Noise Aggregation Analysis Driven by Small-Noise Injection: Efficient Membership Inference for Diffusion Models

TL;DR

The paper addresses privacy risks in diffusion-based image synthesis by proposing an efficient membership inference attack that uses small-noise injection and analyzes noise aggregation across timesteps. The method reduces model queries by directly injecting single-step noise and constructing a short sequence of denoised-noise predictions to measure aggregation with a defined metric, achieving superior ASR and AUC compared with baselines on multiple datasets and scalable to large text-to-image models. It formalizes a set of aggregation metrics and demonstrates robustness across timesteps, noise levels, and sampling configurations, while providing practical guidance for defending diffusion-based systems. The findings illuminate how diffusion models encode training data, offering a path toward stronger privacy-preserving training and inference practices in both DDPM and latent-diffusion frameworks.

Abstract

Diffusion models have demonstrated powerful performance in generating high-quality images. A typical example is text-to-image generator like Stable Diffusion. However, their widespread use also poses potential privacy risks. A key concern is membership inference attacks, which attempt to determine whether a particular data sample was used in the model training process. We propose an efficient membership inference attack method against diffusion models. This method is based on the injection of slight noise and the evaluation of the aggregation degree of the noise distribution. The intuition is that the noise prediction patterns of diffusion models for training set samples and non-training set samples exhibit distinguishable differences.Specifically, we suppose that member images exhibit higher aggregation of predicted noise around a certain time step of the diffusion process. In contrast, the predicted noises of non-member images exhibit a more discrete characteristic around the certain time step. Compared with other existing methods, our proposed method requires fewer visits to the target diffusion model. We inject slight noise into the image under test and then determine its membership by analyzing the aggregation degree of the noise distribution predicted by the model. Empirical findings indicate that our method achieves superior performance across multiple datasets. At the same time, our method can also show better attack effects in ASR and AUC when facing large-scale text-to-image diffusion models, proving the scalability of our method.

Figures (5)

• Figure 1: Overview of our proposed membership inference attack pipeline. The approach injects small noise into test images, predicts noise at selected timesteps, and evaluates the aggregation degree of predictions to determine sample membership.
• Figure 2: Comparison of image diffusion effects under different noise intensities. The figure demonstrates how different noise levels affect image quality and the model's ability to distinguish between member and non-member samples.
• Figure 3: Attack performance across different timestep parameters. The figure shows the relationship between timestep selection and attack effectiveness, with optimal performance achieved in the intermediate range.
• Figure 4: Impact of initial noise intensity on attack performance. The figure illustrates the optimal noise level that balances member/non-member distinguishability with image quality preservation.
• Figure 5: Impact of DDIM sampling step size on attack performance. The figure shows the relationship between sampling granularity and attack effectiveness.