Pith. sign in

REVIEW 5 major objections 4 minor 28 references

On the MIA Vulnerability Gap Between Private GANs and Diffusion Models

T0 review · 5 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DP-diffusion models leak more membership information than DP-GANs under identical privacy budgets, because their denoising objective is less uniformly stable.

desk verdict A plausible empirical observation wrapped in an overreaching theoretical claim; the stability-gap comparison is not established as written. read the letter →

arxiv 2509.03341 v1 pith:N7GUVH24 submitted 2025-09-03 cs.LG cs.AI

Ilana Sebag , Jean-Yves Franceschi , Alain Rakotomamonjy , Alexandre Allauzen , Jamal Atif This is my paper · ORCID
classification cs.LGcs.AI MSC 68P2768T07
keywords membershipinferenceattacksdifferentialprivacygenerativeadversarialnetworksdiffusionmodelsuniformstabilityDP-SGDleakageattackeradvantage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to explain a privacy puzzle: when GANs and diffusion models are both trained with differential privacy, why does one leak more about its training data than the other? It claims that the answer is structural, not a matter of tuning. Diffusion models are trained on a noise-weighted denoising objective in which low-noise terms carry very large weights, and this makes their outputs far less stable when a single training example changes; GANs, whose discriminator is the only private component and trains on a logistic loss, stay much more stable. The authors translate stability into an upper bound on membership-inference advantage, and show experimentally on MNIST that the gap persists across privacy budgets, with diffusion models retaining non-trivial leakage even at $\varepsilon=1$ while GAN attacks fall to near-random. If the claim is right, the privacy budget $\varepsilon$ alone is insufficient to compare private generative models; architecture choice is a first-order privacy lever.

What carries the argument

The load-bearing object is the uniform-stability coefficient $\beta$ of the DP-SGD-trained model, bounding how much a per-sample loss can change when one training point is removed. Lemma 2 gives $\beta \le \frac{2LC}{m}\sum_t \alpha_t$ under coupled randomness; Lemmas 3 and 4 instantiate it for GANs and diffusion models, with the diffusion bound carrying an extra factor $\bar{\lambda}$, the average of the EDM noise-weighting function. Theorem 1 then converts score stability into a membership-advantage bound $\mathrm{ADV}_{\mathrm{MIA}} \le 2QL_s\beta$, where $Q$ is the maximum score density and $L_s$ the Lipschitz constant between attack score and training loss.

What would settle it

Train both architectures with DP-SGD under the same $\varepsilon$ but with independent Gaussian noise (the standard setting), measure the actual MIA advantage on a fixed dataset, and compute the uncoupled bound of Eq. (85) with the actual $T$, $\alpha$, and $\sigma$. If the diffusion advantage does not exceed the GAN advantage once the noise term $\alpha\sigma\sqrt{T}$ is accounted for, the paper's central claim is refuted.

Watch

Extended reading notes

Core claim

The central claim is that, at the same DP-SGD budget, the expected uniform stability of a diffusion denoiser is far weaker than that of a GAN discriminator, written $\beta_{\mathrm{Diff}} \gg \beta_{\mathrm{GAN}}$, and that attacker advantage on any threshold membership-inference attack is bounded by $2QL_s\beta$. The paper derives this ordering from a general stability bound $\beta \le \frac{2LC}{m}\sum_{t=1}^{T}\alpha_t$: the diffusion loss has a large Lipschitz constant $L_D \approx 2\bar{\lambda}LB$ because the EDM weighting $\lambda(\sigma)=\frac{\sigma^2+\sigma_{\mathrm{data}}^2}{(\sigma\sigma_{\mathrm{data}})^2}$ blows up at small noise levels, and diffusion models run far more DP-SGD steps than GAN discriminators ($T_D \gg T_G$). The same privacy parameter therefore corresponds to different real privacy risks across architectures.

Load-bearing premise

The paper's main ordering $\beta_{\mathrm{Diff}} \gg \beta_{\mathrm{GAN}}$ uses the coupled-noise stability bound of Lemma 2, in which the DP noise cancels between neighboring runs; the uncoupled-noise term of order $\alpha\sigma\sqrt{T}$ noted in Appendix D is not included in the comparison, and if that term dominates at realistic noise scales the claimed ordering need not hold.

