Unveiling Structural Memorization: Structural Membership Inference Attack for Text-to-Image Diffusion Models

TL;DR

This paper introduces a novel structure-level membership inference attack for text-to-image diffusion models, exploiting their tendency to memorize image structures rather than pixel details, thereby enhancing privacy protection methods.

Contribution

The paper proposes a new structure-level MIA method for diffusion models, moving beyond pixel-based approaches, and demonstrates its superior performance and robustness.

Findings

Achieves state-of-the-art MIA performance on diffusion models.

Outperforms pixel-level baselines in accuracy.

Shows robustness against various distortions.

Abstract

With the rapid advancements of large-scale text-to-image diffusion models, various practical applications have emerged, bringing significant convenience to society. However, model developers may misuse the unauthorized data to train diffusion models. These data are at risk of being memorized by the models, thus potentially violating citizens' privacy rights. Therefore, in order to judge whether a specific image is utilized as a member of a model's training set, Membership Inference Attack (MIA) is proposed to serve as a tool for privacy protection. Current MIA methods predominantly utilize pixel-wise comparisons as distinguishing clues, considering the pixel-level memorization characteristic of diffusion models. However, it is practically impossible for text-to-image models to memorize all the pixel-level information in massive training sets. Therefore, we move to the more advanced structure-level memorization. Observations on the diffusion process show that the structures of members are better preserved compared to those of nonmembers, indicating that diffusion models possess the capability to remember the structures of member images from training sets. Drawing on these insights, we propose a simple yet effective MIA method tailored for text-to-image diffusion models. Extensive experimental results validate the efficacy of our approach. Compared to current pixel-level baselines, our approach not only achieves state-of-the-art performance but also demonstrates remarkable robustness against various distortions.