Where Did I Come From? Origin Attribution of AI-Generated Images
Authors: Zhenting Wang
Chen Chen
Yi Zeng
Lingjuan Lyu
Shiqing Ma
Venue: NeurIPS 2023 poster (2023)
Keywords: Origin attribution of generated images

Abstract: Image generation techniques have been gaining increasing attention recently, but concerns have been raised about the potential misuse and intellectual property (IP) infringement associated with image generation models. It is, therefore, necessary to analyze the origin of images by inferring if a specific image was generated by a particular model, i.e., origin attribution. Existing methods only focus on specific types of generative models and require additional procedures during the training phase or generation phase. This makes them unsuitable for pre-trained models that lack these specific operations and may impair generation quality. To address this problem, we first develop an alteration-free and model-agnostic origin attribution method via reverse-engineering on image generation models, i.e., inverting the input of a particular model for a specific image. Given a particular model, we first analyze the differences in the hardness of reverse-engineering tasks for generated samples of the given model and other images. Based on our analysis, we then propose a method that utilizes the reconstruction loss of reverse-engineering to infer the origin. Our proposed method effectively distinguishes between generated images of a specific generative model and other images, i.e., images generated by other models and real images.

Where Did I Come From? Origin Attribution of AI-Generated Images
Zhenting Wang" Rutgers University zhenting. wangorutgers.ed.
Chen Chen Sony AI
Yi Zeng
Virginia Tech
ChenA. Chen@sony com com
yizengevt. edu
Lingjuan Lyu' Sony AI
Shiqing Ma
University of Massachusetts Amherst shiqingma@umass. edu
Lingjuan Bregjjunn.L@aooy.ccoom com
Abstract
Image generation techniques have been gaining increasing attention recently, but concerns have been raised about the potential misuse and intellectual property (IP) infringement associated with image generation models. is, therefore, necessary to analyze the origin of images by inferring if a specific image was generated by a particular model. i.c., origin attribution. Existing methods only focus on specific types of generative models and require additional procedures during the training phase or generation phase. This makes them unsuitable for pre-trained models that lack these specific operations and may impair generation quality. To address this problem, we first develop an alteration-fre and aageo--agossic origin attribution method via reverse-enginent -eeeineinngn input of particular model for specific image. Given a particular model, we first analyze the differences in the hardness of reverse-engineering tasks for generated samples of given model and other images. Based on our analysis, we then propose method that utilizes the reconstruction loss of reverse-engineering infer the origin. Our proposed method effectively distinguishes between generated images of specific generative model and other images, i.e., images generated by other models and real images.
image generation models, i.e., inverting the
Introduction
In recent years, there has been a rapid evolution in image generation techniques. With the advances in visual generative models, images can now be easily created with high quality and diversity [1- 4]. There are three important milestones in the field image generation and manipulation, i.c., Generative Adversarial Networks (GAN) [5], Variational AutoEncoders (VAE) [6], and diffusion models [7]. Various image generation models are built based on these three models [8-13] to make the Al-generated images more realistic.
With its wide adoption, the security and privacy image generation models becomes critical [14-19]. One severe and important issue is the potential misuse and intellectual property (IP) infringement of image generation models [16, 18). Users may generate malicious images containing inappropriate or biased content using these models and distribute them online. Furthermore, trained models may be used without authorization, violating the model owner's intellectual property. For example, malicious users may steal the model's parameters file and use it for commercial purposes. Others may create Al Al-generated images and falsely claim them as their own artwork (c.g., photos and paintings) to
WWrk partially done during Zhenting Wang's internship Sony AL i Corresponding Author
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

gain recognition, which also violates the model's IP. Therefore, it is essential to track the origin of Al-generated images. The origin attribution problem is to identify whether a specific image is generated by a particular model. As shown in Fig. 1, assuming we have model Mi and its generated images, the origin attribution algorithm's objective is to flag an image as belonging to model M if it was generated by that model. On the other hand, the algorithm should consider the image as non-belonging if it was created by other models MM in Fig. 1) or it is real image.
One existing way to infer the source of specific images is image watermarking. It works by embedding ownership infor- mation in carrier images to verify the owner's s identity and authenticity [20- 23). The image watermarking- based method requires an additional modifi- cation to the generation results in a post- hoc manner, which may impair the gen- eration quality. Also, it might not nec- essarily reflect the use of particular model in the process of generating an
14 16
Belenging
Generated Emages of Modell Aff
Mj
Origin Attribatton
166
Now-Belenging
Emuages MMdel
ModelMM
Son-Belunging
Real Images
image, which can reduce its credibility as evidence in lawsuits. Furthermore, the watermark can also be stolen, and malicious users can engage in criminal activities and disguise their identities ing the stolen watermark. Another approach to identifying the source models of the generated samples [24-27] is injecting fingerprinting into the models (e.g., modifying the model architecture) and training a supervised classifier to detect the fingerprints presented in the image. While their goal is similar to ours, these methods have several limitations. Firstly, they require extra operations during the model training phase, and they cannot be applied on pre- pre-trained models without additional operations, such as modifying the model architecture [26. 27]. Secondly, since these methods modify the training or inference process of generative models, the model's 's generation performance may be affected. Thirdly, these previous studies mainly focus on a particular kind of generative model, i.c..
Fig. I: Illustration for origin attribution problem. The origin attribution algorithm aims to judging whether the given images belong to particular model, i.e., Model M1-
GAN [5]. In contrast, our goal is to develop an origin attribution approach for different types of generative models, including diffusion models [4, 3] agnossiagnostic). without requiring any extra operations in the training phase and image generation phase calteration-free) We summarize the differences between our method and existing methods in Table 1.
In this paper, we propose a method for origin attribution that is based on the in- put reverse-engincering task on generative models (i.e., inverting the input of par- ticular generative model for specific im- age). The intuition behind our method is that the reverse-enge engineernngnniingggg. task is easier for belonging images than belonningg images. Therefore, we design our method based on the differences the reconstruction loss for the reverse-engineering between generated images of given model and other images. The origin attribution method we propose starts by using the model to generate a set of images and calculate the reconstruction loss on these generated images. To climinate the influence of the inherent complexities of the examined images, we also calibrate the reconstruction loss by considering the hardness of the reverse-enge seeerse-eniineering on any other model that has strong generation ability, but different architectures and training data. Afterwards, the algorithm computes the calibrated reconstruction loss for the examined image and uses statistical hypothesis testing determine if the reconstruction loss falls within the distribution of reconstruction losses observed in the generated images. This allows us to distinguish images generated by the given model from other images in -agessaggostic and alteration free manner. Based on our design, we imple- mented a prototype called RONAN AN (Reverse-engineering -basd OrigiN AttributioN) in PyTorch and evaluated it on three different types of generative models (i.e., unconditional model, class-to-image model, and text-to- to-image model) including various GANs [1. 10, 18-30J, VAEs [6]. and diffusion models such as latest Consistency Model [4] and Stable Diffusion [3]. Results demonstrate our
Table 1:
Summary of the differences between our method and existing methods.
Training phase Generation phase Alteration-fee free Alteration-free
Method
Model-agnostic
Image Watermark [20-23]
Classifier-based [24-27]
x
Ours

---

method is effective for the "alteration free and model-agnostic origin attribution" task. On average, RONAN achieves 96.07% of true positive rate with a false positive rate around 5.00%.
Our contributions are summered as follows: @ We introduce a new task called "alteration-free and model-agnostic origin attribution", which entails determining whether a specific image is generated by a particular model without requiring any additional operations during the training and generation phases. @ To accomplish this task, we analyze the differences in the reconstruction loss for reverse- engineering between the generated images of a given model and other images. Based on our analysis, we design a novel method that involves conducting input reverse- eeerse-nngineering and checking whether the reconstruction loss of the examined sample falls within the distribution of reconstruction losses observed in the generated images. @ We evaluate our method on various different image generation models. The results show that our method effectively distinguishes images generated by the given model from other images in a model-agnostic and alteration manner. Our code can be found in https:/ /gi thub. com /wweetinnnnnnnngg/nn.. /RDNAN..
2 Related Work
Detection of AT-Generated Contents. Detecting Al-generated content has become extremely important with the growing concerns about the misuse of AIGC technology [31]. The detection of Al-generated content is a binary classification problem that involves distinguishing generated samples from real ones. In the CV field, existing research has found that visually imperceptible but machine-distinguisabbb patterns in generated images, such as noise patterns [16, 32), frequency signals [33-36] and texture representation [37] can be used as the clues of AI Al-generated images. Researchers also proposed methods to detect sentences generated by generative NLP models such as ChatGPT [38-41]. Although these methods achieve promising performance for distinguishing Al-generated content and real content, they cannot infer if specific content is generated by a given generative model, which is novel but more challenging task and the main focus of this paper.
Tracking Origin of Generated Images. There are several ways to track the source of the generated images. Image watermarking that pastes ownership information in carrier images [20-23] can be adapted to discern whether a specific sample is from a specific source. Watermarks can take the form of specific signals within the images, such frequency domain signals [22] or display-camera transformations [42]. However, it requires an additional modification to the generation results in a post-hoe manner, and it does not necessarily reflect whether the image was generated by a particular model when the judges use it as the evidence (different models can use the same watermark). Another way is to inject fingerprints into the model during training and train a supervised classifier on it to discern whether an image is from fingerprinted GAN model [24-27]. For example, Yu et al. [27] modify the architecture of the convolutional filter to embed the fingerprint, and they train the generator alongside a fingerprinting classifier capable of identifying the fingerprint and its corresponding source GAN models. requires a modified model architecture, altered training process, and an additional procedure to train source classifier. There are several existing methods [43-45] track the origin of the generated images by exploiting the input reconstruction. However, the practicality of these approaches is limited due to their reliance strong assumptions (see 5.5 for more details).
3 Problem Formulation
We focus on serving as an inspector to infer if specific sample is generated by a particular model in an alteration-free and model-agnostic manner. To the best of our knowledge, this paper is the first work focusing on this problem. To facilitate our discussion, we first define the belonging and non-belonging of the generative models.
Definition 3.1 (Belonging of Generative Models). Given a generative model M : + XM where I is the input space and X'M is the output space. A sample æ is belonging of model M if and only if x E XMM. We call a sample
a non-belonging if x & XMM-
Inspector's Goal. Given a sample x and a generative model M + XM where I is the input space and X'M is the output space of M. the inspector's 's goal is to infer if given image is a belonging of M. Formally, the goal can be written as constructing an inference algorithm B (M, x) - (0. 1} that receives a sample x and a model M as the input, and returns the inference result (i.e., 0 denotes belongings, and 1 denotes non-belongings). The algorithm B can distinguish not only the belongings of the given model M and that of the other models (e.g., trained on different training data, or have different model architectures), but also the belongings of A and the natural samples that are not generated by AI. The inspector also aims to achieve the following goals:
3

