无需文字描述,也能检测图像是否被模型记忆。
No Caption, No Problem: Caption-Free Membership Inference via Model-Fitted Embeddings
- 通过优化图像生成对抗样本,构建模型专属的假文本条件。
- 在无真实描述时仍可实现高精度成员推断,优于现有方法。
- 适合研究模型隐私、数据泄露风险的从业者使用。
潜变量扩散模型在高质量文生图生成中取得显著进展,但其对训练数据的记忆倾向引发严重的隐私与知识产权问题。成员推断攻击(MIAs)为审计此类记忆提供了一种系统性方法,用于判断特定样本是否曾出现在训练集中。然而,现有方法依赖真实文本描述,这一假设在仅拥有图像而无标注的真实场景中失效,导致基于视觉-语言模型(VLM)生成的描述无法有效替代。本文提出MoFit,一种无需真实描述的成员推断框架,通过构建显式过拟合目标模型生成流形的合成条件输入。给定查询图像后,该方法分两阶段进行:(i) 模型适配代理优化,即对图像施加扰动以生成位于成员样本所学无条件先验区域内的代理图像;(ii) 代理驱动嵌入提取,从该代理中提取模型适配嵌入,并作为查询图像的不匹配条件。该嵌入能显著增强成员样本的条件损失响应,而对非成员样本影响较小,从而在缺乏真实描述的情况下提升区分能力。在多个数据集和扩散模型上的全面实验表明,MoFit始终优于先前基于VLM的基线方法,性能接近依赖真实描述的方法。
原文摘要 · Abstract (English)
Latent diffusion models have achieved remarkable success in high-fidelity text-to-image generation, but their tendency to memorize training data raises critical privacy and intellectual property concerns. Membership inference attacks (MIAs) provide a principled way to audit such memorization by determining whether a given sample was included in training. However, existing approaches assume access to ground-truth captions. This assumption fails in realistic scenarios where only images are available and their textual annotations remain undisclosed, rendering prior methods ineffective when substituted with vision-language model (VLM) captions. In this work, we propose MoFit, a caption-free MIA framework that constructs synthetic conditioning inputs that are explicitly overfitted to the target model's generative manifold. Given a query image, MoFit proceeds in two stages: (i) model-fitted surrogate optimization, where a perturbation applied to the image is optimized to construct a surrogate in regions of the model's unconditional prior learned from member samples, and (ii) surrogate-driven embedding extraction, where a model-fitted embedding is derived from the surrogate and then used as a mismatched condition for the query image. This embedding amplifies conditional loss responses for member samples while leaving hold-outs relatively less affected, thereby enhancing separability in the absence of ground-truth captions. Our comprehensive experiments across multiple datasets and diffusion models demonstrate that MoFit consistently outperforms prior VLM-conditioned baselines and achieves performance competitive with caption-dependent methods.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。