💻 computer science

Proof-of-Authorship for Diffusion-based AI Generated Content

This paper proposes a novel, secret-free proof-of-authorship framework for diffusion-based AI content that leverages cryptographic binding of generation seeds to an author's identity, enabling probabilistic adjudication of claims and offering stronger protection against false authorship assertions compared to traditional watermarking or timestamping methods.

Original authors: De Zhang Lee, Han Fang, Ee-Chien Chang

Published 2026-03-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: De Zhang Lee, Han Fang, Ee-Chien Chang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are an artist who paints a beautiful picture using a magical, AI-powered brush. You spend hours tweaking the instructions (prompts) and adjusting the settings to get the perfect image. Suddenly, someone else claims, "I made that!" and tries to sell it.

How do you prove it's yours without having a secret password that only you know?

This paper introduces a clever new system called Proof-of-Authorship for AI art. Instead of hiding a secret, it uses a "digital fingerprint" that is mathematically impossible to fake.

Here is how it works, broken down into simple concepts:

1. The Problem with Old Methods

The "First to Claim" Problem: Imagine you put a timestamp on your photo. Anyone can take a photo and stamp it with a time. Being the first to stamp it doesn't prove you made it; it just proves you were the first to say you made it.
The "Secret Watermark" Problem: Traditional methods try to hide a secret code inside the image (like a hidden message in a painting). But hackers can often find and remove these secrets, or they can forge their own secret code and claim, "Look, my secret code is also in the picture!" This creates a confusing situation where both people seem right.

2. The New Solution: The "Recipe" Fingerprint

The authors realized that with AI art, the creator has a special advantage: they choose the starting point.

Think of generating an AI image like baking a cake:

The Prompt is the recipe (e.g., "A cat on a skateboard").
The Model is the oven and the chef.
The Seed is the specific batch of flour you start with.

In the old days, the AI just grabbed a random bag of flour. But in this new system, the author chooses the exact bag of flour based on their name and the recipe.

The Magic Trick:
The system takes your Name, the Recipe, and a Random Number you picked, and mixes them together using a special mathematical lock (called a Cryptographic Pseudorandom Function). This creates a unique "Seed."

Because of how the math works, if you use your name and your seed, you get a specific cake. If a thief tries to use their name to make the same cake, the math says it's impossible. They would have to guess the exact right seed out of billions of billions of possibilities.

3. The "Probabilistic Adjudicator" (The Smart Judge)

When you claim an image is yours, you don't just say, "It's mine." You bring a Probabilistic Adjudicator (a smart computer judge) to the court.

Here is the trial:

You say: "I made this image using Name 'Alice', Recipe 'Cat', and Seed '12345'."
The Judge runs a simulation: The judge takes your Name, Recipe, and Seed, and asks the AI to bake the cake again.
The Comparison: The judge compares the original image you claim to the new image the AI just baked.
- If they match perfectly: Great! It's likely yours.
- The Math Check: The judge then asks, "What are the odds that a random stranger, picking a random seed, would accidentally bake a cake that looks this similar to yours?"

The Result: The math shows that the odds of a random stranger accidentally baking a cake that looks 99.9% like yours are lower than winning the lottery every day for a year (specifically, less than 1 in $2^{50}$ ).

If the odds are that low, the Judge says, "It is statistically impossible that this was a coincidence. You must be the author."

4. Why This is Better

No Secrets Needed: You don't need to hide a password. You can publish your Name, Recipe, and Seed to the whole world. Even if everyone knows them, no one can fake them because the math prevents it.
Robustness: Even if someone tries to crop the image, add a filter, or compress it (like saving a JPEG), the "flavor" of the cake remains the same. The judge can still recognize it.
Unbreakable: To fake it, a thief would need to break the mathematical lock (the PRF), which is currently considered impossible for any computer to do in a reasonable amount of time.

The Analogy Summary

Imagine you are a master chef.

Old Way: You put a hidden sticker on your cake. A thief can peel it off or put their own sticker on a fake cake.
New Way: You bake your cake using a specific, unique grain of sand from your own backyard as the starting ingredient.
The Test: If someone claims the cake is theirs, we ask them to bake it again using their own backyard sand. If they can't produce a cake that tastes exactly like yours, we know they didn't use your sand. And because the math of the universe makes it impossible to guess the right grain of sand, we know the cake is truly yours.

In short: This paper gives AI artists a way to prove they created something by locking their identity into the very first step of the creation process, making it mathematically impossible for anyone else to claim it.

1. Problem Statement

The rapid advancement of Latent Diffusion Models (LDMs) like Stable Diffusion, DALL-E, and Midjourney has created significant challenges in intellectual property protection and content authentication.

Limitations of Existing Methods: Traditional proof-of-ownership mechanisms, such as time-stamping and digital watermarking, are insufficient for AI-generated content (AIGC).
- Time-stamping allows anyone to claim ownership of an existing object by being the first to register it, failing to prove actual creation.
- Watermarking (pixel-based or latent-based) relies on secrets. These are vulnerable to ambiguity attacks (where an adversary forges a different secret that also matches the object) and removal attacks (where the watermark is stripped or the model is fine-tuned to remove it).
The Core Challenge: There is a need for a mechanism that allows an author to prove they are the creator of a specific AIGC object without relying on secret keys, while ensuring that adversaries cannot falsely claim authorship of objects they did not generate.

