# Towards More Realistic Membership Inference Attacks on Large Diffusion
Models

Jan Dubiński 1,2 Antoni Kowalczuk 1† Stanisław Pawlak 1 Przemyslaw Rokita 1
Tomasz Trzcinski 1,2,3 Paweł Morawiecki 4 Corresponding author:
<EMAIL_ADDRESS>contribution. 1Warsaw University of
Technology 2IDEAS NCBR 3Tooploox 4Polish Academy of Sciences

###### Abstract

Generative diffusion models, including Stable Diffusion and Midjourney, can
generate visually appealing, diverse, and high-resolution images for various
applications. These models are trained on billions of internet-sourced images,
raising significant concerns about the potential unauthorized use of
copyright-protected images. In this paper, we examine whether it is possible
to determine if a specific image was used in the training set, a problem known
in the cybersecurity community as a membership inference attack. Our focus is
on Stable Diffusion, and we address the challenge of designing a fair
evaluation framework to answer this membership question. We propose a new
dataset to establish a fair evaluation setup and apply it to Stable Diffusion,
also applicable to other generative models. With the proposed dataset, we
execute membership attacks (both known and newly introduced). Our research
reveals that previously proposed evaluation setups do not provide a full
understanding of the effectiveness of membership inference attacks. We
conclude that the membership inference attack remains a significant challenge
for large diffusion models (often deployed as black-box systems), indicating
that related privacy and copyright issues will persist in the foreseeable
future.

##  1 Introduction

In recent years, there have been rapid advancements in generative modeling
techniques within the field of deep learning. Among these, generative
diffusion models, particularly those utilising the Stable Diffusion framework,
have gained prominence due to their capability to generate high-quality,
diverse, and intricate samples. These models hold considerable potential for
numerous applications, such as data augmentation, art creation, and design
optimization. However, as these models become more widely adopted, addressing
the privacy concerns linked to their use is essential. Recently, Getty Images
filed a lawsuit against Stability AI, accusing it of unlawfully copying and
processing millions of copyright-protected images [21]. This lawsuit comes on
the heels of a separate case Getty lodged against Stability in the United
Kingdom, as well as a related class-action lawsuit that California-based
artists filed against Stability and other emerging companies in the generative
AI sector [22].

Figure 1:  Pitfalls in the evaluation setting can lead to incorrect
conclusions on the effectiveness of membership attacks against large diffusion
models such as Stable Diffusion. An exemplary misleading setup involves
finetuning the model on a very small dataset with a low internal variance
(such as the POKEMON dataset), which gives a remarkable performance for the
selected attacks. However, for the proposed new dataset we observe a drastic
performance drop. Our setup does not modify the state-of-the-art Stable
Diffusion model but focuses on creating fair membership inference evaluation,
possibly close to a real-life usage of the membership attacks.

One critical issue that arises in this context is determining whether a
specific data point was used during the training process of a model.
Extracting this information from a model - known as _membership inference
attack_ \- can be crucial in cases where copyrighted or sensitive data are
used without permission, leading to potential legal issues. Although
membership inference attacks have been extensively studied in the context of
discriminative models [3, 30, 35, 36], the investigation of their
effectiveness against generative diffusion models is still in its infancy.

In this paper, we contribute to the understanding of membership inference
attacks in large diffusion models, particularly Stable Diffusion. We provide
insights into these models, their susceptibility to different membership
attacks, and the challenges of their evaluation due to the lack of distinct
training and test data. To address these issues, we propose a new dataset for
fair and robust evaluation setup. We conduct attacks against Stable Diffusion
and assess their effectiveness. Our findings underscore the complexity of data
membership inference in large diffusion models. Our main contributions can be
summarized as follows:

  * •

We identify the pitfalls of the existing evaluation of membership inference
attacks for large diffusion models.

  * •

We provide a new
dataset111https://drive.google.com/drive/folders/17lRvzW4uXDoCf1v_sIiaMnKGIARVunNU
along with a construction methodology. It allows us to have a more robust
evaluation setup for membership inference attacks on the state-of-the-art
Stable Diffusion model.

  * •

With the proposed dataset, we thoroughly evaluate a set of membership
inference attacks, which are not prohibitively expensive against Stable
Diffusion, including the loss threshold attack and its variants. We also
introduce new attacks that focus on modifying the diffusion process to extract
more information about membership from the model.

##  2 Background

###  2.1 Diffusion models

Over the past two years, diffusion models [31] have emerged as a novel class
of generative models, overshadowing Generative Adversarial Networks [8] by
achieving state-of-the-art results on numerous benchmarks [5] and becoming the
core technology behind widely popular image generators such as Stablxe
Diffusion [24], Midjourney [32], Runway [24], Imagen [25] and DALL-E 2 [20,
19].

In essence, _Denoising Diffusion Probabilistic Models_ [10] are probabilistic
generative models trained by progressively adding noise to the data and then
learning to reverse this process.

During training, a noised image
$x_{t}\leftarrow\sqrt{a_{t}}x+\sqrt{1-a_{t}}\epsilon$ is produced by adding
Gaussian noise $\epsilon\sim\mathcal{N}(0,I)$ to a clean image $x$, with a
decaying parameter $a_{t}\in[0,1]$ such that $a_{0}=1$ and $a_{T}=0$. The
diffusion model $f_{\theta}$ is trained to remove the noise $\epsilon$ and
recover the original image $x$ by predicting the added noise. This is achieved
by stochastically minimizing the objective
$\frac{1}{N}\sum_{i}\mathbb{E}_{t,\epsilon}\mathcal{L}(x_{i},t,\epsilon;f_{\theta})$,
where

$\displaystyle\mathcal{L}(x,t,\epsilon;f_{\theta})=\lVert\epsilon-
f_{\theta}(x_{t},t)\rVert_{2}^{2}$ (1)

Despite being trained with a simple denoising objective, diffusion models have
shown the ability to generate high-quality images. The process involves
sampling a random vector $x_{T}$ from a normal distribution $\mathcal{N}(0,I)$
and then applying the diffusion model $f_{\theta}$ to remove the noise from
this random image. However, instead of removing all noise at once, the model
gradually removes part of the noise iteratively in each generation step.

The final image $x_{0}$ is obtained from $x_{T}$ using a noise schedule
$\sigma_{t}$ (dependent on $a_{t}$), where the model iteratively applies the
rule $x_{t-1}=f_{\theta}(x_{t},t)+\sigma_{t}\mathcal{N}(0,I)$ to
$\sigma_{1}=0$. The effectiveness of this process is based on the fact that
the diffusion model was trained to denoise images with varying levels of
noise. Applying this iterative generation process with large-scale diffusion
models yields results that closely resemble real images.

Certain diffusion models are designed to generate specific types of images by
incorporating conditional inputs in addition to the noised image. Class-
conditional diffusion models utilise a class label, such as "car" or "plane",
to generate a desired image class. Text-conditioned models extend this concept
by taking the text embedding of a prompt, such as "a photograph of an
astronaut riding a horse in space," which is created by a pretrained language
encoder like CLIP [18].

###  2.2 Stable Diffusion

Stable Diffusion is the largest and most popular open-source diffusion model
[24]. This model is an 890 million parameter text-conditioned diffusion model
trained on 2.3 billion images.

Diffusion models can achieve state-of-the-art synthesis results on image data
and other applications. However, the optimisation of powerful diffusion models
that operate directly in pixel space can consume hundreds of GPU days, and
inference can be expensive due to sequential evaluations. To overcome this
challenge, the authors of Stable Diffusion [24] propose applying diffusion
models in the latent space of powerful pretrained autoencoders. This approach
allows for training and inference on limited computational resources while
retaining the quality and flexibility of diffusion models.

Formally, given an image $x$, the encoder $E$ encodes $x$ into a latent
representation $z=E(x)$, and the decoder $D$ reconstructs the image from the
latent, giving $\tilde{x}=D(z)=D(E(x))$. To preprocess conditional information
$y$ from various modalities (such as language prompts), the Stable Diffusion
framework introduces a domain-specific encoder $\tau_{\theta}$ that projects
$y$ to an intermediate representation. Overall, the Stable Diffusion model is
trained by stochastically minimizing the objective
$\frac{1}{N}\sum_{i}\mathbb{E}_{t,\epsilon}\mathcal{L}(z_{i},t,\epsilon;f_{\theta})$,
where

$\displaystyle\mathcal{L}(z,t,\epsilon;f_{\theta})=\lVert\epsilon-
f_{\theta}(z_{t},t,\tau_{\theta}(y)\rVert_{2}^{2}$ (2)

##  3 Membership inference attack

Membership inference attack [30] answers the question _"was this example in
the training set?"_. Currently, two most common approaches are loss based
attacks and shadow models.

###  3.1 Loss based attacks

In principle, loss-based membership inference attacks are based on the
following simple observation [36]. A model training minimises a loss function
on a training set, hence we expect the loss to be lower for training samples
than for test ones. In most cases, such methods treat the attacked model a as
white-box, assuming that the attacker has access to the model, its source code
and trained weights. This assumption is often not met in practice, as API-
based generative machine learning services such as Midjourney [32] increase in
popularity. In general, methods based solely on the analysis of the loss of
the model are less effective than methods utilising shadow models [4, 3].

###  3.2 Shadow models

Membership inference attacks based on _shadow models_ involve creating
multiple models that imitate the behaviour of the target model, but whose
training datasets are known to the attacker. By studying the labelled inputs
and outputs of these shadow models, researchers can gain insight into the
target model’s behaviour and develop attacks that can exploit its
vulnerabilities. For diffusion models [4] introduced membership inference
attacks called LiRA. This approach involves training a collection of shadow
models on random subsets of the training dataset. Once the shadow models have
been trained, LiRA computes the loss for each example under each shadow model.
By analysing the distribution of losses, LiRA can then determine whether a
given example belongs to the training dataset or not. Although shadow models
have proven to be a powerful tool in the development of membership inference
attacks, this approach has its own disadvantages. Such methods are
computationally very expensive, as they require the training of multiple
copies of the target model. In particular, for large diffusion models such as
Stable Diffusion, the cost of developing multiple shadow models is in practice
too high.

##  4 Attack Challenges and Pitfalls for Large Diffusion Models

Lack of nonmembers To perform and evaluate a membership inference attack we
need two sets: members and nonmembers. Typically, member data samples are
drawn from the training set, whereas nonmembers from the test set.
Unfortunately, for the Stable Diffusion model, we cannot follow this approach.
The original Stable Diffusion model was trained on the data from the LAION-2B
EN dataset, a subset of the LAION-5B dataset [28]. Since the dataset is huge
(more than 2 billion images) and was not divided into a test and training set,
nonmember samples are not easily available.

Shadow models cost As stated in Section 3.2 the shadow models are
computationally expensive. The method requires training several dozens of
models from scratch. For huge models, such as Stable Diffusion, this approach
is practically infeasible. In particular, the cost of training a single Stable
Diffusion model is estimated at 600,000$. Moreover, it would take 80.000 A100
GPU-hours to complete the training.

