PaperlayerView exact revision on arXiv

Source-linked AI summary

Where Flow Matching Leaks: Characterising Membership Signals Along the Interpolation Path

Thomas Sesmat, Gabriel Meseguer-Brocal, Geoffroy Peeters

arXiv:2606.07271v3cs.LGcs.AIcs.SD

TL;DR

The paper asks how generative models can retain exploitable training-data traces despite stable aggregate metrics and no verbatim reproduction. It analyzes these membership signals along Flow Matching’s interpolation path, finding a universal bell-shaped train–test reconstruction gap and a theoretically predictable peak under stated assumptions. The resulting λ-resolved structure supports membership inference and suggests a privacy–efficiency trade-off.

  • Problem

    Aggregate training metrics may show no overfitting even when models encode exploitable training-data information, leaving membership signals insufficiently understood for Flow Matching.

  • Method

    The paper analyzes train–test reconstruction errors along Xλ = (1−λ)X0 + λX1, derives the peak location under Gaussian assumptions, and tests the predictions across modalities and model settings.

  • Results

    The membership signal has a universal bell-shaped profile over λ, while the closed-form peak prediction holds when the Gaussian assumptions are satisfied; its λ-resolved errors enable membership inference.

  • Takeaways & Limitations

    Membership leakage in Flow Matching can accumulate without standard diagnostics revealing it, and its structured location can inform targeted privacy mechanisms.

  • Takeaways & Limitations

    The theory assumes independent coupling and near-Gaussian isotropic latents, while the demonstrated attack uses white-box access and unconditional generation.

Abstract

from arXiv · show

Understanding memorization in generative models remains challenging, with implications for copyright and privacy. Beyond verbatim reproduction, models can encode subtler traces of their training data that never surface in their outputs yet remain exploitable. We refer to these measurable asymmetries as the \emph{membership signal}, and we study this regime for Flow Matching, which are increasingly used in deployed generative systems. We analyze the linear interpolation path $X_λ= (1-λ)X_0 + λX_1$ that defines standard Flow Matching training. We show that a gap exists between the reconstruction of train and test data that follows a bell-shaped curve over $λ$, which accumulates during training, while the validation metrics remain stable. The signal has a maximum whose location we derive in closed form under Gaussian assumptions. We validate these predictions on both audio and images and show that the bell-shaped structure is universal, while the peak prediction holds when our assumptions are satisfied. As a proof of concept, we exploit this specific $λ$-resolved structure to perform a Membership Inference Attack, distinguishing members of the training set from non-members.

1. Introduction

The paper studies membership signals in Flow Matching beyond verbatim reproduction, focusing on how train–test reconstruction differences vary along the linear interpolation path. It proposes a λ-resolved analysis, derives the signal’s peak under theory, and validates the structure across modalities.

  • Motivation: Membership signals are measurable asymmetries in how models treat training and held-out data, even without reproducing training samples.Examples include more accurate reconstruction or greater confidence near training data.
  • Motivation: Aggregate loss curves may remain stable while models encode training-data information, leaving the location and mechanism of the signal unresolved for Flow Matching.The paper highlights the difference between deterministic interpolation and iterative diffusion denoising.
  • Approach: The analysis examines Xλ = (1−λ)X0 + λX1 from pure noise at λ = 0 to data at λ = 1, emphasizing the intermediate regime where velocity prediction uses learned structure.The model predicts velocity along the interpolation path to characterize train–test behavior.
  • Theory: The train–test reconstruction gap isolates a correlation with sample-specific residuals, follows a bell-shaped curve over λ, and peaks where linear information about velocity vanishes.At the peak, the model must fit nonlinear structure that is statistically indistinguishable from sample-specific noise.
  • Validation: Experiments across audio and image datasets, latent spaces, architectures, and noise configurations support a universal bell shape, while peak-location prediction depends on the Gaussian assumptions.The peak location is governed by data geometry, whereas model choices affect signal magnitude.

2. Related Work

Related work places the paper within research on memorization, trajectory-dependent leakage, and membership inference. The paper extends trajectory analysis from iterative diffusion to Flow Matching and provides a theoretical explanation for the signal’s location.

