arxiv: 2604.16363 · v1 · submitted 2026-03-20 · 💻 cs.CR · cs.AI· cs.CV

Recognition: no theorem link

CSF: Black-box Fingerprinting via Compositional Semantics for Text-to-Image Models

Junhoo Lee , Mijin Koo , Nojun Kwak

Authors on Pith no claims yet

Pith reviewed 2026-05-15 08:15 UTC · model grok-4.3

classification 💻 cs.CR cs.AIcs.CV

keywords black-box fingerprintingtext-to-image modelsmodel attributioncompositional promptsfine-tuning detectionIP protectionBayesian attributionsemantic fingerprinting

0 comments

The pith

Compositional Semantic Fingerprinting attributes fine-tuned text-to-image models to their source lineages using only black-box queries.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces Compositional Semantic Fingerprinting as the first black-box method for tracing fine-tuned text-to-image models back to protected base lineages. It works by querying models with compositional prompts that leave important details underspecified, prompts that fine-tuning rarely covers completely. Owners retain an advantage because they can generate new prompt compositions after deployment while any attacker must anticipate and suppress a much wider space of possible fingerprints. A Bayesian framework then converts the resulting response distributions into controlled-risk lineage decisions. Tests across six model families and thirteen fine-tuned variants show every case meets the dominance criterion for reliable attribution.

Core claim

CSF treats each text-to-image model as a generator of semantic categories and probes it with compositional underspecified prompts that remain rare even after fine-tuning. The resulting response distributions differ systematically between lineages, enabling a Bayesian classifier to attribute any fine-tuned variant back to its source model with only query access.

What carries the argument

Compositional underspecified prompts that elicit distinguishable response distributions for Bayesian lineage attribution.

If this is right

IP owners can create fresh fingerprints after a model is released, preserving detection capability over time.
The approach works across diverse families including FLUX, Kandinsky, and multiple Stable Diffusion versions.
Attribution decisions carry controlled risk because every tested variant satisfies the dominance criterion.
No pre-deployment watermarking or internal model access is required for enforcement.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The same prompt-composition strategy could be tested on other generative domains such as audio or video models.
Widespread use might shift commercial API terms toward stronger guarantees against unauthorized fine-tuning.
If the space of rare compositions proves finite in practice, attackers could eventually map and suppress them.

Load-bearing premise

Compositional underspecified prompts remain rare under fine-tuning and produce response distributions that differ enough between lineages to support reliable attribution without false positives.

What would settle it

A fine-tuned model that produces the same response distribution as an unrelated base model on the same set of compositional underspecified prompts would show the attribution method fails.

Figures

Figures reproduced from arXiv: 2604.16363 by Junhoo Lee, Mijin Koo, Nojun Kwak.

**Figure 2.** Figure 2: The “Name That Dataset” game [52] in Diffusion Fingerprinting. Image (a) is from a fine-tuned model (SD1.5- DreamShaper). One of the images (b, c, d) is its base model. This figure illustrates how difficult it is to identify the base model using a naive prompt (right column, randomly sampled from LAION-2B [46]), compared to our CSF prompt (left column). All images are uncurated results generated with diffe… view at source ↗

**Figure 3.** Figure 3: Challenges in naive fingerprinting approaches. (a) Visual space: t-SNE visualization of CLIP embeddings shows no family clustering. (b) Text space: Even when images are converted to captions via I2T models, style information leaks into the text, causing models from different families (e.g., SD1.5 DPO and SD2.1) to cluster together due to similar style descriptors. ous urban nocturnal animal”) that combin… view at source ↗

**Figure 5.** Figure 5: Generated category distributions vary substantially [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗

**Figure 6.** Figure 6: Failure cases of CSF. Top: prompts for baked goods [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗

read the original abstract

Text-to-image models are commercially valuable assets often distributed under restrictive licenses, but such licenses are enforceable only when violations can be detected. Existing methods require pre-deployment watermarking or internal model access, which are unavailable in commercial API deployments. We present Compositional Semantic Fingerprinting (CSF), the first black-box method for attributing fine-tuned text-to-image models to protected lineages using only query access. CSF treats models as semantic category generators and probes them with compositional underspecified prompts that remain rare under fine-tuning. This gives IP owners an asymmetric advantage: new prompt compositions can be generated after deployment, while attackers must anticipate and suppress a much broader space of fingerprints. Across 6 model families (FLUX, Kandinsky, SD1.5/2.1/3.0/XL) and 13 fine-tuned variants, our Bayesian attribution framework enables controlled-risk lineage decisions, with all variants satisfying the dominance criterion.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

