Pith. sign in

REVIEW 3 major objections 4 minor 47 references

Fingerprinting Text-to-Image Diffusion Models via Collapsed Generation

T0 review · 3 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A diffusion model's collapsed-generation behavior — certain inputs yielding near-identical images across random seeds — can fingerprint the model through a plain text API, with no watermark required.

desk verdict Smart, well-executed fingerprinting idea with a real gap: run-level uniqueness at T2I scale is untested, and the verification test never checks the suspect's own normal baseline. read the letter →

arxiv 2608.11732 v1 pith:RBV7EUOE submitted 2026-08-12 cs.CR cs.AI

Yuanmin Huang , Chen Chen , Geng Hong , Xiaoyu You , Hui Xue , Zhenxing Qian , Mi Zhang , Min Yang This is my paper · ORCID
classification cs.CRcs.AI
keywords text-to-imagediffusionmodelscollapsedgenerationmodelfingerprintingownershipverificationintellectualpropertyprotectionmemorizationblack-boxwhite-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that text-to-image diffusion models carry a built-in, per-model behavioral signature: for certain input conditions, independent stochastic samplings converge to nearly identical images, and the set of these collapse-prone conditions is specific to the individual trained model. If that claim holds, a model owner can verify that a leaked checkpoint or a hosted service derives from their model just by checking whether the suspect reproduces the source's characteristic collapse behavior across random seeds — no watermark embedded, no parameters altered, no internal states read. The framework prepares fingerprints in two forms matched to how much of the suspect is accessible: optimized continuous embeddings for white-box pipeline access, and natural-language prompts mined from low-loss training samples for black-box API-only access. In both settings, verification is the same statistical test, comparing the suspect's cross-seed output consistency against the source model's normal-generation baseline, and the default query budget is sixteen generations. This matters because existing alternatives either modify the model at train time (watermarking) or require internal readouts, both of which fail for already-trained checkpoints and end-to-end APIs.

What carries the argument

The load-bearing object is the formal notion of collapsed generation, quantified by the cross-seed consistency score $\bar{s}_\theta(c,K)$: for a fixed conditioning input $c$ (a text embedding or a natural prompt) and $K$ independently sampled initial noises, Equation (4) averages the pairwise perceptual similarity — measured by the SSCD self-supervised copy-detection descriptor — of the $K$ generated images, and the condition is deemed collapsed when $\bar{s}_\theta(c,K) \ge \tau_s$. Two construction mechanisms produce fingerprint sets from this definition. For white-box pipeline access, truncated optimization minimizes a collapse loss $L_{\mathrm{Collapse}}$, the average squared distance between early denoising latents and their mean, differentiating through only the first $t_{\mathrm{trunc}}$ steps; the paper's observation that collapsed content stabilizes early in denoising is what makes this surrogate cheap. For black-box API access, natural-prompt mining exploits the empirical enrichment of collapse-prone prompts among training samples with unusually low denoising loss, screening only that reduced candidate pool by output-level consistency. Verification then runs a right-tailed predictive $t$-test: the aggregate fingerprint response $\bar{s}_f$ over $M$ fingerprint conditions is compared with the source model's normal-prompt reference distribution, and a $p_{\mathrm{val}}$ below the threshold $\tau_f = 10^{-4}$ is read as evidence that the suspect reproduces the source's collapse signature.

What would settle it

Train several text-to-image diffusion models (or DDPMs at a scale beyond CIFAR-10) on the same public dataset with identical architecture, optimizer, and training schedule, varying only the random seed, then run the paper's cross-model verification matrix: if matched fingerprint–model pairs no longer give $p_{\mathrm{val}} < 10^{-4}$ while mismatched pairs do, the uniqueness premise fails. A cheaper check on the paper's own setup is to retrain the four CIFAR-10 DDPMs without the shared 500 upweighted images and see whether the diagonal separation of the $4\times4$ matrix survives.

Watch

Extended reading notes

Core claim

The central discovery is that collapsed generation is an intrinsic, model-dependent property of the learned generation process, not an artifact of the input condition alone. The paper puts it plainly: 'Collapsed generation reflects characteristics of the learned model rather than the input condition alone.' A condition that collapses one model, producing highly consistent outputs across independent seeds, typically yields ordinary, diverse outputs on an independently trained model; the paper shows this both for matched versus mismatched prompt–model pairs on Stable Diffusion 1.4 and 2.1 and in a controlled CIFAR-10 study in which four conditional DDPMs share architecture, data, optimizer, and training schedule and differ only in random initialization. In that study the cross-model verification matrix separates cleanly along the diagonal, which the paper takes as evidence that collapse patterns can be specific to an individual training outcome rather than to the dataset or architecture alone. On that basis the paper treats the source model's collapse-prone conditions as a fingerprint set and accepts an ownership claim when a suspect model reproduces statistically abnormal cross-seed consistency, a test that remains positive for fine-tuned derivatives, pruned and quantized checkpoints, and several adaptive query-time interventions.

