#  Membership Inference Attacks against
Diffusion Models

Tomoya Matsumoto  Osaka University
Osaka, Japan
<EMAIL_ADDRESS>Takayuki Miura Osaka University,
NTT Socical Informatics Laboratories
Tokyo, Japan
<EMAIL_ADDRESS>Naoto Yanai  Osaka University
Osaka, Japan
<EMAIL_ADDRESS>
###### Abstract

Diffusion models have attracted attention in recent years as innovative
generative models. In this paper, we investigate whether a diffusion model is
resistant to a membership inference attack, which evaluates the privacy
leakage of a machine learning model. We primarily discuss the diffusion model
from the standpoints of comparison with a generative adversarial network (GAN)
as conventional models and hyperparameters unique to the diffusion model,
i.e., time steps, sampling steps, and sampling variances. We conduct extensive
experiments with DDIM as a diffusion model and DCGAN as a GAN on the CelebA
and CIFAR-10 datasets in both white-box and black-box settings and then
confirm if the diffusion model is comparably resistant to a membership
inference attack as GAN. Next, we demonstrate that the impact of time steps is
significant and intermediate steps in a noise schedule are the most vulnerable
to the attack. We also found two key insights through further analysis. First,
we identify that DDIM is vulnerable to the attack for small sample sizes
instead of achieving a lower FID. Second, sampling steps in hyperparameters
are important for resistance to the attack, whereas the impact of sampling
variances is quite limited.

###### Index Terms:

diffusion model, membership inference attack, GAN, hyperparameter, privacy

##  I Introduction

###  I-A Motivation

In machine learning, generative models have been actively studied. As a
breakthrough in recent years, diffusion models [1, 2] were discovered as new
generative models. Diffusion models can generate more plausible images and
texts than existing generative models such as a generative adversarial network
(GAN). Remarkably, diffusion models have outperformed GANs on academic
benchmarks in the past years [3] and are expected to replace GANs in a variety
of applications [4, 5, 6, 7].

We emphasize that discussion on privacy violations for training data of
diffusion models [8, 9, 10] is a very recent issue and hence is still
insufficient. In general, training generative models requires large amounts of
training data, and, for example, models that generate disease histories as
sensitive information also attract attention [11, 12]. Understanding privacy
violations under realistic threats for generative models is crucial for using
generative models in the real world [13]. Consequently, privacy violations of
diffusion models should be discussed in more detail.

In this paper, we discuss a membership inference attack [14] against diffusion
models, which is an important criterion for evaluating privacy violations.
Informally, a membership inference attack aims to identify whether a data
record was used to train a machine learning model. A membership inference
attack is discussed for evaluating privacy violations in the past years [15,
16, 17], and hence it is important to discuss the attack for diffusion models
in order to understand potential threats of the model. We then try to answer
the following question: How vulnerable are diffusion models to a membership
inference attack?

We note that this question is non-trivial because the data generation logic by
diffusion models differs from conventional models such as GANs. According to
earlier literature [18, 13, 19, 20], the architecture of a generative model
affects the attack success rate of a membership inference attack. For example,
for an attack against GAN, an attacker can utilize a discriminator model that
is a counterpart to the generative model [19]. By contrast, diffusion models
do not contain such a model. Meanwhile, diffusion models have unique
hyperparameters, i.e., time steps, sampling steps, and sampling variances,
that have never been contained in conventional models. It indicates that we
will no longer be able to know how the membership inference attack on
diffusion models will vary compared to the traditional models. These
standpoints were not addressed in the existing works [8, 10, 9]. (See Section
II-C for more detail.)

###  I-B Contributions

In this paper, we shed light on the impact of a membership inference attack on
diffusion models through extensive experiments. Our primary discussions are on
comparison with a GAN as conventional generative models and hyperparameters of
the diffusion model, i.e., time steps, sampling steps, and sampling variances.
In particular, through extensive experiments with denoising diffusion implicit
models (DDIM) as a diffusion model and deep convolutional GAN (DCGAN) as a GAN
on the CelebA and CIFAR-10 datasets in both white-box and black-box settings,
we show that the diffusion model is comparably resistant to a membership
inference attack as GAN. We then identify the impact of time steps on the
attack. Remarkably, intermediate steps in a noise schedule are the most
vulnerable to the attack rather than the beginning or the final step. (See
Section IV for detail.)

We also provide two key insights into a membership inference attack on the
diffusion model through further analysis for overfitting compared to GAN and
hyperparameters for sampling, i.e., sampling steps and sampling variances.
First, for overfitting, we show that DDIM is vulnerable to the attack if the
training sizes are small since DDIM is well-trained compared to DCGAN. Second,
sampling steps in hyperparameters are quite important for resistance to the
attack in contrast to sampling variances, which are invaluable for the attack.
(See Section V for detail.)

##  II Related Work

In this section, we describe related works of membership inference attacks,
including GANs and diffusion models.

