《Towards Black-Box Membership Inference Attack for Diffusion Models》论文笔记

《Towards Black-Box Membership Inference Attack for Diffusion Models》

Abstract

  1. 识别艺术品是否用于训练扩散模型的挑战,重点是人工智能生成的艺术品中的成员推断攻击------copyright protection
  2. 不需要访问内部模型组件的新型黑盒攻击方法
  3. 展示了在评估 DALL-E 生成的数据集方面的卓越性能。

作者主张

previous methods are not yet ready for copyright protection in diffusion models.

Contributions(文章里有三点,我觉得只有两点)

  1. ReDiffuse:using the model's variation API to alter an image and compare it with the original one.
  2. A new MIA evaluation dataset:use the image titles from LAION-5B as prompts for DALL-E's API [31] to generate images of the same contents but different styles.

Algorithm Design

target model:DDIM

为什么要强行引入一个版权保护的概念???

定义black-box variation API

x ^ = V θ ( x , t ) \hat{x}=V_{\theta}(x,t) x^=Vθ(x,t)

细节如下:

总结为: x x x加噪变为 x t x_t xt,再通过DDIM连续降噪变为 x ^ \hat{x} x^

intuition

Our key intuition comes from the reverse SDE dynamics in continuous diffusion models.

one simplified form of the reverse SDE (i.e., the denoise step)
X t = ( X t / 2 − ∇ x log ⁡ p ( X t ) ) + d W t , t ∈ [ 0 , T ] (3) X_t=(X_t/2-\nabla_x\log p(X_t))+dW_t,t\in[0,T]\tag{3} Xt=(Xt/2−∇xlogp(Xt))+dWt,t∈[0,T](3)

The key guarantee is that when the score function is learned for a data point x, then the reconstructed image x ^ i \hat{x}_i x^i is an unbiased estimator of x x x.(算是过拟合的另一种说法吧)

Hence,averaging over multiple independent samples x ^ i \hat{x}_i x^i would greatly reduce the estimation error (see Theorem 1).

On the other hand, for a non-member image x ′ x' x′, the unbiasedness of the denoised image is not guaranteed.

details of algorithm:

  1. independently apply the black-box variation API n times with our target image x as input
  2. average the output images
  3. compare the average result x ^ \hat{x} x^ with the original image.

evaluate the difference between the images using an indicator function:
f ( x ) = 1 [ D ( x , x ^ ) < τ ] f(x)=1[D(x,\hat{x})<\tau] f(x)=1[D(x,x^)<τ]

A sample is classified to be in the training set if D ( x , x ^ ) D(x,\hat{x}) D(x,x^) is smaller than a threshold τ \tau τ ( D ( x , x ^ ) D(x,\hat{x}) D(x,x^) represents the difference between the two images)

ReDiffuse
Theoretical Analysis

什么是sampling interval???

MIA on Latent Diffusion Models

泛化到latent diffusion model,即Stable Diffusion

ReDiffuse+

variation API for stable diffusion is different from DDIM, as it includes the encoder-decoder process.
z = E n c o d e r ( x ) , z t = α ‾ t z + 1 − α ‾ t ϵ , z ^ = Φ θ ( z t , 0 ) , x ^ = D e c o d e r ( z ^ ) (4) z={\rm Encoder}(x),\quad z_t=\sqrt{\overline{\alpha}_t}z+\sqrt{1-\overline{\alpha}t}\epsilon,\quad \hat{z}=\Phi{\theta}(z_t,0),\quad \hat{x}={\rm Decoder}(\hat{z})\tag{4} z=Encoder(x),zt=αt z+1−αt ϵ,z^=Φθ(zt,0),x^=Decoder(z^)(4)
modification of the algorithm

independently adding random noise to the original image twice and then comparing the differences between the two restored images x ^ 1 \hat{x}_1 x^1 and x ^ 2 \hat{x}_2 x^2:
f ( x ) = 1 [ D ( x ^ 1 , x ^ 2 ) < τ ] f(x)=1[D(\hat{x}_1,\hat{x}_2)<\tau] f(x)=1[D(x^1,x^2)<τ]

Experiments

Evaluation Metrics
  1. AUC
  2. ASR
  3. TPR@1%FPR
same experiment's setup in previous papers [5, 18].
target model DDIM Stable Diffusion
version 《Are diffusion models vulnerable to membership inference attacks?》 original:stable diffusion-v1-5 provided by Huggingface
dataset CIFAR10/100,STL10-Unlabeled,Tiny-Imagenet member set:LAION-5B,corresponding 500 images from LAION-5;non-member set:COCO2017-val,500 images from DALL-E3
T 1000 1000
k 100 10
baseline methods [5]Are diffusion models vulnerable to membership inference attacks?: SecMIA [18]An efficient membership inference attack for the diffusion model by proximal initialization. [28]Membership inference attacks against diffusion models
publication International Conference on Machine Learning arXiv preprint 2023 IEEE Security and Privacy Workshops (SPW)
Ablation Studies
  1. The impact of average numbers
  2. The impact of diffusion steps
  3. The impact of sampling intervals
相关推荐
Chandler_Song3 天前
【读书笔记】《有限与无限的游戏》
论文阅读
lubiii_3 天前
网络安全渗透测试第一步信息收集
安全·web安全·网络安全
无妄无望3 天前
目标计数论文阅读(2)Learning To Count Everything
论文阅读·everything
七元权3 天前
论文阅读-Correlate and Excite
论文阅读·深度学习·注意力机制·双目深度估计
李加号pluuuus3 天前
【论文阅读】Language-Guided Image Tokenization for Generation
论文阅读
ZHANG8023ZHEN3 天前
fMoE论文阅读笔记
论文阅读·笔记
张较瘦_3 天前
[论文阅读] 人工智能 + 软件工程 | 大语言模型驱动的多来源漏洞影响库识别研究解析
论文阅读·人工智能·语言模型
有Li3 天前
基于联邦学习与神经架构搜索的可泛化重建:用于加速磁共振成像|文献速递-最新医学人工智能文献
论文阅读·人工智能·文献·医学生
Suckerbin4 天前
TBBT: FunWithFlags靶场渗透
笔记·安全·web安全·网络安全
jieyu11194 天前
反序列化漏洞详解
网络安全·漏洞原理