1
Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models
…
Existing Methods
Abstract—Model fingerprinting, embedding user-specific identifiers (fingerprints) into generated outputs, has recently emerged as a popular solution to protect the intellectual property rights (IPR) of generative text-to-image (T2I) models and prevent unauthorized redistribution. In this work, we reveal a previously unexplored systematic vulnerability in existing generative model fingerprinting methods: they lack robustness against collusion attacks, where multiple attackers combine their models to remove or obscure the fingerprints. To address this issue, we take the first step towards a robust fingerprinting method for T2I models with anti-collusion capabilities. The proposed method encodes strings of bits, namely fingerprints, into the coefficients of a personalized normalization module (PNM) incorporated into T2I models, so that fingerprints can be reliably recovered from any generated image. To defend against collusion attacks and prevent unauthorized model redistribution, we introduce an anticollusion mechanism based on lossless function-invariant parameter transformations. This mechanism significantly degrades the image generation quality of colluded models, making them effectively unusable. Moreover, our method allows developers to efficiently create multiple copies of fingerprinted T2I models by reparameterizing the PNM without the need for retraining. We also introduce a worst-case optimization strategy to improve robustness against model-level attacks. Our experiments demonstrate that the proposed method achieves high fidelity and robustness across multiple T2I image generation and editing tasks, with fingerprint extraction accuracy exceeding 99.5%. Compared with existing methods, our method demonstrates, for the first time, a notable proactive robustness to collusion attack by significantly increasing the FID of colluded models.
T2I Model
Fingerprinted T2I Model
Fingerprints Embedding
Fingerprinted T2I Model
…
Model Collusion
Colluded T2I Model
“prompts”
Fingerprint Verification
Generated Image
Good Image Quality
Low Match Accuracy
…
Proposed Method
arXiv:2606.12977v1 [cs.CV] 11 Jun 2026
Jianwei Fei, Member, IEEE, Yunshu Dai, Student Member, IEEE Zhihua Xia, Member, IEEE, Xiaochun Cao, Senior Member, IEEE, Jiantao Zhou, Senior Member, IEEE, Alessandro Piva, Fellow, IEEE, and Benedetta Tondi, Senior Member, IEEE
T2I Model
Fingerprinted T2I Model
Fingerprints Embedding with ACT
“prompts”
Fingerprinted T2I Model
…
Model Collusion
Colluded T2I Model
Poor Image Quality Generated Image
Fig. 1: T2I model fingerprinting under collusion attacks. While existing methods allow colluders to obtain functional models that retain good image quality but exhibit low fingerprint matching accuracy, our proposed method effectively disables the collusion. By integrating the Anti-Collusion Transformation (ACT), any attempt to collude results in bad image quality, rendering the colluded model unusable.
I. I NTRODUCTION Jianwei Fei and Alessandro Piva are with the University of Florence, Florence, Italy (e-mail: fei [email protected]; [email protected]); Yunshu Dai and Xiaochun Cao are with the Shenzhen Campus of Sun Yatsen University, Shenzhen, China (e-mail: [email protected]; [email protected]); Zhihua Xia is with the College of Cyber Security, Jinan University, Guangzhou, China (e-mail: xia [email protected]); Jiantao Zhou is with the State Key Laboratory of Internet of Things for Smart City, and also with the Department of Computer and Information Science, Faculty of Science and Technology, University of Macau (e-mail: [email protected]); Benedetta Tondi is with the University of Siena, Siena, Italy (e-mail: [email protected]). This work was supported in part by Macau Science and Technology Development Fund under 001/2024/SKL, 0119/2024/RIB2 and 0110/2025/R1B2; in part by Research Committee at University of Macau under MYRG-CRG202500031-FST and MYRG-GRG2025-00086-FST; in part by the Guangdong Basic and Applied Basic Research Foundation under Grant 2024A1515012536. This work was also supported in part by the National Natural Science Foundation of China under Grant 625B2187, U23B2023, and 62472199, in part by Guangdong S&T Program under 2026B0101100003, by Guangdong Key Laboratory of Data Security and Privacy Preserving under 2023B1212060036, Guangdong Hong Kong Joint Laboratory for Data Security and Privacy Protection under 2023B1212120007, by the basic and Applied Basic Research Foundation of Guangdong Province under 2025A1515011097, and by the Outstanding Youth Project of Guangdong Basic and Applied Basic Research Foundation under 2023B1515020064. Corresponding author: Jiantao Zhou
Recent progress in deep image generative models, particularly latent-diffusion-based text-to-image (T2I) models [1], has achieved remarkable breakthroughs in realism. These models enable high-quality text-guided image generation and editing, thus driving widespread application and leading to a continuous evolution of commercial tools [2], [3], [1]. As these models are increasingly integrated into commercial products and services, the substantial resources required for their development render them intellectual property (IP) with valuable economic worth. Consequently, there is a strong demand for IP rights (IPR) protection against infringements such as unauthorized model redistribution. To this end, recent studies have proposed generative model watermarking [4], [5], [6], [7] and fingerprinting [8], [9] to support IPR protection and attribution. Watermarking methods primarily fine-tune the model with additional optimization objectives to ensure that every image generated by the watermarked model contains a prescribed watermark for IPR protection. In contrast, fingerprinting methods embed user-specific
2
identifiers, i.e., fingerprints, in different model copies to ensure user traceability. Fingerprinting methods can efficiently produce individualized fingerprinted models for each user [10], [8], [9] without requiring retraining. In modern commercial settings, models are often developed and distributed as licensed copies to multiple users. Therefore, fingerprinting methods are particularly suitable for IPR protection and responsibility attribution due to their flexibility. However, distributing distinct fingerprinted model copies to users introduces the collusion vulnerability. Due to the need for data privacy and local customization, users may have access to these distributed model weights. This empowers two or more malicious users to easily combine their models to produce a colluded copy that either contains no registered fingerprint [11] or is erroneously attributed to non-participating parties. A simple yet highly realistic and effective collusion strategy is to average the parameters of the involved models [12]. Malicious users can exploit this parameter-level collusion to completely wipe out fingerprints with zero computational cost, all while preserving the model’s generation capabilities. As noticed in recent works [6] and verified in Sec. VI, the collusion attack yields a colluded model that can generate high-quality images, while the extracted fingerprint shows low matching accuracy with any individual colluder. To the best of our knowledge, this threat has not been addressed so far in existing generative model fingerprinting research. To address this limitation, we propose, for the first time, a T2I model fingerprinting framework explicitly designed to resist collusion attacks. Our method ensures that, even when fingerprinted models are colluded, the resulting model fails to generate high-quality images, effectively preventing unauthorized use. Specifically, we introduce a personalized normalization module (PNM) for model fingerprinting, inspired by Fei et al. [8], who proposed the use of personalized normalization layers for fingerprinting generative adversarial networks (GANs). The PNM is integrated into the decoder of the variational autoencoder (VAE) of a pre-trained T2I model. The parameters of the normalization layer of the PNM are generated by fingerprint encoders conditioned on the assigned fingerprints. The VAE decoder is then fine-tuned to ensure that the generated images encode the fingerprints while maintaining high image quality. Simultaneously, a fingerprint decoder is trained to extract the fingerprints from the images generated by the VAE. During deployment, each user is assigned a unique fingerprint, from which the PNM parameters are generated via the fingerprint encoders, to create a personalized model copy without retraining or fine-tuning. To defend against collusion attacks, we design a lossless anti-collusion transformation (ACT) that is integrated into the proposed PNM. The ACT applies user-specific transformations to the parameters of the PNM layers, ensuring that the collusion of two or more models compromises the image generation capability of the colluded model. Specifically, three operations, namely, parameter permutation, scaling, and sign flip, are applied to modify the PNM parameters in a userdependent manner, while preserving the original output. These transformations guarantee that when multiple models are colluded, the image generation capability of the colluded model
is disrupted, as shown in Fig. 1. To further enhance fingerprint robustness against model-level modifications such as pruning and fine-tuning, we introduce an optimization strategy that minimizes fingerprinting loss under the worst-case parameter perturbation. At each fine-tuning iteration, the model is optimized over parameter perturbations in a neighborhood that maximizes the fingerprinting loss. Experimental results show that our method significantly increases the Fréchet Inception Distance (FID). For example, under a 2-party collusion attack on the COCO dataset using Stable Diffusion v2, the FID rises from 23 to 79, substantially reducing the usability of colluded models. Moreover, our method maintains good performance under model-level and image-level attacks, achieving a high fingerprint extraction accuracy even when the generated images suffer from severe quality degradation. The contributions of our work can be outlined as follows. • We develop a fingerprinting method for T2I models that enables distributors to efficiently create model copies with distinct fingerprints without additional training. To enhance robustness against collusion attacks, we propose the ACT, ensuring that colluding multiple models disrupts the generation capability of the colluded model. • We propose a worst-case embedding strategy that increases the fingerprint robustness to model-level attacks, particularly against fine-tuning. • We introduce a rigorous framework for fingerprint verification and use it to evaluate the performance, considering two different scenarios: i) the claim-based verification scenario, where a claim on the specific fingerprinted model/user has to be verified; and ii) the identification scenario, where ownership is established and then the specific model/user is identified. • We conduct extensive experiments on both T2I generation and text-based image editing tasks, covering diverse datasets, COCO and ImageNet for generation, MagicBrush and InstructPix2Pix for editing, with multiple diffusion-based models. The results demonstrate that our method consistently improves the state-of-the-art in terms of security against collusion attacks as well as robustness to both image-level and model-level attacks. II. R ELATED W ORK A. Generative Model Watermarking Watermarking has been adopted as a solution to protect the IPR of deep neural network (DNN) [13], [14], [15], [16]. Generative model watermarking is a branch of DNN watermarking that focuses on generative models, including GANs [4], [5], [7] and latent diffusion models (LDMs) [6]. Most methods were designed for a black-box and, in particular, a box-free watermarking scenario, which represents the most interesting category. In black-box watermarking, the watermark is embedded in the behavior of the model output in correspondence to some specific inputs, referred to as triggers [17], [18]. The watermark is then extracted by querying the model through its API in a black-box setting. In box-free watermarking, the model is modified so that every output contains an extractable watermark, enabling ownership verification without accessing
3
the model. Note that, unlike generative models designed for image watermarking [19], the carrier of generative model watermarking methods is the model parameters, consequently, their objectives and methodologies differ. Yu et al. [4] introduced the first multi-bit, box-free GAN watermarking method via dataset watermarking. This method embedded a watermark into the training dataset so that any GAN trained with the watermarked dataset produced images containing the watermark. Zhao et al. [17] extended the dataset watermarking approach to diffusion models and also found that the diffusion model trained on a watermarked dataset generated images containing the watermark. Fei et al. [5] proposed the first supervised boxfree GAN watermarking method by fine-tuning GANs with an additional loss function using a pre-trained watermarking decoder and a predefined watermark. Similarly, Lin et al. [20] proposed an improved bi-directional supervised embedding strategy for image translation models, which integrated a pretrained watermarking decoder to supervise the watermark embedding for both the source domain and the translated domain. Zhang et al. [21] proposed a structure-consistent watermarking method for image processing networks, which aligned watermarks with image structures to improve robustness against augmentation attacks. Recent works have focused on diffusion models. In [6], the supervised embedding approach was extended to LDM [6], by fine-tuning the VAE component. In addition, some works also proposed to fine-tune the UNet [22], [23]. Beyond 2D images, pre-trained watermarking decoders were also used to watermark 3D generative models for IPR protection [24], [25], [26]. B. Generative Model Fingerprinting Beyond watermarking, recent research has explored methods for model fingerprinting. The goal of fingerprinting is to insert unique identifiers (fingerprints) into copies of a model, thus creating different fingerprinted copies that can be distributed to different users. The user-specific fingerprint can then be used for user traceability and to track unauthorized re-distribution [27]. In recent work, fingerprints were used to modulate the parameters of specific/purposely added layers [10], [9], [28] or architectures [8], [29]. For efficient generation, the creation of new fingerprinted model copies typically does not require re-training or fine-tuning, but only that the parameters are adjusted based on the fingerprints. Yu et al. [10] introduced a pioneering GAN fingerprinting method. The method embedded binary fingerprints into model parameters via weight modulation [30]. The GAN was finetuned to enable fingerprint extraction from generated images via a decoder. This method can efficiently produce new fingerprinted models by altering the fingerprint and adjusting the parameters via modulation. A similar method for diffusion models by modulating the weights of the VAE decoder has been proposed in [9]. Fei et al. [8] also developed a retrainingfree GAN fingerprinting method that resorted to a personalized normalization layer. The parameters of the normalization layer were modulated by the fingerprints to create model copies. Feng et al. [23] introduced a LoRA-based fingerprinting method for T2I models that also enabled flexible fingerprint updates.
