2023

Membership Inference Attacks against Diffusion Models

Matsumoto, Tomoya, Miura, Takayuki, Yanai, Naoto

Understand

Diffusion models have attracted attention in recent years as innovative generative models.

In this paper, we investigate whether a diffusion model is resistant to a membership inference attack, which evaluates the privacy leakage of a machine learning model.
We primarily discuss the diffusion model from the standpoints of comparison with a generative adversarial network (GAN) as conventional models and hyperparameters unique to the diffusion model, i.e., time steps, sampling steps, and sampling variances.
We conduct extensive experiments with DDIM as a diffusion model and DCGAN as a GAN on the CelebA and CIFAR-10 datasets in both white-box and black-box settings and then confirm if the diffusion model is comparably resistant to a membership inference attack as GAN.

Built on

B. Jayaraman and D. Evans, “Evaluating differentially private machine learning in practice,” in Proc. of USENIX Security 2019 . USENIX Association, 2019, pp. 1895–1912
1912
Earlier work this paper cites.
N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramèr, “Membership inference attacks from first principles,” in Proc. of IEEE S&P 2022 . IEEE, 2022, pp. 1897–1914
1914
Earlier work this paper cites.
Z. Li, Y. Liu, X. He, N. Yu, M. Backes, and Y. Zhang, “Auditing membership leakages of multi-exit networks,” in Proc. of CCS 2022 . ACM, 2022, pp. 1917–1931
1931
Earlier work this paper cites.
C. Dwork, “Differential privacy,” in Proc. of ICALP , ser. LNCS, vol. 4052. Springer, 2006, pp. 1–12
2006
Earlier work this paper cites.
A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009
2009
Earlier work this paper cites.
Z. Liu, P. Luo, X. Wang, and X. Tang, “Deep learning face attributes in the wild,” CoRR , vol. abs/1411.7766, 2014
Original
2014
Earlier work this paper cites.
J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli, “Deep unsupervised learning using nonequilibrium thermodynamics,” in Proc. of ICML 2015 , ser. PMLR, vol. 37. PMLR, 2015, pp. 2256–2265
2015
Earlier work this paper cites.
M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , 2016, pp. 308–318
2016
Earlier work this paper cites.
A. Radford, L. Metz, and S. Chintala, “Unsupervised representation learning with deep convolutional generative adversarial networks,” in 4th International Conference on Learning Representations, ICLR 2016, San Juan, Puerto Rico, May 2-4, 2016, Conference Track Proceedings , Y. Bengio and Y. LeCun, Eds., 2016
2016
Earlier work this paper cites.
E. Choi, S. Biswal, B. Malin, J. Duke, W. F. Stewart, and J. Sun, “Generating multi-label discrete patient records using generative adversarial networks,” in Proc. of MLHC 2017 , ser. PMLR, vol. 68. PMLR, 2017, pp. 286–305
2017
Earlier work this paper cites.
R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in Proc. of IEEE S&P 2018 . IEEE Computer Society, 2017, pp. 3–18
2017
Earlier work this paper cites.
R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18
2017
Earlier work this paper cites.
M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, G. Klambauer, and S. Hochreiter, “Gans trained by a two time-scale update rule converge to a nash equilibrium,” CoRR , vol. abs/1706.08500, 2017
Original
2017
Earlier work this paper cites.
S. Hidano, T. Murakami, S. Katsumata, S. Kiyomoto, and G. Hnnaoka, “Model inversion attacks for online prediction systems: Without knowledge of non-sensitive attributes,” IEICE Transactions on Information and Systems , vol. E101.D, no. 11, pp. 2665–2676, 2018
2018
Earlier work this paper cites.

