A membership inference method based on text-guided sensitivity

Abstract

This invention discloses a membership inference method based on text-guided sensitivity. It converts the image and text to be detected into initial latent variables using a variational autoencoder of a target text-based image diffusion model. After setting a target time step and the number of Monte Carlo sampling iterations, random noise is injected in each iteration to generate noisy latent variables. Conditional and unconditional dual-path prediction is performed using the target text-based image diffusion model to construct a guiding vector representing the text guidance direction and a true residual vector representing objective error correction. The geometric alignment of these two vectors is calculated as a single score, and the arithmetic mean of multiple samples is used to obtain the final inference score. Finally, this score is compared with a preset discrimination threshold to determine membership. This invention eliminates the interference of noise modulus through normalized geometric alignment, achieving high accuracy and robustness in model privacy risk auditing with low query costs.

Description

Technical Field

[0001] This invention relates to the technical field of artificial intelligence security and privacy protection, and in particular to a membership inference method based on text-guided sensitivity. Background Technology

[0002] With the development of deep learning technology, textural image diffusion models have made significant progress in the field of multimodal image synthesis. Their powerful generation capabilities heavily rely on massive amounts of training data containing privacy information. Therefore, data security auditing for textural image diffusion models has become particularly important. Membership inference methods are a type of privacy risk assessment and copyright detection method. They are primarily used to determine whether a sample is used to train a target model. If it is, the sample is considered a member sample of the target model; otherwise, it is considered a non-member sample. Membership inference methods for textural image diffusion models are specifically used to determine whether an input image is used to train the target textural image diffusion model.

[0003] While existing research on membership inference methods for text-generated image diffusion models has made some progress, there is limited work on analyzing textual conditional control mechanisms and removing interference from inherent image features. Consequently, most unsupervised inference methods based on absolute error values ​​are highly susceptible to interference from high-frequency details and texture complexity within the image itself when quantifying memory features, leading to extremely high false positive rates for non-member samples, which inherently have high reconstruction difficulty. Furthermore, existing methods often neglect the core multimodal interaction characteristic of text-controlled generation in text-generated image diffusion models, and some methods relying on conditional likelihood difference assessment require dozens of repeated samplings, incurring high model query costs. To address these technical problems, this invention proposes a membership inference method based on text-guided sensitivity. It delves into the gradient guidance mechanism within the diffusion model, utilizing the geometric alignment between the text guidance direction and the true residual direction under dual-path prediction to guide the generation of inference scores. This preserves directional consistency association features while normalizing the noise magnitude, effectively eliminating interference from image complexity. This significantly reduces parameter query complexity while achieving highly robust membership inference. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings and deficiencies of the prior art and propose a membership inference method based on text-guided sensitivity. This method can effectively remove the interference of image complexity and noise modulus on memory feature measurement, deeply explore the multimodal interaction between text condition control and image denoising direction, improve the accuracy and robustness of membership inference, and significantly reduce the computational cost of model query.

[0005] To achieve the above objectives, the technical solution provided by this invention is: a membership inference method based on text-guided sensitivity, comprising the following steps:

[0006] S1: Acquire the image to be detected and the corresponding text description Using the variational autoencoder of the target text-image diffusion model to process the image Encoding is performed to transform the image in pixel space into initial latent variables in a low-dimensional latent space. ;

[0007] S2: Set target time step Monte Carlo sampling number The target time step The intermediate stage of the diffusion process is selected, and variables used for the final member inference score are initialized. ;

[0008] S3: The loop process of performing Monte Carlo sampling: First, sample a random noise vector from the standard normal distribution. And combined with initial latent variables Generate target time step Noisy latent variables Subsequently, a dual-path prediction was performed using the target text-based image diffusion model to obtain predictions based on the text description. Conditional predictive noise And unconditional prediction noise based on empty text ,based on , and Constructing a guiding vector representing the direction of text guidance and the true residual vector representing the true error correction direction Then, the geometric alignment between the two is calculated as a single sensitivity score;

[0009] S4: Repeat the loop process of step S3 for a total of Each time, the arithmetic mean of the sensitivity scores in each round is calculated as the final member inference score. ,Will The discrimination threshold derived from the distribution statistics of non-member data Compare the fractions Above the threshold Then determine the image Members of the training set of the target text image diffusion model are considered; otherwise, the image is considered invalid. It is not a member of the training set of the target text image diffusion model.

