Large language models (LLMs) can produce harmful content when prompted with unsafe inputs, yet inference-time safety interventions often degrade general-purpose performance through over-refusal. We propose SURE (Semi-supervised Uncertainty-weighted Representation-based External detection), a framework that trains a lightweight classifier on the LLM’s hidden state representations to detect harmful inputs entirely outside the inference pipeline, preserving the model’s original capabilities. To overcome annotation scarcity, SURE queries the target LLM to assess unlabeled inputs and weights each pseudo-label by the classifier’s confidence, the LLM’s uncertainty, measured as the perplexity of its single-token safety self-assessment, and their agreement. Experiments across three open-source LLMs (8B–70B parameters) show that SURE achieves average harmonic mean scores of 88–90% with only 80 labeled samples, surpassing both inference-time and representation-based baselines. Performance plateaus at 40 labeled examples, and cross-category generalization confirms over 90% accuracy on held-out categories, indicating that the learned representations capture general safety features.

The rapid adoption of diffusion models in medical imaging has raised significant concerns regarding data privacy, especially their susceptibility to Membership Inference Attacks (MIAs). However, the privacy risks associated with diffusion models in the medical domain remain underexplored compared to natural images. In this study, we propose a novel grey-box attack framework, termed the Discrete Encoding-Based Membership Inference Attack (DEB), inspired by Denoising Diffusion Codebook Models (DDCM). DEB injects semantically meaningful noise via a discrete codebook strategy and identifies training samples by analyzing the model’s output trajectory under this discrete encoding, specifically measuring the average of intermediate predictions across selected time steps. We conduct an evaluation of MIAs across natural images and five representative datasets from the MedMNIST collection. Our experiments reveal that the susceptibility of diffusion models is highly dependent on the data modality; for instance, while certain datasets exhibit near-complete vulnerability, others like PathMNIST demonstrate strong inherent resistance to MIAs. Furthermore, DEB demonstrates superior performance compared to existing baselines (e.g., SecMI, PIA, SimA), particularly on challenging datasets. For example, DEB achieves a True Positive Rate at 1% False Positive Rate (TPR @ 1% FPR) of 60.3% on CIFAR-10, significantly outperforming the SimA baseline (35.9%). Notably, even on the highly resistant PathMNIST dataset, DEB attains a 10.2% TPR @ 1% FPR, establishing a substantial advantage over the PIA baseline (1.1%). This work provides practical insights into the privacy risks inherent in diffusion models and emphasizes that model providers should carefully assess these vulnerabilities when exposing intermediate generation APIs.