Assessing Membership Inference Privacy Risks in Medical Diffusion Models via Discrete Encoding-Based Inference

Abstract

The rapid adoption of diffusion models in medical imaging has raised significant concerns regarding data privacy, especially their susceptibility to Membership Inference Attacks (MIAs). However, the privacy risks associated with diffusion models in the medical domain remain underexplored compared to natural images. In this study, we propose a novel grey-box attack framework, termed the Discrete Encoding-Based Membership Inference Attack (DEB), inspired by Denoising Diffusion Codebook Models (DDCM). DEB injects semantically meaningful noise via a discrete codebook strategy and identifies training samples by analyzing the model’s output trajectory under this discrete encoding, specifically measuring the average of intermediate predictions across selected time steps. We conduct an evaluation of MIAs across natural images and five representative datasets from the MedMNIST collection. Our experiments reveal that the susceptibility of diffusion models is highly dependent on the data modality; for instance, while certain datasets exhibit near-complete vulnerability, others like PathMNIST demonstrate strong inherent resistance to MIAs. Furthermore, DEB demonstrates superior performance compared to existing baselines (e.g., SecMI, PIA, SimA), particularly on challenging datasets. For example, DEB achieves a True Positive Rate at 1% False Positive Rate (TPR @ 1% FPR) of 60.3% on CIFAR-10, significantly outperforming the SimA baseline (35.9%). Notably, even on the highly resistant PathMNIST dataset, DEB attains a 10.2% TPR @ 1% FPR, establishing a substantial advantage over the PIA baseline (1.1%). This work provides practical insights into the privacy risks inherent in diffusion models and emphasizes that model providers should carefully assess these vulnerabilities when exposing intermediate generation APIs.

1. Introduction

Recently, Generative Artificial Intelligence has witnessed a paradigm shift driven by the breakthrough of Denoising Diffusion Probabilistic Models (DDPMs) [1]. Large-scale diffusion models, such as Stable Diffusion [2], DALL-E 2 [3], and Imagen [4], have achieved dominance in both academia and industry due to their exceptional distribution fitting capabilities and high-fidelity image generation. Unlike traditional Generative Adversarial Networks (GANs) [5,6,7,8] or Variational Autoencoders (VAEs) [9], diffusion models generate data by reversing a progressive noise addition process. This iterative denoising mechanism endows the models with unprecedented diversity and creativity. Crucially, in the field of biomedical engineering, diffusion models have demonstrated superior competitiveness compared to GANs, achieving competitive results in tasks such as medical image segmentation [10,11,12], MRI/CT super-resolution and reconstruction [13,14,15,16], ECG signal enhancement [17] and image-to-image translation [18,19,20]. However, the widespread deployment of these high-performance models in sensitive domains has underscored significant concerns regarding privacy risks [21] and copyright disputes [22]. This issue is particularly critical in the healthcare sector. Unlike general internet data, medical records are governed by strict ethical standards and confidentiality regulations. Potential patient data leakage carries substantially more severe consequences than leakage from generic datasets, necessitating rigorous privacy audits for medical AI models.

Since diffusion models fit data distribution better, studies indicate a significant “memorization” effect, wherein the model may unintentionally memorize specific samples from the training set. Crucially, fundamental works investigating privacy risks in the context of medical imaging have demonstrated that deep learning models are highly susceptible to this memorization, leading to severe vulnerabilities such as inference and inversion attacks [23,24,25]. This phenomenon renders diffusion models vulnerable to Membership Inference Attacks (MIAs) [26,27], which often serve as a precursor to more severe data extraction attacks [28]. As a pivotal metric for assessing privacy risks, MIA aims to determine whether a given data sample was used in the model’s training by analyzing the model’s output behavior. Based on the information accessible from the model, attacks on diffusion models are generally categorized into white-box, grey-box, and black-box settings. This paper primarily focuses on the grey-box setting. In this context, we assume access to the model’s output at each intermediate step of the sampling process, rather than solely the final generated image. This assumption holds substantial practical significance in medical applications; for instance, tasks like image in-painting [29] or iterative reconstruction often require utilizing the model’s output at every step, leading providers to expose APIs that allow users to access these intermediate outputs.

The fundamental assumption underlying Membership Inference Attacks is that models tend to fit training samples better than unseen data [30]. A straightforward approach involves detecting whether the model yields a lower loss function value for a specific sample [31,32]. However, due to the stochastic nature of the diffusion training objective—which typically involves predicting a randomly sampled noise—direct attacks based on the loss function often lack sufficient discriminability. To enhance attack performance, SecMI [33] proposes examining the model from a trajectory perspective, positing that training samples exhibit better alignment along the sampling trajectory. Specifically, it executes a forward and subsequent reverse process on the deterministic DDIM path [34], inferring membership by comparing the consistency of the sample before and after this cycle. PIA [35] further refines the SecMI algorithm by leveraging the property that the sampling trajectory is approximately linear when time step t is small, thereby omitting intermediate steps. More recently, SimA [36] simplifies this further by directly utilizing the norm of the predicted noise $\mathit{ϵ}$ at a specific time step for judgment.

However, SimA relies solely on information from a single time step, and while SecMI and PIA inherently infer membership by measuring trajectory consistency, they utilize information from only key time steps or linear approximations rather than the accumulated information of the entire trajectory. However, diffusion is inherently a multi-step denoising generation process. This raises a pivotal question: Can we leverage information across multiple time steps, or utilize model information via multiple queries at the same time step, to construct a more robust inference attack?

Inspired by Denoising Diffusion Codebook Models (DDCM) [37], we propose a Discrete Encoding-Based membership inference attack (DEB). The original DDCM, designed for image compression, initializes a random codebook and selects the nearest noise to replace the diffusion noise during the denoising process, thereby injecting information from the original sample. We hypothesize that training samples maintain a certain degree of stability around the sample point when subjected to this encoding. However, DDCM cannot be directly applied for MIA: it necessitates denoising from T to 0 and is strictly limited to the DDPM model. In this work, we improve the DDCM framework to be applicable to various diffusion architectures and propose DEB to enhance attack performance by statistically analyzing multiple outputs of model during discrete encoding at selected time steps.

While the aforementioned methods have been extensively verified on natural images, the membership privacy risks within the medical imaging domain remain underexplored. It is currently ambiguous which medical modalities are inherently vulnerable to privacy leakage, which exhibit natural robustness, and how their privacy characteristics diverge from those of natural images. To bridge this gap and provide a comprehensive understanding across diverse domains, we conduct a rigorous evaluation of Loss-Based Attack, SecMI, PIA, SimA, and our proposed DEB on standard natural image benchmarks, text-to-image architectures (Stable Diffusion), and a carefully selected subset of the MedMNIST2D dataset.

Our empirical study reveals that the susceptibility of diffusion models to membership inference is highly dependent on the specific data modality. We hypothesize that this variance in vulnerability arises from the distinct semantic variability and unique visual patterns inherent to different imaging distributions. Consequently, we observe significant heterogeneity across modalities: while the ChestMNIST data is highly vulnerable, others like PathMNIST demonstrate inherent robustness. Besides, DEB demonstrates superior efficacy in these challenging scenarios. By injecting semantically meaningful noise via a discrete codebook, DEB effectively extracts membership signals.

The main contributions of this paper are summarized as follows:

• We extend the DDCM methodology to be compatible with general diffusion architectures beyond standard DDPM and optimize the efficiency. Based on this, we propose the Discrete Encoding-Based membership inference attack (DEB). By performing statistical analysis on the model’s outputs under discrete noise injection, DEB significantly improves membership inference performance.
• We perform a rigorous evaluation of MIA performance across diverse data domains, encompassing natural images, text-to-image models, and a carefully selected subset of medical image modalities. Our results reveal a complex landscape of membership inference privacy risks: vulnerability is highly dependent on the specific data modality and its semantic variance, finding that specific modalities that possess natural defense mechanisms against memorization.
• We validate the proposed DEB algorithm across these diverse domains. Experimental results demonstrate that DEB maintains superior performance, establishing significant advantages on natural images and unconditional text-to-image generation, while remaining superior performance on “hard” medical datasets where existing baselines struggle. Furthermore, we provide a comprehensive analysis of hyperparameters and demonstrate that the computational complexity of DEB remains highly tractable, requiring manageable execution time and GPU memory for practical deployment.