Load-bearing premise

The framework's load-bearing premise is that collapse-prone input regions are unique to an individual training run even when architecture, training data, and optimization are held identical; the only controlled evidence offered for that premise is the small CIFAR-10 DDPM study with upweighted samples, since the text-to-image experiments compare models that differ in data, architecture, or version.

Editorial extensions

If this is right

  • Already-trained, unwatermarked models become traceable after the fact, because the signature is intrinsic to the training outcome rather than implanted during training.
  • Black-box services are verifiable with ordinary-looking text: the natural-prompt fingerprints keep prompt perplexity near normal user text (41.85 and 51.32 on SD 1.4 and SD 2.1, versus above 200 for the adversarial-suffix baseline), giving a query-filtering service little to catch.
  • Derivative and obfuscation pipelines do not erase the signal: fingerprints stay verifiable across fine-tuned derivatives (SD 1.5, Deliberate, Realistic Vision), pruning up to 30 percent, quantization down to fp4, and adaptive interventions such as prompt rewriting, random token addition, embedding optimization, and sharpness-aware initialization.
  • Verification is cheap enough to be routine: with the default $M=4$ fingerprints and $K=4$ seeds, an ownership test costs sixteen generations, and pipeline-access fingerprint construction takes about 25 seconds per condition, matching the white-box baseline and far under the black-box suffix-optimization baseline's 370 seconds.
  • Both access regimes converge on the same decision rule, so one statistical procedure and one piece of evidence — cross-seed consistency — support checkpoint-level and service-level disputes alike.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the uniqueness result scales, the same mechanism should generalize beyond image diffusion: any stochastic generative model — autoregressive image or video models, audio generators, or language models sampled at nonzero temperature — could be fingerprinted by the output consistency of repeated samples under fixed conditions, because the paper's signal is defined purely by output statistics.
  • The paper's appendix shows that optimized white-box embeddings cannot be converted back into text tokens (post-hoc projection and discrete prompt optimization both push $p_{\mathrm{val}}$ above the threshold), which implies a lasting asymmetry: black-box fingerprints read as ordinary text, while white-box fingerprints are continuous and would be visible to anyone with pipeline access who inspects
  • The low-loss enrichment result hands auditors a free diagnostic: if per-sample denoising losses are logged during any diffusion training run, the likely collapse-prone subset can be flagged retroactively, effectively turning fingerprint construction into a byproduct of standard training logs.
  • The cleanest test of the framework's core assumption would train several large text-to-image models on identical public data with only the random seed varied and run the same $4\times4$ verification matrix; the paper's controlled evidence for run-level uniqueness currently comes only from the small CIFAR-10 study.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a non-invasive framework for verifying ownership of text-to-image (T2I) diffusion models by exploiting "collapsed generation," i.e., input conditions under which independent stochastic samplings produce highly consistent outputs. The framework constructs two kinds of fingerprints: continuous text-embedding fingerprints for white-box pipeline access, optimized by a truncated-denoising surrogate loss, and natural-prompt fingerprints for black-box API-only access, mined from low-loss training samples. Verification aggregates cross-seed consistency scores over a fingerprint set and compares the aggregate to a source-model normal-prompt reference via a right-tailed predictive t-test (Eq. 10), declaring ownership when the resulting p-value falls below a threshold. The paper reports a controlled CIFAR-10 DDPM study with four independently trained models, T2I confusion-matrix experiments for white-box and black-box settings, robustness experiments under pruning, quantization, fine-tuning, and adaptive query-time obfuscations, and an efficiency comparison.