###  II-A Membership Inference

A membership inference attack is a kind of attack whereby an adversary infers
whether a particular example was contained in the training dataset of a model
[21, 22, 23]. A model vulnerable to the attack potentially contains threats to
privacy leakage, and hence recent works discuss membership inference attacks
for various machine learning models [18, 15, 16]. There are two settings [14],
i.e., the white-box setting where an adversary has access to model parameters,
and the black-box setting where an adversary utilizes only outputs of the
model.

A typical approach for membership inference attacks is to leverage the large
divergence between the loss distribution over members and non-members [24].
The divergence can be embedded by an adversary. For instance, privacy leakage,
including membership inference attacks, can be more effective by training a
model with poisoning samples [25, 26, 27, 28].

Membership inference attacks can be prevented by differential privacy [29]
where gradients are perturbed [30, 31]. Since differential privacy often
deteriorates inference accuracy, several works evaluated differential privacy
on membership inference attacks in a quantitative fashion [32, 33].

###  II-B Attacks on GANs

Related works are membership inference attacks against GANs [18, 19, 13, 34].
LOGAN was presented as the first attack against GANs in both white-box and
black-box settings. LOGAN in the white-box setting utilizes outputs from the
discriminator of a target model. Concurrently, the Monte Carlo attack [13] was
presented as an attack independent of a target model’s architecture in the
black-box setting. The above attacks are also utilized as oracles in the
subsequent work [19].

GAN-Leaks [34] is the state-of-the-art attack against GANs in the black-box
setting, to the best of our knowledge. It no longer requires the setting of
parameters compared to the above attacks and hence can be used in diffusion
models. GAN-Leaks also showed a new attack whereby an adversary has access to
the internal of a target model’s generator.

We utilize LOGAN in the white-box setting and GAN-Leaks in the black-box
setting to compare a diffusion model with a GAN, respectively. As described
above, LOGAN is the only work on GANs in the white-box setting while GAN-Leaks
can be used in diffusion models. We also note that there is no work that is
also applicable to diffusion models in the white-box setting.

###  II-C Attacks on Diffusion Models

We note that there is an attack by Wu et al. [35] against diffusion models.
Their attack focuses on text-to-image generation models. In contrast, we focus
on typical image generation models. Namely, the underlying problem is quite
different. It is considered that the existing attacks against GANs are rather
close to our work than Wu et al. [35].

Concurrently, there are a few works [8, 10, 9] on typical image generation
models based on diffusion models, which are the closest to ours. As the main
difference from these works, we discuss hyperparameters of diffusion models in
detail, which are our main results. In particular, Hu et al. [8] and Duan et
al. [10] did not discuss comparison with GANs. Carlini et al. [9] compared
with GANs, but did not discuss hyperparameters, i.e., sampling steps and
sampling variances. We primarily focus on comparison with GANs and discussion
on the hyperparameters. Our work is thus concurrent with the above works.
Interested readers are also encouraged to read the existing works [8, 10, 9].

##  III Membership Inference Attacks against Diffusion Model

In this section, we present our membership inference attacks against a
diffusion model. To this end, we first formalize the adversary setting of the
attacks and the detail of a diffusion model. We then describe our
investigation method and the key question of this paper in detail.

Figure 1: Overview of our membership inference attacks

###  III-A Formalization

A membership inference attack in this paper is defined as a game between an
adversary $\mathcal{A}$ and a challenger $\mathcal{C}$. We note that the
adversary’s knowledge about a model is different for white-box and black-box
settings. White-box setting means that an adversary has access to an
architecture of the model and its parameters obtained via training while
black-box setting means that an adversary cannot obtain these information.

We first denote by $\mathbb{R}$ a set of real numbers, by $\mathcal{D}$ a set
of data samples, and by $\mathcal{M}$ a set of machine learning models. Then,
a generative machine learning model $M\in\mathcal{M}$ is defined as a function
$M:\mathbb{R}^{r}\rightarrow\mathcal{D}$, where $r$ is an arbitary integer.

  1. 1.

$\mathcal{C}$ chooses a dataset $D\subseteq\mathcal{D}$.

  2. 2.

$\mathcal{C}$ chooses a bit $b\leftarrow\\{0,1\\}$. If $b=1$, $\mathcal{C}$
chooses a sample $x\in D$; otherwise, $\mathcal{C}$ chooses
$x\in\mathcal{D}\backslash D$ other than $D$. $\mathcal{C}$ sends $x$ to
$\mathcal{A}$.

  3. 3.

$\mathcal{C}$ trains $M$ with the dataset $D$.

  4. 4.

$\mathcal{A}$ obtains $x_{i}=M(z_{i})$ for any $z_{i}\in\mathbb{R}^{r}$.
Furthermore, $\mathcal{A}$ also receives $M$ and its auxiliary
information111In the case of GANs, a discriminator is the auxiliary
information..

  5. 5.

$\mathcal{A}$ returns a bit $b^{\prime}\in\\{0,1\\}$. If $b=b^{\prime}$,
$\mathcal{A}$ wins the game.