The remainder of this article is organized as follows. Section 2 reviews related work on diffusion models and denoising diffusion codebook models. Section 3 details the materials and methods, including dataset descriptions, evaluation metrics, and the theoretical formulation of our proposed DEB algorithm. Section 4 presents a comprehensive empirical evaluation of DEB across medical and natural image domains, along with ablation studies and hyperparameter sensitivity analysis. Finally, Section 5 concludes the paper with a discussion on the implications of our findings and directions for future research.

2. Related Work

2.1. Diffusion Models

Denoising Diffusion Probabilistic Models (DDPMs) generate samples by modeling the reverse of the forward diffusion process. The forward process is defined as a Markov chain that progressively injects Gaussian noise:

$${\mathit{x}}_t=\sqrt{{\alpha }_t}{\mathit{x}}_{t-1}+\sqrt{{\beta }_t}{\mathit{ϵ}}_t,{\mathit{ϵ}}_t\sim \mathcal{N}(0,I).$$

(1)

As the time step t increases, the variance parameter ${\beta }_t$ gradually increases while ${\alpha }_t$ decreases, causing ${\mathit{x}}_t$ to eventually converge towards Gaussian noise. During the sampling phase, the model samples initial noise from a standard Gaussian distribution and subsequently performs a reverse diffusion process for denoising. Let ${\mathit{x}}_t^{\prime }$ denote the sequence generated by the reverse diffusion; it can be theoretically proven that ${\mathit{x}}_t^{\prime }$ remains Gaussian. Assuming its variance matches that of the forward process, the mean of ${\mathit{x}}_t^{\prime }$ can be parameterized as:

$${\tilde{\mu }}_t={\displaystyle \frac{1}{\sqrt{{\alpha }_t}}}\left({\mathit{x}}_t-{\displaystyle \frac{{\beta }_t}{\sqrt{1-\overline{\alpha }t}}}{\mathit{ϵ}}_{\theta }({\mathit{x}}_t,t)\right),$$

(2)

where ${\overline{\alpha }}_t={\prod }_{k=0}^t{\alpha }_k$ and ${\overline{\alpha }}_t+{\overline{\beta }}_t=1$. Accordingly, the single-step update formula for the reverse diffusion process is given by:

$${\mathit{x}}_{t-1}={\tilde{\mu }}_t+\sqrt{{\beta }_t}\mathit{ϵ},\mathit{ϵ}\sim \mathcal{N}(0,I).$$

(3)

The training objective is to predict the noise ${\mathit{ϵ}}_t$ injected during the forward process, with the loss function formulated as:

$${\mathbb{E}}_{{\mathit{x}}_0,{\mathit{ϵ}}_t}\left[{∥{\mathit{ϵ}}_t-{\mathit{ϵ}}_{\theta }\left(\sqrt{{\overline{\alpha }}_t}{\mathit{x}}_0+\sqrt{1-{\overline{\alpha }}_t}{\mathit{ϵ}}_t,t\right)∥}^2\right].$$

(4)

The reverse process is inherently a progressive denoising procedure; however, it typically requires a substantial number of iteration steps (e.g., $T=1000$ for CIFAR-10) to ensure generation quality.

Score-based models [38] generalize the discrete-time diffusion process to the continuous-time domain, utilizing Stochastic Differential Equations (SDEs) to describe data evolution. This framework allows for the flexible design of forward and reverse processes with varying variances while maintaining the marginal distribution. The SDE for the forward process is defined as:

$$d\mathit{x}=\left({\mathit{f}}_t\left(\mathit{x}\right)-{\displaystyle \frac{1}{2}}(g_t^2-{\sigma }_t^2){\nabla }_{\mathit{x}}log{p}_t\left(\mathit{x}\right)\right)dt+{\sigma }_{t}d\mathit{w},$$

(5)

where $\mathit{w}$ represents a standard forward Wiener process. The corresponding reverse SDE is given by:

$$d\mathit{x}=\left({\mathit{f}}_t\left(\mathit{x}\right)-{\displaystyle \frac{1}{2}}(g_t^2+{\sigma }_t^2)\nabla \mathit{x}log{p}_t\left(\mathit{x}\right)\right)dt+{\sigma }_{t}d\overline{\mathit{w}},$$

(6)

where $\overline{\mathit{w}}$ denotes the standard Wiener process in reverse time. When ${\sigma }_t\equiv 0$, the process degenerates into a deterministic Ordinary Differential Equation (ODE).

In the ODE formulation, off-the-shelf numerical solvers can be directly applied for sampling. In practical applications, the drift term is typically set as ${\mathit{f}}_t\left(\mathit{x}\right)=f\left(t\right)\mathit{x}$. Sample generation is achieved by training a neural network to estimate the score function ${\nabla }_{\mathit{x}}log{p}_t\left(\mathit{x}\right)$, with a loss function highly similar to that of DDPM. The grey-box attack acquires the access to ${\mathit{ϵ}}_{\theta }({\mathit{x}}_t,t)$, and it cannot apply to pipeline which we can only access to the generated image ${\mathit{x}}_0$.

2.2. Denoising Diffusion Codebook Models

Denoising Diffusion Codebook Models (DDCM) [37] aim to leverage diffusion models to transform continuous images into discrete tokens. Specifically, this method first constructs a codebook ${\mathcal{E}}_i$ comprising K noise vectors sampled from a standard normal distribution $\mathcal{N}(0,1)$. During the generation process, the method achieves image reconstruction and encoding by substituting the random noise $\mathit{ϵ}$ in Equation (3) with a specific element selected from the codebook $\mathcal{C}$. The core strategy involves selecting the noise vector $\mathit{ϵ}\in \mathcal{C}$ that maximizes the dot product $(\mathit{x}-{\mathit{x}}_{0|x_i})·\mathit{ϵ}$, thereby approximating the direction of ${\nabla }_{{\mathit{x}}_i}log{p}_i\left(\mathit{x}\right|{\mathit{x}}_i)$. However, the framework proposed by DDCM is applicable solely to DDPMs, which severely limits its generality.

2.3. Defenses Against MIA

Defenses against Membership Inference Attacks (MIAs) primarily focus on reducing the distinguishability between member and non-member data. These methods generally fall into four paradigms: regularization, transfer learning, information perturbation, and generative models. Regularization techniques [39,40,41] (e.g., $L_2$-norm, dropout, and adversarial training) mitigate MIA vulnerabilities by restricting model overfitting and enhancing generalization. Meanwhile, transfer learning methods [42,43,44], such as knowledge distillation and domain adaptation, isolate sensitive training records by leveraging surrogate datasets to transfer knowledge, effectively balancing utility and privacy. Information perturbation mechanisms [45,46], including differential privacy and data obfuscation, mask membership signals by injecting calibrated noise into data, model parameters, or prediction outputs. Recently, defenses based on generative models (e.g., GANs, VAEs) [47,48,49] have gained traction by synthesizing high-fidelity proxy data to train substitute models. This fundamentally severs the direct link between original training data and model predictions, providing a critical foundation for addressing privacy risks and designing robust countermeasures in advanced generative architectures like diffusion models.

