Tracing Hyperparameter Dependencies for Model Parsing via Learnable Graph Pooling Network
Authors: Xiao Guo
Vishal Asnani
Sijia Liu
Xiaoming Liu
Venue: NeurIPS 2024 poster (2024)
Keywords: Image Forensics
Forgery Attack Defense
Low-level Vision
Primary area: generative_models

Abstract: \textit{Model Parsing} defines the task of predicting hyperparameters of the generative model (GM), given a GM-generated image as the input. 
Since a diverse set of hyperparameters is jointly employed by the generative model, and dependencies often exist among them, it is crucial to learn these hyperparameter dependencies for improving the model parsing performance. 
To explore such important dependencies, we propose a novel model parsing method called Learnable Graph Pooling Network (LGPN), in which we formulate model parsing as a graph node classification problem, using graph nodes and edges to represent hyperparameters and their dependencies, respectively. 
Furthermore, LGPN incorporates a learnable pooling-unpooling mechanism tailored to model parsing, which adaptively learns hyperparameter dependencies of GMs used to generate the input image. 
Also, we introduce a Generation Trace Capturing Network (GTC) that can efficiently identify generation traces of input images, enhancing the understanding of generated images' provenances.
Empirically, we achieve state-of-the-art performance in model parsing and its extended applications, showing the superiority of the proposed LGPN.

Tracing Hyperparameter Dependencies for Model Parsing via Learnable Graph Pooling Network
Xiao Guo, Vishal Asnani, Sijia Liu, Xiaoming Liu Michigan State University
{guoxial1, asnanivi, liusiji5, liuxm]Ommsu edu
Abstract
Model Parsing defines the task of predicting hyperparameters of the generative model (GM), given GM-generated image the input. Since diverse set of hyperparameters is jointly employed by the generative model, and dependencies often exist among them, it is crucial to learn these hyperparameter dependencies for improving the model parsing performance. To explore such important de- pendencies, propose novel model parsing method called Learnable Graph Pooling Network (LGGNN, in which we formulate model parsing as a graph node classification problem, using graph nodes and edges to represent hyperparameters and their dependencies, respectively. Furthermore, LGPN incorporates learnable mechanism tailored model parsing, which adaptively learns hyperparameter dependencies of GMs used to generate the input image. Also, we introduce Generation Trace Capturing Network (GTC) that can efficiently identify generation traces of input images, enhancing the understanding of gener- ated images' provenances. Empirically, we achieve state-of-the-art performance in model parsing and its extended applications, showing the superiority of the proposed L.PNN The source code available at link.
Introduction
Generative Models (GMs) [22, 73, 11, 44, 33, 60, 32, 34, 50], egg., Generative Adversarial Networks (GANs), Variational Autoencoder (VAEs), and Diffusion Models (DMs), have gained significant attention, offering remarkable capabilities in generating visually compelling images. However, the proliferation of such Artificial Intelligence Generated Content (AIGC) can inadvertently propagate inaccurate or biased information. To mitigate such negative impact, various image forensics [52] methods have been proposed [62. 54, 20, 6, 24, 64, 31, 76, 56, 71, 1]. Alongside these defensive efforts, the recent work [2] defines novel research topic called "model parsing", which predicts 37 GM hyperparameters using the generated image the input, as detailed in Fig. 1a.
Model parsing requires analyzing GM hyperparameters and gaining insights into origins of generated images, which facilitate defenders to develop effective countermeasures. For example, one can reasonably determine if there exists coordinated attacks [2] [2]- two images are generated from the same GM that is unseen during the training, using predicted hyperparameters from the model parsing algorithm. In light of this, the previous method [2] introduces a clustering-
approach that achieves effective model parsing performance. However, this approach neglects the learning of hyperparameter dependencies. For instance, an inherent dependency exists between GM's layer number and parameter number, as GM's 's layer number is positively proportional to its parameter number. A similar proportional relationship exists between the number of convolutional layers and convolutional filters. In contrast, the use of the L1 loss is negatively correlated with the use of the 1.2 loss, as GMs typically do not employ both losses as objective functions simultaneously. We believe the neglect of such dependencies might cause suboptimized performance. Therefore, in
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Paraena Num (300M, 540M)
Panara Nam (0, 150M-
KAR
Baxd Narr
RcLa
Teko
GAN
(IBSML 200Mi
57%
Sigmoid
Hyperparaeeters
Nem.
Generative
Models
Geserated
12
KL divergence
ReLU
Bock
Porare. Nam (360M, SROM)
(a)
(b)
Figure I: (a) Hyperparameters define GM that generates images. Model parsing [2] refers to the task of predicting hyperparameters given the generated image. (b) We study the co-occurrence pattern among different hyperparameters in various GMs from the RED11 40 dataset whose composition is shown as the pie chart', and subsequently construct a directed graph to capture dependencies among these hyperparameters. (c) We define the discrete-value graph node ) (e.g., L1 and Batch Norm) for each discrete hyperparameter. For each continuous hyperparameter ( ), we partition its range into n distinct intervals, and each interval is then represented by graph node: Parameter Number has three corresponding continuous-valus graph nodes. Representations on these graph nodes are used predict hyperparameters.
this work, we propose to use graph nodes and edges to explicitly represent hyperparameters and their dependencies. respectively, and then propose model parsing algorithm that utilizes the effectiveness of Graph Convolution Network (GCN) [35, 61, 18, 51] to capture dependencies among graph nodes.
Specifically, we first use training samples in the RED dataset [2] to construct directed graph (Fig. 1b). The directed graph, based on the label co-occurrence pattern, illustrates the fundamental correlation between different categories and helps prior GCN-based methods achieve remarkable performances in various applications [10, 7, 68, 46, 16, 58]. In this work, this directed graph is tailored to the model parsing we define discrete-value and continuous-value graph nodes to represent hyperparameters, shown in Fig. Ic. Then, we use this graph to formulate model parsing as a graph node classification problem, in which the discrete-valus graph node feature decides if given hyperparameter is used in the given GM, and the continuous -valuu node feature decides which range the hyperparameter resides. This formulation helps obtain effective representations of hyperparameters and dependencies among them for the model parsing task, detailed in Sec. 3.1.
To this end, we propose novel model parsing framework called Learnable Graph Pooling Network (LGPN), which contains a Generation Trace Capturing Network (GTC) and a GCN refinement block (Fig. 2). Our GTC differs from neural network backbones used in State-of-The-Art (SoTA) forgery detection methods [62, 74, 63, 4, 63], using down-sampling operations (c.g., pooling) gradually reduce the learned feature map resolution during the forward propagation. This down-sampling can cause the loss of already subtle generation traces left by GMs. Instead, our GTC leverages nightresolution representation that largely preserves generation traces throughout the forward propagation (Sec. 3.2.1). Therefore, the learned image representation from the GTC deduces crucial information (i.e., generation trace) of used GMs and benefits model parsing. Subsequently, this representation is transformed into a set of graph node features, along with the pre-defined directed graph, which are fed to the GCN refinement block. The GCN refinement block contains trainable pooling layers that progressively convert the correlation graph into a series of coarsened graphs by merging original graph nodes into supernodes. Then, the graph convolution is conducted to aggregate node features at all levels of graphs, and trainable unpooling layers are employed to restore supernode their corresponding children nodes. This learnable pooling- unpooling mechanism helps LGPN generalize to parsing hyperparameters in unseen GMs and improves the GCN representation leamning In summary, our contributions are:
pooling-unpooling
We innovatively formulate model parsing as a graph node classification problem, using a directed graph to help capture hyperparameter dependencies for better model parsing performance.
A learnable pooling-unpooling mechanism is introduced with GCN to enhance representation learning in model parsing and its generalization ability.
We propose Generation Trace Capturing Network (GTC) that utilizes high-resolution representa- tions to capture generation traces, facilitating a deeper understanding of the image's 's provenance.
We adhere to naming conventions from the previous work [2], as the pie chart of Fig. 1b, where AA, AR, and NF represent Adversarial Attack models, auto-Regressive models, and Normalizing Flow models, respectively.

---

GCN Refinement Block
Generation
Trace
h
GCN block
L.Pooling
GCN block
L-Pooling
GCN bleck
Unpooling
GCN block
Unpodling
GCN block
va
Model
Capturing
Parsing
Network
M
M,
a q
M
M
An
A2
A
A
Figure 2: Learnable Graph Pooling Network. Given an input image I, the proposed LGPN first uses the Generation Trace Capturing Network (Fig. 3) to extract the representation Then, f is transformed into H, which represents set of graph node features and is fed into the GCN refinement block. The GCN refinement block stacks GCN layers with paired pooling-unpooliin layers (Sec. 3.2.2) and produces the refined feature V for model parsing, Our method is jointly trained with different objective functions (Sec. 3.3).
Extensive empirical results demonstrate the SoTA performance of the proposed LGPN in model parsing and identifying coordinated attacks. Additionally, the GTC's effectiveness is validated through -en-ggeerated image detection and image attribution tasks.
2 Related Works
Model Parsing Previous model parsing works [59, 30, 17, 4.7 require prior knowledge of machine learning models and their inputs to predict model hyperparameters, and such predictions are primarily limited to architecture-related hyperparameters [17, 47.. In contrast, Asmani ef al. [2] recently propose technique to estimate 37 pre-defined hyperparameters covering loss functions and architectures by only leveraging generated images as inputs. Specifically, this work [2] designs FEN-PN that uses clustering-basee based approach to estimate the mean and standard deviation of hyperparameters for network architecture and loss function types. Then, FEN-PN uses a fingerprint estimation network that is trained with four constraints estimate the fingerprint for each image. These fingerprints are employed to predict hyperparameters. However, FEN-PN overlooks dependencies among hyperparameters, which cannot be adequately captured by the estimated mean and standard deviation. In contrast, we propose LGPN, using GCN to model dependencies among different hyperparameters, improving overall model parsing performance.
Method Graph Convolution Neural Network (GCN) shows effectiveness in encoding dependencies among different graph nodes [35, 61, 18, 26, 28], and in the computer vision community, directed graphs based on label co-occurrence patterns are used with GCN in tasks such multi-label image recognition [10, 7, 68), semantic segmentation [9, 29, 41, 16), and person RelD and action localization [46, 65, 8, 58]. These works rely on original graph structures. whereas our method uses a pooling algorithm to modify this graph structure, which can benefit GCN's representation learning. Also, our GCN refinement block differs from Graph U-Net [19] in that it reduces the graph size by removing certain nodes. However, we formulate model parsing as a graph node classification task, where each node represents specific hyperparameter, meaning no nodes should be discarded.
Learning Image Generation Traces GMs leave partieular traces in their generated images [43, 12). which can be visual artifacts [72, 4] or through evident peaks in the frequency domain [74, These traces serve as important clues for image forensic tasks such as detection [12, 74, 62]. attribution [70, 49] and model parsing [2, 66, 67, 21J. Current methods [62, 74, 63, 4, 63, 57] use backbones like ResNet and XceptionNet that have high generalization abilities, and vision-language foundation models [55, 75, 23] also show effectiveness in detecting unseen forgeries. However, these prior methods often use backbones that rely on downsampling operations, such as convolutions with large strides and pooling, which capture global semantics but discard high-frequency details that contain critical generation traces. In contrast, we propose a Generation Trace Capturing network that mainly operates high-resolution representation for capturing such generation traces. Its effectiveness is shown in our experiment by comparing against recent detection methods that use pre-trained CLIIP features [48] and the novel representation [63], and competitive image attribution methods.
3

---

Higherss branch
4
4
4
Fusios Laper
Niston Loog
(5.5)
Res Net branch
Fh
RaNNel
Block
Generation Trace Capturing Network. First, convolution layers with different kernel sizes extract feature maps of the input image I. A fusion layer concatenates these feature maps and then proceeds the concatenated feature the ResNet branch and High-res branch.
Figure 3:
3 Method
In this section, first revisit some fundamental preliminaries in Sec. 3.1, and then introduce the proposed Learnabled Graph Pooling Network (LGPN) in Sec. 3.2. Lastly, we describe training and inference procedures in Sec. 3.3.
3.1 Preliminaries
This section provides the problem statement of model parsing and its formulation graph node classification task with the Graph Convolutional Network (GCN).
Revisiting Model Parsing Given an input image 3 generated by a GM (iee, 9), the model parsing algorithm generates three vectors (ydd E R y E IR. and y' E R. 10) as predictions of G' different hyperparameters used in the G. Specifically, defined by the previous work [2], these predictable G hyperparameters include discrete and continuous architecture hyperparameters, as well as loss functions, which are denoted as y y", and y', respectively. For yd and y', each element is a binary value representing if the corresponding feature is used not. Each element of y is the value of certain continuous architecture hyperparameters, such as the layer number and parameter number. in different ranges, normalize them into [0, 1], same as the previous work [2]. Predicting y and y' a classification task while the regression is used for y". Detailed definitions are in Tab. 4, 5, and 6 of the Supplementary. We augment the previous model parsing dataset (e.g., RED116 (2]) with different diffusion models such as DDPM [27], ADM [15] and Stable Diffusions [50], increasing the spectrum of GMs. Also, we add real images which these GMs trained into the dataset. In the end, we collect 140 GMs in total and denote such a collection as the RED140 dataset. Details are in the Supplementary Sec. D.
As these hyperparameters
Correlation Graph Construction We design graph structure of model parsing, where graph nodes and edges represent hyperparameters and their dependencies, respectively. We first use conditional probability P(L,) LG) to denote the probability of hyperparameter Lj occurrence when hyperparameter Lj appears. We count the occurrence of such pairs in the RED140 to construct the matrix G CCC where C and Gúy denotes the number of graph nodes and the conditional probability of PLL L,). respectively. Next, we apply a fixed threshold 7 to remove edges with low correlations in and then obtain directed graph, denoted as A E CCC, where Aij indicates there exists edge between node and
Specifically, as depicted in Fig. Ic, each discrete hyperparameter (e.g., discrete architecture hyper- parameters and loss functions) is represented by graph node of A, denoted discrete-value graph node. For continuous hyperparameters, we first divide its value range into n different inter- vals, and each interval is represented by one graph node of A denoted node. In other words, larger than G since each continuous hyperparameter is represented by n continuous-vally graph nodes. Subsequently, hyperparameters are present, and the continuous- value node decides which range the hyperparameter resides. Therefore, we denote the constructed graph A and apply stacked graph convolution on A as follows:
continuous-value graph
discrete-value graph nodes to decide if given
h ReLU A.., W +b').
(1)
where by represents the i-th node feature in graph A. W and b' are weight and bias terms.

