Dual-Model Defense: Safeguarding Diffusion Models from Membership Inference Attacks through Disjoint Data Splitting

We thank the reviewer for the comments, we address main concerns as follows:

• Regarding the comparison to other distillation-based method: We thank the reviewer for the suggestion. We compare the performance of a normal distillation without data division with our approach in the following table. The experiment is conducted in the CIFAR10 dataset with the same settings outlined in our paper. We distill the model with a normal distillation process for 400,000 iterations. The results imply that while the method can mitigate MIAs to some extent, it is not adequate enough for practical usage.

• Regarding the Practical Constraints: Recent diffusion models [1] have scaled to billions of parameters. The Stable Diffusion 3 model can have up to 8B parameters, which makes it hard to train or infer on resource-constrained situations.

• Regarding the Evaluation Metrics: FID and IS are widely used metrics for evaluating image quality. They help verify that the model generates high-quality images while effectively defending against MIA. The Area Under the ROC Curve (AUC) measures the capability of the attack model to classify member and non-member samples correctly, and a closer AUC to 0.5 indicates a stronger defense capability. The True Positive Rate (TPR) when the False Positive Rate (FPR) is 1% (TPR@1%FPR) measures the ability of the attack model to detect member samples correctly in worst-cases when FPR is very low.

• Regarding the explanation of Figure 1: (Left): We divide the training dataset into two non-overlapping subsets. Each subset is then used to train a separate diffusion model with the vanilla diffusion loss (refer to Line 9 in Algorithm 1). (Right): During the distillation phase, for each iteration, if a data point belongs to subset 1, it is passed through the pre-trained model 2 (which is frozen) to generate a "soft" label. Similarly, if a data point belongs to subset 2, it is passed through the pre-trained model 1 (also frozen) to produce a soft label. The student model then uses this "soft" label as the target to compute the diffusion loss (refer to Line 13 in Algorithm 2).

• Regarding the Algorithm: During training, we randomly sample t because we primarily rely on the vanilla diffusion loss [2] for training both models and distilling the student model.

We really hope that the reviewer can reconsider the review score. Please let us know if you would like us to do anything else.

Best,

Authors

References:

[1] Esser, et al. Scaling rectified flow transformers for high-resolution image synthesis. International Conference on Machine Learning, 2024.

[2] Ho, Jonathan, Ajay Jain, and Pieter Abbeel. "Denoising diffusion probabilistic models." Advances in neural information processing systems 33 (2020): 6840-6851.

We thank the reviewer for the comments, we address main concerns as follows:

• Regarding the comparison to other distillation-based method: We thank the reviewer for the suggestion, and we would like to provide the performance of an ordinary distillation without data division in comparison to our approach in the following table. The experiment is conducted in the CIFAR10 dataset with the same settings outlined in our paper. We distill the model using an ordinary distillation process for 400,000 iterations. The results imply that while the method can somewhat mitigate MIAs, it is not effective enough for practical usage. It should also be noted that other distillation-based methods for safeguarding classification models also apply additional techniques, such as label smoothing, to enhance privacy. While these techniques are effective for classification models, they are not generally applicable to generative modeling tasks and we open the door for future works to employ those distillation methods on diffusion models. We hope that this analysis addresses the reviewer's concern about the importance of training multiple private models compared to distilling with only one model.

• Regarding our claim in introduction: We admit that there would be a misunderstanding in the Introduction of our paper. While the prompt diversification technique can somewhat mitigate MIAs, combining it with our proposed methods can further improve the defense performance, reducing the possibilities of False Positive evidenced by a closer AUC to 0.5.

• Regarding the logic of the paper: We would like to provide some clarifications as follow: We consider the prompt overfitting issue for MIAs because both MIAs and model memorization are related to model overfitting and studies from model memorization revealed that diffusion models not only overfit training images but also training prompts. In addition, the reason why we train two models on two disjoint subsets is to ensure that for any training sample, there is always a model that "see" it as a test sample. Therefore, by using this model to infer the training sample, we can avoid MIAs. Our proposed methods DualMD and DistillMD further extend the use of the two models in practical situations, avoiding the need to "choose" model to perform inference. We thank you for these comments, and we will improve these points in our revised version.

