{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/white-box-membership-inference-attacks","title":"White-box Membership Inference Attacks against Diffusion Models","arxiv_id":"2308.06405","date":"2023-08-11","proceeding":null,"authors":["Yan Pang","Tianhao Wang","Xuhui Kang","Mengdi Huai","Yang Zhang"],"abstract":"Diffusion models have begun to overshadow GANs and other generative models in industrial applications due to their superior image generation performance. The complex architecture of these models furnishes an extensive array of attack features. In light of this, we aim to design membership inference attacks (MIAs) catered to diffusion models. We first conduct an exhaustive analysis of existing MIAs on diffusion models, taking into account factors such as black-box/white-box models and the selection of attack features. We found that white-box attacks are highly applicable in real-world scenarios, and the most effective attacks presently are white-box. Departing from earlier research, which employs model loss as the attack feature for white-box MIAs, we employ model gradients in our attack, leveraging the fact that these gradients provide a more profound understanding of model responses to various samples. We subject these models to rigorous testing across a range of parameters, including training steps, sampling frequency, diffusion steps, and data variance. Across all experimental settings, our method consistently demonstrated near-flawless attack performance, with attack success rate approaching 100% and attack AUCROC near 1.0. We also evaluate our attack against common defense mechanisms, and observe our attacks continue to exhibit commendable performance.","url_abs":"https://arxiv.org/abs/2308.06405v3","url_pdf":"https://arxiv.org/pdf/2308.06405v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"links_only","authors_date_abstract":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license), from the Kaggle arXiv metadata snapshot of 2026-09-12"},"code_links":[{"paper_slug":"white-box-membership-inference-attacks","repo_url":"https://github.com/py85252876/GSA","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2308.06405","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2308.06405"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/py85252876/GSA","reach":null}],"summary":{"ran_draft_wrong":4},"by_repo_kind":{"listed":{"samples":4,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":4,"samples":[{"code_sha256_prefix":"22c5e89638e3eb58","entry":"check_embedding","repo":"py85252876/GSA","repo_kind":"listed","path":"Imagen/gen_l2_gradients_Imagen.py","file_url":"https://github.com/py85252876/GSA/blob/HEAD/Imagen/gen_l2_gradients_Imagen.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"22c5e89638e3eb58"}},{"code_sha256_prefix":"23e55de5f1f290ce","entry":"load_target_data","repo":"py85252876/GSA","repo_kind":"listed","path":"test_attack_accuracy.py","file_url":"https://github.com/py85252876/GSA/blob/HEAD/test_attack_accuracy.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"23e55de5f1f290ce"}},{"code_sha256_prefix":"c1e526566040ae5a","entry":"prepare","repo":"py85252876/GSA","repo_kind":"listed","path":"Imagen/gen_l2_gradients_Imagen.py","file_url":"https://github.com/py85252876/GSA/blob/HEAD/Imagen/gen_l2_gradients_Imagen.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c1e526566040ae5a"}},{"code_sha256_prefix":"378230dbf19eb8c0","entry":"preprocess","repo":"py85252876/GSA","repo_kind":"listed","path":"test_attack_accuracy.py","file_url":"https://github.com/py85252876/GSA/blob/HEAD/test_attack_accuracy.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"378230dbf19eb8c0"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}