Latent Diffusion Inversion Requires Understanding the Latent Space
This work addresses privacy risks for users of diffusion-based generative models by providing a new perspective on memorization, though it is incremental as it builds on existing inversion techniques.
The paper tackled the problem of model inversion in latent diffusion models by analyzing memorization patterns in latent codes, finding that non-uniform memorization occurs in high-distortion regions and varies across dimensions, and introduced a method to rank dimensions for improved membership inference attacks, resulting in average AUROC gains of 2.7% and TPR@1%FPR increases of 6.42% across multiple datasets.
The recovery of training data from generative models (``model inversion'') has been extensively studied for diffusion models in the data domain. The encoder/decoder pair and corresponding latent codes have largely been ignored by inversion techniques applied to latent space generative models, e.g., Latent Diffusion models (LDMs). In this work we describe two key findings: (1) The diffusion model exhibits non-uniform memorization across latent codes, tending to overfit samples located in high-distortion regions of the decoder pullback metric. (2) Even within a single latent code, different dimensions contribute unequally to memorization. We introduce a principled method to rank latent dimensions by their per-dimensional contribution to the decoder pullback metric, identifying those most responsible for memorization. Empirically, removing less-memorizing dimensions when computing attack statistics for score-based membership inference attacker significantly improves performance, with average AUROC gains of 2.7\% and substantial increases in TPR@1\%FPR (6.42\%) across diverse datasets including CIFAR-10, CelebA, ImageNet-1K, Pokémon, MS-COCO, and Flickr. This indicates stronger confidence in identifying members under extremely low false-positive tolerance. Our results highlight the overlooked influence of the auto-encoder geometry on LDM memorization and provide a new perspective for analyzing privacy risks in diffusion-based generative models.