Fei Kong

The rapid adoption of diffusion models in medical imaging has raised significant concerns regarding data privacy, especially their susceptibility to Membership Inference Attacks (MIAs). However, the privacy risks associated with diffusion models in the medical domain remain underexplored compared to natural images. In this study, we propose a novel grey-box attack framework, termed the Discrete Encoding-Based Membership Inference Attack (DEB), inspired by Denoising Diffusion Codebook Models (DDCM). DEB injects semantically meaningful noise via a discrete codebook strategy and identifies training samples by analyzing the model’s output trajectory under this discrete encoding, specifically measuring the average of intermediate predictions across selected time steps. We conduct an evaluation of MIAs across natural images and five representative datasets from the MedMNIST collection. Our experiments reveal that the susceptibility of diffusion models is highly dependent on the data modality; for instance, while certain datasets exhibit near-complete vulnerability, others like PathMNIST demonstrate strong inherent resistance to MIAs. Furthermore, DEB demonstrates superior performance compared to existing baselines (e.g., SecMI, PIA, SimA), particularly on challenging datasets. For example, DEB achieves a True Positive Rate at 1% False Positive Rate (TPR @ 1% FPR) of 60.3% on CIFAR-10, significantly outperforming the SimA baseline (35.9%). Notably, even on the highly resistant PathMNIST dataset, DEB attains a 10.2% TPR @ 1% FPR, establishing a substantial advantage over the PIA baseline (1.1%). This work provides practical insights into the privacy risks inherent in diffusion models and emphasizes that model providers should carefully assess these vulnerabilities when exposing intermediate generation APIs.