# An Efficient Membership Inference Attack for the Diffusion Model by Proximal
Initialization

Fei Kong1 Jinhao Duan2 RuiPeng Ma1 Hengtao Shen1 Xiaofeng Zhu1
Xiaoshuang Shi1 Kaidi Xu2 $*$
1University of Electronic Science and Technology of China
2Drexel University
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>Equal corresponding
author

###### Abstract

Recently, diffusion models have achieved remarkable success in generating
tasks, including image and audio generation. However, like other generative
models, diffusion models are prone to privacy issues. In this paper, we
propose an efficient query-based membership inference attack (MIA), namely
Proximal Initialization Attack (PIA), which utilizes groundtruth trajectory
obtained by $\epsilon$ initialized in $t=0$ and predicted point to infer
memberships. Experimental results indicate that the proposed method can
achieve competitive performance with only two queries on both discrete-time
and continuous-time diffusion models. Moreover, previous works on the privacy
of diffusion models have focused on vision tasks without considering audio
tasks. Therefore, we also explore the robustness of diffusion models to MIA in
the text-to-speech (TTS) task, which is an audio generation task. To the best
of our knowledge, this work is the first to study the robustness of diffusion
models to MIA in the TTS task. Experimental results indicate that models with
mel-spectrogram (image-like) output are vulnerable to MIA, while models with
audio output are relatively robust to MIA. Code is available at
https://github.com/kong13661/PIA.

##  1 Introduction

Recently, the diffusion model ho2020denoising ; Score_Based ;
Estimating_Gradients  has emerged as a powerful approach in the field of
generative tasks, achieving notable success in image generation
stable_diffusion ; Imagen , audio generation Popov2021Grad-TTS ;
Kong2021DiffWave , video generation video_diffusion ; video_diffusion2 , and
other domains. However, like other generative models such as GANs gans  and
VAEs vaes , the diffusion model may also be exposed to privacy risks
private_risk  and copyright disputes copyright . Dangers such as privacy leaks
logan  and data reconstruction reconstruction  may compromise the model.
Recently, some researchers have explored this topic SecMI ;
matsumoto2023membership ; hu2023membership ; carlini2023extracting ,
demonstrating that diffusion models are also vulnerable to privacy issues.

Membership Inference Attacks (MIAs) are the most common privacy risks
shokri2017membership . MIAs can cause privacy concerns directly and can also
contribute to privacy issues indirectly as part of data reconstruction. Given
a pre-trained model, MIA aims to determine whether a sample is in the training
set or not.

Generally speaking, MIA relies on the assumption that a model fits the
training data better yeom2018privacy ; shokri2017membership , resulting in a
smaller training loss. Recently, several MIA techniques have been proposed for
diffusion models SecMI ; matsumoto2023membership ; hu2023membership . We refer
to the query-based methods proposed in matsumoto2023membership ;
hu2023membership  as Naive Attacks because they directly employ the training
loss for the attack. However, unlike GANs or VAEs, the training loss for
diffusion models is not deterministic because it requires the generation of
Gaussian noise. The random Gaussian noise may not be the one in which
diffusion model fits best. This can negatively impact the performance of the
MIA attack. To address this issue, the concurrent work SecMI SecMI  adopts an
iterative approach to obtain the deterministic $\boldsymbol{x}$ at a specific
time $t$, but this requires more queries, resulting in longer attack times. As
models grow larger, the time required for the attack also increases, making
time an important metric to consider.

To reduce the time consumption, inspired by DDIM and SecMI, we proposed a
Proximal Initialization Attack (PIA) method, which derives its name from the
fact that we utilize the diffusion model’s output at time $t=0$ as the noise
$\epsilon$. PIA is a query-based MIA that relies solely on the inference
results and can be applied not only to discrete time diffusion models
ho2020denoising ; stable_diffusion  but also to continuous time diffusion
models Score_Based . We evaluate the effectiveness of our method on two image
datasets, CIFAR10 CIFAR10  and TinyImageNet, as well as three audio datasets,
LJSpeech ljspeech17 , VCTK vctk , and LibriTTS zen2019libritts .

To our knowledge, recent research on MIA of diffusion models has only focused
on image data, and there has been no exploration of diffusion models in the
audio domain. However, audio, such as music, encounters similar copyright and
privacy concerns as those in the image domain cnn ; wapo . Therefore, it is
essential to conduct privacy research in the audio domain to determine whether
audio data is also vulnerable to attacks and to identify which types of
diffusion models are more robust against privacy attacks. To investigate the
robustness of MIA on audio data, we conduct experiments using Naive Attack,
SecMI SecMI , and our proposed method on three audio models: Grad-TTS
Popov2021Grad-TTS , DiffWave Kong2021DiffWave , and FastDiff Huang2022FastDiff
. The results suggest that the robustness of MIA on audio depends on the
output type of the model.

Our contributions can be summarized as follows:

  * •

We propose a query-based MIA method called PIA. Our method employs the output
at $t=0$ as the initial noise and the errors between the forward and backward
processes as the attack metric. We generalize the PIA on both discrete-time
and continuous-time diffusion models.

  * •

Our study is the first to evaluate the robustness of MIA on audio data. We
evaluate the robustness of MIA on three TTS models (Grad-TTS, DiffWave,
FastDiff) and three TTS datasets (LJSpeech, VCTK, Libritts) using Naive
Attack, SecMI, and our proposed method.

  * •

Our experimental results demonstrate that PIA achieves similar AUC performance
and higher TPR @ 1% FPR performance compared to SecMI while being 5-10 times
faster, with only one additional query compared to Naive Attack. Additionally,
our results suggest that, for text-to-speech audio tasks, models that output
audio have higher robustness against MIA attacks than those that output mel-
spectrograms, which are the image-like output. Based on our findings, we
recommend using generation models that output audio to reduce privacy risks in
audio generation tasks.

Figure 1: A overview of PIA. First, a sample is an input into the target model
to generate $\boldsymbol{\epsilon}$ at time $0$. Next, we combine the original
sample with $\boldsymbol{\epsilon}_{0}$ and input them into the target model
to generate $\boldsymbol{\epsilon}$ at time $t$. After that, we input all
three variables into a metric and use a threshold to determine if the sample
belongs to the training set.

