Search papers, labs, and topics across Lattice.
This paper introduces a non-invasive model fingerprinting framework that leverages the phenomenon of collapsed generation in text-to-image diffusion models to establish ownership verification. By identifying model-specific behavioral signatures that emerge under certain input conditions, the method can reliably distinguish between different models, even in the presence of fine-tuning or obfuscation. The findings demonstrate that this approach can effectively verify ownership with low confusion rates across various diffusion architectures, offering a robust alternative to traditional watermarking techniques.
Collapsed generation reveals unique fingerprints in diffusion models, enabling reliable ownership verification without invasive watermarks.
Proprietary text-to-image diffusion models are increasingly distributed as hosted services and downloadable checkpoints, making their intellectual property (IP) protection an increasingly critical concern when model leakage, copying, or unauthorized fine-tuning is disputed. In this work, we present a non-invasive model fingerprinting framework based on \emph{collapsed generation}, a phenomenon where certain input conditions produce highly consistent images across multiple stochastic seeds. We show that collapsed generation is an intrinsic, model-dependent property of the learned generation process. These collapse-prone conditions therefore expose model-specific behavioral signatures, enabling reliable ownership verification without embedding invasive watermarks. After preparing conditions on the source model, the framework verifies a suspect model under two access settings: (1) white-box pipeline access, where optimized continuous embeddings can be injected into the generation process, and (2) black-box API-only access, where natural language prompts are queried through the service interface. In both cases, ownership evidence is measured by whether the suspect model reproduces the source model's collapse behavior across stochastic samplings. Extensive experiments across UNet- and transformer-based diffusion models show that collapsed generation fingerprints can distinguish different source models with low confusion. These fingerprints remain verifiable in fine-tuned derivatives and under common and adaptive model- or query-level obfuscations, while requiring only a modest verification query budget. Together, these results establish collapsed generation as a reliable intrinsic evidence source for non-invasive diffusion model ownership verification.