C. Collusion Attacks Challenges The collusion attack, where two or more colluders combine their fingerprinted copies to remove the fingerprint [31], is a well-known threat in traditional media fingerprinting [32]. This threat also exists in the context of model fingerprinting, and recent studies have demonstrated that model collusion can degrade fingerprint verification performance [6], [7], while retaining high-quality image generation. Motivated by this, we aim to address the following unexplored problem: Can collusion attacks be proactively prevented in the context of generative model fingerprinting? Traditional image fingerprinting methods rely on traitortracing codes or group testing [33], [34] to identify colluders. However, applying these methods to generative model fingerprinting has two limitations: (1) the limited bit capacity of existing model fingerprinting methods might be insufficient to guarantee the redundancy required for traitor-tracing encoding; and, more importantly, (2) traitor-tracing schemes are designed for post-hoc attribution, and can be used to identify colluders only after a colluded model has been created. They also require the application of a tracing algorithm. In this work, we address for the first time the collusion attack threat in generative model fingerprinting. We propose a fundamentally different solution that leverages the new paradigm of generative model fingerprinting, where fingerprints are embedded in the functionals (i.e., models) rather than directly in the signals (i.e., generated images) as in traditional media fingerprinting [35]. Our method proactively mitigates collusion attacks by disabling model functionality, rendering any colluded model unusable.
III. P RELIMINARIES A. Text-to-Image Diffusion Models Diffusion models are a class of generative models capable of synthesizing high-quality images by gradually denoising random noise [36], [37]. These models can accept various conditioning inputs, such as textual descriptions (prompts) and other constraints, enabling text-to-image and controlled image generation [38], [39]. Early methods perform the diffusion process in the pixel space [40], [36], [41], [42] with U-Net as the denoising backbone, which is computationally demanding. To improve generation efficiency, Rombach et al. [1] introduced the LDM, which performs denoising in the latent space of a pre-trained VAE using the U-Net backbone. During inference, the reverse diffusion process is initialized from pure noise in the latent space and progressively denoises it to obtain the latent representation of the image, denoted as z0 , conditioned on the input prompt. The final image is subsequently generated by passing z0 through the VAE decoder, i.e., x̂ = D(z0 ). Due to the superior scalability and efficiency, LDM has become the mainstream framework for modern diffusion models [43], including state-of-the-art variants that replace the U-Net backbone with DiT [44]. Therefore, our work focuses on latent diffusion models, which, without exception, rely on a VAE for final image synthesis.
4
B. Fingerprint Verification
•
We consider a scenario where a model provider distributes distinct fingerprinted generative models (copies) to M users. Each user i ∈ {1, . . . , M } is associated with a unique fingerprint m(i) . The distributor uses the user-specific fingerprint m(i) to instantiate a new model M(i) that is released to user i. The goal is to verify whether a suspicious image x is generated by a claimed fingerprinted model, or by one of the M models of the distributor, and identify the responsible model.1 A binary fingerprint m is extracted from the image x via the fingerprint decoder W, i.e., m = W(x). We define the bit-wise matching accuracy (Bit Acc) between the extracted fingerprint and a given fingerprint m(i) as:2 d
(i)
p
1X (i) 1 mj = mj , = Acc(m, m ) = d j=1 (i)
(1)
where d is the number of bits, 1(·) is the indicator function that outputs 1 if the condition is true and 0 otherwise. A threshold τ ∈ [0, 1] is used to determine whether a match is considered valid. We consider two fingerprint verification scenarios detailed in the following: 1) Claim-based verification: “Was x generated by the claimed user/model?”. In this scenario, a claim is made about the model that generated the image, i.e., model M(claim) , or equivalently, the model associated with fingerprint m(claim) . The binary hypothesis testing problem can be defined as: • H1 : The image was generated by the claimed model. • H0 : The image was generated by a non-fingerprinted model or a different fingerprinted model. We verify the claim by comparing the extracted fingerprint m with m(claim) . If the match is above τ , i.e., Acc(m, m(claim) ) > τ , the claim is accepted and the image is attributed to M(claim) (decision for H1 ). To evaluate performance, we compute the true positive rate (TPR) and false positive rate (FPR) as: TPR = N (p(claim) > τ | H1 )/N (H1 ), FPR = N (p(claim) > τ | H0 )/N (H0 ),
(2)
where N (·) denotes the number of samples x satisfying the the specified event. In practice, τ is chosen to achieve a desired TPR while keeping FPR below a desired threshold. τ is estimated empirically using a validation dataset containing both positive and negative samples. 2) Identification (with rejection): “Was x generated from one of the models from the distributor? If yes, which specific model generated it?” In this scenario, no claim is provided. The authority aims to determine if any of the fingerprinted models generated the image x, and, in case of a positive answer, which is the specific model. The problem of detecting whether the image comes from a model of the distributor can be modeled as a binary hypothesis test: • H1 : x was generated by one of the fingerprinted models. 1 A similar approach can be used to verify the identity of a suspicious model, assuming that the model can be queried to generate at least one image. 2 To keep the notation light, we omit the explicit dependence on x in p(i) (and also S, defined in Eq. (3)).
H0 : x comes from a non-fingerprinted model.
If H1 is accepted, the image is attributed to the model with the highest Bit Acc. More formally, let us define the set of candidate models M(i) , i.e., those models whose fingerprints match the extracted fingerprint m for a given threshold τ : n o S = M(i) , i ∈ {1, . . . , M } | p(i) > τ . (3) If S ̸= ∅, a decision for H1 is made. The image is attributed to the model in S with the highest matching accuracy: ∗
M(i ) , with i∗ = arg max p(i) . M(i) ∈S
(4)
The performance of identification with rejection can be evaluated using the following metrics: 1) the TPR and FPR of the binary hypothesis test (i.e., the rejection test), where TPR =
N (S ̸= ∅ | H1 ) , N (H1 )
FPR =
N (S ̸= ∅ | H0 ) . N (H0 )
(5)
2) the Correct Identification Rate (CIR), measuring the percentage of images from fingerprinted models (H1 ) for which H1 is accepted and which are attributed to the correct model. Formally: CIR = N (M(t) ∈ S) ∧ (p(t) > p(i) , ∀i ̸= t) H1 /N (H1 ), (6) where M(t) denotes the ground-truth fingerprinted model. In the following, we refer to these two scenarios as fingerprint verification and identification, respectively. IV. M ETHODOLOGY A. Framework Overview The workflow of the proposed framework, as shown in Fig. 2, is structured in 3 phases: Fingerprinting Model Finetuning, User Fingerprinted Model Initialization, and User Verification. 1) Phase I: Fingerprinting Model Fine-tuning: The developer first integrates the Personalized Normalization Module (PNM) into the T2I model. The fingerprint encoder and decoder are jointly trained with the model to ensure accurate embedding and extraction. Detailed training objectives and loss functions are provided in Sec. IV-B. 2) Phase II: User Fingerprinted Model Initialization: Once the components are trained, the developer can efficiently instantiate uniquely fingerprinted model copies without retraining. As illustrated in the middle of Fig. 2, this process involves 4 sequential steps: 1) User Registration, where a user is assigned a unique ID and a binary fingerprint FPi ; 2) Model Initialization, where FPi is mapped to PNM parameters via the pre-trained encoders (details in Sec. IV-C); 3) Transformation Generation, where user-specific ACT keys are deterministically derived from the User ID; and 4) ACT Application, where these transformations are applied to the PNM parameters to proactively prevent collusion. The final model is then released to the user.
5
I. Fingerprinting Model Fine-tuning …
Developer
II. User Fingerprinted Model Initialization
User 1 User N
T2I Model with PNM
Fingerprint 1 … Fingerprint N
T2I
Model {𝜸(𝒊) , 𝜷(𝒊) }= User (𝑖)
T2I Model User (i)
T2I Model User 1
T2I Model User (i)
SF
T2I Model
*Image Access via API
User-specific transformation seed
Fingerprint 𝒊 FP Encoder
Verification
④ User-specific ACT
SC
FP Encoder
② Fingerprinted Model Initialization
Fingerprint Database Fingerprint 𝑖 → User 𝑖
User ID
CP
FP Decoder
③ User-specific Transformation Generation
① User Register
Train
III. User Verification
T2I Model User N
(w/ ACT)
Fig. 2: Application workflow of the proposed framework.
Fingerprinting Model Fine-tuning
0 1 1 0
𝑧
𝒲
x'
ReLU
Linear
Fingerprint Decoder Personalized Normalization Module (PNM) F 0 ℝ𝑐×ℎ×𝑤 Fingerprint Encoder ℱ𝛾 Linear
LDM Encoder LDM Decoder
m
Linear
1 1 0 1
Linear
We illustrate the fine-tuning pipeline in the upper part of Fig. 3. To fingerprint the T2I model, the original VAE decoder D is modified by inserting an intermediate PNM, whose parameters γ and β are given by two (trainable) encoding networks, Fγ and Fβ , fed with the fingerprint message m as input. The modified decoder is fine-tuned (with the encoder E frozen) for fingerprint embedding, as detailed in Section IV-B2. The fingerprint decoder W is jointly trained to extract the fingerprints from the images generated by the VAE decoder. We denote the fingerprinted VAE decoder by Dm , which replaces the original one D inside the T2I model, thus obtaining the fingerprinted T2I model that can be used for image generation. Note that the denoising U-Net and text encoder are not involved in the fine-tuning process. 1) Personalized Normalization Module: The details of the personalized normalization module (PNM) are shown in the lower part of Fig. 3. The idea behind the use of personalized normalization is inspired by Fei et al. [8], where it was first introduced for GAN fingerprinting. In this work, we extend the idea to T2I models by designing a Conv–Norm–Conv structured PNM, which enables the integration of the proposed ACT against collusion. The detailed operations performed inside our PNM are detailed below, while the details on the ACT are provided in Section IV-C. Given a fingerprint message m ∈ {0, 1}d , the outputs of the two encoding networks Fγ and Fβ are used for the normalization operation, providing, respectively, the scaling and shift parameters. In addition, two 1 × 1 convolution layers (without bias parameters) are placed before and after the normalization layer. Let F (0) ∈ Rc×h×w be the input feature of PNM, where c, h, and w represent the number of channels,
x
𝒟 latent
PNM
ℒ𝑖
ℰ B. Fingerprint Model Fine-tuning
ℒ𝑚 + ℒ𝑟𝑒𝑔
m
ReLU
3) Phase III: User Verification: When a suspicious image is encountered, the model owner uses the pre-trained Fingerprint Decoder to extract the signature. This extracted fingerprint is then matched against the Fingerprint Database to identify the specific user or detect potential collusion, following the verification protocols defined in Sec. III-B.
Scaling Parameters 𝛾
0 1 0 1
m'
Conv Layer1
F 1 ℝ𝑐×ℎ×𝑤 Shift Parameters 𝛽
Fingerprint Encoder ℱ𝛽
Norm Operation 𝜸 ⋅conv1 𝑭0 + 𝜷
Conv Layer2
F 2 ℝ𝑐×ℎ×𝑤
Fig. 3: Pipeline of the proposed fine-tuning method.
height, and width, respectively. The output feature map F (2) of the PNM is computed as: F (2) = Conv2 (F (1) ) = Conv2 (γ · Conv1 (F (0) ) + β), (7) where Conv2 and Conv1 denote the convolution operation, and · denotes element-wise multiplication. γ = Fγ (m) and β = Fβ (m) are vectors in Rc . To enable element-wise operations with the intermediate feature map Conv1 (F (0) ) ∈ Rc×h×w , both γ and β are broadcast to match its shape. Specifically, broadcasting extends each c-dimensional vector into a 3D tensor of shape Rc×h×w by replicating the values of each channel across all spatial positions (i.e., along the height and width dimensions). The normalized intermediate feature map F (1) is then passed through the second convolutional layer Conv2 to produce the final output F (2) .
6
2) Fine-tuning Objective: In the following, we describe the fine-tuning loss objective in detail. To instruct the network to embed a different fingerprint inside the output images for every different input message, we randomly sample m ∈ {0, 1}d at every step. We use the networks Fγ and Fβ to get from m the scaling and shift parameters γ and β used in the PNM. Simultaneously, we randomly sample real images and encode them to get the latent representation z using the frozen VAE encoder E, and use Dm to reconstruct the image from z. The fingerprint decoder W is jointly trained to extract the fingerprint from Dm (z). The optimization includes an image reconstruction loss, a fingerprinting loss and a regularization loss for improved robustness. Image Reconstruction Loss: The purpose of this loss is to maintain the visual quality of the images obtained from the fingerprinted Dm . We used the original image loss employed during the training of the VAE [45], including learned perceptual image patch similarity (LPIPS) [46] and mean squared error (MSE) between input images x and the reconstructed images Dm (E(x)). This combination of these two loss terms ensures a balance between pixel-wise error and perceptual similarity [47], [48]. Specifically, LPIPS is measured by the high-level features extracted by a pre-trained VGG network ϕ: X LLPIPS = wl · ∥ϕl (x) − ϕl (Dm (E(x)))∥22 , (8) l
where x and Dm (E(x)) are the input and reconstructed images, ϕl (x) represents the feature map of image x extracted from the l-th layer of ϕ, and wl is a learned weight for layer l. Then, the image reconstruction loss is expressed as: 2
Li = λlpips LLPIPS + λmse ∥Dm (E(x)) − x∥2 .