##  2 Related Works and Background

Generative Diffusion Models Generative diffusion models have recently achieved
significant success in both image Ramesh2022Hierarchical ; stable_diffusion
and audio generation tasks Huang2022FastDiff ; Chen2021WaveGrad ;
Popov2021Grad-TTS . Unlike GANs gans ; yuan2020attribute ; yuan2023dde , which
consist of a generator and a discriminator, diffusion models generate samples
by fitting the inverse process of a diffusion process from Gaussian noise.
Compared to GANs, diffusion models typically produce higher quality samples
and avoid issues such as checkerboard artifacts salimans2016improved ;
Donahue2017Adversarial ; Dumoulin2017Adversarially . A diffusion process is
defined as
$\boldsymbol{x}_{t}=\sqrt{\alpha_{t}}\boldsymbol{x}_{t-1}+\sqrt{\beta_{t}}\boldsymbol{\epsilon}_{t},\boldsymbol{\epsilon}_{t}\sim\mathcal{N}(\mathbf{0},\mathbf{I})$,
where $\alpha_{t}+\beta_{t}=1$ and $\beta_{t}$ increases gradually as $t$
increases, so that eventually, $\boldsymbol{x}_{t}$ approximates a random
Gaussian noise. In the reverse diffusion process,
$\boldsymbol{x}^{\prime}_{t}$ still follows a Gaussian distribution, assuming
the variance remains the same as in the forward diffusion process, and the
mean is defined as
$\tilde{\boldsymbol{\mu}}_{t}=\frac{1}{\sqrt{a_{t}}}\left(\boldsymbol{x}_{t}-\frac{\beta_{t}}{\sqrt{1-\bar{a}_{t}}}\bar{\boldsymbol{\epsilon}}_{\theta}(\boldsymbol{x}_{t},t)\right)$,
where $\bar{\alpha}_{t}=\prod_{k=0}^{t}\alpha_{k}$ and
$\bar{\alpha}_{t}+\bar{\beta}_{t}=1$. The reverse diffusion process becomes
$\boldsymbol{x}_{t-1}=\tilde{\boldsymbol{\mu}}_{t}+\sqrt{\beta_{t}}\boldsymbol{\epsilon},\boldsymbol{\epsilon}\sim\mathcal{N}(\mathbf{0},\mathbf{I})$.
One can obtain a loss function Eq. 1 by minimizing the distance between the
predicted and groundtruth distributions. Score_Based  transforms the discrete-
time diffusion process into a continuous-time process and uses SDE (
Stochastic Differential Equation) to express the diffusion process. To
accelerate the generation process, several methods have been proposed, such as
Salimans2022Progressive ; Dockhorn2022Score-Based ; Xiao2022Tackling . DDIM
DDIM  is another popular method that proposes a forward process different from
diffusion process with the same loss function as DDPM, allowing it to reuse
the model trained by DDPM while achieving higher generation speed.

$L=\mathbb{E}_{x_{0},\bar{\boldsymbol{\epsilon}}_{t}}\left[\left\|\bar{\boldsymbol{\epsilon}}_{t}-\boldsymbol{\epsilon}_{\theta}\left(\sqrt{\bar{\alpha}_{t}}x_{0}+\sqrt{1-\bar{\alpha}_{t}}\bar{\boldsymbol{\epsilon}}_{t},t\right)\right\|^{2}\right].$
(1)

Membership Inference Privacy Different from conventional adversarial attacks
xu2018structured ; xu2020adversarial ; zhang2022branch , Membership inference
attack (MIA) shokri2017membership  aims to determine whether a sample is part
of the training data. It can be formally described as follows: given two sets,
the training set $\mathcal{D}_{t}$ and the hold-out set $\mathcal{D}_{h}$, a
target model $m$, and a sample $\boldsymbol{x}$ that either belongs to
$\mathcal{D}_{t}$ or $\mathcal{D}_{h}$, the goal of MIA is to find a
classifier or function $f(\boldsymbol{x},m)$ that determines which set
$\boldsymbol{x}$ belongs to, with $f(\boldsymbol{x},m)\in\\{0,1\\}$ and
$f(\boldsymbol{x},m)=1$ indicating that $\boldsymbol{x}\in\mathcal{D}_{t}$ and
$f(\boldsymbol{x},m)=0$ indicating that $\boldsymbol{x}\in\mathcal{D}_{h}$. If
a membership inference attack method utilizes a model’s output obtained
through queries to attack the model, it is called query-based attackSecMI ;
matsumoto2023membership ; hu2023membership . Typically, MIA is based on the
assumption that training data has a smaller loss compared to hold-out data.
MIA for generation tasks, such as GANs logan  and VAEs hilprecht2019monte ;
chen2020gan , has also been extensively researched.

Recently, several MIA methods designed for diffusion models have been
proposed. matsumoto2023membership  proposed a method that directly employs the
training loss Eq. 1 and find a specific $t$ with maximum distinguishability.
Because they directly use the training loss, we refer to this method as Naive
Attack. SecMI SecMI  improves the attack effectiveness by iteratively
computing the $t$-error, which is the error between the DDIM sampling process
and the inverse sampling process at a certain moment $t$.

##  3 Methodology

In this section, we introduce DDIM, a variant of DDPM, and provide a proof
that if we know any two points in the DDIM framework, $\boldsymbol{x}_{k}$ and
$\boldsymbol{x}_{0}$, we can determine any other point $\boldsymbol{x}_{t}$.
We then propose a new MIA method that utilizes this property to efficiently
obtain $\boldsymbol{x}_{t-t^{\prime}}$ and its corresponding predicted sample
$x^{\prime}_{t-t^{\prime}}$. We compute the difference between these two
points and use it to determine if a sample is in the training set.
Specifically, samples with small differences are more likely to belong to the
training set. An overview of this proposed method is shown in Fig. 1.

###  3.1 Preliminary

Denoising Diffusion Implicit Models To accelerate the inference process of
diffusion models, DDIM defines a new process that shares the same loss
function as DDPM. Unlike the DDPM process, which adds noise from $x_{0}$ to
$x_{T}$, DDIM defines a diffusion process from $x_{T}$ to $x_{1}$ by using
$x_{0}$. The process is described in Eq. 2 and Eq. 3. The distribution
$q_{\sigma}\left(\boldsymbol{x}_{T}\mid\boldsymbol{x}_{0}\right)$ is the same
as in DDPM.

