# attributing_image_generative_models_using_latent_fingerprints__fca93367.pdf

Attributing Image Generative Models using Latent Fingerprints

Guangyu Nie * 1 Changhoon Kim * 2 Yezhou Yang 2 Yi Ren 1

Generative models have enabled the creation of contents that are indistinguishable from those taken from nature. Open-source development of such models raised concerns about the risks of their misuse for malicious purposes. One potential risk mitigation strategy is to attribute generative models via ﬁngerprinting. Current ﬁngerprinting methods exhibit a signiﬁcant tradeoff between robust attribution accuracy and generation quality while lacking design principles to improve this tradeoff. This paper investigates the use of latent semantic dimensions as ﬁngerprints, from where we can analyze the effects of design variables, including the choice of ﬁngerprinting dimensions, strength, and capacity, on the accuracy-quality tradeoff. Compared with previous SOTA, our method requires minimum computation and is more applicable to large-scale models. We use Style GAN2 and the latent diffusion model to demonstrate the efﬁcacy of our method. Codes are available in github.

1. Introduction

Generative models can now create synthetic content such as images and audio that are indistinguishable from those captured in nature (Karras et al., 2020; Rombach et al., 2022; Ramesh et al., 2022; Hawthorne et al., 2022). This poses a serious threat when used for malicious purposes, such as disinformation (Breland, 2019) and malicious impersonation (Satter, 2019). Such potential threats have slowed down the industrialization process of generative models, as conservative model inventors hesitate to release their source code (Yu et al., 2020). For example, in 2020, Open AI refused to release the source code of their GPT-2 (Rad-

*Equal contribution 1 School for Engineering of Matter, Transport and Energy, Arizona State University 2School of Computing and Augmented Intelligence, Arizona State University. Correspondence to: Yezhou Yang <yz.yang@asu.edu>, Yi Ren <yren32@asu.edu>.

Proceedings of the 40 th International Conference on Machine Learning, Honolulu, Hawaii, USA. PMLR 202, 2023. Copyright 2023 by the author(s).

ford et al., 2019) model due to concerns over potential malicious use (Brockman et al., 2020). Additionally, the source code for DALL-E (Ramesh et al., 2021) and DALL-E 2 (Ramesh et al., 2022) has not been released for the same reason (Mishkin & Ahmad, 2022).

One potential solution is model attribution (Yu et al., 2018; Kim et al., 2021; Yu et al., 2020), where the model distributor tweaks each user-end model to generate content with model-speciﬁc ﬁngerprints. In practice, we consider a scenario where the model distributor or regulator maintains a database of user-speciﬁc keys corresponding to each user s downloaded model. In the event of a malicious attempt, the regulator can identify the user responsible for the attempt by using attribution.

Formally, let a set of n generative models be G := {gi( )}n i=1 where gi( ) : Rdz Rdx is a mapping from an easy-to-sample distribution pz to a ﬁngerprinted data distribution px,i in the content space, and is parameterized by a binary-coded key φi Φ := {0, 1}dφ. Let f( ) : Rdx Φ be a mapping that attributes contents to their source models ( Fig. 1(b)). We consider four performance metrics of a ﬁngerprinting mechanism: The attribution accuracy of gi is deﬁned as

A(gi) = Ez pz [1 (f(gi(z)) == φi)] . (1)

The generation quality of gi measures the difference between px,i and the data distribution used for learning G, e.g., the Fr echet Inception Distance (FID) score (Heusel et al., 2017) for images. Inception score (IS) (Salimans et al., 2016) is also measured for px,i as additional generation quality metrics. Fingerprint secrecy is measured by the mean structural similarity index measure (SSIM) of individual images drawn from px,i. Compared with generation quality, this metric focuses on how obvious ﬁngerprints are rather than how well two content distributions match. Lastly, the ﬁngerprint capacity is n = 2dφ.

Existing model attribution methods exhibit a signiﬁcant tradeoff between attribution accuracy, generation quality, and secrecy, particularly when countermeasures against deattribution attempts, e.g., image postprocesses, are considered. For example, Kim et al. (2021) use shallow ﬁngerprints for image generators in the form of gi(z) = g0(z) + φi where g0( ) is an unﬁngerprinted model and show that φis have

Attributing Image Generative Models using Latent Fingerprints

Fingerprinted latent var.

Shared generator

Fingerprint estimation

Figure 1: (a) Visual comparison between latent ﬁngerprinting (our method) and shallow ﬁngerprinting (Kim et al., 2021) (baseline). Our method uses subtle semantic changes, rather than strong noises, to maintain attribution accuracy against image postprocesses. (b) Schematic of latent ﬁngerprinting: The same generator g and ﬁngerprint estimator f are used for all ﬁngerprinting models. Our method thus requires minimal compute and is scalable to large latent diffusion models.

to signiﬁcantly alter the original contents to achieve good attribution accuracy against image blurring, causing an unfavorable drop in generation quality and secrecy (Fig. 1(a)).

To improve this tradeoff, we investigate in this paper latent ﬁngerprints in the form of gi(z) = g0(ψ(z) + φi), where w := ψ(z) Rdw contains disentangled semantic dimensions that allow a smoother mapping to the content space (Fig. 1(a)). Such ψ has been incorporated in popular models such as Style GAN (SG) (Karras et al., 2019; 2020), where w is the style vector, and latent diffusion models(LDM) (Rombach et al., 2022), where w comes from a diffusion process. Existing studies on semantic editing showed that Rdw consists of linear semantic dimensions (H ark onen et al., 2020; Zhu et al., 2021). Inspired by this, we hypothesize that using subtle yet semantic changes as ﬁngerprints will improve the robustness of attribution accuracy against image postprocesses, and thus investigate the performance of ﬁngerprints that are generated by perturbations along latent dimensions of Rdw. Speciﬁcally, we consider latent dimensions as eigenvectors of the covariance matrix of the latent distribution pw, denoted by Σw.

Contributions. (1) We propose a novel ﬁngerprinting strategy that directly embeds the ﬁngerprints into pretrained generative model, as a mean to achieve responsible white-box model distribution. (2) We prove and empirically verify that there exists an intrinsic tradeoff between attribution accuracy and generation quality. This tradeoff is affected by ﬁngerprint variables including the choice of the ﬁngerprinting space, the ﬁngerprint strength, and its capacity. Parametric studies on these variables for Style GAN2 (SG2) and a Latent Diffusion Model(LDM) lead to improved accuracy-quality tradeoff from the previous SOTA. In addition, our method requires negligible computation compared with previous SOTA, rendering it more applicable to popular large-scale models, including latent diffusion ones. (3) We show that using a postprocess-speciﬁc LPIPS metric for model attribution leads to further improved attribution accuracy against

image postprocesses.