  • Flow Matching: Flow Matching learns velocity fields through regression on interpolated samples, producing straighter noise-to-data paths and supporting generation in fewer steps.Rectified Flow is discussed alongside Flow Matching as a related framework.
  • Memorization: Prior memorization work spans verbatim reproduction, similarity spectra, counterfactual definitions, and statistical traces that can persist without exact copying.The paper focuses on train–test distinguishability as a subtle, exploitable form of memorization.
  • Membership signals: Membership signals can occur without visible overfitting and are therefore not fully characterized by aggregate loss behavior.The related work also notes that memorization may support generalization on long-tailed distributions.
  • Trajectory-dependent leakage: Diffusion studies find trajectory-dependent vulnerability, with intermediate timesteps often carrying the strongest membership-inference signal.Existing methods such as SecMI and PIA rely on iterative denoising structure and do not transfer directly to Flow Matching.
  • Novelty: This work extends the trajectory perspective to linear Flow Matching by deriving a peak location λF from data statistics rather than identifying it only empirically.The proposed analysis grounds the trajectory-dependent signal theoretically.

3. Mathematical Setup

The mathematical setup defines independent noise and data variables, the interpolation path, the optimal velocity predictor, and train–test loss decompositions. It identifies irreducible variance and a residual-correlation term as the basis for analyzing membership asymmetry.

  • Distributions and predictors: The framework treats the optimal predictor as a deterministic conditional-expectation function determined by the noise and data distributions.The analysis conditions on a fixed trained model when studying train–test behavior.
  • Distributions and predictors: The irreducible variance depends only on the underlying distributions and is a lower bound on expected squared error for every model.Because the optimal predictor is used, additional model capacity cannot reduce this component.
  • Training and test sets: Training and test sets are sampled independently, while the trained velocity model is fixed after conditioning on the training data and training randomness.The setup defines sample-specific training quantities and analogous fresh test quantities.
  • Loss decomposition: The train–test gap is decomposed after conditioning on the training set, isolating a cross-correlation term associated with the model’s deviation from the optimal predictor.This term is generically nonzero on training data under the stated proposition.
  • Loss decomposition: The membership signal is the correlation between the model’s deviation from the optimal predictor and training-specific residuals.The formulation separates this signal from other components of the train–test gap.
  • Linear prediction: Under jointly Gaussian variables, the optimal predictor is linear, whereas non-Gaussian data distributions may introduce a nonlinear component.The cross-covariance measures how strongly the interpolant predicts velocity through linear regression.

4. Theoretical Analysis

The analysis identifies where Flow Matching’s membership signal concentrates along λ and explains why standard losses can miss it. Under Gaussian assumptions, the signal peaks where linear information is minimal, while broader cases are supported heuristically.

  • Critical point: The cross-covariance norm is a convex parabola in λ with a unique minimum, defining a critical interpolation position.Under isotropy, the cross-covariance vanishes exactly at this point.
  • Critical point: At the isotropic critical point, the optimal linear predictor vanishes and Xλ carries no linear information about the velocity.This forces the model to rely on nonlinear features.
  • Scope: For non-Gaussian distributions and nonlinear models, the paper provides heuristic arguments and empirical validation rather than the same formal guarantee.The peak location depends continuously on covariance matrices, suggesting robustness to moderate deviations from exact Gaussianity or isotropy.
  • Membership signal: The membership signal measures the correlation between model error and sample-specific residuals, isolating the train–test reconstruction gap’s sample-dependent component.The linear component generalizes, whereas the sample-specific residual does not.
  • Learning mechanism: The peak mechanism arises because gradient descent cannot distinguish population nonlinearity from sample-specific residuals with shared first- and second-order statistics.When linear structure dominates, spectral bias delays fitting the nonlinear target; when it vanishes, competition between generalization and memorization is strongest.
  • Metric masking: Standard metrics can miss the accumulated signal because spatial averaging dilutes it and temporal compensation lowers training loss while fitting residuals.Validation loss can also decrease while the membership signal accumulates, leaving vulnerability to membership inference without visible overfitting.

5. Experimental Protocol

The experimental protocol measures reconstruction quality along the Flow Matching interpolation path for each sample. It varies λ and averages over repeated noise draws, then evaluates robustness across data, noise, latent-space, modality, architecture, capacity, and scheduler choices.

  • Measurement: The protocol measures reconstruction quality at each λ for a trained velocity model and a data sample.The reconstruction error is normalized to remove the (1 − λ)^2 factor.
  • Measurement: For each data point, the experiment samples K = 100 noise realizations, averages their MSE, and evaluates λ ∈ {0, 0.1, . . . , 1.0}.This procedure is depicted in Figure 1.
  • Baseline: The baseline uses MAESTRO v3 audio, Music2Latent 64-channel latents at 10 Hz, and a 410M-parameter Transformer adapted from DiT.Training uses AdamW with learning rate 10^-4 and batch size 256.
  • Evaluation: Evaluation compares reconstruction MSE on 5,000 training and 5,000 held-out samples, using the same K = 100 noise realizations per sample.Early stopping is used while the membership signal accumulates undetected.
  • Robustness: Ablations vary data distribution, noise variance, latent space, modality, architecture, model capacity, and λ-sampling scheduler.The configurations include audio and CelebA images, Transformer and UNet architectures, and models from 140M to 880M parameters.

