Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancy
Authors: Shengfang Zhai
Huanran Chen
Yinpeng Dong
Jiajun Li
Qingni Shen
Yansong Gao
Hang Su
Yang Liu
Venue: NeurIPS 2024 poster (2024)
Keywords: Diffusion models
Membership inference
Conditional Likelihood
Text-to-Image Synthesis
Primary area: privacy
TL;DR: We propose a membership inference method on text-to-image diffusion models via condition likelihood discrepancy, outperforming previous works on diverse datasets, with superior resistance against early stopping and data augmentation.

Abstract: Text-to-image diffusion models have achieved tremendous success in the field of controllable image generation, while also coming along with issues of privacy leakage and data copyrights. Membership inference arises in these contexts as a potential auditing method for detecting unauthorized data usage. While some efforts have been made on diffusion models, they are not applicable to text-to-image diffusion models due to the high computation overhead and enhanced generalization capabilities. In this paper, we first identify a conditional overfitting phenomenon in text-to-image diffusion models, indicating that these models tend to overfit the conditional distribution of images given the corresponding text rather than the marginal distribution of images only. Based on this observation, we derive an analytical indicator, namely Conditional Likelihood Discrepancy (CLiD), to perform membership inference, which reduces the stochasticity in estimating memorization of individual samples. Experimental results demonstrate that our method significantly outperforms previous methods across various data distributions and dataset scales. Additionally, our method shows superior resistance to overfitting mitigation strategies, such as early stopping and data augmentation.

Membership Inference on Text-to-image Diffusion Models via Conditional Likelihood Discrepancy
Shengfang ?h Huanran Chen Yinpeng Dong .Jajun Li
Qingni Shen 1.2 Yansong Gao Hang Su Yang Liu"
School of Software and Microelectronics, Peking University PKU-OCTA Laboratory for Blockchain and Privacy Computing, Peking University
3 Dept. of Comp. Sci. and Tech., Institute for AI, BNRist Center, THBI Lab, Tsinghua University
"The University of Western Australia $Zhongguancun Laboratory, Beijing, China RRealAl "Nanyang Technological University
{zhaisf, jiajun. 1stu. pku. edu, en huanran. chen@outlook, com
(dongyinpeng, subangas)@tsiighuus edu. edu. cn
qingnishen@ss pku. edu. en garrison woo.nngggwwwwa..o.m edu. au yangliuEntu. edu.
Abstract
Text-to-image diffusion models have achieved tremendous success in the field of controllable image generation, while also coming along with issues of privacy leakage and data copyrights. Membership inference arises in these contexts tential auditing method for detecting unauthorized data usage. While some efforts have been made diffusion models, they are not applicable text-to-image diffu- sion models due to the high computation overhead and enhanced generalization capabilities. In this paper, first identify conditional overfitting phenomenon in text-to-image diffusion models, indicating that these models tend to overfit the conditional distribution of images given the corresponding text rather than the marginal distribution of images only. Based on this observation, we derive an analytical indicator, namely Conditional Likelihood Discrepancy (CLiD), perform membership inference, which reduces the stochasticity in estimating mem- orization of individual samples. Experimental results demonstrate that our method significantly outperforms previous methods across various data distributions and dataset scales. Additionally, our method shows superior resistance to overfitting mitigation strategies, such as early stopping and data augmentation.
po-
Introduction
Text-to-image diffusion models have achieved remarkable success in the guided generation of diverse, high-quality images based on text prompts, such as Stable Diffusion [42, 46], DALLE-2 [43], Imagen [49], and DeepFloyd-IF [31]. These models are increasingly adopted by users to create photorealistic images that align with desired semantics. Moreover, they can generate images of specific concepts [32] or styles [61] when fine-tuned on relevant datasets. However, the impressive generative capabilities of these models depend heavily on high-quality image-text datasets, which involve collecting image-text data from the web. This practice raises significant privacy and copyright concerns in the community [5, 18]. The pretraining and fine-tuning processes of text-to-image diffusion models can cause copyright infringement, as they utilize unauthorized datasets published by human artists stock-image websites [2, 10, 44, 45, 58].
Corresponding authors.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Membership inference (also known as the membership inference attack) is widely used for auditing privacy leakage of training data [4, 53]. defined as determining whether a given data point has been used to train the target model. Dataset owners can thus leverage membership inference to determine if their data is being used without authorization [14,39)
Previous works [5, 15-17, 28, 38J have attempted membership inference on diffusion models. Carlini al. [5] employ LiRA (Likelihood Ratio Attack) [4] perform membership inference on diffusion models. LiRA requires training multiple shadow models to estimate the likelihood ratios of a data point from different models, which incurs high training overhead (e.g.. 16 shadow models for DDPM [22] on CIFAR- 10 [30]), making it neither scalable nor applicable to text-to- -i-tte diffusion models. Other query-based -ased membership inference methods [15, 17, 28, 38] design and compute indicators to evaluate whether a given data point belongs to the member set. These methods require only a few or even a single shadow model, making them scalable to larger text-to-image diffusion models. However, these methods mainly estimate model memorization for data points and do not fully utilize the conditional distribution of image-text pairs. Consequently, they achieve limited success only under excessively high training steps and fail under real steps or common data augmentation methods (Tab. 2), which do not reflect real training scenarios. Text-to-image diffusion models have demonstrated excellent performance in zero-shot image generation [1, 42, 46], indicating their strong generalization, which makes it difficult to distinguish membership by directly measuring overfitting to data points. And due to the stochasticity of diffusion training loss [22, 46], this kind of measuring becomes more challenging.
To address the challenges, we firstly identify Conditional Overfitting phenomenon of text-to-image diffusion models with empirical validation, where the models exhibit more significant overfitting to the conditional distribution of the images given the corresponding text than the marginal distribution of the images only. It inspires the revealing of membership by leveraging the overfitting difference. Based on it, we propose to perform membership inference on text-to-image diffusion models via Conditional Likelihood Discrepancy (CLiD). Specifically, CLiD quantifies overfitting difference analytically by utilizing Kullback-Leibler (KL) divergence the distance metric and derives membership inference indicator that estimates the discrepancy between the conditional likelihood of image-text pairs and the likelihood of images only. We approximate the likelihoods by employing Monte Carlo sampling on their ELBOs (Evidence Lower Bounds), and design two membership inference methods: threshold-based method CLiDD, and feature vector-based method CLiDD
We conduct extensive experiments on three text-to-image datasets [32, 35, 66] with various data distributions and dataset scales, using the mainstream open-sourced text-to-image diffusion models [11, 47] under both fine-tuning and pretraining settings. First, our methods consistently outperform existing baselines across various data distributions and training scenarios, including fine-tuning settings and the pretraining setting. Second, our experiments on fine-tuning settings with different training steps (Sec. 4.2) reveal that excessively high step/image ratios cause overfitting, leading to hallucination success; and we develop a more realistic pretraining setting following [13, 16), where our experiments reveal the insufficient effect of existing membership inference works [15, 17, 28, 38). Third, our comparison experiment with varying training steps (Sec. 4.3) indicates that the effectiveness of membership inference grows with higher step/image ratios and should be evaluated under reasonable settings for realistic results. Next, ablation studies further demonstrate the effect of our CLiD indicator, even with fewer query count, our method still outperforms baseline methods (Fig. 3). Last, experiments show that our methods exhibit stronger resistance to data augmentation, and exhibit resistance even adaptive defenses.
2 Diffusion Model Preliminaries
Denoising Diffusion Probabilistic Model (DDPM) [22] learns the data distribution Xo ~ q(x) by reversing the forward noise-adding process. For the forward process, DDPM defines Markov process of adding Gaussian noise step by step:
(xx)) == (xxx VI - 1,
(I)
where 3 (0,1) is the hyperparameter controlling the variance. For the reverse process, DDPM defines a learnable Markov chain starting at p(xr) = (xx:; 0, I) to generate Xy:
px(xo)= = [ p(XT)
T
pa po (x-- (xx) dxieT;
po px(x = 1xx-1;; o?), (2)
x1.r

---

where of is the untrained time-dependent constant. represents the trainable parameters. To maximize Po(Xo), DDPM optimizes the Evidence Lower Bound (ELBO) of the log- likeliiooood [22, 33]:
Po (x(o)) xx)
log pa 2 (x(x)r/)x
log
E,,, (xl, - ==13] + +C
(3)
g(Xi:T
where (0, (~ Uniform(1 T) and C is a constant. x, is obtained from Eq. (1), and 60 a function approximator intended to predict the noise from X2. Omitting the untrainable constant Eq. (3) and taking its negative yields the loss function of training DDPM.
Conditional diffusion models [21, 40, 46]. To achieve controllable generation ability, text-to-image diffusion models incorporate the conditioning mechanism into the model, which are also known as conditional diffusion models, enabling them to learn conditional probability as:
(x
p(xr)
II Po (xt-1 1 c) dx
where e denotes the embedding condition. For text-to-image synthesis, c T(y), where y and T denote the text input and the text encoder, respectively. Similar to Eq. (3), through derivation [33], we can obtain the ELBO of the conditional log-likelihodd:
log (xolo( 2 -Er, [llea(xe, (,) - -el +C
(5)
3 Methodology
In this section, we detail the proposed Conditional Likelihood Discrepancy (CLiD) method. We first introduce the threat model of query-based membership inference Sec. 3.1. We then identify the conditional overfitting phenomenon with experimental validation in Sec. 3.2. We further drive the membership inference indicator based on CLiD Sec. 3.3 and design two practical membership inference methods in Sec. 3.4. We finally provide the implementation details in Sec. 3.5.
3.1 Threat Model
We use the standard security game of membership inference on image-text data following previous work [4, 5, 38, 48]. We define challenger C and adversary A who performs membership inference. C samples a member set Dmem <- DD and trains or fine-tunes text-to-image diffusion model ʃo (i.e., target model) with D Deem- The rest of ID is denoted by hold-out set D D Dmem- For a given data point (x, c) E D, A designs an algorithm M to yield membership prediction:
M(x, fo) = [M' (x, (x,c, So) r],
(6)
where M denotes an indicator function that reflects membership information, and denotes tunable decision threshold of query-baset membership inference [15, 17, 28, 38].
We consider grey-box setting" consistent with previous guery-based methods [15, 17, 28, 38]. This setting assumes that A has access the intermediate outputs of models without knowledge of specific model parameters. For the given image-text data point (x, c), we assume that x and c always correspond within the dataset This assumption is evident in scenarios where dataset copyright owners perform membership inference to audit usage. And we also consider a weaker assumption of conducting membership inference without the groundtruth text in Sec. 4.6.
Conversely, challenger can mitigate the effectiveness of membership inference during training by utilizing data augmentation even adaptive defense methods, which we discuss in Sec. 4.5. Our work primarily focuses on readily available, making this scenario more prone to copyright risks [41, 56]. Numerous projects are implemented by fine-tuning open-source source models on specific datasets [3, 24, 60, 64]. We also conduct experiments on pretrained texi-to-image di diffusion models (Tab. 3) to demonstrate the effectiveness of our method even in pretraining scenarios.
scenarios because the weights of pretrained models are
Note that in most real-world scenarios, the requirements for AA in gray- box and white box settings are nearly identical. We this terminology here for consistency with previous works [15, 28].