CSF gives a workable black-box route to lineage attribution for fine-tuned T2I models via rare compositional prompts, but the dominance claim needs tighter empirical checks.

read the letter

The main thing to know is that this paper offers the first black-box method for attributing fine-tuned text-to-image models to base lineages using only API queries. It probes models with compositional underspecified prompts that stay rare after fine-tuning, then applies Bayesian attribution to reach a dominance decision on the true lineage. The setup targets a clear commercial need: IP owners who cannot inspect deployed models or force watermarking upfront. The asymmetric advantage—owners generate fresh prompt combinations post-deployment while attackers must cover a much larger space—is a clean conceptual move. They test across six families (FLUX, Kandinsky, SD 1.5/2.1/3.0/XL) and thirteen variants, reporting that every case meets the dominance criterion. That scope is reasonable for an initial demonstration and shows they tried to hit real deployed models rather than toy cases. The approach is straightforward and avoids the usual requirements for internal access or pre-deployment changes. On the soft side, the abstract and high-level description leave the Bayesian framework and prompt construction underspecified. No accuracy numbers, false-positive rates, or prompt examples appear, so it is hard to judge how sensitive the dominance result is to data overlap between fine-tunes or to prompt selection. The stress-test worry about distribution shifts creating overlaps is worth taking seriously; if two unrelated variants produce statistically close outputs on the chosen probes, posterior mass can leak and the dominance guarantee can fail. If the full paper supplies controls for that and shows stable separation, the claim holds up better. This work is aimed at researchers in AI security and model IP enforcement. Anyone thinking about black-box attribution or license compliance for generative models will find the strategy worth reading. I would send it to peer review. The problem is timely, the core idea is grounded in observable model behavior, and the experiments cover enough ground that referees can usefully push on the missing quantitative details.

Referee Report

2 major / 2 minor

Summary. The manuscript presents Compositional Semantic Fingerprinting (CSF), a black-box method for attributing fine-tuned text-to-image models to protected lineages using only query access. It probes models with compositional underspecified prompts that remain rare under fine-tuning and applies a Bayesian attribution framework to enable controlled-risk lineage decisions, claiming that all 13 variants across 6 families (FLUX, Kandinsky, SD1.5/2.1/3.0/XL) satisfy the dominance criterion.

Significance. If the empirical separation holds, the work offers a meaningful advance for IP enforcement in commercial T2I API settings where watermarking or white-box access is unavailable. The compositional prompt strategy creates an asymmetry favoring IP owners, as new fingerprints can be generated after deployment while attackers must cover a broad space.

major comments (2)

Experimental results section: The central claim that all 13 variants satisfy the dominance criterion rests on the assumption that fine-tuning does not induce distribution overlaps with unrelated lineages, yet no quantitative posterior values, false-positive rates, or overlap analysis between models (e.g., SDXL variants) is reported to verify this.
Bayesian attribution framework section: The framework is described at high level without explicit equations for the posterior computation or the precise mathematical definition of the dominance criterion, preventing verification that the method is free of circularity or unstated parameter dependence.

minor comments (2)

Abstract: Include at least one concrete prompt example and a summary statistic (e.g., minimum posterior mass) to make the success claim verifiable without reading the full experiments.
Notation and figures: The definition of compositional underspecified prompts would be clearer with an explicit example set and a table summarizing prompt rarity statistics across families.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their thoughtful and constructive comments. We address each major comment below with clarifications and commit to revisions that strengthen the empirical validation and formal presentation of the CSF method.

read point-by-point responses

Referee: Experimental results section: The central claim that all 13 variants satisfy the dominance criterion rests on the assumption that fine-tuning does not induce distribution overlaps with unrelated lineages, yet no quantitative posterior values, false-positive rates, or overlap analysis between models (e.g., SDXL variants) is reported to verify this.

