docs: sync roadmap current research state

Author: DeliciousBuding

ROADMAP.md

@@ -2740,10 +2740,10 @@ claim。
 | --- | --- |
 | Active GPU question | none |
 | Next GPU candidate | none |
-| CPU sidecar | none selected after ReDiffuse STL-10 denoising-loss and score-norm weak results. The released scout completed `300` steps and produced a `256 / 256` score packet, but fixed-timestep denoising-loss was random-level (`AUC = 0.4996337890625`, `ASR = 0.509765625`, `TPR@1%FPR = 0.01171875`, `TPR@0.1%FPR = 0.0`); a one-pass SimA-style denoiser-output score-norm scorer on the same checkpoint/split was also random-level (`AUC = 0.5052947998046875`, `ASR = 0.525390625`, `TPR@1%FPR = 0.03125`, `TPR@0.1%FPR = 0.01953125`). |
-| Latest mechanism watch | Identity-Focused Inference / arXiv `2410.10177` is identity-level inference / extraction evidence, not a current per-sample membership row. Reopen only if official public code plus checkpoint-bound LDM / DDPM target identities, immutable LFW / CelebA identity and member/nonmember manifests, generated image / extraction / score packets, ROC/metric JSON, utility or extraction-quality metrics, and a no-training verifier appear, or if DiffAudit explicitly opens an identity-privacy consumer boundary. |
-| Previous mechanism watch | RAPTA / ADMCD / arXiv `2603.13070` is copying / memorization mitigation evidence, not a current per-sample membership row. Reopen only if official public code plus checkpoint-bound target identities, immutable copied/non-copied or member/nonmember row manifests, generated image or internal-score packets, pre/post RAPTA / ADMCD ROC/metric JSON, retained-utility and prompt-alignment metrics, and a no-training verifier appear, or if DiffAudit explicitly opens a copying/memorization mitigation consumer boundary. GUARD / arXiv `2603.00133` is official code-public surgical memorization mitigation evidence, not a current per-sample membership row. |
-| Latest closed search branch | Identity-Focused Inference is closed as paper-source-only identity-level inference / extraction evidence unless official public code and row-bound identity/member artifacts or a reviewed identity-privacy consumer boundary appear. RAPTA / ADMCD is closed as paper-source-only copying / memorization mitigation evidence unless official public code and row-bound pre/post copying artifacts or a reviewed copying/memorization consumer boundary appear. GUARD is closed as code-public surgical memorization mitigation evidence unless row-bound pre/post-mitigation artifacts or a reviewed memorization-mitigation consumer boundary appear. BAF is closed as weight-only LoRA mitigation evidence unless row-bound pre/post-mitigation artifacts or a reviewed weight-only LoRA mitigation consumer boundary appear. Broken Memories is closed as memorization detection/mitigation semantic-shift evidence unless row-bound replay artifacts or a reviewed memorized-generation consumer boundary appear. IAR Privacy Attacks remains closed as image-autoregressive code-public watch-plus unless row-bound public replay artifacts or a reviewed IAR boundary appear. Silent Brush, Trajectory Generation Privacy, Model Will Tell / DRC, Discrete DLM, GitHub lightweight diffusion MIA triage, CopyMark `laion_mi`, and the collaborator Stable Diffusion ReDiffuse bundle retain their previously documented close/reopen conditions. |
+| CPU sidecar | none selected after H2 output-cloud order-control seed-stability and ReDiffuse STL-10 weak metric verdicts. H2 output-cloud geometry retained strong signal on the existing `512 / 512` cache and on bounded `256 / 256` shared-position order-control scouts, but it remains a Research-side candidate rather than a Platform/Runtime row. ReDiffuse STL-10 remains closed by default: the released scout completed `300` steps and produced a `256 / 256` score packet, but fixed-timestep denoising-loss was random-level (`AUC = 0.4996337890625`, `ASR = 0.509765625`, `TPR@1%FPR = 0.01171875`, `TPR@0.1%FPR = 0.0`); a one-pass SimA-style denoiser-output score-norm scorer on the same checkpoint/split was also random-level (`AUC = 0.5052947998046875`, `ASR = 0.525390625`, `TPR@1%FPR = 0.03125`, `TPR@0.1%FPR = 0.01953125`). |