---

3.2 Conditional Overfitting Phenomenon
The rationale behind previous studies primarily hinges on the overfitting of diffusion models to training data (usually image data x) [7, 8, 15, 28, 38]. This overfitting tends to result in lower estimation errors for images in the member set (training data) compared to those in the hold-out set during the diffusion process. Various indicators [15, 28, 38] are designed based on this to expose membership information. Specifically, let Qnem and Jout represent the image distributions of the member set and the hold-out set, respectively. p represents the diffusion models' estimated distribution, and D denotes a distance metric (which will be specified later). This rationale can be formulated as:
D(gmem (00mmm(x),70) (x), v (x,
However, if considering the membership inference on text-to-image diffusion models with image-text data (x, c), we emphasize the following assumption:
Assumption 3.1 (Conditional overfitting phenomenon). The overfitting of text- text-to-image diffusion models to the conditional distribution of (x, c) is more salient than to the marginal distribution of x:
E.e [ yowr ( (x(c)xxpxxxeee))) p(x(c)) D [mmom (x(c)x((x(c)) 2
D (oor(x)) p(x)) Dmgoo p(x))
overfiting to conditional distribution
overfittin to marginal distribution
Empirically, we validate this assumption by using Fréchet Inception Distance (FID) [20] as the metric D, i.e. DPID. We calcu-
Momber
000
Member
Hold-out set
Hold-out
late (g(c(g( p(x()) using the MS-
COCO [35] dataset on a fine-tuned Sta- ble Diffusion [46] model. Then by gradu- ally truncating the original condition text to (2/3. 1/3, Null} to obtain c", we calculate DFID(g(xle") ) p(x as a stepwise ap- proximation of D DFID (FxD( p(x)). In Fig. we report the FID scores of synthetic images under different conditions of member set and hold-out set. A smaller FID value indicates closer match between model distributions and dataset distributions. From Fig. 1 (a), it can be observed that for the full condition, the FID difference between the member set and the hold- out set is consistently higher than that for the truncated conditions, which validates our assumptions. We also demonstrate the validation utilizing other metrics in Appendix A.
15-
PM
13
Nit
33 Fut
Nall Fill
Text Condition
(b) Discrepancy Text Conditions
Figure 1: FID values and the FID differences of syn- thetic images (2500/ /250 samples for member/hold- out set) under different conditions of member set and hold-out set.
We further compute the change in FID after truncating the condition and observe that the change in FID of the member set is consistently greater than that of the hold-out set (Fig. 1 (b)), which inspires revealing membership by this overfitting discrepancy. Recalling the aim of text-to-image diffusion model is to latent space mapping from text to image, image data augmentation commonly used to enhance the model generalization. For instance, the official fine- tine-tuning script of Hugging Face [24] employs Random- Crop and Random-Fli as the default augmentation [25]. However, few trainers disturb the text condition as it is discrete and such disturbance would result in decline of model utility (Sec. 4.5). Therefore, we believe that leveraging this phenomenon contributes to addressing the challenges of the strong generalization of text-to-image diffusion models with the resistance to data augmentation.
3.3 Condition Likelihood Diserepancy
In this section, we derive membership inference indicator for given individual sample based on Assumption 3.1. Calculating FID requires sampling lots of images from the p distribution, which is impractical under membership inference scenarios. Instead, we employ Dallback-Leible (KL) divergence as the distance metric, which is widely used and computationally convenient (the usage of other metrics is discussed in Appendix C). Then we have the following theorem:
Theorem 3.2. (Proof Appendix B) When using D DKL as distance metric, Assumption 3.1 is equivalent to:
(x.c) [logp(x(c) c) log logp(x)) ( logg(x)) + δh
(9)

---

where
Ön (quuc())) Bee H 9mem (x|c))] (9mem Be Be(HHggnu (x(c))
(10)
Let us define:
I(x, c) log logp(x(cc log p(x).
(11)
If бн is negligible, then according to Eq. (9), it holds that ge [x() 2 2 Ey.. [[x)], where r is a constant intermediate between the hend side and right-hand side. Membership inference is then posed as follows: given an input instance (x, c), measuring lx c) to predict how probable it is that the input is sample from Qmem rather than Jour- Intuitively, if (xx exceeds threshold т, the instance is likely from Quem: otherwise, it belongs to Gout- In the community of membership inference methods [4-6, 15, 17, 28, 38, 65] setting such threshold T is standard practice differentiate between the two distributions. Therefore, we can utilize the indicator [(x, c) for membership inference. Since Eq. (11) actually involves measuring the likelihood discrepancy under different conditions of diffusion models, we call it Conditional Likelihood Discrepancy (CLiD).
In order calculate the likelihoods in Eq. (11) for a given data point (x, c), utilize the ELBOs in Eq. (3) and Eq. (5) as an approximation of the log- likelihoods:
[(x, c) = Er,, [Ilea (Xe, f, Cmmu) el <l'²] E,, [lleo(x,, t, t, - -cl3]
(12)
where Gmall denotes an empty text condition input used to estimate the approximation of log po()..
3.4 Implementation of CLiD-MI
In practice, calculating Eq. (12) needs a Monte Carlo estimate for data point by sampling N times using (4) pairs, with e; (O, I) and [1,, 1000]. Performing two Monte Carlo estimations independently incurs high computational costs, resulting in 2 x N query count, where N is typically large number to ensure accurate estimation. To simplify computation, we instead perform Monte Carlo estimation on the difference of the ELBOs inspired by [33]:
T(x, c) R2,, [xleo(Xe, (, Cnall) e|1 - (1,,(x,,1,c) -
(13)
In experiments, further mitigate randomness, we also consider diverse reduced conditions along with Cmall, forming the reduced condition set C {ci, cj.., c where we set cj = Caall- Then we compute multiple condition likelihood discrepancies:
Dx,c,e; Er, [Xle (x,,,,,,,,,, I, c)) - ell |leo (, - -)) -|]3]
(14)
where of E C. In subsequent parts, we employ their mean or treat them as feature vectors to reveal membership information. We will introduce how obtain C in Sec. 3.5.
Combining (x())c for further enhancement. Recall that the practical significance of sample likelihood is the probability that data point originates from the model distribution, which essentially can also be used to assess membership. Due to the monotonicity the log function, we can also use ELBO of Eq. (5) to estimate pa (x|c):
Lx.c = -x [[ca(xx, t. -c13].
(15)
Additionally, this estimation can reuse results from estimating Eq. (14), thus obviating any additional query counts. Next, we consider two strategies to combine Eq. (14) and Eq. (15) to construct the final membership inference method.
Threshold- attack-Cl.iD.. First, we normalize the two indicators the same feature scale. Due to the outliers in the data, we use Robust-Scaler: S(a,) = (a: a)/ SQQRR where a, denotes the
i-th value, à denotes the mean and IQR (interquartile range) is defined the difference between the third quartile (Q3) and the first quartile (QI) of the feature. Then we have:
& MCLDD (x, c) = a S( Dx,o,o;) (1- S((x,)) (( 7
(16)
where & denotes the total number of reduced c* (i.e., k = |C], and is a weight parameter.
Vector-based Attack-CLiD vec- We combine the estimated values of Eq. (14) and Eq. (15) obtain the feature vectors corresponding to each data point:
V (Dx.c,c Dx.c.; ... D...Dx.co.. Lxx)).
(17)
5

---

We use a simple classifier to distinguish feature vectors in order to determine the membership of the samples:
MaIaD (x c) = (V) > +],
(18)
where FM denotes the predict confidence of the classifier.
3.5 Practical Considerations
Reducing conditions to obtain c². We consider three methods for diverse reduction: (1) Simply taking the first, middle, and last thirds of the sentences text inputs. (2) Randomly adding Gaussian noises with various scales to the text embeddings. (3) Calculating the importance of words in the text [55, 57] and replacing them with "pad" tokens by varying proportions in descending order. For all three methods, we additionally use the null text input as C.. These methods are all effective and we use (3) with k in subsequent experiments (details Appendix D).
Monte Carlo sampling. Let M and N denote the Monte Carlo sampling numbers of estimating C(x, c) and Px,c,et, respectively. We set M N to achieve result reuse between Eq. (14) and Eq. (15), reducing the number of Monte Carlo sampling. Hence the overall query count of one data point is M K N. Significant effects can be observed even when M, N 1 (Fig. 3).
Classifiers of CLiD vec- Due to the simplicity of the feature vectors, we do not need a neural network as the classifier [15]. Simpler classifiers help to prevent overfitting. In our experiments, we utilize XGBoost [9] and utilize its predict confidence.
4 Experiments
4.1 Setups
Datasets and models. For the fine-tuning setting, we select 416/417 samples on Pokémon [32], 2500/2500 samples on MS-COCO [35] and 10, 000/10,, 000 samples on Flickr [66] as the member/hold-out dataset, respectively. These three datasets involve diverse data distributions and dataset scales. We use the most widely used text-to-image diffusion model, Stable Diffusion v1- 4a [11], as the target model to fine-tune on these three datasets. For the pretraining setting, we conduct experiments on Stable Diffusion v1-5t [47] using the processed LAION dataset [51] (detailed Sec. 4.2) to minimize distribution shift [13, 16].
Fine-tuning setups. For fine-tuning, previous membership inference on text-to-image diffusion models usually relies on strong overfitting settings. To evaluate the performance more realistically, we consider the two following setups: (1) Over-training. Following the previous works [15, 17, 28], we fine-tune 15,000 steps on Pokemon datasets, and 150,000 steps on MS-COCO and Flickr (with only 2500/2500 dataset size). (2) Real-world training. Considering that trainers typically do not train for such high steps, we recalibrate the steps based on the training steps/dataset size ratio (approximately 20) of official fine-tuning scripts on Huggingface [24]. Thus, we train 7,500 steps, 50,000 steps and 200,000 steps for the Pokémon, MS-COCO and Flickr datasets, respectively. Additionally, we employ the default data augmentation (Random-Crop and Random-Flip [25]) in training codes [25] to simulate real-world scenarios.
Baselines. We broadly consider existing member inference methods applicable to text-to-image diffusion models as our baselines: Loss-based inference [38], SecMIguss (SecMI) [15], PIA [28], PFAMI (PFAMI) [17] and an additional method of directly conducting Monte Carlo estimation (M. C.) on Eq. (15) for comparison. For all baselines, we use the parameters recommended in their papers. We omit some membership inference methods for generative models [6, 19, 36], as they have been shown ineffective for diffusion models in previous works [15, 17].
Evaluation metrics. We follow the widely used metrics of previous works [4, 5, 15, 17, 28], including ASR (i.e., the accuracy of membership inference), AUC and the True Positive Rate (TPR) when the False Positive Rate (FPR) is 1% (i.c.. TPR@ 1FPR).
Implementation details. Our evaluation follows the setup of representative membership inference works [4, 5]. It is important to note that some implementations [26, 29] of previous works assume
hncrpe://hugiingaace httpa//c...ccooeeeeaeaaaeeeeeeee htt.://tttaabeedfffiioo--------a "nttps://hugginggaac" htt/r/nwaal//stalle.eeeo www.-diiiffooii-i-oooooo

