Pith. sign in

REVIEW 4 major objections 6 minor 47 references

PromptLA: Towards Integrity Verification of Black-box Text-to-Image Diffusion Models

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read PromptLA detects tampering in black-box text-to-image diffusion models by measuring relative KL divergence between Gaussian fits of generated-image features, reporting a mean AUC above 0.96 across four model families.

desk verdict New problem and strong black-box results, but the multivariate Gaussian KL estimator is underspecified and the headline AUC rests on an unstated regularizer. read the letter →

arxiv 2412.16257 v2 pith:TTNEHZ4P submitted 2024-12-20 cs.CV cs.AIcs.CR

Zhuomeng Zhang , Fangqi Li , Chong Di , Hongyu Zhu , Hanyi Wang , Shilin Wang This is my paper · ORCID
classification cs.CVcs.AIcs.CR
keywords text-to-imagediffusionmodelsintegrityverificationblack-boxmodelauditingKLdivergencelearningautomatonpromptselectiontamperingdetectionAIcopyright
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to establish that a black-box verifier can tell whether a text-to-image diffusion model has been tampered with—fine-tuned, LoRA-injected, parameter-noised, or rolled back—by comparing the statistical distribution of features in images the model generates, without training a classifier for each attack. It proposes PromptLA, which scores candidate prompts by the relative Kullback-Leibler (KL) divergence between Gaussian fits of Inception-v3 features from the original and suspicious models, then uses a learning automaton with hypothesis testing to eliminate weak prompts and return one that exposes the tampering. Across SD-v1.5, SDXL, HunyuanDiT-v1.2, and FLUX.1-dev-fp8, the paper reports mean area-under-the-ROC-curve (AUC) scores of 0.969 and 0.972, beating trained attribution baselines by more than 0.2 while using fewer queries and remaining accurate under JPEG compression and cropping. If correct, this gives model owners a practical, attack-agnostic way to establish that their model was modified, with a quantifiable statistic usable in copyright disputes.

What carries the argument

The load-bearing object is the relative KL divergence $\beta_p = D_{KL}(P\|Q)/D_{KL}(P\|P') - 1$, where $P$ and $P'$ are independent Gaussian fits to Inception-v3 feature vectors from the original model and $Q$ is the Gaussian fit from the suspicious model under prompt $p$; the denominator normalizes away the model's internal randomness. PromptLA wraps this score in a learning automaton, defined here as a reinforcement-learning scheme that iteratively selects actions in a stochastic environment, and applies a statistical hypothesis-testing action-elimination rule: each round it re-estimates $\beta_p$ for surviving prompts using all historical queries in a cross-validation style, identifies the estimated best prompt, and removes any prompt whose feedback mean is significantly lower at level $\alpha$, using a t-test for small feedback sequences and a Z-test later. The implementation uses $n=5$ images per prompt per model per round, and the final prompt's $\beta_p$ is compared with a threshold $\theta$ to declare an integrity violation.

What would settle it

Recompute the paper's Table 3 with $n=50$ images per prompt per model instead of $n=5$; if the mean AUC drops substantially, or if the 2048-dimensional covariance matrices used in Eq. (4) turn out to be singular at $n=5$, the reported 0.96 AUC rests on unstable distribution estimates rather than genuine model differences.

Watch

Extended reading notes

Core claim

The central claim is that every common integrity violation of a T2I diffusion model changes the distribution of Inception-v3 features in the images the model generates under at least some prompts, and that this change is measurable from black-box queries. PromptLA searches a candidate prompt library with a learning automaton, scoring each prompt by relative KL divergence $\beta_p$ between Gaussian fits of features from the original and suspicious models, and eliminates non-discriminating prompts with t-tests or Z-tests. With two configurations of significance level and threshold, the paper reports mean AUCs of 0.969 and 0.972 on four model families, exceeding trained baselines by more than 0.2 and preserving high accuracy after JPEG compression and random cropping.

Load-bearing premise

The method assumes that the pattern of image features from a model forms a bell-shaped (normal) cloud that can be estimated from just five generated images per prompt per round; if that small-sample estimate is not accurate, the distances and statistical tests that drive detection are unreliable.