(9)
Fingerprinting Loss: It instructs the fingerprint decoder W to extract the fingerprints from the images produced by Dm . The binary cross-entropy (BCE) between the input fingerprint and the output of the fingerprint decoder is considered: Lm =
d X
mj log σ(W(Dm (E(x)))j )
j=1
that maximizes the fingerprinting loss within a neighborhood. Formally, the proposed objective is defined as: Lreg = Lm x, m; θDm + δ ∗ , where δ ∗ = arg max Lm x, m; θDm + δ , s.t. ∥δ∥ < ξ. δ
(11) where θDm is the parameter vector of Dm and ξ is an upper bound for the perturbation. δ ∗ denotes the worst-case perturbation. Since solving (11) exactly is computationally expensive, we propose to approximate δ ∗ via a single-step gradient ascent: δ ∗ = η1 · ∇θDm Lm (x, m; θDm ),
(12)
where η1 is a step size controlling the magnitude of the perturbation. While theoretically δ ∗ should be projected onto the ξ-sphere (i.e., ξ · ∇L/∥∇L∥), we found that a fixed step size η1 acts as an effective proxy for the worst-case perturbation in practice and reduces computational overhead. Specifically, at (i) each fine-tuning step i, given the current parameters θDm , we compute the perturbed parameters in the regularization loss as: (i∗)
(i)
(i)
θDm = θDm + δ ∗ = θDm + η1 · ∇θ (i) Lm (x, m; θD(i) ). Dm
m
(13) This newly designed regularization term is minimized jointly with the other losses to update the model parameters θDm . Compared with standard training, the regularization ensures that, under a worst-case perturbation of the VAE parameters, the fingerprinting loss remains low, thereby improving the robustness of the fingerprints against model parameter modification, introduced, for instance, via fine-tuning. Therefore, the overall loss used to fine-tune the VAE is L(x, m; θD ) = Li + λm Lm + λreg Lreg ,
(14)
where λm and λreg are the weights applied to each loss term. At the end of the fine-tuning procedure, the following four models are obtained: the fingerprinted VAE decoder Dm , the fingerprint decoder W, and fingerprint encoders Fγ and Fβ . C. User Fingerprinted Model Initialization with ACT
(10)
+ (1 − mj ) log(1 − σ(W(Dm (E(x)))j )), where σ(·) denotes the sigmoid function. Minimizing Lm corresponds to minimizing the bit-wise error. Remind that E is frozen and only Dm and W are trained. Worst-Case Regularization Loss: To proactively enhance the robustness of the fingerprinted model against parameter perturbations, we propose a novel worst-case regularization Loss. Unlike standard optimization objectives that often lead to sharp minima sensitive to modifications, our designed loss term explicitly aims to encourage the model to converge to a wider, flatter minimum of the fingerprinting loss Lm . In this way, the model should be less sensitive to small perturbations in the parameter space, such as those introduced during fine-tuning, thereby preserving the embedded fingerprints. To achieve this, we formulate a min-max optimization objective where we consider the perturbation of the parameters
Once a new user (i) comes, a model containing the userspecific fingerprint m(i) is obtained by assigning to the normalization layer in the PNM layer the corresponding parameters obtained from the trained encoding networks, that is, γ (i) = Fγ (m(i) ) and β (i) = Fβ (m(i) ). Furthermore, a userdependent ACT is applied to the parameters of the PNM to enable robustness against collusion attacks (the details of the ACT are provided below). While the fingerprinted T2I model M(i) is then distributed to the user, the two trained encoding networks Fγ and Fβ , used for setting user-dependent parameters of the PNM in Dm , and the trained fingerprint decoder W, used for the extraction of the fingerprint in the fingerprint verification phase, are not distributed. Objective and Motivation. Recent studies have shown that the parameter space of deep neural networks exhibits notable connectivity and flatness. Garipov et al. [49] and Draxler et al. [50] demonstrated that independently trained models lie on a connected low-dimensional manifold. As a
7
consequence of such mode connectivity, linear interpolation between two independently trained models often gets wellperforming solutions. Izmailov et al. [51] further showed that averaging model parameters not only preserves model performance but often also improves generalization. These findings suggest that parameter interpolation or averaging is an effective way to maintain model fidelity. However, this property may facilitate collusion attacks, since attackers can exploit parameter-space connectivity to remove or forge embedded fingerprints. The proposed ACT allows for counteracting this by applying user-specific, function-preserving transformations to the model. By deliberately reshaping the parameter space while keeping the generation quality unchanged, ACT breaks the mode connectivity that colluders rely on. The analysis carried out in Sec. VI-D provides empirical evidence of ACT’s effectiveness against collusion attacks. Pipeline. Once Dm is trained, its PNM can be efficiently initialized with distinct fingerprints to produce different model instances, as shown in Sec. IV-A2. Before distributing the fingerprinted models to users, we apply a user-specific ACT to the PNM. As shown in Fig. 2, we combine three operations: parameter permutation, scaling, and sign flip. These transformations are applied sequentially and are parameterized by user-specific keys. Recall that the PNM is a Conv-NormConv module, and F (0) is the input, F (1) and F (2) are the intermediate and final outputs of PNM, respectively. We say a transformation preserves the function of the PNM if for all input F (0) , the output F (2) remains unchanged. Below, we formally define each transformation. The theoretical guarantees of function preservation are provided in Appendix A. Channel-wise parameter Permutation (CP). CP aims to rearrange the parameters of the PNM layers without changing the output. Consider the PNM operation given by Eq. (7), where W (1) and W (2) denote the kernels of Conv1 and Conv2 , respectively. These are 4-dimensional tensors with shape C × C × k × k, where we set the input and output channel dimensions equal to ensure PNM can be inserted at any position in Dm . Let Wi ∈ RC×k×k denote the i-th filter in kernel W , and Wi,j ∈ Rk×k the j-th channel of the i-th filter. (0) For input feature map F (0) with i-th channel Fi ∈ Rh×w , after Conv1 and normalization, the c-th channel is: Fc(1) = γc ·
C X
(0)
Fi
(1)
∗ Wc,i + βc ,
(15)
function π is randomly generated for each user using their unique user ID as the random seed. This ensures reproducibility while providing distinct transformations across users. Parameter Scaling (SC). SC is the second transformation considered in the ACT framework. It modifies the magnitude of convolutional and normalization parameters in such a way that the overall function of the PNM remains unchanged. Specifically, given scaling vectors α(1) , α(2) , α(3) , α(4) ∈ RC , we define the scaled parameters of the PNM as follows: f (1) = α(1) · W (1) , ∀i, W i i i f (2) = α(2) · W (2) , ∀i, j, W i,j
j i,j (3) ei = αi · γi , ∀i, γ (4) βei = αi · βi , ∀i,
(18)
where α(1) , α(2) , α(3) , α(4) ∈ RC , and such that (1)
(2)
(3)
αi αi αi
(2)
(4)
= 1, αi αi
= 1, ∀i.
(19)
To obtain the scaling vectors, a random generator is used to sample α(1) and α(2) with a user-specific random seed. Then, α(3) and α(4) are derived accordingly to satisfy the constraints in Eq. (19). Hence, scaling is applied across the filter dimension of W (1) and the channel dimension of W (2) , and to β and γ, with the above constraints ensuring that the output does not change. Sign Flip (SF). The third transformation in the ACT framework is sign flip, which inverts the signs of parameters in the PNM while ensuring the outputs remain equivalent. By making the parameter sign-flipping user-dependent, this operation provides additional parameter obfuscation. The sign flip transformation applies element-wise sign changes to the convolutional kernels and normalization parameters. Specifically, we define sign flip vectors α̂(1) , α̂(2) , α̂(3) , α̂(4) ∈ {−1, 1}C , where α̂(1) and α̂(2) ∈ {−1, 1}C are generated independently using user-specific random seeds, while α̂(3) and α̂(4) are determined by the same constraints in Eq. (19). The transformed parameters are then obtained as Eq. (18) by replacing the scaling vectors with the sign flip vectors. Hence, sign flip is a special case of parameter scaling where scaling factors are constrained to {−1, 1}. The security of the ACT is also analyzed in the appendix (Appendix B), where the complexity of achieving parameter alignment across different users is evaluated.
i=1
where * represents the convolution operation, γc and βc are the c-th normalization parameters. After Conv2, the c-th output channel becomes: C X (1) (2) Fc(2) = Fj ∗ Wc,j . (16) j=1
Let [C] := {1, 2, . . . , C}. The CP operation applies a permutation function π : [C] → [C] to rearrange parameters as: f (1) := W (1) , W i π(i)
ei := γπ(i) , γ
f (2) := W (2) , W i,j i,π(j)
∀i, j ∈ [C]
ei := βπ(i) , β
∀i ∈ [C] (17)
This permutation modifies filters in W (1) , channels in W (2) , and normalization parameters consistently. The permutation
V. E XPERIMENTAL R ESULTS ON F IDELITY AND E FFECTIVENESS A. Settings Datasets and Tasks. We considered both T2I image generation and text-based image editing tasks. We fine-tuned the VAE decoder for fingerprinting using the MS-COCO-2017 train set [52]. The evaluations are based on the MS-COCO2017 val set (generation task), ImageNet [53] (generation task), MagicBrush [54] (editing task), and InstructPix2Pix [55] (editing task). All images are first resized such that the shorter side is scaled to 512 pixels while maintaining the aspect ratio, followed by a random crop to obtain a final image of size 512×512. For image generation from text, following common
8
B. Evaluation Metrics To evaluate the impact of the fingerprint on the performance of image reconstruction, we measured the peak signal-to-noise ratio (PSNR), the structural similarity index (SSIM), and the learned perceptual image patch similarity (LPIPS). The quality of the image generation is also measured via the FID score. Finally, we also considered the CLIP score [57] to measure the semantic similarity between the generated image and the prompt. Specifically: i) To evaluate image reconstruction performance, we measured PSNR, SSIM, and LPIPS between images reconstructed by the fingerprinted VAE and: (1) the reconstructed images produced by the non-fingerprinted model (baseline); (2) the original (real) images. The corresponding metrics are referred to respectively as PSNRb , SSIMb , 3 As [17] belongs to the black-box watermarking category, comparison is done only on fidelity.
and LPIPSb (b = baseline), and PSNRr , SSIMr , and LPIPSr (r = real). ii) To evaluate image generation performance, we measured the FID between images generated by the fingerprinted model and real images, and CLIP score (scaled to [0, 1]) between generated images and the prompt. The effectiveness of the fingerprinting method is evaluated via the bit-wise matching accuracy (Bit Acc, %) between the extracted fingerprint and the ground truth fingerprint, given by Eq. (1). To evaluate the fingerprint verification performance, we also measured the TPR/FPR and the CIR (in the identification case) given by Eq. (2) and Eq. (5)-(6). Ours
Pixel difference (x5)
A realistic photo of an astronaut riding a horse on the moon
No fingerprint
a mountain cabin surrounded by snow, winter morning
practice [6], [9], we selected a caption per image in the COCO and ImageNet datasets as the input prompt. For image editing, we used: i) MagicBrush, which provides (image, mask, prompt) triplets, comprising a source image, a binary mask that indicates the region to be modified, and a prompt describing the intended modification; and ii) InstructPix2Pix, which provides source images paired with editing prompts. Models. We considered multiple models, including Stable Diffusion v2-base (SD2) for T2I generation, and SD2-inpainting for the MagicBrush dataset, and the InstructPix2Pix model. Note that they share the same VAE, so we only need to modify and fine-tune the decoder once, which can then be used across these models. The PNM was inserted before the final convolutional layer in Dm with C = 128. Fγ and Fβ are 2-layer fully connected networks with 128 neurons and LeakyReLU activation (negative slope = 0.1) [56]. The fingerprint decoder W is implemented via an EfficientNet-B0. Fγ and Fβ are randomly initialized, while W is pre-trained on ImageNet. We used 48-bit fingerprints (i.e., d = 48), which is the same payload used in [6]. Following common practice, a noise layer is introduced in the scheme before the fingerprint decoder, performing data augmentation on the VAE reconstructed image. This procedure forces the VAE decoder to embed a more robust fingerprint that can survive processing. The operations we considered are random Gaussian blurring, brightness adjustment, contrast adjustment, Gaussian noise, horizontal flipping, JPEG compression, and random cropping with factors chosen from 0.5 to 0.9. Given an image, a processing in the above set is randomly chosen and applied with probability 70%, while the image is left unchanged with probability 30%. With regard to the comparison of fingerprinting methods, we consider both U-Net-based methods AquaLoRA [23] and WatermarkDM [17]3 , and VAE-based methods Per. Norm. [8] (applied to the VAE decoder), Sta. Sig. [6] and WOUAF [9]. The hyperparameters are set as follows: λlpips = 10, λmse = 1, λm = 1, λreg = 1, and η1 = 0.05. The model is optimized using the Adam optimizer with a learning rate of 0.0003, β1 = 0.9, β2 = 0.999, and a batch size of 6.
