mlsanityData to 7 Oct 2026

Membership Inference of Diffusion Models

arXiv 2301.09956 ↗First posted 24 Jan 2023cs.CR cs.LGcited by 46

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Recent years have witnessed the tremendous success of diffusion models in data synthesis. However, when diffusion models are applied to sensitive data, they also give rise to severe privacy concerns. In this paper, we systematically present the first study about membership inference attacks against diffusion models, which aims to infer whether a sample was used to train the model. Two attack methods are proposed, namely loss-based and likelihood-based attacks. Our attack methods are evaluated on several state-of-the-art diffusion models, over different datasets in relation to privacy-sensitive data. Extensive experimental evaluations show that our attacks can achieve remarkable performance. Furthermore, we exhaustively investigate various factors which can affect attack performance. Finally, we also evaluate the performance of our attack methods on diffusion models trained with differential privacy.

Key facts. Cited by 46 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 33 of its 41 references that are in the map. First posted on arXiv 24 Jan 2023.

Builds on

33 of 41 references.

References · 33

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  3. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  4. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  5. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  6. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
  7. 2022Generative Adversarial Networkscited by 5,603
  8. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  9. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  10. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  11. 2016Deep Learning with Differential Privacycited by 2,682
  12. 2022Video Diffusion Modelscited by 2,280
21 more
  1. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  2. 2020Extracting Training Data from Large Language Modelscited by 2,144
  3. 2020DiffWave: A Versatile Diffusion Model for Audio Synthesiscited by 1,339
  4. 2021Palette: Image-to-Image Diffusion Modelscited by 1,296
  5. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  6. 2021Membership Inference Attacks From First Principlescited by 839
  7. 2018FFJORD: Free-form Continuous Dynamics for Scalable Reversible Generative Modelscited by 584
  8. 2022Zero-Shot Image Restoration Using Denoising Diffusion Null-Space Modelcited by 574
  9. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  10. 2022Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Modelscited by 418
  11. 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 375
  12. 2020Label-Only Membership Inference Attackscited by 371
  13. 2022Diffusion Models for Medical Image Analysis: A Comprehensive Surveycited by 269
  14. 2022Brain Imaging Generation with Latent Diffusion Modelscited by 267
  15. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
  16. 2018Data Synthesis based on Generative Adversarial Networkscited by 184
  17. 2020Membership Leakage in Label-Only Exposurescited by 156
  18. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  19. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 93
  20. 2020ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learningcited by 66
  21. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 66

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 20; 2024: 13; 2025: 7; 2026: 6.

46 papers.

Sort:

By area:

  1. 2023Extracting Training Data from Diffusion Modelscited by 723
  2. 2023A Comprehensive Survey of AI-Generated Content (AIGC): A History of Generative AI from GAN to ChatGPTcited by 221
  3. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 135
  4. 2023Differentially Private Diffusion Models Generate Useful Synthetic Imagescited by 85
  5. 2023Membership Inference Attacks against Diffusion Modelscited by 84
  6. 2023On the Generalization Properties of Diffusion Modelscited by 67
  7. 2023A Reproducible Extraction of Training Images from Diffusion Modelscited by 60
  8. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initializationcited by 53
  9. 2023White-box Membership Inference Attacks against Diffusion Modelscited by 42
  10. 2023T2IAT: Measuring Valence and Stereotypical Biases in Text-to-Image Generationcited by 39
  11. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
  12. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
34 more
  1. 2023DP-LDMs: Differentially Private Latent Diffusion Modelscited by 28
  2. 2025Bigger Isn't Always Memorizing: Early Stopping Overparameterized Diffusion Modelscited by 24
  3. 2023Privacy Distillation: Reducing Re-identification Risk of Multimodal Diffusion Modelscited by 18
  4. 2024Differentially Private Fine-Tuning of Diffusion Modelscited by 18
  5. 2024Shake to Leak: Fine-tuning Diffusion Models Can Amplify the Generative Privacy Riskcited by 17
  6. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  7. 2024Towards Black-Box Membership Inference Attack for Diffusion Modelscited by 14
  8. 2023EKILA: Synthetic Media Provenance and Attribution for Generative Artcited by 11
  9. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacycited by 10
  10. 2025One-Step Offline Distillation of Diffusion-based Models via Koopman Modelingcited by 9
  11. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  12. 2024U Can't Gen This? A Survey of Intellectual Property Protection Methods for Data in Generative AIcited by 7
  13. 2024Dataset Size Recovery from LoRA Weightscited by 7
  14. 2024Exploring Privacy and Fairness Risks in Sharing Diffusion Models: An Adversarial Perspectivecited by 6
  15. 2024DP-TLDM: Differentially Private Tabular Latent Diffusion Modelcited by 5
  16. 2025OVERT: A Benchmark for Over-Refusal Evaluation on Text-to-Image Modelscited by 5
  17. 2026Membership Inference Attacks Against Fine-tuned Diffusion Language Modelscited by 5
  18. 2023Discriminative Adversarial Privacy: Balancing Accuracy and Membership Privacy in Neural Networkscited by 4
  19. 2023PriSampler: Mitigating Property Inference of Diffusion Modelscited by 4
  20. 2024An Efficient Framework for Crediting Data Contributors of Diffusion Modelscited by 4
  21. 2024CPSample: Classifier Protected Sampling for Guarding Training Data During Diffusioncited by 3
  22. 2025Quantifying the Privacy Implications of High-Fidelity Synthetic Network Trafficcited by 3
  23. 2023On the Inherent Privacy Properties of Discrete Denoising Diffusion Modelscited by 2
  24. 2025Towards Effective Prompt Stealing Attack against Text-to-Image Diffusion Modelscited by 2
  25. 2026Inference Attacks Against Graph Generative Diffusion Modelscited by 2
  26. 2023Quantum Solutions to the Privacy vs. Utility Tradeoffcited by 1
  27. 2025SoK: Can Synthetic Images Replace Real Data? A Survey of Utility and Privacy of Synthetic Image Generationcited by 1
  28. 2024Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Themcited by 0
  29. 2024What happens to diffusion model likelihood when your model is conditional?cited by 0
  30. 2025Noise Aggregation Analysis Driven by Small-Noise Injection: Efficient Membership Inference for Diffusion Modelscited by 0
  31. 2026FERMI: Exploiting Relations for Membership Inference Against Tabular Diffusion Modelscited by 0
  32. 2026Privacy Evaluation of Generative Models for Trajectory Generationcited by 0
  33. 2026Picture the Epsilon: Pursuing Identity-Level Privacy Guarantees for Imagescited by 0
  34. 2026Hearing the Whispers: Black-Box Membership Inference Attacks on Finetuned TTS Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise
  2. 2023Membership Inference Attacks on Diffusion Models via Quantile Regression
  3. 2025Score-based Membership Inference on Diffusion Models
  4. 2025Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective
  5. 2023Privacy Threats in Stable Diffusion Models
  6. 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Models
  7. 2025Winning the MIDST Challenge: New Membership Inference Attacks on Diffusion Models for Tabular Data Synthesis
  8. 2024Real-World Benchmarks Make Membership Inference Attacks Fail on Diffusion Models