SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
f (t) = \frac {\Gamma \left(\frac {\nu + 1}{2}\right)}{\sqrt {\nu \pi} \Gamma \left(\frac {\nu}{2}\right)} \left(1 + \frac {t ^ {2}}{\nu}\right) ^ {- (\nu + 1) / 2} \tag {7}
$$
In Eq. 7,  $\nu$  is the number of degrees of freedom and  $\Gamma$  is the gamma function. Based on Eq. 7, we have the cumulative distribution function:
$$
\mathbb {P} \left(t <   t ^ {\prime}\right) = \int_ {- \infty} ^ {t ^ {\prime}} f (u) d u = 1 - \frac {1}{2} \beta \left(\frac {\nu}{t ^ {\prime 2} + \nu}, \frac {\nu}{2}, \frac {1}{2}\right) \tag {8}
$$
where  $\beta$  denotes the incomplete beta function. Therefore, given a confidence level  $\alpha$  and the number of degrees of freedom  $\nu$ , we have can use Eq. 9 to obtain the value of the critical value  $t_{\alpha,\nu}$ .
$$
\mathbb {P} (t <   t _ {\alpha , \nu}) = 1 - \alpha \tag {9}
$$
Table 9: Results when the inspected model and the other model has the similar architectures but their numbers of layers are different.
M1's Number of Layers	M2's Number of Layers	Acc
4	2	97.5%
2	4	98.0%
Table 10: Results when the inspected model and the other model has the similar architectures but their number of channels in the first Conv layer are different.
M1's Number of Channels in the first Conv Layer	M2's Number of Channels in the first Conv Layer	Acc
64	48	97.5%
48	64	96.0%
C More Results for Distinguishing Belonging Images and Images Generated by Other Models.
In this section, we provide more results for distinguishing belonging images of the model and the images generated by other models. We first consider distinguishing the belonging images and the images generated by the other models having the same architecture and overlapped training data. Given a model  $\mathcal{M}_1$ , we focus on the other model  $\mathcal{M}_2$  which shares the same architecture as  $\mathcal{M}_1$  and has training data that overlaps with  $\mathcal{M}_2$  's training data.
The model architecture used here is DCGAN [1]. We trained  $\mathcal{M}_1$  on the full CIFAR-10 [48] dataset, while  $\mathcal{M}_2$  is trained on the randomly sampled subsets of the CIFAR-10 dataset. The results are presented in Table 8, where the first column indicates the proportion of overlap between the training data of  $\mathcal{M}_1$  and  $\mathcal{M}_2$ . The second column of Table 8 displays the accuracy of RONAN in detecting the differences. Notably, even when  $90\%$  of  $\mathcal{M}_2$ 's training data overlaps with that of  $\mathcal{M}_1$ , the detection accuracy remains above  $95\%$ . These results demonstrate that our method is still effective
when the training data of the inspected model and that of the other model are similar. We also consider distinguishing the belonging images and the images generated by the other models having the same training data and similar architectures. We use DCGAN [1] here and modifies the number of layers and the number of channels in the first Conv layer in the models to make  $\mathcal{M}_1$  and  $\mathcal{M}_2$  have similar architectures. Both  $\mathcal{M}_1$  and  $\mathcal{M}_2$  here are trained on CIFAR-10 [48] dataset. The results can be found in Table 9 and Table 10. Based on these results, our method is effective even the inspected model and other models have the same training dataset and similar architectures. We also provide a summary of the combinatorial setups used for distinguishing belonging images and images generated by other models in Table 11.
Table 8: Results when the inspected model and the other model has the same architecture and their training data has overlaps.
Overlap Fraction	Acc
50%	98.5%
60%	98.0%
70%	98.5%
80%	96.0%
90%	96.5%
D A Thought Experiment on VAE.
If a image generation model perfectly fits the training samples, then the images generated by it will be indistinguishable to its training samples (which are real images). In this section, we investigate a question: "Can image generation models perfectly fit the training samples?" To study this question, we conduct a thought experiment on VAE [6]. In detail, we randomly sample 10 images from MNIST [79] dataset, and use VAE [6] with different numbers of neurons in the hidden layer to fit these 10 images. We set the epoch number to 5000 to ensure the training losses that measures the distance between the generated samples and the training samples of the model are converged. The detailed final training losses with different model sizes are shown in Table 12. There are two parts in the total training loss  $\mathcal{L}_{\mathrm{total}}$ : the reconstruction part  $\mathcal{L}_{\mathrm{reconstruction}}$  and the KL-divergence part  $\mathcal{L}_{\mathrm{divergence}}$ , i.e.,  $\mathcal{L}_{\mathrm{total}} = \mathcal{L}_{\mathrm{reconstruction}} + \mathcal{L}_{\mathrm{divergence}}$ . In Table 12, Detailed values for each part are demonstrated.