Fig. 4: Images generated by SD2 (no fingerprint) and our fingerprinted model, along with their differences (×5). C. Performance Evaluation Fidelity. We first evaluate the impact of the fingerprinting on image quality. As shown in Table I, in terms of image reconstruction performance, our method achieves the highest PSNRb values across all models when evaluated against images generated by the non-fingerprinted model. Our method achieves competitive performance also in terms of SSIM and LPIPS, whose values are always close to those achieved by the other VAE-based methods. Since U-Net–based methods do not modify the VAE, the comparison with the non-fingerprinted model is not applicable. However, in terms of image generation quality (FID and CLIP score), U-Net–based methods lead to a notable degradation. For example, on COCO, for our method FID is 24.03, nearly matching WOUAF (23.93), Sta. Sig. (24.06) and Per. Norm. (23.97), outperforming AquaLoRA and WatermarkDM (for which FID is 24.92 and 27.45). On ImageNet, our FID is 25.46, which is 2-5 better than AquaLoRA and WatermarkDM, and better than WOUAF (26.34) and almost as good as Sta. Sig. (25.71). On MagicBrush, our method achieves 22.18, close to the best (21.76 of Per. Norm.), and better than WOUAF (22.24) and Sta. Sig. (22.40). This advantage is consistent in image editing. Our method achieves the best or second-best FID on both MagicBrush and InstructPix2Pix, and the change in FID relative to the non-fingerprinted model is within 0.5, which is 2–3 points better than U-Net–based methods and also superior to VAE–based methods. CLIP
9
TABLE I: Performance of model fingerprinting on various datasets and tasks. for T2I and also image editing (PSNR ↑; SSIM↑; LPIPS↓; FID↓; CLIP↑; Bit Acc(%) ↑). ‘Generation’ refers to T2I image generation tasks based on SD2; ‘Editing’ refers respectively to text-based image editing tasks based on the SD2-inpainting and InstructPix2Pix models. ’retrain-free’ denotes whether a new fingerprinted model necessitates retraining. Dataset
CoCo (Generation)
ImageNet (Generation)
VAE
MagicBrush (Editing)
U-net
VAE
InstructPix2Pix (Editing)
PSNRr
No fingerprint
-
-
28.55
-
0.805
-
0.128
23.26
0.658
-
AquaLoRA [23] WatermarkDM [17]
✓ ✗
-
28.55 28.55
-
0.805 0.805
-
0.128 0.128
24.92 27.45
0.657 0.655
95.43 -
Per. Norm. [8] Sta. Sig. [6] WOUAF [9]
✓ ✗ ✓
29.97 30.90 31.11
27.56 28.04 28.26
0.858 0.897 0.882
0.789 0.815 0.814
0.068 0.084 0.078
0.124 0.142 0.128
23.97 24.06 23.93
0.658 0.658 0.658
99.60 99.48 98.95
0.071
0.129
24.03
0.658
99.57
0.125
24.23
0.659
-
U-net
U-net
U-net
VAE
Generation FID CLIP
PSNRb
Method
VAE
Reconstruction SSIMb SSIMr
Retrain -free?
Type
LPIPSb LPIPSr
Bit Acc
Ours
✓
31.80
28.51
0.883
0.808
No fingerprint
-
-
29.58
-
0.825
AquaLoRA [23] WatermarkDM [17]
✓ ✗
-
29.58 29.58
-
0.825 0.825
-
0.125 0.125
27.65 30.14
0.659 0.654
95.26 -
Per. Norm. [8] Sta. Sig. [6] WOUAF [9]
✓ ✗ ✓
30.54 32.10 32.05
28.13 28.90 29.19
0.879 0.919 0.919
0.809 0.831 0.828
0.066 0.082 0.081
0.125 0.148 0.149
25.25 25.71 26.34
0.659 0.659 0.659
99.65 99.48 98.82 99.61
Ours
✓
32.66
29.30
0.928
0.822
0.067
0.127
25.46
0.659
No fingerprint
-
-
30.82
-
0.871
-
0.105
19.92
0.620
-
AquaLoRA [23] WatermarkDM [17]
✓ ✗
-
30.82 30.82
-
0.871 0.871
-
0.105 0.105
23.52 24.95
0.618 0.612
94.81 -
Per. Norm. [8] Sta. Sig. [6] WOUAF [9]
✓ ✗ ✓
31.41 32.63 33.01
29.01 29.83 30.22
0.898 0.928 0.924
0.844 0.861 0.850
0.053 0.066 0.062
0.106 0.120 0.109
21.76 22.40 22.24
0.620 0.620 0.620
99.59 99.51 99.17 99.49
Ours
✓
33.95
30.56
0.924
0.869
0.053
0.106
22.18
0.620
No fingerprint
-
-
33.49
-
0.936
-
0.040
13.21
0.657
-
AquaLoRA [23] WatermarkDM [17]
✓ ✗
-
33.49 33.49
-
0.936 0.936
-
0.040 0.040
14.59 16.78
0.655 0.649
95.49 -
Per. Norm. [8] Sta. Sig. [6] WOUAF [9]
✓ ✗ ✓
29.59 29.63 30.05
29.20 28.96 29.17
0.841 0.819 0.820
0.822 0.814 0.804
0.063 0.063 0.067
0.074 0.076 0.075
13.51 13.69 13.69
0.658 0.658 0.658
99.27 99.20 99.15
Ours
✓
30.02
29.84
0.879
0.845
0.060
0.069
13.06
0.658
99.46
scores are stable across all VAE–based methods (0.620–0.659), showing that semantic consistency is preserved regardless of the presence of the fingerprint, whereas U-Net–based methods cause a slight degradation in semantic consistency. In Fig. 4, we show some images generated by the original non-fingerprinted model and by our fingerprinted model, obtained using the same input prompt, in the case of SD2. The images produced by the fingerprinted model are almost indistinguishable from those produced by the original model in both semantic content and fine-grained details. Fingerprinting Performance. In the last column of Table I, we report the Bit Acc (%) achieved on all models and datasets. The reported Bit Acc is averaged over 32 random fingerprints and 1,000 fingerprinted images for each distinct fingerprint (i.e., 32,000 images per dataset). Our method achieves a Bit Acc of around 99.5% across all cases, demonstrating accurate fingerprint extraction. We observe that VAE–based methods achieve higher performance, whereas the Bit Acc of AquaLoRA is limited to 95%. Since WatermarkDM is a trigger-based black-box watermarking scheme, the watermark is not extracted from model outputs but defined as a specific output pattern corresponding to trigger inputs. Therefore, comparison in terms of Bit Accuracy is not applicable.
We further evaluate the performance of our method in fingerprint verification. The results are presented in Fig. 6a. The behavior of TPR/FPR (Eq. 2) is reported as a function of the threshold, defined as the number of matched bits (i.e., τ ×d, where d = 48). The rates are evaluated on 1024k matches under H0 and 32k matches under H1 . As the threshold increases from 35 to 47, the TPR remains consistently high (equal to 1.00 up to 41) and begins to decline thereafter, whereas the FPR is around 10−4 at 35 and drops sharply around 39 to 40. At a threshold of 41, the FPR is 0 in all cases, while the TPR is 1.0 for all cases. Therefore, in the subsequent evaluations, we fix τ = 0.85(41/48). We also computed the TPR and FPR for this case, and all methods achieved perfect performance, with TPR = 1 and FPR = 0. In Fig. 6b, we report the performance of fingerprint identification (see Section III-B) in the T2I COCO case (results are similar in the other cases). The TPR/FPR and CIR (defined in Eq. (5)-(6)) are reported as a function of the number of users, i.e., distinct fingerprinted models, when τ = 0.85. The rates under H1 (i.e., TPR and CIR) are evaluated considering 10 fingerprinted images for each user, for a total of 10 · M fingerprinted images, while the FPR is computed on 1,000 non-fingerprinted images. We see that the TPR and CIR remain
10
50 40 0.8 100
20 Ours -w/o aug Ours -with aug Per. Norm. Sta. Sig. WOUAF PSNR 0.6 0.4
Reduction Rate
15 10 5 0.2
Gaussian Noise
40 0.04
20
Std Dev
15 10 5 0.16
0 0.2
25
70 60 50 40 1.2
100
20 Ours -w/o aug Ours -with aug Per. Norm. Sta. Sig. WOUAF PSNR 1.4 1.6
40
5 1.8
0 2.0 40 35 30 25
70
50
10
Horizontal Flip
80
60
15
Enhancement Rate
90
PSNR Bit Acc
Bit Acc
25
70
50
40 30
80
60
0 0.0
35
90
Ours -w/o aug Ours -with aug Per. Norm. Sta. Sig. WOUAF PSNR 0.08 0.12
80
20 Ours -w/o aug Ours -with aug Per. Norm. Sta. Sig. WOUAF PSNR
Horizontal Flip
15 10 5 0
Contrast Enhancement
35
90
30
80
25
70 60 50 40 1.2
20 Ours -w/o aug Ours -with aug Per. Norm. Sta. Sig. WOUAF PSNR 1.4 1.6
15 10 5 1.8
Enhancement Rate
Cropping Attack
100
70
400.9
40
25 20 Ours -w/o aug Ours -with aug Per. Norm. Sta. Sig. WOUAF PSNR 0.8 0.7
Gaussian Blurring
100
15 10 5
Crop Rate
0.6
0.50
40 35
90
30
80
25
70
20 Ours -w/o aug Ours -with aug Per. Norm. Sta. Sig. WOUAF PSNR 7
60 50 40
30
80
50
0 2.0
35
90
60
40
PSNR
70
30
100
5
15 10 5 11
0 13
JPEG Compression
40
9
Kernel Size
100
35
90
30
80
25
PSNR
25
40 35
90
PSNR Bit Acc
Bit Acc
80
Brightness Enhancement
PSNR Bit Acc
30
100
PSNR Bit Acc
35
90
60
40
PSNR Bit Acc
Brightness Reduction
PSNR Bit Acc
100
70
20
60 50 40
90
Ours -w/o aug Ours -with aug Per. Norm. Sta. Sig. WOUAF PSNR 80 70
15 10 5
Quality Factor
60
50
0
1.00
10 1
0.98
10 3
0.96 0.94 0.92 0.90
FPR
consistently near 1.0, even as the number of users reaches 104 . Meanwhile, the FPR remains close to 0. Hence, given an image, the source model can be correctly identified among 104 distinct fingerprinted models released to users. These results show that our method can achieve good identification performance.4 Since the results obtained for the various tasks are very similar, in the following, we focus on T2I COCO, and results are reported for this case, unless stated otherwise.
TPR
Fig. 5: Robustness against different image-level attacks. The grey line indicates the PSNR after the attack.
10 5
TPR - CoCo TPR - Imagenet TPR - MagicBrush TPR - InstructPix2Pix FPR - CoCo FPR - Imagenet FPR - MagicBrush FPR - InstructPix2Pix
10 7
35 36 37 38 39 40 41 42 43 44 45 46 47 10
9
Threshold (in matched bits)
D. Robustness Analysis
4 It is worth stressing that the fingerprint associated with every user is chosen randomly. In principle, given a maximum number of users M (M ≪ 2d ) that the distributor wants to allocate, better performance can be achieved by choosing the d-bit fingerprints to be associated with every user by means of a suitable binary fingerprint code [58]. This analysis goes beyond the scope of this paper.
1.00
(a) TPR and FPR vs Threshold (τ × d)
0.98
0.10 0.08
0.96
0.06
0.94
FPR
CIR TPR FPR
0.04 0.00
10 00
0
0.90
50 00
0.02
30 00
0.92
10 50 1000 00
TPR / CIR
Robustness Against Image-level Attacks. Fig. 5 shows the robustness against various image-level modifications. We report the Bit Acc under various attacks, as well as the PSNR between the processed images and the original ones. To show the positive impact of the inclusion of the noise layer (which is included for all the methods), we also report the performance of the proposed method without the noise layer augmentation (denoted by ’-w/o aug’). We can observe that, as expected, in all the cases, the Bit Acc of the fingerprint decreases as the attack strength increases. The incorporation of the noise layer augmentation during fine-tuning considerably enhances the fingerprint robustness. When the attack is very strong, the Bit Acc reduces. However, the PSNR also drops, meaning that the attack strongly impairs the quality of the images, making them unusable. Regarding the comparison with the existing methods, Per. Norm. [8] and our method are those that achieve the best performance, which is similar in most cases, while for Sta. Sig. [6], the robustness is significantly lower. A possible explanation for this lies in the two-stage procedure adopted by this method, in which the fingerprint decoder and the T2I
Number of fingerprinted models (M)
(b) TPR,FPR and CIR vs M (number of users).
Fig. 6: Impact of the threshold on fingerprint verification (a) and of the number of users M on fingerprint identification (b).
