{"id":"26a89724-0514-4bfe-8309-aa21879de39b","arxiv_id":"2608.11732","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":8,"one_line_summary":"Collapsed generation, where certain prompts or embeddings force a diffusion model to produce nearly identical images across random seeds, can serve as a model-specific fingerprint for non-invasive ownership verification.","lead":"This paper proposes a way to prove that a text-to-image model was copied by finding special inputs that make the model always draw nearly the same image, like a behavioral fingerprint. The method works both when the verifier can inspect the suspect model and when the suspect is only a remote image-generating API.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"T2I-scale same-data uniqueness is untested; shared training data may yield overlapping collapse regions, causing false ownership matches.","rationale":"The reader's weakest assumption matches the most load-bearing gap I find: the paper extrapolates run-level fingerprint uniqueness from a small CIFAR-10 DDPM study to large-scale T2I models without a same-data, same-architecture controlled experiment at that scale. The framework has real independent support: the controlled CIFAR-10 confusion matrix in Fig. 7 shows diagonal separation across four runs, and the T2I confusion matrices in Figs. 8 and 10 show clear separation across models that differ in architecture or dataset. The robustness results under fine-tuning, pruning, quantization, and adaptive obfuscations are also encouraging. However, none of these experiments tests the scenario that the central claim most needs: two T2I models trained on the same public data with the same architecture but different initializations. The paper's own Appendix D concedes that natural collapsed prompts are sparse but persistent, driven by data outliers and training dynamics, which raises the possibility that shared data, not individual training outcome, is what determines collapse regions. Additionally, the verification statistic in Eq. 10 compares the suspect's aggregate fingerprint response only to the source model's normal-prompt reference distribution. This omission of a suspect-normal baseline means that a generally low-diversity suspect model could trigger a false positive even if it does not reproduce the source's specific collapsed regions. I therefore agree with the reader's conditional verdict: the approach is plausible and well-executed within its tested scope, but the central uniqueness claim at T2I scale needs a direct controlled test before the method can be considered reliable for ownership disputes involving independently trained models on shared data.","tokens_in":22845,"tokens_out":3629,"duration_ms":40971,"concrete_test":"Run a same-data T2I reproducibility study: take a fixed public text-image dataset (e.g., a 10k-image subset of LAION or a curated 5k-image set), and produce two models with identical architecture and training recipe but different random seeds, either by training SD1.4-class checkpoints from scratch or by fine-tuning the same SD1.4 base twice with different LoRA seeds on the same dataset. Construct natural-prompt fingerprint sets Pf for each model using the Sec. IV-C low-loss mining pipeline, then run the full cross-model verification of Sec. IV-D with M=4, K=4, and tau_f=1e-4. If either off-diagonal p_val falls below tau_f, the claimed individual-run specificity fails at T2I scale, and a suspect-normal baseline must be added to the verification statistic.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that collapsed generation is specific to an individual training run, not merely to architecture, data, or prompt. The only controlled evidence for run-level specificity is Sec. V-A: four CIFAR-10 DDPMs trained with the same architecture, dataset, upweighted 500-image subset, and optimizer, differing only in initialization. The T2I experiments in Figs. 8 and 10 compare models that differ in architecture, dataset, version, or fine-tuning lineage; no T2I experiment holds architecture and training data fixed while varying only the random seed. This gap matters because the paper's own Appendix D argues that natural collapse persists in deduplicated models due to \"outlier samples\" and \"training dynamics\" in shared public data. If collapse-prone regions are substantially driven by shared data outliers or duplicated samples rather than by parameter initialization, then two independently trained models on the same public dataset, or two derivatives fine-tuned from the same base, could share collapse-inducing prompts. The verification statistic in Eq. 10 is calibrated only against the source model's normal-prompt distribution and never against the suspect model's own normal cross-seed consistency. A suspect model that generally produces low-diversity outputs, for reasons unrelated to the source's specific collapse regions, could therefore yield a small p_val and be falsely declared a match. Thus the load-bearing untested premise is run-level uniqueness of collapsed regions at T2I scale, and the current evidence does not rule out data-driven overlap.