Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective

Bingkun Bao; Puwei Lian; Songze Li; Yujun Cai

REVIEW 4 major objections 6 minor 3 references

Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A Fourier filter that suppresses high-frequency image detail makes membership inference attacks on diffusion models substantially stronger, by removing score variance the model itself injects when reconstructing edges and textures.

desk verdict Short version: the Fourier-filter trick is a solid empirical contribution, but Proposition 4.2's proof is algebraically wrong, so the 'theoretical demonstration' claim should not be relied upon. read the letter →

arxiv 2505.20955 v5 pith:GXGD34OI submitted 2025-05-27 cs.CR cs.LG

Puwei Lian , Yujun Cai , Songze Li , Bingkun Bao This is my paper

classification cs.CRcs.LG

keywords MembershipInferenceAttacksDiffusionModelsFrequencyDomainFourierTransformHigh-FrequencyDeficiencyPrivacyReconstructionErrorText-to-Image

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that existing membership inference attacks on diffusion models underperform because of a "high-frequency deficiency": diffusion models faithfully reconstruct low-frequency structure but handle high-frequency details with high variance. That variance contaminates the reconstruction-error scores that attacks rely on, so images rich in high-frequency content tend to be misclassified as hold-out data and flat images as members. The paper unifies the Naive, SecMI, and PIA attacks into a single reconstruction-distance paradigm, shows theoretically that high-frequency variance weakens the membership advantage, and proposes a plug-and-play Fourier-domain filter that attenuates high-frequency components before the score is computed. Across DDIM and fine-tuned Stable Diffusion models, the filter raises attack success, AUC, and true-positive rate at low false-positive rate, with negligible extra time cost. The practical message is that any error-based membership inference attack on a diffusion model is leaving accuracy on the table by scoring images in the spatial domain.

What carries the argument

The load-bearing mechanism is the high-frequency Fourier filter combined with a variance-ratio theory of membership advantage. The paper transforms predicted and target images with the discrete Fourier transform, multiplies the spectrum by a mask that suppresses components above a radius $r_t$ (keeping a fraction $s$ of their amplitude), transforms back, and then computes the reconstruction distance. The theoretical engine is Proposition 4.2, which assumes that member and hold-out score variances decompose into independent low- and high-frequency parts. Removing high-frequency variance then changes the ratio $\sigma_H/\sigma_M$; when the high-frequency variance on members is larger than on hold-out data ($k>1$), the ratio rises, and via the Yeom et al. (2018) relation $\sigma_H/\sigma_M \propto \mathrm{Adv}_M(A)$, the attack's membership advantage grows. The mask is what does the work: it strips away the noisy high-frequency component so that the residual score tracks how the model fits the global structure of the image, which is where membership is expressed.

What would settle it

Measure $\sigma_H/\sigma_M$ and attack accuracy before and after applying the filter on a dataset where high-frequency content is deliberately uncorrelated with membership—for example, by equalizing high-frequency energy across member and hold-out sets; if the ratio does not improve or accuracy does not rise, the proposed mechanism is not responsible for the gains. A second check is to compare hard removal ($s=0$) with the paper's attenuation ($s=0.2$): the variance-removal argument predicts hard removal should be at least as strong, so a clear advantage for $s=0.2$ would indicate the theory's premise is incomplete.

