{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/are-diffusion-models-vulnerable-to-membership","title":"Are Diffusion Models Vulnerable to Membership Inference Attacks?","arxiv_id":"2302.01316","date":"2023-02-02","proceeding":null,"authors":["Jinhao Duan","Fei Kong","Shiqi Wang","Xiaoshuang Shi","Kaidi Xu"],"abstract":"Diffusion-based generative models have shown great potential for image synthesis, but there is a lack of research on the security and privacy risks they may pose. In this paper, we investigate the vulnerability of diffusion models to Membership Inference Attacks (MIAs), a common privacy concern. Our results indicate that existing MIAs designed for GANs or VAE are largely ineffective on diffusion models, either due to inapplicable scenarios (e.g., requiring the discriminator of GANs) or inappropriate assumptions (e.g., closer distances between synthetic samples and member samples). To address this gap, we propose Step-wise Error Comparing Membership Inference (SecMI), a query-based MIA that infers memberships by assessing the matching of forward process posterior estimation at each timestep. SecMI follows the common overfitting assumption in MIA where member samples normally have smaller estimation errors, compared with hold-out samples. We consider both the standard diffusion models, e.g., DDPM, and the text-to-image diffusion models, e.g., Latent Diffusion Models and Stable Diffusion. Experimental results demonstrate that our methods precisely infer the membership with high confidence on both of the two scenarios across multiple different datasets. Code is available at https://github.com/jinhaoduan/SecMI.","url_abs":"https://arxiv.org/abs/2302.01316v2","url_pdf":"https://arxiv.org/pdf/2302.01316v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"are-diffusion-models-vulnerable-to-membership","repo_url":"https://github.com/jinhaoduan/secmi","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"are-diffusion-models-vulnerable-to-membership","repo_url":"https://github.com/jinhaoduan/SecMI-LDM","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"jax","reach":null}],"tasks":[{"task_slug":"image-generation","task_name":"Image Generation"}],"methods":[{"method_slug":"diffusion","method_name":"Diffusion"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2302.01316","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2302.01316"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/jinhaoduan/SecMI","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jinhaoduan/SecMI-LDM","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jinhaoduan/secmi","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":8,"ran_fixture":1,"ran_draft_wrong":2,"unverified":12},"by_repo_kind":{"official":{"samples":22,"ran":11,"repositories":1},"listed":{"samples":1,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"d36d04cf36d3999f","entry":"MIDataset","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d36d04cf36d3999f"}},{"code_sha256_prefix":"23f4defe80b11a2d","entry":"ResNet","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"23f4defe80b11a2d"}},{"code_sha256_prefix":"eba347d140a27299","entry":"ResNet18","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"eba347d140a27299"}},{"code_sha256_prefix":"8875f269d4f25f54","entry":"ddim_multistep","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8875f269d4f25f54"}},{"code_sha256_prefix":"8aae53c2358ad7f0","entry":"ddim_singlestep","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8aae53c2358ad7f0"}},{"code_sha256_prefix":"be9ea01d28064f30","entry":"get_intermediate_results","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"be9ea01d28064f30"}},{"code_sha256_prefix":"7f5852ef1a8b8ff1","entry":"naive_statistic_attack","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7f5852ef1a8b8ff1"}},{"code_sha256_prefix":"2329c33cd9385b7f","entry":"nn_eval","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2329c33cd9385b7f"}},{"code_sha256_prefix":"94c0240d193981e4","entry":"nn_train","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"94c0240d193981e4"}},{"code_sha256_prefix":"a1c7d50f62f751e4","entry":"roc","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a1c7d50f62f751e4"}},{"code_sha256_prefix":"f875a34ca4b25fe9","entry":"split_nn_datasets","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f875a34ca4b25fe9"}},{"code_sha256_prefix":"565b5f4760c965c4","entry":"MIACIFAR10","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"565b5f4760c965c4"}},{"code_sha256_prefix":"a37837f442664e59","entry":"MIACIFAR100","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a37837f442664e59"}},{"code_sha256_prefix":"e178434e00efeaa1","entry":"MIACelebA","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e178434e00efeaa1"}},{"code_sha256_prefix":"c1bd6f416b361a68","entry":"MIAImageFolder","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c1bd6f416b361a68"}},{"code_sha256_prefix":"c8669ab03b6eb470","entry":"MIASTL10","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c8669ab03b6eb470"}},{"code_sha256_prefix":"8ea9b61c668976e2","entry":"MIASVHN","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8ea9b61c668976e2"}},{"code_sha256_prefix":"c5d32ff1786210fb","entry":"execute_attack","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c5d32ff1786210fb"}},{"code_sha256_prefix":"4f56353a85d6692e","entry":"get_reverse_denoise_results","repo":"jinhaoduan/SecMI-LDM","repo_kind":"listed","path":"src/mia/secmi.py","file_url":"https://github.com/jinhaoduan/SecMI-LDM/blob/HEAD/src/mia/secmi.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"4f56353a85d6692e"}},{"code_sha256_prefix":"1e2284fb660b2cbc","entry":"load_member_data","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1e2284fb660b2cbc"}},{"code_sha256_prefix":"af4ecede18d692d8","entry":"nns_attack","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"af4ecede18d692d8"}},{"code_sha256_prefix":"ecf81b7416f17f20","entry":"print_result","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ecf81b7416f17f20"}},{"code_sha256_prefix":"d67ce440a0baf665","entry":"secmi_attack","repo":"jinhaoduan/secmi","repo_kind":"official","path":"mia_evals/secmia.py","file_url":"https://github.com/jinhaoduan/secmi/blob/HEAD/mia_evals/secmia.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d67ce440a0baf665"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}