$q_{\sigma}\left(\boldsymbol{x}_{1:T}\mid\boldsymbol{x}_{0}\right):=q_{\sigma}\left(\boldsymbol{x}_{T}\mid\boldsymbol{x}_{0}\right)\prod_{t=2}^{T}q_{\sigma}\left(\boldsymbol{x}_{t-1}\mid\boldsymbol{x}_{t},\boldsymbol{x}_{0}\right),$
(2)

$q_{\sigma}\left(\boldsymbol{x}_{t-1}\mid\boldsymbol{x}_{t},\boldsymbol{x}_{0}\right)=\mathcal{N}\left(\sqrt{\bar{\alpha}_{t-1}}x_{0}+\sqrt{1-\bar{\alpha}_{t-1}-\sigma_{t}^{2}}\cdot\frac{\boldsymbol{x}_{t}-\sqrt{\bar{\alpha}_{t}}x_{0}}{\sqrt{1-\bar{\alpha}_{t}}},\sigma_{t}^{2}\boldsymbol{I}\right).$
(3)

The denoising process defined by DDIM is described below:

$\displaystyle\left.p(\boldsymbol{x}_{t^{\prime}}\mid\boldsymbol{x}_{t}\right)$
$\displaystyle=p\left(\boldsymbol{x}_{t^{\prime}}\mid\boldsymbol{x}_{t},\boldsymbol{x}_{0}=\overline{\boldsymbol{\mu}}\left(\boldsymbol{x}_{t}\right)\right)$
(4)
$\displaystyle=\mathcal{N}\left(\boldsymbol{x}_{t^{\prime}};\frac{\sqrt{\bar{\alpha}_{t^{\prime}}}}{\sqrt{\bar{\alpha}_{t}}}\left(\boldsymbol{x}_{t}-\left(\sqrt{1-\bar{\alpha}_{t}}-\frac{\sqrt{\bar{\alpha}_{t}}}{\sqrt{\bar{\alpha}_{t^{\prime}}}}\sqrt{1-\bar{\alpha}_{t^{\prime}}-\sigma_{t}^{2}}\right)\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{t},t\right)\right),\sigma_{t}^{2}\boldsymbol{I}\right)$

###  3.2 Finding Groundtruth Trajectory

In this section, we will first demonstrate that if we know
$\boldsymbol{x}_{k}$ and $\boldsymbol{x}_{0}$, we can determine any other
$\boldsymbol{x}_{t}$. Then, we will provide the method for obtaining
$\boldsymbol{x}_{k}$.

######  Theorem 1.

The trajectory of $\\{\boldsymbol{x}_{t}\\}$ is determined if we know $x_{0}$
and any other point $x_{k}$ when $\sigma_{t}=0$ under DDIM framework.

######  Proof.

In DDIM definition, if standard deviation $\sigma_{t}=0$, the process adding
noise becomes determined. So Eq. 3 can be rewritten to Eq. 5.

$\boldsymbol{x}_{t-1}=\sqrt{\bar{\alpha}_{t-1}}\boldsymbol{x}_{0}+\sqrt{1-\bar{\alpha}_{t-1}}\cdot\frac{\boldsymbol{x}_{t}-\sqrt{\bar{\alpha}_{t}}\boldsymbol{x}_{0}}{\sqrt{1-\bar{\alpha}_{t}}}.$
(5)

Assuming that we know any point $\boldsymbol{x}_{k}$. Eq. 5 can be rewritten
as
$\frac{\boldsymbol{x}_{t-1}-\sqrt{\bar{\alpha}_{t-1}}\boldsymbol{x}_{0}}{\sqrt{1-\bar{\alpha}_{t-1}}}=\frac{\boldsymbol{x}_{t}-\sqrt{\bar{\alpha}_{t}}\boldsymbol{x}_{0}}{\sqrt{1-\bar{\alpha}_{t}}}$.
By applying this equation recurrently, we can obtain Eq. 6. In other words, we
can obtain any point $x_{t}$ except $x_{k}$.

$\boldsymbol{x}_{t}=\sqrt{\bar{\alpha}_{t}}\boldsymbol{x}_{0}+\sqrt{1-\bar{\alpha}_{t}}\cdot\frac{\boldsymbol{x}_{k}-\sqrt{\bar{\alpha}_{k}}\boldsymbol{x}_{0}}{\sqrt{1-\bar{\alpha}_{k}}}.$
(6)

We call the trajectory obtained from $\boldsymbol{x}_{k}$ _groundtruth
trajectory_.

Assuming that the point is
$\boldsymbol{x}_{k}=\sqrt{\bar{a}_{k}}\boldsymbol{x}_{0}+\sqrt{1-\bar{a}_{k}}\overline{\boldsymbol{\epsilon}}_{k}$,
to find a better groundtruth trajectory, we choose $k=0$ since the choice of
$k$ is arbitrary, and approximate $\boldsymbol{\bar{\epsilon}}_{0}$ using Eq.
7.

$\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\sqrt{\bar{a}_{0}}\boldsymbol{x}_{0}+\sqrt{1-\bar{a}_{0}}\overline{\boldsymbol{\epsilon}}_{0},t\right)\approx\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{0},0\right).$
(7)

This choice is intuitive. First, $\bar{\alpha}_{0}$ is very close to $1$,
making the approximation in Eq. 7 valid. Second, the time $t=0$ is the closest
timing to the original sample, so the model is likely to fit it better.

###  3.3 Exposing Membership via Groundtruth Trajectory and Predicted Point

Our approach assumes that the training set’s samples have a smaller loss,
similar to many other MIAs, meaning that the training samples align more
closely with the groundtruth trajectory. We measure the distance between any
groundtruth point $\boldsymbol{x}_{t-t^{\prime}}$ and the predicted point
$\boldsymbol{x}^{\prime}_{t-t^{\prime}}$ using the $\ell_{p}\text{-norm}$,
which can be expressed by Eq. 8. Here,
$\boldsymbol{x}^{\prime}_{t-t^{\prime}}$ denotes the point predicted by the
model from $\boldsymbol{x}_{t}$. To apply this attack, we need to select a
specific time $t-t^{\prime}$, and we choose the time $t^{\prime}=t-1$ since it
is the closest. However, we will demonstrate later that the choice of
$t^{\prime}$ is not significant in discrete-time diffusion.

$d_{t-t^{\prime}}=\left\|\boldsymbol{x}_{t-t^{\prime}}-\boldsymbol{x}^{\prime}_{t-t^{\prime}}\right\|_{p}.$
(8)

To predict $\boldsymbol{x}^{\prime}_{t-t^{\prime}}$ from the groundtruth point
$\boldsymbol{x}_{t}$, we apply the deterministic version ($\sigma_{t}=0$) of
the DDIM denoising process Eq. 4.

