Technical Summary: TrajPrint – Lossless Copyright Protection via Intrinsic Model Fingerprinting

Problem Statement

Diffusion models have become high-value intellectual property due to the substantial computational resources and data required for their training. However, the open-source nature of model weights and the proliferation of distillation techniques make these models susceptible to unauthorized replication and misappropriation. Existing copyright protection strategies face significant trade-offs:

• Inference Intervention: Methods that inject signals into the denoising loop (e.g., Tree-Ring, Gaussian Shading) often disrupt natural diffusion trajectories, introducing artifacts and limiting generation diversity.
• Model Fine-tuning: Approaches that modify model parameters to embed watermarks (e.g., Stable Signature, SleeperMark) increase training costs and deviate from the pre-trained optimal distribution, thereby impairing generation performance.
• Black-Box Incompatibility: Many existing fingerprinting methods require fine-grained intervention in intermediate denoising steps, rendering them incompatible with black-box APIs where only atomic inference (input-output) is accessible.

Furthermore, current methods often lack rigorous statistical criteria, failing to provide quantifiable evidence for reliable verification.

Methodology: TrajPrint

The authors propose TrajPrint, a completely lossless and training-free framework that verifies model copyright by extracting unique manifold fingerprints formed during deterministic generation. The core insight is that the deterministic generative process of a diffusion model constitutes a unique high-dimensional manifold mapping, serving as an intrinsic identity.

The framework operates in two main phases:

1. Fingerprint Noise Generation

The goal is to construct a specific fingerprint noise $z^*$ that acts as a unique trigger for the target model $G_\theta$.

• Watermarked Anchor: A carrier image is embedded with a discrete binary copyright message to create a "watermarked anchor" ($I_w$).
• Trajectory Inversion: Using deterministic DDIM inversion, the anchor is mapped back to its latent noise origin ($x_T$). This step locks the model's intrinsic generative behavior by tracing the path from the image domain to the noise domain.
• Joint Optimization: To mitigate discretization errors from inversion and enhance specificity, a joint optimization strategy synthesizes the final fingerprint noise $z^*$. This employs dual-end anchoring:
  • Perceptual Manifold Alignment (Output End): A reconstruction loss ($L_{rec}$) enforces semantic consistency, ensuring the generated image aligns with the watermarked anchor $I_w$. This compels the optimization to discover noise that aligns with the target model's unique denoising path.
  • Latent Trajectory Regularization (Input End): A regularization loss ($L_{reg}$) constrains the optimized noise $z^*$ to remain within the local neighborhood of the trajectory origin $x_T$. This prevents the generation of universal adversarial perturbations that could transfer across models.
  • Watermark Recovery: A watermark recovery loss ($L_w$) guides the optimization to ensure the embedded message can be successfully extracted.

The total loss function is a weighted sum of these objectives, optimized exclusively on the latent input $z$ while keeping model parameters frozen.

2. Verification

In the verification phase, the defender queries a suspect black-box model with the optimized fingerprint noise $z^*$.

• Atomic Inference: The process requires only standard input-output interaction, making it compatible with encapsulated APIs.
• Statistical Testing: The extracted watermark message is compared to the original. The bit accuracy (BA) is calculated, and a one-sample t-test is performed against the null hypothesis (random guessing, $\mu=0.5$). A statistically significant p-value provides credible evidence of infringement.

Key Contributions

1. Lossless and Training-Free Verification: TrajPrint extracts intrinsic model fingerprints without modifying model weights or architecture, ensuring zero degradation of generation quality.
2. Black-Box Compatibility: By relying on atomic inference and deterministic trajectory inversion, the method functions in scenarios where intermediate states are inaccessible, unlike previous fingerprinting techniques.
3. Manifold-Specific Fingerprinting: The method maps the unique generative manifold to a specific fingerprint noise via trajectory retracing, constructing a trigger-verification pair that prevents false positives on non-target models.
4. Statistical Rigor: The framework introduces a statistical hypothesis testing protocol to provide quantifiable, legally robust evidence of copyright infringement.

Experimental Results

Extensive experiments were conducted across diverse latent diffusion models (Stable Diffusion v1.5, v2.1, XL, DeciDiffusion, and Pixart-α) and various attack scenarios.

• Specificity: TrajPrint achieved bit accuracy (BA) exceeding 0.96 on target models with p-values $< 10^{-3}$. In cross-model verification, accuracy dropped to approximately 0.55 (random chance), demonstrating a lack of transferability and effectively preventing false accusations. In contrast, baselines using random noise optimization showed high cross-model transferability (BA ~0.7), leading to false positives.
• Robustness: The method demonstrated exceptional resilience against:
  • Parameter Fine-tuning: Maintained high BA (>0.91) even after LoRA and DreamBooth fine-tuning (up to 5000 steps).
  • Quantization: Performed robustly under FP16 and BFloat16 precision (BA > 0.95).
  • Pruning: Withstood unstructured magnitude pruning up to 10% sparsity (BA > 0.8).
• Ablation Studies: Removing dual-end anchoring constraints resulted in a surge in cross-model accuracy (~0.7), confirming the necessity of trajectory anchoring for specificity. The method remained stable across different deterministic samplers and sampling steps (20–100) and supported watermark payloads up to 128 bits.

Significance and Limitations

The paper claims that TrajPrint offers a practical solution for copyright verification in real-world environments where model owners cannot access internal parameters or modify model weights. Its ability to operate via atomic inference makes it uniquely suited for verifying models deployed as black-box APIs.

Limitations:
The authors note a specific constraint: the target environment must support custom initial noise injection (e.g., via interfaces like ComfyUI or Stable Diffusion WebUI). Consequently, the method may not be applicable to API scenarios that do not accept initial noise as a direct input parameter.