Authors: We agree that the current presentation summarizes dominance satisfaction without the supporting quantitative details. In the revised manuscript we will add a dedicated subsection with per-variant posterior probabilities, false-positive rates obtained from cross-lineage probe sets, and explicit overlap metrics (pairwise posterior comparisons and distributional divergence) for models within the same family, including all SDXL variants. These additions will directly substantiate that fine-tuning does not produce problematic overlaps with unrelated lineages. revision: yes
Referee: Bayesian attribution framework section: The framework is described at high level without explicit equations for the posterior computation or the precise mathematical definition of the dominance criterion, preventing verification that the method is free of circularity or unstated parameter dependence.

Authors: We concur that the high-level description requires formalization for full verifiability. The revised version will include the explicit posterior formula P(L|D) ∝ P(D|L) P(L), where the likelihood P(D|L) is the product of empirical match probabilities over the compositional probes, and the dominance criterion will be defined precisely as P(L_true|D) > 0.95 with max_{L'≠L_true} P(L'|D) < 0.05. All hyperparameters and estimation procedures will be stated explicitly to eliminate any ambiguity or potential circularity. revision: yes

Circularity Check

0 steps flagged

No circularity: empirical attribution independent of self-referential definitions

full rationale

The derivation relies on querying external models with compositional prompts and applying Bayesian posterior dominance on observed response distributions. No equations or definitions reduce the attribution result to fitted parameters by construction, and the provided text invokes no self-citations as load-bearing uniqueness theorems or ansatzes. The dominance criterion is presented as an empirical outcome across tested families rather than a mathematical identity derived from the method's own inputs.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract provides no information on free parameters, axioms, or invented entities; the ledger is therefore empty.

pith-pipeline@v0.9.0 · 5461 in / 1185 out tokens · 69354 ms · 2026-05-15T08:15:58.379870+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

105 extracted references · 105 canonical work pages · 2 internal anchors

[1]

Turning your weakness into a strength: Watermarking deep neural networks by back- dooring

Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by back- dooring. In27th USENIX security symposium (USENIX Security 18), pages 1615–1631, 2018. 2

work page 2018
[2]

Sdxl turbo.https://huggingface

Stability AI. Sdxl turbo.https://huggingface. co/stabilityai/sdxl-turbo, 2023. Accessed: 2025-11-12. 1

work page 2023
[3]

Refit: a unified watermark removal framework for deep learning systems with limited data

Xinyun Chen, Wenxiao Wang, Chris Bender, Yiming Ding, Ruoxi Jia, Bo Li, and Dawn Song. Refit: a unified watermark removal framework for deep learning systems with limited data. InProceedings of the 2021 ACM Asia Conference on Computer and Communications Security, pages 321–335, 2021. 1

work page 2021
[4]

Image watermark- ing of generative diffusion models.arXiv preprint arXiv:2502.10465, 2025

Yunzhuo Chen, Jordan Vice, Naveed Akhtar, Nur Al Hasan Haldar, and Ajmal Mian. Image watermark- ing of generative diffusion models.arXiv preprint arXiv:2502.10465, 2025. 1

work page arXiv 2025
[5]

Wmadapter: Adding watermark control to latent diffusion models.arXiv preprint arXiv:2406.08337, 2024

Hai Ci, Yiren Song, Pei Yang, Jinheng Xie, and Mike Zheng Shou. Wmadapter: Adding watermark control to latent diffusion models.arXiv preprint arXiv:2406.08337, 2024. 2

work page arXiv 2024
[6]

Diffusionshield: A watermark for copyright protection against genera- tive diffusion models.arXiv preprint arXiv:2306.04642,

Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun, Yue Xing, and Jiliang Tang. Diffusionshield: A watermark for copyright protection against genera- tive diffusion models.arXiv preprint arXiv:2306.04642,

work page arXiv
[7]

Semantic underspecification.Language and Linguistics Compass, 4(3):166–181, 2010

Markus Egg. Semantic underspecification.Language and Linguistics Compass, 4(3):166–181, 2010. 5

work page 2010
[8]

Scaling recti- fied flow transformers for high-resolution image synthe- sis

Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas M¨uller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling recti- fied flow transformers for high-resolution image synthe- sis. InICML, 2024. 1, 7

work page 2024
[9]