• Regarding the lack of ROC curve: The ROC curves of different strategies under black-box MIAs will be included in our Appendix.

• Regarding more diffusion model architectures: We conducted experiments using the Stable Diffusion 2.1 backbone on the Pokemon dataset. The resulsts suggest that our proposed DistillMD method not only enhances image quality but also effectively defends against two attack methods: SecMIA and PIA.

We really hope that the reviewer can reconsider the review score. Please let us know if you would like us to do anything else.

Best,

Authors

We thank the reviewer for the comments, we address main concerns as follows:

• Regarding the correlated pairs: While the correlated pair analysis can be valuable for classification tasks such as in [1], data deduplication can effectively search similar image pairs and remove them from training data for generative modeling tasks. Duplication retrieval or deduplication methods for diffusion model training have been widely investigated in [3][4][5] and have already been applied in large-scale model training such as in Stable Diffusion 3 [3]. Therefore, we argue that correlated training pairs is not a substantial issue for diffusion model training because it can be effectively mitigated by preprocessing the training data.

• Regarding the text-to-image task: We believe that DualMD better suits text-to-image diffusion models as our analysis reveals that it better preserves the generation quality while effectively mitigates MIAs. Although one limitation of DualMD is the worse performance in worst-case scenarios compared to DistillMD, a score of 1.4% still falls under a safe threshold and can be considered an effective defense.

• Regarding the utility evaluation: The results for the Pokemon dataset are without prompt diversification. In the table below, we additionally provide the scores of the two teacher models on CIFAR10. Although there is unavoidable performance degradation from the distillation process, this loss is offset by the significant increase in the model's privacy.

• Regarding the connection between MIAs and Memorization: Although prior works also investigated the connection between MIAs and Memorization, our study further crosses the border by utilizing insights from one field to the other. On the one hand, we showed that MIA losses can effectively detect memorized instances, and our proposed defense can not only defend MIAs but also mitigate memorization. On the other hand, we also revealed that insights from memorization studies, such as the prompt overfitting, can be beneficial to understanding MIAs, further improving defending mechanisms. In addition, although the propmt diversification technique is studied and applied in [6] for mitigating model memorization, we utilize it for another purpose of defending against MIAs for the first time and prove its essential role in safeguarding text-to-image diffusion models.

• Regarding the "stopgrad" notation: During the distillation phase, we utilize two pretrained and frozen teacher models to generate soft labels for the student model. These teacher models remain unchanged throughout this phase, so we apply the "stopgrad" operation in Equation 7 to prevent gradient updates on the teacher models.

We really hope that the reviewer can reconsider the review score. Please let us know if you would like us to do anything else.

Best,

Authors

References:

[1] Carlini, Nicholas, et al. "Membership inference attacks from first principles." 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022.

[2] Tang, et al. "Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture". Proceedings of the 31st USENIX Security Symposium.

[3] Esser, et al. Scaling rectified flow transformers for high-resolution image synthesis. International Conference on Machine Learning, 2024.

[4] Carlini, Nicolas, et al. "Extracting training data from diffusion models." 32nd USENIX Security Symposium (USENIX Security 23), 2023.

[5] Somepalli, Gowthami, et al. "Diffusion art or digital forgery? investigating data replication in diffusion models." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023.

[6] Somepalli, Gowthami, et al. "Understanding and mitigating copying in diffusion models." Advances in Neural Information Processing Systems 36, 2023.

We thank the reviewer for the comments, we address main concerns as follows:

1. Regarding the similarity with the papers [1] and [2]: While these works look similar to ours in the way they divide datasets into subsets, they both have limitations and our paper presents unique insights of the vulnerability into diffusion models.

