mlsanityData to 7 Oct 2026

Membership Inference Attacks Against Text-to-image Generation Models

arXiv 2210.00968 ↗First posted 3 Oct 2022cs.CR cs.LGcited by 66

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Text-to-image generation models have recently attracted unprecedented attention as they unlatch imaginative applications in all areas of life. However, developing such models requires huge amounts of data that might contain privacy-sensitive information, e.g., face identity. While privacy risks have been extensively demonstrated in the image classification and GAN generation domains, privacy risks in the text-to-image generation domain are largely unexplored. In this paper, we perform the first privacy analysis of text-to-image generation models through the lens of membership inference. Specifically, we propose three key intuitions about membership information and design four attack methodologies accordingly. We conduct comprehensive evaluations on two mainstream text-to-image generation models including sequence-to-sequence modeling and diffusion-based modeling. The empirical results show that all of the proposed attacks can achieve significant performance, in some cases even close to an accuracy of 1, and thus the corresponding risk is much more severe than that shown by existing membership inference attacks. We further conduct an extensive ablation study to analyze the factors that may affect the attack performance, which can guide developers and researchers to be alert to vulnerabilities in text-to-image generation models. All these findings indicate that our proposed attacks pose a realistic privacy threat to the text-to-image generation models.

Key facts. Cited by 66 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 33 of its 39 references that are in the map. First posted on arXiv 3 Oct 2022.

Builds on

33 of 39 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022Membership Inference Attacks by Exploiting Loss Trajectory31 Aug
  2. 2022Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Models22 Aug
  3. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models4 Feb
  4. 2021Practical Blind Membership Inference Attack via Differential Comparisons5 Jan

Other references · 29

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  3. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  4. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  5. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,310
  6. 2021Zero-Shot Text-to-Image Generationcited by 4,276
  7. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  8. 2016Visual Genome: Connecting Language and Vision Using Crowdsourced Dense Image Annotationscited by 2,646
  9. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  10. 2021LAION-400M: Open Dataset of CLIP-Filtered 400 Million Image-Text Pairscited by 1,544
  11. 2015Microsoft COCO Captions: Data Collection and Evaluation Servercited by 1,447
  12. 2022Scaling Autoregressive Models for Content-Rich Text-to-Image Generationcited by 1,287
17 more
  1. 2021Conceptual 12M: Pushing Web-Scale Image-Text Pre-Training To Recognize Long-Tail Visual Conceptscited by 1,209
  2. 2021CogView: Mastering Text-to-Image Generation via Transformerscited by 691
  3. 2021ClipCap: CLIP Prefix for Image Captioningcited by 557
  4. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  5. 2020Label-Only Membership Inference Attackscited by 371
  6. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  7. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  8. 2021General Facial Representation Learning in a Visual-Linguistic Mannercited by 193
  9. 2019RetinaFace: Single-stage Dense Face Localisation in the Wildcited by 164
  10. 2020Membership Leakage in Label-Only Exposurescited by 156
  11. 2016Discrete Variational Autoencoderscited by 124
  12. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  13. 2021Membership Inference Attack on Graph Neural Networkscited by 81
  14. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 80
  15. 2019How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNNcited by 58
  16. 2021Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implicationscited by 50
  17. 2022Auditing Membership Leakages of Multi-Exit Networkscited by 26

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 23; 2024: 25; 2025: 9; 2026: 9.

66 papers.