---

3.2
Learnable Graph Pooling Network
In this section, we detail the Generation Trace Capturing Network (GTC) and GCN refinement block- tto major components used in the proposed LGPN, as depicted in Fig. 2.
3.2.1 Generation Trace Capturing Network
As shown in Fig. 3, GTC uses onc branch (i.., ResNet branch) to propagate the original image information. Meanwhile, the other branch, denoted high-res branch, hamesses the high-resolution representation that helps detect high-frequency generation artifacts stemming from various GMs. More formally, three separate 2D convolution layers with different kernel sizes (e.g.. 3 x 3, 5 x and 7 x 7) are utilized to extract feature maps of I. We concatenate these feature maps and feed them to the fusion layer the obtain the feature map F E RD xH with the same resolution as I. After that, we proceed Fh dual-branch backbone. Specifically, we upsample intermediate features output from each ResNet block and incorporate them into the high-res branch, as depicted in Fig. 3. The high-res branch also has four different convolution blocks (e.g., 9, with b [I...4)) which do not employ down-sampling operations, such as the 2D convolution with large strides or pooling layers. Then, intermediate feature maps throughout the high-res branch possess the same resolution as F
convolution for the channel dimension reduction. Then,
The ResNet branch and high-res branch output feature maps are concatenated and then passed through an AVGPOOL layer. Then, obtain the final learned representation. f E IR that captures generation artifacts of the input image I. Subsuqently,
learn C independent linear layers, i.e. θ (0 to transform f into set of graph node features H {ho, hı,.... h(c- where H E g D and We H denote graph node features of the directed graph
h; RIIDD (i E (0, 1, ..... C (i.e., graph topology) A E -
3.2.2 GCN Refinement Block
The GCN refinement block has a learnable pooling-umper unpooling mechanism that progressively coarsens the original graph Ao into series of coarsened graphs, i.e., A1, An..An, and graph convolution
conducted on graphs all different levels. Specifically, such a pooling operation is achieved by merging graph nodes, namely, via learned matching matrix M. Also, correlation matrices of different graphs, denoted as A, % which are learned using MLP layers, which are also influenced by the GM responsible for generating the input image. This further emphasizes the significant impact of GM on the correlation graph generation process.
Learnable Graph Pooling Layer First, A₁ E R=xm and A1+1 E Rax" denote directed graphs at 7 th and I + 1 th layers, with and n (m 2 n) graph nodes, respectively. An assignment matrix M, E Rm converts A to A1+1 as:
A
A,M
(2)
Also, we use H; R and H4+1 E RBXD to denote graph node features of A₁ and A1+1. respectively. Therefore, use M, to perform the graph node aggregation operation via:
H
M, H
(3)
For simplicity, we use faCN to denote the mapping function imposed by GCN block that has multiple GCN layers. Assuming the q-th and 1-th graph layer are the first and last layer of the GCN block, then have:
H = fGCN (Hg).
(4)
Ideally, the learnable pooling operation should be dependent on the learned representation of the input image, and such representation is converted into H, Therefore, employ a trainable weight Wm to transform H, into the assignment matrix Mc:
M
+ e (W,H.))
where a is set as 1e9. Values of the resultant M, are approximately equal 0 or It is worth noting that prior works [39, 40] also adopt techniques similar to Eq. 5 for making the thresholding operation differentiable.
AA (-th layer graph has nodes and connectivities (e.g., correlations), and we use A to denote the /-th layer graph or only its correlations.
5

---

0
0
MSF.
Presioce Not
(M?)²=
0
L1
Norm
Batch
0
1
ReLU
Presence v.s. Not
Sigmoid
Params, Num. (0, 180M)
Tanh
Params, Num. (180M, 360M)
cconcal
Parms Nam.
MSE
M
Value
Layer Norm
Params, Num.
Relu
(360M, 540M)
PC
(a)
(b)
Figure (a) A toy example of the hyperparameter hierarchy assignment Mf: both and MSE belong to the category of pixel-Ievel loss function, so they are merged into the supernode A. Nonlinearity functions (e.g., ReLu and Tanh) and normalization methods (e.g., Layer Norm. and Batch Norm.) are merged into supernodes B and C, respectively. (b) In inference, discrete-value graph node features are used to classify if discrete hyperparameters are used in the given GM. We concatenate corresponding continuous valuu node features and regress the continuous hyperparameter value.
Learnable Unpooling Layer We perform the graph unpooling operation that progressively restores pooled graphs the graph the original resolution for the graph node classification task. As shown in Fig. 2, to avoid confusion, we use H and V to represent the graph node feature on the pooling and unpooling branches, respectively. The correlation matrix on the unpooling branch is denoted by A',
A/- M,AMM V M,V
where A/ and A/-1 the / th and I th layers in the unpooling branch, respectively. Finally, use the refined feature V for model parsing.
Discussion This learnable pooling-unpooling mechanism offers three distinct advantages. First, each supernode in the coarsened graph serves the combination of features from its children nodes, and graph convolutions on supernodes have a large receptive field for aggregating features. Secondly, the learnable correlation models hyperparameter dependencies dynamically based generation artifacts of input image features (e.g., f). Lastly, learned correlation graphs A vary across different levels, helping address the over-smoothing issue commonly encountered in GCN learning [38, 45, 5].
3.3 Training and Inference
We jointly train our method with three objective functions. Graph node classification loss (e.g., Ceraph) encourages each graph node feature predict the corresponding hyperparameter label. Artifacts isolation loss (e.g., Liso) helps the LGPN only parse the hyperparameters for generated images, and hyperparameter hierarchy constraints (e.g., Chier) imposes hierarchical constraints among different hyperparameters while stabilizing the training.
Training Samples We denote a training sample as {I,y), in which y = {y y" y')
fyo- vi...., -i...... M) is annotations of C graph nodes for G parsed hyperparameters as introduced in Sec. 3.1. Specifically, ye is assigned as 1 if the sample has e-th hyperparameter and otherwise, where c (0, 1,.., 13. Details in Supplementary Sec. B.
Graph Node Classification Loss Given the image I, convert the refined feature V into the predicted score vector, denoted as s = {So, 81,.,8, S(C-1)- We employ the sigmoid activation to retrieve the probability vector p = {po, Soo,PP,--e PIc---)))) namely, P. = SIGMOID(s.).. Then, we have:
C-1
Caraph
(ye logg.
log(1 p-)).
Hyperparameter Hierarchy Prediction Fig. 4 shows that different hyperparameters can be grouped, so we define the hyperparameter hierarchy assignment M to reflect this inherent nature. More details of such the assignment are in Supplementary Sec. A. Suppose, at the th layer, we minimize the L2 norm of the difference between the predicted matching matrix M, and M;.
hier
|M Milla
Σ k
(m, m,,)²
(8)

---

Loss
Dis. Archi.
Con, Archi.
Method
Function
Para.
Para.
ID
Backbone
MP Head
FI
Acc. f
FIT
Acc.
LI error +
Baselinel
ResNet-50
MLP
79.0
77.7
72.1
69.0
0.163
2
Baseline2
HR-Net
MLP
80.7
81.9
72.2
70.3
0.149
Baseline3
ViT-B
MLP
76.3
75.9
68.3
66.4
0.177
4
Baseline4
GTC
MLP
82.5
80.9
75.7
70.9
0.135
5
FEN-PN [2]
FEN.
Parsing Net.
80.5
78.9
73.0
70.8
0,139
6
LGPN
GTC
GCN refinement
84.6
83.3
79.5
77.5
0.120
Table We report model parsing performance on RED140, where each method has an individual ID that represents different backbones and model parsing (MP) heads. The comparison among different backbones shows the effectiveness of the proposed GTC. Loss Function reports the averaged prediction performance on 10 loss functions. The averaged performance on 18 discrete architecture hyperparameters and continuous hyperparameters are reported in Dis. Archi Para. and Con. Archi Para. respectively. [Bold: best result].
Artifacts Isolation Loss We denote the image-level binary label as ue and use pmmg as the probability that I is generated image. Then we have:
M-1
(y ong 1ym9 log imy + (1 - vm)) log(1 - p)m))).
(9)
In summary, our joint training loss function can be written as Call Coraph + >g + AgLiso,
where and A2 equal 0 when is real.
the discrete-value graph node feature to perform the binary classification to decide the presence of given hyperparameters. For the continuous architecture hyperparameter, we first concatenate corresponding node feature and train linear layer to regress it to the estimated value. Empirically, we set n as 3 and show this concatenated feature improves the robustness in predicting the continuous value (see Supplementary Tab. 7).
Inference As Fig. 4b,
4
Experiment
4.1
Model Parsing
Setup Our experiment utilizes RED140 dataset. In RED140, each GM contains 1, 0,0 images, resulting a total of 140, 000 generated images that encompass a wide range of semantics, including objects, handwritten digits, and human faces. Also, RED140 has real images which these GMs are trained, such as CelebA [42], MNIST [14], CIFARIO [36], ImageNet [13], facades [77], edges2shoes [77] and, apple2oranges [77]. We follow the protocol of [2]: divide samples into disjoint sets, each of which comprises different GM categories such as GAN, VAE, DM, etc. Next, we do leave-one-out testing, i.e., train on 125 GMs from three sets, and test on GMs of the remaining set. The performance is averaged across four test sets, measured by Fl score and accuracy for discrete hyperparameters (loss function and discrete architecture hyperparameters) and L1 error for continuous architecture hyperparameters. Implementation details are in Supplementary Sec. B.
Main Performance We report model parsing performance in Tab. 1, where our proposed LGPN (line #6) largely outperforms previous model parsing algorithms. We first employ commonly used backbones to set up competitive model parsing baselines for a more comprehensive comparison. More formally, four baselines lines # #1-4 that use ResNet-50, ViT-B, HR-Net, and GTC as backbones with 2 layers MLP as the model parsing head, respectively. Baseline4 (line #4) achieves the best performance, which indicates that GTC is the most suitable backbone for model parsing. Specifically. Baseline4 has 1.8% and 3.5% higher F1 score over Baseline2 that uses HR-Net on predicting hyperparameters of loss functions and discrete architecture hyperparameters. After that, we report FEN-PN's performance, which already proves the effectiveness on the model parsing task since it has specific model parsing architectures containing a fingerprint estimate network (FEN) and parsing network that predicts hyperparameters. Surprisingly, although FEN-PN has achieved competitive results on RED1 16, only has comparable performance to Baseline2. This indicates that FEN-PN reduces its effectiveness in predicting hyperparameters of diffusion models, as RED140
7

---

Dis. Archi.
Method
Backbone
MP Head
1
Ace.
F1
Acc.
.311
349
82.5
80.1
75.7
70:38
Stacked GCN
83.2
81.3
76.9
13..8
532
112
GTC
At-GGN
83.4
62.7
78.0
14.5
0.10
000
Graph U-Nei [19]]
82.2
82.0
74.8
70:2
3.0
001
GCN relinemmcnt
84.6
63.3
79.5
77.5
Table 2: (a) Model parsing performance comparison with different GCN variants [Bold: best result]. (b) The GCN refinement block improves prediction performance on continuous hyperparameters.
Training Objectives
FI
Loss Function
Dis, Archi.
Con. Archi
Loss
Dis, Archi. Para.
Para.
Parn.
Cgraph
Chee
Fun.
Method
score
emror
83.7
77.0
FEN-PN 12]
81.3
71.8
0.149
81.0
78.1
GTC w MLP
77.8
68.9
0.169
S-GCN
79.0
69.8
0.145
84.6
79.5
LGPN
84.1
74.3
0.130
(b)
(c)
Figure 5: a) Cosine similarity between generated correlation graphs (i.e., A' for unseen GMs in one four test sets. Each element this matrix is the average cosine similarities of 2, 000 pairs of generated correlation graphs A'o from corresponding GMs. b) The ablation three objective functions, defined in Sec. 3.3. e) The model parsing performance on REDI16 dataset. [Key: Best; S-GCN: stacked GCN]
contains more images from diffusion models than RED116. The complete performance comparison on RED116 is reported in Tab. Sc. Lastly, we replace MLP with the GCN refinement block, which is the full model of L.GNN (line #6) and performs better on all metrics, demonstrating that the GCN refinement block indeed refines graph node features and makes more effective model parsing head than MLP layers.
Hyperparameter Dependency Capturing Tab. 2a reports model parsing performance using different GCN variants as the model parsing head. Overall, the proposed GCN refinement block, which refines graph node features to better capture hyperparameter dependencies, helps achieve the best model parsing performance. By comparing lines #1 and #2, conclude that replacing MLP layers with the GCN refinement benefits the model parsing task. After all, GCN leverages structural information of the pre-defined graph, improving the learning of correlations among different hyperparameters. Next, we use Graph attention networks [61] (Att-GCN) at line #3, which employs the attention mechanism update the graph node feature. As result, Att-GCN achieves 1.1% higher F1 than stacked GCN (e.g.. line #2) on predicting discrete architecture parameters. Lastly, line #4 uses Graph U-Net [19], which has similar pooling-unpooling mechanism our GCN refinement block, but its pooling operation discards graph nodes in the previous layer for forming a smaller graph. Using the Graph U-Net as the model parsing head produces the worse performance on discrete architecture hyperparameters - 4.3% lower than Att-GCN (#3). We believe this is because dropping graph nodes not optimal for model parsing, in which all graph nodes represent corresponding hyperparameters and are important for the final performance. In contrast, LGPN merges children nodes into the supernode, so all node information the previous layer remains in the smaller pooled graph, helping achieve the best performance on discrete hyperparameters in Tab. 2a. On the other hand, continuous hyperparameter prediction can also benefit from the GCN refinement block. In Tab. 2b, LGPN shows L1 errors of 0.147 and 0.081 on Layers Num. and Param. Num. respectively, whereas the model with MLP layers only achieves 149 and 0.148, respectively. This because the GCN refinement learns the dependency between Param. Num. and Layer Num., which aligns with the observation that models with more layers typically have more parameters. Therefore, modeling such dependencies ultimately decreases the LI error in Param. Num. prediction. Likewise, when predicting Conv. Layer Num. and Filters Num., the GCN refinement achieves 037 and 0.149 LI error, whereas GTC with MLP layers have 0.151 and 0.161 L1 error.
GM-dependent Graph Fig. 5a shows that learned correlation graphs (A/o) from image pairs exhibit significant similarity when both images belong to the same unseen GM. This result demonstrates that our correlation graph largely depends on the GM instead of image contents, given that we have