---

ffeeeation-ree: The algorithm B does not require any extra operations/mmodiiications in the training phase and image generation phase.
Model-agnosstic: The algorithm B can be applied to different types of image generative models with different architectures.
Inspector's Capability. The inspector has white-box access to the provided model M. thus the inspector can get the intermediate output and calculate the gradient of the models. In addition, the inspector cannot control the development and training process of the provided models. Note that the white-box access to the inspected model is practical especially in the scenarios where the inspector is the owner of the inspected models.
Real-world Application. The inspection algorithm can be widely used in various scenarios where it necessary to verify the authenticity of generated images. We provide three examples as follows:
Copyright protection of image generation models: A copyright a kind of intellectual property (IP) that provides its owner the exclusive right perform a creative work [46]. In this scenario, a party suspects that a specific image may have been generated by their generative model without authorization, such if a malicious user has stolen the model and used to generate images. The party can then request an inspector to use our proposed method to infer if the doubtful image was indeed generated by their particular model, and the resulting inference can be used as a reference in lawsuit. It is important to clarify that infering an image as belonging of a model does not imply the IP of this image is totally belonging to this model. In fact, determining the ownership of the IP related to the generated images remains an unresolved challenge in the field of law. This complexity arises due to the involvement of multiple entities (such as contributors of training data, model trainers, input/prompt providers, and the models themselves) throughout the image generation process. The infering results of our origin attribution method can serve as a valuable reference for addressing IP protection concerns, instead of definitive conclusion.
Tracing the source of maliciously generated images: Assume a user creates malicious images containing inappropriate or biased content and distributes them on the internet. The cyber police can utilize our proposed method to infer if the image was generated by model belonging to a specific user. The resulting inference can be used as a reference for criminal evidence in lawsuits.
Detecting Al-powered plagiarism: Our method can also be used for detecting Al-powered plagiarism. For example, imagine a scenario where an individual generates Al-created images (e.g., using Midjourney) and dishonestly presents them as their own original artwork (e.g., photographs and paintings) to gain recognition and reputation. In such cases, the model owner (e.g.. Midjourney's s owner) may suspect that the image is generated using their model (e.g., Midjourney). Our proposed method can then be employed to uncover such instances of Al-powered plagiarism.
4 Method
Our method built on the input renerss-engineeriigg for image generation models. In this section, we start by formulating the input reverse-engineering task, followed by an analysis of the disparities in reconstruction loss between images generated by a particular model and those from other sources. We then proceed to present a detailed algorithm for our method.
4.1
Reverse-engineering
Recent researches [47, 17] demonstrate that the input of the modern image generative models reconstructable by using the generated images. Here, we view the reverse-engineering as an optimization problem. Formally, it can be defined as follows:
Definition 4.1 (Input Reverse-engineerrigg.. Given a generative model M I XM, and an image ar an input reverse-engineering task is optimizing the input to make the corresponding output image from the model (() as close as possible to the given image x.
The input reverse- enggeneinngnn task is performed by reverse-engineering algorithm A: (M, + R, which can be written as:
arg min L (M()), x), a(M,)) = ((M
where L is metric to measure the distance between different images, and i' is the reverse-engineered input. The given value for the reverse-engineering algorithm a specific image æ and a particular model M. The returned value of the algorithm A is the distance between the given image and its

---

0.40
Generated Samples
0.40
Generated Samples Training Samples
0.40
Generated Samples
Training Samples
Training Samples
Percentage
0.30
Percentage
0.30
Percentage
0.30
0.20
0.20
0.20
0.10
0.10
0.10
0.00
0.0000
0.0100 0.0200 0.0300
0.08.
0,0000
0.0050 0.0100 0.0150
0.
0.0000
0,0300 Recanstructed MSE Loss
0.0100
0.0200
Reconstructed MSE Loss
Reconstructed MSE Loss
(a) DCGAN [1]
(b) VAE [6]
(c) StyleGANZ [10]
Fig. 2: Reconstruction loss distributions for belonging images and real images.
reverse-engineered version, i.e., L. (M .²), which is called as the reconstruction loss. We use the reconstruction loss to measure the hardness of the input reverse-engineering task.
Based on the definitions and formulations, we have the following theorem:
Theorem 4.2. Given generative model M : I XM, and a reverse-engineering algorithm A. if the model is deterministic (i.e., produces the same output given the same input) and the envers--nngineriinn
algorithm is perfect (i.e., it can find the global minimum of the reconstruction loss for the reverse- evvers-enginneernng). then for any XM (belonging) and x' & X.M (non-belonging) we have A(M, x²)= > a).
The proof for Theorem 4.2 can be found in the Appendix A. The theorem demonstrates that the reconstruction loss of the images generated by a specific model will be lower than that of images that not generated by the model. The theorem also establishes that the distribution of reconstruction loss values for belonging and non-belonging images is perfectly separable. Thus, we can use a threshold value to separate the belonging images and non-belonging images. In the real world, many image generation models incorporate random noises into their image generation procedures to enhance the variety of images they produce. However, these models can also be deemed deterministic since we can regard all the random noises utilized in the generation procedure as parts of the inputs. On the other hand. in reality, the weggieeenginc algorithm may get stuck at local minimum, and it is hard to guarantee the achievement of the global minimum. This is where the formula P(A(M,x)) x') A(), 2 X becomes relevant as it serves as a relaxation for Theorem 4.2, explaining the practical scenario. In this formula, À (e.g., 90%) acts as a separability level for distinguishing between the two distributions: belonging images and non-belonging images.
To investigate the practical scenario, we conduct experiments on the CIFAR-10 [48] dataset using DCGAN [1], VAE [6], and StyleGAN2-ADA [10] models. The results are depicted in Fig. where the x-axis represents the reconstruction loss measured by the MSE (Mean Squared Error) [49] metric, and the y-axis indicates the percentage of images whose reconstruction loss value corresponds the corresponding value on the x-axis. We use blue color to denote 100 generated images of the given model and orange to represent 100 real images randomly sampled from the training data of the model. The results indicate that the reconstruction losses of the generated images (belongings) and those not generated by this model monn-leongg)gg) can be distinguished.
4.2 Calibration
Different images have different inherent complexities [50-52]. Some images may be harder to reverse-engineer due to their higher complexity (e-g.. containing more objects, colors, and details). In that case, the reconstruction loss will also be inffuenced by the inherent complexities of the examined images. To increase the separability level of belonging images and others, we disentangle the influence of the inherent complexities and the belonging status by measuring the complexity of the image and use it to calibrate the reconstruction loss. By default, we use the reconstruction loss on reference image generation model M, that is trained on different dataset the measurement of the complexity, i.e., Complexity = A(M,,, æ) (we use the Consistency model [4] pre-trained on ImageNet dataset [53] as the reference model by default). We also diseuss other implements to measure the complexity of the inspected images in Appendix F. The calibrated reconstruction loss A(M, x) is defined as follows:
A'M x) = A(M,
(2)
Complexity(
5

---

Algorithm Origin Attribution
Input: Model: M, Examined Data:
Output: Inference Results: Belonging or Non-belonging
1: function INFERENCE æt)
2: Obtaining Belonging Distribution (Offline)
3: H. a, N = BelougingDDistriutttonn/M
4: Reverse-engineering
5:
A'MM, æ)) t- Calibrated Reconstruction Loss [Eq. 2]
6: Determining Belonging
7:
InferenceResulls = HyyoohhsiisTestinn(4A4
8:
return Inselss
4.3 Belonging Inference via Hypothesis Testing
We use Grubbs' Hypothesis Testing [54] infer if specific sample æ is belonging of the particular given model M. We have null hypothesis Ho æ is a non-belonging of M, and the alternative hypothesis Hz æ is a belonging of M. The null hypothesis Hy is rejected (i.e., the alternative hypothesis H1 is accepted) if the following inequality (Eq. 3) holds:
A'( - (N- VN /
(2./N.N22)
N (la/NNN22)
Here. ls and a the mean value and standard deviation for the calibrated reconstruction loss on belonging samples of model M. Since model M is given to the inspector, the inspector can calculate y and by using M to generate multiple images with randomly sampled inputs. N is the number of generated belonging images. A'M,, x)) is the calibrated reconstruction loss of the examined image æ. fa/N,N- is the critical value of the distribution with N degrees of freedom and significance level of a a/N, where is the significance level of the hypothesis testing (i.e., 0.05 by default in this paper). The critical value of the / distribution (i.e., la/N.N -2) can be computed using the cumulative distribution function (See Appendix B for more details).
4.4 Algorithm
We propose Algorithm 1 to determine if specific sample belongs to given model. The input of Algorithm the examined data æ and the given model M. The output of this algorithm is the inference results, i.e., belonging or non non-belonging. In line 3, we use the given model to generate N (i.e., 100 by default in this paper) images with randomly sampled inputs and calculate the mean value (f() and standard deviation (σ) for the calibrated reconstruction loss on the generated belonging samples. This step can be done offline, i.e., only needs to be performed once for each model. line 5, we calculate the calibrated reconstruction loss of the examined image (Eq. 2), the reconstruction loss computed via gradient descent optimizer (Adam [55] by default this paper). In line determine if the examined image belongs to the model M not by conducting the Grubbs' Hypothesis Testing [54] ($ 4.3). The given image is flagged as a belonging of the given model if the corresponding hypothesis is accepted.
5 Experiments and Results
In this section, we first introduce the setup of the experiments ($ 5.1). We evaluate the effectiveness of RONAN ($ 5.2) and provide a case study on Stable Diffusion model [3] ($ 5.3). We then conduct ablation studies in 5.4, and discuss the comparison to existing reconstruction based attribution methods in 5.5. The discussion about the efficiency and robustness against image editing can be found in the Appendix.
5.1 Setup
Our method is implemented with Python 3.8 and PyTorch 1.11. We conducted all experiments on a Ubuntu 20.04 server equipped with six Quadro RTX 6000 GPUs.
Models. Eleven different models are included in the experiments: DCGAN [1], VAE [6], StyleGAN2-
ADA [10], DDIM [2], DDPM [7]. TransGAN [56], StyleGAN XL [30], Consistency Diffusion

---

Table Detailed results on distinguishing belonging images and real images.
Belongings vs Training Data
Belongings vs Unseen Data
Model Type
Model
Training Daraset
TP
FP
FN
'TN
Acc
TP
FP
FN
TN
Avc
Unconditional
DCGAN VAE
CIFAR-10 10 CIFAR-10
0
4
100
98.0%
95
0
100
97.5%
95
0
100
97.5%
96
0
100
98.0%
Class-conditional
StyleGAN2-ADD ADA
CIFAR 10 ImageNet
96
2
4
98
97.0%
95
0
100
97.5%
Consistency Model
24
76
86.0%
96
11
92.5%
Text-conditional
ControlGAN
CUB-200-2011
95
10
5 90 92.5%
96
8 92
94.0%
Table 3: Results for distinguishing belonging images and images generated by other models with different architectures, Here, Model M₁ is the examined model, Model M2 is the other model that has same training data but different architectures.
Training Dataset
Model M_
M2
VAE
96
0
4
100
98.0%
StykGANZADA
100
98.0%
DCGAN
DDIM
97
0
3
100
9%.5%
DDPM
TransGAN
97
0
3
100
98.5%
DCGAN
97
3
100
98.5%
CIFAR-10
StylGAANZADA
95
0
5
100
97.5%
DDIM
DDPM
96
0
4
100
98.0%
TransGAN
100
98.5%
DCGAN
96
98
97.00 0%.0%
VAE
95
97.09
StYLGANZADA
DDIM
96
99
97.5%
DDPM
98.0%
TransGAN
95
5
94
94.5%
Consisteney Model
StyleGAN XL
95
5
92
93.5%
ImageNet
StyleGAN XL
Consistency Model
96
10
90
93.0%
ControlGAN
StackGAN--2
96
17
4
83
89.5%
CUB
StackGAN
ConiolGAN
96
86
91.0%
Model [4), Control-GAN [28], StackGAN-v2 [29], and Stable Diffusion v2 [3]. These models representative image generation models.
Performance Metrics. The efffectiveness of the method is measured by collecting the detection accuracy (Acc). For a particular model, given set of belonging images and non-belonging images, the Acc is the ratio between the correctly classified images and all images. We also show detailed number of True Positives (TP, i.e., correctly detected belongings), False Positives (FP, i.e. non-belongings classified as belongings), False Negatives (FN, i.e., belongings classified non- non-belongings) and True Negatives (TN, i.e., correctly classified non-belongings).
5.2 Effectiveness
In this section, we evaluate the effectiveness of RONAN from two perspectives: (1) its effectiveness in distinguishing between belongings of a particular model and real images; (2) its effectiveness in differentiating between belongings of particular model and those generated by other models.
Distinguishing Belonging Images and Real Images. To investigate RONAN's effectiveness in distinguishing between belonging images of a particular model and real images, given an image generation model, start by differentiating between the generated images of the given model and the training data of the model. The investigated models include DCGAN [1], VAE [6], StyleGAN2- ADA [10] trained on the CIFAR-10 [48] dataset, Consistency Model [4] trained on the ImageNet [53] dataset, and ControlG AN [28] trained on the CUB- LUB-200-2011 [57] dataset. Among them, DCGAN and the latest diffusion models. In addition to distinguishing belongings and the training data, we also conduct experiments to distinguish belongings from unseen data that has similar distribution to the training data (i.e., the test data of the dataset). For each case, we evaluate the results on 100 randomly sampled belonging images and 100 randomly sampled non-belonging images. The results are demonstrated in Table 2. As can be observed, the detection accuracies (Acc) are above 85% all cases. On average, the Ace is 94.2% for distinguishing belongings and training data, and is 95.9% for distinguishing belongings and unseen data. The results demonstrate that
and VAE are unconditional image generation models. StyleGAN2-ADD
model Consistency Model, are class-conditionns
7

