Search papers, labs, and topics across Lattice.
This paper introduces Cert-LAS, a novel certified model ownership verification (MOV) method for text-to-image diffusion models that addresses the vulnerability of existing watermarking techniques to watermark signal degradation. Cert-LAS embeds watermarks using diffusion classifiers and layer-adaptive noise guided by Layer Feature Statistics (LFS), and verifies ownership through hypothesis testing comparing watermark responses against unwatermarked models. The authors theoretically prove and empirically demonstrate Cert-LAS's robustness against malicious removal attacks, enhancing the reliability of MOV in practical scenarios.
Even if adversaries try to scrub the watermark, Cert-LAS offers provable guarantees for verifying ownership of text-to-image diffusion models.
Large-scale text-to-image (T2I) diffusion models have enabled unprecedented creative applications, but their unauthorized use has raised serious intellectual property concerns, making model ownership verification (MOV) increasingly critical. We find that existing backdoor-based diffusion watermarking methods often (implicitly) assume a"faithful"verification process, namely, that the verifier can query a suspicious model and obtain the faithful watermark response to complete MOV. However, in practice, adversaries may intentionally or unintentionally damage potential watermark signals, significantly degrading verification reliability. To address this issue, we propose Cert-LAS, the first certified MOV method for T2I models based on layer-adaptive smoothing. In general, Cert-LAS embeds specified watermarks using diffusion classifiers and an LFS-guided layer-adaptive noise, and verifies ownership by examining whether the suspected model exhibits significantly stronger watermark responses compared to unwatermarked references through hypothesis testing. We further prove that, under certain conditions, our Cert-LAS can still achieve reliable verification even in the presence of malicious removal attacks. Extensive experiments validate the effectiveness of Cert-LAS and its resistance to adaptive attacks. Our code is available at https://github.com/Leyi-Qi/Cert-LAS.