The stable signature: Rooting watermarks in latent diffusion models

Pierre Fernandez, Guillaume Couairon, Herv ´e J ´egou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. InICCV, pages 22466–22477, 2023. 2

work page 2023
[10]

Semantic underspecification in language processing.Language and linguistics compass, 3(1): 111–127, 2009

Steven Frisson. Semantic underspecification in language processing.Language and linguistics compass, 3(1): 111–127, 2009. 5

work page 2009
[11]

Unified con- cept editing in diffusion models.arXiv preprint arXiv:2308.14761, 2023

Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy ´nska, and David Bau. Unified con- cept editing in diffusion models.arXiv preprint arXiv:2308.14761, 2023. 8

work page arXiv 2023
[12]

Deep residual learning for image recognition

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 3

work page 2016
[13]

Lora: Low-rank adaptation of large language mod- els.ICLR, 1(2):3, 2022

Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language mod- els.ICLR, 1(2):3, 2022. 2, 7, 1

work page 2022
[14]

Stable signature is unstable: Removing im- age watermark from diffusion models.arXiv preprint arXiv:2405.07145, 2024

Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, and Neil Gong. Stable signature is unstable: Removing im- age watermark from diffusion models.arXiv preprint arXiv:2405.07145, 2024. 1, 2

work page arXiv 2024
[15]

Deep fidelity in dnn watermarking: A study of backdoor watermark- ing for classification models.Pattern Recognition, 144: 109844, 2023

Guang Hua and Andrew Beng Jin Teoh. Deep fidelity in dnn watermarking: A study of backdoor watermark- ing for classification models.Pattern Recognition, 144: 109844, 2023. 1

work page 2023
[16]

Robin: Ro- bust and invisible watermarks for diffusion models with adversarial optimization.NeurIPS, 37:3937–3963, 2024

Huayang Huang, Yu Wu, and Qian Wang. Robin: Ro- bust and invisible watermarks for diffusion models with adversarial optimization.NeurIPS, 37:3937–3963, 2024. 1, 2

work page 2024
[17]

Entangled wa- termarks as a defense against model extraction

Hengrui Jia, Christopher A Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. Entangled wa- termarks as a defense against model extraction. In 30th USENIX security symposium (USENIX Security 21), pages 1937–1954, 2021. 2

work page 1937
[18]

Wouaf: Weight modulation for user attribution and fingerprinting in text-to-image diffu- sion models

Changhoon Kim, Kyle Min, Maitreya Patel, Sheng Cheng, and Yezhou Yang. Wouaf: Weight modulation for user attribution and fingerprinting in text-to-image diffu- sion models. InCVPR, pages 8974–8983, 2024. 2

work page 2024
[19]

A watermark for large language models

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. InICML, pages 17061–17084. PMLR, 2023. 2

work page 2023
[20]

On the reliability of watermarks for large language mod- els.arXiv preprint arXiv:2306.04634, 2023

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language mod- els.arXiv preprint arXiv:2306.04634, 2023. 2

work page arXiv 2023
[21]

Similarity of neural network repre- sentations revisited

Simon Kornblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hinton. Similarity of neural network repre- sentations revisited. InICML, pages 3519–3529. PMlR,

work page
[22]

Flux.1 [dev].https : / / huggingface

Black Forest Labs. Flux.1 [dev].https : / / huggingface . co / black - forest - labs / FLUX.1- dev, 2023. Hugging Face model card; Ac- cessed: 2025-11-12. 1

work page 2023
[23]

Flux.https://github.com/ black-forest-labs/flux, 2024

Black Forest Labs. Flux.https://github.com/ black-forest-labs/flux, 2024. 1, 7

work page 2024
[24]

Flux.1 kon- text: Flow matching for in-context image generation and editing in latent space, 2025

Black Forest Labs, Stephen Batifol, Andreas Blattmann, Frederic Boesel, Saksham Consul, Cyril Diagne, Tim Dockhorn, Jack English, Zion English, Patrick Esser, Sumith Kulal, Kyle Lacey, Yam Levi, Cheng Li, Dominik Lorenz, Jonas M ¨uller, Dustin Podell, Robin Rombach, Harry Saini, Axel Sauer, and Luke Smith. Flux.1 kon- text: Flow matching for in-context im...

