Generative Models are Self-Watermarked: Declaring Model Authentication through Re-Generation
Authors: Aditya Desu
Xuanli He
Qiongkai Xu
Wei Lu
Venue: Accepted by TMLR ()

Abstract: As machine- and AI-generated content proliferates, protecting the intellectual property of generative models has become imperative, yet verifying data ownership poses formidable challenges, particularly in cases of unauthorized reuse of generated data. Confirming the ownership of the data is challenging, as the data generation process is opaque to those verifying the authenticity. Our work is dedicated to detecting data reuse from a single sample. While watermarking has been the traditional method to detect AI-generated content by embedding specific information within models or their outputs, which could compromise the quality of outputs, our approach instead identifies inherent fingerprints in the outputs without altering models. The verification is achieved by requiring the (authentic) models to re-generate the data. Furthermore, we propose a method that iteratively re-generates the data to enhance these fingerprints in the generation stage. The strategy is both theoretically sound and empirically proven effective with recent advanced text and image generative models. Our approach is significant because it avoids extra operations or measures, such as (1) modifying model parameters, (2) altering the generated outputs, or (3) employing additional classification models for verification. This enhancement broadens the applicability of authorship verification (1) to track the IP violation in generative models published without explicitly designed watermark mechanisms and (2) to produce outputs without compromising their quality.

Published in Transactions on Machine Learning Research (09/2024)
Generative Models are Self-Watermarked: Declaring Model Authentication through Re-Generation
Aditya Desu" The University of Melbourne
adityodesu/00@@aaal.ooo
Xuanli He University College London
z.muanli.he
Qiongkai Xu Maoquarie University The University of Melbourne
zjonghoi.rru@mq.edee edu.
Wei Lu
Inwees&Buldd edu. sg
Singapore University of Technology and Design Skywork AI
Reviewed on OpenReview: https: // openreview. net/ formm? id= LUHnWDydue
Abstract
As machine- and Al-generated content proliferates, protecting the intellectual property of generative models has become imperative, yet verifying data ownership poses formidable challenges, particularly in cases of unauthorized reuse of generated data. Confirming the ownership of the data is challenging, as the data generation process is opaque those veri- fying the authenticity. Our work is dedicated to detecting data reuse from a single sample. While watermarking has been the traditional method to detect Al-generated content by embedding specific information within models or their outputs, which could compromise the quality of outputs, our approach instead identifies inherent fingerprints in the outputs without altering models. The verification is achieved by requiring the (authentic) models to re-generate the data. Furthermore, we propose a method that iteratively re-generates the data enhance these fingerprints in the generation stage. The strategy is both theoreti- cally sound and empirically proven effective with recent advanced text and image generative models. Our approach is significant because it avoids extra operations measures, such as (1) modilying model parameters, (2) altering the generated outputs, or (3) employing additional classification models for verification. This enhancement broadens the applicabil- ity of authorship verification (1) to track the IP violation in generative models published without explicitly designed watermark mechanisms and (2) to produce outputs without compromising their quality.
1 Introduction
In recent years, the emergence of Artificial Intelligence Generated Content (AIGC), including tools like
ChatGPT, Claude, DALL-E, Stable Diffusion, Copilot, has marked a significant advancement in the quality of machine-generated content. While these based services have accelerated AI technology development, they have also raised concerns about content misuse. Two critical challenges emerge: (1) protecting the Intellectual Property (IP) of authentic generators and (2) ensuring accountability for information sources.
"Equal contribution.
The corresponding author.

---

Published in Transactions on Machine Learning Research (09/2024)
I Generation
(II) Verification
Re-generation
Distance Metric
X, "Storm
s OpanAx
ga
Xa
S. . gc V < Go(xa)
D (Xa. yc) =00733
Gallice"
(i) Traditional Generation
3 OpenAI
Ga a
Xa
(1)
S OpenAI
Ga
(xa, ya)
0.021
Re-generate times
Somai
Ya ga(Xa)
(K)
ga
Xa
D (xa (89)
OpenAI
SB OpenAI
Ga
0.004
(ii) Iterative Re-Generation
Ya f- Ga(xa (80)
Figure 1: The two-stage framework loveraging fingerprints in generative models. In (I) Generation Stage, models generate output in traditional ways and optionally re-generate the outpul k E [1...] times to enhance the fingerprints. The process ensures consistency of the modality in iterative re-generation, i.e., text-to-text and image-to-image. In (II) Verification Stage, the authentication of data ownership established by assessing the distance between the suspected data (left) and its re-generated version (right). There exists distinguishable margin between the distances by authentic generator (Ga, the middle and the bottom examples) and contrasting benign generator (Ge: the top example), exemplified by models from OpenAl (Ga) and Stability AI (Ge), respectively.
Traditionally, the primary approach for safeguarding IP of the contents generated by AI generator has involved embedding subtle but verifiable watermarks into their outputs, such as text (He et al. 2022a b Kirchenbaner et al. 2023a), images (Zear et al. 2018 Zhao et al. (023b) and code (Lee et al.) 2023 These watermarking techniques typically involve adding supplementary information to the deep learning model's parameters and architectures or direct post-processing alterations to the generated outputs. However, these alterations could potentially degrade the quality of the generated content. An alternative strategy has been the classification of data produced by specific model to distinguish it from content generated by other models or humans (Solaiman et al. 2019b [ppolito et al.] 2020 Nonetheless, this often requires training additional classifiers to verify authorship, raising concern about their ability to generalize and maintain robustness across evolving generative models, especially with few training samples.
Another approach has been to classify data from a specific model to tell apart from data created by other models or humans (Solaiman et al. 2019b [ppolito et al. 2020). However, this usually neods extra classifiers to confirm authorship, which can be challenging. These classifiers might struggle stay effective and robust generative models evolve, especially with limited training samples.
In response to the challenges of authorship authentication and IP protection, our approach is to exploit the inherent characteristics of generalive models. Firstly, we recognize that generative models possess unique attributes akin to model fingerprints such as specific styles and embedded knowledge. In the Verification Stage of our framework, we utilize these implicit fingerprints by measuring the distance D between the genuine data samples with content re-generated by the authentic and contrasting models. Secondly, enhance the distinctivs nature of these fingerprints, approach in the Generation Stage involves using the original
2

---

Published in Transactions on Machine Learning Research (09/2024)
model to iteratively re-generate outputs from previous iterations. This process is grounded in fixed-point theory (Granas & Dugundji 2003) and its practical applications. Through this iterative re-generation, the model's inherent fingerprints become more evident, enhancing the effectiveness of our verification process.
In Figure ! we present a conceptual framework for authorship verification through re-generation.
Stage I: Generation The authentic generator targets producing outputs that involve stealthy but sig- nificant signatures that are distinguishable from other generalive models or humans. We consider two distinct approaches: (i) "Trdditional Generation' produces the authentic outputs Va from given text imput as a prompt, i.e., La (a(aa)) (Ip), where z "Storm on Sea of Galilce"; and (ti) 'Tterative Re- Genernatiii enhances the model's unique signature by re-generating the data multiple times using 're-painting or "para- phrasing' mode, (.e., xa (*++)) Ga ). Here Gu is the authentic generative model which is DALL-E (Ramesh et al. 2021 in this example.
Stage II: Verification In this stage, authentic model Ga verifies the origin of its artefact La by comparing the 'distance' between aa and its re-generation by the authentic model Ga (2a)) or other contrasting models Ge(ara). Intuitively, the one-step regeneration distance of an image originally generated by the authentic model, such as DALL-E by OpenAI, expected be smaller when compared itself than contrasting model not involved in its initial generation, i.e., D(xa: Ga(a)) < D( Fe(x:a). Furthermore, the more re-generations an image undergoes during the Generation Slage, the lower its one-step regeneration distance of the authentic model becomes at the Verification Stage, i.e., D( >>
(i) Ga(x B(x Go( )), when
We summarize the key advantages and contributions of our work as follows:
We validate the effectiveness of using re-generated data key indicator for authorship verification. This approach is designed to be functional in black-box settings and applics across various generative applications, such as Natural Language Generation (NLG) and Image Generation (IG).
We introduce an iterative re-generation technique to enhance the inherent fingerprints of generative models. We use fixed-point theory to demonstrate that modifications achieved through re-generation converge to minimal edit distances. This ensures a distinct separation between the outputs of authentic models and those generated by other models.
We have developed a practical verification protocol that streamlines the process of data ownership validation in generative models, This protocol is especially useful in legal settings, as eliminates the need for generators disclose their model parameters or watermarking strategics, thereby preserving confidentiality and proprietary integrily.
A notable advantage of our approach its reliance solely on the standard generative models, without resorting to additional interventions, including (1) manipulating or fine-tuning generative model parameters, (2) post-editing the outputs, or (3) additional independent classification models for verification. This simplicity in design not only preserves the original quality of the generated content but also enhances the feasibility and accessibility of our verification method.
2 Related Work
Recent advancements in the field of generative modeling, exemplified by innovations like DALL E (Ramesh et al.)), Stable Diffusion (Rombach et al. 2022), ChatGPT, Claude, Gemini, and others. However, this prolif-
eration of synthetic media has simultaneously raised ethical concerns. These concerns include the potential
for misuse in impersonation (Hernandez) 2023 Verma 2023), disscmination of misinformation (Pantserey
2020 Hazell 2023 Mozes et al.] 2023 Sjouwerman 2023), academic dishonesty (Lund et al.] 2023) and
copyright infringement (Brundage et al. 2018 Rostamzadeh et al.) 2021 He et al. 2022a Xu & He 2023)
In response, there is an incrcasing focus on the need to trace and authenticate the origins of such content
prevent its illegitimate use in AIGC. Considering the distinct nature of image and text, we will review the authorship identification in image and text generation models separately.
3

---

Published in Transactions on Machine Learning Research (09/2024)
Authorship Identification for Image Generation Models
Traditional image watermarking methods involve imprinting unique watermarks onto generated images, either through direct alterations to pixel values in the spatial domain or by embedding watermarks into altered image forms in the frequency domain (Cox et al. (008).. Recent deep learning techniques have
proposed leveraging neural networks to encode concealed information within images (Zhu et al.) 2018 Yang
et al. 2019 Ahmadi et al. 2020 You et al. 2020). These met ensure that subsequent transformalin applied to watermarked images preserve the integrity of the embedded information (Fermandez et al. 2022
2023). However, given the escalating concerns regarding deep fakes (Brundage et al. 2018 Harris 2019
new methodologies have been proposed to attribute the origin of an image by identifying subtle, machine-
detectable patterns unique to GAN-generated images (Marra et al., 2019: Afchar et al. 2018 Gūera & Delp
2018
Yu al. 2019 Zhang et al. 2019: Durall et al. 2020 Liu et al.) 2020).
Similarly, Fernandez et al. 2023 introduce a binary signature directly into the decoder of a diffusion model,
resulting in images that contain an imperceptibly embedded binary signature. This binary signature can be accurately extracted using a pre-trained watermark extractor during verification. Given the escalating con- cerns regarding the misuse of deep fakes, as highlighted in the literature [Brundage et al. 2018 Harris 2019))
several studies have proposed methodologies for attributing the origin of an image, specifically discerning betweon machino-generated and authentic images. This task is rendcred feasible through the identification of subtle, yet machine-detectable, patterns unique to images generated by Generative Adversarial Networks
(GANs). evidenced in recent research (Marra et al. 2019 Afchar et al.] 2018 Güera & Delp, 2018 Yu et al. 2019). Furthermore, the detection of deep fakes is enhanced by analyzing inconsistencies in the fre- quency domain or texture representation between authentic and fabricated images, as indicated in recent
studies [Zhang et al. 2019 Durall et al. 2020 Liu et. al. 2020
Authorship Identification for Natural Language Generation Models
Likewise, content generated by text generation models is increasingly vulnerable to various forms of misuse, including the spread of misinformation and the training of surrgatt models (Wallace et al., 2020 Xu et al. 2022 Consequently, a growing interest has been in protecting the authorship (or TP) of text generation text.
models or detecting
A straightforward solution is to incorporate watermarks into the generated text. However, unlike images, textual information is composed of discrete tokens, making the watermarking process for text difficult en- dcavor due to the potential for inadvertent alternation that can change its semantic mcaning (Katzenbeissor & &Pelitolas 2000). One solution to preserve semantic integrily during watermarking involves synonym sub- stitution (Topkara et al. 2006; Chang & Clark 2014 He et al. 2022a). Nevertheless, the simplistic approach to synonym substitution is vulncrable to detection through statistical analysos. In response, He ct al. (202bb) have proposed a conditional synonym substitution method to enhance both stealthiness and robust of substitaution-based watermarks. Moreover, |Venugopal et al.] (2011) adopted bit representation to encode semantically similar sentences, enabling the selection of watermarked sentences through bit manipulation.
The previously discussed methods have been centered on applying watermarks through post-editing. How- ever, with the emergence of L.L.s, there has been a significant shift towards developing watermarks tailored for LLMs to identify machine-generated text. A notable approach in this area employs biased sampling strategics to alter token distribution at each generation step, favoring tokens from specific pre-defined cat- egories (Kirchenbauer et al. 2023a b Zhao et al.] 2023a). ). Despite their innovation, these methods face vulnerabilitics to "rewriting" attacks, where watermarked sentences are paraphrasod either automatically or manually, thus challenging the identification of original authorship (Christ al., 2023). To address this issue, Kuditipudi et al. (2023) propose robust approach that maps sequence of random numbers gener- ated from randomized watermark key to the outputs of a language model. This technique maintains the watermark's detectability, notwithstanding text alterations such as substitutions, insertions, or deletions.
Interest in host-hoe detection has surged as a complementary measure to watermarking. This trend is driven by the fact that developers often keep the details of their watermarking algorithms confidential to prevent them from being compromised if leaked. Depending on whether machino-generated or human-authored text samples are available, one can utilize either zero-shot or training-based detection methods. Zero-shot
4