3. Materials and Methods

3.1. Datasets and Training Details

Medical Image.   To evaluate the performance of membership inference attacks (MIAs) on diffusion models within the medical domain, we utilized the MedMNIST collection [50,51]. To maintain consistency with experimental setups in the natural image domain and to prevent the overestimation of privacy risks often associated with exceptionally small datasets, we filtered the 12 available 2D subsets and selected only those containing 50,000 or more samples. Specifically, our evaluation focuses on five datasets: PathMNIST, ChestMNIST, OCTMNIST, TissueMNIST, and OrganAMNIST. We opted for the $28\times 28$ resolution for this study based on two primary considerations. First, this resolution aligns with the standard datasets widely employed in existing MIA research on natural images [33,35,36], ensuring comparability. Second, prior evaluations [50,51] on MedMNIST (

Table 1. Comparison between MedMNIST2D size $28\times 28$ and $224\times 224$ in metrics of AUC and ACC [50,51].

Methods	PathMNIST		ChestMNIST		DermaMNIST		OCTMNIST		PneumoniaMNIST		RetinaMNIST
	AUC	ACC	AUC	ACC	AUC	ACC	AUC	ACC	AUC	ACC	AUC	ACC
ResNet-18 (28)	0.983	0.907	0.768	0.947	0.917	0.735	0.943	0.743	0.944	0.854	0.717	0.524
ResNet-18 (224)	0.989	0.909	0.773	0.947	0.920	0.754	0.958	0.763	0.956	0.864	0.710	0.493
ResNet-50 (28)	0.990	0.911	0.769	0.947	0.913	0.735	0.952	0.762	0.948	0.854	0.726	0.528
ResNet-50 (224)	0.989	0.892	0.773	0.948	0.912	0.731	0.958	0.776	0.962	0.884	0.716	0.511
Methods	BreastMNIST		BloodMNIST		TissueMNIST		OrganAMNIST		OrganCMNIST		OrganSMNIST
	AUC	ACC	AUC	ACC	AUC	ACC	AUC	ACC	AUC	ACC	AUC	ACC
ResNet-18 (28)	0.901	0.863	0.998	0.958	0.930	0.676	0.997	0.935	0.992	0.900	0.972	0.782
ResNet-18 (224)	0.891	0.833	0.998	0.963	0.933	0.681	0.998	0.951	0.994	0.920	0.974	0.778
ResNet-50 (28)	0.857	0.812	0.997	0.956	0.931	0.680	0.997	0.935	0.992	0.905	0.972	0.770
ResNet-50 (224)	0.866	0.842	0.997	0.950	0.932	0.680	0.998	0.947	0.993	0.911	0.975	0.785

) indicate that the performance gap (in terms of accuracy and AUC) between $28\times 28$ images and higher-resolution counterparts (e.g., $224\times 224$) on ResNet [52] is little (1 or 2 points for most datasets). For implementation purposes, we resized the images to $32\times 32$ to accommodate the spatial dimension requirements of the U-Net architecture. The data modality and dataset sizes are detailed in

Table 2. The data modality and the number of samples of all MedMNIST2D datasets.

Name	Data Modality	# Samples	# Training/Validation/Test
PathMNIST	Colon Pathology	107,180	89,996/10,004/7180
ChestMNIST	Chest X-Ray	112,120	78,468/11,219/22,433
DermaMNIST	Dermatoscope	10,015	7007/1003/2005
OCTMNIST	Retinal OCT	109,309	97,477/10,832/1000
PneumoniaMNIST	Chest X-Ray	5856	4708/524/624
RetinaMNIST	Fundus Camera	1600	1080/120/400
BreastMNIST	Breast Ultrasound	780	546/78/156
BloodMNIST	Blood Cell Microscope	17,092	11,959/1712/3421
TissueMNIST	Kidney Cortex Microscope	236,386	165,466/23,640/47,280
OrganAMNIST	Abdominal CT	58,850	34,581/6491/17,778
OrganCMNIST	Abdominal CT	23,660	13,000/2392/8268
OrganSMNIST	Abdominal CT	25,221	13,940/2452/8829

, and samples from the different datasets are exhibited in Figure 1. For all datasets, we adopted a unified DDPM training configuration, with detailed hyperparameters provided in Section 4.5. To evaluate the performance of the membership inference attacks, we constructed the target datasets by randomly sampling 50,000 images from the combined pool of each dataset’s original train, validation, and test splits. These 50,000 samples were then randomly partitioned into two equal halves: 25,000 images designated as the training set (members) and the remaining 25,000 images as the hold-out set (non-members). This setup is rigorously consistent with standard benchmarks about CIFAR-10 and CIFAR-100 used in the natural image domain [33,35,36].

Natural Images.   For the evaluation on natural images, we adhered to widely adopted experimental settings, selecting CIFAR-10, CIFAR-100 [53], and TinyImageNet [54] as our primary benchmark datasets. Consistent with the configuration used for medical images, we partitioned each dataset evenly, designating 50% of the samples as the member set and the remaining 50% as the hold-out set. Specifically, the total sample sizes for the MIA evaluation were set to 50,000 for both CIFAR-10 and CIFAR-100, and 100,000 for TinyImageNet. These DDPM models were trained for 800,000 steps using the Adam optimizer with a learning rate of $2\times {10}^{-4}$.

Additionally, we extended our evaluation to the Stable Diffusion model using the Pokemon dataset [55], which consists of approximately 800 samples. Preprocessing involved center-cropping images to a resolution of $512\times 512$. We adopted a batch size of 1 and established two distinct training configurations to assess different capabilities: a “weak overfitting” setting trained for 150,000 steps, and a “realistic fine-tuning” setting trained for 7500 steps.

3.2. Baseline

To establish a comprehensive benchmark, we compared our method against the most popular baselines in the grey-box diffusion model landscape, specifically Loss-based inference [31], SecMI [33], and PIA [35]. We also incorporated the recently proposed SimA [36] into our evaluation. Furthermore, for experiments involving Stable Diffusion, we included CLiD [27] as an additional comparative baseline. But CLiD is subject to specific constraints: it is exclusively applicable to text-to-image models and necessitates access to the ground-truth text prompts.

3.3. Evaluation Metrics

We adopt the rigorous evaluation metrics established in the MIA literature [28,56]: the Area Under the Curve (AUC) and the True Positive Rate (TPR) at a fixed False Positive Rate (FPR) of 1% (TPR @ 1% FPR). For notational brevity, we denote this metric as T1F throughout the remainder of this paper.

3.4. Proposed Method

We hypothesize that when a sample lies in the proximity of the training data manifold, the model’s output should exhibit stability around that sample point. To exploit this property, we adopt the noise injection strategy of DDCM—specifically leveraging the term $({\mathit{x}}_t-{\mathit{x}}_p)·{\mathit{ϵ}}_t$—to embed discriminative information into the noise component. However, the original DDCM framework is inherently constrained by its exclusive applicability to DDPMs and the requirement for a complete reverse iteration from T to 0. In this section, we first present a generalized extension of the DDCM framework to address these limitations, and then introduce the proposed MIA algorithm.

3.4.1. Generalizing DDCM

DDCM injects information by replacing the standard random noise term $\mathit{ϵ}$ in the reverse DDPM process (Equation (3)) with a noise vector selected via $arg{max}_{{\mathit{ϵ}}_t\in \mathcal{C}}({\mathit{x}}_t-{\mathit{x}}_p)·{\mathit{ϵ}}_t$. The marginal distribution of diffusion models is typically expressed as:

$${\mathit{x}}_t=s\left(t\right){\mathit{x}}_0+\mathrm{\Sigma }\left(t\right)\mathit{ϵ},$$

(7)

where ${\mathit{x}}_0\sim p_{\mathrm{data}}$ and $\mathit{ϵ}\sim \mathcal{N}(\mathit{0},\mathbf{I})$. We establish the following theorem to generalize this process:

Theorem 1. 

