Computer-implemented method and determination device for determining whether a dataset of interest was used to fine-tune a specific generative artificial intelligence model

Abstract

Method for determining whether a dataset with images was used to fine-tune a specific AI model, the method comprising: (S1) performing N fine-tuning steps of the specific generative AI model on one selected image of interest of the dataset of interest, each i-th fine-tuning step including, wherein i is an integer and 1≤i≤N: (a) considering an i-th specific generative AI model if i=1, and fine-tuning the (i-1)- th specific generative AI model on the selected image of interest to obtain the i- th specific generative AI model if i≠1; (b) generating an i-th generated image with the i-th specific generative AI model using a prompt describing the selected image of interest; and (c) computing a distance between the i-th generated image and the selected image of interest; (S2) computing a distance vector including the distances generated in each i-th fine-tuning steps; and (S3) under consideration of the distance vector, determining whether the dataset of interest 20 was used to fine-tune the specific generative AI model.

Description

[0001] COMPUTER-IMPLEMENTED METHOD AND DETERMINATION DEVICE FOR DETERMINING WHETHER A DATASET OF INTEREST WAS USED TO FINE-TUNE A SPECIFIC GENERATIVE ARTIFICIAL INTELLIGENCE MODEL

[0002] TECHNICAL FIELD

[0003] The present invention is directed at a computer-implemented method for determining whether a dataset of interest was used to fine-tune a specific generative artificial intelligence (Al) model. The present invention is further directed at a determination device for determining whether a dataset of interest was used to fine-tune a specific generative Al model.

[0004] BACKGROUND ART

[0005] Generative Als have become essential digital task assistance tools. Their training and fine-tuning rely heavily on the collection of vast amounts of data, which may include copyright protected or sensitive information (such as of personally identifiable information, PH). It is therefore desirable to provide a tool for reliably determining whether a dataset of interest was used to fine-tune a specific generative Al model.

[0006] An objective of the present invention is the provision of a method and a determination device for determining whether a dataset of interest was used to fine-tune a specific generative Al model.

[0007] SUMMARY OF THE INVENTION

[0008] According to a first aspect, a computer-implemented method for determining whether a dataset of interest was used to fine-tune a specific generative artificial intelligence (Al) model is provided. The dataset of interest includes one or more images of interest. The method comprises:

[0009] (51) performing N fine-tuning steps of the specific generative Al model on one selected image of interest of the dataset of interest, each i-th fine-tuning step including, wherein i is an integer and 1<i<N:

[0010] (a) considering an i-th specific generative Al model which is an i-th fine-tuning instance of the specific generative Al model if i=1, and fine-tuning the (i-1 )-th specific generative Al model on the selected image of interest to obtain the i-th specific generative Al model if i^1 ;

[0011] (b) generating an i-th generated image with the i-th specific generative Al model using a prompt describing the selected image of interest; and (c) computing a distance between the i-th generated image and the selected image of interest;

[0012] (52) computing a distance vector including the distances generated in each i-th fine-tuning step; and

[0013] (53) under consideration of the distance vector, determining whether the dataset of interest was used to fine-tune the specific generative Al model.The method of the first aspect allows accurately determining whether the dataset of interest was used to fine-tune the specific generative Al model. This can give the owner of the dataset of interest a warranty that his dataset was not misused by unallowably fine-tuning the specific generative Al model therewith. The privacy and secrecy of the dataset of interest can thereby be ensured, and violations of privacy and intellectual property can be detected. The method of the first aspect is computer-implemented, meaning that is can conveniently be performed in an automatized manner.

[0014] As used herein, the expression “computer-implemented method” indicates that the method is realized using a computer, a computer network or another programmable apparatus, wherein the method is in particular implemented by executing a computer program on such a computer, computer network or other programmable apparatus.

[0015] The specific generative Al model can be a deep-learning model that can generate text, images or other content based on the data it was trained on. The specific generative Al model may be a diffusion model (which is trained through deep learning to progressively “diffuse” samples with random noise, then reverse that diffusion process to generate high-quality images) or any large language model (LLM), for example. Preferably, the specific generative Al model has been fine-tuned, which is the training process of adapting a pre-trained generative Al model for specific tasks or use cases. For example, a diffusion model for generating images can be fine-tuned to generate images of cats, using a large fine-tuning database involving images of cats.

