mlsanityData to 7 Oct 2026

Privacy Attacks on Image AutoRegressive Models

arXiv 2502.02514 ↗First posted 4 Feb 2025cs.CV cs.LGcited by 15

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Image AutoRegressive generation has emerged as a new powerful paradigm with image autoregressive models (IARs) matching state-of-the-art diffusion models (DMs) in image quality (FID: 1.48 vs. 1.58) while allowing for a higher generation speed. However, the privacy risks associated with IARs remain unexplored, raising concerns regarding their responsible deployment. To address this gap, we conduct a comprehensive privacy analysis of IARs, comparing their privacy risks to the ones of DMs as reference points. Concretely, we develop a novel membership inference attack (MIA) that achieves a remarkably high success rate in detecting training images (with True Positive Rate at False Positive Rate = 1% of 94.57% vs. 6.38% for DMs with comparable attacks). We leverage our novel MIA to provide dataset inference (DI) for IARs, and show that it requires as few as 4 samples to detect dataset membership (compared to 200 for DI in DMs), confirming a higher information leakage in IARs. Finally, we are able to extract hundreds of training data points from an IAR (e.g., 698 from VAR-textitd30). Our results suggest a fundamental privacy-utility trade-off: while IARs excel in image generation quality and speed, they are textitempirically significantly more vulnerable to privacy attacks compared to DMs that achieve similar performance. We release the code at https://github.com/sprintml/privacyattacksagainstiars for reproducibility.

Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 58 of its 76 references that are in the map. First posted on arXiv 4 Feb 2025.

Builds on

58 of 76 references.

Closest ancestors · 6

Same direction, newest first

  1. 2024CDI: Copyrighted Data Identification in Diffusion Models19 Nov
  2. 2024Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancy23 May
  3. 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Models22 Jun
  4. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initialization26 May
  5. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  6. 2023Extracting Training Data from Diffusion Models30 Jan

Other references · 52

  1. 2017Attention Is All You Needcited by 59,932
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  6. 2020Denoising Diffusion Implicit Modelscited by 9,655
  7. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,339
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  9. 2020Scaling Laws for Neural Language Modelscited by 6,411
  10. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  11. 2022Scalable Diffusion Models with Transformerscited by 5,931
  12. 2022Classifier-Free Diffusion Guidancecited by 5,717
38 more
  1. 2020Taming Transformers for High-Resolution Image Synthesiscited by 3,229
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2020Extracting Training Data from Large Language Modelscited by 2,144
  4. 2024Visual Autoregressive Modeling: Scalable Image Generation via Next-Scale Predictioncited by 1,005
  5. 2021Membership Inference Attacks From First Principlescited by 839
  6. 2024SiT: Exploring Flow and Diffusion-based Generative Models with Scalable Interpolant Transformerscited by 707
  7. 2024Autoregressive Image Generation without Vector Quantizationcited by 644
  8. 2022All are Worth Words: A ViT Backbone for Diffusion Modelscited by 498
  9. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
  10. 2023Detecting Pretraining Data from Large Language Modelscited by 375
  11. 2024Infinity: Scaling Bitwise AutoRegressive Modeling for High-Resolution Image Synthesiscited by 297
  12. 2023MDTv2: Masked Diffusion Transformer is a Strong Image Synthesizercited by 260
  13. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 249
  14. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 188
  15. 2022A Self-Supervised Descriptor for Image Copy Detectioncited by 175
  16. 2023Flow Matching in Latent Spacecited by 155
  17. 2024Fluid: Scaling Autoregressive Text-to-image Generative Models with Continuous Tokenscited by 147
  18. 2024HART: Efficient Visual Generation with Hybrid Autoregressive Transformercited by 128
  19. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  20. 2024LLM Dataset Inference: Did you train on my dataset?cited by 107
  21. 2024Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large Language Modelscited by 102
  22. 2023Low-Cost High-Power Membership Inference Attackscited by 99
  23. 2024Detecting, Explaining, and Mitigating Memorization in Diffusion Modelscited by 94
  24. 2023Flocks of Stochastic Parrots: Differentially Private Prompt Learning for Large Language Modelscited by 80
  25. 2024Blind Baselines Beat Membership Inference Attacks for Foundation Modelscited by 65
  26. 2024Scaling Diffusion Transformers to 16 Billion Parameterscited by 65
  27. 2023Scalable Membership Inference Attacks via Quantile Regressioncited by 61
  28. 2024Demystifying Verbatim Memorization in Large Language Modelscited by 55
  29. 2024Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Datacited by 49
  30. 2024VAR-CLIP: Text-to-Image Generator with Visual Auto-Regressive Modelingcited by 42
  31. 2022Dataset Inference for Self-Supervised Modelscited by 36
  32. 2024Finding NeMo: Localizing Neurons Responsible For Memorization in Diffusion Modelscited by 36
  33. 2024Alleviating Distortion in Image Generation via Multi-Resolution Diffusion Models and Time-Dependent Layer Normalizationcited by 36
  34. 2024On the Privacy Risk of In-context Learningcited by 31
  35. 2022On the Difficulty of Defending Self-Supervised Learning against Model Extractioncited by 22
  36. 2024Context-Aware Membership Inference Attacks against Pre-trained Large Language Modelscited by 20
  37. 2024Memorization in Self-Supervised Learning Improves Downstream Generalizationcited by 18
  38. 2024Open LLMs are Necessary for Current Private Adaptations and Outperform their Closed Alternativescited by 12

50 most cited of 52 All 52 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 8; 2026: 7.

15 papers.

Sort:

By area:

  1. 2025Unlocking Post-hoc Dataset Inference with Synthetic Datacited by 7
  2. 2025Quantifying the Privacy Implications of High-Fidelity Synthetic Network Trafficcited by 3
  3. 2026Scalable next-scale autoregression for medical image generation across anatomical regionscited by 3
  4. 2025Demystifying Foreground-Background Memorization in Diffusion Modelscited by 2
  5. 2025Membership and Dataset Inference Attacks on Large Audio Generative Modelscited by 2
  6. 2025Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspectivecited by 1
  7. 2025Localizing and Mitigating Memorization in Image Autoregressive Modelscited by 1
  8. 2025PRADA: Probability-Ratio-Based Attribution and Detection of Autoregressive-Generated Imagescited by 1
  9. 2026The Reliability Gap in Benchmark Auditing: Distribution Shift and Scale as Failure Modes of Contamination Detectioncited by 1
  10. 2026Data Provenance for Image Auto-Regressive Generationcited by 1
  11. 2025Exploring Image Generation via Mutually Exclusive Probability Spaces and Local Correlation Hypothesiscited by 0
  12. 2026MGI: Member vs Generated Inferencecited by 0
3 more
  1. 2026Natural Identifiers for Privacy and Data Audits in Large Language Modelscited by 0
  2. 2026Dataset Usage Inference without Shadow Models or Held-out Datacited by 0
  3. 2026Anchored or Drifting: What Recursive Self-Generation Reveals About Training Datacited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise
  2. 2023Privacy Threats in Stable Diffusion Models
  3. 2024Real-World Benchmarks Make Membership Inference Attacks Fail on Diffusion Models
  4. 2024Dual-Model Defense: Safeguarding Diffusion Models from Membership Inference Attacks through Disjoint Data Splitting
  5. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacy
  6. 2026Black-box Membership Inference Attacks on the Pre-training Data of Image-generation Models
  7. 2024Identity-Focused Inference and Extraction Attacks on Diffusion Models
  8. 2024Unveiling Structural Memorization: Structural Membership Inference Attack for Text-to-Image Diffusion Models