Watch

Extended reading notes

Core claim

The paper's central claim is that the membership signal in diffusion models concentrates in the low-frequency part of the reconstruction error, while the high-frequency part is dominated by model variance rather than by membership. It formalizes a general paradigm, $A(x_i,\theta)=\mathbf{1}[\|x_{i,t}-x_{i,t}^{\mathrm{target}}\|_q \le \tau]$, and shows that the main existing attacks are instances of it. Within that paradigm it observes empirically that membership scores rise with the high-frequency content of the image, that failed member predictions have higher high-frequency content than failed hold-out predictions, and that pixel-level reconstruction error concentrates at high-frequency locations. The theoretical engine is Proposition 4.2: under normality and independence of low- and high-frequency score components, removing the high-frequency component raises $\sigma'_H/\sigma'_M$ above $\sigma_H/\sigma_M$, increasing membership advantage in the sense of Yeom et al. (2018). The remedy is a Fourier mask, $\beta_{i,t}(r)=s$ for $r>r_t$ and $1$ otherwise (implemented with $s=0.2$, $r_t=5$), applied to both the predicted and target images before taking the distance. Experiments show consistent gains for Naive, SecMI, and PIA on DDIM (STL10-U, CIFAR-100, Tiny-IN) and fine-tuned Stable Diffusion (Pokémon, MS-COCO, Flickr), including under weaker overfitting, missing captions, and two defenses.

Load-bearing premise

The theory assumes that membership advantage is proportional to the ratio of the standard deviations of member and hold-out scores under normal distributions, that high- and low-frequency score components contribute independent variances, and that the filter removes all high-frequency variance, while the experiments use partial attenuation ($s=0.2$) rather than full removal.

Editorial extensions

If this is right

Any error-based membership inference attack that fits the reconstruction-distance paradigm can be strengthened by inserting the high-frequency filter before computing the score, with no additional training or model access.
The magnitude of the gain scales with dataset complexity: on Tiny-IN the filter added over seven points to average attack success rate and over eleven points to TPR@1% FPR across the three baselines.
The filter remains effective under weaker overfitting, when captions are absent or machine-generated, and when defenses such as data augmentation or the SSei memory-mitigation method are applied, though gains shrink with the baseline's overall strength.
The gain in the $\sigma_H/\sigma_M$ ratio after filtering directly corroborates the theoretical account: observed ratios increase from values near 1 to substantially larger values, matching the predicted improvement in membership advantage.
On pre-trained Stable Diffusion models the filter provides little benefit because the baselines themselves operate near random-guessing in that setting, so the deficiency is not the binding constraint there.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the attacks tested here, any reconstruction-based score on diffusion models—such as pixel-wise error maps used in memorization detection or data auditing—could carry the same high-frequency noise, so the filter may transfer to those tasks.
The implementation attenuates high-frequency components with $s=0.2$ rather than removing them as the theory assumes; an image- or timestep-adaptive mask that more closely matches the theory's hard removal could yield further gains.
The low-to-high frequency generation pattern also appears in text-to-image and video diffusion models, suggesting the deficiency, and the filter, apply beyond the grey-box reconstruction attacks demonstrated in this paper.
If the variance-ratio mechanism is correct, a stronger defense should explicitly reduce high-frequency variance on member images rather than only augmenting data; the adaptive defense proposed here mitigates but does not eliminate the attack, leaving room for further defensive work.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Honest take: the empirical result is real, the theory isn't. The paper shows that a Fourier mask that attenuates high-frequency components improves three established grey-box MIAs on DDIM and fine-tuned Stable Diffusion, with gains that are consistent and sometimes large, especially at TPR@1%FPR. That is a useful, near-zero-cost plug-in for privacy auditing, and the frequency-domain diagnosis of why these attacks struggle is a genuinely new angle. Credit where due: they unify Naive/SecMI/PIA into a single reconstruction-error paradigm, visualize the high-frequency-variance effect, and back it with ablations, defenses, no-text settings, and a public code repo. The empirical package is extensive and internally consistent.

The soft spot is the theoretical demonstration, and it's not minor. Proposition 4.2's proof in Appendix C has an algebraic error: substituting k = h_M/h_H into Eq. C.10 gives a left-hand side involving h_M^2, but Eq. C.11 writes l_M^2 + h_H^2, effectively swapping h_M for h_H. That doesn't follow when h_M ≠ h_H. Even if that step were fixed, Eq. 8 asserts a monotone link between σ_H/σ_M and membership advantage without deriving it; under normality, Yeom's advantage also depends on means, and the claimed proportionality is not established. So the abstract's claim that high-frequency deficiency 'theoretically demonstrates' the effect is unsupported. The experiments use an attenuating filter (s=0.2), not the hard removal the proposition analyzes, so the theory wouldn't cover them even if it were correct.