---

120
Method
Acc.
AUC
Pd@5%
52.3
TEN-99 [PAN020221
HiFi-Net [2]]
72.3
75.4
30.4
Accuracy
62.3
01.6
FEN-PN [2]
83.0
92.4
61.2
70.4
21.4
71.7
GTC w MLP
83.9
92.2
62.5
68.4
GTC w S-GCN
84.3
94.2
68.6
LGPN
85.9
95.7
77.2
50-
Same Seen
DIEE Seen
Same Unseon
DiEE Caseon Seen, & Unssen
50.0
Table 3: (a) The average coordinate attack detection performance 4-fold cross validation. (b) Test image pairs in coordinate attack detection are from one of cases, bar charts from left to right: same and different GMs in other from unseen set. [Key: S-GCN: stacked GCN]
same different GMs in unseen set; GM is from seen set and the
different contents (e.g, human face and objects) in unseen GMs from each test. addition, we empirically observe method remains robust when using different thresholds to construct the graph, which is detailed the Supplementary Tab. 9. However, the performance declines more when the threshold increases to 0.65, which causes the correlation graph to have very sparse connectivities, hindering the learning of hyperparameter dependencies.
Objective Functions Analysis Fig. 5b shows the ablation of different training objective functions introduced in Sec. 3.3. Line #11 only optimizes the LGPN with Cerpeh, producing results comparable to simply stacking GCN with the attention mechanism (e.g., line #3 in Tab. 2a). Lines #2 and #-3 show contributions from Lise and Chier, which improve the performance by 1.1% and 2.0% than only using Larpah, on predicting discrete architecture hyperparameters, respectively. This because Liso and Chier make the LGPN concentrate learning generation traces from generated images and impose the hierarchical constraints, respectively.
RED116 Results Fig. reports that LGPN achieves the best performance on all metrics in RED116 16 dataset. Interestingly, LGPN obtains 79.5% Fl score on predicting discrete architecture hyperparameters RED140 (Tab. 1), whereas only 74.3% RED116, which does not contain diffusion model generated images. We believe this is because all diffusion models share similar architectures, and such similarities make the prediction of their architecture hy perrparaaeteess easier.
4.2 Coordinate Attack Detection
We evaluate the proposed LGPN on coordinated attacks detection [2], which aims to classify whether two fake images are generated from the same GM not. This achieved by computing the cosine similarity between predicted hyperparameters from given images. Specifically, we evaluate coordinated attack detection on RED140 125 GMs, and the test set has 30 GMs where 15 GMs are exclusive (unseen) from the train set and 15 GMs are seen the train set. We generate 89, 000 training image pairs from train-set GMs for training 1, 000 image pairs for validation. We generate 25, 000 test image pairs from test-set GMs, measurement, we use accuracy, AUC,
4-fold pross-validation. In each fold, the train has
and the average of the folds used as the final result. and detection probability at fixed false alarm rate (Pd @ FAR) e.g., Pd 55% metrics. Specifically, aside from FEN-PH [2], we also compare with the recent work HiFi-Net [24] that show SoTA results in attributing different forgery methods. Specifically, we train HiFi-Net to classify 125 GMs and take learned features from the last fully- mully-connected layer for coordinated attack detection. The performance reported in Tab. 3a, which demonstrates that our proposed method surpasses both prior works. We observe the HiFi-Net performs much worse on AUC than the model parsing baseline (e.g., GTC w S-GCN) and FEN-PN. Furthermore, Tab. 3b shows the FEN-PN and LGPN perform comparably as HiFi-Net on seen GMs (first two bar charts), yet much better than HiFi-Net when images are generated by unseen GMs (last three bar charts). Lastly, LGPN has better Pd@ 5% performance than other methods.
4.3 Capturing Generation Traces
To study GTC's ability identify generation traces, adopt it for CNN-generated image detection and image attribution. For a fair comparison, no model parsing dataset is used for the pre-training.
CNN-generated Image Detection We append fully-connected layers at the end of GTC to obtain a binary detector that distinguishes CNN-generated images from real ones (detailed in supplementary

---

Accuacy (Acc.)
PRICCVPRZO24
GTC(
Method
CelebA
LSUN
Method
CelebA
LSUN
Metric:
Acc(%)
Metric:
Acc(%)
ha el [CVPR20231
PRNU [43]
86.61
67.84
PRNU [43]
74.23
67.92
HiFF-Net [CVPR2023)
DE-FAKE [
Attr. [70]
99.43
98.58
Attr. [70]
84.16
81.63
Wong et al [CVPR2020] G2)
FEN-PN [2]
99.66
99.84
FEN-PN [2]
81.09
78.28
Ours
99.79
99.73
Ours
88.11
86.23
96
Average Precision (AP)
(b)
(c)
Figure 6: (a) CNN-generated image detection performance. (b) and (c) report image attribution performance in two different protocols.
Fig. 8). We follow the experiment setup from prior works [62, 48, 57]. which trains the model on images generated by ProGAN [32], and test it on images generated by 11 unseen forgery methods, using average precision (AP) and accuracy for the measurement. Fig. 6a reports that our method achieves premium detection performance compared to prior methods. The second-best method, NPR [57], focuses learning local up-sampling artifacts from pixels, helping detect images from unseen GMs. Instead, GTC's high-resolution representation more effectively exploits both local and global traces left from generation processes, obtaining a better performance.
Image Attribution Tab. 6b and Tab. 6c report the image attribution performance in two different protocols. Specifically, we define the protocol based on the previous work [2], which trains methods on 100, 000 real and 100, 000 images generated from four different GMs (e.g.. SNGAN, MMDGAN, CRAMERGAN, and ProGAN), conducting a five-way classification (i.e. 4 GMs and real). In protocol 2, add two more generative methods (e.g., styleGANv2, styleGANv3), resulting in more challenging task: a 7-way classification task, classifying whether the image is real samples or generated by which one of GMs. As depicted in Supplementary Fig. 8, apply fully-connected layers on the top of GTC, which leverages the final representation of the generation trace for the multi-category classification task, e.g., image attribution. Our proposed method achieves the best image attribution performance on CelebA and competitive results on LSUN, indicating that GTC has a promising ability to capture the generation trace.
5 Conclusion
In this study, our focus is model parsing, which predicts pre-defined hyperparameters of a GM given an input image. We propose novel method that incorporates a learnable pooling-unpooling mechanism devised for the model parsing task. This mechanism serves multiple purposes: modeling GM-dependent hyperparameter dependencies. expanding the receptive field of graph convolution, and mitigating the over- sooothig issue in GCN learning. In addition, we provide the Generation Trace Capturing network to capture generation artifacts, which proves effective in two different image forensic applications: CNN-generated image detection and coordinated attacks detection.
Limitation We empirically observe two limitations in our proposed method, both of which can be interesting directions for future research. First, while our model parsing approach delivers excellent performance on the RED140 dataset, it is worth exploring its effectiveness on specific GMs that fall outside dataset scope. This investigation would provide valuable insights into the generalizability of our method to broader range of GMs. Secondly, we formulate the model parsing task as closed-set classification problem, which limits its ability to predict undefined hyperparameters, e.g., LeLU. One interesting solution could be adding a few new graph nodes for undefined hyperparameters while keeping original graph nodes the learned dependency between graph nodes representing ReLU and LeakyReLU should be high.
Broader Impact We strongly advocate for the machine learning and computer vision community to actively work towards mitigating potential negative societal implications of research. It is possible that generated face images used in training could leak the identity information of subjects who have not provided consent forms. We shall strive to work real face imagery whose collection is reviewed by an Institutional Review Board (IRB).
Ackonwledge This work was supported by the Defense Advanced Research Projects Agency (DARPA) under Agreement No. 12001120 to Xiaoming Liu at Michigan State University.
10

---

References
[1] Vishal Asnani, Xi Yin. Tal Hassner, and Xiaoming Liu. Malp: Manipulation localization using proactive scheme. In CVPR, 2023.
[2] Vishal Asnani, Xi Yin. Tal Hassner, and Xiaoming Liu. Reverse engineering of generative models: Inferring model hyperparameters from generated images. PAMI, 2023.
[3] Lejta Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. CSI NN: Reverse engineering of neural network architcctures through clectromagnetic side channel. In USENIXSS, 2019.
[4] Lucy Chai, David Bau, Ser-Nam Lim, and Phillip Isola. What makes fake images detectable? understanding properties that generalize. In ECCV, 2020.
[5] Deli Chen, Yankai Lin, Wei Li, Peng Li, Jie Zhou, and Xu Sun. Mcasuring and relieving the over-smoothing problem for graph neural networks from the topological view. In AAAI, 2020.
[6] Liang Chen, Yong Zhang, Yibing Song, Lingqiao Liu, and Jue Wang. Self-supervised learning of adversarial example: Towards good generalizations for doepfake detection. CVPR, 2022.
[7] Tianshui Chen, Muxin Xu, Xiaolu Hui, Hefeng Wu, and Liang Lin. Learning semantic-specific graph representation for multi-lahel image recognition. In ICCV, 2019.
[8] Ying Chen, Shixiong Xia, Jiaqi Zhao, Yong Zhou, Qiang Niu, Rui Yao, Dongjun Zhu, and Dongjingdian Liu. Rest-reid: Transformer block-based residual learning for person re-identification. Pattern Recognition Letters, 2022.
[9] Yunpeng Chen, Mareus Rohrbach, Zhicheng Yan, Yan Shuicheng, Jiashi Feng, and Yannis Kalantidis. Graph-based global reasoning networks. In CVPR, 2019.
[10] Zhao-Min Chen, Xiu-Shen Wei, Peng Wang, and Yanwen Guo. Multi-label image recognition with graph convolutional networks. In CVPR, 2019.
[11] Yunjey Choi, Minje Choi, Munyoung Kim, Jung-Woo Ha, Sunghun Kim, and Jaegul Choo. StarGAN: Unified generative adversarial networks for multi-domain image-to-image translation. CVPR, 2018.
[12] Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi. Koki Nagano, and Luisa Verdoliva. On the detection of synthetic images generated by diffusson models. In ICASSP, 2023.
[13] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: large-scale hierarchical image database. CVPR, 2009.
[14] Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE signal processing magazine, 2012.
[15] Prafulla Dhariwal and Alexander Nichol. Diffusion Models Beat GANs on Image Synthesis. In NeurlPS. 2021.
[16] Henghui Ding, Hui Zhang, Jun Liu, Jiaxin Li, Zijian Feng, and Xudong Jiang. Interaction via bi-directional graph semantic region affinity for scene parsing. In ICCV, 2021.
[17] Emilien Dupont, Yee Whye Teh, and Arnaud Doucet. Generative models distributions of functions. In AISTATS, 2021.
[18] Wenqi Fan, Yao Ma. Qing Li, Yuan He, Erie Jiliang Tang, and Dawei Yin. Graph neural networks for social recommendation. In WWW. 2019.
[19] Hongyang Gao and Shuiwang Ji. Graph u-nets. In ICML, 2019.
[20] Candice R Gerstner and Hany Farid. Detecting real-time deep-fake videos using active illumination. In CVPR, 2022.
[21] Yifan Gong, Yuguang Yao, Yize Li, Yimeng Zhang, Xiaoming Liu, Xue Lin, and Sijia Liu. Reverse engineering of imperceptible adversarial image perturbations. In ICLR, 2022.
[22] Ian Goodfellow. Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In NeurlPS, 2014.
[23] Xiao Guo, Xiaohong Liu, Iacopo Masi, and Xiaoming Liu. Sanguage-guides hierarchical fine- tne-gndined image forgery detection and localization. IJCV 2024.

---

[24] Xiao Guo, Xiaohong Liu, Zhiyuan Ren. Steven Grosz, lacopo Masi, and Xiaoming Liu. Hierarchical fine-grained image forgery detection and localization. In CVPR. 2023.
[25] Xiao Guo, Yaojie Liu, Anil Jain, and Xiaoming Liu. Multi-domain learning for updating face anti-spoofing models. In ECCV, 2022.
[26] Zhijiang Guo, Yan Zhang, and Wei Lu. Attention guided graph convolutional networks for relation extraction. In ACL, 2019.
[27] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In NeurIPS, 2020.
[28] Hsu, Xiao Guo, Premkumar Natarajan, and Nanyun Peng. Discourse- relation extraction via graph pooling. In AAAI DLG workshop, 2021.
[29] Hanzhe Hu, Deyi Ji, Weihao Gan, Shuai Bai, Wei Wu, and Junjie Yan. Class-wise dynamic graph convolution for semantic segmentation. In ECCV, 2020.
[30] Weizhe Hua, Zhiru Zhang, and G Edward Suh. Reverse engineering convolutional neural networks through side-channel information leaks. In DAC, 2018.
[31] Kaixiang Ji, Feng Chen, Xin Guo, Yadong Xu, Jian Wang, and Jingdong Chen. Uncertainty-guice learning for improving image manipulation detection. ICCV, 2023.
[32] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen, Progressive growing of gans for improved quality, stability, and variation. In ICL,, 2018.
[33] Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In CVPR, 2019.
[34] Gwanghyun Kim, Taesung Kwon, and Jong Chul Ye. DiffusionCI.IP. Text-guided diffusion models for robust image manipulation. In CVPR, 2022.
[35] Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In ICLR, 2017.
[36] Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical report, 2009.
[37] Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 1998.
[38] Guohao Li. Matthias Muller, Ali Thabet, and Bernard Ghanem. Deepgens: Can gens go as deep as cnns? In ICCV, 2019.
[39] Kumpeng Li, Ziyan Wu, inference network. In CVPR, 2018.
Peng, Jan Ersst, and Yun Fu. Tell me where to look: Guided attention
[40] Kumpeng Li, Ziyan Wu, Kuan-Chuan Peng, Jan Ernst, and Yun Fu. Guided attention inference network. PAMI, 2019.
[41] Xia Li, Yibo Yang, Qijic Zhao, Tiancheng Shen, Zhouchen Lin, and Hong Liu. Spatial pyramid based graph reasoning for semantic segmentation. In CVPR, 2020.
[42] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In ICCV, 2015.
[43] Francesco Marra, Diego Gragnaniello, Luisa Verdoliva, and Giovanni Poggi. Do GANs leave artificial fingerprints? In MIPR, 2019.
[44] Safa C. Medin, Bernhard Egger, Anoop Cherian, Ye Wang. Joshua B. Tenenbaum, Xiaoming Liu, and Tim Marks, MOST-GAN: 3D morphable StyleGAN for disentangled face image manipulation. In AAAI, 2022.
[45] Yimeng Min, Frederik Wenkel, and Guy Wolf. Scattering GCN: Overcoming oversmoothness in graph convolutional networks. In NeuriPS, 2020.
[46] Binh X Nguyen, Binh D Nguyen, Tuong Do, Erman Tjiputra, Quang D Tran, and Anh Nguyen. Graph- based person signature for person re-identifications. In CVPR, 2021.
12