The difference between the white-box and black-box settings is represented as
the sentences with red color, and only the white-box setting contains this
sentence. As described in Section II-A, an adversary in the white-box setting
has access to the internal of a target model $M$: in this paper, he/she can
have access to internal networks, which are utilized in the training of $M$
and unnecessary for data generation, such as discriminators in GANs as
auxiliary information. On the other hand, an adversary in the black-box
setting receives only the generated samples $x_{i}$ from a target model $M$.

We adopt area-under-the-ROC-curve (AUCROC) [36], attack success rate (ASR)
[14], and true positive rates (TPR) at low false positive rates (FPR) [23],
used as TPR at 1%FPR in this paper, as evaluation metrics of the attacks. We
also adopt the Frechet inception distance (FID) [37] to evaluate the quality
of generated images. A lower score for FID means that generated images are of
a higher quality.

###  III-B Detail of Diffusion Model

Membership inference attacks in this paper depend on a loss function of a
diffusion model. To this end, we describe the detail of the loss function,
including the diffusion process and denoising process.

As we utilize DDIM [38] in our experiments, we describe the denoising
diffusion probabilistic models (DDPM) [2] below for simplicity. The diffusion
process is described as:

$\displaystyle
q(x_{t}|x_{t-1})=\mathcal{N}(x_{t};\sqrt{1-\beta_{t}}x_{t-1},\beta_{t}I).$ (1)

According to the noise schedule $\beta$, the observed data $x_{0}$ are
transformed into noise $x_{T}$ by adding Gaussian noise over $T$ steps for any
number $T$.

On the other hand, the denoising process is described as:

$\displaystyle
p_{\theta}(x_{t-1}|x_{t})=\mathcal{N}(x_{t-1};\mu_{\theta}(x_{t},t),\Sigma_{\theta}(x_{t},t)).$
(2)

The data are reconstructed by repeatedly removing noise from noise $x_{T}$
drawn from a multivariate standard normal distribution. The linear and cosine
functions [39] are available as typical noise schedules.

The model is trained to maximize the variational lower bound of the log
marginal likelihood $\log p_{\theta}(x_{0})$. Therefore, the loss function $L$
is expressed as:

$\displaystyle
L:=\mathbb{E}_{q}\Big{[}\log\frac{q(x_{1:T}|x_{0})}{p_{\theta}(x_{0:T})}\Big{]}\geq\mathbb{E}\Big{[}-\log
p_{\theta}(x_{0})\Big{]}.$ (3)

In practice, we use the simplified loss function shown as:

$\displaystyle
L_{simple}:=\mathbb{E}_{t,x_{0},\epsilon}\Big{[}\|\epsilon-\epsilon_{\theta}(\sqrt{\bar{\alpha}_{t}}x_{0}+\sqrt{1-\bar{\alpha}_{t}}\epsilon,t)\|^{2}\Big{]},$
(4)

which represents the noise estimation error of the data $x_{t}$, using the
notation $\bar{\alpha}_{t}:=\prod_{s=1}^{t}(1-\beta_{s})$.

In training, $\theta$ is optimized to the above error. It is also utilized for
the membership inference because the error is quite small for the training
data, i.e., in-member.

Meanwhile, the sampling of DDIM is represented as:

$\displaystyle
x_{t-1}=\sqrt{\bar{\alpha}_{t-1}}\left(\frac{x_{t}-\sqrt{1-\bar{\alpha}_{t}}\epsilon_{\theta}(x_{t},t)}{\sqrt{\bar{\alpha}_{t}}}\right)$
$\displaystyle+\sqrt{1-\bar{\alpha}_{t-1}-{\sigma_{t}}^{2}}\cdot\epsilon_{\theta}(x_{t},t)+\sigma_{t}\epsilon_{t},$
(5)

where $\sigma$ controls the randomness of the sampling.

Sampling can be performed by any number of steps less than or equal to $T$
and, for any substring $\tau$ of $[1,...,T]$, $\sigma$ is represented with a
hyperparameter $\eta$ as:

$\displaystyle\sigma_{\tau_{i}}(\eta)=\eta\sqrt{(1-\bar{\alpha}_{\tau_{i-1}})/(1-\bar{\alpha}_{\tau_{i}})}\sqrt{1-\bar{\alpha}_{\tau_{i}}/\bar{\alpha}_{\tau_{i-1}}}.$
(6)

In [38], the following value is utilized for the sampling of CIFAR-10:

$\displaystyle\hat{\sigma}_{\tau_{i}}=\sqrt{1-\bar{\alpha}_{\tau_{i}}/\bar{\alpha}_{\tau_{i-1}}}.$
(7)

###  III-C Investigation Method

We describe our investigation method to evaluate membership inference attacks
against a diffusion model in the white-box setting. As described in Section
II-B, there is no attack against a diffusion model in the white-box setting,
whereas we utilize LOGAN [18] and GAN-Leaks [34].

