{"id":"b020b483-2839-46a3-9ea5-32bfd506da29","arxiv_id":"2412.16257","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A training-free integrity verification method for black-box text-to-image diffusion models that detects tampering via KL divergence between feature distributions and selects discriminating prompts with a learning automaton.","lead":"Black-box text-to-image services can be secretly fine-tuned to produce harmful images, and this paper proposes a method to detect such tampering by comparing the statistical distribution of features in generated images. It introduces a prompt-selection algorithm that finds the text prompt that makes tampering easiest to spot, and reports high detection accuracy on four popular models.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (5)'s relative KL is computed from 2048-dim Inception-v3 covariance estimates using only n=5 images, with no stated regularization; as written the feedback may be undefined, so the reported AUC may rest on an unstated estimator.","rationale":"The paper's headline result is that integrity violations can be detected with AUC >0.96 by thresholding a relative KL divergence between fitted Gaussians. For that to be true, the KL values must be well-defined and stable when estimated from very few images. The manuscript does not state how a 2048x2048 covariance is estimated from n=5 samples. A raw empirical covariance is singular, and the KL between two singular Gaussians is generically infinite unless the row spaces coincide; the denominator in Eq. (5) is itself a KL between two independent estimates of f0, so under singular fits it can be arbitrarily unstable. The phrase 'Bayesian estimation with non-informative prior' does not fix this, since standard Bayesian posteriors still concentrate on singular matrices when n<d. Thus the algorithm as written cannot compute the feedback values that drive every elimination and final decision. This is not a matter of disagreeing with the authors' assumptions; it is an internal consistency check on the described procedure. The reader flagged the same weak spot, and we agree. A concrete reproduction test can settle it: if the KL values are finite in the authors' implementation, they must disclose the regularizer; if not, the Table 3 numbers likely came from a different algorithm and require re-evaluation. Because this is addressable by code/artifact release and a precise statistical specification, the appropriate verdict remains CONDITIONAL, matching the reader's judgment.","tokens_in":12881,"tokens_out":6429,"duration_ms":58467,"concrete_test":"Re-implement §4.1 and Algorithm 1 exactly as written: extract 2048-d Inception-v3 features from n=5 images per model (f0, f0 for P', and fm) for each of the 50 prompts, compute empirical covariances, and evaluate Eq. (5) using the standard multivariate-normal KL formula (or scipy). Record the fraction of prompts for which β_p is finite and the distribution of D_KL(P||P') over 20 independent draws. If a substantial fraction of β_p is NaN/infinite or D_KL(P||P') is below machine precision, the metric as described is not implementable; the authors should then specify their exact shrinkage/PCA estimator and show that the Table 3 AUCs persist under that estimator with n=5 versus n=50.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—mean AUC 0.972—requires that the feedback β_p in Eq. (5) be a computable, stable signal. Algorithm 1 computes β_p from Gaussian fits of Inception-v3 features, whose penultimate layer has dimension 2048. Implementation details (§5.1.5) set n=5 images per model per prompt per round, and no dimensionality reduction, shrinkage, or diagonal approximation is described anywhere in §4 or §5. With n=5, the empirical covariance of 2048-dim features has rank at most 4, hence is singular; the KL divergence between two such Gaussians is finite only if the means lie in the common support and the covariance row spaces coincide, which generically fails. Thus D_KL(P||P')—the denominator in Eq. (5)—can be zero, infinite, or undefined, making β_p and the t-tests in §4.2.3 non-computable as written. The only mention, 'standard Bayesian estimation with non-informative prior [45]', does not resolve singularity. Consequently, either the method is not reproducible as specified, or the reported experiments used an unstated regularized estimator (e.g., diagonal covariance or PCA), which changes the algorithm. This is load-bearing because the learning automaton's elimination rule and the final threshold decision both consume these β_p values; if the values are noise, the AUC claim is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PromptLA, a black-box integrity verification framework for text-to-image (T2I) diffusion models. For a candidate prompt, it extracts Inception-v3 features from images generated by the original and suspicious models, models the