Where Rectified Flows Leak: Characterising Membership Signals Along the Interpolation Path

Technical Summary: Where Rectified Flows Leak: Characterising Membership Signals Along the Interpolation Path

Problem Statement
The deployment of generative models, particularly Rectified Flows (used in systems like FLUX.1, VoiceBox, and Stable Audio Open), raises significant legal and privacy concerns regarding the retention of training data. While existing research focuses on verbatim reproduction, models can encode subtler "membership signals"—measurable asymmetries where the model treats training data differently from held-out data without explicitly reproducing it. These signals often remain undetected by standard training metrics (e.g., loss curves) which may show no signs of overfitting. The specific location and structural nature of these signals within the Rectified Flow interpolation path remain theoretically uncharacterized, particularly compared to the iterative denoising trajectories of diffusion models.

Methodology
The authors propose a theoretical and experimental framework to characterize membership signals along the linear interpolation path $X_\lambda = (1-\lambda)X_0 + \lambda X_1$, which defines Rectified Flow training.

1. Theoretical Framework:

   • Decomposition: The training loss is decomposed into approximation error, irreducible variance, and a cross-correlation term $G_{train}(\lambda)$. The authors identify $G_{train}(\lambda)$ as the membership signal, representing the correlation between the model's deviation from the optimal predictor and training-specific residuals.
   • Gaussian Assumptions: Under the assumption that the noise distribution $X_0$ and data distribution $X_1$ are independent and Gaussian (with covariances $\Sigma_0$ and $\Sigma_1$), the authors derive a closed-form expression for the location $\lambda^*_F$ where the membership signal peaks. This peak occurs where the cross-covariance between the interpolated state and the velocity is minimized.
   • Mechanism: The signal peaks at $\lambda^*_F$ because the linear component of the prediction vanishes there. The model must rely on nonlinear features to explain the target, leading to a competition between learning generalizable nonlinearities and fitting sample-specific residuals (memorization).

2. Experimental Protocol:

   • Detection: For a given sample $x_1$, the authors interpolate with noise $x_0$ at varying $\lambda$, predict the velocity, reconstruct $x_1$, and measure the Mean Squared Error (MSE).
   • Metric: They compute a normalized train-test gap $\Delta_{norm}(\lambda)$ to isolate the membership signal.
   • Validation: Experiments were conducted on audio (MAESTRO v3, MTG-Jamendo, FMA Large) and image (CelebA) datasets using various latent spaces (Music2Latent, Stable Audio VAE, Stable Diffusion VAE), architectures (Transformer, UNet), and model capacities.

Key Contributions

• Characterization of the Signal: The paper demonstrates that the train-test reconstruction gap in Rectified Flows follows a universal bell-shaped curve over $\lambda$. The signal is minimal at the boundaries ($\lambda=0, 1$) and maximal at an intermediate point.
• Closed-Form Prediction: A theoretical derivation provides a closed-form expression for the peak location $\lambda^*_F$ based on the data and noise covariances:
  $$\lambda^*_F = \frac{\text{tr}(\Sigma_0^2) + \text{tr}(\Sigma_0\Sigma_1)}{\text{tr}((\Sigma_0 + \Sigma_1)^2)}$$
  This prediction holds accurately when the Gaussian isotropic assumptions are satisfied (e.g., in audio latent spaces).
• Silent Accumulation: The study shows that this membership signal accumulates throughout training even while validation losses decrease and standard diagnostics indicate healthy learning. The signal is masked by spatial averaging over $\lambda$ in standard training protocols.
• Membership Inference Attack (MIA): As a proof of concept, the authors exploit the $\lambda$-resolved structure of the reconstruction error. By feeding the full curve (or a vector of errors across $\lambda$) into a simple MLP classifier, they achieve a significantly higher AUC (0.91 on MAESTRO) compared to naive attacks using a single $\lambda$ point (0.67) or adapted diffusion-based methods.

Results

• Universality: The bell-shaped structure of the train-test gap appears universally across all tested configurations, including different modalities (audio/image), architectures (Transformer/UNet), and latent spaces, even when the theoretical assumptions (Gaussianity/isotropy) are violated (e.g., CelebA).
• Peak Accuracy: When the Gaussian isotropic assumptions hold (audio datasets with Music2Latent or Stable Audio VAE), the observed peak location matches the theoretical $\lambda^*_F$ within grid resolution. When assumptions are violated (CelebA with SD VAE), the bell shape persists, but the peak location deviates from the closed-form prediction.
• Factors Influencing Magnitude: The location of the peak is governed solely by data geometry ($\Sigma_0, \Sigma_1$) and is independent of model architecture or capacity. However, the magnitude of the signal increases with model capacity and is amplified by log-normal $\lambda$-sampling schedulers that concentrate training near the peak.
• Reflow: Preliminary experiments suggest that the "reflow" procedure (iteratively straightening trajectories) preserves the bell shape but substantially attenuates the magnitude of the signal, potentially offering a natural mitigation.

Significance and Claims
The paper claims to provide the first theoretical grounding for where and why membership signals concentrate in Rectified Flows, moving beyond empirical observation.

• Privacy Risk: It establishes that standard training metrics are insufficient for detecting memorization in Rectified Flows, as the signal accumulates silently. The structured nature of the leak makes it highly exploitable for Membership Inference Attacks.
• Defensive Implications: The authors suggest that because the peak location is predictable and architecture-independent, privacy-preserving mechanisms (e.g., regularization or noise injection) could be targeted specifically at $\lambda^*_F$ rather than applied uniformly.
• Training Efficiency: The peak $\lambda^*$ corresponds to the point where prediction is hardest (balanced noise and data). The authors note that schedulers concentrating training near this point improve convergence (as seen in SD3) but simultaneously amplify privacy leakage, highlighting a fundamental trade-off between training efficiency and privacy.

The work is presented as a proof of concept under a white-box setting, acknowledging that stronger threat models (black-box access) and the effects of conditional generation (text prompts) remain open questions for future exploration.