[0016] The dataset of interest includes one or more images of interest. The image of interest can be of any format and type of image. Optionally, the dataset includes several images, so that the method of the first aspect can advantageously determine whether an entire dataset of interest was used to finetune the specific generative Al, or not.

[0017] The selected image of interest is in particular selected randomly from the dataset of interest. The specific generative Al model is fine-tuned on said selected image of interest in N subsequent fine-tuning steps. In each i-th fine-tuning step, an i-th specific generative Al model is considered (step (a)). If i=1, the i-th specific generative Al model that is considered corresponds to the specific generative Al model to be tested. If i^1 , before considering the i-th specific generative Al model, said i-th specific generative Al model is created by fine-tuning the (i-1 )-th specific generative Al model on the selected image of interest. Fine-tuning allows optimizing the specific generative Al model by training it specifically on the selected image of interest, thereby making the specific generative Al model more performant for images of the same type as the image of interest.

[0018] An image is then generated with the current instance of the specific generative Al model (i.e. with the i-th specific generative Al model) (step (b)). For this, a prompt describing the selected image ofinterest is used which can be either the original prompt that the specific generative Al model was fine-tuned with (assuming this information is available), or a prompt generated from an image-to-text model like BLIP. The distance between the i-th generated image and the selected image of interest is determined (step (c)). The steps (a) to (c) are repeated for each i, with 1<i<N. The 1stfine tuning step (i=1 ) does not include fine-tuning as such as the initial specific generative Al model is used but all subsequent fine-tuning steps (2ndto N-th fine-tuning steps) do.

[0019] The distance vector has N components, which correspond to the distances generated in each i-th fine tuning step. Whether the dataset of interest (and more specifically the selected image of interest) was used to fine-tune the specific generative Al model can be deduced from the determined distance vector. Examples for this determination will be described in the following.

[0020] According to an embodiment, the dataset of interest includes several images of interest, and the method comprises:

[0021] repeating the steps (S1) and (S2) such as to perform N fine-tuning steps of the specific generative Al model on each of the images of interest of the dataset of interest as the selected image of interest and such as to compute a distance vector for each of the selected images of interest; wherein

[0022] the step of determining (S3) whether the dataset of interest was used to fine-tune the specific generative Al model is further performed under consideration of the distance vectors computed for each of the selected images of interest.

[0023] In case that the dataset includes more than one image of interest, the process of steps (S1 ) and (S2) can be performed for each of the images of interest. Namely, the step (S1 ) including the steps (a) to (c) included therein is performed for each image of interest individually, and accordingly, a distance vector is calculated (S2) for each image of interest individually. All determined distance vectors are considered when determining whether the dataset was used to fine-tune the specific generative Al model. Thereby, the described method allows determining whether an entire dataset was used in the fine-tuning, rather than just an individual image of interest. In particular, the conditions for validating that a selected image of interest was used to fine-tune the specific generative Al model are different (in particular more restrictive) than the conditions for validating that the database of interest including several images of interest was used to fine-tune the specific generative Al model.

[0024] According to a further embodiment, determining (S3) whether the dataset of interest was used to fine-tune the specific generative Al model includes inputting the at least one distance vector into a trained classifier.

[0025] In particular, the trained classifier is trained such that when a distance vector is input into the classifier, the classifier outputs a binary result indicating either that the dataset of interest was usedto fine-tune the specific generative Al model, or that the dataset of interest was not used to fine-tune the specific generative Al model.

[0026] In order to determine whether the dataset of interest was used to fine-tune the specific generative Al model, the method of the first aspect may alternatively compare the distance vector with a threshold vector, and / or compare an average or mean of the components of the distance vector with a threshold value. Whether the dataset of interest was used to fine-tune the specific generative Al model can then be determined based on the result of the comparison.

[0027] According to a further embodiment, it is determined that the dataset of interest was used to fine-tune the specific generative Al model if the classifier outputs that more than a predefined number of distance vectors indicate that the corresponding selected image was part of the dataset of interest.