---

Table 1: Results under Over-training setting. We mark the best and second-best results for each metric bold and underline, respectively. Additionally, the best results from baselines are marked in blue for comparison.
MS-COCO
Flickr
Pokemon
Method
Query
ASR
AUC
@ I&FPR
ASR
AUC
TPR IIPPPRPPRR
ASR
AUC
TPR @IPPP
Loss
81.92
91.79
25.77
PIA
68.56
75.12
5.08
68.56
75.12
5.08
83.37
90.95
13.31
M. C.
82.04
89.77
36.04
83.32
91.37
41.20
79.35
86.78
23.74
SecMI
83.00
90.81
50.64
62.961
89.29
48.52
80.49
90.64
9.36
PFAMI
94.48
98.60
78.00
90.64
89.86
95.70
65.35
CLiD 99.08
99.94
97.96
99.28
97.84
CLiD ecc
99.74
99.31
95.20
91.78
97.52
73.88
97.36
99.46
96.88
When conducting SocMI [15]. observe that the thresholds obtained the shadow model sometimes transfer well the turget model.
Table 2: Results under Real-world training setting. We also highlight key results according to Tab. 1.
MS-COCO
Flickr
Pokemon
Method
Query
ASR
AUC
T 1&FPR
ASR
AUC
TPR@ I&FPR
ASR
AUC
IPR J%FPR
Loss
56.28
61.89
54.91
56.60
61.03
65.96
2.82
PIA
54.10
55.52
1.76
51.96
52.73
1.28
58.34
59.95
2.64
2
M. C.
57.98
61.97
2.64
54.92
56.78
2.16
61.10
66.48
3.84
3
SecMI
60.94
65,40
3.92
55.60
63.85
2.76
61.28
65.56
12
PFAMI
57.36
60.39
2.72
54.68
56.13
L.80
58.94
63.53
5.76
20
CLiDio
88.88
96.13
67.52
87.12
94.74
53,56
86.79
93.28
61.39
15
CLiD vee
89.52
96.30
66.36
88.86
95.33
53.92
85.47
92.61
59.95
15
access portion the exact member set and the hold-out set to obtain threshold for calculating ASR or to train classification network [26]. This assumption does not align with real-world scenarios. Therefore, we strictly adhere to the fundamental assumption of membership inference
[4, 17]: knowing only the overall dataset without any knowledge of the member/hold-ou split. Hence, we first train a shadow model to obtain the for Eq. (16), classifiers for Eq. (18) and the threshold for calculating ASR with auxiliary datasets of the same distribution. Then we perform the test on the target models. Other implementation details are provided in Appendix D.
4.2 Main Results
Over-training setting (fine-tuning). In Tab. 1, models are trained for excessive steps on all three datasets, resulting in significant overfitting. We observe that under this over-training scenario, both of methods nearly achieve ideal binary classification effectiveness. For instance, CLiD,,, achieves over 99% ASR, AUC and TPR@ &FPP value on the MS-COCO dataset [35]. With this training setup, the metrics for different baselines are very similar. Even the simplest loss-based method [38] (with the query count of 1) also yields satisfactory results compared with other high query count methods. Therefore, emphasize the effectiveness differences among various membership inference methods.
emphasize: This unrealistic over-trane ever-training setting fails adequately reflect
Real-world training setting (fine-tuning). In Tab. 2, we adjust the training steps simulating real- word training scenario [24] and utilize default data augmentation [25]. The best value ASR and AUC of baseline methods decreases to around 65% and the best value of TPR @ %%PR decreases to around 5%, indicating insufficient effectiveness of previous member inference methods in real-world training scenarios of eext-to-image diffusion models. In contrast, our methods maintain ASR above 86% and AUC above 93%, exceeding the best baseline values by about 30%. The TPR 1%FPR of methods exceeds the best bascline values by 50%-60%. The results demonstrate the effectiveness of our methods across various data distributions and scales in real-world training scenarios.
Pretraining setting. For the pretraining setting, we adopt stringent and realistic membership inference setting based on previous works [13, 16). (1) ensure the distribution consistency between the member and hold-out set, respectively select 2500 samples from the LAION-Aesthetie v2 5+ and LAION-2B Multaaranllated [51] as member/hold-out set following [16]: (2) We filter out samples containing non-Engle English characters to ensure there are other "distinguishable tails" [13] in

---

LAION
CLiDA
Method
Query
SecMI
ASR
AUC
T I&FPR
PRAMI
Loss
51.78
50.90
50-
52.13
$2.42
PIA
M.
53.18
53.96
1.25
3
80
SecM1
57.43
58.59
2.45
12
AUC
PFAMI
59.08
61.11
1.45
20
70
CLiDas
67.82
5.01
Table 3: The performance of membership inference methods Stable Diffusion vl- [47] in pretraining setting. We utilize the processed LAION dataset ensure the dis- tribution consistency between member / hold- sets [13, 16]. The best results high- lighted in bold.
50
25K
100K
125K
Training iterations
Figure Effectiveness trajectory on various train-
ing steps.
the ' We conduct membership inference Stable Diffusion v1-5 [46]. As shown in Tab. 3, our method consistently outperforms the baselines across all three metrics.
4.3 Performance on Various Training Steps
From Tab. and Tab. find that the training steps greatly influence the effectiveness of member- ship inference. All membership inference methods tend to exhibit satisfactory performance when the model is trained for excessive number of steps that conflicts with real-world scenarios. Therefore, we emphasize that the effectiveness trajectory of membership inference across varying training steps should also be utilized evaluate different methods. Better membership inference methods should reveal membership information carlier as training progresses.
To explore this, fine-tune Stable Diffusion models with the MS-COCO dataset for varying training steps under real-world training setting and report the AUC values of different membership inference methods in Fig. It can be observed that as the training progresses, CLiDa,, exhibits significantly faster increase in effectiveness trajectory. By 25, 000 steps, CLiDaa effectively exposes membership information, whereas other baselines achieve similar results only around 150, 000 steps. This demonstrates that our method can effectively reveal membership information when the overfitting degree of the text-to-image diffusion model is much weaker.
4.4 Ablation Study
To conduct an ablation study, we vary the Monte Carlo sampling count in Eq. (14) and Eq. (15), per- form CLiD,, with MS-COCO dataset under real- world training setting and report the AUC values Fig. 3. To further compare the effects of Eq. (14) and Eq. (15), we discard each term in Eq. (16) and denote it as M/N M/N- O. We also include the result of the best baseline, SecMI [15], as a comparison.
100
0.8
True Positive Rate
ac
M-1,N-0
AUC-0.619
AUC-0.619
SecMI
(Q-12) AUC-0.654
84
M-0,N-1 (Q-4) AUC-0.923
Effect of Dx.c.e-. In Fig. 3, results of "M=1, N=0" and "M=1, N=1" show significant improvement of membership inference by including Dx.c.e-. Results of "M=5, N=0" and "M=1, N=1" further show that the method utilizing Dx.c.e- performs much better under the same sampling numbers. Additionally, the results of "M=0, N=1" and "M=1, N=1" indicates that only considering both Eq. (14) and Eq. (15) achieves the optimal performance.
M-1,N-1 AUC=0.929
M-3,N-3 (Q-15) AUC-0.961
M-5 (Q-20) AUC-0.944
M-7, (0-35) AUC-0.967
0
False Positive Rate
Figure 3: Performance of CLiD and SecMI under various Monte Carlo sampling num- bers (i.e., query count). The legend labels sorted in ascending order by AUC values.
Das et al. [13] indicates that MultiTranslated-LA.. LAION dataset contains fewer non- EongEnglihh characters than the LAION dataset due the use of the translation model.

---

Table 4: The performance of different methods under no augmentation and default augmentation.
No Augmentation
Defaut Augmentation
Method
ASR
AUC
TPR@ I&FP
ASR (A)
AUC (A)
T 1%FPR (A)
Loss
66.54
72.73
7.72
56.28 (-10.26)
61.89 (-10.84)
1.92 (-5.80)
PIAT
56.56
59.28
2.00
54.10 (-2.46)
55.52 (-3.76)
1.76 (-0.24)
SecMI
72.02
81.07
13.72
60.94 (-11.08)
65.40 (-15.08)
3.92 (-9.80)
PFAMI
79.20
87.05
18.44
57.36 (-21.84)
60.39 (-26.66)
2.72 (-15.72)
CLiDas 96.76
99.47
91.72
88.88 (-7.88)
96.13 (-3.34)
67.52 (-24.20)*
We omit discussion of PIA as shows no effectiveness at this training steps, with the metries consistently approximating random guessing.
The @ I&PR value changes significantly here because ROC curve is very sharp when FPR close to
Monte Carlo sampling numbers. In Fig. 3, we observe that when setting M = N, the performance improves as the number of Monte Carlo sampling increases. And the performance is improved slightly when N > 3. Hence, we set M, N = 3 to ensure the balance between a low query count and satisfied performance. Moreover, the experiment results of "M=1, N=1" and "SecMI" also demonstrate: CLiDa, outperforms previous works even with a much fewer query count.
4.5 Resistance to Defense
Since data augmentation is commonly used in train- ing and can mitigate the effectiveness of membership inference [15], we use it evaluate the performance of methods under defense. As the baseline methods already exhibit weak performance under real-world training setting, we opt not to incorporate additional data augmentation. Instead, we remove the default data augmentation from training scripts [25] to ob- serve the effectiveness change of different methods. We fine-ture tune Stable Diffusion models for 50,000 steps with MS-COCO, report the metries, and calculate the metrics changes in Tab. 4. We observe that the effectiveness of all membership inference methods declines after data augmentation is introduced during training. Note that PFAMI [17] exhibits the highest sensitivity to data augmentation since it infers membership by probability fluctuation after images are perturbed, which also explains its significant performance decline between Tab. and Tab. 2. Compared to the baselines, our method exhibits the smallest decrease, which indicates its stronger resistance to data augmentation.
Table 5: Effectiveness of CLiDAA in adap- tive defense. We calculate the FID [20] with 10, 000 unseen MS-COCO samples to assess the model utility.
CLiDa, MS-COCO
Defense
FID 4/A
ASR AUC TPR@1% PPR@ISPPR
None
88.88 96.13
67.52
13.17
Reph
85.32 93.83
55.67
13.58 +0.41
Del-1
86.40
93.59
59.52
13.18/ -0.01
Del-3
83.91 91.52
52.03
12.92/ -0.25
Shuffle
65.89 67.37
0.15
18.26 / +5.09*
Compared to other methods, the increase in FID caused by shuffling unacceptable for generative models.
We further consider adaptive defense: assuming the trainers are aware of our methods and perturb the text of image-text datasets before training. We consider the following adaptive defense methods: (1) rephrasing the original texts, (2) randomly deleting 10%, 30% words in text, and (3) shuffling 50% of the image-text mappings in the dataset. In Tab. 5, we observe that except for shuffling, the other adaptive defense methods have almost no effect CLiD And shuffling damages the model utility (too high FID values), rendering this defense meaningless.
Adaptive defense.
4.6 Weaker Assumption
Although in Sec. 3.1 we assume that the adversary can access the entire image-text pairs based on the real-world data usage auditing scenario, we also consider a weaker assumption: the adversary can only access the image without the corresponding text.
In this scenario, we first generate pseudo-text corresponding the images using an image captioning model (BLIP [34] in our experiments), and then conduct CLiD-MI based on the image-pseudo, text pairs. In Tab. 6, we observe that our method still broadly outperforms baselines. We believe this is because the pseudo-text preserves the image's key semantics, keeping our methods effective.
"We utilize ChatGPT-3.5 with the following prompt: "Please rewrite the following sentences while keeping the key semantics."