6. Results

Across configurations, the train–test reconstruction gap is bell-shaped over λ, with peak location governed by data geometry and prediction accuracy limited by Gaussian isotropic assumptions. The signal accumulates despite stable validation behavior, while architecture, capacity, and scheduling mainly affect its magnitude.

  • Mechanism: The Transformer-to-OLS test-loss ratio peaks where the membership signal peaks, indicating that nonlinear capacity is most useful at the signal maximum.At λ ∈{0, 1}, the ratio is close to 1 because linear prediction suffices.
  • Bell-shaped gap curve: The normalized train–test reconstruction gap is minimal at λ ∈{0, 1} and maximal at intermediate values in every tested configuration.This bell-shaped structure holds across datasets, architectures, latent spaces, and modalities.
  • Peak location: The observed peak λobs matches the theoretical λ∗F when Gaussian isotropic assumptions hold, including the MAESTRO Music2Latent configuration.On MAESTRO, λobs ∈ [0.5, 0.6] versus λ∗F = 0.52, within grid resolution.
  • Temporal evolution: The train–test gap grows from the first epochs while validation loss decreases until early stopping, making the accumulated signal invisible to standard metrics.By early stopping, a significant gap has accumulated despite the validation plateau.
  • Ablations: The bell shape persists on CelebA, but λ∗F prediction fails when heavy-tailed marginals and strong latent correlations violate Gaussian isotropic assumptions.CelebA has |κ| = 0.71 and |ρ| = 0.61, with λobs ∈[0.6, 0.7] versus λ∗F = 0.45.
  • Ablations: Architecture, model capacity, and λ-sampling scheduling leave peak location unchanged while changing signal magnitude.Replacing the Transformer with a UNet reduces peak magnitude from 0.09 to 0.01; larger models and log-normal scheduling amplify the signal.
  • Ablations: Changing data covariance, noise scale, or latent encoder shifts the predicted peak and observed peak together, showing that peak location follows data geometry.Increasing noise variance shifts λ∗F rightward; the two tested encoders predict 0.50 and 0.52, with observed peaks matching both.

7. Implications for Membership Inference

The paper shows that the λ-resolved reconstruction profile can expose membership information without requiring gradients or model weights. A lightweight classifier uses this profile to distinguish training members from non-members.

  • Attack rationale: The reconstruction error’s predictable bell-shaped profile across λ provides a structured signal for membership inference.The signal vanishes at the interpolation boundaries and is exploitable for a proof-of-concept attack.
  • Attack construction: The attack evaluates reconstruction MSE at 11 λ values with K = 100 noise samples, then trains an MLP on the resulting 11-dimensional profile.It requires only forward passes through the trained model, with no gradient computation or weight access.

8. Discussion

The discussion identifies important scope boundaries and practical implications of the λ-resolved membership signal. The peak location can guide targeted privacy defenses and training-schedule choices, but its prediction depends on distributional assumptions and the threat model remains limited.

  • Limitations: The closed-form peak prediction requires near-Gaussian isotropic latents, although the bell-shaped signal persists when these assumptions fail.On CelebA with an SD VAE, the peak location deviates while the bell shape remains.
  • Limitations: The theory assumes independent coupling and excludes reflow; preliminary experiments suggest one reflow step attenuates the signal.The attenuation suggests reflow may provide a natural mitigation, but the authors leave thorough characterization for future work.
  • Limitations: The white-box MIA is a proof of concept, while black-box and label-only threat models remain unexplored.The limitation concerns access assumptions rather than the existence of the λ-resolved signal.
  • Implications: The empirical peak can be located on a small proxy model and transferred to larger target models without retraining.This architecture-independent structure enables targeted privacy-preserving mechanisms near λ∗F, where leakage is maximal.
  • Implications: Concentrating the training scheduler near λ∗F may improve efficiency but can also amplify membership leakage, creating a training-efficiency–privacy trade-off.The peak is where prediction is hardest and nonlinear structure is required; dataset-specific scheduling may therefore have opposing effects on utility and privacy.

9. Conclusion

The paper concludes that Flow Matching encodes a structured membership signal along the interpolation path. This signal is predictable from data geometry, remains invisible to standard diagnostics, and can support membership inference.