work page 2025
[25]

Diffusetrace: A transparent and flexible watermarking scheme for latent diffusion model.arXiv preprint arXiv:2405.02696, 2024

Liangqi Lei, Keke Gai, Jing Yu, and Liehuang Zhu. Diffusetrace: A transparent and flexible watermarking scheme for latent diffusion model.arXiv preprint arXiv:2405.02696, 2024. 1

work page arXiv 2024
[26]

Diffwa: Diffusion models for watermark at- tack

Xinyu Li. Diffwa: Diffusion models for watermark at- tack. In2023 International Conference on Integrated In- telligence and Communication Systems (ICIICS), pages 1–8. IEEE, 2023. 1

work page 2023
[27]

Diffip: Repre- sentation fingerprints for robust ip protection of diffusion models

Zhuoling Li, Haoxuan Qu, Jason Kuen, Jiuxiang Gu, Qi- uhong Ke, Jun Liu, and Hossein Rahmani. Diffip: Repre- sentation fingerprints for robust ip protection of diffusion models. InICCV, pages 17035–17045, 2025. 2

work page 2025
[28]

Model fingerprinting with benign inputs

Thibault Maho, Teddy Furon, and Erwan Le Merrer. Model fingerprinting with benign inputs. InICASSP 2023-2023 IEEE International Conference on Acous- tics, Speech and Signal Processing (ICASSP), pages 1–5. IEEE, 2023. 2

work page 2023
[29]

Flowtransformer: A transformer framework for flow-based network intrusion detection systems.Expert Systems with Applications, 241:122564, 2024

Liam Daly Manocchio, Siamak Layeghy, Wai Weng Lo, Gayan K Kulatilleke, Mohanad Sarhan, and Marius Port- mann. Flowtransformer: A transformer framework for flow-based network intrusion detection systems.Expert Systems with Applications, 241:122564, 2024. 7

work page 2024
[30]

Black-box forgery attacks on semantic watermarks for diffusion models

Andreas M ¨uller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models. InCVPR, pages 20937–20946, 2025. 1

work page 2025
[31]

Sentence-t5: Scalable sentence encoders from pre- trained text-to-text models

Jianmo Ni, Gustavo Hernandez Abrego, Noah Con- stant, Ji Ma, Keith Hall, Daniel Cer, and Yinfei Yang. Sentence-t5: Scalable sentence encoders from pre- trained text-to-text models. InFindings of the association for computational linguistics: ACL 2022, pages 1864– 1874, 2022. 7

work page 2022
[32]

Training language models to follow instructions with hu- man feedback.NeurIPS, 35:27730–27744, 2022

Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with hu- man feedback.NeurIPS, 35:27730–27744, 2022. 7

work page 2022
[33]

Community foren- sics: Using thousands of generators to train fake im- age detectors

Jeongsoo Park and Andrew Owens. Community foren- sics: Using thousands of generators to train fake im- age detectors. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 8245–8257,

work page
[34]

Scalable diffusion models with transformers

William Peebles and Saining Xie. Scalable diffusion models with transformers. InICCV, pages 4195–4205,

work page
[35]

Are you copying my model? protecting the copyright of large language mod- els for eaas via backdoor watermark

Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. Are you copying my model? protecting the copyright of large language mod- els for eaas via backdoor watermark. InProceedings of the 61st Annual Meeting of the Association for Computa- tional Linguistics (Volume 1: Long Papers),...

work page 2023
[36]

SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis

Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas M¨uller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion mod- els for high-resolution image synthesis.arXiv preprint arXiv:2307.01952, 2023. 1, 7

work page internal anchor Pith review Pith/arXiv arXiv 2023
[37]

The semantics of lexical underspeci- fication.Folia linguistica, 51(s1000):1–25, 2017

James Pustejovsky. The semantics of lexical underspeci- fication.Folia linguistica, 51(s1000):1–25, 2017. 5

work page 2017
[38]

Learning transferable visual models from natural lan- guage supervision

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sas- try, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural lan- guage supervision. InICML, pages 8748–8763. PmLR,

work page
[39]