---

Published in Transactions on Machine Learning Research (09/2024)
detection relies on the premise that language model-generated texts inherently contain detectable markers, identifiable through analysis techniques such as perplexity (Idnay et al.
2022 Tian 2023 or average per-
token log probability (Solaiman et al. 2019a Mitchell et al. 2023). The training based approaches leverage
features from pre-trained language models to distinguish between bachine-generatee and human-authored
texts (Solaiman et al. 2019a Bakhtin el. al. 2019 Jawahar et al. 2020 Chen et al. 2023 However, these
approaches yield a binary outcome, classifying texts as machine-generated or humannggmeeann gennantee.eeaed.... Instead, our approach can determine the origin of text generated by any LLMs, moving beyond binary outcomes.
3
Background
The most recent advanced large generalive models usually support two modes for generating outputs:
Prompt-based Generation (Generation mode (g)): conditioned on the given prompts pp. expressed as
The authentic generator & produces outputs æ.
Fa = G())
(8) (zp).
(1)
The selection of prompt inputs, denoted as Tp depends on the modalities supported by the generative models. These can vary widely, ranging from textual descriptions to images.
The generators can also "paraphrase" the intended outputs, including texts or images, by reconstructing the content,
Paraphrasing Content (Paraphrasing mode (p)):
x (new) G(v) (x: (o))))))
As examples of Natural Language Generation (NLG), we prompt the Large Language Model (LLM) to "paraphrase" a sentence. As an image generalion (IG) example, given a generated image La, the "paraphrasing" process will be (1) rebuilding partial images of
round-trip translation (Gaspari 2006
the randomly masked region [t] in the original image (nld)) i.e. xa 2nno [t] G( (M()) (von Platen
et al. 2022). and (2) merge these rebuilt. portions whole image as the "paraphrased" output,
(new) Merge({x)) (new) (())
(3)
This iteralive re-generation uses prior outputs as inputs and keeps their modality consistent. (0) the initial output from the prompt-based generation.
Our method will use Prompt-based Generation mode for initial output generation and Paraphrasing Content mode for both (1) ileralively polishing the generaled content and (2) authorship verification.
4 Methodology
Our research primarily focuses on the threat posed by malicious users who misuse generated content without authorization. Specifically, we delve into cases where the owner of authentic generative models, referred to as Ga, allows access to their models in a black-box fashion, permitting external queries to their APIs for content generation. This black-box setting is consistent with the current application practices of Large Foundation Models. Hereby, unscrupulous users could take advantage of the generated content, Va, while disregarding the legitimate creator's license for their own profits. To address this issue, API providers can actively monitor the characteristics of publicly available data to identify potential cases of plagiarism misuse. This can be accomplished by applying the re- generatiion and measuring the corresponding edit distance in the verification stage, as described in Section 4.2 To enhance verification accuracy, the authentic model Ga can employ an iterative re-generation approach to boost the fingerprinting signal, as introduced and proved in Section [.3] If there are suspicions plagiarism, the company can initiate legal proceedings against the alleged plagiarist through a third-party arbitration, following the verification protocol (see Algorithm 2 on the output with iterative re-generation (see Algorithm 1), as demonstrated in Section 4.1 The motivation and intuition of
the approach proposed in Section 4.1 explained in Sections 4.2 and
5

---

Published in Transactions on Machine Learning Research (09/2024)
Algorithm Generation Algorithm for Stage I.
Input: Prompt imput 2p for generation (text or image) and the number of iterations K. (l)) and g (-)
indicate the generalion and paraphrusing modes of the authentic generative model respectively. Output: The generated content (text or image) with implicit fingerprints.
1: Ca + g (2
(0)
> Initial generation from prompts Bp using generation mode (()),
2: for k + 1 to K do
b Iterate steps. > Re-generation using peraphasing mode with consistent types.
va (k) g (na 1)
4: end for
5: return za (K)
Algorithm Verification Algorithin for Slage II.
Data sample za (K) generated by authentic generator Go and another generator for contrasting Ge. The threshold d for confident authentication.
Input:
Output: Unauthorized usage according to a contrasting generator.
1: Ya - G/Pp) (x)) (k)
Regenerate data by model glP) in paraphrasing mode. > Regenerate data by model g( in paraphrasing mode, Calculate the exceeding distance ratio.
ye - G. (x. (K))
3: r + Dyyer Ta (K) (D Ta )
return > 1 6
4.1 Data Generation and Verification Protocol
The defense framework is comprised of two key components, responding to the Generalion and Verification
Stages in Figure !
(1) Iterative Generation (Algorithm which progressively enhances the fingerprint signal in the gen- erated outputs. Initially, prompt input Tp is used to generate the first output xa using the generative model G in generation mode ((a), This output is then iteratively re-generated for K steps using the same model but in peraphrasing mode, g(r), ensuring the type consistency of the content. Each iteration aims to reinforce the unique fingerprint of the authentic model in the generated content.
(2) Verification (Algorithm 2 is responsible for confirming the authorship of the data sample through one-step re-generation process using both authentic model Ga and suspected contrasting model Ge in paraphrasing mode. The authentic and contrasting samples then distinguished by their ratio with confidence margin 8 0.
Our verification protocol takes inspiration from human artists' capability to reproduce their work that closely resembles the original. Similarly, our process of iterative re-generation mirrors the way artists refine their unique writing or painting styles. Moreover, the distinctive 'style' the generative model becomes increasingly pronounced with each re-generation cycle, as it converges to more 'stable' output. This process is formulated by the iterative functions and their tendency to converge fixed points proved in Theorem
4.2 Authorship Verification through Re-Generation Distance
An authentic generative model G. that aims to distinguish between the data samples it generated, denoted as Fa, with the benign samples ze generated by other models G. for contrast. Unless stated otherwise, the generators G operate in paraphrasing mode in the following discussion, ensuring a uniform output modality during the re-generation process. To verify the data, the authentic model (1) re-generates the data G.(w) and (2) evaluates the distance between the original sample and the ro-generated sample, defined as d(x,, 9) ())()),)) In essence, samples produced by the authentic model are expected to exhibit lower 'self-edit" distance, they share the same generative model Ga, which uses identical internal knowledge, such

---

Published in Transactions on Machine Learning Research (09/2024)
writing painting styles, effectively serving model fingerprints. In mathematical terms, we have ((Ga( < (aee, xe),
(4)
i.e. d(za, 9a) < d( Ga).
(5)
Consequently, models can identify the authentic samples generated by themselves by evaluating the 'self- edit' distance, which can be viewed as a specialized form of classification function for discriminating the authentic and contrasting models. Additionally, the ro-generation process and corresponding 'odit' distances can serve explainable and comprehensible evidence to human judges.
4.3 Enhancing Fingerprint through Iterative Re-Generation
While we have claimed that the data samples generated through the vanilla generative process can be verified, there is no theoretical guarantee regarding the 'self-edit' distance for certilying these samples using the authentic model. To address this limitation, we introduce an iterative re-generation method that improves the finerprinting capability of the authentic generative model, as it manages to reduce the 'self-edit' distances. This property will be utilized in verification, as the re-generation step in Verification Stage serves as the (K + 1)-th re-gencration step after K steps the Generation Stage regarding the authentic model. Our thcoretical foundation assumes the L-Lipschitz constant of the generative model satisfying L (0, 1). While measuring the exact Lipschitz constant for deep generative AI model is challenging, especially for proprietary models, this property is empirically verifiable and we find it satisfied in many generative Al models, as presented in Appendix
Definition 1 (The Fixed Points of a Lipschitz Continuous Function) Given multi-variable func- tion f R - R is L-Lipschitz continuous, ie., [lf(x) f(y) L || - yll, where L E (0,1). For any initial point (0)),, the sequence (0) k=u is acquired by the recursion ((++1) = f(x(()). The sequence conwerges to a fized point x", where x² = f(x).
(The Convergence of Step Distance for k-th Re-generation) Assuming that the Läps- chitz constant L of function f, which can be presented a generative model, the distance between the input and output of the K-th ileration is bounded by
Theorem
a (K++) (K)
S LK (xx()) xx
(6)
and the dislance converges to 0 given (0,1)
Proof We apply L-Lipschitz continuous property recursively,
| (K+1) (K) (K)) - (xx
< L | (K) - x 1111 L- ( (K 11) (Kx
< 2 ||00 (K 11) -K(K-21 s
x * |ax (2) x 10
(7)
The theory can be extended to distance metrics in Banach space.
Theorem (Banach Fixed-Point Thcorem) (anacch 1922 Ciesielski 2007) Let (X. be complete
metric space, and f X + X' is contraction mapping, if there cxists I. E (0. 1) such that for all E X
D(((),, < L. (xx
(8)
Then, we have the following convergence of the distance sequence similar to Theorem
(k+)) x (k)) < K Mi (.))
(9)
We estimated L for Stable Diffusion models with results presented Appendix C.3

---

Published in Transactions on Machine Learning Research (09/2024)
5 Experiments
This section aims to demonstrate the efficacy of our re-generation framework of authorship authentication on generated text and image separately. For both Natural Language Generation (NLG) and Image Generation (IG) scenarios, in Sections 5.2 and 5.3 we first generate the initial intended data samples followed by several steps of "paraphrasing' (for NLG) or 'inpainting' (for IG) as ro-gencration, detailed in Algorithm | Then, we test the properties of these samples by three series of experiments.
1. Distance Convergence: We verify the convergence of the distance between all one-step re- generations k E [I..K].
Discrepancy: We illustrate the discrepancy between the distances by the authentic generative models and the "suspected" other models for contrast.
3. Verification: We report the verification performance using precision and recall of the identified samples by the authentic models vs those from other contrasting models.
5.1 Experimental Setup
Despite falling under the same framework for authorship verification, Natural Language Generation (NLG) and Image Generation (IG) use distinct generative models and varying metries for measuring distance.
Gencrative Models. For text generation, we consider four generative models: 1) M2M (Fan et al. 2021 multilingual encoder-decoder model trained for many-to-many multilingual translation; 2) mBART- large- 50 (Tang et al. 2021 ; model fine-tuned mBART for multilingual machine translation between any
pair of 50 languages; Cohere: large language model developed by Cohere; 4) GPT3.5-turbo (version:
0613): chat-based GPT3.5 model developed by OpenA1
For image generation, we examine five primary generative models based on the Stable Diffusion (SD) archi- tecture (Rombach et al.) 2022). All models are trained on a subset of the LAION-2B dataset (Schuhmann ltt al.] (022) consisting of CLIP-filterd image-text pairs. These models are: 1) SDv2.1; 2) SDv2; 3) SDv2.1 Base; 4) SDXLv1.0 (Podell et al. 2023 , which distinguishes itself by employing an ensemble of experts pipeline for latent diffusion, where the base model first generates noisy latent that is refined using specialized denoising model 5) SDXL Base0.9 (Podell et al. 2023 More information model architecture and training, and the quality of re-generated images is demonstrated in Appendix C.1
Distance Metrics. To gauge the similarity between generated outputs, we employ three popular similarity metrics for NLG experiments, 1) BLEU calculates the precision of the overlap of various n-grams (usually 1 to 4) between the candidate and the reference sentences (Papineni et al. 2002);; 2) ROUGE-L calculates the F-1 score of longest common subsequence between the candidate and reference sentences Lin 2004) and 3) BERTScore computes the similarity between candidate and reference tokens using cosine similarity on their embeddings. Then, the token-level scores are aggregated to produce a single score for the whole text (Zhang et al. p For IG experiments, we consider the following distance metrics: 1) CLIP Cosine Distance measures the semantic similarity of two images using pre-trained CLIP image-text models (Radford et al. 2021): 2) LPIPS compares perceptual style differences between two images (Zhang al. 2018); 3) Mean Squared Error (MSE) serves as a pixel-level metric that compares all raw pixel values in the image pair; 4) Structural Similarity Index (SSIM) assesses image degradation based on luminance, contrast, and structure (Wang et al. 2004). We transform all similarity scores E [0, to distances d by d=1-5.
Note that we gauge the success of our approach based on the satisfactory performance of any of these metrics when applied to the verification of generative models.
We have also studied GPT4 and present its corresponding results in the Appendix D.2 3 Addiitionlly, explored other variants, including SDv1.5, SDv1.4, and Nota-Al's SDM Base. The corresponding experiments and results are provided in Appendix C.
8