Significance. If the central claim holds, the framework would be a useful addition to non-invasive model IP protection: it provides both white-box and black-box verification with a unified statistical criterion, uses natural prompts in the API-only setting, and demonstrates robustness to several obfuscations. The controlled CIFAR-10 study in Sec. V-A is a genuine strength, as it directly tests run-level uniqueness under fixed architecture, data, and optimizer; the confusion-matrix evaluations on T2I models and the explicit adaptive-query experiments are also valuable. However, the significance is conditional because the core premise—that collapsed-generation regions are unique to an individual training run at T2I scale when architecture and training data are held fixed—is only directly supported by a small-scale upweighted CIFAR-10 study. The T2I experiments compare models that differ in architecture, dataset, version, or fine-tuning lineage, so they do not yet establish the claimed granularity for the setting the paper targets.

major comments (3)
  1. [Sec. V-A and Figs. 8, 10] The only controlled test of run-level uniqueness uses four CIFAR-10 DDPMs trained on the same upweighted 500-image subset. The T2I uniqueness experiments in Figs. 8 and 10 compare models that differ in architecture, dataset, version, or fine-tuning lineage; no T2I experiment holds architecture and training data fixed while varying only the random seed. This is load-bearing because Appendix D argues that natural collapse persists even in deduplicated models due to "outlier samples" and "training dynamics" in shared public data, which implies that two independently trained models on the same public data could share collapse-inducing prompts. The paper should provide a same-data, same-architecture, different-seed T2I experiment, or alternatively an analysis of overlap between collapse-prone prompt sets of such models, and report the full cross-model verification p-value matrix for that setting.
  2. [Sec. IV-D, Eq. (10)] The verification statistic compares the suspect's aggregate fingerprint response only to the source model's normal-prompt reference; it is never calibrated against the suspect model's own normal cross-seed consistency. A suspect model that is globally low-diversity for reasons unrelated to the source's specific collapsed regions would produce a small p_val and be falsely declared a match. The paper does not report a false-positive experiment with a low-diversity unrelated model, nor does it compute the suspect's own normal reference. Because Eq. (11) converts this p_val directly into an ownership decision, the missing suspect-side baseline is a load-bearing gap in the verification procedure.
  3. [Sec. IV-C and Sec. IV-D] Fingerprint conditions are selected or optimized on the source model for high cross-seed consistency, so the matched-source diagonal in Figs. 7, 8, and 10 is partly satisfied by construction. The statistical test is also calibrated only against the source's normal prompts, not against an independent null distribution of the source's collapsed conditions or against conditions selected from a held-out subset. The paper should include an out-of-sample evaluation, for example by constructing fingerprints on one half of the source's collapse candidates and testing on the other half, to show that the observed separation reflects model specificity rather than a construction-time selection artifact.
minor comments (4)
  1. [Fig. 6] The caption describes a cumulative distribution of training loss, but the axes are labeled "Cumulative Probability" and "Average Loss" without explaining the curve and the marked threshold; please clarify what the plotted curve represents and how the likelihood ratio is computed.
  2. [Tables II and III] The green/red cell coloring used to indicate success and failure is not accessible in grayscale or for color-blind readers; please add explicit symbols (e.g., check/cross marks) or state success/failure in each cell.
  3. [Appendix E] The entry "SD 1.4 (white-box), Deci: N/A 1" is formatted as if it contains a footnote marker; please move the footnote text to the actual footnote position.
  4. [Eq. (10)] The predictive t-test assumes the reference scores are approximately normal and that sigma_0 is nonzero; with N=50 many reported p-values are below 1e-18, far outside the reliable tail of a t-distribution with 49 degrees of freedom. Please report effect sizes or log-transformed p-values and state how zero variance in the reference would be handled.

Circularity Check

1 steps flagged · score 4.0 of 10

Verification evidence is source-referenced and fingerprint conditions are source-optimized, so the matched-source result is definitional; off-diagonal tests supply the real uniqueness content.

  1. self definitional [Sec. IV-D, Eqs. (9)-(11); fingerprint construction in Sec. IV-C]
    "Before deployment, the owner establishes a normal-generation reference sample on the source model using a set of normal prompts... Treating the aggregate fingerprint response \bar{s}_f as a new observation relative to this reference sample, we perform a right-tailed predictive t-test... Given a decision threshold \tau_f, we accept the ownership claim when p_val < \tau_f."