[0010] Furthermore, in step S3, noisy latent variables are generated. The process follows the forward-noisy Markov chain property of the diffusion model, and the calculation formula is:

[0011] ;

[0012] In the formula, Indicates the elapsed target time step The diffused noisy latent variable serves as the common input for subsequent dual-path prediction; Representing an image Initial latent variables after being encoded by a variational autoencoder; This represents a noise vector generated by random sampling that follows a standard normal distribution, and its dimension is... Maintain consistency; This represents the target time step, and its value ranges from 30% to 60% of the total time step to ensure the signal-to-noise ratio. This indicates the noise variance scheduling parameters preset in the target text image diffusion model at time [time value missing]. The cumulative product of these factors determines the proportion of the original image retained versus the proportion of input noise.

[0013] Furthermore, in step S3, the dual-path prediction utilizes a classifier-free guidance strategy to simultaneously acquire two sets of noisy prediction values, and constructs a feature vector accordingly. The specific implementation method is as follows:

[0014] First, the noisy latent variables The denoising network of the target text image diffusion model is input, with the input condition being text description. Conditional Predictive Noise in Time Output When the input condition is empty text, the output is unconditional predicted noise. ;

[0015] Subsequently, the guiding vector is constructed. The calculation formula is:

[0016] ;

[0017] The vector In a physical sense, this characterizes the gradient correction direction generated by the target text-based image diffusion model relative to the semantic-free state after receiving textual semantic information; that is, the guiding trend of the text on image generation remembered by the target text-based image diffusion model. Simultaneously, it constructs the true residual vector. The calculation formula is as follows:

[0018] ;

[0019] The vector This characterizes the target text-generated image diffusion model's ability to reproduce the real injected noise in the absence of textual cues. The required direction of objective error correction;

[0020] Finally, the calculated guiding vector With the true residual vector Together, they form the basic feature space for subsequent geometric alignment calculations.

[0021] Furthermore, in step S3, the calculation of the single sensitivity score employs a normalized cosine similarity algorithm, aiming to eliminate the interference of noise magnitude on the discrimination. The calculation formula is as follows:

[0022] ;

[0023] In the formula, Indicates the first Single sensitivity score in a cycle; numerator Represents the guiding vector With the true residual vector The dot product operation quantifies the consistency of the projections of two vectors in a direction; the denominator part Represents the guiding vector Euclidean norm and true residual vector The product of the Euclidean norms is used to normalize the magnitude of the dot product, thereby eliminating the influence of magnitude expansion caused by high image texture complexity or strong gradient signals, and ensuring that the score only reflects the degree of alignment in the geometric direction. This is a preset, extremely small constant used to prevent division operations from failing when the vector magnitude is zero, thus ensuring the stability of the calculation;

[0024] when When the value is close to 1, it means that the direction of the text guidance vector is geometrically highly coincident with the residual direction that the target image diffusion model needs to correct in order to recover the real image. This indicates that the internal parameters of the target image diffusion model have a deep memory of the text conditional control rules of the image and can accurately use text information to guide the denoising process, thus it is judged as a member sample; conversely, when the value is close to 1, it means that the direction of the text guidance vector is geometrically highly coincident with the direction of the residual direction that the target image diffusion model needs to correct in order to recover the real image. This indicates that the internal parameters of the target image diffusion model have a deep memory of the text conditional control rules of the image and can accurately use text information to guide the denoising process, thus it is judged as a member sample; When the value is close to 0 or even negative, it means that the direction of the text guidance appears chaotic, with a large angle or even the opposite direction from the actual direction that needs to be corrected. This reflects that the target text-based image diffusion model has not established an effective association between the image and the text, and the introduction of text conditions has not produced the expected correction guidance effect. Therefore, it is judged as a non-member sample. Through this geometric alignment method, high evaluation consistency and attack robustness can be maintained in scenarios with different noise intensities, different image complexities, and different training stages.