---

Published in Transactions on Machine Learning Research (09/2024)
M2M
0.6
mBART
0.3
D TScre
Dist-ROUGEL
0.20
Dist-BLEU
Cohere
0.4
0.15
0.10
0.1
0.05
0.0
0.0
0.00
8
10
iteration
iteration
iteration
Figure 2: The convergence analysis of the distances in iterations based on various metrics on the re-generated
text of 200 samples from in-house datasets.
5.2 Natural Language Generation Experiments
In the study of text generation, the primary objective is to produce sentences that fulfill specific require- ments, including translation, paraphrasing, summarization, etc. Then, sentences via "paraphrasing' them. This study focuses on machine translation (specifically from French to English) as the primary generation task] F Considering that M2M and mBART are restricted to machine translation tasks, we utilize round-trip translation as a way for paraphrasing. Specifically, for each round- trip translation step, an English input sentence first translated into French and then translated back English. We repeat this process multiple times to observe the change of the 'edit" distances. To reproduce the primary experiment, i.c., Fr-En translation, using GPT3.5-turbs and Cohere, we perform zero-shot prompling using the following prompts:
re-generate intended output
Translate to English: You are a professional translator. You should translate the following senlence to English and output the final result only: (INPUT)
Translate to French: You are a professional translator. You should translate the following sentence to French and output the final result only: (INPUT)
Text generative models have been known exhibit outstanding performance when test data inadvertently overlaps with pro-training data, phenomenon referred to as data contamination (Magar & Schwartz 2022) To address this potential issue, sample 200 sentences from the in-house data the starting point for each model. To mitigate biases arising from varied sampling strategies, we set the temperature and top to 0.7 and 0.95 for all NLG experiments.
Distance Convergence. The dynamics of the distance change across three metrics and various generative models are depicted in Figure 2 We observe a remarkable distance reduction between the first and sccond iterations in all settings. Subsequently, the changes in distance between consecutive iterations exhibit a diminishing pattern, tending to converge after approximately 5-7 rounds of re-generation. These observed trends are consistent with the Fixed-Point Theorem claborated in Scction
Discrepancy. In our previous study iterative re-generation using the same model, we observe the convergence of 'edit' distances which can be utilized to distinguish the authentic model from its counterparts. As delineated in Section [.2] for each French sentence from the corpus, we apply the prompt-mode of authentic model yield 2a via a translation. Both authentic and contrasting models are considered to perform onc-step re-generation of E. to obtain y for verification. We measure the distance between and (including yo and yz). As illustrated in Figure 3 the density distribution associated with the authentic model demonstrates a noticeable divergence from those of models for contrast, thus affirming the
In addition machine translation, examine paraphrasing and summarization as the generation tasks in Section

---

Published in Transactions on Machine Learning Research (09/2024)
Density Distribution over Disi-BLEU (k=1)
M2M
mBART
@PP33.5-urbo
Density
Cohere
0.6
0.4
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.90
0.75
1.00
Density Distribution Dist-BLEU (k=5)
2.0
1.5
5tttubb
Densty
Cohere
1.0
0.5
0.0
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
Figure 3: Density distribution of one-step re-generation among four text generation models, where the input the one-step re-generation is the k-th iteration from the authentic models. The authentic models from left to right are: 1) M2M, 2) mBART, 3) GPT3.5-turbo, and Cohere.
hypothesis discussed in Section 4.2 This pattern also holds when using ROUGE-L and BERTScore for distance measures, evidenced by their respective density distributions in Appendix D.I
We observe the difficulty of distinguishing Cohere from other models merely based on the outputs from the first iteration, i.e., without re-generation. We attribute the distinctive behavior of Cohere to its relatively slower convergence than other models However, depicted Figure 2 the distances observed in subso- quent iterations of the same model experience substantial reduction. This implies the re-generated outputs in the Generation Stage possess enhanced fingerprints. In particular, we can derive xa from itcrations of (.). Figure shows that increasing & euhances the differentiation of the authentic model''s densily distribution compared other models. This distinction becomes evident even the case of Cohere, which remains indistinguishable at h 1. This enhancement for Cohere is also corroborated in the verification experiments in the next paragraph.
Verification. We employ Algorithm 2 ascertain if a given sentence originates from the authentic models. The determination hinges the threshold parameter, 5. Thus, we designate M2M as the authentic model, while using mBART, Cohere, and terrrbb-turboo as contrasting models to determine the optimal value of ö. As indicated Table a threshold of 0.05 cortifies that the three contrasting modcls can validate that more than 93% of the samples are derived from M2M. As anticipated, an increase the value of augments the stringency criteria, resulting in reduction in verification precision. Therefore, we fix 8 at 0.05 for ensuing evaluations unless stated otherwise.
As indicated in Table 2 our approach undertakes the validation of authorship, yielding precision exceeding 85% and a recall rate surpassing 88% across M2M, mBART, and CPT3.5-turbe Morcover, both precision and recall metrics improve with additional re-generation iterations. Although with a slower convergence speed on Cohere, the verification performance on its samples improved significantly given more re-generation iterations, see Cohere lines in Table 2
5Tehe underlying reason behind the slow convergence for Cohere is investigated in Appendix D.3.1
10

---

Published in Transactions on Machine Learning Research (09/2024)
Table 1: The precision of differentiating contrast models (ge: mBART, Cohere, and GPT3.5-turbo) from the authentic model (9., M2M) using various ó E {0.05, 0.1, 0.2, 0.4), based on BLUE, ROUGE-L, and BERTSccre, respectively.
mBART ROUGE
Cohere ROUGE
GPT3.5-turbo
8
BLEU
BERT
BLEU
BERT
BLEU
ROUGE
BERT
0.05
94.0
92.0
91.0
99.0
99.0
99.0
93.0
89.0
92.0
0.10
91.0
92.0
90.0
98.0
99.0
99.0
92.0
88.0
92.0
0.20
91.0
92.0
90.0
98.0
99.0
99.0
91.0
87.0
90.0
0.40
88.0
88.0
85.0
95.0
97.0
99.0
87.0
85.0
85.0
Table 2: The precision and recall of verifying the authentic models (Ga) using different contrasting models
(G.).
M2M
mBART
Cohere
GPT3.5-turbo
Precision
Recall f
Precision
Recall
Precision f
Recall f
Precision Recall
M2M
94.0
98.0
99.0
99.0
93.0
95.0
mBART
85.0
89.0
100.0
100.0
89.0
92.0
Cohere
60.0
64.0
63.0
57.0
65.0
51.0
GPT3.5-turbo
87.0
92.0
90.0
92.0
99.0
99.0
(b)
M2M
94.0
99.0
100.0
100.0
95.0
97.0
mBART
85.0
93.0
100.0
100.0
90.0
96.0
Cohere
75.0
83.0
73.0
76.0
63.0
69.0
GPT3.5-turbo
89.0
92.0
93.0
95.0
97.0
98.0
(c) 5
M2M
94.0
98.0
98.0
99.0
95.0
99.0
mBART
91.0
96.0
100.0
100.0
88.0
94.0
Cohere
71.0
81.0
83.0
69.0
73.0
GPT3.5-turbo
90.0
94.0
94.0
95.0
97.0
5.3 Image Generation Experiments
The main objective of the image generation task to produce image given text prompt using generative model, a.k.a prompt-mode. To generate the initial proposal of images, sample 200 captions prompls each from MS-COCO dataset (COCO) Lin el al. 2014h and Polo Club Diffusson DB dataset (POLO) (Wang et al. 2022). then we generate initial images x (0) corresponding to the prompts using all assigned models. For re-gencration, we consider two scttings: (1) watermarking images through inpainting a pre-defined sub-regions and (2) fingerprinting euhancement through full image re-generation. The subsequent two paragraphs detail the methodologies for each setting.
Watermarking through Sub-Region Inpainting When re-generating authentic image we first mask a sub-region, f.e., 1/N (N = 10 in our experiments) of its pixels with fixed positions as the water- mark pattern. Then, all pixels in the masked regions are re-generated by inpainting using a generative model. Similar to text generation, the inpainting step is iterated multiple times, following Algorithm The comprehensive description of the watermarking procedure provided in Appendix B.1
Fingerprinting through Full-Image Ro-generation In the ro-generation setting, we first split all possible mask positions into N (N = 8 in our experiments) non-overlapped sets, coined segments, each with 1/N pixel positions. We parallelly reconstruct each segment based on the rest (N-1)/N pixels of the image as the context in gencration. Then, we reassemble these N independent segments into new full image y. When analyzing reconstructions of ya Ga(xx) by contrasting models Ye Gc(x)), there is an expectation that models may exhibit variations in painting masked regions due their inherent biases.
11

---

Published in Transactions on Machine Learning Research (09/2024)
Image
Iteration
Reration
Iteration
Iteration
Iteration
Initial Image
Iteration
Reration 2
Iteration
Iteration
Iteration
Image
Figure 4: The quality of fingerprinted images over multiple iterations of full-image re-generation using SDXL 0.9B.
CLIP Polo dataset
CLIP Coco dataset
LPIPS Polo dataset
LPIPS Coco dataset
0.036
0.042
SDv2.1
0.050
0.034
0.040
SDXLv1.0
0.045
SDv2
0.032
0.038
0.040
SDXL Base0.9
0.040
0.030
0.036
0.035
0.035
0.028
0.034
0.030
0.030
0.026
0.032
0.025
0.025
0
Iterations
lterations
lterations
Rteraiion
Figure 5: The convergence analysis of the distances in iterations based on CLIPS and LPIPS metrics re-generated images of 200 samples on Coco and Polo datasets.
In this study, to generate the samples from the authentic models, each model first generales 200 initial images (0) given the captions, which are then ro-generated over one to five iterations using 'inpainting' approaches. In the verification stage, by comparing ya and ye the original Ba aim to identify subtle model fingerprints based the 'edit-distance' from the original data to re-generated content. We use LPIPS and CTIPP similarity between image pairs to estimate their difference 0 Additionally, the consistency of the image quality during re-generated is demonstrated in Figure and a detailed discussion is provided in Appendix D33.2
Distance Convergence. Similar to text re-generation experiments, the re-generation distance converges for both watermarking and fingerprinting settings, as illustrated in Figures 5 and 11 indicated by con- sistent. downward trends across datasets and distance metrics. This implies that the re-generation process converges, with subsequent iterations yielding images that more closely resemble their predecessors. While our methodology proves efficacious in both scenarios, subsequent sections will prioritize the full-image regen- eration setting as it is independent of the masks, which are considered confidential to the generative model. Details about the watermarking setting can be found in Appendix B.1.1
6Tehe results based on MSF and SSTM also reported in Appendix R.2.1
12

---

Published in Transactions on Machine Learning Research (09/2024)
Denaity Distribution CLIP
SDv2.1
SDXLv1.0
SD-V2
SDXL 80.9
20
20
20
20
S0v2.1
15
S0XLv100
15
15
16
Density
Styd
10
5534 Besee 9
10
0
0.01
0.02
0.03
0.01
0.02
0.03
0.01
0.02
0.03
0.01
0.02
0.03
CLIP
CLIP
CLIP
CLIP
Figure 6: Density distribution of one-step re-generation among four image generation models Polo Datasel. The authentic models from left to right are: 1) SD 2.1, 2) SDXL 1.0, 3) SD 2, 4) SDXL Base 0.9.
Initial Image
Iteration
lteration
ltfratioon
20
20
20
20
SEN2
Density
50N2 Dane
SEALL
10
5
5
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
Initial Image
Iteration
Iteration
Iteration 5
SDv2.1
SExLv1.0
S0v2
Density
15
90v2.1
15
15
15
10
10
5
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
Figure 7: Verilying data generated by authentic 9, SDv2.1 and SDv 2.1 Base on Coco Dataset al various iterations using CLIP distance.
Discrepancy. our study, we focus on the setting iterative re-generation through inpainting and observe convergence that can reveal differences between models. Like the NT.G section, for verification, both authentic and contrasting models perform an additional one-step re-generation of va to obtain y and the CLIP distance is measured between the outputs. As illustrated in Figure b the one-step ro-generation density distribution of the authentic model predominantly peaks at lower values across all generative models. This indicates that authentic models can effectively distinguish their outputs from those of non-authentic models.
Then, we examine the effectiveness of 'inpainting' as re-generation for Generation Stage. As illustrated Figure 7 ro-generation can suecossfully cnhance their fingerprints by I = itcrations. While most models, average, may require fewer rounds of re-generation deeply impart their fingerprints, with more rounds of re-generation, even older models' fingerprints can be successfully enhanced. Overall, the quality of the images is retained during re-generation, as showcased in Figure 4 At the same time, the strength of the fingerprints embedded in model outputs is reinforced over iterations, as illustrated in Figure 7
Verification. In accordance with the text generation framework, we utilize Algorithm 2 to evaluate ver- ification performance, selecting optimal parameters
and 8 0.05 basod on the results of the text generation experiment. As demonstrated in Table 3. models reliably identify images from the authentic model, with precision often exceeding 80% and recall around 85%.
13

