PaperlayerView exact revision on arXiv

Source-linked AI summary

Membership Inference in Fine-tuned Diffusion Language Models via Token-level Memorization Asymmetry

Shengfang Zhai, Leo Marchyok, Yuling Shi, Huanran Chen, Yinpeng Dong, Jiaheng Zhang, Sanghyun Hong

arXiv:2609.00873v1cs.CLcs.CR

TL;DR

Privacy risks in diffusion language models remain underexplored, especially because their stochastic, any-order denoising differs from autoregressive modeling. The paper derives token-level memorization asymmetry, proposes Q-SKEW for membership inference, and reports stronger baseline performance alongside improved PII extraction. Its evaluation is mainly limited to currently available mainstream open-source diffusion models, so generalization to future architectures remains unknown.

  • Problem

    Privacy issues in diffusion language models, including membership inference and PII extraction, have received limited study despite architectural differences from autoregressive models.

  • Method

    The paper theoretically characterizes token-level memorization asymmetry and proposes Q-SKEW, a quantile-weighted skewness indicator using token-level loss behavior for membership inference.

  • Results

    Q-SKEW outperforms baselines across datasets and fine-tuning settings, with average AUC improvement exceeding 10%, and also enhances PII extraction.

  • Takeaways & Limitations

    DLMs exhibit privacy characteristics distinct from autoregressive language models, motivating focused evaluation of their membership-inference and PII-reconstruction risks.

  • Takeaways & Limitations

    Evaluation mainly uses currently available mainstream open-source diffusion models, leaving generalization to more diverse future architectures and training mechanisms unknown.

Abstract

from arXiv · show

Diffusion language models (DLMs) have recently emerged as an alternative modeling paradigm to autoregressive LMs, offering advantages such as parallel generation and bidirectional context modeling. Despite growing interest in their generative capabilities, the privacy risks of DLMs remain underexplored. We identify a phenomenon termed token-level memorization asymmetry through theoretical analysis of diffusion training dynamics. Building on this finding, we propose Q-Skew, a quantile-weighted skewness-based indicator for membership inference on finetuned DLMs. Experiments across multiple fine-tuning datasets and models show that our method outperforms existing baselines. Moreover, we show that Q-Skew can also facilitate other privacy violations, such as PII extraction. Our findings reveal a previously underexplored privacy attack surface and highlight the need for systematic privacy evaluation of DLMs.

1 Introduction

DLM privacy risks are understudied, and their stochastic, any-order denoising process challenges membership-inference methods developed for autoregressive models. The paper identifies token-level memorization asymmetry and uses it to develop Q-SKEW, which outperforms baselines and also improves PII extraction.

  • Research gap: DLM privacy research has largely lagged behind their advancing generative capabilities, leaving membership inference comparatively underexplored.Membership inference can support both privacy violation and unauthorized data auditing.
  • Research gap: Any-order denoising reduces exact sample memorization, while token-specific masking randomness undermines lower-tail methods such as MinK and Min-K++.These properties distinguish DLM training from the fixed left-to-right objectives used by autoregressive models.
  • Approach: Theoretically derived token-level memorization asymmetry motivates Q-SKEW, a quantile-weighted skewness indicator for membership inference.The analysis finds that single-step token memorization gain is inversely proportional to the mask ratio.
  • Results: Q-SKEW outperforms baselines across fine-tuning objectives, dataset domains, model types, and training epochs, with average AUC improvement exceeding 10%.The evaluation includes both base and instruction-tuned diffusion language models.
  • Results: The paper reports that Q-SKEW consistently outperforms SAMA in both instruction fine-tuning and domain fine-tuning settings.This evaluation extends beyond the domain-fine-tuning setting covered by the concurrent work.
  • Broader privacy risk: Skewness also enhances PII extraction, extending the privacy relevance of the proposed indicator beyond membership inference.The paper presents this as a complementary data-reconstruction risk in generative language models.

2 Background and Related Work

DLMs generate text through iterative denoising from masked states, using masked-position denoising during training and iterative sampling during inference. Membership inference evaluates whether data belongs to training sets, while prior diffusion- and language-model attacks rely on metrics and settings that do not directly transfer across architectures.