We use method described in Section 3.2 to obtain the groundtruth point
$\boldsymbol{x}_{t}$ and $\boldsymbol{x}_{t-t^{\prime}}$. We then insert these
points into Eq. 8, giving us a simpler formula:

$\frac{\sqrt{1-\bar{\alpha}_{t-t^{\prime}}}\sqrt{\bar{\alpha}_{t}}-\sqrt{1-\bar{\alpha}_{t}}\sqrt{\bar{\alpha}_{t-t^{\prime}}}}{\sqrt{\bar{\alpha}_{t}}}\left\|\boldsymbol{\bar{\epsilon}}_{0}-\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\sqrt{\bar{a}_{t}}\boldsymbol{x}_{0}+\sqrt{1-\bar{a}_{t}}\overline{\boldsymbol{\epsilon}}_{0},t\right)\right\|_{p}.$

If we ignore the coefficient, $t^{\prime}$ disappears. Finally, the metric
ignoring the coefficient reduces to Eq. 9, where samples with smaller
$R_{t,p}$ are more likely to be training samples.

$R_{t,p}=\left\|\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{0},0\right)-\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\sqrt{\bar{a}_{t}}\boldsymbol{x}_{0}+\sqrt{1-\bar{a}_{t}}\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{0},0\right),t\right)\right\|_{p}.$
(9)

Since $\epsilon$ is initialized in time $t=0$, we call our method Proximal
Initialization Attack (PIA).

Normalization The values of
$\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{0},0\right)$
may not conform to a standard normal distribution, so we use Eq. 10 to
normalize them. $N$ represents the number of elements in the sample, such as
$h\times w$ for an image. We refer to this method as PIAN (PIA Normalized).
Although this normalization cannot guarantee that
$\hat{\boldsymbol{\epsilon}}_{\boldsymbol{\theta}}\left(\boldsymbol{x}{0},0\right)\sim\mathcal{N}(\mathbf{0},\mathbf{I})$,
we deem it reasonable since each element of $\bar{\epsilon}_{t}$ in the
training loss Eq. 1 is identically and independently distributed.

$\hat{\boldsymbol{\epsilon}}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{0},0\right)=\frac{\boldsymbol{\epsilon}_{\boldsymbol{\theta}}(\boldsymbol{x}_{0},0)}{\mathbb{E}_{x\sim\mathcal{N}(0,1)}(|x|)\frac{\|\boldsymbol{\epsilon}_{\boldsymbol{\theta}}(\boldsymbol{x}_{0},0)\|_{1}}{N}}=N\sqrt{\frac{\pi}{2}}\frac{\boldsymbol{\epsilon}_{\boldsymbol{\theta}}(\boldsymbol{x}_{0},0)}{\|\boldsymbol{\epsilon}_{\boldsymbol{\theta}}(\boldsymbol{x}_{0},0)\|_{1}}.$
(10)

To apply our attack, we first evaluate the value of $R_{t,p}$ on a sample, and
use an indicator function:

$f(\boldsymbol{x},m)=\mathds{1}[R_{t,p}<\tau].$ (11)

This equation means we consider a sample is in training set if $R_{t,p}$ is
smaller than a threshold $\tau$. $R_{t,p}$ is obtained from
${\boldsymbol{\epsilon}}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{0},0\right)$
(PIA) or
$\hat{\boldsymbol{\epsilon}}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{0},0\right)$
(PIAN).

###  3.4 For Continuous-Time Diffusion Model

Recently, some diffusion models are trained with continuous time. As
demonstrated in Score_Based , the diffusion process with continuous time can
be defined by a stochastic differential equation (SDE) as
$d\boldsymbol{x}_{t}=\boldsymbol{f}_{t}(\boldsymbol{x}_{t})dt+g_{t}d\boldsymbol{w}_{t}$,
where $\boldsymbol{w}_{t}$ is a Brownian process. One of the reverse process
is
$d\boldsymbol{x}_{t}=\left(\boldsymbol{f}_{t}(\boldsymbol{x}_{t})-\frac{1}{2}\left(g_{t}^{2}+\sigma_{t}^{2}\right)\nabla_{\boldsymbol{x}_{t}}\log
p_{t}(\boldsymbol{x}_{t})\right)dt+\sigma_{t}d\boldsymbol{w}$. When
$\sigma_{t}=0$, this formula becomes an ordinary differential equation (ODE):
$d\boldsymbol{x}_{t}=\left(\boldsymbol{f}_{t}(\boldsymbol{x}_{t})-\frac{1}{2}g_{t}^{2}\nabla_{\boldsymbol{x}_{t}}\log
p_{t}(\boldsymbol{x}_{t})\right)dt$. Continuous-time diffusion model train an
$\boldsymbol{s}_{\boldsymbol{\theta}}$ to approximate
$\nabla_{\boldsymbol{x}_{t}}\log p_{t}(\boldsymbol{x}_{t})$, the loss function
become:
$L=\mathbb{E}_{\boldsymbol{x}_{0},\boldsymbol{x}_{t}\sim
p\left(\boldsymbol{x}_{t}\mid\boldsymbol{x}_{0}\right)\bar{p}\left(\boldsymbol{x}_{0}\right)}\left[\left\|\boldsymbol{s}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{t},t\right)-\nabla_{\boldsymbol{x}_{t}}\log
p\left(\boldsymbol{x}_{t}\mid\boldsymbol{x}_{0}\right)\right\|^{2}\right].\vspace{-1mm}$

Replacing $\nabla_{\boldsymbol{x}_{t}}\log p_{t}(\boldsymbol{x}_{t})$ with
$\boldsymbol{s}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{t},t\right)$, the
inference procedure become the following equation:

$d\boldsymbol{x}_{t}=\left(\boldsymbol{f}_{t}(\boldsymbol{x}_{t})-\frac{1}{2}g_{t}^{2}\boldsymbol{s}_{\boldsymbol{\theta}}(\boldsymbol{x}_{t},t)\right)dt.$
(12)

The distribution $p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0})$ is typically set
to be the same as in DDPM for continuous-time diffusion models. Therefore, the
loss of the continuous-time diffusion model and the loss of the concrete-
diffusion model Eq. 1 are similar. Since DDPM and the diffusion model
described by SDE share a similar loss, our method can be applied to
continuous-time diffusion models. However, due to the different diffusion
process, $R_{t,p}$ differs from Eq. 9. From Eq. 12, we obtain the following
equation: $\boldsymbol{x}_{t-t^{\prime}}-\boldsymbol{x}_{t}\approx
d\boldsymbol{x}_{t}=\left(\boldsymbol{f}_{t}(\boldsymbol{x}_{t})-\frac{1}{2}g_{t}^{2}\boldsymbol{s}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{t},t\right)\right)dt.$
By substituting this equation into Eq. 8, we obtain the following equation:

