Abstract:Diffusion models have revolutionized image synthesis, garnering significant research interest in recent years. Diffusion is an iterative algorithm in which samples are generated step-by-step, starting from pure noise. This process introduces the notion of diffusion trajectories, i.e., paths from the standard Gaussian distribution to the target image distribution. In this context, we study discriminative algorithms operating on these trajectories. Specifically, given a pre-trained diffusion model, we consider the problem of classifying images as part of the training dataset, generated by the model or originating from an external source. Our approach demonstrates the presence of patterns across steps that can be leveraged for classification. We also conduct ablation studies, which reveal that using higher-order gradient features to characterize the trajectories leads to significant performance gains and more robust algorithms.
What problem does this paper attempt to address?
### What problems does this paper attempt to solve?
This paper aims to solve three main problems related to Diffusion Models:
1. **Membership Inference Attacks (MIA)**:
- **Problem description**: Given an image, determine whether it is part of the training data set. Traditional methods usually use the loss value of a single time step to distinguish between member and non - member data, but these methods perform poorly when faced with generated data.
- **Challenge**: Existing MIA methods cannot handle generated data and are sensitive to distribution shift.
2. **Model Attribution (MA)**:
- **Problem description**: Determine whether an image is generated by a specific diffusion model. This task is more difficult than blind synthetic data detection because it is necessary to attribute the generated data to a specific model.
- **Challenge**: Existing MA methods rely on model or layer inversion techniques, which are difficult to apply in diffusion models.
3. **Origin Attribution (OA)**:
- **Problem description**: Simultaneously distinguish whether an image is member data, generated data, or external data. This is an extension of MIA and MA, aiming to provide a more comprehensive classification framework.
- **Challenge**: The OA task needs to develop robust algorithms that can handle multiple categories without relying on additional proxy models.
### Main contributions of the paper
- **Propose new attack methods**: By exploiting patterns in the diffusion trajectory, a multi - time - step attack method is proposed to improve the performance of MIA and MA.
- **Introduce global time context**: Demonstrate the importance of considering larger time intervals in the diffusion trajectory, which helps to reveal global patterns.
- **Combine high - order gradient features**: In addition to traditional loss features, high - order gradient features are introduced, significantly improving the classification performance.
- **Experimental verification**: Through experiments, the effectiveness of the new method on the CIFAR - 10 and CelebA - HQ 256 data sets is verified, especially in dealing with distribution shift and generated data.
### Formula summary
- **SDE of the diffusion process**:
\[
dx = f(x, t)dt+g(t)dw
\]
where \( f(·, t):X \to X\), \( g(·):\mathbb{R} \to \mathbb{R}\), and \( w\) is a standard Wiener process.
- **SDE of the reverse diffusion process**:
\[
dx = [f(x, t)-g(t)^2\nabla_x\log p_t(x)]dt + g(t)d\bar{w}
\]
where \( d\bar{t}<0\), and \(\bar{w}\) is a time - reversed standard Wiener process.
- **Forward probability of DDPM**:
\[
p_t(x_t|x)=\mathcal{N}(x_t;\sqrt{\bar{\alpha}_t}x,(1 - \bar{\alpha}_t)I)
\]
where \(\alpha_t = 1-\beta_t\), \(\bar{\alpha}_t=\prod_{s = 0}^t\alpha_s\).
- **Minimization objective**:
\[
\min_{\theta}\mathbb{E}_{t\sim U\{0,T - 1\},x\sim p(x),\epsilon\sim\mathcal{N}(0,I)}[\lambda_tL_t]
\]
where \( L_t=\|\epsilon_\theta(\sqrt{\bar{\alpha}_t}x+\sqrt{1 - \bar{\alpha}_t}\)