Pitfall 1: Evaluation based on fine-tuning In [6] authors propose to tackle
the lack of nonmembers by fine-tuning the Stable Diffusion on a dataset that
was not used for training the original model. However, it has been
demonstrated that fine-tuning the model can easily lead to overfitting [12].
As shown in [4], better diffusion models are more vulnerable to membership
inference attacks: the quality of the generated samples is proportional to the
success rate of the attack. This is especially the case for models that
overfit to the limited training data during fine-tuning [36], leading to
inflated performance and misleading conclusions.

Pitfall 2: Distribution mismatch between members and nonmembers Another
approach to dealing with the absence of a natural nonmember dataset is to draw
samples from a dataset similar to the training data that was not actually used
in the training. However, for a fair evaluation of membership inference
attacks, it is important that the members and nonmembers share the same
feature distribution. If these two groups can be easily distinguished based on
feature distribution mismatch, then there is a high risk that the attack
method will learn to distinguish between the features of the two data groups
[15] instead of the behaviour of the model on these two sets.

##  5 The LAION-mi dataset

To address the absence of nonmembers samples for the Stable Diffusion model we
propose a new dataset consisting of members and nonmembers called LAION-mi.
This new dataset aims to facilitate a realistic evaluation of membership
inference attacks against large diffusion models. We do not fine-tune nor
modify the Stable Diffusion model in any other way, in order to avoid the
first pitfall from Sec. 4. To mitigate the second pitfall, we apply a
sanitization process on the member set. Figure 2 shows a general scheme of how
the LAION-mi dataset is constructed.

###  5.1 Sources of members and nonmembers sets in LAION-mi

Members Stable Diffusion-v1.4 was trained on all data points from the LAION
Aesthetics v2 5+ dataset (see Appendix C for details), so all samples from
this dataset can serve as member candidates for our new dataset.

Nonmembers To obtain the nonmembers set, we use LAION-2B Multi Translated
dataset [14]. This dataset is created by LAION-5B authors from LAION-2B Multi,
a subset of LAION-5B, but unlike LAION-2B EN, LAION-2B Multi consists of
samples which descriptions are in other languages (not English). LAION-2B
Multi Translated is obtained by translating these descriptions to English.
Since SD-v1.4 was fine-tuned using samples with an aesthetic score above 5
(obtained by LAION-Aesthetics_Predictor V2 [26]), to build our nonmembers set
we also use samples with aesthetic score above 5. The score is precomputed by
the LAION-2B Multi Translated dataset authors.

###  5.2 Adapting members and nonmembers sets to ensure the validity of
evaluation setting.

As mentioned before, for a fair evaluation of the membership inference attack
we should ensure that the underlying data distribution is the same for the
member and nonmember samples. We solve it by introducing the adaptation step
for members and nonmembers subsets constituting LAION-mi dataset. During the
adaptation, we first deduplicate the nonmembers set (Sec. 5.3) and then filter
the member set using sanitization process (Sec. 5.4). Finally, we obtain
members and nonmembers sets which have the same, indistinguishable underlying
distribution.

Figure 2:  A general scheme of constructing LAION-mi dataset. First, members
and nonmembers are sampled from LAION Aesthetics v2 5+ and LAION-2B Multi
Translated datasets, respectively. Then, we remove nonmember that are
duplicates of samples from the member set. Finally, to ensure that the
distribution of member samples is indistinguishable from nonmembers
distribution, we execute an extensive sanitization algorithm on the member
set.

###  5.3 Deduplication

Member samples in the nonmembers source dataset Duplicate samples are images
present in a dataset more than once. It has been shown [34] that LAION-2B EN
contains approximately 30% duplicates when it comes to the image data. We can
expect that the whole LAION-5B contains samples, which are present both in
LAION-2B EN and LAION-2B Multi Translated. These samples can potentially
contaminate LAION-mi nonmembers subset with members samples and therefore
compromise the fairness and correctness of our solution. The following
procedure aims to address this issue.

Solution In order to obtain the nonmembers set free of contamination by
members samples we perform two-step deduplication. The first step aims to
propose a set of duplicate candidates for each nonmember sample. The second
step filters out nonmembers samples, which we suspect have a duplicate in the
members source dataset. We end up with the clean nonmembers set.

Duplicate candidates We need to somehow obtain the samples from the LAION-2B
EN dataset which are the most similar to the given sample from the nonmember
source. We achieve this by querying the Clip Retrieval Client [1]. This
service searches through the LAION-5B dataset and returns the requested amount
of samples that are the most similar to the input image. In our approach, we
obtain up to 40 duplicate candidates per nonmember sample. One important
limitation of this service is that it doesn’t distinguish between subsets of
LAION-5B. LAION-5B is split into LAION-2B EN and LAION-2B Multi using the CLD3
[33] language identifier on the captions of images. Because we care only about
the duplicates from the LAION-2B EN, we need to check if the returned
candidate is from this dataset. We use CLD3 to check if the given candidate is
from the LAION-2B EN dataset. Only samples from the LAION-2B EN dataset are
considered duplicate candidates.

Duplicates detection and filtering When it comes to filtering out the
duplicates we propose the following approach: we define the distance metric
between the nonmember and its duplicate candidate, and then if the distance is
below some threshold we decide that this sample has a duplicate in the members
set, effectively discarding it from the final nonmember set.

Firstly, for each sample, we calculate the L2 distances of CLIP image
embeddings between the sample and all of its duplicate candidates. Then the
final duplicate candidate for each sample is the one with the lowest L2
distance score. We then end up with the approximately normal distribution of
L2 distances (see Fig. 3(a)).

We then pick the threshold below which we reject samples and mark them as
duplicates. Our goal here is to filter out as many duplicates as possible, to
avoid contamination of the nonmembers set with members samples. At the end of
this process, we have less than $1\%$ of the duplicates by setting this
threshold at $0.5$, using the rule of three [13]. We manually confirm it by
sampling random $300$ samples and checking for the duplicates, without finding
any. For the threshold of $0.5$ we reject approximately $75\%$ of nonmembers
as having a duplicate in the members source dataset. It is a really
conservative approach, but as we show next, it is necessary in order to
achieve the cleanest nonmembers set possible.

To further confirm that we pick the correct threshold we perform a manual
analysis of the duplicates ratio in different L2 score intervals and show the
results in Figure 3(b). Since our goal is to make the cleanest nonmembers
dataset possible, we pick a threshold of $0.5$ to avoid duplicates.

(a) Distribution of L2 distances.

(b) Duplicates count per 100 samples for L2 distances buckets.

Figure 3:  The distribution of the L2 distances between duplicate candidates
and the original images approximately follow a normal distribution, with a
mean around $0.4$ (left). For increasing L2 threshold value the duplicates
count decreases sharply, with the interval $[0.4,0.5)$ containing
approximately $8\%$ duplicates and $92\%$ non-duplicates.

###  5.4 Sanitization

Differences between sets As we have stated before, one of the most important
challenges of membership attack evaluation is ensuring that the member and
nonmember samples come from the most similar distribution possible, in our
case both images and their descriptions coming from these subsets should be
indistinguishable from each other. However, our source of nonmembers is
obtained by translating captions from LAION-2B Multi to English using machine
translation222Facebook’s M2M100 1.2B model [7]. Therefore, we expect the
distribution of captions’ CLIP [18] embeddings to be different for members and
nonmembers sets. We need to address this issue to not fall into the second
pitfall, which we line up in the Sec. 4.

Assessment approach In order to assess the magnitude of this problem and the
efficacy of our sanitization approach we use three metrics. All are based on
the CLIP embeddings of the descriptions and images. The metrics are as
follows:

  * •

Fréchet Inception Distance (FID) [9]: in order to compare the resulting metric
we compute it for two cases: internal (between two random samples of 10k
examples from the same set) and comparative (between 10k random members and
10k random nonmembers). If the difference between these two is significant, we
assume that there is a mismatch between distributions.

  * •

Visual analysis of PCA 2D projection: we use PCA decomposition on the
embeddings to project them into a 2D space using scikit-learn [2]
implementation. The mismatch in the underlying distributions should be
indicated by a mismatch of the distributions of the PCA components of the
projected embeddings.

  * •

Classification: we train a binary classifier in order to distinguish between
embeddings of the descriptions. High accuracy indicates a significant
difference between the two sets.

Scale of the problem Our experiments confirm the seriousness of the issue.
Firstly, we observe that FID for the comparative case is way greater than for
any of the internal cases, see Tab. 1. Secondly, visual analysis of embeddings
projected to 2D space using PCA, Fig. 4(a)) confirms our concerns that these
text embeddings are in fact different. Finally, a simple logistic regression
model separates prompt embeddings with a $90\%$ accuracy.

(a) Prompts embeddings
before sanitization

(b) Prompts embeddings after
three iterations

(c) Image embeddings after
three iterations

Figure 4:  Sanitization effect on prompts and image embeddings distribution of
the members and nonmembers sets. Figure 4(a) shows that there is a significant
difference between prompts embeddings of nonmembers and members samples before
the sanitization process. After three iterations of our sanitization Algorithm
1 these distributions match closely – Figure 4(b). Despite the fact that the
algorithm uses only prompts embeddings, we observe in Figure 4(c) that image
embeddings distributions are also well aligned after the third iteration of
our algorithm. We suspect that it is due to the close match between images and
their descriptions so that aligning text distributions leads to aligning image
distributions as well. Table 1: FID comparison for 10k samples. For text data
we calculate FID for CLIP embeddings. To calculate FID for image data we first
resize images to 512x512 and then use Pytorch FID implementation [29]. To
calculate internal FID we divide the dataset into 2 equal random subsets, each
of 10k samples.

| FID
---|---
Data subset | text | images
Members internal - random | 9.84 | 7.00
Members internal - sanitized | 9.77 | 7.06
Nonmembers internal | 9.73 | 7.01
Comparative - random | 66.43 | 13.90
Comparative - sanitized | 13.54 | 8.87

Algorithm 1 Sanitization algorithm

1:$F\leftarrow\emptyset$ $\triangleright$ trained binary classifiers

2:$NM\leftarrow\text{deduplicated nonmembers}$

3:$M\leftarrow\text{global set of members}$

4:$M_{i}\leftarrow\emptyset$ $\triangleright$ sanitized members after i-th
iteration

5:$TrainSet\leftarrow\emptyset$ $\triangleright$ training dataset

6:for $i\leftarrow 1,\ 2,\ ...,\ n$ do

7: $TrainSet\leftarrow\emptyset$

8: if $i=1$ then

9: $TrainSet\leftarrow$ sample of size $|NM|$ from $M$

10: else

11: $TrainSet\leftarrow M_{i-1}$

12: end if

13: $TrainSet\leftarrow TrainSet\cup NM$

14: $F_{i}\leftarrow\text{trained classifier on }TrainSet$

15: while $|M_{i}|<|NM|$ do

16: $M_{tmp}\leftarrow\text{sample from }M$

17: for $j\leftarrow 1,\ 2,\ ...,\ i$ do

18: if $F_{j}$ predicts member label for sample then

19: $M_{tmp}\leftarrow M_{tmp}\setminus sample$

20: end if

21: end for

22: $M_{i}\leftarrow M_{i}\cup M_{tmp}$

23: end while

24:end for

25:$SM\leftarrow M_{n}$ $\triangleright$ final sanitized members set

Santization algorithm The goal of this process is to create a member set that
is as similar as possible to our deduplicated nonmembers set.