• Firstly, while both papers employ an output aggregation framework to get the final results from the sub-models, this approach is not suitable for generative modeling tasks. Take the case when two models are trained on two non-identical subsets. If the two subsets are drawn from a same distribution but are not representative enough for that distribution, the two resulting models can follow two different trajectories in their generation process. Consequently, their outputs for the same input can be different, making the aggregation process become mixing two distinct images. There is no guarantee that the combination of the two images is a good image which should be evidenced by good generation scores. To validate this analysis, we tried to generate images by averaging the outputs of our two sub-models trained on two disjoint subsets of CIFAR10, and the resulting FID score in compared to our approach is reported in the table below.

• Secondly, while the paper [2] is designed for diffusion models, the method is only tested with unconditional diffusion models on small datasets, including MNIST and CIFAR10. In contrast, we validated our method’s efficacy on both unconditional and text-guided diffusion models, shedding new insights into the difference between the two tasks. Specifically, our experiments suggest that DistillMD or DualMD alone cannot effectively defend MIAs for text-guided generation, which implies that similar methods in [1] and [2] are also not suitable for large text-to-image models because they all rely on dividing the datasets. Nevertheless, we investigated the issue and realized that the main cause is prompt overfitting, consequently proposed to diversify the training prompts of text-to-image diffusion models. Our investigation provided new insights into conditional diffusion models as we are the first ones to realize the difference between unconditional and conditional diffusion models. In addition, employing prompt diversification alongside DualMD and DistillMD further improves the defense capability of resulting models.

• In addition, we provide new insights into the connections between MIAs and the model memorization issue. By proving that DistillMD not only defends MIAs but also mitigates memorization, we unify the two domains and simplify the defending mechanism of both to one common algorithm.

• Besides, [1] is not explicitly designed for diffusion models, and there is no guarantee that their method will work well for all types of diffusion models. Besides, they propose to divide the datasets into multiple subsets and train multiple models on joint clusters of subsets. The large number of models can hinder the utility of the method for large-scale diffusion models because each model requires substantial memory to store, and train and running multiple models would be significantly slow. Hence, we propose reducing the algorithm to training only two models on two disjoint subsets, which lowers the memory consumption and preserving the property that for any training sample, there is always a model that "sees" it as a "test example".

2. Regarding further utility evaluation: We would like to provide some generated images by our model on CIFAR10 and Pokemon in the Appendix for reference. We also provide more quantitative results of the sub-models and more experiments with a new dataset Naruto [3] and a new architecture Stable Diffusion v2.1. For the reviewer's inquiry, our evaluation on image generation only gives comparable results with the baseline non-private models, so we are not claiming SOTA for image generation quality as it is not the main goal of our work.

For Pokemon dataset with backbone SDv2.1:

For Naruto dataset with backbone SDv1.5 and SDv2.1:

3. Regarding Adaptive Attack concerns: We thank the reviewer for the suggestion. We conduct an adaptive attack against DualMD by manipulating the number of steps as follows. We first call the model to generate an image in n steps; the input noise is denoised by the SubModel1 (SB1), then SubModel2 (SB2), and repeat. We add noise to the generated images to the second largest timestep to eliminate the effect of all denoising steps except the earliest one from SB1. The noisy image and its corresponding noisy timestep then serve as the initial noise and starting timestep for the second round of generation with n-1 steps starting again from SB1. The process can be repeated with more generation rounds to gradually remove the effect of SB2 and keep only denoising steps from SB1. Combining this generation process with black-box MIAs we have a complete attack, and the performance of DualMD against this attack is given in the table below. It can be seen that our method still maintains a high defense efficiency after rounds of this adaptive attack.

We really hope that the reviewer can reconsider the review score. Please let us know if you would like us to do anything else.

Best,

Authors

References:

[1] Tang, et al. "Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture". Proceedings of the 31st USENIX Security Symposium.

[2] Sehwag, et al. "Differentially Private Generation of High Fidelity Samples From Diffusion Models".

[3] Cervenka, Eole. "Naruto BLIP captions".