---

[47] Seong Joon Oh, Bernt Schiele, and Mario Fritz. Towards reverse-engineering black-box neural networks. Explainable AI: interpreting, explaining and visualizing deep learning, pages 121-144, 2019.
[48] Utkarsh Ojha, Yuheng Li, and Yong Jac Lec. Towards universal fake image detectors that generalize across generative models. In CVPR, 2023.
[49] Yongyang Pan, Xiaohong Liu, Siqi Luo, Xin, Xiao Guo, Xiaoming Liu, Xiongkuo Min, and Guangtao Zhai Towards effective user attribution for latent diffusion models via watermark-infomm blending. arXiv preprint arXiv:2409 10958, 2024.
[50] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. High-resolution image synthesis with latent diffusion models. In CVPR, 2022.
[51] Michael Schlichtkrull, Thomas N Kipf, Peter Bloem, Rianne Van Den Berg, Ivan Titov, and Max Welling. Modeling relational data with graph convolutional networks. In ESWC, 2018.
[52] Husrev Taha Sencar, Luisa Verdoliva, and Nasir Memon. Multimedia Forensics. Springer Nature, 2022.
[53] Zeyang Sha, Zheng Li, Ning Yu, and Yang Zhang. De-fake: Detection and attribution of fake images generated by text-to-image generation models. Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 1418-332, 2023.
[54] Kaede Shiohara and Toshihiko Yamasaki. Detecting deepfakes with self-blended images. In CVPR, 2022.
[55] Xiufeng Song, Xiao Guo, Jiache Zhang, Qirui Li, Lei Bai, Xiaoming Liu, Guangtao Zhai, and Xiaohong Liu. On lcarning multi-modal forgery representation for diffusion generated video detection. In NeurlPS, 2024.
[56] Zhihao Sun, Haoran Jiang, Danding Wang. Xirong Li, and Juan Cao. Safl-net: Semantic-agnostic feature learning network with auxiliary plugins for image manipulation detection. In ICCV, 2023.
[57] Chuangchuang Tan. Huan Liu, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethink- ing the up-sampling operations in enn-based generative network for generalizable deepfake detection. In CVPR, 2024.
[58] Praveen Tirupattur, Kevin Duarte, Yogesh S Rawat, and Mubarak Shah. Modeling multi-labe action dependencies for temporal action localization. In CVPR, 2021.
[59] Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine lcarning models via prediction APIs. In USENIXSS, 2016.
[60] Luan Tran, Xi Yin, and Xiaoming Liu. Disentangled representation learning GAN for pose-invariant face recognition. In CVPR, 2017.
[61] Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. Graph attention networks. In ICLR, 2017.
[62] Sheng- Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei Efros. Can-geeeraaed images are surprisingly easy to spot... for now. In CVPR, 2020.
[63] Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang. Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diffusion-generated image detection. In ICCV, 2023.
[64] Yue Wu, Wael AbdAlmageed, and Premkumar Natarajan. Mantra-net: Manipulation tracing network for detection and localization of image forgeries with anomalous features. In CVPR, 2019.
[65] Yingmao Yao, Xiaoyan Jiang, Hamido Fujita, and Zhijun Fang. A sparse graph wavelet convolution neural network for video-based person re-identification. Pattern Recognition, 2022.
[66] Yuguang Yao, Xiao Guo, Vishal Asnani, Yifan Gong, Jiancheng Liu, Xue Lin, Xiaoming Liu, Sijia Liu, et al. Reverse engineering deceptions on machine-and human-centric attacks. Foundations and Trends@ in Privacy and Security, 6(2):53-152) 152, 2024.
[67] Yuguang Yao, Jiancheng Liu, Yifan Gong, Xiaoming Liu, Yanzhi Wang, Xue Lin, and Sijia Liu. Can adversarial examples be parsed to reveal victim model information? In WACV, 2024.
[68] Jin Ye, Junjun He, Xiaojiang Peng, Wenhao Wu, and Yu Qiao. Attention-d driven dynamic graph convolu- tional network for multi-labe image recognition. In ECCV, 2020.
13

---

[69] Fisher Yu, Ari Seff, Yinda Zhang. Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. LSUN: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint urXiv:1506.0336. 2015.
[70] Ning Yu, Larry S Davis, and Mario Fritz. Attributing fake images GANs: Learning and analyzing GAN fingerprints. In ICCV, 2019.
[71] Yuanhao Zhai, Tianyu Luan, David Doermann, and Junsong Yuan. Towards generic image manipulation detection with weakly-supervisee self consistesit learning. In ICCV, 2023.
[72] Lingzhi Zhang, Zhengjie Xu, Connelly Barnes, Yuqian Zhou, Qing Liu, He Zhang. Sohrab Amirghodsi, Zhe Lin, Shechtman, and Jianbo Shi. Perceptual artifacts localization for image synthesis tasks. In ICCV, 2023.
[73] Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control text-to-image diffusion models. In ICCV, 2023.
[74] Zhang, Svebor Karaman, and Shih-Fu Chang. Delecting and simulating artifacts in gan fake images. In WIFS, 2019.
[75] Yue Zhang, Ben Colman, Ali Shahriyari, and Gaurav Bharaj. Common sense reasoning deep fake detection. In ECCV, 2024.
[76] Jizhe Zhou, Xiaochen Ma, Du, Ahmed Alhammadi, and Wentao Feng. Pre-training-free image manipulation localization through non-mutually exclusive contrastive learning. In ICCV, 2023.
[77] Jun- Yan Zhu, Taesung Park, Phillip Isola, and Alexei Efros. Unpaired image-to-inage translation using cycle-consistent adversarial networks. In ICCV, 2017.
14

---

In this supplementary, we provide:
Predictable hyperparameters introduction.
Training and implementation details.
Additional results of model parsing and CNN-generated image detection.
The construction of RED140 dataset.
Hyperparameter ground truth and the model parsing performance for each GM
A Predictable Hyperparameters Introduction
We investigate 37 hyperparameters that exhibit the predictability according Asnani al. [2]. These hyperparameters are categorized into three groups: (1) Loss Function (Tab. 4), (2) Discrete Architecture Hyperparameters (Tab. 5), (3) Continuous Architecture Hyperparameters (Tab. 6). We report our proposed method performance of parsing hyperparameters in these three groups via Fig. 7a, Fig. 7b, and Fig. 7c, respectively. Moreover, in the main paper's Eq. 8 and Fig. 4a, we employ the assignment hierarchy M to group different hyperparameters together, which supervises the learning of the matching matrix M. The construction of such the M is also based on Tab. 4, 5, and which not only define three coarse-level categories, but also fine-grained categories such as pixel-level objective (loss) function (e.g.. and MSE) in Tab. 4, and normalization methods (e.g.. ReLu and Tanh) as well as nonlinearity functions (e.g., Layer Norm. and Batch Norm.) )) in Tab. 5.
B Training and Implementation Details
Training Details Given the directed graph A E RCxC, which contains C graph nodes. We empirically set C' as 55, as mentioned in the main paper Sec. 3.3. In the training, LGPN takes the given image I and output the refined feature V E R which contains learned features for each graph node, namely, V = (Vo. Vi,..., V51}. As matter of fact, we can view V as three separate sections: V = (Vo, Vi,... vo). V = {V10, Vi1...., V27). and V = [V28, V29...., V34 ). which denote learned features for graph nodes of 10 loss functions (e.g., L1 and MSE), 18 discrete architecture hyperparameter (e.g., Batch Norm. and ReLU), and continuous architecture hyperparameter (i.e., Parameter Num respectively. Note V represents learned features of 9 continuous architecture hyperparameters because each continuous hyperparameter is represented by 3 graph nodes, as illustrated in Fig. Ic of the main paper. Furthermore, via Eq. 7 in the main paper, we use V obtain the corresponding probability score p [Po. ..... P51 for each graph node. Similar to V, this can be viewed as three sections: p' E IR p E 18 and pd E R227 for loss functions, discrete architecture hyperparameters, continuous architecture hyperparameters, respectively. In the end, we use to help optimize LGPN via the graph node classification loss (Eq. 7). After the training converges, we further apply individual fully connected layers on the top of frozen learned features of continuous architecture hyperparameters (e.g.. Vo). via minimizing the L1 distance between predicted and ground truth value.
In the inference (the main paper Fig, 4b), for loss function and discrete architecture hyperparameters, use output probabilities (e.g., p' and pd)) of discrete value graph nodes, for the binary "used v.s. not" classification. For the continuous architecture hyperparameters, we first concatenate learned features of corresponding graph nodes. We utilize such a concatenated feature with pre-trained, fully connected layers to estimate the continuous hyperparameter value.
Model Parsing Implementation Details Denote the output feature from the Generation Trace Capturing Network as f R2048 To transform f into a set of features H {ho. hy.... ha4 } for the 55 graph nodes, 55 independent linear layers (9) are employed. Each feature h, is of dimension R512, The H is fed to the GCN refinement block, which contains 5 GCN blocks, each of which has 2 stacked GCN layers. In other words, the GCN refinement block has 10 layers in total. We use the correlation graph A 55565 (Fig. 10) capture the hyperparameter dependency and during the training the LGPN pools into A E R 18x18 and A₂ E R as the Fig. of the main paper. The LGPN implemented using the PyTorch framework. During training, learning rate of 3e-2 used. The training is performed with a batch size of 400, where 200 images are generated by various GMs and 200 images real.
15

---

Table 4: Loss Function types used by all GMs. We group the 10 loss functions into three categories. We use the binary representation to indicate the presence of each loss type in training the respective GM.
Category
Loss Function
ln
L2
Pixel-level
Mean squared error (MSE)
Maximum mean discrepancy (MMD)
Least squares (LS)
Wasserstein loss for GAN (WGAN)
Kullback-Leibler (KL) divergence
Discrininator
Adversarial
Hinge
Classification
Cross-entropy (CE)
Table 5: Discrete Architecture Hyperparameters used by all GMs. We group the 18 discrete architec- ture hyperparameters into 6 categories. We use the binary representation to indicate the presence of each hyperparameter type in training the respective GM.
Category
Diserete Architecture Hyperparameters
Batch Normalization
Instance Normalization
Normalization
Adaptive Instance Normalization
Group Normalization
ReL.U
Tanh
Nonlincarity in the Last Layer
Leaky ReLU
Sigmoid
SiLU
ELU
ReLU
Nonlinearity in the Last Block
Leaky_ReLU
Sigmoid
SiLU
Nearest Neighbour Up-sampling
Up-sampling
Deconvolution
Skip Connection
Feature used
Down- wwwn-sampling
Feature used
Table 6: Continuous Architecture Hyperparameters used by all GMs, where "[" denotes inclusive and "(" denotes exclusive intervals. We report the range for 9 continuous hyperparameters.
Category
Range
Discrete Architecture Hyperparameters
(0 717
Layers Number
0 289
Convolution Layer Number
[ 0-1885
Fully-connected Layer Number
Layer Number
[0 46
Pooling Layer Number
() 0-2355
Normalization I Layer Number
(0 20
Layer Number per Block
(0-S 365
Filter Number
Unit Number
(0-155]
Block Number
00 56, 008, 488)
Parameter Number
Implementation Details for Detection and Attributions We validate GTC's effectiveness in capturing the generation trace in Fig. 6. Specifically, Fig. 8 shows the detailed implementation. We employ FC layers convert output feature f 2048 to fdct. 1 and fatt. R for CNN-generated image detection and image attribution respectively.
C Additional Results
We report detailed performance on RED116 via Tab. 8, demonstrating that our proposed L.PNN achieves the best performance on both datasets. Also, in Fig, 5a of the main paper, we visualize
16

---

.83
.988
.861
.901
.939
0.8
.748
.752
.752
F1 Score
.655
0.6
0.4
0.2
L.1
12
MMD
MSE
1.
Adv.
WGAN
KI.
Hingo
CE
(a)
.897
.787
.815
.792
.727
.701
F1 Score
0.6
0.4
0.0
Non-linear.
type
None-linear last block
Skip connect.
Upsampling Downsampling
last layer
(h)
0.16
1419
0.14
.138
Error
0.12
0.10
.091
.081
0.08
0.06
0.04
0.02
0.00
Layers
Conv
PC
Pooling
Norm
Milters
Block
Block Param. Num
Layers
Num
(c)
Figure 7: (a) The Fl score on the loss function reveals that MMD and KL are two easiest loss functions predict. (b) The Fl score the discrete architecture hyperparameters demonstrates that predicting these hyperparameters is more challenging than predicting the loss function. This finding aligns with the empirical results reported in the previous work [2]. (c) The L1 error on the continuous architecture hyperparameters indicates that it is challenging to predict Block Num. and Filter Num..
22 Value
4
Ll Error
0.123
0.120
0.124
0.132
0.130
Table 7: Using different n graph nodes for the continuous hyperparameter regression.
the correlation graph similarities among different GMs in the first test set. In this section, we offer similar visualization (e.g., Fig. 9 of the supplementary) for other test sets. In the main paper's Sec 3.3, we use graph nodes for each continuous hyperparameter and is set as 3. Tab. shows the advantage of choice, which shows the lowest regression error is achieved when n is 3.
17

---

FC layers
Real or CNN- gmmerate??
FC layers
Clasification categories.
GTC
GTC
204888
1+2
12048
(6) CNN generated image detection
Image attribation.
Figure 8: We construct simple classifiers based on GTC. Then, we train these two classifiers for CNN-generated image detection and image attribution, respectively. Please note that GTC only leverages ImageNet pre- pre-trained weights as the initialization, same as the previous method [62]. For fair comparison, no model parsing datasets such REDI16 16 and RED140 are used for pre-training.
AAR
CRGANUC
GREM
ADAGAN.C
YAS
IMACE_OPP
BEGAN
BETA.H
ICRGAN
MADE
LOGAN
PROGUGAN
DERFFOOL
STARGAN
SEAN
SURYAE MAN
SURVAE NON
PVEN
STAB PM 15
CONTROLMA
SDEDET
ST
PADML 176
GLIDE
STAU PM XL
1.0
Figure 9: Each element of these two matrices is the average cosine similarities of 2, 000 pairs of generated correlation graphs A' o from corresponding GMs the second, third and forth test sets.
Unose supo
lost 2000
cone 10000
New 66%
fas 980
w
Ubboe 1340
cor se 1100
roe trmm
Poets
c.
newe past
(G:50)
toche
(200
boit hov.
Gcup tenr.
Well
ca
Cocery sp-torging
Figure 10: The initial correlation graph A that we construct based on the probability table in Sec. 3.1 of the main paper. The optimum threshold we use 0.45.
18