    The test's reference distribution is the source model's own normal-prompt consistency (mu_0, sigma_0), so 'reproduces the source's collapsed fingerprint behavior' is operationalized as 'bar_s_f lies in the upper tail of the source's normal reference.' This is self-referential: a suspect with generally low output diversity will yield a small p_val for any fingerprint prompt, even if it does not reproduce the source's specific collapsed regions, because the suspect's own normal consistency is never used as the null. Since the fingerprint conditions were themselves selected/optimized on the source to maximize consistency (Eq. 8 argmin L_Collapse; Sec. IV-C 'select the M prompts with the highest consistency'), the matched-source diagonal is guaranteed by construction.

full rationale

The core derivation chain is a standard trigger-based fingerprinting argument: define collapse-prone conditions, construct them on the source model, and test whether a suspect reproduces them. That chain is not circular per se, and the paper's uniqueness evidence includes genuinely informative off-diagonal comparisons (e.g., Fig. 2(b), Fig. 7, Fig. 8, Fig. 10) showing that mismatched models do not reproduce the same collapse. No load-bearing self-citation or imported uniqueness theorem is used; the cited memorization/extraction literature is external. The main circularity concern is the verification statistic: the null distribution is estimated from the source's own normal prompts, so the decision rule defines 'ownership evidence' as 'abnormal relative to the source', not 'specific relative to the suspect'. Combined with the fact that the fingerprint conditions are fitted on the source to maximize consistency, the matched-source diagonal is satisfied by construction. This makes the formal evidence predicate partially circular, while the empirical off-diagonal separation keeps the overall claim from being fully reducible to its inputs. The untested T2I-scale same-data run-level uniqueness is a correctness and robustness gap rather than an additional circular step.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The method rests on the empirical phenomenon of collapsed generation and on several access assumptions. The main free parameters are the decision thresholds, fingerprint sizes, and optimization hyperparameters; the key axioms are the model-specificity of collapsed regions, the adequacy of SSCD as a consistency metric, the availability of stochastic sampling in the suspect API, and the validity of the source-referenced t-test.

free parameters (8)
  • Collapse detection threshold tau_s = not specified
    Defined in Eq. 5 as the threshold for declaring a condition collapsed; its value is not reported in the main text, making the operational definition incomplete.
  • Verification decision threshold tau_f = 1e-4
    Chosen threshold for p_val in Eq. 11; used throughout the T2I experiments.
  • Low-loss candidate threshold = 0.02 (MSE)
    Threshold on per-sample training loss for building the candidate pool P_cand (Sec. IV-C, Fig. 6); chosen to yield a likelihood ratio of about 12.5.
  • Number of fingerprints M = 4
    Default fingerprint set size; ablation shows marginal gain at M=8.
  • Number of generations K = 4
    Default generations per fingerprint; ablation shows K=4 is sufficient.
  • Normal reference size N = 50
    Number of GPT-4 generated prompts used to estimate mu_0 and sigma_0 in the predictive t-test.
  • Truncated optimization steps t_trunc = 5 (SD 1.4, Deci); 10 (PixArt, SD 3)
    Number of early denoising steps through which gradients are propagated (Table VII).
  • Learning rate eta and optimization iterations I = model-dependent (Table VII)
    Optimization hyperparameters for continuous-embedding synthesis.
assumptions (5)
  • domain assumption SSCD score measures perceptual similarity adequate for cross-seed consistency.
    Sec. IV-A instantiates s(·,·) with SSCD; the method's signal depends on this similarity metric tracking human-perceived output consistency.
  • domain assumption Collapsed generation is an intrinsic, model-dependent property shaped by data, architecture, and optimization.
    Sec. IV-B and Sec. III rely on prior memorization studies; the model-specificity of collapsed regions is the core uniqueness premise.
  • domain assumption The suspect API permits independent stochastic sampling with controllable seeds.
    Verification requires K independent generations per fingerprint (Eq. 4); a deterministic API or result caching would trivially satisfy the consistency test and break its discriminative power.
  • domain assumption The source's normal-generation reference (GPT-4 prompts) is representative and the predictive t-test is valid.
    Sec. IV-D uses N=50 GPT-4 prompts to estimate the null distribution; assumes normality and representativeness, without checking the suspect's own normal diversity.
  • ad hoc to paper Early denoising latent dispersion is a valid surrogate for final-image cross-seed consistency.
    Sec. IV-C motivates truncated optimization via Fig. 5; the surrogate is not quantitatively validated against full-image consistency during optimization, only via final fingerprint evaluation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fingerprinting Text-to-Image Diffusion Models via Collapsed Generation." pith.science (2026). https://pith.science/paper/RBV7EUOE

@misc{pith2026260811732,
  author       = {Pith},
  title        = {Pith review of: Fingerprinting Text-to-Image Diffusion Models via Collapsed Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RBV7EUOE}},
  note         = {Machine review of arXiv:2608.11732}
}
read the original abstract

