Where Rectified Flows Leak: Characterising Membership Signals Along the Interpolation Path

Understanding what generative models retain from training data remains challenging, with implications for copyright and privacy. Beyond verbatim reproduction, models can encode subtler traces of their training data that never surface in their outputs yet remain exploitable. We study this regime for Rectified Flows, which are increasingly used in deployed generative systems. We analyse the interpolation path $X_\lambda = (1-\lambda)X_0 + \lambda X_1$ that defines the Rectified Flow training. We show that a gap exists between the reconstruction of train and test data that follows a bell-shaped curve over $\lambda$, wich accumulates during training, while the validation metrics remain stable. The signal has a maximum whose location we derive in closed form under Gaussian assumptions. We validate these predictions on both audio and images and show that the bell-shaped structure is universal, while the peak prediction holds when our assumptions are satisfied. As a proof of concept, we exploit this specific $\lambda$-resolved structure to perform a Membership Inference Attack, distinguishing members of the training set from non-members.

Generative AI systems that create music or images are trained on large datasets, raising concerns about what these models retain from their training data. Even when a model never reproduces a training sample exactly, it may still treat it differently from data it has never seen: reconstructing it more accurately, for instance. Can we detect and measure this effect? We studied this question for Rectified Flows, a technique behind popular systems like FLUX and Stable Audio. During training, each data sample is blended with random noise at varying levels. We found that the gap between how well the model reconstructs training data versus new data follows a predictable bell-shaped curve across these blending levels, and we derived a formula for where this gap is largest. Crucially, this signal builds up silently: standard training diagnostics show nothing unusual. We validated these predictions on both music and image datasets, and showed that a simple classifier exploiting this structure can reliably tell whether a given sample was used for training.