  • Diffusion language models: DLMs recover text from a fully masked state through iterative denoising rather than traditional left-to-right generation.The discrete masked diffusion architecture progressively replaces tokens with mask tokens during the forward process.
  • Diffusion language models: The forward diffusion process is a Markov chain that gradually masks tokens, with a closed-form timestep state determined by cumulative unmasking probability.The extended vocabulary includes the ordinary token vocabulary plus a mask token.
  • Diffusion language models: DLM denoisers are trained with a masked-position objective and inferred by iterative updates from xT until timestep 0.Training predicts the original tokens at masked positions, whereas inference repeatedly samples denoised states.
  • Membership inference: Membership inference determines whether a sample belongs to a target model’s training data and supports privacy-risk measurement or unauthorized-data auditing.Existing effective generative-model attacks commonly use query-based gray-box access to output logits.
  • Related work: Prior diffusion-model membership attacks use estimation errors, perturbation-induced probability fluctuations, or likelihood discrepancies to distinguish member and non-member sets.Language-model membership-inference work includes methods developed for autoregressive models.

3 Methodology

The methodology models token-level memorization asymmetry in fine-tuned DLMs and turns it into a query-based membership inference indicator. Q-SKEW compares target–reference token loss differences, emphasizing distributional skewness and using cyclic sampling for stable token coverage.

  • 3.1 Threat Model: The threat model targets fine-tuning membership inference using output logits, with optional access to an unfinetuned reference model.The adversary determines whether a record trained the target model without accessing model weights or gradients.
  • 3.2 Token-level Memorization Asymmetry: DLM training creates token-level asymmetry because lower mask ratios produce stronger single-step memorization gains.The paper assumes the update-strength function is strictly decreasing in the mask rate.
  • 3.2 Token-level Memorization Asymmetry: Member-token cumulative memorization gains are strictly right-skewed for any finite number of training epochs, whereas non-member fluctuations are typically much less asymmetric.For non-members, the aggregated stochastic generalization noise is often approximately symmetric, yielding Skew(G_wi) ≈ 0.
  • 3.3 Quantile-weighted Skewness with Cyclic Sampling: Q-SKEW estimates token memorization through target–reference loss differences and uses quantile-weighted skewness to capture asymmetry robustly under long-tailed distributions.The weighting function anchors the empirical quantile position at the 15th and 85th percentiles, with bandwidth h set to 0.1 in experiments.
  • 3.3 Quantile-weighted Skewness with Cyclic Sampling: The sample-level indicator aggregates token loss differences and predicts membership when its skewness exceeds a decision threshold.The method uses the target model, reference model, and threshold τ to distinguish likely members from non-members.
  • 3.3 Quantile-weighted Skewness with Cyclic Sampling: Cyclic Sampling reduces Monte Carlo variance and ensures uniform token coverage through repeated random permutations partitioned into disjoint masking batches.The algorithm performs R full-coverage rounds rather than relying on random replacement alone.

4 Experiments

Experiments evaluate Q-SKEW across DLM families, datasets, fine-tuning settings, training stages, reference-model assumptions, and ablations. Q-SKEW consistently outperforms baselines, including when the reference model is misaligned.

  • Experimental Setup: Q-SKEW is evaluated on four DLMs across domain fine-tuning and instruction fine-tuning using six datasets.The models are LLaDA-8B-Base, LLaDA-8B-Instruct, Dream-Base-7B, and Dream-Instruct-7B; datasets span ArXiv, WikiText, XSUM, MedQA, Alpaca, and Tulu-3.
  • Main Results: Q-SKEW consistently outperforms baselines across datasets, DLMs, and both domain and instruction fine-tuning settings.The main evaluation uses LLaDA-8B-Base and LLaDA-8B-Instruct, with results reported in Tables 1 and 2.
  • Main Results: Q-SKEW achieves the best overall performance among baselines on Dream models evaluated with XSUM and Tulu-3.Dream models exhibit lower membership-inference vulnerability than the LLaDA series.
  • Training Progress: Q-SKEW consistently outperforms baselines across different training steps in the training-epoch evaluation.The evaluation is motivated by the gradual increase of training-data memorization during fine-tuning.
  • Reference Models: Under a misaligned reference model, Q-SKEW shows a slight performance decline but remains better than the best baseline.This weaker-reference evaluation considers domain fine-tuning on ArXiv and instruction fine-tuning on MedQA.
  • Ablation Study: Each component of Q-SKEW is effective: cyclic sampling, skewness calculation, and quantile weighting all contribute in ablations.The ablation study is conducted on WikiText for domain fine-tuning.

