arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2409.08482cs.LGcs.CRcs.CV
收藏

共享LoRA微调扩散模型权重时的风险

Risks When Sharing LoRA Fine-Tuned Diffusion Model Weights

University of Toronto(多伦多大学)

Dixi Yao

AI总结:

本文研究共享LoRA微调扩散模型权重的隐私泄露风险,提出带时间步嵌入的变分自编码器可从权重重建私有身份图像,且现有防御方法无法兼顾效用与隐私。

摘要:

随着生成式模型的兴起以及公众可便捷获取在大规模数据集上预训练的扩散模型,用户可对这些模型进行微调,以生成自然语言描述的新场景下的个人面部或物品图像。低秩适配(Low Rank Adaptation,LoRA)等参数高效微调(Parameter Efficient Fine-Tuning,PEFT)技术已成为用户端微调过程中节省内存与计算资源的最常用方式。但一个自然存在的问题是:共享模型权重时,用于微调的私有图像是否会泄露给攻击者。本文在实际场景下研究了微调扩散模型的隐私泄露问题,该场景中攻击者仅能获取模型权重,无法接触微调所用的提示词或图像。我们设计并构建了一个变分网络自编码器,它以模型权重为输入,输出私有图像的重建结果。为提升此类自编码器的训练效率,我们提出了一种借助时间步嵌入的训练范式。研究结果给出了出人意料的答案:攻击者可以生成与私有图像包含相同身份的图像。此外我们还证明,包括基于差分隐私的方法在内,现有防御方法均无法在不损害微调模型效用的前提下,保护扩散模型微调所用私有数据的隐私。

英文摘要:

With the emerging trend in generative models and convenient public access to diffusion models pre-trained on large datasets, users can fine-tune these models to generate images of personal faces or items in new contexts described by natural language. Parameter efficient fine-tuning (PEFT) such as Low Rank Adaptation (LoRA) has become the most common way to save memory and computation usage on the user end during fine-tuning. However, a natural question is whether the private images used for fine-tuning will be leaked to adversaries when sharing model weights. In this paper, we study the issue of privacy leakage of a fine-tuned diffusion model in a practical setting, where adversaries only have access to model weights, rather than prompts or images used for fine-tuning. We design and build a variational network autoencoder that takes model weights as input and outputs the reconstruction of private images. To improve the efficiency of training such an autoencoder, we propose a training paradigm with the help of timestep embedding. The results give a surprising answer to this research question: an adversary can generate images containing the same identities as the private images. Furthermore, we demonstrate that no existing defense method, including differential privacy-based methods, can preserve the privacy of private data used for fine-tuning a diffusion model without compromising the utility of a fine-tuned model.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