As described in Equation (4), the loss function of a diffusion model
represents a noise estimation error. In general, the loss distribution among
members is smaller than among non-members because a model learns training data
to minimize the estimation error [24]. Based on this fact, by providing random
samples and appropriate time $t$ (as described later) with a target model $M$,
an error for noise is estimated, and then a target sample is classified with
the error. The detail of the method is shown in Algorithm 1. The setting of
the time $t$ is different for each noise schedule. (See Section IV-B2 for
detail.)

Algorithm 1 White-box attack against diffusion models

Target samples $x^{1},...,x^{m}$, model’s network $\epsilon_{\theta}$, time
$t$, noise schedule $\bar{\alpha}_{t}:=\prod_{s=1}^{t}(1-\beta_{s})$,
threshold $c$

for $i=1$ to $m$ do

$y^{i}\leftarrow 0$ $\triangleright$ initialization

if
$\epsilon-\epsilon_{\theta}(\sqrt{\bar{\alpha}_{t}}x^{i}+\sqrt{1-\bar{\alpha}_{t}}\epsilon,t)<c$
then

$y^{i}\leftarrow 1$ $\triangleright$ member

Labels $y^{1},...,y^{m}$

###  III-D Key Question

As described in Section I-A, we shed light on how a diffusion model is
vulnerable to membership inference attacks. To this end, we discuss it from
two standpoints: difference from generative adversarial models (GANs), and
time steps of a diffusion model.

We first evaluate membership inference attacks, including the investigation
method in the previous section, against the diffusion model and existing GANs.
The main difference between the diffusion model and existing GANs is the
number of neural networks, i.e., the diffusion model consists of a single
neural network while the existing GANs consist of generators and
discriminators. We discuss the impact of the above difference on membership
inference attacks in both black-box and white-box settings.

We also discuss the impact of time steps on membership inference attacks. In a
diffusion model, information learned by the model is different for each time
step $t$. Although the performance of membership inference attacks depends on
the divergence of loss distributions between members and non-members [24], it
is unknown that the divergence increases in proportion to the time step $t$.
Consequently, we evaluate membership inference attacks with respect to time
step $t$.

##  IV Experiments

In this section, we conduct extensive experiments on membership inference
attacks against a diffusion model. We evaluate the attack AUC by comparing the
attacks against GANs. We also evaluate the impact of the time steps of a
diffusion model on the attack AUC.

###  IV-A Experimental Setting

The experimental setting in this paper is described below.

####  IV-A1 Datasets

We utilize CIFAR-10 [40] and CelebA [41] datasets, which contain samples with
$32\times 32$ color pixels and with center-cropped $64\times 64$ color pixels,
respectively.

####  IV-A2 Architectures

We utilize the denoising diffusion implicit model (DDIM) [38] as a diffusion
model and the deep convolutional GAN [42] as a baseline. The reason of the use
of these architectures is that DDIM is the basis of other diffusion models and
is suitable for investigating common properties of the diffusion models. On
the other hand, DCGAN has been utilized in existing works[18, 13, 34] for
membership inference attacks on generative models.

For hyperparameters, we set $T=1000$, and the noise schedule is the cosine
schedule [39] or the linear schedule [2]. The default setting is the cosine
schedule. Also, the sampling is performed for sampling variance $\sigma(0)$
and per 50 steps, i.e., 20 steps in total. The number of dimensions for latent
variables in DGCAN is 100.

A target model $M$ is trained with 12,000 samples, and the number of epochs is
500 for DDIM and 300 for DCGAN. To fairly compare the evaluation metrics for
membership inference attacks, the effect of overfitting should be minimized.
Thus, we utilize 500 epochs for DDIM and 300 epochs for DCGAN as the target
model $M$.

(a) DDIM

(b) DCGAN

Figure 2: FID scores throughout training

####  IV-A3 Attack Methods

In the white-box setting, we utilize the investigation method described in
Section III-C for the attack on DDIM, where time $t=350$, and LOGAN [18] for
the attack on DCGAN. On the other hand, in the black-box setting, we utilize
the full black-box attack of GAN-Leaks [34] where the number of generated
images is 12,000.

###  IV-B Results

####  IV-B1 Comparison with GANs

The results of DDIM and DCGAN are shown in Fig. 3, and Tables I-II. According
to these results, DDIM is more resistant to the membership inference attack
than DCGAN for CIFAR-10 in the white-box setting. Furthermore, according to
Table I, DDIM is more resistant than DCGAN in terms of AUCROC. Although one
might think that DDIM is vulnerable according to TPR at 1%FPR, including
several low scores of FPR in Fig. 3, on CelebA, it is considered that they are
fairly comparable because each value is quite small. By contrast, the attack
fails for all models and datasets in the black-box setting.

As a result, it is considered that DDIM is at least resistant equivalently to
DCGAN.

