mlsanityData to 14 Oct 2026

Towards More Realistic Membership Inference Attacks on Large Diffusion Models

arXiv 2306.12983 ↗First posted 22 Jun 2023cs.LG cs.CR cs.CVcited by 41

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Generative diffusion models, including Stable Diffusion and Midjourney, can generate visually appealing, diverse, and high-resolution images for various applications. These models are trained on billions of internet-sourced images, raising significant concerns about the potential unauthorized use of copyright-protected images. In this paper, we examine whether it is possible to determine if a specific image was used in the training set, a problem known in the cybersecurity community and referred to as a membership inference attack. Our focus is on Stable Diffusion, and we address the challenge of designing a fair evaluation framework to answer this membership question. We propose a methodology to establish a fair evaluation setup and apply it to Stable Diffusion, enabling potential extensions to other generative models. Utilizing this evaluation setup, we execute membership attacks (both known and newly introduced). Our research reveals that previously proposed evaluation setups do not provide a full understanding of the effectiveness of membership inference attacks. We conclude that the membership inference attack remains a significant challenge for large diffusion models (often deployed as black-box systems), indicating that related privacy and copyright issues will persist in the foreseeable future.

Key facts. Cited by 41 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 19 of its 45 references that are in the map. First posted on arXiv 22 Jun 2023.

Builds on

19 of 45 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  2. 2023Extracting Training Data from Diffusion Models30 Jan

Other references · 17

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  4. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  6. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  7. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  8. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  9. 2022Generative Adversarial Networkscited by 5,627
  10. 2021Zero-Shot Text-to-Image Generationcited by 4,288
  11. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
  12. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
5 more
  1. 2021Membership Inference Attacks From First Principlescited by 878
  2. 2020Beyond English-Centric Multilingual Machine Translationcited by 561
  3. 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 248
  4. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 69
  5. 2019Language Identification on Massive Datasets of Short Message using an Attention Mechanism CNNcited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 5; 2024: 18; 2025: 8; 2026: 10.

41 papers.

Sort:

By area:

  1. 2024Blind Baselines Beat Membership Inference Attacks for Foundation Modelscited by 69
  2. 2024Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancycited by 38
  3. 2024Evaluations of Machine Learning Privacy Defenses are Misleadingcited by 36
  4. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
  5. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  6. 2023Traces of Memorisation in Large Language Models for Codecited by 29
  7. 2024Separable Multi-Concept Erasure from Diffusion Modelscited by 28
  8. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  9. 2024CDI: Copyrighted Data Identification in Diffusion Modelscited by 17
  10. 2025Privacy Attacks on Image AutoRegressive Modelscited by 15
  11. 2024On the Limitations and Prospects of Machine Unlearning for Generative AIcited by 12
  12. 2024Replication in Visual Diffusion Models: A Survey and Outlookcited by 11
29 more
  1. 2024Privacy-Preserving Low-Rank Adaptation against Membership Inference Attacks for Latent Diffusion Modelscited by 9
  2. 2024GLiRA: Black-Box Membership Inference Attack via Knowledge Distillationcited by 7
  3. 2024Mitigating Privacy Risk in Membership Inference by Convex-Concave Losscited by 6
  4. 2024Trustworthy Text-to-Image Diffusion Models: A Timely and Focused Surveycited by 6
  5. 2023VA3: Virtually Assured Amplification Attack on Probabilistic Copyright Protection for Text-to-Image Generative Modelscited by 5
  6. 2026Membership Inference Attacks Against Fine-tuned Diffusion Language Modelscited by 5
  7. 2023Privacy Threats in Stable Diffusion Modelscited by 3
  8. 2024CPSample: Classifier Protected Sampling for Guarding Training Data During Diffusioncited by 3
  9. 2025How does Bayesian Sampling help Membership Inference Attacks?cited by 2
  10. 2025Auditing Data Provenance in Real-world Text-to-Image Diffusion Models for Privacy and Copyright Protectioncited by 2
  11. 2025Membership and Dataset Inference Attacks on Large Audio Generative Modelscited by 2
  12. 2026Inference Attacks Against Graph Generative Diffusion Modelscited by 2
  13. 2024Real-World Benchmarks Make Membership Inference Attacks Fail on Diffusion Modelscited by 1
  14. 2025Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspectivecited by 1
  15. 2025SoK: Can Synthetic Images Replace Real Data? A Survey of Utility and Privacy of Synthetic Image Generationcited by 1
  16. 2026Model See, Model Do? Exposure-Aware Evaluation of Bug-vs-Fix Preference in Code LLMscited by 1
  17. 2026The Reliability Gap in Benchmark Auditing: Distribution Shift and Scale as Failure Modes of Contamination Detectioncited by 1
  18. 2023DIAGNOSIS: Detecting Unauthorized Data Usages in Text-to-image Diffusion Modelscited by 0
  19. 2024Tracing the Roots: Leveraging Temporal Dynamics in Diffusion Trajectories for Origin Attributioncited by 0
  20. 2024Exploiting Watermark-Based Defense Mechanisms in Text-to-Image Diffusion Models for Unauthorized Data Usagecited by 0
  21. 2024DREAM: Domain-agnostic Reverse Engineering Attributes of Black-box Modelcited by 0
  22. 2025Membership Inference Attacks for Face Images Against Fine-Tuned Latent Diffusion Modelscited by 0
  23. 2025FiMMIA: scaling semantic perturbation-based membership inference across modalitiescited by 0
  24. 2026PDR: A Plug-and-Play Positional Decay Framework for LLM Pre-training Data Detectioncited by 0
  25. 2026No Caption, No Problem: Caption-Free Membership Inference via Model-Fitted Embeddingscited by 0
  26. 2026Black-box Membership Inference Attacks on the Pre-training Data of Image-generation Modelscited by 0
  27. 2026NAMESAKES: Probing Identity Memorization in Text-to-Image Modelscited by 0
  28. 2026Dataset Usage Inference without Shadow Models or Held-out Datacited by 0
  29. 2026From Modes to Memories: Characterizing the Scale-Space Dynamics of Diffusion Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise
  2. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacy
  3. 2024Towards Black-Box Membership Inference Attack for Diffusion Models
  4. 2023Membership Inference Attacks on Diffusion Models via Quantile Regression
  5. 2023Membership Inference Attacks against Diffusion Models
  6. 2024Dual-Model Defense: Safeguarding Diffusion Models from Membership Inference Attacks through Disjoint Data Splitting
  7. 2023Membership Inference of Diffusion Models
  8. 2024Model Will Tell: Training Membership Inference for Diffusion Models