Two more moderate concerns. The hyperparameters (s, rt) are selected on the evaluation data, and the k^2>f constraint is validated on the same datasets used to show improvement — that's checking a precondition, not independent confirmation. The lack of error bars and multiple seeds in the main tables also makes the improvements harder to judge, though the consistency across many settings helps. The normality tests are okay but a bit thin.

In the end, the paper is worth reading and worth refereeing, but the theory should be separated from the empirical claim. Either fix the proof or reframe it as a motivating heuristic; the empirical finding stands on its own. I'd send it to peer review with a clear request for revision: correct or remove Proposition 4.2, add error bars, and temper the abstract.

Referee Report

4 major / 6 minor

Summary. This paper studies membership inference attacks (MIAs) against diffusion models. The authors unify error-based attacks (Naive, SecMI, PIA) into a single reconstruction-distance paradigm, observe that diffusion models reconstruct low-frequency content more reliably than high-frequency content, and argue that the high-frequency component of the reconstruction score injects variance that drowns the membership signal. They propose FreMIA, a plug-and-play module that applies a Fourier-domain mask to attenuate high-frequency components before computing the membership score. They report consistent improvements in ASR, AUC, and TPR@1%FPR over three baselines on DDIM (STL10-U, CIFAR-100, Tiny-IN) and fine-tuned Stable Diffusion (Pokémon, MS-COCO, Flickr), with ablations, defense evaluations, and additional experiments in the appendix. They also state Proposition 4.2, intended to prove that high-frequency filtering increases the membership advantage.

Significance. The empirical finding is potentially valuable: a simple, low-overhead preprocessing step improves attack performance across multiple datasets and model types, with especially large gains in TPR@1%FPR. The paper is careful in its experimental design: same-distribution member/hold-out splits, standard metrics, baseline default parameters, ablation over s and r_t, weaker-overfitting and defense settings, and a public code link. If the frequency-deficiency mechanism is correct, this is a practical contribution to privacy auditing of diffusion models. However, the theoretical demonstration is not currently sound: the proof of Proposition 4.2 contains an algebraic error, and the asserted link between the standard-deviation ratio and membership advantage is not established. The paper's significance at this stage rests on the empirical results rather than on the theory.

major comments (4)

[Appendix C, Eqs. (C.10)-(C.12)] The transition from Eq. (C.10) to Eq. (C.11) is algebraically incorrect. Substituting k = h_M/h_H into Eq. (C.10) gives h_M^2 - h_H^2 > 2 l_M Δ + 2Δ^2 - 2Δ√((l_M+Δ)^2 + h_M^2). Eq. (C.11) instead asserts l_M^2 + h_H^2 > (l_M+Δ)^2 + h_H^2 - 2Δ√((l_M+Δ)^2 + h_M^2) + Δ^2, which after canceling l_M^2 + h_H^2 reduces to √((l_M+Δ)^2 + h_M^2) > l_M + Δ, a trivially true statement for h_M > 0. This is not equivalent to Eq. (C.10). Since the subsequent steps (C.12)-(C.17) all rely on Eq. (C.11), the proof of Proposition 4.2 does not go through. The authors should provide a correct derivation or remove the theoretical claim.
[Section 4.3, Eq. (8)] The statement that σ_H/σ_M ∝ Adv_M(A) is presented as a consequence of Yeom et al. (2018), but it is not derived there and is false in general under the paper's own normality assumption. For Gaussian score distributions with means μ_H, μ_M and variances σ_H^2, σ_M^2, the optimal-threshold advantage is a function of both the mean shift and the variances; the variance ratio alone does not determine it. Consequently, the argument that a reduction in σ_H/σ_M implies a reduction in membership advantage is not justified, and Proposition 4.2, even if its algebra were corrected, would not establish an attack improvement. Please replace Eq. (8) with a direct computation of the advantage (or AUC) for the relevant score distribution, or explicitly restrict the claim to the empirical observation.
[Section 4.3 / Section 5.1, Eqs. (9)-(10) and s=0.2] Proposition 4.2 concerns hard removal of the high-frequency components (the filter with s=0), but the proposed module and all experiments use multiplicative attenuation with s=0.2, and the recommended range is s ∈ [0.0, 0.3]. The proposition therefore does not apply to the actual method. If the proof is repaired, it should be extended to the attenuating mask, or the theoretical claim should be explicitly limited to the s=0 case and the experimental improvement argued separately.
[Appendix D.2 / Table 7] The validation of the constraint k^2 > f is performed on the same datasets and methods used to measure the attack improvement (Table 7 vs. Tables 2-3). Since all reported values of f are below 1, the condition is automatically satisfied whenever k ≥ 1, and the few k < 1 cases still pass. This is a post-hoc precondition check, not a predictive test of the theory; the text in Section 4.3 should not present it as independent support for Proposition 4.2.