Editorial extensions

If this is right

  • A model owner can audit a black-box T2I service without knowing which attack was used, because PromptLA picks the discriminating prompt on the fly instead of relying on a classifier trained on known attacks.
  • Because verification is classifier-free, it generalizes to unseen tampering methods; the trained baselines collapse on violations outside their training set while PromptLA's average AUC stays above 0.96.
  • The protocol supplies a quantifiable per-prompt statistic and a decision threshold, which could serve as evidence in disputes over whether a user modified a model.
  • The adaptive prompt-elimination rule reduces query cost on hard violations, keeping verification practical when each image can take tens of seconds to generate.
  • The method's tolerance of JPEG compression and cropping means ordinary image handling by users will not by itself trigger a false integrity alarm.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not analyze an adaptive attacker; a natural extension is to test whether a malicious user who can observe the verifier's prompts could fine-tune the model to preserve Inception-v3 feature means and covariances, which would likely evade this detector.
  • The relative-KL normalization suggests the same auditing idea could transfer to other generative domains, such as audio, video, or text, wherever a fixed feature extractor and a conditioning signal exist; this goes beyond the paper's T2I experiments.
  • The decision thresholds are chosen experimentally, so a principled calibration of $\theta$ from the null distribution of $\beta_p$ would remove a free parameter and is a testable extension the paper leaves open.
  • Replacing the small-sample Gaussian fit with a nonparametric two-sample test on lower-dimensional features could lower the number of images needed per prompt, a variant the paper does not explore.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes PromptLA, a black-box integrity verification framework for text-to-image (T2I) diffusion models. For a candidate prompt, it extracts Inception-v3 features from images generated by the original and suspicious models, models the feature distributions as multivariate Gaussians, and computes a relative KL divergence (Eq. 5) as a tampering signal. A learning-automaton prompt-selection algorithm (Algorithm 1) iteratively evaluates a small set of prompts, eliminates non-discriminative prompts via sequential t-tests or Z-tests, and returns the most discriminative prompt. A threshold θ then decides whether an integrity violation is reported. Experiments on SD-v1.5, SDXL, HunyuanDiT-v1.2, and FLUX.1-dev-fp8 report a mean AUC of 0.972 over various integrity violations, outperforming trained baselines by more than 0.2, with robustness to image-level post-processing.

Significance. If the reported results are reproducible, the paper makes a useful contribution: it addresses a realistic black-box scenario, avoids training attack-specific classifiers, and demonstrates that prompt selection can substantially improve detection of fine-grained tampering such as LoRA injection and parameter modification. The use of learning automata for query-efficient prompt selection is novel in this context, and the generalization across four architectures is encouraging. However, the central statistical estimator—the Gaussian KL feedback used throughout Algorithm 1—is underspecified, and the evaluation protocol for the headline AUC also needs clarification. The paper would be a solid contribution after these load-bearing issues are resolved.