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a non-invasive framework for verifying ownership of text-to-image (T2I) diffusion models by exploiting \"collapsed generation,\" i.e., input conditions under which independent stochastic samplings produce highly consistent outputs. The framework constructs two kinds of fingerprints: continuous text-embedding fingerprints for white-box pipeline access, optimized by a truncated-denoising surrogate loss, and natural-prompt fingerprints for black-box API-only access, mined from low-loss training samples. Verification aggregates cross-seed consistency scores over a fingerprint set and compares the aggregate to a source-model normal-prompt reference via a right-tailed predictive t-test (Eq. 10), declaring ownership when the resulting p-value falls below a threshold. The paper reports a controlled CIFAR-10 DDPM study with four independently trained models, T2I confusion-matrix experiments for white-box and black-box settings, robustness experiments under pruning, quantization, fine-tuning, and adaptive query-time obfuscations, and an efficiency comparison.","tokens_in":23154,"tokens_out":4609,"duration_ms":51449,"significance":"If the central claim holds, the framework would be a useful addition to non-invasive model IP protection: it provides both white-box and black-box verification with a unified statistical criterion, uses natural prompts in the API-only setting, and demonstrates robustness to several obfuscations. The controlled CIFAR-10 study in Sec. V-A is a genuine strength, as it directly tests run-level uniqueness under fixed architecture, data, and optimizer; the confusion-matrix evaluations on T2I models and the explicit adaptive-query experiments are also valuable. However, the significance is conditional because the core premise—that collapsed-generation regions are unique to an individual training run at T2I scale when architecture and training data are held fixed—is only directly supported by a small-scale upweighted CIFAR-10 study. The T2I experiments compare models that differ in architecture, dataset, version, or fine-tuning lineage, so they do not yet establish the claimed granularity for the setting the paper targets.","major_comments":[{"comment":"The only controlled test of run-level uniqueness uses four CIFAR-10 DDPMs trained on the same upweighted 500-image subset. The T2I uniqueness experiments in Figs. 8 and 10 compare models that differ in architecture, dataset, version, or fine-tuning lineage; no T2I experiment holds architecture and training data fixed while varying only the random seed. This is load-bearing because Appendix D argues that natural collapse persists even in deduplicated models due to \"outlier samples\" and \"training dynamics\" in shared public data, which implies that two independently trained models on the same public data could share collapse-inducing prompts. The paper should provide a same-data, same-architecture, different-seed T2I experiment, or alternatively an analysis of overlap between collapse-prone prompt sets of such models, and report the full cross-model verification p-value matrix for that setting.","section":"Sec. V-A and Figs. 8, 10"},{"comment":"The verification statistic compares the suspect's aggregate fingerprint response only to the source model's normal-prompt reference; it is never calibrated against the suspect model's own normal cross-seed consistency. A suspect model that is globally low-diversity for reasons unrelated to the source's specific collapsed regions would produce a small p_val and be falsely declared a match. The paper does not report a false-positive experiment with a low-diversity unrelated model, nor does it compute the suspect's own normal reference. Because Eq. (11) converts this p_val directly into an ownership decision, the missing suspect-side baseline is a load-bearing gap in the verification procedure.","section":"Sec. IV-D, Eq. (10)"},{"comment":"Fingerprint conditions are selected or optimized on the source model for high cross-seed consistency, so the matched-source diagonal in Figs. 7, 8, and 10 is partly satisfied by construction. The statistical test is also calibrated only against the source's normal prompts, not against an independent null distribution of the source's collapsed conditions or against conditions