DIME exposes two-query membership leaks in diffusion models

Problem

This paper studies membership inference against diffusion-based generative models: determining whether a specific image was included in a model's training set by querying the model. This matters because diffusion models are widely deployed for image synthesis, and confirmation that an individual's image or copyrighted content was used in training can cause privacy, legal, or compliance harms. Prior attacks were largely heuristic and often required many queries, limiting practicality against rate-limited or monitored inference APIs.

Approach

The authors derive an exact closed-form characterisation of the MSE-optimal diffusion denoiser for a finite training set, showing it equals a responsibility-weighted average of training examples where weights are a softmax over distances to the query. From this they define an estimation error that decomposes exactly into two signals: a bias term that captures reconstruction displacement and a newly identified crowding term that captures local dispersion of responsible training points. Both terms admit efficient, query-only estimators: the bias via Monte Carlo averaging of perturbed inputs and the crowding term via a Hutchinson trace estimator applied to the denoiser's local Jacobian. These estimators share the same perturbed queries and require only forward passes to the model's noise-prediction output at chosen noised inputs and timesteps, with no gradient access, shadow models, or full generative sampling. The resulting attack framework is called DIME (Denoiser Ideal Membership Error). Experiments evaluate DIME on publicly available and trained checkpoints over CIFAR-10, CIFAR-100, STL10-U, CelebA and ImageNet-1k, and compare to prior query-based baselines under a grey-box threat model.

Key Findings

• DIME consistently outperforms prior state-of-the-art query-based attacks on ASR, AUC and TPR at 1% FPR across all evaluated checkpoints and datasets.
• Query efficiency: DIME is effective with very few queries; a two-query variant already matches or exceeds many baselines that use 30 queries. Example: on ImageNet-1k DIME with two queries attains TPR@1%FPR = 14.27% versus the strongest baseline's best 9.33% at ten queries, a roughly 1.5× improvement at a fraction of the query budget.
• Magnitude of gains: at 11 queries on CIFAR-10 DIME achieves TPR@1%FPR = 47.23% compared with SimA-MC's 16.14% at 30 queries, an improvement approaching 3× in the low-false-positive regime.

Limitations

The theoretical construction concerns an idealised denoiser; real neural networks approximate this object and a formal characterisation of the approximation gap remains open. Empirically the attack's advantage varies with timestep choice and model capacity. Importantly, training with DP-SGD collapses DIME and all evaluated baselines to near-chance performance, showing differential privacy remains an effective defence at the tested budgets.

Implications

Offensive security implications are that a low-cost adversary with grey-box query access can reliably test membership for individual images, enabling confirmation that a person’s biometric or medical images, or a specific copyrighted image, were used to train a deployed diffusion model. This enables targeted privacy breaches, provenance checks by malicious actors, and automated auditing of deletion requests without access to training pipelines. Because attacks are query-light they are more deployable against rate-limited or pay-per-query APIs. Differentially private training mitigates this risk but is not yet universally applied.