Main intuition behind the sanitization algorithm (Alg. 1) is to train a set of
binary classifiers to label samples as members or nonmembers in an iterative
fashion, and then pick only the samples from one of these sets, for which all
of the models predict wrong label. In effect, at each iteration, one of these
sets becomes closer to the other one in terms of the text embeddings
distribution.

In general, we can use both members and nonmembers sets to perform this
classifier-based filtering. In our case, we filter only the huge members set
(LAION Aesthetics v2 5+ consists of 600M samples, our deduplicated nonmembers
set has 42.5k samples). The main reason is that the deduplication process (see
Sec. 5.3) is a great bottleneck of our system; to get duplicate candidates for
all 160k nonmember candidates, we query the retrieval API for 50h.

Results To obtain our final set of 40k sanitised members we apply the
algorithm for three iterations. To obtain this subset we filter approximately
5M samples from LAION Aesthetics v2 5+ dataset, which takes only 2h on a
single NVidia RTX 2080Ti. Using our assessment methodology we confirm its
efficacy. FID score in the comparative case drops significantly compared to
the starting members set. We see that the PCA components’ distribution align
(see Fig. 4(b)) and a binary classifier’s accuracy is almost random.

Images embeddings Regarding the image embeddings for LAION-2B EN and LAION-2B
Multi Translated, we expect them to have the same characteristics as they come
from the same source. This assumption is confirmed by a low FID value between
them, see Tab. 1. Additionally, the FID value decreases even further after the
text-focused sanitization and a binary classifier’s accuracy is almost random.
Therefore, additional sanitization efforts focused on image embeddings are not
necessary, and the PCA components are also aligned, see Fig. 4(c)).

##  6 Experiments

###  6.1 Threat model

A membership inference attack is defined as follows. We consider an adversary
$A$ that aims to infer whether a single data point $x$ was included in the
training set $D$ of a generative model $M$. The attacker has no knowledge
about the dataset $D$ and is only able to query the model $M$. We distinguish
three scenarios according to the attacker’s capabilities.

  * •

In the black-box scenario, an adversary queries a generative model with a text
prompt and gets a generated image. The attacker has no knowledge about the
model architecture and no access to its weights.

  * •

In the grey-box scenario an adversary has access to the visual and text
encoders of the attacked model. Thus, they are able to calculate the latent
representation (embedding) of a given image and text prompt. However, the
attacker still has no access to the model weights.

  * •

Finally, in the white-box scenario, an adversary has full access to the model,
its source code and trained weights.

We start with a baseline white-box model loss threshold attack, which is based
on the fact that machine learning models learn by minimising the loss in the
training samples. We extend our analysis by covering metrics related to model
inference. Moreover, we introduce new white-box attack methods and show that
they outperform the commonly used baseline method. We also describe and
evaluate a grey and a black-box scenario. The attacks are based on the
intuition that generative models tend to synthesise samples similar to their
training set. For all attacks, we evaluate a variant in which the losses are
obtained as the average of 5 losses (5 different passes through the model,
each time with a different noise) following the findings of [3]. We explore
more attack methods in the Appendix D.

###  6.2 Threshold attack

A general threshold attack is formulated as follows. For a selected threshold
$\tau$, the attack classifies the image $x$ as a member if $\mathcal{L}<\tau$.
Otherwise, $x$ belongs to the nonmember set. Commonly used threshold attacks
focus only on a model loss. We extend our analysis by Pixel and Latent error,
defined as follows:

Model loss We monitor the loss of the diffusion model given by Eq. 1
$\mathcal{L}(x,t,\epsilon;f_{\theta})=\lVert\epsilon-
f_{\theta}(x_{t},t)\rVert_{2}^{2}$.

Pixel error We define the pixel error as the reconstruction error between an
original image $x$ and the generated image $x^{\prime}$ defined as
$\mathcal{L}(x,x^{\prime})=\lVert x-x^{\prime}\rVert_{2}^{2}$.

Latent error This measurement is similar to the pixel error. However, it
focuses on the reconstruction error between a latent representation $z$ of the
original image $x$ and the latent representation $z^{\prime}$ generated by the
diffusion model. The error $\mathcal{L}(z,z^{\prime})$ is defined as $\lVert
z-z^{\prime}\rVert_{2}^{2}$.

Table 2: Threshold membership inference attacks results on LAION-mi and POKEMON datasets. We demonstrate the importance of evaluating membership inference attacks in a fair setting. On the POKEMON dataset some of the attacks are almost perfect, with _partial denoising_ reaching $\mathbf{99.5}$% TPR@FPR=1%, but on ours LAION-mi dataset with original SD-v1.4 we reach at most $\mathbf{2.51}$%. Our proposed methods outperform the _Baseline loss threshold_ method. |  |  | TPR@FPR=1%. $\uparrow$
---|---|---|---
Scenario | Loss | Method | LAION-mi | POKEMON
White-box | Model Loss | Baseline loss thr. |  1.92%$\pm$0.59 |  80.9%$\pm 2.27$
Reversed noising |  2.51%$\pm$0.73 |  97.3%$\pm 0.93$
Partial denoising |  2.31%$\pm$0.61 |  94.5%$\pm 1.34$
Reversed denoising |  2.25%$\pm$0.64 |  91.5%$\pm 1.63$
Latent Error | Reversed noising |  1.26%$\pm$0.62 |  11.5%$\pm 1.84$
Partial denoising |  2.42%$\pm$0.62 |  $99.5$%$\pm 0.4$
Reversed denoising |  2.17%$\pm$0.64 |  61.1%$\pm 2.74$
Pixel Error | Reversed noising |  1.90%$\pm$0.51 |  8.36%$\pm 1.66$
Reversed denoising |  $2.03$%$\pm$0.55 |  12.0%$\pm 1.97$
Partial denoising |  1.75%$\pm$0.68 |  $25.38$%$\pm 2.55$
Grey-box | Latent Error | Generation from prompt |  0.93%$\pm$0.41 |  7.15%$\pm 1.5$
Black-box | Pixel Error | Generation from prompt |  0.35%$\pm$0.19 |  12.0%$\pm 1.9$

###  6.3 Attack methods

We present a baseline and the best-performing attack methods evaluated in our
experiments. Most methods are only applicable under the white-box scenario but
we also examine the attacks in the grey- and black-box scenario. An exhaustive
description and analysis of these different attack methods are given in
Appendix D.1.

Baseline loss threshold In [4] the authors show that evaluating the model loss
at timestep $100$ for the latent with applied noise scale $\alpha_{t}$ at
$t=100$ yields the best results for the membership inference attacks based on
model loss. We follow this method and evaluate the model loss at timestep
$100$ for the latent noised with scale $\alpha_{100}$.

Methods exploiting the noise There are many possible variants of adding or
removing noise in the diffusion process before we make a final decision based
on the loss. The intuition (or hopeful assumption) behind such attacks is that
member samples would behave more robustly than nonmembers under noisy
conditions. We explore many different settings and refer a reader to Appendix
D.1 for details.

Generation from prompt To perform this attack we pass only the prompt
associated with the original images to the model. We do so to simulate a real-
world scenario, where we have access to the model only via the API. In the
black-box scenario, we calculate the Pixel error between the original image
and the image generated by the model using the default method of $50$
timesteps. In the grey-box scenario, we obtain the generated images in the
same way as in the black-box scenario, but then we calculate the latent
representation of the original and generated images using the visual encoder
of the attacked model and then calculate the latent error between them.

###  6.4 Targeted datasets

LAION-mi In our paper we use our LAION-mi dataset proposed in Section 5. For
each attack, we use the same subset of $5000$ member samples and $5000$
nonmembers samples, further referred to as the attack set. We find that
different training and evaluation set splits can produce significantly
different results, some almost $10$ times better than others (see Appendix E).
Following these findings, we evaluate our attacks on 100 random subsets
(evaluation sets) of $500$ members and $500$ nonmember samples drawn from the
attack set and then report the mean and the standard deviation of the
performance.

POKEMON POKEMON dataset [17] is a Text2Image dataset. We use it to first
finetune the original StableDiffusion v1.4 model using a subset of $633$
samples (members), leaving the remaining $200$ samples as nonmembers. We
evaluate our attacks on $1000$ subsets obtained from random $200$ member and
all nonmember samples. We also conduct an analysis of the influence of
overfitting on the attack performance in Appendix F.

##  7 Results

We evaluate the attacks for two setups. First, we attack the Stable Diffusion
v1.4 model, which we do not modify in any way. We draw data samples of members
and nonmembers from our LAION-mi dataset. Then, we evaluate the effectiveness
of the attacks on the same model, which is finetuned on the POKEMON dataset
[17]. Here, we use test and training data splits ($633$/$200$ samples) as
member and nonmember sets.

Metric A metric to evaluate the membership attack is true-positive rate (TPR)
calculated at a low false-positive rate (e.g. FPR=1%). For privacy-related
problems, it is a much better metric than common aggregate metrics, such as
accuracy or AUC [3].

Discussion In Table 2 we observe a severe discrepancy in the effectiveness of
the attacks achieved for the LAION-mi dataset and fine-tuning on POKEMON. In
the second case, two white-box attacks (_reversed noising_ and _partial
denoising_) achieve a very high TPR. However, when the attacks are applied
against our LAION-mi dataset, we observe a huge drop in performance. Here we
clearly see the effects of the first pitfall from Sec. 4, namely the fine-
tuned model overfits, and the membership inference task becomes trivial. We
explore this topic further in Appendix F. The obtained results demonstrate
that evaluation on a small dataset (used for finetuning the model) is
misleading and a more careful setup, such as our proposal, is required.

Moreover, the results show the limited performance of loss-based attacks in
the black- and grey-box scenarios, even for the simple POKEMON setting. This
highlights an important issue, as many image-generation services work as a
black-box API. As mentioned in 3.1 this trend is unlikely to change in the
future.

In theory, identifying training samples in black-box scenarios can be
approached by extracting training samples from the model, as in [4]. However,
this approach requires the generation of hundreds of images per text prompt,
which is computationally expensive. This approach is also limited to
identifying training samples that have been memorised by the model. For those
reasons, such methods are not well suited for identifying the membership of a
sample. For the white-box scenario, the state-of-the-art approach is a method
based on the shadow models. However, as stated in 3.2, this strategy is too
costly for large diffusion models such as Stable Diffusion. We further discuss
the applicability of shadow models in Appendix G.

##  8 Conclusion

We showed that evaluation of membership inference attacks with the model
finetuning approach may lead to false conclusions. As an alternative, we
proposed a new carefully crafted dataset, which mitigates the main limitation
of the original LAION dataset, which is a lack of a test set. Having the
proposed dataset and reliable set of nonmembers, we evaluated several
membership inference attacks and obtained results, which contradict previous
findings.