[0028] The predefined number of distance vectors can be a percentage of the total number of distance vectors, for example 80%, 90% or 95% of all distance vectors.

[0029] According to a further embodiment, the training of the classifier comprises:

[0030] (54) providing K shadow models, K being an integer and K>2, the shadow models preferably being machine learning models having the same architecture as the specific generative Al model, wherein each shadow model has a shadow dataset associated therewith, wherein the shadow dataset includes member shadow images with a label indicating that each of the member shadow images is a member and including non-member shadow images with a label indicating that each of the non-member shadow image is a non-member, wherein the shadow models are each fine-tuned on the member shadow images of the associated shadow dataset;

[0031] for each of the K shadow models:

[0032] (55) performing N fine-tuning steps of the shadow model on one selected member or non-member shadow image of the associated shadow dataset, each i-th fine-tuning step including:

[0033] (d) considering an i-th shadow model which is an i-th fine-tuning instance of the shadow model if i=1, and fine-tuning the (i-1 )-th shadow model on the selected shadow image to obtain the i-th shadow model if i^1;

[0034] (e) generating an i-th generated shadow image with the i-th shadow model using a prompt describing the selected shadow image; and

[0035] (f) computing a distance between the i-th generated image and the selected shadow image;

[0036] (56) computing the training distance vector including the distances generated in each of the i-th fine-tuning step of step (S5); and

[0037] (57) training the classifier using the training distance vectors and the corresponding label of the member or non-member shadow image used to fine-tune (S5) the shadow model to compute (S6) the training distance vector.The present embodiment describes how the classifier is trained. In detail, training data for training the classifier needs to be obtained. The training data is here in particular formed by the shadow dataset and the computed corresponding training distance vectors.

[0038] The K shadow models can be machine learning models having the same architecture as the specific generative Al model. The shadow model is preferably also of the same type as the specific generative Al model (i.e. diffusion model, LLM, etc.). Each shadow model can be associated with a shadow dataset. The shadow dataset is in particular a dataset which has the same data distribution as the dataset used to train the specific generative Al model. The shadow dataset can include member shadow images and non-member shadow images. “Member” here designates that the member shadow image was used to fine-tune the corresponding shadow model, while “non-member” here indicates that the non-member shadow image was not used to fine-tune the corresponding shadow model. Optionally, the method of the present embodiment includes fine-tuning the shadow model using the member shadow image(s) of the associated shadow dataset.

[0039] For each of the K shadow models, it is known with which member shadow images it has been finetuned. This property can be used to generate training distance vectors for the member shadow images and for the non-member shadow images and associating the training distance vector with the “member” or “non-member” label. The value of the integer number “K” can depend on factors such as the type of specific generative Al model and on whether the distribution of the training data thereof is known. Usually, K is at least 5, and more is better.

[0040] As such, for each of the K shadow models, the steps (d) to (f) are performed in a step (S5), said steps (d) to (f) being substantially the same as the steps (a) to (c) described in view of step (S1 ).

[0041] Namely, for each of the K shadow models, a selected member or non-member shadow image is selected, in particular randomly, from the shadow dataset associated with the shadow model. The shadow model is fine-tuned on said selected shadow image in N subsequent fine-tuning steps, wherein the integer N is preferably the same as described in step (S1). In each i-th fine-tuning step, an i-th shadow model (which is a specific shadow model in its i-th fine-tuning state) is considered (step (d)). If 1=1 , the i-th shadow model that is considered corresponds to one of the shadow models in its initial state. If i^1, before considering the i-th shadow model, said i-th shadow model is created by fine-tuning the (i-1 )-th shadow model. Fine-tuning allows optimizing the shadow model by training it specifically on the selected shadow image, thereby making the shadow model more performant for images of the same type as the selected shadow image.

