Papers for

ai model security engineers

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

Improving membership inference in diffusion models with time-based calibration

Difficulty Calibration Across Time for Membership Inference in Diffusion Models

Abstract: Modern diffusion models are trained on massive datasets that often include copyrighted or private images. Membership inference attacks (MIAs) address this by testing whether a given image was in a model's training set. The standard approach scores an image by its reconstruction loss and flags low-loss images as members. This often fails because some images are simply easier to reconstruct than others, so a simple unseen image can score a lower loss than a complex training image. Difficulty calibration separates memorization from how difficult an image is to begin with. We show how to calibrate along two axes of time: training time and diffusion time. First, across training time, we introduce Reference-Model Calibration (RMC), which compares a fine-tuned model's loss against an earlier checkpoint. This cleanly isolates newly memorized data and gives near-perfect auditing, even without text captions. Since earlier checkpoints are not always available, we next present Temporal Self-Calibration (TSC), which calibrates across diffusion time using only a single model. Our key observation is that an image's difficulty persists across noise levels, whereas memorization is localized in time. By comparing the loss at a target timestep against neighboring timesteps from the same model, TSC attenuates image difficulty using the model's own trajectory. Empirically, our methods beat the state of the art by a wide margin, and unlike most existing attacks, generalize across different model parameterizations such as $x$-, $v$-, and $ε$-prediction models. Code is available at https://github.com/MichaelJoseph777/TSC.

Thu 29 OctComputer Vision and Pattern RecognitionCryptography and SecurityMachine Learning
The gist
Modern diffusion models learn from huge collections of images, but it's hard to tell if a specific picture was part of that training set. The usual way guesses based on how well the model recreates the image, but some images are naturally easier to recreate, causing confusion. The authors developed methods that compare model behavior over time—either across training checkpoints or within the image reconstruction process itself—to better separate true memorization from image difficulty. Their approaches improve the accuracy of figuring out which images the model actually memorized.
Open → 2610.40616v1