Noise as a Probe: Membership Inference Attacks on Diffusion Models Leveraging Initial Noise

2026-01-29

AI Summary

This study investigates the privacy vulnerability of diffusion models to membership inference attacks after fine-tuning, particularly in settings where intermediate model outputs or auxiliary datasets are unavailable. The authors demonstrate that even at the highest noise step, residual semantic signals from training data persist, revealing that standard noise schedules fail to fully erase semantic information from training samples. Building on this insight, they propose a novel membership inference attack that requires neither intermediate activations nor shadow models. Instead, the method leverages statistical correlations between semantic content injected into the initial noise and the final generated outputs to infer membership. Experimental results show that this approach effectively identifies whether a given sample was part of the training set, highlighting significant privacy risks inherent in fine-tuned diffusion models.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Machine Learning: Privacy
• Natural Language Processing: Safety and Robustness

Application Category

• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Diffusion models have achieved remarkable progress in image generation, but their increasing deployment raises serious concerns about privacy. In particular, fine-tuned models are highly vulnerable, as they are often fine-tuned on small and private datasets. Membership inference attacks (MIAs) are used to assess privacy risks by determining whether a specific sample was part of a model's training data. Existing MIAs against diffusion models either assume obtaining the intermediate results or require auxiliary datasets for training the shadow model. In this work, we utilized a critical yet overlooked vulnerability: the widely used noise schedules fail to fully eliminate semantic information in the images, resulting in residual semantic signals even at the maximum noise step. We empirically demonstrate that the fine-tuned diffusion model captures hidden correlations between the residual semantics in initial noise and the original images. Building on this insight, we propose a simple yet effective membership inference attack, which injects semantic information into the initial noise and infers membership by analyzing the model's generation result. Extensive experiments demonstrate that the semantic initial noise can strongly reveal membership information, highlighting the vulnerability of diffusion models to MIAs.

Problem

• membership inference attacks
• diffusion models
• privacy
• initial noise
• semantic information

Innovation

• membership inference attack
• diffusion models
• initial noise
• semantic leakage
• privacy vulnerability