[0025] Furthermore, in step S4, the specific implementation process of calculating the final member inference score and determining member status adopts the Monte Carlo integration concept to eliminate random errors. The calculation formula is as follows:

[0026] ;

[0027] In the formula, Indicates the final score inferred by the members; This represents the total number of Monte Carlo sampling rounds, optimally set to 3 to 6. This number is chosen to balance inference stability and computational cost, offsetting the random noise injected in each sampling by averaging multiple samples. Fluctuations in a single forecast due to differences; Indicates the first The sensitivity score is calculated from round sampling; the final decision logic is: if... Greater than the discrimination threshold Then it is considered that the input image to be detected is... These are member samples used to train the target image diffusion model; otherwise, the input image to be detected is considered to be... These are not member samples used to train the target text image diffusion model.

[0028] Further, in step S4, the discrimination threshold The method for determining it is as follows:

[0029] Construct an independent validation dataset not included in the training set of the target image diffusion model. This dataset contains non-member images with the same distribution as those in the training set. Calculate the member inference score for each image in the validation dataset using steps S1-S4, forming a statistical distribution of non-member scores. Based on a preset false alarm rate tolerance (FPR) for the actual application scenario, select the corresponding percentile score from the non-member score distribution as the discrimination threshold. If the false alarm rate tolerance is set to 1%, then the threshold is... This is the value corresponding to the 99th percentile in the non-member score distribution. Any score higher than this value will be considered a statistically significant outlier from the non-member distribution and thus be classified as a member sample; conversely, any score lower than this value will be classified as a member sample.

[0030] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0031] 1. This invention boasts significant advantages in high accuracy and low false alarm rate. Existing member inference methods based on prediction loss or reconstruction error are highly susceptible to the influence of high-frequency details and texture complexity of the image itself, resulting in a persistently high false alarm rate for non-member samples, which are difficult to generate. This invention successfully eliminates the interference of noise modulus on memory feature measurement by calculating the geometric alignment between the text guidance direction and the true residual direction and utilizing the normalization property of cosine similarity. This mechanism focuses on mining the deep multimodal interactive memory of the model, thus maintaining an excellent member sample detection rate even under the stringent condition of extremely low false alarm rate.

[0032] 2. This invention significantly reduces the computational cost of querying the target text-based image diffusion model while ensuring inference accuracy. Addressing the drawback of methods that rely heavily on conditional likelihood difference assessment, which require extensive repeated sampling leading to high auditing costs, this invention cleverly combines a dual-path prediction mechanism with Monte Carlo integration to reduce random errors. Only three to six samplings are needed to achieve convergence of the sensitivity score, keeping the number of accesses to the target text-based image diffusion model extremely low. This greatly improves the algorithm's execution efficiency, enabling low-cost, scalable application in data privacy compliance auditing and copyright detection for large-scale generative artificial intelligence. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the logical flow of the method of the present invention.

[0034] Figure 2 This is a schematic diagram of the principle framework of the method of this invention. This represents the image to be detected. Represents a variational autoencoder, and represents the actual injected noise. ∅ indicates an empty input condition, ∅ indicates an input with text description, and U-Net is an abbreviation for Target Text-Based Image Diffusion Model. The input condition is a text description. Conditional prediction noise of the output time, It is the unconditional prediction noise in the output when the input condition is empty text. It is a guiding vector. It is the true residual vector. Indicates the first Single sensitivity score in a cycle; numerator Represents the guiding vector With the true residual vector The dot product operation, the denominator part Represents the guiding vector Euclidean norm and true residual vector The product of Euclidean norms.