5 Increase in Privacy Risks Beyond MIAs

The paper extends its privacy analysis from membership inference to PII reconstruction in DLMs. It formulates extraction as candidate ranking and combines cross-entropy with token-level skewness to improve attack success.

  • Attack Setup: PII reconstruction asks an adversary to recover redacted values from training records by querying the target model and ranking candidate PII items.The setup covers redacted records such as an insurance member ID and candidate values generated by the adversary.
  • Attack Setup: Autoregressive PII extraction methods do not directly apply to DLMs because DLMs use iterative denoising and do not expose left-to-right conditional probabilities.The paper therefore adapts extraction into a candidate-ranking problem based on reconstruction loss.
  • Combined Scoring: Q-SKEW supplies a complementary ranking signal by capturing localized token-level asymmetries that can arise from memorized sequences.Cross-entropy ranking can instead be dominated by generic token probabilities from the language prior.
  • Combined Scoring: The attack computes skewness over a contextual span using randomly masked variants, with masking at 35% and repetition across 4–16 batches.For X = 20, the span contains 8 preceding tokens, 5 PII tokens, and 7 following tokens.
  • Evaluation: Combined CE and skewness reaches 34% ASR for phone numbers and 24% for emails, exceeding CE-based ranking at 30% and 20%.Skewness-only variants achieve 10–22% ASR on phone numbers and 8–16% on emails.

6 Conclusion

The paper characterizes token-level memorization asymmetry and uses it to develop membership inference for fine-tuned DLMs. It reports stronger performance than existing baselines and demonstrates applicability to PII reconstruction.

  • Conclusion: The paper defines token-level memorization asymmetry and derives Q-SKEW as a membership-inference method for fine-tuned DLMs.Q-SKEW is based on the inverse mask-ratio phenomenon identified in the paper.
  • Conclusion: Q-SKEW outperforms existing baselines across datasets and setups and also facilitates PII reconstruction.The conclusion connects the membership-inference method with a broader privacy attack.
  • Conclusion: The findings indicate that DLMs have privacy characteristics distinct from autoregressive LLMs because their training processes differ.The paper encourages systematic attention to DLM-specific privacy risks.

Limitations

The method advances privacy attacks against diffusion language models, but evaluation is limited by the small set of suitable open-source models and uncertainty about future architectures.

  • Evaluation mainly uses current mainstream diffusion language models because suitable open-source models remain limited.
  • Generalization to future diffusion architectures and training mechanisms remains unknown.

Impact Statement

The paper frames its attack as an auditing tool for privacy risks in emerging diffusion language models. Its theoretical analysis establishes positive skewness in cumulative token memorization under local assumptions and explains how long tails arise.

  • Q-SKEW is presented as an auditing tool intended to assess and mitigate privacy risks rather than facilitate misuse.
  • The proof models cumulative token memory gain as repeated zero-inflated updates and analyzes its third central moment.
  • Non-constant update strength yields the strict inequality 2E[V 3] + (E[V ])3 > 3E[V ]E[V 2].
  • The local analysis assumes token-level updates are approximately i.i.d. across epochs, with a separate analysis provided without that assumption.
  • High memory gains correspond to low mask rates, while low sampling probability suppresses extreme events and produces a monotonically decaying long tail.

A.3 A Non-i.i.d. Extension of the Skewness Analysis

The non-i.i.d. extension decomposes cumulative skewness into positive marginal and cross-epoch third-order contributions. Positive skewness is expected to persist unless negative dependence dominates, and experiments support the inverse mask-ratio relationship across metrics, domains, and scales.

