privacy leakage evaluation of IARs**. We employ the strongest model-specific attacks, and perform comprehensive analysis across publicly available models.\n\n2. **First IAR-tailored MIA**. We combine LLM-like properties of IARs with ideas from attacks against DMs to craft our MIA, improving TPR@FPR=1% by up to **69%** over the naive baseline.\n\n3. **First IAR-specific DI**. We decrease the number of samples needed for DI for IARs by up to **90%** compared to baseline.\n\n4. **Successful extraction attack**. We are the first to recover training data from IARs, leaking up to **698** images.\n\n5. **Privacy-utility trade-off**. IARs are fast, but less private. Next, we explain **why**:\n\n>**What makes IARs leakage different? DMs vs. IARs**\n\nInherent causes for higher privacy leakage in IARs:\n\n1. **Access to p(x) boosts MIA** (Zarifzadeh et al., 2024). DMs do not expose it at inference–they learn to transform N(0,I) to data. IARs are trained to output p(x) directly. It is reflected in distinct MIA designs for DMs and IARs–the former exploit the noise, the latter–p(x), via logits. MAR does not output p(x), and is less prone to MIA (Tab. 1).\n\n2. **AR training exposes IARs to more data per update**. RAR *outputs* 256 distinct sequences to predict a sample. DMs operate only on *a single, noised image*. At fixed training duration, leakage is stronger for IARs. VAR *outputs* 10 sequences of tokens, and is less prone than RAR to MIA (e.g., VAR-d20 vs. RAR-L of similar size).\n\n3. **Multiple *independent* signals amplify leakage**. Each token predicted by IARs leaks a unique signal, as it is generated from a different prefix. DMs’ outputs are tightly correlated, and the aggregated signal is weaker.\n\nArchitectural design choices for DMs and IARs differ for *every* model; it makes single-point conclusions unsound.\n\n>**Limited IARs. Real world: text-to-img models, on messy, large datasets**\n\nDue to the reasons highlighted in our answer on scalability, we cannot soundly evaluate larger models due to *lack of access to train data* and *lack of IID non-members*. \n\nStill, we added experiments on VAR-CLIP (Zhang et al., 2024), a text-to-img VAR trained on a captioned ImageNet-1k, reporting:\n\n\n|Model|TPR@FPR=1%|P (DI)\n-|-|-\nVAR-CLIP|6.30|60\nVAR-d16|2.18|200\nVAR-d20|5.92|40\n\nWe compare VAR-CLIP to VAR-d16, as these models have the same size (300M). Notably, text-to-img model exhibits greater privacy leakage, on the level of a model twice as big, VAR-d20.\n\n>**Retelling DMs story**\n\nOur work goes beyond mirroring findings in DMs. We introduce the strongest privacy attacks available, and evaluate many public SOTA models. We empirically show that IARs are *significantly* more vulnerable than DMs; we explain **why** in the updated version of the paper. Thereby, our paper offers a valuable insight on the privacy of novel generative models.", "claims_and_evidence": "The study claims that image autoregressive models (IARs) inherently exhibit heightened privacy vulnerabilities compared to diffusion models (DMs), as asserted in Lines 105–107 and empirically supported by comparative metrics in Figure 1. However, this conclusion raises questions regarding its generalizability across the broader landscape of contemporary generative architectures. Notably, the evaluation omits emerging DM variants such as flow-matching methods. Furthermore, critical factors—including model training duration and data duplication rates—significantly influence membership inference attack (MIA) efficacy. The authors should temper their generalized claim by incorporating qualifiers such as 'under the evaluated configurations' or 'potentially,' thereby aligning the conclusion more closely with the scope of empirical evidence.", "methods_and_evaluation_criteria": "The dataset in the experiments is ImageNet-1K, which may raise concerns about the scalability of the proposed privacy attacks.", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "The experimental designs in this paper primarily follows previous arts. Thus, the designs are nothing to blame.", "relation_to_broader_scientific_literature": "The paper connects to prior work on MIAs for DMs and LLMs. Besides, it also transfors dataset inference in LLM and data extraction attack in DM to IARs.", "essential_references_not_discussed": "Readers can understand the main idea of this paper given current related works.", "other_strengths_and_weaknesses": "## Strengths\n\n1. This paper is the first to explore the privacy risks in IARs.