Table 11: Summary of combinatorial setups for distinguishing belonging images and images generated by other models.
Setting	M1	M2
Model	Training Dataset	Model	Training Dataset
Different Model Architecture	DCGAN	CIFAR-10	VAE	CIFAR-10
DCGAN	CIFAR-10	StyleGAN2ADA	CIFAR-10
DCGAN	CIFAR-10	DDIM	CIFAR-10
DCGAN	CIFAR-10	DDPM	CIFAR-10
DCGAN	CIFAR-10	TransGAN	CIFAR-10
VAE	CIFAR-10	DCGAN	CIFAR-10
VAE	CIFAR-10	StyleGAN2ADA	CIFAR-10
VAE	CIFAR-10	DDIM	CIFAR-10
VAE	CIFAR-10	DDPM	CIFAR-10
VAE	CIFAR-10	TransGAN	CIFAR-10
StyleGAN2ADA	CIFAR-10	VAE	CIFAR-10
StyleGAN2ADA	CIFAR-10	DCGAN	CIFAR-10
StyleGAN2ADA	CIFAR-10	DDIM	CIFAR-10
StyleGAN2ADA	CIFAR-10	DDPM	CIFAR-10
StyleGAN2ADA	CIFAR-10	TransGAN	CIFAR-10
Consistency Model	ImageNet	StyleGAN XL	ImageNet
StyleGAN XL	ImageNet	Consistency Model	ImageNet
ControlGAN	CUB-200-2011	StackGAN-v2	CUB-200-2011
StackGAN-v2	CUB-200-2011	ControlGAN	CUB-200-2011
Similar Model Architecture	DCGAN	CIFAR-10	DCGAN with different numbers of layers	CIFAR-10
DCGAN	CIFAR-10	DCGAN with different numbers of channels	CIFAR-10
Different Training Dataset	Consistency Model	ImageNet	Consistency Model	LSUN
Consistency Model	LSUN	Consistency Model	ImageNet
Overlapping Training Dataset	DCGAN	CIFAR-10	DCGAN	50% subset of CIFAR-10
DCGAN	CIFAR-10	DCGAN	60% subset of CIFAR-10
DCGAN	CIFAR-10	DCGAN	70% subset of CIFAR-10
DCGAN	CIFAR-10	DCGAN	80% subset of CIFAR-10
DCGAN	CIFAR-10	DCGAN	90% subset of CIFAR-10
Table 12: Detailed final training losses with different model sizes in the thought experiments on VAE.
Num of Neurons in Hidden Layer	\( {\mathcal{L}}_{\text{total }} \)	\( {\mathcal{L}}_{\text{reconstruction }} \)	\( {\mathcal{L}}_{\text{divergence }} \)
1	184.24	183.93	0.31
5	105.27	99.68	5.59
10	77.20	69.07	8.13
50	53.52	47.55	5.97
100	53.23	47.99	5.24
500	53.04	48.21	4.83
1000	53.81	48.93	4.88
With the increases in the model sizes, the final total training losses reduce at first. However, when the model is large enough, the final total training loss becomes stable at the region from 53.00-54.00. The results show that even the VAEs with enough large sizes can not fit all pixels perfectly. We also conduct the reverse-engineering of the training samples on the trained VAE with 1000 neurons in the hidden layer. The results show that we can not reconstruct the exact training samples.
As pointed out by existing works [33, 80, 81], morden generative models (e.g., VAEs, GANs, and Diffusion models) including the state-of-the-art models such as Stable Diffusion [3] and DALLE [13] will leave forensics traces in the frequency spaces of the generated images. This is caused by indispensable operations used in modern generative models (e.g., Upsampling operations and Convolutional Layers). Also, perfectly fitting the training samples means finding the global optimum in the optimization process. However, the essential gradient descent optimizers used in modern generative models (e.g., SGD and Adam) typically can not get the global optimum. Based on the above analysis and empirical results, at least we can conclude that the probabilities that the real images belong to the output space of generative models are very low.
