通过集合多图信号，99%置信度识别扩散模型是否使用了版权数据。
CDI: Copyrighted Data Identification in Diffusion Models
- 利用数据集级成员身份推断，聚合多个样本的隐藏信号。
- 仅需70张公开图片，即可以99%以上置信度检测训练数据归属。
- 适合版权方、艺术家或媒体公司验证数据是否被非法训练使用。
扩散模型（DMs）依赖大规模多样数据集进行训练，而这些数据常未经许可从网络抓取，引发版权与知识产权争议。尽管可通过推理时复现训练样本检测非法使用，但当输出非精确副本时，数据所有者难以验证其数据是否被用于训练。理论上，成员身份推断攻击（MIAs）可用于判断某数据点是否参与训练，但我们发现现有MIAs在大型先进扩散模型中可靠性不足。为此，我们提出CDI框架，帮助数据所有者识别其数据集是否被用于训练给定扩散模型。该方法不依赖单个样本信号，而是利用数据所有者通常拥有多个公开可查的数据点这一特性，通过选择性聚合现有MIAs信号，并结合新设计的特征提取方法，输入评分模型并进行严格统计检验。实验表明，即使仅有70个数据点，也能以超过99%的置信度完成识别。CDI为版权持有者提供了有力工具，用于主张其数据被不当使用。代码已开源：https://github.com/sprintml/copyrighted_data_identification。
原文摘要 · Abstract (English)
Diffusion Models (DMs) benefit from large and diverse datasets for their training. Since this data is often scraped from the Internet without permission from the data owners, this raises concerns about copyright and intellectual property protections. While (illicit) use of data is easily detected for training samples perfectly re-created by a DM at inference time, it is much harder for data owners to verify if their data was used for training when the outputs from the suspect DM are not close replicas. Conceptually, membership inference attacks (MIAs), which detect if a given data point was used during training, present themselves as a suitable tool to address this challenge. However, we demonstrate that existing MIAs are not strong enough to reliably determine the membership of individual images in large, state-of-the-art DMs. To overcome this limitation, we propose CDI, a framework for data owners to identify whether their dataset was used to train a given DM. CDI relies on dataset inference techniques, i.e., instead of using the membership signal from a single data point, CDI leverages the fact that most data owners, such as providers of stock photography, visual media companies, or even individual artists, own datasets with multiple publicly exposed data points which might all be included in the training of a given DM. By selectively aggregating signals from existing MIAs and using new handcrafted methods to extract features for these datasets, feeding them to a scoring model, and applying rigorous statistical testing, CDI allows data owners with as little as 70 data points to identify with a confidence of more than 99% whether their data was used to train a given DM. Thereby, CDI represents a valuable tool for data owners to claim illegitimate use of their copyrighted data. We make the code available at https://github.com/sprintml/copyrighted_data_identification
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。