Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective

TL;DR

This paper reveals that diffusion models' poor handling of high-frequency information hampers membership inference attacks and proposes a high-frequency filtering method to enhance attack effectiveness.

Contribution

It formalizes a unified paradigm for MIAs on diffusion models, identifies the high-frequency processing deficiency, and introduces a plug-and-play filter to improve attack performance.

Findings

High-frequency content influences membership classification errors.

The proposed filter improves attack accuracy across datasets.

Theoretical analysis links high-frequency deficiency to reduced attack advantage.

Abstract

Diffusion models have achieved tremendous success in image generation, but they also raise significant concerns regarding privacy and copyright issues. Membership Inference Attacks (MIAs) are designed to ascertain whether specific data were utilized during a model's training phase. As current MIAs for diffusion models typically exploit the model's image prediction ability, we formalize them into a unified general paradigm which computes the membership score for membership identification. Under this paradigm, we empirically find that existing attacks overlook the inherent deficiency in how diffusion models process high-frequency information. Consequently, this deficiency leads to member data with more high-frequency content being misclassified as hold-out data, and hold-out data with less high-frequency content tend to be misclassified as member data. Moreover, we theoretically demonstrate that this deficiency reduces the membership advantage of attacks, thereby interfering with the effective discrimination of member data and hold-out data. Based on this insight, we propose a plug-and-play high-frequency filter module to mitigate the adverse effects of the deficiency, which can be seamlessly integrated into any attacks within this general paradigm without additional time costs. Extensive experiments corroborate that this module significantly improves the performance of baseline attacks across different datasets and models.