Hierarchical Bayesian Membership Inference: A General Framework with Applications to Diffusion Models

Membership inference attacks often reduce a model's response to a single score and treat the parameters of class-conditional signal distributions estimated from finitely many reference models as known, without propagating estimation uncertainty or separating variation across stochastic queries, trained models, data points, and groups. We propose a general hierarchical Bayesian framework that models these sources of variation under the member and non-member hypotheses, propagates uncertainty from finite reference-model data, and yields a posterior-predictive likelihood-ratio test. We instantiate the framework for denoising diffusion and flow matching models, whose randomized objectives yield repeated loss observations. For record-level inference, our attack outperforms state-of-the-art methods. For group-level inference, it infers an individual's presence without access to their training images and outperforms adapted baselines with a mixed DDPM and flow-matching reference pool, demonstrating robustness to model-type mismatch. Beyond diffusion, the framework applies to deterministic, repeated stochastic, and grouped observations.