🤖 AI

Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models

This paper proposes a robust, efficient, and anti-collusion fingerprinting method for text-to-image diffusion models that embeds user-specific identifiers into a personalized normalization module, enabling reliable extraction while degrading the quality of colluded models to prevent unauthorized redistribution.

Original authors: Jianwei Fei, Yunshu Dai, Zhihua Xia, Xiaochun Cao, Jiantao Zhou, Alessandro Piva, Benedetta Tondi

Published 2026-06-12

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Jianwei Fei, Yunshu Dai, Zhihua Xia, Xiaochun Cao, Jiantao Zhou, Alessandro Piva, Benedetta Tondi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a bakery owner who creates a famous, delicious cake recipe. To protect your business, you want to sell copies of this recipe to thousands of different customers. However, you need a way to prove that a specific cake came from your bakery and not a copycat, and you need to stop customers from secretly swapping their recipe pages to create a "super-recipe" that belongs to no one.

This paper presents a new, clever way to "fingerprint" AI image generators (specifically Text-to-Image models) to solve exactly this problem. Here is the breakdown in simple terms:

The Problem: The "Recipe Swap" Attack

Currently, companies sell AI models to users. To track who owns which copy, they embed a hidden digital ID (a fingerprint) into the model. If someone steals the model, the owner can scan the images it creates and say, "Ah, this image was made by User #5's stolen copy."

The Flaw: The paper discovered a major weakness. If User A and User B both steal their copies of the model, they can simply average their settings together.

Think of it like two people mixing their secret recipe ingredients in a bowl.
In existing methods, this mixing creates a new, working recipe that still bakes great cakes, but the hidden "User A" and "User B" IDs are washed away. The new cake has no fingerprint, so the owner can't trace it. This is called a Collusion Attack.

The Solution: The "Magic Shaker" (Anti-Collusion)

The authors propose a new system that stops this mixing trick. They introduce a special module called a Personalized Normalization Module (PNM). Think of this as a custom "magic shaker" built into the AI's brain that adjusts how it works based on a unique ID.

Here is how their system works in three steps:

1. The Invisible Ink (Fingerprinting)

Instead of just changing the recipe slightly, they embed the user's ID into the very mechanics of the "magic shaker."

How it works: They train the AI so that when it generates an image, the hidden ID is woven into the pixels.
The Result: You can look at any image the AI makes and extract the ID to prove who owns the model. The paper claims this works with 99.5% accuracy, even if the image is cropped, compressed, or edited.

2. The "Anti-Collusion" Trick (The Real Innovation)

This is the paper's biggest breakthrough. Before giving the model to a user, they apply a special transformation called ACT (Anti-Collusion Transformation).

The Analogy: Imagine giving User A a recipe where the "salt" is measured in teaspoons, but the "sugar" is measured in grams. You give User B a recipe where "salt" is in grams and "sugar" is in teaspoons.
The Catch: Both recipes still bake a perfect cake because the shaker knows how to translate the units internally.
The Trap: If User A and User B try to mix their recipes (average them), the units get confused. The result is a recipe that says "add 500 grams of salt" when it should be teaspoons. The cake turns into a salty, inedible mess.
The Paper's Claim: If two or more users try to collude, the resulting model produces terrible quality images (so bad they are unusable). This stops the attack because the attackers can't get a working model without the fingerprint.

3. The "Worst-Case" Training

To make sure the fingerprint survives even if someone tries to tweak the model (like fine-tuning it), the authors trained the AI using a "worst-case" strategy.

The Analogy: Imagine a security guard training by practicing against the strongest possible attacker.
The Result: The fingerprint is so deeply embedded that even if someone tries to "prune" (cut out parts of) the model or add noise to it, the ID remains readable.

The Results

The paper tested this on popular AI image generators (like Stable Diffusion) and found:

Quality: The images generated by the fingerprinted model look just as good as the original (no blurry or weird artifacts).
Security: When attackers tried to mix models, the image quality crashed (the "FID" score, which measures quality, jumped from a good 23 to a terrible 79).
Efficiency: The owner can create thousands of unique copies for different users instantly without having to retrain the AI from scratch every time.

Summary

This paper introduces a "lock" for AI models. If you try to break the lock by combining two keys (collusion), the lock doesn't just stay open; it jams the entire machine so it can't produce anything useful. It protects the creator's rights by ensuring that you can't steal a model, mix it with another, and get a working product that hides your tracks.

Technical Summary: Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models

1. Problem Statement

The rapid advancement of Text-to-Image (T2I) diffusion models has created significant intellectual property (IP) risks, particularly regarding unauthorized model redistribution. While existing fingerprinting methods embed user-specific identifiers into model outputs to ensure traceability, they suffer from a critical, previously unexplored vulnerability: collusion attacks.

In a collusion attack, multiple malicious users possessing distinct fingerprinted model copies can combine their model parameters (e.g., via simple averaging) to create a new "colluded" model. Existing methods fail to prevent this because:

Parameter Interpolation: Deep neural networks often exhibit mode connectivity, where linear interpolation between independently trained models yields functional solutions.
Zero-Cost Removal: Attackers can average parameters to effectively erase the unique fingerprints of individual users while preserving the model's high-quality image generation capabilities.
Lack of Proactive Defense: Current research relies on post-hoc attribution (identifying colluders after the fact) rather than preventing the creation of a functional colluded model.

2. Methodology

The proposed framework introduces a robust fingerprinting system for T2I models that integrates three core components: a Personalized Normalization Module (PNM), a Worst-Case Optimization strategy, and an Anti-Collusion Transformation (ACT).