\n\n2. The paper explores various privacy attacks including MIA, DI and data extraction attack.\n\n## Weaknesses\n\n1. **The primary concern of this paper is its novelty.** Though it is the first to explore the privacy risks in IARs, it tells an old story similar in DMs and LLMs. For instance, the proposed MIA method is mainly based on CLiD conditional overfitting assumption without showing what is unique about IARs. What makes IARs privacy leakage different? Do their token generation or stacked transformers inherently make them riskier? The paper just repeats the same old \"conditional overfitting\" story we have heard for DMs. The authors are required to clearly explain **why** IARs are special, either in how they're build or what new risks they create. Right now, it's like saying \"DMs have privacy issues... and guess what? IARs do too\". That does not bring much new to the table. Highlight the difference between DMs and IARs, either from the organization of the paper or from the theoretical perspective, will help improve the contributions of this paper. \n\n2. The target IAR models are somewhat limited. Only class-conditional models trained on ImageNet are utilized. However, most real world  concerns involve text-to-image models (e.g. copyright infringment). Evaliation on more models would actually matter for real-world harm, especailly the models trained on messy, large scale datasets like LAION. \n\nOverall, I recognize the contribution of the paper as the first to explore the privacy attacks in IARs. However, personally, only retelling story in DMs again does not match the high standard of ICML. Therefore, I give the weak reject score.", "other_comments_or_suggestions": "See Weaknesses.", "questions_for_authors": "Sea Weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vrdV5mwoj6", "reviewer": "Reviewer_rfqr", "summary": "This paper provides a thorough investigation into the privacy risks of image autoregressive models (IARs), highlighting their elevated vulnerability compared to diffusion models (DMs). The authors develop a novel membership inference attack (MIA) with significantly higher detection rates, introduce a dataset inference (DI) method requiring notably fewer samples, and demonstrate large-scale data extraction from IARs. Moreover, the authors conclude that a critical privacy-utility trade-off: while IARs outperform DMs in terms of image generation quality and speed, they are more susceptible to privacy breaches.\n\n\n\n## Update After Rebuttal\nThe author has addressed my initial concerns, particularly on baseline comparisons and experimental settings. However, issues with wording and narration persist, which could cause misunderstandings. I recommend addressing these if the paper is accepted.\nI also agree with Reviewer 1YbK's concerns about the conclusion that \"IARs have higher privacy leakage.\" The attacks are tailored for IARs, so a more cautious phrasing like \"empirical upper bound\" or \"tend to\" would be more appropriate.\nOverall, the experimental section is robust and provides insights for other researchers, I lean toward a weak accept.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the Reviewer for the feedback. \n\n## Attacks tailored for LLMs, DMs, IARs\n\n>**The proposed [MIA and DI] are specifically tailored to exploit [ARs], raising questions about whether the comparisons with DMs are conducted under balanced conditions. [Selecting baselines derived] from language model research raises questions about their suitability for [DMs]. [...] The experimental setup appears to favor IARs. [...] The baselines [...] may not [be] rigorous benchmarks for [DMs].**\n\nWe use MIAs that are tailored to unique characteristics of a given model, including DMs (see Tab. 13, App. F). For DMs we use **the strongest** MIA available at the time of writing the paper, namely CLiD (Zhai et al., 2024), and we *do not* use LLM/IAR-specific MIAs against DMs. Similarly, for IARs we build on the strongest MIAs that are suitable for the AR architecture of these models. Overall, we use the strongest attacks for a given model, following [1].\n\n>**[...] developing equally specialized attacks for [DMs] or applying the same, more generic attack methods [...]. The authors should clarify why LLM-attack approaches were selected over methods designed for DMs.**\n\nWe *do not* use LLM/IAR-specific MIAs/DI against DMs. Instead, we use SOTA DM-specific attacks, as explained in the previous answer.