Extracting Training Data from Diffusion Models

TL;DR

This paper demonstrates that diffusion models memorize training images and can leak them at generation time, raising privacy concerns and highlighting the need for privacy-preserving training methods.

Contribution

It reveals the privacy vulnerabilities of diffusion models by extracting training data and analyzes how different training choices impact privacy risks.

Findings

Over a thousand training images extracted from diffusion models

Diffusion models are less private than GANs

Mitigating privacy risks requires new training approaches

Abstract

Image diffusion models such as DALL-E 2, Imagen, and Stable Diffusion have attracted significant attention due to their ability to generate high-quality synthetic images. In this work, we show that diffusion models memorize individual images from their training data and emit them at generation time. With a generate-and-filter pipeline, we extract over a thousand training examples from state-of-the-art models, ranging from photographs of individual people to trademarked company logos. We also train hundreds of diffusion models in various settings to analyze how different modeling and data decisions affect privacy. Overall, our results show that diffusion models are much less private than prior generative models such as GANs, and that mitigating these vulnerabilities may require new advances in privacy-preserving training.