---

Published in Transactions on Machine Learning Research (09/2024)
Table 3: The precision and recall of verifying the authentic models Go using different contrasting models Ge on Polo Datasct, given & and 0.05.
Go
SD v2.1
SD v2
SD
v2.1B
SDXL 0.9
SDXL 1.0
9,
Precision
Recall
Precision 1 Recall f
Precision
Recall f
Precision
Recall f
Precision
Recall f
SD v2.1
80.0
86.0
99.5
99.5
98.5
99.5
99.0
100.0
SD v2
77.5
81.5
99.0
100.0
96.5
97.0
95.5
97.5
SD v2.1B
81.5
83.5
82.5
86.5
88.5
92.0
89.5
91.0
SDXL 0.9
97.5
97.5
96.5
98.0
99.5
99.5
92.0
93.5
SDXL 1.0
95.5
96.0
92.5
95.5
100.0
100.0
94.5
96.0
5.4
Generalization and Robustness Evaluation
To demonstrate the generalization of our approach, we further examine two popular text generation lasks, paraphrasing and summarization, the target generation tasks. The prompts for the prompt mode are:
Task Generalization
You are professional language facilitator. You should paraphrase the following sentence and output the final result only: {INPUT)
Paraphrasing:
Summarization: You are professional language facilitator. You should summarize the following document using one sentence: (INPUT)
We consider prompt-based paraphrasing for one-step re-generation (i.e., paraphrasing mode), opting for a k value of 5 due to its superior performance. As for backbone models for text generation tasks, we con- sider GPT3.5-turbo, Llama2-chat-7B (Touvron et al. 2023), and Mistral (Jiang et al.] (023a)). Table demonstrates that while paraphrasing and summa- rization tasks exhibit performance degradation com- pared to machine translation, our approach effectively distinguishes IPs among various models. This sup- ports the overall effectiveness of our approach across a wide range of text-generation tasks.
Table 4: The precision of verifying the authentic
models (Ga) using different contrasting models (G.). The target tasks are paraphrasing and summariza- tion.
G.
GPT3.5-turbo Precision f
Zephyr Precision f
Mistral
Ga
Precision
Parapbrasing
G. Zephyr Mistral
75.0
69.0
$4.0
69.0
74.0
76.0
Sunnar ization
GPT3.5-turbo
92.0
68.0
Robustness Evaluation To examine the robust- ness of our verification process, we corrupt the gen- erated outpuls using paraphrasing and perturbation attacks.
Zephyr Mistral
58.0
67.0
86.0
Our robustness assessment commenced with a paraphrasing attack targeting image generation. This experi- ment was designed to test the efficacy of our verification ion process in identifying plagiarized images. Specifically, we consider images that are originally generated by one authentic model (Model A) and then re-generated paraphrased by another attack model (Model B), coined as A B. We experiment with SD v2.1 as the authentic model A and SDXL 1.0 the paraphrasing model B.
In verification, we re-generate these paraphrased A B images using both the authentic and paraphrasing models to analyze the distance density distribution variations. Furthermore, we assess this paraphrasing attack at different rounds of generation x.! (K) where K is 1, 3, and 5 by the authentic model.
The results, represented in Figure S show comparisons between DDA (A B)) and D(A B, B,Ga(A B)), indicating the distance between the paraphrased image (created by A then paraphrased by B) and re- generated images.
We observe a significant challenge in attributing authorship the original creator model once the image is plagiarized (even at higher values of re-generation iteration K in Algorithm 1 The distance between the
14

---

Published in Transactions on Machine Learning Research (09/2024)
paraphrased image to the authentic model and the paraphrasing model cannot be differentiated making it increasingly difficult to distinguish whether the SDv2.1 model or another paraphrasing model generated the image.
However, the results also reveal a noteworthy strength in the methodology. There dis- cernible and consistently large distance when comparing paraphrased images to those gen- erated by a contrast model (i.e., unrelated model, one which was neither the authentic nor the paraphrasing model). This finding is cru- cial as it suggests that despite the challenges in direct attribution, our approach can reliably detect when an external model, not involved in the image's original creation its paraphras- ing, is falsely claimed as the author. Therefore, this method could potentially be leveraged to establish joint authorship in scenarios where the paraphrased image is claimed by a third party, ensuring proper credit given to the authentic and paraphrasing models involved in the image's creation.
lteration
20
DIy_SDXL1, G SDV2-)
Density
16
D(y_SDXL1, G_SDXL1)
D(y SDV2))
0.005
0,010
0.015
0.020
0.025
0,080
0.035
0.040
Clip Distance
Iteration
Density
15
10
Clip Distance
lteration 5
We investigate perturbation attacks in both
Density
text and image generation tasks. For our
NLP experiments, we randomly perturb X% of
the words precoding the onc-step re-gencration procedure by substituting them with random words. The value of X ranges from 10% to 50%. We designate GPT3.5-turbe thentic model. We set k 5, due to its out- performing performance. As depicted in Ta- ble 5 as the perturbation rate increases, we observe a gradual docline in the verification performance of our method. In general, the efficacy watermark verification remains rea- sonably positive. Nevertheless, we argue that perturbations in the range of 30% to 50% have notable adverse impact on the quality of the potential attackers.
0.005
0.10
0.015
0,020
0.025
0,030
0.33
0.640
Clip Distance
the
Figure The variations in the distance density distribu- tion of paraphrasing images through the authentic model and contrasting model. The paraphrased images are ini- tially generated by SDv2.1 (authentic model) and then para- phrased by models SDXL 1.0 at different itcrations K (1, 3 & 5) by the authentic model. Additionally, SDv2 acts as a contrasting model for the set of images which produced by SDv2.1 and then paraphrased by SDXL 1.0.
generated texts, rendering them significantly less valuable for
Table The robustness evaluation of image gen- eration under brightness perturbation Different Levels for Models SD v2, SD v2.1B, and SDXL 1.0 (k= 5).
Table The evaluation robustness evaluation for generation with perturbed substitution when k using precision.
Perturbation rates
M2M
mBART
Cohere
Perturbation rate
SD v2
SD v2.1B
SDXL 1.0
0%
90.0
94.0
95.0
0.00
76.0
97.5
94.0
10%
91.0
91.0
97.0
1.01
35.0
97.0
85.0
20%
$4.0
84.0
95.0
1.02
41.5
91.0
87.0
30%
74.0
1.05
34.5
94.0
59.5
40%
79.0
75.0
93.0
1.10
35.0
93.0
44.0
50%
69.0
65.0
92.0
1.50
23.5
91.5
41.5
15

---

Published in Transactions on Machine Learning Research (09/2024)
Regarding image generation, introduce two types of perturbations: Brightness alterations and Gaus- sian Noise. For brightness alterations, we modify the brightness of 10% of randomly chosen pixcls. As the intensity this perturbation increases, we observe a corresponding decrease in verification precision. No- tably, as detailed in Table G the precision for the SDXL 1.0 model declines sharply but stabilizes when the perturbation rate reaches 1.02. Beyond this point, the model's robustness significantly deteriorated. In our second experiment, we applied Gaussian noise with a mean (μ = 0) and standard deviation (a= = 4) a random selection of image pixcls. This process has negligible effect
Table 7: The robustness evaluation for image gener- ation under various lovels of Gaussian Noise pertur- bation, where μ = 0, o = 4 at iteration == 5.
Perturbation rates
SD v2
SD v2.1B
SDXL 1.0
0.00
76.0
97.5
94.0
0.01
82.0
94.5
82.0
0.05
100.0
98.5
91.0
0.10
97.0
99.0
95.0
0.20
99.5
100.0
93.5
0.50
99.0
99.0
89.5
1.00
99.5
99.0
66.5
verification accuracy across different. models, as shown in Table 7 Even with noise affecting up to 50% of the pixels, the models demonstrated high precision range of 89-99%, underscoring their robustness to substantial random noise.
Distance Differentiation between Natural and Al-Generated Images In order to assess the via- bility of our framework to detect plagiarism on nat- urally made images (i.e., shot on camera), we re- gencrate natural images from the MS COCO 2017 Evaluation set (Lin et al., 2014)) with previously used image generation models for one iteration. We com- pare the Clip distances between these natural im- ages and their respective re-generations to the dis- lance between the Al-generated images and their re-generation for one iteration by the corresponding models as presented distinction in the distance density distribution when
Table 8: Precision, Recall, and Fl Score for different thresholds in classifying GeneartGeerrated vs. AI- Generated images. The values are also translated into mean +/- T std.
Threshold
Precision
Recall
F1 Score
T (Natural)
(AI)
0.01
0.5797
1.000
0.7339
-2.1825
-0.6311
0.02
0.7418
0.8517
-1.8827
0.0914
0.03
0.8701
0.991
0.9266
-1.5820
0.8130
0.04
0.9280
0.942
0.9349
-1.2831
1.5364
0.9572
0.9004
-0.9833
2,2580
0.06
0.9716
0.719
0.8264
-0.6835
2,9814
Figure g There is clear
0.07
0.9801
0.600
0.7114
-0.3837
3,7038
Al-generated images re-generated using AT our Generation Algorithm [ the distance remains low whereas using a natural image for re-generation results in further distances even with the most advanced Al models.
To quantify this distinction, we applied various thresholds to these distances and evaluated our method's performance. The results, shown in Table Table S illustrate the trade-offs between precision and recall at different thresholds. For example, at a threshold of 0.03, we achieved a high balance with a precision of 0.8701, recall of 0.991, and an F1 score of 0.9266, demonstrating robustness of the method. To facilitate threshold selection, both Natural and Al-generated images, interpretation of each threshold's position relative to the data distribution, enhaucing the explainablility and reliability of the threshold selection.
demonstrate the number of standard deviation from the mean CLIP distance for
(threshold mcan)/std. This standardization provides
6 Conclusion
In this work, observe the intrinsic fingerprint in both text and vision generative models, which can be identified and verified by contrasting the ro-generation of the suspicious data samples by authentic models and contrasting models. Furthermore, we propose iterative re-generation in the Generation Stage to enhance the fingerprints and provide a theoretical framework to ground the convergence of one-step re-generation distance by the authentic model. Our rescarch paves the way towards a generalized authorship authentication for deep generative models without (1) modifying the original generative model, (2) post-processing to the generated outputs, (3) an additional model for identity classification.
16

---

Published in Transactions on Machine Learning Research (09/2024)
7.00
SD v2.1 (N)
SDXL 1.0 (N)
SD v2 (N)
6.00
SD v2.1B (N)
SDXL Base0.9 (N)
5.00
SD v2.1
SDXL 1.0
SD v2
Density
4.00
SD v2.1B
SDXL Base0.9
3.00
2,00
0.08.00
0.02
0.04
0.06
0.08
0.10
Clip Distance
Figure 9: Comparison of Density Distribution of Re-generation Distances in Verification Stage, acquired by Natural and AI Image Re-generations.
Limitations
Our approach, while effective in many scenarios, has several limitations. Firstly, it assumes that malicious users employ the authentic model and then directly utilize or disseminate them. However, users may modify the content to circumvent. IP infringements, e.g., involving other generative models. This poses a challenge for our method in protecting IP claims for altered content, which was also highlighted as fundamental challenge in verifying Al-generated content QJiang al. 2023b).. For image generation tasks, our approach relies the inpainting methodology, which is native to the stable diffusion set of models (as described in C.1. As result, we currently cannot empirically verify the effectiveness of our approach for other image generative models, such as GAN Esser et al., 2021 Kang et al. 2023) and VAËs (Vahdat & Kautz 2020). Nonetheless, considering that many of the otete- image generators are based on similar diffusion based architectures, it is reasonable to hypothesize that our method is applicable to them as well. Lastly, while our approach effectively diffcrentiates between natural and AT-generated images, determining the optimal threshold for this dilferentiation requires careful balancing of precision and recall. This need for the hyperparemeter search highlights the complexity of developing universally applicable verification method across various content types and generation models.
References
Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen. Mcsonet: a compact facial video forgery detection network. In 2018 IEEE international workshop on information forensics and security (WIFS), pp. 1-7. IEEE, 2018.
17