+| Latest mechanism watch | H2 output-cloud geometry is the latest strong Research-side mechanism candidate: existing `512 / 512` cache review, `256 / 256` shared-position order-control, and seed `177` stability all retain strong signal while label-shuffle sanity stays random-level. It is not admitted because it remains one H2 response-cache geometry candidate, not a second public asset or Platform/Runtime consumer contract. Reopen only for formal mechanism promotion, a second public asset, an independent consumer contract, or a genuinely new observable; do not run same-cache feature sweeps or a full `512 / 512` shared-position rerun by default. |
+| Previous mechanism watch | Feature-packet consumption remains deferred: Tracing the Roots is positive Research-only feature-packet evidence, but there is no second public non-source-equivalent feature packet and no raw target/sample/regeneration asset. Identity-Focused Inference / arXiv `2410.10177`, RAPTA / ADMCD / arXiv `2603.13070`, and GUARD / arXiv `2603.00133` remain semantic-shift watch items, not current per-sample membership rows. |
+| Latest closed search branch | Identity-Focused Inference is closed as paper-source-only identity-level inference / extraction evidence unless official public code and row-bound identity/member artifacts or a reviewed identity-privacy consumer boundary appear. RAPTA / ADMCD is closed as paper-source-only copying / memorization mitigation evidence unless official public code and row-bound pre/post copying artifacts or a reviewed copying/memorization consumer boundary appear. GUARD is closed as code-public surgical memorization mitigation evidence unless row-bound pre/post-mitigation artifacts or a reviewed memorization-mitigation consumer boundary appear. BAF is closed as weight-only LoRA mitigation evidence unless row-bound pre/post-mitigation artifacts or a reviewed weight-only LoRA mitigation consumer boundary appear. Broken Memories is closed as memorization detection/mitigation semantic-shift evidence unless row-bound replay artifacts or a reviewed memorized-generation consumer boundary appear. IAR Privacy Attacks remains closed as image-autoregressive code-public watch-plus unless row-bound public replay artifacts or a reviewed IAR boundary appear. Silent Brush, Trajectory Generation Privacy, Model Will Tell / DRC, Discrete DLM, GitHub lightweight diffusion MIA triage, CopyMark `laion_mi`, the collaborator Stable Diffusion ReDiffuse bundle, and ReDiffuse STL-10 retain their documented close/reopen conditions. |
 | Highest-value next action | Continue non-duplicate Lane A clean-asset search only for candidates with public target identity, exact member/nonmember split artifacts, response or score coverage, and a public row-binding path. Do not reopen the ReDiffuse STL-10 short-target denoising-loss or score-norm line unless a public third-party checkpoint/score packet appears, a genuinely different membership observable is proposed, or a reviewed long-training budget with checkpoint and score-packet publication contract is explicitly approved. Do not reopen CommonCanvas, Beans, MIDST, same-contract mid-frequency residual, the collaborator Stable Diffusion ReDiffuse bundle, or the current public CopyMark `laion_mi` surface unless a new artifact changes the actual decision gate. CPSample remains defense watch-plus; reopen it only if checkpoint-bound denoiser/classifier artifacts or hashes, exact train/test/subset row identities, protected/unprotected row-bound score packets, ROC/metric JSON, retained-utility metrics, and a defended-vs-undefended adaptive-attacker consumer contract are public. DSiRe / LoRA-WiSE remains a future weight-only privacy lane candidate, but reopen it only if DiffAudit explicitly opens a weight-only LoRA dataset-size recovery consumer contract with MAE/MAPE/accuracy as primary metrics and language separating aggregate