2. Related Work

Model attribution through ﬁngerprint encoding and decoding. Yu et al. (2020) propose to encode binary-coded keys into images through gi(z) = g0([z, φi]) and to decode them via another learnable function. This requires joint training of the encoder and decoder over Rdz Φ to empirically balance attribution accuracy and generation quality. Since ﬁngerprint capacity is usually high (i.e., 2dφ), training is made tractable by sampling only a small subset of ﬁngerprints. Thus this method is computationally expensive and lacks a principled understanding of how the ﬁngerprinting mechanism affects the accuracy-quality tradeoff. In contrast, our method does not require any additional training and mainly relies on simple principle component analysis of the latent distribution.

Certiﬁable model attribution through shallow ﬁngerprints. Kim et al. (2021) propose shallow ﬁngerprints gi(z) = g0(z) + φi and linear classiﬁers for attribution. These simpliﬁcations allow the derivation of sufﬁcient conditions of Φ to achieve certiﬁable attribution of G. Since the ﬁngerprints are added as noises rather than semantic changes coherent with the generated contents, increased noise strength becomes necessary to maintain attribution accuracy under postprocesses. While this paper does not provide attribution certiﬁcation for latent ﬁngerprint, we discuss the technical feasibility and challenges in achieving this goal.

Style GAN and low-rank subspace. Our study focuses on popular image generation models which share an architecture rooted in SG: A Gaussian distribution is ﬁrst transformed into a latent distribution (pw), samples from which are then decoded into images. H ark onen et al. (2020) apply principal component analysis on pw distribution and found semantically meaningful editing directions. Zhu et al.

Attributing Image Generative Models using Latent Fingerprints

(2021) use local Jacobian ( wg) to derive perturbations that enable local semantic editing of generated images, and show that such semantic dimensions are shared across the latent space. In this study, we show that the mean of the Gram matrix for local editing (Ew pw[ wg T wg]) and the covariance of w (Σw) are qualitatively similar in that both reveal major to minor semantic dimensions through their eigenvectors.

GAN inversion. The model attribution problem can be formulated as a GAN inversion problem. A learning-based inversion (Perarnau et al., 2016; Bau et al., 2019) optimizes parameters of the encoder network which map an image to latent code z. On the other hand, optimizationbased inversion (Abdal et al., 2019; Huh et al., 2020) solve for latent code z that minimizes distance metric between a given image and generated image g(z). The learning-based method is computationally more efﬁcient in the inference stage compared to optimization-based method. However, optimization-based GAN inversion achieves a superior quality of latent interpretation, which can be referred to as the quality-time tradeoff (Xia et al., 2022). In our method, we utilized the optimization-based inversion, as faithful latent interpretation is critical in our application. To further enforce faithful latent interpretation, we incorporate existing techniques, e.g., parallel search, to solve this non-convex problem, but uniquely exploit the fact that ﬁngerprints are small latent perturbations to enable analysis on the accuracyquality tradeoff.

3.1. Notations and preliminaries

Notations. For x Rn and A Rn m, denote by proj Ax the projection of x to span(A), and by A the pseudo inverse of A. For parameter a, we denote by ˆa its estimate and ϵa = ˆa a the error. xf is the gradient of f with respect to x, Ex px[ ] is an expectation over px, and tr(B) (resp. det(B)) is the trace (resp. determinant) of B Rn n. diag(λ) Rn n diagonalizes λ Rn.

Latent Fingerprints. Contemporary generative models, e.g., SG2 and LDM, consist of a disentanglement mapping ψ : Rdz Rdw from an easy-to-sample distribution pz to a latent distribution pw, followed by a generator g : Rdw Rdx that maps w to the content space. In particular, ψ is a multilayer perception network in SG2 and a diffusion process in a diffusion model. Existing studies showed that linear perturbations along principal components of wg enable semantic editing, and such perturbation directions are often applicable over w pw (H ark onen et al., 2020; Zhu et al., 2021). Indeed, instead of local analysis on the Jacobian, (H ark onen et al., 2020) showed that principal component analysis directly on pw also reveals semantic dimensions. This paper follows these ex-

isting ﬁndings and uses a subset of semantic dimensions as ﬁngerprints. Speciﬁcally, let U Rdw (dw dφ) and V Rdw dφ be orthonormal and complementary. Given random seed z Rdz, user-speciﬁc key φ Rdφ, and strength σ R, let α = U proj Uψ(z) Rdw dφ, the ﬁngerprinted latent variable is

wφ(α) = Uα + σV φ, (2)

where α pα and pα is induced by pw. Then, the user can generate ﬁngerprinted images, g(wφ(α)). The choice of (U, V ) and σ affects the attribution accuracy and generalization performance, which we analyze in Sec. 3.2.

Attribution.To decode user-speciﬁc key from the image g(wφ(α)), we formulate an optimization problem:

min ˆα, ˆφ l g(w ˆφ(ˆα)), g(wφ(α))

s.t. ˆαi [αl,i, αu,i], i = 1, ..., dw dφ.

While l is l2 norm for analysis in Sec.3.2, here we minimize LPIPS (Zhang et al., 2018) which measures the perceptual difference between two images. Through experiments, we discovered that attribution accuracy can be improved by constraining α. Here the upper and lower bounds of α are chosen based on the empirical limits observed from pα. In practice, we introduce a penalty on ˆα with large enough Lagrange multipliers and solve the resulting unconstrained problem. To avoid convergence to unfavorable local solutions, we also employ parallel search with n initial guesses of ˆα drawn through Latin hypercube sampling (LHS).

3.2. Accuracy-quality tradeoff

Attribution accuracy. Deﬁne Jw = g(w), Hw = JT w Jw. Let Hw = Ew pw[Hw] be the mean Gram matrix, and Hφ = Eα pα[Hwφ(α)] be its ﬁngerprinted version. Let l : Rdx Rdx R be a distance metric between two images, (ˆα, ˆφ) the estimates. To analyze how (V, U) affects the attribution accuracy, we use the following simpliﬁcations and assumptions: (A1) l( , ) is the l2 norm. (A2) Both ||ϵα|| and σ are small. In practice we achieve small ||ϵα|| through parallel search (see Appendix B). (A3) Since our focus is on ϵφ, we further assume that the estimation of α, denoted by ˆα(α), is independent from φ, and ϵα is constant. This allows us to ignore the subroutine for computing ˆα(α) and turns the estimation problem into an optimization with respect to only ϵφ. Formally, we have the following proposition (see Appendix A.1 for proof):

Proposition 3.1. c > 0 such that if σ c and ||ϵα||2 c, the ﬁngerprint estimation problem

min ˆφ Eα pα h g(w ˆφ(ˆα(α))) g(wφ(α)) 2 2 i

has an error ϵφ = (σ2V T HφV ) 1V T HφUϵα.