---

Published in Transactions on Machine Learning Research (09/2024)
Mahdi Ahmadi, Alireza Norouzi, Nader Karimi, Shadrokh Samavi, and Ali Emami. Redmark: Framework for residual diffusion watermarking based on deep networks. Expert Systems with Applicalions, 146:113157, 2020.
Anton Bakhtin, Sam Gross, Myle Ott, Yuntian Deng, Marc Aurelio Ranzato, and Arthur Szlam. Real or fake? learning to discriminate machine from human generated text. arXiv preprint arXiv:1966.0800 03351, 2019.
Stefan Banach. Sur les opérations dans les ensembles abstraits et leur application aux équations intégrales. Fundamenta mathemalicae, 3(1):133-18) 181, 1922.
Miles Brundage, Shahar Avin, Jack Clark, Helen Toner, Peter Eckersley, Ben Garfinkel, Allan Dafoe, Paul Scharre, Thomas Zeitzoff, Bobby Filar, et al. The malicious use of artificial intelligence: Forecasting, prevention, and mitigation. arxiv preprint Xiv: 07228, 2018.
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In Proceedings of the IEEE/CVE /CFF international conference on computer vision, pp. 9650-96600 2021.
Ching-Yur Chang and Stephen Clark. Practical Linguistic Steganography using Contextual Synonym Sub- stitution and Novel Vertex Coding Method. Computational Linguistics, 40(2):403 448, 06 2014. ISSN 0891-2017. doi: 10.1162/COLI 00176. URL https://doi. org/ 1162/COLI, a a0176
Yutian Chen, Hao Kang, Vivian Zhai, Liangze Li, Rita Singh, and Bhiksha Ramakrishnan. Gpt-sentinel: Distinguishing human and chatgpt generated content. arXiv preprint arXiv:2305. (:Xi:2235.00769, 2023.
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. orXiv preprint arXiv:2306.0919. 2023.
Krzysztof Ciesielski. On stefan banach and some of his results. Banach Journal of Mathematical Analysis, 1(1):1-10, 2007.
Ingemar J. Cox, Matthew L. Miller, Jeffrey A. Bloom, Jessica Fridrich, and Ton Kalker. Digital Watermarking and Steganography. The Morgan Kaufmann Series in Multimedia Information and Systems, 2 edition, 2008
Ricard Durall, Margret Keuper, and Janis Keuper. Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions. In Proceedings of the IEEE/CVP conference on computer vision and pottern recognition, pp. 7890-7899, 2020.
Patrick Esser, Robin Rombach, and Bjorn Ommer. Taming transformers for high-resolution image synthesis. In Proceedings of the IEFE/CV /CVF conference on computer vision and pattern recognition, pp. 12873-1288)
2021.
Angela Fan, Shruti Bhosale, Holger Schwenk, Zhiyi Ma Ahmed Ei-Kishky, Siddharth Goyal, Mandeep Baines, Onur Celebi, Guillaume Wenzek, Vishrav Chaudhary, el al. Beyond english-centric multilingual machine translation. The Journal of Machine Learning Research, 22(1):4839 4886, 2021.
Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Watermark- ing images in self-supervised latent spaces. In ICASSP 2022 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3054-3058, 2022. doi: 10. (0.109//CASSP44322.. 2022.9746058.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signa- ture: Rooting watermarks in latent diffusion models. arXiv preprint arXit:2303.15/33 2023.
Federico Gaspari. Look who's translating. impersonations, Chinese whispers and fun with machine trans- lation on the Internet. In Viggo Hansen and Bente Macgaard (ods.), Proceedings of the 11th Annual Conference of the European Association for Machine Translation, Oslo, Norway, June 19 20 2006. Euro- eamt- 1.19.
pean Association for Machine Translation. URL httpp://acllatthooogg.oorr
18

---

Published in Transactions on Machine Learning Research (09/2024)
Andrzej Granas and James Dugundji. Fized Point Theory, volume 14. Springer, 2003.
David Güera and Edward J. Delp. Deepfake video detection using recurrent neural networks. In 2018 15th TEFE International Conference on Advanced Video and Signal Based Surveillance (AVSS), pp- 1-6, 2018.
doi: 10.1109/ /A/// 2018.86311......
Douglas A. Harris. Deepfakes: False pornography is here and the law cannot protect you. Duke low and technology review, 17:99-120 127, 2019. URL https://api. www.ssmmscmoolllaa....... htpp::// org//orppusD::11555633
Julian Hazell. Large language models can be used to effectively scale spear phishing campaigns. arXiv preprinl Xiv:22000..000 06972, 2023.
Xuanli He, Qiongkai Xu, Lingjuan Lyu, Fangzhao Wu, and Chenguang Wang. Protecting intellec- tual property of language generation apis with lexical watermark. Proceedings of the AAAI Confer- ence Artificial Intelligence, 36( 16110))107558817766 Jun. 2022a. doi: 111609/aaai.v36110 https://ojs... aaai orggindex...o http://pppp///aaaarrrrca///////s
URL
Xuanli He, Qiongkai Xu, Yi Zeng, Lingjuan Lyu, Fangzhao Wu, Jiwei Li, and Ruoxi Jia. CATER: Intellectual property protection on text generation APIs via conditional watermarks. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (ods.), Advances in Neural Information Processing Systems, 2022b.
URL https://openrervie: wwt ott.://r........ooooooooooeeooor
Joe Hernandez. That panicky call from relative? it could be a thief using voice clone, fte warns. NPR, 2023. URL http:: npr
voocceeeoovvvveeeeeeeeeoeoe clones ai si-ssams--te
Alain Hore and Djemel Ziou. Image quality metrics: Psnr vs. ssim. In 2010 20th international conference on pattern recograition, pp. 2366 2369. IEEE, 2010.
Betina Idnay, Caitlin Dreisbach, Chunhua Weng, and Rebecca Schnall. A systematic review on natural language processing systems for eligibility prescreening in clinical research. Journal of the American Medical Informatics Association, 29(1):197-206, 2022.
Daphne Ippolito, Daniel Duckworth, Chris Callison-Burch, and Douglas Eck. Automatic detection of gener- ated text is easiest when humans are fooled. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 1808 1822, Online, July 2020. Association for Computational Linguis- URL httpp://aclanthoolggy http://mttooooooooo/000000000000 www.://.........maannnn.. ac1-main. 164
tics. doi: 10. 10.18653/v1 /106://///2200.ammmai....
Ganesh Jawahar, Muhammad Abdul Mageed, and VS Laks Lakshmanan. Automatic detection of machine generated text: A critical survey. In Proceedings of the 28th International Conference on Computational Linguislics, pp. 2296 2309, 2020.
Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. Mistral 7b. arXiv preprint XrXix:2310. 0..0625,.6.... 2023a.
Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. Evading watermark based detection of ai- generaled content. In Proceedings of the 2023 ACM SIGSAC Conference on Compuler and Communica- tions Security, CCS '23, pp. 1168-1181, New York, NY, USA, 2023b. Association for Computing Machin- cry. ISBN 9798400700507. doi: 10.1145/3566115.36223 3623189
URL https://dol wrg/oo.gr//oo 1145/11577771155
Minguk Kang, Jun Zhu, Richard Zhang, Jaesik Park, Eli Shechtman, Sylvain Paris, and Taesung Park. Scaling up gans for text-to-image synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10124 10134, 2023.
Stephan Katzenbeisser and Fabicn Petitolas. Information hiding techniques for steganography and digital watermaking. EDPACS, 28 6-)1122 2000. doi: 10.1201 1009// 000000793320 2...68..8.6.200022111/1 200000000000000800000000000 /30373.5. URL https: 7/doi. 1rt.o//000/111122/1009999 03210000///09999333..3 28. 6.20002200/333333.55
19

---

Francesco Marra, Diego Gragnaniello, Luisa Verdoliva, and Giovanni Poggi. Do gans leave artificial fin- gerprints? In 2019 IEEE Conference on Multimedia Information Processing and Retrieval (MIPR), pp. 506-511, 2019. doi: 10.1109/ MMI.........00.... Published in Transactions on Machine Learning Research (09/2024)
Bo-Kyeong Kim, Syyunn-Kyu Song, Thibault Castells, and Shinkook Choi. On architectural compression of text-to-image diffusion models. Xie preprint or 2rXiv:2305.1570 157988 2023.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. International Conference on Machine Learning, 2023a.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models. In The Twelfth International Conference Learning Represenlations, 2023b.
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Perey Liang. Robust distortion-free water- marks for language models. arXiv preprint arXit:2307.15593 2023.
Taehyun Lee, Seokhee Hong, Jaewoo Ahn, lggee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. Who wrote this code? watermarking for code generation. arXiv preprint arXiv:2305.1500 2023.
Chin- Yew Lin. ROUGE: A package for automatic evaluation of summaries. In Tert Summarization Branches Oul, pp. 74-81, Barcelona, Spain, July 2004. Association for Computational Linguistics. URL https: //aclanthology. srt.laattoooooy.orr//0-----0000 org/N04-1013
Tsung-Y: Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer EisionEECVV 2014: 19th European Conference, Zurich, Swilzerland, Seplember 6-12, 2014, Proceedings, Parl V 13, pp. 740-755. Springer, 2014.
Zhengzhe Liu, Xiaojuan Qi, and Philip HS Torr. Global texture enhancement for fake face detection in the wild. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition, pp. 8060-800 8069, 2020.
Brady D Lund, Ting Wang, Nishith Reddy Mannuru, Bing Nie, Somipam Shimray, and Ziang Wang. Chatgpt and a new academic reality: Artificial intelligence-writter written research papers and the ethics of the large lan- guage models in scholarly publishing. Journal of the Association for Information Science and Technology, 7505)5570-581, 2023.
Inbal Magar and Roy Schwartz. Data contamination: From memorization to exploitation. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguisties ( (Volume 2: Short Papers), pp- 157-165, 2022.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. Detectgpt: Zero-shot machine-genorated text detection using probability curvature. In International Conference Machine Learning, pp. 24950 24962. PMLR, 2023.
Maximilian Mozes, Xuanli He, Bennett Kleinberg, and Lewis D Griffin. Use of 1lms for illicit purposes: Threats, prevention measures, and vulnerabilities. arXiv preprint arXiv:2308. 2023.
Konstantin A. Pantserev. The Malicious Use of Al-Based Deepfake Technology as the New Threat to Psychological Security and Political Stability, pp. 37-55. Springer International Publishing, Cham, 2020. ISBN 978-3-030-35746-7. doi: 11.1007/978-33000-337/47 978-3 778-3-030-35746-733
3. URL https://doi. httt::://ed..orr/10.00077 or0/10.1007/
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: a method for automatic evaluation of machine translation. In Proceedings of the 40th Annual Meeting of the Association for Computational Linguistics, pp. 311-318, Philadelphia, Pennsylvania, USA, July 2002. Association for Computational Tinguistics. doi: 10.3115/1073083 1073335..0073335. 1073135. URL http:://acccaaaoooooooooo///////
20

---

Published in Transactions on Machine Learning Research (09/2024)
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXie:2307.01952 2023.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 2021.
PMT.,
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents.
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Πly Sutskever. Zero-shot text-to-image generation. In International Conference on Machine Learning, pp. 8821 8831. PMLR, 2021.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognétion (CVPR), pp. 10684-10695, June 2022.
Negar Rostamzadch, Emily Denton, and Linda Petrini. Ethics and creativity in computer vision. arXiv preprinl crXiv:2112.03111 2021.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion-5b: An open large- scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 255222277-,2,,, 2022.
Stu Sjouwerman. How ai is changing social engineering forever. Forbes, 2023. URL https::/www..rrbbbbbb com cot/:stteee/oootseeccoooo//////2 haap:////oooo----------aaannn-- socisooclllloooo wwwclaal-enginnernng--ooooo ?sh=2031e2c0321b
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Voss, Jeff Wu,, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. Release strategies and the social impacts of language models. arXiv preprint arXiv:1908. 100.00000000 2019a.
Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert- Horsert-Voss, Jeff Wu, Alec Radford, and Jasmine Wang. Release strategies and the social impacts of language models. CoRR, abs/1908.0990 092003, 2019b. URL http:///axxvv.ooo
09203
Yuqing Tang, Chau Tran, Xian Li, Peng-Jen Chen, Naman Goyal, Vishrav Chaudhary, Jiatao Gu, and Angela Fan. Multilingual translation from denoising pre-training. In Findings of the Association for Computational Linguistics: ACI-IICNIIP 2021, pp. 3450 3466, Online, August. 2021. Association for Computational Linguisties. doi: 10.18653/v112021..hmm findings-acl.304. ac1.304. URL https://aclantholooo org/
2021. wwwfiiinnnnaaacoo
Edward Tian. Gptzero, 2023. URL https::/gptzeroo.me/
Umut Topkara, Mercan Topkara, and Mikhail J. Atallah. The hiding virtues of ambiguity: Quantifiably resilient watermarking of natural language text through synonym substitutions. In Proceedings of the 8th Workshop on Multimedia and Security, MM&Sec '06, pp. 164 174, New York, NY, USA, 2006. Association for Computing Machinery. ISBN 1595934936. doi: 10. 10.1145/11 1111411111130 166666661166111 URL httph:tt:///e org/
10. 09.114//116166. 1161397
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaci, Nikolay Bash- lykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. Xiv preprint arXi:2207700955 2023.
21