feature distributions as multivariate Gaussians, and computes a relative KL divergence (Eq. 5) as a tampering signal. A learning-automaton prompt-selection algorithm (Algorithm 1) iteratively evaluates a small set of prompts, eliminates non-discriminative prompts via sequential t-tests or Z-tests, and returns the most discriminative prompt. A threshold θ then decides whether an integrity violation is reported. Experiments on SD-v1.5, SDXL, HunyuanDiT-v1.2, and FLUX.1-dev-fp8 report a mean AUC of 0.972 over various integrity violations, outperforming trained baselines by more than 0.2, with robustness to image-level post-processing.","tokens_in":13155,"tokens_out":6204,"duration_ms":53151,"significance":"If the reported results are reproducible, the paper makes a useful contribution: it addresses a realistic black-box scenario, avoids training attack-specific classifiers, and demonstrates that prompt selection can substantially improve detection of fine-grained tampering such as LoRA injection and parameter modification. The use of learning automata for query-efficient prompt selection is novel in this context, and the generalization across four architectures is encouraging. However, the central statistical estimator—the Gaussian KL feedback used throughout Algorithm 1—is underspecified, and the evaluation protocol for the headline AUC also needs clarification. The paper would be a solid contribution after these load-bearing issues are resolved.","major_comments":[{"comment":"The feedback β_p in Eq. (5) is computed from Gaussian fits to 2048-dimensional Inception-v3 features. With n=5 images per model per prompt per round, the empirical covariance matrix estimated from each model has rank at most 4 and is singular. The paper does not specify any dimensionality reduction, shrinkage, diagonal approximation, or Bayesian posterior covariance. The only qualification, “standard Bayesian estimation with non-informative prior [45],” does not define the prior or the resulting estimator, and does not resolve singularity. As written, the KL divergence between the two Gaussians is generically infinite or undefined, so the t-tests and Z-tests in §4.2.3 consume values that may not exist. This is load-bearing: the mean AUC of 0.972 in Table 3 rests on these β_p values. Please specify the exact covariance estimator used (e.g., diagonal covariance, PCA projection, shrinkage, or an explicit Bayesian posterior) and report an ablation over n and the regularization strength.","section":"§4.1, Eq. (5), §5.1.5"},{"comment":"The denominator of Eq. (5), D_KL(P||P′), uses a second independent estimate of the intact model’s feature distribution. The text says that P, P′, and Q are estimated from the images produced so far, but it does not state how the f0 images are split into the two independent sets, nor how zero or near-zero denominators are handled. With n=5, the denominator is a ratio of noisy, possibly singular covariance estimates and can be zero, making β_p undefined. Please specify the data-splitting protocol and a floor or stabilization for the denominator, and show the distribution of β_p under intact-versus-intact comparisons.","section":"§4.2.2, Eq. (5)"},{"comment":"The Student t-test and Z-test are applied to the sequence of β feedback values without justifying the required independence and normality assumptions. These values are ratios of dependent KL estimates from overlapping data, and the sequential hypothesis testing with elimination can inflate the Type I error beyond the nominal α. Because the elimination rule determines which prompts are evaluated and thus the cost and FPR reported in Tables 4 and 5, the statistical validity of this procedure needs support. Please provide a permutation or nonparametric test, or an empirical calibration study of the FPR under the null hypothesis of an intact model.","section":"§4.2.3, Algorithm 1"},{"comment":"The evaluation protocol for the headline AUC is not fully defined. In §4.3, verification stops for a tampered model as soon as d̂_m exceeds θ, while for an intact model the algorithm traverses the prompt library and the highest value encountered is recorded. It is unclear what score is assigned to each model for the ROC computation—whether it is the first value that exceeded θ, the maximum over all prompts evaluated before stopping, or some other statistic. Since PromptLA_v1 and PromptLA_v2 use different θ, and θ affects the stopping behavior, the reported AUC may depend on the scoring rule. Please specify the exact scoring rule used to compute AUC and justify that it is independent of the threshold.","section":"§4.3, Table 3"}],"minor_comments":[{"comment":"The abstract claims mean AUC above 0.96, the introduction claims above 0.95, and Table 3 reports an average of 0.972; these numbers should be aligned and the exact average stated consistently.","section":"Abstract, Introduction, Table 