Di- rect preference optimization: Your language model is se- cretly a reward model.NeurIPS, 36:53728–53741, 2023

Rafael Rafailov, Archit Sharma, Eric Mitchell, Christo- pher D Manning, Stefano Ermon, and Chelsea Finn. Di- rect preference optimization: Your language model is se- cretly a reward model.NeurIPS, 36:53728–53741, 2023. 2, 7, 1

work page 2023
[40]

Zero-shot text-to-image generation

Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea V oss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. InICML, pages 8821–8831. Pmlr, 2021. 2

work page 2021
[41]

Kandinsky: an im- proved text-to-image synthesis with image prior and latent diffusion.arXiv preprint arXiv:2310.03502, 2023

Anton Razzhigaev, Arseniy Shakhmatov, Anasta- sia Maltseva, Vladimir Arkhipkin, Igor Pavlov, Ilya Ryabov, Angelina Kuts, Alexander Panchenko, Andrey Kuznetsov, and Denis Dimitrov. Kandinsky: an im- proved text-to-image synthesis with image prior and latent diffusion.arXiv preprint arXiv:2310.03502, 2023. 1, 7

work page arXiv 2023
[42]

Lawa: Using latent space for in-generation image watermarking

Ahmad Rezaei, Mohammad Akbari, Saeed Ranjbar Al- var, Arezou Fatemi, and Yong Zhang. Lawa: Using latent space for in-generation image watermarking. InECCV, pages 118–136. Springer, 2024. 2

work page 2024
[43]

High-resolution image synthesis with latent diffusion models

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image synthesis with latent diffusion models. InCVPR, pages 10684–10695, 2022. 1, 7

work page 2022
[44]

U-net: Convolutional networks for biomedical image segmentation

Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. InInternational Conference on Medi- cal image computing and computer-assisted interven- tion, pages 234–241. Springer, 2015. 7

work page 2015
[45]

DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models

Bita Darvish Rouhani, Huili Chen, and Farinaz Koushan- far. Deepsigns: A generic watermarking framework for ip protection of deep learning models.arXiv preprint arXiv:1804.00750, 2018. 2

work page internal anchor Pith review Pith/arXiv arXiv 2018
[46]

Laion-5b: An open large-scale dataset for training next generation image-text models.NeurIPS, 35:25278–25294, 2022

Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion-5b: An open large-scale dataset for training next generation image-text models.NeurIPS, 35:25278–25294, 2022. 3, 7, 8, 1

work page 2022
[47]

Diffusion art or dig- ital forgery? investigating data replication in diffusion models

Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or dig- ital forgery? investigating data replication in diffusion models. InCVPR, pages 6048–6058, 2023. 2

work page 2023
[48]

Riemannian-geometric fingerprints of generative models

Hae Jin Song and Laurent Itti. Riemannian-geometric fingerprints of generative models. InProceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 11425–11435, 2025. 2

work page 2025
[49]

Deep intellectual property protection: A survey

Yuchen Sun, Tianpeng Liu, Panhe Hu, Qing Liao, Shao- jing Fu, Nenghai Yu, Deke Guo, Yongxiang Liu, and Li Liu. Deep intellectual property protection: A survey. arXiv preprint arXiv:2304.14613, 2023. 2

work page arXiv 2023
[50]

Dawn: Dynamic adversarial watermarking of neural networks

Sebastian Szyller, Buse Gul Atli, Samuel Marchal, and N Asokan. Dawn: Dynamic adversarial watermarking of neural networks. InProceedings of the 29th ACM in- ternational conference on multimedia, pages 4417–4425,

work page
[51]

Fingerprinting denoising diffusion proba- bilistic models

Huan Teng, Yuhui Quan, Chengyu Wang, Jun Huang, and Hui Ji. Fingerprinting denoising diffusion proba- bilistic models. InCVPR, pages 28811–28820, 2025. 8

work page 2025
[52]

Unbiased look at dataset bias

Antonio Torralba and Alexei A Efros. Unbiased look at dataset bias. InCVPR 2011, pages 1521–1528. IEEE,

work page 2011
[53]

Paladin: Robust neural fin- gerprinting for text-to-image diffusion models.arXiv preprint arXiv:2506.03170, 2025