---

RONAN achieves good performance in distinguishing between belonging images of a particular model and real images.
Distinguishing Belonging Images and Images Generated by Other Models. In this section, we study RONAN's effectiveness distinguish between belonging images of particular model and the images generated by other models. For a given model M we consider two different types of other models M2 i.e., the model trained on the same dataset but with different architectures and the model that has the same architecture but is trained on different dataset.
Models with Different Architectures. We first evaluate RONAN's effectiveness in distinguishing between belonging images of a particular model and the images generated by other models with the same training data but different architectures. For the models trained the CIFAR- 10 [48] dataset, the used model architectures are DCGAN [1], VAE [6], StYAeGAN2-AD [10], DDIM [2], DDPM [7], TransGAN [56]. For the Imagenet [53] dataset, the involved models are the latest diffusion model Consistency Model [4] and StyleGAN XI. [30]. For the CUB-200-2011 [57] dataset, we use text-to-image models ControlGAN [28] and StackGAN-v2 [29]. To measure the effectiveness of RONAN, we collect its results on 100 randomly sampled belonging images and 100 randomly sampled non-belonging images. The results are shown in Table 3. where Model M, denotes the examined model, and Model M2 represents the other model that has the same training data but a different architecture. The results show that the average detection accuracy (Ace) of RONAN is 96.45% confirming its good performance for distinguishing between belongings of a given model and the images generated by other models with different architectures.
Models Trained on Different Datasets. We also evaluate RONAN's effectiveness in distinguish- ing between belonging images of a particular model and the images generated by other mod- els with the same model architecture but trained on different datasets. The model used here is the diffusion model Consistency Model [4]. We use model trained on the ImageNet [53] dataset and a model trained on the LSUN [58] dataset. The results are demonstrated in Table 4, where Model M2 denotes the examined model, and Model M2 means the other model that has the same model architecture but is trained on a different dataset. The results show that RONAN can effectively distinguish between belonging images of a particular model and the images generated by other models with the same model architecture but different training data. On average, the detection accuracy of our method is 93.0%. In the Appendix, we also dis- cuss the results when the training data of the model M2 and that of the model Mj have overlaps. Empirical results demonstrate that RONAN is still effective even the training data of the examined model and that of the other model are similar (i.e., they have large overlaps).
Table 4: Results for distinguishing belonging im- ages and images generated by other models with different training data. Here, Model M₁ is the ex- amined model, Model M2 is the other model that has same architecture but different training data.
Trainging dataset of Model M1
Trainging datasel of Model M2
TP
FP
FN
TN
Ace
ImageNet LSUN
LSUN ImageNet
95
13
5
87
91.0%
96
6
94
93.0%
5.3 Case Study on Stable Difflusion v2
In this section, we conduct a case study on the recent Stable Diffusion v2 [3] model. We first randomly collect 20 images of Shiba dogs from the internet and use these images as the non- belonging images. We then use the prompt "A cute Shiba on the grass." and feed it into the Stable Diffusion v2 model to generate 20 belonging images. We apply RONAN on the model, and evaluate its performance in distinguishing the belonging images and non-belongin images. The results show that the detection accuracy of RONAN 87.5%, with 18 TP, FP, 2 FN, 17 TN. In Fig. 3, we show the visualization of belonging image and a non-belonging image, as well as their corresponding reverse enginee-n images. Note that the belongiggg image and the belonging image have similar inherent complexities (i.e., their reconstructed loss with the MSE metric on the reference model are 0.029 and 0.022, respectively). For the non-belonging image, the reverse-engineered image is more noisy and blurred, while the reverse-engineered image of the belonging image seems nearly identical to the original image. These results show the potential to apply our method on state-of-the-arr models such Stable Diffusson v2. More visualizations and examples can be found in Appendix J.
5.4 Ablation Study
In this section, we evaluate the impact of different metries used in calculating reconstruction loss, and the impact of reconstruction loss calibration.
8

---

Non-helonging
Reverse-engineered
Belonging
Reverse-cngineered
(a) A non-belonging image and its reverse- engineered image for Stable Diffusion v2. The re- constructed loss is 0.0078 with MSE metric.
(b) belonging image and its reverse-engineered image for Stable Diffusion v2. The reconstructed loss is 0.0005 with MSE metric.
Fig. 3: Visualization the belonging image and non-belonging image for Stable Diffusion v2 [3], and their corresponding reverse- reverse-enginecet engineered images. image have similar inherent complexities.
The bon-belonging image and the belonging
Different Metrics. In the reverse-engineering task (Eq. 1), we use a metric L to mea- sure the distance between different images. By default, select MSE [49] the metric. In addition to MSE, we also evaluate the results on other image distance metrics, i.e., MAE (Mean Ab-
Table 5: Results different distance metries.
solute Error) [59], SSIM (Structural Similarity Index
Metric
TP
FP
FN
TN
Acc
Measure) [60]. and LPIPS (Learned Perceptual Im-
age Patch Similarity) [61]. The task is to distinguish between belonging images and real images (i.e., train- ing images of the model here). The model used in this section is the StyleGAN2-ADD
MAE
96
7
93
94.5%
MSE
96
2
98
97.0%
SSIM
97
26
74
85.5%
LPIPS
96
4
96
96.0%
[10] trained on CIFAR-10 [48] dataset. The results are shown in Table 5. As we can observe, the detection accuracy (Ace) under MAE, MSE, SSIM, and LPIPS are 94.5%, 97.0%. 85.5%, and 96.0%, respectively. Overall, the MSE metric achieves the highest performance in distinguishing belonging images and real images. Thus, we select MSE as our default metric.
Impacts of Reconstruction Loss Calibration. To eliminate the influence of images' inherent complexities,
calibrate the reconstruction loss by considering the hardness of the reverse-engineering on a reference model (S 4.2). To measure the effects of the calibration step, we compare the detailed TP, FP, FN, TN, and Ace for the method with and without the calibration step. We use the Stable Diffusion v2 [3] model and follow the experiment settings described in $ 5.3. The results in Table 6 demonstrate the detection accuracy for the method with and without the calibration step are 75.0% and 87.5%, respectively. These results show that the calibration step can effectively improve the performance of RONAN.
Table Effects of reconstruction loss calibration.
Method
TP
FP
FN
TN
Acc
w/o Calibration
17
3
13
75.0%
w/ Calibration
18
3
2
17
87.5%
5.5 Comparison to Existing Reconstruction based Attribution Methods
Albright et al. [43] and Zhang et al. [44] are two existing attribution methods that also apply the reconstruction the input. In this section, we compare our method them. Given inspected image, Albright et al. and Zhang et al. works by enumerting and conducting inversion on all models within set of suspicious candidate models (referred as the "candidate set" in this section), and attribute the model with the lowest reconstruction loss as the source of the image. Their methods rely on the assumptions that the inspector can have the white-box access all models in the candidate set, and the examined image must be generated by one of the models in the candidate set. These assumptions diminish the practicability of their methods, whereas our method does have such requirements. Thus, our threat model and experiment settings are fundamentally different to theirs. Our paper focus on the problem of determining if given image generated by a single given model or not. Consider scenario where model owner wants to verify if an image is generated by a model owned by him/her. While our method only needs to conduct the inversion on this specific model. Albright et al. and Zhang et al. need to compare the reconstruction loss of this particular model with a large number of suspicious models. There are several cases where Albright et al. and Zhang et al. ineffective in addressing this problem: ① In cases where the inspector lacks white-box access

---

to some of the suspicious models, deriving reconstruction on them and getting inference results becomes infeasible. Notably, more and more state-of th-t image generation models (e.g.. such as Midjourney [62] and DALL-FF [13]) are close-sourced and they only provide the black-box API to the users. @ Albright et al. and Zhang et al. are prone to making wrong predictions if the real source model is not included in the candidate set. This is attributed to their underlying assumption that the examined image must originate from one of the models within the candidate set. Ensuring the real source model is included within the candidate set is a very hard problem in practice. @ Equally noteworthy, Albright et al. and Zhang et al. do not work when the inspected images are real images due to their strong assumption (i.e., the examined image must be generated by one of the model in the candidate set). Our method does not have the above problems.
Despite the threat models are dif- ferent, we also conduct the com- parison experiments. We con- sider the setting for distinguish- ing the belonging images of the inspected model Mi and the generated images of other mod- els M2. and the inspected model here is Stable Diffusion v2. For our method, we assume the inspector can only access MM For Albright et al. and Zhang et al., we assume the inspector access both Mj and M2 The results can be found in Table 7. While the average detection accuracy of Albright et al. and Zhang et al. are only 50%, our method achieves over 90% detection accuracy, meaning that our method outperforms Albright al. and Zhang et al.
Table 7: Comparison to Albright et al. [43] and Zhang et al. [44].
Model M₁
Model Mg
Method
TP
FP
FN
TN
Acc
Albright al.
100
100
50.0%
StyleGAN2-ADA
Zhang al.
100
100
0
0
50.0%
Stable Diffusion v2
Ours
96
7
94.5% 4
93
Albright et al.
100
100
0
0
50.0%
Consistency Model
Zhang al.
100
100
50.0%
Ours
95
10
90
92.5%
Laszkiewicz et al. [45] is a concurrent work focusing on the single-model attribution problem. Although the method proposed in Laszkiewiez et al. achieves promising performance, it is important to note that is not model-agnostic. More specifically, assumes the last layer of the inspected model is invertible. Therefore, it is not applicable to the models that use non-invertible activation functions (such as the commonly-use ReLU function) in the last layer. It also has assumptions on the architectures of the models, making it can not be used for many modern diffusion models [7, 63].
Discussion
Limitations. While our method can achieve origin attribution in alteration-free and model-agnostic manner, the computation cost might be higher than that of watermark- classifier-based methods 124-27]. More discussion about the efficiency of our method can be found in the Appendix. Speeding up the reverse-engineene on the image generation models. Expanding our method for origin attribution on the model in other fields. (e.g., vedio generation models such as Imagen Video [64], language generation models like ChatGPT [65], and graph generation models [66, 67J) will also be our future work.
methods [20-23] and
will be our future work. This paper focuses
Ethics. Research on security and privacy of machine learning potentially has ethical concerns [68-78]. This paper proposes a method to safeguard the intellectual property of image generation models and monitor their potential misuse. We believe that our approach will enhance the security of image generation models and be beneficial to generative AI.
7 Conclusion
In this paper, we take the first effort to introduce the "alteration-fres and model-agnostic origin attri- bution" task for Al-generated images. Our contributions for accomplishing this task involves defining the ceverse-engineering task for generative models and analyzing the disparities in reconstruction loss between generated samples of a given model and other images. Based on our analysis, we devise novel method for this task by conducting input reverse-enginee eeverseengineerring and calculating the corresponding reconstruction loss. Experiments conducted different generative models under various settings demonstrate that our method is effective in tracing the origin of Al-generated images.
A Acknowledgement
We thank the anonymous reviewers for their valuable comments. This research is supported by Sony AI, IARPA TrojAi W91 INF--I-----0 NSF 2342250 and 23 29944... Any opinions, findings, and conclusions expressed in this paper are those of the authors only and do not necessarily reflect the views of any funding agencies.
10

