Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective

Diffusion models have achieved tremendous success in image generation, but they also raise significant concerns regarding privacy and copyright issues. Membership Inference Attacks (MIAs) are designed to ascertain whether specific data was utilized during a model's training phase. As current MIAs for diffusion models typically exploit the model's image prediction ability, we formalize them into a unified general paradigm that computes the membership score for membership identification. Under this paradigm, we empirically find that existing attacks overlook the inherent deficiency in how diffusion models process high-frequency information. Consequently, this deficiency leads to member data with more high-frequency content being misclassified as hold-out data, and hold-out data with less high-frequency content tends to be misclassified as member data. Moreover, we theoretically demonstrate that this deficiency reduces the membership advantage of attacks, thereby interfering with the effective discrimination of member data and hold-out data. Based on this insight, we propose a plug-and-play high-frequency filter module to mitigate the adverse effects of the deficiency, which can be seamlessly integrated into any attacks within the general paradigm without additional time costs. Extensive experiments corroborate that this module significantly improves the performance of baseline attacks across different datasets and models. Code is available at https://github.com/poetic2/FreMIA.

Diffusion models can create highly realistic images, but they also raise privacy concerns because they may memorize parts of their training data. Membership Inference Attacks (MIAs) are designed to test whether a specific sample was used to train a model. In this work, we study existing MIAs for diffusion models and organize them into a unified framework. We discover that current attacks ignore an important weakness of diffusion models: they do not process high-frequency image details effectively. Because of this, images with many fine details are often wrongly identified as unseen data, while smoother images are more likely to be mistaken as training data. We further show that this problem reduces the accuracy of existing attacks. To solve it, we propose a simple high-frequency filtering module that can be easily added to existing methods without extra computational cost. Experiments on different datasets and diffusion models demonstrate that our method consistently improves the effectiveness and reliability of membership inference attacks.