Model Will Tell: Training Membership Inference for Diffusion Models
Xiaomeng Fu Xi Wang Qiao Li Jin Liu Jiao Dai Jizhong Han
Diffusion models pose risks of privacy breaches and copyright disputes,
primarily stemming from the potential utilization of unauthorized data during
the training phase. The Training Membership Inference (TMI) task aims to
determine whether a specific sample has been used in the training process of a
target model, representing a critical tool for privacy violation verification.
However, the increased stochasticity inherent in diffusion renders traditional
shadow-model-based or metric-based methods ineffective when applied to
diffusion models. Moreover, existing methods only yield binary classification
labels which lack necessary comprehensibility in practical applications. In
this paper, we explore a novel perspective for the TMI task by leveraging the
intrinsic generative priors within the diffusion model. Compared with unseen
samples, training samples exhibit stronger generative priors within the
diffusion model, enabling the successful reconstruction of substantially
degraded training images. Consequently, we propose the Degrade Restore Compare
(DRC) framework. In this framework, an image undergoes sequential degradation
and restoration, and its membership is determined by comparing it with the
restored counterpart. Experimental results verify that our approach not only
significantly outperforms existing methods in terms of accuracy but also
provides comprehensible decision criteria, offering evidence for potential
privacy violations.