mlsanityData to 7 Oct 2026

Membership Inference Attacks against Diffusion Models

arXiv 2302.03262 ↗First posted 7 Feb 2023cs.CR cs.LGcited by 84

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Diffusion models have attracted attention in recent years as innovative generative models. In this paper, we investigate whether a diffusion model is resistant to a membership inference attack, which evaluates the privacy leakage of a machine learning model. We primarily discuss the diffusion model from the standpoints of comparison with a generative adversarial network (GAN) as conventional models and hyperparameters unique to the diffusion model, i.e., time steps, sampling steps, and sampling variances. We conduct extensive experiments with DDIM as a diffusion model and DCGAN as a GAN on the CelebA and CIFAR-10 datasets in both white-box and black-box settings and then confirm if the diffusion model is comparably resistant to a membership inference attack as GAN. Next, we demonstrate that the impact of time steps is significant and intermediate steps in a noise schedule are the most vulnerable to the attack. We also found two key insights through further analysis. First, we identify that DDIM is vulnerable to the attack for small sample sizes instead of achieving a lower FID. Second, sampling steps in hyperparameters are important for resistance to the attack, whereas the impact of sampling variances is quite limited.

Key facts. Cited by 84 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 30 of its 41 references that are in the map. First posted on arXiv 7 Feb 2023.

Builds on

30 of 41 references.

Closest ancestors · 3

Same direction, newest first

  1. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  2. 2023Extracting Training Data from Diffusion Models30 Jan
  3. 2023Membership Inference of Diffusion Models24 Jan

Other references · 27

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  3. 2020Denoising Diffusion Implicit Modelscited by 9,655
  4. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  5. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  6. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  7. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  8. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
  9. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  10. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  11. 2016Deep Learning with Differential Privacycited by 2,682
  12. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
15 more
  1. 2015Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networkscited by 2,048
  2. 2021Membership Inference Attacks From First Principlescited by 839
  3. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  4. 2018Generative Adversarial Network in Medical Imaging: A Reviewcited by 257
  5. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 237
  6. 2020Auditing Differentially Private Machine Learning: How Private is Private SGD?cited by 213
  7. 2017GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibriumcited by 208
  8. 2017Generating Multi-label Discrete Patient Records using Generative Adversarial Networkscited by 197
  9. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  10. 2020Synthetic Data -- Anonymisation Groundhog Daycited by 105
  11. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  12. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 66
  13. 2021Property Inference From Poisoningcited by 56
  14. 2022Auditing Membership Leakages of Multi-Exit Networkscited by 26
  15. 2022Label-Only Membership Inference Attack against Node-Level Graph Neural Networkscited by 18

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 19; 2024: 23; 2025: 26; 2026: 16.

84 papers.

Sort:

By area:

  1. 2023A Comprehensive Survey of AI-Generated Content (AIGC): A History of Generative AI from GAN to ChatGPTcited by 221
  2. 2024Detecting, Explaining, and Mitigating Memorization in Diffusion Modelscited by 94
  3. 2023On the Generalization Properties of Diffusion Modelscited by 67
  4. 2023A Reproducible Extraction of Training Images from Diffusion Modelscited by 60
  5. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initializationcited by 53
  6. 2023Exposing the Fake: Effective Diffusion-Generated Images Detectioncited by 48
  7. 2023White-box Membership Inference Attacks against Diffusion Modelscited by 42
  8. 2024Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancycited by 38
  9. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
  10. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  11. 2023DP-LDMs: Differentially Private Latent Diffusion Modelscited by 28
  12. 2025Bigger Isn't Always Memorizing: Early Stopping Overparameterized Diffusion Modelscited by 24
38 more
  1. 2023Selective Pre-training for Private Fine-tuningcited by 22
  2. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  3. 2024Towards Black-Box Membership Inference Attack for Diffusion Modelscited by 14
  4. 2023PrivImage: Differentially Private Synthetic Image Generation using Diffusion Models with Semantic-Aware Pretrainingcited by 12
  5. 2024On the Limitations and Prospects of Machine Unlearning for Generative AIcited by 12
  6. 2024Replication in Visual Diffusion Models: A Survey and Outlookcited by 11
  7. 2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
  8. 2025DPImageBench: A Unified Benchmark for Differentially Private Image Synthesiscited by 11
  9. 2025Membership Inference Attacks as Privacy Tools: Reliability, Disparity and Ensemblecited by 11
  10. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacycited by 10
  11. 2024Privacy-Preserving Low-Rank Adaptation against Membership Inference Attacks for Latent Diffusion Modelscited by 9
  12. 2024U Can't Gen This? A Survey of Intellectual Property Protection Methods for Data in Generative AIcited by 7
  13. 2024Dataset Size Recovery from LoRA Weightscited by 7
  14. 2025Trustworthy Machine Learning via Memorization and the Granular Long-Tail: A Survey on Interactions, Tradeoffs, and Beyondcited by 6
  15. 2025ICAS: Detecting Training Data from Autoregressive Image Generative Modelscited by 6
  16. 2024Model Will Tell: Training Membership Inference for Diffusion Modelscited by 5
  17. 2024Risks When Sharing LoRA Fine-Tuned Diffusion Model Weightscited by 5
  18. 2025ArtistAuditor: Auditing Artist Style Pirate in Text-to-Image Generation Modelscited by 5
  19. 2026Membership Inference Attacks Against Fine-tuned Diffusion Language Modelscited by 5
  20. 2023PriSampler: Mitigating Property Inference of Diffusion Modelscited by 4
  21. 2024Privacy-Preserving Diffusion Model Using Homomorphic Encryptioncited by 4
  22. 2023Privacy Threats in Stable Diffusion Modelscited by 3
  23. 2023Adaptive Domain Inference Attack with Concept Hierarchycited by 3
  24. 2024CPSample: Classifier Protected Sampling for Guarding Training Data During Diffusioncited by 3
  25. 2024Dual-Model Defense: Safeguarding Diffusion Models from Membership Inference Attacks through Disjoint Data Splittingcited by 3
  26. 2025Has My System Prompt Been Used? Large Language Model Prompt Membership Inferencecited by 3
  27. 2025Frequency-Calibrated Membership Inference Attacks on Medical Image Diffusion Modelscited by 3
  28. 2025Responsible Diffusion: A Comprehensive Survey on Safety, Ethics, and Trust in Diffusion Modelscited by 3
  29. 2025Score-based Membership Inference on Diffusion Modelscited by 3
  30. 2025Quantifying the Privacy Implications of High-Fidelity Synthetic Network Trafficcited by 3
  31. 2025In-Context Probing for Membership Inference in Fine-Tuned Language Modelscited by 3
  32. 2025What Lurks Within? Concept Auditing for Shared Diffusion Models at Scalecited by 2
  33. 2025Auditing Data Provenance in Real-world Text-to-Image Diffusion Models for Privacy and Copyright Protectioncited by 2
  34. 2025Membership Inference Attacks with False Discovery Rate Controlcited by 2
  35. 2025Membership Inference Attacks on Recommender System: A Surveycited by 2
  36. 2025Latent Diffusion Inversion Requires Understanding the Latent Spacecited by 2
  37. 2026Inference Attacks Against Graph Generative Diffusion Modelscited by 2
  38. 2023Quantum Solutions to the Privacy vs. Utility Tradeoffcited by 1

50 most cited of 84 All 84 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Models
  2. 2023Membership Inference Attacks on Diffusion Models via Quantile Regression
  3. 2025On the MIA Vulnerability Gap Between Private GANs and Diffusion Models
  4. 2024Real-World Benchmarks Make Membership Inference Attacks Fail on Diffusion Models
  5. 2024Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Models
  6. 2023Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Models
  7. 2024Exploring Privacy and Fairness Risks in Sharing Diffusion Models: An Adversarial Perspective
  8. 2025Winning the MIDST Challenge: New Membership Inference Attacks on Diffusion Models for Tabular Data Synthesis