[0042] A generated shadow image is then generated with the current instance of the shadow model (i.e. with the i-th shadow model) (step (b)). For this, a prompt describing the selected shadow image isused which can be either the original prompt that the specific generative Al model was fine-tuned with (assuming this information is available), or a prompt generated from an image-to-text model like BLIP. The distance between the i-th generated shadow image and the selected shadow image is determined (step (c)). The steps (a) to (c) are repeated for each i, with 1 <i<N. The 1stfine tuning step (i=1) does not include fine-tuning as such as the initial shadow model is used but all subsequent fine-tuning steps (2ndto N-th fine-tuning steps) do.

[0043] The training distance vector has the same format as the distance vector described in view of step (S2). The training distance vector has N components, which correspond to the distances generated in each i-th fine tuning step. The training data used to train the classifier includes the computed training distance vectors as well as the associated labels indicating whether they are related to “members” or “non-members”. The reliability of the classifier can be improved by increasing the quantity of training data.

[0044] According to a further embodiment, the method further comprises repeating the steps (S5) and (S6) such as to perform the N fine-tuning steps of the shadow model on different selected member or non-member shadow images and such as to accordingly compute the training distance vector for each of the selected member or non-member shadow images.

[0045] Preferably, a training distance vector is computed for each of the member and non-member shadow images associated with each shadow model. The reliability of the classifier can be improved by increasing the quantity of training data.

[0046] According to a further embodiment, the number N is an integer between 5 and 30, more preferably between 10 and 20.

[0047] According to a further embodiment, the distance between the i-th generated image and the selected image of interest, and / or the distance between the i-th generated shadow image and the selected member or non-member shadow image is:

[0048] a pixel-wise distance;

[0049] an embedding distance; and / or

[0050] a concatenated distance which is a combination of the pixel-wise distance and the embedding distance.

[0051] The pixel-wise distance can be a one-to-one comparison of pixels of the compared images and can correspond to a Euclidean distance between the compared distances. The embedding distance can be computed by creating the embedding vectors of both compared images (for example generated using a ResNet-18 model) and calculating the Euclidean distance between those vectors. Theconcatenated distance can be an average between the pixel-wise distance and the embedding distance, for example.

[0052] According to a further embodiment, the specific generative Al model is a specific diffusion model.

[0053] According to a second aspect, a computer program product is provided, which is stored on a machine-readable media and comprises machine readable instructions for executing the method according to the first aspect or any embodiment thereof.

[0054] All features described in view of the first aspect or any embodiment thereof also hold for the computer program product of the second aspect.

[0055] According to a third aspect, a determination device for determining whether a dataset of interest was used to fine-tune a specific generative artificial intelligence (Al) model is provided, the dataset of interest including one or more images of interest, the determination device including:

[0056] a fine-tuning unit for performing N fine-tuning steps of the specific generative Al model on one selected image of interest of the dataset of interest, each i-th fine-tuning step including wherein i is an integer and 1<i<N:

[0057] (a) considering an i-th specific generative Al model which is an i-th fine-tuning instance of the specific generative Al model if i=1, and fine-tuning the (i-1 )-th specific generative Al model on the selected image of interest to obtain the i-th specific generative Al model if i^1 ;

[0058] (b) generating an i-th generated image with the i-th specific generative Al model using a prompt describing the selected image of interest; and (c) computing a distance between the i-th generated image and the selected image of interest;

[0059] a computation unit for computing a distance vector including the distances generated in each i-th fine-tuning steps; and

[0060] a result determination unit for determining, under consideration of the distance vector, whether the dataset of interest was used to fine-tune the specific generative Al model.

[0061] All features described in view of the first aspect or any embodiment thereof also hold for the determination device of the third aspect.

[0062] According to an embodiment, the determination device is configured to perform the method steps of the method according to the first aspect or any embodiment thereof.The present invention will be described more fully hereinafter with reference to the accompanying figures in which like numerals represent like elements throughout the different figures, and in which prominent aspects and features of the invention are illustrated.

[0063] BRIEF DESCRIPTION OF THE FIGURES

[0064] Fig. 1 shows a method for determining whether a dataset of interest was used to fine-tune a specific generative artificial intelligence model;

[0065] Fig. 2 shows details of step S1 of the method of Fig. 1;

[0066] Fig. 3 shows a method for training a classifier to be used in the method of Fig. 1 ;

[0067] Fig. 4 shows details of the training phase to train the classifier as part of the method of Fig. 3; and

[0068] Fig. 5 shows an embedding distance against a number of fine-tuning steps.