3"},{"comment":"The implementation details mention a generation time for SD-v2.1, but SD-v2.1 is not listed among the base models in §5.1.1; this appears to be a typo and should be corrected.","section":"§5.1.5"},{"comment":"Figure 4 states that the distribution is estimated using 50 images each, while §5.1.5 sets n=5 for PromptLA; please clarify whether Figure 4 is an illustrative setup and how it relates to the n=5 configuration used in the tables.","section":"Figure 4"},{"comment":"The summation notation in Eq. (6) is difficult to parse; rewriting it with explicit summation limits, e.g., a double sum over rounds and within-round indices, would improve clarity.","section":"§4.2.2, Eq. (6)"},{"comment":"In each round r, the inner loop computes feedback for k=1,...,r, so the feedback sequence grows by r items per round and the total size after R_e rounds is O(R_e^2); please confirm this is intended and clarify the associated t-test/Z-test switching condition on |F_i(r)|.","section":"Algorithm 1, line 5"},{"comment":"The baseline evaluation uses a single fixed prompt, prompt22 “Lion,” selected because Figure 4 shows it is discriminative for most violations; since this prompt choice may favor the baselines, reporting the range of baseline AUCs over several prompts would make the comparison more informative.","section":"§5.1.3, Table 3"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely problem and the empirical gains are large, but the missing specification of the covariance estimator is a genuine blocker for reproducibility. I do not see evidence of circularity or result forcing: the KL statistic is computed from generated images, the AUC is threshold-independent in principle, and the prompt library is external. However, the adaptive stopping rule makes the AUC scoring rule non-obvious, and the authors should be asked to state it precisely. If the required estimator and scoring details are provided, and the experiments are rerun or confirmed under the clarified protocol, I would be willing to reconsider."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe one thing you should know: this paper introduces a genuinely new problem—integrity verification of black-box text-to-image diffusion models—and reports a strong empirical result (mean AUC 0.972) with a simple, training-free method. I think the idea is worth taking seriously, but the statistical core is underspecified in exactly the spot the stress-test note flags, and that keeps me from trusting the headline number as written.\n\nWhat's new and good: The problem framing is fresh. Prior work does ownership verification or AI-image attribution; nobody has framed black-box integrity verification for T2I models as a prompt-selection problem. The method itself is sensible: fit Gaussians to Inception-v3 features of generated images, measure relative KL divergence, and use a learning automaton (with t-tests/Z-tests) to eliminate non-discriminative prompts. The evaluation covers four base models, several attack types (FFT, LoRA, parameter noise, version rollback), and shows robustness to JPEG/cropping. The baseline comparison is fair in the sense that trained classifiers generalize poorly to unseen attacks—this is the paper's main selling point—and the ablation shows the prompt-selection module helps.\n\nSoft spots: The stress-test concern is real. Eq. (5) computes KL divergence between two multivariate normals estimated from 2048-dim Inception-v3 features with n=5. Without PCA, shrinkage, or diagonal covariance, the empirical covariance is singular and the KL can be undefined. The paper's only mitigation, 'standard Bayesian estimation with non-informative prior [45]', doesn't fix this as described. So either the implementation used an unstated regularizer (which would be a different algorithm) or the feedback is numerically unstable. This is load-bearing: the automaton's elimination rule and the final threshold decision both consume these beta values. The paper also tunes theta and alpha on the evaluation data, reports no error bars (the 20 repeats are averaged), and releases no code or data. These are addressable, but they block full acceptance as submitted.\n\nWho this is for: people working on model watermarking, AI-content provenance, and platform governance. They will find the problem definition and the prompt-selection idea useful even before the estimator is clarified.