Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothing
Leyi Qi 1 Yiming Li 1 Siyuan Liang 1 Zhengzhong Tu 2 Dacheng Tao 1
Abstract
erative modeling, achieving breakthrough progress in highquality image synthesis and being widely adopted in content creation and commercial design. Represented by large-scale pretrained models such as Stable Diffusion (Rombach et al., 2022), T2I diffusion models can generate high-quality and diverse images from user prompts, substantially improving creative efficiency and reshaping content production workflows; moreover, with the advancement of personalization and fine-tuning techniques, these models can be customized to generate images with specific themes or styles (Lim et al., 2025; Wu et al., 2025; Li et al., 2025a). However, training high-performing models typically requires massive data and expensive computational resources (Zheng et al., 2025; Dubiński et al., 2025; Shao et al., 2026), making them valuable intellectual property assets that are also vulnerable to unauthorized copying, redistribution, and misuse (Li et al., 2025d; Lyu et al., 2025; Li et al., 2025b). Therefore, effectively protecting the copyright and ownership of T2I diffusion models has become a critical challenge in generative model security and intellectual property protection (Guo et al., 2024; Chen et al., 2023).
arXiv:2605.29809v1 [cs.CR] 28 May 2026
Large-scale text-to-image (T2I) diffusion models have enabled unprecedented creative applications, but their unauthorized use has raised serious intellectual property concerns, making model ownership verification (MOV) increasingly critical. We find that existing backdoor-based diffusion watermarking methods often (implicitly) assume a “faithful” verification process, namely, that the verifier can query a suspicious model and obtain the faithful watermark response to complete MOV. However, in practice, adversaries may intentionally or unintentionally damage potential watermark signals, significantly degrading verification reliability. To address this issue, we propose CertLAS, the first certified MOV method for T2I models based on layer-adaptive smoothing. In general, Cert-LAS embeds specified watermarks using diffusion classifiers and an LFS-guided layeradaptive noise, and verifies ownership by examining whether the suspected model exhibits significantly stronger watermark responses compared to unwatermarked references through hypothesis testing. We further prove that, under certain conditions, our Cert-LAS can still achieve reliable verification even in the presence of malicious removal attacks. Extensive experiments validate the effectiveness of Cert-LAS and its resistance to adaptive attacks. Our code is available here.
To the best of our knowledge, model ownership verification (MOV) is an important tool for mitigating model-stealing risks, aiming to determine whether a suspicious model is stolen from a protected owner model. Existing MOV methods are generally categorized into model fingerprinting (Gloaguen et al., 2025; Pasquini et al., 2025; Shao et al., 2025a) and model watermarking (Shao et al., 2025b; Yang et al., 2025; 2026): Fingerprinting typically embeds verification signals outside the model backbone but often exhibits limited robustness under sophisticated stealing scenarios (Li et al., 2025c; Wang et al., 2025d; Zhu et al., 2025). Therefore, we primarily focus on model watermarking, which trains the owner model to produce verifiable outputs on predefined inputs. Specifically, this paper mainly focuses on the most widely used backdoor-based diffusion watermarking paradigm, which embeds a private trigger during training that activates predefined watermark behavior during generation (Zhao et al., 2023; Wang et al., 2025d), thereby enabling MOV for T2I diffusion models in practice.
1. Introduction Text-to-image (T2I) (Zhang et al., 2025; Wang et al., 2025c) diffusion models have emerged as a major paradigm in gen1
Generative AI Lab, College of Computing and Data Science, Nanyang Technological University, Singapore 2 Department of Computer Science and Engineering, Texas A&M University, USA . Correspondence to: Yiming Li <[email protected]>, Dacheng Tao <[email protected]>.
Inspired by (Qiao et al., 2025; 2026a), we first revisit existing backdoor-based diffusion watermarking methods. We
Proceedings of the 43 rd International Conference on Machine Learning, Seoul, South Korea. PMLR 306, 2026. Copyright 2026 by the author(s).
1
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
t-test, the suspicious model can be verified as derived from the protected model (without authorization) if its WR value is significantly larger than the RP value of a reference generator that is independently trained without watermarking, thereby achieving certified ownership verification.
find that these methods often implicitly assume a “faithful” verification process, where a verifier can query a suspicious model and obtain faithful watermark responses to complete MOV. However, in realistic adversarial settings, this assumption frequently breaks down, as an adversary could intentionally or unintentionally damage potential watermark signals. In particular, our experiments demonstrate that both unintentional random perturbations and intentionally crafted adversarial perturbations can substantially corrupt the watermark signal and degrade verification reliability. Meanwhile, for MOV of conventional classifiers, pioneering studies (Bansal et al., 2022; Jiang et al., 2023; Ren et al., 2023) have provided certified robustness guarantees: as long as parameter perturbations are confined within a certified region, the watermark remains stable and non-removable in the worst case. This leads to a key question: can we design a certified watermark for T2I diffusion models that is both stealthy and equipped with provable robustness guarantees?
In summary, the main contributions of this paper are fourfold: (1) We revisit existing model ownership verification (MOV) methods for text-to-image (T2I) diffusion models and reveal their limitations in undetectability and robustness; (2) We propose Cert-LAS, the first certified watermarking method for T2I diffusion models, which uses a diffusion classifier as an implicit watermark carrier and introduces layer-adaptive randomized smoothing tailored to UNet architectures; (3) We theoretically analyze the robustness guarantees of the proposed MOV method for T2I diffusion models and establish the corresponding conditions; (4) We conduct extensive experiments to validate the effectiveness of our method and its resistance to potential adaptive attacks.
The answer to this question is affirmative, although we cannot simply adapt existing certified watermarking methods from classifiers. This is mainly because diffusion models learn score estimates (i.e., gradients of the log-density) over a much broader data region rather than relying on low-dimensional decision boundaries, and certified robust training at this scale is computationally prohibitive. To address this gap, we propose Cert-LAS, the first certified watermarking method for T2I diffusion models for model ownership verification, and show that our method enables reliable MOV under certain conditions (e.g., bounded parameter perturbations). In general, our Cert-LAS operates in two stages. In the first stage, we embed a trigger-free watermark under layer-adaptive smoothing. We begin by allocating layer-wise noise to each UNet layer according to the Layer Fine-tuning Sensitivity (LFS) indicator, concentrating noise on more vulnerable layers to enlarge the certifiable region. We then leverage a private diffusion classifier to induce the generator to produce misclassified watermark signals, while a perceptual consistency regularizer maintains generation quality, evading watermark auditing from both input and output spaces. To make robust optimization computationally tractable for diffusion models, we further adopt an exponential growth schedule that progressively increases the number of noise samples for gradient averaging during training, significantly reducing the computational overhead of robust optimization. In the second stage, we introduce two statistics, i.e., Watermark Robustness (WR) and Reference Probability (RP), to measure the probability of predicting the target class prompt for a suspected watermarked generator and an unwatermarked reference generator under layer-adaptive smoothing, respectively. In particular, we prove a lower bound on their gap when parameter perturbations on the suspected model remain within the certifiable range. As such, by employing a paired-sample
2. Related Work 2.1. Copyright Protection in Deep Learning Copyright protection of deep learning systems mainly proceeds along two complementary lines: data(set) ownership verification (DOV) and model ownership verification (MOV), depending on the protected asset. DOV (Shao et al., 2025c; Li et al., 2025b) embeds verification signals into the protected data and tests whether a suspect model has been developed based on it. Although DOV can in principle be repurposed for MOV by checking whether a suspect model has been trained on this private dataset, the defender can only watermark the dataset itself and has no control over the training pipeline, making DOV insufficient for reliable model ownership verification against informed adversaries with stronger knowledge of the training pipeline. We therefore focus on MOV, where the defender directly controls the watermark embedding inside the protected model and can thus enforce stronger robustness guarantees. Existing MOV approaches mainly fall into two categories: model fingerprinting (Gloaguen et al., 2025; Pasquini et al., 2025) and model watermarking (Shao et al., 2025b; Yang et al., 2025), depending on whether predefined secret inputs are needed (see Appendix B). Fingerprinting methods typically embed verification signals outside the model backbone, but they often become less effective under sophisticated stealing scenarios (Gan et al., 2023; Li et al., 2025c; Wang et al., 2025d). Therefore, we primarily focus on model watermarking, which trains the owner model to produce verifiable outputs on specific inputs. In recent years, model watermarking has expanded from image classification (Liu et al., 2023a) to a range of tasks (Yang et al., 2024b; Wang et al., 2025b). With the rapid rise of generative models,
2
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
Sin (p)
Sout (p)
WatermarkDM SleeperMark
96.42 95.81
93.30 2.45
dN
Method
0.006 0
-0.006 -0.0006 0
dA
text-to-image (T2I) diffusion models have also attracted growing attention. In this context, backdoor-based watermarking with synthetic triggers (Zhao et al., 2023; Wang et al., 2025d; Gao et al., 2026) (i.e., rare tokens and atypical patterns) has gradually become the dominant method. However, synthetic triggers are more prone to detection and removal due to their semantic atypicality (Liang et al., 2024a;b), and existing methods lack certified robustness guarantees against adaptive attacks (Wang et al., 2023; Zhu et al., 2024; Wang et al., 2025a). Therefore, it is necessary to develop watermarking approaches that achieve both stealthiness and certified robustness.
1.0 0.8 0.6 0.4 0.2 0.0006 0.0
0.009
dN
Table 1. Prompt and image space suspicious scores (%) for representative backdoor-based watermarking methods.
0
-0.009 -0.0003 0
dA
1.0 0.8 0.6 0.4 0.2 0.0003 0.0
(a) WatermarkDM (b) SleeperMark Figure 1. TPR@FPR = 10−6 of watermarked models under parameter perturbations. dN and dA denote the random noise and adversarial directions, respectively, and ‘•’ marks the original watermarked model.
fusion watermarking methods remain effective under these conditions. Before presenting our experiments and results, we briefly review the general workflow of such methods. Main Pipeline of (Backdoor-Based) Diffusion MOV Methods. Consider a diffusion generator G(·; θ) inducing conditional distributions Pθ (·|p) over X = [0, 1]C×H×W given prompts p ∈ P. In the model watermarking phase, the owner defines a private trigger κ with associated trigger map Tκ : P → P (e.g., prepending a secret token), and produces a watermarked generator G(·; θ w ) such that benign behavior is preserved while triggered sampling Pθw (·|Tκ (p)) yields images containing a verifiable artifact. The owner also specifies a verification functional Ψκ : X N → {0, 1} that determines whether N i.i.d. triggered samples exhibit the artifact (e.g., via target-image similarity or bit-string decoding). In the ownership verification phase, given a suspicious generator G(·; θ ′ ), the owner queries it with triggered prompts p̃i = Tκ (pi ) to obtain xi ∼ Pθ′ (·|p̃i ), and claims ownership if Ψκ (x1 , . . . , xN ) = 1.
2.2. Certified Robustness Certified robustness (Voracek & Hein, 2023; Lyu et al., 2024; Qiao et al., 2026a) guarantees that a model’s output remains unchanged under any perturbation within a provable certified region. Randomized smoothing (Cohen et al., 2019; Salman et al., 2019; Qiao et al., 2026b) is a widely used approach to achieve this, injecting random noise and aggregating predictions via majority vote to produce smoothed outputs. This idea has been extended from input space to parameter space (Bansal et al., 2022; Jiang et al., 2023; Ren et al., 2023), enabling certified watermark robustness in MOV: as long as parameter perturbations remain within a certified region, the watermark exhibits provable non-removability. However, these methods are designed for small-scale classifiers with low-dimensional decision boundaries, whereas T2I diffusion models learn score estimates over high-dimensional continuous distributions (Song & Ermon, 2019; Song et al., 2021; Li et al., 2025a), making both fidelity preservation and certified training significantly more challenging. Consequently, certified MOV techniques for conventional classifiers cannot be directly transferred to T2I diffusion models, leaving certified watermarking for T2I diffusion models unexplored.
3.1. Limitations of Trigger Stealthiness under Auditing Settings. We hereby exploit two representative backdoorbased diffusion watermarking methods (i.e., WatermarkDM (Zhao et al., 2023) and SleeperMark (Wang et al., 2025d)) to evaluate the detectability of their synthetic triggers when an adversary audits both prompts and generated images. For prompt-space auditing, we measure wordlevel contextual incongruity. Given a prompt p = {wi }ni=1 , we use GPT-2 medium (Radford et al., 2019) to compute for each word the conditional surprisal mi (p) under the original left context and a baseline surprisal qi (p) under an unconditional prior. The prompt suspiciousness score mi (p) is then Sin (p) ≜ σ maxi qi (p) , where σ(·) is the logis-
3. Revisiting T2I Backdoor Watermarking Existing backdoor-based diffusion watermarking methods often (implicitly) assume a “faithful” verification process, in which watermark responses from a queried model are stable enough for reliable verification. However, in real-world settings, the adversary may first conduct watermark auditing to expose embedded patterns and then apply intentional or unintentional perturbations that can corrupt the watermark signal and significantly degrade verification reliability. In this section, we examine whether current backdoor-based dif-
tic sigmoid. When Sin (p) suggests trigger presence, we conduct image-space auditing: we generate images from both the original prompt p+ = p and a de-triggered variant p− , then compare their within-prompt similarity M(p) (average pairwise MSE). The image suspiciousness score is + )−M(p− )| Sout (p) ≜ |M(pM(p . For both metrics, higher scores −) indicate greater likelihood of trigger presence. 3
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
Results. As shown in Tab. 1, both methods are detectable but differ in detection space. Specifically, WatermarkDM is detectable in both spaces, with Sin (p) and Sout (p) both exceeding 93%. In contrast, SleeperMark evades imagespace detection Sout (p) = 2.45% due to semantic diversity preservation, but remains highly detectable in prompt space Sin (p) > 95%. These results reveal an inherent limitation of backdoor-based watermarking: synthetic triggers compromise stealthiness and can be identified through auditing.
4.1. Threat Model Following the classical model ownership verification (MOV) setting (Yang et al., 2024b; Shao et al., 2025b; Li et al., 2025c), we consider a model owner (i.e., defender), an adversary, and a trusted verification authority. The model owner embeds a watermark into a text-to-image (T2I) diffusion model before release. After release, users may apply the model to downstream tasks, while adversaries may steal it for unauthorized exploitation and ownership claims (Liang et al., 2022; Guo et al., 2023). Once an infringement is suspected, the verification authority obtains a copy of the suspect model (e.g., its weights) and performs verification using private information held only by the owner; ownership violation is confirmed if the watermark is detected. Unlike prior work that implicitly assumes adversaries only perform benign personalization fine-tuning, we further consider stronger adversaries who may adaptively remove watermarks via post-release parameter modifications, reflecting more realistic adversarial scenarios. An extended discussion is provided in Appendix H.