---

Published in Transactions on Machine Learning Research (09/2024)
Arash Vahdat and Jan Kautz. Nvae: A deep hicrarchical variational autoencoder. Advances in neural information processing systems, 33:19667- 2020.
Ashish Venugopal, Jakob Uszkoreit, David Talbot, Franz Och, and Juri Ganitkevitch. Watermarking the outputs of structured prediction with application in statistical machine translation. In Proceedings of the 2011 Conference on Empérical Methods in Natural Language Processing, pp. Scotland, UK., July 2011. Association for Computational Linguisties. URL httts:://aclatthologg org/ D11-1126
Edinburgh,
Pranshu Verma. They thought loved ones were calling for help. it was an ai scam. The Washinglon Post, 2023. URL
scam/
Patrick von Platen, Suraj Patil, Anton Lozhkov, Pedro Cuenca, Nathan Lambert, Kashif Rasul, Mishig Davaadorj, and Thomas Wolf. Diffusers: Statc-of-tho-art diffusion models. https://gittub.. com/
(iggsnngface/dffuuerss 2022.
Eric Wallace, Mitchell Stern, and Dawn Song. Imitation attacks and defenses for black-box machine transla- tion systems. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Process- ing (EMNLP), pp. 5531-5546, Online, November 2020. Association for Computational Linguistics. doi: URL http::///cllaatholloggg 2rw.:t/hooooooyoo/220000000 emnlp-maiiiei.. main. 446
10.18653/v1/2020 wttp:/.0..ommmaammm.amma
Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing. 1300)6600-112, 2004.
Zijic J Wang, Evan Montoya, David Muncchika, Haoyang Yang, Benjamin Hoover, and Duen Horng Chau. Diffusiondb: A large-scale prompt gallery dalaset for lext-to-image generative models. orXiv preprinl 1:Xiv:2200114900 2022.
Qiongkai Xu and Xuanli He. Security challenges in natural language processing models. In Proceedings of the 2023 Conference Empirical Methods in Natural Language Processing: Tutorial Abstracts, pp. 7-12, 2023.
Qiongkai Xu, Xuanli Hc, Lingjuan Lyu, Lizhen Qu, and Gholamreza Haffari. Student surpasses teacher: Imitation attack for black-box NLP APIs. In Proceedings of the 29th International Conference on Compu- tational Linguistics, pp. 2849 2860, Gyeongju, Republic of Korea, October 2022. International Committee on Computational Linguistics. URL httpp::/aclaatthooo
owg/ co mooling-1.255
Kuan Yang, Kejiang Chen, Weiming Zhang, and Nenghai Yu. Provably secure generative steganography based on autoregressive model. In Chang D. Yoo, Yun-Qing Shi, Hyoung Joong Kim, Alessandro Piva, and Gwangsu Kim (eds.), Digital Forensics and Walermarking, pp. 55 68, Cham, 2019. Springer International Publishing. ISBN 118-3-030-11389-
Weike You, Hong Zhang, and Xianfeng Zhao. A siamese enn for image steganalysis. IEFE Transactions on Information Forensics and Security, 16:291-306, 2020.
Ning Yu, Larry S Davis, and Mario Fritz. Attributing fake images to gans: Learning and analyzing gan fingerprints. In Proceedings of the IEEE/CVE /CF international conference on computer vision, pp. 7556-7566, 2019.
Aditi Zear, Amit Kumar Singh, and Pardeep Kumar. A proposed secure multiple watermarking technique based on dwt, det and svd for application in medicine. Multimedia tools and applications, 2018.
Richard Zhang. tichzhanggperrootuuassiiiiaiii Sep 2023. PerceptuulSSimlarityy
URL https://gtthubb.c///tchhhaggg
Richard Zhang, Phillip Isola, Alexci A Efros, Eli Shechtman, and Oliver Wang. The unrcasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pallern recognition, pp. 1866-595, 2018.
22

---

Published in Transactions on Machine Learning Research (09/2024)
Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q. Weinberger, and Yoav Artzi Bertscore: Evaluating text generation with bert. In International Conference on Learning Represenlations, 2020. URL https:
Xu Zhang, Svebor Karaman, and Shih-Fu Chang. Detecting and simulating artifacts in gan fake images. In 2019 IEEE International Workshop Information Forensics and Security (WIFS), pp. 1-6, 2019. doi: 10.1109/WIFS4T7I WVTFS47025.2019.993311
Xuandong Zhao, Yu-Xiang Wang, and Lei Li. Protecting language generation models via invisible water- marking. In International Conference on Machine Learning, pp. 42187-4212 PMLR, 2023a.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for water- marking diffusion models. arXiv preprint orXiv:2303. 10137, 2023b.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. Tn Proceedings of the European conference on computer vision (ECCV), pp. 657 672, 2018
23

---

Published in Transactions on Machine Learning Research (09/2024)
A
Detailed Related Work
Authorship Identification for Image Generation Models
With the advancements of deep learning techniques, multiple works have suggested leveraging neural net- works to scamlossly encode conccaled information within images in a fully trainable manner (Zhu et al. Yang el al. 2019; Ahmadii et al., 2020 You et al., 2020). Inspired by this idea, Fernandez et al. (2022) incorporate watermarks into the latent space formulated by a self-supervieed network such as DINO (Caron
2018
et al. 2021). This approach modulates the features of the image within a specific region of the latent space, ensuring that subsequent transformations applied to watermarked images preserve the integrity of the em- bedded information. Subsequently, watermark detection can be conducted based on this same latent space. Similarly, Fernandez et al. (2023) introducc a binary signature directly into the decoder of a diffusion model, resulting in images that contain an imperceptibly embedded binary signature. This binary signature can be accurately extracted using a pre-trained watermark extractor during verification.
Given the escalating concerns regarding the misuse of deep fakes, as highlighted in the literature (Brundage et al., 2018 Harris 2019) ; several studies have proposed methodologies for attributing the origin of an im- age, specifically discerning between machine-generater and authentic images. This task is rendered feasible through the identification of subtle, yet machine-detectable, patterns unique to images generated by Gener- ative Adversarial Networks (GANs), as evidenced in recent rescarch (Marra et al. 2019 Afchar et al.) 2018 Güera & Delp, 2018 Yu et al.) 2019). Furthermore, the detection of deep fakes is enhanced by analyzing incousistencies in the frequency domain or texture representation between authentic and fabricated images, as indicated in recent studics (Zhang ct al. 2019 Durall ct al., 2020 Liu ct al.] 2020).
Authorship Identification for Natural Language Generation Models
Content generated by text generation models is increasingly vulnerable to various forms of misuse, including the spread of misinformation and the training of surrogate models (Wallace et al. 2020 Xu et al.) 2022). Consequently, a growing interest has been in protecting the authorship (or TP) of text generation models or detecting machine -enhrne-generated text.
A straightforward solution is to incorporate watermarks into the generated text. However, unlike images, textual information is composed of discrete tokens, making the watermarking process for text difficult en- dcavor due to the potential for inadvertent alternation that can change its semantic mcaning (Katzenbeissor & PPelitolas 2000). One solution to preserve semanticc integrily during watermarking involves synonym sub- stitution (Topkara et al. 2006; Chang & Clark 2014 He et al. 2022a). Nevertheless, the simplistic approach to synonym substitution is vulncrable to detection through statistical analysos. In response, He ct al. (202bb) have proposed a conditional synonym substitution method to enhance both stealthiness and robust of substittution-based watermarks. Moreover, |Venugopal et al.] (2011) adopted bit representation to encode semantically similar sentences, enabling the selection of watermarked sentences through bit manipulation.
The previously discussed methods have been centered on applying watermarks through post-editing. How- ever, with the emergence of L.LMs, there has been a significant shift towards developing watermarks tailored for LLMs to identify machine-generated text. A notable approach in this area employs biased sampling strategics to alter token distribution at each generation step, favoring tokens from specific pre-defined cat- egories (Kirchenbauer et al. 2023a b Zhao et al.] 2023a). ). Despite their innovation, these methods face vulnerabilitics to "rewriting" attacks, where watermarked sentences are paraphrasod either automatically or manually, thus challenging the identification of original authorship (Christ al., 2023). To address this issue, Kuditipudi et al. (2023) propose robust approach that maps sequence of random numbers gener- ated from randomized watermark key to the outputs of a language model. This technique maintains the watermark's detectability, notwithstanding text alterations such as substitutions, insertions, or deletions.
Interest in host-hoe detection has surged as a complementary measure to watermarking. This trend is driven by the fact that developers often keep the details of their watermarking algorithms confidential to prevent them from being compromised if leaked. Depending on whether machino-generated or human-authored text samples are available, one can utilize either zero-shot or training-based detection methods. Zero-shot
24

---

Published in Transactions on Machine Learning Research (09/2024)
detection relies on the premise that language model-generated texts inherently contain detectable markers, identifiable through analysis techniques such as perplexity (Idnay et al.
2022 Tian 2023 or average per-
token log probability (Solaiman et al. 2019a Mitchell et al. 2023). The training based approaches leverage
features from pre-trained language models to distinguish between bachine-generatee and human-authored
texts (Solaiman et al. 2019a Bakhtin el. al. 2019 Jawahar et al. 2020 Chen et al. 2023 However, these
approaches yield a binary outcome, classifying texts as machine-generated or human- samman-generttd.. Instead, our approach can determine the origin of text generated by any LLMs, moving beyond binary outcomes.
B Experimental setup for image generation
B.1 Embedding Watermark through Inpainting
To analyze the stability and convergence properties of inpainting models, we perform an iterative masked image infilling procedure. Given an input image from model G, we iteratively inpaint with mask M:
x(++1) (k) M)
(10)
Here, the mask M not only guides the inpainting but also functions as the medium to embed our watermark. As we iteratively inpaint using mask M, the watermark becomes more deeply embedded, serving as a distinctive signature to identify the authentic model Ga.
B.1.1 Convergence of Watermarked Images
The iterative masked inpainting procedure displays consistent. convergence behavior across models. With fixed binary mask covering 1/10th of the image, the distance between successive image generations decreases rapidly over the first few iterations before stabilizing. This is evidenced by the declining trend in metrics like MSE, LPIPS, and CLIP similarity as iterations increase.
The early convergence suggests the generative models are effectively reconstructing the masked regions in a coherent manner. While perfect reconstrruction is infeasible over many passes, the models appear to reach reasonable stability within 5 iterations shown in Figure 10 and
Convergence to a stable equilibrium highlights latent fingerprints in the model behavior. The consistent self- reconstruction statistics form the basis for dist inguissinn authentic sources in the subsequent fingerprinting experiments. The watermarking convergence analysis highlights model stability and confirms that iterative inpainting effectivcly removes embedded watermarks without degrading image quality (sce Figures in D.3.2
MSE Polo datasel
CLPP Polo dalaset
LPIPS Polo datasel
SSIM Polo dalaset
3.00
E315
0.03
0.03
2,80
0.03
0.03
2.60
0.02
0.00
BCOCM
0.00
2.20
0.03
0.00
2.00
0.03
0.01
1.80
0.02
0.01
0.00
1.60
0.02
0.01
0.00
0.02
0
3
0.01
0.00
0
3
Iterations
Ite rations
Iterations
Iterations
Figure 10: The convergence analysis of the distances in iteration based on various metrics on the watermarked images of 200 samples from Polo datasets.
B.2
Enhancing and Verifying Fingerprint through Re-generation
We divide an image into non-overlapping segments and have models reconstruct masked regions to expose inherent fingerprints. Given an image æ, we generate segment masks Mı.... My covering x and apply G reconstruct each part:
25

---

Published in Transactions on Machine Learning Research (09/2024)
y(4 (ax M[J)
(11)
By analyzing reconstructed segments y(4 and the composited image y, model-specific artifacts can be quanti- fied without additional pattern information. The non-overlapping reconstructed segments are merged to form the composite image y, portion. A salient feature of our proposed re-generation paradigm is its independence from any additional information about the image partitioning pattern. The model's unique fingerprint emerges naturally during re-generation, regardless of how the image is divided or the components are merged. We experiment on 5 latest SD models SDv 2.1, SD v2.1B, SD v2, SDXL 1.0, and SDXL0,9B using 8 segmented masks each covering 1/8th of the image thereby totaling full image coverage. Model fingerprints are identified through LPIPS, and CLIP similarities between original Fa and reconstructed y.-
obtain this by using the corresponding mask and extracting the reconstructed
B.2.1 Convergence of Re-generated Images
Enhancing fingerprint re-generation shows consistent convergence in perceptual metrics like CLIP and LPTPS within four iterations (sce Figure 12 and 13 However, traditional metrics such as MSE and SSIM lack clear convergence, suggesling inpainting effectively captures visual content but not al the pixel level. The models converge to unique stable points, revealing inherent fingerprints based on their biases and training data. This divergence is important for model attribution. Overall, re-generation effectively exposes these fingerprints while maintaining visual integrity, underscoring perceptual superiority over pixel-based metrics in evaluating generative model fingerprints.
C Computer Vision Supplementary Experiments and Details
C.1 Image Generation Models
We consider cight models based the Stable Diffusion architecture (Rombach et al. 2022 These models leverage the architecture and diller primarily in their training schemes. The models are selected to span a range of architectures, training schemes, and dataset sizes. This diversity allows us to explore model-specific behaviors for attribution and stability analysis.
All models support inpainting, allowing images to edited given a mask and image. We utilize the inpainting pipeline- StfuleDDifuussion and StableDiffusionnLL provided by HuggingFace (von Platen al. 2022 Both SD v1.4 and SD v2 checkpoints were initialized with the weights of the SD v1.4 chockpoints and subscquently fine-tuned on aestheeics v2 5+". SDXL 1.0 employs a larger UNet backbone and more potent text encoder (Podell et al.) 2023). BKSDM is designed for efficient text-to-image synthesis, removing blocks from the U-Net and undergoing distillation pre-training on 0.22M LAION text-image pairs (Kim et al. 2023
on dataset
LPIPS delase!
52v15
0.04
0.03
0.00
93x1
0.04
0.00
0.03
0.00
2.20
84:0MM
20x2
0.03
0.03
0.00
2.00
20v21 tue
52XL
0.03
0.02
0.00
1.80
0.03
0.01
0.00
1.60
0.03
1.40
0.02
0.01
lteratinss
rabions
Iterations
Iterations
Figure 11: The convergence analysis of the distances in iterations based various metrics the water- marked images of 200 samples from Coco dataset
26

