整流流的泄露之处：沿插值路径表征成员身份信号

摘要

理解生成模型从训练数据中保留了哪些内容仍然是一个挑战，这涉及版权和隐私问题。除了逐字复述外，模型还可能编码训练数据中更细微的痕迹，这些痕迹虽然不会在输出中显现，但仍可被利用。我们针对当前在生成系统中日益广泛使用的修正流（Rectified Flows）研究这一现象。我们分析了定义修正流训练过程的插值路径 X_λ= (1-λ)X_0 + λX_1，发现训练数据与测试数据的重建差异存在一个随λ变化的钟形曲线缺口，该缺口在训练过程中累积，而验证指标保持稳定。该信号存在一个最大值，我们在高斯假设下推导出该最大值位置的闭式解。我们在音频和图像上验证了这些预测，表明钟形结构具有普适性，而峰值预测在满足假设条件时成立。作为概念验证，我们利用这种特定的λ解析结构进行了成员推断攻击（Membership Inference Attack），成功区分训练集成员与非成员。

English

Understanding what generative models retain from training data remains challenging, with implications for copyright and privacy. Beyond verbatim reproduction, models can encode subtler traces of their training data that never surface in their outputs yet remain exploitable. We study this regime for Rectified Flows, which are increasingly used in deployed generative systems. We analyse the interpolation path X_λ= (1-λ)X_0 + λX_1 that defines the Rectified Flow training. We show that a gap exists between the reconstruction of train and test data that follows a bell-shaped curve over λ, wich accumulates during training, while the validation metrics remain stable. The signal has a maximum whose location we derive in closed form under Gaussian assumptions. We validate these predictions on both audio and images and show that the bell-shaped structure is universal, while the peak prediction holds when our assumptions are satisfied. As a proof of concept, we exploit this specific λ-resolved structure to perform a Membership Inference Attack, distinguishing members of the training set from non-members.