---

Table 6: Results without access to the corresponding text under Over-training setting and Real-world training setting. We fine-tune MS-COCO on SDv1-4, Key results are highlighted as Tab. 1.
Over-training (Pscudo-Text)
Real-world training (Pseudo-Tex))
Method
Query
ASR
AUC
TPR 1%FPR
ASR
AUC
TPR @ 1%FPR
Loss
73.80
81.01
9.71
56.08
58.47
1.60
1
PIA
61.40
65.75
1.20
53.44
54.38
1.52
2
M.
74.36
81.55
11.28
56.68
60.00
1.28
SecMI
82.04
88.97
40.80
60.48
64.04
3.28
12
PFAMI
91.56
95.16
68.16
58.12
59.77
2.64
20
CLiDaa
92.84
95.43
72.36
76.16
83.27
19.76
15
CLiDvee
93.26
96.59
71.73
77.76
84.48
18.06
15
Related Works
Copyright protection in text-to-image synthesis. To protect the copyright of text-to-image models, several works [67, 68] propose inserting backdoors to embed watermarks in text-to-image models. To protect the copyright of image-text datasets, some works [50, 52, 69] incorporate imperceptible perturbations render the released datasets unusable. Other works [12, 56] utilize the backdoor or watermark to track the usage of image-text datasets. In contrast, our method indicates the possibility of auditing the unauthorized usage of individual image-text data points utilizing membership inference.
Membership inference on diffusion models. In the grey-box or white-box setting, Carlini al. [5] firstly conduct membership inference on unconditional diffusion models by conducting LiRA (Likelihood Ratio Attack) [4], with the requirement of training multiple shadow models. Matsumoto et al. [38] make the first step by utilizing diffusion loss to conduct query-based membership inference. Some works [15, 28] leverage the DDIM [54] deterministic forward process [27] to access the posterior estimation errors of diffusion models. And Fu et al. [17] leverage the probability fluctuations by perturbing image samples. Few works consider the black-box settings [41, 62]. However, these studies either assume partial knowledge of member set data [62] or assume extensive fine-tuning steps [41] (100 ~ 500 epochs), both of which do not align with real-world scenarios.
Memorization detection in text-to-image models. A similar work [59] detects token memorization by inspecting the magnitude of text-conditional predictions, but differs from ours by lacking in in-depth rationale analysis and rigorous membership inference setup with randomly selected member/hold- out sets.
Conclusion
In this paper, identify the phenomenon of conditional overfitting in text-to-image models and propose CLiD-MI, the membership inference framework on text-to-image diffusion models utilizing the derived indicator, conditional likelihood discrepancy. Experimental results demonstrate the superiority of our method and its resistance against early stopping and data augmentation. Our method aims to inspire
direction for the community regarding unauthorized usage auditing.
Limitations: Due to the limited availability of open-source text-to-image diffusion models, eval- uations under the pretraining setting are not sufficient. Considering fine-tuning setting involves multi step/image ratio, we acknowledge that the superiority CLiD-MI over the baselines in the pretraining setting is not as evident compared to fine-tuning setting. We emphasize experiments under pretraining setting (Tab. 3) reveal the hallucination success existing works and encourage future research to focus this more challenging and practical scenario.
Acknowledgments
We thank anonymous reviewers for their valuable feedback. In addition, we thank Xin Zhang for his editorial comments. This work is supported by the National Key R&D Program of China NNo.2022YFB2703301 NSFC Projects (Nos. 92370124, 62076147). Dong is also supported by the China National Postdoctoral Program for Innovative Talents and Shuimu Tsinghua Scholar Program.
10

---

References
[1] Fan Bao, Shen Nie. Kaiwen Xue, Chongxuan Li, Shi Pu, Yaole Wang, Gang Yue, Yue Cao. Hang Su, and Jun Zhu. One transformer fits distributions multi-modal diffusion scale, International Conference on Machine Learning, pages 1692-1717. PMLR, 2023.
[2] BBC. "Art is dead Dude" the rise of the Al artists stirs debate. 2022. URL http:://// www.ww.bbbccc...... nows/technology- 2ot.rmmooloyyy6788275...
[3] BIGWILLY. Hear of Apple XL, 2024.
heart-of-a ofert-of-applee pappleex--looe
[4] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897-1914, IEEE, 2022.
[5] Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthe Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pages 3253-5270 2023.
[6] Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of membership inference attacks against generative models. In Proceedings of the 2020 ACM SIGSAC conference computer and communications security, pages 343-362, 2020.
[7] Huanran Chen, Yinpeng Dong, Zhengyi Wang, Xiao Yang. Chenggi Duan, Hang Su, and Jun Zhu. Robust classification via a single diffusion model. arXiv preprint arXiv:2305. 15241, 2023.
[8] Huanran Chen, Yinpeng Dong, Shitong Shao, Zhongkai Hao, Xiao Yang. Hang Su, and Jun Zhu. Your diffusion model is secretly a certifiably robust classifier. arXiv preprint arXiv:2402.023116 2024.
[9] Tianqi Chen and Carlos Guestrin. Xgboost: scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, pages 785-794, 2016.
[10] CNN. Al won an art contest, and artists are furious. 2022. RRl.https:///nn cnn. com wttpmm//////////////// tech/as art- --r--rrt-fi---- seiir-winner--re cot.eeerrrotttoorreeeeeeeaeeeeee wa/eerrr//////eeeeeeeeeeeeee html.
[11] Comp stable-diffusion-v...
Stable-Diffusion-v--
2024.
URL https://hugginggtt co/ compom/iss/
[12] Yinggian Cui, Jie Ren, Yuping Lin, Han Xu, Pengfei He, Yue Xing, Wenqi Fan, Hui Liu, and Jiliang Tang. Ft-shield: A watermark against unauthorized fine-tuning in text-to-image diffusion models. arXiv preprint arXiv:2310.02401, 2023.
[13] Debeshee Das, Jie Zhang, and Florian Tramèr. Blind baselines beat membership inference attacks for foundation models. arXiv preprint arXiv:2406. 16201, 2024.
[14] Daniel DeAlcala, Aythami Morales, Gonzalo Mancera, Julian Fierrez, Ruben Tolosana, and Javier Ortega- Garcia. Is my data in your ai model? membership inference test with application to face images. arXiv preprint arXiv:2402.0900 09225, 2024.
[15] Jinhao Duan, Fei Kong. Shiqi Wang, Xiaoshuang Shi, and Kaidi Xu. Are diffusion models vulnerable to membership inference attacks? International Conference on Machine Learning, pages 8717-8730. PMLR, 2023.
[16] Jan Dubiáski, Antoni Kowalezuk, Stanislaw Pawlak, Przemyslaw Rokita, Tomasz Trzciński, and Pawel Morawiecki. Towards more realistic membership inference attacks on large diffusion models. In Pro- ceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 4860-4869, 2024.
[17] Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. A probabilistic fluctuation based memhership inference attack for generative models. arXiv preprint arXiv:2308. 12/43, 2023.
[18] Juliana Neelbauer an Intellectual Property Problem. generative-o ai- has an- intellectual-pereeeeeeeeee propuaatlyprprtttyyooo probrr...
Appel and David Schweidel. URL http:://bbb..rrg/0223///
Generative Al Has
2023.
[19] Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. Logan: Membership inference attacks against generative models. Proceedings on Privacy Enhancing Technologies, 2019.
11

---

[20] Martin Heusel. Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by time-scale update rule converge a local nash equilibrium. Advances neural information processing systems, 30, 2017.
[21] Jonathan Ho and Tim Salimans. Classifier- diffusion guidance. arXiv preprint arXiv:2207.12598. 2022.
[22] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.
[23] Emiel Hoogeboom, Jonathan Heek, and Tim Salimans. simple diffusion: End-to-end diffusion for high resolution images. International Conference on Machine Learning, pages 13213-13232. PMLR, 2023.
[24] Huggingface. The training script of stable-difiusion, 2024. URL https: / www.ggggggggg...o..ooogggo htt.uggiingacc.cc/occaaa aunch- scr-script. Accessed: May 22, 2024.
[25] Huggingface.
The python code of fine-tuning stable-diffusion, 2024. https: / github......... com/ huggingface/difffueeeee /aalo//maan///////
[26] Jinhaoduan. Seemi, 2023. htt.a/////s.il....iioooo///////r secmia.py.
[27] Gwanghyun Kim, Taesung Kwon, and Jong Chul Ye. Diffusionclip: Text-guided diffusion models for robust image manipulation. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2426-2435, 2022.
[28] Fei Kong, Jinhao Duan, RuiPeng Ma, Heng Tao Shen, Xiaofeng Zhu, Xiaoshuang Shi, and Kaidi Xu. An efficient membership inference attack for the diffusion model by proximal initialization. In The Twelfth International Conference on Leurning Representations, 2024. 2024.
[29] Kong13661. Pia, 2023. URL https: / wttp:/cowt/occc////////o
[30] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[31] DeepFloyd Lab. Deepfloyd
wwt.//////eeeeeeeo floyd/eee 2023.
[32] Lambda. Pokemmon-blip-captionn. 2023. URL http:p///uuggnnaaaecccaaatttttta
pokemon- blip- captions.
[33] Alexander C Li, Mihir Prabhudesai, Shivam Duggal, Ellis Brown, and Deepak Pathak. Your diffusion model is secretly zero-shot classifier. Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2206-2217, 2022.
[34] Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre- pre-training for unified pages 12888-18 12900. PMLR, 2022.
understanding and generation. In International conference on machine learning.
[35] Tsung-Yr Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision ECCV 2014: 13th European Conference, Zurich, Swirzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[36] Kin Sum Liu, Chaowei Xiao, Bo Li, and Jie Gao. Performing co-membership attacks against deep generative models. In 2019 IEEE International Conference Data Mining (ICDM), pages 459-467, JEEE, 2019.
[37] David Lopez-Pat Paz and Maxime Oquab. arXiv:1620.06545. 2016.
Revisiting classifier two-sample tests.
arXiv preprint
[38] Tomoya Matsumoto, Takayuki Miura, and Naoto Yanai. Membership inference attacks against diffusion models. In 2023 IEEE Security and Privacy Workshops (SPW), pages 77-83. JEEE, 2023.
[39] Yuantian Miao, Minhui Xue. Chao Chen, Lei Pan, Jun Zhang, Benjamin Zi Hao Zhao. Dali Kaafar, and Yang Xiang. The audio auditor: User-level membership inference in internet of things voice services. Proceedings on Privacy Enhancing Technologies, 2021.
[40] Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprint 10741 2021.
12