Proprietary text-to-image diffusion models are increasingly distributed as hosted services and downloadable checkpoints, making their intellectual property (IP) protection an increasingly critical concern when model leakage, copying, or unauthorized fine-tuning is disputed. In this work, we present a non-invasive model fingerprinting framework based on \emph{collapsed generation}, a phenomenon where certain input conditions produce highly consistent images across multiple stochastic seeds. We show that collapsed generation is an intrinsic, model-dependent property of the learned generation process. These collapse-prone conditions therefore expose model-specific behavioral signatures, enabling reliable ownership verification without embedding invasive watermarks. After preparing conditions on the source model, the framework verifies a suspect model under two access settings: (1) white-box pipeline access, where optimized continuous embeddings can be injected into the generation process, and (2) black-box API-only access, where natural language prompts are queried through the service interface. In both cases, ownership evidence is measured by whether the suspect model reproduces the source model's collapse behavior across stochastic samplings. Extensive experiments across UNet- and transformer-based diffusion models show that collapsed generation fingerprints can distinguish different source models with low confusion. These fingerprints remain verifiable in fine-tuned derivatives and under common and adaptive model- or query-level obfuscations, while requiring only a modest verification query budget. Together, these results establish collapsed generation as a reliable intrinsic evidence source for non-invasive diffusion model ownership verification.

Figures

Figures reproduced from arXiv: 2608.11732 by the authors.

Figure 1
Figure 1. Collapsed generation as a non-invasive ownership signal for diffusion models. (a) Collapsed generation. Under ordinary input conditions, different stochastic seeds usually produce diverse images, whereas a collapse-prone condition yields highly consistent outputs on the source model. Such collapse behavior is model-dependent and therefore can serve as a behavioral fingerprint. (b) Ownership verification. The model o… view at source ↗
Figure 2
Figure 2. (a): Distribution of average pairwise similarity scores [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Different model architectures, training data, and op [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Overview of fingerprint construction. (a) Continuous-Embedding Synthesis. For pipeline-access verification, the owner optimizes conditioning embeddings on the source model. Starting from an initial embedding ci and K independent noises {x (k) T } K k=1, truncated optim…
Figure 5
Figure 5. Figure 5: Visualization of predicted x0 along the denoising process for a representative collapsed and normal example in SD 1.4. For the collapsed example (top), stable and recog￾nizable output content emerges within the first few denoising steps. For the normal example (bottom)…
Figure 7
Figure 7. Figure 7: Controlled validation of fingerprint uniqueness across [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Confusion matrices (white-box). Blue indicates higher [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Case study for robustness analysis (white-box). Fin [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: Confusion matrices (black-box). Scores are displayed [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 11
Figure 11. Figure 11: pval using different number of prompts/generations (black-box). 2 4 6 8 Number of Embeddings p v al 1.26e-18 1.23e-19 4.87e-20 2 4 6 8 Number of Seeds p v al 1.64e-14 1.23e-19 6.87e-20 [PITH_FULL_IMAGE:figures/full_fig_p016_11.png]
Figure 12
Figure 12. Figure 12: pval using different number of embeddings/generations (white-box). along the main diagonal maintain a high degree of visual consistency, while off-diagonal entries exhibit varying levels of significant diversity. This validates the strong discriminative ability of our…
Figure 14
Figure 14. Figure 14: Case study for robustness analysis (SD 1.4, black [PITH_FULL_IMAGE:figures/full_fig_p016_14.png]
Figure 15
Figure 15. Figure 15: Case study for robustness analysis (SD 1.4, white [PITH_FULL_IMAGE:figures/full_fig_p017_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 25 canonical work pages

  1. [1]

    High- resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High- resolution image synthesis with latent diffusion models,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 10 684–10 695

    2022

  2. [2]

    Stable diffusion v2.1 and dreamstudio updates,

    S. AI, “Stable diffusion v2.1 and dreamstudio updates,” Blog post / Release notes, Dec 2022, stable Diffusion v2.1 release (Dec 7, 2022). [Online]. Available: https: //stability.ai/news/stablediffusion2-1-release7-dec-2022

    work page 2022

  3. [3]

    Decidiffusion 1.0,

    D. R. Team, “Decidiffusion 1.0,” 2023. [On- line]. Available: [https://huggingface.co/deci/decidiffusion-v1-0](https: //huggingface.co/deci/decidiffusion-v1-0)

    work page 2023

  4. [4]

    Hunyuan-dit: A powerful multi-resolution diffusion transformer with fine-grained chinese understanding,

