mlsanityData to 14 Oct 2026

DIME: Query-Efficient Framework for Membership Inference on Diffusion Models

arXiv 2608.22824 ↗First posted 24 Aug 2026cs.LG cs.CRcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Membership inference attacks expose whether individual records were used to train a model, yet existing attacks on diffusion models are largely heuristic and can require substantial query budgets. We introduce DIME (Denoiser Ideal Membership Error), a theoretically grounded and query-efficient framework for membership inference on diffusion models. Our starting point is an exact characterization of the optimal diffusion denoiser for a finite training set, which reveals that membership leakage is governed by the denoiser's implicit reconstruction error. This error decomposes into two complementary signals: a bias term, capturing reconstruction accuracy, and a previously unexplored local crowding term, capturing the geometry of nearby training examples. Both admit efficient estimators using only model queries, yielding a practical attack with as few as two queries. Across CIFAR-10/100, STL10-U, CelebA, and ImageNet, DIME consistently outperforms prior attacks at comparable or substantially lower query cost, improving TPR at 1% FPR by up to 3×; remarkably, its two-query variant can outperform existing 30-query baselines. Finally, we suggest, discuss, and evaluate specific defenses to counteract such powerful membership tests.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 31 of its 51 references that are in the map. First posted on arXiv 24 Aug 2026.

Builds on

31 of 51 references.

Closest ancestors · 7

Same direction, newest first

  1. 2025Score-based Membership Inference on Diffusion Models29 Sep
  2. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Models13 Dec
  3. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initialization26 May
  4. 2023Membership Inference Attacks against Diffusion Models7 Feb
  5. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  6. 2023Extracting Training Data from Diffusion Models30 Jan
  7. 2022How to Backdoor Diffusion Models?11 Dec

Other references · 24

  1. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  3. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  6. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  7. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  8. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,101
  9. 2014Deep Learning Face Attributes in the Wildcited by 3,693
  10. 2016Deep Learning with Differential Privacycited by 2,728
  11. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  12. 2020Extracting Training Data from Large Language Modelscited by 2,189
12 more
  1. 2019Do ImageNet Classifiers Generalize to ImageNet?cited by 1,515
  2. 2021Membership Inference Attacks From First Principlescited by 878
  3. 2016Conditional Image Generation with PixelCNN Decoderscited by 862
  4. 2016Pixel Recurrent Neural Networkscited by 816
  5. 2022Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Modelscited by 424
  6. 2023Detecting Pretraining Data from Large Language Modelscited by 387
  7. 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 383
  8. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
  9. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 246
  10. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 75
  11. 2024Membership Inference Attacks against Large Vision-Language Modelscited by 33
  12. 2025Membership Inference Attacks Against Vision-Language Modelscited by 29

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Noise Aggregation Analysis Driven by Small-Noise Injection: Efficient Membership Inference for Diffusion Models
  2. 2026Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise
  3. 2025Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective
  4. 2024Real-World Benchmarks Make Membership Inference Attacks Fail on Diffusion Models
  5. 2023Membership Inference Attacks on Diffusion Models via Quantile Regression
  6. 2023Membership Inference of Diffusion Models
  7. 2024Towards Black-Box Membership Inference Attack for Diffusion Models
  8. 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Models