Paper: DIAGNOSIS: Detecting Unauthorized Data Usages in Text-to-image Diffusion Models (ICLR-2024)

Reviewer comment (Experiments):
[Texutal Inversion] Is it possible to detect the unauthorized data usages with Textual Inversion [1] (a personalization technique for text-to-image diffusion models)?

Author response:
Thank you very much for your constructive suggestion. We conducted the experiments on the Textutal Inversion during the rebuttal period. The model used is Stable Diffusion v1. The dataset used is the Dog dataset used in Table 1.
Unconditional injected memorization is used here. The results on 10 models w/ unauthorized data usages and 10 models w/o unauthorized data usages are shown in the following table:

TP | FP| FN| TN| Acc| 
---- | ---| ---| ---| ---| 
10 | 0 | 0| 10| 100.0%|

 The results demonstrate that our method is effective for the Textual Inversion personalization method.

Reviewer comment (Evaluation):
[Efficiency] I did not find the discussion about the time cost of the proposed method. Helping the potential users know the approximated time cost is beneficial.

Author response:
Thanks for your thoughtful comment. In the image coating stage, the
warping function only costs 0.08s on one image with 1280 height and 1280 width.
The time cost for training the signal classifier is 1085.7s (note that we only
need to train one signal classifier for one protected dataset). The runtime for
the Algorithm 2 (detecting if the inspected model has unauthorized data usages
or not) is 546.7s. All runtime is measured on one Quadro RTX 6000 GPU. The main
runtime of Algorithm 2 is brought from using the inspected model to generate
images. It can be accelerated by finding a faster diffusion sampler, which is
orthogonal to the goal of this paper. We will add the discussion about runtime
in the revised version.

Reviewer comment (Writing):
[Summary Table for Symbols] A table summarizing the meaning of all symbols used in this paper can be added to make this paper more clear.

Author response:
Thank you very much for your valuable suggestion. We will add the summary table for used symbols in our revised version.

Reviewer comment (Experiments):
The authors mention that, compared with the sota schemes which focus on the sample-level memorization, this paper focuses on the element-level memorization. I think it does not matter whethat it is sample-level or element-level, the most important is which one offers higher performance. The authors do not logically or experimentally justify the advantage of element-level memorization over the sample-level ones.

Author response:
**A1:** Thank you for your valuable feedback. As pointed out by Carlini et al.
[1], a model is considered to have sample-wise memorization if a specific sample
can be accurately identified as a training sample of the model through
membership inference attacks. 

* Existing methods [2,3] have shown that
membership inference attack remains a significant challenge for large diffusion
models such as Stable Diffusion. For instance, the state-of-the-art membership
inference method for diffusion models, namely SecMI [2], only has a 66.1%
success rate for the membership inference on the stable-diffusion-v1-5 model
(also see our discussion in the Introduction Section). 

* In addition, these state-of-the-art membership inference methods require 
  white-box access to the inspected model, while the threat model in our paper
  is that the protector only has **black-box** access to the model, which is more practical. Performing
  membership inference for large diffusion models in black-box settings is
  even more challenging [3]. Dubinski et al. demonstrate that existing methods
  only have around 50% membership inference accuracy for large text-to-image
  diffusion models under the black-box setting. To the best of our knowledge, no current membership inference method is known to achieve significant accuracy in this specific setting.

These limitations are the main reasons why we opted not to employ sample-level
memorization in our method. We will make it more clear in our revised version.
Thanks again for your constructive comment.

[1] Carlini et al., Extracting Training Data from Diffusion Models. USENIX Security 2023.

[2] Duan et al., Are Diffusion Models Vulnerable to Membership Inference Attacks? ICML 2023.

[3] Dubinski et al., Towards More Realistic Membership Inference Attacks on Large Diffusion Models. arXiv 2023.

Reviewer comment (Theory):
The motivation of introducing two types of injected memorization is not well explained. The reviewer is confused with the necessarity of the trigger function.