3.2. Limitations of Watermark Robustness under Adversarial Parameter Perturbations Settings. To examine watermark robustness under perturbations, we visualize TPR@FPR = 10−6 in a twodimensional parameter subspace. Following previous works (Zhao et al., 2023; Wang et al., 2025d), the verification functionals are method-specific: for WatermarkDM, Ψκ accepts ownership when the SSIM (Wang et al., 2004) between generated samples and a predefined reference image exceeds a threshold; for SleeperMark, Ψκ accepts when the bit-decoding accuracy from a pretrained message decoder exceeds a threshold. All thresholds are calibrated via hypothesis testing on unwatermarked models to control FPR at 10−6 . We define the perturbed parameters as θ ′ (ϵN , ϵA ) = θ w + ϵN dN + ϵA dA , where dN is a random sign vector and dA is the worst-case adversarial direction that maximally degrades verification. These perturbed parameters correspond to the perturbed generator G(·; θ ′ (ϵN , ϵA )). We report TPR@FPR = 10−6 across the (ϵN , ϵA ) grid to illustrate how verification degrades under random versus adversarial perturbations.
4.2. Preliminaries In this section, we introduce the theoretical foundations of layer-adaptive noise design. We begin by introducing a metric to quantify layerwise parameter dynamics during finetuning, which enables us to formalize layer-adaptive noise. To ensure fair comparison with layer-uniform baselines, we further establish a budget-matching criterion. Definition 4.1 (Average L2 Norm). For a diffusion model l dl with L layers of dimensions {dl }L l=1 , let θ ∈ R represent the parameters of layer l. The average L2 norm measures the magnitude of parameter change for layer l between step
Results. As shown in Fig. 1, both random and adversarial perturbations degrade watermark verification, although adversarial perturbations are far more effective. For SleeperMark, a random perturbation requires a magnitude of 0.009 to cause a noticeable drop, whereas an adversarial perturbation of only 0.0003 already induces significant degradation. This indicates that while parameter perturbations in general can compromise T2I diffusion watermarks, adversarial perturbations even pose a substantially stronger threat.
θ l (t2 )−θ l (t1 )
2 √ t1 and step t2 : δ̄ l (t1 , t2 ) ≜ , where θ l (t) dl denotes the parameter vector of layer l at step t and ∥·∥2 represents the L2 norm.
Next, we formalize layer-adaptive noise as follows. Definition 4.2 (Layer-adaptive Noise). For a scaling factor k, let ϵk = (ϵ1k , . . . , ϵL k ) ∼ Ek denote a noise sample with ϵlk ∈ Rdl . We call Ek a layer-adaptive noise distribution if ϵk is non-uniform with respect to the layer-block decomposition, i.e., there exist layers l ̸= j such that the marginal distributions of ϵlk and ϵjk have different scales under the Euclidean norm. Remark 4.3 (Multivariate Gaussian Specialization). In this paper, we instantiate Definition 4.2 with a multivariate Gaussian distribution, since it is analytically tractable for certification and often serves as a common approximation to aggregated stochastic effects. Let σ k = (kσ1 , . . . , kσL ) denote the scaled layer-wise noise levels. We take ϵk ∼ N (0, Σk ) with block diagonal covariance 2 2 Σk = diag σk,1 Id1 , . . . , σk,L IdL , where σk,l = kσl .
4. The Proposed Method As demonstrated in Section 3, existing backdoor-based diffusion watermarking methods are fragile under both watermark auditing and parameter perturbations. To address these issues, we propose Cert-LAS, the first certified, triggerfree MOV method for T2I diffusion models based on layeradaptive smoothing. Before presenting the method details, we first introduce the threat model and preliminaries.
4
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
Figure 2. The main pipeline of Cert-LAS consists of two stages. In the first stage, we conduct a short fine-tuning on the pretrained model Gθ0 to derive the Layer Fine-tuning Sensitivity LFS(l), which adaptive assigns layer-wise noise levels {σ1 , . . . , σL } under a global noise budget σu , allocating larger noise to fragile layers. Guided by this allocation, we sample layer-adaptive noise ϵ and inject it into the generator, and leverage a frozen model as a private diffusion classifier, training the generator to induce misclassification toward a target posterior q ∗ while preserving fidelity. In the second stage, we reuse the layer-adaptive noise levels to compute the Watermark Robustness (WR) of a suspicious model and the Reference Probability (RP) of an unwatermarked reference; the suspicious model is verified as derived from the protected one if WR significantly exceeds RP, equivalently when WR surpasses the closed-form threshold in Eq. (5).
To enable fair comparison with layer-uniform baselines, we define a budget equivalence condition matching the total noise budget across allocation strategies.
Robustness (WR) of the suspicious generator and the Reference Probability (RP) of an unwatermarked reference, then perform ownership verification via a paired-sample statistical test. The suspicious model is verified as watermarked if WR is significantly larger than RP at a certain significance level. The technical details are as follows.
Definition 4.4 (Budget Equivalence Condition). Let σ = (σ1 , . . . , σL ) specify a layer-adaptive noise as in Definition 4.2, and let σu denote the noise level of a layer-uniform noise. We say the two noises are budget-matched if they induce equivalent Mahalanobis P distances for all parameter L dl σl2 2 changes, which requires: σu = Pl=1 . L d l=1
4.4. Watermark Embedding of Cert-LAS In this stage, we present the watermark embedding procedure. Since the UNet architecture exhibits layer-dependent sensitivity to fine-tuning, we derive a layer-adaptive noise allocation that concentrates noise on vulnerable layers, thereby enlarging the certified radius. To embed watermarks under such smoothing without triggers, we leverage diffusion models as private classifiers, enabling trigger-free verification while remaining stealthy against auditing. Optimizing this objective under layer-adaptive smoothing would naively require averaging gradients over many noise samples. We therefore adopt an exponential growth schedule that gradually increases the gradient averaging frequency, substantially reducing computational overhead.
l
Intuitively, Definition 4.4 ensures that layer-uniform and layer-adaptive schemes use equivalent total noise budget, so any performance difference can be attributed solely to the noise allocation strategy. 4.3. Overview of the Proposed Method In general, our Cert-LAS consists of two main stages, as illustrated in Fig. 2: (1) watermark embedding and (2) ownership verification. In the first stage, we embed a trigger-free watermark by training the diffusion generator under layer-adaptive smoothing, where noise is allocated across layers according to a Layer Fine-tuning Sensitivity (LFS) indicator. To handle the computational burden of robust optimization, we employ an exponential growth schedule that progressively increases the number of noise samples. In the second stage, we estimate the Watermark
Layer-Adaptive Noise. To address the architectural differences between discriminative classifiers and generative diffusion models, we study how different UNet layers respond to downstream fine-tuning (see Appendix C). We observe that the relative magnitudes of layerwise updates 5
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
remain consistent across diverse datasets, which may stem from UNet’s characteristic compress-then-generate architecture. Based on this observation, we introduce a layerwise sensitivity indicator to guide noise allocation.
As formalized in Definition 4.7, a diffusion model induces a well-defined posterior pϕ (y | x) via its energy function, which we leverage for watermark embedding. Specifically, given a frozen private diffusion classifier parameterized by ϕ and a binary prompt set Y = {y, y ′ }, we train the generator G(·; θ) such that samples x ∼ Pθ (· | y) induce pϕ (· | x) matching a target distribution q ∗ . The watermark objective minimizes the Kullback–Leibler divergence:
Definition 4.5 (Layer Fine-tuning Sensitivity). The fine-tuning sensitivity of layer l is defined as the ratio of its update magnitude to the average update magnitude l ) , where δ̄ l (0, T ) across all layers: LFS(l) ≜ 1 Pδ̄L (0,T δ̄ j (0,T ) L
j=1
LKL (θ) = Ex∼Pθ (·|y) [DKL (q ∗ ∥ pϕ (· | x))] .
denotes the average L2 norm of parameter changes in layer l from initialization to step T .
Since optimizing LKL alone may alter the generation distribution and degrade generation quality, we further regularize G(·; θ) against G(·; ϕ), reusing the frozen diffusion model as a reference generator. For each class prompt y ∈ Y, we draw xθ ∼ Pθ (· | y) and xϕ ∼ Pϕ (· | y), and minimize their MS-SSIM discrepancy, which measures luminance, contrast, and structure across multiple scales:
Intuitively, LFS(l) measures the normalized update magnitude of layer l under downstream fine-tuning. Under a fixed global noise budget, layers with LFS(l) > 1 receive a larger noise level and vice versa, leading to the following layer-adaptive allocation. Proposition 4.6 (Layer-Adaptive Noise Allocation). Consider a layer-adaptive Gaussian noise with noise levels proportional to fine-tuning sensitivity, i.e., σl ∝ LFS(l). Under the global noise budget σu , the allocation
Lssim (θ) = Ey∼Y Exθ ,xϕ [1 − MS-SSIM(xθ , xϕ )] . (3) With the perceptual regularization, the training objective at step t is: θ ∗t ∈ arg minθ LKL (θ) + Lssim (θ).
v PL u u j=1 dj t σl = σu · LFS(l) · PL 2 j=1 dj LFS(j)
Exponential Growth Schedule. However, layer-adaptive smoothing requires averaging gradients over many noise samples at each update, making it computationally expensive. Fortunately, pretrained T2I diffusion models exhibit strong generative priors whose subspace lies in flat loss basins (Karras et al., 2024; Ma et al., 2025; Mao et al., 2025), meaning that noise samples produce nearly identical gradients in the early training phase. Intensive smoothing therefore offers little benefit until the model begins to induce classifier misclassification. Accordingly, we adopt an exponential schedule that starts with minimal smoothing and progressively increases both the number of noise samples mt and the regularization strength ωt : mt = min mmax , ⌊2t/Tg ⌋ , ωt = ω0 · 2t/Tg , where ω0 is the initial regularization weight and Tg controls the doubling period.
is non-uniform whenever LFS(l) varies across layers, and satisfies the equivalence condition in Definition 4.4. In particular, this allocation assigns a higher noise level to vulnerable layers than layer-uniform smoothing while keeping the total noise budget unchanged. Trigger-Free Watermark. Inspired by recent findings that diffusion models can function as generative classifiers (Li et al., 2023; Chen et al., 2024; Clark & Jaini, 2023), we propose to embed watermarks by training the generator to induce misclassification under a private diffusion classifier, enabling implicit watermark verification without triggers (i.e., using only class prompts). Since modifying the generation distribution may degrade generation fidelity, we further encourage the watermarked generator to retain perceptual fidelity to the original. To formalize this mechanism, we first define the diffusion classifier as an energy-based model.
4.5. Ownership Verification of Cert-LAS In this stage, inspired by certified dataset ownership verification (Qiao et al., 2025; 2026a), we introduce two statistics under layer-adaptive smoothing: Watermark Robustness (WR) and Reference Probability (RP). Specifically, WR measures the empirical probability that images generated by the suspected model are classified as the target class prompt by the diffusion classifier, while RP measures the same probability for an unwatermarked reference generator serving as a baseline. Since the embedded watermark persists under parameter perturbations, a watermarked generator will exhibit WR significantly higher than RP. To formalize this comparison, we employ a paired-sample t-test (Student, 1908) and derive a closed-form threshold on WR. Ownership of the
Definition 4.7 (Diffusion Classifier as Energy-Based Model). Let x ∈ X be an input image and y ∈ Y a class label. A diffusion model parameterized by θ with noisehpredictor εθ induces i an energy function Eθ (x, y) ≜ 2
Et,η ∥η − εθ (xt , y)∥2 , where xt denotes the noise perturbed input at diffusion timestep t. The corresponding Gibbs posterior is given by exp(−Eθ (x, y)) . ŷ∈Y exp(−Eθ (x, ŷ))
pθ (y | x) = P
(2)
(1) 6
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
suspected model is then verified whenever WR exceeds this threshold. The proof is deferred to Appendix A.
where Φ is the standard Gaussian CDF, α is the significance √ 2M N ζ+t2α + Γ is the verification threshold level and τα,ζ = 2
Computing WR and RP under Layer-Adaptive Smoothing. Given a target prompt ỹ ∈ Y, let qϕ (x) ≜ arg maxc∈Y pϕ (c | x) denote the class prediction of the diffusion classifier. For a suspected generator G(·; θ sus ) and an unwatermarked reference generator G(·; θ ref ), we gener(j) ate samples x (i) ∼ Pθ+ϵ(i) (· | ỹ) under layer-adaptive
in Theorem 4.8.
θ+ϵk
2 M N +tα
In general, Theorem 4.8 first establishes a closed-form verification threshold τα,ζ , which then serves as the decision boundary in Theorem 4.9 to derive the certified radius R∗ . Since a higher WR relaxes the constraint in Eq. (6), stronger watermark embedding directly yields a larger certified radius R∗ , implying that stronger watermark robustness leads to greater tolerance against parameter perturbations.
k
noise ϵk . We define the WR of Gθsus and the RP of Gθref as: N M 1 X 1 X (j) WR(Gθsus , Ek ) ≜ I qϕ x = ỹ , (i) θ sus +ϵk N j=1 M i=1 RP(Gθref , Ek ) ≜
N M 1 X 1 X (j) I qϕ x = ỹ , (i) θ ref +ϵk N j=1 M i=1
5. Experiments 5.1. Experiment Setup
(4) where I{·} denotes the indicator function. In practice, both (i) i.i.d. quantities are estimated with M i.i.d. draws ϵk ∼ Ek over N verification samples. After obtaining WR and RP, model ownership is then verified through the paired-sample t-test.
Diffusion Models. Following prior work (Fernandez et al., 2023; Zhao et al., 2023; Wang et al., 2025d), we implement Cert-LAS on Stable Diffusion v1.4 (SD v1.4) (Rombach et al., 2022), the standard benchmark in diffusion watermarking research, to enable fair and direct comparison with existing methods. Our method employs two instances: one serves as the protected generative model that embeds the watermark, while the other remains frozen and serves as both the private diffusion classifier and the reference generator.
4.6. Theoretical Analysis of Cert-LAS In this section, we establish the theoretical analysis of ownership verification of Cert-LAS proposed in Section 4.5. The detailed proof is provided in Appendix A.
Watermark Removal Attacks. We evaluate the robustness of Cert-LAS against both unintentional and intentional removal attacks. For unintentional removal, we consider standard fine-tuning on diverse datasets as well as advanced finetuning methods including LoRA (Hu et al., 2022), DreamBooth (Ruiz et al., 2023), and Custom Diffusion (Kumari et al., 2023). For intentional removal, we consider adaptive attacks including ℓ2 -bounded PGD attacks in parameter space and parameter perturbations along both adversarial and random directions. Details are provided in Appendix D.