model-weight cardinality leakage from per-sample MIA. CopyMark remains official Research-side score-artifact support evidence, but reopen its public asset path only if authors publish a compact row-ID-bound score manifest, checkpoint hashes, a no-training verifier, or a small immutable data/checkpoint packet that avoids the full HF zip and model-folder downloads. VAE2Diffusion remains code-public latent-space MIA watch-plus; reopen it only if public split manifests, matching checkpoints or generated response/feature caches, score rows, ROC/metric JSON, verifier outputs, or another bounded no-training artifact appears. DCR remains copying/memorization semantic-shift watch-plus; reopen it only if a public available LAION split or equivalent immutable image manifest, target checkpoint/generated response packets, score rows, ROC/metric JSON, verifier outputs, or an explicit copying/memorization consumer-boundary lane appear. FCRE remains a medical-image frequency-calibrated reconstruction-error paper-source watch item; reopen it only if official code plus frozen split manifests, matching target checkpoints, generated reconstruction packets, reusable score rows, ROC/metric JSON, verifier outputs, or a reviewed medical-image consumer-boundary lane appear. Tabular Privacy Leakage TDM is a single-table tabular code-public watch-plus item; reopen it only if paper-bound Berka/Diabetes target checkpoints, immutable split manifests, generated synthetic tables, reusable score rows, ROC/metric JSON, verifier outputs, or a reviewed tabular consumer-boundary lane appear. TMIA-DM remains a temporal-noise / noise-gradient paper-only mechanism watch item; reopen it only if official public code plus immutable target/split artifacts and reusable score/ROC/metric packets appear. Shake-to-Leak is a fine-tuning-amplified generative-privacy code-public watch-plus item, but reopen it only if public checkpoint-bound score artifacts, immutable split manifests, generated private-set packets, or ready verifier outputs appear. FSECLab MIA-Diffusion is a direct diffusion-MIA code-public watch-plus item, but reopen it only if public checkpoint-bound score artifacts, immutable split manifests, generated sample packets, or ready verifier outputs appear. MT-MIA remains useful public score-packet support evidence, but reopen it only if DiffAudit explicitly opens a relational-tabular synthetic-data membership lane, authors publish row-ID-bound verifier artifacts, or paperization needs clearly labeled cross-domain support outside Platform/Runtime rows. Reopen LSA-Probe only if real public adversarial-cost score artifacts, exact music/audio target identities, and exact member/nonmember manifests appear, or if DiffAudit explicitly opens a music/audio lane. Reopen DualMD/DistillMD only if public checkpoint-bound defended/undefended score artifacts, ROC arrays, metric JSON, generated response packets, or a bounded verifier appear and a consumer-boundary decision explicitly admits disjoint-training defense evidence. Reopen DIFFENCE only if public checkpoint-bound defended/undefended score artifacts or a bounded verifier appear and a consumer-boundary decision explicitly admits classifier-defense evidence. Reopen MIAHOLD/HOLD++ only if public checkpoint-bound score artifacts or a bounded verifier appear, plus an explicit TTS/audio consumer-boundary decision before any audio lane execution. Reopen the Quantile/SecMI-style support packet only if explicit quantile-regression score outputs, trained quantile artifacts, or a bounded verifier command are released, or if a consumer-boundary review approves third-party SecMI-style packets as paperization support without Platform/Runtime admission. Reopen ReproMIA only if a current non-withdrawn paper plus official public code, exact target/split manifests, and reusable score/metric artifacts appear; reopen Tracing Roots only if raw target checkpoint identity, raw sample manifests, or a feature-packet consumer-boundary decision appears; reopen CLiD only if authors publish a row manifest or HF gated access allows metadata-only manifest inspection. |