[0069] DETAILED DESCRIPTION

[0070] The solution as described herein introduces a novel MIA (membership interference attack) approach designed for generative models (generative Al models). In the example described herein, the solution is targeted at latent diffusion models (LDM) as the generative Al model. The described solution leverages the fine-tuning process, utilizing memorization in weights and gradients, without the need for direct access to the model.

[0071] The attacker uses the described solution to fine-tune the target model (the generative Al model) on the target (tested) image (image of interest). The target model is a fine-tuned model whose dataset is suspected of containing leaked data. Following each training iteration, the attacker uses the model to generate an image and computes the distance between the generated image and the target image. This process is repeated N times for members and non-members, resulting in a vector of N sequential distances. These distance vectors are generated for k shadow models, which are then used to train a classifier. To determine membership, the features extracted from the target model are tested with the classifier. This solution will be described in more detail in the following.

[0072] Given a diffusion model M fine-tuned on dataset D and a sample s consisting of an image (image of interest) and its corresponding prompt p, the goal is to determine whether s e D. This is achieved by analyzing the model’s behavior (by computing the distances described later in this section) when it is fine-tuned on the sample s. It is hypothesized that a diffusion model fine-tuned on a single sample s when the solution described herein is performed will behave differently when applied to a sample from the training set (member) compared to a sample not included in the training set (non-member). The analysis in Fig. 5 supports this hypothesis, presenting the embedding distance ED for member samples (dashed curve) and non-member samples (continuous curve) against the number N of fine-tuning steps when performing the solution described herein. For the member images, the averagedistance reaches a minimum (overfiting) after 40 instances of fine-tuning, whereas for the nonmember images, the minimum is achieved after 60 instances.

[0073] The described attack leverages the ability to fine-tune the model remotely (e.g., via an application programming interface, API) in order to determine membership, unlike traditional MIA methods that rely on loss values to determine this. This allows to perform the MIA without direct access to the model’s weights or internal outputs. Platforms that provide such remote fine-tuning capabilities, like OpenArt, facilitate this approach.

[0074] Two threat models are considered based on the attacker’s knowledge:

[0075] • Complete knowledge: The atacker targets an LDM and has access to both the image and the original prompt used to train the model.

[0076] • Image-only: The attacker targets an LDM but only has access to the image, without the corresponding prompt.

[0077] The approach consists of two phases: a training phase and a testing phase. Each phase employs a feature extraction method tailored to a specific architecture.

[0078] The following feature extraction algorithm 1 is used both to generate features (referred to as attack features) from shadow models which are used to train a classifier to perform an MIA and to test the classifier with features that are extracted similarly from the target model.

[0079] Algorithm 1:

[0080] Require: Target image It, prompt P, target model M, number of fine-tuning steps N

[0081]

[0082] 3: lg< — Generatelmage(M, P)

[0083] 4: d <— ComputeDistance(lg, It)

[0084] 5: D.append(d)

[0085] 6: M <— FineTuneModel(M, It, P)

[0086] 7: end for

[0087] 8: return D

[0088] The algorithm’s input consists of a target image, an image caption (prompt), a target model, and the number of fine-tuning steps. To extract the features, the algorithm also iteratively generates images, computes the distance between the generated images and the target image, and fine-tunes the model. The algorithm’s output is a set of attack features comprised of the following distances for each fine-tuning step:• Pixel-wise distance, which is the L2 (Euclidean) distance between the generated and target images’ pixel values.

[0089] • Embedding distance, which is computed by creating the embedding vectors of both the target and generated images using a ResNet-18 model and applying the L2 (Euclidean) distance on those two vectors.

[0090] • Concatenated distance, which is a combination of both the pixel-wise and embedding distances.

[0091] In the image-only threat model, where the original prompt is unavailable, BLIP (bootstrapping language-image pre-training) is used to generate a substitute prompt before performing algorithm 1.