\n\n>**Why [MIAs and DI] tailored [for ARs show that] IARs are more susceptible to privacy breaches than DMs. This design choice seems to favor ARs.**\n\nTo perform DI against DMs, we use CDI (Dubiński et al., 2024)–a method *explicitly* created for DMs. For IARs we build upon LLM DI (Maini et al., 2024), which we adapt to IAR specifics (see Sec. 5.2) to ensure a fair comparison.\n\n>**Different MIA strategies are tailored for MAR and for VAR/RAR [...] (Should?) a single, unified MIA strategy be used [...]**\n\nEmpirical privacy leakage analysis should be carried out with respect to the worst case [1], thus the strongest known attack. Unified MIA for all IARs would not allow such comparison.\n\n>**[...] whether the performance differences are due to inherent model vulnerabilities or inconsistencies in the attack strategies [...] These strategies are combined into a single tab. without clearly distinguishing how each approach is evaluated. [It is unclear if] the metrics for MAR should be compared directly to those for VAR/RAR.**\n\nMAR and V/RAR are distinct in *design, inference, and training–and the attacks differ too*, as they exploit unique vulnerabilities of the models. Some design choices allow for stronger attacks; it is reflected in the results (Tab. 1). Evaluation protocol stays consistent; the attacks vary.\n\n## Baselines\n\n>**The authors select certain baselines [...], but some vital experimental settings are not explicitly detailed. For instance, the term “baseline” appears repeatedly in [Tab. 1-3] without fully describing the precise settings, assumptions, and hyperparameters [...]** \n\nAll MIAs assume gray-box access to the model, i.e., output and model loss. Some MIAs for DMs require white-box access to the model. We expanded the description provided in App. B. For all MIAs, we use the default hyperparameters from the respective MIAs. Following the literature we report the TPR@FPR=1% only for the best hyperparameter in Table 9, 11. In Table 1, for baseline and our methods, we report the best MIA for each model, as we strive to compare only *the strongest* attacks.\n\n​​In Tab. 1-3, “baseline” denotes a naive use of LLM-tailored MIAs and DI to attack IARs. We revise App. B to include experimental details, relevant configurations and parameter choices.\n\n>**A clearer justification of baseline [...]**\n\nFor IARs we use MIAs and DI for LLMs as “Baseline” (Table 1-3) as we can directly apply them to IARs, and no IAR-specific attacks exist in prev. work.\n\n## Other\n\n>**Methodological descriptions (e.g., the integration of CLiD into MIAs) and the explicit definition of experimental settings [...] require improvement. [For instance] “incorporate [this] into our MIAs by building on CLiD”, [...] how the tailored MIA approach is employed within the DI [...].**\n\nWe improved the clarity of those aspects. For details, see answer to the [Reviewer ZL49](https://openreview.net/forum?id=7SXXczJCWP&noteId=yF02U11EAL]).\n\n>**Fig. 1 and 2**\n\nWe improve Fig. 1,2 accordingly. \n\n>**TPR@FPR**\n\nWe clarify what TPR@FPR (True Positive Rate at False Positive Rate) stands for in the abstract section.\n\n>**Please elaborate on the unique contributions or key design elements of your methods. The paper lacks a clear theoretical contribution beyond statements such as “incorporate CLiD in our methods” (line 224) and “simply summing” (line 289).**\n\nPlease refer to [the answer to the Rev. 1YbK.](https://openreview.net/forum?id=7SXXczJCWP&noteId=yJHAnkGBJf)\n\n>**Tab. 9**\n\nWe thank the Reviewer for the suggestion. We will move Tab. 9 to the main text if accepted, given the 1 extra page allowed.\n\n**Ref.:**\n\n[1] Carlini et al., Extracting Training Data from [DMs], USENIX 2023.", "claims_and_evidence": "1. The paper claims that autoregressive image models (IARs) are inherently more vulnerable to privacy attacks than diffusion models (DMs). However, the proposed membership inference and dataset inference attacks are specifically tailored to exploit autoregressive architectures, raising questions about whether the comparisons with DMs are conducted under balanced conditions.