Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise

TL;DR

The paper identifies a privacy vulnerability in diffusion-model fine-tuning where residual semantic information persists in the initial noise despite standard noise schedules. It introduces an end-to-end membership inference attack that injects image semantics into the initial noise via DDIM inversion with a pre-trained model, requiring no access to the target model's internals or shadow models. The approach achieves high discriminatory power across multiple datasets (e.g., $AUC$ around 90% and $TPR_{1\%}$ above 20%), outperforming several end-to-end baselines and remaining competitive with intermediate attacks under defenses. This work highlights a practical privacy risk in diffusion-model deployments and motivates the development of defenses that mitigate semantic-information leakage in initial noise.

Abstract

Diffusion models have achieved remarkable progress in image generation, but their increasing deployment raises serious concerns about privacy. In particular, fine-tuned models are highly vulnerable, as they are often fine-tuned on small and private datasets. Membership inference attacks (MIAs) are used to assess privacy risks by determining whether a specific sample was part of a model's training data. Existing MIAs against diffusion models either assume obtaining the intermediate results or require auxiliary datasets for training the shadow model. In this work, we utilized a critical yet overlooked vulnerability: the widely used noise schedules fail to fully eliminate semantic information in the images, resulting in residual semantic signals even at the maximum noise step. We empirically demonstrate that the fine-tuned diffusion model captures hidden correlations between the residual semantics in initial noise and the original images. Building on this insight, we propose a simple yet effective membership inference attack, which injects semantic information into the initial noise and infers membership by analyzing the model's generation result. Extensive experiments demonstrate that the semantic initial noise can strongly reveal membership information, highlighting the vulnerability of diffusion models to MIAs.

Figures (10)

• Figure 1: Visualization of generation. In our method, the generated images of members are clearly closer to their originals, and the non-members differ significantly from their original images.
• Figure 2: Left: the intermediate result attacks, where the adversary supplies inputs to the denoising network and attacks based on its predictions. Note: the diffusion model includes the denoising network, scheduler, and other components.Right: the end-to-end attacks, where the adversary provides inputs to the diffusion model and attacks based on the final generation.
• Figure 3: Overview of our method. Step 1: Use a pre-trained model for DDIM inversion to obtain initial noise with semantics. Step 2: Generate images using the noise and determine membership based on the generation results.
• Figure 4: Visualization of cross-attention heatmaps. Heatmaps display the local contributions of the second attention modules in the third upsampling block. Random: generation using random noise; Self-Inv: generation using semantic noise obtained via inversion of the target model; Pre-Inv: generation using semantic noise obtained via inversion of the pre-trained model. The red boxes highlight regions with high attention, which precisely correspond to the locations of the main objects in the original images.
• Figure 5: Membership score distribution of member and non-member data in the Pokémon, T-to-I, and MS-COCO dataset, arranged from left to right. The score distribution gap between member data and hold-out data is significantly larger in our method.