[0035] Figure 3This is a schematic diagram illustrating the input and output of the method of the present invention for accessing the diffusion model of the target text image.

[0036] Figure 4 This is a graph showing the score distribution of member samples and non-member samples when the method of this invention is tested on the COCO dataset. Detailed Implementation

[0037] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0038] like Figures 1 to 4 As shown, this embodiment discloses a membership inference method based on text-guided sensitivity. The overall logical flow of this method includes four steps: Step S1 is the data preparation stage, which involves acquiring the image to be detected and its text description and encoding it; Step S2 is the parameter setting stage, which involves setting the target time step and the number of Monte Carlo samplings for the diffusion process; Step S3 is the core calculation stage, which involves injecting random noise into the latent variables and performing conditional and unconditional dual-path prediction to calculate the cosine similarity between the text-guided direction and the true residual direction as a sensitivity score; Step S4 is the result determination stage, which involves obtaining the final membership inference score by taking the average value of multiple rounds of Monte Carlo sampling and comparing it with the discrimination threshold to complete the membership determination. Figure 3 As shown, the method of this invention only requires accessing the inference interface of the target text image diffusion model in a black-box manner. The input is the image to be detected and its corresponding text description, and the output is the noise prediction results of the model under conditional and unconditional conditions. It does not require obtaining the model's internal parameters or training process information. The specific details are as follows:

[0039] S1: Acquire the image to be detected and the corresponding text description Using the variational autoencoder of the target text-image diffusion model to process the image Encoding is performed to transform the image in pixel space into initial latent variables in a low-dimensional latent space. ;

[0040] S2: Set target time step Monte Carlo sampling number The target time step The intermediate stage of the diffusion process is selected, and variables used for the final member inference score are initialized. ;

[0041] S3: The loop process of performing Monte Carlo sampling: First, sample a random noise vector from the standard normal distribution. And combined with initial latent variables Generate target time step Noisy latent variables Then as Figure 2 As shown, a dual-path prediction is performed using the target text-to-image diffusion model to obtain predictions based on the text description. Conditional predictive noise And unconditional prediction noise based on empty text ,based on , and Constructing a guiding vector representing the direction of text guidance and the true residual vector representing the true error correction direction Then, the geometric alignment between the two is calculated as a single sensitivity score;

[0042] Generate noisy latent variables The process follows the forward-noisy Markov chain property of the diffusion model, and the calculation formula is:

[0043] ;

[0044] In the formula, Indicates the elapsed target time step The diffused noisy latent variable serves as the common input for subsequent dual-path prediction; Representing an image Initial latent variables after being encoded by a variational autoencoder; This represents a noise vector generated by random sampling that follows a standard normal distribution, and its dimension is... Maintain consistency; This represents the target time step, and its value ranges from 30% to 60% of the total time step to ensure the signal-to-noise ratio. This indicates the noise variance scheduling parameters preset in the target text image diffusion model at time [time value missing]. The cumulative product of these factors determines the proportion of the original image retained versus the proportion of input noise.

[0045] The dual-path prediction utilizes a classifier-free guidance strategy to simultaneously acquire two sets of noisy prediction values, and constructs a feature vector based on these values. The specific implementation method is as follows:

[0046] First, the noisy latent variables The denoising network of the target text image diffusion model is input, with the input condition being text description. Conditional Predictive Noise in Time Output When the input condition is empty text, the output is unconditional predicted noise. ;

[0047] Subsequently, the guiding vector is constructed. The calculation formula is:

[0048] ;

[0049] The vector In a physical sense, this characterizes the gradient correction direction generated by the target text-based image diffusion model relative to the semantic-free state after receiving textual semantic information; that is, the guiding trend of the text on image generation remembered by the target text-based image diffusion model. Simultaneously, it constructs the true residual vector. The calculation formula is as follows:

[0050] ;

[0051] The vector This characterizes the target text-generated image diffusion model's ability to reproduce the real injected noise in the absence of textual cues. The required direction of objective error correction;

[0052] Finally, the calculated guiding vector With the true residual vector Together, they form the basic feature space for subsequent geometric alignment calculations.