[0092] Details about how algorithm 1 is used in the context of the testing phase are described in view of Fig.

[0093] 1 and 2. Fig. 1 shows a computer-implemented method for determining whether a dataset of interest including an image of interest was used to fine-tune a specific generative Al model (i.e. for determining whether s e D). Step S1 of Fig. 1 is further described under reference to Fig. 2, which shows details of said step S1.

[0094] Namely, step S1 includes performing N fine-tuning steps of the specific generative Al model D on one selected image of interest s of the dataset of interest, each i-th fine-tuning step including (herein i is an integer and 1 <i<N):

[0095] (a) considering an i-th specific generative Al model if i=1 , and fine-tuning the (i-1 )-th specific generative Al model to obtain the i-th specific generative Al model on the selected image of interest if i^1;

[0096] (b) generating an i-th generated image with the i-th specific generative Al model using a prompt describing the selected image of interest; and

[0097] (c) computing a distance between the i-th generated image and the selected image of interest.

[0098] As shown in Fig. 2, for i=1, the 1stspecific generative Al model Di is considered, which corresponds to the specific generative Al model for which the membership is to be tested (step (a)). Using a prompt generated from an image-to-text model when the target image (image to be tested) It is input, the 1stspecific generative Al model Di is used to create a 1stgenerated image lg_i, which is here an image of a man (step (b)). A pixelwise distance di between the 1stgenerated image lg_i and the target image It is then calculated (step (c)). These steps (a) - (c) are repeated for each i. Namely, for i=2, the 2ndspecific generative Al model D2 is generated by fine-tuning the 1stspecific generative Al model Dt in a fine-tuning step FT1 (step (a)). Using the same prompt as for i=1, the 2ndspecific generative Al model D2 is used to create a 2ndgenerated image lg_2, which is here an image of a woman with glasses (step (b)). A pixelwise distance d2 between the 2ndgenerated image lg_2 and the target image It is then calculated (step (c)). For i=N-1 , the (N-1 )-th specific generative Al model DN-I is generated by fine-tuning the (N-2)-th specific generative Al model DN-2 fine-tuning step FTN-2 (step (a)). Usingthe same prompt as for i=1 and i=2, the (N-1 )-th specific generative Al model DN-I is used to create an (N-1 )-th generated image I9_N-I , which is here an image of a woman looking straight (step (b)). A pixelwise distance dN-i between the (N-1 )-th generated image lg_N-i and the target image It is then calculated (step (c)). For i=N, the N-th specific generative Al model DN is generated by fine-tuning the (N-1 )-th specific generative Al model DN-I fine-tuning step FT N-I (step (a)). Using the same prompt as for all preceding i’s, the N-th specific generative Al model DN is used to create an N-th generated image lg_N, which is here an image of a woman looking sideways and is very similar to the target image It (step (b)). A pixelwise distance dN between the N-th generated image lg_N and the target image It is then calculated (step (c)).

[0099] In a step S2 of Fig. 1, a distance vector including the distances di, d2, ... dN from step S1 as components is created, i.e. the distance vector is <dt , d2, ... du). In a step S3, it is determined whether the dataset of interest was used to fine-tune the specific generative Al model under consideration of the distance vector. This is achieved by inputting the distance vector into a classifier C which outputs either that the target image was used to fine-tune the generative Al model, or that it was not used to fine-tune the generative Al model.

[0100] Details about how algorithm 1 is used in the context of the training phase are described in view of Fig. 3 and 4. In detail, Fig. 3 and 4 show how the above-described classifier C is trained. In a step S4, K shadow models SM1 - SMK are provided, K being an integer and K>2 (here, K=10). A shadow model effectively replicates the target model’s D behaviour in order to provide features F that are used to train the classifier C that can distinguish between member and non-member instances. The architecture of the shadow models is the same as the target model; the training dataset derived for the shadow model has the same data distribution as the training dataset used to create the target model. Each shadow model has a shadow dataset associated therewith, wherein the shadow dataset includes member shadow images (MSI, striped pattern in Fig. 4) with a label indicating that each of the member shadow images is a member and including non-member shadow images (NMSI, dotted pattern in Fig. 4) with a label indicating that each of the non-member shadow image is a non-member, wherein the shadow models are each fine-tuned FT on the member shadow images of the associated shadow dataset.

