Diffusion-based generative models have shown great potential for image
synthesis, but there is a lack of research on the security and privacy risks
they may pose. In this paper, we investigate the vulnerability of diffusion
models to Membership Inference Attacks (MIAs), a common privacy concern. Our
results indicate that existing MIAs designed for GANs or VAE are largely
ineffective on diffusion models, either due to inapplicable scenarios (e.g.,
requiring the discriminator of GANs) or inappropriate assumptions (e.g., closer
distances between synthetic images and member images). To address this gap, we
propose Step-wise Error Comparing Membership Inference (SecMI), a black-box MIA
that infers memberships by assessing the matching of forward process posterior
estimation at each timestep. SecMI follows the common overfitting assumption in
MIA where member samples normally have smaller estimation errors, compared with
hold-out samples. We consider both the standard diffusion models, e.g., DDPM,
and the text-to-image diffusion models, e.g., Stable Diffusion. Experimental
results demonstrate that our methods precisely infer the membership with high
confidence on both of the two scenarios across six different datasets

本文研究了基于扩散的生成模型对成员隐私的攻击风险，提出了一种新的黑盒成员隐私攻击方法 SecMI，并通过对标准扩散模型和文本 - 图像扩散模型等不同数据的实验结果展示其高准确性。