LeakyCLIP: Extracting Training Data from CLIP

TL;DR

This work examines privacy risks in CLIP by framing data extraction as CLIP inversion, where training images are reconstructed from text prompts. It introduces LeakyCLIP, a three-stage attack combining adversarial fine-tuning, embedding alignment, and diffusion-based refinement to achieve high-fidelity reconstructions from CLIP embeddings. Empirical results show substantial improvements in structural and perceptual fidelity (e.g., up to 258% SSIM gains on ViT-B-16 with LAION-2B) and reveal that training data membership can be inferred even from low-fidelity reconstructions, highlighting pervasive privacy risks. Theoretical and empirical analyses underscore how richer text prompts amplify memorization and inversion capabilities, emphasizing the need for robust defenses in multimodal systems.

Abstract

Understanding the memorization and privacy leakage risks in Contrastive Language--Image Pretraining (CLIP) is critical for ensuring the security of multimodal models. Recent studies have demonstrated the feasibility of extracting sensitive training examples from diffusion models, with conditional diffusion models exhibiting a stronger tendency to memorize and leak information. In this work, we investigate data memorization and extraction risks in CLIP through the lens of CLIP inversion, a process that aims to reconstruct training images from text prompts. To this end, we introduce \textbf{LeakyCLIP}, a novel attack framework designed to achieve high-quality, semantically accurate image reconstruction from CLIP embeddings. We identify three key challenges in CLIP inversion: 1) non-robust features, 2) limited visual semantics in text embeddings, and 3) low reconstruction fidelity. To address these challenges, LeakyCLIP employs 1) adversarial fine-tuning to enhance optimization smoothness, 2) linear transformation-based embedding alignment, and 3) Stable Diffusion-based refinement to improve fidelity. Empirical results demonstrate the superiority of LeakyCLIP, achieving over 258% improvement in Structural Similarity Index Measure (SSIM) for ViT-B-16 compared to baseline methods on LAION-2B subset. Furthermore, we uncover a pervasive leakage risk, showing that training data membership can even be successfully inferred from the metrics of low-fidelity reconstructions. Our work introduces a practical method for CLIP inversion while offering novel insights into the nature and scope of privacy risks in multimodal models.

Figures (13)

• Figure 1: The first row presents reconstructed images generated by LeakyCLIP, while the second row shows the corresponding training images. According to our Highly Similar metric, these reconstructions are recognized as highly similar to the originals.
• Figure 2: LeakyCLIP for Training Data Extraction. (i) Adversarial Fine-Tuning (AFT): The image encoder $f_I$ is Adversarial Fine-Tuned to smooth the optimization landscape. $f_{org}$ is a duplicated image encoder whose parameters are frozen during fine-tuning. (ii) Embedding Alignment (EA): A linear transformation matrix $M$ is learned to align the text and image embeddings, mapping text embedding $U_T$ to an approximate image embedding $U_T M$. (iii) Diffusion Refinement (DR):The reconstructed image is refined using Stable Diffusion to improve visual quality.
• Figure 3: Top: Reconstructed images by LeakyCLIP. Bottom: The original images and metric values.
• Figure 4: Gradient Distribution Comparison: Histograms showing that adversarially fine-tuned CLIP have smaller and less variable gradient norms, reflecting a smoother optimization landscape.
• Figure 5: The relationship between the reconstruction similarity of image embedding in $D_{test}$ and size of the $D_{aux}$.

Theorems & Definitions (5)

• Theorem 1
• Definition 1
• Theorem 2
• Corollary 1
• Definition 2