[0101] For each of the K shadow models, the method of Fig. 3 includes a step S5 with steps (d) to (f). Namely, in step S5, N fine-tuning steps of each of the shadow models are performed for each of the member shadow image MSI and for each of the non-member shadow image NMSI individually, the member shadow image MSI and the non-member shadow image NMSI forming a selected shadow image. Each i-th fine-tuning step includes, for 1<i<N:

[0102] (d) considering an i-th shadow model if i=1 , and fine-tuning the (i-1 )-th shadow model to obtain the i-th shadow model on the selected shadow image if i^1;(e) generating an i-th generated shadow image with the i-th shadow model using a prompt describing the selected shadow image; and

[0103] (f) computing a distance between the i-th generated image and the selected shadow image.

[0104] In other words, the steps (d) to (f) correspond to algorithm 1 (alg. 1) and to the steps (a) to (c) described above in view of Fig. 2 but for selected shadow images and their corresponding shadow model.

[0105] In step S6, the training distance vector including the distances generated in each of the i-th fine-tuning steps of step S5 is computed. In step S7, the classifier is trained using the training distance vectors and their corresponding labels.

[0106] In many cases, data owners may want to determine whether their proprietary dataset has been leaked and used to train a diffusion model without their consent (rather than just an individual image). This section explains how the above solution can be used to identify whether an entire dataset was part of the fine-tuning dataset (referred to as a dataset-level MIA) based on the assumption that entire datasets are either fully included in or excluded from the training set. T o implement the solution on the dataset level, the following steps are performed:

[0107] 1. Use the trained classifier to classify each instance (image of interest) in the tested dataset. 2. Calculate the number of instances classified as members.

[0108] 3. Compare this number to a predetermined threshold to determine whether the entire dataset was part of the fine-tuning dataset.

[0109] Since the classifier is applied to each instance separately, it is assumed that the results for individual instances are not dependent on one another. This assumption of independence allows to model the number of positive classifications as a binomial distribution. For a threshold t, a classifier with accuracy p, and n samples in the dataset (group size), we can use the following formula to calculate the probability of the dataset being classified as leaked:

[0110] >

[0111]

[0112] where X is the number of instances classified as members. For example, consider a member dataset with a size of 11, a threshold t = 6 (indicating a majority vote), and a classifier that has accuracy of 90%. In this scenario, we would achieve a true positive rate (TPR) of over 99% for identifying the dataset as being part of the model’s training set. It is important to note that we can control the TPR and true negative rate (TNR) of our dataset-level MIA by adjusting the threshold t presented in the above equation. This approach provides a robust and practical method for detecting dataset leakagein real-world scenarios where entire datasets are more likely to be compromised than individual instances.

[0113] The above disclosed subject-matter is to be considered illustrative, and not restrictive, and serves to provide a better understanding of the invention defined by the independent claims. The methods as described in view of Fig. 1 and 3 can be performed by a dedicated determination device.

Claims

CLAIMS1. A computer-implemented method for determining whether a dataset of interest was used to fine-tune a specific generative artificial intelligence (Al) model, the dataset of interest including one or more images of interest, the method comprising:(51) performing N fine-tuning steps of the specific generative Al model on one selected image of interest of the dataset of interest, each i-th fine-tuning step including, wherein i is an integer and 1<i<N:(a) considering an i-th specific generative Al model which is an i-th fine-tuning instance of the specific generative Al model if i=1, and fine-tuning the (i-1 )-th specific generative Al model on the selected image of interest to obtain the i-th specific generative Al model if i^1 ;(b) generating an i-th generated image with the i-th specific generative Al model using a prompt describing the selected image of interest; and(c) computing a distance between the i-th generated image and the selected image of interest;(52) computing a distance vector including the distances generated in each i-th fine-tuning step; and(53) under consideration of the distance vector, determining whether the dataset of interest was used to fine-tune the specific generative Al model.