---

[41] Yan Pang and Tianhao Wang. Black-box membership inference attacks against fine-tuned diffusion models. arXiv preprint arXiv:2312.08207, 2023. 2023.
[42] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint xr11:22077.11952 2023.
[43] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint 2rXi::2204.06125, 1(2):, 2022.
[44] Reuters. 2023.
misusing copyrighted https: //ww:///wwwwwaa rewters wtaaalaaarbaaaattionlll work- lawsuits- accuse-ai- contenteett-oo www.ennt-creatoos--tttetee- creators-misusing copyrighted work Beerk-20233-00 0023-01-17/.
Lawsuits
accuse
Al
content creators
work.
URL
[45] Reuters. tos
Getty ai.
images
lawsuit
says
stability
ai misused pho-
train getty-inagea--avenee www.-aaat-taaa-taaata---------e-
2023.
rewters.ww.u.......e.. comleegal/ -ww.:aaaa-ee.tttt----------aaa-- 200.--a02002002--0
URL
[46] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[47] Runwayml. s stable-diffusion v1-5.
Sibbl--iffuusion-1155
2024.
URL https///bugggnff.c..o//rux
[48] Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. White-box vs black-box: Bayes optimal strategies for membership inference. In International Conference on Machine Learning, pages 5558-5567. PMLR, 2019.
[49] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily I. Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, al. Photorealistic text-to- image diffusion models with deep language understanding. Advances neural information processing systems, 35:36479-36494, 2022.
[50] Hadi Salman, Alaa Khaddaj, Guillaume Leclere, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. International Conference on Machine Learning, pages 29894-29918. 88. PMIR,, 2023.
[51] Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. arXiv preprint arXiv:2210.08400, 2022.
[52] Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y 7hao. Glaze: Protecting artists from style mimiery by (Text-to-mmage) models. In 32nd USENIX Security Symposium (USENIX Security 23). pages 2187-2204, 2023.
[53] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3-18. IEEF, 2017.
[54] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2020.
[55] Raphael Tang, Linging Liu, Akshat Pandey, Zhiying Jiang, Gefei Yang, Karun Kumar, Pontus Stenetorp, Jimmy Lin, and Ferhan Türe. What the daam: Interpreting stable diffuusio using cross attention. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume I: Long 2023.
Pupers), pages
[56] Zhenting Wang, Chen Chen, Lingjuan Lyu, Dimitris N Metaxas, and Shiqing Ma. Diagnosis: Detecting unauthorized data usages in text-to-image diffusion models. In The Twelfth International Conference on Learning Representations, 2023.
[57] Zhijic Wang, Yuheng Huang, Da Song, Lei Ma, and Tianyi Zhang. Promptcharm: Text-to-image generation through multi-modal prompting and refinement. arXiv preprint arXiv:2403.04014 2024.
[58] WashingtonPost.
He made a children's book using AL. Then came the rage. URL http:////wwweeeeaaaatttaoooooot
http://///eeeeeeeoooo/////////// ai childrens- book wwwttoversyycooooooooo mide ourney/.
2022.
13

---

[59] Yuxin Wen, Yuchen Liu, Chen Chen, and Lingjuan Lyu. Detecting, explaining, and mitigating memorization in diffusion models. In The Twelfth International Conference on Learning Representations, 2024.
[60] Jonathan
CL.0OB-Codditioned Latent Diffu- https://jolmowhittaer dev/dsc/ 2022-04- wwwe-innttteetee finn-tuning-----. a condiiiendd wwweeiioneeddd--d--e--eeeeee html.
Whitaker. Model
Fine-tuning
sion
WikiArt, 2024.
on- -n--wiiart..
[61] WikiArt. WikiArt. 2024, URL https: http:::///wwwwwaattt...... wikiart. org/.
[62] Yixin Wu, Ning Yu, Zheng Li, Michael Backes, and Yang Zhang. Membership inference attacks against text-to-image generation models. arXiv preprint arXiv:2210.00668 2022.
[63] Qiantong Xu, Gao Huang, Yang Yuan, Chuan Guo, Yu Sun, Felix Wu, and Kilian Weinberger. An empirical study on evaluation metries of generative adversarial networks. arXiv preprint arXiv:1806.077:: 2018.
[64] Ying Yeh, Yu-Guan Hsich, Zhidong Gao, Bernard BW Yang. Giyeong Oh, and Yanmin Gong- Navigating text-to-image customization: From lycoris fine-tuning to model evaluation. The Twelfth International Conference on Learning Representations, 2023.
[65] Samuel Yeom. Irene Giacomelli, Matt Fredrikson. and Somesh Jha. Privacy risk machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pages 268-282. IEEE, 2018.
[66] Peter Young, Alice Lai, Micah Hodosh, and Julia Hockenmaier. From image descriptions to visual denotations: New similarity metrics for semantic inference over event descriptions. Transactions of the Association for Computational Linguistics, 2867-78. 2014.
[67] Shengfang Zhai, Yimpeng Dong, Qingni Shen, Shi Pu, Yuejian Fang, and Hang Su. Text-to-image diffussin models can be casily backdoored through multimodal data poisoning. In Proceedings of the 31st ACM International Conference on Multimedia, pages
2023.
[68] Yunqing Zhao, Tianyu Pang. Chao Du Xiao Yang, Man Cheung, and Min Lin. recipe for watermarking diffuusio models. arXiv preprint arXiv:2303.1013 10137, 2023.
[69] Zhengyue Zhao, Jinhao Duan, Xing Hu, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du Qi Guo, and Yunji Chen. Unlearnable examples diffusion models: Protect data from unauthorized exploitation. arXiv preprint arXiv:2306.01 2023.
14

---

A Validation of Assumption 3.1
11idd ost
750
Hete our
122
250
35
10
Na
Strie
341
Rd Disorponcy
Discrpaacy
Tlild-ost
Noldvart
Helifoor
Boldent
1000
MANI
LID
630
En
610
301
25
Figure A.1: Metric values and the metric differences synthetic images, with the same setting as Sec. 3.2.
To extensively validate the effectiveness of Assumption 3.1, we utilize additional metries as
distances metric D in Eq. (8), including Wasserstein Distance [63], Kernel MMD (Maximum Mean Discrepancy) [63] and 1-Nearest Neighbor Classifier (I-NN) [37], in addition to FID [20]. As observed in Fig. A.I, regardless of the metric used for D, Assumption 3.1 consistently holds, thereby confirming the broad applicability Conditional Overfitting phenomenon.
B Proof of Theorem 3.2
Proof. Eq. (8) is equivalent to:
Bel D(gout (x(c), p(x[))] (gm (x), p(x)) BBe (Da[D((mmn ((mmm (x c), p(x c))] D(gmem (x), p(x)).
(B.1)
Given that both the member set and the hold-out set are mixtures of Dirac distributions:
(xx)
Σ 8(x-xx xi),
(B.2)
D
x.EDaet
where Dser denotes the set of images in the corresponding dataset. We can derive the analytical form for the Kullback-Leibler (KL) KL divergence when using DEL as the distance metric:
Dxi(g(x),p(x) = / x(x) log ((x)
dx
(xx)
/ Dset
Σ
- -(x logp(x)dr H(g(x))
xiEDoct
8(x xx) dx (B.3)
Σ
DDee
x,E
Σ
logp(x.) + (g(x)).
|Dsex Dret
where is the entropy functional. Therefore, we have:
Ee [ (xx))
-Dxx((()),p())
Σ [log((((c) logp(x)) [e[H[((())c)) (((x))),
(B.4)
Daeel D.etD.et
15

---

where Deet is the corresponding dataset (member set or hold-out set). Substituting Eq. (B.4) into Eq. (B.1), we can get:
Σ
p(x(c) - log p(x)) + E. (Hou (x|c)) (9out (x))
Doul
x,CE Dout
(B.5)
2
logp(x/c) - -oacce--ooppppp p(x) + Be (Amem xxc]]]] H (9mom (x)).
D mom!
x,0E Duon
Eq. (B.5) is equivalent to:
E Ei (x.c)) (x.e) p(g]((())) logp(x)) + Be (9ou (9ou (x [x)c]]]]]]]]]]]]] H (gout (x))
(B.6)
E (x) logr(x)] E.|H (1mem (fmem (x|c)] H (ymem (x))
Finally, we can get:
E (x (x Dog log p(x)) 2 E (xx logp(x)) + 6н
(B.7)
where
5н (gou (x)) + E.l (Amem (Xmem(x(())) (1mem - E. (Hour (Xour(((())) (x/c))].
(B.8)
C Metrics Discussion of Sec. 3.3
In the derivation of Sec. 3.3, also consider other metrics besides KL divergence. The results show that KL divergence yields the most easily computable analytical form. For instance, we briefly discuss
(JS) divergence as follows:
Recall the expression for Jensen-Shannon divergence:
1 2 5(1 p)) + DKL(P, (q
Dıs(g.p) = Dxr(q.
(C.1)
The first parameter of the KL. divergence should be a simple distribution that is easy to compute; otherwise, deriving the analytical form for such divergence is typically difficult. In Eq (8), JS divergence cannot be efficiently computed because it includes DKL (p. [. + where p denotes the model distribution. It needs to the Monte Carlo method, which involves sampling images from both and to make an approximation. As result, this process is extremely time-consuning.
D Experiment Details
D.1 Monte Carlo Sampling
In our method, the key to accurate membership inference lies in estimating ELBO with fewer sampling steps for better precision. To achieve this, firstly, we reduce the number of Monte Carlo samples by directly estimating the ELBO difference (Eq. (13)). Secondly, recalling Monte Carlo sampling using (li, <;) pairs with ~ (O, I) and I; ~ [1, 1000), we explore the effect of the sampling time t, We conduct single Monte Carlo sampling test using MS-COCO on real-word training setting and report the AUC values in Fig. D.I.
In Fig. D. we observe that the single Monte Carlo estimation achieves optimal accuracy when E [400, 500). Similar results are shown in [33]. Therefore, consistent with [33], we sample at intervals of 10 centered around the timestep 450. our experiments, M,, in Eq (14) are both uniformly set to 3 (i.e., the estimation number is 3), and we use the time list of [400, 450, 460), resulting
Note that [5, 15] indicate that for DDPM of Cifar- [30], the best estimation timestep is around 100. This difference may arise from the different signal-to-noise ratios of images with various resolution [23]. This finding suggests that the Monte Carlo sampling timestep should be designed differently for diffusion models of different scales.
query count
16