$\|\boldsymbol{x}_{t-t^{\prime}}-\boldsymbol{x}^{\prime}_{t-t^{\prime}}\|_{p}\approx\left\|\left(\boldsymbol{f}_{t}(\boldsymbol{x}_{t})-\frac{1}{2}g_{t}^{2}\boldsymbol{s}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{t},t\right)\right)dt+\boldsymbol{x}_{t}-\boldsymbol{x}^{\prime}_{t-t^{\prime}}\right\|_{p}.$
(13)

By ignoring the high-order infinitesimal term
$\boldsymbol{x}_{t}-\boldsymbol{x}^{\prime}_{t-t^{\prime}}$ in Eq. 13, we can
obtain
$\|\boldsymbol{x}_{t-t^{\prime}}-\boldsymbol{x}^{\prime}_{t-t^{\prime}}\|_{p}\approx\left\|\left(\boldsymbol{f}_{t}(\boldsymbol{x}_{t})-\frac{1}{2}g_{t}^{2}\boldsymbol{s}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{t},t\right)\right)dt\right\|_{p}dt$.
We ignore $dt$ and use the following attack metric:

$R_{t,p}=\left\|\boldsymbol{f}_{t}(\boldsymbol{x}_{t})-\frac{1}{2}g_{t}^{2}\boldsymbol{s}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{t},t\right)\right\|_{p},$
(14)

where $\boldsymbol{x}_{t}$ is obtained from the output of
$\boldsymbol{s}_{\boldsymbol{\theta}}(\boldsymbol{x}_{0},0)$, similar to the
discrete-time diffusion case.

##  4 Experiment

In this section, we evaluate the performance of PIA and PIAN and robustness of
TTS models across various datasets and settings.

###  4.1 Dataset and Diffusion Models

For TTS, we evaluate three commonly used datasets: LJSpeech, VCTK, and a
subset of LibriTTS called libritts-lean-100. We test three models: GradTTS
111https://github.com/huawei-noah/Speech-Backbones/tree/main/Grad-TTS,
FastDiff 222https://github.com/Rongjiehuang/FastDiff, and DiffWave
333https://github.com/lmnt-com/diffwave. For image generation, we evaluate the
CIFAR10 and TinyImageNet datasets using the same DDPM model as SecMI . Unless
otherwise specified, we randomly select half of the samples as a training set
and the other half as the hold-out set.

###  4.2 Implementations Details

For the audio generation models, we use their codes from the official
repositories and apply the default hyperparameters for all models except for
the hyperparameters we mentioned. The training iterations were set to
1,000,000, due to the default value for the three audio generative models are
all around this. For the image generation, all settings are the same as those
in SecMI .

On GradTTS and DDPM, we utilized a consistent attack time $t$ across different
datasets for the same model. On DDPM, for Naive Attack, we set $t=200$. For
SecMI, we set $t=100$, which is the same as their papers. For our proposed
method, we set $t=200$. On GradTTS, for Naive Attack, we set $t=0.8$. For
SecMI, we set $t=0.6$. Because SecMI is not designed for continuous-time
diffusion, we discretize $[0,1]$ into 1000 steps and then apply SecMI. For the
proposed method, we adopt $t=0.3$. We chose $\ell_{4}$-norm to compute
$R_{t,p}$. For other models, we choose the best $t$ because our focus is on
the model’s robustness. Moreover, as stated later, the difference between the
best $t$ and a fixed $t$ is not significant.

###  4.3 Evaluation Metrics

We follow the most convincing metrics used in MIAs carlini2023extracting ,
including AUC, the True Positive Rate (TPR) when the False Positive Rate (FPR)
is 1%, i.e., TPR @ 1% FPR, and TPR @ 0.1% FPR.

###  4.4 Proximal Initialization Attack Performance

Table 1: Performance of the proposed method on Grad-TTS.

LJspeech VCTK LibriTTS Method Query AUC TPR@1% FPR AUC TPR@1% FPR AUC TPR@1%
FPR NA matsumoto2023membership  1 99.4 93.6 83.4 6.1 90.2 9.1 SecMI SecMI
60+2 99.5 94.0 87.0 14.8 93.9 19.7 PIA 1+1 99.6 95.0 87.3 20.1 95.5 37.7 PIAN
1+1 99.6 95.0 87.3 20.0 95.5 37.8

Table 2: Performance of the proposed method on DDPM. TPR@x% is the
abbreviation for TPR@x% FPR.

CIFAR10 TN-IN Method Query AUC TPR@1% <EMAIL_ADDRESS>AUC TPR@1% <EMAIL_ADDRESS>NA
matsumoto2023membership  1 84.7 6.85 0.06 84.9 10.0 0.07 SecMI SecMI  10+2
88.1 9.11 0.7 89.4 12.7 0.7 PIA 1+1 91.4 23.1 1.1 92.6 27.7 3.2 PIAN 1+1 89.0
31.9 2.0 89.9 37.3 10.6

As previously mentioned, we train TTS models on the LJSpeech, VCTK, and
LibriTTS datasets. We summarize the AUC and TPR @ 1% FPR results on GradTTS, a
continuous-time diffusion model, in Table 1. We employ NA to denote Naive
Attack. Compared to SecMI, PIA and PIAN achieve slightly better AUC
performance and significantly higher TPR @ 1% FPR performance, i.e., 8%
higher. However, our proposed method only requires $1+1$ queries, just one
more query than Naive Attack, and has a computational consumption of only 3.2%
of SecMI. The performance of PIA and PIAN is similar, and both methods
outperform SecMI and Naive Attack.

For the image generation model, we present the results in Table 2. For DDPM, a
discrete-time diffusion model, PIA performs slightly better than SecMI in
terms of AUC but has a distinctly higher TPR @ 1% FPR than SecMI, i.e. 14.1%
higher on average than SecMI. For PIAN, the AUC performance is slightly lower
than PIA, but higher than SecMI, and the TPR @ 1% FPR performance is
significantly better than SecMI, i.e. 23.4% higher on average than SecMI. The
TPR @ 0.1% FPR performance is also better than SecMI. Similar to the previous
case, our attack only requires two queries on DDPM and the computational
consumption is 17% of SecMI. Both methods outperform SecMI and Naive Attack.

###  4.5 Ablation Study

(a) The results of PIA and PIAN on Grad-TTS for different values of $t$ and
different datasets.

(b) The results of PIA and PIAN on DDPM for different values of t and
different datasets.