selected from a held-out subset. The paper should include an out-of-sample evaluation, for example by constructing fingerprints on one half of the source's collapse candidates and testing on the other half, to show that the observed separation reflects model specificity rather than a construction-time selection artifact.","section":"Sec. IV-C and Sec. IV-D"}],"minor_comments":[{"comment":"The caption describes a cumulative distribution of training loss, but the axes are labeled \"Cumulative Probability\" and \"Average Loss\" without explaining the curve and the marked threshold; please clarify what the plotted curve represents and how the likelihood ratio is computed.","section":"Fig. 6"},{"comment":"The green/red cell coloring used to indicate success and failure is not accessible in grayscale or for color-blind readers; please add explicit symbols (e.g., check/cross marks) or state success/failure in each cell.","section":"Tables II and III"},{"comment":"The entry \"SD 1.4 (white-box), Deci: N/A 1\" is formatted as if it contains a footnote marker; please move the footnote text to the actual footnote position.","section":"Appendix E"},{"comment":"The predictive t-test assumes the reference scores are approximately normal and that sigma_0 is nonzero; with N=50 many reported p-values are below 1e-18, far outside the reliable tail of a t-distribution with 49 degrees of freedom. Please report effect sizes or log-transformed p-values and state how zero variance in the reference would be handled.","section":"Eq. (10)"}],"recommendation":"major_revision","confidential_remarks":"The central claim is plausible and the controlled CIFAR-10 experiment is a good start, but the T2I-scale same-data uniqueness question is the crux of the paper and remains untested. I would ask the authors to supply a same-architecture, same-data, different-seed T2I experiment or to substantially weaken the uniqueness claim; without this, the method's ability to distinguish two models trained from the same public data is not demonstrated."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth engaging with seriously. The core idea—that collapsed generation (unusually high cross-seed consistency) can serve as a model-intrinsic fingerprint—is new among diffusion fingerprinting methods, and the authors back it with both a white-box realization (optimized continuous embeddings via truncated backprop) and a black-box one (natural prompts mined from low-loss training samples). Unlike FingerInv, which needs internal denoising states, or TVN, which uses adversarial suffixes, this works from final images and the prompts pass as ordinary text (perplexity around 40-50 versus TVN's 200+). The controlled CIFAR-10 study with four same-architecture, same-data, same-upweighted-subset runs differing only in initialization shows clean diagonal separation. That is the right experiment to attempt, and it works.\n\nThe soft spots are real but mostly addressable. The biggest one is that run-level uniqueness at T2I scale is untested. The only same-data/different-seed evidence is the small CIFAR-10 study; every T2I comparison uses models that differ in architecture, data, or version. The paper asserts in Sec IV-B that independently trained models on the same public data will have distinct collapsed regions, but it never demonstrates that at the scale that matters. Given the paper's own Appendix D says natural collapse persists in deduplicated models due to shared outliers and training dynamics, data-driven overlap is a live possibility. If two independent models share collapse-inducing prompts, the fingerprint loses its power. This needs a same-data, different-seed T2I experiment (or at least two LoRA derivatives from the same base).\n\nSecond, the verification statistic in Eq. 10 is calibrated only against the source's normal-prompt reference. It never measures the suspect's own normal cross-seed consistency. A suspect that is intrinsically low-diversity—say, a badly tuned model that always outputs near-identical images—could produce a small p-value against the source's reference and be falsely declared a match. The confusion matrices show the evaluated models are separable, but they don't include such a degenerate case. Adding a suspect-normal baseline to the test would close this.\n\nThird, minor: the decision threshold tau_f = 1e-4 looks selected after seeing results; there are no error bars on p-values across fingerprint sets or reference sets; and the low-loss candidate threshold is another free parameter. These are worth a few paragraphs of ablations.