VAE are optimized independently. The joint fine-tuning of the fingerprint decoder and the VAE in Per. Norm. [8] and our method forces the VAE decoder to embed a more robust fingerprint, allowing the fingerprint decoder to recover it also from processed versions of the image. We also evaluated our method against fingerprint purification attacks using deep learning-based image compression models (Cheng [59] and Ballé [60]). As shown in Fig. 7, our method shows moderate robustness, as attackers must degrade image quality with a PSNR drop of over 3 dB to reduce
11
100
Bit Acc
90 80 70 60 32.0
Cheng [59] Ballé [60] Cheng [59] (aug with Cheng) Ballé [60] (aug with Cheng) PSNR w/o attack
31.5
31.0
30.5
30.0
PSNR
29.5
29.0
28.5
28.0
80
30 20
10%
20%
30%
Pruning Rate
40%
Model Quantization
50%
Ours -w/o reg Ours -with reg Sta. Sig. Per. Norm. WOUAF PSNR
60
0
40 30
PSNR
Bit Acc
40
10
80
4K
5K
6K
Fine-tuning Steps
7K
8K
9K
10K
4
3
2
1
Quantization Precision
Model Noise
0
Ours -w/o reg Ours -with reg Sta. Sig. Per. Norm. WOUAF PSNR
80 60 0.02
0.03
Std. Dev.
0.04
0.05
Fig. 9 shows the robustness against fine-tuning, where the models are fine-tuned for various iterations without the fingerprinting loss. We observe that Per. Norm., Sta. [8] Sig. [6], and WOUAF [9] all have limited robustness. In contrast, our method is very robust, and after 10,000 steps of fine-tuning, the Bit Acc is still above 90% (and is approximately 7% lower when the regularization term Lreg is not considered). TABLE II: Robustness of the fingerprinted model under structural attacks on the COCO dataset.
0
40 30
Attack
PSNRb
FID
Bit Acc
No Attack PNM Removal PNM Reinitialization
31.80 8.45 12.21
24.03 185.22 95.9
99.57 51.20 50.30
20 10
0.01
addition, the weights of the VAE are perturbed by adding Gaussian noise. The results are reported in Fig. 8 (in the figure, levels 4, 3, 2, 1, and 0 correspond to a quantization precision of 10−4 , 10−3 , 10−2 , 10−1 , and 100 , respectively). To show the benefit of the proposed regularization, the performance is also reported for our method in the case where the regularization loss (Lreg ) is not used during the fine-tuning of the VAE (i.e., setting λreg = 0 in Eq. (14)). The results show that, when the regularization loss is considered, our method outperforms all the other methods, except in the case of model pruning with 50% of pruning rate, in which case, Per. Norm. [8] gets larger Bit Acc. However, it is worth noticing that when the modification is so strong, the PSNR goes below 15, meaning that the attack severely impacts the model functionality.
20 10
100
40
Ours -w/o reg Ours -with reg Per. Norm. Sta. Sig. WOUAF 1K 2K 3K
PSNR
Bit Acc
90
100
Bit Acc
Ours -w/o reg Ours -with reg Sta. Sig. Per. Norm. WOUAF PSNR
PSNR
Model Pruning
100
40
Fine-tuning Attack
Fig. 9: Robustness against fine-tuning attack.
Fig. 7: Robustness against purification attacks. The trade-off between Bit Acc and post-attack image quality is shown. Augmenting our method with Cheng [59] can also enhance robustness against both known (Cheng [59]) and unknown (Ballé [60]) attacks.
70
100 95 90 85 80 75 70 65 600K
Bit Acc
the Bit Acc to 75%. Moreover, we found that incorporating Cheng [59] as augmentation during fingerprint model finetuning is highly effective. It improves robustness by increasing Bit Acc by over 10% under the same attack for comparable quality degradation, while also enhancing resistance to unseen purification methods such as the Ballé [60] attack.
0
Fig. 8: Robustness against different model-level attacks. The gray line indicates the PSNR after the attack. Robustness Against Model-level Attacks. We assessed the robustness against modifications of the model in the case of pruning, compression, noise addition, and fine-tuning. In detail: 1) for pruning, a percentage of the parameters having the smallest magnitude is set to zero; 2) for quantization, we reduce the numerical precision of the model parameters, truncating to a fixed number of significant digits. 3) for noise
Finally, Table II evaluates the robustness against intentional structural attacks. We define PNM removal as bypassing the module during inference and reinitialization as resetting its weights to random noise. While both attacks reduce the fingerprint extraction accuracy to approximately 50%, they induce a catastrophic collapse in generation quality. For instance, PNM removal degrades the reconstruction PSNR from 31.80 dB to 8.45 dB and surges the FID to 185.22. This strong degradation occurs because the PNM is entangled with the VAE’s feature representations in the fingerprint fine-tuning phase. This indicates that attackers must either retain a functional but traceable model or destroy the fingerprint at the cost of rendering the model useless, while recovering such severely degraded image quality via fine-tuning demands considerable effort.
12
E. Ablation Study Quality-Effectiveness Trade-off. We further study the trade-off between image quality and fingerprint effectiveness by changing the weight of the fingerprint loss during finetuning. Specifically, we set the weight of the fingerprinting loss λm to 10, 1, and 0.1, and report the corresponding image quality and Bit Acc on the COCO dataset (T2I). From Table III we observe that a larger λm results in a degradation of image quality, which is up to 1 dB of PSNR, passing from 10 to 0.1. In terms of fingerprinting performance, passing from λm = 0.1 to 10 yields only a slight improvement in Bit Acc. However, using a large λm is beneficial for fingerprint robustness, especially against JPEG compression, in which case the Bit Acc improvement is above 4%. TABLE III: Image reconstruction quality and Bit Acc (%, ↑) for different fingerprinting loss weight λm . λm
PSNRb
SSIMb
no Attack
Crop
JPEG
10 1 0.1
30.92 31.80 31.95
0.86 0.88 0.88
99.85 99.57 99.45
91.42 90.53 90.25
94.65 92.04 90.37
Fingerprint Decoder Architecture. In all the experiments reported so far, the fingerprint decoder W is based on EfficientNet-B0. In this section, we study the impact of using a different architecture to implement the decoder. Specifically, we additionally trained other fingerprint decoders by considering different architectures, including ResNet-18 and ResNet50, and used them to fine-tune the VAE decoder. All decoders were initialized with ImageNet pre-trained weights. In Table IV, we report the results in terms of image reconstruction quality and Bit Acc on COCO. It can be observed that the differences in image reconstruction performance of the VAE are minimal, with fluctuations in PSNR of approximately 0.1. The fingerprint extraction accuracy is also similar in the three cases. The EfficientNet-B0-based decoder exhibits a slight advantage in terms of robustness against JPEG compression, with a Bit Acc more than 1% higher. TABLE IV: Impact of fingerprint decoder architecture on image reconstruction quality and Bit Acc (%, ↑) Architecture
PSNRb SSIMb
no Attack
Crop
JPEG
EfficientNet-B0 ResNet18 ResNet50
31.80 31.72 31.88
99.57 99.56 99.52
90.53 90.15 90.40
92.04 91.20 91.07
0.88 0.88 0.88
Complexity Analysis. We evaluated the computational overhead of the proposed method by measuring the average image generation time over 10,000 images. On a single Nvidia A100 GPU, for the no-fingerprint model, the average time on COCO and ImageNet is 4,807 ms and 4,646 ms, respectively. For our PNM fingerprinted model, the corresponding times are 4,818 ms and 4,708 ms, with an increase of only 11 ms and 62 ms, i.e., within 1.5%. Moreover, in terms of model
parameters, PNM introduces only additional 4C parameters (C parameters respectively for β, γ, conv1 and conv2). VI. A NTI -C OLLUSION A NALYSIS In this section, we reveal the widespread systemic vulnerability in current methods: multiple attackers can easily synthesize a new model whose fingerprint does not reliably match that of any of the participating parties, via model collusion. Parameter-level collusion represents a unique attack in modern open-weight or locally-licensed deployments. Since it requires no retraining and preserves generation quality, it represents a dangerous zero-cost threat to IPR protection. We demonstrate that the proposed ACT can address such a threat. Instead of relying on post-hoc accountability, ACT operates as a proactive defense, preventing colluders from synthesizing an effective model. We first focus on the common case of collusion attacks using linear parameter averaging [12], then we also consider the case in which more advanced non-linear collusion attacks are adopted. A. Collusion Attack Settings We consider both 2-party and multi-party collusion, as well as linear and non-linear attacks. In the simple case of 2-party linear collusion, let M(a) and M(b) be the fingerprinted model distributed to users a and b with user-specific fingerprints m(a) (atk) and m(b) . The attacker constructs a colluded model Mm (b) (a) (atk) = αMm + (1 − α)Mm , where 0 < α < 1. as Mm We vary α from 0 to 1 to simulate different interpolation scenarios and assess how the fingerprinting performance and image generation quality are affected. We further extend the evaluation to multi-party linear collusion, where n users collaborate to produce a colluded model. In this case, the attacker computes a weighted sum of N fingerprinted models: PN PN (atk) (i) = i=1 αi Mm , where i=1 αi = 1 and αi > 0. Mm We use αi = 1/n to simulate equal contributions from all colluders. We also evaluate our method on non-linear collusion attacks, the details are presented in Sec. VI-C. B. Evaluation under Linear Collusion Attacks In this subsection, we evaluate the robustness of the proposed method against linear collusion attacks, considering both 2-party and multi-party scenarios. We provide a comparative analysis with state-of-the-art fingerprinting methods to demonstrate the effectiveness of the proposed ACT. 1) Comparative Analysis on 2-Party Collusion: We first focus on the 2-party collusion scenario with equal weights (α = 0.5), which represents the most straightforward attempt to remove fingerprints. We evaluate both the image generation quality (FID, based on the COCO dataset) and the Bit Acc between the two user-specific fingerprints m(a) and m(b) and the fingerprint extracted from the colluded model, indicated with m(atk) . Let p(a) = Acc(m(atk) , m(a) ) and p(b) = Acc(m(atk) , m(b) ). Vulnerability of Existing Methods. Table V shows the results, averaged over 20 pairs of randomly sampled fingerprints (m(a) , m(b) ). In addition, we compute the TPR of the
13
TABLE V: Image generation (FID) and fingerprint verification performance of colluded models for different methods.
p(a)
p(b)
TPR
Per. Norm. [8] Sta. Sig. [6] WOUAF [9] AquaLoRA [23]
24.19 23.82 23.65 27.79
76.41 75.41 76.77 70.59
76.26 74.95 75.20 71.42
0.534 0.407 0.469 0.451
Ours w/o ACT Ours with ACT
23.55 79.51
74.61 75.92
74.73 75.45
0.468 0.467
2 X U V F R O O X G H U D 2 X U V F R O O X G H U E 6 W D 6 L J F R O O X G H U D 6 W D 6 L J F R O O X G H U E
L Q F R O O X V L R Q D W W D F N
(a) Bit Acc vs. α
colluding model under the claim-based verification protocol, at a fixed FPR 10−4 (the threshold τ = 0.85 used before can also be adopted. The FPR we get would be even lower in this case). We observe that for all methods, two colluding attackers can substantially weaken the fingerprint information in the colluded model without degrading the quality of the generated images. Specifically, the matching accuracy with the fingerprints of participants (a) and (b) drops to around 75%, while in the verification scenario, the TPR at an FPR of 1×10−4 falls to only 0.4–0.5. This indicates that the attackers can compromise existing generative model fingerprinting systems without any prior knowledge or sophisticated technical capabilities. Effectiveness of ACT. In contrast, our method with ACT demonstrates a proactive defense capability. As reported in Table V, although the fingerprint verification performance is similarly affected by parameter averaging (which is mathematically inevitable), the ACT causes the image quality to degrade drastically, with the FID surging by over 50 points compared to the baseline. This severe degradation renders the colluded model effectively unusable, thereby precluding the attack. Notably, without ACT, our method exhibits similar vulnerability to existing approaches, confirming that ACT is the key component for disruption. 2) Impact of Interpolation Factor (α): To further analyze the behavior of the models, we evaluate the performance under varying interpolation factors α ∈ [0, 1]. Fingerprint Matching Analysis. Fig. 10a reports the Bit Accuracy between the extracted fingerprint m(atk) and the users’ original fingerprints. The results are averaged over 20 pairs, considering 1,000 images each. As expected, as α increases from 0 to 1, Acc(m(atk) , m(a) ) decreases while Acc(m(atk) , m(b) ) increases. Both metrics reach their minimum (≈ 75%) at α = 0.5, confirming that the fingerprint signal is maximally obfuscated at the midpoint. Image Quality Analysis. The crucial difference lies in the image quality preservation. Fig. 10b plots the PSNR of generated images against α. For existing methods and ours without ACT, the PSNR remains stable and high across the entire range of α, confirming their vulnerability to collusion attacks. For ours with ACT, the ACT disrupts this connectivity. As shown in Fig. 10b and the visual examples in Fig. 11, any deviation from the original parameters (i.e., α ̸= 0, 1) leads to a sharp deterioration in quality. Even a small interpolation (e.g., α = 0.1) causes severe degradation. This effect is consistent across diverse prompts.