---

References
[1] Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint
2015.
[2] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference Learning Representations, 2020.
[3] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684-10695, 2022.
[4] Yang Song, Prafulla Dhariwal, Mark Chen, and llya Sutskever. Consistency models. arXiv preprint arXiv:2303.01166) 2023.
[5] lan J. Goodfellow, Jean Pouget-Abadie Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. Generative adversarial nets. NIPS, 2014.
[6] Diederik P Kingma and Max Welling, Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114 2013.
[7] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.
[8] Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4401-44 2019.
[9] Tero Karras, Samuli Laine, Mïika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 8110-8119, 2020.
[10] Tero Karras, Miika Aittala, Janne Hellsten, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Training generative adversarial networks with limited data. Advances in neural information processing systems, 33: 12:4414--2114, 2020.
[11] Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning. Advances in neural information processing systems, 30, 2017.
[12] Jiapeng Zhu, Yujun Shen, Deli Zhao, and Bolei Zhou. In-domain gan inversion for real image editing. European conference on computer vision, pages 592-608. Springer, 2020.
[13] OpenAl. DALL-E https: hatpp/aaacaaappooccccaaallle---
[14] Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. Logan: Membership inference attacks against generative models. arXiv preprint
2017.
[15] Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito. and Eric Wallace. Extracting training data from diffusion models. arXiv preprint wxXiv:2301.13/88 2023.
[16] Hanqing Zhao, Wenbo Zhou, Dongdong Chen, Tianyi Wei, Weiming Zhang, and Nenghai Yu. Multi-attentional deepfake detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2185-2192 2021.
[17] Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of member- ship inference attacks against generative models. Proceedings of 2020 ACM SIGSAC conference computer and communications security, pages 343-362. 2020.
[18] Ding Sheng Ong, Chee Seng Chan, Kam Woh Ng. Lixin Fan, and Qiang Yang. Protecting intellectual property of generative adversarial networks from ambiguity attacks. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pages 3630-3639,
2021.
11

---

[19] Zhenting Wang, Chen Chen, Yuchen Liu, Lingjuan Lyu. Dimitris Metaxas, and Shiqing Ma. How to detect unauthorized data usages in text-to-image diffusion models. arXiv preprint arXiv:2307.03 108, 2023.
[20] Mitchell D Swanson, Bin Zhu, and Ahmed H Tewfik. Transparent robust image watermarking. In Proceedings of 3rd IEEE International Conference on Image Processing, volume 3, pages 211-214, IEEE, 1996.
[21] Lixin Luo, Zhenyong Chen, Ming Chen, Xiao Zeng, and Zhang Xiong. Reversible image watermarking using interpolation technique. IEEE Transactions information forensics and security, 5(1):187-193, 2009.
[22] Shelby Pereira and Thierry Pun. Robust template matching for affine resistant image watermarks. IEEE transactions on image Processing, 96):1123-1129 2000.
[23] Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognilion, pages 2117-2126, 2020.
[24] Ning Yu, Larry S Davis, and Mario Fritz. Attributing fake images to gans: Learning and analyzing gan fingerprints. In Proceedings of the IEEE/CVF international conference on computer vision, pages 7556-7566, 2019.
[25] Yuzhen Ding, Nupur Thakur, and Baoxin Li. Does a gan leave distinct model-specific finger- prints. In Proceedings of the BMVC, 2021.
[26] Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Rooting deepfake attribution training data. In Proceedings of the IEEE/CVF International conference computer vision, pages
2021.
[27] Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry S Davis, and Mario Fritz. Responsible disclosure of generative models using scalable fingerprinting. In International Conference on Learning Representations, 2022.
[28] Bowen Li, Xiaojuan Qi, Thomas Lukasiewicz, and Philip Torr. Controllable text-to-image generation. Advances Neural Information Processing Systems, 32, 2019.
[29] Han Zhang, Tao Xu, Hongsheng Li, Shaoting Zhang, Xiaogang Wang, Xiaolei Huang, and Dimitris N Metaxas. Stackgan++: Realistic image synthesis with stacked generative adversarial networks. IEEE transactions on pattern analysis and machine intelligence, 1944:11977 2018.
[30] Axel Sauer, Katja Schwarz, and Andreas Geiger. Stylegan-xl: Scaling stylegan to large diverse datasets. In ACM SIGGRAPH 2022 conference proceedings, pages 1-10, 2022.
[31] Chen Chen, Jie Fu, and Lingjuan Lyu. pathway towards responsible ai generated content. arXiv preprint arXiv:2303.013325 2023.
[32] Francesco Marra, Diego Gragnaniello, Luisa Verdoliva, and Giovanni Poggi. Do gans leave artificial fingerprints? In 2019 IEEE conference on multimedia information processing and retrieval (MIPR), pages 506-511. IEEE, 2019.
[33] Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. In International confer- ence on machine learning, pages 3247-3258. PMLR, 2020.
[34] Ricard Durall, Margret Keuper, Franz-Josee Pfreundt, and Janis Keuper. Unmasking deepfakes with simple features. arXiv preprint arXiv: /9/ 1.00666 2019.
[35] Ricard Durall, Margret Keuper, and Janis Keuper. Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions. In Proceedings of the IEFE/CVF conference on computer vision and pattern recognition, pages 7890-7899, 2020.
12

---

[36] Yonghyun Jeong, Doyeon Kim, Youngmin Ro, and Jongwon Choi. Frepgan: robust deepfake detection using frequency-level perturbations. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 1060-1068, 2022.
[37] Zhengzhe Liu, Xiaojuan Qi, and Philip HS Torr. Global texture enhancement for fake face detection in the wild. In Proceedings of the IEEE/CVF conference on computer vision and pattem recognition. pages 8060-8069 2020.
[38] Xinlei He, Xinyue Shen, Zeyuan Chen, Michael Backes, and Yang Zhang. Mgtbench: Bench- marking machine-generatee text detection. arXiv preprint arXiv:2303. 2023.
[39] OpenAI. New AI classifier for indicating Al-written text. aew-ai-classifin forrieer--o-innnee ai
[40] Ganesh Jawahar, Muhammad Abdul-Mageed, and Laks VS Lakshmanan. Automatic detection of machine generated text: A critical survey. arXiv preprint arXiv:2011.01314 2020.
[41] Matthias Gallé, Jos Rozen, Germán Kruszewski, and Hady Elsahar. Unsupervised and distribu- tional detection of machine-generated text. arXiv preprint urXiv221 2021.
[42] Han Fang, Weiming Zhang, Hang Zhou, Hao Cui, and Nenghai Yu. Screen resilient watermarking. IEEE Transactions on Information Forensics and Security, 14(6):1403-144 2018.
[43] Michael Albright and Scott McCloskey. Source generator attribution via inversion. In CVPR Workshops, volume 8, page 3, 2019.
[44] Baiwu Zhang, Jin Peng Zhou, Ilia Shumailov, and Nicolas Papernot. On attribution of deepfakes. arXiv preprint arXiv:2008.091 2020.
[45] Mike Laszkiewicz, Jonas Ricker, Johannes Lederer, and Asja Fischer. Single-model attribution via final-layer inversion. arXiv preprint arXiv:2306.062/0, 2023.
[46] Michael Spence. Intellectual property. OUP Oxford, 2007.
[47] Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. Monte carlo and reconstruction membership inference attacks against generative models. Proc. Priv. Enhancing Technol., 2019 (4):232-244 2299, 2019.
[48] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[49] Zhou Wang and Alan Bovik. Mean squared error: Love it or leave it? a new look signal fidelity measures. IEEE signal processing magazine, 26(1):98 117, 2009.
[50] Christoph Redies, Seyed Ali Amirshahi, Michael Koch, and Joachim Denzler. Phog-derived aesthetic measures applied to color photographs of artworks, natural scenes and objects. In Computer ECCV 2012. Workshops and Demonstrations: Florence, Italy, October 7-13, 2012, Proceedings, Part I 12, pages 522-531. Springer, 2012.
[51] Honghai Yu and Stefan Winkler. Image complexity and spatial information. In 2013 Fifth International Workshop on Quality of Multimedia Experience (QoMEX), pages 12-17. IEEE, 2013.
[52] I Mario, M Chacon, D Alma, and S Corral. Image complexity measure: a human criterion free approach. In NAFIPS 2005-2005 Annual Meeting of the North American Fuzzy Information Processing Society, pages 241-241 246. IEEE, 2005.
[53] Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision. 1 115(3):1112522 2015.
[54] Frank Grubbs. Sample criteria for testing outlying observations. The Annals of Mahematical Statistics, pages 27-58, 1950.
13

---

[55] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
[56] Yifan Jiang, Shiyu Chang, and Zhangyang Wang. Transgan: Two pure transformers can make one strong gan, and that can scale up. Advances in Neural Information Processing Systems, 34: 14745-14758, 2021.
[57] C. Wah, S. Branson, P. Welinder, P. Perona, and S. Belongie. Caltech-uesd birds-200-200 200-2011 (cub-200-2011). Technical Report CNS-TR-2011-000 1-000, California Institute of Technology, 2011.
[58] Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv: 1506.03363 2015.
[59] Tianfeng Chai and Roland R Draxler. Root mean square error (rmse) or mean absolute error (mac). Geoscientific model development discussions, 7()):1525-1334 2014.
[60] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing. 13(4): 600-612, 2004.
[61] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unrea- sonable effectiveness of deep features as perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586-595, 2018.
[62] Midjournyy. Midjourney. attps://wat midjourney.com
[63] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in Neural Information Processing Systems, 34:8780-8794, 2021.
[64] Jonathan Ho, William Chan, Chitwan Saharia, Jay Whang, Ruiqi Gao, Alexey Gritsenko, Diederik Kingma, Ben Poole, Mohammad Norouzi, David J Fleet, et al. Imagen video: High definition video generation with diffuusion models. arXiv preprint arXiv:2210.0233 2022.
[65] OpenAl. ChatGPT. https: httpss//ppppaa..ccc//hh/////t/t/
[66] Minkai Xu, Lantao Yu, Yang Song, Chence Shi, Stefano Ermon, and Jian Tang. Geodiff: geo- metric diffusion model for molecular conformation generation. arXiv preprint arXiv:2203.0292. 2022.
[67] Clement Vignac, Igor Krawczuk, Antoine Siraudin, Bohan Wang, Volkan Cevher, and Pas- cal Frossard. Digress: Discrete denoising diffusion for graph generation. arXiv preprint arXiv:2209.144: 14734, 2022.
[68] Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction apis. In USENIX security symposium, volume 16, pages 601-618, 2016.
[69] Zhenting Wang, Kai Mei, Juan Zhai, and Shiqing Ma. Unicorn: A unified backdoor trigger inversion framework. The Eleventh International Conference on Learning Representations, 2023.
[70] Yingqi Liu, Guangyu Shen, Guanhong Tao. Zhenting Wang. Shiqing Ma, and Xiangyu Zhang. Complex backdoor detection by symmetric feature differencing. Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 15003-15013, 2022.
[71] Guanhong Tao, Zhenting Wang, Shiwei Feng, Guangyu Shen, Shiqing Ma, and Xiangyu Zhang, Distribution preserving backdoor attack in self-supervised learning. In 2024 IEEE Symposium on Security and Privacy (SP), pages 29-29. IEEE Computer Society, 2023.
[72] Guanhong Tao, Zhenting Wang, Siyuan Cheng, Shiqing Ma, Shengwei An, Yingqi Liu, Guangyu Shen, Zhuo Zhang, Yunshu Mao, and Xiangyu Zhang. Backdoor vulnerabilities normally trained deep learning models. arXiv preprint arXiv:2211.15922 2022.
14