Attributing Image Generative Models using Latent Fingerprints

Table 1: Attribution accuracy and generation quality of the proposed method. FID-g0 and IS-g0 represent the baseline FID and inception score for the image quality of generative models prior to ﬁngerprinting. ( ) indicates higher (lower) is desired. The standard deviation is in parentheses.

Model Dataset Attribution Accuracy Image Quality

Ours w/o α-reg w/o LHS FID-g0 FID IS-g0 IS SSIM

SG2 FFHQ 0.983 0.877 0.711 7.24 8.59 5.16 4.96 0.93(0.02) SG2 AFHQ Cat 0.993 0.991 0.972 6.35 7.87 1.65 2.32 0.97(0.01) SG2 AFHQ Dog 0.999 0.998 0.981 3.80 5.36 9.76 12.33 0.95(0.01) LDM FFHQ 0.996 0.364 0.872 12.34 13.63 4.50 4.35 0.94(0.01)

Remarks: (1) Similar to the classic design of the experiment, one can reduce ||ϵφ|| by maximizing det(V T HφV ), which sets columns of V as the eigenvectors associated with the largest dφ eigenvalues of Hφ. However, Hφ is neither computable because φ is unknown during the estimation, nor is it tractable because Jwφ(α) is large in practice. To this end, we propose to use the covariance of pw, denoted by Σw, to replace Hφ in experiments. In Appendix C, we support this approximation empirically by showing that Σw and Hw (the non-ﬁngerprinted mean Gram matrix) are qualitatively similar in that the principal components of both matrices offer disentangled semantic dimensions. (2) Let the kth largest eigenvalue of Hw be γk. By setting columns of V as the eigenvectors of Hw associated with the largest dφ eigenvalues, and by noting that ˆφ is accurate only when all of its elements match with φ ((1)), the worst-case estimation error is governed by γ 1 dφ . This means that higher key capacity, i.e., larger dφ, leads to worse attribution accuracy. (3) From the proposition, ϵφ = 0 if V and U are complementary sets of eigenvectors of Hφ. In practice this decoupling between ϵφ and ϵα cannot be achieved due to the assumptions and approximations we made.

Generation quality. For analysis purpose, we approximate the original latent distribution pw by w = µ + Uα + V β where α N(0, diag(λU)), β N(0, diag(λV )), and µ = Ew pw[w]. λU Rdw dφ and λV Rdφ are calibrated to match pw. Denote λV,max = maxi{λV,i}. A latent distribution ﬁngerprinted by φ is similarly approximated as wφ = µ + Uα + σV φ. With mild abuse of notation, let g be the mapping from the latent space to a feature space (usually deﬁned by an Inception network in FID) and is continuously differentiable. Let the mean and covariance matrix of wi be µi and Σi, respectively. Denote by HU = Eα[JT µ+UαJµ+Uα] the mean Gram matrix in the subspace of U, and let γU,max be the largest eigenvalue of HU. We have the following proposition to upper bound ||µ0 µ1||2 2 and |tr(Σ0) tr(Σ1)|, both of which are related to the FID score for measuring the generation quality (see Appendix A.2 for proof):

Proposition 3.2. For any τ > 0 and η (0, 1), c(τ, η) >

0 and ν > 0, such that if σ c(τ, η) and λV,i c(τ, η) for all i = 1, ..., dφ, then µ0 µ1 2 2 σ2γU,maxdφ + τ and |tr(Σ0 Σ1)| λV,maxγU,maxdφ + 2νσ p

dφ + τ with probability at least 1 η.

Remarks: Recall that for improving attribution accuracy, a practical approach is to choose V as eigenvectors associated with the largest eigenvalues of Σw. Notices that with the approximated distribution with α N(0, diag(λU)) and β N(0, diag(λV )), Σw = diag([λT U, λT V ]T ). On the other hand, from Proposition 3.2, generation quality improves if we minimize λV,max by choosing V according to the smallest eigenvalues of Σw. In addition, smaller key capacity (dφ) and lower strength (σ) also improve the generation quality. Propositions 3.1 and 3.2 together reveal the intrinsic accuracy-quality tradeoff.

4. Experiments

In this section, we present empirical evidence of the accuracy-quality tradeoff and show an improved tradeoff from the previous SOTA by using latent ﬁngerprints. Experiments are conducted for both with and without a combination of postprocesses including (image noising, blurring, and JPEG compression, and their combination).

4.1. Experiment settings

Models, data, and metrics. We conduct experiments on SG2 (Karras et al., 2020) and LDM (Rombach et al., 2022) models trained on various datasets including FFHQ (Karras et al., 2019), AFHQ-Cat, and AFHQ-Dog (Choi et al., 2020). Generation quality is measured by the Frechet Inception distance (FID) (Heusel et al., 2017) and inception score (IS) (Salimans et al., 2016), attribution accuracy by (1), and ﬁngerprint secrecy by SSIM.

Latent ﬁngerprint dimensions. To approximate Σw, we drew 10K samples from pw for SG2, which has a semantic latent space dimensionality of 512, and 50K samples from pw for LDM, which has a semantic latent space dimensionality of 12,288. We deﬁne ﬁngerprint dimensions V as a subset eigenvectors of Σw associated with consecutive

Attributing Image Generative Models using Latent Fingerprints

Original Image Watermarked Image Differences

Original Image Watermarked Image Differences

Style GAN2 LDM

(a) Watermarking along Minor PCs (b) Watermarking along Major PCs

Fingerprinted Image Fingerprinted Image

(a) Fingerprinting along Minor PCs (b) Fingerprinting along Major PCs

Figure 2: Visualization of ﬁngerprints along minor and major principal components of the covariance of the latent distribution. (Top) Style GAN2. (Bottom) Latent Diffusion Model (LDM).

eigenvalues: V := PC[i : j], where PC is the full set of principal components of Σw sorted by their variances in the descending order while i and j represent the starting and ending indices of the subset.

Attribution. To compute the empirical accuracy (Eq. (1)), we use 1K samples drawn from pz for each ﬁngerprint φ, and use 1K ﬁngerprints where each bit is drawn independently from a Bernoulli distribution with p = 0.5. In Table 1, we show that both constraints on ˆα and parallel search with 20 initial guesses improve the empirical attribution accuracy across models and datasets. Notably, constrained estimation is essential for the successful attribution of LDMs. In these experiments, V is chosen as the eigenvectors associated with the 64 smallest eigenvalues of Σw as a worst-case scenario for attribution accuracy.

4.2. Attribution performance without postprocessing

We present generation quality results in Table 1. Since the least variant principal components are used as ﬁngerprints, generation quality (FID) and ﬁngerprint secrecy (SSIM) are preserved.