(a) White-box setting

(b) Black-box setting

Figure 3: ROC curves TABLE I: Attack performance on White-box setting Dataset | Model | AUCROC | ASR | TPR at
---|---|---|---|---
1%FPR
CIFAR-10 | DDIM | 0.552 | 0.536 | 1.54%
DCGAN | 0.778 | 0.707 | 6.50%
CelebA | DDIM | 0.635 | 0.599 | 2.93%
DCGAN | 0.699 | 0.643 | 2.56%
TABLE II: Attack performance on Black-box setting Dataset | Model | AUCROC | ASR | TPR at
---|---|---|---|---
1%FPR
CIFAR-10 | DDIM | 0.503 | 0.499 | 1.19%
DCGAN | 0.497 | 0.497 | 1.05%
CelebA | DDIM | 0.503 | 0.502 | 1.09%
DCGAN | 0.495 | 0.494 | 1.13%

####  IV-B2 Attack performance for different time steps

The investigation method in Section III-C requires giving a time step $t$ as
an input to a target model $M$ in addition to samples $x^{1},\ldots,x^{m}$. We
show that time steps and the noise schedule strongly affect the performance of
the membership inference attacks.

The results of AUCROC for each time step $t$ are represented in Fig. 4, where
DDIM is trained with the cosine and linear schedules. According to the figure,
AUCROC is maximized at $t=350$ for the cosine schedule and at $t=200$ for the
linear schedule. We call these values best-one AUCROC for the sake of
convenience. For these values, the value of $\bar{\alpha}_{t}$ is 0.7. As
might have been unexpected, these maximized values were obtained in
intermediate steps. The best-one AUCROC for the cosine schedule is higher than
the liner schedule. Besides, according to Table III, AUCROC with an average of
loss values for all the steps, called average AUCROC for the sake of
convenience, is lower than the best-one AURCROC. Therefore, we use results at
$t=350$ for the investigation methods in the entire experiments.

Figure 4: AUCROC at every 25 step on White-box setting TABLE III: AUCROC by best-one and average $t$ | CIFAR-10 | CelebA
---|---|---
| best-one | average | best-one | average
cosine | 0.552 | 0.535 | 0.636 | 0.597
linear | 0.518 | 0.510 | 0.555 | 0.529

##  V Discussion

In this section, we discuss the attack performance in terms of training sizes
and training epochs to understand the impact of overfitting on diffusion
models. We then discuss the impacts of hyperparameters for sampling in the
diffusion models.

###  V-A Impact of Overfitting

Overfitting strengthens membership inference attacks in general [31]. We
discuss the impact of overfitting with respect to training sizes and epochs.

####  V-A1 Training Sizes

(a) White-box setting (CIFAR-10)

(b) White-box setting (CelebA)

(c) Black-box setting (CIFAR-10)

(d) Black-box setting (CelebA)

Figure 5: ROC curves for different training sizes TABLE IV: Attack performance for different training sizes in White-box / Black-box setting Model | Training | CIFAR-10 | CelebA
---|---|---|---
size | AUCROC | ASR | TPR at 1%FPR | FID | AUCROC | ASR | TPR at 1%FPR | FID
| 12,000 | 0.552 / 0.503 | 0.536 / 0.499 | 1.54 / 1.19% | 13.91 | 0.635 / 0.503 | 0.599 / 0.502 | 2.93 / 1.09% | 13.94
DDIM | 6,000 | 0.801 / 0.499 | 0.736 / 0.500 | 5.65 / 0.90% | 16.27 | 0.973 / 0.497 | 0.901 / 0.499 | 65.30 / 0.90% | 16.64
| 600 | 1.000 / 0.931 | 0.968 / 0.882 | 100.00 / 77.50% | 28.72 | 1.000 / 0.762 | 0.995 / 0.717 | 100.00 / 47.33% | 33.89
| 12,000 | 0.778 / 0.497 | 0.707 / 0.497 | 6.50 / 1.05% | 68.29 | 0.699 / 0.495 | 0.643 / 0.494 | 2.56 / 1.13% | 25.54
DCGAN | 6,000 | 0.983 / 0.497 | 0.899 / 0.499 | 69.80 / 0.78% | 79.30 | 0.776 / 0.492 | 0.694 / 0.490 | 8.33 / 0.95% | 31.99
| 600 | 1.000 / 0.526 | 0.988 / 0.529 | 99.50 / 2.17% | 189.96 | 0.940 / 0.524 | 0.873 / 0.520 | 19.83 / 1.50% | 227.53

We perform the attacks on three target models, i.e., their training sizes are
12,000, 6000, and 600 images, to evaluate the impact of training sizes on a
membership inference attack. The results are shown in Fig 5 and Table IV,
where the number of epochs is changed depending on the training sizes in order
to align the number of images trained by the model.

Overall, DDIM is vulnerable to membership inference attacks compared to DCGAN
when the training sizes are small. We analyze this result in detail below. We
also note that FID for DCGAN on CIFAR-10 is high because DCGAN is unsuitable
for the dataset. Indeed, we found many strange images, although we omit the
detail due to the space limitation. Consequently, we focus on results on
CelebA.

