mlsanityData to 7 Oct 2026

Are Diffusion Models Vulnerable to Membership Inference Attacks?

arXiv 2302.01316 ↗First posted 2 Feb 2023cs.CV cs.AI cs.CRcited by 135

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Diffusion-based generative models have shown great potential for image synthesis, but there is a lack of research on the security and privacy risks they may pose. In this paper, we investigate the vulnerability of diffusion models to Membership Inference Attacks (MIAs), a common privacy concern. Our results indicate that existing MIAs designed for GANs or VAE are largely ineffective on diffusion models, either due to inapplicable scenarios (e.g., requiring the discriminator of GANs) or inappropriate assumptions (e.g., closer distances between synthetic samples and member samples). To address this gap, we propose Step-wise Error Comparing Membership Inference (SecMI), a query-based MIA that infers memberships by assessing the matching of forward process posterior estimation at each timestep. SecMI follows the common overfitting assumption in MIA where member samples normally have smaller estimation errors, compared with hold-out samples. We consider both the standard diffusion models, e.g., DDPM, and the text-to-image diffusion models, e.g., Latent Diffusion Models and Stable Diffusion. Experimental results demonstrate that our methods precisely infer the membership with high confidence on both of the two scenarios across multiple different datasets. Code is available at https://github.com/jinhaoduan/SecMI.

Key facts. Cited by 135 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 39 of its 57 references that are in the map. First posted on arXiv 2 Feb 2023.

Builds on

39 of 57 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023Extracting Training Data from Diffusion Models30 Jan
  2. 2023Membership Inference of Diffusion Models24 Jan

Other references · 37

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  4. 2020Denoising Diffusion Implicit Modelscited by 9,655
  5. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  6. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  7. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  8. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  9. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  10. 2022Classifier-Free Diffusion Guidancecited by 5,717
  11. 2022Generative Adversarial Networkscited by 5,603
  12. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,310
25 more
  1. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
  2. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  3. 2021On the Opportunities and Risks of Foundation Modelscited by 3,961
  4. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,580
  5. 2016Deep Learning with Differential Privacycited by 2,682
  6. 2019RandAugment: Practical automated data augmentation with a reduced search spacecited by 2,261
  7. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  8. 2021SDEdit: Guided Image Synthesis and Editing with Stochastic Differential Equationscited by 1,903
  9. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  10. 2020DiffWave: A Versatile Diffusion Model for Audio Synthesiscited by 1,339
  11. 2021Membership Inference Attacks From First Principlescited by 839
  12. 2021DiffusionCLIP: Text-Guided Diffusion Models for Robust Image Manipulationcited by 640
  13. 2021Tackling the Generative Learning Trilemma with Denoising Diffusion GANscited by 515
  14. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  15. 2020Label-Only Membership Inference Attackscited by 371
  16. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  17. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  18. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 241
  19. 2021Score-Based Generative Modeling with Critically-Damped Langevin Diffusioncited by 230
  20. 2022Learning Fast Samplers for Diffusion Models by Differentiating Through Sample Qualitycited by 181
  21. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  22. 2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 73
  23. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 66
  24. 2017Knock Knock, Who's There? Membership Inference on Aggregate Location Datacited by 63
  25. 2020On the Difficulty of Membership Inference Attackscited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 34; 2024: 43; 2025: 37; 2026: 21.

135 papers.

Sort:

By area:

  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  2. 2023A Comprehensive Survey of AI-Generated Content (AIGC): A History of Generative AI from GAN to ChatGPTcited by 221
  3. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 175
  4. 2024Detecting, Explaining, and Mitigating Memorization in Diffusion Modelscited by 94
  5. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 91
  6. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 90
  7. 2023Differentially Private Diffusion Models Generate Useful Synthetic Imagescited by 85
  8. 2023Membership Inference Attacks against Diffusion Modelscited by 84
  9. 2023Large AI Models in Health Informatics: Applications, Challenges, and the Futurecited by 61
  10. 2023A Reproducible Extraction of Training Images from Diffusion Modelscited by 60
  11. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initializationcited by 53
  12. 2024Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Datacited by 49
38 more
  1. 2023Exposing the Fake: Effective Diffusion-Generated Images Detectioncited by 48
  2. 2023White-box Membership Inference Attacks against Diffusion Modelscited by 42
  3. 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Modelscited by 41
  4. 2024Critical windows: non-asymptotic theory for feature emergence in diffusion modelscited by 41
  5. 2023T2IAT: Measuring Valence and Stereotypical Biases in Text-to-Image Generationcited by 39
  6. 2024Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancycited by 38
  7. 2023Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?cited by 37
  8. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
  9. 2024Advances and Open Challenges in Federated Foundation Modelscited by 33
  10. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  11. 2023DP-LDMs: Differentially Private Latent Diffusion Modelscited by 28
  12. 2024Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Modelscited by 28
  13. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generationcited by 26
  14. 2024Separable Multi-Concept Erasure from Diffusion Modelscited by 25
  15. 2024Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generationcited by 25
  16. 2023Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Modelscited by 22
  17. 2024DiffZOO: A Purely Query-Based Black-Box Attack for Red-teaming Text-to-Image Generative Model via Zeroth Order Optimizationcited by 19
  18. 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Modelscited by 19
  19. 2024Differentially Private Fine-Tuning of Diffusion Modelscited by 18
  20. 2023A Probabilistic Fluctuation based Membership Inference Attack for Diffusion Modelscited by 17
  21. 2023Membership Inference Attacks on Diffusion Models via Quantile Regressioncited by 17
  22. 2024Systematic Assessment of Tabular Data Synthesiscited by 17
  23. 2024Shake to Leak: Fine-tuning Diffusion Models Can Amplify the Generative Privacy Riskcited by 17
  24. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  25. 2024CDI: Copyrighted Data Identification in Diffusion Modelscited by 17
  26. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  27. 2024On Catastrophic Inheritance of Large Foundation Modelscited by 15
  28. 2025Privacy Attacks on Image AutoRegressive Modelscited by 15
  29. 2023Challenges and Remedies to Privacy and Security in AIGC: Exploring the Potential of Privacy Computing, Blockchain, and Beyondcited by 14
  30. 2024Towards Black-Box Membership Inference Attack for Diffusion Modelscited by 14
  31. 2023A Systematic Survey of Prompt Engineering on Vision-Language Foundation Modelscited by 12
  32. 2023Semantic Adversarial Attacks via Diffusion Modelscited by 12
  33. 2024Replication in Visual Diffusion Models: A Survey and Outlookcited by 11
  34. 2025The DCR Delusion: Measuring the Privacy Risk of Synthetic Datacited by 11
  35. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacycited by 10
  36. 2025Winning the MIDST Challenge: New Membership Inference Attacks on Diffusion Models for Tabular Data Synthesiscited by 10
  37. 2024Unveiling Structural Memorization: Structural Membership Inference Attack for Text-to-Image Diffusion Modelscited by 9
  38. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8

50 most cited of 135 All 135 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025On the MIA Vulnerability Gap Between Private GANs and Diffusion Models
  2. 2025Membership Inference Attacks for Face Images Against Fine-Tuned Latent Diffusion Models
  3. 2026Adaptive Diffusion Freezing: Privacy-preserving Diffusion Models Against Membership Inference Attacks
  4. 2025Embedding Hidden Adversarial Capabilities in Pre-Trained Diffusion Models
  5. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Survey
  6. 2024Adversarial Examples are Misaligned in Diffusion Model Manifolds
  7. 2024Privacy-Preserving Low-Rank Adaptation against Membership Inference Attacks for Latent Diffusion Models
  8. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitation