mlsanityData to 7 Oct 2026

Visual Privacy Auditing with Diffusion Models

arXiv 2403.07588 ↗First posted 12 Mar 2024cs.LG cs.CRcited by 1

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Data reconstruction attacks on machine learning models pose a substantial threat to privacy, potentially leaking sensitive information. Although defending against such attacks using differential privacy (DP) provides theoretical guarantees, determining appropriate DP parameters remains challenging. Current formal guarantees on the success of data reconstruction suffer from overly stringent assumptions regarding adversary knowledge about the target data, particularly in the image domain, raising questions about their real-world applicability. In this work, we empirically investigate this discrepancy by introducing a reconstruction attack based on diffusion models (DMs) that only assumes adversary access to real-world image priors and specifically targets the DP defense. We find that (1) real-world data priors significantly influence reconstruction success, (2) current reconstruction bounds do not model the risk posed by data priors well, and (3) DMs can serve as heuristic auditing tools for visualizing privacy leakage.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 39 of its 71 references that are in the map. First posted on arXiv 12 Mar 2024.

Builds on

39 of 71 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023Extracting Training Data from Diffusion Models30 Jan

Other references · 38

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  6. 2020Denoising Diffusion Implicit Modelscited by 9,655
  7. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  8. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  9. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  10. 2016Deep Learning with Differential Privacycited by 2,682
  11. 2019CheXpert: A Large Chest Radiograph Dataset with Uncertainty Labels and Expert Comparisoncited by 1,410
  12. 2022Denoising Diffusion Restoration Modelscited by 951
26 more
  1. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  2. 2017Renyi Differential Privacycited by 643
  3. 2017PixelCNN++: Improving the PixelCNN with Discretized Logistic Mixture Likelihood and Other Modificationscited by 415
  4. 2018Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoisingcited by 216
  5. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
  6. 2021Numerical Composition of Differential Privacycited by 174
  7. 2023How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacycited by 150
  8. 2022Reconstructing Training Data with Informed Adversariescited by 143
  9. 2022Reconstructing Training Data from Trained Neural Networkscited by 129
  10. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 126
  11. 2023Privacy Auditing with One (1) Training Runcited by 119
  12. 2021Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Modelscited by 106
  13. 2023Image Denoising: The Deep Learning Revolution and Beyond -- A Survey Paper --cited by 71
  14. 2022MR Image Denoising and Super-Resolution Using Regularized Reverse Diffusioncited by 66
  15. 2023DDM2: Self-Supervised Diffusion MRI Denoising with Generative Diffusion Modelscited by 50
  16. 2022Bounding Training Data Reconstruction in Private (Deep) Learningcited by 43
  17. 2023Bounding Training Data Reconstruction in DP-SGDcited by 42
  18. 2020Improving Deep Learning with Differential Privacy using Gradient Encoding and Denoisingcited by 30
  19. 2022Defending against Reconstruction Attacks with R'enyi Differential Privacycited by 30
  20. 2023Diffusion Model for Generative Image Denoisingcited by 27
  21. 2023Reconstructing Individual Data Points in Federated Learning Hardened with Differential Privacy and Secure Aggregationcited by 16
  22. 2023Unlocking Accuracy and Fairness in Differentially Private Image Classificationcited by 16
  23. 2023Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacycited by 14
  24. 2023Understanding Deep Gradient Leakage via Inversion Influence Functionscited by 6
  25. 2023Reconciling AI Performance and Data Reconstruction Resilience for Medical Imagingcited by 1
  26. 2024From Mean to Extreme: Formal Differential Privacy Bounds on the Success of Real-World Data Reconstruction Attackscited by 1

Built on by

Cited by year

Citing papers per year: 2024: 1.

1 paper.

  1. 2024LDPKiT: Superimposing Remote Queries for Privacy-Preserving Distillationcited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2024Gradient-Guided Conditional Diffusion Models for Private Image Reconstruction: Analyzing Adversarial Impacts of Differential Privacy and Denoising
  2. 2024Is Diffusion Model Safe? Severe Data Leakage via Gradient-Guided Diffusion Model
  3. 2026Protecting Sensitive Data in Image Synthesis via PAC-Private Adaptation for Diffusion Models
  4. 2025Enhanced Privacy Leakage from Noise-Perturbed Gradients via Gradient-Guided Conditional Diffusion Models
  5. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacy
  6. 2024PID: Prompt-Independent Data Protection Against Latent Diffusion Models
  7. 2023PAC Privacy Preserving Diffusion Models
  8. 2024Shake to Leak: Fine-tuning Diffusion Models Can Amplify the Generative Privacy Risk