\n\n2. It asserts that the proposed membership inference attacks significantly improve performance on AR models (e.g., a TPR of 86.38% at 1% FPR and up to 69% improvement over previous methods). However, different MIA strategies are tailored for MAR and for VAR/RAR, prompting the question of whether a single, unified MIA strategy should be used to conclusively evaluate performance.", "methods_and_evaluation_criteria": "1. The study employs tailored membership inference attacks specifically designed for autoregressive architectures. However, the rationale behind selecting certain baselines—often derived from language model research—raises questions about their suitability for diffusion models. Additionally, clarity in methodological descriptions (e.g., the integration of CLiD into MIAs) and the explicit definition of experimental settings (such as hyperparameters) require improvement. \n\n2. Evaluation is based on performance metrics such as TPR at fixed FPR and comparative improvements over baseline methods. The evaluation metrics themselves appear to be sound and reasonable.", "theoretical_claims": "No, the paper does not present explicit theoretical proofs for the proposed methods. Instead, it primarily relies on the intrinsic design of the approaches and empirical validation through experimental results. While the work may be conceptually motivated, it does not include rigorous theoretical justifications or formal proofs.", "experimental_designs_or_analyses": "1. The experiments are structured to compare privacy vulnerabilities between IARs and DMs, with a focus on the performance of tailored membership inference attacks. However, the experimental setup may favor IARs by using attack strategies specifically optimized for them, while applying different (and potentially less aligned) approaches for MAR and VAR/RAR. This design choice raises concerns about whether the performance differences are due to inherent model vulnerabilities or inconsistencies in the attack strategies applied. \n\n2. The authors select certain baselines from language model research, but some vital experimental settings are not explicitly detailed. For instance, the term “baseline” appears repeatedly in Tables 1, 2, and 3 without fully describing the precise settings, assumptions, and hyperparameters employed.", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "The current reference are sufficient.", "other_strengths_and_weaknesses": "Strengths:\n\n1. The paper offers a well-structured background section that thoroughly contextualizes privacy attacks on generative models. This makes the work accessible to researchers who are new to privacy attack techniques yet familiar with generative modeling.\n\n2. This study appears to be the first systematic evaluation of privacy attacks specifically targeting autoregressive image models, which have gained prominence due to their speed and quality benefits. The direct comparison with diffusion-based models adds valuable insights to the research community.\n\n3. The proposed membership inference attacks show remarkable enhancements over naive baselines. Notably, a TPR of 86.38% at 1% FPR and improvements up to 69% over previous methods underscore the effectiveness of the tailored attacks. \n\nWeaknesses:\n\n1. While the paper concludes that IARs, with their superior generation speed and image quality, are more susceptible to privacy breaches than DMs, the direct comparisons may not be entirely equitable. The proposed membership inference and dataset inference attacks are specifically tailored to exploit autoregressive architectures, raising questions about whether the comparisons with DMs are conducted under balanced conditions. To strengthen the argument that IARs inherently pose a higher privacy risk, the authors might consider either developing equally specialized attacks for diffusion models or applying the same, more generic attack methods to both model types. This would help ensure that any observed differences in vulnerability stem from the model architectures themselves rather than from a mismatch in attack strategies.\n\n2. The paper aims to demonstrate two core points: (1) IARs are intrinsically more vulnerable to privacy attacks than DMs, and (2) the newly proposed attacks outperform existing methods. However, the current experimental setup appears to favor IARs as a more accessible target from the outset. In particular, the chosen baselines—many of which originate from language model research—may not offer the most relevant or rigorous benchmarks for diffusion-based image models. To reinforce the claim that IARs are inherently more susceptible, the authors should clarify why LLM-attack approaches were selected over methods designed for DMs-attack, and detail how these baselines align or diverge from DM-specific attacks. A clearer justification of baseline choices, as well as a more balanced experimental design, would further bolster the credibility of the results and conclusions.