Diffusion models have achieved tremendous success in image generation, but they also raise significant concerns regarding privacy and copyright issues. Membership Inference Attacks (MIAs) are designed to ascertain whether specific data was utilized during a model's training phase. As current MIAs for diffusion models typically exploit the model's image prediction ability, we formalize them into a unified general paradigm that computes the membership score for membership identification. Under this paradigm, we empirically find that existing attacks overlook the inherent deficiency in how diffusion models process high-frequency information. Consequently, this deficiency leads to member data with more high-frequency content being misclassified as hold-out data, and hold-out data with less high-frequency content tends to be misclassified as member data. Moreover, we theoretically demonstrate that this deficiency reduces the membership advantage of attacks, thereby interfering with the effective discrimination of member data and hold-out data. Based on this insight, we propose a plug-and-play high-frequency filter module to mitigate the adverse effects of the deficiency, which can be seamlessly integrated into any attacks within the general paradigm without additional time costs. Extensive experiments corroborate that this module significantly improves the performance of baseline attacks across different datasets and models. Code is available at https://github.com/poetic2/FreMIA.

翻译：扩散模型在图像生成领域取得了巨大成功，但也引发了严重的隐私与版权问题。成员推断攻击旨在确定特定数据是否被用于模型训练阶段。针对当前扩散模型的成员推断攻击通常利用模型的图像预测能力，我们将其形式化为一个统一的通用范式，通过计算成员分数进行成员身份识别。在该范式下，我们通过实验发现现有攻击忽略了扩散模型在处理高频信息时固有的缺陷。这一缺陷导致包含更多高频内容的成员数据被误判为留存数据，而高频内容较少的留存数据则更易被误判为成员数据。此外，我们从理论上证明该缺陷会降低攻击的成员优势，从而干扰对成员数据与留存数据的有效区分。基于这一发现，我们提出一种即插即用的高频滤波器模块，用于缓解该缺陷的不利影响。该模块可无缝集成到通用范式内的任意攻击中，且无需额外时间成本。大量实验证实，该模块在不同数据集和模型上均能显著提升基线攻击的性能。代码已开源至 https://github.com/poetic2/FreMIA。