🤖 machine learning

Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothing

This paper introduces Cert-LAS, the first certified model ownership verification method for text-to-image diffusion models that utilizes layer-adaptive smoothing to ensure reliable watermark detection even under malicious removal attacks.

Original authors: Leyi Qi, Yiming Li, Siyuan Liang, Zhengzhong Tu, Dacheng Tao

Published 2026-05-29

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Leyi Qi, Yiming Li, Siyuan Liang, Zhengzhong Tu, Dacheng Tao

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are an artist who has spent years and a fortune training a magical robot to paint pictures based on your specific style. You call this robot a "Text-to-Image Diffusion Model." Now, imagine someone steals your robot, tweaks it slightly, and claims it's theirs. How do you prove it's actually yours?

This is the problem the paper Cert-LAS tries to solve.

The Problem: The "Fragile" Secret Handshake

Currently, many people try to protect their AI models using a "backdoor" method. Think of this like a secret handshake. You train your robot so that if you whisper a specific, weird phrase (a "trigger") to it, it produces a picture with a hidden mark. If someone else has your robot, you whisper the phrase, and if the mark appears, you know you own it.

The paper argues that this old method has two big flaws:

It's too obvious: The weird phrase or the hidden mark is like a neon sign saying "I'm a secret!" A thief can easily spot it and remove it.
It's too fragile: If the thief accidentally bumps the robot (random changes) or intentionally tries to break the secret handshake (adversarial attacks), the mark disappears, and you can no longer prove ownership.

The authors say existing methods assume the thief will play fair and not touch the robot's brain. But in the real world, thieves will try to break the seal.

The Solution: Cert-LAS (The "Layer-Adaptive" Shield)

The authors propose a new method called Cert-LAS. Instead of a fragile secret handshake, they build a "certified" shield that is mathematically proven to survive attacks.

Here is how it works, using simple analogies:

1. The "Layer-Adaptive" Noise (The Customized Blanket)

Imagine your AI robot is a multi-layered cake. Some layers are the "frosting" (very sensitive to changes), and some are the "sponge" (very sturdy).

Old methods treated the whole cake the same, shaking it evenly.
Cert-LAS is smart. It first checks which layers of the cake are "wobbly" (sensitive to fine-tuning). It then wraps those wobbly layers in extra-thick, protective blankets (noise) while leaving the sturdy layers with thinner blankets.
Why? By focusing protection on the weak spots, the whole cake becomes much harder to break. This is called Layer-Adaptive Smoothing.

2. The "Trigger-Free" Watermark (The Invisible Ink)

Instead of using a weird secret phrase (a trigger) that thieves can find, Cert-LAS uses a trick called a Diffusion Classifier.

Imagine you train your robot to paint a picture of a Cat.
Normally, the robot paints a cat.
With Cert-LAS, you train the robot so that when you ask for a "Cat," it secretly paints a picture that looks like a cat but is mathematically "classified" by your secret decoder as a Dog.
The Magic: To the thief, the picture looks like a perfect cat. There are no weird words or hidden pixels. But when you run it through your secret decoder, it screams "DOG!" proving the model is yours. Because there is no "trigger" to find, the thief can't audit and remove it.

3. The "Certified" Guarantee (The Math Promise)

The most important part is the word Certified.

The authors didn't just test this and hope it works. They used heavy math to prove a "radius of safety."
They proved that as long as the thief doesn't change the robot's brain by more than a certain amount (a specific mathematical limit), your secret "Cat-as-Dog" signal cannot be removed.
It's like saying, "I can mathematically guarantee that if you try to break my lock with a hammer smaller than 5 pounds, the lock will not open."

How They Tested It

The researchers tested Cert-LAS against:

Accidental damage: Like fine-tuning the model on new data (e.g., teaching it to draw cartoons).
Intentional attacks: Thieves trying to specifically erase the watermark using advanced hacking techniques.

The Results:

Old methods: The watermark disappeared quickly when the model was tweaked or attacked.
Cert-LAS: The watermark survived almost everything. Even when the model was heavily modified, the "Cat-as-Dog" signal remained strong enough to prove ownership.
Quality: The pictures generated by the watermarked model still looked great; the watermark didn't ruin the art.

Summary

Cert-LAS is a new way to protect AI art generators. Instead of using a fragile, easy-to-spot secret code, it uses a smart, mathematically proven shield that hides the ownership signal inside the model's natural behavior. It guarantees that unless a thief completely destroys the model's ability to function, they cannot remove the proof that the model belongs to the original creator.

Technical Summary: Cert-LAS

Problem Statement

Large-scale text-to-image (T2I) diffusion models represent significant intellectual property assets, yet they are vulnerable to unauthorized copying, redistribution, and misuse. Model Ownership Verification (MOV) is critical for protecting these assets. Existing MOV methods for T2I diffusion models primarily rely on backdoor-based watermarking, which embeds private triggers (e.g., rare tokens) to activate specific watermark behaviors.

The authors identify two fundamental limitations in current approaches:

Fragility under Auditing: Existing methods often implicitly assume a "faithful" verification process where the verifier can query a model and obtain a stable watermark response. However, in adversarial settings, triggers can be detected and removed. Experiments show that synthetic triggers are often detectable in either the prompt space (via contextual incongruity) or the image space (via similarity metrics), compromising stealthiness.
Lack of Certified Robustness: Current methods lack theoretical guarantees against parameter perturbations. Experiments demonstrate that both unintentional random perturbations and intentionally crafted adversarial perturbations can significantly degrade verification reliability. While certified robustness exists for small-scale classifiers via randomized smoothing, it has not been successfully adapted to T2I diffusion models due to their high-dimensional continuous score estimation and the computational prohibitions of certified training at this scale.