Theorem 4.8 (Closed-Form Threshold for Ownership Verification). Consider testing the null hypothesis H0 : WR = RP against the alternative H1 : WR > RP. Given an upper bound RP ≤ ζ, at significance level α, the suspicious model G(·; θ sus ) is verified as watermarked whenever √ 2M N ζ + t2α + Γ , WR > 2 M N + t2α where Γ =
2M N ζ + t2α
2
− 4 M N + t2α
(5)
M N ζ2 −
Evaluation Metrics. We evaluate Cert-LAS on model fidelity and watermark effectiveness. For fidelity, following prior works (Song et al., 2024; Kang et al., 2024), we report FID (Parmar et al., 2022), CLIP score (Radford et al., 2021), and DreamSim (Fu et al., 2023) on 50,000 images generated from COCO2014 (Lin et al., 2014) validation captions, where DreamSim compares images generated from the watermarked and pretrained models. For watermark effectiveness, we adopt metrics tailored to two method paradigms. For empirical methods, we report the confidence-based T@10−6 F for fair comparison with empirical baselines, together with suspiciousness scores Sin (p) and Sout (p) under watermark auditing to assess stealthiness. For certified methods, we report the label-based verification success rate (VSR) and the certified radius R̄, which quantify certified verifiability and provable robustness. Further details are provided in Appendix D.
t2α ζ + t2α ζ 2 , and tα denotes the (1 − α)-quantile of the
t-distribution with (N − 1) degrees of freedom. Theorem 4.9 (Certified Radius under Layer-Adaptive Gaussian Smoothing). Consider Gaussian smoothing noise Ek = N (0, Σk ) and the normalized radius R̄ as in Definition A.2. For probability thresholds h P a ≤n s1 ≤ · · · ≤ sm o≤ b, let i (i) N 1 Psj (θ) ≤ Pϵk ∼Ek N i=1 I qϕ xθ+ϵk = ỹ ≥ sj . For any perturbation δ ∈ Bσk (θ; Rk ), diffusion model ownership verification with layer-adaptive noise is guaranteed if R̄ ≤ R∗ , which is obtained by solving R̄ −1 a + (s1 − a) Φ Φ (Ps1 (θ)) − k m X R̄ + (sj − sj−1 ) Φ Φ−1 Psj (θ) − > τα,ζ , k j=2
(6)
7
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing Table 2. Performance comparison between Cert-LAS and baseline methods. Cert-LAS (w/o smooth) and Cert-LAS (w/ smooth) denote our method without and with inference-time layer-adaptive smoothing, respectively. Top results within each category are in bold. Model Fidelity
Watermark Effectiveness
Category
Method
FID ↓ CLIP ↑ DreamSim ↓ T@10−6 F ↑ Sin (p) ↓ Sout (p) ↓
Baseline
None
25.23
31.22
N/A
N/A
N/A
N/A
Empirical Methods
WatermarkDM 26.27 SleeperMark 25.85 Cert-LAS (w/o smooth) 25.91
30.86 31.21 31.13
0.164 0.120 0.111
0.879 0.998 1.000
0.964 0.958 0.125
0.933 0.025 0.016
Certified Methods
σk
Method
FID ↓ CLIP ↑ DreamSim ↓ T@10−6 F ↑
VSR ↑
R̄ ↑
σ 1.0
Vanilla Cert-LAS (w/ smooth)
27.48 25.91
31.05 31.13
0.123 0.111
0.944 1.000
0.812 1.000
0.81 1.48
σ 1.2
Vanilla Cert-LAS (w/ smooth)
26.33 26.54
31.13 31.10
0.101 0.122
0.718 1.000
0.647 0.938
0.45 1.68
σ 1.4
Vanilla Cert-LAS (w/ smooth)
25.82 26.96
31.14 31.08
0.087 0.125
0.281 1.000
0.385 0.847
0.00 1.428
Table 3. T@10−6 F of different watermarking methods after fine-tuning watermarked SD v1.4 via LoRA. LoRA Rank
20
80
320
640
Fine-tuning Steps
20
200
2000
20
200
2000
20
200
2000
20
200
2000
WatermarkDM SleeperMark Cert-LAS (w/o smooth) Cert-LAS (w/ smooth)
0.893 0.998 1.000 1.000
0.687 0.998 1.000 1.000
0.000 0.996 1.000 1.000
0.885 0.998 1.000 1.000
0.714 0.997 1.000 1.000
0.000 0.993 1.000 1.000
0.865 0.998 1.000 1.000
0.588 0.997 1.000 1.000
0.000 0.990 1.000 1.000
0.830 0.998 1.000 1.000
0.451 0.996 1.000 1.000
0.000 0.988 0.996 1.000
1.000 and stealthiness scores below 0.125, less than 15% of WatermarkDM. Meanwhile, it maintains competitive fidelity with the smallest DreamSim of 0.111, and images generated under class prompts are perceptually indistinguishable from the source model as shown in Fig. 3. For certified methods, Cert-LAS consistently outperforms Vanilla across all noise levels. As σk increases, Cert-LAS exhibits mildly degraded fidelity but maintains strong verification, achieving VSR of 0.847 at k = 1.4. In contrast, Vanilla exhibits an opposite trend where fidelity improves as verification collapses, indicating it fails to learn the watermark under layer-uniform noise. These results confirm that our method demonstrates strong effectiveness while preserving fidelity.
Figure 3. Qualitative comparison between images generated by Cert-LAS and the source model under class prompts.
Baselines. We compare Cert-LAS with two categories of baselines. For empirical methods, we consider WatermarkDM (Zhao et al., 2023) and SleeperMark (Wang et al., 2025d), evaluated without inference-time smoothing; their original metrics are converted into T@10−6 F (see Appendix D). For certified methods, we compare against a vanilla layer-uniform smoothing baseline that applies smoothing during verification, with certified radius computed analytically as (Cohen et al., 2019; Jiang et al., 2023).
5.3. Resistance to Watermark Removal Attacks We hereby evaluate the robustness of Cert-LAS against both unintentional and intentional removal attempts. Unintentional Attack. As shown in Tab. 4-6, Cert-LAS demonstrates exceptional robustness against benign downstream fine-tuning across all scenarios. Even under the most challenging regime of standard fine-tuning with fullparameter updates for 2000 steps, Cert-LAS maintains T@10−6 F above 0.991, whereas WatermarkDM fails entirely after merely 400 steps on CelebA-HQ. Notably, CertLAS still maintains T@10−6 F above 0.987 without smoothing, indicating that our robust training inherently introduces resilience into the watermarks, and inference-time smoothing further strengthens it through majority voting. Moreover, our watermark embedding does not impair downstream adaptation capability (see Fig. 10 in Appendix J).
Implementation Details. In this paper, we use cat and dog as the class prompts for diffusion classification following (Li et al., 2023; Chen et al., 2024). The uniform noise level is set to σu = 0.01, with σ 1 calibrated to match the same noise budget. Further details are provided in Appendix D. 5.2. Main Results As shown in Tab. 2, for watermarked methods, Cert-LAS achieves the best watermark effectiveness with T@10−6 F of 8
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing Table 4. T@10−6 F of different watermarking methods after finetuning watermarked SD v1.4 on (a) Cartoon, (b) CelebA-HQ, (c) Landscape, and (d) ArtBench datasets.
Table 5. T@10−6 F of different watermarking methods after finetuning watermarked SD v1.4 via DreamBooth.
(a) Cartoon Fine-tuning Steps
400
800
1200
1600
2000
WatermarkDM SleeperMark Cert-LAS (w/o smooth) Cert-LAS (w/ smooth)
0.716 0.998 1.000 1.000
0.432 0.998 1.000 1.000
0.179 0.998 0.999 1.000
0.000 0.997 0.997 0.999
0.000 0.993 0.992 0.996
0.000 0.995 1.000 1.000
0.000 0.989 1.000 1.000
0.000 0.984 0.998 1.000
0.344 0.998 1.000 1.000
0.155 0.997 1.000 1.000
0.000 0.995 1.000 1.000
0.000 0.997 1.000 1.000
0.000 0.990 0.995 0.998
0.000 0.988 0.987 0.991
0.137 0.998 1.000 1.000
0.000 0.996 1.000 1.000
(c) Landscape WatermarkDM SleeperMark Cert-LAS (w/o smooth) Cert-LAS (w/ smooth)
0.667 0.998 1.000 1.000
0.589 0.998 1.000 1.000
0.94
0
0.87 0.80 -0.01
0
dA
0.01 0.74
(a) Cert-LAS (w/ smooth)
1.00
0.01
dN
dN
0.031 0.997 1.000 1.000
1.00
0.01
-0.01
0.105 0.998 1.000 1.000
600
800
1000
0.702 0.997 1.000 1.000
0.255 0.993 1.000 1.000
0.328 0.987 1.000 1.000
0.209 0.988 0.999 1.000
Fine-tuning Steps
100
200
300
400
500
WatermarkDM SleeperMark Cert-LAS (w/o smooth) Cert-LAS (w/ smooth)
0.719 0.998 1.000 1.000
0.510 0.998 1.000 1.000
0.252 0.995 1.000 1.000
0.058 0.992 1.000 1.000
0.000 0.991 1.000 1.000
L2 Norm Budget
0.2
0.4
0.6
0.8
WatermarkDM SleeperMark Cert-LAS (w/o smooth) Cert-LAS (w/ smooth)
0.781 0.999 0.000 1.000
0.000 0.861 0.000 1.000
0.000 0.060 0.000 0.984
0.000 0.000 0.000 0.965
0.75
0
-0.01
400
0.823 0.998 1.000 1.000
Table 7. T@10−6 F of different watermarking methods under ℓ2 bounded parameter perturbation on watermarked SD v1.4.
(d) ArtBench WatermarkDM SleeperMark Cert-LAS (w/o smooth) Cert-LAS (w/ smooth)
200
WatermarkDM SleeperMark Cert-LAS (w/o smooth) Cert-LAS (w/ smooth)
Table 6. T@10−6 F of different watermarking methods after finetuning watermarked SD v1.4 via Custom Diffusion.
(b) CelebA-HQ WatermarkDM SleeperMark Cert-LAS (w/o smooth) Cert-LAS (w/ smooth)
Fine-tuning Steps
0.50
indicating that the watermark cannot be reproduced by any other classifier. Detailed results are provided in Appendix F.
0.25 -0.01
0
dA
0.01 0.00
Generalization Analysis. We further examine the generality of Cert-LAS along two axes: model architecture and classification task. For the former, the layerwise update consistency underlying LFS holds across mainstream architectures; for the latter, the broad task level generality, combined with the classifier specificity above, enables noninterference among multiple owners (Appendix I). Detailed results are provided in Appendix G.1.
(b) Cert-LAS (w/o smooth)
Figure 4. T@10−6 F of watermarked models under parameter perturbations. dN and dA denote the random noise and adversarial directions, respectively, and ‘•’ marks the original model.
Intentional Attack. As shown in Fig. 4 and Tab. 7, baseline methods and Cert-LAS without smoothing exhibit rapid degradation under parameter perturbations. In contrast, CertLAS with smoothing eliminates the tenfold asymmetry between random and adversarial perturbations observed in Section 3.2, maintaining T@10−6 F above 0.965 even at L2 norm budget 0.8 where all baselines fail entirely, demonstrating the robustness against intentional attacks.
6. Conclusion In this paper, we revealed the vulnerabilities of existing model ownership verification (MOV) methods for text-toimage diffusion models under watermark auditing and parameter perturbations. To address these issues, we proposed Cert-LAS, the first certified watermarking method based on layer-adaptive smoothing. Cert-LAS leverages diffusion classifiers for trigger-free embedding to evade auditing, and introduces Layer Fine-tuning Sensitivity (LFS) guided noise allocation to enlarge the certifiable region. Our theoretical analysis establishes a tight lower bound between Watermark Robustness (WR) and Reference Probability (RP) under bounded parameter perturbations, enabling certified verification via paired-sample t-test. Extensive experiments validate that Cert-LAS maintains high fidelity while achieving superior robustness, paving the way for trustworthy sharing of diffusion models with certified guarantees.
5.4. Ablation Study and Generalization Analysis Ablation Study. We conduct comprehensive ablation studies along two complementary dimensions: internal hyperparameters (e.g., ω0 and q ∗ ) and external verification components (e.g., the reference generator and private classifier). Notably, the Exponential Growth Schedule reduces training time by 76.6% without sacrificing performance, and the verification signal is uniquely bound to the watermarkingstage private classifier, where replacing it at verification time causes verification to fail across all tested architectures, 9
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
Acknowledgements
Chen, J., Liu, X., Liang, S., Jia, X., and Xun, Y. Universal watermark vaccine: Universal adversarial perturbations for watermark protection. In CVPR Workshops, 2023.
This research is supported by the National Research Foundation, Singapore, and Cyber Security Agency of Singapore under its National Cybersecurity R&D Programme and CyberSG R&D Cyber Research Programme Office. Any opinions, findings and conclusions or recommendations expressed in these materials are those of the author(s) and do not reflect the views of National Research Foundation, Singapore, Cyber Security Agency of Singapore as well as CyberSG R&D Programme Office, Singapore.
Clark, K. and Jaini, P. Text-to-image diffusion models are zero-shot classifiers. In NeurIPS, 2023. Cohen, J., Rosenfeld, E., and Kolter, Z. Certified adversarial robustness via randomized smoothing. In ICML, 2019. Dhariwal, P. and Nichol, A. Diffusion models beat GANs on image synthesis. In NeurIPS, 2021. Dubiński, J., Kowalczuk, A., Boenisch, F., and Dziedzic, A. CDI: Copyrighted data identification in diffusion models. In CVPR, 2025.
Impact Statement This paper focuses on protecting the intellectual property of text-to-image diffusion models through certified model ownership verification. We demonstrate that existing backdoorbased watermarking methods are fragile under watermark auditing and subsequent parameter perturbations, and propose Cert-LAS to enable reliable ownership verification even in the presence of bounded, malicious removal attacks. The method is purely defensive, intended solely for legitimate verification by authorized model owners in conjunction with trusted verification authorities when necessary, with strict protection of private verification artifacts. Given that training large-scale diffusion models demands substantial computational and data costs, robust ownership verification helps underpin enforceable licensing and accountability mechanisms, ensuring that creators receive appropriate recognition and compensation while discouraging unauthorized exploitation. Overall, by providing provable robustness guarantees against watermark removal, this work contributes positively to trustworthy intellectual property governance in the generative AI ecosystem and promotes the sustainable development of accountable generative systems.