  • Conclusion: Flow Matching encodes a membership signal with a universal bell-shaped profile over λ.The signal peaks where the interpolant’s linear information about velocity vanishes and nonlinear, sample-specific structure must be fitted.
  • Conclusion: The peak location is governed by data geometry, whereas model choices primarily affect the signal’s magnitude.The signal can accumulate silently even when standard diagnostics show no visible overfitting.
  • Conclusion: A simple λ-resolved membership inference attack consistently outperforms baselines adapted from diffusion literature.This translates the structured signal into a practical privacy risk.

Impact Statement

The supplied passages cover the paper’s theoretical setup, datasets, assumptions, and scope rather than a distinct impact statement. They establish the conditions under which the analysis is intended to apply and where its conclusions are limited.

  • Theoretical setup: The analysis studies linear Flow Matching interpolation between independent Gaussian noise and data variables.It defines Xλ = (1 − λ)X0 + λX1 and analyzes the velocity-prediction problem coordinatewise under isotropic covariances.
  • Theoretical setup: Under Gaussian assumptions, the conditional velocity expectation is linear and the residual variance can be analyzed explicitly.The derivation reduces to univariate linear regression for each coordinate before summing across dimensions.
  • Theoretical results: The theoretical results characterize expected training, test, and train–test-gap behavior using ordinary least-squares calculations.The supplied passages identify the relevant lemmas and connect the expected gap to the loss decomposition.
  • Theoretical results: The predicted peak occurs at λ∗ = σ0^2/(σ0^2 + σ1^2) in the isotropic Gaussian setting.The location follows from the condition that the covariance term c(λ) vanishes.
  • Data and evaluation: The experiments use audio datasets with distinct scale and diversity characteristics, including MAESTRO v3, MTG-Jamendo, and FMA Large.MAESTRO contains approximately 200 hours of classical piano, MTG-Jamendo over 55,000 tracks, and FMA Large 106,574 clips across 161 genres.
  • Scope boundary: The Gaussian-isotropic assumptions fail for CelebA latents encoded with the Stable Diffusion VAE, where heavy tails and inter-dimensional correlations distort the predicted peak.The reported excess kurtosis is |κ| = 0.71 and correlation magnitude is |ρ| = 0.61; the bell shape persists despite the peak mismatch.

B.3.3. TRAINING

The training and evaluation protocol measures λ-resolved reconstruction behavior across multiple statistics and uses those features for membership inference. The results support a robust bell-shaped pattern for central error statistics, a distinct S-shaped standard-deviation pattern, and practical attack performance.

  • Training: The training protocol uses AdamW with learning rate 10^-4, mixed precision, gradient clipping at 1.0, and validation-based early stopping.Transformer and UNet models use batch sizes of 128 and 64, respectively.
  • Evaluation: Each sample is evaluated at λ values from 0 to 1 in increments of 0.1 using K = 100 independent noise realizations.The per-λ mean reconstruction errors form an 11-dimensional feature vector for the classifier.
  • Reconstruction statistics: Median and quartile gaps closely match the mean’s bell-shaped curve, peaking at λ = 0.5 with boundary values approaching zero.The consistency indicates that the pattern is not driven solely by outliers.
  • Reconstruction statistics: Standard-deviation gaps instead form an S-shaped curve, changing from negative below λ = 0.3 to positive above λ = 0.3.Training samples have higher reconstruction-error variance at lower λ and lower variance at higher λ than test samples.
  • Limitations: The interpretation of the standard-deviation pattern remains speculative, and higher-order statistics lack a theoretical characterization.The authors identify this characterization as future work.
  • Membership inference: The proposed MIA trains a small two-hidden-layer MLP on λ-resolved reconstruction features using disjoint training and evaluation partitions.The construction uses 1,000 samples per class for training and 500 per class for testing.
  • Membership inference: On MAESTRO at threshold 0.38, the classifier correctly identifies 82% of members and 84% of non-members.Table 3 reports AUC and TPR@5%FPR across datasets and baselines, while Figure 9 provides the confusion matrix.

F. Reflow: Preliminary Results

A preliminary one-step reflow experiment preserves the bell-shaped membership signal but substantially attenuates and broadens it, while leaving its peak location near the geometry-predicted value. This suggests reflow may mitigate leakage, although thorough characterization remains future work.

  • Reflow preserves the bell-shaped normalized train–test gap, showing the phenomenon is not specific to independent coupling.The experiment compares the reflow model with the baseline on MAESTRO v3.
  • The peak magnitude decreases from 0.09 to 0.01 under reflow.
  • Reflow produces a broader, flatter plateau rather than a sharp peak.
  • The peak location remains near λF, consistent with control by data geometry rather than the coupling procedure.
  • The authors suggest reflow may naturally mitigate membership leakage through trajectory straightening, but leave thorough characterization for future work.
Loading 2606.07271v3…