Author response:
**A2:** Thank you for your insightful comment. In this paper, we introduce two
types of injected memorization, i.e., unconditional memorization and 
trigger-conditioned memorization. Each of them has its unique advantages. For
unconditional memorization, it is more general and it can be applied in both Scenario 1
and Scenario 2 introduced in Section 3.1. For
trigger-conditioned memorization, although it is only suitable for Scenario 1,
it is more effective under low coating rates. For example, in Table 7 of our
main paper, we show that the trigger-conditioned memorization is still effective
even under extremely small coating rates, e.g., 2.0%. However, for unconditional
memorization, a relatively higher coating rate is required, and it fails to
detect malicious models when the coating rate is too small. You can also find
the comparison between these two types of memorization in Section 4.4 of our main
paper. 
The trigger function is used to inject trigger-conditioned memorization, which is more effective at lower coating rates.
We will make it more clear in our revised version.

Reviewer comment (Evaluation):
Insufficient Evaluation. Only less than 20 models are constructed during the evaluations, which is far from enough to demonstrate the effectiveness of the approach. It lacks of evaluation regarding the distortion of the image after the warping. It also lacks the discussion on the potential countermeasures against the proposed approach.

Author response:
**A3:** Thanks for your helpful comment. In our paper, we have constructed **140
models in Table 1** and **120 models in Table 2**. To make the evaluation more
comprehensive, we have generated more models and conducted the experiments on a
larger scale. For each case in Table 1, we have 20 models w/ unauthorized data
usages and 20 models w/o unauthorized data usages. Therefore, **now we have 360
models in Table 1**. The results are shown in the following table:

Model | Dataset| Memorization Type| TP|FP|FN|TN|Acc|
---- | ---| ---|---|---|---|---|---|
Stable Diffusion v1 + LoRA | Pokemon | Unconditional|20|0|0|20|100.0%|
Stable Diffusion v1 + LoRA | Pokemon | Trigger-condioned|20|0|0|20|100.0%|
Stable Diffusion v1 + LoRA | CelebA | Unconditional|20|0|0|20|100.0%|
Stable Diffusion v1 + LoRA | CelebA | Trigger-condioned|20|0|0|20|100.0%|
Stable Diffusion v1 + LoRA | CUB-200 | Unconditional|20|0|0|20|100.0%|
Stable Diffusion v1 + LoRA | CUB-200 | Trigger-condioned|20|0|0|20|100.0%|
Stable Diffusion v2 + LoRA | Pokemon | Unconditional|20|0|0|20|100.0%|
Stable Diffusion v2 + LoRA | Pokemon | Unconditional|20|0|0|20|100.0%|
Stable Diffusion v1 + LoRA + DreamBooth | Dog | Unconditional|20|0|0|20|100.0%|

As can be seen, our method achieves 100.0% accuracy in all cases. We are
confident that our method will still have high accuracy in the evaluation with
more models. We hope our results adequately addressed your concern. We will include the new results in our revised version.

**A4:** Thanks for your thoughtful comment. We conducted the suggested
evaluation accordingly during the rebuttal period. In the following tables, we
report the average value of the SSIM, PSNR, MAE (Mean Absolute Error), and MSE
(Mean Squared Error) between the coated images under our default setting and the
original images.

The results on the Pokemon dataset with warping strength 1.0:

Measurement | Value|
---- | ---| 
SSIM | 0.99 |
PSNR| 31.35 |
MAE| 0.0052 |
MSE| 0.0008 |

The results on the Pokemon dataset with warping strength 2.0:

Measurement | Value|
---- | ---| 
SSIM | 0.96 |
PSNR| 26.35 |
MAE| 0.0097 |
MSE| 0.0026 |

The results on the CelebA dataset with warping strength 1.0:

Measurement | Value|
---- | ---| 
SSIM | 0.99 |
PSNR| 45.80 |
MAE| 0.0026 |
MSE| 0.00003 |

The results on the CelebA dataset with warping strength 2.0:

Measurement | Value|
---- | ---| 
SSIM | 0.98 |
PSNR| 40.04 |
MAE| 0.0049 |
MSE| 0.0001 |

The results demonstrate the coated version is highly similar to the original
images (for example, it has above 0.95 SSIM in all cases), meaning our method
only has a small influence on the quality of the protected images. The
visualization of the coated images and the original images can be found in Fig.
5 in the Appendix. We will add more discussion in the revised version.

Reviewer comment (Experiments):
What is the value of the coating rate used in section 4.2? If only a small portion of the data is protected, it is quite strange that selecting only a portion from the whole dataset to train the model would still be accurately detected with 100% accuracy. If the selection does not overlap with the protected portion, the detection mechenism should not work, right?