\n\nRecommendation: send to peer review, but with a strong request to specify the covariance estimation (or replace the Gaussian model with something stable), release code, and report variance across runs. As written, I'd take the AUC with a grain of salt, but the paper is worth refereeing.","headline":"New problem and strong black-box results, but the multivariate Gaussian KL estimator is underspecified and the headline AUC rests on an unstated regularizer.","tokens_in":13702,"tokens_out":3067,"would_cite":false,"duration_ms":25397,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"PromptLA detects tampering in black-box text-to-image diffusion models by measuring relative KL divergence between Gaussian fits of generated-image features, reporting a mean AUC above 0.96 across four model families.","keywords":["text-to-image diffusion models","integrity verification","black-box model auditing","KL divergence","learning automaton","prompt selection","model tampering detection","AI copyright"],"falsifier":"Recompute the paper's Table 3 with $n=50$ images per prompt per model instead of $n=5$; if the mean AUC drops substantially, or if the 2048-dimensional covariance matrices used in Eq. (4) turn out to be singular at $n=5$, the reported 0.96 AUC rests on unstable distribution estimates rather than genuine model differences.","tokens_in":12664,"feed_emoji":"🖼️","tokens_out":10677,"duration_ms":82961,"temperature":0.7,"pith_summary":"The paper aims to establish that a black-box verifier can tell whether a text-to-image diffusion model has been tampered with—fine-tuned, LoRA-injected, parameter-noised, or rolled back—by comparing the statistical distribution of features in images the model generates, without training a classifier for each attack. It proposes PromptLA, which scores candidate prompts by the relative Kullback-Leibler (KL) divergence between Gaussian fits of Inception-v3 features from the original and suspicious models, then uses a learning automaton with hypothesis testing to eliminate weak prompts and return one that exposes the tampering. Across SD-v1.5, SDXL, HunyuanDiT-v1.2, and FLUX.1-dev-fp8, the paper reports mean area-under-the-ROC-curve (AUC) scores of 0.969 and 0.972, beating trained attribution baselines by more than 0.2 while using fewer queries and remaining accurate under JPEG compression and cropping. If correct, this gives model owners a practical, attack-agnostic way to establish that their model was modified, with a quantifiable statistic usable in copyright disputes.","feed_headline":"Feature-distribution test catches tampered image models at 0.96 AUC","feed_subtitle":"PromptLA needs no attack-specific training and stays accurate under JPEG and cropping post-processing.","key_machinery":"The load-bearing object is the relative KL divergence $\\beta_p = D_{KL}(P\\|Q)/D_{KL}(P\\|P') - 1$, where $P$ and $P'$ are independent Gaussian fits to Inception-v3 feature vectors from the original model and $Q$ is the Gaussian fit from the suspicious model under prompt $p$; the denominator normalizes away the model's internal randomness. PromptLA wraps this score in a learning automaton, defined here as a reinforcement-learning scheme that iteratively selects actions in a stochastic environment, and applies a statistical hypothesis-testing action-elimination rule: each round it re-estimates $\\beta_p$ for surviving prompts using all historical queries in a cross-validation style, identifies the estimated best prompt, and removes any prompt whose feedback mean is significantly lower at level $\\alpha$, using a t-test for small feedback sequences and a Z-test later. The implementation uses $n=5$ images per prompt per model per round, and the final prompt's $\\beta_p$ is compared with a threshold $\\theta$ to declare an integrity violation.","core_discovery":"The central claim is that every common integrity violation of a T2I diffusion model changes the distribution of Inception-v3 features in the images the model generates under at least some prompts, and that this change is measurable from black-box queries. PromptLA searches a candidate prompt library with a learning automaton, scoring each prompt by relative KL divergence $\\beta_p$ between Gaussian fits of features from the original and suspicious models, and eliminates non-discriminating prompts with t-tests or Z-tests. With two configurations of significance level and threshold, the paper reports mean AUCs of 0.969 and 0.972 on four model families, exceeding trained baselines by more than 0.2 and preserving high accuracy after JPEG compression and random cropping.","pith_inferences":["The paper does not analyze an adaptive attacker; a natural extension is to test whether a malicious user who can observe the verifier's prompts could fine-tune the model to preserve Inception-v3 feature means and covariances, which would likely evade this detector.","The relative-KL normalization suggests the same auditing idea could transfer to other generative domains, such as audio, video, or text, wherever a fixed feature extractor and a conditioning signal exist; this goes beyond the paper's T2I experiments.","The decision thresholds are chosen experimentally, so a principled calibration of $\\theta$ from the null distribution of $\\beta_p$ would remove a free parameter and is a testable extension the paper leaves open.","Replacing the