MGE: Membership-Inference-Guided Data Extraction Attack against Diffusion Models

1. 01What problem does this paper attempt to solve?

   Aiming at the risk of training data leakage caused by diffusion model memorization, the authors propose a membership-inference-guided extraction attack, MGE.

   Core question: how to extract training set images from a pretrained diffusion model, to reveal the privacy leakage risk caused by its memorization.

   • Scenario and motivation: Diffusion models perform well in image generation, but the authors state that their memorization properties bring training data leakage risk, and existing work reveals this risk through membership inference attacks and data extraction attacks.
   • Shortcomings of existing methods: Early extraction attacks are mostly the "generate-and-filter" paradigm, generating candidates and then filtering memorized samples; the authors consider their success rate and efficiency limited, and MGE aims to improve both simultaneously.
   • Core observation: Data extraction can be formalized as conditional generation p(x0 | x0 ∈ S), and the condition signal can be provided by a membership inference (MIA) classifier, without training an additional auxiliary classifier.
   • Proposed approach: Proposes MGE (Membership Guided Extraction), using a differentiable approximation of the PIA membership inference classifier as guidance, with two components, adversarial guidance and parallel branch decoding.
   • Threat model:
     • Goal: Extract real training images from the training set of the target diffusion model.
     • Knowledge: The paper does not explicitly state white-box or black-box; the method by default backpropagates during sampling to compute guidance gradients, and Appendix A.6 additionally tests a zeroth-order gradient estimation variant.
     • Capability: Control the initial noise for sampling and inject a guidance signal during denoising.
     • Victim systems: Pretrained diffusion models such as ADM, EDM, and Stable Diffusion v1.5.

   Collapse this answer

2. 02What related research exists?

   Related work falls into two categories: membership inference attacks and data extraction attacks. This paper uses PIA to construct the guidance signal, which differs from the guidance methods of SIDE and FineXtract.

   Membership inference attacks (MIA)

   • Shokri et al. 2017 et al. — proposed MIA on classification models, later extended to LLMs and diffusion models; MIA on diffusion models is divided into white-box (Pang et al. 2023, Duan et al. 2023) and black-box (Tang et al. 2023, Kong et al. 2023, etc.).
   • Kong et al. 2023 (PIA), Duan et al. 2023/2024 — construct diffusion model membership inference classifiers based on "reconstruction error" or "noise difference"; this paper uses PIA to construct the guidance signal, which the authors say strikes a balance between efficiency and accuracy.
   • Li et al. 2024b, Luo et al. 2025 — extend MIA to specific scenarios such as Text-to-Image, DreamBooth, and LoRA.

   Data extraction attacks (DEA)

   • Fredrikson et al. 2015, Zhang et al. 2020, etc. — model inversion on classification models; Carlini et al. 2021 extract training text from autoregressive language models, and Nasr et al. 2023 extend this to LLaMA, ChatGPT, and Falcon.
   • Carlini et al. 2023 — generate-and-filter extraction on diffusion models, which is the baseline of this paper; the paper notes that its difference from it is that it injects the membership guidance signal directly into the generation process.
   • SIDE (Chen et al. 2026) and FineXtract (Wu, Zhang, and Wu 2025) — both are guided extraction: SIDE uses a clustering-based proxy condition and does not explicitly encode training set membership; FineXtract exploits the difference between pretrained and fine-tuned checkpoints to extract fine-tuning data. The paper notes that MGE's guidance comes directly from the target model itself and does not require an auxiliary classifier or a pretrained–fine-tuned checkpoint pair.

   Baselines and benchmarks: The baseline is the generate-and-filter of Carlini et al. 2023 (using DDPM and DDIM sampling respectively); the benchmarks are CIFAR10, CIFAR100, Tiny-ImageNet, FFHQ, AFHQv2, and LAION-2B.

   The authors position this paper as: like SIDE and FineXtract, it is guided extraction, but the guidance signal is constructed differently, coming directly from the target model's membership score.

   Collapse this answer

3. 03How does the paper address this problem?

   MGE formalizes data extraction as membership-inference-guided conditional generation, supplemented by adversarial guidance and parallel branch decoding for acceleration.

   Overall idea: turn the data extraction attack into conditional generation, with the condition signal provided by a membership inference classifier; the framework is named MGE (Membership Guided Extraction) and contains two components, adversarial guidance and parallel branch decoding (Figure 2, Algorithm 1).