Our dataset could help the community evaluate attacks on large generative
diffusion models such as Stable Diffusion in a more rigorous and fair setting.
A clear picture of how successful the membership attacks are is essential for
a sound policy on matters such as data ownership and privacy. We argue that
for large diffusion models, where shadow models are prohibitively expensive,
membership inference remains a very challenging task.

## References

  * [1] Romain Beaumont.  Clip retrieval: Easily compute clip embeddings and build a clip retrieval system with them.  https://github.com/rom1504/clip-retrieval, 2022.
  * [2] Lars Buitinck, Gilles Louppe, Mathieu Blondel, Fabian Pedregosa, Andreas Mueller, Olivier Grisel, Vlad Niculae, Peter Prettenhofer, Alexandre Gramfort, Jaques Grobler, Robert Layton, Jake VanderPlas, Arnaud Joly, Brian Holt, and Gaël Varoquaux.  API design for machine learning software: experiences from the scikit-learn project.  In ECML PKDD Workshop: Languages for Data Mining and Machine Learning, pages 108–122, 2013.
  * [3] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer.  Membership inference attacks from first principles.  In IEEE Symposium on Security and Privacy. IEEE, 2022.
  * [4] Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, and Eric Wallace.  Extracting training data from diffusion models.  2023\.
  * [5] Prafulla Dhariwal and Alexander Nichol.  Diffusion models beat GANs on image synthesis.  Advances in Neural Information Processing Systems, 2021.
  * [6] Jinhao Duan, Fei Kong, Shiqi Wang, Xiaoshuang Shi, and Kaidi Xu.  Are diffusion models vulnerable to membership inference attacks?, 2023.
  * [7] Angela Fan, Shruti Bhosale, Holger Schwenk, Zhiyi Ma, Ahmed El-Kishky, Siddharth Goyal, Mandeep Baines, Onur Celebi, Guillaume Wenzek, Vishrav Chaudhary, Naman Goyal, Tom Birch, Vitaliy Liptchinsky, Sergey Edunov, Edouard Grave, Michael Auli, and Armand Joulin.  Beyond english-centric multilingual machine translation, 2020.
  * [8] Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative adversarial networks, 2014.
  * [9] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter.  Gans trained by a two time-scale update rule converge to a local nash equilibrium, 2018.
  * [10] Jonathan Ho, Ajay Jain, and Pieter Abbeel.  Denoising diffusion probabilistic models.  Advances in Neural Information Processing Systems, 2020.
  * [11] Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen.  Lora: Low-rank adaptation of large language models, 2021.
  * [12] Huggingface.  Fine tuning stable diffusion.  https://huggingface.co/docs/diffusers/v0.15.0/training/text2image, 2023.  [Online].
  * [13] B. D. Jovanovic and P. S. Levy.  A look at the rule of three.  The American Statistician, 51(2):137–139, 1997.
  * [14] LAION.  Laion translated: 3b captions translated to english from laion5b, 2022.  [Online].
  * [15] OpenReview.net.  Review of "membership inference attacks against text-to-image generation models".  https://openreview.net/forum?id=J41IW8Z7mE, 2023.  [Online].
  * [16] Justin Pinkney.  Fine tuning stable diffusion.  https://github.com/LambdaLabsML/examples/tree/main/stable-diffusion-finetuning, 2022.
  * [17] Justin N. M. Pinkney.  Pokemon blip captions.  https://huggingface.co/datasets/lambdalabs/pokemon-blip-captions/, 2022.
  * [18] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al.  Learning transferable visual models from natural language supervision.  In International Conference on Machine Learning, 2021.
  * [19] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen.  Hierarchical text-conditional image generation with CLIP latents.  arXiv preprint arXiv:2204.06125, 2022.
  * [20] Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever.  Zero-shot text-to-image generation.  In International Conference on Machine Learning, 2021.
  * [21] Reuters.  Getty images lawsuit says stability ai misused photos to train ai.  https://www.reuters.com/legal/getty-images-lawsuit-says-stability-ai-misused-photos-train-ai-2023-02-06/, 2023.
  * [22] Reuters.  Lawsuits accuse ai content creators of misusing copyrighted work.  https://www.reuters.com/legal/transactional/lawsuits-accuse-ai-content-creators-misusing-copyrighted-work-2023-01-17/, 2023.
  * [23] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer.  Compvis stable diffusion v1-4 model card, 2022.  [Online].
  * [24] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer.  High-resolution image synthesis with latent diffusion models.  In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022.
  * [25] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Burcu Karagol Ayan, S Sara Mahdavi, Rapha Gontijo Lopes, et al.  Photorealistic text-to-image diffusion models with deep language understanding.  arXiv preprint arXiv:2205.11487, 2022.
  * [26] Christoph Schuhmann.  Clip+mlp aesthetic score predictor, 2022.  [Online].
  * [27] Christoph Schuhmann.  Laion-aesthetics, 2022.  [Online].
  * [28] Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev.  Laion-5b: An open large-scale dataset for training next generation image-text models, 2022.
  * [29] Maximilian Seitzer.  pytorch-fid: FID Score for PyTorch.  https://github.com/mseitzer/pytorch-fid, August 2020.  Version 0.3.0.
  * [30] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.  Membership inference attacks against machine learning models.  In IEEE Symposium on Security and Privacy, 2017.
  * [31] Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli.  Deep unsupervised learning using nonequilibrium thermodynamics.  In International Conference on Machine Learning, 2015.
  * [32] Midjourney Team.  https://www.midjourney.com/, 2022.
  * [33] Duy Tin Vo and Richard Khoury.  Language identification on massive datasets of short message using an attention mechanism cnn, 2019.
  * [34] Ryan Webster, Julien Rabin, Loic Simon, and Frederic Jurie.  On the de-duplication of laion-2b, 2023.
  * [35] Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri.  Enhanced membership inference attacks against machine learning models.  In ACM SIGSAC Conference on Computer and Communications Security (CCS), 2021.
  * [36] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha.  Privacy risk in machine learning: Analyzing the connection to overfitting.  In IEEE Computer Security Foundations Symposium (CSF), 2018.

##  Appendix A Appendix: Broader impact

In this work, we treat the membership inference attacks as a potential tool
for privacy protection. By applying these attacks to a model, we can highlight
the instances where images have been used in training without the appropriate
consent. As more individuals and organizations become aware of this
possibility, we might see a push towards more stringent data usage policies
and ethical guidelines for machine learning practices. The potential of these
attacks to expose privacy violations could serve as a catalyst for a broader
dialogue on privacy rights and data ownership in the digital age.

However, these benefits come with a significant caveat. The same mechanism
that can be used to protect user privacy can also be used maliciously. If a
membership inference attack is successful and achieves high accuracy, it could
potentially lead to personal data leakage. Thus, the dual implications of
membership inference attacks for diffusion models offer both a warning and a
beacon. They highlight the need for robust privacy protection measures while
simultaneously alerting us to the potential risks of personal data leakage.

##  Appendix B Appendix: Limitations

LAION-5B dataset, the source of data used both to train the Stable Diffusion
model and to create LAION-mi dataset does not contain the images, just URLs to
them. Therefore, to prepare a training set, one needs to first download the
images using the URLs, and then train the model. Since the content, that a URL
points to is out of our control, it might be a subject of edition or deletion,
which we are unable to handle. Because of that, we cannot guarantee with
$100\%$ certainty that every member in LAION-mi is a real member of the Stable
Diffusion model’s train set.

In fact, during our experiments, we find out that approximately $10\%$ of
links are dead, i.e. we cannot download images from them. This limitation is
inherent to the LAION-5B dataset, and therefore cannot be alleviated.
Additionally, a URL to an image from LAION-mi has to be alive to use it for
the attack evaluation. We argue that it is unlikely that a URL from the LAION-
mi members subset that was dead during training of the Stable Diffusion is now
alive, however, we cannot rule out such scenario. Fortunately, since it
affects only the members set, it makes the membership inference task harder,
in effect saving us from the pitfalls described in Section 4.

##  Appendix C Appendix: Stable Diffusion-v1.4 training

Datasets Datasets used to train this model are as follows

  * •

LAION-2B EN: a subset of the LAION-5B[28] with images’ descriptions in
English.

  * •

LAION-Aesthetics V2 5+[27]: a subset of the LAION-2B EN dataset, in which each
image is scored using the LAION-Aesthetics_Predictor V2[26], and only images
with the Aesthetic Score above 5 are a part of it.

Stable Diffusion-v1.4 This version of the Stable Diffusion is first trained
for 431k steps using samples from LAION-2B EN, then fine-tuned for 515k steps
using LAION-Aesthetics V2 5+, and then fine-tuned for 225k steps on LAION-
Aesthetics V2 5+ again [23].

##  Appendix D Appendix: Loss attacks

In this section, we discuss different approaches to perform the diffusion
denoising process in the white-box scenario. In each of the following setups,
at every timestep, we collect the Model loss, Latent error, and Pixel error
described in Section 6.2. These values are calculated based on the output of
the UNet SD-v1.4 backbone using the methods described below.

###  D.1 All attack methods

Here we describe all the methods used in our experiments. For all methods, the
classifier-free guidance is applied with scale $7.5$ unless otherwise stated.

  1. 1.

Partial denoising Following findings in [4] in this method, we start our
denoising process at the timestep $300$ for the steps $26$ up to the timestep
$50$. Latent image representation is noised once, with scale $\alpha_{300}$,
and then for each step calculated from the UNet noise prediction.

  2. 2.

Partial denoising non-iterative is similar to the Partial denoising method,
but at each timestep we pass a newly noised latent representation of the image
to the UNet, instead of the output of the previous timestep’s inference
through UNet. The main intuition behind this is to see whether the information
about membership gets lost or accumulates during the iterative denoising
process.

  3. 3.

Partial denoising latent shift follows the Partial denoising attack method,
but at the middle timestep $170$ we shift the latent representation of the
image by a scaled random noise. The intuition behind this method is that the
member samples should return to the correct trajectory after the shift better
than the nonmember samples enabling us to better identify the member samples.

  4. 4.

Partial denoising text shift is similar to the Partial denoising latent shift,
but instead of shifting the latent representation of the image, we shift the
text embedding by a random noise $N(0,I)\times 0.1$ before passing it to the
UNet. The intuition here is the same as in the partial denoising latent shift
method, but we want to see if the text embedding is more important than the
latent representation of the image.

  5. 5.

Partial denoising bigger text shift is identical to the Partial denoising text
shift, but the noise added to the text embedding is scaled by $0.5$ instead of
$0.1$. We want to test if adding more noise to the text embedding benefits the
performance of the attacks.

  6. 6.

Partial denoising wrong start In this method we follow the Partial denoising,
but the starting latent representation of the image is noised using
$\alpha_{t}$ from the wrong timestep, $t=100$ instead of $t=300$. We want to
test whether we can extract more information about the membership if we apply
lower noise to the latent representations at the beginning of the process than
UNet expects.

  7. 7.

Full denoising start 100 is similar to the Partial denoising wrong start
method, but we perform an almost full denoising process, starting on timestep
and $900$ ending at timestep $0$, denoising every $100$ and starting from the
latent noised with $\alpha_{100}$ noise scale.

