Extracting Training Data from Unconditional Diffusion Models

2024-06-18

arXiv.org

AI Summary

This work presents the first systematic investigation of data memorization in unconditional diffusion models and its associated risks of data leakage and copyright infringement. Existing data extraction methods are limited to conditional models and cannot be directly applied to unconditional ones. Method: We propose a theory-driven memorization measurement framework that introduces surrogate conditioning and the SIDE (Score-based Inversion via Distribution Estimation) method to enable reverse engineering of training data from unconditional diffusion models. Our approach combines memorization modeling, theoretical analysis of conditional memorization, surrogate condition construction via classifier training on generated samples, and gradient-based optimization for reconstructing original training instances. Results: On CelebA, our method achieves over a 50% average improvement in extraction success rate. Crucially, it is the first to successfully recover original training images from multiple unconditional diffusion models—where prior methods completely fail.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Machine Learning: Large Multimodal Models (LMMs)
• Search and Optimization: Learning to Search

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Fairness-aware retrieval and ranking
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

As diffusion probabilistic models (DPMs) are being employed as mainstream models for generative artificial intelligence (AI), the study of their memorization of the raw training data has attracted growing attention. Existing works in this direction aim to establish an understanding of whether or to what extent DPMs learn by memorization. Such an understanding is crucial for identifying potential risks of data leakage and copyright infringement in diffusion models and, more importantly, for more controllable generation and trustworthy application of Artificial Intelligence Generated Content (AIGC). While previous works have made important observations of when DPMs are prone to memorization, these findings are mostly empirical, and the developed data extraction methods only work for conditional diffusion models. In this work, we aim to establish a theoretical understanding of memorization in DPMs with 1) a memorization metric for theoretical analysis, 2) an analysis of conditional memorization with informative and random labels, and 3) two better evaluation metrics for measuring memorization. Based on the theoretical analysis, we further propose a novel data extraction method called extbf{Surrogate condItional Data Extraction (SIDE)} that leverages a classifier trained on generated data as a surrogate condition to extract training data directly from unconditional diffusion models. Our empirical results demonstrate that SIDE can extract training data from diffusion models where previous methods fail, and it is on average over 50% more effective across different scales of the CelebA dataset.

Problem

• Investigates memorization risks in unconditional diffusion models.
• Proposes SIDE method for extracting training data effectively.
• Enhances understanding of data leakage in generative AI.

Innovation

• Surrogate condItional Data Extraction (SIDE) method
• Time-dependent classifier for data extraction
• Enhanced effectiveness on CelebA dataset