    Z. Li, J. Zhang, Q. Lin, J. Xiong, Y . Long, X. Deng, Y . Zhang, X. Liu, M. Huang, Z. Xiao, D. Chen, J. He, J. Li, W. Li, C. Zhang, R. Quan, J. Lu, J. Huang, X. Yuan, X. Zheng, Y . Li, J. Zhang, C. Zhang, M. Chen, J. Liu, Z. Fang, W. Wang, J. Xue, Y . Tao, J. Zhu, K. Liu, S. Lin, Y . Sun, Y . Li, D. Wang, M. Chen, Z. Hu, X. Xiao, Y . Chen, Y . Liu, W. Liu...

    arXiv 2024

  5. [5]

    Pixart-$\alpha$: Fast training of diffusion transformer for photorealistic text-to-image synthesis,

    J. Chen, J. YU, C. GE, L. Yao, E. Xie, Z. Wang, J. Kwok, P. Luo, H. Lu, and Z. Li, “Pixart-$\alpha$: Fast training of diffusion transformer for photorealistic text-to-image synthesis,” inThe Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/forum?id=eAKmQPe3m1

    work page 2024

  6. [6]

    A comprehensive defense framework against model extraction attacks,

    W. Jiang, H. Li, G. Xu, T. Zhang, and R. Lu, “A comprehensive defense framework against model extraction attacks,”IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 2, pp. 685–700, 2023

    2023

  7. [7]

    Megex: Data-free model extrac- tion attack against gradient-based explainable ai,

    T. Miura, T. Shibahara, and N. Yanai, “Megex: Data-free model extrac- tion attack against gradient-based explainable ai,” inProceedings of the 2nd ACM Workshop on Secure and Trustworthy Deep Learning Systems, 2024, pp. 56–66

    work page 2024

  8. [8]

    A Recipe for Watermarking Diffusion Models,

    Y . Zhao, T. Pang, C. Du, X. Yang, N.-M. Cheung, and M. Lin, “A Recipe for Watermarking Diffusion Models,” Oct. 2023. [Online]. Available: http://arxiv.org/abs/2303.10137

    arXiv 2023

Show all 47 references
  1. [9]

    The stable signature: Rooting watermarks in latent diffusion models,

    P. Fernandez, G. Couairon, H. J ´egou, M. Douze, and T. Furon, “The stable signature: Rooting watermarks in latent diffusion models,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 22 466–22 477. [Online]. Available: http://openaccess.thec...

    2023

  2. [10]

    Watermarking Diffusion Model,

    Y . Liu, Z. Li, M. Backes, Y . Shen, and Y . Zhang, “Watermarking Diffusion Model,” May 2023. [Online]. Available: http://arxiv.org/abs/ 2305.12502

    2023 arXiv

  3. [11]

    Huref: Human-readable fingerprint for large language models,

    B. Zeng, L. Wang, Y . Hu, Y . Xu, C. Zhou, X. Wang, Y . Yu, and Z. Lin, “Huref: Human-readable fingerprint for large language models,”Ad- vances in Neural Information Processing Systems, vol. 37, pp. 126 332– 126 362, 2024

    2024

  4. [12]

    One Prompt to Verify Your Models: Black-Box Text-to-Image Models Verification via Non-Transferable Adversarial Attacks,

    J. Guo, W. Jiang, R. Zhang, G. Lu, and H. Li, “One Prompt to Verify Your Models: Black-Box Text-to-Image Models Verification via Non-Transferable Adversarial Attacks,” May 2025. [Online]. Available: http://arxiv.org/abs/2410.22725

    2025 arXiv

  5. [13]

    Fingerprinting Denoising Diffusion Probabilistic Models,

    H. Teng, Y . Quan, C. Wang, J. Huang, and H. Ji, “Fingerprinting Denoising Diffusion Probabilistic Models,”2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2025

    2025

  6. [14]

    Diffip: Representation fingerprints for robust ip protection of diffusion models,

    Z. Li, H. Qu, J. Kuen, J. Gu, Q. Ke, J. Liu, and H. Rahmani, “Diffip: Representation fingerprints for robust ip protection of diffusion models,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2025, pp. 17 035–17 045

    2025

  7. [15]

    Extracting training data from diffusion models,

    N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V . Sehwag, F. Tramer, B. Balle, D. Ippolito, and E. Wallace, “Extracting training data from diffusion models,” in32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 5253–5270. [Online]. Available: https://www.usenix.org/...