The results suggest that the attribution accuracy, generation quality, capacity (264), and ﬁngerprint secrecy are all acceptable using the proposed method. Fig. 2 visualizes and compares latent ﬁngerprints generated from small vs. large eigenvalues of Σw. Fingerprints corresponding to small eigenvalues are non-semantic, while those to large eigenvalues create semantic changes. We will later show that semantic yet subtle (perceptually insigniﬁcant) ﬁngerprints are necessary to counter image postprocesses.

Accuracy-quality tradeoff. Table 2 summarizes the tradeoff when we vary the choice of V and the ﬁngerprint strength σ while ﬁxing the ﬁngerprint length dφ to 64. Then in Table 3 we sweep dφ while keeping V as PCs associated with smallest eigenvalues of Σw and σ = 1. The experiments

are conducted on SG2 and LDM on the FFHQ dataset. The empirical results in Table 2 are consistent with our analysis: Accuracy decreases while generation quality improves when V is moved from major to minor principal components. For ﬁngerprint strength, however, we observe that the positive effect of strength on the accuracy, as predicted by Proposition 3.1, is only limited to small σ. This is because larger σ causes pixel values to go out of bounds, causing loss of information. In Table 3, we summarize the attribution accuracy, FID, and SSIM score under 32to 128-bit keys. Accuracy and generation quality, in particular the latter, are both affected by dφ as predicted.

4.3. Fingerprint performance with postprocessing

We now consider more realistic scenarios where generated images are postprocessed, either maliciously as an attempt to remove the ﬁngerprints or unintentionally, before they are attributed. Under this setting, our method achieves better accuracy-quality tradeoff than shallow ﬁngerprinting under two realistic settings: (1) when noising and JPEG compression are used as unknown postprocesses, and (2) when the set of postprocesses, rather than the ones that are actually chosen, is known.

Postprocesses. To keep our solution realistic, we solve the attribution problem by assuming that the potential postprocesses are unknown:

min ˆα, ˆφ l g(w ˆφ(ˆα)), T(g(wφ(α)))

s.t. ˆαi [αl,i, αu,i], i = 1, ..., dw dφ.

where T : Rdx Rdx is a postprocess function, and T(g(wφ(α))) is a given image from which the ﬁngerprint is to be estimated. We assume that T does not change the image in a semantically meaningful way, because otherwise the value of the image for either an attacker or a benign user will be lost. Since our method adds semantically mean-

Attributing Image Generative Models using Latent Fingerprints

Table 2: Tradeoff between attribution accuracy (Att.) and generation quality (FID, IS) under different ﬁngerprinting directions (PC) and strength (σ).

Style GAN2 σ = 0.6 σ = 1.0 σ = 6.0

Att. FID IS Att. FID IS Att. FID IS

PC[0:64] 0.99 129.0 1.23 0.99 110.8 1.59 0.99 101.3 4.31 PC[128:192] 0.98 8.5 4.93 0.99 8.7 4.92 0.99 39.2 3.94 PC[256:320] 0.98 8.6 4.96 0.99 9.1 4.87 0.96 31.1 3.90 PC[448:512] 0.97 8.1 4.99 0.98 8.5 4.96 0.90 26.3 4.75

LDM σ = 1.0 σ = 2.0 σ = 3.0

Att. FID IS Att. FID IS Att. FID IS

PC[0:64] 0.99 33.62 3.84 0.99 33.17 3.70 0.99 34.07 3.82 PC[1000:1064] 0.77 13.32 4.37 0.99 13.75 4.40 0.99 16.03 4.35 PC[2000:2064] 0.32 13.17 4.45 0.99 13.63 4.35 0.99 15.74 4.34 PC[3000:3064] 0.12 12.98 4.43 0.97 13.61 4.45 0.99 15.44 4.48 PC[4000:4064] 0.00 12.77 4.35 0.96 13.61 4.42 0.99 15.41 4.41

Table 3: Attribution accuracy (Att.) and generation quality for different key lengths (dφ). FID-BL is the baseline FID score. ( ) indicates higher (lower) is desired. The standard deviation of SSIM is in parentheses.

dφ Att. FID-BL FID SSIM IS

32 0.982 7.24 8.49 0.96(0.01) 4.90 64 0.983 7.24 8.59 0.92(0.02) 4.96 96 0.981 7.24 9.50 0.90(0.02) 4.93 128 0.973 7.24 9.61 0.87(0.03) 4.91

ingful perturbations to the images, we expect such latent ﬁngerprints to be more robust to postprocesses than shallow ones (Kim et al., 2021) added directly to images and will lead to improved attribution accuracy. To test this hypothesis, we consider four types of postprocesses: Noising, Blurring, JPEG, and Combo. Noising adds a Gaussian white noise of standard deviation randomly sample from U[0, 0.1]. Blurring uses a randomly selected Gaussian kernel size from [3, 7, 9, 16, 25] and a standard deviation of [0.5, 1.0, 1.5, 2.0]. We randomly sample the JPEG quality from [80, 70, 60, 50]. These parameters are chosen to be mild so that images do not lose their semantic contents. And Combo randomly chooses a subset of the three through a binomial distribution with p = 0.5 and uses the same postprocess parameters.

Modiﬁed LPIPS metric. In addition to testing the worstcase scenario where postprocesses are completely unknown, we also consider cases where they are known. While this is unrealistic for individual postprocesses, it is worth investigating when we assume that the set of postprocesses, rather than the ones that are actually chosen, is known. Within this scenario, we show that modifying LPIPS according to the

postprocess improves the attribution accuracy. To explain, LPIPS is originally trained on a so-called two alternative forced choice (2AFC) dataset. Each data point of 2AFC contains three images: a reference, p0, and p1, where p0 and p1 are distorted in different ways based on the reference. A human evaluator then ranks p0 and p1 by their similarity to the reference. Here we propose the following modiﬁcation to the dataset for training postprocess-speciﬁc metrics: Similar to 2AFC, for each data point, we draw a reference image x from the default generative model to be ﬁngerprinted and deﬁne p0 as the ﬁngerprinted version of x. p1 is then a postprocessed version of x given a speciﬁc T (or random combinations for Combo). To match with the setting of 2AFC, we sample 64 64 patches from x, p0, and p1 as training samples. We then rank patches from p1 as being more similar to those of x than p0. With this setting, the resulting LPIPS metric becomes more sensitive to ﬁngerprints than mild postprocesses. The detailed training of the modiﬁed LPIPS follows the vgg-lin conﬁguration in (Zhang et al., 2018). It should be noted that, unlike previous SOTA where shallow ﬁngerprint (Kim et al., 2021) or encoder-decoder models (Yu et al., 2020) are retrained based on the known attacks, our ﬁngerprinting mechanism, and therefore generalization performance, are agnostic to postprocesses.