\n\n3. Certain technical implementations lack detailed descriptions, making reproducibility challenging. For instance, the authors briefly state that they “incorporate [this] into our MIAs by building on CLiD” (lines 222–224), but do not elaborate on how this integration is achieved. Similarly, the description of how the tailored MIA approach is employed within the DI framework (lines 315–318) remains vague, limiting the clarity of the specific methodological contributions.\n\n4. Although the paper highlights in Section 5.1 that different MIA strategies are tailored for MAR and for VAR/RAR, these strategies are combined into a single table (Table 1) without clearly distinguishing how each approach is evaluated. This makes it difficult to discern whether the metrics for MAR should be compared directly to those for VAR/RAR, especially if they rely on different methodologies. \nAdditionally, the term “baseline” appears repeatedly in Tables 1, 2, and 3, but the precise settings, assumptions, and hyperparameters for these baselines are not fully described. This lack of clarity complicates the interpretation of experimental results and raises questions about whether comparisons across methods are valid. To improve transparency and rigor, the authors should clearly demarcate the distinct MIA strategies (e.g., MAR vs. VAR/RAR) and provide detailed descriptions of the baselines, including all relevant configurations and parameter choices.", "other_comments_or_suggestions": "1. For Figures 1 and 2, it is recommended to avoid using dashed lines ('----') for interval division, as they might be mistaken for elements of the legend. Instead, consider incorporating these distinctions directly within separate legend entries. Additionally, employing triangle symbols for diffusion-based methods could enhance visual differentiation.\n2. Including a full extension or definition of abbreviation TPR@FPR in the abstract or introduction would help readers unfamiliar with the metric to understand its significance and context.", "questions_for_authors": "1. Please explain why the membership inference and dataset inference attacks are specifically tailored to exploit autoregressive architectures to conclude that IARs are more susceptible to privacy breaches than DMs. This design choice seems to favor ARs and may impact the fairness of the comparison. \n\n2. Please elaborate on the unique contributions or key design elements of your methods. The paper currently lacks a clear theoretical contribution beyond statements such as “incorporate CLiD in our methods” (line 224) and “simply summing” (line 289). A more detailed explanation of the underlying principles would strengthen the work. \n\n3. Please provide detailed descriptions of the experimental settings. Specifically, clarify the precise configurations, assumptions, and hyperparameter choices for the baselines mentioned in Tables 1, 2, and 3, which are currently seem to be described in a fuzzy manner.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "mY4dM3wH9n", "reviewer": "Reviewer_1YbK", "summary": "The paper presents a systematic analysis of privacy attacks on image autoregressive models, including membership inference attacks, dataset inference, and data extraction attacks. The proposed method is primarily constructed from components of previous work.\n\n## Update after Rebuttal\n\nThe authors have provided a detailed response and addressed most of my concerns regarding the experimental aspects. However, my main concern remains the clarity of the writing. While it is encouraging that the authors have outlined a plan for revision, it is difficult to fully assess the impact of these changes without seeing the modified version of the paper. (Although the authors note that updates are not allowed by the conference, the current version is indeed unclear.) Therefore, I still lean toward a weak reject and recommend that the paper be revised and resubmitted to another venue.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ">**The method is primarily constructed from components of prev. work.**\n\nBeyond the proposed method, our contributions are:\n\n1. **First empirical privacy leakage evaluation of IARs**. We develop the strongest model-specific attacks, and perform comprehensive analysis across publicly available models.