Editorial extensions

If this is right

  • The same reported $(\varepsilon,\delta)$ budget does not imply the same membership-inference exposure across generative architectures.
  • DP-GANs, whose only private component is the discriminator, keep MIA advantage near random at moderate budgets ($\varepsilon=10$), while DP-diffusion models retain measurable leakage even at $\varepsilon=1$.
  • Privacy evaluation of generative models should report an empirical MIA metric alongside $\varepsilon$, because $\varepsilon$ alone can be misleading.
  • There is a fidelity-privacy trade-off: the better sample quality of diffusion models comes with higher membership leakage under DP.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The stability ordering relies on coupling DP-SGD noise between neighboring runs; with independent noise, an extra term of order $\alpha\sigma\sqrt{T}$ appears, and at the large noise scales needed for small $\varepsilon$ this term could dominate and reverse the ordering. Testing the bound under uncoupled noise is a direct extension.
  • The bound contains $Q$ and $L_s$, which are score- and architecture-dependent; the empirical gap might shrink or widen with different attack scores (e.g., loss-based vs. logit-based) or different architectures.
  • A natural testable extension is to run the same MIA pipeline on larger image datasets and at smaller $\varepsilon$; the theory predicts the diffusion-vs-GAN gap persists as long as the low-noise EDM weights remain large.
  • The privacy-accounting implication is that architectures with high loss Lipschitz constants may need either more noise or fewer steps to reach the same true risk, suggesting that per-architecture noise calibration could replace fixed $\varepsilon$ budgets.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. This paper studies membership inference leakage in differentially private GANs and diffusion models. The authors propose a theoretical framework based on uniform stability: they connect attack-score stability to loss stability (Properties 1-2, Lemma 1), bound membership advantage by 2Q L_s β for threshold attacks (Theorem 1), and derive DP-SGD stability bounds for GAN discriminators and diffusion denoisers (Lemmas 2-4). They conclude that the diffusion model's weighted multi-pass denoising objective yields β_Diff >> β_GAN and hence a larger upper bound on the MIA advantage, explaining an empirically observed privacy gap. The empirical section compares shadow-model MIAs on MNIST for DP-GANs and DP-diffusion models at ε ∈ {1,5,10,∞}, reporting attack metrics and FID.

Significance. If the central claim were established, the paper would be significant: it would show that model architecture and training dynamics, not just the DP budget, shape membership leakage, and it would provide a concrete stability-based explanation. The paper also contributes a reproducible shadow-model attack pipeline for private generative models and a clean MNIST comparison. However, the theoretical argument as presented does not support the claim: the comparison of upper bounds is not a proof of a gap in actual leakage, and several technical steps (pointwise versus expected stability, coupled versus independent noise, unmeasured constants) are unresolved. The empirical results are restricted to MNIST and confounded by large FID differences between the two families.