Performing a backward iteration with step size $\Delta t$ utilizing the score-based formulation (Equation (6)) is approximately equivalent to applying the following update rule:

$${\mathit{x}}_{t-\Delta t}=s(t-\Delta t){\mathit{x}}_p+\sqrt{\mathrm{\Sigma }{(t-\Delta t)}^2-{\sigma }_t^2\Delta t}{\mathit{ϵ}}_p+{\sigma }_t\sqrt{\Delta t}\mathit{ϵ}.$$

(8)

Proof. 

For notational simplicity, we disregard terms of order higher than $O(\Delta t)$. The proof proceeds as follows:

Applying the Euler-Maruyama discretization to the backward SDE, we obtain:

$${\mathit{x}}_{t-\Delta t}={\mathit{x}}_t-\left({\mathit{f}}_t{\mathit{x}}_t-{\displaystyle \frac{1}{2}}{g}_t^2{\nabla }_{\mathit{x}}log{p}_t\left(\mathit{x}\right)\right)\Delta t+{\sigma }_t\sqrt{\Delta t}\mathit{ϵ}+{\displaystyle \frac{1}{2}}{\sigma }_t^2{\nabla }_{\mathit{x}}log{p}_t\left(\mathit{x}\right)\Delta t.$$

(9)

We first analyze the deterministic component of Equation (9), temporarily excluding the noise-related term ${\sigma }_t\sqrt{\Delta t}\mathit{ϵ}+{\displaystyle \frac{1}{2}}{\sigma }_t^2{\nabla }_{\mathit{x}}log{p}_t\left(\mathit{x}\right)\Delta t$:

$${\mathit{x}}_{t-\Delta t}^{\det }={\mathit{x}}_t-\left({\mathit{f}}_t{\mathit{x}}_t-{\displaystyle \frac{1}{2}}{g}_t^2{\nabla }_{\mathit{x}}log{p}_t\left(\mathit{x}\right)\right)\Delta t.$$

(10)

According to [38], the score function can be formulated as:

$${\mathit{x}}_t=s\left(t\right){\mathit{x}}_p-{\nabla }_{\mathit{x}}log{p}_t\left({\mathit{x}}_t\right)\mathrm{\Sigma }{\left(t\right)}^2.$$

(11)

where ${\mathit{x}}_p$ is the predicted ${\mathit{x}}_{0|t}$ and:

$$\mathrm{\Sigma }\left(t\right)=s\left(t\right)\sigma \left(t\right),$$

(12)

$$\sigma {(t-\Delta t)}^2=\sigma {\left(t\right)}^2-{\displaystyle \frac{g{\left(t\right)}^2}{s{\left(t\right)}^2}}\Delta t+O(\Delta t^2).$$

(13)

The predicted noise vector can be formulated as:

$${\mathit{ϵ}}_p=-{\nabla }_{\mathit{x}}log{p}_t\left({\mathit{x}}_t\right)\mathrm{\Sigma }\left(t\right).$$

(14)

Additionally, for the term $s\left(t\right)$, the following approximation holds [38]:

$$s(t-\Delta t)\approx s\left(t\right)-f_t·s\left(t\right)\Delta t.$$

(15)

Substituting Equation (11) into Equation (10) and rearranging the terms yields:

$$\begin{array}{cc}\hfill {\mathit{x}}_{t-\Delta t}^{\det }& =(s\left(t\right)-s\left(t\right)f_t\Delta t){\mathit{x}}_p+{\displaystyle \frac{1}{2}}{g}_t^2\Delta t{\nabla }_{\mathit{x}}log{p}_t\left(\mathit{x}\right)\hfill \\ \hfill & -{\nabla }_{\mathit{x}}log{p}_t\left(\mathit{x}\right)\left({\left(s\left(t\right)\sigma \left(t\right)\right)}^2-f_t·{\left(s\left(t\right)\sigma \left(t\right)\right)}^2\Delta t\right).\hfill \end{array}$$

(16)

Using the iterative relationship in Equation (15), we have:

$$(s\left(t\right)-s\left(t\right)f_t\Delta t){\mathit{x}}_p\approx s(t-\Delta t){\mathit{x}}_p.$$

(17)

Furthermore, from Equation (15), we derive:

$${\left(s\left(t\right)\sigma \left(t\right)\right)}^2-f_t·{\left(s\left(t\right)\sigma \left(t\right)\right)}^2\Delta t\approx s\left(t\right)s(t-\Delta t)\sigma {\left(t\right)}^2.$$

(18)

Substituting these back into Equation (16), we obtain:

$${\mathit{x}}_{t-\Delta t}^{\det }=s(t-\Delta t){\mathit{x}}_p-{\nabla }_{\mathit{x}}log{p}_t\left(\mathit{x}\right)\left[s\left(t\right)s(t-\Delta t)\left(\sigma {\left(t\right)}^2-{\displaystyle \frac{g{\left(t\right)}^2}{s\left(t\right)s(t-\Delta t)}}{\displaystyle \frac{\Delta t}{2}}\right)\right].$$

(19)

For any continuously differentiable function $s\left(t\right)$, the property $s(t-\Delta t)s(t+\Delta t)=s{\left(t\right)}^2+O(\Delta t^2)$ holds. By shifting the time index to $t+{\displaystyle \frac{1}{2}}\Delta t$, we approximate:

$$s\left(t\right)s(t-\Delta t)\approx s{\left(t+{\displaystyle \frac{1}{2}}\Delta t\right)}^2.$$

(20)

Substituting Equation (13) into the bracketed term in Equation (19), it simplifies as:

$$\sigma {\left(t\right)}^2-{\displaystyle \frac{g{\left(t\right)}^2}{s\left(t\right)s(t-\Delta t)}}{\displaystyle \frac{\Delta t}{2}}\approx \sigma {\left(t+{\displaystyle \frac{\Delta t}{2}}\right)}^2\approx \sigma \left(t\right)\sigma (t-\Delta t).$$

(21)

Combining Equations (12), (14), and (21) into Equation (19), we derive:

$${\mathit{x}}_{t-\Delta t}^{\det }=s(t-\Delta t){\mathit{x}}_p+\mathrm{\Sigma }(t-\Delta t){\mathit{ϵ}}_p.$$

(22)

Now, we reintroduce the noise terms from Equation (9):

$${\mathit{x}}_{t-\Delta t}=s(t-\Delta t){\mathit{x}}_p+\mathrm{\Sigma }(t-\Delta t){\mathit{ϵ}}_p+{\sigma }_t\sqrt{\Delta t}\mathit{ϵ}+{\displaystyle \frac{1}{2}}{\sigma }_t^2{\nabla }_{\mathit{x}}log{p}_t\left(\mathit{x}\right)\Delta t.$$

(23)

Utilizing Equation (14), we substitute the score term:

$${\mathit{x}}_{t-\Delta t}\approx s(t-\Delta t){\mathit{x}}_p+\mathrm{\Sigma }(t-\Delta t)\left(1-{\displaystyle \frac{1}{2}}{\displaystyle \frac{{\sigma }_t^2}{\mathrm{\Sigma }{(t-\Delta t)}^2}}\Delta t\right){\mathit{ϵ}}_p+{\sigma }_t\sqrt{\Delta t}\mathit{ϵ}.$$

(24)

Applying the first-order Taylor expansion $\sqrt{1-x}=1-{\displaystyle \frac{1}{2}}x+O\left(x^2\right)$ to Equation (24), we arrive at:

$$\begin{array}{cc}\hfill {\mathit{x}}_{t-\Delta t}& \approx s(t-\Delta t){\mathit{x}}_p+\mathrm{\Sigma }(t-\Delta t)\sqrt{1-{\displaystyle \frac{{\sigma }_t^2}{\mathrm{\Sigma }{(t-\Delta t)}^2}}\Delta t}{\mathit{ϵ}}_p+{\sigma }_t\sqrt{\Delta t}\mathit{ϵ}\hfill \\ \hfill & =s(t-\Delta t){\mathit{x}}_p+\sqrt{\mathrm{\Sigma }{(t-\Delta t)}^2-{\sigma }_t^2\Delta t}{\mathit{ϵ}}_p+{\sigma }_t\sqrt{\Delta t}\mathit{ϵ}.\hfill \end{array}$$

(25)

This concludes the proof.    □

Leveraging the fact that ${\sigma }_t$ is an arbitrary parameter, we replace the scaling term ${\sigma }_t\sqrt{\Delta t}$ with ${\sigma }_t$. Consequently, Equation (8) is reformulated as:

$${\mathit{x}}_{t-\Delta t}=s(t-\Delta t){\mathit{x}}_p+\sqrt{\mathrm{\Sigma }{(t-\Delta t)}^2-{\sigma }_t^2}{\mathit{ϵ}}_p+{\sigma }_t\mathit{ϵ}.$$

(26)

We employ Equation (26) to overcome the limitations of DDCM—specifically, the rigid step size and non-adjustable noise injection levels mandated by Equation (3). This modification naturally raises critical implementation questions regarding the magnitude of noise injection, the determination of forward iteration step sizes, and the definition of the start ($T_s$) and end ($T_e$) time steps.