 | Stop condition | Do not download the Identity-Focused Inference arXiv source tarball, PDF, LFW / CelebA images, generated images, training data, Stable Diffusion / LDM / DDPM weights, checkpoints, or inferred code archives; do not implement identity inference or extraction from the paper, train face-generation targets, scrape face datasets, generate images, fit identity classifiers, launch CPU/GPU sidecars, or promote Identity-Focused Inference into Platform/Runtime rows until public row-bound identity/member artifacts and a reviewed identity-privacy consumer boundary exist. Do not download the RAPTA / ADMCD arXiv source tarball, PDF, generated images, training data, detector assets, Stable Diffusion weights, checkpoints, or inferred code archives; do not implement RAPTA or ADMCD from the paper, train/fine-tune targets, run object detection, generate images, fit copy detectors, launch CPU/GPU sidecars, or promote RAPTA / ADMCD into Platform/Runtime rows until public row-bound copying/memorization artifacts and a reviewed copying/memorization consumer boundary exist. Do not download the GUARD arXiv source, GitHub archive, Google Drive `sdv1_500_mem` assets, Stable Diffusion weights, reference model weights, generated images, masks, or checkpoints; do not run `detect_mem.py`, `inference_mem.py`, `generate_mask.py`, W&B logging, local generation, or mitigation sweeps; do not promote GUARD into Platform/Runtime rows until public row-bound pre/post mitigation artifacts and a reviewed memorization-mitigation consumer boundary exist. Do not download the BAF arXiv source or supplementary archive, LoRA weights, Stable Diffusion base weights, training images, generated images, or checkpoints; do not implement BAF from the paper, train/fine-tune LoRAs, run mitigation sweeps, launch CPU/GPU sidecars, or promote BAF into Platform/Runtime rows until public row-bound artifacts and a reviewed weight-only LoRA mitigation boundary exist. Do not download ImageNet train/validation, VAR/RAR/MAR weights, generated samples, memorization candidates, or extraction outputs for IAR Privacy Attacks; do not clone `FoundationVision/VAR`, `LTH14/mar`, `bytedance/1d-tokenizer`, or the full IAR repo for execution; do not run `main.py`, `analysis/mia_performance.py`, `analysis/di.py`, `mem_info`, `gen_memorized`, `find_memorized`, distributed extraction, CPU sidecars, or GPU jobs from this gate. Do not download Foursquare NYC, GeoLife, DiDi Chengdu, generated trajectories, trajectory-model checkpoints, or trajectory preprocessing assets for Trajectory Generation Privacy; do not implement trajectory discriminator-score or diffusion-loss attacks, train LSTM-TrajGAN, MoveSim, DiffTraj, or Diff-RNTraj, or open CPU/GPU sidecars from the paper. Do not download Cifar10, Cifar100, CelebA, FFHQ, latent-diffusion weights, face-recognition encoders, CLIP checkpoints, generated images, or restored image payloads for Model Will Tell / DRC; do not implement degradation/restoration scoring, train Cifar/CelebA diffusion targets, run latent-diffusion restoration, sweep masks, or open CPU/GPU sidecars from the paper. Do not download MIMIR, MDLM checkpoints, language-model weights, tokenizer artifacts, or text datasets for Discrete DLM; do not implement reconstruction-loss/XGBoost/MLP features from the withdrawn abstract or open a text/DLM CPU/GPU sidecar without a current paper, artifacts, and consumer-boundary decision. Do not download CIFAR-10, CelebA, LSUN, Stable Diffusion weights, denoiser/classifier checkpoints, generated images, or missing Google Drive placeholders for CPSample; do not run `python main.py`, train classifiers, fine-tune denoisers, generate protected/unprotected images, run `--inference_attack`, or launch CPU/GPU sidecars from this gate. Do not download LoRA-WiSE parquet shards, image folders, Stable Diffusion weights, or LoRA tensor payloads; do not run `python dsire.py`, FAISS/SVD sweeps, CPU sidecars, or GPU work unless a separate weight-only