---

[73] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE sympostum on security and privacy (SP), pages 3-18. IEEE, 2017.
[74] Zhenting Wang, Hailun Ding, Juan Zhai, and Shiqing Ma. Training with more confidence: Mitigating injected and natural backdoors during training. Advances Neural Information Processing Systems, 35:36396-364111 2022.
[75] Minhao Cheng. Thong Le, Pun-Yu Chen, Jinfeng Yi, Huan Zhang, and Cho-Jui Hsieh. Query-efficient hard-label black-box attack: An optimization-based approach. arXiv preprint arXiv:1807.04457, 2018.
[76] Zhenting Wang, Kai Mei, Hailun Ding, Juan Zhai, and Shiqing Ma. Rethinking the reverse- engineering of trojan triggers. Advances in Neural Information Processing Systems, 2022.
[77] Zhenting Wang, Juan Zhai, and Shiqing Ma. Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 15074-15084, 2022.
[78] Kai Mei, Zheng Li, Zhenting Wang, Yang Zhang, and Shiqing Ma. Notable: Transferable backdoor attacks against prompt-based nlp models. Annual Meeting of the Association for Computational Linguistics, 2023.
[79] Yann LeCun, Corinna Cortes, and CJ Burges. Mnist handwritten digit database. ATT Labs [Online]. Available: http://yann.lecmm www.:l/ww...o//ee///iiissssss 2, 2010.
[80] Sheng- Yu Wang. Oliver Wang, Richard Zhang, Andrew Owens, and Alexei Efros. Can- generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8695-8704, 2020.
[81] Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi, Koki Nagano, and Luisa Verdoliva. On the detection of synthetic images generated by diffusion models. In ICASSP 2023- 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1-5. IEEE, 2023.
[82] Gaurav Parmar, Krishna Kumar Singh, Richard Zhang, Yijun Li, Jingwan Lu, and Jun-Yan Zhu. Zero-shot image-to-image translation. In ACM SIGGRAPHI 2023 Conference Proceedings, pages 1-11, 2023.
[83] Robert B Ash. Information theory. Courier Corporation, 2012.
[84] Paulius Micikevicius, Sharan Narang, Jonah Alben, Gregory Diamos, Erich Elsen, David Gareia, Boris Ginsburg, Michael Houston, Oleksii Kuchaiev, Ganesh Venkatesh, et al. Mixed precision training, arXiv preprint 170000770 2017.
15

---

Roadmap: In this appendix, we show the proof for Theorem 4.2 (Appendix A), detailed process for calculating critical value of the distribution used in $ 4.3 (Appendix B), more results for distinguishing belonging images and images generated by other models (Appendix C), thought experiment on VAE (Appendix D), results on different reverse-engineering methods (Appendix E), discussion on different methods for measuring the complexity of the images (Appendix F). RONAN's robustness to editing-based adaptive attack (Appendix G), the discussion for the efficiency RONAN (Appendix H). Finally, provide more results and demonstrate more visualizations Stable Diffusion v2 [3] (Appendix andAppendix J).
A Proof for Theorem 4.2
We start our analysis from ideal generative model and reconstruction algorithm, which we define as deterministic generative model and perfect reconstruction algorithm:
Definition A.1 (Deterministic Generative Model). Given generative model M I XM, it is deterministic if it always produce the same output a E X' given the same input i I.
Definition A.2 (Perfect enggiee-nng Algorithm). Given reverse-engineering algorithm A. if it is guaranteed that the returned reconstruction loss is the global minima, then we say A is perfect -egiieeenggnniiing algorithm.
Proof. Assume the given output sample is generated by input i. Since the given model M is deterministic, we have:
M(1)
(4)
In this case, the distance between the æ and M(1) is O, i.., L (M x)) = Based on Theorem 4.1, as A is perfect reverse-engineering algorithm, it can find the input that can produce the minimal reconstruction loss. Therefore, we have:
Vo E A(M, =
(5)
Similarly, for sample x' & XM. There does not exist an input that can produce x', meaning that there does not exist an input that have L (Mii') x') = Thus, we have:
Va' & XM, A(M, >
(6)
Finally, we have for any x E XM and & XM we have A(M, M'Mx > 2(M,
B Computing Critical Value of the Distribution.
In 4.3, we use the critical value of the t distribution obtain the results of the hypothesis testing. In this section, we discuss the detailed process for calculating the critical value. For the t-distribution, we have the probability density function:
11/1)/2
A(1)
1
+
VTTI
In Eq. 7, the number of degrees of freedom and I' is the gamma function. Based on Eq. 7, we have the cumulative distribution function:
P(t t') x))= I" f(w)du =
v 1 212
(8)
2
1/ 2'
where 3 denotes the incomplete beta function. Therefore, given a confidence level a and the number of degrees of freedom v, we have Eq. obtain the value of the critical value l,.0.
P(t tav)
(9)
16

---

Table Results when the inspected model and the other model has the similar architectures but their numbers of layers are different.
Mj Number of Layers
Ma Number of Layers
Acc
2
97.5%
2
98.0%
Table 10: Results when the inspected model and the other model has the similar architectures but their number of channels in the first Conv layer are different.
Mg 's Numher of Channels in the first Conv Layer
M2 's Number of Channels in the first Cony Layer
Acc
97.5%
48
64
96.0%
C
More Results for Distinguishing Belonging Images and Images Generated by Other Models.
In this section, we provide more results for distinguishing belonging images of the model and the images generated by other models. We first consider distinguishing the belonging im- ages and the images generated by the other models having the same architecture and over- lapped training data. Given a model M1. we focus on the other model M2 which shares the same architecture as MM and has training data that overlaps with M2 training data.
The model architecture used here is DCGAN [1]. We trained Mj on the full CIFAR-I0 [48] dataset, while M2 is trained on the randomly sampled subsets of the CIFAR-10 10 dataset. The results are presented in Table 8, where the first column indicates the proportion of overlap between the training data M, and M2. The second column of Table 8 displays the accuracy of RONAN in detecting the differences. Notably, even when 90% of M2's 's training data overlaps with that of M1. the detection accuracy remains above 95%. These results demonstrate that method is still effective when the training data of the inspected model and that of the other model are similar. We also consider distinguishing the belonging images and the images generated by the other models having the same training data and similar architectures. We use DCGAN [1] here and modifies the number of layers and the number of channels in the first Conv layer the models to make Mj and M2 have similar architectures. Both Mi and M2 here are trained on CIFAR-10 10 [48] dataset. The results can be found in Table and Table 10. Based on these results, our method is effective even the inspected model and other models have the same training dataset and similar architectures. We also provide summary of the combinatorial setups used for distinguishing belonging images and images generated by other models in Table 11.
Table 8: Results when the inspected model and the other model has the same architec- ture and their training data has overlaps.
Overlap Fraction
Acc
50%
98.5%
60%
98.0% 98.0%
70%
98.5%
80%
96.0%
96.5%
D A Thought Experiment VAE.
If a image generation model perfectly fits the training samples, then the images generated by it will be indistinguishable to its training samples (which are real images). In this section, we investigate a question: "Can image generation models perfectly fit the training samples?". To study this question, we conduct thought experiment on VAE [6]. In detail, we randomly sample 10 images from MNIST [79] dataset, and use VAE [6] with different numbers of neurons in the hidden layer fit these 10 images. We set the epoch number to 5000 to ensure the training losses that measures the distance between the generated samples and the training samples of the model are converged. The detailed final training losses with different model sizes are shown in Table 12. There are two parts in the total training loss Livaat: the reconstruction part Creconstraction and the -il-dieegee part Laivergence. i.c., Lioual Ercconttuction + Ldivargene. In Table 12, Detailed values for each part are demonstrated.
17

---

Table 11: Summary of combinatorial setups for distinguishing belonging images and images generated by other models.
M₁
M2
Setting
Modal
Training Dataset
Model
Training Dutsset
DCGAN
CIFAR-10
VAE
CIFAR-10
DCGAN
CIFAR-10
StylGANNAAA
CIFAR-10
DOGAN
CIFAR-I0
DDIM
CIFAR-10
CIFAR-I0
DCGAN
CIFAR-10
TransGAN
CIFAR-10 1O
Different Model Architecture
DCGAN
CIFAR-10
VAE
CIFAR-I0
StylGGANZADA
CIFAR-I0
VAE
CIFAR-10
DDIM
CIFAR-IO
VAE
CIFAR-10
DDPM
CIFAR-I0
VAE
CIFAR-10
TranGAN
CIFAR-10
StylGANNADA
CIFAR-10
CIFAR-10
NtylGGANZADA
CIFAR-1O
DCGAN
CIFAR-1O
StyleGANZADA
StyleGANZADA
CIFAR-10
DDPM
CIFAR-IP 10
Styl:GANZADA
CIFAR-10
TransGAN
CIFAR-10
Consistency Model
ImageNet
StyleGIAN XI.
ImageNet
StyleGN XL
ImageNet
Consistcncy Model
ImageNet
ControlGAN
CUB-200-200
StackGAN-v2
CUB-200- 2011
StackGAN-v2
CUB-200-2011
ContmoGAN
CUB-200-2011
DCGAN
CIFAR-10
DCGAN with different numbers layers DCGAN with different numbers channels
CIFAR-10
Similar Architecture
DCGAN
CIFAR-10
CIFAR-10
Consistency Model
ImageNet
Consistency Model
LSUN
Different Training Daraset
Consistency Model
LSUN
Consistency Model
ImageNet
DCGAN
CIFAR-10
DCGAN
50% subset CIFAR-10
DCGAN
CIFAR-10
DCGAN
60% subset CIFAR-10
Overlapping Training Dataset
DCGAN
CIFAR-I0
DCGAN
70% subset CIFAR-10
ICGAN
CIFAR-10
DOGAN
80%
CIFAR-10
DOGAN
CIFAR-10
DCGAN
90% suhset of CIFAR-10
Table 12: Detailed final training losses with different model sizes in the thought experiments on VAE.
Num of Neurons in Hidden Layer
Lusi Emamonation
Latoorgnnc
184.24
183.93
0.31
5.59
10
77.20
69.07
8.13
53.52
47.55
5.97
53.23
47.99
5,24
500
53.04
48.21
4.83
With the increases in the model sizes, the final total training losses reduce at first. However, when the model large enough, the final total training loss becomes stable at the region from 53.00-54.00. The results show that even the VAEs with enough large sizes can not fit all pixels perfectly. We also conduct the everrs-enginnering of the training samples on trained VAE with 1000 neurons the hidden layer. The results show that
not reconstruct the exact training samples.
As pointed out by existing works [33, 80, 81], morden generative models (e.g.. VAEs. GANs, and Diffusion models) including the state-of-the-art models such Stable Diffusion [3] and DALL-- [13] will leave forensics traces in the frequency spaces of the generated images. This caused by indispensable operations used in modern generative models (e.g., Upsampling operations and Convolutional Layers). Also, perfectly fitting the training samples means finding the global optimum in the optimization process. However, the essential gradient descent optimizers used in modern generative models (e.g., SGD and Adam) typically can not get the global optimum. Based on the above analysis and empirical results, at least we can conclude that the probabilities that the real images belong to the output space of generative models are very low.
E Discussion on Different Reverse-enginerring Methods
In this section, we discuss the details of the reverse-engineering process on different models and the effects of different reverse-engincering methods. The details of the reverse-engineering for different
18