E Discussion on Different Reverse-engineering Methods
In this section, we discuss the details of the reverse-engineering process on different models and the effects of different reverse-engineering methods. The details of the reverse-engineering for different
Table 13: Details of reverse-engineering on different models.
Model	Details of Reverse-engineering
DCGAN	Using gradient decent to optimize the input in the noise space.
VAE	Using gradient decent to optimize the input in the noise space.
StyleGAN2-ADA	Using gradient decent to optimize the input in the noise space.
Consistency Model	Using gradient Decent to optimize the input in the noise space.
StyleGAN XL	Using gradient decent to optimize the input in the noise space.
ControlGAN	Using gradient decent to optimize the feature in the intermediate feature space before the G3 layer.
StackGAN-v2	Using gradient decent to optimize the feature in the intermediate feature space before the G2 layer.
Stable Diffusion 2	Using gradient decent to optimize the feature in the intermediate feature space before the decoder.
Table 14: Results under different inversion methods for StyleGANs.
Model	Space	Acc
StyleGAN2-ADA	Z space	97.0%
W+ space	96.0%
StyleGAN XL	Z space	93.0%
W+ space	93.5%
Table 15: Results under different inversion methods for Stable Diffusion.
Inversion Method	Acc
Default	87.5%
DDIM Inversion	55.5%
Parmar et al.	62.5%
models are summarized in Table 13. We also investigate the effects of different reverse-engineering methods. For StyleGAN2-ADA [10] and StyleGAN-XL [30], we use the random noise space (i.e., Z space) to reconstruct the images by default. We also conducted experiments on using intermediate latent space (i.e.,  $\mathcal{W}+$  space) to reconstruct the images for distinguishing belonging images and images generated by other models (see setting for Table 3). The results on StyleGAN2-ADA with the CIFAR-10 [48] dataset and StyleGAN XL with ImageNet dataset are shown in Table 14. As can be observed, using the  $\mathcal{W}+$  space has similar accuracy to using Z space, meaning that our method is not sensitive to the selection of the input spaces used for optimization.
We also conduct experiments for different reverse-engineering methods designed for diffusion models (i.e., DDIM inversion [2], Parmar et al. [82] and our method) on the Stable Diffusion v2 [3] model with the setting described in § 5.3. The results are shown in Table 15. DDIM inversion [2] is an inversion approach performing the reverse of the DDIM sampling. It is based on the assumption that the ODE process can be reversed in limited of small steps. It only has unsatisfying inversion performance on the conditional diffusion models (e.g., Stable Diffusion) because it will magnify the accumulated error in the inversion process (since it ignores the classifier-free guidance in the diffusion process). As can be seen in the above table, the accuracy of using DDIM inversion is only  $55.5\%$ . Parmar et al. [82] improve the DDIM inversion by using an approximated prompt as the conditional guidance in the inversion process. The approximated prompts are generated by a caption model (i.e., BLIP). This method's inversion quality is dependent on the captions used. Given a generated image of the inspected model, since the caption model can not get the accurate prompt used for generating this image, the inversion using this method is also not accurate, leading that the reconstruction losses of the belonging images and non-belonging images are not highly separable (the accuracy is  $62.5\%$ ). Compared to DDIM inversion [2] and Parmar et al. [82], our method achieves higher accuracy.
F Discussion on Different Methods for Measuring the Complexity of the Images
In this section, we discuss the different methods for measuring the complexity of the images.
We first discuss the reference model based method. Here, we conducted experiments that using different models as reference models. The inspected model here is the StyleGAN2-ADA [10] model trained on CIFAR-10 [48] dataset and the setting here is identical to that used in the Table 2 (belongings vs training data). The results can be found in Table 16. As can be observed, using
Table 16: Results on using different models as reference models.
Reference Model	Acc
Consistency Model	97.0%
StyleGAN XL	95.0%
Stable Diffusion	96.0%
different reference models yields similar results, meaning that our method is not sensitive to the selection of the reference models. The measurement of the image complexity can also be implemented
Table 17: Results under adaptive attack with instagram filter editing.
TP	FP	FN	TN	Acc
96	15	4	85	90.5%
Table 18: Results under adaptive attack with box blur filter editing.
Box Size	Acc	SSIM
1	92.5%	0.8920
2	83.0%	0.7446
3	58.0%	0.5174
4	53.5%	0.3530
by calculating the 2D entropy of the image [83]. Using this entropy-based method as the image complexity measurement also yields  $97.0\%$  final detection accuracy in our setting.