Elson, J., Douceur, J. R., Howell, J., and Saul, J. Asirra: A CAPTCHA that exploits interest-aligned manual image categorization. In CCS, 2007. Feng, W., Zhou, W., He, J., Zhang, J., Wei, T., Li, G., Zhang, T., Zhang, W., and Yu, N. AquaLoRA: Toward whitebox protection for customized stable diffusion models via watermark LoRA. In ICML, 2024. Fernandez, P., Couairon, G., Jégou, H., Douze, M., and Furon, T. The stable signature: Rooting watermarks in latent diffusion models. In ICCV, 2023. Fu, S., Tamir, N., Sundaram, S., Chai, L., Zhang, R., Dekel, T., and Isola, P. DreamSim: Learning new dimensions of human visual similarity using synthetic data. In NeurIPS, 2023. Gan, G., Li, Y., Wu, D., and Xia, S.-T. Towards robust model watermark via reducing parametric vulnerability. In ICCV, 2023.
References
Gao, K., Zhu, Y., Li, Y., Bai, J., Yang, Y., Li, Z., and Xia, S.-T. Toward dataset copyright evasion attack against personalized text-to-image diffusion models. IEEE Transactions on Information Forensics and Security, 21:725–740, 2026.
Bansal, A., Chiang, P.-y., Curry, M. J., Jain, R., Wigington, C., Manjunatha, V., Dickerson, J. P., and Goldstein, T. Certified neural network watermarks with randomized smoothing. In ICML, 2022.
Gloaguen, T., Staab, R., Jovanović, N., and Vechev, M. Robust LLM fingerprinting via domain-specific watermarks. arXiv preprint arXiv:2505.16723, 2025.
Bao, Z., Li, Y., Singh, K. K., Wang, Y.-X., and Hebert, M. Separate-and-enhance: Compositional finetuning for text-to-image diffusion models. In SIGGRAPH, 2024.
Guo, J., Zheng, X., Liu, A., Liang, S., Xiao, Y., Wu, Y., and Liu, X. Isolation and induction: Training robust deep neural networks against model stealing attacks. In ACM MM, 2023.
Cervenka, E. Naruto BLIP captions. https: //huggingface.co/datasets/lambda/ naruto-blip-captions/, 2022. Accessed: 2026-01-28.
Guo, Z., Liang, S., Liu, A., and Tao, D. Copyrightshield: Spatial similarity guided backdoor defense against copyright infringement in diffusion models. arXiv preprint arXiv:2412.01528, 2024.
Chen, H., Dong, Y., Wang, Z., Yang, X., Duan, C., Su, H., and Zhu, J. Robust classification via a single diffusion model. In ICML, 2024. 10
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
Hu, E. J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. LoRA: Low-rank adaptation of large language models. In ICLR, 2022.
Li, Z., Zong, R., Liu, Y., Yao, R., Liu, Y., Zhang, Y., and Wang, D. Anti-tamper protection for unauthorized individual image generation. In ICCV, 2025d.
Huang, Y., Juefei-Xu, F., Guo, Q., Zhang, J., Wu, Y., Hu, M., Li, T., Pu, G., and Liu, Y. Personalization as a shortcut for few-shot backdoor attack against text-to-image diffusion models. In AAAI, 2024.
Liang, J., Liang, S., Liu, A., Jia, X., Kuang, J., and Cao, X. Poisoned forgery face: Towards backdoor attacks on face forgery detection. In ICLR, 2024a.
Huang, Z., Zhou, P., Yan, S., and Lin, L. ScaleLong: Towards more stable training of diffusion model via scaling network long skip connection. In NeurIPS, 2023.
Liang, J., Liang, S., Liu, A., and Cao, X. VL-Trojan: Multimodal instruction backdoor attacks against autoregressive visual language models. International Journal of Computer Vision, 133(7):3994–4013, 2025a.
Jiang, Z., Fang, M., and Gong, N. Z. IPCert: Provably robust intellectual property protection for machine learning. In ICCV, 2023.
Liang, S., Liu, A., Liang, J., Li, L., Bai, Y., and Cao, X. Imitated detectors: Stealing knowledge of black-box object detectors. In ACM MM, 2022.
Kang, M., Zhang, R., Barnes, C., Paris, S., Kwak, S., Park, J., Shechtman, E., Zhu, J.-Y., and Park, T. Distilling diffusion models into conditional GANs. In ECCV, 2024.
Liang, S., Liu, K., Gong, J., Liang, J., Xun, Y., Chang, E.-C., and Cao, X. Unlearning backdoor threats: Enhancing backdoor defense in multimodal contrastive learning via local token unlearning. arXiv preprint arXiv:2403.16257, 2024b.
Karras, T., Aila, T., Laine, S., and Lehtinen, J. Progressive growing of GANs for improved quality, stability, and variation. In ICLR, 2018.
Liang, S., Zhu, M., Liu, A., Wu, B., Cao, X., and Chang, E.-C. Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning. In CVPR, 2024c.
Karras, T., Aittala, M., Lehtinen, J., Hellsten, J., Aila, T., and Laine, S. Analyzing and improving the training dynamics of diffusion models. In CVPR, 2024.
Liang, S., Liang, J., Pang, T., Du, C., Liu, A., Zhu, M., Cao, X., and Tao, D. Revisiting backdoor attacks against large vision-language models from domain shift. In CVPR, 2025b.
Kumar, A., Levine, A., Feizi, S., and Goldstein, T. Certifying confidence via randomized smoothing. In NeurIPS, 2020. Kumari, N., Zhang, B., Zhang, R., Shechtman, E., and Zhu, J.-Y. Multi-concept customization of text-to-image diffusion. In CVPR, 2023.
Liao, P., Li, X., Liu, X., and Keutzer, K. The ArtBench dataset: Benchmarking generative models with artworks. arXiv preprint arXiv:2206.11404, 2022.
Lei, L., Gai, K., Yu, J., and Zhu, L. DiffuseTrace: A transparent and flexible watermarking scheme for latent diffusion model. arXiv preprint arXiv:2405.02696, 2024.
Lim, H., Won, Y., Seo, J., and Park, G.-M. ConceptSplit: Decoupled multi-concept personalization of diffusion models via token-wise adaptation and attention disentanglement. In ICCV, 2025.
Li, A. C., Prabhudesai, M., Duggal, S., Brown, E., and Pathak, D. Your diffusion model is secretly a zero-shot classifier. In ICCV, 2023.
Lin, T.-Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P., and Zitnick, C. L. Microsoft COCO: Common objects in context. In ECCV, 2014.
Li, B., Wei, Y., Fu, Y., Wang, Z., Li, Y., Zhang, J., Wang, R., and Zhang, T. Towards reliable verification of unauthorized data usage in personalized text-to-image diffusion models. In S&P, 2025a.
Liu, A., Liu, X., Zhang, X., Xiao, Y., Zhou, Y., Liang, S., Wang, J., Cao, X., and Tao, D. Pre-trained trojan attacks for visual recognition. International Journal of Computer Vision, 133(6):3568–3585, 2025.
Li, Y., Shao, S., He, Y., Guo, J., Zhang, T., Qin, Z., Chen, P.-Y., Backes, M., Torr, P., Tao, D., et al. Rethinking data protection in the (generative) artificial intelligence era. arXiv preprint arXiv:2507.03034, 2025b.
Liu, H., Weng, Z., Zhu, Y., and Mu, Y. Trapdoor normalization with irreversible ownership verification. In ICML, 2023a.
Li, Y., Zhu, L., Jia, X., Bai, Y., Jiang, Y., Xia, S.-T., Cao, X., and Ren, K. MOVE: Effective and harmless ownership verification via embedded external features. IEEE Transactions on Pattern Analysis and Machine Intelligence, 47 (6):4734–4751, 2025c.
Liu, Y., Li, Z., Backes, M., Shen, Y., and Zhang, Y. Watermarking diffusion model. arXiv preprint arXiv:2305.12502, 2023b. 11
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
Lyu, S., Shaikh, S., Shpilevskiy, F., Shelhamer, E., and Lécuyer, M. Adaptive randomized smoothing: Certified adversarial robustness for multi-step defences. In NeurIPS, 2024.
Qiao, T., Liu, X., Huang, W., Li, J., Fan, Z., and Li, Y. DSSmoothing: Toward certified dataset ownership verification for pre-trained language models via dual-space smoothing. In WWW, 2026a.
Lyu, X., Liu, Y., Li, Y., and Xiao, B. PLA: Prompt learning attack against text-to-image generative models. In ICCV, 2025.
Qiao, T., Wang, Y., Liu, X., Wu, S., Li, J., and Li, Y. Certssbd: Certified backdoor defense with sample-specific smoothing noises. IEEE Transactions on Information Forensics and Security, 21:2446–2461, 2026b.
Ma, Z., Jia, G., Qi, B., and Zhou, B. Safe-SD: Safe and traceable stable diffusion with text prompt trigger for invisible generative watermarking. In ACM MM, 2024.
Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., and Sutskever, I. Language models are unsupervised multitask learners. OpenAI Blog, 2019. URL https://openai. com/research/language-unsupervised.
Ma, Z., Liang, X., Wu, R., Zhu, X., Lei, Z., and Zhang, L. Progressive rendering distillation: Adapting stable diffusion for instant text-to-mesh generation without 3D data. In CVPR, 2025.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In ICML, 2021.
Mao, Y., Wang, B., Kulkarni, N., and Park, J. J. SIR-DIFF: Sparse image sets restoration with multi-view diffusion model. In CVPR, 2025.
Ren, J., Zhou, Y., Jin, J., Lyu, L., and Yan, D. Dimensionindependent certified neural network watermarks via mollifier smoothing. In ICML, 2023.
Neyman, J. and Pearson, E. S. On the problem of the most efficient tests of statistical hypotheses. Philosophical Transactions of the Royal Society of London. Series A, 231:289–337, 1933.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In CVPR, 2022.
Nichol, A. Q. and Dhariwal, P. Improved denoising diffusion probabilistic models. In ICML, 2021.
Ronneberger, O., Fischer, P., and Brox, T. U-Net: Convolutional networks for biomedical image segmentation. In MICCAI, 2015.
Norod78. cartoon-blip-captions. https: //huggingface.co/datasets/Norod78/ cartoon-blip-captions, 2022. Accessed: 2026-01-28.
Rougetet, A. Landscape pictures. https: //www.kaggle.com/datasets/arnaud58/ landscape-pictures, 2020. Accessed: 2026-0128.
Or, A., Jain, A., Vega-Myhre, D., Cai, J., Hernandez, C. D., Zheng, Z., Guessous, D., Kuznetsov, V., Puhrsch, C., Saroufim, M., Rao, S., Tran, T., and Samardzic, A. TorchAO: PyTorch-native training-to-serving model optimization. In CODEML@ICML, 2025.
Ruiz, N., Li, Y., Jampani, V., Pritch, Y., Rubinstein, M., and Aberman, K. DreamBooth: Fine tuning text-to-image diffusion models for subject-driven generation. In CVPR, 2023.
Parmar, G., Zhang, R., and Zhu, J.-Y. On aliased resizing and surprising subtleties in GAN evaluation. In CVPR, 2022.
Salman, H., Li, J., Razenshteyn, I., Zhang, P., Zhang, H., Bubeck, S., and Yang, G. Provably robust deep learning via adversarially trained smoothed classifiers. In NeurIPS, 2019.
Pasquini, D., Kornaropoulos, E. M., and Ateniese, G. LLMmap: Fingerprinting for large language models. In USENIX Security, 2025.
Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C., Wightman, R., Cherti, M., et al. LAION-5B: An open large-scale dataset for training next generation image-text models. In NeurIPS, 2022.
Podell, D., English, Z., Lacey, K., Blattmann, A., Dockhorn, T., Müller, J., Penna, J., and Rombach, R. SDXL: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952, 2023.
Shao, S., Li, Y., He, Y., Yao, H., Yang, W., Tao, D., and Qin, Z. Sok: Large language model copyright auditing via fingerprinting. arXiv preprint arXiv:2508.19843, 2025a.
Qiao, T., Li, Y., Li, J., Wang, Y., Qi, L., Guo, J., Feng, R., and Tao, D. CertDW: Towards certified dataset ownership verification via conformal prediction. arXiv preprint arXiv:2506.13160, 2025.
Shao, S., Li, Y., Yao, H., He, Y., Qin, Z., and Ren, K. Explanation as a watermark: Towards harmless and multibit model ownership verification via watermarking feature attribution. In NDSS, 2025b. 12
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
Shao, S., Li, Y., Zheng, M., Hu, Z., Chen, Y., Li, B., He, Y., Guo, J., Tao, D., and Qin, Z. Databench: Evaluating dataset auditing in deep learning from an adversarial perspective. arXiv preprint arXiv:2507.05622, 2025c.
Weber, M., Xu, X., Karlaš, B., Zhang, C., and Li, B. RAB: Provable robustness against backdoor attacks. In S&P, 2023. Wen, Y., Kirchenbauer, J., Geiping, J., and Goldstein, T. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030, 2023.
Shao, S., Li, Y., Yao, H., Chen, Y., Yang, Y., and Qin, Z. Reading between the lines: Towards reliable black-box llm fingerprinting via zeroth-order gradient estimation. In WWW, 2026.
Wu, Y., Zhang, J., Kerschbaum, F., and Zhang, T. THEMIS: Regulating textual inversion for personalized concept censorship. In NDSS, 2025.
Song, Y. and Ermon, S. Generative modeling by estimating gradients of the data distribution. In NeurIPS, 2019. Song, Y., Sohl-Dickstein, J., Kingma, D. P., Kumar, A., Ermon, S., and Poole, B. Score-based generative modeling through stochastic differential equations. In ICLR, 2021.
Xie, E., Li, W., Luo, W., Wang, Y., Ma, S., Yu, J., Gao, Y., Yu, G., and Sun, H. SANA: Efficient high-resolution image synthesis with linear diffusion transformers. arXiv preprint arXiv:2410.10629, 2024.
Song, Y., Zhang, Z., Lin, Z., Cohen, S., Price, B., Zhang, J., Kim, S. Y., Zhang, H., Xiong, W., and Aliaga, D. Imprint: Generative object compositing by learning identitypreserving representation. In CVPR, 2024.
Xiong, C., Qin, C., Feng, G., and Zhang, X. Flexible and secure watermarking for latent diffusion model. In ACM MM, 2023.
Student. The probable error of a mean. Biometrika, 6(1): 1–25, 1908.