---

Table 13: Details of reverse-engineering different models.
Model
Detuils of Reverse Reverse-engineriig engineering
DCGAN VAE
Using gradient decent optimize the input in the noise space. Using gradient decent optimize the input in the noise space.
StyleGANZ-ADA
Using gradient decent optimize the input in the noise space.
Consistency Model
Using gradient Decent to optimize the input in the noise space. Using gradient decent optimize the input in the noise space.
StyleGAN XI
ControlGAN
Using gradicat decent to optimize the feature in the intermediate feature space before the G. layer. Using gradient decent to optimize the festure
StackGAN-22
intermediate feature space before Ga layer. Using gradient decent optimize the feature the intermediate feature space before the decoder.
Stable Diffusion
Table 14: Results under different inversion meth- ods for StyleGANs.
Table 15: Results under different inversion meth-
ods for Stable Diffusion.
Model
Space
Aoc
Inversion Method
Acc
spoce 97.0%
StybGAAN-AAA
W+ space
96.0%
Detault
87.5%
DDIM Inversion
55.5%
StyleGAN XI.
Zspace 93.0%
Parmar et al.
62.5%
space
93.5%
models are summarized in Table 13. We also investigate the effects of different reverse-engineering methods. For StyleGAN2-ADA [10] and StyleGAN-XL [30], we use the random noise space (i.c., Z space) to reconstruct the images by default. We also conducted experiments on using intermediate latent space (i.e., W+ space) to reconstruct the images for distinguishing belonging images and images generated by other models (see setting for Table 3). The results on StyleGAN2-ADA with the CIFAR-10 [48] dataset and StyleGAN XL with ImageNet dataset are shown in Table 14. As can be observed, using the W+ space has similar accuracy to using Z space, meaning that our method not sensitive to the selection of the input spaces used for optimization.
We also conduct experiments for different reverse- entenneringnnn methods designed for diffusion models (i.c., DDIM inversion [2]. Parmar et al. [82] and our method) on the Stable Diffusion v2 [3] model with the setting described in 5.3. The results are shown in Table 15. DDIM inversion [2] is an
inversion approach performing the reverse of the DDIM sampling. It is based on the assumption that the ODE process can reversed in limited of small steps. only has unsatisfying inversion performance on the conditional diffusion models (e.g., Stable Diffusion) because it will magnify the accumulated error in the inversion process (since ignores the classifier-fre free guidance the diffusion process). As can be seen in the above table, the accuracy of using DDIM inversion is only 55.5% Parmar et al. [82] improve the DDIM inversion by using an approximated prompt as the conditional guidance in the inversion process. The approximated prompts are generated by caption model (i.e., BLIP). This method's 's inversion quality is dependent on the captions used. Given a generated image of the inspected model, since the caption model can not get the accurate prompt used for generating this image, the inversion using this method is also not accurate, leading that the reconstruction losses of the belonging images and non-belonging images not highly separable (the accuracy is 62.5%). Compared to DDIM inversion [2] and Parmar et al. [82], our method achieves higher accuracy.
F Discussion on Different Methods for Measuring the Complexity of the Images
In this section, we discuss the different methods for measuring the complexity of the images. We first discuss the reference model based method. Here, we conducted experiments that us-
Table 16: Results on using different models as reference models.
ing different models as reference models. The in- spected model here is the StyleGAN2-ADA [10] model trained on CIFAR-10 10 [48] dataset and the setting here is identical to that used in the Table 2 (belongings vs training data). The results can be found in Table 16. As can be observed, using different reference models yields similar results, meaning that our method is not sensitive to the selection of the reference models. The measurement of the image complexity can also be implemented
Reference Model
Acc
Consistency Model
97.0%
StyleGAN XI. 95.0%
Stuble Diflusion 96.0%
19

---

Table 18: Results under adaptive attack with box blur filter editing.
Table 17: Results under adaptive attack with instagram filter editing.
Box Size
Acc
SSIM
TP
FP
EN
TN
Acc
92.5%
0.8920
2
83.0%
0.7446
90.5%
58.0%
0,5174
4
53.5%
0.3530
by calculating the 2D entropy of the image [83]. Using this entropy- method as the image complexity measurement also yields 97.0% final detection accuracy in our setting.
G Adaptive Attack
In this section, we evaluate the robustness of RONAN against the adaptive attack where the malicious user is aware of it and try to bypass the inspection of RONAN. For example, when the malicious user use a specific model to generate an image, he/she can make a slight modification on the image to bypass the inspection of the origin attribution algorithm. We consider the image editing as the adaptive attack because it can preserve most of the information in the original image while changing the image. To investigate if RONAN is robust the maage-eiiting-based adaptive attack, we use the 1977 instagram filter' and the box blur filter to conduct results. The model used here is the DCGAN [1] model trained on the CIFAR-10 10 [48] dataset. The results are shown in Table 17 and Table 18. For 1977 instagram filter, we can see that the detection accuracy of RONAN is still above 90% even under the adaptive attack. For box blur filter, we show the results under different box sizes of the filter. Besides the detection accuracy (Acc) of our method, we also demonstrate the Structural Similarity Index (i.e., SSIM [60]) between the original images and the edited images, which can measure the similarity between them. A higher SSIM value means the edited images are more similar to the original images. As can be observed, our method remains effective under relatively small box sizes. As the box sizes expand, however, the detection accuracy of our method diminishes. This outcome understandable and acceptable, as it corresponds to a rapid reduction in the Structural Similarity Index (SSIM) between the edited images and their unaltered counterparts. When employing larger box sizes, it is conceivable that an adaptive attacker might find ways to clude method's 's scrutiny, yet this comes at the cost of substantially compromising the quality of the edited images. Consequently, our method maintains its effectiveness even in the face of adaptive attacks that seek to maintain the quality of the edited images.
H Efficiency
In this section, discuss the efficiency of RONAN. To study the efficiency, we measure the runtime of our method on different models (i.e.,
Table 19: Runtime different models.
DCGAN [1], VAE [6], StyleGAN2-ADA [10], Con-
sistency Model [4], and Stable Diffusion v2 [3]). For
Model
Runtime (s)
each model, we run 5 times on Quadro RTX 6000 GPU and collect the average runtime and its standard deviation. The results can be found in Table 19. Our method can be accelerated by using mixed precision training [84]. Further approach for speeding up the input reverse-engineering process will be our future work.
DCGAN
16.53 + 0.35
VAE
$1.63 0.84
StyleGANZ-ADA
54.44 1: 0.79
Consistency Model
153.65 + 2.02
Stable Diffusion
605.45 + 3.26
I More Results on Stable Diffusion
In this section, we provide more results on the Stable Diffusion. Here, we use the Stable Diffusion v2 model the inspected model. The scenario considered here is distinguishing 1000 images generated by Stable Diffusion v2 model (the inspected model) and 1000 images generated by DeepFloyd-IF-II L model. Note that the images here generated using the prompts randomly sampled from the
20

---

PromptHero website. The results demonstrate that our method achieves 91.6% detection accuracy. meaning it is effective under this scenario.
More Visualizations on Stable Diffusion
In this section, we provide more visualizations for our case study on Stable Diffusion v2 model [3] ($ 5.3). We show more visualizations for the belonging images and their corresponding reverse- engineered images in Fig. In Fig. we demonstrate more visualizations for the non-belonging images of the Stable Diffusion v2 model, and also show their reverse-engineent images. The detailed reconstruction loss and the calibrated reconstruction loss are reported Fig. 4 and Fig. 5, The distance metric used here is MSE. As we can observed, the belonging images have much lower calibrated reconstruction loss than the non-belonging images, further demonstrating the effectiveness of our approach.
'atpss//prompphero.com/
21

---

Belonging
Reverse-engineered
(a) The reconstruction loss and the calibrated reconstruction loss are 0.0006 and 0.0167, respectiell..
Belonging
Reverse-engineered
(b) The reconstruction loss and the calibrated reconstruction loss are 0.0008 and 0.0286, respectively.
Belonging
Reverse-cngineered
(c) The reconstruction loss and the calibrated reconstruction loss are 0.0005 and 0.0161, respectively.
Fig. 4: More visualization of the belonging images for Stable Diffusion v2 [3], and their corresponding reverse-engineered images. The distance metric used here is MSE.
22

---

bon-belonging
Reverse-engineered
(a) The reconstruction loss and the calibrated reconstruction loss are 0.0038 and 0.1727, respectilly
Non-belonging
Reverse-engineered
(b) The reconstruction loss and the calibrated reconstruction loss are 0.0019 and 0.0704, respectively.
Non Son-belonging
Reverse-engineered
(c) The reconstruction loss and the calibrated reconstruction loss are 0.0028 and 0.2800, respectively.
Fig. 5: More visualization of the non-belonging images for Stable Diffusion v2 [3], and their corresponding reverse-engineered images. The distance metric used here is MSE.
23


