Beyond Global Error: Path–Frequency Membership Inference in Denoising Generative Models

Denoising generative models expose training membership through their predictions on noisy inputs. Existing attacks often summarize prediction residuals into error statistics, compressing the available evidence before membership discrimination. Focusing on rectified flow, we uncover a richer structure: member–nonmember differences vary across spatial-frequency bands, and these frequency responses change along the interpolation path. Global error conceals how residual energy is distributed across bands, while isolated path positions miss complementary responses. To exploit this structure, we introduce PaFMIA (Path–Frequency Membership Inference Attack), which represents queried residuals jointly across path positions and spatial frequencies. PaFMIA either retains the complete band measurements or learns position-dependent weights that aggregate them, then fits a lightweight membership classifier using labeled source-model examples. The resulting attack learns from both the distribution of residual energy and its variation along the path. All frequency measurements reuse existing predictions, adding no generator queries. Our mathematical analysis characterizes information lost through aggregation, identifies conditions for complementary positions to improve detection at a fixed query budget, and derives frequency-dependent membership responses in a linear rectified-flow model. Experiments on four image datasets demonstrate the value of this representation: at 32 queries, PaFMIA reaches 67.41% TPR at 1% FPR on TinyImageNet, compared with 19.78% for DIME adapted to rectified flow. Controlled ablations identify the contributions of frequency resolution and joint positions, while variance-preserving flow matching and DDPM experiments extend the approach across flow and diffusion objectives.