Yang, S., Bai, J., Gao, K., Yang, Y., Li, Y., and Xia, S.-T. Not all prompts are secure: A switchable backdoor attack against pre-trained vision transfomers. In CVPR, 2024a.
Voracek, V. and Hein, M. Improving ℓ1 -certified robustness via randomized smoothing by leveraging box constraints. In ICML, 2023.
Yang, W., Sun, Y., Chen, C., Chu, Z., Zhang, J., Li, Y., and Tao, D. Swap: Towards copyright auditing of soft prompts via sequential watermarking. International Journal of Computer Vision, 2026.
Voynov, A., Chu, Q., Cohen-Or, D., and Aberman, K. p+: Extended textual conditioning in text-to-image generation. arXiv preprint arXiv:2303.09522, 2023.
Yang, Y., Li, Q., Hong, Y., and Wang, B. FedGMark: Certifiably robust watermarking for federated graph learning. In NeurIPS, 2024b.
Wang, J., Zhang, Z., Wang, M., Qiu, H., Zhang, T., Li, Q., Li, Z., Wei, T., and Zhang, C. Aegis: Mitigating targeted bit-flip attacks against deep neural networks. In USENIX Security, 2023.
Yang, Y., Xiao, S., Li, L., Dong, W., and Qu, J. Do you steal my model? signature diffusion embedded dualverification watermarking for protecting intellectual property of hyperspectral image classification models. In IJCAI, 2025.
Wang, J., Wu, Y., Xu, W., Huang, Y., Zhang, C., Li, Z., Xu, M., and Liang, Z. Your scale factors are my weapon: Targeted bit-flip attacks on vision transformers via scale factor manipulation. In CVPR, 2025a. Wang, L., Wang, M., Fu, H., and Zhang, D. Vision-language model IP protection via prompt-based learning. In CVPR, 2025b.
Yang, Z., Zeng, K., Chen, K., Fang, H., Zhang, W., and Yu, N. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In CVPR, 2024c.
Wang, Z., Bovik, A. C., Sheikh, H. R., and Simoncelli, E. P. Image quality assessment: From error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4):600–612, 2004.
Zhang, J., Huang, Q., Liu, J., Guo, X., and Huang, D. Diffusion-4K: Ultra-high-resolution image synthesis with latent diffusion models. In CVPR, 2025.
Wang, Z., Bao, J., Gu, S., Chen, D., Zhou, W., and Li, H. DesignDiffusion: High-quality text-to-design image generation with diffusion models. In CVPR, 2025c.
Zhao, Y., Pang, T., Du, C., Yang, X., Cheung, N.-M., and Lin, M. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137, 2023.
Wang, Z., Guo, J., Zhu, J., Li, Y., Huang, H., Chen, M., and Tu, Z. SleeperMark: Towards robust watermark against fine-tuning text-to-image diffusion models. In CVPR, 2025d.
Zheng, Y., Ren, Y., Xia, X., Xiao, X., and Xie, X. Dense2MoE: Restructuring diffusion transformer to MoE for efficient text-to-image generation. In ICCV, 2025. 13
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
A. Theoretical Proofs
Zhu, J., Wang, H., Su, M., Wang, Z., and Wang, H. OBSDiff: Accurate pruning for diffusion models in one-shot. In ICLR, 2026.
A.1. Proof of Theorem 4.8 Theorem A.1 (Closed-Form Threshold for Ownership Verification). Consider testing the null hypothesis H0 : WR = RP against the alternative H1 : WR > RP. Given an upper bound RP ≤ ζ, at significance level α, the suspicious model G(·; θ sus ) is verified as watermarked whenever
Zhu, L., Li, Y., Weng, H., Liu, Y., Zhang, T., Xia, S.-T., and Wang, Z. Holmes: Towards effective and harmless model ownership verification to personalized large vision models via decoupling common features. arXiv preprint arXiv:2507.00724, 2025.
√ 2M N ζ + t2α + Γ , WR > 2 M N + t2α
Zhu, M., Liang, S., and Wu, B. Breaking the false sense of security in backdoor defense through re-activation attack. In NeurIPS, 2024. where Γ =
2M N ζ + t2α
2
− 4 M N + t2α
(A.1)
M N ζ2 −
t2α ζ + t2α ζ 2 , and tα denotes the (1 − α)-quantile of the
t-distribution with (N − 1) degrees of freedom. Proof. Let qϕ (x) ≜ arg maxc∈Y pϕ (c | x) denote the (smoothed) diffusion classifier. For each verification sample j ∈ [N ] and noise draw i ∈ [M ], define (j) (j,i) Esus ≜ I qϕ x = ỹ , (i) θ sus +ϵk (A.2) (j,i) (j) Eref ≜ I qϕ x = ỹ . (i) θ ref +ϵk
For fixed (j, i), these are Bernoulli variables with means psus ≜ Pr[qϕ (xθsus +ϵk ) = ỹ] , pref ≜ Pr[qϕ (xθref +ϵk ) = ỹ] .
(A.3)
For each j, define the noise-averaged scores M X dj ≜ 1 E (j,i) , WR M i=1 sus
(A.4)
M
X (j,i) cj ≜ 1 RP E . M i=1 ref Therefore, N
WR =
1 Xd WRj , N j=1
N
RP =
1 Xc RPj . N j=1
(A.5)
d j − RP c j and D̄ ≜ Define paired differences Dj ≜ WR PN 1 j=1 Dj = WR − RP. The paired t-test uses N √
N D̄ ≈ t(N − 1), sD N 1 X s2D ≜ (Dj − D̄)2 . N − 1 j=1 T ≜
14
(A.6)
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
Expanding s2D gives s2D =
In regimes where M N (1 − ζ) > t2α ζ, we have f (1) > 0. Therefore, f admits a unique root WR2 ∈ (ζ, 1), and f (WR) > 0 holds iff WR > WR2 over WR ∈ [ζ, 1].
N i2 1 Xh d c j − RP) . (WRj − WR) − (RP N − 1 j=1
Applying the quadratic formula to (A.14) and selecting the larger root yields √ 2M N ζ + t2α + Γ , (A.17) WR > 2 M N + t2α 2 where Γ = 2M N ζ + t2α − 4 M N + t2α M N ζ 2 − t2α ζ + t2α ζ 2 .
(A.7) d j and RP c j are averages of M Bernoulli variables, Since WR we use the standard plug-in approximation 1 WR WR, M c j ) ≈ 1 RP RP, Var(RP M
d j) ≈ Var(WR
(A.8)
where WR ≜ 1 − WR and RP ≜ 1 − RP. Accordingly, we approximate the sample variance of {Dj }N j=1 by s2D ≈
1 WR WR + RP RP . M
A.2. Proof of Theorem 4.9 In this section, we prove Theorem A.7, which establishes certified robustness guarantees for the ownership verification of Cert-LAS. Since our layer-adaptive allocation assigns different noise levels across layers, a uniform ℓ2 -ball fails to capture the geometry of admissible perturbations, motivating the Mahalanobis-based neighborhood in Definition A.2. Before presenting the proof, we first introduce Definition A.3 and Lemmas A.4–A.6 as preliminaries.
(A.9)
To reject H0 at significance level α, we require T > tα , i.e., √ N (WR − RP) > tα . (A.10) sD Substituting sD and rearranging yields p √ M N (WR − RP) − tα WR WR + RP RP > 0. (A.11)
Definition A.2 (Mahalanobis Ellipsoidal Neighborhood). Let σ k = (kσ1 , . . . , kσL ) denote the layerwise standard deviations under the Gaussian smoothing in Remark 4.3, and PL ∥δl ∥22 1/2 let ∥δ∥σk ≜ be the induced Mahalanobis l=1 σ 2
We next derive the closed-form threshold on WR under a known upper bound RP ≤ ζ. √
k,l
norm. The ellipsoidal neighborhood of θ with radius Rk is defined as: Bσk (θ; Rk ) ≜ θ + δ ∈ Rd |∥δ∥σk ≤ Rk , (A.18)
q WR WR + ζ(1 − ζ) > 0. (A.12) Under the above conservative rule, declaring ownership is guaranteed whenever (A.12) holds. √ Since M N > 0, we square both sides of (A.12) (noting that it already enforces WR > ζ) and obtain M N (WR − ζ)2 > t2α WR(1 − WR) + ζ(1 − ζ) . (A.13) Expanding and rearranging yields a quadratic inequality: M N + t2α WR2 − 2M N ζ + t2α WR (A.14) + M N ζ 2 − t2α ζ + t2α ζ 2 > 0. M N (WR − ζ) − tα
where Rk bounds the σ k -weighted magnitude of admissible perturbations. Since σ k = kσ 1 , we define the normalized radius R̄ ≜ R1 , so that Rk = R̄/k for any k > 0. Definition A.3 (Type-I/II Error in Model Watermark Detection). Let X be a random variable taking values in X , with distribution P0 under the null hypothesis H0 (i.e., the suspected generator G(·; θ sus ) does not contain watermark W) and distribution P1 under the alternative hypothesis H1 (i.e., G(·; θ sus ) contains W). For a sample x ∈ X , a randomized test ψ : X → [0, 1] specifies the probability of rejecting H0 . The Type-I and Type-II errors are defined as follows: • Type-I Error (β1 ): The probability of incorrectly identifying an unwatermarked model as watermarked (i.e., H0 is true but rejected):
Let f (WR) denote the left-hand side of (A.14). Since M N + t2α > 0, f is an upward parabola. Moreover, f (ζ) = 2t2α ζ(ζ − 1) < 0,
for ζ ∈ (0, 1),
β1 (ψ; P0 ) = EP0 [ψ(x)].
• Type-II Error (β2 ): The probability of incorrectly identifying a watermarked model as unwatermarked (i.e., H0 is false but accepted):
(A.15)
and f (1) = (1 − ζ) M N (1 − ζ) − t2α ζ .
(A.19)
(A.16)
β2 (ψ; P1 ) = EP1 [1 − ψ(x)]. 15
(A.20)
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
model ownership verification is certified robust against δ if
In model ownership verification, Type-I errors mistakenly flag an unwatermarked model as infringing, while Type-II errors allow adversarially modified models to evade detection. Since watermark detection often serves as a preliminary step before legal proceedings, provable bounds on false positives are essential for evidential admissibility. We note that the Type-I/II errors defined here are instantiated in the MOV context with (P0 , P1 ) specifying the unwatermarked and watermarked hypotheses; in the subsequent analysis (e.g., Lemmas A.4–A.5), the same notation β1 (·) and β2 (·) refers to the generic Type-I/II errors from the Neyman-Pearson framework, where (P0 , P1 ) may correspond to other distribution pairs such as (Z, Z + δ) under smoothing noise.
a + (s1 − a) β2 (1 − Ps1 (θ); P0 , P1 ) m X + (sj − sj−1 ) β2 1 − Psj (θ); P0 , P1 > τα,ζ , j=2
where P0 and P1 are the distributions under H0 : Z ≜ θ + ϵk ∼ P0 against H1 : Z + δ ∼ P1 , and τα,ζ is the verification threshold in Theorem A.1. Proof. Let Z ≜ θ + ϵk ∼ P0 and Z ′ ≜ Z + δ ∼ P1 , (z) and denote by Λ(z) ≜ ffZZ′(z) the likelihood ratio between P1 and P0 . For any p ∈ [0, 1], define tp ≜ inf{t ≥ 0 : P(Λ(Z) ≤ t) ≥ p} and ( 0, if P(Λ(Z) = tp ) = 0, qp = P(Λ(Z)≤tp )−p (A.24) P(Λ(Z)=tp ) , otherwise.
Accordingly, inspired by the optimal likelihood ratio test ψ ∗ established by the Neyman-Pearson lemma (Neyman & Pearson, 1933), we seek to maximize verification power subject to a controlled false positive rate. Let α denote the significance level specifying the maximum tolerable false positive rate. The optimal test ψ ∗ then satisfies:
By Lemma A.4, we have P(Λ(Z) ≤ tp ) ≥ p and P(Λ(Z) < tp ) ≤ p, hence qp ∈ [0, 1]. Define the likelihood ratio test 1, if Λ(z) > tp , φp (z) = qp , if Λ(z) = tp , (A.25) 0, if Λ(z) < tp .
β1 (ψ ∗ ; P0 ) = α,
β2 (ψ ∗ ; P1 ) = β2∗ (α; P0 , P1 ), (A.21) where β2∗ (α; P0 , P1 ) = inf ψ: β1 (ψ;P0 )≤α β2 (ψ; P1 ). Lemma A.4. (Weber et al., 2023) Let X0 and X1 be two random variables with densities f0 and f1 with respect to a measure µ and denote by Λ the likelihood ratio Λ(x) = f1 (x)/f0 (x). For p ∈ [0, 1] let tp ≜ inf{t ≥ 0 : P(Λ(X0 ) ≤ t) ≥ p}. Then it holds that P (Λ(X0 ) < tp ) ≤ p ≤ P(Λ(X0 ) ≤ tp ).
(A.23)
Then φp has type-I error β1 (φp ) = P0 (φp = 1) = 1 − p. Fix thresholds a ≤ s1 ≤ · · · ≤ sm ≤ b. For each j ∈ [m], let φsj ≡ φPsj (θ) so that β1 (φsj ) = 1 − Psj (θ).
(A.22)
For each threshold s ∈ [0, 1], define the events ( ) N o 1 X n (i) As ≜ I qϕ xθ+ϵk = ỹ ≥ s , N i=1 ) ( N o 1 X n (i) I qϕ xθ+δ+ϵk = ỹ ≥ s . Bs ≜ N i=1
Lemma A.5.(Weber et al., 2023) Let X0 and X1 be random variables taking values in Z and with probability density functions f0 and f1 with respect to a measure µ. Let φ∗ be a likelihood ratio test for testing the null X0 against the alternative X1 . Then for any deterministic function φ : Z → [0, 1] the following implications hold: i) β1 (φ) ≥ 1 − β1 (φ∗ ) ⇒ 1 − β2 (φ) ≥ β2 (φ∗ )
(A.26)
(A.27)
By the definition of Ps (θ), we have P0 (Asj ) = Pϵk ∼Ek (Asj ) ≥ Psj (θ),
∀j ∈ [m]. (A.28) Consider the deterministic function φ(z) ≜ I{Asj } and the likelihood ratio test φ∗ ≡ φsj . Since β1 (φ) = P0 (φ = 1) = P0 (Asj ) ≥ Psj (θ) = 1 − β1 (φsj ) and φ∗ yields
ii) β1 (φ) ≤ β1 (φ∗ ) ⇒ β2 (φ) ≥ β2 (φ∗ ). Building on Definition A.3, Eq. (A.21), and Lemmas A.4– A.5 (Weber et al., 2023), and inspired by Kumar et al. (2020), which certifies the stability of continuous probabilistic outputs rather than discrete Top-1 predictions, we derive a general robustness condition for Cert-LAS.