consumer contract is opened. Do not download CopyMark HF `datasets.zip`, image folders, Stable Diffusion/CommonCanvas/LDM/Kohaku weights, LAION/COCO/CC12M/YFCC/DataComp/FFHQ/CelebA-HQ/CommonCatalog payloads, or model folders; do not clone the full repo by default, run PIA/PFAMI/SecMI/GSA scripts, regenerate features, fit XGBoost models, or launch GPU work from the CopyMark official score artifact gate. Do not download CIFAR-10, CelebA, ImageNet-1K, Pokemon, COCO, Flickr, LAION, Stable Diffusion weights, VAE/LDM checkpoints, split payloads, generated responses, or pullback/per-dim caches for VAE2Diffusion; do not train LDMs, fine-tune Stable Diffusion, run SimA/PFAMI/PIA variants, or launch GPU work from that gate. Do not download LAION payloads, DCR Drive split folders, Stable Diffusion weights, generated image sets, or retrieval outputs; do not fine-tune, infer, run retrieval, or launch GPU work for DCR. Do not download FeTS, ChestX-ray8, CIFAR-10, or medical-image payloads, train diffusion targets, run DDIM reconstruction, sweep frequency bands, or launch GPU work for FCRE. Do not download Berka/Diabetes/MIDST resources, train ClavaDDPM targets or shadows, run Tartan Federer/Ensemble/EPT attacks, promote MIDST toolkit integration-test fixtures, or launch GPU work for Tabular Privacy Leakage TDM. Do not download CIFAR/Tiny-ImageNet/Pokemon/LAION/COCO assets, train or fine-tune diffusion targets, reconstruct temporal-noise trajectory pipelines, or launch GPU work for TMIA-DM. Do not download Stable Diffusion weights, LAION/person images, synthetic private sets, or checkpoints for Shake-to-Leak; do not run `sp_gen.py`, LoRA/DB/End2End fine-tuning, SecMI scripts, or data extraction from that gate. Do not download CIFAR-10, CelebA, DDIM/DCGAN checkpoints, generated samples, or full repo payloads for FSECLab MIA-Diffusion; do not run DDIM/DCGAN training, sampling, attack scripts, or TTUR evaluation from that gate. Do not download MT-MIA raw figshare datasets, synthetic CSV payloads, ClavaDDPM/RelDiff training assets, or the full repository; do not regenerate high-cost RelDiff outputs or promote relational-tabular score packets without a consumer-boundary decision. Do not download MAESTRO, FMA-Large, DiffWave, MusicLDM, audio clips, checkpoints, or GitHub Pages demo JSON as LSA-Probe experiment evidence; do not implement LSA-Probe from the TeX or demo. Do not download the DualMD/DistillMD SharePoint Pokemon payload, Stable Diffusion weights, CIFAR/CIFAR100/STL10/Tiny-ImageNet datasets, or run DDPM/LDM training, distillation, SecMIA/PIA, black-box attack scripts, or launch GPU jobs from this gate. Do not download DIFFENCE Google Drive diffusion/target model folders or CIFAR/SVHN datasets; do not train classifiers or diffusion models, generate DIFFENCE reconstructions, run MIA scripts, or launch GPU jobs from that gate. Do not download MIAHOLD/HOLD++ Grad-TTS, HiFi-GAN, CLD-SGM, CIFAR, CelebA, LJSpeech, or LibriTTS assets; do not scrape W&B, train HOLD++ CIFAR/audio models, regenerate PIA scores, or launch GPU jobs from that gate. Do not clone the full `neilkale/quantile-diffusion-mia` repository by default, download pretrained DDPM checkpoints/CIFAR archives/SharePoint model folders, run training, fit quantile models, recover W&B artifacts, or launch GPU jobs from that support packet. Do not promote Identity-Focused Inference, RAPTA / ADMCD, GUARD, BAF, IAR Privacy Attacks, Trajectory Generation Privacy, Model Will Tell / DRC, CPSample, DSiRe / LoRA-WiSE, CopyMark, VAE2Diffusion, DCR, FCRE, Tabular Privacy Leakage TDM, TMIA-DM, Shake-to-Leak, FSECLab MIA-Diffusion, MT-MIA, LSA-Probe, DualMD/DistillMD, DIFFENCE, or MIAHOLD as admitted rows, Quantile replay as a Quantile Regression result, or any of these lines as admitted Platform/Runtime rows. Keep the existing no-download/no-GPU constraints for Discrete DLM, ReproMIA, DMin, ELSA, Memorization Anisotropy, FERMI, DurMI, FMIA, CLiD, StablePrivateLoRA, MIDM, GGDM, Diffusion Memorization, ReDiffuse, and same-family MIDST expansions. |