DIME: Query-Efficient Framework for Membership Inference on Diffusion Models
2026-08-24 • Machine Learning
Machine LearningCryptography and Security
AI summaryⓘ
The authors study how to figure out if a specific piece of data was used to train a diffusion model, which is a type of AI model for generating images. They create a new method called DIME that uses a smarter way to analyze errors made by the model’s denoiser, needing very few queries to guess membership effectively. Their approach breaks down the error into two parts: how well the model reconstructs data and how crowded the data is near the training example. Tests on various datasets show their method is better than previous ones, even with far fewer questions asked to the model. They also explore ways to defend models against these attacks.
Membership Inference AttackDiffusion ModelsDenoiserReconstruction ErrorBias TermLocal CrowdingQuery EfficiencyImage DatasetsModel Defense
Authors
Tue Do, Daniel Alabi
Abstract
Membership inference attacks expose whether individual records were used to train a model, yet existing attacks on diffusion models are largely heuristic and can require substantial query budgets. We introduce DIME (Denoiser Ideal Membership Error), a theoretically grounded and query-efficient framework for membership inference on diffusion models. Our starting point is an exact characterization of the optimal diffusion denoiser for a finite training set, which reveals that membership leakage is governed by the denoiser's implicit reconstruction error. This error decomposes into two complementary signals: a bias term, capturing reconstruction accuracy, and a previously unexplored local crowding term, capturing the geometry of nearby training examples. Both admit efficient estimators using only model queries, yielding a practical attack with as few as two queries. Across CIFAR-10/100, STL10-U, CelebA, and ImageNet, DIME consistently outperforms prior attacks at comparable or substantially lower query cost, improving TPR at 1% FPR by up to $3\times$; remarkably, its two-query variant can outperform existing 30-query baselines. Finally, we suggest, discuss, and evaluate specific defenses to counteract such powerful membership tests.