First, in the white-box setting, Fig. 5 shows a remarkable phenomenon: DDIM is
more vulnerable to the membership inference attack than DCGAN for small
training sizes but is more resistant for large training sizes. For instance,
DDIM is vulnerable in the white-box setting until 6000 images. After that,
according to the columns of CelebA in Table IV, AUCROC and ASR of DDIM for
12,000 images are 0.064 smaller and 0.044 smaller than DCGAN, respectively.

We also found remarkable results in the black-box setting: for small training
sizes, DDIM is significantly vulnerable compared to DCGAN. Notably, AUCROC and
ASR of DDIM for 600 images are 0.24 higher and 0.19 higher than DCGAN,
respectively. Meanwhile, after the training size is 6,000, the result of DDIM
for each model is identical to that of DCGAN for any metrics. It means that
DDIM is vulnerable to a membership inference attack for small training sizes
instead of providing lower FID.

####  V-A2 Epochs

We perform the attacks on five target models, i.e., models with 300 epochs to
700 epochs, to evaluate the impact of the number of epochs on a membership
inference attack in the white-box setting. The results are shown in Fig 6. We
also note that we omit results in the black-box setting since those for DDIM
and DCGAN are identical. According to the figure, values of AUCROC become
higher in proportion to the number of epochs, and this statement is especially
stable for DDIM. It means that the impact of overfitting by the number of
epochs for DDIM can be more estimated than DCGAN. Since it increases linearly,
we believe that the number of epochs to obtain the resistance to a membership
inference attack can be estimated.

(e) DDIM

(f) DCGAN

Figure 6: AUCROC throughout training on White-box setting

###  V-B Impact of Hyperparameters for Sampling

Hyperparameters often affect the model’s performance, and hence we discuss the
impact of hyperparameters for sampling, which are unique to diffusion models,
i.e., sampling steps and sampling variances. Here, the investigation method in
Section III-C is independent of hyperparameters for sampling since they are
used only for the image generation process. Consequently, we evaluate only in
the black-box setting.

####  V-B1 Sampling Steps

We perform the attacks on three different numbers of steps, i.e., 50 steps, 20
steps, and 10 steps, to evaluate the impact of sampling steps on a membership
inference attack. The results are shown in Fig. 7 and Table V, where the
number of epochs is 1000 and the model is trained with 600 images. According
to the figure, DDIM is more vulnerable to the membership inference attack in
proportion to the number of sampling steps. The reason is that generated
images have passed through the trained networks more frequently in proportion
to the number of sampling steps. Namely, the generated images represent the
training results strongly. It also means that sampling steps significantly
affect the resistance to a membership inference attack.

(a) CIFAR-10

(b) CelebA

Figure 7: ROC curves for different sampling steps on Black-box setting TABLE V: Attack performance for different sampling steps on Black-box setting  Dataset | Steps | AUCROC | ASR | TPR at | FID
---|---|---|---|---|---
1%FPR
| 50 | 0.986 | 0.962 | 92.83% | 22.60
CIFAR-10 | 20 | 0.931 | 0.882 | 77.50% | 28.72
| 10 | 0.781 | 0.724 | 51.17% | 45.50
| 50 | 0.966 | 0.933 | 87.67% | 12.37
CelebA | 20 | 0.762 | 0.717 | 47.33% | 33.89
| 10 | 0.539 | 0.516 | 15.00% | 101.01

####  V-B2 Sampling Variances

We perform the attacks on three different sampling variances, i.e.,
$\sigma(1)$, $\sigma(0)$, and $\hat{\sigma}$, to evaluate the impact of
sampling variances that control the randomness of the sampling on a membership
inference attack. The results are shown in Table VI, where the number of
sampling steps is 20 and the model is trained with 600 images and 10,000
epochs. According to the table, although FID becomes larger in proportion to
variances, DDIM is vulnerable to the membership inference attack for any
variance. It means that the resistance to a membership inference attack is
independent of sampling variances and affects only the quality of generated
images.

TABLE VI: Attack performance for different sampling variances on Black-box setting  Dataset | Variance | AUCROC | ASR | TPR at | FID
---|---|---|---|---|---
1%FPR
| $\sigma(0)$ | 0.931 | 0.882 | 77.50% | 28.72
CIFAR-10 | $\sigma(1)$ | 0.927 | 0.892 | 78.50% | 39.10
| $\hat{\sigma}$ | 0.929 | 0.886 | 79.83% | 89.95
| $\sigma(0)$ | 0.762 | 0.717 | 47.33% | 33.89
CelebA | $\sigma(1)$ | 0.799 | 0.763 | 55.50% | 31.42
| $\hat{\sigma}$ | 0.803 | 0.759 | 54.17% | 78.85

####  V-B3 Summary

In summary, for hyperparameters for sampling, sampling steps are important for
the resistance to a membership inference attack, while sampling variances are
invaluable. We leave it as an open problem to confirm if the same results are
obtained in other architectures of diffusion models.