  • The i.i.d. approximation transfers positive single-epoch skewness to cumulative gains, but is stronger than practice requires.
  • Without independence, cumulative third central moments decompose into marginal epoch-wise moments and mixed third-order cross-epoch terms.
  • Positive skewness should persist unless cross-epoch dependence introduces a dominant negative third-order contribution.
  • The analysis concludes µ3(Gwi) > 0 under the non-dominance and non-degeneracy conditions.
  • B Validation of Inverse Mask-Ratio Scaling Assumption: Lower mask ratios produce greater average token memorization across confidence, softmax, and token-loss metrics.
  • B Validation of Inverse Mask-Ratio Scaling Assumption: The inverse mask-ratio scaling assumption holds across ArXiv and WikiText domains and dataset sizes increased from 125 to 1,000 samples.

C Implementation of MIA Baselines

The baseline suite adapts autoregressive-LM and vision-diffusion membership-inference methods alongside SAMA under matched evaluation settings. Some methods cannot be adapted because their derivations or input assumptions do not hold for diffusion language models.

  • Baselines comprise AR-LM methods, the vision-diffusion method SecMI, and the DLM-specific method SAMA.
  • All baselines use identical member splits, access settings, ROC metrics, computing budgets, and 16 denoising forward passes per sample.
  • Loss averages DLM loss over 16 denoising runs, with smaller average loss indicating greater membership likelihood.
  • Min-K% and Min-K%++ average bottom-20% token scores over 16 denoising runs, with higher scores indicating greater membership likelihood.
  • Calibration uses target-reference loss differences, while SecMI uses prior differences between denoising steps and lower reconstruction error indicates higher membership probability.
  • PIA is not adapted because its t approaching 0 derivation does not hold for DLMs, and CLiD does not match DLM inputs.
  • Unfinetuned LLaDA shows high Loss MI AUC on MIMIR because of strong prior knowledge, producing a hallucinated membership-inference success.
  • Fine-tuned-model MI evaluation requires matched prior knowledge, so the study uses recent data and leakage-controlled samples.

E Justification of Accessing Reference Models in Logit-based Settings.

The paper justifies reference-model access as compatible with the logit-based threat model because target-model architecture knowledge is natural and architectures may use incompatible tokenizers and representations.

  • Reference-model access is assumed alongside target-model logits under the paper’s standard logit-based membership-inference setting.
  • Architecture knowledge is natural in a logit-based setting because different architectures typically use different tokenizers, output dimensions, and token representations.
  • LLaDA and Dream exemplify this incompatibility through completely different tokenizers and token representations.

F.1 Ablation Study

The ablation study examines token-span, weighting, mask-ratio, and batch-count choices, alongside candidate-ranking behavior and calibration with limited fine-tuning records. Results show that hyperparameter effects depend on PII type, while combining loss and skewness recovers complementary candidates.

  • Hyperparameter Investigation: Four hyperparameters—token span X, α, mask ratio t, and masking batches B—are evaluated using LLaDA attack success rate.The study reports the resulting ASR in Fig. 5.
  • Hyperparameter Investigation: Increasing α consistently reduces ASR across both PII types, underscoring the contribution of the cross-entropy signal in the combined score.
  • Hyperparameter Investigation: Higher mask ratios reduce phone-number ASR but substantially improve email performance compared with lower ratios such as 0.1.
  • Hyperparameter Investigation: Both very small and very large B values degrade performance, with excessively large values hypothesized to weaken the membership signal by reducing loss-difference skewness.
  • Top-K Candidate Ranking: Over 50% email top-k accuracy is achieved at k=5, the highest reported value across methods and k values.For phone numbers, Ranking narrowly exceeds Combine-0.1 when k is greater than 1.
  • Top-K Candidate Ranking: Combine-0.1 achieves higher top-1 accuracy across multiple settings because loss and skewness recover different PII subsets.Ranking-only emails tend to be shorter and more natural-language-like, whereas skewness-only targets tend to be longer and more structured.
Loading 2609.00873v1…