major comments (4)
  1. [§4.1, Eq. (5), §5.1.5] The feedback β_p in Eq. (5) is computed from Gaussian fits to 2048-dimensional Inception-v3 features. With n=5 images per model per prompt per round, the empirical covariance matrix estimated from each model has rank at most 4 and is singular. The paper does not specify any dimensionality reduction, shrinkage, diagonal approximation, or Bayesian posterior covariance. The only qualification, “standard Bayesian estimation with non-informative prior [45],” does not define the prior or the resulting estimator, and does not resolve singularity. As written, the KL divergence between the two Gaussians is generically infinite or undefined, so the t-tests and Z-tests in §4.2.3 consume values that may not exist. This is load-bearing: the mean AUC of 0.972 in Table 3 rests on these β_p values. Please specify the exact covariance estimator used (e.g., diagonal covariance, PCA projection, shrinkage, or an explicit Bayesian posterior) and report an ablation over n and the regularization strength.
  2. [§4.2.2, Eq. (5)] The denominator of Eq. (5), D_KL(P||P′), uses a second independent estimate of the intact model’s feature distribution. The text says that P, P′, and Q are estimated from the images produced so far, but it does not state how the f0 images are split into the two independent sets, nor how zero or near-zero denominators are handled. With n=5, the denominator is a ratio of noisy, possibly singular covariance estimates and can be zero, making β_p undefined. Please specify the data-splitting protocol and a floor or stabilization for the denominator, and show the distribution of β_p under intact-versus-intact comparisons.
  3. [§4.2.3, Algorithm 1] The Student t-test and Z-test are applied to the sequence of β feedback values without justifying the required independence and normality assumptions. These values are ratios of dependent KL estimates from overlapping data, and the sequential hypothesis testing with elimination can inflate the Type I error beyond the nominal α. Because the elimination rule determines which prompts are evaluated and thus the cost and FPR reported in Tables 4 and 5, the statistical validity of this procedure needs support. Please provide a permutation or nonparametric test, or an empirical calibration study of the FPR under the null hypothesis of an intact model.
  4. [§4.3, Table 3] The evaluation protocol for the headline AUC is not fully defined. In §4.3, verification stops for a tampered model as soon as d̂_m exceeds θ, while for an intact model the algorithm traverses the prompt library and the highest value encountered is recorded. It is unclear what score is assigned to each model for the ROC computation—whether it is the first value that exceeded θ, the maximum over all prompts evaluated before stopping, or some other statistic. Since PromptLA_v1 and PromptLA_v2 use different θ, and θ affects the stopping behavior, the reported AUC may depend on the scoring rule. Please specify the exact scoring rule used to compute AUC and justify that it is independent of the threshold.
minor comments (6)
  1. [Abstract, Introduction, Table 3] The abstract claims mean AUC above 0.96, the introduction claims above 0.95, and Table 3 reports an average of 0.972; these numbers should be aligned and the exact average stated consistently.
  2. [§5.1.5] The implementation details mention a generation time for SD-v2.1, but SD-v2.1 is not listed among the base models in §5.1.1; this appears to be a typo and should be corrected.
  3. [Figure 4] Figure 4 states that the distribution is estimated using 50 images each, while §5.1.5 sets n=5 for PromptLA; please clarify whether Figure 4 is an illustrative setup and how it relates to the n=5 configuration used in the tables.
  4. [§4.2.2, Eq. (6)] The summation notation in Eq. (6) is difficult to parse; rewriting it with explicit summation limits, e.g., a double sum over rounds and within-round indices, would improve clarity.
  5. [Algorithm 1, line 5] In each round r, the inner loop computes feedback for k=1,...,r, so the feedback sequence grows by r items per round and the total size after R_e rounds is O(R_e^2); please confirm this is intended and clarify the associated t-test/Z-test switching condition on |F_i(r)|.
  6. [§5.1.3, Table 3] The baseline evaluation uses a single fixed prompt, prompt22 “Lion,” selected because Figure 4 shows it is discriminative for most violations; since this prompt choice may favor the baselines, reporting the range of baseline AUCs over several prompts would make the comparison more informative.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the KL feedback is computed from generated images without label fitting, the AUC is threshold-independent, and the cited LA framework is an independent algorithmic ingredient rather than a proof of the result.

full rationale

The derivation chain is self-contained against the claimed result. Eq. (5) defines the feedback β_p as a relative KL divergence between Gaussian estimates of Inception-v3 feature distributions of images produced by f0 and fm; no verification label or AUC objective enters its computation. The learning automaton (Algorithm 1) only selects prompts using these statistics and the hypothesis-testing procedure of Di et al. [8]; it is an optimization/routing mechanism, not a fitted predictor of integrity. The integrity decision compares the selected score d̂_m to a threshold θ (§4.3), and the headline AUC in Table 3 is threshold-independent, so tuning (α, θ) on the test bed does not manufacture the reported separation. The paper's self-citations ([7], [8]) supply a general non-associative reinforcement-learning framework whose correctness is independent of the T2I verification target; they are not used to forbid alternatives or to assert the AUC result, so they are not load-bearing circularity. A genuine reproducibility concern remains—§5.1.5 sets n=5 while Inception-v3 features have dimension 2048, and §4.1 does not specify shrinkage or diagonal covariance, which may make the covariance estimates in Eq. (5) singular—but this is a potential correctness gap (unstated regularizer) rather than a circular reduction: even if the statistic is unstable, the claim would be unsupported, not equivalent to its inputs by construction. Accordingly, no circular step is exhibited and the score is 1 rather than 0 only to acknowledge the presence of non-load-bearing self-citations and test-bed hyperparameter selection.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests on several unverified modeling choices, chiefly the Gaussian assumption for high-dimensional features and the estimability of the covariance from tiny samples, plus algorithm hyperparameters (alpha, theta) tuned on the evaluation data. None of these are independently validated or derived.