major comments (5)
  1. [Section 3.4, after Eq. (38)] The inference from larger upper bounds to larger actual leakage is invalid. Eq. (38) and the following paragraph compare upper bounds on β and then on ADV_MIA, concluding that the 'upper bound on ADVDiff MIA is significantly larger than that of ADVGAN MIA' and that this 'provides a theoretical explanation of greater membership leakage.' A larger upper bound does not imply a larger actual value; without lower bounds on the adversary's success or a direct comparison of the leakage quantities, the empirical gap is not explained by these inequalities. This is load-bearing because the paper's central claim is that the theory explains the observed leakage gap.
  2. [Lemma 2 (Eq. 16) and Theorem 1 (Eq. 15)] There is a mismatch between the stability notion used in Lemma 2 and the one required by Theorem 1. Lemma 2 bounds the supremum over z,i of the expected absolute loss difference, i.e., an expected-stability quantity of the form sup_{z,i} E|ℓ(f_D,z) - ℓ(f_{D\i},z)|. In contrast, Definition 3 and Lemma 1 require a pointwise uniform bound |ℓ(f_D,z) - ℓ(f_{D\i},z)| ≤ β for all z. The proof of Theorem 1 uses the pointwise version in the margin argument (Eqs. (75)-(77)): the indicator functions can differ only when the score lies within L_s β of τ, which requires a deterministic bound on |s_{f_D}(x) - s_{f_{D\i}}(x)|. The expectation bound from Lemma 2 does not control this event, so the chain from Lemma 2 to Theorem 1 is broken.
  3. [Appendix D, Eq. (85)] The coupled-randomness assumption in Lemma 2 makes the DP noise scale σ cancel, and the main text states that the bound reflects the sensitivity of the algorithm rather than the effect of noise. Appendix D, Eq. (85), acknowledges that with independent noise, which is what real DP-SGD and the paper's own experiments use, the parameter divergence acquires an additional random-walk term O(α σ √T). Because the σ needed to achieve a fixed (ε,δ) differs between the GAN and the diffusion model (e.g., due to the noise multiplicity K=32 in Eq. (5)), the omitted term may dominate and could reverse the claimed ordering β_Diff >> β_GAN. The paper provides no argument or measurement showing that the uncoupled term is negligible.
  4. [Appendix B, proof of Theorem 1, Eqs. (72)-(77)] The proof of Theorem 1 contains an unjustified distributional step. The first equality identifies the member probability with E_{xi}[I{s(xi)≤τ}] and the non-member probability with E_x[I{s'(x)≤τ}], where s' is the score of the model trained on D\i. The subsequent inequality replaces both expectations by an expectation over x∼P, but the member xi is drawn from the empirical distribution of the training set D, not from P, and the non-member probability in the definition of ADVMIA is evaluated with the same model f_D, not with f_{D\i}. The bound in Eq. (74) is therefore not justified as written; a correct proof or a precise reference for this coupling step is needed.
  5. [Section 3.4 and Theorem 1] The quantitative comparison relies on several unmeasured constants: the shared Lipschitz constant L, the prediction-error bound B, the average EDM weight λ̄, the score-density bound Q, and the loss interval [a,b]. In particular, Theorem 1's bound is 2Q L_s β, and Q is not shown to be comparable between GANs and diffusion models; if the diffusion score density is more concentrated, the advantage bound could be smaller despite a larger β. Without measuring or bounding these quantities, the conclusion β_Diff >> β_GAN in Eq. (38) is not established.
minor comments (4)
  1. [Section 1] The phrase 'in under comparable conditions' should read 'under comparable conditions'.
  2. [Table 1] For ε=∞, the GAN AUC is 0.74 and the diffusion AUC is 0.75, so the claim of a 'marked privacy robustness gap' is not supported by the AUC at the non-private setting; the differences at ε=1 are also small (GAN AUC 0.49, diffusion AUC 0.52). The paper does not report confidence intervals, which would help assess whether the reported gaps are meaningful.
  3. [Table 2] The FID gap between GANs and diffusion models is large at every ε (e.g., 183.2 vs. 72.9 at ε=1). If the GAN outputs are of much lower quality, the attack score distributions may be trivially different for reasons unrelated to membership leakage, confounding the empirical privacy comparison. This should be discussed as a limitation.
  4. [Lemma 2] The bound in Eq. (16) contains a factor 2 that does not appear in the proof of Lemma 2: Eq. (21) gives LC/m Σ α_t, while Eq. (16) states 2LC/m Σ α_t. Please reconcile this constant.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the theoretical stability comparison is derived from stated Lipschitz and DP-SGD assumptions, not from the attack results it explains.

full rationale

The derivation chain is self-contained: Properties 1 and 2 define Lipschitz maps from training loss to attack score; Lemma 1 transfers uniform stability of the loss to stability of the score; Theorem 1 bounds threshold-attack advantage in terms of score stability and score-density; Lemma 2 bounds the expected DP-SGD stability under an explicitly stated coupled-randomness assumption; and Lemmas 3 and 4 instantiate that bound for GAN discriminators and diffusion denoisers. None of the constants (L, B, lambda-bar, step counts, Q) is fitted to the MIA measurements, and the claimed ordering beta_Diff >> beta_GAN is obtained by comparing Lipschitz constants and total update counts rather than by importing the empirical leakage gap into the bound. The diffusion attack score is deliberately defined as an unweighted version of the EDM denoising loss, so the score-stability transfer is close to definitional, but the paper presents this as a modeling choice and the load-bearing comparison lies in the stability bounds themselves, so this is not circularity. There is no load-bearing self-citation and no imported uniqueness theorem. The appended limitation in Appendix D, Eq. (85), states that with independent noise the stability bound acquires an additional term O(alpha sigma sqrt(T)) and that the main bound uses coupled noise so that sigma cancels; this is a genuine soundness concern about whether the claimed ordering holds at a fixed DP budget, but a non-sequitur or an unsupported dominance assumption is not circularity. Therefore no circular step is identified.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The theoretical comparison depends on unmeasured constants (L, B, lambda_bar, Q) and on a coupled-noise stability bound that drops the DP noise term. The empirical claim rests on one dataset and tables without error bars. No invented entities are introduced.

