Paper Overview
Field: Computer Vision Authors: Michael Joseph, Yedid Hoshen Published: 2025-10-28 arXiv: 2510.25908
Summary
Modern diffusion models are trained on massive datasets that often include copyrighted or private images. Membership inference attacks (MIAs) address this by testing whether a given image was in a model's training set. The standard approach scores an image by its reconstruction loss and flags low-loss images as members. This often fails because some images are simply easier to reconstruct than others, so a simple unseen image can score a lower loss than a complex training image.
Difficulty calibration separates memorization from how difficult an image is to begin with. The authors show how to calibrate along two axes of time: training time and diffusion time.
Reference-Model Calibration (RMC)
Across training time, RMC compares a fine-tuned model's loss against an earlier checkpoint. This cleanly isolates newly memorized data and enables near-perfect auditing, even without text captions.
Time-Self-Calibration (TSC)
Because earlier checkpoints are not always available, TSC calibrates over diffusion time using only a single model. The key observation is that an image's difficulty persists across noise levels, while memorization is temporally localized. By comparing the loss at a target timestep with losses at adjacent timesteps from the same model, TSC uses the model's own trajectory to attenuate image difficulty.
Results
Empirically, the proposed methods beat state-of-the-art approaches by a large margin. Unlike most existing attacks, they generalize to different model parameterizations such as x-, v-, and epsilon-prediction models.
Links
- arXiv: https://arxiv.org/abs/2510.25908
- Code: https://github.com/MichaelJoseph777/TSC