##  VI Conclusion

In this paper, we investigated a membership inference attack on diffusion
models. We primarily discussed the comparison of DDIM as a diffusion model
with DCGAN as an existing generative model and hyperparameters of a diffusion
model, i.e., time steps, sampling steps, and sampling variances. We first
showed that the diffusion model is comparably resistant to a membership
inference attack as GAN through experiments on the CelebA and CIFAR-10
datasets in the white-box and black-box settings. We then demonstrated the
impact of time steps on the membership inference attack. According to our
result, intermediate steps in a noise schedule are the most vulnerable.

We also found two key insights into a membership inference attack on the
diffusion model through analysis for overfitting, including comparison with a
GAN, and hyperparameters for sampling. First, for overfitting, we confirmed if
DDIM is vulnerable to the attack when the sample sizes are small because it
could be more well-trained than DCGAN. Second, sampling steps in
hyperparameters are significantly important for resistance to the attack,
while sampling variances are invaluable. We are in the process of
investigating further resistance to membership inference attacks on diffusion
models, including other architectures.

## References

  * [1] J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli, “Deep unsupervised learning using nonequilibrium thermodynamics,” in _Proc. of ICML 2015_ , ser. PMLR, vol. 37. PMLR, 2015, pp. 2256–2265.
  * [2] J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in _Proc. of NeurIPS 2020_ , vol. 33. Curran Associates, Inc., 2020, pp. 6840–6851.
  * [3] P. Dhariwal and A. Nichol, “Diffusion models beat gans on image synthesis,” _Advances in Neural Information Processing Systems_ , vol. 34, pp. 8780–8794, 2021.
  * [4] A. Ramesh, P. Dhariwal, A. Nichol, C. Chu, and M. Chen, “Hierarchical text-conditional image generation with clip latents,” _arXiv preprint arXiv:2204.06125_ , 2022.
  * [5] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High-resolution image synthesis with latent diffusion models,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2022, pp. 10 684–10 695.
  * [6] C. Saharia, W. Chan, S. Saxena, L. Li, J. Whang, E. Denton, S. K. S. Ghasemipour, B. K. Ayan, S. S. Mahdavi, R. G. Lopes _et al._ , “Photorealistic text-to-image diffusion models with deep language understanding,” _arXiv preprint arXiv:2205.11487_ , 2022.
  * [7] A. Q. Nichol, P. Dhariwal, A. Ramesh, P. Shyam, P. Mishkin, B. Mcgrew, I. Sutskever, and M. Chen, “GLIDE: Towards photorealistic image generation and editing with text-guided diffusion models,” in _Proceedings of the 39th International Conference on Machine Learning_ , 2022, pp. 16 784–16 804.
  * [8] H. Hu and J. Pang, “Membership inference of diffusion models,” _arXiv preprint arXiv:2301.09956_ , 2023.
  * [9] N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V. Sehwag, F. Tramèr, B. Balle, D. Ippolito, and E. Wallace, “Extracting training data from diffusion models,” _arXiv preprint arXiv:2301.13188_ , 2023.
  * [10] J. Duan, F. Kong, S. Wang, X. Shi, and K. Xu, “Are diffusion models vulnerable to membership inference attacks?” _arXiv preprint arXiv:2302.01316_ , 2023\.
  * [11] E. Choi, S. Biswal, B. Malin, J. Duke, W. F. Stewart, and J. Sun, “Generating multi-label discrete patient records using generative adversarial networks,” in _Proc. of MLHC 2017_ , ser. PMLR, vol. 68. PMLR, 2017, pp. 286–305.
  * [12] X. Yi, E. Walia, and P. Babyn, “Generative adversarial network in medical imaging: A review,” _Medical Image Analysis_ , vol. 58, p. 101552, 2019.
  * [13] B. Hilprecht, M. Härterich, and D. Bernau, “Monte carlo and reconstruction membership inference attacks against generative models,” _Proceedings of Privacy Enhancing Technologies_ , vol. 2019, no. 4, pp. 232–249, 2019.
  * [14] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in _Proc. of IEEE S &P 2018_. IEEE Computer Society, 2017, pp. 3–18.
  * [15] M. Conti, J. Li, S. Picek, and J. Xu, “Label-only membership inference attack against node-level graph neural networks,” in _Proc. of AISec 2022_ , 2022, pp. 1–12.
  * [16] Z. Li, Y. Liu, X. He, N. Yu, M. Backes, and Y. Zhang, “Auditing membership leakages of multi-exit networks,” in _Proc. of CCS 2022_. ACM, 2022, pp. 1917–1931.
  * [17] J. Ye, A. Maddi, S. K. Murakonda, V. Bindschaedler, and R. Shokri, “Enhanced membership inference attacks against machine learning models,” in _Proc. of CCS 2022_. ACM, 2022, pp. 3093–3106.
