ICAS: Detecting Training Data from Autoregressive Image Generative Models

TL;DR

This paper tackles training-data privacy in autoregressive image generative models by introducing ICAS, a membership inference method tailored to VARs that combines an implicit classifier with an adaptive token-weighted scoring mechanism. By comparing conditional and unconditional token likelihoods and aggregating token scores with emphasis on low-scoring tokens, ICAS outperforming adapted LLM MI baselines across class-conditional and text-to-image generation, while showing robustness to transformations. A key finding is a linear scaling law linking model size to MI vulnerability, indicating that larger scale-wise VARs are easier to attack. The work highlights practical privacy implications for large autoregressive image models and provides open-source code for replication.

Abstract

Autoregressive image generation has witnessed rapid advancements, with prominent models such as scale-wise visual auto-regression pushing the boundaries of visual synthesis. However, these developments also raise significant concerns regarding data privacy and copyright. In response, training data detection has emerged as a critical task for identifying unauthorized data usage in model training. To better understand the vulnerability of autoregressive image generative models to such detection, we conduct the first study applying membership inference to this domain. Our approach comprises two key components: implicit classification and an adaptive score aggregation strategy. First, we compute the implicit token-wise classification score within the query image. Then we propose an adaptive score aggregation strategy to acquire a final score, which places greater emphasis on the tokens with lower scores. A higher final score indicates that the sample is more likely to be involved in the training set. To validate the effectiveness of our method, we adapt existing detection algorithms originally designed for LLMs to visual autoregressive models. Extensive experiments demonstrate the superiority of our method in both class-conditional and text-to-image scenarios. Moreover, our approach exhibits strong robustness and generalization under various data transformations. Furthermore, sufficient experiments suggest two novel key findings: (1) A linear scaling law on membership inference, exposing the vulnerability of large foundation models. (2) Training data from scale-wise visual autoregressive models is easier to detect than other autoregressive paradigms. Our code is available at https://github.com/Chrisqcwx/ImageAR-MIA.

Figures (9)

• Figure 1: MI methods developed for LLMs, which leverage the generative probability, fail to distinguish the distribution shift between member and non-member samples. In contrast, the implicit classifier can distinguish them.
• Figure 2: Overview of our membership inference method. The distribution is based on the experimental results of VAR-$d24$.
• Figure 3: FID evaluation results with different CFG ratios on training set and validation set.
• Figure 4: Cumulative distribution of token scores from a specific member and a non-member sample. A few tokens in the non-member sample have high scores, while more have low scores.
• Figure 5: The log ROC curve for membership inference on the VAR models