Where Rectified Flows Leak: Characterising Membership Signals Along the Interpolation Path
Summary
This paper studies membership inference attacks on Rectified Flows by analyzing the interpolation path, revealing a bell-shaped gap between train and test data reconstruction that accumulates during training.
View Cached Full Text
Cached at: 06/10/26, 12:13 AM
Paper page - Where Rectified Flows Leak: Characterising Membership Signals Along the Interpolation Path
Source: https://huggingface.co/papers/2606.07271
Abstract
Rectified Flows retain subtle training data traces that accumulate during training and can be exploited for membership inference attacks.
Understanding what generative models retain from training data remains challenging, with implications for copyright and privacy. Beyond verbatim reproduction, models can encode subtler traces of their training data that never surface in their outputs yet remain exploitable. We study this regime forRectified Flows, which are increasingly used in deployed generative systems. We analyse theinterpolation pathX_λ= (1-λ)X_0 + λX_1 that defines the Rectified Flow training. We show that a gap exists between the reconstruction of train and test data that follows abell-shaped curveover λ, wich accumulates during training, while the validation metrics remain stable. The signal has a maximum whose location we derive in closed form underGaussian assumptions. We validate these predictions on both audio and images and show that the bell-shaped structure is universal, while the peak prediction holds when our assumptions are satisfied. As a proof of concept, we exploit this specific λ-resolved structure to perform aMembership Inference Attack, distinguishing members of the training set from non-members.
View arXiv pageView PDFGitHub0Add to collection
Get this paper in your agent:
hf papers read 2606\.07271
Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash
Models citing this paper0
No model linking this paper
Cite arxiv.org/abs/2606.07271 in a model README.md to link it from this page.
Datasets citing this paper0
No dataset linking this paper
Cite arxiv.org/abs/2606.07271 in a dataset README.md to link it from this page.
Spaces citing this paper0
No Space linking this paper
Cite arxiv.org/abs/2606.07271 in a Space README.md to link it from this page.
Collections including this paper0
No Collection including this paper
Add this paper to acollectionto link it from this page.
Similar Articles
JUMP: Single-Pass Membership Inference on Fine-Tuned Diffusion Language Models
This paper proposes JUMP, a single-pass membership inference attack for fine-tuned discrete diffusion language models that exploits their any-order and parallel decodability to improve detection accuracy with fewer queries.
StraightDP: Geometry-Aware Differential Privacy for Rectified-Flow Transformers
This paper introduces StraightDP, a geometry-aware differential privacy framework for text-conditioned rectified-flow transformers. It partitions the privacy budget to release class-conditional moments and use DP-SGD, improving accuracy and FID over uniform DP training at strong privacy levels.
(HB-ARFM) History-Bootstrapped Flow Matching for Inverse Boiling Reconstruction
This paper proposes a history-bootstrapped autoregressive flow matching method for reconstructing full spatiotemporal fields (velocity and temperature) from partial observations of boiling dynamics, addressing the ill-posed inverse problem with non-Markovian posterior.
Flow Matching with Missing Data
This paper proposes Missing-Data Flow Matching, a method that treats missing coordinates of training samples as latent variables and averages the flow matching loss over possible values. Theoretical analysis shows the correction is exact and provides design guidance, with experiments validating the approach on tabular data.
Geometric Erasure by Contrastive Velocity Matching in Rectified Flows
This paper introduces GEM, a concept erasure framework for Rectified Flow models that combines trajectory-based unlearning with teacher-guided flow matching, achieving 5× faster and safer content suppression while preserving benign generation.