\n\n2. **Privacy-utility trade-off**. We show IARs are fast and performant, but substantially less private. We highlight that DMs are comparably performant, while leaking *significantly less* information about the training data.\n\n>**The authors propose an attack specifically tailored for IARs, it is misleading to claim that IARs inherently have higher privacy leakage. It would be more accurate to state that *using the tailored attack*, higher privacy leakage is observed in IARs compared to DMs. Privacy leakage measurements should reflect an upper bound across possible methods, not just the results from a specific, targeted attack.**\n\nWe do not use IAR-tailored MIAs/DI against DMs–they are not applicable to DMs. **We use SOTA DM-specific attacks against DMs**, thus the observed privacy leakage for DMs and IARs **is an empirical upper bound** across possible methods, since we use the strongest possible attacks. Effectively, our claims hold. We improved the wording in the manuscript. \n\n>**The method [...] lacks sufficient emphasis on the differences from previous work. [...]  In the introduction: [...] a citation to CLiD should be included.**\n\nWe now include the citation to CLiD (Zhai et al. 2024) in the introduction.\n\nOur MIA for VAR/RAR provides the following innovations over CLiD:\n\n1. **Difference between logits, not model loss**. CLiD uses $\\mathcal{L}(x,c)-\\mathcal{L}(x,c_{null})$. Since MIAs we use work with logits, we compute $p(x|c)-p(x|c_{null})$.\n\n2. **Parameter-free method**. CLiD needs a sweep through a hyperparameter $\\alpha$ to achieve its high performance, as well as Robust-Scaler to stabilize the MIA signal. We provide a more generalized approach.\n\n>**2. In Sec. 5.3: “[...] builds on elements of data extraction attacks [...].” It is not clearly stated which parts align with previous work. [...] Fixing and knowing the first i tokens mirrors the setting in LLMs.**\n\nOur attack consists of the following:\n1. **Efficient candidates selection**. We do not simply generate millions of images. Instead, we identify promising images for further generation. This improves over Carlini et al., 2023.\n\n2. **Fixing the prefix**. We directly follow the approach by Carlini et al., 2021.\n\n3. **Generating from the prefix**. We follow (Carlini et al., 2021), and use greedy sampling for VAR/RAR starting from the prefix. For MAR, we do not alter the generation process.\n\n4. **Final assessment**. In contrast to LLM extraction (Carlini et al., 2021), we focus on the images, not sequences of tokens. Samples we extract *do not match* the training samples in the token space; instead, we classify a sample as extracted in the image domain. To this end, we use SSCD (Pizzi et al., 2022), following Wen et al., 2024.\n\n>**[...] the unclear presentation of prior work makes the paper’s contributions less apparent. [...] the attacking method is not particularly innovative [...].**\n\nOur methods include novel designs:\n1. **Improved MIA against VAR/RAR**. While we *are* building on CLiD, the adaptation to IARs is non-trivial. We improve the performance by up to **69%**.\n\n2. **MIA specifically tailored against MAR**. We exploit model vulnerabilities (the DM module, training specifics) to boost the performance of our attack.\n\n3. **Efficient data extraction**. While we build on previous work, we address two drawbacks: 1) focus in the sequence space, 2) high cost. We suggest an improved method enabling quicker, more successful extraction from the IARs, extracting up to **698** images. \n\n4. **Improved DI**. We improve feature aggregation (replacing scoring function) and the feature extraction pipeline. We achieve an improvement of up to over **90%** compared to the baseline.\n\n\n>**The experimental section is solid, but [...] it would be beneficial to include more insights.**\n\nWe appreciate that the Reviewer considers our experiments solid. We agree that insights would improve our work. In the [answer to the Reviewer RYDX](https://openreview.net/forum?id=7SXXczJCWP&noteId=GeVeD4wCQI) we provide intuitions to *why* IARs are more vulnerable than DMs. We add them to the paper.\n\n>**The approach in Sec. 5.1 feels like parameter tuning [...] rather than offering deeper methodological innovations.**\n\nOur main innovation stems from modifying the DM module of MAR to increase the leakage. We are not aware of any prior work that modifies the inference stage of an AR model to design a more potent attack. \n\n>**[...] unclear articulation of the contributions gives the impression of claiming a larger contribution than is warranted.