---

0.00
0.00
AUC
0.58
0.50
0.54
100
300
500
600
500
900
.000
Sampling
Figure D.I: Effectiveness of single Monte Carlo estimation of various timesteps. Small t, corresponds less noise added, and large t; corresponds significant noise. AUC value is highest when the timestep is around 450.
Table D.1: The membership inference performance with different reduction methods. "Null" denotes employing null text solely to compute Eq. (14) without reduction methods.
CLiD MS-COCO
Reduction Methods
Query
ASR
AUC
TPR@ I%FPR
Null (K=1)
85.10
93.60
42.96
Simply Clipping (K=4)
88.02
95.90
66.53
15
Gaussian Noise (K=4)
86.58
94.79
56.78
Importance Clipping (K=4)
88.88
96.13
67.52
15
D.2 Reduction Methods
In implementation, actually diversely reduce the condition c* and calculate po px(x(c") to approximate (x). this part, we evaluate the effectiveness different reduction methods. We consider three methods in Sec. 3.5: (1) Simply Clipping. We simply use the first, middle, and last thirds of the sentences as text inputs. (2) Gaussian Noise. We add Gaussian noises with the scales of 50%, 70%, 90% to the overall text embeddings.
(3) Importance Clipping. We calculate the importance of words in the text [55, 57] and replace them with "pad" tokens in descending order by varying proportions of 30%, 50%, 70%. For all three methods, additionally the null text c". The experiments are conducted on the real-world training setting with MS-COCO dataset. And we also employ null text solely compute Eq. (14) without reduction methods for comparison.
In Tab. D.1, we observe that Importance Clipping achieves the best results due to its more deterministic reduction. So adopt it the reduction method used in our experiments. Additionally, we note that all three reduction methods exhibit satisfactory results, demonstrating the general applicability of method. Comparing the results without the usage of reduction methods, the results validate the effectiveness of reduction methods in Sec. 3.5.
E
Compute Overhead and Resources
Computational Overhead. As a query-based member inference method, the computational efficiency of our method primarily depends the number of queries. A lower query count signifies more efficient member inference method. Our method significantly outperforms the baselines when the query count about the same (such as SecMI and PFAMI in Sec. 4.2). Furthermore, even with much lower query count such as M N, = 1(Q = 5) (Fig. 3), our method exhibits noticeable improvement compared to the basclines.
Our experiments are divided into two main parts: training (fine-tuning) and inference, both conducted on a single RTX A6000 GPU. The time of execution in the training phase depends on the training steps. For example, we perform 7, 500, 50, 000, and 200, 000 steps for Pokemon [32], MS-COCO [35] and Flickr [66] dataset, which take about hours, 12 hours, and 48
Compute Resources.
'https://gitaan http////ittiu.cooaaaaaaaaaa com/ma- wanmmaa-aaoo/Pronpthherrr
17

---

hours, respectively. The time of execution in inference time depends on the methods' query count. For example, with the query count of 15, our membership inference method on dataset of size 2500/2200 takes approximately 80 minutes per run for all data points. Typpiclly, we perform this inference once on the shadow model and once on the target model, resulting in total time cost of 160 minutes.
F
Ethics Statements
Although the current threat models for membership inference methods include privacy attack scenarios and data auditing scenarios, emphasize that for text-to-image diffusion models, the potential application membership inference lies more in unauthorized data usage auditing than data privacy leakage. This is because most training data is obtained by scraping open-source image- text pairs, which are more likely to pose copyright threats rather than privacy violations. So we emphasize that our method make positive societal impact for inspiring unauthorized usage auditing technologies of text-image datasets in the community.
18

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: In the abstract and introduction, we state that focus the membership inference on text-to-image diffusion models in the scenario of auditing unauthorized usage.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: See Sec. 6
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model sell-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
19

---

Justification:
Our Assumption is provided in Sec. 3.2. The Proof is provided in Appendix B.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proof' can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification:
We provide all the implementation details and the hyper-parameterr We also provide the code. All the models and utilized datasets are open-soured which make it easy to reproduce.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
20

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes)
Justification: All the models and utilized datasets are open-soured in this paper. And we provide the code in supplemental material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips cc/
Beaili//guides/Coeeuubbbae soo.bmiisssoooicccc for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed run reproduce the results. See the NeurlPS code and data submission guidelines (https: /nips. ctips.cc/public/ guides /CodeSubmii ssi wwwssssosslssooeeeeessoo onnolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: See Sec. 4.1. When training models, we utilize the open-sourced official training scripts by Huggingface with the default hyperparameters, type of optimizer, etc.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: In main experiments, due the high computational cost of repeatedly fine-tuning diffusion models, we fine-tune only once under different settings for the MS-
COCO and Flickr datasets and then evaluate various member inference methods. Given the large dataset sizes, the variance between multiple runs is minimal, and even single-run training introduces negligible errors, thereby reducing carbon emissions. For the smaller Pokemon dataset, we conducted experiments three times and reported the average results in Tab. 1 and Tab. 2
Guidelines:
The answer NA means that the paper does not include experiments.
21

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We provide extensive discussion in Appendix E.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https //terr///......//eeeee cc hpppllc//tticsuuuiiiitee
Answer: [Yes]
Justification: See Appendix
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: See Appendix F.
Guidelines:
22

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (c.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate point that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e-g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: We utilize only open-source models and datasets. Additionally, the current text-to-image diffusion models are also trained on open-source datasets. Therefore, our method is solely applicable for detecting unauthorized dataset usage and does not pose a high risk for misuse.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (c.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We correctly cite the utilized models and datasets in the paper.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
23