    2023

  8. [16]

    Finding nemo: Localizing neurons responsible for memorization in diffusion models,

    D. Hintersdorf, L. Struppek, K. Kersting, A. Dziedzic, and F. Boenisch, “Finding nemo: Localizing neurons responsible for memorization in diffusion models,”Advances in Neural Information Processing Systems, vol. 37, pp. 88 236–88 278, 2024. [Online]. Available: https://proceed...

    2024

  9. [17]

    Understanding and Mitigating Copying in Diffusion Models,

    G. Somepalli, V . Singla, M. Goldblum, J. Geiping, and T. Goldstein, “Understanding and Mitigating Copying in Diffusion Models,”Advances in Neural Information Processing Systems, 2023. 13

    2023

  10. [18]

    Detecting, Explaining, and Mit- igating Memorization in Diffusion Models,

    Y . Wen, Y . Liu, C. Chen, and L. Lyu, “Detecting, Explaining, and Mit- igating Memorization in Diffusion Models,”The Twelfth International Conference on Learning Representations, 2024

    2024

  11. [19]

    Embedding watermarks into deep neural networks,

    Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” inProceedings of the 2017 ACM on International Conference on Multimedia Retrieval, ser. ICMR ’17. ACM, Jun. 2017, p. 269–277. [Online]. Available: http://dx.doi.org/10.1145/3078...

    2017

  12. [20]

    Turning your weakness into a strength: Watermarking deep neural networks by backdooring,

    Y . Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” 2018. [Online]. Available: https://arxiv.org/abs/1802. 04633

    2018

  13. [21]

    Deepsigns: A generic watermarking framework for ip protection of deep learning models,

    B. D. Rouhani, H. Chen, and F. Koushanfar, “Deepsigns: A generic watermarking framework for ip protection of deep learning models,”

  14. [22]

    Deep neural network fingerprinting by conferrable adversarial examples,

    N. Lukas, Y . Zhang, and F. Kerschbaum, “Deep neural network fingerprinting by conferrable adversarial examples,”arXiv preprint arXiv:1912.00888, 2019

    1912 arXiv

  15. [23]

    Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,

    X. Cao, J. Jia, and N. Z. Gong, “Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,” inProceedings of the 2021 ACM asia conference on computer and communications security, 2021, pp. 14–25

    2021

  16. [24]

    A dnn fingerprint for non- repudiable model ownership identification and piracy detection,

    Y . Zheng, S. Wang, and C.-H. Chang, “A dnn fingerprint for non- repudiable model ownership identification and piracy detection,”IEEE Transactions on Information Forensics and Security, vol. 17, pp. 2977– 2989, 2022

    2022

  17. [25]

    A watermark-conditioned diffusion model for ip protection,

    R. Min, S. Li, H. Chen, and M. Cheng, “A watermark-conditioned diffusion model for ip protection,” 2024. [Online]. Available: https://arxiv.org/abs/2403.10893

    2024 arXiv

  18. [26]

    Sleepermark: Towards robust watermark against fine- tuning text-to-image diffusion models,

    Z. Wang, J. Guo, J. Zhu, Y . Li, H. Huang, M. Chen, and Z. Tu, “Sleepermark: Towards robust watermark against fine- tuning text-to-image diffusion models,” 2025. [Online]. Available: https://arxiv.org/abs/2412.04852

    2025 arXiv

  19. [27]

    Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Models,

    G. Somepalli, V . Singla, M. Goldblum, J. Geiping, and T. Goldstein, “Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Models,” in2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Jun. 2023, pp. 6048–6058. [Online]. Availa...

    2023

  20. [28]

    A Reproducible Extraction of Training Images from Diffusion Models,

    R. Webster, “A Reproducible Extraction of Training Images from Diffusion Models,” May 2023. [Online]. Available: http://arxiv.org/abs/ 2305.08694

    2023 arXiv

  21. [29]

    Understanding and Mitigating Memo- rization in Generative Models via Sharpness of Probability Landscapes,

    D. Jeon, D. Kim, and A. No, “Understanding and Mitigating Memo- rization in Generative Models via Sharpness of Probability Landscapes,” Proceedings of the 42nd International Conference on Machine Learning, 2025

    2025

  22. [30]

    A geometric framework for understanding memorization in generative models,

    B. L. Ross, H. Kamkari, T. Wu, R. Hosseinzadeh, Z. Liu, G. Stein, J. C. Cresswell, and G. Loaiza-Ganem, “A geometric framework for understanding memorization in generative models,” inThe Thirteenth International Conference on Learning Representations, 2025

    2025

  23. [31]