Sort:

By area:

  1. 2023Extracting Training Data from Diffusion Modelscited by 723
  2. 2023Text-to-image Diffusion Models in Generative AI: A Surveycited by 264
  3. 2023A Comprehensive Survey of AI-Generated Content (AIGC): A History of Generative AI from GAN to ChatGPTcited by 221
  4. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 175
  5. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 135
  6. 2023Membership Inference Attacks against Diffusion Modelscited by 84
  7. 2024Unlearning Concepts in Diffusion Model via Concept Domain Correction and Concept Preserving Gradientcited by 69
  8. 2023On the Generalization Properties of Diffusion Modelscited by 67
  9. 2024Blind Baselines Beat Membership Inference Attacks for Foundation Modelscited by 65
  10. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  11. 2023Prompt Stealing Attacks Against Text-to-Image Generation Modelscited by 48
  12. 2023Membership Inference of Diffusion Modelscited by 46
38 more
  1. 2023White-box Membership Inference Attacks against Diffusion Modelscited by 42
  2. 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Modelscited by 41
  3. 2023T2IAT: Measuring Valence and Stereotypical Biases in Text-to-Image Generationcited by 39
  4. 2024Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancycited by 38
  5. 2024Membership Inference Attacks Against In-Context Learningcited by 38
  6. 2023Practical Membership Inference Attacks Against Large-Scale Multi-Modal Models: A Pilot Studycited by 37
  7. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
  8. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  9. 2023Fair Text-to-Image Diffusion via Fair Mappingcited by 31
  10. 2023DP-LDMs: Differentially Private Latent Diffusion Modelscited by 28
  11. 2025Bigger Isn't Always Memorizing: Early Stopping Overparameterized Diffusion Modelscited by 24
  12. 2024SeqMIA: Sequential-Metric Based Membership Inference Attackcited by 19
  13. 2024Differentially Private Fine-Tuning of Diffusion Modelscited by 18
  14. 2024Shake to Leak: Fine-tuning Diffusion Models Can Amplify the Generative Privacy Riskcited by 17
  15. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  16. 2024Towards Black-Box Membership Inference Attack for Diffusion Modelscited by 14
  17. 2023A Systematic Survey of Prompt Engineering on Vision-Language Foundation Modelscited by 12
  18. 2024On the Limitations and Prospects of Machine Unlearning for Generative AIcited by 12
  19. 2023EKILA: Synthetic Media Provenance and Attribution for Generative Artcited by 11
  20. 2024Replication in Visual Diffusion Models: A Survey and Outlookcited by 11
  21. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacycited by 10
  22. 2024Range Membership Inference Attackscited by 10
  23. 2024Privacy-Preserving Low-Rank Adaptation against Membership Inference Attacks for Latent Diffusion Modelscited by 9
  24. 2024Improving Robustness to Model Inversion Attacks via Sparse Coding Architecturescited by 8
  25. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  26. 2024DP-TLDM: Differentially Private Tabular Latent Diffusion Modelcited by 5
  27. 2026Membership Inference Attacks Against Fine-tuned Diffusion Language Modelscited by 5
  28. 2023Discriminative Adversarial Privacy: Balancing Accuracy and Membership Privacy in Neural Networkscited by 4
  29. 2023PriSampler: Mitigating Property Inference of Diffusion Modelscited by 4
  30. 2025Synthetic Artifact Auditing: Tracing LLM-Generated Synthetic Data Usage in Downstream Applicationscited by 4
  31. 2026VidLeaks: Membership Inference Attacks Against Text-to-Video Modelscited by 4
  32. 2024CPSample: Classifier Protected Sampling for Guarding Training Data During Diffusioncited by 3
  33. 2024Dual-Model Defense: Safeguarding Diffusion Models from Membership Inference Attacks through Disjoint Data Splittingcited by 3
  34. 2025Responsible Diffusion: A Comprehensive Survey on Safety, Ethics, and Trust in Diffusion Modelscited by 3
  35. 2023On the Inherent Privacy Properties of Discrete Denoising Diffusion Modelscited by 2
  36. 2024Inference Attacks: A Taxonomy, Survey, and Promising Directionscited by 2
  37. 2024Membership Inference Attack Against Masked Image Modelingcited by 2
  38. 2024Promptly Yours? A Human Subject Study on Prompt Inference in AI-Generated Artcited by 2

50 most cited of 66 All 66 (JSON)