Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces DIME, a query-efficient framework for membership inference attacks on diffusion models, addressing the limitations of existing heuristic methods that require high query budgets. By characterizing the optimal diffusion denoiser and identifying the implicit reconstruction error as a key factor in membership leakage, DIME reveals that both bias and local crowding terms can be efficiently estimated with minimal queries. Experimental results demonstrate that DIME significantly outperforms prior methods, achieving up to three times better true positive rates at a 1% false positive rate with as few as two queries, while also suggesting effective defenses against these attacks.
Membership inference on diffusion models just got a game-changing upgrade—DIME achieves up to 3x better accuracy with only two queries compared to existing methods that need 30.
Membership inference attacks expose whether individual records were used to train a model, yet existing attacks on diffusion models are largely heuristic and can require substantial query budgets. We introduce DIME (Denoiser Ideal Membership Error), a theoretically grounded and query-efficient framework for membership inference on diffusion models. Our starting point is an exact characterization of the optimal diffusion denoiser for a finite training set, which reveals that membership leakage is governed by the denoiser's implicit reconstruction error. This error decomposes into two complementary signals: a bias term, capturing reconstruction accuracy, and a previously unexplored local crowding term, capturing the geometry of nearby training examples. Both admit efficient estimators using only model queries, yielding a practical attack with as few as two queries. Across CIFAR-10/100, STL10-U, CelebA, and ImageNet, DIME consistently outperforms prior attacks at comparable or substantially lower query cost, improving TPR at 1% FPR by up to $3\times$; remarkably, its two-query variant can outperform existing 30-query baselines. Finally, we suggest, discuss, and evaluate specific defenses to counteract such powerful membership tests.