Imagine you're a teacher grading an exam, and one student gets a perfect score. Did they study the answer key, or is the test just easy for them? You can't tell from the raw score alone — you need to know how hard the question was for that student independently. That's the core problem in membership inference attacks (MIAs) on diffusion models: a low reconstruction loss might mean the model memorized a training image, or it might just mean the image is inherently easy to reconstruct. This paper cracks open that ambiguity by calibrating difficulty along two axes of time. The committed claim: by comparing a model's loss against a temporal reference — either an earlier training checkpoint or neighboring diffusion timesteps — you can isolate memorization signal from intrinsic image difficulty, producing membership inference that beats existing methods by a wide margin and generalizes across x-, v-, and ε-prediction model parameterizations. The first method, Reference-Model Calibration (RMC), is conceptually elegant: take the fine-tuned model's loss on an image, subtract the loss from an earlier checkpoint that hadn't yet seen the data. What remains is almost pure memorization signal. The authors report near-perfect auditing performance with RMC, even without text captions — a significant practical advantage since captions are often unavailable in real-world auditing scenarios. The limitation is obvious: you need access to that earlier checkpoint, which you often don't have for third-party models. This motivates the second and more novel contribution, Temporal Self-Calibration (TSC). The key insight is beautifully simple: an image's intrinsic difficulty is consistent across diffusion noise levels, but memorization is temporally localized — it spikes at specific timesteps. So by comparing a target timestep's loss against its neighbors within the same model's diffusion trajectory, you can use the model's own behavior as its own difficulty baseline. No reference model needed. This is a single-model attack that works out of the box. The ladder position is strong. The authors benchmark against current SOTA MIA methods and report wide-margin improvements. Crucially, they address a known blind spot: most existing attacks are tuned for ε-prediction models and break when applied to v-prediction or x-prediction parameterizations. TSC generalizes across all three. This matters because the diffusion model ecosystem is fragmenting across parameterizations, and an attack that only works on one flavor has limited real-world auditing value. Integrity is solid for a methods paper. Code is released on GitHub, enabling independent replication. The evaluation appears to use standard fine-tuning setups and multiple model parameterizations, which reduces the risk of benchmark shopping. The main integrity gap is that all validation is same-team simulation — no independent group has yet reproduced these results, and the paper doesn't specify whether benchmark configurations were locked before experiments. The successor question is interesting. The obvious next experiment is applying TSC to large-scale foundation models (Stable Diffusion 3, Flux) trained on web-scale data where memorization is sparser and harder to detect. The authors likely didn't run this because the controlled fine-tuning setup lets them construct ground truth — they know exactly what's in the training set. On web-scale models, ground truth is unavailable, making evaluation much harder. This is probably (a) — a genuine difficulty constraint, not something they're hiding.
