提出高效会员推理框架，仅用两次查询即可精准检测训练数据
DIME: Query-Efficient Framework for Membership Inference on Diffusion Models
- 基于去噪器理想误差建模，分解出重建精度与局部密集度信号
- 在多个数据集上以极低查询量（最低2次）实现远超现有方法的攻击效果
- 适合研究模型隐私泄露或设计防御方案的研究者参考
会员推理攻击可判断个体记录是否被用于模型训练，但现有扩散模型攻击多为启发式且需大量查询。本文提出理论严谨、查询高效的DIME（去噪器理想会员误差）框架。核心思想是精确刻画有限训练集下最优扩散去噪器，揭示会员信息泄露由去噪器隐式重建误差决定。该误差分解为两个互补信号：偏置项（反映重建精度）和此前未被探索的局部稠密项（反映邻近训练样本几何结构）。二者均可通过少量模型查询高效估计，实现仅需两次查询的实用攻击。在CIFAR-10/100、STL10-U、CelebA和ImageNet上，DIME在相近或更低查询成本下持续优于先前方法，于1%误报率下真阳性率提升最高达3倍；尤为显著的是，其两查询版本可超越现有30查询基线。最后，我们提出、讨论并评估了针对性防御措施。
原文摘要 · Abstract (English)
Membership inference attacks expose whether individual records were used to train a model, yet existing attacks on diffusion models are largely heuristic and can require substantial query budgets. We introduce DIME (Denoiser Ideal Membership Error), a theoretically grounded and query-efficient framework for membership inference on diffusion models. Our starting point is an exact characterization of the optimal diffusion denoiser for a finite training set, which reveals that membership leakage is governed by the denoiser's implicit reconstruction error. This error decomposes into two complementary signals: a bias term, capturing reconstruction accuracy, and a previously unexplored local crowding term, capturing the geometry of nearby training examples. Both admit efficient estimators using only model queries, yielding a practical attack with as few as two queries. Across CIFAR-10/100, STL10-U, CelebA, and ImageNet, DIME consistently outperforms prior attacks at comparable or substantially lower query cost, improving TPR at 1% FPR by up to $3\times$; remarkably, its two-query variant can outperform existing 30-query baselines. Finally, we suggest, discuss, and evaluate specific defenses to counteract such powerful membership tests.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。