free parameters (5)
  • Common Lipschitz constant L
    Lemmas 3 and 4 assume the same network smoothness L for GAN discriminator and diffusion denoiser; L is never measured, and in practice the two networks have different sizes.
  • Diffusion prediction-error bound B
    Lemma 4 assumes norm of denoising error is uniformly bounded by B over noise levels and parameters; B is unspecified and could be large at low noise.
  • Average EDM weight lambda_bar
    Section 3.4 asserts lambda_bar is typically large, but no value or distribution is computed for the experimental setup.
  • Score-density bound Q
    Theorem 1 requires an upper bound on the density of the attack score; Appendix B asserts it holds in practice, but Q is never estimated.
  • Loss interval [a,b] for GAN logits
    Property 1 requires loss values in a compact interval in (0,infinity); no evidence that this holds for the raw logit of a trained discriminator.
assumptions (5)
  • domain assumption Bounded score density Q exists for both GAN logits and diffusion denoising losses.
    Theorem 1 and Appendix B require this to convert score stability into an advantage bound; the paper only asserts it is likely to hold.
  • domain assumption GAN discriminator and diffusion denoiser share the same Lipschitz constant L with respect to parameters.
    Lemmas 3 and 4 use a common L; the conclusion LD >> LG assumes L is comparable across very different architectures.
  • ad hoc to paper Coupled randomness in DP-SGD isolates the data effect and omits the DP noise scale from the stability comparison.
    Lemma 2 and Appendix D couple the noise between neighboring runs; the uncoupled noise term in Eq. (85) is not included in the comparison.
  • domain assumption The denoiser prediction error is uniformly bounded by B for all noise levels and all parameters.
    Lemma 4 needs this to derive the Lipschitz constant of the EDM loss; no evidence is given for the bound.
  • domain assumption The score density bound Q is comparable across GAN and diffusion models.
    Section 3.4 implicitly treats Q as the same constant when comparing the two advantage bounds, though the score distributions are different.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the MIA Vulnerability Gap Between Private GANs and Diffusion Models." pith.science (2026). https://pith.science/paper/N7GUVH24

@misc{pith2026250903341,
  author       = {Pith},
  title        = {Pith review of: On the MIA Vulnerability Gap Between Private GANs and Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/N7GUVH24}},
  note         = {Machine review of arXiv:2509.03341}
}
read the original abstract

Generative Adversarial Networks (GANs) and diffusion models have emerged as leading approaches for high-quality image synthesis. While both can be trained under differential privacy (DP) to protect sensitive data, their sensitivity to membership inference attacks (MIAs), a key threat to data confidentiality, remains poorly understood. In this work, we present the first unified theoretical and empirical analysis of the privacy risks faced by differentially private generative models. We begin by showing, through a stability-based analysis, that GANs exhibit fundamentally lower sensitivity to data perturbations than diffusion models, suggesting a structural advantage in resisting MIAs. We then validate this insight with a comprehensive empirical study using a standardized MIA pipeline to evaluate privacy leakage across datasets and privacy budgets. Our results consistently reveal a marked privacy robustness gap in favor of GANs, even in strong DP regimes, highlighting that model type alone can critically shape privacy leakage.

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 9 canonical work pages

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    B.; Mironov, I.; Talwar, K.; and Zhang, L

    Abadi, M.; Chu, A.; Goodfellow, I.; McMahan, H. B.; Mironov, I.; Talwar, K.; and Zhang, L. 2016. Deep Learning with Differential Privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security . ACM

    2016

  4. [4]

    Bie, A.; Kamath, G.; and Zhang, G. 2023. Private GANs, Revisited. arXiv:2302.02936

    arXiv 2023

  5. [5]

    Bousquet, O.; and Elisseeff, A. 2002. Stability and generalization. J. Mach. Learn. Res., 2: 499–526

    work page 2002

  6. [6]

    Carlini, N.; Chien, S.; Nasr, M.; Song, S.; Terzis, A.; and Tramèr, F. 2022. Membership Inference Attacks From First Principles. In 2022 IEEE Symposium on Security and Privacy (SP), 1897--1914

    2022

  7. [7]

    Carlini, N.; Hayes, J.; Nasr, M.; Jagielski, M.; Sehwag, V.; Tramèr, F.; Balle, B.; Ippolito, D.; and Wallace, E. 2023. Extracting Training Data from Diffusion Models. arXiv:2301.13188

    arXiv 2023

  8. [8]

    Chen, D.; Orekondy, T.; and Fritz, M. 2020. GS-WGAN: A Gradient-Sanitized Approach for Learning Differentially Private Generators. In Larochelle, H.; Ranzato, M.; Hadsell, R.; Balcan, M.; and Lin, H., eds., Advances in Neural Information Processing Systems, volume 33, 12673--12684. Curran Associates, Inc

    work page 2020

Show all 28 references
  1. [9]

    Chen, D.; Yu, N.; Zhang, Y.; and Fritz, M. 2020. GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, CCS ’20, 343–362. ACM