3.4.2. Discrete Encoding-Based Membership Inference Attack

Let $T_s$ and $T_e$ denote the start and end time steps of the iteration process, respectively. We redefine the discrete time step at the n-th iteration, denoted as $t_n$ (formerly $t-\Delta t$). Given a total of N iterations, $t_n$ is defined as:

$$t_n=⌈{\displaystyle \frac{n}{N}}(T_e-T_s)+T_s⌉.$$

(27)

Since the start time is not T, we need a strategy to initialize the ${\mathit{x}}_{t_d}$. To determine the optimal initialization strategy, we investigate two distinct initialization functions, denoted as $I\left({\mathit{x}}_t\right)$. These are defined as follows:

$$I({\mathit{x}}_0,t)=\sqrt{{\left({\displaystyle \frac{1}{2}}s\left(t\right)\right)}^2+\mathrm{\Sigma }{\left(t\right)}^2}\mathit{ϵ},$$

(28)

and:

$$I({\mathit{x}}_0,t)=s\left(t\right){\mathit{x}}_0+\mathrm{\Sigma }\left(t\right)\mathit{ϵ},$$

(29)

where the noise vector is selected from the codebook to maximize alignment with the data: $\mathit{ϵ}=arg{max}_{\mathit{ϵ}\in {\mathcal{C}}^g}({\mathit{x}}_0·\mathit{ϵ})$.

For ${\sigma }_t$, we govern the noise parameter ${\sigma }_t$ via a time-dependent variable $t_d$:

$${\sigma }_t(t_d,t_n)=\sqrt{1-{\displaystyle \frac{{\overline{\alpha }}_{t_n}}{{\overline{\alpha }}_{t_n-t_d}}}}.$$

(30)

To regulate the variation of the noise level, inspired by the EDM framework [57], we establish maximum and minimum time ratios, $r_{\max }$ and $r_{\min }$, respectively. The variable $t_d$ is iterated in descending order from $\lceil T_s·r_{max}\rceil$ to $\lceil T_s·r_{max}{r}_{min}\rceil$. Denoting ${\Delta }_{max}=\lceil T_s·r_{max}\rceil$, ${\Delta }_{min}=\lceil T_s·r_{max}{r}_{min}\rceil$ and $P={\Delta }_{max}-{\Delta }_{min}$ represent the range, the number of iterations allocated to each time step $t_d$ is determined by the function:

$$\begin{array}{c}\hfill r(t_d,{\sigma }_{\max },\rho ,T_s,{\Delta }_{min},{\Delta }_{max},P,N)=⌈{\displaystyle \frac{{\left(1+L(t_d-{\Delta }_{min})·({\sigma }_{max}^{1/\rho }-1)\right)}^{\rho }}{{\sum }_i{\left(1+L\left(i\right)·({\sigma }_{max}^{1/\rho }-1)\right)}^{\rho }}}N⌉,\end{array}$$

(31)

where $L\left(i\right)=l(i,{\Delta }_{min},{\Delta }_{max})={\displaystyle \frac{log{\Delta }_{max}-log({\Delta }_{min}+i)}{log{\Delta }_{max}-log{\Delta }_{min}}}$. For the noise injection mechanism, we select the noise vector ${\mathit{ϵ}}_{t_d}$ that maximizes alignment with the residual:

$${\mathit{ϵ}}_{t_d}=arg\underset{\mathit{ϵ}\in {\mathcal{C}}^g}{max}({\mathit{x}}_0-{\mathit{x}}_p)·\mathit{ϵ},$$

(32)

where the codebook ${\mathcal{C}}^g$ is parameterized by a grid size g and is regenerated after each iteration.

We record the model outputs ${\mathit{x}}_{t_n}$ at step $t_n$ and the corresponding noise vectors ${\mathit{ϵ}}_{t_n}$ at each iteration. Using a window size W, we compute the moving averages of these sequences, denoted as $\left\{{\mathit{x}}_{t_{n}w}\right\}$ and $\left\{{\mathit{ϵ}}_{t_{n}w}\right\}$. Zero-padding is applied where the sequence length is insufficient to fill the window. Finally, given a decision threshold $\tau$ and target step $t_a$, we classify a sample as a member of the training set if either of the following criteria is met:

$${∥{\mathit{ϵ}}_{t_{a}w}∥}_p<\tau ,$$

(33)

or:

$${∥{\mathit{x}}_{t_{a}w}-{\mathit{x}}_0∥}_p<\tau .$$

(34)

We term our proposed algorithm the Discrete Encoding-Based membership inference attack (DEB). The corresponding pseudocode is presented in Algorithm 1, and Figure 2 displays the overview of DEB.

Algorithm 1 Discrete Encoding-Based Membership Inference Attack
1: Input: The start time $T_s$, the end time $T_e$, maximum noise time ratio $r_{max}$, minimum noise time ratio $r_{min}$, ${\sigma }_{max}$ and $\rho$ for function r, total iteration number N, threshold $\tau$, sample ${\mathit{x}}_0$, DDPM model $\theta ({\mathit{x}}_t,t)$, init function $I({\mathit{x}}_0,t)$, codebook size K and codebook grid size g, attack time $t_a$, window size W, norm p. 2: Output: if ${\mathit{x}}_0$ is in member set. 3: ${\sigma }_t$_list = [], ${\Delta }_{max}=\lceil T_s·r_{max}\rceil$, ${\Delta }_{min}=\lceil T_s·r_{max}{r}_{min}\rceil$, $t_d={\Delta }_{max}$, $P={\Delta }_{max}-{\Delta }_{min}$ 4: repeat
5:    $t_d$_list.append([$t_d$] * $r(t_d,{\sigma }_{max},\rho ,T_s,{\Delta }_{min},{\Delta }_{max},P,N))$	▹ Equation (31)
6:    $t_d=t_d-1$ 7: until $t_d$==$\lceil T_s·r_{max}{r}_{\min }\rceil$ 8: sample ${\mathcal{C}}^g$
9: $n=0$, $t_n=T_s$, ${\mathit{x}}_{t_n}=I({\mathit{x}}_0,t_n,{\mathcal{C}}^g)$	▹ Equation (28) or Equation (29)
10: ${\mathit{x}}_p$_list = [], ${\mathit{ϵ}}_p$_list = [] 11: repeat 12:    $n=n+1$ 13:    sample ${\mathcal{C}}^g$
14:    $t_n=⌈{\displaystyle \frac{n}{N}}(T_e-T_s)+T_s⌉$	▹ Equation (27)
15:    $t_d=t_d$_list[n] 16:    ${\mathit{x}}_p,{\mathit{ϵ}}_p=\theta ({\mathit{x}}_{t_n},t_n)$
17:    ${\mathit{ϵ}}_{t_d}=arg{max}_{{\mathit{ϵ}}_{t_d}\in {\mathcal{C}}^g}({\mathit{x}}_0-{\mathit{x}}_p)·{\mathit{ϵ}}_{t_d}$	▹ Equation (32)
18:    ${\sigma }_{t_d}={\sigma }_t(t_d,t_n)$	▹ Equation (30)
19:    ${\mathit{x}}_{t_n}=s\left(t_n\right){\mathit{x}}_p+\sqrt{\mathrm{\Sigma }{\left(t_n\right)}^2-{\sigma }_{t_d}^2}{\mathit{ϵ}}_p+{\sigma }_{t_d}{\mathit{ϵ}}_{t_d}$ 20:    ${\mathit{x}}_p$_list.append(${\mathit{x}}_p$), ${\mathit{ϵ}}_p$_list.append(${\mathit{ϵ}}_p$) 21: until  $n==N$ 22: do DDIM 23: apply windowed averaging with size W to ${\mathit{x}}_p$_list and ${\mathit{ϵ}}_p$_list. 24: target $=\parallel {\mathit{x}}_p$_list[$t_a$]${\parallel }_p$ or target $=\parallel {\mathit{ϵ}}_p$_list[$t_a$]${\parallel }_p$ 25: if target $<\tau$ then 26:    return True 27: else 28:    return False 29: end if

