Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models

2026-06-11

AI Summary

Existing fingerprinting techniques for image generation models are vulnerable to collusion attacks involving multiple adversaries, often leading to fingerprint invalidation. This work proposes the first collusion-resistant fingerprinting scheme for generative models by embedding bit-string fingerprints into diffusion model parameters via a Personalized Normalization Module (PNM). The approach leverages lossless function-invariant parameter transformations and a worst-case optimization strategy to enable efficient deployment of multiple model copies without retraining. Experimental results demonstrate that the method achieves over 99.5% fingerprint extraction accuracy across diverse generation and editing tasks. Moreover, colluded models exhibit significantly degraded FID scores and severely compromised output quality, thereby actively deterring unauthorized redistribution.

Abstract

Model fingerprinting, embedding user-specific identifiers (fingerprints) into generated outputs, has recently emerged as a popular solution to protect the intellectual property rights (IPR) of generative text-to-image (T2I) models and prevent unauthorized redistribution. In this work, we reveal a previously unexplored systematic vulnerability in existing generative model fingerprinting methods: they lack robustness against collusion attacks, where multiple attackers combine their models to remove or obscure the fingerprints. To address this issue, we take the first step towards a robust fingerprinting method for T2I models with anti-collusion capabilities. The proposed method encodes strings of bits, namely fingerprints, into the coefficients of a personalized normalization module (PNM) incorporated into T2I models, so that fingerprints can be reliably recovered from any generated image. To defend against collusion attacks and prevent unauthorized model redistribution, we introduce an anti-collusion mechanism based on lossless function-invariant parameter transformations. This mechanism significantly degrades the image generation quality of colluded models, making them effectively unusable. Moreover, our method allows developers to efficiently create multiple copies of fingerprinted T2I models by reparameterizing the PNM without the need for retraining. We also introduce a worst-case optimization strategy to improve robustness against model-level attacks. Our experiments demonstrate that the proposed method achieves high fidelity and robustness across multiple T2I image generation and editing tasks, with fingerprint extraction accuracy exceeding 99.5%. Compared with existing methods, our method demonstrates, for the first time, a notable proactive robustness to collusion attacks by significantly increasing the FID of colluded models.

Problem

• fingerprinting
• collusion attacks
• generative models
• intellectual property rights
• text-to-image

Innovation

• anti-collusion
• model fingerprinting
• personalized normalization module
• diffusion models
• IPR protection