Figure 2: The performance of PIA and PIAN as $t$ varies. The top row shows the
results for AUC, and the bottom row shows the results for TPR @ 1% FPR.

(a) The results of PIA and PIAN on Grad-TTS for different values of $t$ and
different LibriTTS splits.

(b) The results of PIA and PIAN on DDPM for different values of $t$ and
different CIFAR10 splits.

Figure 3: The performance of our method on 4 random split LibriTTS/CIFAR10
dataset as $t$ varies. The top row shows the results for AUC, and the bottom
row displays the results for TPR @ 1% FPR.

(a) The results of PIA and PIAN on Grad-TTS for different values of
$\ell_{p}$-norm.

(b) The results of PIA and PIAN on DDPM for different values of
$\ell_{p}$-norm.

Figure 4: The performance of our method as $\ell_{p}$-norm varies. The top row
shows the results for AUC, and the bottom row displays the results for TPR @
1% FPR.

Our proposed method has two hyper-parameters: $t$ and the $\ell_{p}$-norm used
in the attack metrics $R_{t,p}$ presented in Eqs. 9 and 14.

To evaluate the impact of $t$, we attack the target model at intervals of
$0.01\times T$ from $0$ to $T$ and report the results across different models
and datasets. We demonstrate the performance of our proposed method on two
different models: GradTTS, a continuous-time diffusion model used for audio,
in Fig. 2(a); and DDPM, a discrete-time diffusion model employed for images,
in Fig. 2(b). The results indicate that our method produces a consistent
pattern in the same model across different datasets, whether PIA or PIAN.
Specifically, for GradTTS, both AUC and TPR @ 1% FPR exhibit a rapid increase
at the beginning as $t$ increases, followed by a decline around $t=0.5$. For
DDPM, AUC and TPR @ 1% FPR also demonstrate a rapid increase at the beginning
as $t$ increases, followed by a decline around $t=200$. In Fig. 3, we randomly
partition the LibriTTS/CIFAR10 dataset four times and compare the performance
of each partition. Consistent with the previous results, our method exhibits a
similar trend across the different splits.

In Fig. 4, we compare the results obtained on $\ell_{p}$-norm using the
$\ell_{1}$-norm to the $\ell_{7}$-norm, with the choice of $t$ being the same
as in Section 4.4. The results indicate an increase in performance at
$\ell_{1}$-norm, followed by a decline after the $p=5$. It reveals that the
combined effect of both large and small differences exhibits a synergistic
influence when present in an appropriate ratio.

Table 3: Comparison of different models. AUC is the result on the LJSpeech/TinyImageNet dataset. Model | Size | T | Output | Segmentation Length | Best AUC
---|---|---|---|---|---
DDPM | 35.9M | 1000 | Image | N/A | 92.6
GradTTS | 56.7M | $[0,1]$ | Mel-spectrogram | 2s | 99.6
DiffWave | 30.3M | 50 | Audio | 0.25s | 52.4
FastDiff | 175.4M | 1000 | Audio | 1.2s | 54.4

###  4.6 Which Type of Model Output is More Robust?

There are generally two forms of output in TTS: mel-spectrograms and audio. In
Table 3, we summarize the model details and best results of our proposed
method on three TTS models using the LJSpeech dataset and the DDPM model on
the TinyImageNet dataset. We only report the results of our method since it
achieves better performance most of the time.

As shown in Table 3, with the same training and hold-out data, GradTTS
achieves an AUC close to 100, while DiffWave and FastDiff only achieve the
performance slightly above 50, which is close to random guessing. However,
DiffWave has a similar size to DDPM and GradTTS, and FastDiff has similar $T$
with DDPM. Additionally, FastDiff has similar segmentation length to GradTTS.
Thus, we believe that these hyperparameters are not the decisive parameters
for the model’s robustness. It is obvious that the output of GradTTS and DDPM
is image-like. Fig. 5 provides an example of mel-spectrogram. The deep reasons
why these models exhibit robustness can be further explored. We report these
results hoping that they may inspire the design of models with MIA robustness.

Figure 5: An example of mel-spectrogram.

(a) The results of PIA and PIAN on Grad-TTS for different training and
evaluation sample numbers.

(b) The results of PIA and PIAN on DDPM for different training and evaluation
sample numbers.

Figure 6: The performance of our method for different training and evaluation
sample numbers. The top row shows the results for AUC, and the bottom row
displays the results for TPR @ 1% FPR.

We also explore the attack performance with various training and evaluation
sample numbers. We select 10%, 30%, 50%, and 100% of the samples from the
complete dataset. In each split, half of all samples are used for training,
and the other half are utilized as a hold-out set. The results are presented
in Fig. 6. As we can see, when only 10% of the data is used, relatively high
AUC and TPR @ 1% FPR can be achieved. Additionally, we find that the AUC and
TPR @ 1% FPR decrease as the proportion of selected samples in the total
dataset increases. However, for GradTTS and DDPM, the decrease is relatively
gentle, while for DiffWave and FastDiff, the decrease is rapid. In other
words, the robustness increases rapidly with the increase of training samples.

##  5 Conclusion

In this paper, we propose an efficient membership inference attack method for
diffusion models, namely Proximal Initialization Attack (PIA) and its
normalized version, PIAN. We demonstrate its effectiveness on a continuous-
time diffusion model, GradTTS, and a discrete-time diffusion model, DDPM.
Experimental results indicate that our proposed method can achieve similar AUC
performance to SecMI and significantly higher TPR @ 1% FPR with the cost of
only two queries, which is much faster than the 12~62 queries required for
SecMI in this paper. Additionally, we analyze the vulnerability of models in
TTS, an audio generation tasks. The results suggest that diffusion models with
the image-like output (mel-spectrogram) are more vulnerable than those with
the audio output. Therefore, for privacy concerns, we recommend employing
models with audio outputs in text-to-speech tasks.

Limitation and Broader Impacts The purpose of our method is to identify
whether a given sample is part of the training set. This capability can be
leveraged to safeguard privacy rights by detecting instances of personal
information being unlawfully used for training purposes. However, it is
important to note that our method could also potentially result in privacy
leaking. For instance, this could occur when anonymous data is labeled by
determining whether a sample is part of the training set or as a part of data
reconstruction attack. It is worth mentioning that our method solely relies on
the diffusion model’s output, but it does require the intermediate output.
This dependency on the intermediate output may pose a limitation to our
method.