\n\nThis paper deserves a serious referee. The idea is strong, the implementation is honest, and the weaknesses are testable rather than fatal. I'd send it out, asking the authors to run the missing same-data T2I experiment and to anchor the statistical test on the suspect's own baseline.","headline":"Smart, well-executed fingerprinting idea with a real gap: run-level uniqueness at T2I scale is untested, and the verification test never checks the suspect's own normal baseline.","tokens_in":23678,"tokens_out":3166,"would_cite":false,"duration_ms":32110,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A diffusion model's collapsed-generation behavior — certain inputs yielding near-identical images across random seeds — can fingerprint the model through a plain text API, with no watermark required.","keywords":["text-to-image diffusion models","collapsed generation","model fingerprinting","ownership verification","intellectual property protection","diffusion model memorization","black-box model verification","white-box model verification"],"falsifier":"Train several text-to-image diffusion models (or DDPMs at a scale beyond CIFAR-10) on the same public dataset with identical architecture, optimizer, and training schedule, varying only the random seed, then run the paper's cross-model verification matrix: if matched fingerprint–model pairs no longer give $p_{\\mathrm{val}} < 10^{-4}$ while mismatched pairs do, the uniqueness premise fails. A cheaper check on the paper's own setup is to retrain the four CIFAR-10 DDPMs without the shared 500 upweighted images and see whether the diagonal separation of the $4\\times4$ matrix survives.","tokens_in":22658,"feed_emoji":"🖼️","tokens_out":15718,"duration_ms":129278,"temperature":0.7,"pith_summary":"This paper tries to establish that text-to-image diffusion models carry a built-in, per-model behavioral signature: for certain input conditions, independent stochastic samplings converge to nearly identical images, and the set of these collapse-prone conditions is specific to the individual trained model. If that claim holds, a model owner can verify that a leaked checkpoint or a hosted service derives from their model just by checking whether the suspect reproduces the source's characteristic collapse behavior across random seeds — no watermark embedded, no parameters altered, no internal states read. The framework prepares fingerprints in two forms matched to how much of the suspect is accessible: optimized continuous embeddings for white-box pipeline access, and natural-language prompts mined from low-loss training samples for black-box API-only access. In both settings, verification is the same statistical test, comparing the suspect's cross-seed output consistency against the source model's normal-generation baseline, and the default query budget is sixteen generations. This matters because existing alternatives either modify the model at train time (watermarking) or require internal readouts, both of which fail for already-trained checkpoints and end-to-end APIs.","feed_headline":"Collapsed prompts fingerprint copied diffusion models","feed_subtitle":"Prompts that yield near-identical images across seeds leave a fingerprint that survives fine-tuning via a plain API.","key_machinery":"The load-bearing object is the formal notion of collapsed generation, quantified by the cross-seed consistency score $\\bar{s}_\\theta(c,K)$: for a fixed conditioning input $c$ (a text embedding or a natural prompt) and $K$ independently sampled initial noises, Equation (4) averages the pairwise perceptual similarity — measured by the SSCD self-supervised copy-detection descriptor — of the $K$ generated images, and the condition is deemed collapsed when $\\bar{s}_\\theta(c,K) \\ge \\tau_s$. Two construction mechanisms produce fingerprint sets from this definition. For white-box pipeline access, truncated optimization minimizes a collapse loss $L_{\\mathrm{Collapse}}$, the average squared distance between early denoising latents and their mean, differentiating through only the first $t_{\\mathrm{trunc}}$ steps; the paper's observation that collapsed content stabilizes early in denoising is what makes this surrogate cheap. For black-box API access, natural-prompt mining exploits the empirical enrichment of collapse-prone prompts among training samples with unusually low denoising loss, screening only that reduced candidate pool by output-level consistency. Verification then runs a right-tailed predictive $t$-test: the aggregate fingerprint response $\\bar{s}_f$ over $M$ fingerprint conditions is compared with the source model's normal-prompt reference distribution, and a $p_{\\mathrm{val}}$ below the threshold $\\tau_f = 10^{-4}$ is read as evidence that the suspect reproduces the source's collapse signature.","core_discovery":"The central discovery is that collapsed generation is an