4. Results

4.1. Attack Performance on Medical Images

We present the comprehensive evaluation results on the MedMNIST2D benchmark in

Table 3. MIA performance on a subset of the MedMNIST2D dataset. The best results are highlighted in bold, and the second-best results are underlined.

Methods	ChestMNIST		TissueMNIST		OrganAMNIST		OCTMNIST		PathMNIST
	AUC	T1F	AUC	T1F	AUC	T1F	AUC	T1F	AUC	T1F
Loss	98.3	51.4	57.4	1.1	86.4	15.8	89.6	13.0	53.9	1.2
SecMI	99.7	93.8	73.5	1.9	89.6	26.9	87.1	13.4	63.2	1.1
PIA	99.9	97.5	74.5	1.1	94.0	36.8	93.2	15.4	54.1	1.1
SimA	99.4	84.0	70.4	1.2	91.9	30.6	93.3	14.1	64.9	1.2
DEB	99.6	95.6	80.1	15.8	85.1	30.4	91.9	19.9	67.2	10.2

. To ensure a rigorous comparison, we optimized the baselines (Loss, SecMI, PIA, and SimA) by conducting a grid search over their hyperparameters and reporting the best results. For our proposed DEB method, we maintain a parameter configuration consistent with that used for natural images (DDPM settings), limiting our search space exclusively to the attack target time $t_a$.

As observed in our evaluations (Table 3), the susceptibility of models to membership inference attacks is highly correlated with the specific data modality. There are significant performance discrepancies across different datasets; for instance, models trained on ChestMNIST exhibit near-complete vulnerability, whereas those trained on PathMNIST demonstrate greater resilience.

To mitigate the risk of overestimating vulnerability due to potential instability in attack performance across different training subsets, we conducted a rigorous evaluation using six distinct data splits of the ChestMNIST dataset (

Table 4. Evaluation of MIA performance across six different data splits of the ChestMNIST dataset. The best results are highlighted in bold, and the second-best results are underlined.

Methods	ChestMNIST0		ChestMNIST1		ChestMNIST2
	AUC	T1F	AUC	T1F	AUC	T1F
Loss	98.1	47.7	98.1	49.3	98.1	51.7
SecMI	99.6	91.2	99.8	96.6	99.6	89.0
PIA	99.7	94.6	99.8	96.8	99.8	95.4
SimA	99.2	72.3	99.1	72.0	99.3	77.5
DEB	99.6	95.9	99.6	94.9	99.5	94.2
Methods	ChestMNIST3		ChestMNIST4		ChestMNIST5
	AUC	T1F	AUC	T1F	AUC	T1F
Loss	98.2	50.3	98.2	52.9	98.2	49.8
SecMI	99.9	98.0	99.7	92.7	99.8	95.0
PIA	99.8	97.2	99.7	94.3	99.8	96.2
SimA	99.3	77.9	99.2	73.8	99.1	71.1
DEB	99.7	95.6	99.5	94.4	99.5	92.6

). For each split, we trained an independent target model and subsequently evaluated the attack efficacy. As demonstrated in our results, the attack performance exhibits remarkable consistency across all six models. Especially, the AUC scores remain highly stable. This confirms that the observed vulnerabilities are intrinsic to the model and data modality rather than statistical anomalies arising from specific data sampling.

To investigate whether the variance in vulnerability across modalities simply stems from differing degrees of overfitting, we analyze the relationship between training loss and attack performance. Generally, for models of identical architecture trained on datasets of the same scale, the loss function can serve as a proxy for overfitting. However, as illustrated in Figure 3, there is no definitive correlation between the loss magnitude and empirical robustness. Notably, while OrganAMNIST presents the highest training loss, it is the second most vulnerable dataset. This further substantiates that attack efficacy is predominantly governed by the intrinsic characteristics of the medical imaging modality.

Furthermore, our proposed DEB method consistently demonstrates superior performance on more challenging datasets, such as TissueMNIST and PathMNIST (Table 3 and

Table 5. MIA performance on subset of MedMNIST2D dataset (w/o RandomHorizontalFlip). The best results are highlighted in bold, and the second-best results are underlined.

Methods	ChestMNIST		TissueMNIST		OrganAMNIST		OCTMNIST		PathMNIST
	AUC	T1F	AUC	T1F	AUC	T1F	AUC	T1F	AUC	T1F
Loss	100.0	100.0	96.3	31.4	97.5	63.2	98.0	27.2	80.1	1.2
SecMI	100.0	100.0	97.9	54.1	98.2	71.7	98.1	27.9	37.4	1.2
PIA	100.0	100.0	98.3	58.1	99.4	86.6	98.1	26.3	59.0	1.7
SimA	100.0	100.0	97.3	22.0	99.3	86.0	98.2	29.0	62.1	1.6
DEB	100.0	99.9	97.7	67.0	97.0	76.6	97.7	32.0	88.7	58.2

). This effectiveness is fundamentally tied to our attack methodology, which relies on the injection of semantic noise. Consequently, DEB necessitates that the target model has successfully learned robust, semantic-level features to be effective. In scenarios involving datasets with smaller scales where the model fails to capture comprehensive semantic representations, DEB may yield suboptimal results.

Another critical factor influencing model robustness is the application of data augmentation. A comparative analysis between models trained with RandomHorizontalFlip data augmentation (Table 3) and those trained without this augmentation (Table 5) reveals a stark contrast. Models incorporating this augmentation exhibit significantly enhanced robustness against MIAs. This underscores the profound impact of data augmentation strategies on the privacy profile of medical imaging models. We strongly advise model developers to rigorously evaluate how different data augmentations affect empirical robustness during the model design phase.

To confirm that our findings at the standard $28\times 28$ resolution are indicative of real-world scenarios, we extended our evaluation to $64\times 64$ resolution images (

Table 6. MIA performance on ChestMNIST and PathMNIST at a $64\times 64$ resolution (w/o RandomHorizontalFlip). The best results are highlighted in bold, and the second-best results are underlined.

Methods	ChestMNIST		PathMNIST
	AUC	T1F	AUC	T1F
Loss	100.0	100.0	83.2	1.5
SecMI	100.0	100.0	83.5	4.3
PIA	100.0	100.0	86.2	12.3
SimA	100.0	100.0	85.8	10.1
DEB	100.0	100.0	88.6	69.6

). The attack performance remains highly consistent across both resolutions. Moreover, according to Table 1, the classification accuracy of ResNet architectures on $224\times 224$ images differs from the $28\times 28$ images by only a marginal factor, typically within 2%. This minimal discrepancy validates that our evaluations at the $28\times 28$ resolution provide highly meaningful and transferable insights. We plan to systematically evaluate larger resolution datasets in future work.

