Membership Inference Attacks Against Fine-tuned Diffusion Language Models

TL;DR

This paper investigates membership inference risks for Diffusion Language Models (DLMs) and shows that bidirectional masking enables sparse, configuration-dependent memorization signals. It introduces SAMA (Subset-Aggregated Membership Attack), combining robust local subset sampling, sign-based aggregation, and progressive masking with adaptive weighting to detect membership despite heavy-tailed noise. Empirical results across nine datasets and two modern DLMs demonstrate substantial gains over baselines, including up to 30% relative AUC improvement and up to 8× improvement at low false positive rates. The findings reveal critical privacy vulnerabilities in DLMs and highlight the need for tailored privacy defenses, such as privacy-preserving fine-tuning strategies, defense-aware calibration, and robust aggregation techniques. Overall, the work provides a rigorous framework for evaluating and mitigating MIA risks in diffusion-based language models with practical implications for secure deployment.

Abstract

Diffusion Language Models (DLMs) represent a promising alternative to autoregressive language models, using bidirectional masked token prediction. Yet their susceptibility to privacy leakage via Membership Inference Attacks (MIA) remains critically underexplored. This paper presents the first systematic investigation of MIA vulnerabilities in DLMs. Unlike the autoregressive models' single fixed prediction pattern, DLMs' multiple maskable configurations exponentially increase attack opportunities. This ability to probe many independent masks dramatically improves detection chances. To exploit this, we introduce SAMA (Subset-Aggregated Membership Attack), which addresses the sparse signal challenge through robust aggregation. SAMA samples masked subsets across progressive densities and applies sign-based statistics that remain effective despite heavy-tailed noise. Through inverse-weighted aggregation prioritizing sparse masks' cleaner signals, SAMA transforms sparse memorization detection into a robust voting mechanism. Experiments on nine datasets show SAMA achieves 30% relative AUC improvement over the best baseline, with up to 8 times improvement at low false positive rates. These findings reveal significant, previously unknown vulnerabilities in DLMs, necessitating the development of tailored privacy defenses.

Figures (6)

• Figure 1: An overview of the . (a) An input sequence The doctor prescribed the medication after reviewing the patient 's symptoms . undergoes progressive masking over $S$ steps, accumulating masked positions. (b) The target and reference DLMs' reconstruction errors for masked tokens [MASK] are tracked position-wise at each step ($\{\ell^s\}_{s=1}^S$). Sign-based test statistics detect when specific mask configurations activate memorization, computing the fraction of configurations where reference loss exceeds target loss. This sign-based comparison, combined with inverse weighting, forms the membership score to differentiate training members from non-members.
• Figure 2: Empirical analysis of signal sparsity and configuration dependency. (a) The aggregate density of signal strengths $\Delta_{DF}(x; \mathcal{S})$ shows that member signals (red) are shifted positively compared to the more zero-centered non-member noise (blue), yet possess significant overlap. (b) Violin plots for individual samples reveal that the intra-sample variance, fluctuations in signal strength caused solely by changing the mask configuration, is substantial. This high variance confirms that membership signals are sparse and configuration-dependent, motivating the need for robust aggregation over multiple masks rather than single-shot estimation.
• Figure 3: (Ablation) Impact of 's Core Components Across MIMIR Datasets. The bar charts are illustrated in AUC. The overlaid line plots show the corresponding TPR@10%FPR.
• Figure 4: Sensitivity analysis of hyperparameters on LLaDA-8B-Base (ArXiv). The top row reports AUC, and the bottom row reports TPR@1%FPR. We vary the number of progressive steps $T$ (left), subset size $m$ (middle), and number of subsets $N$ (right). The dashed red line indicates the performance of the best baseline (Ratio).
• Figure 5: Impact of Reference Model Misalignment on Performance. Performance (AUC and TPR@10%FPR) is shown for an ideal reference (LLaDA-8B-Base), a slightly misaligned reference (LLaDA-8B-Instruct), and a severely misaligned reference (Dream-v0-7B-Base). Increasing misalignment leads to a reduction in attack performance, though still outperforms baselines even with severe misalignment.