Author response:
**A6:** Thanks for your helpful questions and comments. 

* By default, the coating rate we used for unconditional injected memorization
and the trigger-conditioned injected memorization are 100.0% and 20.0% (also see
the implementation details in Section 4.1). 

* In our experiments, we use the scenario where the whole dataset is used to
train the model. Regarding the situation where an infringer selects a portion of the full dataset for model training, 
we discovered that it's challenging for the infringer to precisely choose a portion that excludes coated images. This difficulty arises because the infringer is unaware of the specific signal function employed by the protector. Consequently, our study focuses on the practical scenario where the infringer randomly selects a portion of the entire dataset for training purposes. Under these circumstances, statistical analysis indicates that the coating rate of the selected subset is likely to be similar to that of the full dataset.
Our method becomes ineffective if the chosen subset doesn't include
any of the protected data, but the likelihood of this happening is very slim.
Take the Pokemon dataset as an example, which contains 833 images. If we assume a
coating rate of 20% and the infringer randomly picks 20% of the dataset for
model training, the chance that the chosen subset completely misses the coated
data is only $4.2*10^{-19}$, which is nearly
negligible. The table below illustrates the probabilities for different coating
rates in the selected subsets. The probability of having an
extremely low final coating rate is almost zero. It's worth noting that our
method with trigger-conditioned memorization still has 100% accuracy even at a
2% coating rate (refer to Table 7 in our paper), proving its effectiveness in
such scenarios.

Coating Rate for the Selected Portion | Possibility|
---- | ---| 
0% | $4.2*10^{-19}$ | 
1%| $6.7*10^{-10}$ |
2%| $3.2*10^{-5}$ |

Reviewer comment (Writing):
Some typos and grammar errors exist, e.g., pp. 7, "we assume the subsets provide by different data sources..." should be "we assume the subsets provided by different data sources".

Author response:
**A1:** Thank you very much for your helpful comment. We will revise accordingly in our revised version.

Reviewer comment (Evaluation):
In the experimental results section, the authors shall provide more quantitative results (in terms of, e.g., PSNR, SSIM or the residual) for comparing the original sample image and its coated counterpart.

Author response:
**A2:** Thanks for your insightful suggestion. We conducted the suggested experiments accordingly during the rebuttal period. For the residual, we use the Mean Absolute Error (MAE) and  
Mean Squared Error (MSE) as the measurements (here the pixel values of the images range from 0 to 1). We report the average value of the SSIM, PSNR, MAE, and MSE between the coated images under our default setting and the original images in the following tables.

The results on the Pokemon dataset with warping strength 1.0:

Measurement | Value|
---- | ---| 
SSIM | 0.99 |
PSNR| 31.35 |
MAE| 0.0052 |
MSE| 0.0008 |

The results on the Pokemon dataset with warping strength 2.0:

Measurement | Value|
---- | ---| 
SSIM | 0.96 |
PSNR| 26.35 |
MAE| 0.0097 |
MSE| 0.0026 |

The results on the CelebA dataset with warping strength 1.0:

Measurement | Value|
---- | ---| 
SSIM | 0.99 |
PSNR| 45.80 |
MAE| 0.0026 |
MSE| 0.00003 |

The results on the CelebA dataset with warping strength 2.0:

Measurement | Value|
---- | ---| 
SSIM | 0.98 |
PSNR| 40.04 |
MAE| 0.0049 |
MSE| 0.0001 |


The results demonstrate the coated version is highly similar to the original images ( it has above 0.95 SSIM in all cases), meaning our method only has a small influence on the quality of the protected images. The visualization of the coated images and the original images can be found in Fig. 5 in the Appendix. We will add more discussion in the revised version.

Reviewer comment (Theory):
Does the image warping is reversible? It seems that the coated images are permanently damaged by the warping.

Author response:
**A4:** Thanks for your insightful comment. The warping effect is reversible by using the stored residual between the original image and the wrapped image. In the data coating process, the protector can record the residual bought from the wrapping operation for each protected image. Then the wrapped images can be recovered to the original image by using the stored residuals.

Thank you very much for your support and feedback. The analysis in Heckbert et al. demonstrates that image warping function has its inverse function and it is reversible. Thanks again for your insightful question and helpful comment.

Heckbert et al., Fundamentals of Texture Mapping and Image Warping.