  8. 8.

Full denoising start 100 text shift is close to the Full denoising start 100,
but we shift the text embedding by a random noise $N(0,\mathbf{I})*0.1$ before
passing it to the UNet.

  9. 9.

Full denoising start 50 is similar to the Full denoising start 100, but the
starting latent is noised using $\alpha_{50}$ instead of $\alpha_{100}$.

  10. 10.

Full denoising start 300 is like the Full denoising start 100, but the
starting latent is noised using $\alpha_{300}$ instead of $\alpha_{100}$.

  11. 11.

Short denoising start 300 In this method, we perform a short denoising
process, starting from timestep $200$ ending at timestep $0$ every $100$ steps
instead of the full one. The latent representation of the image is noised
using $\alpha_{300}$.

  12. 12.

Reversed noising We perform $10$ denoising steps for timesteps from $900$ to
$0$. The image latent representation we get from the VAE encoder is noised
using noise scales $\alpha_{t}$ in reverse order, e.g. at timestep $800$ we
pass the latent noised with $\alpha_{100}$ to the UNet. Additionally, during
inference, we use classifier-free guidance on the guidance scale $100$. The
text embedding passed to UNet remains unchanged. The intuition behind the
attack is that member samples will behave more robustly than nonmember samples
under such conditions.

  13. 13.

Full denoising start 300 no cfg is similar to the Full denoising start 300,
but we do not use the classifier-free guidance. We want to see if the
classifier-free guidance is beneficial for the attacks performance.

  14. 14.

Full denoising start 100 non-iterative. This method is identical with the Full
denoising start 100, but at each timestep we pass newly noised latent
representation with scale $\alpha_{100}$ of the image to the UNet, instead of
the output of the previous timestep.

  15. 15.

Reversed noising regular cfg resembles the Full denoising start 100 non-
iterative attack method. The latent representations we pass to the UNet are
noised using $\alpha_{t}$ from the timesteps in the reversed order, i.e. from
$0$ to $900$, so the first latent passed to the UNet is noised using
$\alpha_{0}$, while UNet receives timestep $900$ as input. The classifier-free
guidance is applied with scale $7.5$.

  16. 16.

Reversed denoising In this method, we reverse the order of timesteps at which
we perform denoising using UNet. We start from the timestep $0$ and then go up
to the timestep $900$, for $10$ steps in total. Similarly as in the baseline
loss threshold method, we apply noise to the latent image representation once,
but this time using noise scale $\alpha_{100}$. At each timestep we measure
all losses described in Section 6.2 and use them to evaluate the attack. The
intuition here is similar as in the Reversed noising method, but here we test
if the iterative nature of the diffusion denoising process will magnify this
effect.

###  D.2 Classifier attack

Table 3: Hyperparameters used for the classifiers: Logistic Regression (LR), Decision Tree Classifier (DTC) and Random Forest Classifier (RFC). Classifier | Hyperparameter | Values
---|---|---
LR | C | [0.01, 0.1, 1, 10, 100]
DTC | max_depth | [2, 8, 16]
| min_samples_split | [2, 8, 16]
RFC | n_estimators | [10, 100, 1000]
| max_depth | [2, 8, 16]
Table 4:  Threshold attack results for each method. We see that for each attack method Model loss gives out better performance of threshold attacks compared to Latent or Pixel error. It is also more robust for the denoising procedure modification than Latent Error, dropping to at most $2\%$, while Latent error performance can drop to $1.1\%$. Pixel error seems also more stable than Latent Error, but we cannot achieve as high results as for the Model loss or Latent error. The high discrepancy between different attack methods points that we can indeed influence the amount of membership information extracted during influence, with some methods performing better on Model loss and some on other losses, Pixel and Latent error. Loss | Model Loss | Latent Error | Pixel Error
---|---|---|---
method |  |  |
Partial denoising |  2.3%$\pm$0.61 |  $\mathbf{2.4}$%$\pm$0.62 |  1.7%$\pm$0.68
Partial denoising non-iterative |  2.3%$\pm$0.68 |  1.1%$\pm$0.46 |  1.39%$\pm$0.59
Partial denoising latent shift |  2.3%$\pm$0.62 |  2.24%$\pm$0.9 |  1.6%$\pm$0.62
Partial denoising text shift |  2.2%$\pm$0.57 |  2.28%$\pm$0.57 |  1.7%$\pm$0.64
Partial denoising bigger text shift |  2.3%$\pm$0.62 |  2.22%$\pm$0.75 |  1.74%$\pm$0.6
Partial denoising wrong start |  2.2%$\pm$0.69 |  2.13%$\pm$0.85 |  1.99%$\pm$0.56
Full denoising start 100 |  2.08%$\pm$0.64 |  1.1%$\pm$0.41 |  1.84%$\pm$0.6
Full denoising start 100 text shift |  2.01%$\pm$0.6 |  1.1%$\pm$0.43 |  1.8%$\pm$0.6
Full denoising start 50 |  2.0%$\pm$0.6 |  1.15%$\pm$0.38 |  1.95%$\pm$0.55
Full denoising start 300 |  1.99%$\pm$0.61 |  1.34%$\pm$0.49 |  1.72%$\pm$0.64
Short denoising start 300 |  2.32%$\pm$0.67 |  2.06%$\pm$0.72 |  1.57%$\pm$0.67
Reversed denoising |  2.25%$\pm$0.64 |  2.17%$\pm$0.64 |  $\mathbf{2.03}$%$\pm$0.55
Full denoising 300 no cfg |  2.07%$\pm$0.62 |  1.45%$\pm$0.52 |  1.7%$\pm$0.6
Full denoising 100 non-iterative |  2.2%$\pm$0.55 |  2.18%$\pm$0.75 |  1.91%$\pm$0.53
Reversed noising regular cfg |  $\mathbf{2.5}$%$\pm$0.74 |  2.03%$\pm$0.6 |  1.92%$\pm$0.5
Reversed noising |  $\mathbf{2.51}$%$\pm$0.73 |  1.26%$\pm$0.52 |  1.9%$\pm$0.51

In addition to the threshold attack type described in 6.2 we also introduce
the classifier attack type. Classifier attack builds on top of the threshold
attack. It uses a binary classifier $C$ to predict the membership of an image
$x$ based on the losses collected during inference through the diffusion
model. The classifier is trained on a set of images with known membership and
returns a probability of membership for a given image. We then perform a
threshold attack on the classifier’s output.

We train four model classes: Logistic Regression (LR), Decision Tree
Classifier (DTC), Random Forest Classifier (RFC), and Neural Network binary
classifier (NN). The classifiers are trained in the binary classification
task, with the member samples as positive examples and the nonmember samples
as negative examples. The input for every classifier consists of the vector of
the loss values we collect at every timestep. For the Logistic Regression
(LR), Decision Tree Classifier (DTC) and Random Forest Classifier (RFC) we
perform Grid Search with k-Cross Validation, $k=5$ for each fit. The
hyperparameters used for the classifiers are described in Table 3. Note that
we perform the Grid Search for every fit separately, therefore we do not
report the best parameters in our table, since they turn out to be different
for different fits.

For the Neural Network classifier (NN) we use the following architecture: 3
fully connected layers, with the input size of $3*timesteps$ (since for
different methods we have a different amount of data), hidden size of $10$ and
a single output for the binary classification. We use ReLU activation function
for the hidden layers and Sigmoid for the output layer. We use Adam optimizer
with a learning rate $0.001$ and binary cross entropy loss. We train the
classifier for $100$ epochs with batch size $32$ and early stopping. We use
the best model from the early stopping for the evaluation.

Following 6.4 we fit our models $100$ times on $100$ different training sets
sampled from the whole attack set and evaluate them on the remaining
evaluation sets. We report the mean and standard deviation of the metrics for
the $100$ fits. The results are presented in Table 4.

###  D.3 Results

Table 5:  Classifier attack results for each method. Same as in Tab. 4 we observe that for different attack methods the same model classes achieve visibly different performance. This again confirms that we are able to obtain more information about the membership of samples by influencing the whole denoising process of the large diffusion model. Unsurprisingly, we are able to outperform the simple threshold attacks, because the membership information ends up spread out on different timesteps and losses. Using classifier attack we can combine the information from the whole inference procedure and make better predictions. Surprisingly, it seems to be harder to perform such attacks in the TPR@FPR=1% regime. For almost all methods and model classes we are not able to outperform the simple threshold attacks, especially on the Model loss. For almost all methods the Random Forest Classifier model outperforms all other model types, with the exception of Reversed noising regular cfg method data fitted using Logistic Regression. Decision Tree Classifier fails to be better than a random guess for almost all methods, and the Neural Network classifier also fails to deliver satisfying results. Classifier class | LR | DTC | RFC | NN
---|---|---|---|---
method |  |  |  |
Partial denoising |  1.83%$\pm$0.87 |  0.67%$\pm$1.09 |  2.27%$\pm$0.76 |  1.50%$\pm$0.92
Partial denoising non-iterative |  2.24%$\pm$0.86 |  $\mathbf{1.10}$%$\pm$1.12 |  2.35%$\pm$0.88 |  1.52%$\pm$1.03
Partial denoising latent shift |  1.94%$\pm$0.92 |  0.86%$\pm$0.94 |  2.35%$\pm$0.86 |  1.40%$\pm$0.91
Partial denoising text shift |  1.71%$\pm$0.87 |  0.49%$\pm$0.84 |  2.43%$\pm$0.93 |  1.40%$\pm$1.00
Partial denoising bigger text shift |  2.14%$\pm$1.01 |  0.80%$\pm$1.13 |  2.30%$\pm$0.73 |  1.49%$\pm$0.90
Partial denoising wrong start |  1.50%$\pm$0.70 |  0.74%$\pm$1.08 |  2.26%$\pm$0.87 |  1.51%$\pm$0.92
Full denoising start 100 |  1.09%$\pm$0.56 |  0.54%$\pm$0.74 |  1.89%$\pm$0.85 |  1.30%$\pm$0.76
Full denoising start 100 text shift |  1.10%$\pm$0.62 |  0.62%$\pm$0.76 |  1.88%$\pm$0.80 |  1.24%$\pm$0.69
Full denoising start 50 |  1.16%$\pm$0.68 |  0.70%$\pm$0.68 |  1.89%$\pm$0.78 |  1.31%$\pm$0.78
Full denoising start 300 |  1.21%$\pm$0.58 |  0.42%$\pm$0.85 |  1.87%$\pm$0.87 |  1.39%$\pm$0.80
Short denoising start 300 |  1.94%$\pm$0.91 |  0.54%$\pm$0.83 |  2.31%$\pm$0.91 |  1.49%$\pm$0.85
Reversed denoising |  1.96%$\pm$0.96 |  0.80%$\pm$1.17 |  2.37%$\pm$0.98 |  1.26%$\pm$0.78
Full denoising 300 no cfg |  1.31%$\pm$0.73 |  0.31%$\pm$0.65 |  1.78%$\pm$0.78 |  1.37%$\pm$0.82
Full denoising 100 non-iterative |  1.60%$\pm$0.77 |  0.68%$\pm$1.05 |  2.19%$\pm$0.85 |  1.60%$\pm$0.73
Reversed noising regular cfg |  $\mathbf{2.41}$%$\pm$1.09 |  0.47%$\pm$1.03 |  2.17%$\pm$0.84 |  1.40%$\pm$0.82
Reversed noising |  1.98%$\pm$0.97 |  0.41%$\pm$1.02 |  $\mathbf{2.75}$%$\pm$1.03 |  $\mathbf{1.62}$%$\pm$0.86
Figure 5: Min, mean, max TPR@FPR=1% for different methods and losses,
threshold attack type. Solid line indicates the mean value of the TPR@FPR=1%
metric from 100 experiments, and the shaded area is the 95% confidence
interval. Figure 6: Min, mean, max TPR@FPR=1% for different methods,
classifier classes and losses, classifier attack type. Figure 7:  Attack
performances on different losses in different timesteps for each attack method
for the threshold attack type. The solid line indicates the mean value of the
TPR@FPR=1% metric from 100 experiments, and the shaded area is the 95%
confidence interval. We see how important is to collect all three losses on
each timestep, with the biggest difference visible for the Reversed noising
method, with the worst result around $0.5\%$ and the best around $2.5\%$ for
Latent error at timestep $0$ and Model loss at timestep $500$. We derive the
following insights from these plots. Applying the denoising process
iteratively instead of passing the newly noised latent to the UNet greatly
benefits the Latent and Pixel error threshold attacks, while slightly reducing
the effectiveness of threshold attacks on the Model loss. Shifting the latent
by a random noise mid-inference affects the results negatively, with the
biggest drop in performance for the Model loss. Shifting text embedding by a
random noise for different noise scales ($0.1$ and $0.5$) does not make any
significant difference in terms of the final results, generally being slightly
harmful to the performance of the threshold attack. The mismatch between the
actual and latent noise timesteps is by far the most impactful modification we
implemented. We see improvements on the Pixel error threshold attacks for
Partial denoising wrong start method, where we start from the latent noised
with the noise scale of $\alpha_{t}=100$ and denoising from the timestep $300$
to $50$. However, for the Full denoising attack methods we see that different
noise scales applied to the starting latent representations do not change the
performance. Applying the classifier-free guidance seems to be insignificant
for the final results (see Full denoising 300 vs Full denoising 300 no cfg),
but increasing the guidance scale (from the default $7.5$ to $100$) reduces
the effectiveness of the threshold attacks on Pixel and Latent error. The best
results are obtained when we reverse the order of noise scales used to apply
noising on the latent representation of the input image, while the input
timesteps we pass to UNet remain in the normal order. We also see in Tab. 5
that these methods allow the classifier attacks to achieve the best results,
suggesting that this approach extracts the most data about the membership from
the model.