2. Methodology: Proof-of-Authorship (POA) Framework

The authors propose a lightweight framework called Proof-of-Authorship (POA). Unlike traditional ownership proofs, POA guarantees that only the specific creator (who possesses the specific generation parameters) can legitimately claim the object.

Core Mechanism

The framework cryptographically binds the author's identity and generation metadata to the random seed used to initialize the LDM generation process.

Seed Generation: Instead of using a truly random seed, the seed $s$ is derived deterministically using a Cryptographically Secure Pseudorandom Function (PRF):
$s = G(f_i(\langle m, e, r \rangle))$
Where:
- $i$ : Author's unique identity.
- $m$ : LDM meta-parameters (e.g., scheduler, steps).
- $e$ : Text prompt embedding.
- $r$ : A random binary sequence (allowing for diversity in generation).
- $f_i$ : The PRF (e.g., HMAC-SHA256) keyed by the author's identity.
- $G$ : A sampler that maps the seed to a starting point in the latent space (typically following a multivariate Gaussian distribution $N(0, I)$ ).
Verification Process (Contention Phase):
- When an author claims ownership of a contested image $I$ , they provide their identity $i$ and the generation parameters $\kappa = \langle m, e, r \rangle$ .
- A Probabilistic Adjudicator (PA) reconstructs the original latent starting point using the provided parameters and generates a reference image $J$ .
- The PA computes a similarity score (specifically, the normalized dot product of the latent vectors) between the contested image's latent representation and the reconstructed reference.
- Statistical Testing: The PA estimates the probability $q$ that a "random forger" (someone without the correct parameters) could generate an image with a similarity score as high as the observed one.
- Adjudication: A Judge evaluates the confidence interval of $q$ . If $q$ is extremely low (e.g., $< 2^{-50}$ ), the claim is accepted.

Key Assumptions

Assumption A1 (PRF Hardness): The PRF is computationally indistinguishable from a random oracle. This ensures an adversary cannot reverse-engineer the seed or find a collision.
Assumption A2 (Diffusion Property): The similarity scores between a target image and images generated from randomly sampled starting points follow a sub-exponential distribution. This allows the system to estimate tail probabilities (extremely rare events) using a small number of samples, rather than requiring exhaustive search.

3. Key Contributions

Secret-Free Framework: The POA framework does not require the author to keep any secrets. All parameters ( $m, e, r$ ) and the identity can be public, enabling transparent verification.
Stronger Guarantee: It provides Proof-of-Authorship rather than just Proof-of-Ownership. It proves that the object was generated by the specific author using specific parameters, preventing "first-come-first-served" ownership claims on existing objects.
Theoretical Security:
- Proves that no probabilistic polynomial-time (PPT) adversary can forge a claim with non-negligible advantage over random guessing.
- Demonstrates that under Assumption A2, statistical testing requires only a polylogarithmic number of samples to achieve high confidence, making verification computationally efficient.
Optimal Statistical Testing: The proposed test statistic is shown to be Uniformly Most Powerful (UMP), achieving the minimal false-negative rate for a given false-positive rate.

4. Experimental Results

The authors evaluated the framework using Stable Diffusion 2.1 (SD2.1).

Distribution Validation: Empirical tests confirmed that similarity scores between images generated from random seeds follow a sub-exponential distribution (approximated well by a generalized normal distribution), validating Assumption A2.
Accuracy: For a target random forger success probability of $2^{-50}$ , the method achieved 100% accuracy in determining authorship.
Robustness: The system remained robust against various distortions:
- Noise: Additive Gaussian noise ( $\sigma^2$ up to 9).
- Compression: JPEG compression with quality factors as low as 10.
- Geometric Transformations: Mild affine transformations (scaling $\pm 2\%$ , translation $\pm 2\%$ , rotation $\pm 3^\circ$ ).
- In all distortion scenarios, the false-positive rate remained negligible, and the false-reject rate was effectively 0.00 for reasonable parameters.

5. Significance and Implications

Paradigm Shift: Moves away from "hiding secrets" (watermarking) to "public cryptographic binding." This eliminates the vulnerability of ambiguity attacks where two parties claim the same object.
Practicality: The method is lightweight, does not require model fine-tuning, and works with existing LDMs (like Stable Diffusion) without modifying the model architecture.
Security: Even if an adversary could theoretically invert the LDM to find a starting point, the cryptographic binding of the seed to the author's identity via PRF makes it computationally infeasible to generate a valid claim for a different identity.
Future of AIGC Rights: Provides a viable technical solution for establishing copyright and authorship in the era of generative AI, addressing the legal consensus that the user (prompt engineer) should hold the rights to AI-generated content.

In summary, this paper presents a robust, mathematically grounded, and empirically validated framework that solves the critical problem of authenticating AI-generated images without relying on fragile secrets, offering a superior alternative to traditional watermarking and time-stamping.