2. The method according to claim 1, wherein the dataset of interest includes several images of interest, the method comprising:repeating the steps (S1 ) and (S2) such as to perform N fine tuning steps of the specific generative Al model on each of the images of interest of the dataset of interest as the selected image of interest and such as to compute a distance vector for each of the selected images of interest; whereinthe step of determining (S3) whether the dataset of interest was used to fine-tune the specific generative Al model is further performed under consideration of the distance vectors computed for each of the selected images of interest.

3. The method according to claim 1 or 2, wherein determining (S3) whether the dataset of interest was used to fine-tune the specific generative Al model includes inputting the at least one distance vector into a trained classifier.

4. The method according to claim 3, wherein it is determined that the dataset of interest was used to fine-tune the specific generative Al model if the classifier outputs that more than a predefined number of distance vectors indicate that the corresponding selected image was part of the dataset of interest.

5. The method according to claim 3 or 4, wherein the training of the classifier comprises: (54) providing K shadow models, K being an integer and K>2, the shadow models preferably being machine learning models having the same architecture as the specific generative Al model, wherein each shadow model has a shadow dataset associated therewith, wherein the shadow dataset includes member shadow images with a label indicating that each of the member shadow images is a member and including non-member shadow images with a label indicating that each of the non-member shadow image is a non-member, wherein the shadow models are each fine-tuned on the member shadow images of the associated shadow dataset;for each of the K shadow models:(55) performing N fine-tuning steps of the shadow model on one selected member or non-member shadow image of the associated shadow dataset, each i-th fine-tuning step including:(d) considering an i-th shadow model which is an i-th fine-tuning instance of the shadow model if i=1, and fine-tuning the (i-1 )-th shadow model on the selected shadow image to obtain the i-th shadow model if i^1;(e) generating an i-th generated shadow image with the i-th shadow model using a prompt describing the selected shadow image; and(f) computing a distance between the i-th generated image and the selected shadow image;(56) computing the training distance vector including the distances generated in each of the i-th fine-tuning step of step (S5); and(57) training the classifier using the training distance vectors and the corresponding label of the member or non-member shadow image used to fine-tune (S5) the shadow model to compute (S6) the training distance vector.

6. The method according to claim 5, further comprising repeating the steps (S5) and (S6) such as to perform the N fine-tuning steps of the shadow model on different selected member or non-member shadow images and such as to accordingly compute the training distance vector for each of the selected member or non-member shadow images.

7. The method according to any one of claims 1 to 6, wherein the number N is an integer between 5 and 30, more preferably between 10 and 20.

8. The method according to any one of claims 1 to 7, wherein the distance between the i-th generated image and the selected image of interest, and / or the distance between the i-th generated shadow image and the selected member or non-member shadow image is:a pixel-wise distance;an embedding distance; and / ora concatenated distance which is a combination of the pixel-wise distance and the embedding distance.

9. The method according to any one of claims 1 to 8, wherein the specific generative Al model is a specific diffusion model.

10. A computer program product stored on a machine-readable media and comprising machine readable instructions for executing the method according to any one of claim 1 to 9.

11. A determination device for determining whether a dataset of interest was used to fine-tune a specific generative artificial intelligence (Al) model, the dataset of interest including one or more images of interest, the determination device including:a fine-tuning unit for performing N fine-tuning steps of the specific generative Al model on one selected image of interest of the dataset of interest, each i-th fine-tuning step including, wherein i is an integer and 1 <i<N :(a) considering an i-th specific generative Al model which is an i-th fine-tuning instance of the specific generative Al model if i=1, and fine-tuning the (i-1 )-th specific generative Al model on the selected image of interest to obtain the i-th specific generative Al model if i^1 ;(b) generating an i-th generated image with the i-th specific generative Al model using a prompt describing the selected image of interest; and (c) computing a distance between the i-th generated image and the selected image of interest;a computation unit for computing a distance vector including the distances generated in each i-th fine-tuning steps; anda result determination unit for determining, under consideration of the distance vector, whether the dataset of interest was used to fine-tune the specific generative Al model.

12. The determination device according to claim 11, which is configured to perform the method steps of any one of claims 1 to 9.

Images