free parameters (4)
  • significance level alpha = 0.01 or 0.05
    Chosen to define the hypothesis-testing elimination rule; the paper states these configurations 'have good performance in comprehensive testing', i.e., tuned on the evaluation data.
  • decision threshold theta = 0.25 or 0.30
    Chosen by hand to trade off FPR and detection rate; directly determines the verification decision and reported FPR.
  • images per prompt per model per round n = 5
    Sets the sample size for Gaussian covariance estimation; small value makes the normality assumption harder to justify.
  • start round R_s, total rounds R_e, action-set size q = 5, 10, 5
    Algorithm hyperparameters chosen without sensitivity analysis; they affect cost and which prompts are tested.
assumptions (4)
  • domain assumption Features of generated images follow a multivariate normal distribution
    Section 4.1: 'assuming that the underlying distributions of features is a multivariate normal distribution.' The paper provides no goodness-of-fit check.
  • domain assumption Feedback samples for the same action are independent across rounds
    The t-test and Z-test in Algorithm 1 assume i.i.d. samples, but beta_i(k) values are computed from overlapping historical image sets, so the feedback sequence is not independent.
  • domain assumption Inception-v3 pre-trained on ImageNet provides features that preserve model-specific distribution shifts
    Section 4.1 uses Inception-v3 as feature extractor; no analysis of how extractor choice affects detectability.
  • domain assumption Verifier can query the original model f0 during verification
    Threat model assumes the publisher or third party has black-box access to the original model to generate reference images; without f0, no reference distribution exists.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PromptLA: Towards Integrity Verification of Black-box Text-to-Image Diffusion Models." pith.science (2026). https://pith.science/paper/TTNEHZ4P

@misc{pith2026241216257,
  author       = {Pith},
  title        = {Pith review of: PromptLA: Towards Integrity Verification of Black-box Text-to-Image Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TTNEHZ4P}},
  note         = {Machine review of arXiv:2412.16257}
}
read the original abstract

Despite the impressive synthesis quality of text-to-image (T2I) diffusion models, their black-box deployment poses significant regulatory challenges: Malicious actors can fine-tune these models to generate illegal content, circumventing existing safeguards through parameter manipulation. Therefore, it is essential to verify the integrity of T2I diffusion models. To this end, considering the randomness within the outputs of generative models and the high costs in interacting with them, we discern model tampering via the KL divergence between the distributions of the features of generated images. We propose a novel prompt selection algorithm based on learning automaton (PromptLA) for efficient and accurate verification. Evaluations on four advanced T2I models (e.g., SDXL, FLUX.1) demonstrate that our method achieves a mean AUC of over 0.96 in integrity detection, exceeding baselines by more than 0.2, showcasing strong effectiveness and generalization. Additionally, our approach achieves lower cost and is robust against image-level post-processing. To the best of our knowledge, this paper is the first work addressing the integrity verification of T2I diffusion models, which establishes quantifiable standards for AI copyright litigation in practice.

Figures

Figures reproduced from arXiv: 2412.16257 by the authors.

Figure 1
Figure 1. Integrity Violation Scenarios and proposed integrity [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Comparison of images generated by the original model and after various integrity violations. For each prompt, the [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. tSNE of features extracted from generated images [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: The relative KL divergence differences in the distribution of features extracted from images generated by T2I diffusion [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: A visual instance of prompt selection using [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Robustness against image-level post-processing [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 24 canonical work pages

  1. [45]

    Michael J Zyphur and Frederick L Oswald. 2015. Bayesian estimation and infer- ence: A user’s guide. Journal of Management 41, 2 (2015), 390–420

    work page 2015

  2. [1]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Floren- cia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

    arXiv 2023

  3. [2]