[0053] The single-test sensitivity score is calculated using a normalized cosine similarity algorithm, which aims to eliminate the interference of noise magnitude on the discrimination. The calculation formula is as follows:

[0054] ;

[0055] In the formula, Indicates the first Single sensitivity score in a cycle; numerator Represents the guiding vector With the true residual vector The dot product operation quantifies the consistency of the projections of two vectors in a direction; the denominator part Represents the guiding vector Euclidean norm and true residual vector The product of the Euclidean norms is used to normalize the magnitude of the dot product, thereby eliminating the influence of magnitude expansion caused by high image texture complexity or strong gradient signals, and ensuring that the score only reflects the degree of alignment in the geometric direction. This is a preset, extremely small constant used to prevent division operations from failing when the vector magnitude is zero, thus ensuring the stability of the calculation;

[0056] when When the value is close to 1, it means that the direction of the text guidance vector is geometrically highly coincident with the residual direction that the target image diffusion model needs to correct in order to recover the real image. This indicates that the internal parameters of the target image diffusion model have a deep memory of the text conditional control rules of the image and can accurately use text information to guide the denoising process, thus it is judged as a member sample; conversely, when the value is close to 1, it means that the direction of the text guidance vector is geometrically highly coincident with the direction of the residual direction that the target image diffusion model needs to correct in order to recover the real image. This indicates that the internal parameters of the target image diffusion model have a deep memory of the text conditional control rules of the image and can accurately use text information to guide the denoising process, thus it is judged as a member sample; When the value is close to 0 or even negative, it means that the direction of the text guidance appears chaotic, with a large angle or even the opposite direction from the actual direction that needs to be corrected. This reflects that the target text-based image diffusion model has not established an effective association between the image and the text, and the introduction of text conditions has not produced the expected correction guidance effect. Therefore, it is judged as a non-member sample. Through this geometric alignment method, high evaluation consistency and attack robustness can be maintained in scenarios with different noise intensities, different image complexities, and different training stages.

[0057] S4: Repeat the loop process of step S3 for a total of Each time, the arithmetic mean of the sensitivity scores in each round is calculated as the final member inference score. ,Will The discrimination threshold derived from the distribution statistics of non-member data Compare the fractions Above the threshold Then determine the image Members of the training set of the target text image diffusion model are considered; otherwise, the image is considered invalid. It is not a member of the training set of the target text image diffusion model.

[0058] The specific implementation process for calculating the final member inference score and determining membership status adopts the Monte Carlo integration concept to eliminate random errors. The calculation formula is as follows:

[0059] ;

[0060] In the formula, Indicates the final score inferred by the members; This represents the total number of Monte Carlo sampling rounds, optimally set to 3 to 6. This number is chosen to balance inference stability and computational cost, offsetting the random noise injected in each sampling by averaging multiple samples. Fluctuations in a single forecast due to differences; Indicates the first The sensitivity score is calculated from round sampling; the final decision logic is: if... Greater than the discrimination threshold Then it is considered that the input image to be detected is... These are member samples used to train the target image diffusion model; otherwise, the input image to be detected is considered to be... These are not member samples used to train the target text image diffusion model.

[0061] The discrimination threshold The method for determining it is as follows:

[0062] Construct an independent validation dataset not included in the training set of the target image diffusion model. This dataset contains non-member images with the same distribution as those in the training set. Calculate the member inference score for each image in the validation dataset using steps S1-S4, forming a statistical distribution of non-member scores. Based on a preset false alarm rate tolerance (FPR) for the actual application scenario, select the corresponding percentile score from the non-member score distribution as the discrimination threshold. If the false alarm rate tolerance is set to 1%, then the threshold is... This is the value corresponding to the 99th percentile in the non-member score distribution. Any score higher than this value will be considered a statistically significant outlier from the non-member distribution and thus be classified as a member sample; conversely, any score lower than this value will be classified as a member sample.