small-sample Gaussian fit with a nonparametric two-sample test on lower-dimensional features could lower the number of images needed per prompt, a variant the paper does not explore."],"forward_implications":["A model owner can audit a black-box T2I service without knowing which attack was used, because PromptLA picks the discriminating prompt on the fly instead of relying on a classifier trained on known attacks.","Because verification is classifier-free, it generalizes to unseen tampering methods; the trained baselines collapse on violations outside their training set while PromptLA's average AUC stays above 0.96.","The protocol supplies a quantifiable per-prompt statistic and a decision threshold, which could serve as evidence in disputes over whether a user modified a model.","The adaptive prompt-elimination rule reduces query cost on hard violations, keeping verification practical when each image can take tens of seconds to generate.","The method's tolerance of JPEG compression and cropping means ordinary image handling by users will not by itself trigger a false integrity alarm."],"supporting_citations":[{"why":"supplies the statistical hypothesis-testing framework that PromptLA uses to eliminate non-discriminating prompts","marker":"[8]"},{"why":"provides the KL divergence formula used to compare feature distributions of generated images","marker":"[16]"},{"why":"defines the Inception-v3 feature extractor that maps generated images to the compared distributions","marker":"[37]"},{"why":"motivates the Bayesian estimation with a non-informative prior used to reduce bias in the Gaussian distribution estimates","marker":"[45]"},{"why":"used to generate the candidate prompt library from which PromptLA selects","marker":"[1]"},{"why":"supplies the Stable Diffusion base models whose integrity is verified in the experiments","marker":"[30]"},{"why":"provides the DreamBooth fine-tuning methodology used to create the full fine-tuning integrity violation","marker":"[31]"},{"why":"provides the LoRA method used to create several parameter-efficient fine-tuning violations","marker":"[32]"},{"why":"serves as a trained attribution baseline that PromptLA must beat on generalization","marker":"[35]"}],"fun_headline_variants":["KL divergence on image features catches tampered T2I models","PromptLA verifies diffusion model integrity from black-box queries","0.97 AUC: feature distribution test flags tampered image models","First black-box integrity verification for T2I diffusion models","Feature-distribution test spots fine-tuned T2I models at 0.97 AUC"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that the pattern of image features from a model forms a bell-shaped (normal) cloud that can be estimated from just five generated images per prompt per round; if that small-sample estimate is not accurate, the distances and statistical tests that drive detection are unreliable.","fun_headline_variants_meta":{"raw":{"variants":["KL divergence on image features catches tampered T2I models","PromptLA verifies diffusion model integrity from black-box queries","0.97 AUC: feature distribution test flags tampered image models","First black-box integrity verification for T2I diffusion models","Feature-distribution test spots fine-tuned T2I models at 0.97 AUC"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000937,"raw_usage":{"total_tokens":3985,"prompt_tokens":898,"completion_tokens":3087,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":514,"completion_tokens_details":{"reasoning_tokens":2996}},"tokens_in":514,"tokens_out":3087,"duration_ms":19557,"temperature":1.0,"reasoning_tokens":2996,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T11:15:03.417917+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Recompute the paper's Table 3 with $n=50$ images per prompt per model instead of $n=5$; if the mean AUC drops substantially, or if the 2048-dimensional covariance matrices used in Eq. (4) turn out to be singular at $n=5$, the reported 0.96 AUC rests on unstable distribution estimates rather than genuine model differences.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"supplies the statistical hypothesis-testing framework that PromptLA uses to eliminate non-discriminating prompts"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"provides the KL divergence formula used to compare feature distributions of generated images"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"motivates the Bayesian estimation with a non-informative prior used to reduce bias in the Gaussian distribution estimates"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"provides the DreamBooth fine-tuning methodology used to create the full fine-tuning integrity violation"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"provides the LoRA method used to create several parameter-efficient fine-tuning violations"}],"review_version":1}