Fingerprinting Text-to-Image Diffusion Models via Collapsed Generation

• URL: http://arxiv.org/abs/2608.11732v1
• Date: Wed, 12 Aug 2026 07:12:38 GMT
• Title: Fingerprinting Text-to-Image Diffusion Models via Collapsed Generation
• Abstract summary: Collapsed generation is an intrinsic, model-dependent property of the learned generation process.<n>We show collapsed generation fingerprints can distinguish different source models with low confusion.<n>These fingerprints remain verifiable in fine-tuned derivatives and under common and adaptive model- or query-level obfuscations.
• Score: 38.697895774925136
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Proprietary text-to-image diffusion models are increasingly distributed as hosted services and downloadable checkpoints, making their intellectual property (IP) protection an increasingly critical concern when model leakage, copying, or unauthorized fine-tuning is disputed. In this work, we present a non-invasive model fingerprinting framework based on \emph{collapsed generation}, a phenomenon where certain input conditions produce highly consistent images across multiple stochastic seeds. We show that collapsed generation is an intrinsic, model-dependent property of the learned generation process. These collapse-prone conditions therefore expose model-specific behavioral signatures, enabling reliable ownership verification without embedding invasive watermarks. After preparing conditions on the source model, the framework verifies a suspect model under two access settings: (1) white-box pipeline access, where optimized continuous embeddings can be injected into the generation process, and (2) black-box API-only access, where natural language prompts are queried through the service interface. In both cases, ownership evidence is measured by whether the suspect model reproduces the source model's collapse behavior across stochastic samplings. Extensive experiments across UNet- and transformer-based diffusion models show that collapsed generation fingerprints can distinguish different source models with low confusion. These fingerprints remain verifiable in fine-tuned derivatives and under common and adaptive model- or query-level obfuscations, while requiring only a modest verification query budget. Together, these results establish collapsed generation as a reliable intrinsic evidence source for non-invasive diffusion model ownership verification.

Related papers

• Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models [99.66311024852651]
  Existing model fingerprinting methods lack robustness against collusion attacks.<n>We propose a robust fingerprinting method for T2I models with anti-collusion capabilities.<n>Our method achieves high fidelity and robustness across multiple T2I image generation and editing tasks, with fingerprint extraction accuracy exceeding 99.5%.
  arXiv  Detail & Related papers  (2026-06-11T07:12:13Z)
• A Behavioral Fingerprint for Large Language Models: Provenance Tracking via Refusal Vectors [43.11304710234668]
  We introduce a novel fingerprinting framework that leverages the behavioral patterns induced by safety alignment.<n>In a large-scale identification task across 76 offspring models, our method achieves 100% accuracy in identifying the correct base model family.<n>We propose a theoretical framework to transform this private fingerprint into a publicly verifiable, privacy-preserving artifact.
  arXiv  Detail & Related papers  (2026-02-10T05:57:35Z)
• ExposeAnyone: Personalized Audio-to-Expression Diffusion Models Are Robust Zero-Shot Face Forgery Detectors [58.45131932883374]
  We propose a fully self-supervised approach to detect deepfakes in videos.<n>Our model computes the identity distances between suspected videos and personalized subjects via diffusion reconstruction errors.<n>Our method is highly robust to corruptions such as blur and compression, highlighting the applicability in real-world face forgery detection.
  arXiv  Detail & Related papers  (2026-01-05T18:59:54Z)
• SeedPrints: Fingerprints Can Even Tell Which Seed Your Large Language Model Was Trained From [65.75182441010327]
  We propose a stronger and more intrinsic notion of LLM fingerprinting: SeedPrints.<n>We show that untrained models exhibit reproducible token selection biases conditioned solely on their parameters.<n> Experiments on LLaMA-style and Qwen-style models show that SeedPrints achieves seed-level distinguishability and can provide birth-to-lifecycle identity verification akin to a biometric fingerprint.
  arXiv  Detail & Related papers  (2025-09-30T15:34:08Z)
• Causal Fingerprints of AI Generative Models [18.85839181425287]
  We argue that a complete model fingerprint should reflect the causality between image provenance and model traces.<n>We propose a causality-decoupling framework that disentangles it from image-specific content and style.<n>Our approach outperforms existing methods in model attribution, indicating strong potential for forgery detection, model copyright tracing, and identity protection.
  arXiv  Detail & Related papers  (2025-09-18T20:33:27Z)
• AuthPrint: Fingerprinting Generative Models Against Malicious Model Providers [5.450474861880874]
  This paper introduces a trusted verifier that extracts hidden fingerprints from the authentic model's output space and trains a detector to recognize them.<n>During verification, this detector can determine whether new outputs are consistent with the certified model, without requiring specialized hardware or model modifications.<n>In extensive experiments, our methods achieve near-zero FPR@95%TPR on both GANs and diffusion models.
  arXiv  Detail & Related papers  (2025-08-06T12:17:38Z)
• Attuned to Change: Causal Fine-Tuning under Latent-Confounded Shifts [32.989526411946606]
  Adapting to latent-confounded shifts remains a core challenge in modern AI.<n>One practical failure mode arises when fine-tuning pre-trained foundation models on confounded data.<n>We frame causal fine-tuning as an identification problem and pose an explicit causal model that decomposes inputs into low-level spurious features.
  arXiv  Detail & Related papers  (2024-10-18T11:06:23Z)
• WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models [32.29120988096214]
  This paper introduces a novel approach to model fingerprinting that assigns responsibility for the generated images. Our method modifies generative models based on each user's unique digital fingerprint, imprinting a unique identifier onto the resultant content that can be traced back to the user.
  arXiv  Detail & Related papers  (2023-06-07T19:44:14Z)
• Decentralized Attribution of Generative Models [35.80513184958743]
  Decentralized attribution relies on binary classifiers associated with each user-end model. We develop sufficient conditions of the keys that guarantee an attributability lower bound. Our method is validated on MNIST, CelebA, and FFHQ datasets.
  arXiv  Detail & Related papers  (2020-10-27T01:03:45Z)
• Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data [64.65952078807086]
  Photorealistic image generation has reached a new level of quality due to the breakthroughs of generative adversarial networks (GANs) Yet, the dark side of such deepfakes, the malicious use of generated media, raises concerns about visual misinformation. We seek a proactive and sustainable solution on deepfake detection by introducing artificial fingerprints into the models.
  arXiv  Detail & Related papers  (2020-07-16T16:49:55Z)
• Understanding the Intrinsic Robustness of Image Distributions using Conditional Generative Models [87.00072607024026]
  We study the intrinsic robustness of two common image benchmarks under $ell$ perturbations. We show the existence of a large gap between the robustness limits implied by our theory and the adversarial robustness achieved by current state-of-the-art robust models.
  arXiv  Detail & Related papers  (2020-03-01T01:45:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.