Accuracy-quality tradeoff. We summarize ﬁngerprint performance metrics on SG2 and FFHQ in Table 4. The attribution accuracies reported here are estimated using the strongest parameters of each attack. For Combo, we use sequentially apply Blurring+Noising+JPEG as a deterministic worst-case attack. To estimate attribution accuracy, we solved the estimation problem in (4.3) where postprocesses are applied. The proposed method: We choose V as a subset of 32 consecutive eigenvectors of Σw starting

Attributing Image Generative Models using Latent Fingerprints

Table 4: Comparison on accuracy-quality tradeoff between proposed and baseline methods under image postprocesses. The experiments are tested using Style GAN2-FFHQ. Fingerprinting strength σ = 3. The FID score of the baseline method is 96.24. KN (UK) stands for when attribution accuracy is measured with (without) the knowledge of the attack. The standard deviation is in parentheses.

Metric Model Blurring Noising JPEG Combo - - UK KN UK KN UK KN UK KN

Att. BL (Kim et al., 2021) 0.85 0.88 0.85 0.87 0.87 0.89 0.83 0.88 PC[0:32] 0.79 0.99 0.99 0.99 0.98 0.99 0.82 0.99 PC[16:48] 0.56 0.92 0.95 0.99 0.98 0.99 0.42 0.88 PC[32:64] 0.32 0.83 0.93 0.98 0.98 0.99 0.26 0.79

SSIM BL (Kim et al., 2021) 0.67(0.08) 0.68(0.07) 0.67(0.07) 0.66(0.06) PC[0:32] 0.27(0.04) 0.27(0.04) 0.27(0.04) 0.27(0.04) PC[16:48] 0.40(0.08) 0.40(0.08) 0.40(0.08) 0.40(0.08) PC[32:64] 0.56(0.07) 0.56(0.07) 0.56(0.07) 0.56(0.07)

IS BL (Kim et al., 2021) 2.86 3.02 2.91 2.90 PC[0:32] 2.93 2.93 2.93 2.93 PC[16:48] 4.35 4.35 4.35 4.35 PC[32:64] 4.50 4.50 4.50 4.50

FID BL (Kim et al., 2021) 99.05 93.04 97.70 100.15 PC[0:32] 102.26 102.26 102.26 102.26 PC[16:48] 31.25 31.25 31.25 31.25 PC[32:64] 27.50 27.50 27.50 27.50

Table 5: Accuracy-quality tradeoff under Combo attack. V is deﬁned as the 8, 16, and 32 eigenvectors of Σw starting from the 33rd eigenvectors. σ = 3. KN (UK) stands for when attribution accuracy is measured with (without) knowledge of attacks. The standard deviation is in parentheses.

Model Key length UK KN SSIM IS FID

BL (Kim et al., 2021) N/A 0.83 0.88 0.66(0.06) 2.90 100.15 PC[32:40] 8 0.65 0.89 0.73(0.06) 4.75 12.35 PC[32:48] 16 0.45 0.85 0.65(0.06) 4.86 13.25 PC[32:64] 32 0.26 0.79 0.57(0.07) 4.50 27.50

from the 1th, 17th, and 33th eigenvectors, denoted respectively by PC[0:32], PC[16:48], and PC[32:64] in the table. ﬁngerprinting strength σ is set to 3. Attribution results from both a standard and a postprocess-speciﬁc LPIPS metric are reported in the UK (unknown) and KN (known) columns, respectively. Accuracies for our method are computed based on 100 random ﬁngerprint samples from 232, each with 100 random generations. The baseline: We compare with a shallow ﬁngerprinting method from (Kim et al., 2021) (denoted by BL). When the postprocesses are known, BL performs postprocess-speciﬁc computation to derive shallow ﬁngerprints that are optimally robust against the known postprocess. Results in UK and KN columns for BL are respectively without and with the postprocess-speciﬁc ﬁngerprint computation. BL accuracies are computed based on 10 ﬁngerprints, each with 100 random generations.

It is worth noting that the shallow ﬁngerprinting method is

not as scalable as ours (See Appendix: D, and increasing the key capacity decreases the overall attribution accuracy (see (Kim et al., 2021)). Also, recall that the key length affects attribution accuracy (Proposition 1). Therefore, we conduct a fairer comparison to highlight the advantage of our method. Here we choose a subset of ﬁngerprints PC[32 : 40] (256 ﬁngerprints) and report performance in Table 5, where accuracies are computed using the same settings as before. Visual comparisons between our method (PC[32 : 40]) and the baseline can be found in Fig. 3: To maintain attribution accuracy, high-strength shallow ﬁngerprints, in the form of color patches, are needed around eyes and noses, and signiﬁcantly lower the generation quality. In comparison, our method uses semantic changes that are robust to postprocesses. The choice of semantic dimensions, however, needs to be carefully chosen for the ﬁngerprint to be perceptually subtle.

Attributing Image Generative Models using Latent Fingerprints

Original Post-processed Watermarked

Noise Blur JPEG Combination Noise Blur JPEG Combination

Differences

(a) Our Method (b) SG2-BL

Fingerprinted

Figure 3: Comparison on generation quality between our method and the baseline with similar attribution accuracy The ﬁrst row shows original images generated without ﬁngerprinting. Each image in the second row represent robustly ﬁngerprinted images against corresponding post-processes. The next row illustrates post-processed images. The last row depicts the differences between the original (the ﬁrst row) and ﬁngerprinted images (the second row) using a heat map. Even if our method shows large pixel value changes, the ﬁngerprints are not perceptible compared with the baseline method (see second row).

Fingerprint secrecy. The secrecy of the ﬁngerprint is evaluated through the SSIM which is designed to measure the similarity between two images by taking into account three components: loss of correlation, luminance distortion, and contrast distortion (Wang et al., 2004). To facilitate a more equitable comparison between our methodology and the baseline, we select a subset of ﬁngerprints presented in Table 5 for evaluation. As shown in Table 5, the robustly ﬁngerprinted model for PC[32 : 40] exhibits superior ﬁngerprint secrecy compared to the baseline, while simultaneously outperforming it in attribution accuracy. Besides these quantitative measures, our approach also demonstrates a qualitative advantage in terms of secrecy when compared to the baseline (see Fig. 3). This is largely attributed to the fact that subtle semantic variations across images are more challenging to visually detect and thus being removed compared to typical artifacts introduced by shallow ﬁngerprinting.