   Formalization: extraction as conditional generation

   • The objective is written as sampling from the conditional distribution p(x0 | x0 ∈ S), where S is the training set; by Bayes decomposition, the guidance term is ∇xt log p(x0 ∈ S | xt).
   • Using the PIA classifier f(x₀)=𝟙[R_t,p(x₀)<τ] 判定成员身份，其中 Rt,p 是重构误差；因其不可微，用 Sigmoid(−(Rt,p(x0)−τ)/ϕ) 作可微代理，ϕ 为温度常数。
   • 作者称该 sigmoid 代理保持排序型 AUC 不变，但论文同时说明这不验证概率校准或引导梯度的准确性，实际效果由提取实验评估。

   引导的近似计算

   • 用一步点估计 x̂0(xt) 代替从完整后验 p(x0 | xt) 采样，论文明确这是可处理的近似而非精确概率恒等式。
   • 条件噪声预测为 ϵ̂_θ(x_t,t) ≈ ϵ_θ(x_t,t) − s√(1−ᾱ_t)  f_ϕ(x̂₀(x_t))，s 为引导强度；作者称因 sigmoid 导数接近 0，实践中需用较大的 s。

   对抗引导

   • 作者发现直接引导会产生"对抗样本"：骗过成员分类器但细节差、并非训练集图像（Figure 4a）。
   • 对策：对 x̂0 施加 4 种随机数据增强（颜色调整、缩放、平移、cutout），对 4 个视图的引导取平均，使生成样本在多个视图下都满足成员特征。

   加速：子集引导与并行分支解码

   • 只在去噪步子集 G 内注入引导，而非每步；作者称过多引导会拖慢生成并降低图像质量。
   • 在 t0 处把中间状态复制 m 份，用不同随机种子并行去噪；依据是作者引用的观察：去噪最后阶段才出现多样性。

   算法与关键参数

   • Algorithm 1：t > t0, single-chain DDIM (σ0); for t ≤ t0, m branches of parallel DDIM (σ1); guidance steps use conditional noise prediction.
   • Default parameters: 100-step DDIM (25 steps for EDM and Stable Diffusion), s = 70.0 (20.0 for EDM), m = 4, t0 = 50, G = {4t : 5 ≤ t ≤ 16} ({4t : 5 ≤ t ≤ 12} for Stable Diffusion), σ0 = σ1 = 1.0, ϕ = 15.0 (10.0 for Stable Diffusion).

   Determining extraction results

   • For small datasets such as CIFAR10, a normalized ℓ2 distance criterion ℓ(x̂, x; Nx̂) < 0.9 is used to determine whether a candidate comes from the training set (α = 0.5, |Nx̂| = 50), followed by manual verification and deduplication; the threshold is changed to 1.3 for AFHQv2/FFHQ.
   • The training set of Stable Diffusion v1.5, LAION-5B, is unavailable, so extraction is instead performed from the subset LAION-2B, candidates are identified using the detection method of Carlini et al. 2023, and the 500 most repeated prompts in LAION-2B are selected for generation.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Compared with generate-and-filter baselines on ADM, EDM and Stable Diffusion v1.5, MGE has higher Quantity, ASR and Efficiency.

   Experimental Setup

   • Models under test: ADM (CIFAR10/CIFAR100/Tiny-ImageNet 32×32 checkpoints), EDM (CIFAR10/AFHQv2/FFHQ 64×64 checkpoints), Stable Diffusion v1.5 (trained on LAION-5B).
   • Benchmarks: CIFAR10, CIFAR100, Tiny-ImageNet, AFHQv2, FFHQ, LAION-2B (used for Stable Diffusion extraction).
   • Baselines: generate-and-filter from Carlini et al. 2023, sampled with DDPM and DDIM (σ = 0) respectively.
   • Metrics: Quantity (number of distinct extracted samples after deduplication and verification), ASR (number of unique extractions ÷ total number of generated candidates), Efficiency (number of unique extractions per minute, including guidance computation).
   • Generation scale and hardware: 2^17 candidates generated per group (500×500 for Stable Diffusion), batch size 4, a single NVIDIA-A800.
   • Number of repetitions: Appendix A.8 reports extraction counts for 3 random seeds on CIFAR100; for the other settings the paper does not report the number of repetitions.