Finally, we contextualize the applicable scenarios for our proposed attack. Our attack requires grey-box access, specifically the ability to query the model’s inputs and outputs during the generation process, and the grey-box attack cannot apply to pipelines which can only access the generated images. In the realm of diffusion models, numerous downstream applications—such as image classification [58] and image inpainting [29]—leverage the intermediate outputs of pre-trained generation processes. Consequently, model providers may expose these intermediate APIs to facilitate broader applicability. While adding noise to the output is a common defensive heuristic, we argue it is fundamentally unsuitable for medical domains. For diffusion models, multi-step iterative processes inherently amplify injected noise. More critically, perturbing medical images can induce fatal diagnostic errors, posing unacceptable risks of misdiagnosis to both practitioners and patients. Instead, as demonstrated by our earlier analysis, applying appropriate data augmentation strategies (such as RandomHorizontalFlip) during the training phase serves as a highly effective and non-destructive defense mechanism to inherently enhance the model’s resistance to MIAs. Given that the aforementioned applications typically utilize pre-trained models with low adaptation costs, we recommend that model providers refrain from exposing intermediate APIs unless strictly necessary. For specific client requirements, a joint-development paradigm with users that restricts API exposure to solely the final outputs can significantly enhance model security without compromising clinical utility.

4.2. Attack Performance on Natural Images

We summarize the performance on standard natural image benchmarks (CIFAR-10, CIFAR-100, and TinyImageNet) in

Table 7. MIA performance on CIFAR-10, CIFAR-100, and TinyImageNet datasets. The best results are highlighted in bold, and the second-best results are underlined.

Methods	CIFAR10		CIFAR100		TN-IN		Query
	AUC	T1F	AUC	T1F	AUC	T1F
GAN-Leaks	64.6	2.8	45.9	1.9	45.7	1.0	2000
Loss	84.7	6.9	82.3	9.6	84.9	10.0	1
SecMI	88.1	9.1	87.6	11.1	89.4	12.7	12
PIA	88.5	13.7	89.4	19.6	89.6	17.1	2
SimA	90.5	35.9	89.9	38.8	89.8	21.7	1
DEB	93.4	60.3	94.3	58.1	95.6	73.9	180

. DEB demonstrates a substantial performance advantage over existing methods. On CIFAR-10, DEB achieves a T1F of 60.3%, significantly outperforming the baseline SimA (35.9%). Similar improvements are observed on CIFAR-100 and TinyImageNet. It is important to acknowledge that DEB utilizes a higher query budget (180 queries) compared to baselines like PIA or SimA. However, in the context of grey-box MIA, such a query magnitude is practically feasible, making the significant gain in attack performance a worthwhile trade-off.

We further extend our evaluation to the text-to-image domain using Stable Diffusion on the Pokemon dataset, as detailed in

Table 8. MIA performance on the Stable Diffusion model under the Pokemon dataset. (none) means no groundthuth text. The best results are highlighted in bold, and the second-best results are underlined.

Methods	Weak Overfitting		Realistic Finetuning		Query
	AUC	T1F	AUC	T1F
Loss	79.6	6.0	66.0	2.82	1
SecMI	89.1	7.2	60.0	0.84	12
PIA	87.5	10.0	60.0	2.64	2
SimA	93.0	21.8	64.3	3.92	1
CLiD	99.3	97.8	93.3	61.4	15
DEB	97.5	86.8	83.2	30.0	140
DEB (none)	95.2	70.0	80.9	31.0	140

. Following the experiment setting established in CLiD [27], we assess two distinct training scenarios: a “weak overfitting” setting trained for 150,000 steps, and a “realistic finetuning” setting trained for 7500 steps.

In the weak overfitting scenario, DEB remains highly competitive. While CLiD achieves the highest performance (97.8% T1F), it is subject to severe constraints: it is exclusively applicable to text-to-image models and necessitates access to the groundtruth text prompts. In contrast, DEB is a modality-agnostic approach. Notably, even when we remove the text condition entirely—denoted as DEB (none)—our method still delivers robust performance. In the realistic fine-tuning setting, where overfitting is minimal, DEB (none) achieves a T1F of 31.0%, which is comparable to the supervised DEB (30.0%) and significantly higher than standard baselines. This highlights the ability of DEB, proving its effectiveness even in unconditional settings where specialized methods like CLiD are inapplicable.

4.3. Necessity of the Codebook Strategy

When initializing the diffusion process with the Equation (29), we observe that if the time step t is set to a small value, the noised samples retain a significant portion of the original semantic information. This observation raises a question: Can we simply rely on adding random Gaussian noise around the noised samples to consistently recover the target, thereby obviating the need for a codebook-based noise selection mechanism? To address this question and demonstrate the necessity of the codebook strategy, we conduct the following comparative experiments by injecting random noise:

• Type-1, Continuous Random Perturbation: We initialize the sample ${\mathit{x}}_t$ by sampling from the distribution ${\mathit{x}}_t\sim p_t\left({\mathit{x}}_t\right|{\mathit{x}}_0)p_{data}\left({\mathit{x}}_0\right)$ (i.e., adding noise to the original sample). In each iteration, we inject random Gaussian noise, perform a denoising step via the model, and then re-inject new noise for the subsequent step. Throughout this process, we record the model outputs and the reconstructed samples at each step.
• Type-2, Perturbation with Re-initialization: This setup shares the same initialization as the first method. However, to prevent the sample trajectory from deviating significantly from the original data point due to cumulative noise injection, we explicitly re-initialize the sample to the starting state ${\mathit{x}}_t$ after each denoising step. We similarly record the model outputs for each iteration.

Following the iterative perturbation phase described above, both methods proceed to execute a DDIM process. We record the intermediate results of this final denoising phase and incorporate them into the calculation of the AUC.

The quantitative results of these ablation studies are summarized in

Table 9. MIA performance of different noise injection type.

	CIFAR10	CIFAR100	TinyImageNet
Type-1	85.4	86.3	85.7
Type-2	82.3	83.1	83.0

. We observe that Type-1 (Continuous Random Perturbation) consistently outperforms Type-2 (Perturbation with Re-initialization) across all tested datasets. For instance, on CIFAR-10, Type-1 achieves an AUC of 85.4%, surpassing Type-2 by 3.1%. This suggests that allowing the sample to drift and explore the local manifold via continuous noise injection provides a more informative signal than the constrained re-initialization approach.

However, a substantial performance gap becomes evident when comparing these random noise strategies with our proposed DEB method. Despite Type-1 representing the optimal random perturbation baseline, it falls significantly short of the performance achieved by DEB. Referring back to the main results in Table 7, DEB attains an AUC of 93.4% on CIFAR-10, outperforming the random noise approach (Type-1) by a remarkable margin of 8.0%. Similar performance deficits are observed on CIFAR-100 and TinyImageNet. This empirical evidence underscores the limitation of unguided Gaussian noise: while it can perturb the sample, it lacks the directional specificity required to fully exploit the model’s memory. Consequently, the codebook-based strategy, which selects noise vectors that maximize alignment with the residuals, is proven to be strictly necessary for achieving better inference performance.

4.4. Parameters’ Sensitivity Analysis

Given the stability of the parameters observed across modalities, we utilized natural images as the primary testbed. To thoroughly evaluate the robustness of DEB and identify the optimal hyperparameter configuration, we conducted a sensitivity analysis on the CIFAR-10, CIFAR-100, and TinyImageNet datasets. In these experiments, we adopted a control variable approach: when analyzing specific parameters, all other hyperparameters were held constant. To expedite the evaluation process while ensuring statistical significance, we utilized a randomly sampled subset of 1024 samples (512 members and 512 non-members) rather than the full validation set for these ablation studies.