Reviews:
[{"review_id": "vwm8L5g1Om", "reviewer": "Reviewer_FUt3", "summary": "This paper proposes a new problem: given an image $x$ and an generate model $M$, predict whether this image $x$ belongs to $M$ or not. To this end, this paper proposes to do hypothesis testing based on the reconstruction error after conducting latent optimization to reconstruct the given image $x$. They hypothesize that if the image belongs to the model, the reconstruction error while be lower, if it does not belong to, the loss will be higher.", "questions": "see above", "limitations": "see above", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- This attribution problem is relative new, despite it has ambiguity with a more popular attribution problem, where given a generated image from a model, how can distribute the credit to each image in the training set.\n\n- their algorithm show high accuracy in their relevant but maybe limited setup.", "weaknesses": "while I understand the motivation of considering this problem, but I feel the formulation of this problem is problematic: \n\n- (1) The first is that, this framework will only work if the real images used to train these generative models do not belong to the output space of the generative models. If these training images belong to the output space, then they will be credited as the generated images of the given generative model, which is wrong. If you assume the training images do not belong to the output space, it's also weird, since this is how generative models, such as VAE, is optimized. If a generative model, such as VAE, perfectly fits the training data, your model will wrongly give IP to this generative model.\n\n- (2) relevantly, this framework will determine any reconstructed images as generated images. i.e., given any real image $x$, let's feed it through the vae autoencoder, and then get vae reconstruction as $x'$. Apparently $x'$ belongs to the output space of the vae model, but can we ethically classified it as images generated by the model, and give IP to the VAE? I do not think so.\n\n- (3) what if I train two models with the same architecture on the same dataset (just with different random seeds), then how can you determine which model generate which images? In this case, your method may wrongly attribute output from one model to the other model.\n\n- (4) This method sounds like very easy to get attacked, despite the authors argue that it's advantageous over wartermaking and classifier based one. One apparent question is that, if I do some photoshoping-ish editing or as simple as running a gaussian blurring over the generated images and real images, is this framework still able to distinguish which model generate which image?\n\n- (5) For line 301, you train the same model on different datasets, what if we train different models (architectures) on the same datasets?\n\n- (6) For the study 5.3, one question is that many other papers have shown that diffusion model can almost identically output some images used to train it. So how do you guarantee that there is no similar images in the training set for your generated images?\n\nThe calibration step is not very intuitive. Can you use any other model for calibration? will they be equally effective? why do you just choose this consistency model? it's not well justified.\n\nAssuming these generative models are white-box is too strong. The reality is that, many real images are generated by private models where you have no access to even weights, such as Mid-journey.\n\nMore realistic situation is also that, let's say we found one image is guilty, then how do we know which model is from? Then it's infeasible to iterate all models to see which model creates this given image.\n\nWriting-wise,\n\n- (1) the abstract is not easy to follow, the inverse engineering makes me think it's something very different that what you actually did, which was just latent optimization for reconstructing the output.\n- (2) because of this terminology, it also renders paragraph 67 not easy to understand what you actually do\n\nIsn't Theorem 4.2 trivial? I do not understand why authors put it as a theorem?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your time and valuable comments. We hope the\nfollowing new clarifications and results can address your\nconcerns. We are happy to provide further responses and\nperform more experiments if you have further suggestions.\n\n**Q1**: The first is that, this framework will only work if\nthe real images used to train these generative models do not\nbelong to the output space of the generative models. If\nthese training images belong to the output space, then they\nwill be credited as the generated images of the given\ngenerative model, which is wrong. If you assume the training\nimages do not belong to the output space, it's also weird,\nsince this is how generative models, such as VAE, is\noptimized. If a generative model, such as VAE, perfectly\nfits the training data, your model will wrongly give IP to\nthis generative model.\n\n**A1**: Thank you for your thoughtful comment. We respectively disagree.\n\n* Although the goal of the\ngenerative model's training is fitting the training data, to the\nbest of our knowledge, the training data **can not be perfectly fitted**,\nat least until now. Even the state-of-the-art generative\nmodels can not reach exactly 0 training loss. Our empirical\nresults in Table 2 of the main paper also demonstrate that the training\nsamples and the generated samples for the state-of-the-art\ngenerative models are actually distinguishable by our method.\nThere are various existing works (e.g., Rossler et al., Yan\net al. and Zhu et al.) demonstrate the real images (even the\ntraining data for the generative models) and the images\ngenerated by the real-world generative models are\ndistinguishable. We want to note that the fundamental goal of\nmachine learning is not perfectly memorizing the training\ndata. In fact, various existing works (e.g., Carlini et al.)\ndemonstrate that deeply memorizing the training data is\nharmful and we should avoid memorizing so much.\n\n* While generative models can produce highly realistic synthetic data, differences between generated and real data often remain detectable. The growing field of generated data detection continues pursuing improvements, suggesting this is still an open research problem rather than a meaningless endeavor. \n\nCarlini et al., Extracting Training Data from Diffusion Models. USENIX Security 2023.\n\nRossler et al., FaceForensics++: Learning to Detect Manipulated Facial Images. ICCV 2019. (1491 citations)\n\nYan et al., DeepfakeBench: A Comprehensive Benchmark of Deepfake Detection. arXiv 2023.\n\nZhu et al., GenImage: A Million-Scale Benchmark for Detecting AI-Generated Image. arXiv 2023.\n\n**Q2**: This framework will determine any\nreconstructed images as generated images.\n\n**A2**: Thanks for your insightful comment. In this paper,\nwe focus on the IP infringement and misuse problem related\nto the novel-generated images of the generative models. Note\nthat generating creative novel images is also the\nfundamental goal of the image generative models. Forcing the\ngenerated images to be close to some real images means the\nIP infringement and misuse are mostly associated with the\nimitated real images, instead of the generative model\nitself. The detailed problem formulation, application\nranges, and use cases of our method can be found in Section\n3. We admit that the reconstructed images will be considered\nas the belongings of the model, but we do not need to\nconsider the attribution of the reconstructed images in our\nuse cases. We will make it more clear in the revised\nversion.\n\n\n**Q3**: what if I train two models with the same\narchitecture on the same dataset (just with different random\nseeds), then how can you determine which model generate\nwhich images? In this case, your method may wrongly\nattribute output from one model to the other model.\n\n**A3**: Thank you for your constructive comment. For our main use case where the model holder wants to defend the IP of his/her trained models (see Section 3 of our main paper for more details), we focus on\nprotecting the IP of the models that are trained on the\nprivate dataset or close-sourced model architecture. If two\nmodels trained by different parties only have the difference\non the random seeds, then both the dataset and the model\narchitecture used are open-sourced and we might not need to\nprotect the IP of the models. We will add more discussion to\nmake it more clear. \n\n**Q4**: Photoshoping-ish editing based adaptive attack.\n\n**A4**: Thank you for your useful comment. The discussion\nabout the image-editing-based adaptive attack can be found\nin Appendix.D in the supplementary materials. Following Ali\net al., to keep the quality of the images while conducting\nediting on them, we use the _1977 Instagram filter to\nconduct image editing. The model used here is the DCGAN\ntrained on the CIFAR-10. The results show that the detection\naccuracy of RONAN is 90.5% even under the\nimage-editing-based adaptive attack, demonstrating the\nrobustness of our method.\n\nAli et al., ColorFool: Semantic Adversarial Colorization. CVPR 2020.\n\n**Q5**: For line 301, you train the same model on different\ndatasets, what if we train different models (architectures)\non the same datasets?\n\n**A5**: Thanks for your valuable question. The results for\ndifferent models (architectures) on the same datasets can be\nfound in Table 2 (also see line 289) in our paper. Also, see\nrv4w-A3 and Tabel 1 of the PDF file in the global response\nfor more results. "}, {"review_id": "FbvqrPcI42", "reviewer": "Reviewer_FZhr", "summary": "The method proposes a model-agnostic attribution method. Given a synthesized image as input, the goal is to attribute the correct model that generates the image. Different from prior work, the method is not restricted to a fixed set of models. The main idea of the work is to use reconstruction error -- the model that generates the image should also reconstruct the image better. On top of this, the work introduces a relative reconstruction measure to calibrate the difficulty of reconstruction of each image, along with a thresholding method based on hypothesis testing. The method is tested on multiple generative models or different training datasets, and the method shows strong performance in most cases.", "questions": "1. How is reconstruction done on StyleGAN2-ADA and StyleGAN-XL? A common practice is to reconstruct the images by optimizing the extended intermediate latent space (W+) [1], instead of the random noise (z). Will these make a difference in the proposed task?\n\n2. There exist multiple reconstruction strategies for diffusion models as well [2, 3, 4]. It will be great to provide detail on this too.\n\n[1] Abdal et al. Image2StyleGAN++: How to Edit the Embedded Images?\n[2] Song et al. Denoising Diffusion Implicit Models.\n[3] Mokady et al. Null-text Inversion for Editing Real Images using Guided Diffusion Models.\n[4] Parmar et al. Zero-shot Image-to-Image Translation.", "limitations": "In my opinion, the authors have addressed the limitations adequately.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The author clearly defines the inspector's goal and what the inspector can see. This is helpful in understanding the problem setup easily.\n\n2. The quantitative results look promising, indicating that the relative reconstruction loss is effective for this problem.\n\n3. The method section is well-motivated, where the authors introduce relative reconstruction loss for calibration, and hypothesis testing to find thresholds.\n\n4. Although the method is simple, it is interesting to have a model-agnostic attribution method.", "weaknesses": "1. Using reconstruction error is not new for membership inference [1]. Although membership inference focuses on whether an image is used for training the model or not, finding whether a synthesized image is generated by the model shares a similar spirit. It will be good to have more discussion on this.\n\n2. A type of generative model can have multiple ways to reconstruct an input. Currently, the paper does not provide detail about how reconstruction is done for each model. Please check the question sections for this point.\n\n3. Although the authors have mentioned in the limitation section already, the reconstruction-based algorithm requires a huge runtime cost, making it a less favorable option for model attribution.\n\n\n[1] Hilprecht et al. Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for your time and insightful comments.\nWe hope the following new clarifications and results can\naddress your concerns.\n\n**Q1**: Using reconstruction error is not new for membership\ninference. Although membership inference focuses on\nwhether an image is used for training the model or not,\nfinding whether a synthesized image is generated by the\nmodel shares a similar spirit. It will be good to have more\ndiscussion on this.\n\n**A1**: Thank you for your valuable suggestion. We focus on\nthe origin attribution problem that inspecting if a given\nimage is generated by a given model or not, which is\ndifferent from the membership inference problem that focuses\non the membership of the training samples. Also, our method\nis guided and supported by our theoretical analysis for the\norigin attribution problem in Theorem 4.2, while the method\nproposed by Abdal et al. is heuristic, and it does not have\ntheoretical support for membership inference problem. We\nwill add more discussion about the suggested work (i.e.,\nAbdal et al.) accordingly in the revised version.\n\n**Q2**: A type of generative model can have multiple ways to\nreconstruct an input. Currently, the paper does not provide\ndetail about how reconstruction is done for each model. How\nis reconstruction done on StyleGAN2-ADA and StyleGAN-XL? A\ncommon practice is to reconstruct the images by optimizing\nthe extended intermediate latent space (W+), instead of\nthe random noise (z). Will these make a difference in the\nproposed task?\n\n**A2**: Thanks for your insightful comment. For\nunconditional generative models, we use gradient descent to\noptimize the input in the noise space. For text-to-image\nmodels, we optimize the input in the intermediate feature\nspace. More details about how reconstruction is done for\neach model are provided in Table 2 of the PDF file\nattached to the global response.\n\n\nFor StyleGAN2-ADA and StyleGAN-XL, we\nuse the random noise space (i.e., z space) to reconstruct\nthe images by default. During the rebuttal period, we also\nconducted experiments on using intermediate latent space\n(i.e., W+ space) to reconstruct the images for\ndistinguishing belonging images and images generated by\nother models (see setting for the Tabel 3 of the main\npaper). The results on StyleGAN2-ADA with the CIFAR-10 dataset\nare shown in the following table:\n\nSpace | Acc|\n---- | ---|\nz space |  97.0%|\nW+ space| 96.0%|\n\nWe also have the results on StyleGAN XL with ImageNet\ndataset and the identical setting used in the Tabel 3 of the main paper, and the results are demonstrated as follows:\n\nSpace | Acc|\n---- | ---|\nz space |  93.0%|\nW+ space| 93.5%|\n\nAs can be observed, using the W+ space has\nsimilar accuracy to using z space, meaning that\nour method is not sensitive to the selection of the input\nspaces used for optimization. We will add more results and\ndiscussion in the revised version.\n\n**Q3**: There exist multiple reconstruction strategies for\ndiffusion models as well. It will be great to provide detail\non this too.\n\n**A3**: Thank you very much for your constructive comment\nand valuable suggestions. We conduct experiments for\ndifferent inversion methods suggested and our default\ninversion approach on the Stable Diffusion 2 model with the\nsetting described in Section 5.3 of the main paper. The\nresults are shown in the below table:\n\nInversion Method | Acc|\n---- | ---|\nDefault |  87.5%|\nDDIM| 55.5%|\nParmar et al.| 62.5%|\nMokady et al.| 85.0%|\n\n* DDIM inversion is an inversion approach performing the\n  reverse of the DDIM sampling. It is based on the assumption\n  that the ODE process can be reversed in limited of\n  small steps. It only has unsatisfying inversion performance\n  on the conditional diffusion models (e.g., Stable\n  Diffusion) because it will magnify the accumulated error\n  in the inversion process (since it ignores the\n  classifier-free guidance in the diffusion process). As can\n  be seen in the above table, the accuracy of using DDIM\n  inversion is only 55.5%.\n\n* Parmar et al. improve the DDIM inversion by using an\n  approximated prompt as the conditional guidance in the\n  inversion process. The approximated prompts are generated\n  by a caption model (i.e., BLIP). This method's inversion\n  quality is dependent on the captions used. Given a\n  generated image of the inspected model, since the caption\n  model can not get the accurate prompt used for generating\n  this image, the inversion using this method is also not\n  accurate, leading that the reconstruction losses of the\n  belonging images and non-belonging images are not highly\n  separable (the accuracy is 62.5%).\n\n* Mokady et al. use the diffusion trajectory estimated by\n  the DDIM inversion as the pivotal, and conduct pivotal\n  tuning on the null-text embedding. It achieves comparable\n  accuracy (i.e., 85.0%) to our default inversion method.\n\nWe will add more results and discussion in our revised\nversion. Thanks again for your valuable suggestions.\n\n**Q4**: Although the authors have mentioned in the\nlimitation section already, the reconstruction-based\nalgorithm requires a huge runtime cost, making it a less\nfavorable option for model attribution.\n\n**A4**: Thank you very much for your thoughtful comment. The\ndiscussion of the efficiency and the runtime can be found in\nAppendix.E. We admit the computational complexity of our\nmethod is larger than watermarking and classifiers-based\nmethod. However, our method is alteration-free and\nmodel-agnostic while existing methods are not. In addition,\nour method can be accelerated by mixed precision training\n(Micikevicius et al.). We will add more discussion in the\nrevised version.\n\nMicikevicius et al., Mixed Precision Training. ICLR 2018.\n"}, {"review_id": "W3p2Fnm2Eq", "reviewer": "Reviewer_rv4w", "summary": "This paper develops an origin attribution method to determine whether a specific image is generated by a particular model. The key idea is based on reverse-engineering generation models, and the decision is made by thresholding the reconstruction loss. The proposed method is evaluated on eight different image generation models.", "questions": "1. How is the attribution efficiency? As the proposed method is optimization-based,  the attribution procedure may take more time than other methods by straightforward prediction. \n2. The authors should conduct more sufficient literature research and conduct more comparison experiments.", "limitations": "The limitations are listed in the weaknesses above.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. This method could be applied to different types of generative models (model-agnostic) without requiring any extra operations in the training phase and image generation phase (alteration-free).", "weaknesses": "1. The novelty is lacking. The authors state that \"this paper is the first work focusing on this problem to infer if a specific sample is generated by a particular model in an alteration-free and model-agnostic manner\". However, as far as I know, there are several works working on the same problem listed below, and the proposed methodology is very similar to these works. I doubt whether the authors have conducted sufficient literature research.  \n[1] Source Generator Attribution via Inversion, CVPRW2019\n[2] On Attribution of Deepfakes, arXiv2020\n\n2. The proposed method could not be a \"perfect reverse-engineering algorithm\". Model inversion has been a difficult problem due to the nonlinearity of neural networks. Existing works make many efforts to improve the precision of inversion. The methods proposed in the work only follow the most simple optimization-based inversion method without innovations in technology.\n\n3.  The experiments are far from sufficient. In the real-world scenario, the number of unknown models is far greater than the known models. However, in Table 3, the author only uses a single model M2 as the negative model. The high accuracy doesn't reflect the performance in the open-world scenario. Besides, there is no comparison with existing methods. The author should at least compare with [1] and [2], which solve the same problem as this paper and use a similar method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your time and insightful comments. We have run\nall the suggested experiments. We hope the following new\nclarifications and results can address your concerns. We are\nwilling to perform more experiments if you have further\nsuggestions.\n\n**Q1**: The authors state that \"this paper is the first work\nfocusing on this problem to infer if a specific sample is\ngenerated by a particular model in an alteration-free and\nmodel-agnostic manner\". However, as far as I know, there are\nseveral works working on the same problem listed below, and\nthe proposed methodology is very similar to these works. I\ndoubt whether the authors have conducted sufficient\nliterature research. Besides, there is no comparison with\nexisting methods. The author should at least compare with\nAlbright et al. and Zhang et al., which solve the same\nproblem as this paper and use a similar method.\n\n**A1**: Thank you for the suggested papers.\n\n* First of all, the problems focused by Albright et al. and\n  Zhang et al. are **different** from our problem. More\n  specifically, their problem is that given an image and a set\n  of provided models, how to determine which model in the given\n  model set is the source of the given image. However, our\n  problem is determining if a given image is generated by\n  a single given model or not, which is a fundamentally\n  different problem. Albright et al. and Zhang et al. have\n  several drawbacks compared to our method. For example,\n  they can not distinguish the real images and the generated\n  images. Also, if the given image is not generated by the\n  model in the provided model set, their method will always\n  give a wrong prediction. Since their problem formulation\n  is different from ours, we did not empirically compare our\n  method to theirs (i.e., their methods are not applicable to our problem).\n\n* Besides the optimization for reverse-engineering, to solve\n  the problem of determining if a given image is generated\n  by a single given model or not, we propose the important\n  calibration step to make the belonging images and\n  non-belonging images more separable. Our origin\n  attribution framework is also based on the designed\n  statistical hypothesis testing. Both these techniques are not discussed in \n  Albright et al. and Zhang et al.\n\n* While Albright et al. and Zhang et al. are limited to the\n  inversion of noise-to-image GANs, our work also includes\n  the reverse-engineering on more models, e.g.,\n  text-to-image diffusion models and GANs. We also discuss\n  different reverse-engineering methods for the latest\n  diffusion models (see Reviewer FZhr A3), which are also\n  insightful to the community. We will add more discussion\n  to make it more clear.\n\nAlbright et al., Source Generator Attribution via Inversion. CVPR Workshop 2019.\n\nZhang et al., On Attribution of Deepfakes. arXiv 2020.\n\n**Q2**: The proposed method could not be a \"perfect\nreverse-engineering algorithm\". Model inversion has been a\ndifficult problem due to the nonlinearity of neural\nnetworks. Existing works make many efforts to improve the\nprecision of inversion. The methods proposed in the work\nonly follow the most simple optimization-based inversion\nmethod without innovations in technology.\n\n**A2**: Thanks for your thoughtful comment. Although the\nreverse-engineering in the real world is not exactly\nperfect, Theorem 4.2 reflects the relaxation and the\napproximations of real-world cases. Thus, Theorem 4.2 is\nmeaningful as the guidance of our method. Our experiments in\nSection 5 of the main paper and Table 1 of the\nattached PDF in the global response demonstrates that the\nreconstruction loss values for belonging and non-belonging\nimages are highly separable (i,e, the average detection\naccuracy of our method is 96.4%).\n\n\n**Q3**: The experiments are far from sufficient. In the\nreal-world scenario, the number of unknown models is far\ngreater than the known models. However, in Table 3, the\nauthor only uses a single model M2 as the negative model.\nThe high accuracy doesn't reflect the performance in the\nopen-world scenario. \n\n**A3**: Thanks for your helpful comment. We have conducted\nthe experiments on 5 negative models accordingly during the\nrebuttal period. The results are shown in the Table 1 of the\nPDF file in the global response. The results demonstrate\nthat our method has good performance for distinguishing\nbetween the belongings of a given model and the images generated\nby other models with different architectures. We will add\nthe above results and more discussion in the revised version of\nthis paper.\n\n**Q4**: How is the attribution efficiency? As the proposed\nmethod is optimization-based, the attribution procedure may\ntake more time than other methods by straightforward\nprediction.\n\n**A4**: Thank you very much for your thoughtful comment. The\ndiscussion of the efficiency and the runtime can be found in\nAppendix.E. We admit the computational complexity of our\nmethod is larger than watermarking and classifiers-based\nmethod. However, our method is alteration-free and\nmodel-agnostic while existing methods are not. In addition,\nour method can be accelerated by mixed precision training\n(Micikevicius et al.). We will add more discussion in the\nrevised version.\n\nMicikevicius et al., Mixed Precision Training. ICLR 2018.\n"}, {"review_id": "D4IfVbEDlj", "reviewer": "Reviewer_SUvG", "summary": "This paper addresses the problem of distinguishing between images generated by a generative AI model or acquired by a camera (real images). The motivation comes from the concerns of AI community about the potential misuse and intellectual property (IP) infringement associated with image generation models. \n\nThe authors approach the classification problem (generated image vs real image) by first developing an alteration-free and model-agnostic origin attribution method via reverse-engineering (i.e., inverting the input of a particular model for a specific image) followed by computing the reconstruction loss of reverse-engineering to infer the origin. The authors provide the intuition behind the approach by stating that reverse-engineering task is easier for belonging images to a particular model than for non-belonging images generated by some other models\n", "questions": "Would it be possible to create a table summarizing the combinatorial setups for Architecture = {the same, different} x Training Data = {the same, different, overlapping} given selected two models M1 and M2?", "limitations": "The section “Discussion” describes the limitations of the approach in its higher computational cost than the two other approaches based on watermarking [19-22] and classifiers [23-26]. This opens up a question about tradeoffs.", "rating": 9, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "The strengths of the paper lie in\n(1)\tIntroducing “alteration-free and model-agnostic origin attribution\" algorithm\n(2)\tAnalyzing the differences in the reconstruction loss for reverse engineering between the generated images of a given model and other images, and then checking whether the reconstruction loss of the examined sample falls within the distribution of reconstruction losses observed in the generated images. \n(3)\tEvaluating the method on eight different image generation models to quantify the accuracy\n", "weaknesses": "The weaknesses of the paper lie in \n(1)\tMissing description of computational costs\n(2)\tReproducibility of the algorithm is the paper presents the algorithm 1 at very high level which makes it difficult to reproduce the algorithm (unless the code becomes available)\n(3)\tAssuming of having belonging images to a specific model (Section 4.4 refers to 100 images labeled as belonging images to a specific model) which might not always be the case in practice\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for your precious time, thoughtful\ncomments, and recognition of the significance of our work.\nWe hope the following results and clarifications can\nadequately address your concerns.\n\n**Q1**: Missing description of computational costs.\n\n**A1**: Thanks for your valuable comment. The discussion of\nthe efficiency and the computational costs can be found in\nAppendix.E. We will add a more detailed discussion in the\nrevised version.\n\n**Q2**: Reproducibility of the algorithm is the paper\npresents the algorithm 1 at very high level which makes it\ndifficult to reproduce the algorithm (unless the code\nbecomes available).\n\n**A2**: Thank you very much for your insightful suggestion.\nThe link to our code repo can be found in line 541 of the\nappendix (supplementary materials).\nWe will open-source our code upon acceptance.\n\n**Q3**: Assuming of having belonging images to a specific\nmodel (Section 4.4 refers to 100 images labeled as belonging\nimages to a specific model) which might not always be the\ncase in practice.\n\n**A3**: Thanks for your thoughtful comment. In our problem\nformulation, the defender has access to the examined \nmodel. Thus, the belonging images of it can be generated by\ndirectly using the examined model. We will add more\ndiscussion to make it more clear.\n\n**Q4**: Would it be possible to create a table summarizing\nthe combinatorial setups for Architecture = {the same,\ndifferent} x Training Data = {the same, different,\noverlapping} given selected two models M1 and M2?\n\n**A4**: Thank you very much for your helpful suggestion. The\nsummary of combinatorial setups can be found in Table 3 of\nthe attached PDF in the global response. We will add the\ntable accordingly in the revised version."}]