Following our evaluation method described in Section 6.4 we report our results
for each method in Table 4 for threshold attacks, and in Table 5 for
classifier attacks.

We conclude that extraction of the membership information from the attacked
model can be improved by modifying the diffusion denoising process by altering
the timesteps, latent representations, and text embeddings. We also see that
the information about membership can be better extracted by using classifier
attack, but for most methods, a simple threshold attack outperforms the
classifier attack.

We also observe that different methods achieve visibly different performance
on different timesteps, which points out that the timing of loss measurement
is also really important when performing the threshold attack, see Figure 7.

##  Appendix E Appendix: Experiments randomization

Here we highlight the need to perform the randomization described in Section
6.4. For each of the methods described in Appendix D we show the differences
between the best, mean and worst results for each attack from the separate
runs. We also visualise these differences for the classification attack type.
We can observe a mismatch between mean and best results for all of the
attacks, some of them being even three times worse than the best ones (Partial
denoising method). When the available size of the nonmembers set is relatively
small, the randomization is crucial to obtain reliable results, especially
when proposing attacks based on more sophisticated methods that require
training a classifier, which is the case in the classifier attack type. In
this case, we suggest splitting the whole attack set randomly in the way
described in Section 6.4 into training and evaluation sets, then training the
classifier, and repeating the whole procedure for at least $100$ times. The
reported results should be the mean of the results for each attack from each
run. In this way, we can mitigate the influence of the potential outliers and
obtain more reliable results.

Visualisation of the mismatch between the best, mean, and worst results can be
found in Figure 5 for the threshold attacks and Figure 6 for the classifier
attacks.

##  Appendix F Appendix: Overfitting impact on membership inference attacks

(a) ROC curves and TPR@FPR=1% results for different checkpoints.

(b) Wasserstein Distance for different checkpoints.

Figure 8: Figure 8(a) shows how overfitting correlates with the attacks
performance. Figure 8(b) shows the Wasserstein Distance calculated between the
losses of members and nonmembers sets for each checkpoint.

In this section, we present the results of our experiments on overfitting on
the POKEMON dataset from Section 6.4. We finetune the original
StableDiffusion-v1.4 using the default method from [16] for $30000$ train
steps with the learning rate $0.00001$ and gradient accumulation of $4$. Every
$5000$ steps we save the partially finetuned model.

The attack method we use to perform for this section is the Baseline loss
threshold method, described in Section 6.3. The ROC curves and TPR@FPR=1%
results for different checkpoints can be found in Figure 8(a). We can observe
that the model is overfitting to the training set, as the TPR@FPR=1% results
are significantly better for the checkpoints from the later stages of the
training. This is in line with the findings in [3], which also show that model
loss based membership inference attacks give better results when the model is
overfitted. This issue seems to be not addressed in some of the previous
contributions, e.g. in [6] authors claim really good performance of their
attacks on the finetuned version of the SD-v1.4 model on the same dataset.

##  Appendix G Appendix: Fine-tuned Shadow models for Large Diffusion Models

Training a new Stable Diffusion model from scratch multiple times is in
practice infeasible. Thus, it is impossible to directly apply the existing
shadow model attack in this case. To overcome this limitation we focus our
analysis on model fine-tuning, rather than training from the start. Motivated
by the state-of-the-art results achieved by shadow model membership inference,
we draw inspiration for our approach from the offline LIRA attack introduced
in [3]. Intuitively, we aim to answer the question "is there a difference
between finetuning the model on member and nonmember samples?". To overcome
the memory requirements for storing multiple versions of the Stable Diffusion
models we apply fine-tuning with LoRA [11].

(a) LAION-mi nonmember samples.

(b) LAION-mi member samples.

Figure 9: Visualization of the random subset of LAION-mi dataset

First, we sample $n$ nonmember samples from LAION-mi. For each single sample,
we finetune the Stable Diffusion v1.4 model on a single training step at
$t=100$ using LoRA. We measure the ratio of the training loss after and before
the finetuning. We repeat that procedure for $n$ member samples from LAION-mi.
Thus we obtain loss ratio distributions for shadow models finetuned on member
($D_{mem}$) and nonmember ($D_{nonmem}$) samples. For inference, we fine-tune
the model on the new sample using the same procedure, obtaining the
corresponding loss ratio $l\star$. If
$\frac{Pr[l\star|D_{mem}]}{Pr[l\star|{Dnonmmem}]}>\tau$ we classify the sample
as a member.

This attack can only be performed in the white-box scenario. The attacker
needs to have access to the model weights to perform the fine-tuning.

We evaluate our method on 100 subsets of 1000 member and 1000 nonmember
samples randomly selected from 4000 samples from each set. The approach based
on shadow models achieves TPR@FPR=1% equal to 2.21% $\pm$ 1.11. The
performance of the attack is thus comparable with the attacks described in
Section 6.3. Although shifting the focus of shadow models from full training
to finetuning using LORA enabled us to apply this kind of approach, the
resources required to execute this attack are still significantly larger than
for the methods described in Sec. 6.3.

##  Appendix H Appendix: LAION-mi samples

In this section we provide a random sample of the LAION-mi dataset, 16 images
from the nonmembers set and 16 images from the members set, see Figure 9.

##  Appendix I Appendix: GPU cost

To conduct the experiments for this paper we utilized $4000$ hours of Nvidia
A100 GPU compute.


2022

[1]Krzysztof Piotrzkowski

[1]Mariusz Przybycien

1]AGH University of Science and Technology, Faculty of Physics and Applied
Computer Science, Al. Mickiewicza 30, 30-055 Krakow, Poland

# High energy bremsstrahlung at the FCC-ee, FCC-eh and LHeC

<EMAIL_ADDRESS><EMAIL_ADDRESS>[

###### Abstract

Bremsstrahlung spectra will be strongly distorted due to small lateral beam
sizes at future colliders. That in turn will have large consequences for the
electron and positron beam lifetimes as well as for the luminosity
measurements in the case of electron-hadron colliders. We discuss in detail
such consequences for the Future Circular Collider and Large Hadron electron
Collider cases.

###### keywords:

bremsstrahlung, BSE, $e^{+}e^{-}$ collisions, $ep$ collisions, FCC-ee, FCC-eh,
LHeC

##  1 Introduction

In collisions of high energy charged particles, the bremsstrahlung process
(”braking radiation”) takes place over macroscopic lateral distances, or at
extremely large impact parameters. As a result, bremsstrahlung becomes
suppressed in high energy collisions of beams with small lateral sizes, as was
observed at VEPP-4 Blinov:1982vp , HERA Piotrzkowski:1995xh , LEP
Burkhardt:1994wk  and KEKB Kotkin:2005rm . A very good understanding of
bremsstrahlung at colliders is important as on the one hand it is usually the
limiting factor for the electron and positron beam lifetimes, and on the other
hand, the high energy bremsstrahlung is used for the precise luminosity
measurements, of the electron-hadron collisions in particular. Below, the
relevance of such Beam-Size Effects (BSE) is discussed in-depth in the context
of the future colliders – the electron-positron Future Circular Collider (FCC-
ee) FCC:2018evy , the Large Hadron electron Collider (LHeC) LHeC:2020van  and
the electron-hadron Future Circular Collider (FCC-eh) FCC:2018vvp .

Macroscopically large impact parameters in bremsstrahlung stem from the
extremely small virtuality $Q^{2}$ of the exchanged photons in this process at
high energies (see Fig. 1), as its minimal value
$Q^{2}_{\mathrm{min}}=m_{e}^{2}y^{2}/\left(4\gamma_{e}\gamma_{p}(1-y)\right)^{2}$,
where $m_{e}$ is the electron mass, $y=E_{\gamma}/E_{e}$, $E_{\gamma}$ is the
energy of the radiated photon and $E_{e}$ the electron beam energy,
$\gamma_{e}=E_{e}/m_{e}$ and $\gamma_{p}$ is the proton Lorentz factor for the
electron-proton collisions or the positron one for the electron-positron case.
The minimal virtuality $Q^{2}_{\mathrm{min}}$ is due to a longitudinal
momentum transfer only, without any lateral contribution – this results in a
typical size of lateral momentum transfers being not far from
$|Q|_{\mathrm{min}}$, as the bremsstrahlung amplitude strongly decreases with
increasing $Q^{2}$. For example, in case of the electron-positron collisions
at $\sqrt{s}=365$ GeV, the maximal impact parameter $b_{\mathrm{max}}$ exceeds
1 m for $y\approx 0.2$, assuming
$b_{\mathrm{max}}={\mathrm{\hbar}}/|Q|_{\mathrm{min}}$.