G Adaptive Attack
In this section, we evaluate the robustness of RONAN against the adaptive attack where the malicious user is aware of it and try to bypass the inspection of RONAN. For example, when the malicious user use a specific model to generate an image, he/she can make a slight modification on the image to bypass the inspection of the origin attribution algorithm. We consider the image editing as the adaptive attack because it can preserve most of the information in the original image while changing the image. To investigate if RONAN is robust to the image-editing-based adaptive attack, we use the _1977 instagram filter<sup>3</sup> and the box blur filter to conduct results. The model used here is the DCGAN [1] model trained on the CIFAR-10 [48] dataset. The results are shown in Table 17 and Table 18. For _1977 instagram filter, we can see that the detection accuracy of RONAN is still above  $90\%$  even under the adaptive attack. For box blur filter, we show the results under different box sizes of the filter. Besides the detection accuracy (Acc) of our method, we also demonstrate the Structural Similarity Index (i.e., SSIM [60]) between the original images and the edited images, which can measure the similarity between them. A higher SSIM value means the edited images are more similar to the original images. As can be observed, our method remains effective under relatively small box sizes. As the box sizes expand, however, the detection accuracy of our method diminishes. This outcome is understandable and acceptable, as it corresponds to a rapid reduction in the Structural Similarity Index (SSIM) between the edited images and their unaltered counterparts. When employing larger box sizes, it is conceivable that an adaptive attacker might find ways to elude our method's scrutiny, yet this comes at the cost of substantially compromising the quality of the edited images. Consequently, our method maintains its effectiveness even in the face of adaptive attacks that seek to maintain the quality of the edited images.
H Efficiency
In this section, we discuss the efficiency of RONAN. To study the efficiency, we measure
the runtime of our method on different models (i.e., DCGAN [1], VAE [6], StyleGAN2-ADA [10], Consistency Model [4], and Stable Diffusion v2 [3]). For each model, we run 5 times on one Quadro RTX 6000 GPU and collect the average runtime and its standard deviation. The results can be found in Table 19. Our method can be accelerated by using mixed precision training [84]. Further approach for speeding up the input reverse-engineering process will be our future work.
Table 19: Runtime on different models.
Model	Runtime (s)
DCGAN	16.53 ± 0.35
VAE	51.63 ± 0.84
StyleGAN2-ADA	54.44 ± 0.79
Consistency Model	153.65 ± 2.02
Stable Diffusion	605.45 ± 3.26
I More Results on Stable Diffusion
In this section, we provide more results on the Stable Diffusion. Here, we use the Stable Diffusion v2 model as the inspected model. The scenario considered here is distinguishing 1000 images generated by Stable Diffusion v2 model (the inspected model) and 1000 images generated by DeepFloyd-IF-II-L<sup>4</sup> model. Note that the images here are generated using the prompts randomly sampled from the
<sup>3</sup>https://github.com/akiomik/pilgram
<sup>4</sup>https://huggingface.co/DeepFloyd/IF-II-L-v1.0
PromptHero  $^{5}$  website. The results demonstrate that our method achieves  $91.6\%$  detection accuracy, meaning it is effective under this scenario.
J More Visualizations on Stable Diffusion
In this section, we provide more visualizations for our case study on Stable Diffusion v2 model [3] (§ 5.3). We show more visualizations for the belonging images and their corresponding reverse-engineered images in Fig. 4. In Fig. 5, we demonstrate more visualizations for the non-belonging images of the Stable Diffusion v2 model, and also show their reverse-engineered images. The detailed reconstruction loss and the calibrated reconstruction loss are reported in Fig. 4 and Fig. 5. The distance metric used here is MSE. As we can observed, the belonging images have much lower calibrated reconstruction loss than the non-belonging images, further demonstrating the effectiveness of our approach.
<sup>5</sup>https://prompthero.com/
Belonging
Fig. 4: More visualization of the belonging images for Stable Diffusion v2 [3], and their corresponding reverse-engineered images. The distance metric used here is MSE.
(a) The reconstruction loss and the calibrated reconstruction loss are 0.0038 and 0.1727, respectively.
Non-belonging
(b) The reconstruction loss and the calibrated reconstruction loss are 0.0019 and 0.0704, respectively.
Non-belonging
(c) The reconstruction loss and the calibrated reconstruction loss are 0.0028 and 0.2800, respectively.
Fig. 5: More visualization of the non-belonging images for Stable Diffusion v2 [3], and their corresponding reverse-engineered images. The distance metric used here is MSE.