P1 (Bsj ) = 1 − β2 (φ) ≥ β2 (φsj )
(A.29) = β2 1 − Psj (θ); P0 , P1 , ∀j ∈ [m].
Lemma A.6 (General Layer-Adaptive Robustness Condition). Consider layer-adaptive smoothing noise Ek and perturbation δ = (δ 1 , . . . , δ L ). For probability thresholds a h ≤ s1 ≤n · · · ≤ sm ≤ o b, leti Psj (θ) ≤ PN (i) 1 Pϵk ∼Ek N i=1 I qϕ xθ+ϵk = ỹ ≥ sj . Diffusion
Next, define the random variable N
U≜ 16
o 1 X n (i) I qϕ xθ+δ+ϵk = ỹ ∈ [a, b]. N i=1
(A.30)
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
where ϵk ∼ N (0, Σk ) and
We lower bound EP1 [U ] by a Riemann-sum decomposition over the bins [a, s1 ), [s1 , s2 ), . . . , [sm , b]. Using U ≥ a on Bsc1 , U ≥ s1 on Bs1 \Bs2 , . . . , and U ≥ sm on Bsm , taking expectations under P1 yields EP1 [U ] ≥ a + (s1 − a)P1 (Bs1 ) +
m X
2 2 Σk = diag σk,1 Id1 , . . . , σk,L IdL ,
(sj − sj−1 )P1 (Bsj ).
σk,l ≜ kσl . (A.36) Denote by P0 and P1 the distributions of Z and Z ′ under the layer-adaptive smoothing, respectively. For z ∈ R
j=2
P
l dl
(A.31)
log Λ(z) = ⟨z − θ, δ⟩Σ−1 −
Substituting the bound (A.29) into the above yields
k
(A.37)
k
By definition of Σk , we have
j=2
(A.32)
⟨δ, δ⟩Σ−1 =
L X ∥δ l ∥2 2
k
Finally, ownership verification under perturbation δ follows if the watermark robustness exceeds the verification threshold τα,ζ in Theorem A.1. Therefore, the condition
l=1
2 σk,l
=
L X ∥δ l ∥2 2
l=1
(kσl )2
= ∥δ∥2σk . (A.38)
Since the Gaussian distribution is continuous, the likelihood ratio test for testing P0 against P1 takes the form
a + (s1 − a) β2 (1 − Ps1 (θ); P0 , P1 ) m X + (sj − sj−1 ) β2 1 − Psj (θ); P0 , P1 > τα,ζ
φt (z) = I{Λ(z) ≥ t}.
(A.39)
For any p ∈ [0, 1], choose tp such that the test φtp attains type-I error 1 − p under P0 . Then 1 tp = exp Φ−1 (p) ∥δ∥σk − ∥δ∥2σk , (A.40) 2
j=2
(A.33) implies EP1 [U ] > τα,ζ and thus guarantees successful verification at significance level α.
and consequently the corresponding type-II probability of φtp under P1 is β2 (1 − p; P0 , P1 ) = Φ Φ−1 (p) − ∥δ∥σk , (A.41)
The general robustness condition in Lemma A.6 applies to any layer-adaptive smoothing distribution. We now instantiate it with Gaussian smoothing. Theorem A.7 (Certified Radius under Layer-Adaptive Gaussian Smoothing). Consider Gaussian smoothing noise Ek = N (0, Σk ) and the normalized radius R̄ as in Definition A.2. For probability thresholds h P a ≤n s1 ≤ · · · ≤ sm o≤ b, let i (i) N Psj (θ) ≤ Pϵk ∼Ek N1 i=1 I qϕ xθ+ϵk = ỹ ≥ sj .
where Φ is the standard Gaussian CDF. For each j ∈ [m], applying Lemma A.6 with (A.41) gives " # N o 1 X n (i) EP1 I qϕ xθ+δ+ϵk = ỹ N i=1 (A.42) ≥ a + (s1 − a) Φ Φ−1 (Ps1 (θ)) − ∥δ∥σk m X + (sj − sj−1 ) Φ Φ−1 Psj (θ) − ∥δ∥σk .
For any perturbation δ ∈ Bσk (θ; Rk ), diffusion model ownership verification with layer-adaptive noise is guaranteed if R̄ ≤ R∗ , which is obtained by solving R̄ a + (s1 − a) Φ Φ−1 (Ps1 (θ)) − k (A.34) m X R̄ + (sj − sj−1 ) Φ Φ−1 Psj (θ) − > τα,ζ , k j=2
j=2
By Theorem A.1, verification succeeds whenever the watermark robustness rate exceeds the threshold τα,ζ . Therefore, it suffices that the right-hand side of (A.42) satisfies a + (s1 − a) Φ Φ−1 (Ps1 (θ)) − ∥δ∥σk m X + (sj − sj−1 ) Φ Φ−1 Psj (θ) − ∥δ∥σk > τα,ζ .
where Φ is the standard Gaussian CDF, α is the significance √ 2M N ζ+t2α + Γ is the verification threshold level and τα,ζ = 2 2 M N +tα
in Theorem A.1. Proof of Theorem A.7. We instantiate Lemma A.6 for the Gaussian layer-adaptive smoothing noise Ek = N (0, Σk ) and derive the certified condition as follows. Let Z ′ ≜ Z + δ,
1 ⟨δ, δ⟩Σ−1 , k 2
⟨a, b⟩Σ−1 ≜ a⊤ Σ−1 k b.
EP1 [U ] ≥ a + (s1 − a) β2 (1 − Ps1 (θ); P0 , P1 ) m X + (sj − sj−1 ) β2 1 − Psj (θ); P0 , P1 .
Z ≜ θ + ϵk ,
(z) , the likelihood ratio Λ(z) ≜ ffZZ′(z) satisfies
j=2
(A.43) Finally, for δ ∈ Bσk (θ; Rk ), Definition A.2 implies ∥δ∥σk ≤ Rk = R̄/k.
(A.35) 17
(A.44)
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
constraints: on each likelihood-ratio interval, h∗ assigns the minimum admissible value.
Since Φ(·) is strictly increasing, each term Φ(Φ−1 (Psj (θ)) − r) is strictly decreasing in r ≥ 0. Hence the left-hand side of (A.43) is strictly decreasing in ∥δ∥σk , and it is sufficient to enforce (A.43) at the worst case ∥δ∥σk = R̄/k. Therefore, ownership verification is guaranteed for all perturbations with R̄ ≤ R∗ , where R∗ is the maximal radius obtained by solving (A.34).
We first verify that this construction satisfies the constraints. For each j ∈ [m], the event {h∗ (Z) ≥ sj } coincides with the acceptance region of the likelihood ratio test with threshold Tj , namely {Λ(Z) < Tj } together with a randomized assignment on the boundary {Λ(Z) = Tj }. Hence,
A.3. Proof of Tightness
P0 (h∗ (Z) ≥ sj ) = P0 (Λ(Z) < Tj ) + (1 − qj ) P0 (Λ(Z) = Tj ) , (A.50)
where qj is the tie-breaking coefficient of the likelihood ratio test at threshold Tj : ( 0, if P0 (Λ(Z) = Tj ) = 0, qj = P0 (Λ(Z)≤Tj )−Psj (θ) , otherwise. P0 (Λ(Z)=Tj ) (A.51) By Lemma A.4, we have
In this section, we derive a theorem that establishes tightness: any perturbation outside (A.23) admits a classifier that leads to unreliable verification. Theorem A.8 (Tightness). For any perturbation δ that violates (A.23), there exists a diffusion classifier h∗ consistent with the probability bounds Psj (θ) for which (A.1) does not hold. Consequently, ownership verification cannot be guaranteed at significance level α.
P0 (Λ(Z) < Tj ) ≤ Psj (θ) ≤ P0 (Λ(Z) ≤ Tj ) . Therefore, the above choice of qj ensures
Proof. We demonstrate the tightness of our robustness condition by constructing a worst-case base classifier h∗ such that its smoothed diffusion classifier fails to maintain reliable verification when condition (A.23) is violated. The key insight is to design h∗ to precisely achieve the lower bound in Lemma A.6, thereby representing the most challenging scenario for ownership verification.
P0 (h∗ (Z) ≥ sj ) = Psj (θ).
The crucial step is to show that this construction achieves the theoretical lower bound. Let U ∗ ≜ h∗ (Z ′ ). By expanding the expectation over the disjoint regions in (A.49), we obtain EP1 [U ∗ ] = a · P1 (Λ(Z ′ ) > T1 ) m X + sj−1 · P1 (Tj < Λ(Z ′ ) < Tj−1 ) (A.54)
Z ′ ≜ θ + δ + ϵk ∼ P1 , (A.45)
and define the likelihood ratio fZ ′ (z) Λ(z) ≜ . fZ (z) For any p ∈ [0, 1], let n o tp ≜ inf t ≥ 0 : P Λ(Z) ≤ t ≥ p
j=2
+ sm · P1 (Λ(Z ′ ) < Tm ) ,
(A.46)
with the same boundary randomization as above. For each j, consider the likelihood ratio test 1, if Λ(z) > Tj , φj (z) = qj , if Λ(z) = Tj , (A.55) 0, if Λ(z) < Tj .
(A.47)
as in Lemma A.4. For each j = 1, 2, . . . , m, we further introduce the following notation: Tj ≜ t Psj (θ) .
By construction, φj has type-I error
(A.48)
β1 (φj ) = P0 (Λ(Z) > Tj ) + qj P0 (Λ(Z) = Tj ) = 1 − Psj (θ). (A.56)
Then, the base classifier h∗ is defined by sm , if Λ(z) < Tm , sm−1 , if Tm < Λ(z) < Tm−1 , . ∗ h (z) = .. s1 , if T2 < Λ(z) < T1 , a, if Λ(z) > T1 .
(A.53)
Therefore, h∗ is consistent with the prescribed bounds {Psj (θ)}m j=1 and qualifies as a valid classifier.
Let Z ≜ θ + ϵk ∼ P0 ,
(A.52)
Therefore, by the definition of β2 (·; P0 , P1 ), P1 (Λ(Z ′ ) < Tj ) + (1 − qj ) P1 (Λ(Z ′ ) = Tj ) = β2 1 − Psj (θ); P0 , P1 . (A.49)
(A.57)
Substituting (A.57) into (A.54) yields EP1 [U ∗ ] = a + (s1 − a) β2 (1 − Ps1 (θ); P0 , P1 ) m X + (sj − sj−1 ) β2 1 − Psj (θ); P0 , P1 ,
This construction is deliberately chosen to make verification as difficult as possible while still satisfying the given
j=2
(A.58) 18
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
which exactly matches the lower bound in Lemma A.6, proving its tightness. Finally, when condition (A.23) is violated, the right-hand side of (A.58) is at most τα,ζ . This means the verification condition (A.1) does not hold for the constructed h∗ . Consequently, model ownership verification cannot be guaranteed at significance level α.
B. More Related Works B.1. Fingerprinting-based Diffusion Watermarking
Figure 5. Empirical cumulative distribution functions of rank dispersion RD(l) and stability score S(l) across UNet layers. Most layers demonstrate low rank dispersion and high stability scores, indicating consistent update patterns across datasets.
Fingerprint-based diffusion watermarking embeds userspecific identifiers into generated images, enabling userlevel attribution and deepfake tracing. Based on the embedding strategy, existing methods can be divided into two categories: latent space fingerprinting and fine-tuning (Fernandez et al., 2023; Xiong et al., 2023; Ma et al., 2024). Latent-space fingerprinting methods (Wen et al., 2023; Lei et al., 2024; Yang et al., 2024c) embed watermarks by modifying the frequency domain of latent representations without additional training. Partial fine-tuning methods embed watermarks through model adaptation, such as fine-tuning customized decoders for different users. However, latent-space fingerprinting requires strong externalization assumptions where model providers must maintain control over the generation code, while fine-tuning locates ownership signals outside the UNet backbone (e.g., in detachable decoders), making both categories vulnerable to component substitution attacks (Wang et al., 2025d).
pretrained visual backbones (Yang et al., 2024a; Liu et al., 2025), highlighting the breadth of trigger-design strategies that motivate trigger-free alternatives such as ours.