5. Conclusion

This paper investigated latent ﬁngerprint as a solution to enable the attribution of generative models. Our solution achieved a better tradeoff between attribution accuracy and generation quality than the previous SOTA that uses shallow ﬁngerprints, and also has extremely low computational cost compared to SOTA methods that require encoder-decoder training with high data complexity, rendering our method more scalable to attributing large models

with high-dimensional latent spaces. Limitations and future directions: (1) There is currently a lack of certiﬁcation on attribution accuracy due to the nonlinear nature of both the ﬁngerprinting and the ﬁngerprint estimation processes. Formally, by considering both the generation and estimation processes as discrete-time dynamics, such certiﬁcation would require forward reachability analysis of ﬁngerprinted contents and backward reachability analysis of the ﬁngerprint, e.g., convex approximation of the support of px,i and ˆφ. It is worth investigating whether existing neural net certiﬁcation methods can be applied. (2) Our method extracts ﬁngerprints from the training data. Even with feature decomposition, the amount of features that can be used as ﬁngerprints is limited. Thus the accuracy-quality tradeoff is governed by the data. It would be interesting to see if auxiliary datasets can help to learn novel and perceptually insigniﬁcant ﬁngerprints that are robust against postprocesses, e.g., background patterns.

6. Acknowledgment

This work is partially supported by the National Science Foundation under Grant No. 2038666 and No. 2101052 and by an Amazon AWS Machine Learning Research Award (MLRA). Any opinions, ﬁndings, and conclusions expressed in this material are those of the author(s) and do not reﬂect the views of the funding entities.

Attributing Image Generative Models using Latent Fingerprints

Abdal, R., Qin, Y., and Wonka, P. Image2stylegan: How to embed images into the stylegan latent space? In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4432 4441, 2019.

Bau, D., Zhu, J.-Y., Wulff, J., Peebles, W., Strobelt, H., Zhou, B., and Torralba, A. Inverting layers of a large generator. In ICLR Workshop, volume 2, pp. 4, 2019.

Breland, A. The bizarre and terrifying case of the deepfake video that helped bring an african nation to the brink. motherjones, Mar 2019. URL https://www.moth erjones.com/politics/2019/03/deepfak e-gabon-ali-bongo/.

Brockman, G., Murati, M., Welinder, P., and Open AI. Openai api, 2020. URL https://openai.com/blog/ openai-api/.

Choi, Y., Uh, Y., Yoo, J., and Ha, J.-W. Stargan v2: Diverse image synthesis for multiple domains. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8188 8197, 2020.

H ark onen, E., Hertzmann, A., Lehtinen, J., and Paris, S. Ganspace: Discovering interpretable gan controls. Advances in Neural Information Processing Systems, 33: 9841 9850, 2020.

Hawthorne, C., Simon, I., Roberts, A., Zeghidour, N., Gardner, J., Manilow, E., and Engel, J. Multi-instrument music synthesis with spectrogram diffusion. ar Xiv preprint ar Xiv:2206.05408, 2022.

Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., and Hochreiter, S. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In Advances in Neural Information Processing Systems, pp. 6626 6637, 2017.

Huh, M., Zhang, R., Zhu, J.-Y., Paris, S., and Hertzmann, A. Transforming and projecting images into classconditional generative networks. In European Conference on Computer Vision, pp. 17 34. Springer, 2020.

Karras, T., Laine, S., and Aila, T. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4401 4410, 2019.

Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., and Aila, T. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8110 8119, 2020.

Kim, C., Ren, Y., and Yang, Y. Decentralized attribution of generative models. In International Conference on Learning Representations, 2021. URL https://open review.net/forum?id= kxlwvh Ood K.

Mishkin, P. and Ahmad, L. Dall e 2 preview - risks and limitations, 2022. URL https://github.com/o penai/dalle-2-preview/blob/main/syst em-card.md.

Perarnau, G., Van De Weijer, J., Raducanu, B., and Alvarez, J. M. Invertible conditional gans for image editing. ar Xiv preprint ar Xiv:1611.06355, 2016.

Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., and Sutskever, I. Language models are unsupervised multitask learners. 2019.

Ramesh, A., Pavlov, M., Goh, G., Gray, S., Voss, C., Radford, A., Chen, M., and Sutskever, I. Zero-shot textto-image generation. In International Conference on Machine Learning, pp. 8821 8831. PMLR, 2021.

Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M. Hierarchical text-conditional image generation with clip latents. ar Xiv preprint ar Xiv:2204.06125, 2022.

Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10684 10695, June 2022.

Salimans, T., Goodfellow, I., Zaremba, W., Cheung, V., Radford, A., and Chen, X. Improved techniques for training gans. In Advances in neural information processing systems, pp. 2234 2242, 2016.

Satter, R. Experts: Spy used ai-generated face to connect with targets. Experts: Spy used AI-generated face to connect with targets, Jun 2019. URL https://apne ws.com/bc2f19097a4c4fffaa00de6770b8a 60d.

Wang, Z., Bovik, A., Sheikh, H., and Simoncelli, E. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing, 13 (4):600 612, 2004. doi: 10.1109/TIP.2003.819861.

Xia, W., Zhang, Y., Yang, Y., Xue, J.-H., Zhou, B., and Yang, M.-H. Gan inversion: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.

Yu, N., Davis, L., and Fritz, M. Attributing fake images to gans: Analyzing ﬁngerprints in generated images. ar Xiv preprint ar Xiv:1811.08180, 2018.

Attributing Image Generative Models using Latent Fingerprints

Yu, N., Skripniuk, V., Chen, D., Davis, L., and Fritz, M. Responsible disclosure of generative models using scalable ﬁngerprinting. ar Xiv preprint ar Xiv:2012.08726, 2020.

Zhang, R., Isola, P., Efros, A. A., Shechtman, E., and Wang, O. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 586 595, 2018.

Zhu, J., Feng, R., Shen, Y., Zhao, D., Zha, Z.-J., Zhou, J., and Chen, Q. Low-rank subspaces in gans. Advances in Neural Information Processing Systems, 34:16648 16658, 2021.

Attributing Image Generative Models using Latent Fingerprints

A. Proof of Propositions

A.1. Proposition 1

Deﬁne Jw = g(w), Hw = JT w Jw, and Hφ = Eα pα[HUα+σV φ], where pα is induced by pw. Let xφ(α) be a content parameterized by (α, φ). Denote by ϵa = ˆa a the estimation error from the ground truth parameter a. Assume that the estimate ˆα(α) is computed independent from φ, and ϵα is constant. Proposition 1 states:

Proposition 1. c > 0 such that if σ c and ||ϵα||2 c, the ﬁngerprint estimation problem

min ˆφ Eα pα h g(U ˆα(α) + σV ˆφ) xφ(α) 2 2 i (3)

has an estimation error ϵφ = (σ2V T HφV ) 1V T HφUϵα.