[0063] like Figure 4 The figure shows the probability density distribution of inference scores for member samples and non-member samples when the method of the present invention is tested on the COCO dataset. As can be seen from the figure, the inference score distribution of member samples is significantly biased towards higher score regions, while the inference score distribution of non-member samples is concentrated in lower score regions, with a significant separation interval between the two types of sample score distributions. This distribution characteristic indicates that the method of the present invention can effectively distinguish between member samples and non-member samples: member samples obtain higher inference scores because the target text-image diffusion model memorizes the correspondence between its image and text during training, resulting in a high cosine similarity between the text guidance direction and the true residual direction; while non-member samples, not having participated in model training, lack an effective alignment relationship between the text guidance direction and the true residual direction, thus resulting in lower inference scores. Based on the above differences in the score distribution of the two types of samples, by selecting an appropriate percentile value as the discrimination threshold on the non-member score distribution, high-precision, low-false-positive-rate member identification determination can be achieved.

[0064] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A membership inference method based on text-guided sensitivity, characterized in that, Includes the following steps: S1: Acquire the image to be detected and the corresponding text description Using the variational autoencoder of the target text-image diffusion model to process the image Encoding is performed to transform the image in pixel space into initial latent variables in a low-dimensional latent space. ; S2: Set target time step Monte Carlo sampling number The target time step The intermediate stage of the diffusion process is selected, and variables used for the final member inference score are initialized. ; S3: The loop process of performing Monte Carlo sampling: First, sample a random noise vector from the standard normal distribution. And combined with initial latent variables Generate target time step Noisy latent variables Subsequently, a dual-path prediction was performed using the target text-based image diffusion model to obtain predictions based on the text description. Conditional predictive noise And unconditional prediction noise based on empty text ,based on , and Constructing a guiding vector representing the direction of text guidance and the true residual vector representing the true error correction direction Then, the geometric alignment between the two is calculated as a single sensitivity score; S4: Repeat the loop process of step S3 for a total of Each time, the arithmetic mean of the sensitivity scores in each round is calculated as the final member inference score. ,Will The discrimination threshold derived from the distribution statistics of non-member data Compare the fractions Above the threshold Then determine the image Members of the training set of the target text image diffusion model are considered; otherwise, the image is considered invalid. It is not a member of the training set of the target text image diffusion model.

2. The membership inference method based on text-guided sensitivity according to claim 1, characterized in that, In step S3, noisy latent variables are generated. The process follows the forward-noisy Markov chain property of the diffusion model, and the calculation formula is: ； In the formula, Indicates the elapsed target time step The diffused noisy latent variable serves as the common input for subsequent dual-path prediction; Representing an image Initial latent variables after being encoded by a variational autoencoder; This represents a noise vector generated by random sampling that follows a standard normal distribution, and its dimension is... Maintain consistency; This represents the target time step, and its value ranges from 30% to 60% of the total time step to ensure the signal-to-noise ratio. This indicates the noise variance scheduling parameters preset in the target text image diffusion model at time [time value missing]. The cumulative product of these factors determines the proportion of the original image retained versus the proportion of input noise.

3. The membership inference method based on text-guided sensitivity according to claim 1, characterized in that, In step S3, the dual-path prediction uses a classifier-free guidance strategy to simultaneously acquire two sets of noisy prediction values, and constructs a feature vector accordingly. The specific implementation method is as follows: First, the noisy latent variables The denoising network of the target text image diffusion model is input, with the input condition being text description. Conditional Predictive Noise in Time Output When the input condition is empty text, the output is unconditional predicted noise. ; Subsequently, the guiding vector is constructed. The calculation formula is: ； The vector In a physical sense, it represents the gradient correction direction generated by the target text-generated image diffusion model relative to the semantic-free state after receiving text semantic information, that is, the guiding trend of the text on image generation remembered by the target text-generated image diffusion model. Simultaneously construct the true residual vector The calculation formula is as follows: ； The vector This characterizes the target text-generated image diffusion model's ability to reproduce the real injected noise in the absence of textual cues. The required direction of objective error correction; Finally, the calculated guiding vector With the true residual vector Together, they form the basic feature space for subsequent geometric alignment calculations.