C. Pilot Study Settings. To derive a noise allocation strategy that accounts for the structure of the UNet architecture, we conduct a pilot study examining layerwise parameter updates during full fine-tuning across diverse datasets. We fine-tune Stable Diffusion v1.4 (Rombach et al., 2022) with full parameters and a learning rate of 1 × 10−5 on 6 datasets spanning different domains: LAION-5B (Schuhmann et al., 2022), CelebA-HQ (Karras et al., 2018), Dogs vs. Cats (Elson et al., 2007), Cartoon (Norod78, 2022), Landscape (Rougetet, 2020), and ArtBench (Liao et al., 2022). For each layer l in the UNet backbone, we quantify the update magnitude using the average L2 norm δ̄ l (0, T ) as defined in Definition 4.1, measured between initialization and the final training step T = 5000. To assess whether these update patterns generalize across datasets, we evaluate two complementary metrics. P First, we compute the rank dispersion RD(l) = |P1m | (i,j)∈Pm |rl,i − rl,j | by ranking all layers according to their update magnitude within each dataset, then calculating the average absolute rank difference across all dataset pairs, where rl,i denotes the rank of layer l in dataset i and Pm = {(i, j) ∈ [m] × [m]|i < j} is the set of unordered dataset pairs. A smaller RD(l) indicates that layer l maintains more consistent relative ranking across datasets. Second, we compute the stability score S(l) = 1 − RD(l) L−1 , where L is the number of layers. A higher S(l) indicates more consistent relative update behavior. To visualize the distribution of these metrics across all layers, we compute their empiricalPcumulative distribution functions L (ECDF): FbRD (t) = L1 l=1 1{RD(l) ≤ t} and FbS (s) = P L 1 l=1 1{S(l) ≤ s}, where 1{·} is the indicator function. L
B.2. Backdoor-based Diffusion Watermarking Backdoor-based diffusion watermarking achieves model ownership verification (MOV) through a private trigger that activates a predefined watermark behavior during generation (Liu et al., 2023b; Zhao et al., 2023; Feng et al., 2024; Wang et al., 2025d), adopting either synthetic triggers such as rare tokens and semantically atypical patterns, or concept triggers that reuse pretrained concepts to induce a semantically mismatched watermark response. Among these, synthetic triggers remain the dominant design, as they reduce language drift and empirically exhibit stronger survivability under downstream fine-tuning, while concept triggers are less competitive because pretrained concepts are difficult to learn as triggers for mismatched image targets (Huang et al., 2024). However, the confidentiality of synthetic triggers is difficult to guarantee in practice due to their semantic atypicality, and this line of work lacks theoretical guarantees of certified robustness under adversarial model modifications, leaving it exposed to adaptive attacks. Beyond diffusion-specific designs, backdoor mechanisms have been broadly explored across CLIP (Liang et al., 2024c), vision-language models (Liang et al., 2025a;b), and
Results. As shown in Fig. 5, layerwise update patterns exhibit strong cross-dataset consistency: approximately 19
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing Table 8. Layers with Largest and Smallest Update Magnitude Top 25 Layers
Bottom 25 Layers
up blocks.1.resnets.2.norm2.weight up blocks.2.resnets.0.norm2.weight up blocks.3.attentions.0.transformer blocks.0.norm1.weight down blocks.2.attentions.1.transformer blocks.0.norm2.bias up blocks.0.resnets.1.norm2.weight up blocks.0.resnets.2.norm2.weight up blocks.2.resnets.1.norm2.weight mid block.resnets.1.norm2.weight up blocks.2.resnets.2.norm2.weight up blocks.3.attentions.0.transformer blocks.0.norm3.weight up blocks.3.attentions.1.transformer blocks.0.norm1.weight up blocks.0.resnets.0.norm2.weight up blocks.1.resnets.0.norm2.weight down blocks.0.attentions.1.transformer blocks.0.norm1.weight up blocks.3.resnets.0.norm2.weight conv norm out.bias up blocks.3.attentions.0.transformer blocks.0.attn2.to k.weight up blocks.1.attentions.1.transformer blocks.0.norm2.weight up blocks.3.attentions.0.transformer blocks.0.norm2.weight up blocks.1.attentions.0.transformer blocks.0.norm2.weight up blocks.1.resnets.1.norm2.weight up blocks.2.attentions.0.transformer blocks.0.norm2.weight up blocks.1.attentions.2.transformer blocks.0.norm2.weight up blocks.3.attentions.0.transformer blocks.0.attn2.to q.weight up blocks.2.attentions.2.transformer blocks.0.norm2.weight
time embedding.linear 1.bias time embedding.linear 2.bias up blocks.0.resnets.2.time emb proj.weight up blocks.3.attentions.2.norm.bias up blocks.3.attentions.2.proj in.bias up blocks.3.resnets.2.conv2.bias down blocks.0.resnets.0.norm1.bias up blocks.3.resnets.2.conv shortcut.bias up blocks.3.attentions.2.proj out.bias down blocks.0.resnets.0.conv2.bias up blocks.3.resnets.1.conv2.bias up blocks.0.resnets.1.time emb proj.weight up blocks.3.resnets.1.conv shortcut.bias up blocks.0.resnets.0.time emb proj.weight mid block.resnets.1.time emb proj.weight up blocks.3.resnets.0.conv2.bias up blocks.3.resnets.0.conv shortcut.bias up blocks.3.attentions.2.transformer blocks.0.norm1.bias up blocks.1.resnets.1.conv2.bias up blocks.1.resnets.1.conv shortcut.bias up blocks.3.attentions.2.transformer blocks.0.ff.net.2.bias mid block.resnets.0.time emb proj.weight down blocks.0.attentions.1.transformer blocks.0.ff.net.2.bias down blocks.0.attentions.1.proj out.bias up blocks.3.attentions.1.proj out.bias
78.6% of layers satisfy rank dispersion RD(l) ≤ 50 and stability scores S(l) > 0.5. Under a random ranking baseline, achieving such agreement would have probability ≈ 10−1543 , which suggests that the observed update magnitudes may be driven more by intrinsic architectural properties than by idiosyncrasies of any particular dataset.
dataset-specific adjustment. In summary, this asymmetry could be indicative of an efficient adaptation pattern: the model may largely preserve components related to core feature processing and noise scheduling, while preferentially adjusting modules that mediate semantic conditioning and detail synthesis. Such a mechanism could facilitate transfer across visual domains without substantially altering the model’s generative behavior (Ronneberger et al., 2015; Dhariwal & Nichol, 2021). Correspondingly, the persistence of this pattern across diverse datasets motivates our LFS(l)-guided noise allocation strategy, which prioritizes smoothing on layers that appear more susceptible to fine-tuning updates.
To shed light on this phenomenon, Tab. 8 highlights several plausible explanations. Among the top 25 layers, normalization parameters (e.g., up blocks.*.norm2.weight) appear frequently, which could be consistent with their role in modulating feature distributions toward datasetspecific statistics (Ronneberger et al., 2015). Moreover, upsampling blocks and cross-attention components (attn2.to q/k.weight) also rank highly, potentially reflecting their involvement in reconstructing fine-grained visual details and encoding domain-dependent semantic relations (Rombach et al., 2022; Kumari et al., 2023; Bao et al., 2024). In contrast, the bottom 25 layers are dominated by time-embedding projections (e.g., time emb proj.weight), bias terms, and certain linear projections. One possible interpretation is that time embeddings primarily parameterize diffusion timesteps with comparatively limited dependence on image content (Nichol & Dhariwal, 2021; Huang et al., 2023; Voynov et al., 2023), while bias terms and some linear projections may function as more generic structural parameters that require less
D. Detailed Experimental Settings D.1. Model Watermarking In the watermarking phase, we use Stable Diffusion v1.4 on the Dogs vs. Cats dataset (Elson et al., 2007) as the default setting. To derive layer-adaptive noise levels, we first perform a short fine-tuning stage with learning rate 1 × 10−5 to compute the sensitivity indicators LFS(l), which then determine the layerwise noise levels σ 1 under a global budget σu = 0.01. With these noise levels established, we proceed to watermark embedding by training the generator to induce targeted misclassification. 20
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
Suspiciousness Scores (Sin (p) and Sout (p)). These metrics measure the detectability of watermark triggers under adversarial auditing. The prompt suspiciousness score Sin (p) evaluates trigger detectability in the input space by computing word-level contextual incongruity using GPT-2 medium. The image suspiciousness score Sout (p) evaluates detectability in the output space by comparing the within-prompt similarity between images generated from original and detriggered prompts. Lower scores indicate better stealthiness.
Following prior work on diffusion-based classification (Li et al., 2023; Chen et al., 2024), we adopt a binary prompt set Y = {“a photo of a cat”, “a photo of a dog”}, designate “cat” as the watermark class prompt ỹ, and train the generator such that samples produced under the “cat” prompt are shifted toward the “dog” side with target distribution q ∗ (λ) = [1 − λ, λ], using λ = 0.55 by default. The generator is optimized with a single-step inversion-based objective, regularization weight ω0 = 5 × 10−5 , and a learning rate 1 × 10−6 , yielding the watermarked generator G(·; θ w ).
D.4. Details of Statistical Testing D.2. Model Verification
Following prior work (Wang et al., 2025d), we adopt hypothesis testing for watermark verification to ensure fair comparison across methods.
For watermark verification, we reuse the layer-adaptive noise levels {σl }L l=1 from the watermarking stage and repeatedly evaluate both the watermarked model and an unwatermarked reference model under paired parameter noise trials. Each trial produces a scalar verification statistic given by the fraction of generated images classified by the diffusion classifier as the target prompt ỹ. To obtain finitesample certified bounds, we instantiate the watermarkedside probabilities Psj (θ) via a one-sided Dvoretzky–Kiefer– Wolfowitz lower confidence bound, and bound the referenceside baseline rate ζ via a one-sided Hoeffding upper confidence bound. Substituting these bounds into Eq. (A.34) with m = 100 empirical-quantile thresholds, we determine the maximum certified radius R∗ by grid search.
WatermarkDM. WatermarkDM employs hypothesis testing based on image similarity metrics. They use SSIM to measure the alignment between a generated image and the target watermark image, with the verification threshold empirically determined by evaluating SSIM scores on clean images and selecting a value that maintains the FPR below 10−6 . With this threshold established, they compute T@10−6 F to assess watermark detection performance. SleeperMark. SleeperMark embeds a predefined watermark message and extracts it from images generated by a suspicious model. Verification relies on counting matching bits between embedded and extracted messages: if the count exceeds a threshold, the model is deemed derived from the original. The threshold is analytically determined by assuming bits extracted from clean images follow an i.i.d. Bernoulli(0.5) distribution, which allows exact computation of the false positive rate. They set the threshold to maintain an FPR of 10−6 and average verification results across multiple triggered images to confirm ownership.
D.3. Effectiveness Metrics TPR at FPR 10−6 (T@10−6 F). We report the true positive rate (TPR) under a stringent false positive rate (FPR) constraint of 10−6 . Specifically, given images generated from verification prompts, we apply an exact Binomial sign test to determine whether the suspected model produces watermarked images while controlling the FPR at 10−6 . We then report the resulting TPR as T@10−6 F. Higher values indicate stronger watermark detectability.
Ours. We employ different statistical tests for T@10−6 F and certified radius R̄. For T@10−6 F, we apply per-sample exact sign tests, comparing classifier confidence scores between watermarked and clean models to compute exact p-values via the binomial distribution, with a sample detected if the p-value falls below 10−6 . This image-level hypothesis testing aligns with baselines at the 10−6 significance level for fair comparison. We evaluate two settings: with randomized smoothing, where paired parameter noise is added to both models to test robustness under parameter perturbations, and without smoothing, where only input randomness varies. This approach effectively captures the directional consistency of subtle confidence shifts around 0.5 (e.g., 0.5001 vs. 0.4999) regardless of magnitude. For computing R̄ via VSR, we employ a paired-sample t-test at significance level α = 0.05, as our theoretical guarantee requires only the mean VSR based on whether the target class label is successfully predicted, and the averaged success rates within [0, 1] satisfy the normality assumption.
Verification Success Rate (VSR). VSR measures the proportion of verification attempts that successfully confirm model ownership under layer-adaptive smoothing. Given M noise samples and N verification images, VSR is calculated as the fraction of trials where the suspected model is successfully verified as watermarked. Higher values indicate more reliable ownership verification. Certified Radius (R̄). The certified radius quantifies the maximum magnitude of parameter perturbations under which ownership verification is provably guaranteed. We measure perturbations using a Mahalanobis norm induced by the layer-adaptive noise levels. A larger R̄ indicates greater robustness against parameter modifications, providing a provable guarantee that adversaries cannot remove the watermark through bounded parameter manipulations.
21
0.12
0
Orig. W8A32 W8A8 W4A32
0.15
50
0.14
VSR
25
DreamSim
0
Orig.
30%
50%
70%
0.12
WatermarkDM SleeperMark Cert-LAS (w/o Exp.) Cert-LAS (w Exp.)
3.2h 13.7h 9.4h 2.2h
0.10
50 25
VSR DreamSim
0.08 0.06
10−6 10−5 10−4 10−3 10−2
100
32
75
24
50 VSR
25 0 400
Time
16 8
1200 2000 2800 3600
T
(a) Ablation study on ω0 (b) Ablation study on T Figure 7. Impact of ω0 on VSR and DreamSim (left), and T on VSR and training time (right).
Table 9. Training efficiency comparison on 4 A100 80GB GPUs. Time
0.12
w0
(a) Model Quantization (b) Model Pruning Figure 6. Robustness of Cert-LAS under Model Compression.
Method
0.14
75
0
0.10
Pruning Ratio
Quantization
100
Time (min)
0.14
25
0.16
75
VSR (%)
DreamSim
100
VSR (%)
0.16
VSR
VSR (%)
50
DreamSim
VSR (%)
75
DreamSim
0.18
100
DreamSim
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing
Table 10. Impact of sampling budget M and N on verification. Setting
Time
VSR
M =10, N =100 M =100, N =100 M =1000, N =100 M =100, N =1000
0.23h 2.22h 22.17h 21.10h
0.676 0.671 0.670 0.671
D.5. Details of Unintentional Attack We evaluate watermark robustness against unintentional attacks through fine-tuning on diverse downstream tasks. For full fine-tuning, we employ four large-scale datasets spanning distinct visual domains: Cartoon (Norod78, 2022) for stylized illustrations, CelebA-HQ (Karras et al., 2018) for high-resolution facial imagery, Landscape (Rougetet, 2020) for natural scenery, and ArtBench (Liao et al., 2022) for artistic styles. Additionally, we consider three parameterefficient fine-tuning methods that represent common adaptation scenarios: LoRA (Hu et al., 2022) fine-tuned on the Naruto-style dataset (Cervenka, 2022), DreamBooth (Ruiz et al., 2023) personalized on the Dog dataset (Ruiz et al., 2023), and Custom Diffusion (Kumari et al., 2023) trained on tortoise plushy (Kumari et al., 2023). These datasets and fine-tuning methods collectively represent typical model customization scenarios encountered in practice.
pression such as quantization or pruning, which can substantially alter parameter values. We therefore evaluate whether Cert-LAS remains verifiable under these transformations. Settings. For quantization, we apply post-training quantization to the watermarked model using torchao (Or et al., 2025), at W8A32, W8A8, and W4A32 precision. For pruning, we apply structured pruning using OBSDiff (Zhu et al., 2026) at sparsity ratios of 30%, 50%, and 70%. In all cases the private classifier and reference generator are kept fixed. We report the verification success rate (VSR) to measure watermark robustness under compression, together with DreamSim to quantify the degradation in generation quality. Results. As shown in Fig. 6, Cert-LAS withstands both quantization and pruning unless the compression itself destroys generation quality. Specifically, Cert-LAS preserves VSR = 1.000 across moderate quantization and pruning. While VSR does drop markedly under the most aggressive W4A32 quantization, DreamSim has by then risen well above its watermarked baseline, indicating the model is no longer practically usable. This indicates that Cert-LAS exhibits strong robustness against model compression, as the watermark cannot be removed without simultaneously reducing the stolen model’s generation quality.
D.6. Details of Intentional Attack In this paper, we evaluate robustness against parameterspace attacks for three watermarking methods: WatermarkDM uses an attack that optimizes model parameters through backpropagation across the entire diffusion process to make watermarked outputs structurally similar to clean model generations, thereby reducing the SSIM score with the reference watermark image below the detection threshold; SleeperMark faces an attack that trains the model to remove the embedded watermark residual signal from its outputs, causing the watermark extractor to decode all-zero bits instead of the private binary string; and our method is attacked by training the model so that the frozen classifier correctly classifies the generated images as the true class prompt instead of the watermark class.