Author rebuttal:

We sincerely thank all reviewers for their thoughtful
comments and precious time. We provide our responses below
to address concerns. Please let us know if there is anything
still not clear. We are willing to answer more questions and
perform more experiments if the reviewers have further
concerns.

Due to the length limition, we put the responses for Q6, Q7, Q8, Q9 and Q10 of Review FUt3 in here.

**Review FUt3-Q6**: For the study 5.3, one question is that many other
papers have shown that diffusion model can almost
identically output some images used to train it. So how do
you guarantee that there are no similar images in the
training set for your generated images?

**Review FUt3-A6**: Thanks for your constructive question. We are aware
of some methods (e.g., Carlini et al. and Webster et al.)
that can extract generated images similar to some training
samples of the model. Although the extracted images are much
more similar to some training samples than the randomly
generated images, these generated images still have a
certain $l_2$ distance to the corresponding training images,
and there are obvious artifacts for human vision in these
generated images (see Carlini et al.). Thus, the
distribution of the extracted images is different from that
of the corresponding training images. We also conduct
experiments on using our method to distinguish the extracted
images (by using Webster et al.) and their corresponding
training images. The model used is Stable Diffusion. The
results are that our method still achieves 85.0% accuracy
for distinguishing the memorized training samples and the
corresponding generated samples. We will add more details
and results in our revised version.

Carlini et al., Extracting Training Data from Diffusion Models. USENIX Security 2023.

Webster et al., A Reproducible Extraction of Training Images from Diffusion Models. arXiv 2023.


**Review FUt3-Q7**: Calibration step and reference models.

**Review FUt3-A7**: Thank you very much for your constructive comment.
We have conducted experiments that used different models as
reference models during the rebuttal. The inspected model
here is the StyleGAN2-ADA model trained on CIFAR-10 dataset
and the setting here is identical to that used in the Table
2 of the main paper (belongings vs training data)
distinguishing the belonging images and the results can
be found in the following table.

Reference Model | Acc|
---- | ---|
Consistency Model |  97.0%|
StyleGAN XL| 95.0%|
Stable Diffusion| 96.0%|

As can be observed, using different reference models yields
similar results, meaning that our method is not sensitive to
the selection of the reference models. We will add more
discussion and results in our revised version.

**Review FUt3-Q8**: Assuming these generative models are white-box is
too strong.

**Review FUt3-A8**: Thanks for the useful comment. The detailed
application ranges and use cases of our method can be found
in Section 3. The inspectors in all use cases can have
white-box access to the model, and they know the range of
the examined models (i.e., they do not need to iterate all
models). For example, the main use case of our method is
protecting the IP of the model owner. In this scenario, a
party suspects that a specific image may have been generated
by their generative model without authorization, such as if
a malicious user has stolen the model and used it to
generate images. The party can then request an inspector to
use our proposed method to infer if the doubtful image was
indeed generated by their particular model. The situation
where the inspector does not have white-box access to the
model and needs to iterate all models is out of the scope of
this paper. We will add more discussion to make it more
clear in our revised version.

**Review FUt3-Q9**: Theorem 4.2.

**Review FUt3-A9**: Although it is straightforward, Theorem 4.2
establishes the theoretical separability of the
reconstruction loss values for belonging and non-belonging
images. Thus, Theorem 4.2 is meaningful as the guidance of
our method.

**Review FUt3-Q10**: Other writing issues.

**Review FUt3-A10**: Thank you very much for your helpful suggestions.
We will revise accordingly in the revised version.


Meta-review: This submission presented a model-agnostic attribution method by introducing a relative reconstruction measure to calibrate the difficulty of reconstruction of each data. Overall, the reviewers are positive and appreciate the idea and contribution of this work. It is of good value compared to previous works in terms of three aspects: (1) they provide a theory prove about why reconstruction loss can tell the belonging (though intuitively it is not surprised), (2) they contribute the calibrated reconstruction loss and hypothesis testing (two points mentioned by you as well) and support with ablation and explanation (but can be improved), (3) they analyze the attribution in diffusion models, which is the latest mainstream model in content generation but the copyright issue is frequently raised and urgently needs some solutions. After a fruitful discussion and checking all reviews, a decision of acceptance is made. There are still some concerns, for example, the literature review is not deep, as two closely related works in the above discussion are totally missed. Discussion with them should be added through revision.
Decision: Accept (poster)