Proof. Let ˆx := g(U ˆαφ(α) + σV ˆφ), we have

ˆx = g(U ˆα + σV ˆφ) = g(U(α + ϵα) + σV (φ + ϵφ)).

With Taylor s expansion, we have

ˆx = g(Uα + σV φ) + Jw(Uϵα + σV ϵφ) + o(Uϵα + σV ϵφ)

= xφ(α) + Jw(Uϵα + σV ϵφ) + o(Uϵα + σV ϵφ).

Ignoring higher-order terms and , we then have

xφ(α) ˆx 2 2 = Jw(Uϵα + σV ϵφ) + o(Uϵα + σV ϵφ) 2 2 = Jw(Uϵα + σV ϵφ) 2 2 + o(Uϵα + σV ϵφ)T Jw(Uϵα + σV ϵφ).

For any τ > 0, there exists c, such that if σ c and ||ϵα||2 c,

xφ(α) ˆx 2 2 Jw(Uϵα + σV ϵφ) 2 2 + τ

= σ2ϵT φV T Hw V ϵφ + 2ϵT φV T Hw Uϵα + ϵT αU T Hw Uϵα + τ.

Removing terms independent from ϵφ to reformulate (3) as

min ϵφ σ2ϵT φV T HφV ϵφ + 2ϵT φV T HφUϵα,

the solution of which is ϵφ = (σ2V T HφV ) 1V T HφUϵα.

A.2. Proposition 2

Consider two distributions: The ﬁrst is w0 = µ+Uα+V β where µ Rdw, α N(0, diag(λU)), and β N(0, diag(λV )). diag(λ) is a diagonal matrix where diagonal elements follow λ. The second distribution is w1 = µ + Uα + σV φ where σ > 0 and φ {0, 1}dφ. Let g : Rdw Rdx C1. Let the mean and covariance matrix of wi be µi and Σi. Denote by HU = Eα[JT µ+UαJµ+Uα] the mean Gram matrix, and let γU,max be the largest eigenvalue of HU. Proposition 2 states:

Proposition 2. For any τ > 0 and η (0, 1), there exists c(τ, η) > 0 and ν > 0, such that if σ c(τ, η) and λV,i c(τ, η) for all i = 1, ..., dφ, µ0 µ1 2 2 σ2γU,maxdφ +τ and |tr(Σ0 Σ1)| λV,maxγU,maxdφ +2νσ p

dφ +τ with probability at least 1 η.

Attributing Image Generative Models using Latent Fingerprints

Proof. We start with µ0 µ1 2 2. From Taylor s expansion and using the independence between α and β, we have

µ0 :=Eα,β [g(µ + Uα + V β)]

=Eα [g(µ + Uα)] + Eα,β [Jµ+UαV β + o(Jµ+UαV β)] +

=Eα [g(µ + Uα)] + Eα,β [o(Jµ+UαV β)] ,

µ1 :=Eα [g(µ + Uα + σV φ)]

=Eα [g(µ + Uα) + o(σJµ+UαV φ)] + σEα [Jµ+UαV φ]

=µ0 + σEα [Jµ+UαV φ] + Eα,β [o(Jµ+UαV (σφ β))] .

Let v = V φ. With orthonormal V and binary-coded φ, we have

v 2 2 = φT V T V φ = φ 2 2 dφ. (5)

For the residual term Eα,β [o(Jµ+UαV (σφ β))] 2 2 and any τ > 0 and η (0, 1), there exists c(τ, η) > 0, such that if σ c(τ, η) and λV,i c(τ, η) for all i = 1, ..., dφ, we have

Pr Eα,β [o(Jµ+UαV (σφ β))] 2 2 τ 1 η. (6)

Lastly, we have Eα[Jµ+Uαv] 2 2 Eα[v T JT µ+UαJµ+Uαv]

= v T HUv γU,max v 2 2 γU,maxdφ. (7)

Then combining (11), (5), (6), (7), we have with probability at least 1 η

µ0 µ1 2 2 σ2γU,maxdφ + τ. (8)

For covariances, let ΣU = Cov(g(µ + Uα)). We have

Σ0 :=Eα,β (g(µ + Uα + V β) µ0)(g(µ + Uα + V β) µ0)T

=ΣU + Eα Jµ+UαV diag(λV )V T JT µ+Uα + Eα,β o(Jµ+UαV β)(g(µ + Uα + V β) µ0)T

Σ1 :=Eα (g(µ + Uα + σV φ) µ1)(g(µ + Uα + σV φ) µ1)T

=ΣU + σ2Cov(Jµ+UαV φ ) + 2σCov(g(µ + Uα), Jµ+UαV φ + o(Jµ+UαV φ)).

For tr(Σ0), using the same treatment for the residual, we have for any τ > 0 and η (0, 1), there exists c(τ, η) > 0, such that if λV,i c(τ, η) for all i = 1, ..., dφ, the following upper bound applies with at least probability 1 η:

tr(Σ0) tr(ΣU) + tr(Eα Jµ+UαV diag(λV )V T JT µ+Uα ) + τ

tr(ΣU) + λV,maxtr(Eα Jµ+UαV V T JT µ+Uα ) + τ

= tr(ΣU) + λV,maxtr(Eα V T JT µ+UαJµ+UαV ) + τ

tr(ΣU) + λV,maxγU,maxtr(V T V ) + τ

tr(ΣU) + λV,maxγU,maxdφ + τ.

For the lower bound, we have tr(Σ0) tr(ΣU).

For tr(Σ1), we ﬁrst denote by JT i the ith row of Jµ+Uα, ΣJi its covariance matrix, and σ2 i the maximum eigenvalue of ΣJi. Then with binary-coded φ, we have

V ar(JT i V φ) = φT V T Cov(Ji)V φ σ2 i dφ. (11)

Then let gi (resp. vi) be the ith element of g(µ + Uα) (resp. Jµ+UαV φ), and σ2 U,i be the ith diagonal element of ΣU. Using (11), we have the following bound on the trace of the covariance between g(µ + Uα) and Jµ+UαV φ:

|tr(Cov(g(µ + Uα), Jµ+UαV φ))| =

i=1 Cov(gi, vi)

i=1 σU,iσi p

Attributing Image Generative Models using Latent Fingerprints

Figure 4: (a) Average percentage error rate on α (b) Comparison between ﬁngerprints guided by Σw and Hw. The editing strength for top two rows and bottom two rows are 0.05 and 0.2 respectively.

