CPSample: Classifier Protected Sampling for Guarding Training Data During Diffusion

TL;DR

CPSample is a novel sampling method for diffusion models that prevents training data replication and enhances privacy without sacrificing image quality, by guiding generation away from training data points using a classifier.

Contribution

This work introduces CPSample, which uses classifier guidance during sampling to protect training data privacy in diffusion models without retraining the entire model.

Findings

Achieves low FID scores on CIFAR-10 and CelebA-64.

Effectively prevents exact data replication.

Enhances robustness against membership inference attacks.

Abstract

Diffusion models have a tendency to exactly replicate their training data, especially when trained on small datasets. Most prior work has sought to mitigate this problem by imposing differential privacy constraints or masking parts of the training data, resulting in a notable substantial decrease in image quality. We present CPSample, a method that modifies the sampling process to prevent training data replication while preserving image quality. CPSample utilizes a classifier that is trained to overfit on random binary labels attached to the training data. CPSample then uses classifier guidance to steer the generation process away from the set of points that can be classified with high certainty, a set that includes the training data. CPSample achieves FID scores of 4.97 and 2.97 on CIFAR-10 and CelebA-64, respectively, without producing exact replicates of the training data. Unlike prior methods intended to guard the training images, CPSample only requires training a classifier rather than retraining a diffusion model, which is computationally cheaper. Moreover, our technique provides diffusion models with greater robustness against membership inference attacks, wherein an adversary attempts to discern which images were in the model's training dataset. We show that CPSample behaves like a built-in rejection sampler, and we demonstrate its capabilities to prevent mode collapse in Stable Diffusion.