Local conditional fit improves membership inference in image diffusion models
Probing Local Conditional Fit for Diffusion Model Membership Inference
Artificial IntelligenceComputer Vision and Pattern RecognitionMachine Learning
Summary
Membership inference is a way to check if a specific example was used to train an AI model that generates images from text. The authors found a new signal related to how the model’s predictions change when given different text prompts. They created a method called LoFIT that measures these small changes without needing complex information from the model. Tests on several datasets show that LoFIT can better tell if an example was part of training, especially early in the training process.
What this means in practice
- •For ai model auditors: Detect if individual images were used to train sensitive text-to-image diffusion models using efficient non-gradient analysis.
- •For ai service operators: Monitor and track training data usage during fine-tuning of diffusion models for compliance and privacy auditing.
Authors
ByungHee Cha, Naoki Murata, Yuhta Takida, Jong Chul Ye, Yuki Mitsufuji
Abstract
Membership inference determines whether a candidate example was used to train a text-to-image diffusion model and is an important tool for auditing training-data use. We identify a directional membership signal in \emph{conditional prediction shifts}, the changes in predicted noise under alternative text conditions at a fixed noisy input: whether movement toward the alternative prediction initially lowers or raises the denoising loss from its value under the original caption. Members exhibit less room for such local improvement. To quantify this response, we propose \emph{LoFIT} (Local Conditional Fit), which measures the initial response of the denoising loss along normalized prediction shifts and aggregates it across multiple text conditions and diffusion states. LoFIT requires no target-model gradients and can be computed using only forward queries to the denoiser. Evaluations on four datasets show improved membership discrimination across fine-tuned and pretrained models. LoFIT distinguishes members early in fine-tuning, while the naive denoising-loss baseline remains near chance. Controlled comparisons show that the membership signal is concentrated in the first-order response, with little discrimination from prediction-shift magnitude alone.