## References

  * [1] Rishi Bommasani, Drew A Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, et al.  On the opportunities and risks of foundation models.  arXiv preprint arXiv:2108.07258, 2021.
  * [2] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer.  Membership inference attacks from first principles.  In IEEE Symposium on Security and Privacy, pages 1897–1914. IEEE, 2022.
  * [3] Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace.  Extracting training data from diffusion models.  arXiv preprint arXiv:2301.13188, 2023.
  * [4] Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz.  Gan-leaks: A taxonomy of membership inference attacks against generative models.  In SIGSAC Conference on Computer and Communications Security, pages 343–362, 2020.
  * [5] Nanxin Chen, Yu Zhang, Heiga Zen, Ron J. Weiss, Mohammad Norouzi, and William Chan.  Wavegrad: Estimating gradients for waveform generation.  In International Conference on Learning Representations, 2021.
  * [6] CNN.  Ai won an art contest, and artists are furious.  Website, 2022.  https://www.cnn.com/2022/09/03/tech/ai-art-fair-winner-controversy/index.html.
  * [7] Tim Dockhorn, Arash Vahdat, and Karsten Kreis.  Score-based generative modeling with critically-damped langevin diffusion.  In International Conference on Learning Representations, 2022.
  * [8] Jeff Donahue, Philipp Krähenbühl, and Trevor Darrell.  Adversarial feature learning.  In International Conference on Learning Representations, 2017.
  * [9] Jinhao Duan, Fei Kong, Shiqi Wang, Xiaoshuang Shi, and Kaidi Xu.  Are diffusion models vulnerable to membership inference attacks?  arXiv preprint arXiv:2302.01316, 2023.
  * [10] Vincent Dumoulin, Ishmael Belghazi, Ben Poole, Alex Lamb, Martín Arjovsky, Olivier Mastropietro, and Aaron C. Courville.  Adversarially learned inference.  In International Conference on Learning Representations, 2017.
  * [11] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative adversarial networks.  Communications of the ACM, 63(11):139–144, 2020.
  * [12] Benjamin Hilprecht, Martin Härterich, and Daniel Bernau.  Monte carlo and reconstruction membership inference attacks against generative models.  Proceedings on Privacy Enhancing Technologies, 2019(4):232–249, 2019.
  * [13] Jonathan Ho, Ajay Jain, and Pieter Abbeel.  Denoising diffusion probabilistic models.  In Advances in Neural Information Processing Systems, volume 33, pages 6840–6851, 2020.
  * [14] Jonathan Ho, Tim Salimans, Alexey Gritsenko, William Chan, Mohammad Norouzi, and David J. Fleet.  Video diffusion models.  In Advances in Neural Information Processing Systems, 2022.
  * [15] Kalin Hristov.  Artificial intelligence and the copyright dilemma.  Idea, 57:431, 2016.
  * [16] Hailong Hu and Jun Pang.  Membership inference of diffusion models.  arXiv preprint arXiv:2301.09956, 2023.
  * [17] Rongjie Huang, Max W. Y. Lam, Jun Wang, Dan Su, Dong Yu, Yi Ren, and Zhou Zhao.  Fastdiff: A fast conditional diffusion model for high-quality speech synthesis.  In European Conference on Artificial Intelligence, pages 4157–4163, 2022.
  * [18] Keith Ito and Linda Johnson.  The lj speech dataset.  https://keithito.com/LJ-Speech-Dataset/, 2017.
  * [19] Yamagishi Junichi, Veaux Christophe, and MacDonald Kirsten.  Cstr vctk corpus: English multi-speaker corpus for cstr voice cloning toolkit.  https://datashare.ed.ac.uk/handle/10283/3443, 2019.
  * [20] Diederik P Kingma and Max Welling.  Auto-encoding variational bayes.  arXiv preprint arXiv:1312.6114, 2013.
  * [21] Zhifeng Kong, Wei Ping, Jiaji Huang, Kexin Zhao, and Bryan Catanzaro.  Diffwave: A versatile diffusion model for audio synthesis.  In International Conference on Learning Representations, 2021.
  * [22] Alex Krizhevsky, Geoffrey Hinton, et al.  Learning multiple layers of features from tiny images, 2009.
  * [23] Tomoya Matsumoto, Takayuki Miura, and Naoto Yanai.  Membership inference attacks against diffusion models.  arXiv preprint arXiv:2302.03262, 2023.
  * [24] Dang Pham and Tuan M. V. Le.  Auto-encoding variational bayes for inferring topics and visualization.  In International Conference on Computational Linguistics, pages 5223–5234, 2020.
  * [25] Vadim Popov, Ivan Vovk, Vladimir Gogoryan, Tasnima Sadekova, and Mikhail Kudinov.  Grad-tts: A diffusion probabilistic model for text-to-speech.  In International Conference on Machine Learning, pages 8599–8608, 2021.
  * [26] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen.  Hierarchical text-conditional image generation with clip latents.  user-5f6bfffd92c7f9be21bbcc99, 2022.
  * [27] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer.  High-resolution image synthesis with latent diffusion models.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 10674–10685, 2022.
  * [28] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al.  Photorealistic text-to-image diffusion models with deep language understanding.  In Advances in Neural Information Processing Systems, volume 35, pages 36479–36494, 2022.
  * [29] Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen.  Improved techniques for training gans.  In Advances in Neural Information Processing Systems, volume 29, 2016.
  * [30] Tim Salimans and Jonathan Ho.  Progressive distillation for fast sampling of diffusion models.  In International Conference on Learning Representations, 2022.
  * [31] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.  Membership inference attacks against machine learning models.  In IEEE Symposium on Security and Privacy, pages 3–18. IEEE, 2017\.
  * [32] Jiaming Song, Chenlin Meng, and Stefano Ermon.  Denoising diffusion implicit models.  In International Conference on Learning Representations, 2021.
  * [33] Yang Song and Stefano Ermon.  Generative modeling by estimating gradients of the data distribution.  In Advances in Neural Information Processing Systems, pages 11895–11907, 2019.
  * [34] Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole.  Score-based generative modeling through stochastic differential equations.  In International Conference on Learning Representations, 2021.
  * [35] WashingtonPost.  He made a children’s book using ai. then came the rage.  Website, 2022.  https://www.washingtonpost.com/technology/2023/01/19/ai-childrens-/book-controversy-chatgpt-midjourney.
  * [36] Zhisheng Xiao, Karsten Kreis, and Arash Vahdat.  Tackling the generative learning trilemma with denoising diffusion gans.  In International Conference on Learning Representations, 2022.
  * [37] Kaidi Xu, Sijia Liu, Pu Zhao, Pin-Yu Chen, Huan Zhang, Quanfu Fan, Deniz Erdogmus, Yanzhi Wang, and Xue Lin.  Structured adversarial attack: Towards general implementation and better interpretability.  In International Conference on Learning Representations, 2018.
  * [38] Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin.  Adversarial t-shirt! evading person detectors in a physical world.  In European conference on computer vision, pages 665–681. Springer, 2020.
  * [39] Ruihan Yang, Prakhar Srivastava, and Stephan Mandt.  Diffusion probabilistic modeling for video generation.  arXiv preprint arXiv:2203.09481, 2022.
  * [40] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha.  Privacy risk in machine learning: Analyzing the connection to overfitting.  In IEEE Computer Security Foundations Symposium, pages 268–282. IEEE, 2018.
  * [41] Chenxi Yuan, Tucker Marion, and Mohsen Moghaddam.  Dde-gan: Integrating a data-driven design evaluator into generative adversarial networks for desirable and diverse concept generation.  Journal of Mechanical Design, 145(4):041407, 2023.
  * [42] Chenxi Yuan and Mohsen Moghaddam.  Attribute-aware generative design with generative adversarial networks.  IEEE Access, 8:190710–190721, 2020.
  * [43] H. Zen, V. Dang, R. Clark, Y. Zhang, R. J. Weiss, Y. Jia, Z. Chen, and Y. Wu.  Libritts: A corpus derived from librispeech for text-to-speech.  In Proceedings of Interspeech, September 2019.
  * [44] Huan Zhang, Shiqi Wang, Kaidi Xu, Yihan Wang, Suman Jana, Cho-Jui Hsieh, and Zico Kolter.  A branch and bound framework for stronger adversarial attacks of relu networks.  In International Conference on Machine Learning, pages 26591–26604. PMLR, 2022.
  * [45] Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song.  The secret revealer: Generative model-inversion attacks against deep neural networks.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 253–261, 2020.

