mlsanityData to 7 Oct 2026

Privacy Threats in Stable Diffusion Models

arXiv 2311.09355 ↗First posted 15 Nov 2023cs.CV cs.AI cs.LGcited by 3

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

This paper introduces a novel approach to membership inference attacks (MIA) targeting stable diffusion computer vision models, specifically focusing on the highly sophisticated Stable Diffusion V2 by StabilityAI. MIAs aim to extract sensitive information about a model's training data, posing significant privacy concerns. Despite its advancements in image synthesis, our research reveals privacy vulnerabilities in the stable diffusion models' outputs. Exploiting this information, we devise a black-box MIA that only needs to query the victim model repeatedly. Our methodology involves observing the output of a stable diffusion model at different generative epochs and training a classification model to distinguish when a series of intermediates originated from a training sample or not. We propose numerous ways to measure the membership features and discuss what works best. The attack's efficacy is assessed using the ROC AUC method, demonstrating a 60% success rate in inferring membership information. This paper contributes to the growing body of research on privacy and security in machine learning, highlighting the need for robust defenses against MIAs. Our findings prompt a reevaluation of the privacy implications of stable diffusion models, urging practitioners and developers to implement enhanced security measures to safeguard against such attacks.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 43 of its 68 references that are in the map. First posted on arXiv 15 Nov 2023.

Builds on

43 of 68 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Models22 Jun
  2. 2023Membership Inference Attacks against Diffusion Models7 Feb
  3. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  4. 2023Extracting Training Data from Diffusion Models30 Jan

Other references · 39

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  4. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  5. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  6. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
  7. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  8. 2016Deep Learning with Differential Privacycited by 2,682
  9. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  10. 2020Extracting Training Data from Large Language Modelscited by 2,144
  11. 2021Image Super-Resolution via Iterative Refinementcited by 1,506
  12. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
27 more
  1. 2021Blended Diffusion for Text-driven Editing of Natural Imagescited by 924
  2. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  3. 2021Membership Inference Attacks From First Principlescited by 839
  4. 2021ILVR: Conditioning Method for Denoising Diffusion Probabilistic Modelscited by 634
  5. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  6. 2021Label-Efficient Semantic Segmentation with Diffusion Modelscited by 495
  7. 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 492
  8. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
  9. 2020Label-Only Membership Inference Attackscited by 371
  10. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  11. 2018Scalable Private Learning with PATEcited by 266
  12. 2022Diffusion Models for Medical Anomaly Detectioncited by 231
  13. 2022Diffusion models as plug-and-play priorscited by 230
  14. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  15. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  16. 2020Revisiting Membership Inference Under Realistic Assumptionscited by 108
  17. 2020When is Memorization of Irrelevant Training Data Necessary for High-Accuracy Learning?cited by 102
  18. 2022Fast Unsupervised Brain Anomaly Detection and Segmentation with Diffusion Modelscited by 96
  19. 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
  20. 2021CovidGAN: Data Augmentation Using Auxiliary Classifier GAN for Improved Covid-19 Detectioncited by 64
  21. 2020DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environmentscited by 57
  22. 2021Score-Based Generative Classifierscited by 53
  23. 2021Graph Embedding for Recommendation against Attribute Inference Attackscited by 40
  24. 2017LOGAN: Membership Inference Attacks Against Generative Modelscited by 28
  25. 2022User-Level Membership Inference Attack against Metric Embedding Learningcited by 22
  26. 2021Membership Inference Attacks on Deep Regression Models for Neuroimagingcited by 19
  27. 2020Ulixes: Facial Recognition Privacy with Adversarial Machine Learningcited by 7

Built on by

Cited by year

Citing papers per year: 2024: 1; 2025: 2.

3 papers.

  1. 2025Data Unlearning in Diffusion Modelscited by 18
  2. 2024RetinaRegNet: A Zero-Shot Approach for Retinal Image Registrationcited by 7
  3. 2025Copyright Infringement Detection in Text-to-Image Diffusion Models via Differential Privacycited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2026Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise
  2. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacy
  3. 2023Membership Inference of Diffusion Models
  4. 2024Dual-Model Defense: Safeguarding Diffusion Models from Membership Inference Attacks through Disjoint Data Splitting
  5. 2023Membership Inference Attacks on Diffusion Models via Quantile Regression
  6. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Models
  7. 2024Model Will Tell: Training Membership Inference for Diffusion Models
  8. 2026Adaptive Diffusion Freezing: Privacy-preserving Diffusion Models Against Membership Inference Attacks