  * [18] J. Hayes, L. Melis, G. Danezis, and E. D. Cristofaro, “LOGAN: membership inference attacks against generative models,” _Proceedings of Privacy Enhancing Technologies_ , vol. 2019, no. 1, pp. 133–152, 2019.
  * [19] S. Mukherjee, Y. Xu, A. Trivedi, N. Patowary, and J. L. Ferres, “privgan: Protecting gans from membership inference attacks at low cost to utility.” _Proceedings of Privacy Enhancing Technologies_ , vol. 2021, no. 3, pp. 142–163, 2021.
  * [20] T. Stadler, B. Oprisanu, and C. Troncoso, “Synthetic data – anonymisation groundhog day,” in _Proc. of USENIX Security 2022_ , 2022, pp. 1451–1468.
  * [21] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in _2017 IEEE symposium on security and privacy (SP)_. IEEE, 2017, pp. 3–18.
  * [22] A. Salem, Y. Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” in _Proc. of NDSS 2019_. The Internet Society, 2019.
  * [23] N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramèr, “Membership inference attacks from first principles,” in _Proc. of IEEE S &P 2022_. IEEE, 2022, pp. 1897–1914.
  * [24] L. Song, R. Shokri, and P. Mittal, “Membership inference attacks against adversarially robust deep learning models,” in _Proc. of IEEE SPW 2019_. IEEE, 2019, pp. 50–56.
  * [25] F. Tramèr, R. Shokri, A. San Joaquin, H. Le, M. Jagielski, S. Hong, and N. Carlini, “Truth serum: Poisoning machine learning models to reveal their secrets,” in _Proc. of CCS 2022_. ACM, 2022, pp. 2779–2792.
  * [26] S. Hidano, T. Murakami, S. Katsumata, S. Kiyomoto, and G. Hnnaoka, “Model inversion attacks for online prediction systems: Without knowledge of non-sensitive attributes,” _IEICE Transactions on Information and Systems_ , vol. E101.D, no. 11, pp. 2665–2676, 2018.
  * [27] Z. Wang, Y. Huang, M. Song, L. Wu, F. Xue, and K. Ren, “Poisoning-assisted property inference attack against federated learning,” _IEEE Transactions on Dependable and Secure Computing_ , pp. 1–13, 2022.
  * [28] S. Mahloujifar, E. Ghosh, and M. Chase, “Property inference from poisoning,” in _Proc. of IEEE S &P 2022_. IEEE, 2022, pp. 1569–1569.
  * [29] C. Dwork, “Differential privacy,” in _Proc. of ICALP_ , ser. LNCS, vol. 4052\. Springer, 2006, pp. 1–12.
  * [30] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in _Proceedings of the 2016 ACM SIGSAC conference on computer and communications security_ , 2016, pp. 308–318.
  * [31] S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in _Proc. of CSF 2018_. IEEE, 2018, pp. 268–282.
  * [32] B. Jayaraman and D. Evans, “Evaluating differentially private machine learning in practice,” in _Proc. of USENIX Security 2019_. USENIX Association, 2019, pp. 1895–1912.
  * [33] M. Jagielski, J. Ullman, and A. Oprea, “Auditing differentially private machine learning: How private is private sgd?” in _Advances in Neural Information Processing Systems_ , vol. 33. Curran Associates, Inc., 2020, pp. 22 205–22 216.
  * [34] D. Chen, N. Yu, Y. Zhang, and M. Fritz, “GAN-leaks: A taxonomy of membership inference attacks against generative models,” in _Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security_.
  * [35] Y. Wu, N. Yu, Z. Li, M. Backes, and Y. Zhang, “Membership inference attacks against text-to-image generation models,” _CoRR_ , vol. abs/2210.00968, 2022\. [Online]. Available: https://doi.org/10.48550/arXiv.2210.00968
  * [36] C. Song and V. Shmatikov, “Auditing data provenance in text-generation models,” in _Proc. of CCS 2019_. ACM, 2019, pp. 196–206.
  * [37] M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, G. Klambauer, and S. Hochreiter, “Gans trained by a two time-scale update rule converge to a nash equilibrium,” _CoRR_ , vol. abs/1706.08500, 2017.
  * [38] J. Song, C. Meng, and S. Ermon, “Denoising diffusion implicit models,” _CoRR_ , vol. abs/2010.02502, 2020.
  * [39] A. Nichol and P. Dhariwal, “Improved denoising diffusion probabilistic models,” _CoRR_ , vol. abs/2102.09672, 2021.
  * [40] A. Krizhevsky, G. Hinton _et al._ , “Learning multiple layers of features from tiny images,” 2009.
  * [41] Z. Liu, P. Luo, X. Wang, and X. Tang, “Deep learning face attributes in the wild,” _CoRR_ , vol. abs/1411.7766, 2014.
  * [42] A. Radford, L. Metz, and S. Chintala, “Unsupervised representation learning with deep convolutional generative adversarial networks,” in _4th International Conference on Learning Representations, ICLR 2016, San Juan, Puerto Rico, May 2-4, 2016, Conference Track Proceedings_ , Y. Bengio and Y. LeCun, Eds., 2016.