3 H U 1 R U P 6 W D 6 L J : 2 8 $ ) 2 X U V Z R $ & 7 2 X U V Z $ & 7
PSNRb
FID
% L W $ F F
Method
L Q F R O O X V L R Q D W W D F N
(b) PSNR vs. α
Fig. 10: PSNR and fingerprint Bit Acc (%) of colluded models for α (for sake of visibility, in (a), only our method and Sta. Sig. are reported. The behavior is similar in the other cases. 3) Comparative Analysis on Multi-party Collusion: Table VI reports the results for different N . Existing methods maintain high fidelity for the colluded models, with PSNR above 29 dB, which indicates that the colluded models preserve their functionality (LPIPS is also reported). However, their Bit Acc drops significantly (typically below 70%), highlighting the general vulnerability of fingerprinting schemes to multi-party collusion attacks. In the case of our method, although the Bit Acc also decreases as N increases, a strong degradation in generation capability is observed, which makes the colluded model unusable. For instance, with N = 10, the PSNR drops to 11.44 dB, and LPIPS rises to 0.65, resulting in an unusable model. These observations further suggest that increasing the number of colluding parties does not enhance the image quality of the colluded model. Instead, the quality remains constrained by the ACT. As a result, the collusion attack remains ineffective, since attackers are unable to both preserve high-fidelity generation and simultaneously degrade fingerprint reliability. These observations further suggest that increasing the number of colluding parties does not enhance the image quality of the colluded model. TABLE VI: Effect of different numbers of colluders (N ) on generation quality and fingerprint extraction accuracy. Bit Acc: mean ± std over N colluders. Quality: PSNR ↓ / LPIPS ↓ Method
Metric
N=3
N=5
N=10
N=20
[8]
Bit Acc Quality
75.69±8.72 68.75±9.59 63.54±7.52 57.08±6.85 30.05/0.06 29.88/0.06 29.97/0.06 30.12/0.07
[6]
Bit Acc Quality
71.52±6.87 66.66±6.58 62.08±8.05 56.04±8.98 30.92/0.08 30.87/0.08 31.03/0.08 30.71/0.08
[9]
Bit Acc Quality
73.61±2.59 69.16±5.17 60.83±7.44 57.60±4.85 31.04/0.07 30.96/0.07 31.28/0.08 31.15/0.0
Ours
Bit Acc Quality
77.08±1.70 71.25±9.44 62.08±5.57 58.85±9.52 12.64/0.59 11.76/0.68 11.44/0.65 10.96/0.70
C. Evaluation under Non-linear Collusion Attacks We also evaluate more advanced non-linear collusion attack strategies, including the Random strategy, the Power mean
14
Per. Norm.
parameters θatk are calculated as: 1 p θ1 + θ2p p , θatk = 2
(20)
WOUAF
Sta. Sig.
where p > 0 is a parameter controlling the non-linearity. (3) max-absolute-value parameter merging strategy. For each parameter i, the colluded model selects the parameter with the larger absolute value: ( (i) (i) (i) θ1 , if θ1 ≥ θ2 , (i) (21) θatk = (i) θ2 , otherwise.
Collusion Strategy
PSNRb LPIPSb
p(a)
p(b)
Random Power Mean (p = 2) Max-Abs Merge
5.21 5.51 6.24
74.51 75.61 75.23
76.49 74.72 74.49
Ours w/ ACT
0.87 0.82 0.84
Table VII shows the results of our method under advanced non-linear 2-party collusion attacks. We evaluate both visual fidelity (PSNR, LPIPS) and the Bit Acc with respect to each colluding model, i.e., p(a) , p(b) . We can see that all evaluated strategies fail to preserve both the visual quality and fingerprints, as indicated by PSNR values between 5 dB and 6 dB, high LPIPS scores ranging from 0.82 to 0.87. Overall, these results confirm that all tested non-linear collusion attacks are ineffective against our fingerprinting method.
Ours w/ ACT - other samples
Ours w/o ACT
TABLE VII: Evaluation under non-linear 2-party collusion.
D. Impact of ACT on Anti-collusion Capability TABLE VIII: The effectiveness of different transformations in ACT against 2-party and 10-party collusion, i.e., the performances of the colluded model (FID↑; PSNR ↓; LPIPS↑). CP
CS
✓ ✓ ✓
α = 0.0
α = 0.3
α = 0.6
α = 1.0
Fig. 11: Images generated by 2-party colluded models with different α. Row 1–2: Results from Sta. Sig.[6] and WOUAF[9]. Row 3: Ours without ACT. Row 4: Ours with ACT (same prompt). Row 5–7: Ours with ACT on different prompts.
based parameter merging strategy, and the max-absolute-value parameter merging strategy, described below. (1) Random strategy: each parameter is selected independently from either model a or b with equal probability. (2) Power mean based parameter merging strategy: Given two fingerprinted models with θ1 and θ2 , the colluded model’s
2-party
SF
10-party
FID
PSNR
LPIPS
FID
PSNR
LPIPS
72.49 76.45 62.17
11.54 13.70 12.92
0.51 0.45 0.49
81.21 80.58 76.62
11.23 12.68 11.15
0.54 0.52 0.51
1) Ablation Study of ACT: We analyze the impact of different transformations in ACT on anti-collusion performances. As shown in Table VIII, we evaluate linear collusion under 2party and 10-party scenarios, and measure the generative and reconstruction capabilities of the colluded models based on the ImageNet. It can be observed that even a single transformation significantly degrades both image generation quality and reconstruction performance. Specifically, CP achieves the largest increase in FID and LPIPS under both collusion settings, indicating its strong disruption of image quality. These results suggest that each transformation contributes to anti-collusion. 2) Analysis of the effectiveness of ACT: We analyze why ACT is effective against collusion. Collusion attacks based on parameter interpolation rely on the principle of mode connectivity, which assumes that fingerprinted models reside on continuous low-loss manifolds [49]. The success of such attacks depends primarily on two factors: (1) high parameter
15
' L U H F W F W L R Q L R Q H U ' L
(b) Fingerprint 2 (w/o ACT)
' L U H F W F W L R Q L R Q H ' L U
(e) Fingerprint 1 (with ACT)
(f) Fingerprint 2 (with ACT)
(c) Fingerprint 3 (w/o ACT)
' L U H F W F W L R Q L R Q H ' L U
(g) Fingerprint 3 (with ACT)
' L U H F W F W L R Q L R Q H U ' L
(d) Fingerprint 4 (w/o ACT) , P D J H 5 H F R Q V W U X F W L R Q / 3 , 3 6
, P D J H 5 H F R Q V W U X F W L R Q / 3 , 3 6
' L U H F W F W L R Q L R Q H U ' L
, P D J H 5 H F R Q V W U X F W L R Q / 3 , 3 6
, P D J H 5 H F R Q V W U X F W L R Q / 3 , 3 6
(a) Fingerprint 1 (w/o ACT)
' L U H F W F W L R Q L R Q H ' L U
' L U H F W F W L R Q L R Q H U ' L
, P D J H 5 H F R Q V W U X F W L R Q / 3 , 3 6
, P D J H 5 H F R Q V W U X F W L R Q / 3 , 3 6
, P D J H 5 H F R Q V W U X F W L R Q / 3 , 3 6
, P D J H 5 H F R Q V W U X F W L R Q / 3 , 3 6
' L U H F W F W L R Q L R Q H ' L U
(h) Fingerprint 4 (with ACT)
Fig. 12: LPIPS landscapes of models with different fingerprints, plotted using [61]. First row: models with different fingerprints without ACT; second row: models with different fingerprints after ACT. Note that in both cases, the loss at (0,0) remains low, but with ACT it rises sharply with even slight perturbations, making this local minimum less visually discernible.
Z R $ & 7 Z $ & 7
) U H T X H Q F \
) U H T X H Q F \
& R V 6 L P
Z R $ & 7 Z $ & 7
& R V 6 L P
(a) Distribution of cosine similar- (b) Distribution of cosine similarity for γ (a) and γ (b) , with and ity for β (a) and β (b) , with and without ACT. without ACT.
Fig. 13: Similarity distributions of model parameters with and without ACT, computed on 10,000 random fingerprint pairs.
similarity among fingerprinted models, and (2) the presence of a connected low-loss manifold enabling smooth interpolation. ACT is designed to break this by applying user-specific, function-preserving transformations that remap the parameters of each user’s model to a distant location in the parameter space. Although each transformed model remains functionally identical to its original version, the parameters for different users become highly dissimilar. Consequently, parameter interpolation of two or more ACT-protected models, which no longer share a connected low-loss path, yields parameters that fall outside any valid functional manifold. This interpolated point corresponds to a region in the loss landscape characterized by high loss values, leading to the observed failure to generate high-fidelity images. Parameter Similarity. First, we analyze how ACT alters the similarity between model parameters. Fig. 13 illustrates the distributions of the cosine similarity between the normalization parameters of two models of users a and b, averaged across
10,000 random fingerprint pairs (m(a) , m(b) ), both with and without ACT. Specifically, Fig. 13a shows the similarity between γ (a) and γ (b) , while Fig. 13b reports the same for β (a) and β (b) . We can observe that without ACT, both fingerprinted parameters show high positive similarity, which makes the model susceptible to collusion attacks, as parameter interpolation between users can produce functional and colluded models. In contrast, with ACT, the distributions are centered around zero. This demonstrates that ACT substantially reduces the similarity between fingerprinted parameters and enforces near-orthogonality between different user models. Loss Landscapes. We also study the influence of ACT on loss landscapes. Following [61], we randomly sample two orthogonal directions to perturb PNM and compute the LPIPS loss between the reconstructed image and the input image. In Fig. 12, the first row presents the loss landscapes of four models with randomly selected fingerprints without ACT, while the second row shows those with ACT. Without ACT, the landscapes across different fingerprints exhibit high similarity, smooth variations, and continuous gradients. In contrast, ACT induces substantially steeper surfaces, where loss values increase sharply within the same perturbation range. These observations reveal that ACT substantially reshapes the loss landscape, making it steeper and more irregular, which affects the model’s behavior in the presence of collusion attacks. In the absence of ACT, the high parameter similarity ensures that an interpolated solution remains in a close neighborhood of the original models. Given the smoothness of loss surfaces, such a small deviation naturally incurs minimal loss, allowing colluding parties to remove fingerprints with little degradation in image quality. With ACT, the interpolation causes a large deviation in the parameter space, due to the near-orthogonality of the models. On the steep and irregular surfaces induced by ACT, such large deviations inevitably trigger large errors and
16
severe quality degradation. E. Discussion Practical Applicability. LDM–based architectures are widely adopted in state-of-the-art models, such as SD3 [62]. Although these models employ different diffusion backbones, they still rely on a decoder for image synthesis, which implies that our method can be applied to these cutting-edge models. For video generation models [63], our method can be extended to 3D convolutions. Moreover, recent model customization methods [64] mainly adjust the diffusion backbone while leaving the VAE unchanged, thereby avoiding any conflicts or degradation of fingerprints. Capacity. In our experiments, we randomly selected the fingerprint associated with each user. In principle, given a maximum number of users M that the distributor wants to allocate, better performance can be achieved by choosing the d-bit fingerprints to be associated with every user by means of a suitable binary fingerprint code [58]. In particular, the length of the fingerprint d has an important impact on M . We employed a 48-bit fingerprint, yielding 248 distinct fingerprints. To ensure safety and obtain some error-correction capability, e.g., ensuring that fingerprints from different users differ in at least 12 positions, according to the Hamming bound [65], we can allocate up to 1.98 × 107 unique models using a suitable code. Although this is only a bound, it indicates that the 48-bit length can already be sufficient to meet real-world requirements for fingerprinting. VII. C ONCLUSION We introduced a novel, efficient, and robust framework for image diffusion model fingerprinting, which addresses the challenge posed by collusion attacks. By integrating fingerprint embedding directly into the model parameters through a PNM module, our method enables efficient and scalable creation of uniquely fingerprinted model copies. Strong fingerprint robustness against model-level modifications, and, notably, fine-tuning, is achieved by minimizing the fingerprinting loss against worst-case parameter perturbations. The method incorporates a user-specific ACT inside the PNM, ensuring that any attempt to collude, multiple models result in a non-functional model, thus effectively preventing unauthorized redistribution. Future research will focus on optimizing user fingerprint allocation and on the evaluation of the performance in a real scenario using binary fingerprint codes. The optimization of ACT transformation strategies may also be considered. R EFERENCES [1] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High-resolution image synthesis with latent diffusion models,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recog., New Orleans, Louisiana, USA, Jun. 2022, pp. 10 684–10 695. [2] A. Q. Nichol, P. Dhariwal, A. Ramesh, P. Shyam, P. Mishkin, B. Mcgrew, I. Sutskever, and M. Chen, “Glide: Towards photorealistic image generation and editing with text-guided diffusion models,” in Proc. Int. Conf. Mach. Learn., Baltimore, Maryland, USA, Jul. 2022, pp. 16 784– 16 804.