intrinsic, model-dependent property of the learned generation process, not an artifact of the input condition alone. The paper puts it plainly: 'Collapsed generation reflects characteristics of the learned model rather than the input condition alone.' A condition that collapses one model, producing highly consistent outputs across independent seeds, typically yields ordinary, diverse outputs on an independently trained model; the paper shows this both for matched versus mismatched prompt–model pairs on Stable Diffusion 1.4 and 2.1 and in a controlled CIFAR-10 study in which four conditional DDPMs share architecture, data, optimizer, and training schedule and differ only in random initialization. In that study the cross-model verification matrix separates cleanly along the diagonal, which the paper takes as evidence that collapse patterns can be specific to an individual training outcome rather than to the dataset or architecture alone. On that basis the paper treats the source model's collapse-prone conditions as a fingerprint set and accepts an ownership claim when a suspect model reproduces statistically abnormal cross-seed consistency, a test that remains positive for fine-tuned derivatives, pruned and quantized checkpoints, and several adaptive query-time interventions.","pith_inferences":["If the uniqueness result scales, the same mechanism should generalize beyond image diffusion: any stochastic generative model — autoregressive image or video models, audio generators, or language models sampled at nonzero temperature — could be fingerprinted by the output consistency of repeated samples under fixed conditions, because the paper's signal is defined purely by output statistics.","The paper's appendix shows that optimized white-box embeddings cannot be converted back into text tokens (post-hoc projection and discrete prompt optimization both push $p_{\\mathrm{val}}$ above the threshold), which implies a lasting asymmetry: black-box fingerprints read as ordinary text, while white-box fingerprints are continuous and would be visible to anyone with pipeline access who inspects ","The low-loss enrichment result hands auditors a free diagnostic: if per-sample denoising losses are logged during any diffusion training run, the likely collapse-prone subset can be flagged retroactively, effectively turning fingerprint construction into a byproduct of standard training logs.","The cleanest test of the framework's core assumption would train several large text-to-image models on identical public data with only the random seed varied and run the same $4\\times4$ verification matrix; the paper's controlled evidence for run-level uniqueness currently comes only from the small CIFAR-10 study."],"forward_implications":["Already-trained, unwatermarked models become traceable after the fact, because the signature is intrinsic to the training outcome rather than implanted during training.","Black-box services are verifiable with ordinary-looking text: the natural-prompt fingerprints keep prompt perplexity near normal user text (41.85 and 51.32 on SD 1.4 and SD 2.1, versus above 200 for the adversarial-suffix baseline), giving a query-filtering service little to catch.","Derivative and obfuscation pipelines do not erase the signal: fingerprints stay verifiable across fine-tuned derivatives (SD 1.5, Deliberate, Realistic Vision), pruning up to 30 percent, quantization down to fp4, and adaptive interventions such as prompt rewriting, random token addition, embedding optimization, and sharpness-aware initialization.","Verification is cheap enough to be routine: with the default $M=4$ fingerprints and $K=4$ seeds, an ownership test costs sixteen generations, and pipeline-access fingerprint construction takes about 25 seconds per condition, matching the white-box baseline and far under the black-box suffix-optimization baseline's 370 seconds.","Both access regimes converge on the same decision rule, so one statistical procedure and one piece of evidence — cross-seed consistency — support checkpoint-level and service-level disputes alike."],"supporting_citations":[{"why":"supplies the empirical foundation that diffusion models can reproduce specific training examples, which the paper builds on to define collapsed generation.","marker":"[15]"},{"why":"explains data duplication as a driver of copying in diffusion models and provides the random-token-addition attack used as an adaptive obfuscation.","marker":"[17]"},{"why":"provides the public prompt collections from which the black-box natural-prompt fingerprint candidates are drawn.","marker":"[28]"},{"why":"provides the SSCD self-supervised copy-detection similarity score used to measure cross-seed consistency in Equation (4).","marker":"[32]"},{"why":"supports the claim that collapse-prone samples concentrate in the low-loss region of training, the basis for natural-prompt mining.","marker":"[39]"},{"why":"supplies the geometric account of memorization as narrow basins in the latent space, used to explain why optimized collapsed embeddings resist discretization.","marker":"[30]"},{"why":"the white-box baseline whose QR-code recovery evidence is compared against cross-seed consistency under pipeline access.","marker":"[13]"},{"why":"the black-box baseline whose adversarial-suffix prompts are compared on uniqueness, robustness, and prompt perplexity.","marker":"[12]"}],"fun_headline_variants":["Collapse patterns fingerprint image diffusion models","Hidden prompt collapses expose copied diffusion models","Diffusion model fingerprints via collapse-prone seeds","Black-box API fingerprints diffusion model lineage","Intrinsic collapse signatures reveal copied diffusion models"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The framework's load-bearing premise is that collapse-prone input regions are unique to an individual training run even when architecture, training data, and optimization are held identical; the only controlled evidence offered for that premise is the small CIFAR-10 DDPM study with upweighted samples, since the text-to-image experiments compare models that differ in data, architecture, or version.","fun_headline_variants_meta":{"raw":{"variants":["Collapse patterns fingerprint image diffusion models","Hidden prompt collapses expose copied diffusion models","Diffusion model fingerprints via collapse-prone seeds","Black-box API fingerprints diffusion model lineage","Intrinsic collapse signatures reveal copied diffusion models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00105,"raw_usage":{"total_tokens":4455,"prompt_tokens":1036,"completion_tokens":3419,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":652,"completion_tokens_details":{"reasoning_tokens":3356}},"tokens_in":652,"tokens_out":3419,"duration_ms":22929,"temperature":1.0,"reasoning_tokens":3356,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T00:29:35.401474+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train several text-to-image diffusion models (or DDPMs at a scale beyond CIFAR-10) on the same public dataset with identical architecture, optimizer, and training schedule, varying only the random seed, then run the paper's cross-model verification matrix: if matched fingerprint–model pairs no longer give $p_{\\mathrm{val}} < 10^{-4}$ while mismatched pairs do, the uniqueness premise fails. A cheaper check on the paper's own setup is to retrain the four CIFAR-10 DDPMs without the shared 500 upweighted images and see whether the diagonal separation of the $4\\times4$ matrix survives.","supporting_citations":[{"cited_title":"Extracting training data from diffusion models,","cited_arxiv_id":null,"evidence_quote":"supplies the empirical foundation that diffusion models can reproduce specific training examples, which the paper builds on to define collapsed generation."},{"cited_title":"Understanding and Mitigating Copying in Diffusion Models,","cited_arxiv_id":null,"evidence_quote":"explains data duplication as a driver of copying in diffusion models and provides the random-token-addition attack used as an adaptive obfuscation."},{"cited_title":"A self- supervised descriptor for image copy detection,","cited_arxiv_id":null,"evidence_quote":"provides the SSCD self-supervised copy-detection similarity score used to measure cross-seed consistency in Equation (4)."},{"cited_title":"Why diffusion models don’t memorize: The role of implicit dynamical regularization in training,","cited_arxiv_id":null,"evidence_quote":"supports the claim that collapse-prone samples concentrate in the low-loss region of training, the basis for natural-prompt mining."},{"cited_title":"A geometric framework for understanding memorization in generative models,","cited_arxiv_id":null,"evidence_quote":"supplies the geometric account of memorization as narrow basins in the latent space, used to explain why optimized collapsed embeddings resist discretization."},{"cited_title":"Fingerprinting Denoising Diffusion Probabilistic Models,","cited_arxiv_id":null,"evidence_quote":"the white-box baseline whose QR-code recovery evidence is compared against cross-seed consistency under pipeline access."},{"cited_title":"One Prompt to Verify Your Models: Black-Box Text-to-Image Models Verification via Non-Transferable Adversarial Attacks","cited_arxiv_id":"2410.22725","evidence_quote":"the black-box baseline whose adversarial-suffix prompts are compared on uniqueness, robustness, and prompt perplexity."}],"review_version":1}