Adaptive Diffusion Freezing (ADF) is a new privacy‑preserving framework for diffusion models that protects against membership inference attacks (MIAs). It uses cross‑timestep adaptive freezing training, where a mask matrix controls which data subsets participate at each diffusion timestep, reducing over‑memorization and aligning model behavior for member and non‑member samples. A pretraining‑based risk‑aware freezing policy estimates MIA risk and suppresses high‑risk subset‑timestep pairs, achieving a superior privacy‑utility‑efficiency trade‑off across multiple datasets.
arXiv:2410. 06814v2 Announce Type: replace Abstract: Over-parameterized models are typically vulnerable to membership inference attacks, which aim to determine whether a specific sample is included in the training of a given model.
arXiv:2602. 02819v4 Announce Type: replace Abstract: Membership Inference Attacks (MIAs) aim to distinguish training points (members) from unseen data (non-members), and are widely used to quantify memorization and assess privacy risks.
arXiv:2509. 25003v3 Announce Type: replace Abstract: Membership inference attacks (MIAs) against Diffusion Models (DMs) raise pressing privacy concerns by revealing whether a sample was part of the training set.
Batch Normalization (BN) is widely used to speed up and stabilize deep neural network training, yet its effect on privacy and memorization has been largely unexplored. This study shows that BN significantly increases the memorization of atypical or outlier samples, as evidenced by unintended memorization, per-sample influence, and heightened susceptibility to membership inference attacks across multiple datasets and architectures. A mechanistic analysis of the BN backward pass reveals that BN amplifies the per‑step margin growth of outlier samples during training, thereby intensifying their influence.
The paper introduces a new privacy vulnerability in diffusion language models (DLMs) called token‑level memorization asymmetry, derived from theoretical analysis of diffusion training dynamics. It proposes Q‑Skew, a quantile‑weighted skewness indicator, to perform membership inference on fine‑tuned DLMs, outperforming existing baselines across multiple datasets and models. Additionally, Q‑Skew can be used to extract personally identifiable information (PII), demonstrating a broader privacy attack surface.
arXiv:2606. 04384v1 Announce Type: new Abstract: Machine learning's reliance on sensitive data necessitates privacy-preserving techniques like Differentially Private Stochastic Gradient Descent (DPSGD).
arXiv:2601. 21628v2 Announce Type: replace-cross Abstract: Diffusion models have achieved remarkable progress in image generation, but their increasing deployment raises serious concerns about privacy and copyright.
arXiv:2608.28934v1 Announce Type: new Abstract: Differential privacy (DP) has traditionally been used to provide theoretical upper bounds on an algorithm's stability to changing its training data. In...
arXiv:2607. 02903v1 Announce Type: cross Abstract: Explainability is central to building trustworthy AI, yet explanation interfaces can inadvertently provide adversaries with an expanded privacy-related attack surfaces.
Machine learning's reliance on sensitive data necessitates privacy-preserving techniques like Differentially Private Stochastic Gradient Descent (DPSGD). However, DPSGD suffers from substantial utility degradation and slow convergence due to gradient clipping and noise injection.
arXiv:2606. 09401v1 Announce Type: new Abstract: Recent work has applied differential privacy (DP) to adapt large language models (LLMs) for sensitive applications, offering theoretical guarantees.
arXiv:2606. 10481v1 Announce Type: cross Abstract: Parameter-efficient fine-tuning of large language models (LLMs) can exhibit problematic memorization of individual training examples.