[3] C. Saharia, W. Chan, S. Saxena, L. Li, J. Whang, E. L. Denton, K. Ghasemipour, R. Gontijo Lopes, B. Karagol Ayan, T. Salimans et al., “Photorealistic text-to-image diffusion models with deep language understanding,” in Adv. Neural Inf. Process. Syst., vol. 35, New Orleans, Louisiana, USA, Nov. 2022, pp. 36 479–36 494. [4] N. Yu, V. Skripniuk, S. Abdelnabi, and M. Fritz, “Artificial fingerprinting for generative models: Rooting deepfake attribution in training data,” in Proc. IEEE/CVF Int. Conf. Comput. Vis., Montreal, QC, Canada, Oct. 2021, pp. 14 448–14 457. [5] J. Fei, Z. Xia, B. Tondi, and M. Barni, “Supervised gan watermarking for intellectual property protection,” in Proc. IEEE Int. Workshop Inf. Forensics Secur., Shanghai, China, Dec. 2022, pp. 1–6. [6] P. Fernandez, G. Couairon, H. Jégou, M. Douze, and T. Furon, “The stable signature: Rooting watermarks in latent diffusion models,” in Proc. IEEE/CVF Int. Conf. Comput. Vis., Paris, France, Oct. 2023, pp. 22 466–22 477. [7] J. Fei, Z. Xia, B. Tondi, and M. Barni, “Wide flat minimum watermarking for robust ownership verification of gans,” IEEE Trans. Inf. Forensics Secur., vol. 19, pp. 8322–8337, Aug. 2024. [8] ——, “Robust retraining-free gan fingerprinting via personalized normalization,” in Proc. IEEE Int. Workshop Inf. Forensics Secur., Nürnberg, Germany, Dec. 2023, pp. 1–6. [9] C. Kim, K. Min, M. Patel, S. Cheng, and Y. Yang, “Wouaf: Weight modulation for user attribution and fingerprinting in text-to-image diffusion models,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., Seattle, WA, USA, Jun. 2024, pp. 8974–8983. [10] N. Yu, V. Skripniuk, D. Chen, L. S. Davis, and M. Fritz, “Responsible disclosure of generative models using scalable fingerprinting,” in Int. Conf. Learn. Represent., Virtual, Apr. 2022. [11] D. Boneh and J. Shaw, “Collusion-secure fingerprinting for digital data,” IEEE Trans. Inf. Theory, vol. 44, no. 5, pp. 1897–1905, 1998. [12] M. Wortsman, G. Ilharco, S. Y. Gadre, R. Roelofs, R. Gontijo-Lopes, A. S. Morcos, H. Namkoong, A. Farhadi, Y. Carmon, S. Kornblith et al., “Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time,” in Proc. Int. Conf. Mach. Learn., Baltimore, Maryland, USA, Jul. 2022, pp. 23 965–23 998. [13] Y. Li, H. Wang, and M. Barni, “A survey of deep neural network watermarking techniques,” Neurocomputing, vol. 461, pp. 171–193, 2021. [14] L. Fan, K. W. Ng, C. S. Chan, and Q. Yang, “Deepipr: Deep neural network ownership verification with passports,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 44, no. 10, pp. 6122–6139, 2021. [15] J. Zhang, D. Chen, J. Liao, W. Zhang, H. Feng, G. Hua, and N. Yu, “Deep model intellectual property protection via deep watermarking,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 44, no. 8, pp. 4005–4020, 2021. [16] B. Li, L. Fan, H. Gu, J. Li, and Q. Yang, “Fedipr: Ownership verification for federated deep neural network models,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 45, no. 4, pp. 4521–4536, 2022. [17] Y. Zhao, T. Pang, C. Du, X. Yang, N.-M. Cheung, and M. Lin, “A recipe for watermarking diffusion models,” arXiv:2303.10137, 2023, online: https://arxiv.org/abs/2303.10137. [18] Z. Yuan, L. Li, Z. Wang, and X. Zhang, “Watermarking for stable diffusion models,” IEEE Internet of Things Journal, vol. 11, no. 21, pp. 35 238–35 249, 2024. [19] S. Baluja, “Hiding images within images,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 42, no. 7, pp. 1685–1697, 2019. [20] D. Lin, B. Tondi, B. Li, and M. Barni, “A cyclegan watermarking method for ownership verification,” IEEE Trans. Dependable Secure Comput., vol. 22, pp. 1040–1054, 2025. [21] J. Zhang, D. Chen, J. Liao, Z. Ma, H. Fang, W. Zhang, H. Feng, G. Hua, and N. Yu, “Robust model watermarking for image processing networks via structure consistency,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 46, no. 10, pp. 6985–6992, 2024. [22] R. Min, S. Li, H. Chen, and M. Cheng, “A watermark-conditioned diffusion model for ip protection,” in Proc. Eur. Conf. Comput. Vis. Malmö, Sweden: Springer, Sep. 2024, pp. 104–120. [23] W. Feng, W. Zhou, J. He, J. Zhang, T. Wei, G. Li, T. Zhang, W. Zhang, and N. Yu, “Aqualora: Toward white-box protection for customized stable diffusion models via watermark lora,” in Proc. Int. Conf. Mach. Learn., Vienna, Austria, Jul. 2024, pp. 13 423–13 444. [24] Y. Jang, D. I. Lee, M. Jang, J. W. Kim, F. Yang, and S. Kim, “Waterf: Robust watermarks in radiance fields for protection of copyrights,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., Seattle, WA, USA, Jun. 2024, pp. 12 087–12 097.
17
[25] Q. Song, Z. Luo, K. C. Cheung, S. See, and R. Wan, “Protecting nerfs’ copyright via plug-and-play watermarking base model,” in Proc. Eur. Conf. Comput. Vis., Milan, Italy, Sep. 2024, pp. 57–73. [26] Z. Luo, A. Rocha, B. Shi, Q. Guo, H. Li, and R. Wan, “The nerf signature: Codebook-aided watermarking for neural radiance fields,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 47, pp. 4652–4667, 2025. [27] W. Luh and D. Kundur, “Digital media fingerprinting: Techniques and trends,” in Multimedia Encryption and Authentication Techniques and Applications. Boca Raton, FL: Auerbach Publications, 2006, pp. 215– 241. [28] J. Fei, Y. Dai, Z. Xia, F. Huang, and J. Zhou, “Omnimark: Efficient and scalable latent diffusion model fingerprinting,” in Proc. AAAI Conf. Artif. Intell., vol. 39, no. 16, Pennsylvania, USA, Feb. 2025, pp. 16 550– 16 558. [29] J. Fei, Y. Dai, P. Yu, Z. Kong, J. Zhou, and Z. Xia, “Scalable dual fingerprinting for hierarchical attribution of text-to-image models,” in Proc. IEEE/CVF Int. Conf. Comput. Vis., Honolulu, Hawaii, Oct. 2025, pp. 15 025–15 034. [30] T. Karras, S. Laine, and T. Aila, “A style-based generator architecture for generative adversarial networks,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 43, no. 12, pp. 4217–4228, 2021. [31] H. Feng, H. Ling, F. Zou, W. Yan, and Z. Lu, “Optimal collusion attack for digital fingerprinting,” in Proc. ACM Int. Conf. Multimedia, Firenze, Italy, Oct. 2010, pp. 767–770. [32] H. V. Zhao, M. Wu, Z. J. Wang, and K. R. Liu, “Forensic analysis of nonlinear collusion attacks for multimedia fingerprinting,” IEEE Trans. Image Process., vol. 14, no. 5, pp. 646–661, 2005. [33] M. Wu, W. Trappe, Z. J. Wang, and K. R. Liu, “Collusion-resistant fingerprinting for multimedia,” IEEE Signal Process. Mag., vol. 21, no. 2, pp. 15–27, 2004. [34] B. Škorić, “Tally-based simple decoders for traitor tracing and group testing,” IEEE Trans. Inf. Forensics Secur., vol. 10, no. 6, pp. 1221– 1233, 2015. [35] M. Barni, F. Pérez-González, and B. Tondi, “Dnn watermarking: Four challenges and a funeral,” in Proc. ACM Workshop Inf. Hiding Multimedia Secur., online, Jun. 2021, pp. 189–196. [36] J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Adv. Neural Inf. Process. Syst., vol. 33, pp. 6840–6851, Dec. 2020. [37] F.-A. Croitoru, V. Hondru, R. T. Ionescu, and M. Shah, “Diffusion models in vision: A survey,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 45, no. 9, pp. 10 850–10 869, 2023. [38] L. Zhang, A. Rao, and M. Agrawala, “Adding conditional control to text-to-image diffusion models,” in Proc. IEEE/CVF Int. Conf. Comput. Vis., Paris, France, Oct. 2023, pp. 3836–3847. [39] C. Mou, X. Wang, L. Xie, Y. Wu, J. Zhang, Z. Qi, and Y. Shan, “T2iadapter: Learning adapters to dig out more controllable ability for textto-image diffusion models,” in Proc. AAAI Conf. Artif. Intell., vol. 38, no. 5, Vancouver, Canada, Feb. 2024, pp. 4296–4304. [40] Y. Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole, “Score-based generative modeling through stochastic differential equations,” in Int. Conf. Learn. Represent., Vienna, Austria, May 2021. [41] J. Ho, C. Saharia, W. Chan, D. J. Fleet, M. Norouzi, and T. Salimans, “Cascaded diffusion models for high fidelity image generation,” J. Mach. Learn. Res., vol. 23, no. 47, pp. 1–33, 2022. [42] F. Bie, Y. Yang, Z. Zhou, A. Ghanem, M. Zhang, Z. Yao, X. Wu, C. Holmes, P. Golnari, D. A. Clifton et al., “Renaissance: A survey into ai text-to-image generation in the era of large model,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 47, pp. 2212–2231, 2024. [43] D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. Müller, J. Penna, and R. Rombach, “Sdxl: Improving latent diffusion models for high-resolution image synthesis,” in Int. Conf. Learn. Represent., Vienna, Austria, May 2024. [44] W. Peebles and S. Xie, “Scalable diffusion models with transformers,” in Proc. IEEE/CVF Int. Conf. Comput. Vis., Paris, France, Oct. 2023, pp. 4195–4205. [45] S. AI, “stabilityai/sd-vae-ft-mse-original,” https://huggingface.co/ stabilityai/sd-vae-ft-mse-original, Aug. 2024, [Online]. Available: https://huggingface.co/stabilityai/sd-vae-ft-mse-original. [46] R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., Salt Lake City, UT, USA, Jun. 2018, pp. 586–595. [47] A. B. L. Larsen, S. K. Sønderby, H. Larochelle, and O. Winther, “Autoencoding beyond pixels using a learned similarity metric,” in Proc. Int. Conf. Mach. Learn., New York City, NY, USA, Jun. 2016, pp. 1558– 1566.
[48] A. Dosovitskiy and T. Brox, “Generating images with perceptual similarity metrics based on deep networks,” Adv. Neural Inf. Process. Syst., vol. 29, Dec. 2016. [49] T. Garipov, P. Izmailov, D. Podoprikhin, D. P. Vetrov, and A. G. Wilson, “Loss surfaces, mode connectivity, and fast ensembling of dnns,” Adv. Neural Inf. Process. Syst., vol. 31, Dec. 2018. [50] F. Draxler, K. Veschgini, M. Salmhofer, and F. Hamprecht, “Essentially no barriers in neural network energy landscape,” in Int. Conf. Mach. Learn., Vienna, Austria, Jul. 2018, pp. 1309–1318. [51] P. Izmailov, A. Wilson, D. Podoprikhin, D. Vetrov, and T. Garipov, “Averaging weights leads to wider optima and better generalization,” in Conf. Uncertain. Artif. Intell., Monterey, California, USA, Aug. 2018, pp. 876–885. [52] T.-Y. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick, “Microsoft coco: Common objects in context,” in Proc. Eur. Conf. Comput. Vis., Zurich, Switzerland, Sep. 2014, pp. 740–755. [53] O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, A. C. Berg, and L. FeiFei, “Imagenet large scale visual recognition challenge,” Int. J. Comput. Vis., vol. 115, no. 3, pp. 211–252, 2015. [54] K. Zhang, L. Mo, W. Chen, H. Sun, and Y. Su, “Magicbrush: A manually annotated dataset for instruction-guided image editing,” in Adv. Neural Inf. Process. Syst., vol. 36, New Orleans, Louisiana, USA, Dec. 2023, pp. 31 428–31 449. [55] T. Brooks, A. Holynski, and A. A. Efros, “Instructpix2pix: Learning to follow image editing instructions,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., Vancouver, BC, Canada, Jun. 2023, pp. 18 392– 18 402. [56] A. L. Maas, A. Y. Hannun, A. Y. Ng et al., “Rectifier nonlinearities improve neural network acoustic models,” in Proc. Int. Conf. Mach. Learn., vol. 30, no. 1, Atlanta, USA, Jun. 2013, p. 3. [57] J. Hessel, A. Holtzman, M. Forbes, R. Le Bras, and Y. Choi, “Clipscore: A reference-free evaluation metric for image captioning,” in Proc. Conf. Empir. Methods Nat. Lang. Process., Punta Cana, Dominican Republic, Nov. 2021, pp. 7514–7528. [58] G. Tardos, “Optimal probabilistic fingerprint codes,” J. ACM, vol. 55, no. 2, pp. 1–24, 2008. [59] Z. Cheng, H. Sun, M. Takeuchi, and J. Katto, “Learned image compression with discretized gaussian mixture likelihoods and attention modules,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., Jun. 2020, pp. 7939–7948. [60] J. Ballé, D. Minnen, S. Singh, S. J. Hwang, and N. Johnston, “Variational image compression with a scale hyperprior,” in Proc. Int. Conf. Learn. Represent., Vancouver, BC, Canada, Apr. 2018. [61] H. Li, Z. Xu, G. Taylor, C. Studer, and T. Goldstein, “Visualizing the loss landscape of neural nets,” Adv. Neural Inf. Process. Syst., vol. 31, p. 6391–6401, Dec. 2018. [62] P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. Müller, H. Saini, Y. Levi, D. Lorenz, A. Sauer, F. Boesel et al., “Scaling rectified flow transformers for high-resolution image synthesis,” in Int. Conf. Mach. Learn., Vienna, Austria, Jul. 2024, p. 28. [63] Z. Zheng, X. Peng, T. Yang, C. Shen, S. Li, H. Liu, Y. Zhou, T. Li, and Y. You, “Open-sora: Democratizing efficient video production for all,” arXiv preprint arXiv:2412.20404, 2024. [64] N. Ruiz, Y. Li, V. Jampani, Y. Pritch, M. Rubinstein, and K. Aberman, “Dreambooth: Fine tuning text-to-image diffusion models for subjectdriven generation,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., Vancouver, BC, Canada, Jun. 2023, pp. 22 500–22 510. [65] F. J. MacWilliams and N. J. A. Sloane, The theory of error-correcting codes. Elsevier, 1977, vol. 16.