**\n\nDo our above answers articulate our contributions clearly enough? We are happy to incorporate any additional feedback.", "claims_and_evidence": "In the abstract, the third contribution states:  \n> IARs outperform DMs in generation efficiency and quality but suffer order-of-magnitude higher privacy leakage compared to them in MIAs, DI, and data extraction.  \n\nHowever, since the authors propose a privacy-related attack specifically tailored for IARs, it is misleading to claim that IARs inherently have higher privacy leakage. It would be more accurate to state that *using the tailored attack*, higher privacy leakage is observed in IARs compared to DMs. Privacy leakage measurements should reflect an upper bound across possible methods, not just the results from a specific, targeted attack.", "methods_and_evaluation_criteria": "I think the method is mostly intuitive but lacks sufficient emphasis on the differences from previous work. The paper’s writing style tends to merge several aspects into its contributions, which should be clarified. For example:\n\n1. In the introduction:  \n> We exploit this property and compute the difference in outputs between conditional and unconditional inputs as an input to MIAs.  \n\nAt minimum, a citation to CLiD should be included here. Without it, this technique appears to be the author’s own contribution.\n\n2. In Section 5.3:  \n> This attack builds on elements of data extraction attacks for LLMs (Carlini et al., 2021) and DMs (Carlini et al., 2023).  \n\nHowever, it is not clearly stated which parts align with previous work. For instance, fixing and knowing the first *i* tokens directly mirrors the setting in LLMs (Carlini et al., 2021).\n\nI believe the method includes some novel designs, but the unclear presentation of prior work makes the paper’s contributions less apparent.", "theoretical_claims": "No theoretical claims found.", "experimental_designs_or_analyses": "Experiment design is mostly good.", "relation_to_broader_scientific_literature": "There has been extensive research on privacy leakage threats in LLMs and DMs. IARs, which can be seen as a new architecture combining properties of both LLMs and DMs, have not been explored in the context of privacy leakage. This paper addresses that gap.", "essential_references_not_discussed": "Not found.", "other_strengths_and_weaknesses": "The experimental section is solid, but the proposed method appears somewhat empirical. It would be beneficial to include more insights. For instance, the approach in Section 5.1 feels like parameter tuning, focusing on the timestep and binary mask ratio, rather than offering deeper methodological innovations.", "other_comments_or_suggestions": "Although the attacking method is not particularly innovative compared to previous work, the paper appears solid due to its strong experimental section. However, the unclear articulation of the contributions gives the impression of claiming a larger contribution than is warranted.", "questions_for_authors": "See comments above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper proposes and evaluates membership inference attacks against image autoregressive (IAR) models. Reviewers generally appreciated the novelty of studying MIA for IARs, and found the strong MIA result compared to diffusion models to be interesting and meaningful. However, reviewers also cited some weaknesses, including:
1. Missing ablation study on factors that affect memorization, e.g. number of training steps and duplicated data.
2. Findings largely agree with what is known for diffusion models and autoregressive text models without providing additional insight.
3. Only studies class-conditional models rather than text-to-image models.

The authors included additional experiments in the rebuttal aimed at addressing these weaknesses. As IARs become more prevalent and serve as efficient alternatives to diffusion models, this study is likely to have significant impact for future studies on memorization in generative models, even if the study is deemed not deep or comprehensive enough to some reviewers. For this reason, AC believes the paper's merits outweigh its weaknesses and recommends acceptance. The authors are strongly encouraged to revise the draft to include experiments and relevant discussion from the rebuttal.
Decision: Accept (poster)