Impact of Noise Scheduling ($\rho ,{\sigma }_{max},r_{max},r_{min}$). We examined the parameters governing the noise allocation function $r(·)$ defined in Equation (31). As shown in Figure 4, the attack performance is sensitive to the time ratio range determined by $r_{max}$. Generally, a larger $r_{max}$ yields higher AUC, implying that aggregating information across a larger noise level enhances robustness. In contrast, the parameters $\rho$ and ${\sigma }_{max}$ exhibit high stability. As visualized in Figure 5, varying these parameters results in minimal fluctuations in AUC. We attribute this to the design of our iteration allocation function (Equation (31)): within the loop from ${\Delta }_{max}$ to ${\Delta }_{min}$, the function ensures that at least one iteration is performed for each step. This mechanism effectively mitigates the sensitivity to $\rho$ and ${\sigma }_{max}$, particularly when $r_{max}$ is sufficiently large.

Impact of Codebook Hyperparameters ($K,g$). The parameters of the codebook play a crucial role in noise injection. Figure 6a demonstrates that increasing the codebook size K improves performance up to a saturation point (around $K=64$, $K=128$ or 256), after which the gains diminish. Regarding the grid size g, Figure 6b shows that for low-resolution datasets like CIFAR ($32\times 32$), $g=2$ yields the optimal performance. Notably, in our experiments with the Stable Diffusion model (resolution $512\times 512$), we observed that a larger grid size ($g=4$) outperforms $g=2$. This indicates a positive correlation between the optimal grid size and the image resolution: larger images require a larger grid to effectively capture the discriminative information during noise selection.

Impact of Time Configuration ($T_s,T_e$). First, regarding the start ($T_s$) and end ($T_e$) time steps of the attack, our preliminary experiments on CIFAR-10 revealed that the performance difference between the setting $T_s=T_e$ and $T_s\ne T_e$ is negligible. Consequently, we adopted the simplified configuration $T_s=T_e$ for all subsequent experiments. We further investigated the impact of the specific choice of $T_s$, as illustrated in Figure 7a. The results indicate an inverted U-shaped trend: performance peaks when $T_s$ is set within the range of $[100,200]$ and degrades significantly as $T_s$ approaches either 0 or the maximum timestep T. This suggests that the membership signal is most prominent in the early-to-intermediate stages of the reverse diffusion process, whereas pure noise ($T\approx 1000$) or near-clean data ($T\approx 0$) contain less discriminative information.

Impact of Window Size (W). Finally, we analyze the effect of the window size W used for averaging the outputs. As shown in Figure 7b, the AUC increases rapidly as W grows from 1 to approximately 100, validating our hypothesis that accumulating statistical information over multiple steps significantly reduces variance compared to single-step attacks. Beyond this point, the performance plateaus, suggesting that a window size covering the most signal-rich temporal region is sufficient for effective membership inference.

Our sensitivity analysis reveals consistent behavioral patterns across all three datasets, demonstrating the stability of the proposed method. The performance of DEB is primarily governed by four key hyperparameters: the start time $T_s$, the maximum time ratio $r_{max}$, the window size W, and the codebook grid size g. Importantly, these parameters exhibit distinct and predictable regularities: $T_s$ should be selected to target the early-to-intermediate diffusion stages where membership signals are strongest; $r_{max}$ and W should be sufficiently large to maximize the accumulation of trajectory information; and g must be scaled in accordance with the image resolution. Conversely, other parameters such as $\rho$ and ${\sigma }_{max}$ show minimal impact on the final results, further attesting to the robustness of DEB and its ease of deployment.

4.5. Settings of Hyperparameters

In evaluating our proposed DEB method, we established two sets of hyperparameters based on the target model architecture, as detailed in

Table 10. Summary of MIA hyperparameters for the DDPM and Stable Diffusion architectures.

Hyperparameters	Model
	DDPM	Stable Diffusion
K	128	128
g	2	4
W	200	120
$T_s$	120	110
$T_e$	120	110
$r_{min}$	0.03	0.45
$r_{max}$	0.97	0.97
$\rho$	2.1	8
${\sigma }_{max}$	2.1	4

. Specifically, we applied one unified parameter configuration across all experiments involving the DDPM architecture (encompassing both natural and medical datasets at $32\times 32$ and $64\times 64$ resolutions). Similarly, we employed a second, unified set of parameters for all experiments utilizing the Stable Diffusion model. The only exception to these fixed configurations is the attack target time, $t_a$. To determine the optimal $t_a$, we utilized a validation split consisting of 256 member samples and 256 non-member samples, maintaining similar evaluation protocols described in [33,35]. To ensure a strictly fair comparison, the hyperparameter tuning for all baseline methods was conducted using this identical sample size.

Furthermore, we detail the model training hyperparameters and the associated computational overhead for the DDPM architecture in

Table 11. Detailed DDPM training hyperparameters and corresponding computational resource consumption across different image resolutions.

Hyperparameters	32 × 32	64 × 64
Optimizer	adam	adam
Optimizer-Scheduler	constant	cosine
LR	2 × ${10}^{-4}$	1 × ${10}^{-4}$
Training Steps	800k	800k
Batch Size	128	128
GPR	RTX 4090	RTX 4090
GPU RAM	10.5 G	24 G
Training Time	1 d 14 h	3 d 11 h
Precision	32FP	32FP
T	1000	1000
ch_mult	[1, 2, 2, 2]	[1, 1, 2, 2, 4, 4]
ch	128	128
${\beta }_1$	1 × ${10}^{-4}$	1 × ${10}^{-4}$
${\beta }_T$	0.02	0.02
num_res_blocks	2	2
attn	[1]	[4]
Attack Time (bs 128)	40 s	120 s
Attack GPU RAM (bs 128)	5 G	15 G

. We report the specific model configurations, GPU memory allocation, and total training time consumption for both $32\times 32$ and $64\times 64$ image resolutions. Alongside the training costs, we also record the resource consumption required to execute our attack method. Although DEB intrinsically requires a higher number of query iterations compared to standard baseline methods, the empirical results demonstrate that the overall attack duration and GPU memory requirements (e.g., 40 s and 5 GB RAM for a batch size of 128 at the $32\times 32$ resolution) remain highly manageable and computationally tractable for practical execution.

5. Discussion and Conclusions

In this paper, we presented a comprehensive evaluation of the membership inference privacy vulnerabilities of diffusion models across both natural and medical imaging domains. To address the limitations of existing grey-box attacks, we proposed the Discrete Encoding-Based membership inference attack (DEB). Our extensive evaluation—spanning standard natural image benchmarks, text-to-image models, and a refined subset of the MedMNIST benchmark—reveals that the susceptibility of diffusion models to membership inference is highly dependent on the specific data modality. We hypothesize that this variance in vulnerability arises from the distinct semantic variability and unique visual patterns inherent to different imaging distributions. Crucially, DEB significantly outperforms existing baselines by leveraging codebook-based noise injection to exploit the stability of samples. This capability is particularly evident on challenging datasets and in unconditional text-to-image settings where conventional methods severely struggle, demonstrating DEB’s effectiveness. Furthermore, because the attack frameworks in this paper actively exploit the intermediate states of the generation process, we strongly advise diffusion model providers to carefully evaluate the privacy risks associated with their API designs. Whenever feasible, providers should restrict access to intermediate generation steps to mitigate the threat of advanced membership inference attacks. Collectively, this study proposes a highly effective new MIA method and highlights the urgent need for robust, modality-aware defense mechanisms for diffusion models across diverse applications.

Limitations and Future Work. Despite its effectiveness, DEB requires a relatively higher query budget compared to single-step methods like SimA, primarily due to the need for computing statistical averages over the outputs. While this overhead is acceptable in typical grey-box auditing scenarios, it may constrain real-time applications. Future work will focus on optimizing the sampling efficiency of DEB, potentially by developing adaptive windowing strategies and new noise injection scheduler to reduce the query count without compromising inference accuracy. Additionally, extending the evaluation to 3D medical diffusion models is also a valuable field.