    Omid Aramoon, Pin-Yu Chen, and Gang Qu. 2021. Aid: Attesting the integrity of deep neural networks. In 2021 58th ACM/IEEE Design Automation Conference (DAC). IEEE, 19–24

    work page 2021

  4. [3]

    Negin Ayoughi, Shiva Nejati, Mehrdad Sabetzadeh, and Patricio Saavedra. 2024. Enhancing Automata Learning with Statistical Machine Learning: A Network Security Case Study. arXiv preprint arXiv:2405.11141 (2024)

    work page Pith review arXiv 2024

  5. [4]

    Eva Cetinic, Tomislav Lipic, and Sonja Grgic. 2018. Fine-tuning convolutional neural networks for fine art classification. Expert Systems with Applications 114 (2018), 107–118

    work page 2018

  6. [5]

    Anuran Chakraborty, Kushal Kanti Ghosh, Rajonya De, Erik Cuevas, and Ram Sarkar. 2021. Learning automata based particle swarm optimization for solving class imbalance problem. Applied Soft Computing 113 (2021), 107959

    work page 2021

  7. [6]

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition . Ieee, 248–255

    2009

  8. [7]

    Chong Di, Fangqi Li, Pengyao Xu, Ying Guo, Chao Chen, and Minglei Shu. 2023. Learning automata-accelerated greedy algorithms for stochastic submodular maximization. Knowledge-Based Systems 282 (2023), 111118

    work page 2023

Show all 47 references
  1. [8]

    Chong Di, Shenghong Li, Fangqi Li, and Kaiyue Qi. 2019. A novel framework for learning automata: a statistical hypothesis testing approach. IEEE Access 7 (2019), 27911–27922

    2019

  2. [9]

    Ming Ding, Zhuoyi Yang, Wenyi Hong, Wendi Zheng, Chang Zhou, Da Yin, Junyang Lin, Xu Zou, Zhou Shao, Hongxia Yang, et al. 2021. Cogview: Master- ing text-to-image generation via transformers. Advances in neural information processing systems 34 (2021), 19822–19835

    2021

  3. [10]

    Ricard Durall, Margret Keuper, and Janis Keuper. 2020. Watch your up- convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 7890–7899

    2020

  4. [11]

    Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. 2023. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision. 22466– 22477

    2023

  5. [12]

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. 2022. An image is worth one word: Personalizing text-to-image generation using textual inversion. arXiv preprint arXiv:2208.01618 (2022)

    2022 arXiv

  6. [13]

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative adversarial nets. Advances in neural information processing systems 27 (2014)

    2014

  7. [14]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition . 770–778

    2016

  8. [15]

    Zecheng He, Tianwei Zhang, and Ruby Lee. 2019. Sensitive-sample fingerprinting of deep neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 4729–4737

    2019

  9. [16]

    John R Hershey and Peder A Olsen. 2007. Approximating the Kullback Leibler di- vergence between Gaussian mixture models. In2007 IEEE International Conference on Acoustics, Speech and Signal Processing-ICASSP’07 , Vol. 4. IEEE, IV–317

    2007

  10. [17]

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilistic models. Advances in neural information processing systems 33 (2020), 6840–6851

    2020

  11. [18]

    Diederik P Kingma and Max Welling. 2013. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114 (2013)

    2013 arXiv

  12. [19]

    Fang-Qi Li, Shi-Lin Wang, and Alan Wee-Chung Liew. 2023. Linear Functionality Equivalence Attack Against Deep Neural Network Watermarks and a Defense Method by Neuron Mapping. IEEE Transactions on Information Forensics and Security 18 (2023), 1963–1977

    2023

  13. [20]

    Zhimin Li, Jianwei Zhang, Qin Lin, Jiangfeng Xiong, Yanxin Long, Xinchi Deng, Yingfang Zhang, Xingchao Liu, Minbin Huang, Zedong Xiao, et al. 2024. Hunyuan- dit: A powerful multi-resolution diffusion transformer with fine-grained chinese understanding. arXiv preprint arXiv:240...