    2020

  2. [10]

    Dockhorn, T.; Cao, T.; Vahdat, A.; and Kreis, K. 2023. Differentially Private Diffusion Models. Transactions on Machine Learning Research

    2023

  3. [11]

    Dwork, C. 2011. A Firm Foundation for Private Data Analysis. Commun. ACM, 54: 86--95

    2011

  4. [12]

    Dwork, C.; McSherry, F.; Nissim, K.; and Smith, A. 2006. Calibrating Noise to Sensitivity in Private Data Analysis. In Theory of Cryptography Conference, volume Vol. 3876, 265--284. ISBN 978-3-540-32731-8

    2006

  5. [13]

    Dwork, C.; and Roth, A. 2014. The Algorithmic Foundations of Differential Privacy. Found. Trends Theor. Comput. Sci., 9(3–4): 211–407

    2014

  6. [14]

    L.; Wiles, O.; and Balle, B

    Ghalebikesabi, S.; Berrada, L.; Gowal, S.; Ktena, I.; Stanforth, R.; Hayes, J.; De, S.; Smith, S. L.; Wiles, O.; and Balle, B. 2023. Differentially Private Diffusion Models Generate Useful Synthetic Images. arXiv:2302.13861

    2023 arXiv

  7. [15]

    J.; Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde-Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y

    Goodfellow, I. J.; Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde-Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y. 2014. Generative Adversarial Networks. arXiv:1406.2661

    2014 arXiv

  8. [16]

    Hardt, M.; Recht, B.; and Singer, Y. 2016. Train faster, generalize better: Stability of stochastic gradient descent. arXiv:1509.01240

    2016 arXiv

  9. [17]

    Heusel, M.; Ramsauer, H.; Unterthiner, T.; Nessler, B.; and Hochreiter, S. 2018. GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium. arXiv:1706.08500

    2018 arXiv

  10. [18]

    Ho, J.; Jain, A.; and Abbeel, P. 2020. Denoising Diffusion Probabilistic Models. arXiv:2006.11239

    2020 arXiv

  11. [19]

    Karras, T.; Aittala, M.; Aila, T.; and Laine, S. 2022. Elucidating the Design Space of Diffusion-Based Generative Models. arXiv:2206.00364

    2022 arXiv

  12. [20]

    LeCun, Y.; and Cortes, C. 2010. MNIST handwritten digit database

    2010

  13. [21]

    Long, Y.; Wang, B.; Yang, Z.; Kailkhura, B.; Zhang, A.; Gunter, C.; and Li, B. 2021. G-PATE: Scalable Differentially Private Data Generator via Private Aggregation of Teacher Discriminators. In Ranzato, M.; Beygelzimer, A.; Dauphin, Y.; Liang, P.; and Vaughan, J. W., eds., Adv...

    2021

  14. [22]

    Nasr, M.; Shokri, R.; and Houmansadr, A. 2019. Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning. In 2019 IEEE Symposium on Security and Privacy (SP), 739--753

    2019

  15. [23]

    Shokri, R.; Stronati, M.; Song, C.; and Shmatikov, V. 2017. Membership Inference Attacks Against Machine Learning Models. In 2017 IEEE Symposium on Security and Privacy (SP), 3--18

    2017

  16. [24]

    Song, Y.; and Ermon, S. 2020. Generative Modeling by Estimating Gradients of the Data Distribution. arXiv:1907.05600

    2020 arXiv

  17. [25]

    P.; Kumar, A.; Ermon, S.; and Poole, B

    Song, Y.; Sohl-Dickstein, J.; Kingma, D. P.; Kumar, A.; Ermon, S.; and Poole, B. 2021. Score-Based Generative Modeling through Stochastic Differential Equations. arXiv:2011.13456

    2021 arXiv

  18. [26]

    Xie, L.; Lin, K.; Wang, S.; Wang, F.; and Zhou, J. 2018. Differentially Private Generative Adversarial Network. arXiv:1802.06739

    2018 arXiv

  19. [27]

    Yeom, S.; Giacomelli, I.; Fredrikson, M.; and Jha, S. 2018. Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting. arXiv:1709.01604

    2018 arXiv

  20. [28]

    Yousefpour, A.; Shilov, I.; Sablayrolles, A.; Testuggine, D.; Prasad, K.; Malek, M.; Nguyen, J.; Ghosh, S.; Bharadwaj, A.; Zhao, J.; Cormode, G.; and Mironov, I. 2021. Opacus: U ser-Friendly Differential Privacy Library in PyTorch . arXiv preprint arXiv:2109.12298

    2021 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.