##  Appendix A Appendix

###  A.1 Robustness on FastDiff and DiffWave

Table 4 shows the AUC of different methods at FastDiff and DiffWave model on
three datasets. The performance of all three MIA methods is very poor.

Table 4: Performance of AUC on FastDiff and DiffWave across three datasets. | FastDiff | DiffWave
---|---|---
Method | LJSpeech | VCTK | LibriTTS | LJSpeech | VCTK | LibriTTS
NA [23] | 52.6 | 55.1 | 53.7 | 52.7 | 53.8 | 51.2
SecMI [9] | 51.6 | 56.3 | 53.7 | 53.2 | 54.3 | 52.4
PIA | 51.6 | 57.1 | 54.1 | 54.4 | 54.2 | 50.8
PIAN | 52.4 | 57.0 | 54.6 | 50.0 | 50.5 | 50.7

###  A.2 Distribution for samples from training set and hold-out set.

Fig. 7 shows the $R_{t=0.3,p=4}$ distribution for samples from training set
and hold-out set at GradTTS on different datasets of PIAN.

(a) Distribution on LJSpeech.

(b) Distribution on VCTK.

(c) Distribution on LibriTTS.

Figure 7: $R_{t=0.3,p=4}$ distribution for samples from training set and hold-
out set at GradTTS on different datasets of PIAN.

###  A.3 Log-scaled ROC curve

As suggested by [2], Fig. 8 and Fig. 9 display the log-scaled ROC curves.
These curves demonstrate that the proposed method outperforms NA and SecMI at
most of times.

(a) Log-scaled ROC on CIFAR10.

(b) Log-scaled ROC on TinyImageNet.

Figure 8: The log-scaled ROC at DDPM of different methods on CIFAR10 and
TinyImageNet.

(a) Log-scaled ROC on LJSpeech.

(b) Log-scaled ROC on VCTK.

(c) Log-scaled ROC on LibriTTS.

Figure 9: The log-scaled ROC at GradTTS of different methods on LJSpeech, VCTK
and LibriTTS.

###  A.4 Visualization of Reconstruction

Note Eq. 9 is equal to the distance between
$\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{0},0\right)$
and the predicted one
$\boldsymbol{\epsilon}^{\prime}=\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{t},t\right)$
, where
$x_{t}=\sqrt{\bar{a}_{t}}\boldsymbol{x}_{0}+\sqrt{1-\bar{a}_{t}}\boldsymbol{\epsilon}_{\boldsymbol{\theta}}\left(\boldsymbol{x}_{0},0\right)$.
Fig. 10 and Fig. 11 show the reconstructed sample
$\boldsymbol{x}^{\prime}_{0}=\frac{\boldsymbol{x}_{t}-\sqrt{1-\bar{a}_{t}}\boldsymbol{\epsilon}^{\prime}}{\sqrt{\bar{a}_{t}}}$
from $\boldsymbol{x}_{t}$ using the predicted $\boldsymbol{\epsilon}^{\prime}$
at DDPM on CIFAR10 of PIAN. The reconstructed samples from $t=100$ are clear
for both the training set and the hold-out set. The reconstructed samples from
$t=400$ are blurry for both sets. However, for $t=200$, the reconstructed
samples are clear for the training set but blurry for the hold-out set.

For GradTTS, we use Eq. 12 to reconstruct samples from $x_{t}$. This
reconstruction is not rigorous, but we just use it to give a visualization.
Fig. 12 and Fig. 13 show the reconstructed samples on LJSpeech from PIA. The
observed pattern is consistent with DDPM.

(a) Samples in training set.

(b) Samples reconstructed from $t=100$.

(c) Samples reconstructed from $t=200$.

(d) Samples reconstructed from $t=400$.

Figure 10: Samples in training set and the reconstructed samples at DDPM on
CIFAR10 from PIAN.

(a) Samples in hold-out set.

(b) Samples reconstructed from $t=100$.

(c) Samples reconstructed from $t=200$.

(d) Samples reconstructed from $t=400$.

Figure 11: Samples in hold-out set and the reconstructed samples at DDPM on
CIFAR10 from PIAN.

(a) Samples in training set.

(b) Samples reconstructed from $t=0.1$.

(c) Samples reconstructed from $t=0.6$.

(d) Samples reconstructed from $t=0.95$.

Figure 12: Samples in training set and the reconstructed samples at GradTTS on
LJSpeech from PIA.

(a) Samples in hold-out set.

(b) Samples reconstructed from $t=0.1$.

(c) Samples reconstructed from $t=0.6$.

(d) Samples reconstructed from $t=0.95$.

Figure 13: Samples in hold-out set and the reconstructed samples at GradTTS on
LJSpeech from PIA.