    2024 arXiv

  14. [21]

    Bo Liu, Fan Yang, Xiuli Bi, Bin Xiao, Weisheng Li, and Xinbo Gao. 2022. Detecting generated images by real images. In European Conference on Computer Vision . Springer, 95–110

    2022

  15. [22]

    Scott McCloskey and Michael Albright. 2018. Detecting gan-generated imagery using color cues. arXiv preprint arXiv:1812.08247 (2018)

    2018 arXiv

  16. [23]

    Kumpati S Narendra and Mandayam AL Thathachar. 2012. Learning automata: an introduction. Courier corporation

    2012

  17. [24]

    Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. 2021. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprint arXiv:2112.10741 (2021)

    2021 arXiv

  18. [25]

    Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. 2023. Towards universal fake image detectors that generalize across generative models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 24480–24489

    2023

  19. [26]

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. 2023. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952 (2023)

    2023 arXiv

  20. [27]

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learni...

    2021

  21. [28]

    Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen

  22. [29]

    Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. 2021. Zero-shot text-to-image generation. In International conference on machine learning . Pmlr, 8821–8831

    2021

  23. [30]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 10684–10695

    2022

  24. [31]

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. 2023. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF conference on computer PromptLA: Towards Integrity Verificat...

    2023

  25. [32]

    Simo Ryu. 2023. Low-rank adaptation for fast text-to-image diffusion fine-tuning. Low-rank adaptation for fast text-to-image diffusion fine-tuning (2023)

    2023

  26. [33]

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. 2022. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural infor...

    2022

  27. [34]

    Mohammad Savargiv, Behrooz Masoumi, and Mohammad Reza Keyvanpour

  28. [35]

    Zeyang Sha, Zheng Li, Ning Yu, and Yang Zhang. 2023. De-fake: Detection and attribution of fake images generated by text-to-image generation models. In Proceedings of the 2023 ACM SIGSAC conference on computer and communications security. 3418–3432

    2023

  29. [36]

    Journal of Ambient Intelligence and Humanized Computing 13, 7 (2022), 3467–3482

    A new ensemble learning method based on learning automata. Journal of Ambient Intelligence and Humanized Computing 13, 7 (2022), 3467–3482

    2022

  30. [37]

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. 2016. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition . 2818–2826

    2016

  31. [38]

    Hae Jin Song, Mahyar Khayatkhoei, and Wael AbdAlmageed. 2024. ManiFPT: Defining and Analyzing Fingerprints of Generative Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 10791–10801

    2024

  32. [39]

    Shuo Wang, Sharif Abuadbba, Sidharth Agarwal, Kristen Moore, Ruoxi Sun, Minhui Xue, Surya Nepal, Seyit Camtepe, and Salil Kanhere. 2023. Publiccheck: Public integrity verification for services of run-time deep models. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE,...

    2023

  33. [40]

    Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, and Yunchao Wei. 2023. Learning on gradients: Generalized artifacts representation for gan-generated images detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 12105–12114

    2023

  34. [41]

    Dongxian Wu and Yisen Wang. 2021. Adversarial neuron pruning purifies backdoored deep models. Advances in Neural Information Processing Systems 34 (2021), 16913–16925

    2021

  35. [42]

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. 2023. Tree- ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030 (2023)

    2023 arXiv

  36. [43]

    Xiao Yu, Kejiang Chen, Kai Zeng, Han Fang, Zijin Yang, Xiuwei Shang, Yuang Qi, Weiming Zhang, and Nenghai Yu. 2024. SemGIR: Semantic-Guided Image Regeneration Based Method for AI-generated Image Detection and Attribution. In Proceedings of the 32nd ACM International Conference...

    2024

  37. [44]

    Zhaoxia Yin, Heng Yin, Hang Su, Xinpeng Zhang, and Zhenzhe Gao. 2023. Decision-based iterative fragile watermarking for model integrity verification. arXiv preprint arXiv:2305.09684 (2023)

    2023 arXiv

  38. [46]

    Zhiying Zhu, Hang Zhou, Siyuan Xing, Zhenxing Qian, Sheng Li, and Xinpeng Zhang. 2022. Perceptual hash of neural networks. Symmetry 14, 4 (2022), 810

    2022

  39. [2022]

    arXiv preprint arXiv:2204.06125 1, 2 (2022), 3

    Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125 1, 2 (2022), 3

    2022 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.