Subarna Tripathi et al. Paladin: Robust neural fin- gerprinting for text-to-image diffusion models.arXiv preprint arXiv:2506.03170, 2025. 2

work page arXiv 2025
[54]

Dire for diffusion-generated image detection

Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diffusion-generated image detection. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 22445–22455, 2023. 2

work page 2023
[55]

Sleep- ermark: Towards robust watermark against fine-tuning text-to-image diffusion models

Zilan Wang, Junfeng Guo, Jiacheng Zhu, Yiming Li, Heng Huang, Muhao Chen, and Zhengzhong Tu. Sleep- ermark: Towards robust watermark against fine-tuning text-to-image diffusion models. InCVPR, pages 8213– 8224, 2025. 1, 2

work page 2025
[56]

Tree-ring watermarks: Fingerprints for diffu- sion images that are invisible and robust.arXiv preprint arXiv:2305.20030, 2023

Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffu- sion images that are invisible and robust.arXiv preprint arXiv:2305.20030, 2023. 1, 2

work page arXiv 2023
[57]

Adversarial neuron prun- ing purifies backdoored deep models.Advances in Neu- ral Information Processing Systems, 34:16913–16925,

Dongxian Wu and Yisen Wang. Adversarial neuron prun- ing purifies backdoored deep models.Advances in Neu- ral Information Processing Systems, 34:16913–16925,

work page
[58]

Gaussian shading: Provable performance-lossless image watermarking for diffusion models

Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weim- ing Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. InCVPR, pages 12162–12171, 2024. 2

work page 2024
[59]

Reef: Representation encoding fingerprints for large language models.arXiv preprint arXiv:2410.14273, 2024

Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. Reef: Representation encoding fingerprints for large language models.arXiv preprint arXiv:2410.14273, 2024. 2, 8

work page arXiv 2024
[60]

Attack-resilient image watermarking using stable diffusion.NeurIPS, 37: 38480–38507, 2024

Lijun Zhang, Xiao Liu, Antoni V Martin, Cindy X Bearfield, Yuriy Brun, and Hui Guan. Attack-resilient image watermarking using stable diffusion.NeurIPS, 37: 38480–38507, 2024. 1

work page 2024
[61]

Provable robust watermarking for ai- generated text.arXiv preprint arXiv:2306.17439, 2023

Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu- Xiang Wang. Provable robust watermarking for ai- generated text.arXiv preprint arXiv:2306.17439, 2023. 2

work page arXiv 2023
[62]

A recipe for watermark- ing diffusion models.arXiv preprint arXiv:2303.10137,

Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai- Man Cheung, and Min Lin. A recipe for watermark- ing diffusion models.arXiv preprint arXiv:2303.10137,

work page arXiv
[63]

A photo of a [ADJECTIVE] [OBJECT] [LOCATION]

1, 2 CSF: Black-box Fingerprinting via Compositional Semantics for Text-to-Image Models Supplementary Material A. Model Selection A.1. Base Models We include 6 base models representing the most prominent open-source diffusion model families. These models are selected due to their widespread adoption in both research and production environments, making the...

work page
[64]

A photo of a savory baked good on a dimmed studio

work page
[65]

A photo of a savory baked good on a dark wood surface

work page
[66]

A photo of a savory baked good against a brick wall

work page
[67]

A photo of a cheesy baked good on a dimmed studio

work page
[68]

A photo of a cheesy baked good on a dark wood surface

work page
[69]

A photo of a cheesy baked good against a brick wall

work page
[70]

A photo of a sweet baked good on a dimmed studio

work page
[71]

A photo of a sweet baked good on a dark wood surface

work page
[72]

Animals (9 prompts)

A photo of a sweet baked good against a brick wall. Animals (9 prompts)

work page
[73]

A photo of a dangerous animal in a grassland

work page
[74]

A photo of a dangerous animal in a forest

work page
[75]

A photo of a dangerous animal in a dimmed studio

work page
[76]

A photo of a wild animal in a grassland

work page
[77]

A photo of a wild animal in a forest

work page
[78]

A photo of a wild animal in a dimmed studio

work page
[79]

A photo of a peaceful animal in a grassland

work page
[80]

A photo of a peaceful animal in a forest

work page

Showing first 80 references.