Methodology: Cert-LAS

The paper proposes Cert-LAS (Certified Layer-Adaptive Smoothing), the first certified MOV method for T2I diffusion models. The method operates in two stages:

1. Watermark Embedding (Trigger-Free)

Instead of using explicit triggers, Cert-LAS embeds a watermark by training the diffusion generator to induce misclassification under a private diffusion classifier.

Diffusion Classifier as Watermark Carrier: The method leverages the finding that diffusion models can function as generative classifiers. A frozen private diffusion classifier is used to define a target posterior distribution. The generator is trained to produce images that are misclassified by this private classifier (e.g., generating "cat" images that the classifier identifies as "dog") while maintaining perceptual fidelity to the original generation via a perceptual consistency regularizer (MS-SSIM).
Layer-Adaptive Smoothing: To achieve certified robustness, the method injects noise into the model parameters during training. Crucially, it employs Layer-Adaptive Noise rather than uniform noise.
- Layer Fine-tuning Sensitivity (LFS): The authors define an LFS indicator based on the average L2 norm of parameter updates during fine-tuning. They observe that certain UNet layers (e.g., normalization and attention blocks) are consistently more sensitive to fine-tuning across diverse datasets.
- Noise Allocation: Noise levels are allocated proportionally to the LFS of each layer. More noise is concentrated on "vulnerable" layers to enlarge the certifiable region, while the total noise budget remains equivalent to uniform baselines.
Exponential Growth Schedule: To make the robust optimization computationally tractable, an exponential growth schedule is adopted. This progressively increases the number of noise samples for gradient averaging during training, leveraging the fact that early training gradients are similar across noise samples.

2. Ownership Verification

Verification is performed by examining whether a suspected model exhibits significantly stronger watermark responses compared to an unwatermarked reference.

Statistics: Two statistics are computed under layer-adaptive smoothing:
- Watermark Robustness (WR): The empirical probability that images from the suspected model are classified as the target class by the private diffusion classifier.
- Reference Probability (RP): The same probability for an unwatermarked reference generator.
Hypothesis Testing: A paired-sample t-test is employed. The suspected model is verified as derived from the protected model if its WR is significantly larger than the RP of the reference.
Certified Guarantees: The authors derive a closed-form threshold for WR and prove a lower bound on the gap between WR and RP. They establish a certified radius ( $R^*$ ), guaranteeing that if parameter perturbations remain within this radius, the ownership verification will succeed.

Key Contributions

Revisiting Limitations: The paper reveals that existing backdoor-based watermarking methods suffer from detectability in prompt/image spaces and a lack of robustness against parameter perturbations.
Cert-LAS Framework: It introduces the first certified watermarking method for T2I diffusion models, utilizing a diffusion classifier as an implicit, trigger-free carrier and introducing layer-adaptive randomized smoothing tailored to UNet architectures.
Theoretical Analysis: The work provides a theoretical analysis establishing robustness guarantees, including a closed-form verification threshold and a certified radius under bounded parameter perturbations.
Empirical Validation: Extensive experiments validate the method's effectiveness, demonstrating high fidelity, stealthiness, and resistance to both unintentional (fine-tuning) and intentional (adversarial) removal attacks.

Experimental Results

The authors evaluate Cert-LAS on Stable Diffusion v1.4 against baselines like WatermarkDM and SleeperMark.

Effectiveness & Stealth: Cert-LAS achieves a verification success rate (VSR) of 1.000 and a True Positive Rate at $10^{-6}$ False Positive Rate (T@10⁻⁶F) of 1.000. Its stealthiness scores (suspiciousness in prompt and image spaces) are significantly lower than backdoor-based methods (e.g., <0.125 vs. >93% for WatermarkDM).
Robustness to Fine-Tuning: Under various fine-tuning scenarios (LoRA, DreamBooth, Custom Diffusion, and full fine-tuning on diverse datasets), Cert-LAS maintains T@10⁻⁶F above 0.987, whereas baselines often drop to 0.000 after limited steps.
Robustness to Adversarial Attacks: Under $\ell_2$ -bounded parameter perturbations, Cert-LAS with smoothing maintains T@10⁻⁶F above 0.965 even at a budget of 0.8, where all baselines fail completely.
Generalization: The method demonstrates generalization across different architectures (SDXL, Sana-1.6B) and classification tasks (different class pairs, prompt templates, and multi-class settings).
Efficiency: The exponential growth schedule reduces training time by 76.6% compared to a non-scheduled robust training baseline.

Significance and Claims

The paper claims that Cert-LAS addresses the critical gap in protecting T2I diffusion models by providing provable robustness guarantees against adaptive attacks, a feature previously absent in diffusion watermarking. By shifting from trigger-based to trigger-free, classifier-based embedding and utilizing layer-adaptive smoothing, the method achieves a balance between stealthiness, generation fidelity, and certified reliability.

The authors position this work as a step toward trustworthy sharing of diffusion models. They emphasize that the method is purely defensive, intended for legitimate verification by authorized owners and trusted authorities. By ensuring that watermarks cannot be removed without degrading the model's utility (as shown in compression experiments), the method supports enforceable licensing and accountability mechanisms in the generative AI ecosystem. The work does not claim to solve all IP issues but provides a specific, theoretically grounded tool for verifying ownership in the presence of bounded malicious modifications.