   Main Results

   According to Table 1 (Quantity / ASR / Efficiency; the Efficiency column header is written as Efficient in the EDM and Stable Diffusion tables):

   Swipe horizontally to read the table

   Model	Dataset	MGE	DDPM baseline	DDIM baseline
   ADM	CIFAR10	141/2^17, 0.107%, 0.78	55/2^17, 0.042%, 0.08	26/2^17, 0.020%, 0.37
   ADM	CIFAR100	358/2^17, 0.273%, 1.94	129/2^17, 0.098%, 0.18	52/2^17, 0.040%, 0.57
   ADM	Tiny-IN	163/2^17, 0.124%, 0.88	41/2^17, 0.031%, 0.06	24/2^17, 0.018%, 0.25
   EDM	CIFAR10	46/2^17, 0.035%, 0.51	22/2^17, 0.017%, 0.04	17/2^17, 0.013%, 0.23
   EDM	AFHQv2	123/2^17, 0.094%, 0.41	17/2^17, 0.013%, 0.04	27/2^17, 0.021%, 0.22
   EDM	FFHQ	23/2^17, 0.018%, 0.10	4/2^17, 0.003%, 0.01	2/2^17, 0.002%, 0.02
   SD v1.5	LAION-2B	27, 0.0108%, 0.075	7, 0.0028%, 0.001	5, 0.0020%, 0.033

   • The authors state that MGE outperforms the baselines on Quantity, ASR and Efficiency, and attribute the gains to turning extraction into conditional generation; note that on EDM/AFHQv2 the DDIM baseline's Quantity (27) is higher than DDPM's (17).
   • The authors state that DDPM extracts more because injected noise gives higher diversity, that DDIM is more efficient, and that MGE balances the two through parallel branch decoding.
   • The authors explain that Stable Diffusion v1.5's low ASR is because this Text2Image model has high generation diversity.

   Comparison with SIDE and the No-Guidance Control

   • SIDE comparison (Appendix A.5, Table 10): reproducing SIDE on CIFAR10 yields 96 unique extractions, ASR 0.073%, Efficiency 0.20, versus MGE's 141, 0.107%, 0.78; the authors note this is only an empirical comparison under this setting and should not be interpreted as a general ranking across all attack settings.
   • No-guidance control (Table 6): with s = 0 (membership guidance off, all other configurations unchanged), Quantity is 6/2^17 and ASR 0.005%; with s = 70.0, 141/2^17 and 0.107%.

   Component Ablations (CIFAR10)

   • MIA classifier (Table 2): with NA, SecMI and PIA, ASR is 0.025%, 0.053% and 0.107% respectively, consistent with the ordering of their AUC (84.7, 88.1, 91.9) and TPR@1%FPR (6.85, 9.11, 24.7); Efficiency does not show the same monotonic trend.
   • Number of data augmentation types (Table 3): with 0, 1, 2 and 4 augmentation types, Quantity is 18, 58, 57 and 141, and ASR is 0.014%, 0.044%, 0.043% and 0.107%; the authors state that augmentation improves guidance accuracy but increases computational cost.
   • Guidance approximation precision (Table 5): one-step estimation yields 141 unique extractions and 1,094 duplicates; 1/5, 1/2 and full multi-step estimation yield only 15–18 unique extractions and more than 13,800 duplicates. The authors state that multi-step estimation exhibits "over-memorization" and mode collapse, and note that these experiments cannot isolate the causal role of approximation error itself; the authors state that one-step estimation improves efficiency by more than 40× over standard DDIM denoising.