---

Loss Function
Dis. Archi.
Con. Archi.
Para.
Para.
Method
FI f
Acc. 1
FIT
Acc. 1
Li crror
Random GT [2]
0.636
0.716
0.529
0.575
0.184
FEN-PN [2]
0.813
0.792
0.718
0.706
0.149
FEN-PN [2]
0.801
0.811
0.701
0.708
0.146
GTC W MLP
0.778
0.801
0.689
0.701
0.169
GTC w Stacked -GCN
0.790
0.831
0.698
0.720
0.145
LGPN
0.841
0.833
0.727
0.755
0.130
Table 8: The model parsing performance on RED116. In the last row, our proposed LGPN that contains GTC and GCN Refinement block, which achieves the best model parsing performance in all metries. [Key: GCN refine.: GCN refinement block; Bold: best.].
Loss Function
Dis. Archi.
Para.
Threshold
F1/Accuracy 1
0.35
84.0/83.0
79.2/77.0
0.45
84.6/83.3
79.5/77.5
0.55
84.5/82.8
78.9/77.0
0.65
82.7/82.5
77.0/74.5
Table 9: More parsing performance with different thresholds constructing the correlation graph A.
Method
Test GM
Train GM
Con. Archi, Para. L5 error
Dis. Archi. Para. Fl
Loss function F1 1
FEN-PN
Face
Face
0.139 0.042
0.729 0.106
0.146
Ours
Face
Face
0.112 0.028
0.786 0.116
0.801 0.134
FEN-PN
Face
Non-Face
0.213 0.066
0.688 0.125
0.759 + 0.1
Ours
Face
Non-Face
0.139 0.063
0.694 0.117
0.771 1: 0.2
FEN-PN
Face
Full
0.118 0,046
0.712 0.129
0.833
Ours
Face
Full
0.099 0.044
0.745 + 0.099
0.840=0.122
FEN-PN
Non-Face
Non-Face
0.118 = 0.021
0.794 + 0.11
0.864 + 0.094
Ours
Non-Face
Face
0.116 0.016
0.810 +: 0.102
0.870 +: 0.092
FEN-PN
Non-Face
Face
0.125 = 0.031
0.667 + 0.099
0.858 = 0.115
Ours
Non-Face
Non-Face
0.100 = 0.027
0.692 + 0.101
0.882 + 0.112
FEN-PN
Non-Face
Full
0.082 = 0.045
0.832 0.046
0.386 0.061
Ours
Non-Face
Full
0.080 = 0.042
0.844 + 0.032
0,901 0.021
Table 10: Performance comparison across different face and non-face GMs.
Continuous type
Discrete type
Method
L; error
P-value
Conr. coct.
Coef. det.
score
Accuracy
Random ground-truit
0.184 = 0.019
0.006 1: 0.001
0.261 4 0.188
0.315 4 0.095
0.529
0.078
0.575 4: 0.097
Mean/mode
0.164 0.011
0.035
0.005
0.326 0.112
0.115
0.612
No fingerprint
0.170 0.033
0.017
+: 0.004
0.738 4: 0.014
0.605 + 0.152
0.700
0.032
0.663 +: 0.104
Using one parser
0.161 = 0.028
0.032
+ 0.002
0.226 + 0.030
0.512
:: 0.116
0.607 : 0.034
0.593 4: 0.10
FEN-PN
0.149 0.019
0.022
0.007
0.744 0.098
0.612 0.161
0.718
0.706 0.040
Ours
0.130 0.011
N/A
0.833 + 0.098
0.732 + 0.177
0.713 + 0.033
0.755 + 0.030
Table 11: Performance of architecture hyperparameters prediction. We use L1 error, p-value, correlation coefficient, and coefficient of determination for continuous type parameters. For discrete architecture hyperparameters, we use the score and classification accuracy. The first value standard deviation across sets, while the second one is across samples. The p-value is estimated for every ours baselie pair. [KEYS: corr.: correlation, coef.: coefficient, det.: determination]
19

---

Object Acc.
Con. Archi. Err.
Archi. Acc.
10
44
07
C1
FACUS
DIGANLC
ORGAN
FXXELOIn VELCWw SCCAN,MAL STARGAAN ME,GAN SOMM DOeN MONPGANN
(a)
Object Acc.
Con. Archi. Err.
Dis. Archi. Acc.
0.0
0.-
ADAGAULC
GAN CAAMER DEEWOOL
S7AL0MC115 32
(b)
Object Acc.
Con. Archi. Err.
Dis. Archi, AcC.
0.7
0.4
ORGAN,C
FACTOR WA
KRGANLC
LOGAN
PARELSNAL
STARdMILyA FLOW FLORAAAOOOL
FXLD
CONTROL DR,
Object
Dis. Archi. Acc.
42
GFUK
IMIGE
15CAN)
MADC
PROG_GAN ASGALIEES
SEAM
STYEURIME FLOMI JONHOSL
VIGAI
30EDIr INDW, STLOMMAN
(d)
Figure 11: We report detailed model parsing results on different GMs in each test set. These results include loss function and discrete architecture hyperparameter prediction accuracy, well the L1 enror on the continuous architecture hyperparameter prediction. Specifically, (a), (b), (c), and (d) are the performance for GMs in the 1st, 2nd, 3rd, and 4th test sets, respectively. 20

---

Table 12: Test sets used for evaluation. Each contains generative models from GAN, DM, VAE, AR (Auto-Regressive) AA (Adversarial Attack), and NF (Normalizing Flow). All test sets contain face and non-face in the image content. [Keys: R means GM is used in the test of RED116 but is not used in RED140.]
Set ADV FACES BETA
Set AAE
Set
Set
BICYCLE GAN (R)
GFLM
ADAGAN C
BIGGAN 512 (R)
IMAGE GPT
BETA TCVAE
BEGAN
CRGAN C
LSGAN
BIGGAN 128 (R)
BETA H
FACTOR VAE
MADE
DAGAN
BIGGAN 256 (R)
PIX2PIX (R)
DRGAN
COCOGAN
ICRGAN C
PROG GAN
EGAN
CRAMERGAN
LOGAN
RSGAN ESGAN_REG
PIXEL CNN
DEEPFOOL
MUNIT
SEAN
PIXEL_ PIXEL_CNN+ CNN++
DRIT
PIXEL SNAIL.
STYLE_ GAN
RSGAN HALF
FAST PIXELL)X
STARGAN
SURVAE FLOW NONPOOL
STARGAN
FVBN
SURVAE FLOW MAXPOOL
WGAN DRA
VAEGAN
SRELOW (R)
VAE FIELD
YLG (R)
DDPM
ADM
LDM
ADM
IDDMM 64
DDPM_32 32
CONTROLNET
STABLE DM
Denoise
GAN Cannise_GAN___
GLIDE
STABLE_ DM_15
SEDdit
Semantics
REAL
Resolution
LSUN
((eca)
1004"1024
bragshet
17%
16.7%
FFHO (faoe)
0.3%
23.8%
64764
MeeST
Face
8,3%
16.7%
512'512
15.2%
SOUPS
Imagehett
15.7%
120"128
GFAR10
LSUN
15.0
15.7%
7.0%
Figure 12: RED140 statistics. (a) The dataset is trained on various image contents semantics. (b) The real-image category contains many real-image datasets that GMs are trained on [33, 32, 13, 69, 25, 36, 37J. (c) The GM has various image resolutions.
D RED140 Dataset
In this section, we provide an overview of the RED140 dataset, which used for both model parsing and coordinated attack detection. Note that, for the experiment reported in Tab. ?? of the supplementary, we follow the test sets defined in RED116 [2]. When construct RED140, we use images from ImageNet, FFHQ, CelebHQ, CIFAR1O, and LSUN as the real-images category of RED140. We exclude GM that not trained the real-image category RED140. addition, both RED116 and RED140 40 contain various image content and resolution, and the details about RED140 are uncovered in Fig. 12 the supplementary. For test sets (Tab. 12 of the supplementary), we follow the dataset partition of REDI16, excluding the GMs that are trained on real images, which RED140 does have. For example, JFT-300M used to train BigGAN, so we remove BIGGAN_128, BIGGAN 256 and BIGGAN_57 512 in the first, second, and third test sets.
E GM Hyperparameter Ground Truth
In this section, we report the ground truth vector of different hyperparameters of each GM contained in the RED140. Specifically, Tab. 13 and Tab. 14 report the loss function ground truth vector for each GM. Tab. 15 and Tab. 16 report the discrete architecture hyperparameter ground truth for each GM. Tab. 17 and Tab. 18 report the continuous architecture hyperparameter ground truth for each GM. The detailed model parsing performance on each GM is reported in the supplementary's Fig. 11.
21

---

Table 13: Ground truth Loss Function feature vector used for prediction of loss type for all GMs. The loss function ground truth is in (Tab. 4).
GM
L
MSE
MMD
LS
WGAN
KL
Adversarial
Tingee
CE
AAE
U
U
0
U
ACGAN
0
0
ADAGAN C
ADAGAN
ADM_G. G 128
ADM G 256
ADV FACES
ALAE
0
BEGAN
BETA
BETA
BETA TCVAR
0
BGAN
BICYCLE GAN
BIGGAN 128
BIGGAN 256
BIGGAN_ST 512
Blended DM
CADGAN
CCGAN
OGAN
CLIPDM
COCO_GAT
COGAN
COLOUR GAN
CONT_ENS
CONTRAGAN
CONTROLNET
COUNCIL GAN
CRAMER GAN
CRGAN
CRGAN
CYCLEGAN
DAGAN C
DAGAN P
DCGAN
DDPM 32
DDPM 256
DDIFFGAN 32
DEEPFOOL.
DFCVAE
DIFFAE 256
DIFFAE LATENT
DIFF-PrOGAN
DIFF-StylGANN
DIFF-ISGEN
DISCOGAN
DRGAN
DRIT
DUALGAN
EBGAN
ESRGAN
FACTOR VAE
Fast pixel
FEGAN
FGAN
FGAN KL
FGAN NEYMAN
FGAN PEARSON
FGSM
FPGAN
ESGAN
FVBN
GAN ANIME
Gated pixel con
GDWCT
GFLM
GGAN
00
GLIDE
ICRGAN C
ICRGAN_P
22

---

Table 14: Ground truth Loss Function feature vector used for prediction of loss type for all GMs. The loss function ground truth is in (Tab. 4).
GM
MSE
MMD
LS
WGAN
KL
Adversarial
Tlinge
CE
IDPM 32
0
0
0
IDDPM 64
1
0
IDDMM 256
1
0
ILVER 256
0
Image_ GPT
O
INFOGAN
1
0
LAPGAN
0
0
0
LDM
0
0
0
0
0
IDM_
0
0
Lmcony
0
LOGAN
0
LSGAN
MADE
0
0
0
MAGAN
0
MEMGAN
0
MMD_GAN
1
MRGAN
MSG BIG_STYLE__GRR
MUNIT
0
NADE
0
OCFGAN
1
PGD
PIX2PIX
PixeICNN
0
0
PixcICNN+
0
0
PIXELDA
0
PixelSnail
PNDM 32
PNDM 256
1
PROG_GAM
0
0
RGAN
0
0
RSGAN HALF
RSGAN QUAR
RSGAN REG
RSGAN RES BOT
0
RSGAN RES HALF
0
RSGAN RES QUAR
RSGAN RES REG
SAGAN
SCOREDIFF 256
SDEdiL_2S0
SEAN
0
SEMANTIC
0
SGAN
SNGAN
0
SOFT_GAN
0
0
SRFLOW
0
0
0
SRRNET
0
STANDARD VAE
STARGAN
STARGAN_2 2
WA_DMMIS
STA DM 21
0
STA DM XL
STGAN
STYLEGAN
STYLEGAN 2
0
0
STYLEGAN2 ADA
1
SURVAE FLOW MAXPOOL
0
0
SURVAE FLOW NONPOOL
0
TPGAN
UGAN
0
0
UNIT
0
0
VAE, field
0
0
VAR flow
0
0
VAEGAN
0
VDVAE
00
0
WGAN
0
0
1
WGAN DRA
0
0
0
WGAN WC
0
0
WGANGP
YLG
23

---

Table 15: Ground truth feature vector used for prediction of Discrete Architecture Hyperparameters for all GMs. The discrete architecture hyperparameter ground truth is defined in (Tab. 5). A D are Batch Norm., Instance Norm., Adaptive Instance Norm., and Group Norm., respectively. E I are non- von-linearity in the last layer. and they are ReLU, Tanh, Leaky_ ReLu, Sigmoid, and SiLU. are non-linearity in the last block, and they are ELJU, ReLU,, Leaky_Red Sigmoid, and SiL.U. O and P are Nearest Neighbour and Deconvolution Upsampling. Q and I. are Skip Connection and Downsampling.
GM AAE
R
C
D
F
G
H
K
M
0
Q
0
0
0
U
ACGAN
1
ADAGAN.C C
0
1
0
ADAGAN_P
0
U
0
0
1
0
ADM_G_I28
0
DI
ADV_PACHE
D
6
ALAB
0
0
BEGAN
BETA
BETAJH
0
BETA TCYAE
D
BGAN
GAN
BIGGAN 128
BIGGAN 255
RIGGAN
Bleaded
CADGAN
COGAN
CGAN
CLIPDM
COCD_GAN
COGAN
COLOUR
CONTRAGAN
CONTROL NET
COUNCHL
CRAMER GAN
ORGAN C
ORGAN P
CYCLEGAN
DAGAN
DAGAN_ PP
DCGAN
O
O
DIIERGAN
DDPM_32
DRPM 256
O
DEEPROOL
D
D
DFCVAE
DIFF ISGEN
DIFF PEAN
D
O
DIFF SGAN
0
DIFFAR
DIFFAR
DISCOGAN
D
DRGAN
0
DRIT
DUALGAN
ERGAN
0
ESRGAN
0
FACTOR VAE
FASTPIXEI
FRGAN
0
RGAN
0
O
IGAN NEYMAN
POAN PEARSON
0
FGSM
0
O
FPGAN
FSGAN
FVDN
D
0
0
GAN ANIME
PIXEL_CNN
GDWCT
GFLM
D
0
0
GGAN
GLIDE
24

---

Table 16: Ground truth feature vector used for prediction of Discrete Architecture Hyperparameters for all GMs. The discrete architecture hyperparameter ground truth is defined in (Tab. 5). A D are Batch Norm., Instance Norm., Adaptive Instance Norm., and Group Norm., respectively. E I are non-linearity in the last layer and they are ReLU, Tanh, Leaky_Ree Reeu,, Sigmoid, and SiLU. N are non-linearity in the last block and they are ELU, ReLU, Leaky_Rel.a Sigmoid, and SiLU. O and P are Nearest Neighbour and Deconvolution Upsampling- Q and L are Skip Connection and Downsampling
GM ICRGAN
C
E
F
1
K
L
F
0
0
ICRGAN P
0
0
0
1
0
0
1
0
0
0
0
0
IDDPM 32
0
1
0
0
1
0
0
0
IDDPM 64
IDDMM 256
0
0
0
1
0
IMAG GPT
0
0
0
0
0
0
0
INFOGAN
0
0
O
IINER
LAPGAN
LDM
0
0
0
LDM CON
0
EMCONV
LOGAN
LSGAN
0
MADE
0
MAGAN
MEMGAN
MMD. GAN
0
MRGAN
0
MSG STYLE GAN
MUNIT
1
NADE
0
OCFGAN
0
PGD
PIX2PIX
PIXELCNN
0
0
PIXELCNN_IP PP
PIXELDA
PINELSNAIL
0
PNDML 32
0
0
PNDM 256
0
PROG_GAN
ROAN
0
RSGAN HALF
0
RSGAN QUAR
REG
RSGAN_ JEES BOT
0
RSGAN RES HALP
0
0
RSGAN RES QUAR
0
RSGAN_RC BERSA_RRE_LAAE RES_REESE REG
SAGAN
0
SCOREDIPE 256
0
SDEDIT
SEAN
SEMANTIC
SGAN
0
SNGAN
SOFT_GAN
SRELOW
0
Q
SRRNET
0
STANDARD
STA DMLIS
STA DM 21
0
STA DMLAL
0
STARGAN
STARGAN
SIGAN
0
STYLEGAN
O
STYLEGAN_2
STYLEGAN
SURVAR M
0
SURVAE_N
0
IPGAN
UGIAN
UNIT
O
FIEL
0
O
O
VLOW
YAEGGAN
VDVAF
0
O
WGAN
0
G
0
O
WGAN DRA
WGAN
WGANGP
0
0
YLG
0
0
G
25

