Towards Black-Box Membership Inference Attack for Diffusion Models
Authors: Jingwei Li, Jing Dong, Tianxing He, Jingzhao Zhang
ICML 2025 | Venue PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | We validate our method using DDIM and Stable Diffusion setups and further extend both our approach and existing algorithms to the Diffusion Transformer architecture. Our experimental results consistently outperform previous methods. |
| Researcher Affiliation | Academia | 1Institute for Interdisciplinary Information Sciences, Tsinghua University 2Shanghai Qizhi Institute 3The Chinese University of Hong Kong. |
| Pseudocode | Yes | Algorithm 1 MIA through REDIFFUSE |
| Open Source Code | Yes | Code is available at https://github.com/lijingwei0502/diffusion_mia. |
| Open Datasets | Yes | We evaluate our method using DDIM (Song et al., 2020a) and Stable Diffusion (Rombach et al., 2022) models on classical datasets, including CIFAR10/100 (Krizhevsky et al., 2009), STL10-Unlabeled (Coates et al., 2011), LAION-5B (Schuhmann et al., 2022), etc. |
| Dataset Splits | Yes | For all the datasets, we randomly select 50% of the training samples to train the model and denote them as members. The remaining 50% are utilized as nonmembers. ... For the membership inference attack setup, 1000 images are randomly chosen from our training set as the member set, and another 1000 images are randomly selected from the Image Net validation set as the non-member set. |
| Hardware Specification | Yes | We use NVIDIA RTX 6000 graphics cards for all our experiments. |
| Software Dependencies | No | The paper mentions software components like DDIM, Stable Diffusion, Diffusion Transformer, Res Net-18, BLIP, and Huggingface, but does not specify their version numbers for reproducibility. |
| Experiment Setup | Yes | We fix the diffusion step at t = 200, and independently call the variation API 10 times to take the average of the output images as ˆx. ... The training iterations are set to 800,000. ... For the 128x128 image size, we use 200,000 training iterations. For the 256x256 image size, we use 300,000 training iterations. ... We fix the diffusion step at t = 150 and the DDIM step at k = 50, and we independently call the variation API 10 times to take the average of the output images as ˆx. ... We fix the diffusion step at t = 10 to call the variation API and directly use the SSIM metric (Wang et al., 2004) to measure the differences between two images. |