---

Published in Transactions on Machine Learning Research (09/2024)
CLIP on Polo dafaset
LPIPS on Polo datasel
MSE on Polo datasel
SSIM on Pola dalasel
0.04
0.14
SDV2
28.00
0.04
0.13
26.00
0.00
0.04
0.03
0.12
0.11
50-2-1
Baseo
24.00
0.00
0.00
0.03
0.10
22.00
0.00
0.03
20.00
0.00
0.02
0.08
0.00
0
2 Iterations
3
2
3
0
Iterations
Iterations
Iterations
Figure 12: The convergence analysis of the distances in iteration based on various metrics on the re-generated images of 200 samples from Polo dataset.
CLIP on Polo dataset
LPIPS on Polo dataset
MSE on Polo dataset
0.01
SSIM on Polo dataset
0.06
0.14
30-2.1
0.05
0.13
50XLv1
26.00
0.00
0.04
SDXL teed
SD-2
24.00
0.00
0.11
0.00
0.04
0.10
22.00
0.00
0.04
0.09
20.00
0.03
0.08
0.00
2
3
3
Iterations
Iterations
Iterations
Iterations
Figure 13: The convergence analysis of the distances in iteration based on various metrics on the re-generated images of 200 samples from Coco dataset.
Image Inpainting: Image inpainting refers to filling in missing masked regions of an image to recon- struct the original intact image. A fixed binary mask is applied to cover certain areas of the image. The binary masks are generated as blank images filled with random white pixels. To reconstruct images, the binary mask and original image are passed to the generative model's inpainting pipeline, where the values of the pixels in the masked areas are predicted based on the unmasked context. After inpainting, the re- constructed masked regions are merged back into the re-generated image for future itcration. We utilize the inpainting pipeline StableDiffussion and StableDiffusionXLL provided by HuggingFace (von Platen al. 2022 that enables to regenerate given image multiple times by masking different parts of the image.
C.2 Distance Metrics for Images
Contrastive Language-Image Pretraining (CLIP) Cosine Distance The CLIP model encodes im- ages into high-dimensional feature representations that capture semantic content and meaning (Radford) et al.] 2021). With pre-trained image-text models, we easily capture the semantic similarity of two images, which is their shared meaning and content, regardless of their visual appearance.
CLIP uses a vision transformer model as the image encoder. The output of the final transformer block can interpreted as a semantic feature vector describing the content of the image. Images with similar content will have feature vectors close together or aligned in the embedding space.
To compare two images I1 and 12 using CLIP, cosine distance between these semantic feature vectors indicates the degree of semantic alignment.
encode them into feature vectors fl and f2. The
fi f2
cosine_sim(ft (ammfi,,5 fa) Ill
(12)
cosine dist (21, = 1 cosine
cosine sim(fi,Ja)
(13)
Where denotes the dot product and || denotes the L2 norm. The cosine distance ranges from 0 to 1. with 0 indicating perfectly aligned features. A lower distance between images implies more similar high-
27

---

2022 Published in Transactions on Machine Learning Research (09/2024)
Summary of models based on the Stable Diffusion architecture for IG experiments. The bold models are used in our primary experiments.
Table 9:
Model
Description
Model1
Stable Diffusion 1.5: Fine-tuned from SD1.4 for 595k steps (Rombach et al.
Model2
Stable Diffusion 2.1 (SDv 2.1): Fine-tuned from SDvTwo for 210k steps
Rombach et al.
2022)
Modela
Stable Diffusion 1.4 (SD v1.4) Initialized from SDv1.2 weights RRmbach et al.
2022
Modelı
Stable Diffusion XL 1.0 (SDXL 1.0): Larger backbone, trained on LAION-5B Pdell et al.
2023)
Models
Block-removed chowledge-distilled Stable Diffusion Model (Kim et al.
2023
Modele
Stable Diffusion 2 (SD v2) (Rombach et al. 2022)
Model,
Stable Diffusion v 2.1 Base (SD v2.1B) Rombach et al.
2022
Models
Stable Diffusion XL 0.9 (SDXL0.9B)
Podel et al. 2023
level content and meaning in the images captured by the CLIP feature embeddings. We specifically use OpenClip with ConyNext-XXLarg encoder pretrained laion2b dataset.
Learned Perceptual Image Patch Similarity (LPIPS) LPIPS metric focuses on perceptual and stylis- tic similarities by using a convolutional neural network pre-trained on human judgments of image patch similarities. The distance measured between the CNN's intermediate feature representations of two im- ages (Zhang et al. 2018).
d(x, x²)
Σ H,W,
Σ h
Joy O (ol
1/ thw 113
(14)
By comparing features across corresponding layers of the CNN, LPIPS can provide a fine-grained distance measuring subtle perceptual differences imperceptible in pixel space (Zhag al., 2018). For example, changes to color scheme artistic style that maintain semantic content will have a low CLIP distance but higher LPIPS distance. We use the original implementation of Zhang 2023
Mcan Squared Error (MSE) 88:
The mean squared error (MSE) between two images x and is calculated
m- m-1a-1
MSE(a,
mn Σ (x(i,)) - -i.,)))
Where and x images represented as matrices of pixel intensities. The MSE measures the average of the squared intensity differences between corresponding pixels in and x'.
It provides simple pixel-level similarity metric sensitive to distortions like noise, blurring, and coloring errors. However, MSE lacks perceptual relevance and is not robust to goometric/sttructural changes in the image.
Structural Similarity Index (SSIM) The structural similarity index (SSIM) (Hore & Ziou 2010) com- pares corresponding 8 8 windows in the images across three terms luminance, contrast, and structure:
SZ) = (2 + c1 c2)(2 + 02) (n + 2 + co + oz + +2)
Where Pas Me are mean intensities, 02, 0f, are variances, and oen is covariance for windows in x and x'. C1 C2 stabilize division.
28

---

Published in Transactions on Machine Learning Research (09/2024)
This decomposes similarity into comparative measurements of structure, luminance, and contrast. As result, SSIM better matches human perceptual judgments compared to MSE. Values range from -1 to 1, with 1 being identical local structure.
As research rapidly improves generation quality, we expect future use cases to leverage such advanced gen- erators. Analyzing these models is thus more indicative of real-world conditions going forward compared earlier versions. Furthermore, the marked quality improvements in recent SD models present greater chal- lenges for attribution and fingerprinting. Subtle inter-model differences become more difficult to quantify amidst high-fidelity outputs. Distance metrics like MSE and LPIPS are sensitive to quality, lower baseline distortion is more rigorous test scenario. By evaluating cutting-odge models without inpainting specializa- tion, we aim to benchmark model fingerpritting efficacy on contemporary quality levels. Our experiments on the latest SD variants at scale also assess generalization across diverse high-fidelity generators. Successful at- tribution and stability analysis under these conditions will highlight the viability of our proposed techniques in real-world deployment.
C.3 Empirical Estimation of the Lipschitz Constant L
For the empirical estimation of L, we use all pairs of images (æ and y) from Polo dataset, representing them inputs and applying the re-generation function ʃ(.). We measure their distances using DD i.e. Euclidean and LPIPS. The ratio below is the transformation of Equation g
D(x, y) L < I())
(15)
Table 10: Lipschitz Constant Estimation
Model
L LPIPS Mean
L LPIPS Std
L Euclidean Mean
Euclidean Std
SD v2.1
0.976
0.015
1.000
0.001
SDXL 1.0
0.943
0.21
1.000
0.004
SD v2
0.975
0.016
1.000
0.001
SD v2.1B
0.970
0.023
1.000
0.002
SDXL 0.9
0.946
0.020
0.999
0.005
observe LPIPS distance metric consistently produced lower L, values compared to Euclidean distance. This demonstrates LPIPS as superior metric for our framework, explaining why Euclidean distance fails for verification. Additionally, more advanced models exhibited improved L values, indicating better pertubation resilience and verification capacity. Our approach focuses on leveraging inherent model properties for verification rather than enforcing universal viability. For models currently unsupported, we suggest targeting euhancements to model robustness in line with these observations.
From Table 10
Overall, the experiment validated LPIPS as an optimal distance function and revealed a correlation between model advancement and verifiability via intrinsic fingerprints.
C.4 Sample Prompts and Images Reproduced
In computer vision experiments, sample prompts from the MS-COCO 2017 Evaluation [Lin et al. 2014) and POLOCLUB (POLO) Diffusion Dataset (Wang et al. 2022) for image generation. We present lew example prompts and images produced for different. models in the section below.
C.4.1 COCO Dataset Prompts
A motorcycle with its brake extended standing outside.
Off white toilet with faucet and controls.
A group of scooters rides down street.
29

---

Published in Transactions on Machine Learning Research (09/2024)
Table 11: The precision and recall verifying the authentic models Go using different contrast models Ge on Coco Datasct.
SD v2.1
SD v2.
SD v2.1B
SDXL 0.9
SDXL 1.0
Precision
Recall f
Precision
Recall f
Precision
Recall
Precision 1
Recall
Precision f Recall
(a) k
v2.1
96.5
98.0
97.0
97.5
SD v2.
89.0
91.3
97.0
98.0
96.0
97.0
95.5
97.5
SD v2.1B
11.5
19.0
2.0
3.0
47.5
53.0
18.5
56.0
SDXL 0.9
85.5
88.3
88.0
91.5
99.3
100.0
90.5
95.00
SDXL 1.0
95.5
97.0
(b)
SD v2.1
73.0
77.0
97.5
98.5
94.5
96.5
96.5
96.5
SD v2.
72.0
79.0
97.0
99.0
95.0
96.0
94.5
95.5
SD v2.1B
71.0
79.0
74.5
79.5
82.0
86.0
81.5
85.5
SDXL
86.5
SDXL 1.0
91.5
94.5
92.5
95.0
100.0
100.0
89.0
91.0
(c) &
SD v2.1
68.0
73.0
99.5
90.5
94.5
97.0
93.0
96.0
SD v2.
72.5
81.3
96.0
181.5
91.0
92.5
94.0
95.0
SD v2.1B
78.5
83.5
77.0
82.5
82.5
87.0
85.5
89.5
SDXL 0.9
97.0
98.0
97.5
98.0
100.0
100.0
92.0
95.0
SDXL 1.0
93.0
96.0
92.5
93.0
99.0
99.5
88.0
90.5
C.4.2 Polo Dataset Prompts
A renaissance portrait of Dwayne Johnson, art in the style of Rembrandt!! Intricate. Ultra de- tailed, oil on canvas, wet-on-wet technique, pay attention to facial details, highly realistic, cinematic lightning, intricate textures, illusionistic detail.
Epic 3D, become legend shiji! GPU mecha controlled by telepathic hackers, made liquid, bubbles, crystals, and mangroves, Houdini SideFX, perfect render, ArtStation trending, by Jeremy Mann, Tsutomu Nihei and Πya Kuvshinov.
An airbrush painting of cyber war machine scene in area by Destiny Womack, Gregoire Boonzaier, Harrison Fisher, Richard Dadd.
C.5 Density Distribution of one-step re-generation
The one-step ro-generation density distributions reveal distinct model-spocific characteristics, enabling dis- crimination seen in Figure 14 and 15 Most models exhibit distinction, with each distribution showing unique traits.
A notable exception in this behavior is observed for the SD v2.1B (sec Figures 14 and 15 which initially demonstrates less discrimination. However, over exlended iterations, SD v2. 1B shows marked improvement, highlighting the capacity for iterative refinement. By the 5th iteration, there a noticiable improvement in the discriminative nature of its one-step re-generation. This improvement is crucial it highlights the model's capacity to refine and enhance its re-generative characteristics over time.
While LPIPS is not immediately effective in pinpointing the authentic model at the very first step, it still offers a powerful mechanism to distinguish between models. LPIPS is effective at differentiating between families of models, such as the Stable Diffusion models and the Stable Diffusion XL models, as visualized in Figure 16 for the Polo dataset and Figure 17 for the Coco dataset. The lack of effectiveness of LPIPS identifying the authentic model is primary reason why it was not chosen for verification.
Further insights into the models' discriminative capabilities SDv2.1B starts with lower accuracy in distinguishing itself, significant improvement in accuracy is seen across iterations. The initially anomalous behavior transitions into more discriminating re-generation.
be derived from Table and 12 while
30

---

Published in Transactions on Machine Learning Research (09/2024)
Table 12: The precision and recall of verifying the authentic models Ga using different contrast models Ge
Polo Dataset.
S.
SD v2.1
SD v2.
SD v2.1B
SDXL 0.9
SDXL 1.0
Ga
Precision
Recall
Precision
Recall
Precision 1
Recall Precision 1
Recall
Precision 1 Recall
(a) k
SD
76.0
78.5
97.5
SD
79.0
84.0
98.0
98.5
95.5
91.0
95.5
SD v2.1B
40.5
51.0
39.0
46.0
72.5
80.0
73.5
80.5
SDXL 0.9
86.0
88.5
85.0
89.5
99.5
99.5
91.5
95.5
SDXL 1.0
89.0
92.0
89.5
93.0
98.0
99.0
91.5
95.5
(b) l
77.0
83.0
100.0
SD v2.
75.5
82.0
98.0
98.0
96.5
97.5
97.5
SD vB.1B
70.0
76.5
71.5
78.5
84.0
90.5
84.5
89.5
SDXL 0.9
92.5
95.0
91.0
94.0
100.0
100.0
91.0
94.0
SDXL 1.0
90.0
92.5
89.5
91.5
100.0
100.0
90.0
93.0
(c)
v2.1
80.0
86.0
99.5
98.5
100.0
77.5
100.0
SD vB.1B
81.5
83.5
82.5
86.5
88.5
92.0
89.5
91.0
SDXL 0.9
97.5
97.5
96.5
98.0
99.5
99.5
92.0
93.5
SDXL 1.0
95.5
96.0
92.5
95.5
100.0
0.0
91.5
96.0
31