4. The membership inference method based on text-guided sensitivity according to claim 1, characterized in that, In step S3, the single sensitivity score is calculated using a normalized cosine similarity algorithm to eliminate the interference of noise magnitude on the discrimination. The calculation formula is as follows: ； In the formula, Indicates the first Single sensitivity score in a round-robin cycle; Molecular part Represents the guiding vector With the true residual vector The dot product operation quantifies the consistency of the projections of two vectors in a direction; the denominator part Represents the guiding vector Euclidean norm and true residual vector The product of the Euclidean norms is used to normalize the magnitude of the dot product, thereby eliminating the influence of magnitude expansion caused by high image texture complexity or strong gradient signals, and ensuring that the score only reflects the degree of alignment in the geometric direction. This is a preset, extremely small constant used to prevent division operations from failing when the vector magnitude is zero, thus ensuring the stability of the calculation; when When the value is close to 1, it means that the direction of the text guidance vector is geometrically highly coincident with the residual direction that the target image diffusion model needs to correct in order to recover the real image. This indicates that the internal parameters of the target image diffusion model have a deep memory of the text conditional control rules of the image and can accurately use text information to guide the denoising process, thus it is judged as a member sample; conversely, when the value is close to 1, it means that the direction of the text guidance vector is geometrically highly coincident with the direction of the residual direction that the target image diffusion model needs to correct in order to recover the real image. This indicates that the internal parameters of the target image diffusion model have a deep memory of the text conditional control rules of the image and can accurately use text information to guide the denoising process, thus it is judged as a member sample; When the value is close to 0 or even negative, it means that the direction of the text guidance appears chaotic, with a large angle or even the opposite direction from the actual direction that needs to be corrected. This reflects that the target text-based image diffusion model has not established an effective association between the image and the text, and the introduction of text conditions has not produced the expected correction guidance effect. Therefore, it is judged as a non-member sample. Through this geometric alignment method, high evaluation consistency and attack robustness can be maintained in scenarios with different noise intensities, different image complexities, and different training stages.

5. The membership inference method based on text-guided sensitivity according to claim 1, characterized in that, In step S4, the specific implementation process of calculating the final member inference score and determining member status adopts the Monte Carlo integration method to eliminate random errors. The calculation formula is as follows: ； In the formula, Indicates the final score inferred by the members; This represents the total number of Monte Carlo sampling rounds, optimally set to 3 to 6. This number is chosen to balance inference stability and computational cost, offsetting the random noise injected in each sampling by averaging multiple samples. Fluctuations in a single forecast due to differences; Indicates the first The single sensitivity score obtained from round sampling calculation; The final decision logic is: if Greater than the discrimination threshold Then it is considered that the input image to be detected is... These are member samples used to train the target image diffusion model; otherwise, the input image to be detected is considered to be... These are not member samples used to train the target text image diffusion model.

6. The membership inference method based on text-guided sensitivity according to claim 1, characterized in that, In step S4, the discrimination threshold The method for determining it is as follows: Construct an independent validation dataset not included in the training set of the target image diffusion model. This dataset contains non-member images with the same distribution as those in the training set. Calculate the member inference score for each image in the validation dataset using steps S1-S4, forming a statistical distribution of non-member scores. Based on a preset false alarm rate tolerance (FPR) for the actual application scenario, select the corresponding percentile score from the non-member score distribution as the discrimination threshold. ; If the false alarm rate tolerance is set to 1%, then the threshold is... This is the value corresponding to the 99th percentile in the non-member score distribution. Any score higher than this value will be considered a statistically significant outlier from the non-member distribution and thus be classified as a member sample; conversely, any score lower than this value will be classified as a member sample.

Images