mlsanityData to 14 Oct 2026

A Probabilistic Fluctuation based Membership Inference Attack for Diffusion Models

arXiv 2308.12143 ↗First posted 23 Aug 2023cs.LG cs.AI cs.CRcited by 18

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Membership Inference Attack (MIA) identifies whether a record exists in a machine learning model's training set by querying the model. MIAs on the classic classification models have been well-studied, and recent works have started to explore how to transplant MIA onto generative models. Our investigation indicates that existing MIAs designed for generative models mainly depend on the overfitting in target models. However, overfitting can be avoided by employing various regularization techniques, whereas existing MIAs demonstrate poor performance in practice. Unlike overfitting, memorization is essential for deep learning models to attain optimal performance, making it a more prevalent phenomenon. Memorization in generative models leads to an increasing trend in the probability distribution of generating records around the member record. Therefore, we propose a Probabilistic Fluctuation Assessing Membership Inference Attack (PFAMI), a black-box MIA that infers memberships by detecting these trends via analyzing the overall probabilistic fluctuations around given records. We conduct extensive experiments across multiple generative models and datasets, which demonstrate PFAMI can improve the attack success rate (ASR) by about 27.9% when compared with the best baseline.

Key facts. Cited by 18 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 26 of its 46 references that are in the map. First posted on arXiv 23 Aug 2023.

Builds on

26 of 46 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  2. 2023Extracting Training Data from Diffusion Models30 Jan

Other references · 24

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  4. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  6. 2020Denoising Diffusion Implicit Modelscited by 9,781
  7. 2021On the Opportunities and Risks of Foundation Modelscited by 4,033
  8. 2014Deep Learning Face Attributes in the Wildcited by 3,693
  9. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  10. 2022Pseudo Numerical Methods for Diffusion Models on Manifoldscited by 700
  11. 2021CSDI: Conditional Score-based Diffusion Models for Probabilistic Time Series Imputationcited by 582
  12. 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 497
12 more
  1. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 460
  2. 2020Label-Only Membership Inference Attackscited by 388
  3. 2017Wasserstein Auto-Encoderscited by 373
  4. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 321
  5. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
  6. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 246
  7. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  8. 2023Art and the science of generative AI: A deeper divecited by 95
  9. 2023Membership Inference Attacks against Synthetic Data through Overfitting Detectioncited by 66
  10. 2021On Memorization in Probabilistic Deep Generative Modelscited by 60
  11. 2021Data Augmentation in High Dimensional Low Sample Size Setting Using a Geometry-Based Variational Autoencodercited by 27
  12. 2018Performing Co-Membership Attacks Against Deep Generative Modelscited by 26

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 3; 2024: 4; 2025: 6; 2026: 5.

18 papers.

Sort:

By area:

  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
  2. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 98
  3. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 67
  4. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
  5. 2024MIA-Tuner: Adapting Large Language Models as Pre-training Text Detectorcited by 15
  6. 2024Replication in Visual Diffusion Models: A Survey and Outlookcited by 11
  7. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  8. 2025ICAS: Detecting Training Data from Autoregressive Image Generative Modelscited by 6
  9. 2025ArtistAuditor: Auditing Artist Style Pirate in Text-to-Image Generation Modelscited by 5
  10. 2026Membership Inference Attacks Against Fine-tuned Diffusion Language Modelscited by 5
  11. 2025Score-based Membership Inference on Diffusion Modelscited by 3
  12. 2025Auditing Data Provenance in Real-world Text-to-Image Diffusion Models for Privacy and Copyright Protectioncited by 2
6 more
  1. 2025Latent Diffusion Inversion Requires Understanding the Latent Spacecited by 2
  2. 2024Real-World Benchmarks Make Membership Inference Attacks Fail on Diffusion Modelscited by 1
  3. 2026Your Unlearning Gives You Away: Identifying Erased Concepts in Diffusion Modelscited by 1
  4. 2026No Caption, No Problem: Caption-Free Membership Inference via Model-Fitted Embeddingscited by 0
  5. 2026Generalization and Memorization in Rectified Flowcited by 0
  6. 2026Membership Inference in Fine-tuned Diffusion Language Models via Token-level Memorization Asymmetrycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025MIA-EPT: Membership Inference Attack via Error Prediction for Tabular Data
  2. 2025Defending Diffusion Models Against Membership Inference Attacks via Higher-Order Langevin Dynamics
  3. 2026Black-box Membership Inference Attacks on the Pre-training Data of Image-generation Models
  4. 2025Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective
  5. 2023Membership Inference Attacks against Diffusion Models
  6. 2026Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise
  7. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initialization
  8. 2023Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Models