   Other Ablations and Analyses

   • Number of branches (Table 4): with m = 1, 2, 4 and 8, Quantity is 73, 60, 141 and 65; the authors state that diversity decreases when m ≥ 8.
   • Guidance strength s (Table 6): as s goes from 0 to 90, Quantity first rises then falls, peaking at s = 70 (141).
   • Temperature ϕ (Table 7): as 1/ϕ goes from 1.0 to 15.0, Quantity rises from 11 to 141, while AUC remains essentially unchanged (91.7–91.9).
   • Guidance stage (Table 8): mid-stage guidance G = {4t : 5 ≤ t ≤ 16} is best (141); early only 7, late only 42, full stage 47.
   • Zeroth-order gradient estimation (Table 11): the zeroth-order variant retains 118 of the 141 unique extractions (about 84%), and Efficiency drops from 0.78 to 0.44; the authors note that this does not constitute an attack using only a standard image generation API.
   • Stable Diffusion component ablation (Table 12): full MGE gives 27 extractions; replacing with 1/5 multi-step prediction drops it to 5, and removing branches drops it to 14.
   • Negative results (Appendix A.4, Figures 5–6): as generation scale increases, ASR falls for both MGE and the baselines, which the authors attribute to redundancy and mode collapse caused by highly similar samples; deduplicated guidance (Table 9) raises ASR from 0.159% to 0.171%, but Efficiency drops from 1.18 to 0.20.
   • Seed stability (Table 13): extraction counts for three seeds on CIFAR100 are 358, 346 and 351, with mean 351.7 and sample standard deviation about 6.0.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note that over-memorization and mode collapse limit efficiency, and that deduplication guidance is costly; both are left for future research.

   Limitations and future directions noted by the authors

   • At large-scale generation, output redundancy and mode collapse lower ASR; the authors believe that reducing over-memorization may further improve extraction efficiency, and leave this as future work (Appendix A.4).
   • Although deduplication guidance alleviates collapse, it reduces generation efficiency, and the authors state that further study is needed (Appendix A.4).
   • The one-step approximation experiments cannot isolate the causal effect of approximation error on diversity (Section 5.3).
   • Seed stability is only preliminary evidence, and more runs and settings are needed to draw broader conclusions (Appendix A.8).
   • The comparison with SIDE should not be interpreted as a general ranking under all attack settings (Appendix A.5).
   • The zeroth-order experiments do not constitute an attack using only standard image generation APIs (Appendix A.6).

   Scope of experiments

   • The models tested are 3 in total: ADM, EDM, and Stable Diffusion v1.5; the benchmarks are 6 in total: CIFAR10, CIFAR100, Tiny-ImageNet, AFHQv2, FFHQ, and LAION-2B (Table 1).
   • The baseline is only the generate-and-filter of Carlini et al. 2023 (two samplers, DDPM and DDIM); SIDE is additionally reproduced in the appendix for a single-setting comparison.
   • In the main experiments, each group generates 2^17 candidates (500×500 for Stable Diffusion), with batch size 4, on a single A800; random seed repetition is only 3 times on CIFAR100.
   • Component ablations are mainly conducted on CIFAR10, and Stable Diffusion v1.5 has an additional component-level ablation (Table 12).
   • The paper does not report an evaluation against any defense mechanism, nor an analysis of whether the extracted images contain personally sensitive information.

   Collapse this answer

6. 06Summarize the main content of the paper

   MGE uses membership inference signals to guide conditional generation for extracting diffusion model training data, outperforming generate-and-filter baselines on three models.

   A data extraction attack paper targeting the privacy risk of diffusion models. The authors believe that the memorization properties of diffusion models lead to training data leakage, and that existing generate-and-filter extraction is limited in success rate and efficiency.

   • Method: MGE formalizes data extraction as conditional generation, using a differentiable sigmoid approximation of a PIA membership inference classifier to construct the guidance signal; it pairs adversarial guidance with 4 kinds of random data augmentation to suppress "adversarial examples", and uses subset guidance plus parallel branch decoding for acceleration.
   • Main results: On CIFAR10/ADM, 2^17 generations extract 141 training images (ASR 0.107%), versus 55 for the DDPM baseline (Table 1); on CIFAR100/ADM, 358 vs. 129; on Stable Diffusion v1.5, 27 vs. 7 (DDPM).
   • Comparison: Reproducing SIDE on CIFAR10 yields 96 extractions, versus 141 for MGE (Table 10); the s = 0 no-guidance control yields only 6 (Table 6).
   • Ablation: Guidance signal strength, number of augmentation seeds, number of branches, and guidance stage all affect results; multi-step exact estimation instead extracts only 15–18 unique samples due to over-memorization and mode collapse (Table 5).
   • Authors' conclusion: Before generative models are safely deployed, privacy protection mechanisms with a theoretical basis need to be developed to defend against such active attacks; the authors also note that redundancy caused by over-memorization and the efficiency cost of deduplication guidance are left as future work.

   Collapse this answer

Related papers