---

Table 17: Ground truth feature vector used for prediction of Continuous Architecture Hyperparameters for all GMs. The discrete architecture hyperparameter ground truth is defined in (Tab. 6). Fl: # layers, F2: convolutional layers, F3: # fully connected layers, F4: pooling layers, F5: normalization layers, F6: #filters, F7: # blocks, F8:# layers per block, and F9: # parameters.
Block
Layer
Conv,
FC
Norm.
Block
Layer #
Para.
AAE
1,33,,
ACGAN
18
10
7
2, 307
4, 276, 739
ADAGAN_C C
35
14
13
7
4, 1131
9, 416, 196
ADAGAN_P P
35
7
4, 1111
9.416, 196
ADM. G28
223
90
37
88
NYA
34
421, 529, 606
ADM 252
266
103
N/A
553, 838, 086
ADV FACES
45
23
20
2, 627
30, 000, 000 50,
4,
BEGAN
10
0
515
7, 278 472
B
7
0
99
469, 173
BETA
99
469, 173
BETA TCVAE
7
99
469, 173
BGAN
8
3
757, 412
BICYCLE GAN
25
14
10
4, 483
10
23, 680, 256
BIGGAN 128
BIGGAN 256
75
25
49
7, 215
12
56. 900, 000
BIGGAN
57
56,
Blended DM
266
107
45
11
103
N/A
39
553, 838, 086
3, 41812,
OCGAN
22
12
10
3, 203
29, 257. 731
CGAN
3
1, 757, 412
COCO_GA GAN
19
883
50, 000, 000
COGAN
259
1, 126, 790
COLOUR GAN
10
435
19, 422, 404
CONT ENC
19
1I
5, 987
2
10, 401, 187
9,
CONTROLNET
427
121
132
174
N/A
56
39, 726, 979
COUNCHI
29
69,
CLIPDM
226
120
34
72
N/A
38
113, 673, 219
CRAMER GAN
4
434
9, 681, 28-
CRGAN_C C
35
14
7
4, 131
9, 416, 196
CRGAN P
35
14
7
4, 131
9, 416, 196
CYCLEGAN
23
2, 947
11,377 378, 179
DAGAN C
35
14
13
7
4, 131
9, 116, 196
9, 414,
DCGAN
9
454
2
681, 284
91
N/A
48, 432,
DDPM_32
16-1
89
21
51
N/A
28
35, 716, 307
256
225
120
34
71
NAA
39
113, 673, 219
DEEPFOOL
95
236
22, 000, 000
DECVAE
45
22
21
4, 227
2, 3464 234
DIFE ISGEN
88
56
N/A
30, 276, 583
DIFE PGAN
45
20
13
N/A
105, 684, 175
DIFF SGAN
N/A
21. 707, 458
DIFFAE
712
263
171
45
233
NIA
118
336, 984, 582
235
445, 203,
DISCOGAN
21
12
9
3, 459
29, 241, 731
DRGAN
14
4, 481
18, 885, 008
DRIT
19
10
9
1, 793
964, 170
DUALGAN
25
14
10
4, 483
23, 680, 256
ERGAN
195
738, 433.
ESRGAN
G6
66
O
4, 547
7, 0121, 163
FACTOR
99
Fast pisel
17
9
8
768
2
4, 600, 000
3, 0
50,
EGAN
2
2
2, 256, 401
FGAN
2
2, 256,
FOAN NEYMAN
2
2
2, 256, 401
EGAN PEARSON
2, 256 401
FGSM
95
7, 236
22, 000, 000
EPGAN
23
12
11
2, 179
2
53. 192, 576
2, 0
FVBN
28
0
28
O
307. 721
2,
8, 467,
Gated Bood__pxee__cm pixee__en
32
32
O
5, 433
3
10
364, 161
GDWCT
79
27
11
3, 699
51, 965, 832
GFLM
95
92
O
7, 236
10
22, 000, 000
GGAN
3
451
3. 812, 355
GLIDE
331
103
129
N/A
74
385, 030. 726
ICRGAN
35
14
7
4, 131
9. 416, 196
ICRGAN P
35
4, 1,1
9, 41616, 196
26

---

Table 18: Ground truth feature vector used for prediction of Continuous Architecture Hyperparameters for all GMs. The discrete architecture hyperparameter ground truth is defined in (Tab. 6). Fl: # layers, F2: convolutional layers, F3: fully connected layers, F4: pooling layers, F5: normalization layers, F6: #filters, F7: # blocks, F8:# layers per block, and F9: # parameters.
Layer #
Cony,
FC
Pool #
Norm.
Filter
Block
Layer 4
Pana
IDDPML 64
195
87
32
0
76
N/A
45
27, 3019, 350
678
ILVER 256
266
107
45
11
103
N/A
39
553, 835, 086
Image GPT
4,673
401,
INFOGAN
3
0
3
195
1, 049, 985
LAPGAN
6
262
182, 857
LDM
255
127
21
101
N/A
65
329, 378. 945
LDM_CON
503
159
184
152
N/A
65
456, 755, 873 46. 000, 000
LEnCoR
105
60
10
33
T. 156
15
LOGAN
35
14
13
131
416, 196
909,
MADE
O
2
0
0
12552784
MEMGAN
14
7
O
1, 155
4, 128, 515
MRGAN
1
D
451
15, 038, 350
MSG STYLE GAN
094
200,
MUNIT
15
0
3, 715
10, 305, 035
NADE
0
785, 284
OCEGAN
4
O
454
9, 681, 284
PGD
92
236
22, 000, 000
PIX2PIX
16
O
13
5, 507
54. 104, 099
PiXeCCNN
9
U
768
600, 000
35
000,
PIXELDA
27
14
12
835
4
483, 715
90
000,
PNDM_S3
164
89
24
O
51
N/A
28
35, 746, 307
256
086
PROG GAN
26
25
D
4, 600
3
46, 200, 000
RGAN
195
985
RSGAN HALF
O
899
3
13, 129, 731
RSGAN QUAR
355
RSGAN REG
O
795
48, 279, 555
RSGAN_RES RES BOT
963
758. 467
RSGAN RRS HALF
7
O
155
1, 2010 411
RSGAN RES QUAR
O
579
367, 235
270,
SAGAN
6
O
139
16, 665, 286
062
266,
SEMANTIC
23
12
O
11
2. 179
53. 192, 576
SGAN
SCOREDIFF 256 225
120
34
11
T1
N/A
39
113, 673, 219
SDEdit
120
34
N/A
38
113, 673,
SNGAN
23
11
O
11
3, 871
10, 000, 000
SOPT GAN
757.
SRFLOW
66
0
4. 547
012, 163
SRRNET
36
37
819
069, 955
STANDARD VAE
4
0
99
469.
STARGAN
12
179
192, 576
STARGAN_2
26
12
25
188
008,
STA DM 15
503
159
184
152
N/A
65
456, 755. 873
STA DMLLM
601
184
201
12
185
N/A
74
618, 997, 638
STGAN
STYLEGAN
33
25
0
4. 094
50, 200 000
STYLEGAN
00,0000,000
STYLEGAN2 ADA
33
25
O
4. 094
59. 000, 000
SURVAE FLOW. MAX
90
5
542
000, 000
SERVAE_FLOW NON
90
O
542
25, 000, 000
TPGAN
45
31
I
11
275
27, 233, 200
UGAN
4
O
771
850, 692
UNIT
43
22
21
739
13. 131, 779
O
300,
VAE. Row
14
O
14
D
2
760, 448
396,
VDVAE
48
42
6
3. 5.5002
3
13
41, 000, 000
909,999.00 265
WGAN DRA
18
10
0
2. 307
4,276, 739
WGAN
2,307
4,276,
WGANGP
5
0
1,923
23, 905, 841
YLG
20
2
5. 155
078, 078,878,5 852
27

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We propose model parsing algorithm, which is claimed in both the abstract and introduction sections.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We discuss the limitation of our proposed method at the end of the paper, which helps the deeper understanding.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sellsspeciiiationn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
28

---

Answer: [Yes]
Justification: We provide extensive empirical results and detailed insights that justify each of our contribution statements.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: Yes. We include an extensive supplementary that includes the dataset de- scription, implementation details, and detailed performance on each generative model and hyperparameters.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g.. in the of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the partieular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
29

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: Yes. We will release the source code.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm cc/
mablic/guides ht/g///dd//ooeeiie
ollic) for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed run to reproduce the results. See the NeurIPS code and data submission guidelines (https:
httpsssccppbblcccccccccccccccccc gww////i/eee/ee////ee///e//eeee/ htteg/guuieeeeeeeuuuueeeeeeeeeee (oodeSummssses stt.suumisssooooooooooooooooo for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results the new proposed method and baselines. If only subset of experiments reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We offer the detailed description regarding the experimental setups in this work.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: Our proposed method uses different metrics, such as ROCAUC, Fl score, accuracy, and average precision, to report the performance. This helps show the statistical significance of the performance difference between the previous work and ours. Also, consid- ering the large number of experiments, including error bars for all of them is computationally expensive.
Guidelines:
The answer NA means that the paper does not include experiments.
30

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative eπror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We indicate the computation resources and architecture implementations in the supplementary.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https http://www...pppppii/////e/e//e/ hpppblic//ciccaauiieeiiieeee.e
Answer: [Yes]
Justification: We discuss the potential harms and societal impact at the end of our work, following NeurlPS code of ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive socictal impacts and negative socictal impacts of the work performed?
Answer: [Yes]
31

---

Justification: We include societal impact contents at the end of our work, following NeurIPS code of ethics.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has socictal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: The dataset consists of digital images, which do not need safeguards. This is not applicable to our work.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: Both the REDI 16 and RED140 datasets used in this work are publicly available and can be used for research purposes.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
32

---

The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
We will release the dataset and code based on the acceptance. They are well-documented.
Justification:
Guidelines:
The answer NA means that the paper does not release assets.
Researchers should communicate the details the dataset/code/moodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our work does involve crowdsourcing and human subjects' biometric informa- tion.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
supplemental material is fine, but if the main contribu-
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [No]
33

---

Justification: Due to the page limit, we provide societal impact here: We strongly advocate for the machine learning community to actively work towards mitigating the potential negative societal implications of research, It is possible that generated face image may leak the identity information of subjects in the training set of a GM who not sign the consent form. We shall strive to work on real face imagery whose collection is reviewed by an Institutional Review Board (IRB).
Guidelines:
The answer NA means that the paper does not involve crowdsoureing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
34