minor comments (6)

[Section 5.4 / Appendix D.8] The text says the best performance is achieved at 's=5 and rt=0.2', but Table 4 is indexed by s as columns and rt as rows; the intended setting is s=0.2 and rt=5. The same typo appears in Appendix D.8.
[Section 5.4] The sentence 'When rt = 1, the high-frequency threshold is set too low, leading to most high- and low-frequency components of the image being filtered' is inaccurate for the mask in Eq. (10): with rt=1 and s=0.2, only components with radius > 1 are attenuated, and low-frequency components are not filtered. Please rephrase.
[Appendix D.2, Table 8] Normality tests are reported only for MS-COCO and Flickr; the text nonetheless claims that 'the scores of baselines conform to a normal distribution'. Please qualify the claim to the tested datasets, or report normality tests for the remaining datasets.
[Section 4.2 / Figure 1] The choice of the high/low frequency boundary radius (5 for MS-COCO and Flickr, 2 for CIFAR-100 and Tiny-IN) is not justified. A sentence explaining how this radius was selected would improve reproducibility.
[Eq. (1)] The DDIM posterior distribution in Eq. (1) is typeset incorrectly, with missing parentheses and ambiguous square-root scope. Please fix the equation.
[Tables 2 and 3] The 'Avg+' rows are not defined in the captions; please state explicitly that the average is taken over the three baseline attacks.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's empirical gains are externally benchmarked, and its theoretical claim is a conditional proposition rather than a restatement of its inputs.

full rationale

The paper's central empirical claim, that a Fourier-domain high-frequency filter improves error-based membership inference attacks on diffusion models, is supported by direct experiments against the SecMI, PIA, and Naive baselines on standard datasets. These results do not reduce to the paper's theoretical assumptions or to any fitted parameter that was then renamed as a prediction. The theoretical Proposition 4.2 is conditional: it assumes variance-decomposition identities and a threshold condition on k^2, then derives an inequality about post-filter standard-deviation ratios. Checking that the condition k^2 > f holds on the same datasets used for experiments is a validation of a precondition, not a circular prediction from the theorem. The paper contains no load-bearing self-citations: the spectral-bias observations are attributed to prior external work (Yang et al., 2023; Falck et al., 2025), and the membership-advantage definition is attributed to Yeom et al. (2018). While the proof in Appendix C appears to contain an invalid algebraic step (Eq. C.11 does not follow from Eq. C.10), and the asserted link via Eq. 8 between the standard-deviation ratio and membership advantage may be under-supported, these are correctness concerns rather than circularity. The empirical contribution can stand independently of the flawed or incomplete theoretical derivation. Therefore no circular step meeting the required evidentiary standard can be identified.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim rests on a small set of fitted hyperparameters (s, r_t), the normality and independence assumptions behind the theoretical advantage analysis, and the standard grey-box threat model used by all three baseline attacks. No new physical or algorithmic entities are introduced.

