How exactly would an attacker have enough access to your encrypted data to do a diff attack? If he has physical access to the machine you're going to be comprom

How exactly would an attacker have enough access to your encrypted data to do a diff attack? If he has physical access to the machine you're going to be compromised regardless of the details of the encryption scheme.