    Memo- rization is localized within a small subspace in diffusion models,

    R. Chavhan, O. Bohdal, Y . Zong, D. Li, and T. Hospedales, “Memo- rization is localized within a small subspace in diffusion models,” in International Conference on Machine Learning (ICML)-Workshop on Generative AI and Law, 2024

    2024

  24. [32]

    A self- supervised descriptor for image copy detection,

    E. Pizzi, S. D. Roy, S. N. Ravindra, P. Goyal, and M. Douze, “A self- supervised descriptor for image copy detection,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 14 532–14 542

    2022

  25. [33]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” 2020. [Online]. Available: https://arxiv.org/abs/2006.11239

    2020 arXiv

  26. [34]

    On the convergence and mode collapse of gan,

    Z. Zhang, M. Li, and J. Yu, “On the convergence and mode collapse of gan,” inSIGGRAPH Asia 2018 Technical Briefs, 2018, pp. 1–4

    2018

  27. [35]

    Training diffusion models towards diverse image generation with reinforcement learning,

    Z. Miao, J. Wang, Z. Wang, Z. Yang, L. Wang, Q. Qiu, and Z. Liu, “Training diffusion models towards diverse image generation with reinforcement learning,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 10 844–10 853

    2024

  28. [36]

    Content- based unrestricted adversarial attack,

    Z. Chen, B. Li, S. Wu, K. Jiang, S. Ding, and W. Zhang, “Content- based unrestricted adversarial attack,”Advances in Neural Information Processing Systems, vol. 36, pp. 51 719–51 733, 2023

    2023

  29. [37]

    Sd-nae: Generating natural adver- sarial examples with stable diffusion,

    Y . Lin, J. Zhang, Y . Chen, and H. Li, “Sd-nae: Generating natural adver- sarial examples with stable diffusion,”arXiv preprint arXiv:2311.12981, 2023

    2023 arXiv

  30. [38]

    Membership inference on text-to-image diffusion models via conditional likelihood discrepancy,

    S. Zhai, H. Chen, Y . Dong, J. Li, Q. Shen, Y . Gao, H. Su, and Y . Liu, “Membership inference on text-to-image diffusion models via conditional likelihood discrepancy,”Advances in Neural Information Processing Systems, vol. 37, pp. 74 122–74 146, 2024

    2024

  31. [39]

    Why diffusion models don’t memorize: The role of implicit dynamical regularization in training,

    T. Bonnaire, R. Urfin, G. Biroli, and M. Mezard, “Why diffusion models don’t memorize: The role of implicit dynamical regularization in training,” inThe Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025

    2025

  32. [40]

    Scaling rectified flow transformers for high-resolution image synthesis,

    P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. M ¨uller, H. Saini, Y . Levi, D. Lorenz, A. Sauer, F. Boeselet al., “Scaling rectified flow transformers for high-resolution image synthesis,” inForty-first international conference on machine learning, 2024

    2024

  33. [41]

    Hugging Face – The AI community building the future

    “Hugging Face – The AI community building the future.” [Online]. Available: https://huggingface.co/

  34. [42]

    Deliberate v4,

    XpucT, “Deliberate v4,” 2023. [Online]. Available: [https://huggingface. co/XpucT/Deliberate](https://huggingface.co/XpucT/Deliberate)

    2023

  35. [43]

    Realistic vision v2.0,

    SG161222, “Realistic vision v2.0,” 2023. [Online]. Avail- able: [https://huggingface.co/SG161222/Realistic Vision V2.0](https: //huggingface.co/SG161222/Realistic Vision V2.0)

    2023

  36. [44]

    Mistral 7b,

    A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. de las Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier, L. R. Lavaud, M.-A. Lachaux, P. Stock, T. L. Scao, T. Lavril, T. Wang, T. Lacroix, and W. E. Sayed, “Mistral 7b,” 2023. [Online]. Available: ht...

    2023 arXiv

  37. [45]

    Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery,

    Y . Wen, N. Jain, J. Kirchenbauer, M. Goldblum, J. Geiping, and T. Gold- stein, “Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery,”Advances in Neural Information Processing Systems, vol. 36, pp. 51 008–51 025, 2023

    2023

  38. [46]

    Universal and transferable adversarial attacks on aligned language models,

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,”arXiv preprint arXiv:2307.15043, 2023. 14 APPENDIXA ALGORITHMS Algorithm 1Continuous-Embedding Fingerprint Synthesis Input:Initial...

    2023 arXiv

  39. [2018]

    Available: https://arxiv.org/abs/1804.00750

    [Online]. Available: https://arxiv.org/abs/1804.00750

    arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.