free parameters (2)

s (filtering factor) = 0.2
Chosen from ablation study (Table 4) as the best setting; the paper recommends a range of 0.0-0.3 and shows low sensitivity within it.
r_t (high-frequency threshold radius) = 5
Chosen from ablation study (Table 4); recommended range 3-10. The analysis in Section 4.2 used radius 5 for MS-COCO/Flickr and 2 for CIFAR-100/Tiny-IN, but the method uses r_t=5 everywhere.

assumptions (4)

domain assumption Membership scores follow a normal distribution for members and hold-outs
Invoked in Section 4.3 to use the sigma_H/sigma_M characterization of advantage and validated with a KS test in Appendix D.2.
domain assumption Membership advantage is proportional to sigma_H/sigma_M (Yeom et al. 2018)
Eq. 8 asserts this proportionality without derivation; it is the basis for interpreting Proposition 4.2 as an improvement in attack advantage.
domain assumption High- and low-frequency components of membership scores are independent and variances add; the filter removes high-frequency variance entirely
Used in Appendix C (Eq. C.14) to decompose Delta_M and Delta_H; the implemented filter attenuates (s=0.2) rather than removes, so the theory's clean decomposition does not exactly match the experiments.
domain assumption The reconstruction error at step t is a sufficient statistic for membership in the grey-box setting
Underlies the general paradigm in Eq. 6, inherited from the design of Naive, SecMI, and PIA.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective." pith.science (2026). https://pith.science/paper/GXGD34OI

@misc{pith2026250520955,
  author       = {Pith},
  title        = {Pith review of: Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GXGD34OI}},
  note         = {Machine review of arXiv:2505.20955}
}

read the original abstract

Diffusion models have achieved tremendous success in image generation, but they also raise significant concerns regarding privacy and copyright issues. Membership Inference Attacks (MIAs) are designed to ascertain whether specific data was utilized during a model's training phase. As current MIAs for diffusion models typically exploit the model's image prediction ability, we formalize them into a unified general paradigm that computes the membership score for membership identification. Under this paradigm, we empirically find that existing attacks overlook the inherent deficiency in how diffusion models process high-frequency information. Consequently, this deficiency leads to member data with more high-frequency content being misclassified as hold-out data, and hold-out data with less high-frequency content tends to be misclassified as member data. Moreover, we theoretically demonstrate that this deficiency reduces the membership advantage of attacks, thereby interfering with the effective discrimination of member data and hold-out data. Based on this insight, we propose a plug-and-play high-frequency filter module to mitigate the adverse effects of the deficiency, which can be seamlessly integrated into any attacks within the general paradigm without additional time costs. Extensive experiments corroborate that this module significantly improves the performance of baseline attacks across different datasets and models. Code is available at https://github.com/poetic2/FreMIA.

Figures

Figures reproduced from arXiv: 2505.20955 by the authors.

**Figure 1.** Statistical plots of membership scores versus highfrequency content for the MS-COCO dataset. Horizontal coordinates indicate high-frequency content and vertical coordinates indicate membership scores. We used red to indicate areas with the highest data density. To dig deeper into the influence of high-frequency deficiency on attacks, we analyzed the high-frequency content of common attack failure cases. As shown … view at source ↗

**Figure 2.** Membership score distribution of member and hold-out data in the MS-COCO dataset. The score distribution gap between member data and hold-out data has noticeably increased. frequency deficiency, resulting in a significant decline in attack performance. When s = 0.4 and s = 0.5, the filtering effect on the high-frequency components is weakened. Although the baseline performance improves significantly, it does not re… view at source ↗

**Figure 3.** Statistical plots of membership scores versus high-frequency content on the Flickr dataset. In addition, we visualize the distribution of membership scores contributions in [PITH_FULL_IMAGE:figures/full_fig_p016_3.png] view at source ↗

