Membership Inference Attack Against Music Diffusion Models via Generative Manifold Perturbation

TL;DR

This paper analyzes membership inference attacks on music diffusion models and shows that conventional loss-based signals poorly separate training members from non-members at forensic low-FPRs. It introduces the Latent Stability Adversarial Probe (LSA-Probe), a white-box method that quantifies the adversarial cost required to degrade perceptual quality along the reverse diffusion trajectory, arguing that training members occupy more stable regions. By optimizing time-normalized latent perturbations and calibrating a perceptual degradation threshold, LSA-Probe yields stronger low-FPR signals across both waveform (DiffWave) and latent (MusicLDM) diffusion models on MAESTRO and FMA-Large datasets, with perceptual metrics like CDPAM and MR-STFT providing robust discrimination. The work demonstrates practical utility for forensic auditing of copyright and privacy in generative music, highlighting mid-trajectory timesteps and moderate perturbation budgets as particularly informative and offering a framework that extends to latent-diffusion architectures.

Abstract

Membership inference attacks (MIAs) test whether a specific audio clip was used to train a model, making them a key tool for auditing generative music models for copyright compliance. However, loss-based signals (e.g., reconstruction error) are weakly aligned with human perception in practice, yielding poor separability at the low false-positive rates (FPRs) required for forensics. We propose the Latent Stability Adversarial Probe (LSA-Probe), a white-box method that measures a geometric property of the reverse diffusion: the minimal time-normalized perturbation budget needed to cross a fixed perceptual degradation threshold at an intermediate diffusion state. We show that training members, residing in more stable regions, exhibit a significantly higher degradation cost.

Figures (2)

• Figure 1: LSA-Probe overview (two-loop procedure at timestep $t$).(a) Outer control loop. We search the budget $\eta$ by binary search to find the adversarial cost$C_{\mathrm{adv}}(x_0;t,\tau)=\min\{\eta:\ D(\hat{x}_0,\hat{x}_0^{\delta})\ge\tau\}$, then use $C_{\mathrm{adv}}$ as the decision score (higher $\Rightarrow$ more likely member); the dashed line indicates the decision threshold used for TPR@FPR analyses. (b) Inner loop (PGD on $\tilde{\delta}$). Given a target waveform $x_0$, we form $x_t$ by the forward process and inject a time-normalized latent perturbation $\delta_t=\sigma_t\tilde{\delta}$ with $\sigma_t=\sqrt{1-\bar{\alpha}_t}$. We update $\tilde{\delta}$ for $K$ steps with projection onto the $\ell_p$ ball $\|\tilde{\delta}\|_p\le\eta$ (sign step for $\ell_\infty$ or normalized gradient for $\ell_2$), while backpropagating through the deterministic reverse operator $R_t(\cdot;\theta)$ and the chosen differentiable distance $D$ (CDPAM, MR-STFT, log-mel MSE, or waveform MSE). The inner loop outputs the degradation $D(\hat{x}_0,\hat{x}_0^{\delta})$ for the current $\eta$, which the outer loop uses to adjust $\eta$. For each $(x_0,t)$ we fix the forward noise $\epsilon$ (seeded) to isolate the effect of $\delta_t$; restarts and momentum are omitted from the diagram for clarity.
• Figure 2: Key analyses under fixed $\tau{=}$P95 (DDIM, $p{=}2$, $\eta_{\max}{=}0.8$). (a) ROC curves with 95% CIs; our LSA-Probe improves the low-FPR region. (b) Timestep ablation: mid-trajectory timesteps yield stronger separability. (c) Budget ablation: larger budgets help until mild saturation. (d) Metric robustness: perceptual metrics (CDPAM/MR-STFT) outperform training-aligned MSEs at low FPR.