Jianwei Fei (Member, IEEE) received the Ph.D. degree in information security from Nanjing University of Information Science and Technology in 2023. From 2024 to 2025, he was a Post-Doctoral Fellow at the University of Macau. He is currently a Post-Doctoral Fellow at the University of Florence, Italy. His research interests include the security of generative AI, proactive and passive attribution of generative models, and digital forensics.
18
Yunshu Dai (Student Member, IEEE) is currently pursuing the Ph.D. degree with the School of Cyber Science and Technology, Sun Yat-sen University. Her research interests include AI security, watermarking, and multimedia forensics.
Zhihua Xia (Member, IEEE) received his Ph.D. degree in computer science and technology from Hunan University, China, in 2011, and worked successively as a lecturer, an associate professor, and a professor with College of Computer and Software, Nanjing University of Information Science and Technology. He is currently a professor with the College of Cyber Security, Jinan University, China. He was a visiting scholar at New Jersey Institute of Technology, USA, in 2015, and was a visiting professor at Sungkyunkwan University, Korea, in 2016. He serves as a managing editor for IJAACS. His research interests include AI security, cloud computing security, and digital forensics. He has been a member of the IEEE since Mar. 1, 2014.
Xiaochun Cao (Senior Member, IEEE) received the B.E. and M.E. degrees in computer science from Beihang University (BUAA), China, and the Ph.D. degree in computer science from the University of Central Florida, USA. After graduation, he spent about three years at ObjectVideo Inc., as a Research Scientist. From 2008 to 2012, he was a Professor at Tianjin University. He was a Professor at the Institute of Information Engineering, Chinese Academy of Sciences. He is a Professor at the School of Cyber Science and Technology, Sun Yat-sen University. He has authored and co-authored more than 200 journal and conference papers. He is a fellow of the IET. In 2004 and 2010, he was a recipient of the Piero Zamperoni Best Student Paper Award at the International Conference on Pattern Recognition. His Ph.D. dissertation was nominated for the UniversityLevel Outstanding Dissertation Award. He was on the Editorial Board of IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMS FOR VIDEO TECHNOLOGY and IEEE TRANSACTIONS on MULTIMEDIA. He is on the Editorial Board of IEEE TRANSACTIONS ON IMAGE PROCESSING and IEEE TRANSACTIONS ON PATTERN ANALYSIS AND MACHINE INTELLIGENCE.
Jiantao Zhou (Senior Member, IEEE) received the B.Eng. degree from the Department of Electronic Engineering, Dalian University of Technology, in 2002, the M.Phil. degree from the Department of Radio Engineering, Southeast University, in 2005, and the Ph.D. degree from the Department of Electronic and Computer Engineering, Hong Kong University of Science and Technology, in 2009. He held various research positions with the University of Illinois at Urbana-Champaign, Hong Kong University of Science and Technology, and McMaster University. He is now the Head and Professor with the Department of Computer and Information Science, Faculty of Science and Technology, University of Macau. His research interests include multimedia security and forensics, multimedia signal processing, artificial intelligence, and big data. He holds four granted U.S. patents and two granted Chinese patents. He has coauthored two papers that received the Best Paper Award at the IEEE Pacific-Rim Conference on Multimedia in 2007 and the Best Student Paper Award at the IEEE International Conference on Multimedia and Expo in 2016. He is serving as an Associate Editor for the IEEE TRANSACTIONS ON IMAGE PROCESSING, the IEEE TRANSACTIONS ON MULTIMEDIA, and the IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING.
Alessandro Piva (Fellow, IEEE) is currently an Associate Professor with the Department of Information Engineering, University of Florence. He is also the Head of the FORLAB, the Multimedia Forensics Laboratory, University of Florence. His research interests include information forensics and security, and image and video processing. In the first topic, he was interested in data hiding, signal processing in the encrypted domain, and image and video forensic techniques. In the second area, he was interested in the design of image and video processing and analysis techniques for cultural heritage, medical, and industrial applications. In the above research topics, he is the coauthor of more than 70 articles published in international journals and 130 papers published in international conference proceedings, with an H-index of 43 according to Scopus.
Benedetta Tondi (Senior Member, IEEE) received the master’s degree (cum laude) in electronics and communications engineering and the Ph.D. degree in information engineering and mathematical sciences from the University of Siena, Siena, Italy, in 2012 and 2016, respectively. She is currently an Associate Professor with the Department of Information Engineering and Mathematics, University of Siena. From October 2014 to February 2015, she was a Visiting Student with the University of Vigo, Vigo, Spain. Since January 2019, she has been a member of the Information Forensics and Security Technical Committee of the IEEE Signal Processing Society. She is part of the IEEE Young Professionals and IEEE Signal Processing Society and a member of the National InterUniversity Consortium for Telecommunications. She has been Area Chair of several IEEE conferences and workshops and Technical Program Chair of ACM IHMMSEC 2022 and 2026. She is an Associate Editor of IEEE SIGNAL PROCESSING LETTERS and a Senior Area Editor of IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY.
19
Appendix for “Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models”
A PPENDIX A T HEORETICAL P ROOFS OF O UTPUT I NVARIANCE FOR ACT We provide the detailed mathematical proofs demonstrating that Channel Permutation, Parameter Scaling, and Sign Flip, included in the proposed Anti-Collusion Transformations (ACT), strictly preserve the input-output mapping of the Personalized Normalization Module (PNM).
Proof. We examine the forward pass through the PNM under the scaled parameters. The intermediate features after Conv1 and normalization are: ec · Fec(1) = γ
C X
(0)
Fi
ec f (1) + β ∗W c,i
i=1
= α(3) c γc ·
C X
(0)
Fi
(1)
(4) ∗ α(1) c Wc,i + αc βc
(26)
i=1
A. Proof of Channel Permutation Invariance We first formalize the invariance property of the channelwise parameter permutation (CP). Theorem 1 (Channel Permutation Invariance). For any permutation π : [C] → [C] and input feature map F (0) ∈ RC×h×w , the channel-wise parameter permutation transformation pree are f (1) , W f (2) , γ e , β) serves the PNM output. That is, if (W the permuted parameters defined by Eq. (17), then Fec(2) = Fc(2) ,
∀c ∈ [C].
ec · Fec(1) = γ
(0)
= γπ(c) ·
C X
C X
(23) (0) (1) (1) Fi ∗ Wπ(c),i + βπ(c) = Fπ(c) .
(1) f (2) = Fej ∗ W c,j
j=1
=
C X
=
C X
C X
(1) (2) Fπ(j) ∗ Wc,π(j) .
(1)
(2)
Fπ(j) ∗ Wc,π(j) = Fc(2) .
C X
! (2)
(2)
(4) (1) (0) Fi ∗ Wj,i + αj βj
∗ αj Wc,j
C X
(2)
i=1
j=1 (1)
(2)
(3)
αj αj αj · γj
j=1
(0)
Fi
(1)
∗ Wj,i
∗ Wc,j
i=1
C X
(2)
(2)
(4)
αj αj · βj ∗ Wc,j ,
∀c ∈ [C]. Applying the constraints from Eq.(18), where (1) (2) (3) (2) (4) αi αi αi = 1 and αi αi = 1 for ∀i, we obtain: " # C C X X (0) (1) (2) Fe (2) = γj F ∗W + βj ∗ W i
j=1
(24)
j=1
C X
(1) (3) αj αj γj
c
=
C X
j,i
i=1
c,j
(28)
(1) (2) Fj ∗ Wc,j = Fc(2) .
j=1
Since π is a bijection, as j ranges over [C], π(j) also ranges over [C]. Therefore: Fec(2) =
(1) f (2) Fej ∗ W c,j
j=1
(27)
i=1
C X
(1)
∗ Wc,i + α(4) c βc ,
j=1
For the final output after Conv2 : Fec(2) =
Fec(2) =
f (1) + βec ∗W c,i
i=1
(0)
Fi
∀c ∈ [C]. Then, the final output after the second convolution is
+
Fi
C X i=1
(22)
Proof. We analyze the forward computation under permuted parameters. For the intermediate features after Conv1 and normalization, ∀c ∈ [C]: C X
(3) = α(1) c αc γc ·
(25)
j=1
Hence, the input-output mapping is preserved. B. Proof of Scaling Invariance In this section, we show that the parameter scaling (SC) operation does not alter the overall functionality of the PNM. Theorem 2 (Scaling Invariance). Let F (0) ∈ RC×h×w be an input feature map and let the scaled parameters e be defined as in Eq. (18), with constraints f (1) , W f (2) , γ e , β) (W given by Eq. (19). Then the output of the PNM remains unchanged: Fe (2) = F (2) .
Therefore, Fe (2) = F (2) , completing the proof. C. Proof of Sign Flip Invariance Building upon the scaling invariance, we briefly formalize the output preservation for the sign flip operation. Sign Flip (SF). We observed that the sign flip is a special case of parameter scaling where the scaling factors are constrained to {−1, 1}. Then, from Theorem 2, output preservation is guaranteed. A PPENDIX B S ECURITY A NALYSIS OF ACT Having established the function-preserving nature of ACT, we present a formal security analysis and derive theoretical complexity bounds against collusion attacks. We first define
20
the threat model and analyze the complexity required for an adversary to successfully carry out such an attack. Definition 1 (Attacker Model). We consider colluders who possess K ≥ 2 fingerprinted model copies {M(1) , . . . , M(K) } and have full knowledge of the model architecture and the ACT mechanism (White-box setting). However, the attacker does not have access to the private user-specific seeds used to generate the ACT keys. The goal of the attacker is to find a set of transformation parameters to align the models into a parameter space, such that their interpolation yields a model with high generation quality. The security of ACT depends on the difficulty of achieving Parameter Alignment across different users. We formulate this hardness in the following theorem. Theorem 3 (Complexity of Parameter Alignment). Given two distinct models M(a) and M(b) protected by ACT with channel size C, the complexity to align their parameters for a successful collusion attack is Ω(C! · 22C ). Proof. Since the attacker aims to perform parameter averaging (or interpolation), they must find a transformation mapping T such that T (θ(b) ) ≈ θ(a) (or map both to a common space). Since the ACT keys are generated randomly and independently for each user, aligning two models is equivalent to guessing the relative transformation differences between them. The search space is determined by the combined transformations: 1) CP: CP applies a random permutation π : [C] → [C]. To align the channels of M(b) with M(a) , the attacker must identify the correct permutation out of all possible mappings. The size of this search space is |SCP | = C!. 2) SF and SC: For SF, the attacker must determine the relative sign differences for each channel. Since the sign flip vectors are composed of 2C independent binary elements (for the two convolution layers in PNM), there are 22C possible patterns. For SC, the scaling factors are continuous values, hence, guessing the exact value is impossible for the attacker. Even if we relax this by quantizing the scaling factors into Q levels (Q > 1), the search space expands by a factor of Q2C . Combining these factors, the minimum size of the hypothesis space that the attacker must explore is: |H| ≥ |SCP | · |SSF | = C! · 22C .
(29)
Thus, the complexity is Ω(C! · 22C ). □ Remark. For a typical configuration with C = 128, the search space |H| is extremely large, rendering brute-force attacks computationally infeasible. Furthermore, verifying each guess requires a full forward pass to inspect the image quality, which introduces significant computational overhead. Consequently, ACT effectively prevents attackers from achieving the parameter alignment necessary for collusion.