GoodDiffusion: Proactive Copyright Protection for Diffusion Bridge Models via Learnable Sample-specific Signatures

Technical Summary of GoodDiffusion

Problem Statement
The paper addresses the critical challenge of developing a proactive copyright protection (CP) mechanism for diffusion bridge models (DBMs), specifically for Image-to-Image (I2I) tasks. Existing defenses are largely post-hoc (e.g., watermarking and fingerprinting), which only provide evidence of unauthorized use after generation has occurred, or degradation-only strategies (e.g., PCDiff), which reduce output quality but fail to completely prevent unauthorized generation. The authors argue that these methods are insufficient for real-world deployment where unauthorized derivatives can spread before detection. The core problem is to design a mechanism that completely prevents unauthorized generation at the model level while maintaining high-quality output for authorized users, even in a white-box scenario where an adversary has full access to the model parameters and architecture.

Methodology: GoodDiffusion
The proposed framework, GoodDiffusion, is inspired by backdoor mechanisms but reverses their objective: instead of forcing incorrect outputs with a trigger, it forces high-quality outputs only when a valid signature is present.

1. Core Mechanism (Backdoor for Good):
   The method trains the DBM to exhibit two distinct behaviors based on the input:

   • Authorized Trajectory: If the input contains a valid signature, the model follows a diffusion bridge to generate high-quality target images.
   • Unauthorized Trajectory: If the input is "clean" (lacking a valid signature), the model is steered to generate a predefined warning image (e.g., an image with warning text), effectively cutting off unauthorized use.

2. Naive Implementation (Static Signatures):
   Initially, the authors explore a naive approach using a fixed perturbation pattern (static signature $k$) injected into the input. The model is trained on a mixture of authorized inputs ($x_1 + k$) and unauthorized inputs ($x_1$) mapped to a warning target.

   • Vulnerability: The paper theoretically demonstrates (Theorem 4.1) that static signatures are fundamentally fragile in white-box scenarios. An adversary with access to the model can efficiently recover a surrogate signature ($N^*$) via gradient-based optimization that mimics the effect of the original signature, thereby bypassing the protection.

3. Proposed Solution (Learnable Signature Network - LSN):
   To address the vulnerability of static signatures, GoodDiffusion introduces Sample-Specific Signatures.

   • Architecture: A Learnable Signature Network (LSN), denoted as $g_\phi(\cdot)$, is trained to generate a unique signature $k(x_1)$ conditioned on each specific input $x_1$.
   • Injection: The authorized input is formed as $\tilde{x}_1 = \gamma \cdot x_1 + (1-\gamma) \cdot k(x_1)$, blending the original semantic information with the dynamic signature.
   • Security Logic: Unlike static signatures which represent a fixed vector shift in the pixel space, sample-specific signatures create a nonlinearly deformed image manifold. This design breaks the "universality" of the signature; a surrogate signature recovered for one input cannot be transferred to another. Consequently, even if an adversary recovers a signature for a specific sample, it fails to generalize to other inputs, preventing the bypass of the protection mechanism.

Key Contributions

• Proactive Model-Level Control: GoodDiffusion is presented as a first step toward shifting copyright protection from post-hoc output analysis to internalized, model-level prevention. It enforces a "No Ticket, No Ride" policy where unauthorized users receive only a warning image.
• Theoretical Insight on Static Signatures: The paper provides a theoretical proof that naive static signature designs are vulnerable to gradient-based surrogate recovery in white-box settings, highlighting the necessity of dynamic, input-dependent designs.
• Learnable Signature Network (LSN): The introduction of the LSN to generate input-dependent signatures, which effectively mitigates the transferability of surrogate signatures and enhances security against white-box adversaries.
• Comprehensive Evaluation: Extensive experiments on CelebA and ImageNet across three I2I tasks (Super-Resolution, Inpainting, Deblurring) using various DBMs (DDBM, I2SB, DBIM).

Experimental Results

• Protection Effectiveness: GoodDiffusion achieves an Abuse Rate (AR) of nearly 0% (e.g., < 0.06% on CelebA) for unauthorized inputs, meaning the model successfully refuses to generate high-quality target images without valid signatures. In contrast, when an adversary attempts to use a recovered surrogate signature on the static design, the AR spikes to ~98%, confirming the vulnerability of static signatures.
• Generation Quality: For authorized users (with valid signatures), the model maintains satisfactory generation quality. While there is a slight performance drop compared to unprotected baselines (measured by FID, PSNR, and SSIM), the results remain competitive. For instance, in Super-Resolution on CelebA with DDBM-VP, the SSIM slightly surpasses the baseline.
• Error Rate: The Error Rate (ER)—the fraction of authorized requests incorrectly blocked—is kept very low (e.g., 0.06% to 0.25%), indicating high reliability for legitimate users.
• Security Validation: Experiments simulating white-box attacks show that while static signatures are easily bypassed by recovered surrogates, the sample-specific signature design results in poor generation quality (high FID, low PSNR) even when an adversary attempts to optimize a surrogate, confirming the lack of a universal surrogate.

Significance and Claims
The paper claims that GoodDiffusion offers a practical, proactive solution to model theft that complements existing software-level protections (like authentication). By separating the model deployment from the signature service (maintained by the owner), the method ensures that even if a model is stolen and the thief has full white-box access, they cannot utilize it for high-quality generation without the dynamic signatures. The authors position this work as a significant step forward in securing diffusion models as valuable intellectual properties, moving beyond passive detection to active prevention of unauthorized inference. The code is made available to facilitate further research in this area.