The Bethe-Heitler cross section111It is accurate to well below 1% at high-
energies and for $E_{e}-E_{\gamma}\gg m_{e}$, if the BSE are negligible. for
the electron bremsstrahlung is:

$\frac{{\rm d}\sigma_{\mathrm{BH}}}{{\rm
d}y}=\frac{16\alpha^{3}}{3m_{e}^{2}}\frac{1}{y}\left(1-y+\frac{3}{4}y^{2}\right)L,$
(1)

where $\alpha$ is the fine structure constant, and
$L=\ln{(m_{e}/|Q|_{\mathrm{min}})}-0.5$. For all practical purposes, one can
assume that the energy of the scattered electron is equal to
$E_{e}-E_{\gamma}$, as in the laboratory frame this equality holds with a
precision of approximately $\gamma_{p}|Q|_{\mathrm{min}}/E_{e}$.

At asymptotically large energies, with good accuracy, one can represent the
BSE in head-on beam collisions by replacing $|Q|_{\mathrm{min}}$ in Eq. (1)
with a constant derived from the lateral beam sizes. This results in an
asymptotic independence of the bremsstrahlung cross section from the beam
energies which is closely related to the asymptotic ”full screening” effect in
the electron-gas bremsstrahlung, where a constant $b_{\mathrm{max}}$ cut-off
is effectively set by the size of atom or molecule.

Figure 1: Bremsstrahlung diagram for electron-positron or electron-proton
collisions. At high energies, the proton structure can be neglected thanks to
the long-range nature of this process.

One should note here, that the BSE are present only if both beams have small
transverse sizes, and that it has nothing to do with particle densities – in
fact, the BSE are fully present for collisions of single-particle-
beams222However, for collisions of single particles instead of formulae valid
for the Gaussian-shaped particle bunches, used below, one should start from
the most general ones – see Eqs. 4.8–4.10 in Ref. Kotkin:1992bj ., and are
independent of the number of particles in colliding bunches, hence might be
called ”geometrical” effects. However, the following results are limited to
$y>0.001$ as for such bremsstrahlung events their formation or coherence
length (see Ref. Klein:1998du , for example), $l_{c}=4\hbar
c\gamma_{e}^{2}/E_{\gamma}=4\hbar c\gamma_{e}/(ym_{e})$, is much shorter than
the length of interaction area, and below $y=10^{-3}$ the coherent effects
might become significant and should be then taken into account.

The results reported below were obtained using the BSE framework described in
Ref. Kotkin:1992bj , with the additional effects (as a bremsstrahlung
amplification) due to the beam lateral displacements reported in Ref.
Piotrzkowski:2020uya .

##  2 Beam-size effects at the FCC-ee

Electron-positron collisions at the Future Circular Collider will be made at
four centre-of-mass energies – 91.2 GeV (at the $Z$-pole), 160 GeV (at the
$WW$ production threshold), 240 GeV (for the $WH$ production) and 365 GeV (at
the $t\bar{t}$ threshold). The colliding beams will be very flat with an
aspect ratio larger than $200\\!:\\!1$, see Tab. 1 FCC:2018evy . The expected
observed bremsstrahlung cross-sections are calculated by subtracting from the
nominal Bethe-Heitler cross-section a correction due to the BSE:
$\sigma_{\mathrm{obs}}=\sigma_{\mathrm{BH}}-\sigma_{\mathrm{corr}}$.

$E_{\mathrm{beam}}$[GeV] | 45.6 | 80 | 120 | 182.5
---|---|---|---|---
$\sigma_{x}$ [$\upmu$m] | 8 | 21 | 14 | 39
$\sigma_{y}$ [nm] | 34 | 66 | 36 | 69

Table 1: FCC-ee lateral beam-sizes at the interaction points.

Bremsstrahlung in high energy electron-positron collisions, also called the
radiative Bhabha scattering, is identical for electrons and positrons.

###  2.1 Bremsstrahlung spectra

The bremsstrahlung spectra at the FCC-ee will be very strongly distorted by
the BSE, even at the highest photon energies, for $y$ close to 1, as shown in
Fig. 2. The observed bremsstrahlung cross-sections are very weakly dependent
on beam energy and vary significantly only with a change of vertical beam
sizes, as expected for the BSE asymptotic regime333In Appendix A a simple
function is described which provides precise predictions, for a given
$\sigma_{y}$, of the BSE cross-sections at the FCC-ee..

Figure 2: Bremsstrahlung spectra at the $\sqrt{s}=91.2$ GeV, 160 GeV, 240 GeV
and 365 GeV FCC-ee – solid lines $y\,{\rm d}\sigma/{\rm d}y$ are for the
Bethe-Heitler nominal case and dashed ones $y\,{\rm
d}\sigma_{\mathrm{obs}}/{\rm d}y$ when the BSE is included. Note that the
spectra with the BSE included overlap due to similar $\sigma_{y}$: those at
$\sqrt{s}=160$ GeV and 365 GeV, as well as those at $\sqrt{s}=91.2$ GeV and
240 GeV.

At low photon energies, the bremsstrahlung suppression exceeds 50% – see Fig.
3, and a four-fold increase of the beam aspect ratios, while keeping the
transverse beam area constant, would increase the BSE suppression only by
about 3%.

The size of BSE varies also with the relative lateral beam displacements – at
large displacements, it is even leading to the effective bremsstrahlung
amplification, manifested by negative $\sigma_{\mathrm{corr}}$. In Fig. 4 the
relative BSE corrections due to the horizontal and vertical beam displacements
are shown for the 240 GeV FCC-ee case. These effects are very similar at all
four centre-of-mass energies – significant horizontal displacements do not
result in a significant change of the bremsstrahlung cross-section, in
contrast to vertical displacements leading to a visible decrease of the
suppression even for relatively small (wrt. the corresponding beam size) beam
lateral shifts. This overall behaviour does not change much with a significant
variation of the beam aspect ratio, and the weak sensitivity of the BSE at the
FCC-ee to the horizontal beam offsets implies a small sensitivity also to the
horizontal beam crossing angles.

At high energy $e^{+}e^{-}$ colliders the non-radiative Bhabha scattering is
used for precise absolute luminosity measurements. Since the scattering angles
of the detected electrons and positrons are not negligible therefore the
exchanged photon virtuality is significant. As a result, the event rates are
not affected by the BSE in this case.

Figure 3: Relative size of bremsstrahlung suppression at the $\sqrt{s}=91.2$,
160, 240 and 365 GeV FCC-ee. Dashed lines represent the BSE for the nominal
beam sizes and the dotted ones correspond to the BSE case with
$\sigma_{x}\times 2$, $\sigma_{y}/2$.

Figure 4: Variations of the bremsstrahlung cross-sections at the
$\sqrt{s}=240$ GeV FCC-ee for the horizontal (upper plots) and vertical
(bottom plots) beam displacements or offsets. The blue lines correspond to the
nominal beam sizes and the red ones to the case with a 4 times bigger beam
aspect ratio. Results at different values of $y=E_{\gamma}/E_{e}$ are shown
with different line styles.

###  2.2 Lifetime limits of electron and positron beams

The beam lifetime $\tau$ is one of the crucial parameters of high energy
colliders – the bigger is $\tau$ the higher is the average collider luminosity
for a given initial luminosity. In addition, shorter beam lifetimes require
more frequent beam refilling, which might be particularly challenging in the
case of the positron beams.

There are many sources of beam particle losses which are affecting the beam
lifetime, but its ultimate, irreducible limit is due to particle scattering at
the collider interaction points. Such a loss may occur due to either a
significant energy reduction of the beam particle, its annihilation or due to
a large scattering angle, as a result of a single $e^{+}e^{-}$ interaction. At
the FCC-ee the largely dominant particle loss mechanism proceeds via the
energy decrease due to the emission of high-energy photons at very small
angles, in the bremsstrahlung process.

These particle losses are well modelled by introducing the energy aperture $a$
which is simply the maximal fractional energy decrease of beam particles which
is still accommodated by the collider beam optics444Or, $a$ is the minimal
fractional energy decrease for the lost particles.. At the FCC-ee this
aperture varies, from below 0.01 to almost 0.02 for low and high-energy beams,
respectively.

The beam lifetime $\tau_{b}$ due to bremsstrahlung can be then calculated as
$\tau_{b}=N_{b}/(L_{\mathrm{tot}}\sigma_{a})$, where $N_{b}$ is the nominal
number of particles in the ”radiating beam”, $L_{\mathrm{tot}}$ is the nominal
FCC-ee luminosity (summed over four interaction points) and
$\sigma_{a}=\int^{1}_{a}d\sigma_{\mathrm{obs}}$, where $a=y_{\mathrm{min}}$.

$E_{\mathrm{beam}}$ [GeV] | 45.6 | 80 | 120 | 182.5
---|---|---|---|---
$N_{b}$ [$10^{13}$] | 242 | 25.5 | 5.05 | 0.945
$L_{\mathrm{tot}}$ [$10^{35}$ cm-2s-1] | 74.8 | 7.64 | 2.92 | 0.5
$\sigma_{a}$ [mb] for $a=0.01(0.02)$ | 166 (137) | 174 (144) | 167 (138) | 175 (145)
$\sigma_{\mathrm{BH}}$ [mb] for $a=0.01(0.02)$ | 319 (260) | 333 (271) | 343 (280) | 353 (288)
$\tau_{b}$ [min] for $a=0.01(0.02)$ | 32 (39) | 32 (39) | 17 (21) | 18 (22)

Table 2: FCC-ee beam lifetimes due to bremsstrahlung, assuming the most recent
beam parameters as given in Tab. 1 in Ref. Zimmermann:2023uqi .

The BSE are very beneficial at the FCC-ee as the ultimate beam lifetimes are
about two times bigger thanks to the effective bremsstrahlung suppression due
to small lateral beam sizes, see Tab. 2. One should note that these are
instantaneous beam lifetimes, assuming perfectly Gaussian particle bunches of
given sizes, and colliding head-on exactly. The suppression is weakly
dependent on the energy aperture as well as on the beam offsets (see Fig. 4).
Beams will not collide head-on at the FCC-ee – a full horizontal beam crossing
angle of 30 mrad is foreseen FCC:2018evy , but that should not affect the
bremsstrahlung suppression since its sensitivity to significant horizontal
offsets is negligible, as demonstrated by upper plots in Fig. 4.

The FCC-ee beams will be very strongly focused in the vertical plane leading
to the hour-glass effect – a significant change of vertical beam size during
the bunch crossing. Using $R_{HG}$, the luminosity correction factors for the
hour-glass effect (see Tab. 2.1 in Ref. FCC:2018evy ), the effective vertical
beam-size $\sigma_{y,e\\!f\\!\\!f}=\sigma_{y}/R_{HG}$ is evaluated. The
significance of the hour-glass effect to the BSE at the FCC-ee can be then
estimated by replacing $\sigma_{y}$ with $\sigma_{y,e\\!f\\!\\!f}$ what leads
to an increase of the observed cross-sections reported above in Tab. 2 by
0.35% at the lowest beam energy and up to 1.3% at the highest one. The
corresponding beam lifetimes will then decrease accordingly.