A. Framework Overview

The workflow consists of three phases:

Fine-tuning: A base T2I model (specifically the VAE decoder) is fine-tuned to embed fingerprints.
Initialization: Unique fingerprinted copies are generated for users without retraining.
Verification: Fingerprints are extracted from generated images to verify ownership.

B. Personalized Normalization Module (PNM)

Instead of modifying the entire model, the method inserts a lightweight PNM into the decoder of the Variational Autoencoder (VAE).

Structure: The PNM follows a Conv–Norm–Conv structure.
Mechanism: A fingerprint message $m$ (a binary string) is fed into two encoding networks ( $F_\gamma$ and $F_\beta$ ) to generate scaling ( $\gamma$ ) and shifting ( $\beta$ ) parameters. These parameters modulate the normalization layer within the PNM.
Efficiency: Once the encoders and the base model are trained, new user copies are created by simply generating new $\gamma$ and $\beta$ vectors from the user's unique fingerprint, eliminating the need for retraining.

C. Anti-Collusion Transformation (ACT)

To proactively defeat collusion, the method applies a lossless, function-invariant transformation to the PNM parameters specific to each user. This transformation ensures that while the model functions correctly for a single user, combining parameters from different users destroys the model's utility.
The ACT comprises three sequential operations:

Channel-wise Permutation (CP): Rearranges the filters and normalization parameters based on a user-specific permutation function $\pi$ .
Parameter Scaling (SC): Scales convolutional kernels and normalization parameters by vectors $\alpha$ such that the product of scaling factors across the layer equals 1, preserving the output function.
Sign Flip (SF): Inverts the signs of specific parameters (a special case of scaling where factors are $\{-1, 1\}$ ).

Theoretical Basis: These transformations break the "mode connectivity" between different user models. While each transformed model produces identical outputs to its untransformed counterpart, their parameters become nearly orthogonal. Consequently, linear interpolation (collusion) between two ACT-protected models lands in a high-loss region of the parameter space, causing catastrophic failure in image generation.

D. Worst-Case Optimization

To enhance robustness against model-level attacks (e.g., fine-tuning, pruning), the training objective includes a worst-case regularization loss.

The model is optimized to minimize the fingerprinting loss under the assumption of the worst-case parameter perturbation ( $\delta^*$ ) within a defined neighborhood.
This is approximated via a single-step gradient ascent on the loss, encouraging the model to converge to a "flat" minimum that is less sensitive to parameter modifications.

3. Key Contributions

Proactive Anti-Collusion Defense: The paper presents the first T2I fingerprinting framework explicitly designed to render colluded models unusable. By integrating ACT, any attempt to merge models results in a severe degradation of image quality (high FID, low PSNR), effectively neutralizing the attack.
Efficient, Retraining-Free Deployment: The PNM architecture allows developers to generate distinct, fingerprinted model copies for thousands of users instantly by reparameterizing the normalization layers, without the computational cost of retraining.
Enhanced Robustness: The introduction of a worst-case optimization strategy significantly improves resilience against model-level attacks, including fine-tuning and pruning, maintaining high fingerprint extraction accuracy even after significant parameter perturbations.
Comprehensive Evaluation: The study provides a rigorous evaluation across multiple datasets (COCO, ImageNet, MagicBrush, InstructPix2Pix) and tasks (generation and editing), establishing new baselines for security against collusion.

4. Experimental Results

The method was evaluated on Stable Diffusion v2 and InstructPix2Pix models.

Fidelity and Quality: The proposed method maintains high image quality. On the COCO dataset, the FID score (24.03) is comparable to state-of-the-art VAE-based methods (e.g., Per. Norm., Sta. Sig.) and significantly better than U-Net-based watermarking methods. The visual difference between fingerprinted and non-fingerprinted images is negligible.
Fingerprint Extraction Accuracy: The method achieves a Bit Accuracy of >99.5% across all datasets and tasks, outperforming existing methods.
Robustness to Attacks:
- Image-level: The method remains robust against Gaussian noise, blurring, cropping, and JPEG compression, especially when a noise layer augmentation is used during training.
- Model-level: Under fine-tuning attacks (10,000 steps), the Bit Accuracy remains above 90%, significantly outperforming competitors which drop below 70%.
Anti-Collusion Performance:
- 2-Party Collusion: When two users average their models, existing methods retain high image quality (FID ~24) but lose fingerprint validity (TPR drops to ~0.4). In contrast, the proposed method with ACT causes the FID to surge to 79.51 and PSNR to drop drastically, rendering the colluded model unusable.
- Multi-Party Collusion: As the number of colluders increases (up to 20), existing methods maintain high fidelity. The proposed method causes a continuous degradation in quality (PSNR drops to ~11 dB for 10 colluders), preventing the synthesis of a functional model.
- Non-linear Attacks: The method remains effective against advanced non-linear collusion strategies (Random selection, Power mean, Max-absolute-value), where all tested strategies fail to preserve both image quality and fingerprint integrity.

5. Significance and Claims

The paper claims to address a fundamental gap in generative model security: the vulnerability to collusion. The authors argue that while traditional media fingerprinting relies on traitor-tracing codes to identify attackers after a breach, generative model fingerprinting requires a proactive approach.

The significance of this work lies in shifting the paradigm from attribution to deterrence. By ensuring that the act of collusion itself destroys the utility of the model, the method effectively prevents unauthorized redistribution. The authors emphasize that this is achieved without compromising the efficiency of model distribution (no retraining) or the quality of the generated content for legitimate users.

The work concludes that the combination of PNM-based embedding, worst-case optimization, and ACT provides a robust, scalable solution for protecting the intellectual property of T2I models in commercial and licensed settings.