Diffusion model

How a diffusion model works

A diffusion model has two procedures and one use. Sohl-Dickstein and colleagues gave the idea in 2015.

1. Forward process. Add a small quantity of noise to a training image, again and again, until only noise stays. The model learns nothing in this step.
2. Reverse process. Train a neural network to remove one step of noise. The network gets an image with noise and predicts the noise.
3. Generation. Start from pure random noise. Use the network to remove noise one step at a time, until an image stays.

In DDPM (Ho, Jain and Abbeel, 2020), the network is a U-Net and the chain has 1,000 steps. A text prompt can control the steps. Imagen encodes the prompt with T5, a language model trained on text only.

Why diffusion models are a security risk

Diffusion models make images for Stable Diffusion, Imagen and the unCLIP decoder. Three risks come from this method:

• Synthetic media. The same models make realistic images for a deepfake.
• Leaks of training data. A model can give back images from its training data.
• Poisoned training data. A small number of bad samples can change the output for a prompt.

In practice: the primary models and the known attacks

Model	Year	What it added	Source
DDPM	2020	High quality images, FID 3.17 on CIFAR10	Ho et al.
Latent diffusion	2021	Steps on a compressed image, text input	Rombach et al.
unCLIP	2022	Diffusion decoder from a CLIP embedding	Ramesh et al.
Imagen	2022	Text to image with a T5 text encoder	Saharia et al.
DiT	2022	A transformer replaces the U-Net	Peebles and Xie

Song and colleagues (2020) give the same idea as a continuous equation. The model learns the “score”, the direction that moves data with noise to actual data. Latent diffusion uses cross attention layers to let text control the output.

Carlini and colleagues attacked Stable Diffusion v1.4 in 2023. They used the 350,000 training examples with the most copies, and made 500 images for each.

• 94 generated images agreed with training images in their distance test.
• 13 more were near copies after a manual check. That gives 109 in all.
• Imagen gave 23 from the 1,000 prompts with the most copies.

The extracted images include photos of persons and trademarked logos. The authors found diffusion models “much less private” than GANs.

Data poisoning is also possible. Nightshade (Shan et al., University of Chicago, October 2023) attacks one prompt at a time. It corrupted a Stable Diffusion SDXL prompt with fewer than 100 poison samples.

Stability AI released the Stable Diffusion weights with the CreativeML OpenRAIL-M license. It gave 6.9 GB of VRAM as the memory use at release. For the risks of public weights, see open weight model.

Trade-offs: quality, speed and cost

Selection	What the source reports
Many steps (DDPM, 1,000)	High quality, but 300 s to sample 128 images at 256x256
Fewer steps (DDIM)	10 to 50 times faster in wall clock time than DDPM
Pixel space	Hundreds of GPU days to train the strongest models
Latent space	Less computation, but needs a pretrained autoencoder

Diffusion is also used for text at this time. Google DeepMind shows Gemini Diffusion, an experimental text diffusion model. It makes blocks of tokens at one time, not one token after the next. Google reports 1479 tokens each second. That is a vendor figure.

Questions and answers

How is a diffusion model different from a large language model?

A typical large language model writes text one token after the next. A diffusion model makes the full output from noise, then improves it in many steps. Google DeepMind shows an experimental text diffusion model, Gemini Diffusion, that makes blocks of tokens at one time.

Can a diffusion model copy its training images?

Yes, for some images. In 2023, Carlini and colleagues extracted 109 near copies of training images from Stable Diffusion v1.4. They made 175 million images to find them. Images with many copies in the training data came back most frequently.

Why are diffusion models slow?

A diffusion model removes noise in many small steps. DDPM used 1,000 steps. The DDIM sampler uses fewer steps. Its authors report that DDIM is 10 to 50 times faster than DDPM.