Fingerprinting Text-to-Image Diffusion Models via Collapsed Generation

2026-08-12

AI Summary

This work addresses the challenge of intellectual property protection for text-to-image diffusion models in scenarios involving model leakage, replication, or unauthorized fine-tuning. It proposes a non-intrusive ownership verification method grounded in the “collapsed generation” phenomenon—an intrinsic behavioral trait wherein the source model produces highly consistent outputs across different random seeds under specific inputs. The approach requires no watermark embedding and supports both white-box verification (via continuous embedding injection) and black-box verification (through natural language prompts). Experiments demonstrate that this fingerprinting mechanism exhibits high discriminability across models based on both UNet and Transformer architectures, remains robust against fine-tuning and various obfuscation attacks, and enables effective ownership confirmation with only a small number of queries.

Abstract

Proprietary text-to-image diffusion models are increasingly distributed as hosted services and downloadable checkpoints, making their intellectual property (IP) protection an increasingly critical concern when model leakage, copying, or unauthorized fine-tuning is disputed. In this work, we present a non-invasive model fingerprinting framework based on \emph{collapsed generation}, a phenomenon where certain input conditions produce highly consistent images across multiple stochastic seeds. We show that collapsed generation is an intrinsic, model-dependent property of the learned generation process. These collapse-prone conditions therefore expose model-specific behavioral signatures, enabling reliable ownership verification without embedding invasive watermarks. After preparing conditions on the source model, the framework verifies a suspect model under two access settings: (1) white-box pipeline access, where optimized continuous embeddings can be injected into the generation process, and (2) black-box API-only access, where natural language prompts are queried through the service interface. In both cases, ownership evidence is measured by whether the suspect model reproduces the source model's collapse behavior across stochastic samplings. Extensive experiments across UNet- and transformer-based diffusion models show that collapsed generation fingerprints can distinguish different source models with low confusion. These fingerprints remain verifiable in fine-tuned derivatives and under common and adaptive model- or query-level obfuscations, while requiring only a modest verification query budget. Together, these results establish collapsed generation as a reliable intrinsic evidence source for non-invasive diffusion model ownership verification.

Problem

• model fingerprinting
• diffusion models
• ownership verification
• intellectual property
• collapsed generation

Innovation

• collapsed generation
• model fingerprinting
• diffusion models
• ownership verification
• non-invasive watermarking