Reviews:
[{"review_id": "VfsetY44cL", "reviewer": "Reviewer_nGEg", "summary": "This paper solves the model parsing task that requires models to predicting hyperparameters of the generative models (GMs) through one input image. The proposed model LGPN predict hyperparameters and their dependencies via directed graphs. LGPN incorporates a learnable pooling-unpooling mechanism to convert this task as a node classification problem. As stated in paper, LGPN achieves state-of-the-art results in model parsing and some extended applications like coordinate attack detection.", "questions": "1.\tOne concern is about the relation to prior works. The authors can better illustrate the contributions by discussing the relationship and difference between LGPN and the papers [1][2]. The paper [1] uses a meta model to predict model attributes from input data, and the paper [2] regards generative models as distributions of functions and captures model hyperparameters and architectures through the latent vector.\n2.\tHow can we predict the continuous parameters of activation functions like leaky ReLU?\n3.\tQuestion about the problem setting. Will using more input images as context improves the accuracy in results?\n\n[1] Oh S J, Schiele B, Fritz M. Towards reverse-engineering black-box neural networks[J]. Explainable AI: interpreting, explaining and visualizing deep learning, 2019: 121-144.\n\n[2] Dupont, Emilien, Yee Whye Teh, and Arnaud Doucet. \"Generative models as distributions of functions.\" arXiv preprint arXiv:2102.04776 (2021).", "limitations": "The ability of LGPN to infer input images generated with unseen or undefined model architectures is still unclear. For example, would LGPN predicts the leaky ReLU activation in the test environment if it is not appeared in the training data?", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. As stated in the paper, LGPN consider more generative models in the training set, e.g., diffusion models. Therefore, LGPN can be adapted to the test environments where the images can be generated from diffusion model family.\n2. Modeling model parsing as node classification on directed graphs makes sense. The proposed graph pooling network can group similar type of hyperparameters into supernodes, which indicates the model’s understanding on hyperparameter dependences.\n3. LGPN show outstanding performance in experiments and has practical applications like coordinate attack detection.", "weaknesses": "1. The extensibility of LGPN can be limited in some aspects. For example, if a class of generative models that include new activation functions is proposed, LGPN may not be able to be directly applied to the new task environment.\n2. Efficiency of the proposed method is an aspect that needs to be discussed. As the types of hyperparameters increase, the time cost of the algorithm may increase as well.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate the reviewer's praise for our method's effectiveness and reasonable algorithm design. Here, we present answers to all concerns raised. \n\n**Q1: Difference between ours and two previous works:**\n\nWe highlight three key differences between our approach and those in references [R1, R2], demonstrating that our proposed model parsing algorithm is more practical and better suited for general image forensic purposes.\n\nThree differences to [R1]:\n\n- [R1]'s algorithm is only evaluated on the MNIST dataset, while our evaluation dataset contains a wider variety of semantics, including hand-written digitals, faces, and generic objects.\n\n- [R1] only focuses on predicting architecture hyperparameters, yet we are capable of predicting both loss functions and architecture hyperparameters.\n\n- [R1]'s metamodel requires n query images to predict hyperparameters, while our LGPN requires only a single image as the input.\n\nThree differences to [R2]:\n\n- Unlike [R2], which uses estimated hyperparameters for generation purposes, we utilize these estimated hyperparameters for image forensic tasks.\n\n- While [R2] directly applies HyperNet [R4] for the hyperparameter prediction, we develope a more sophisticated LGPN with a high generalization ability. \n\n- [R2] focuses on estimating hyperparameters for a single architecture (the generator mentioned in [R2]), yet our approach is evaluated on 140 different Generative Models (GMs), many of which have distinctive architectures.\n\n**Q2: Multiple images input:** \n\nThis is a valuable suggestion! Table R.5 reports results when the LGPN takes multiple images as inputs. \nSpecifically, we denote input images and corresponding learned representations as {I1, I2 ... Ii} and {V1, V2 ... Vi}, respectively. \nWe concatenate {V1, V2 ... Vi} for the final prediction. \nTable R.5 shows that more input images can possibly slightly improve LGPN's performance: inputting 12 images improves prediction on loss functions and continuous archi. hyperparameters but decreases in predicting discrete archi. hyperparameters. \nThis means naively feeding LGPN with more inputs cannot provide substantial improvements, so a meaningful future research direction can be developing a specific module that effectively processes multiple images, such as meta-models as introduced in [R1] or ensemble learning methods.\nSecondly, when taking different numbers of images as inputs, our LGPN still maintains decent model parsing performance, indicating our approach's robustness.\n\n**Table R.5** Performance of using multiple input images.\n\n|Input Image Num.|Loss Fun.|Dis. Archi. Para.|Con. Archi. Para.|\n|:-:|:----------------:|:------------------:|:-----------------:|\n||F1 / Acc(↑)|F1 / Acc(↑)|L1 error(↓)|\n|1|84.6/83.3|79.5/**77.5**|0.120|\n|4|84.1/83.2|**80.4**/74.3|0.118|\n|8|84.7/83.9|**80.4**/77.3|0.119|\n|12|**84.9**/**84.1**|79.2/77.1|**0.117**|\n\n**Q3: Generalization to the unseen generative model (GM) and undefined hyperparameters:**\n\nWe agree with you on the importance of generalization ability to unseen GMs and hyperparameters! First, LGPN has effective extensibility and is capable of predicting 37 defined hyperparameters of unseen GMs. \n\n- Table 1 of the main paper reports performance on the RED140 dataset, where all models are evaluated on test sets that only have images from GMs unseen during the training. \n\n- Also, we use Table R.6 to report performances on 10 more unseen GMs (e.g., styleGANv3, controlNet1.1, etc.) that are exclusive to the RED140, showing that both FEN-PN and LGPN can deliver reasonable generalization performances. \n\n**Table R.6:** Model parsing performances on 10 more unseen GMs besides RED140. \n\n|Method|Loss Fun.|Dis. Archi. Para.|Con. Archi. Para.|\n|:-:|:----------------:|:------------------:|:-----------------:|\n||F1/Acc(↑)|F1/Acc(↑)|L1 error(↓)|\n|FEN-PN|83.1/80.2|70.8/67.0|0.156|\n|Ours|85.0/84.1|75.0/71.5|0.131|\n\nSecondly, both FEN-PN [R3] and our work do not focus on predicting undefined hyperparameters beyond these 37 predictable hyperparameters. \nThis is because the motivation of model parsing is to offer a new understanding to different GMs, thereby benefiting image forensic applications like coordinated attack detection. This understanding purpose is fulfilled by predicting 37 fundamental, predictable hyperparameters defined in [R3].\n\nOf course, predicting undefined hyperparameters, e.g., LeakyReLU, is an important future direction for the model parsing research topic. For example, based on our LGPN, one can add a few new graph nodes for undefined hyperparameters while keeping the original graph nodes—the learned dependency between graph nodes representing ReLU and LeakyReLU should be high.\n\nLastly, we conduct an experiment (Table R.6.2) by naïve applying the pre-trained FEN-PN and LGPN to (i) classify if the input image is generated by GM with LeakyReLU and (ii) regress the continuous value about the negative slope used in LeakyReLU if available. The poor performance suggests that a trivial extension of existing model parsing methods is insufficient for undefined hyperparameter prediction, and a substantial new research is needed.\n\n**Table R.6.2:** Performances on predicting LeakyReLU.\n\n|Model|ACC(↑)| L1 error(↓)|\n|:------:|:---:|:---:|\n|FEN-PN|0.425|0.733|\n|LGPN|0.480|0.678|\n\n**Q4: Efficiency discussion:** \n\nAlthough the graph size might increase when adapting to new hyperparameters, our innovative graph pooling design actually largely reduces the graph size via the learned graph pooling mechanism, offering a more computationally efficient solution than prior GCN-based methods [10,7,59]. We implement LGPN with different input graph sizes, which are proportional to the number of hyperparameters. Then, we report the inference speed of one forward propagation as follows, indicating that the time cost is not largely affected by the increasing number of hyperparameters involved. \n\n|Graph Size|Speed|\n|----------|----------|\n|18|41.2 ms|\n|55|41.5 ms|\n|250|42.1 ms|\n|600|42.5 ms|", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6ckQ5FCINN", "reviewer": "Reviewer_born", "summary": "This paper focuses on the problem of model parsing, which aims to analyze the hyperparameters of the model that generates a given image. Different from existing model parsing methods, the proposed Learnable Graph Pooling Network (LGPN) exploits the dependencies among hyperparameters to better perform model parsing. In LGPN, the features are extracted by Generation Trace Capturing Network (GTC), which fuses the outputs of the high-res branch and the ResNet branch to preserve high-frequency generation artifacts. The performance of LGPN is compared with baseline methods and a recently proposed model parsing method on the RED140 dataset. The effectiveness of the proposed method is verified by the experimental results.", "questions": "1. Is the ground truth of the hyperparameter hierarchy assignment constructed based on the entire dataset or just the training data?\n2. It has been shown that the hyperparameter hierarchy prediction loss and artifacts isolation loss is important to the performance. Will the performance of the proposed method drop noticeably if: 1) the hyperparameter hierarchy in the test set differ greatly from the training set; 2) some generated images are mistakenly treated as real images in the training set.", "limitations": "The limitations are discussed in the conclusion part. There is no potential negative societal impact.", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The considered problem setting is novel and practical.\n2. The dependences among hyperparameters are exploited to improve the model parsing performance.\n3. The proposed method outperforms the compared methods.", "weaknesses": "1. The effectiveness of GTC can be further verified if different backbones are also compared with GCN refinement as the MP head.\n2. It is unclear whether the ground truth of the hyperparameter hierarchy assignment is constructed based on the entire dataset or just the training data.\n3. The quality of the paper can be improved if the expressions are polished more carefully, especially in the experimental part.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for acknowledging our practical and novel research topic and the effectiveness of the proposed LGPN. In this response, we offer additional experimental results regarding GTC's effectiveness (**Q1**), a discussion of mistaken labeling (**Q2**), and clarification on the hyperparameter hierarchy assignment (**Q3**).\n\n**Q1: Using GCN refinement as model parsing (MP) head:** \n\nThanks! Table.R.7 provides additional experimental results to demonstrate the effectiveness of the proposed GTC.\n\n**Table R.7** Performance of different backbones with the GCN refinement block as MP head.\n\n| Backbone | MP head        | Loss function | Dis. Archi. Para. | Con. Archi. Para. |\n|:--------:|:--------------:|:-------------:|:-----------------:|:-----------------:|\n| | |F1/Acc (↑)          |F1/Acc (↑)          |L1 error (↓)        |  \n| | |--------------------|--------------------|--------------------|\n| ResNet   | GCN ref. | 80.5 / 82.5   | 75.6 / 69.8       | 0.155             |\n| HR-Net   | GCN ref. | 81.8 / 82.1   | 74.8 / 72.9       | 0.147             |\n| ViT      | GCN ref. | 76.9 / 76.7   | 69.7 / 67.0       | 0.170             |\n| GTC      | GCN ref. | **84.6** / **83.3**   | **79.5** / **77.5** | **0.120**|\n\n**Q2: will the performance drop when some generated images are mistakenly treated as real images in the training set:** \n\nThis is an interesting advice! We take this mistaken labeling idea and intentionally treat different percentages of generated images as real ones in the training set. We report the performance in Table R.8.\nSpecifically, the model performance is still acceptable when 1% or 5% percent of samples are mistakenly labeled.\nHowever, as expected, the performance largely decreases when the LGPN experiences 8% mistaken labeling. This is reasonable as the proposed LGPN identifies the generation trace as the foundation for predicting hyperparameters.\nConsequently, this mistaken labeling disturbs the learning of the generation trace, largely reducing the overall prediction performance. \n\n**Table R.8** Performance metrics for different percentages of mistaken labeling.\n\n|Percent| Loss Fun. | Dis. Archi. Para.  |\n|:-:|:------------------:|:------------------:|\n| |F1/Acc(↑)              |F1/Acc(↑)              |\n| |--------------------|--------------------|\n| 0| **84.6** / **83.3** | **79.5** / **77.5** |\n| 1| 83.0 / 80.4       | 77.1 / 73.2        |\n| 5| 80.4 / 79.2       | 74.9 / 70.6        |\n| 8| 74.4 / 61.2       | 68.3 / 45.9        |\n\n**Q3: Clarification on hyperparameter hierarchy assignment:** \n\nSorry for the confusion. The hyperparameter hierarchy assignment (the main paper's Figure 4) is a fixed constraint, which uses general knowledge to encourage the model to pool graph nodes that represent hyperparameters with the same attribute. For example, graph nodes for pixel-wise loss functions (e.g., L1 and L2) are merged, and graph nodes for normalization (e.g., Batchnorm and Layernorm) are merged.\n\nWhen hyperparameter distributions differ largely between training and test samples, our LGPN leverages the GCN refinement block and the powerful GTC as the backbone to achieve a robust and generalizable model parsing ability.\nThis is demonstrated by Table 1 of the main paper, in which we evaluate LGPN on unseen GMs and it shows SoTA model parsing performance. In addition, please refer to **Table R.6** from the response to **Reviewer nGEg**, in which more GMs are used for the evaluation. \n\n**Q4: Experiment section clarification:** \n\nThe supplementary material offers details about the experimental setup and implementations. In the revised version, we will also polish the expression in the experiment section.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ku2dM0yfQi", "reviewer": "Reviewer_6bSd", "summary": "This paper examines the challenge of predicting the hyperparameters of a generative model from its output, specifically a generated image. The proposed approach introduces a learnable graph pooling technique, framing the problem as a node classification task. Experiments across several tasks demonstrate the effectiveness of this method.", "questions": "See weakness.", "limitations": "The authors have adequately addressed the limitations.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- This paper explores the interesting problem of predicting hyperparameters and their dependencies.\n\n- The proposed graph-based method is reasonable and appears to be easy to implement.\n\n- The experimental results in Table 1 clearly demonstrate the effectiveness of the proposed method for model parsing. Additionally, ablation studies or case studies provide further valuable insights.", "weaknesses": "-  It remains unclear how the proposed method aids in the detection of coordinated attacks.\n\n- Additional demonstrations or examples of predicted hyperparameters would provide clarity on the effectiveness of the proposed method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank the reviewer for recognizing our interesting research topic and easy-to-implement algorithm. In this response, we present clarification of the coordinated attack detection (**Q1**) and additional empirical results (**Q2**) that will be added in the revised version. \n\n**Q1: Coordinated attack detection clarification:** \n\nWe follow the procedure defined in the previous work [R3] for the coordinated attacks detection task, which calculates the cosine distance between predicted hyperparameter vectors from two input images (i.e., ${\\mathbf{I}}_1$ and ${\\mathbf{I}}_2$). If this distance is larger than a certain threshold, we decide two images are from different generative models (GMs); otherwise, they are from the same GM. \n\nMore formally, as stated in Sec.3.1 of the main paper, given an image ${\\mathbf{I}}$ as the input, predicted outputs from the LGPN are three vectors, e.g., ${\\mathbf{y}}^d\\in\\mathbb{R}^{18}$, ${\\mathbf{y}}^c\\in\\mathbb{R}^{9}$ and ${\\mathbf{y}}^l\\in\\mathbb{R}^{10}$, which represent the predicted discrete architecture hyperparameters, continuous architecture hyperparameters, and loss function, respectively. Then, the final hyperparameter vector (i.e., descriptor) can be a vector ${\\mathbf{y}}^t\\in\\mathbb{R}^{37}$ via concatenating ${\\mathbf{y}}^d$, ${\\mathbf{y}}^c$, and ${\\mathbf{y}}^l$. \n\nBased on this, given two images (i.e., ${\\mathbf{I}}_1$ and ${\\mathbf{I}}_2$), we use LGPN to retrieve ${\\mathbf{y}}^{t1}\\in\\mathbb{R}^{37}$ and ${\\mathbf{y}}^{t2}\\in\\mathbb{R}^{37}$, respectively. Then, we compute the cosine distance between ${\\mathbf{y}}^{t1}\\in\\mathbb{R}^{37}$ and ${\\mathbf{y}}^{t2}\\in\\mathbb{R}^{37}$. If this distance is larger than a certain threshold, we decide $\\mathbf{I}_1$ and $\\mathbf{I}_2$ are generated from different generative models (GMs); otherwise, they are from the same GM. This procedure is used by both FEN-PN [R3] and LGPN, and the revised version will include more details. \n\n**Q2: Additional model parsing evidence:** \n\nWe agree that more experimental evidence would solidify our contributions. Due to the paper length, we keep a large number of experimental results in the supplementary. Please refer to our supplementary, which already offers additional quantitative results and visualizations as follows:  \n\n- Supplementary Figure 7: Prediction performance for each hyperparameter.\n- Supplementary Figure 12: Visualizations of learned correlation matrix similarity.\n- Supplementary Table 9: The detailed performance of RED116.\n- Supplementary Figure 10: Visualization of model parsing performance on different semantics.\n- Supplementary Figure 12: Model parsing performance for different generative models. \n- Supplementary Section D: details of the RED140 dataset.\n- Supplementary Section E: details of the annotated ground truth. \n\nMoreover, we will add our rebuttal responses in the revised version, which includes:\n\n- The performance on RED116 using different metrics. (Table R.1, R.2, R.3)\n- The detailed performance of face and non-face images. (Table R.4)\n- The performance when the model takes a different number of images as the input. (Table R.5)\n- The performance using GCN refinement with different backbones. (Table R.7)\n- The performance with mistaken labeling. (Table R.8)\n- The updated image attribution performance. (Table R.9)\n- The sensitivity of using different thresholds for the correlation graph. (Table R.10)", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "3InnryHUpj", "reviewer": "Reviewer_Q98w", "summary": "This paper studies the model parsing (MP) task [1], which predicts the hyperparameters of the generative model with a generated image input. The authors propose a Learnable Graph Pooling Network (LGPN) method to explore hyperparameter dependencies in the generative model. The LGPN consists of two core designs: the Generation Trace Capturing Network (GTC) and the learnable pooling-unpooling graph mechanism called the GCN Refinement Block. Extensive experiments validate the effectiveness of the method.", "questions": "Please see the comments in Weakness. I'm willing to change my rating if the authors address my concerns.", "limitations": "The authors introduce the performance improvement, but the discussions on hyperparameter dependency analyses (what and how dependents?) and the compatibility on different GM models are insufficient.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. A new idea of graph pooling mechanisms to model hyperparameter dependency in the MP task.\n2. A new dataset, RED140, extended from RED116 [1].\n3. Outstanding performances on both the RED116 and RED140 datasets.", "weaknesses": "Despite the strengths mentioned above, there are some concerns listed as follows:\n1. The authors provide a new dataset, RED140, which removes and collects some samples. Please clarify the distinction between these two datasets. Is the ground-truth feature vector for Discrete Architecture hyperparameters newly added to supervise the model training? \n2. The work mainly compares with FEN-PN. [1]. The experimental results on the RED116 dataset in Fig. 5(c) just report the F1 score and L1 error performance. [1] provides more evaluation metrics (P-value, Corr. Coef, Slope, Acc., etc.) and tests more dataset types and GM models, such as continuous type, discrete type, and loss type datasets, as well as face and non-face GMs. These analyses provide more evidence to show the method's generalizability and robustness. By comparison, the proposed method needs more experimental evidence.\n3. From Fig. 6 (b), the performance of the proposed method has a slight drop compared with FEN-PN [1]. What happens?\n4. In lines 30-32, there is a motivation statement for hyperparameter dependency modeling: ”For instance, an inherent dependency exists between GM’s layer number and parameter number.” The authors do not provide such analysis and discussion in the experiments. The discussion on hyperparameter dependency analyses (what and how dependents?) is insufficient. \n5. About the correlation graph construction (lines 125–126), “we count the occurrence of such pairs in the RED140 to retrieve the matrix G\\in R^{C \\times C}, where C is the hyperparameter number.” The method approach appears to overuse the dataset information in advance and is unfair when compared to FEN-PN [1].\n6. There are some parameters, such as the thresholds to remove relations in the graph or binary classification; how about the sensitivities of these parameters?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for constructive feedbacks. Reviews are positive about our empirical performance and the learnable pooling algorithm, and we address all concerns raised as follows:\n\n**Brief Recap:**\n\nWe adhere to the problem statement of model parsing [R3], in which the algorithm takes one image as the input and predicts 37 hyperparameters used in the generative model (GM) that generates the input image. \nThese 37 predictable hyperparameters are clearly defined in [R3] and detailed in our supplementary, including discrete architecture hyperparameters, continuous architecture hyperparameters, and loss functions. \n\n**Q1: The difference between RED116 dataset and RED140 dataset & Ground truth vector:**\n\nRED116 is a subset of RED140, with RED140 serving as a more advanced model parsing dataset. The key distinctions between RED116 and RED140 are as follows:\n\n1. RED116 does not have diffusion model images, whereas RED140 includes images from 24 distinct diffusion models (details in supplementary Sec.D and E). Consequently, RED140 provides a richer variety of samples, enhancing the dataset's utility in developing algorithms capable of identifying hyperparameter patterns in images generated by diffusion models.\n\n2. RED140 has real images covering different semantics (supplementary Sec.D details). These real images are crucial for training models to only predict hyperparameters for generated images, rather than real ones. Without these real images, models might erroneously assign hyperparameters to real images when used as inputs\n\nMoreover, each GM has an annotated ground truth vector for discrete architecture hyperparameters.  As defined in [R3], these vectors can supervise the training. FEN-PN and our LGPN use the same train and test protocol.\n\n**Q2: The comparison on RED116 & comparison on face and non-face GM:**\n\nThank you very much for the suggestion. \nPlease refer to the general rebuttal response, in which we use Table R.1, R.2, R.3, and R.4 to report various performances on RED116. \nAlso, the main paper's Table 1 shows the performance of RED140. \nThese five tables show that LGPN surpasses [R3] on all metrics (i.e., discrete architecture hyperparameters, continuous architecture hyperparameters, and loss functions) on both RED116 and RED140 datasets. \nSuch performance superiority indicates our proposed method's better generalization ability and robustness.\n\n**Q3: Image attribution performance:**\n\nThe main paper's Fig.6 (b) shows a relatively easy protocol in which different models have similar saturated performances. Therefore, we extend this image attribution experiment into Table R.9 with a more challenging protocol, showcasing our method's performance superiority to FEN-PN[R3]:\n\n- **Protocol 1**: as Fig.6 (b) reports (detailed in Supplementary Fig.8), the image attribution is a 5-way classification task --- classifying if the image is real or generated by which one from 4 GMs (e.g., SNGAN, MMDGAN, CRAMERGAN, and ProGAN).\n\n- **Protocol 2**: On top of protocol 1, we add 2 more generative methods, resulting in a more challenging task: a 7-way classification task, classifying whether the image is real samples or generated by which one from 6 GMs (e.g., styleGANv2, styleGANv3, SNGAN, MMDGAN, CRAMERGAN, and ProGAN).\n\n**Table R.9** Image attribution performance. \n\n|Method|protocol 1|protocol 2|\n|:----:|:--------:|:--------:|\n||CelebA/LSUN|CelebA/LSUN|\n|PRNU|86.61/67.84|74.23/67.92|\n|Attr.|99.43/98.58|84.16/81.63|\n|FEN-PN|99.66/**99.84**|81.09/78.28|\n|Ours|**99.79**/99.73|**88.11**/**86.23**|\n\n**Q4: Hyperparameter dependencies:**\n\nSorry for the inconvenience. One common dependency is that GMs with more layers usually have more parameters (lines 30-32). This is illustrated by lines 270-274 and Tab. 2(b):\n\n- Lines 270-274 detail that, with capturing the dependency between _Param. Num._ and _Layer Num._,  the GTC with GCN refinement block achieves a better performance than GTC with MLP layers, on predicting these two continuous hyperparameters.\n  \n- Tab. 2(b) shows that the GCN refinement block helps GTC achieve better prediction performance than GTC with MLP layers on all continuous architecture hyperparameters. Such performance improvements are attributed to the proposed GCN refinement block, which effectively captures dependencies among continuous hyperparameters, such as FC layer numbers, model parameter numbers, pooling layer numbers, etc.\n\n**Q5: Graph construction:**\n\nSorry for the confusion. We only use training samples from RED140 dataset to construct such a graph and strictly forbid data leakage. The procedure of using training samples for graph construction is commonly adopted in prior works [10, 7, 59, 39, 15, 50]. \nIn the revised version, we will add the statement --- \"use training samples from the RED140 dataset.\" \n\n**Q6: Sensitivity analysis:**\n\nThanks for this valid concern. \nWe follow your suggestions and show the model parsing performance with different thresholds in Table R.10. \nOverall, the best performance is achieved when the threshold is 0.45, as we employ in LGPN. \nAlso, this best performer is comparable to models that use 0.35 and 0.55 as threshold values, showing LGPN's robustness to different thresholds. \nHowever, the performance decreases more when the threshold increases to 0.65, which causes the correlation graph to have very sparse connectivities, hindering the learning of hyperparameter dependencies. \n\nThe second robustness analysis is Table 7 in the supplementary, which shows that our model parsing performance is generally robust to using different numbers of graph nodes to represent each continuous hyperparameter. \n\n**Table R.10** The model performance on different graph thresholds. \n\n||Loss Func.|Dis. Archi. Para.|Con. Archi. Para.|\n|:---:|:----------:|:----------:|:-----:|\n|Threshold|F1/Acc|F1/Acc|L1 error|\n|0.35|84.0/83.0|79.2/77.0|0.122|\n|0.45|**84.6**/**83.3**|**79.5**/**77.5**|**0.120**|\n|0.55|84.5/82.8|78.9/77.0|0.124|\n|0.65|82.7/82.5|77.0/74.5|0.139|", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We want to thank all four reviewers for their valuable comments. We are delighted to see (a) **all reviewers** recognize our proposed LGPN's effectiveness and high generalization ability, (b) our research topic of model parsing is interesting and novel (**Reviewer born** and **Q98w**), (c) praises for our well-motivated and reasonable solution (**Reviewer nGEg** and **6bSd**), (d) the insightful ablation study has been appreciated by (**Reviewer 6bSd**), and (e) the useful proposed dataset for future work (**Reviewer Q98w**). 