##  3 Beam-size effects at the LHeC and FCC-eh

At electron-hadron colliders bremsstrahlung plays a very important role also
because of its use for precise measurements of absolute luminosity
ZEUSLuminosityGroup:2001eva ; Piotrzkowski:2021cwj . However, in this case,
the beam size effects become a problem as they need to be accurately corrected
for. At HERA I, the BSE were small and the theoretical predictions could be
verified only with a precision of about 30% Piotrzkowski:1995xh , but the BSE
calculations can be profoundly verified at the planned Electron-Ion Collider
at Brookhaven, including the surprising effect of bremsstrahlung amplification
for large beam offsets Piotrzkowski:2020uya .

###  3.1 Bremsstrahlung spectra and luminosity measurement

At future electron-hadron colliders, as the Large Hadron electron Collider
(LHeC) LHeC:2020van  and the FCC-eh FCC:2018vvp , the BSE are large over the
whole bremsstrahlung spectra, see Fig. 5. This gives rise to a challenge for
precise luminosity measurements, as the BSE corrections should be known with
accuracy at a couple of per mille levels.

Figure 5: Bremsstrahlung spectra $y{\rm d}\sigma/{\rm d}y$ at the LHeC (blue
lines) and at the FCC-eh (red lines) – solid lines are for the Bethe-Heitler
nominal case and the dashed when the BSE are included. Figure 6: Relative size
of bremsstrahlung suppression at the LHeC (blue lines) and at the FCC-eh (red
lines). Dashed lines are for the nominal beam sizes, and the dotted lines are
for the increased beams’ lateral sizes as shown in the legend.

In particular, a 1% luminosity precision will require frequent verifications
of Gaussianity of the lateral distribution of bunch particles and continuous
measurements of lateral beam sizes with a 5% precision at least, see Fig. 6.
The control of beam offsets is less critical, as for small lateral beam
displacements, smaller than the lateral beam sizes, the corresponding
modifications of BSE are negligible, see Fig. 7.

In any case, the experiments at the LHeC and FCC-eh should profit a lot from
the experience acquired with the luminosity measurements planned at the EIC,
both in the context of proper detector solutions Piotrzkowski:2021cwj  as well
as the precise verification of the BSE predictions Piotrzkowski:2020uya .

As for the FCC-ee case, in Appendix A a simple formula is provided for quick
calculations of the observed cross-sections of bremsstrahlung at the LHeC and
FCC-eh.

###  3.2 Electron beam losses

If the LHeC and FCC-eh would be ring-ring colliders then the BSE would be less
beneficial for the electron beam lifetimes than at the FCC-ee, as the BSE
would be weaker there. However, for both future electron-hadron colliders the
linac-ring configurations are being proposed. Hence, as the electron bunches
collide only once with the proton ones, the role of bremsstrahlung in the
electron beam losses is minimal, see Tab. 3.

$E_{\mathrm{beam}}$[GeV] for electrons (protons) | 50 (7000) | 60 (50000)
---|---|---
$N_{b}$ [$10^{9}$] per electron bunch | 3 | 3
$L$ [$10^{26}$cm-2] per bunch crossing | 3 | 5
$\sigma_{x,y}^{e,p}$ [$\mu$m] | 5 | 2
$\sigma_{a}$ [mb] | 219 | 208
$\sigma_{\mathrm{BH}}$ [mb] | 290 | 317
Electron beam fractional loss | $2.2\times 10^{-8}$ | $3.5\times 10^{-8}$

Table 3: The relative electron beam losses due to bremsstrahlung at the LHeC
and FCC-eh, for the energy aperture $a=0.01$. Figure 7: Effects of the beam
offset $B$ at the FCC-eh (red lines) and LHeC (blue lines) for the nominal
beam sizes. Results at different values of $y=E_{\gamma}/E_{e}$ are shown with
different line styles.

##  4 Summary

Bremsstrahlung rates at future high-energy colliders will be strongly affected
by small lateral beam sizes, and that will have important consequences. At the
FCC-ee, the strong suppression of bremsstrahlung (or radiative Bhabha
scattering) will result in a very beneficial phenomenon of doubling the
ultimate beam lifetime limits. This is especially relevant for the positron
beams at FCC-ee, and potentially also at other colliders under study, as the
rate of positron beam refilling, required for high luminosity operations, is
one of the major technological problems. On the other hand, at the LHeC and
FCC-eh, the bremsstrahlung sensitivity to the beam sizes will pose a big
challenge to precise luminosity measurements using this process. Finally, the
planned studies of the beam size effects at the EIC will allow to thoroughly
verify the theoretical framework used for the BSE calculations.

Acknowledgments

K. Piotrzkowski is supported by the IDUB programme at the AGH UST and by the
NAWA grant BPN/PPO/2021/1/00011.

## Appendix A

At the FCC-ee energies, the observed bremsstrahlung cross-sections approach
the asymptotic form, for $y$ not too close to 1. This allows for a simple
parameterization:

$\frac{\rm{d}\sigma_{\mathrm{obs,p}}}{{\rm
d}y}=\sigma_{0}\left(1-y+\frac{3}{4}y^{2}\right)\frac{L}{y}\,C(r),$ (2)

where $\sigma_{0}=3.093$ mb, $L=\ln{(m_{e}/|Q|_{\mathrm{cut}})}-0.5=13.505,$
with $|Q|_{\mathrm{cut}}=0.4227$ eV being the effective ”geometrical” cutoff
of lateral momentum transfer, and $C(r)=(1+0.074\ln{r})$ is the correction
coefficient for a given ratio $r$ of a vertical beam size to a ”reference”
beam size of 36 nm, assuming equal bunch sizes for electrons and positrons.
For $y\ll 1$ one can simplify to $y\,{\rm d}\sigma_{\mathrm{obs,p}}/{\rm
d}y\simeq\sigma_{0}LC(r)=41.77\times C(r)~{}[\rm mb]$.

Figure 8: Ratios of the FCC-ee cross-sections ${\rm
d}\sigma_{\mathrm{obs}}/{\rm d}y$, as shown in Figs. 2 and 3, to the cross-
sections ${\rm d}\sigma_{\mathrm{obs,p}}/{\rm d}y$, according to Eq. (2).

In Fig. 8 this parameterization is compared with a number of full
calculations, and an excellent agreement is observed, within $\pm 0.04\%$ for
$y<0.3$. One should note, however, that the precision of Eq. (2) will
deteriorate for the lateral beam sizes largely different from those considered
for the FCC-ee at the moment.

The integrated cross-section $\sigma_{a,{\rm p}}=\int^{1}_{a}{\rm
d}\sigma_{\mathrm{obs,p}}=41.77\times C(r)(a-5/8-3a^{2}/8-\ln{a})$ [mb], where
$a=y_{\mathrm{min}}$. For $a=0.01$ and $C(r)=1$, one obtains
$\sigma_{\mathrm{obs,p}}=166.67$ mb, to be compared with 166.59 (166.61) mb
from full calculations for $\sigma_{y}=$ 36 nm and $\sigma_{x}=$ 14 (28)
$\upmu$m at $\sqrt{s}=240$ GeV.

For the cases of LHeC and FCC-eh,
$\sigma_{0}LC(r)=54.90\times(1+0.0564\ln{r})~{}[\rm mb]$, where
$r=\sigma/(5~{}\rm\upmu m$) and $\sigma=\sigma_{x}=\sigma_{y}$ for both beams.
The agreement between full calculations and the parameterization of BSE cross-
sections is very good, as can be seen in Fig. 9.

Figure 9: Ratios of the FCC-eh and LHeC cross-sections ${\rm
d}\sigma_{\mathrm{obs}}/{\rm d}y$, as shown in Figs. 5 and 6, to the cross-
sections ${\rm d}\sigma_{\mathrm{obs,p}}/{\rm d}y$, according to Eq. (2).

## References

  *   * (1) Blinov, A.E., et al.: Large Impact Parameters Cutoff in Bremsstrahlung at Colliding Beams. Phys. Lett. B 113, 423 (1982). https://doi.org/10.1016/0370-2693(82)90777-8
  * (2) Piotrzkowski, K.: Observation of the beam size effect at HERA. Z. Phys. C 67, 577–584 (1995) arXiv:hep-ex/9504003. https://doi.org/10.1007/BF01553983
  * (3) Burkhardt, H., Kleiss, R.: Beam lifetimes in LEP. Conf. Proc. C 940627, 1353–1355 (1995)
  * (4) Kotkin, G.L., Serbo, V.G.: Beam-size effect and particle losses at B-factories KEKB and PEP-II. Nucl. Instrum. Meth. B 227, 137–142 (2005). https://doi.org/10.1016/j.nimb.2004.04.178
  * (5) Abada, A., et al.: FCC-ee: The Lepton Collider: Future Circular Collider Conceptual Design Report Volume 2. Eur. Phys. J. ST 228(2), 261–623 (2019). https://doi.org/10.1140/epjst/e2019-900045-4
  * (6) Agostini, P., et al.: The Large Hadron–Electron Collider at the HL-LHC. J. Phys. G 48(11), 110501 (2021) arXiv:2007.14491 [hep-ex]. https://doi.org/10.1088/1361-6471/abf3ba
  * (7) Abada, A., et al.: FCC-hh: The Hadron Collider: Future Circular Collider Conceptual Design Report Volume 3. Eur. Phys. J. ST 228(4), 755–1107 (2019). https://doi.org/10.1140/epjst/e2019-900087-0
  * (8) Kotkin, G.L., Serbo, V.G., Schiller, A.: Processes with large impact parameters at colliding beams. Int. J. Mod. Phys. A 7, 4707–4745 (1992). https://doi.org/10.1142/S0217751X92002131
  * (9) Klein, S.: Suppression of Bremsstrahlung and pair production due to environmental factors. Rev. Mod. Phys. 71, 1501–1538 (1999) arXiv:hep-ph/9802442. https://doi.org/10.1103/RevModPhys.71.1501
  * (10) Piotrzkowski, K., Przybycien, M.: When invariable cross-sections change: the Electron-Ion Collider case. Phys. Rev. D 103(5), 051901 (2021) arXiv:2011.11591 [hep-ph]. https://doi.org/10.1103/PhysRevD.103.L051901
  * (11) Zimmermann, F., Benedikt, M.: FCC-ee Feasibility Study Progress. JACoW eeFACT2022, 7–13 (2023). https://doi.org/10.18429/JACoW-eeFACT2022-MOXAT0104
  * (12) Andruszkow, J., et al.: Luminosity measurement in the ZEUS experiment. Acta Phys. Polon. B 32, 2025–2058 (2001)
  * (13) Piotrzkowski, K.: Challenging luminosity measurements at the Electron-Ion Collider. JINST 16(09), 09023 (2021) arXiv:2106.08993 [physics.acc-ph]. https://doi.org/10.1088/1748-0221/16/09/P09023