---

The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
24

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
25


Reviews:
[{"review_id": "qM00tFHml1", "reviewer": "Reviewer_meQ8", "summary": "The paper addresses potential unauthorized data usage and the privacy concerns in text-to-image diffusion models. The authors introduce a novel membership inference method, Conditional Likelihood Discrepancy (CLiD), which leverages the identified phenomenon of conditional overfitting in these models. They propose two practical membership inference methods, CLiD_th and CLiD_vec, which indicate membership by measuring the KL divergence between conditional distribution of image-text pairs and the distribution of images. The results shows superior performance of their methods compared to existing baselines, particularly in real-world training scenarios with common data augmentation techniques. Also, their method shows robustness to overfitting mitigation strategies like early stopping and adaptive defenses. Their experiments across multiple datasets validate the effectiveness and robustness of CLiD in detecting training data in text-to-image diffusion models.", "questions": "1. What is the main difference between CLiD_th and CLiD_vec methods in terms of accuracy and effectiveness? Is one preferred over the other in general, or in specific settings? Why some tables and figures do not show CLiD_vec results?\n\n2. What is the benefit in evaluating the overfitting scenario? Ideally, shouldn't the evaluation setting be as close as possible to the real world scenarios?\n\n3. How do these methods compare to existing membership inference methods in terms of computational complexity and runtime?", "limitations": "Yes.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Conditional Likelihood Discrepancy is a novel method for membership inference on text-to-image diffusion models is a significant contribution which significantly outperforms existing methods.\n\n2. For the empirical validation of assumption 3.1, authors provide thorough results using various metrics such as FID, Wasserstein Distance, Kernel MMD, and 1-NN.\n\n3. Experimental results show that CLiD_th and CLiD_vec methods significantly outperform existing baselines in terms of ASR, AUC, and TPR@1%FPR. This includes various training scenarios with data augmentation, highlighting the robustness and effectiveness of their approach.\n\n4. By focusing on a foundation text-to-image diffusion model like SD which is widely used in practice, the paper addresses a timely and relevant problem of data privacy and unauthorized usage in a practical context.", "weaknesses": "1. Since the theoretical results depend on assumption 3.1, I believe that validating this assumption on other dataset domains is important. Would you observe the same phenomenon if you test on domain specific datasets, such as Faces (CelebA, FFHQ, ...).\n\n2. Authors do not present empirical results on the benchmark that previous papers have test on, such as CelebA, Tiny ImageNet, and CIFAR datasets.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for appreciating the novelty and the effectiveness of our work as well as providing valuable feedback. Below we address the detailed comments and hope that you may find our response satisfactory. (**Refer to the submitted PDF for Tab. E and Fig. B**)\n## Weakness (1):\nThe concern about assumption validation in domain-specific datasets.\n## Answer (1):\n\nThank you for your suggestion. This assumption arises from the overfitting of text-to-image diffusion model to the conditional distribution, so **this phenomenon is widely present in image-text datasets, including domain-specific datasets.**\n \nFirst, the Pokemon dataset we used is an open-source dataset containing images of Pokemon characters [1]. Due to its distinct style compared to MS-COCO and Flickr, **Pokemon dataset can be considered as a domain-specific dataset**. Our experimental results (Tab. 1 and Tab. 2) show that our method is effective on this domain-specific dataset. \n\nSecond, **we further conduct extra experiments to show that the assumption holds in other domain-specific datasets such as Face (Fig. B)**. The MMCelebA dataset [2] is a multimodal facial dataset that includes faces and corresponding text descriptions. We repeat the experiments in Sec. 3.2 and Appendix 1. The results show that the distribution distance between the member set and the hold-out set is consistently higher than those with truncated conditions, demonstrating the validation of our assumption.\n## Weakness (2):\nThe leak of evaluation on other datasets, such as CIFAR et. al.\n## Answer (2):\n(1) Thank you for your suggestion. Current MI methods mainly focus on unconditioned DMs, which is not suitable for real-world applications. Hence, in this paper, we design a MI method specifically for text-to-image models (conditional DMs). So our method primarily targets image-text data, which is more aligned with real-world scenarios where copyright issues are prevalent.\n\n(2) However, in principle, our method is applicable to class-conditional datasets such as CIFAR-10 as well. **We conduct extra experiments using CIFAR-10 to further validate this (Tab. E).**\n\nWe revised Eq. (14) and Eq. (16) to align with class-conditional DM as follows:\n\n* First, we estimate CLiD between the groundtruth label of each data point and every other label:\n$$\n\\\\mathcal{D}\\_{\\\\mathbf{x},\\\\mathbf{c}\\_{G},\\\\mathbf{c}\\_{i}} = \\\\mathbb{E}\\_{ t, \\\\mathbf{\\\\epsilon}} \\\\left[|| \\\\mathbf{\\\\epsilon}\\_{\\\\theta}( \\\\mathbf{x}\\_t , t, \\\\mathbf{c}\\_{i}) - \\\\epsilon ||^2     -       || \\\\mathbf{\\\\epsilon}\\_{\\\\theta}( \\\\mathbf{x}\\_t    , t, \\\\mathbf{c}\\_{G}) - \\\\epsilon ||^2 \\\\right],\n$$\nwhere $c_G$ refers to the groundtruth label of a data point, and $c_i$ refers to another false label. \n* Then we use threshold-based attack method for final classification:\n$$\n \\\\mathcal{M}\\_{\\\\text{CLiD-Class}\\_{th}}(\\\\mathbf{x},\\\\mathbf{c}\\_{G}) = \\\\mathbf{1} \\\\left[ \\\\alpha \\\\cdot \\\\mathcal{S}(\\\\frac{1}{k} \\\\sum\\_{i, \\\\mathbf{c}\\_{i} \\\\neq \\\\mathbf{c}\\_{G}}^{k}  \\mathcal{D}\\_{\\\\mathbf{x},\\\\mathbf{c}\\_{G},\\\\mathbf{c}\\_{i}}) +  (1-\\\\alpha) \\\\cdot \\\\mathcal{S}(\\\\mathcal{L}\\_{\\\\mathbf{x},\\\\mathbf{c}\\_{G}}) > \\\\tau \\\\right].\n$$\n\nWe use 50,000 CIFAR-10 training data to train a class-conditional DM. We use augment method of RandomFlip to prevent overfitting. In Tab. E, we can observe that with only simple data augmentation, the baseline's performance on the CIFAR-10 dataset shows a decline compared to what was claimed in their paper.  **In contrast, our method shows a clear improvement, indicating its effectiveness on CIFAR-10.**\n## Question (1):\nWhat is the difference between CLIiD_th and CLiD_vec? Why some tables and figures do not show CLiD_vec results?\n## Answer (Q1):\n\nCompared to CLID_th (Eq. (16)), which uses a threshold, CLID_vec (Eq. (18)) employs a simple classifier (we use XGBoost in the paper) to distinguish between the member set and the hold-out set. Since the classifier's objective is accuracy (i.e., ASR), this method typically achieves higher ASR and AUC, but a lower TPR@1% FPR compared to CLID_th (Tab. 1 and Tab. 2). \n\nNevertheless, both methods essentially use CLiD (Eq. (11)) as the MI indicator. Therefore, in further analysis experiments, we only selected one method to save space and computational cost. \n\nIn the updated version, we will include the CLiD_vec results in these tables and figures.\n## Question (2):\nWhat is the benefit of evaluating the overfitting scenario?\n## Answer (Q2):\nYes, we also emphasize that the evaluation setting should align with real-world scenarios (line 258). **We use the over-training setting because it is commonly adopted by previous works such as SecMI, PFAMI.** Our experiments under this setting (Tab. 1) indicate excessive overfitting so that this setting prevents MI methods from being properly evaluated. Therefore, we then develop a real-world training setting and show that our method outperforms baselines in both settings. \n## Question (3):\nThe evaluation of computational complexity and runtime compared with baselines.\n## Answer (Q3):\nSince diffusion model inference is the main computational process in conducting MI, the computational complexity and runtime are proportional to the query count. We provide the query counts for our methods and baselines (Tab. 1, Tab. 2) and a detailed analysis in Appendix E. Our methods outperform the baselines when their query counts are about the same (such as SecMI and PAFMI). Additionally, in Fig. 3, when we set “M=0, N=1” (Q=4), our method achieves a higher AUC of 0.923 than 0.654, the AUC value of SecMI (Q=12). **It shows that even with less computational time, our method still significantly surpasses the baseline.**\n\nWe thank you again for your valuable feedback. We hope our responses above have addressed all your concerns and questions. We are happy to answer any follow-up questions you may have.\n\n[1] https://huggingface.co/datasets/lambdalabs/pokemon-blip-captions\n\n[2] https://github.com/IIGROUP/MM-CelebA-HQ-Dataset", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "b2yCyrxXsg", "reviewer": "Reviewer_iMS8", "summary": "In this paper, the authors propose a novel membership inference attack for text-to-image diffusion models. By examining the discrepancy between the text-conditional predictions and unconditional predictions, the proposed method outperforms the SOTA method by a significant margin. In the end, the authors also show the proposed attack is robust to various defenses.", "questions": "- What happens if an image in the training data is associated with multiple different prompts? For instance, if (image, prompt A) appears 100 times in the training set, while (image, prompt B) appears only 10 times, will the method still be effective for (image, prompt B)?", "limitations": "The authors do include the limitations in the appendix, and I appreciate it.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper is well-written.\n- The method is simple and the motivation behind it is straightforward.\n- The results look very promising. The proposed method outperforms all other methods by a big margin.\n- The authors compare the method to various recent methods.\n- The authors include various adaptive defenses, and the method seems to be very robust.", "weaknesses": "- The paper claims the setting is grey-box, but I feel like it's just a white-box setting since the attacker needs the model weights to perform the loss calculation, and there's no such API in the real world. I feel like the authors should emphasize it, even though previous works claim such a setting is \"grey-box.\"", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your efforts in reviewing our paper and your valuable feedback. We are encouraged by your appreciation on our clear motivation, extensive experiments and promising results, as well as the comprehensive experiment of adaptive defenses and good writing.  Below we address the detailed comments and hope that you may find our response satisfactory. (**Refer to the submitted PDF for Tab. C, Tab. D and Fig. D**)\n\n\n## Weakness (1):\nGrey-box setting is almost equivalent to white-box in real-world scenarios.\n## Answer (1):\nThank you for your suggestion regarding our threat model. We acknowledge that in most cases in real-world scenarios, the \"grey-box\" setting is almost the same as the \"white-box\" setting. Therefore, we discuss them together in Sec. 5 (line 346). We use the term “grey-box” to maintain consistency with previous works [1,2]. \n\nWe will emphasize this issue in the updated version.\n## Question (1):\nThe effectiveness of image-text datasets where a single image corresponds to multiple different texts (including imbalanced text).\n## Answer (Q1):\nThank you for raising this interesting question. **We conduct additional evaluation for both pretraining and fine-tuning training settings to answer this question:**\n\n(1) For pretraining setting, since the original Stable Diffusion is trained by LAION which contains one-to-one image-text pairs, **we use the Stable Diffusion v1-2 [3] architecture to train a simple text-to-image model from scratch on the MS-COCO 2017 train dataset.** \n\nIn the COCO 2017 dataset, each image corresponds to approximately five text descriptions, so we randomly use these descriptions during the training phase. We trained 25,000 steps with a large batch size of 64x4x4 using 4 H100 GPUs in about four days. To prevent overfitting, we used data augmentation during the training stage. We report the evaluation metrics using this model in **Tab. C** and the results show our methods still outperform the baselines across all three metrics. \n\n(2) For fine-tuning setting, **we create an image-text dataset with multiple imbalanced texts using data repetition from the MS-COCO dataset.** Each image corresponds to two text descriptions, with a ratio of 9:1 in the dataset.  All other settings follow the real-world training setting in Sec. 4.1 (50,000 training steps). Thus, (image, promptA) and (image, promptB) appear 18 times and 2 times in the training stage, respectively.\n\nWe report the results in **Tab. D**, which shows that performing MI with less frequent texts is slightly less effective than using more frequent texts. However, our method still demonstrates a significant improvement compared with baselines. We believe the key intuition here is that **although one image corresponds to two different texts, the key semantic information in both texts is always consistent.** Therefore, performing MI with either text yields a certain level of effectiveness.\n\nThank you again for reviewing our paper and your insightful questions. And we appreciate your positive comments on our work. We hope our responses above have addressed all your concerns. Please let us know if any follow-up questions you may have.\n\n[1] Duan, Jinhao, et al. \"Are diffusion models vulnerable to membership inference attacks?.\" International Conference on Machine Learning. PMLR, 2023.\n\n[2] Kong, Fei, et al. \"An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initialization.\" The Twelfth International Conference on Learning Representations.\n\n[3] https://huggingface.co/CompVis/stable-diffusion-v1-2", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HOoVfNMl3R", "reviewer": "Reviewer_gj8y", "summary": "This paper proposes a new MIA metric tailored for text-to-image diffusion models. More precisely, they assume that conditional overfitting is more severe that unconditional one. Based on this assumption, a new MIA metric (CLiD) is proposed. The CLiD metric shows superior performance in various text-to-image diffusion models.", "questions": "I do not have any questions.", "limitations": "The authors have already addressed the limitaions of this paper.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The problem (MIA) is a very important problem which requires a lot of thought, especially with the increased usage of diffusion models which are essentially trained on the entire internet. Current MIAs tailored for Diffusion Models (DM) mainly focus on **uncondition** DM. This work bridges the gap between **conditional** and **unconditional** DM MIA. \n\n2. The idea is straightforward and further validation using gradually truncating operation is quite insightful.\n\n3. The experiment is very comprehensive. The exps on overfitting and real world scenarios reveals that current MIAs rely on severe overfitting and are not as strong as they claim (while CliD is more sensitive to overfitting). The idea to choose the threshold is more reasonable than current method (globally chosen). The exps about distribution consistency reveals the selection of nonmembers will seriously affect the performance of MIA, which gives a more reasonable setting of pretrained DM MIA. These insights above are interesting and very helpful for the MIA community.", "weaknesses": "1. There are some typos. For example, FPR@1%FPR $\\rightarrow$ TPR@1%FPR in Tab.3 and Tab.4. \n\n2. One related work should be included and further discussed: \n\nWen, Yuxin, et al. \"Detecting, explaining, and mitigating memorization in diffusion models.\" The Twelfth International Conference on Learning Representations. 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank you for your time and efforts in reviewing our paper. Your recognition of the significance of our work and acknowledgment of our experiments’ comprehensiveness is deeply appreciated. \n\n## Weakness (1):\nTypos in the paper.\n## Answer (1):\nThank you for carefully reviewing our paper and pointing out the typos. We will review it and correct all typos in the updated version.\n## Weakness (2):\nOne related work [1] missing.\n## Answer (2):\n\nThank you for pointing out this related work. This paper presents an interesting and valuable direction: detecting and mitigating memorization in diffusion models. In real life, it can be used to detect if a model remembers specific prompts, which has practical significance for detecting copyright infringement. The main differences between the work and ours are: \n\n1. This paper [1] focuses on detecting and mitigating the diffusion model's memorization of specific tokens (i.e. prompt memorization detection). In contrast, our work primarily aims to determine whether a given image-text pair exists in the model's training dataset (i.e., membership inference).\n\n2. This paper [1] designs a simple and effective detection method based on the intuition that tokens involved in memorization typically lead to a larger magnitude of prediction. It also proposes two mitigation methods: inference-time mitigation method and training-time mitigation method. In contrast, our work is based on the broadly validated phenomenon of conditional overfitting, from which we analytically derive the MI indicators CLiD and propose two MI methods: CLiD_th and CLiD_vec.\n\nWe will include it in the related work section and add a further discussion in the updated version.\n\nWe thank you again for your careful review and valuable feedback. We appreciate your positive comments on our work and we are more than happy to answer any further questions you may have.\n\n[1] Wen, Yuxin, et al. \"Detecting, explaining, and mitigating memorization in diffusion models.\" The Twelfth International Conference on Learning Representations. 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "i4jOqa7DqD", "reviewer": "Reviewer_k8Sd", "summary": "This paper firstly identifies a condition discrepancy in diffusion models that generation results conditioned on the training text prompts can significantly differ membership datasets and hold-out datasets of the model. Based on this observation, the paper proposes a novel method for membership inference that exploits the difference of losses conditioned on groundtruth text prompts and null (or partially null) text prompts as the feature. This method yields satisfying result.", "questions": "Can you introduce some prompt searching mechanisms and test your method based on this mechanisms? Since you have complete access to the diffusion model, it is possible to recover the text prompt without directly accessing to it. You can refer to [4].", "limitations": "See Weaknesses.", "rating": 7, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "a) The paper investigates the membership inference of diffusion models, which is a meaningful topic with positive societal impacts.\n\nb) The paper formally reveals an important phenomenon that diffusion models over-fit the condition, which is a finding useful for both membership inference and other scenarios (in case it is real).", "weaknesses": "a) The primary weakness of this paper is its fundamental setting, that we cannot assume that we have accesses to the groundtruth conditions (text prompts) c in real-world membership inference of diffusion models. The whole proposed method is based on this unrealistic assumption so that its meaning to the progress of membership inference would be quite limited. For example, we do not know the prompt used in the training of Stable Diffusion and SDXL, where membership inference is in need for copyright data detection. As baselines, SecMI [1] and PIA [2] discuss how different prompts c (null, groundtruth, blip) influence their performance and show that with BLIP caption their methods still hold to be effective. This robustness is in need for real-world usage of membership inference. However, this work is totally based on the groundtruth prompts so that it seems noLimt to have this necessary robustness.\n\nb) In addition to a), the baseline comparison could be unfair, because one can easily adapt a similar conditional mechanism to SecMI [1] and PIA [2] to enhance their performance, which is not included in their default implementation. Notably, this is an extra information so that it seems certain to improve their performance.\n\nc) Two evaluation setups, both over-training and real-world training, do not meet the real world scenario. For example, the author trains models on MS-COCO (2500 images) for 150,000 (over-training) and 50,000 (real-world training) steps and evaluates the proposed method on them. This means 60 steps/image and 20 steps/image. However, Stable Diffusion is trained only 1 step/image on LAION [3]. Hence, there is a gap between the evaluation setup of the paper and that of the real world. By contrast, baselines like SecMI [1] and PIA [2] are evaluated on Stable Diffusion & LAION, indicating their effectiveness on real-world membership inference.\n\nd) The finding of condition discrepancy has been revealed by [1] to some extent, for it shows the clear difference when using blip prompts and groundtruth prompts. This makes the novelty of this finding doubtful.\n\nReferences:\n\n[1] Duan, Jinhao, et al. \"Are diffusion models vulnerable to membership inference attacks?.\" International Conference on Machine Learning. PMLR, 2023.\n\n[2] Kong, Fei, et al. \"An efficient membership inference attack for the diffusion model by proximal initialization.\" arXiv preprint arXiv:2305.18355 (2023).\n\n[3] https://huggingface.co/runwayml/stable-diffusion-v1-5\n\n[4] Ma, Zhe, et al. \"Could It Be Generated? Towards Practical Analysis of Memorization in Text-To-Image Diffusion Models.\" arXiv preprint arXiv:2405.05846 (2024).\n\n_______________________\nAccording to the rebuttal, I have raised my score to 7.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your recognition of the societal impact of our work and your acknowledgment of our contribution in first identifying the condition likelihood discrepancy. In the following, we address your concerns point by point. (**Refer to the submitted PDF for Tab. A, Tab. B, Tab. C and Fig. A**).\n## Weakness (a): \nThe concern about the assumption that adversary accesses the ground truth text of images.\n## Answer (a):\n(1) We want to clarify that our threat model is indeed practical in real-world settings. First, for typical T2I DM (such as Stable Diffusion), we can concurrently access their images and text prompts because the image-text data is publicly available [1]. Second, for other non-publicly trained models, we emphasize that the primary application of our method is for dataset owners to **audit unauthorized usage (line 104)**, in which case both images and prompts are available for MI conductors. Third, the assumption of accessing the entire data distribution is also a common setting in representative MI works [2].\n\n(2) However, we genuinely understand your concern about whether our methods are still effective when the corresponding text is unknown. **Therefore, we conduct additional experiments to show the effectiveness of our methods without the groundtruth text (Tab. A and Tab. B):**\n\nWe assume that the adversary first generates the corresponding text of images and then conducts MI using pseudo-text. \n\nWe use two models: BLIP [3] and GPT4o-mini [4] to generate text. We still use two setups in Sec. 4.1: Over-training and Real-world training.  We observe that when using generated text for membership inference, both the baselines and our methods exhibit performance decline. However, our method still broadly outperforms baselines. **We believe this is because the generated text still retains the key semantics of the image, which makes our methods still effective.** We provide some generated examples by BLIP and GPT4o-mini for reference (Fig. A). Additionally, Tab. A and Tab. B show that using the text generated by GPT4o-mini yields better results than by BLIP. We think this is because GPT4o-mini generates better captions. \n## Weakness (b): \nThe concern about unfair comparison by introducing extra information for our methods.\n## Answer (b):\n(1) We want to clarify that in all experiments we strictly maintain the same setting: all methods could access the image-text data (i.e. no extra information for our methods). **These baselines such as PIA, SecMI and PFAMI (in Sec. 4.1) still require inputting both images and text to calculate their indicators, otherwise, their performance will degrade** (refer to Tab. A, Tab. B and [5]).\n \n(2) And the experiments in Tab. A and Tab. B also demonstrate that our methods outperform baselines even when groundtruth text is unavailable.\n## Weakness (c): \nThe concern about fine-tuning setups: over-training and real-world training settings. And the leak of evaluation in pretraining setting on Stable Diffusion & LAION.\n## Answer (c):\nOpen-sourced models bring increasing ease of copyright infringement through fine-tuning (line 109). **So we emphasize that MI methods should apply to both fine-tuning and pretraining stages and we explore both in our paper.** \n\n(1) For fine-tuning stage, we first use the over-training setting, as it is commonly used by existing baselines such as SecMI, PFAMI. Our experiments under this setting indicate excessive overfitting of the setting so that MI methods cannot be differentiated. We then devise a real-world training setting according to official fine-tuning scripts [7]. Our method outperforms baselines in both settings.\n\n(2) For pretraining stage, **please note that we do conduct evaluation on Stable Diffusion & LAION (refer to Sec. 4.6 and Tab. 5 in our paper).** We use LAION-v2 5+ and LAION-2B MultiTrans as member/hold-out sets to make sure the distribution consistency between training data and hold-out data and our method outperforms baselines. \n\n**And we conduct extra pretraining experiment for comparison  (Tab. C).** We use the SDv1-2 architecture to train a model from scratch on MS-COCO. The results also show our method's effectiveness.\n## Weakness (d): \n“The finding of condition discrepancy has been revealed by [5] to some extent”.\n## Answer (d):\nOur finding is different from SecMI[5] in two-fold:\n\n**(1)** For a given data point $(x_0, c_0)$, [5] can be formalized as:\n$$\nM(x\\_0, c\\_0, \\\\theta) = \\\\mathbf{1} [\\\\tilde{l}\\_{t_{sec},x\\_0,c\\_0} < \\\\tau].\n$$\nAnd when using a different condition $c^*$ such as BLIP-text / Null-text, [5] can be formalized as:\n$$\nM(x\\_0, c^*, \\\\theta) = \\\\mathbf{1} [\\\\tilde{l}\\_{t\\_{sec},x\\_0,c^*} < \\\\tau].\n$$\n\n__The \"condition discrepancy\" you mentioned is effectiveness difference__ of using $M(x\\_0, c\\_0, \\\\theta)$ compared with using $M(x\\_0, c^*, \\\\theta)$. [5] does not, like ours, compute discrepancy from different conditional likelihoods of a single data point to conduct MI, nor does it drive the analytical form of likelihood (Eq. (11)). Our method can be approximatively formalized as:\n$$\nM_{CLiD}(x_0, c_0, \\theta) \\approx \\mathbf{1} [ (\\log p(x_0|c_0) - \\log p(x_0)) > \\tau].\n$$\nSo the findings and intuition behind these two works are essentially different.\n\n**(2)** To our knowledge, we are the first to define the phenomenon of condition overfitting in T2I diffusion models and analytically derive the indicator CLiD for MI.\n## Question (1): \nConduct our method by recovering text prompts without access to it. \n## Answer (Q1): \nWe add experiments. Please refer to **“Answer(a)”** above.\n\n[1] https://laion.ai/\n\n[2] Carlini, Nicholas, et al. \"Membership inference attacks from first principles.\"\n\n[3] https://github.com/salesforce/BLIP\n\n[4] https://openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/\n\n[5] Duan, Jinhao, et al. \"Are diffusion models vulnerable to membership inference attacks?.\"\n\n[6] https://huggingface.co/docs/diffusers/training/text2image##launch-the-script", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank all reviewers for their constructive feedback. We are encouraged by your appreciation on our clear motivation and positive societal impact (Reviewers iMS8, gj8y, and k8sd), innovative and pioneering method (Reviewers meQ8, iMS8, and gj8y), comprehensive and practical experiments (Reviewers meQ8, iMS8, and gj8y). 

