mlsanityData to 14 Oct 2026

Black-box Membership Inference Attacks against Fine-tuned Diffusion Models

arXiv 2312.08207 ↗First posted 13 Dec 2023cs.CRcited by 35

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

With the rapid advancement of diffusion-based image-generative models, the quality of generated images has become increasingly photorealistic. Moreover, with the release of high-quality pre-trained image-generative models, a growing number of users are downloading these pre-trained models to fine-tune them with downstream datasets for various image-generation tasks. However, employing such powerful pre-trained models in downstream tasks presents significant privacy leakage risks. In this paper, we propose the first reconstruction-based membership inference attack framework, tailored for recent diffusion models, and in the more stringent black-box access setting. Considering four distinct attack scenarios and three types of attacks, this framework is capable of targeting any popular conditional generator model, achieving high precision, evidenced by an impressive AUC of 0.95.

Key facts. Cited by 35 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 52 of its 81 references that are in the map. First posted on arXiv 13 Dec 2023.

Builds on

52 of 81 references.

Closest ancestors · 12

Same direction, newest first

  1. 2023Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Models30 Oct
  2. 2023A Probabilistic Fluctuation based Membership Inference Attack for Diffusion Models23 Aug
  3. 2023White-box Membership Inference Attacks against Diffusion Models11 Aug
  4. 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Models22 Jun
  5. 2023VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Models12 Jun
  6. 2023Privacy Distillation: Reducing Re-identification Risk of Multimodal Diffusion Models2 Jun
  7. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initialization26 May
  8. 2023Membership Inference Attacks against Diffusion Models7 Feb
  9. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  10. 2023Extracting Training Data from Diffusion Models30 Jan
  11. 2023Membership Inference of Diffusion Models24 Jan
  12. 2022Differentially Private Diffusion Models18 Oct

Other references · 40

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  2. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  4. 2014Microsoft COCO: Common Objects in Contextcited by 17,608
  5. 2020Denoising Diffusion Implicit Modelscited by 9,781
  6. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  7. 2020End-to-End Object Detection with Transformerscited by 7,414
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  9. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  10. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  11. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
  12. 2022Classifier-Free Diffusion Guidancecited by 5,847
28 more
  1. 2022Generative Adversarial Networkscited by 5,627
  2. 2020Training data-efficient image transformers & distillation through attentioncited by 4,586
  3. 2021Zero-Shot Text-to-Image Generationcited by 4,288
  4. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
  5. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,614
  6. 2016Deep Learning with Differential Privacycited by 2,728
  7. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,375
  8. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  9. 2021Membership Inference Attacks From First Principlescited by 878
  10. 2021Vector Quantized Diffusion Model for Text-to-Image Synthesiscited by 774
  11. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
  12. 2020Label-Only Membership Inference Attackscited by 388
  13. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
  14. 2021WIT: Wikipedia-based Image Text Dataset for Multimodal Multilingual Machine Learningcited by 287
  15. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
  16. 2022EfficientFormer: Vision Transformers at MobileNet Speedcited by 241
  17. 2023Glaze: Protecting Artists from Style Mimicry by Text-to-Image Modelscited by 205
  18. 2020When Machine Unlearning Jeopardizes Privacycited by 198
  19. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  20. 2023Kandinsky: an Improved Text-to-Image Synthesis with Image Prior and Latent Diffusioncited by 114
  21. 2020Revisiting Membership Inference Under Realistic Assumptionscited by 112
  22. 2021Talk-to-Edit: Fine-Grained Facial Editing via Dialogcited by 102
  23. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 101
  24. 2018Understanding Membership Inferences on Well-Generalized Learning Modelscited by 90
  25. 2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 78
  26. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 69
  27. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  28. 2020Medical Image Generation using Generative Adversarial Networkscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 11; 2025: 11; 2026: 13.

35 papers.

Sort:

By area:

  1. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 67
  2. 2024Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancycited by 38
  3. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  4. 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Modelscited by 20
  5. 2025Who Stole Your Data? A Method for Detecting Unauthorized RAG Theftcited by 15
  6. 2024Towards Black-Box Membership Inference Attack for Diffusion Modelscited by 14
  7. 2024Replication in Visual Diffusion Models: A Survey and Outlookcited by 11
  8. 2024Privacy-Preserving Low-Rank Adaptation against Membership Inference Attacks for Latent Diffusion Modelscited by 9
  9. 2025ArtistAuditor: Auditing Artist Style Pirate in Text-to-Image Generation Modelscited by 5
  10. 2026Membership Inference Attacks Against Fine-tuned Diffusion Language Modelscited by 5
  11. 2024CPSample: Classifier Protected Sampling for Guarding Training Data During Diffusioncited by 3
  12. 2024Dual-Model Defense: Safeguarding Diffusion Models from Membership Inference Attacks through Disjoint Data Splittingcited by 3
23 more
  1. 2025CompLeak: Deep Learning Model Compression Exacerbates Privacy Leakagecited by 3
  2. 2025Responsible Diffusion: A Comprehensive Survey on Safety, Ethics, and Trust in Diffusion Modelscited by 3
  3. 2025Membership Inference Attacks on Tokenizers of Large Language Modelscited by 3
  4. 2025Quantifying the Privacy Implications of High-Fidelity Synthetic Network Trafficcited by 3
  5. 2025In-Context Probing for Membership Inference in Fine-Tuned Language Modelscited by 3
  6. 2026Inference Attacks Against Graph Generative Diffusion Modelscited by 2
  7. 2026VLALeaks: Membership Inference Attacks against Vision-Language-Action Modelscited by 2
  8. 2024Identity-Focused Inference and Extraction Attacks on Diffusion Modelscited by 1
  9. 2025Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspectivecited by 1
  10. 2025SoK: Can Synthetic Images Replace Real Data? A Survey of Utility and Privacy of Synthetic Image Generationcited by 1
  11. 2025Membership Inference Attack with Partial Featurescited by 1
  12. 2024EnTruth: Enhancing the Traceability of Unauthorized Dataset Usage in Text-to-image Diffusion Models with Minimal and Robust Alterationscited by 0
  13. 2024Exploiting Watermark-Based Defense Mechanisms in Text-to-Image Diffusion Models for Unauthorized Data Usagecited by 0
  14. 2026Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noisecited by 0
  15. 2026The Silent Brush: Evaluating Artistic Style Leakage in AI Art Generationcited by 0
  16. 2026Black-box Membership Inference Attacks on the Pre-training Data of Image-generation Modelscited by 0
  17. 2026ImageAuditor: Membership Inference Attack against Image-based Retrieval-Augmented Generationcited by 0
  18. 2026One Framework for All: Cross-Modal Membership Inference for Generative Modelscited by 0
  19. 2026When T2I Synthetic Data Backfires: Amplified Privacy Risks in Real-Synthetic Mix Trainingcited by 0
  20. 2026MemCatalyst: Amplifying Data Auditing on Vision-Language Models via Data Poisoningcited by 0
  21. 2026DIME: Query-Efficient Framework for Membership Inference on Diffusion Modelscited by 0
  22. 2026Hearing the Whispers: Black-Box Membership Inference Attacks on Finetuned TTS Modelscited by 0
  23. 2026A Data-Interventional Framework for Auditing Privacy and Fairness in Generative Medical Imagingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacy
  2. 2023Membership Inference Attacks on Diffusion Models via Quantile Regression
  3. 2025Membership Inference Attacks for Face Images Against Fine-Tuned Latent Diffusion Models
  4. 2023Privacy Threats in Stable Diffusion Models
  5. 2024Shake to Leak: Fine-tuning Diffusion Models Can Amplify the Generative Privacy Risk
  6. 2024Unveiling Structural Memorization: Structural Membership Inference Attack for Text-to-Image Diffusion Models
  7. 2024Model Will Tell: Training Membership Inference for Diffusion Models
  8. 2025Explore the vulnerability of black-box models via diffusion models