F. Ablation Study F.1. Ablation on Hyperparameters Impact of Initial Regularization Weight. Fig. 7a reveals a clear trade-off between robust verification (measured by VSR) and model fidelity (measured by DreamSim, where lower indicates better preservation of visual quality) when varying the initial regularization weight ω0 . Increasing ω0 improves model fidelity by reducing DreamSim, but concurrently degrades watermark effectiveness, leading to lower VSR. When ω0 falls below 5 × 10−5 , VSR remains saturated while DreamSim increases substantially, indicating
E. Resistance to Model Compression Beyond fine-tuning and parameter perturbations, a verifier may encounter suspect models that have undergone com22
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing Table 11. Ablation on the reference generator (WR–RP gap). (a) Distinct architectures and scales. Reference Generator
WR–RP gap
SD v1.4 SDXL Z-Image
0.875 0.891 0.856
(b) Hardest-to-distinguish SD v1.3–v1.5 variants. Model
ArtBench
CelebA-HQ
Landscape
SD v1.3 SD v1.4 SD v1.5
0.864 0.876 0.893
0.891 0.887 0.872
0.888 0.880 0.899
Figure 8. Impact of the target distribution q ∗ (λ) on verification and fidelity.
grades fidelity. Notably, when λ ≥ 0.55, both T@10−6 F and VSR saturate at 1.000 with diminishing improvements, while DreamSim continues to increase as the classification loss progressively dominates the perceptual regularizer, indicating a notable decline in fidelity. This suggests that λ = 0.55 (i.e., q ∗ = [0.45, 0.55]) strikes a reasonable balance between verification robustness and model fidelity.
that weaker regularization embeds watermarks more aggressively at the expense of generation quality. Based on these observations, ω0 of 5 × 10−5 strikes a reasonable balance between robust verification and model fidelity. Impact of Sensitivity Estimation Steps and Training Schedule. As illustrated in Fig. 7b, VSR saturates quickly while runtime scales linearly with increasing sensitivity estimation steps T . Specifically, even 13 to 20 minutes of sensitivity estimation suffices to achieve high VSR, indicating that reliable layer sensitivity indicators can be efficiently obtained without extensive computation. Based on this, we further explore the efficiency of the Exponential Growth Schedule proposed in Section 4.4. As shown in Tab. 9, with LFS(l, T = 2000) and the Exponential Growth Schedule, Cert-LAS achieves a total training time of 2.2h on 4 A100 80GB GPUs. Notably, the Exponential Growth Schedule alone reduces training time by 76.6% compared to Cert-LAS without this schedule, while also outperforming existing watermarking methods by substantial margins, suggesting that our method remains highly efficient despite the computational demands of robust training on large-scale text-to-image diffusion models.
F.2. Ablation on Model-Dependent Components The WR–RP verification involves three model-dependent components: the reference generator, the suspect model, and the private classifier. We ablate each in isolation while keeping the rest of the pipeline at its default configuration. Throughout, we report the WR–RP gap, since the ownership decision depends only on whether this gap is significant: a large gap indicates reliable verification, while a collapsed gap indicates the decision threshold τα,ζ cannot be exceeded. Unless otherwise stated, RP is 0.125 under the default reference generator and private classifier. Reference Generator (Inference-Time). Since RP is estimated on the reference generator, we test whether the WR–RP gap is sensitive to its choice, replacing it with (a) distinct architectures and scales (Stable Diffusion XL (SDXL) (Podell et al., 2023), Z-Image), and (b) the hardestto-distinguish SD v1.3–v1.5 variants fine-tuned on ArtBench, CelebA-HQ, and Landscape, which constitute a worst case as they share initialization and architecture, differing only in continued-training steps. As shown in Tab. 11, the gap stays consistently large, above 0.85 across distinct architectures and within 0.864 to 0.899 for the hardest variants. This indicates the WR–RP separation does not rely on any particular reference generator.
Impact of Sampling Budget. In verification, M denotes the number of layer-adaptive noise samples and N the number of verification images. We evaluate VSR on models attacked by PGD with ℓ2 = 0.8, since unattacked models consistently achieve 100% VSR. As shown in Tab. 10, VSR exhibits diminishing returns with increasing sampling budget. For instance, M = N = 100 achieves comparable accuracy to M = 1000 or N = 1000, indicating that model owners can reliably verify ownership with a small sampling budget. Impact of the Target Distribution q ∗ (λ). To study the impact of the target distribution q ∗ , we parameterize it in the binary case as q ∗ (λ) = [1 − λ, λ]. We then embed the watermark into SD v1.4 under different values of λ, which controls the strength of the embedded watermark signal during training, and report the results in Fig. 8. The table illustrates a trade-off between verification robustness and model fidelity. Increasing λ enhances verification but de-
Suspect Model (Inference-Time). Using the same two settings as suspects, with the private classifier and reference generator fixed (hence RP = 0.125 and τα,ζ = 0.426), we check for false attribution of non-watermarked models. As shown in Tab. 12, the gap collapses for every suspect, with WR staying far below τα,ζ and under 0.13 even for the hardest-to-distinguish variants. This suggests Cert-LAS 23
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing Table 12. False-positive evaluation on non-watermarked suspects (the WR–RP gap collapses, WR < τα,ζ = 0.426; RP = 0.125). (a) Distinct architectures and scales.
Suspect Model
WR
SDXL Z-Image
0.312 0.008
Table 14. Replacing the private classifier at inference time (the WR–RP gap collapses, WR ≪ τα,ζ ).
(b) Hardest-to-distinguish SD v1.3–v1.5 variants. Model
ArtBench
CelebA-HQ
Landscape
SD v1.3 SD v1.4 SD v1.5
0.114 0.123 0.107
0.101 0.108 0.102
0.126 0.127 0.110
WR
RP
τα,ζ
SD v1.4 (ArtBench) SD v1.4 (CelebA-HQ) SD v1.4 (Landscape) SDXL Z-Image
0.004 0.048 0.019 0.232 0.001
0.102 0.008 0.197 0.210 0.003
0.351 0.219 0.456 0.469 0.233
Table 15. Cross-architecture robustness (T@10−6 F) under full fine-tuning on four datasets.
Table 13. Ablation on the watermarking-stage private classifier (WR–RP gap > 0.79). Private Classifier
Classifier (replaced)
Dataset
Backbone
ArtBench
SDXL 1.000 1.000 0.996 0.988 Sana-1.6B 1.000 1.000 0.999 0.993
CelebA-HQ
SDXL 1.000 1.000 1.000 0.999 Sana-1.6B 1.000 1.000 1.000 0.995
Cartoon
SDXL 1.000 1.000 1.000 0.990 Sana-1.6B 1.000 1.000 1.000 0.995
Landscape
SDXL 1.000 1.000 1.000 0.998 Sana-1.6B 1.000 1.000 1.000 0.996
WR–RP gap
SD v1.4 SDXL Z-Image
0.875 0.790 0.987
500
1000
1500
2000
of the two mainstream T2I diffusion architectures (UNetbased and Transformer-based). Notably, on Sana-1.6B we instantiate the verification classifier with a flow-matching velocity-MSE score, rather than the denoising score used for SD v1.4/SDXL. We find that the same layerwise consistency holds on both backbones, and hence LFS-guided smoothing transfers across architectures.
does not produce false positives, independent of the suspect’s architecture or pretraining background. Private Classifier (Watermarking-Stage). We embed the watermark using SD v1.4, SDXL, and Z-Image as the private classifier. As shown in Tab. 13, the WR–RP gap remains above 0.79 across all architectures. This indicates that the private classifier and the protected generator can adopt different architectures during watermark embedding, granting the defender flexibility in selecting the classifier backbone.
Layerwise Consistency. We repeat the pilot study of Appendix C on both backbones, using the normalized stability score S(l) = 1 − RD(l)/(L − 1) to account for their different layer counts. As Fig. 9 shows, the S(l) distributions of SDXL and Sana-1.6B almost coincide with that of SD v1.4 at high stability scores, indicating that the layerwise consistency is an architectural property shared across UNet- and Transformer-based diffusion models rather than an artifact of the SD v1.4 UNet.
Private Classifier (Inference-Time). We hereby replace the private classifier at verification stage, using SD v1.4 variants fine-tuned on ArtBench, CelebA-HQ, and Landscape, as well as SDXL and Z-Image, while the watermarkingstage classifier remains unchanged. As shown in Tab. 14, the gap collapses in all cases, with WR staying far below τα,ζ , likely because the watermark is embedded as a targeted misclassification specific to one classifier’s energy landscape and does not transfer across misaligned landscapes. This indicates that only the defender’s private classifier can verify the watermark, preventing adversaries from forging it with a substitute classifier.
Watermark Robustness. We then evaluate watermark robustness under both standard full fine-tuning (Tab. 15) and advanced fine-tuning (Tab. 16). Across all datasets and finetuning paradigms, Cert-LAS remains highly robust on both backbones. Specifically, even under the most challenging regime of full fine-tuning for 2000 steps, T@10−6 F stays above 0.988 for both SDXL and Sana-1.6B, while advanced fine-tuning (DreamBooth, LoRA, Custom Diffusion) leaves it essentially unaffected. This indicates that Cert-LAS transfers effectively across architectures and scales, confirming that the proposed LFS-guided layer-adaptive smoothing is not restricted to the UNet backbone.
G. Generalization Analysis G.1. Generality across Model Architectures Although Cert-LAS is implemented on SD v1.4 by default to ensure fair comparison with prior watermarking baselines, it is not inherently tied to this backbone: the LFS indicator only relies on the layerwise update consistency of diffusion models under fine-tuning. To examine whether this property is specific to the SD v1.4 UNet, we evaluate CertLAS on Stable Diffusion XL (SDXL) (Podell et al., 2023) and Sana-1.6B (Xie et al., 2024), representative models
G.2. Generality across Classification Tasks Although Cert-LAS adopts a Dogs-vs-Cats class pair with a fixed prompt template by default, the class pair, prompt template, and number of classes are design choices of the 24
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing Table 16. Cross-architecture robustness (T@10−6 F) under advanced fine-tuning: DreamBooth, LoRA, and Custom Diffusion. (a) DreamBooth Backbone
250
500
750
1000
SDXL Sana-1.6B
1.000 1.000
1.000 1.000
1.000 1.000
1.000 1.000
Table 17. Generality of Cert-LAS across classification tasks, prompt templates, and the number of classes. Template 1 = “{class}”; Template 2 = “a blurry photo of a {class}”; Template 3 = “a photo of a {class}, a type of pet”. Variation
Configuration
Class pair
Dogs-vs-Cats Black-vs-White Ship-vs-Truck
(b) LoRA (rank 640) Backbone
500
1000
1500
2000
SDXL Sana-1.6B
1.000 1.000
1.000 1.000
1.000 1.000
1.000 0.998
Template 1 Prompt template Template 2 Template 3 Multi-class
(c) Custom Diffusion Backbone
100
200
300
400
500
SDXL Sana-1.6B
1.000 1.000
1.000 1.000
1.000 1.000
1.000 1.000
1.000 1.000
defender rather than inherent constraints of the method. To verify this, we jointly embed Cert-LAS on the same backbone under three variations: (i) multiple alternative binary class pairs, (ii) varied prompt templates, and (iii) multi-class settings on STL-10 and CIFAR-10. As shown in Tab. 17, all configurations achieve T@10−6 F = 1.000 and VSR = 1.000. This indicates that Cert-LAS generalizes across diverse class pairs, prompt templates, and multi-class settings, and is not tied to the default Dogs-vs-Cats instance.
STL-10 (10-class) CIFAR-10 (10-class)
T@10−6 F↑ VSR↑ 1.000 1.000 1.000
1.000 1.000 1.000
1.000 1.000 1.000
1.000 1.000 1.000
1.000 1.000
1.000 1.000
Figure 9. Empirical cumulative distribution functions of the stability score S(l) across layers for SDXL and Sana-1.6B.
I. Extended Discussion: Multi-Owner Scenarios Our Cert-LAS mainly targets model ownership verification, i.e., determining whether a suspect model derives from a protected one, rather than owner identification among a large pool. Nevertheless, the multi-owner scenario, where distinct owners’ watermarks must remain mutually distinguishable, is also worth exploring. Cert-LAS achieves such non-interference along two orthogonal dimensions: the task dimension and the classifier dimension. Along the task dimension, the generality across class pairs (Tab. 17) implies that different owners can adopt non-overlapping task configurations, keeping their watermark responses separable without degrading verifiability. Along the classifier dimension, as established in Appendix F.2 (Tab. 14), the verification signal is uniquely bound to the watermarking-stage private classifier, and replacing it at inference renders the watermark undetectable. This non-transferability ensures that distinct owners’ watermarks do not interfere with one another. Nevertheless, how to enable scalable multi-owner verification remains an important open problem.
H. Extended Discussion on Threat Model Arguably, the MOV setting adopted in the main paper is compatible with realistic legal and compliance-oriented forensics: a trusted verification authority can obtain an executable copy of the suspect model (e.g., a weight snapshot or an equivalent implementation) via forensic procedures, platform retention, or lawful requests, and perform verifiable ownership determination without disclosing the owner’s private verification information. In particular, when direct access to the model’s internal parameters is unavailable and verification can only proceed via querying the suspect model, our method could degrade to an empirical watermarking approach. The owner queries the suspect model using class prompts, collects the generated outputs, and applies a private diffusion classifier for decision-making. Although this variant no longer provides certified robustness guarantees without inference-time layer-adaptive smoothing, it remains highly effective in practice: as demonstrated in our experiments (in Section 5.3), the degraded method exhibits strong empirical robustness against various finetuning attacks, while the trigger-free design ensures stealthiness by employing neither explicit triggers on the input side nor visible artifacts in generated images, thereby evading input/output-space watermark auditing (in Section 5.2).
J. Qualitative Results for Downstream Fine-tuning In this section, we provide qualitative evidence that our watermark embedding does not degrade the model’s adaptability for downstream customization. Fig. 10 shows gen25
Cert-LAS: Toward Certified Model Ownership Verification for T2I Diffusion Models via Layer-Adaptive Smoothing (a) Advanced Fine-tuning via LoRA (Rank = 320)
(b) Advanced Fine-tuning via DreamBooth
(c) Advanced Fine-tuning via Custom Diffusion
Figure 10. Qualitative generations of SD v1.4 watermarked by Cert-LAS after downstream fine-tuning with (a) LoRA, (b) DreamBooth, and (c) Custom Diffusion. The embedded watermark does not impair the model’s adaptability for downstream customization.
erations from SD v1.4 watermarked by Cert-LAS, subsequently fine-tuned using three popular personalization techniques: LoRA, DreamBooth, and Custom Diffusion. Across all three fine-tuning paradigms, the watermarked model successfully learns the target concepts and produces highquality, style-consistent outputs, demonstrating that CertLAS imposes no observable degradation.
26