We have responded to each reviewer individually. 

We have also uploaded a rebuttal PDF that includes our additional experiments as follows:

* **Table A**: We conduct the experiments of using generated text for membership inference (MI) when groundtruth text is not available (Over-training setting).

* **Table B**: We conduct the experiments of using generated text for MI when groundtruth text is not available (Real-world training setting).

* **Table C**: We train a text-to-image diffusion model from scratch using SDv1-2 structure on MS-COCO 2017 dataset and report the results of different MI methods.

* **Table D**: We finetune the model using the imbalanced image-text dataset (i.e. each image corresponds to multiple texts with varying proportions) and evaluate the effectiveness of different MI methods.

* **Table E**: We train class-conditional diffusion model (class-conditional DM) on the dataset of CIFAR10 and present evaluation results of MI methods.


* **Figure A**: Examples of groundtruth and generated text by BLIP and GPT4o-mini of MS-COCO (refer to Table A and Table B).

* **Figure B**: The further validation of Assumption 3.1 on domain-specific dataset (MMCelebA).

We hope all of your concerns have been well-addressed in our responses. We are more than willing to address any follow-up questions you may have.

Meta-review: This paper proposes an algorithm to identify unauthorized data usage for text-to-image diffusion models’ training, through the membership inference method. Observing that models tend to overfit the text-conditional image distributions rather than marginal distributions of images, an analytical indicator is proposed to measure the KL divergence of two distributions, thus identifying the membership of images. Reviewers commend the significance of the observation and the proposed method and agree that the proposed algorithm is simple, straightforward, and promising. The rebuttal is detailed and carefully clarifies reviewers’ concerns including implications of experiment results, impacts, and applicability of algorithms when the ground truth text prompt is unknown. Given the consensus among all the reviewers, the AC recommends the acceptance of this paper.
Decision: Accept (poster)