Moreover, we receive three positive feedbacks, and **Reviewer Q98w** kindly indicates the negative feedback can be changed after concerns are adequately addressed. Therefore, in this rebuttal, we provide precise answers to all questions, which mainly include (a) the difference between our work and two previous works (**Reviewer nGEg**), (b) additional experimental results on RED116 dataset (**Reviewer Q98w**), (c) additional generalization and robustness analysis (**Reviwer nGEg, born, and Q98w**), and (d) more elaborations on our experimental setup (**Reviewer 6bSd and Q98w**).

## 1. Recap:

Before we start our rebuttal, we would like to do a brief recap of our work. We study the research topic, model parsing [R3], in which the algorithm takes one generated image as the input and predicts 37 hyperparameters used in the generative model (GM) that generates the input image. 
These 37 hyperparameters are defined in [R3], including discrete architecture hyperparameter, continuous architecture hyperparameter, and loss functions. 
Motivated by the previous work's limitation in learning hyperparameter dependencies, we proposed a learnable graph pooling network (LGPN) that uses the GCN refinement block with a learnable pooling-unpooling mechanism to model hyperparameter dependencies, and a Generation Trace Capturing Network (GTC) effectively learns the generation trace from given generated images. 
Our work achieves the SoTA performance on model parsing and has practical applications like coordinate attack detection.

## 2. Additional model parsing performance on RED116 dataset:

As suggested by **Reviewer Q98w**, we use Table R.1, R.2, and R.3 to show detailed performance comparisons to FEN-PN on the RED116 dataset for predicting continuous architecture hyperparameters, discrete architecture hyperparameters, and loss functions, respectively.
Also, Table R.4 illustrates the performance of face and non-face GMs. 

These four tables, along with the main paper's Table 1, show that our LGPN surpasses FEN-PN [R3] on all metrics on both RED116 and RED140 datasets, indicating LGPN's better generalization ability and robustness in the model parsing task.

**Table R.1** Prediction performance on continuous architecture hyperparameters of RED116.

|Method\Metrics|L1 error(↓)|P-value(↓)|Corr. coef(↑)| Coef. of det.(↑)|Slope(↑)|
|:--------------------:|:---------:|:--------:|:-----------:|:---------------:|:-------:|
|**FEN-PN**|0.149±0.019|0.022±0.007|0.744±0.098 |0.612±0.161|0.921±0.021|
|**Ours**|**0.130**±**0.011**|N/A|**0.833**±**0.098**|**0.732**±**0.177**|**0.983**±**0.012**|


**Table R.2** Prediction performance on discrete architecture hyperparameters of RED116.

|Method\Metrics|F1(↑)|Acc(↑)|
|:--------:|:----:|:----:|
|**FEN-PN**|0.718±0.036|0.706±0.040|
|**Ours**|**0.743**±**0.033**|**0.755**±**0.030**|

**Table R.3** Prediction performance on loss functions of RED116.

|Method\Loss function|F1(↑)|Acc(↑)|
|:--------:|:----:|:----:|
|**FEN-PN**|0.813±0.019|0792±0.021|
|**Ours**|**0.841**±**0.011**|**0.833**±**0.017**|

**Table R.4** Performance of face GMs and non-face GMs of RED116.

|Method|Test GM|Train GM|Con. Archi. Para.|Dis. Archi. Para.|Loss function|
|:------:|---------|---------|:-----------------------------:|:-----------------------:|:-------------------:|
||||L1 error(↓)|F1(↑)|F1(↑)|
|FEN-PN|Face|Face|0.139±0.042|0.729±0.106|0.788±0.146|
|Ours|Face|Face|**0.112**±**0.028**|**0.786**±**0.116**|**0.801**±**0.134**|
|------|------|-------|--------------------|-------------------|-------------|
|FEN-PN|Face|Non-Face|0.213±0.066|0.688±0.125|0.759±0.1|
|Ours|Face|Non-Face|**0.139**±**0.063**|**0.694**±**0.117**|**0.771**±**0.2**|
|------|------|-------|--------------------|-------------------|-------------|
|FEN-PN|Face|Full|0.118±0.046|0.712±0.129|0.833±0.136|
|Ours|Face|Full|**0.099**±**0.044**|**0.745**±**0.099**|**0.840**±**0.123**|
|------|------|-------|--------------------|-------------------|-------------|
|FEN-PN|Non-Face|Face|0.118±0.021|0.794±0.110|0.864±0.094|
|Ours|Non-Face|Face|**0.116**±**0.016**|**0.810**±**0.102**|**0.870**±**0.092**|
|------|------|-------|--------------------|-------------------|-------------|
|FEN-PN|Non-Face|Non-Face|0.125±0.031|0.667±0.099|0.858±0.115|
|Ours|Non-Face|Non-Face|**0.100**±**0.027**|**0.692**±**0.101**|**0.882**±**0.112**|
|------|------|-------|--------------------|-------------------|-------------|
|FEN-PN|Non-Face|Full|0.082±0.045|0.832±0.046|0.886±0.061|
|Ours|Non-Face|Full|**0.080**±**0.042**|**0.844**±**0.032**|**0.901**±**0.021**|

## 3. Contents will be included in the revised version:

The revised version draft will include contents of the rebuttal to better reflect constructive suggestions received. Please refer to  **Q2** from the response to the **reviewer 6bSd**.

## 4. References:

**[R1]** S. J. Oh, B. Schiele, and M. Fritz, "Towards reverse-engineering black-box neural networks," in Explainable AI: Interpreting, Explaining and Visualizing Deep Learning, 2019.

**[R2]** E. Dupont, Y. W. Teh, and A. Doucet, "Generative models as distributions of functions," arXiv preprint arXiv:2102.04776, 2021.

**[R3]** V. Asnani, X. Yin, T. Hassner, and X. Liu, "Reverse Engineering of Generative Models: Inferring Model Hyperparameters from Generated Images," PAMI, 2023.

**[R4]** D. Ha, A. Dai, and Q. V. Le, "HyperNetworks," ICLR, 2017.

Meta-review: This paper considers the model parsing task that predicts hyperparameters of the generative models through an input image. Compared to the existing work, this paper considers more generative models in the training set (e.g., diffusion models) and their dependencies via directed graphs. The reviewers recognize the strengths in the following aspects: 1) the considered problem is interesting and novel (Reviewers born, 6bSd, Q98w); 2) the approach is reasonable and practical (Reviewers nGEg, born, 6bSd); and 3) the proposed method is effective in terms of comparison performance (Reviewers nGEg, born, 6bSd, Q98w).

The authors have also addressed a number of concerns raised by the reviewers in the rebuttal and during the discussion period, such as the relationship and difference between the proposed method and the related works, the time cost as the types of hyperparameters increase, how the proposed method aids in the detection of coordinated attacks, the distinction between the two datasets, the sensitivities of hyperparameters, etc. These clarifications and supplementary experimental results should be reflected in the revised version.

All reviewers lean to accept this paper. However, some concerns not fully addressed (e.g., LGPN may not be able to be directly applied to the new task environment raised by Reviewer nGEg) can be further explored to improve the generalization ability.
Decision: Accept (poster)