Similar

S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in Proc. of CSF 2018 . IEEE, 2018, pp. 268–282
2018
Cited alongside, same era.
X. Yi, E. Walia, and P. Babyn, “Generative adversarial network in medical imaging: A review,” Medical Image Analysis , vol. 58, p. 101552, 2019
2019
Cited alongside, same era.
B. Hilprecht, M. Härterich, and D. Bernau, “Monte carlo and reconstruction membership inference attacks against generative models,” Proceedings of Privacy Enhancing Technologies , vol. 2019, no. 4, pp. 232–249, 2019
2019
Cited alongside, same era.
J. Hayes, L. Melis, G. Danezis, and E. D. Cristofaro, “LOGAN: membership inference attacks against generative models,” Proceedings of Privacy Enhancing Technologies , vol. 2019, no. 1, pp. 133–152, 2019
2019
Cited alongside, same era.
A. Salem, Y. Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” in Proc. of NDSS 2019 . The Internet Society, 2019
2019
Cited alongside, same era.
L. Song, R. Shokri, and P. Mittal, “Membership inference attacks against adversarially robust deep learning models,” in Proc. of IEEE SPW 2019 . IEEE, 2019, pp. 50–56
2019
Cited alongside, same era.
C. Song and V. Shmatikov, “Auditing data provenance in text-generation models,” in Proc. of CCS 2019 . ACM, 2019, pp. 196–206
2019
Cited alongside, same era.
J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in Proc. of NeurIPS 2020 , vol. 33. Curran Associates, Inc., 2020, pp. 6840–6851
2020
Cited alongside, same era.
M. Jagielski, J. Ullman, and A. Oprea, “Auditing differentially private machine learning: How private is private sgd?” in Advances in Neural Information Processing Systems , vol. 33. Curran Associates, Inc., 2020, pp. 22 205–22 216
2020
Cited alongside, same era.
D. Chen, N. Yu, Y. Zhang, and M. Fritz, “GAN-leaks: A taxonomy of membership inference attacks against generative models,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security
2020
Cited alongside, same era.
J. Song, C. Meng, and S. Ermon, “Denoising diffusion implicit models,” CoRR , vol. abs/2010.02502, 2020
Original
2020
Cited alongside, same era.
P. Dhariwal and A. Nichol, “Diffusion models beat gans on image synthesis,” Advances in Neural Information Processing Systems , vol. 34, pp. 8780–8794, 2021
2021
Cited alongside, same era.

Then

A. Ramesh, P. Dhariwal, A. Nichol, C. Chu, and M. Chen, “Hierarchical text-conditional image generation with clip latents,” arXiv preprint arXiv:2204.06125 , 2022
Original
2022
Later among the works it cites.
R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High-resolution image synthesis with latent diffusion models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 10 684–10 695
2022
Later among the works it cites.
C. Saharia, W. Chan, S. Saxena, L. Li, J. Whang, E. Denton, S. K. S. Ghasemipour, B. K. Ayan, S. S. Mahdavi, R. G. Lopes et al. , “Photorealistic text-to-image diffusion models with deep language understanding,” arXiv preprint arXiv:2205.11487 , 2022
Original
2022
Later among the works it cites.
A. Q. Nichol, P. Dhariwal, A. Ramesh, P. Shyam, P. Mishkin, B. Mcgrew, I. Sutskever, and M. Chen, “GLIDE: Towards photorealistic image generation and editing with text-guided diffusion models,” in Proceedings of the 39th International Conference on Machine Learning , 2022, pp. 16 784–16 804
2022
Later among the works it cites.
M. Conti, J. Li, S. Picek, and J. Xu, “Label-only membership inference attack against node-level graph neural networks,” in Proc. of AISec 2022 , 2022, pp. 1–12
2022
Later among the works it cites.
J. Ye, A. Maddi, S. K. Murakonda, V. Bindschaedler, and R. Shokri, “Enhanced membership inference attacks against machine learning models,” in Proc. of CCS 2022 . ACM, 2022, pp. 3093–3106
2022
Later among the works it cites.
T. Stadler, B. Oprisanu, and C. Troncoso, “Synthetic data – anonymisation groundhog day,” in Proc. of USENIX Security 2022 , 2022, pp. 1451–1468
2022
Later among the works it cites.
F. Tramèr, R. Shokri, A. San Joaquin, H. Le, M. Jagielski, S. Hong, and N. Carlini, “Truth serum: Poisoning machine learning models to reveal their secrets,” in Proc. of CCS 2022 . ACM, 2022, pp. 2779–2792
2022
Later among the works it cites.
Z. Wang, Y. Huang, M. Song, L. Wu, F. Xue, and K. Ren, “Poisoning-assisted property inference attack against federated learning,” IEEE Transactions on Dependable and Secure Computing , pp. 1–13, 2022
2022
Later among the works it cites.
S. Mahloujifar, E. Ghosh, and M. Chase, “Property inference from poisoning,” in Proc. of IEEE S&P 2022 . IEEE, 2022, pp. 1569–1569
2022
Later among the works it cites.
Y. Wu, N. Yu, Z. Li, M. Backes, and Y. Zhang, “Membership inference attacks against text-to-image generation models,” CoRR , vol. abs/2210.00968, 2022. [Online]. Available: https://doi.org/10.48550/arXiv.2210.00968
Original
2022
Later among the works it cites.
H. Hu and J. Pang, “Membership inference of diffusion models,” arXiv preprint arXiv:2301.09956 , 2023
Original
2023
Closest in time.
N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V. Sehwag, F. Tramèr, B. Balle, D. Ippolito, and E. Wallace, “Extracting training data from diffusion models,” arXiv preprint arXiv:2301.13188 , 2023
Original
2023
Closest in time.
J. Duan, F. Kong, S. Wang, X. Shi, and K. Xu, “Are diffusion models vulnerable to membership inference attacks?” arXiv preprint arXiv:2302.01316 , 2023
Original
2023
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…