Figures from the paper (6 more)

**Figure 4.** Figure 4: Naive pixel-wise errors distribution visualization, with the top half being the original image and the bottom half being the error visualization. The areas of high error often coincide with areas of high-frequency information. 16 [PITH_FULL_IMAGE:figures/full_fig_p016…

**Figure 5.** Figure 5: PIA pixel-wise errors distribution visualization. The areas of high error often coincide with areas of high-frequency information. D.2. Discussion of the theoretical analysis Constraint Conditions. We conducted experimental validation of the constraint in Proposition 4…

**Figure 6.** Figure 6: Membership scores distribution for samples from member set and hold-out set [PITH_FULL_IMAGE:figures/full_fig_p020_6.png]

**Figure 7.** Figure 7: The three-dimensional histogram shows the ASR/AUC under different parameter settings. The x-axis represents the parameter rt, the y-axis represents the parameter s, and the z-axis represents the ASR/AUC [PITH_FULL_IMAGE:figures/full_fig_p022_7.png]

**Figure 8.** Figure 8: ROC and Log-ROC curves before and after applying the high-frequency filter for the baselines. 24 [PITH_FULL_IMAGE:figures/full_fig_p024_8.png]

**Figure 9.** Figure 9: ROC curves of Naive with different parameter settings. 25 [PITH_FULL_IMAGE:figures/full_fig_p025_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

3 extracted references · 1 canonical work pages

[755]

Matsumoto, T., Miura, T., and Yanai, N

Springer, 2014. Matsumoto, T., Miura, T., and Yanai, N. Membership in- ference attacks against diffusion models. In2023 IEEE Security and Privacy Workshops (SPW), pp. 77–83. IEEE, 2023. Nasr, M., Shokri, R., and Houmansadr, A. Comprehen- sive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and feder- a...

arXiv 2014
[1974]

Coates, A., Ng, A., and Lee, H

PMLR, 2021. Coates, A., Ng, A., and Lee, H. An analysis of single- layer networks in unsupervised feature learning. InPro- ceedings of the fourteenth international conference on artificial intelligence and statistics, pp. 215–223. JMLR Workshop and Conference Proceedings, 2011. CompVis. Stable diffusion v1-4, 2024. URL https://huggingface.co/CompVis/ stab...

arXiv 2021
[2023]

Finally, it evaluates the membership status based on the distance between the predicted noise and the initial noise

retrieves an initial noise through a proximal initialization process, then uses the model to predict noise for samples 12 Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective containing that initial noise. Finally, it evaluates the membership status based on the distance between the predicted noise and the initial...

work page 2022

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [755]

Matsumoto, T., Miura, T., and Yanai, N

Springer, 2014. Matsumoto, T., Miura, T., and Yanai, N. Membership in- ference attacks against diffusion models. In2023 IEEE Security and Privacy Workshops (SPW), pp. 77–83. IEEE, 2023. Nasr, M., Shokri, R., and Houmansadr, A. Comprehen- sive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and feder- a...

arXiv 2014

[2] [1974]

Coates, A., Ng, A., and Lee, H

PMLR, 2021. Coates, A., Ng, A., and Lee, H. An analysis of single- layer networks in unsupervised feature learning. InPro- ceedings of the fourteenth international conference on artificial intelligence and statistics, pp. 215–223. JMLR Workshop and Conference Proceedings, 2011. CompVis. Stable diffusion v1-4, 2024. URL https://huggingface.co/CompVis/ stab...

arXiv 2021

[3] [2023]

Finally, it evaluates the membership status based on the distance between the predicted noise and the initial noise

retrieves an initial noise through a proximal initialization process, then uses the model to predict noise for samples 12 Enhancing Membership Inference Attacks on Diffusion Models from a Frequency-Domain Perspective containing that initial noise. Finally, it evaluates the membership status based on the distance between the predicted noise and the initial...

work page 2022