Lastly, by ignoring σ2 terms and borrowing the same τ, η, and c(τ, η), we have with probability at least 1 η:

tr(Σ1) tr(ΣU) + 2σtr(Cov(g(µ + Uα), Jµ+UαV φ)) + τ

tr(ΣU) + 2σ

i=1 σU,iσi p

dφ + τ, (13)

tr(Σ1) tr(ΣU) 2σ

i=1 σU,iσi p

Therefore, with probability at least 1 η

tr(Σ0) tr(Σ1) λV,maxγU,maxdφ + 2σ

i=1 σU,iσi p

dφ + τ, (15)

tr(Σ0) tr(Σ1) 2σ

i=1 σU,iσi p

B. Convergence on α

In the proofs, we assume that ϵα 2 is small and constant. Here we show empirical estimation results on SG2 and on FFHQ, AFHQ-DOG, AFHQ-CAT datasets. The results in Fig. 4(a) are averaged over 100 random α and 100 random φ, and uses parallel search on α during the estimation.

C. Qualitative similarity between Hw and Σw

Since computing Hw for large models is intractable, here we train a SG2 on MNIST to estimate Hw. Fig. 4(b) summarizes perturbed images from a randomly chosen reference along principal components of Hw and Σw. Note that both have quickly diminishing eigenvalues. Therefore most components other than the few major ones lead to imperceptible changes in the image space.

Attributing Image Generative Models using Latent Fingerprints

D. Computational Complexity and Efﬁciency Comparison of Proposed and Baseline Methods

To comprehensively evaluate the computational costs of the proposed and baseline methods, we analyzed them from two perspectives: ﬁngerprint generation and attribution. Our proposed method demonstrates a signiﬁcant increase in efﬁciency compared to existing methods with regards to ﬁngerprint generation. However, current methods, such as those proposed in (Kim et al., 2021), often necessitate a considerable amount of time for ﬁne-tuning the model before generating a ﬁngerprinted image. For instance, the baseline method requires approximately one hour to ﬁne-tune the model for each individual user. For a key capacity of 232 users, it would take an estimated 232 hours to train on an NVIDIA V100 GPU. In contrast, our proposed method does not require the model to be ﬁne-tuned, and only requires Principal Component Analysis (PCA) to be performed on the latent space of each pre-trained model to identify the editing direction. This process takes approximately three seconds for a key capacity of 232.

Regarding attribution time, the baseline approach performs attribution through a pre-trained network, resulting in low computation cost during inference. On the other hand, the proposed method uses optimization techniques to perform attribution, resulting in a longer computation time. Speciﬁcally, the average attribution time for the baseline method is approximately two seconds, while the proposed method takes approximately 126 seconds on average for 1k optimization trials (in parallel) using an NVIDIA V100 GPU.

It is important to acknowledge that there exists a trade-off between computational costs during generation and attribution. The choice of which aspect is more critical may depend on the speciﬁc application requirements.

E. Ablation Study

In this section, we estimated attribution accuracy based on various attack parameters with multiple editing directions (see Tab.6,7,8,9). The image quality evaluation is available in Tab.10 and more visualizations can be found in Fig.5.

Table 6: Attributability Table of Blurring attack. σ refers standard deviation of Gaussian Blur ﬁlter size 25. When attributability is measured with (without) knowledge of attack, we put results under KN (UK).

Metric Model σ=0.5 σ=1.0 σ=1.5 σ=2.0 - - UK KN UK KN UK KN UK KN

BL 0.88 0.89 0.87 0.89 0.87 0.88 0.85 0.88 PC[32:40] 0.99 0.99 0.95 0.99 0.90 0.99 0.53 0.92 PC[32:48] 0.99 0.99 0.97 0.99 0.72 0.92 0.38 0.88 PC[32:64] 0.99 0.99 0.73 0.94 0.51 0.90 0.32 0.83

Table 7: Attributability Table of Noise attack. σ refers standard deviation of Gaussian normal distribution. When attributability is measured with (without) knowledge of attack, we put results under KN (UK).

Metric Model σ=0.025 σ=0.05 σ=0.075 σ=0.1 - - UK KN UK KN UK KN UK KN

Att. BL 0.87 0.88 0.86 0.88 0.86 0.87 0.85 0.87 PC[32:40] 0.99 0.99 0.99 0.99 0.99 0.99 0.99 0.99 PC[32:48] 0.99 0.99 0.97 0.99 0.94 0.99 0.95 0.99 PC[32:64] 0.98 0.99 0.95 0.99 0.92 0.98 0.93 0.98

Attributing Image Generative Models using Latent Fingerprints

Original PC[32:40] PC[32:48] PC[32:64]

Figure 5: Qualitative Comparison of Fingerprinted Samples. The ﬁrst column shows original images g0(w). Latent ﬁngerprinted images are in the second to the last column.

Attributing Image Generative Models using Latent Fingerprints

Table 8: Attributability Table of JPEG attack. Q refers quality metric of JEPG compression. When attributability is measured with (without) knowledge of attack, we put results under KN (UK).

Metric Model Q=80 Q=70 Q=60 Q=50 - - UK KN UK KN UK KN UK KN

Att. BL 0.88 0.89 0.87 0.89 0.87 0.89 0.87 0.89 PC[32:40] 0.99 0.99 0.99 0.99 0.99 0.99 0.99 0.99 PC[32:48] 0.99 0.99 0.99 0.99 0.99 0.99 0.99 0.99 PC[32:64] 0.99 0.99 0.99 0.99 0.99 0.99 0.98 0.99

Table 9: Attributability Table of combination attack. From T1 to T4, the attack parameters are composed of the weakest to the strongest attack parameters of each attack (e.g., T4 is [σblur = 2.0, σnoise = 0.2, QJPEG=50]). When attributability is measured with (without) knowledge of attack, we put results under KN (UK).

Metric Model T1 T2 T3 T4 - - UK KN UK KN UK KN UK KN

Att. BL 0.86 0.88 0.86 0.87 0.85 0.86 0.83 0.88 PC[32:40] 0.99 0.99 0.94 0.99 0.81 0.95 0.65 0.89 PC[32:48] 0.99 0.99 0.74 0.92 0.52 0.88 0.45 0.85 PC[32:64] 0.99 0.99 0.63 0.90 0.41 0.82 0.26 0.79

Table 10: Quality Comparison Table. Standard deviation are in parentheses. The baseline score is in the parentheses.

Model FID (7.24) IS (4.95) SSIM

BLBlur 99.05 2.86 (0.35) 0.67(0.08) BLNoise 93.04 3.02 (0.27) 0.68(0.07) BLJPEG 97.70 2.91 (0.26) 0.67(0.07) Bl Combo 100.15 2.90 (0.23) 0.66(0.06) PC[32:40] 12.35 4.75 (0.05) 0.73(0.06) PC[32:48] 13.25 4.86 (0.08) 0.65(0.06) PC[32:64] 27.50 4.50 (0.07) 0.57(0.07)