---

Published in Transactions on Machine Learning Research (09/2024)
a Image
Iteration
Iteration
Iteration
40
60x2
40
40
40
SDXUv1 .
30
5ix2
30
30
30
Density
5DXI Browh.3
S0x2.1 Base
20
20
20
10
10
0
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
Initial Image
Iteration
lteration 3
Iteration
5Dw21
SDXLv1
30x2
Density
SDXL, Baswd
0.02
0.04
0.02
0.04
0.06
0.02
0.06
0.02
0.06
Image
lttration
Iteration
25
SDv2.1
SDXLv1.0
20
10.0
Density.
SDv2.1 Base
7.5
15
SDXL Base0.9
10
2.5
0.0
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
Initial Image
Iteration
Iteration
Iteration
50
50
60
50
s0w2
40
83KL/10
40
40
40
Bix2
Density
S0v2 Bass
30
30
30
30
20
20
20
20
10
10
10
10
0
0.04
0.06
0.06
0.02
0.06
0.02
0.04
Initial Image
Iteration
Iteration
Iteration
50
80v2.1
BDXL-10
40
Densit
S3XL B6600
30
20
10
10
0
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
Figure 14: One Step Re-generation for various authentic models on the Polo Dataset using the CLIIP metric at different iterations. The authentic models from top to bottom are: 1) SDv 2.1, 2) SD v2, 3) SD v2. vB,4) SDXL 1.0, 5) SDXLO.9B.
32

---

Published in Transactions on Machine Learning Research (09/2024)
IntBil Image
lleration
Iteration 3
lteration
20
5Dw21
20
S000
SDx2
Density
15
50x2.1 Biews
15
15
15
SDXL Base
10
5
0
0
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
Inital Image
lteration
Ileration 3
Iteration
60x2
SDXLv1
Density
15
15
SDXL
10
10
10
10
8.00
8.00
8 .000
8.00
0.02
Init Image
Iteration
Iteration 3
lteration
20
20
20
20
BDXLv1
60x2
Density
SDv2.1 Base
SDXL, Base0.3
10
10
5
5
5
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
Initial Image
Iteration
Iteration 3
Iteration
SDv2.1
SDs2
Density
20
60v2 Bowee
20
20
SDXL
15
15
15
15
10
0
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.08
Initial Image
lteration
lteration 3
Iteration
30
SDXt
90x2.1
30
SDx2
Density
S0XL
10
10
10
10
Figure 15: One Step Re-generation for various Authentic Models on the Coco Dataset using the CLIP metric at different iterations. The authentic models from top to bottom are: 1) SDv 2.1, 2) SD v2, 3) SD v2.1B, 4) SDXL 1.0, 5) SDXL0.9B.
33

---

Published in Transactions on Machine Learning Research (09/2024)
Image
Iteration
Iteration
Iteration
15
50x2
15
SDXLV1. .0
S0x2
Density
SDx2.1 Base
1.
5DXL Boowd.33
10
10
10
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
Initial Image
Iteration 1
Iteration 3
Iteration
15
SDx2.1
15
15
15
SDXLV1
50xz
Density
10
SDXL
5
0
0
0.02
0.02
Initial Image
Iteration
Iteration 3
Iteration
Density
SDv21 Base
SDXL Base
0.02
0.04
0.02
0.06
0.02
0.04
0.06
0.02
0.04
0.08
Initial Image
Iteration
Iteration 3
Iteration
25
25
25
25
SDv2
20
SDXLv1 /
20
20
20
50x2
Density
15
SDv211 Base
SDXL
15
15
15
10
10
10
10
5
5
0
0
0.04
0.06
0.02
0.04
0.06
0.02
Initial Image
Iteration
Iteration 3
Iteration
25
25
20
20
20
20
Density
Basc
SDXL Base
10
10
10
10
5
0.02
0.04
0.06
0.02
0.04
0.08
0.02
0.04
0.06
0.02
0.04
0.06
Figure 16: One Step Re-generation for various Authentic Models on the Polo Dataset using the I.PPS metric at differrnt iterations. The authentic models from top to bottom are: 1) SDv 2.1, 2) SD v2, 3) SD v2.1B, 4) SDXL 1.0, 5) SDXLO.9B.
34

---

Published in Transactions on Machine Learning Research (09/2024)
Initial Image
lteration 1
lteration
Iteration
12.5
50x2.1
12.5
12.5
12.5
S000
10.0
9Dx2
10.0
10.0
10.0
Density
50x2.1 Biees
SDXL Baseb
5.0
5.0
5.0
2.5
2.5
2.5
2.5
0.0
0.0
0.0
0.0
0.04
0.08
0.02
0.04
0.08
0.02
0.04
0.08
0.02
0.04
0.08
Initial Image
Iltraaion 1
Iteration
Iteration
12.5
50x2
12.5
12.5
12.5
SDXLvt
10.0
10.0
10.0
10.0
Density
7.5
SDXL
7.5
7.5
7.5
5.0
5.0
5.0
2.5
08.00
0..00 00
08.00
08.00
0.02
0.02
Initial Image
Iteration
Iteration
Iteration
B0XLy1
8
8
60x2
Density
SDv2.1 Base
SOXL Base0.3
6
4
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
Initial Image
Iteration
Iteration 3
Iteration
SDv2.1
20
5000.1
20
20
20
SDs2
Density
15
50v2 Booee
SDXL Base
15
5
0
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
0.02
0.04
0.06
Initial Image
lteration
lteration 3
Iteration
90x2.1
20
SDXt
20
Density
15
SOXL
15
10
10
0.02
Figure 17: One Step Re-generation for various Authentic Models on the Coco Dataset. using the LPIPS metric at different. iterations. The authentic models from top to bottom are: 1) SDv 2.1, 2) SD v2, 3) SD vB.1B, 4) SDXL 1.0, 5) SDXL0.9B.
35

---

Published in Transactions on Machine Learning Research (09/2024)
D Supplementary experiments for text generation models
D.1 Density distribution of one-step re-generation
In Figure 18 we illustrate the density distribution of onc-step ro-generation for four text generation models, using the first iteration from the authentic models as input. Exchuding Cohere, the density distributions of the authentic models are discermible from those of the contrast models across BLEU, ROUGE-L, and BERTScore metrics.
Density Distribution over Dist-BLEU (k=1)
M2M
1.0
mBART
0.8
GPT3.5-turbe
Density
Cohere
0.4
0.2
0.0
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
Density Distribution over Dist-ROUGE-L (K=1)
M2M
2.0
mBART
3PP3..-turbo
Density
1.5
Cohere
0.5
0.0
0.0
0.2
0.4
0.6
0.8
0.0
0.2
0.4
0.6
0.8
0.0
0.2
0.4
0.6
0.8
0.0
0.2
0.4
0.6
0.8
Density Distribution over Dist- Best-Be (k=1)
M2M mBART
3
-PP3.b-turbo
Density
Cohere
1.0
0.0
Figure 18: Density distribution of onc-step ro-generation among four text generation models, where the input to the one-step re-generation is the first iteration from the authentic models. The authentic models from left to right are: 1) M2M, 2) mBART, 3) GPT3.5-turbo, and 4) Cohere.
Figure 19 illustrates the density distribution when the input the kth iteration from the authentic models. As increases, the distinction between the authentic model's distribution and that of the contrast models becomes more pronounced.
36

---

Published in Transactions on Machine Learning Research (09/2024)
Density Distribution over Dist-BLEU (k=1)
M2M
1.0
mBART
0.8
GPT3.6-turbo
Density
Cohere
0.6
0.2
0.0
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
Density Distribution over Dist-BLEU (k=3)
M2M
2.0
mBART
CPT3.5-turbo
1.5
Densiyy
Cohere
0.5
0.0
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
Density Distribution over Dist-BLEU (k=5)
2.0
M2M
mBART
1.5
GPT3.5-turbo
Density
Cohere
1.0
0.5
0.0
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
Figure Density distribution of one-step re-generation among four text generation models, where the input to the one-step re-generation is the kth iteration from the authentic models. The authentic models from left to right are: 1) M2M, 2) mBART, 3) GPT3.5-turbo, and 4) Cohere.
D.2 Experiments for GPT4
In this section, we analyze the characteristics of GPT4. We first present the density distribution when the input the kth iteration from the authentic models in Figure 20 Similarly, as increases, the difference between the authentic model's 's distribution and the contrast models intensifies. Nonetheless, distinguishing between GPT3.5-turbo and GPT4 proves difficult, particularly when GPT3.5-turbo serves the authentic model, even for larger values of k. Detailed examination reveals that GPT4's one-step re-generation bears resemblance to the k-th iteration of GPT3.5-turbo. This might stem from GPT3.5-turbo and GPT4 originat- ing from the same institution, suggesting potential similaritics in architecture and pre-training data. Thus, we contend that models stemming from the same institution inherently share identical intellectual property, thus obviating the possibility of intellectual property conflicts. Interestingly, when GPT4 is the authentic model, our methodology can differentiate it from GPT3.5-turbo attributed the marked difference between GPT3.5-turbo's one-step re-generation and GPT4's k-tth iteration. This distinction, we surmise, due GPT4's superior advancement. GPT3.5-turbo.
37

---

Published in Transactions on Machine Learning Research (09/2024)
Density Distribution over Dist-BLEU (k=1)
M2M
1.0
mBART
0.8
GPT3.5-turbo
Density
GPT4
0.6
0.2
0.0
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
Density Distribution over Dist-BLEU (k=3)
M2M
2.0
mBART
GPT3.5-turbo GPT4
1.5
Density
0.5
0.0
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
Density Distribution over Dist-BLEU (k=5)
2.0
M2M
mBART
1.5
GPT3.5-turbo
Density
GPT4
1.0
0.5
0.0
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
Density distribution of one-step re-generation among four text generation models, where the input to the one-step re-generation is the kth iteration from the authentic models. The authentic models from left to right are: 1) M2M, 2) mBART, 3) GPT3.5-turbo, and 4) GPT4.
Figure 20:
In evaluating the verification of authentic models, our methodology, as depicted in Table 13 consistently confirms the authorship of all models with an accuracy exceeding 85%. Furthermore, the misclassification rate remains below 10%.
D.3 Quality of Re Re-generated Sentences and Images
D.3.1 Text Re Re-generations
In this section, we examine the quality of re- generateed sentences. As illustrated in Figure the re-generated sentences display high quality across most evaluation metrics, except for Cohere. The slower convergence observed for Cohere can be attributed to its subpar re-generation quality, which significantly deviates from that of other models. For further illustration, refer to the samples and their re-generations in Table 14 17
38

---

Published in Transactions on Machine Learning Research (09/2024)
Table 13:
The precision and recall of verifying the authentic models (9.) using different contrast models
(G.).
M2M
mBART
GPro.5-tarbo
GPT4
Precision Recall
Precision
Recall f
Precision
Rocall
Preciston
Recall
==
M2M
94.0
95.0
93.0
95.0
87.0
92.0
mBART
92.0
80.0
85.0
C-rroo-turb GPT4
87.0 92.0
51.0
69.0
98.0
94.0
98.0
77.0
90.0
(b) 3
M2M mBART
94.0
99.0
95.0
97.0
94.0
95.0
93.0
90.0
96.0
89.0
95.0
GPT3.5-turbo
51.0
72.0
GPT4
97.0
92.0
91.0
79.0
91.0
(c)
5
M2M
94.0
98.0
95.0
99.0
91.0
96.0
mBART
91.0
96.0
88.0
94.0
89.0
94.0
GPTS.5-turbo
94.0
94.0
98.0
55.0
83.0
GPT4
98.0
94.0
97.0
$3.0
95.0
80
50
ROUGE-L
70
LERTScore
40
75
M2M
70
30
mBART
GPT3.5-turb0
Cbkere
60
GPT4
4
10
2
6
8
10
2
8
10
iteration
iteration
iteration
Figure 21: The quality between the original inputs and kth re-generation using BLEU, ROULGGE-L, and BERTScore.
D.3.2 Image Re-generations
An integral part of our evaluation process involves understanding the reproducibility of the images generated by different models across iterations. To this end, we present image re-generations for various authentic models in Figure 22 26 These re-generations provide insights into the consistency and stability of each model when tasked with reproducing the same visual content over multiple iterations.
39

---

Published in Transactions on Machine Learning Research (09/2024)
Table 14: Three original samples and their corresponding k-iteration from M2M.
Sample 1:
Original input: Working in groups of or (even ummbers may work better later on), suggest a houristic to evaluate the utility of a given board configuration.
Tteration 1: Working in groups of 2 or (even numbers can work better later), suggests a hearist to evaluate the
usefulness of a given table configuration.
Iteration 2: Working in groups of 2 or 4 (even numbers can work better later), suggests a heurist to evaluate the wsefulness of a given table coufiguration.
Iteration 3: Working in groups of 2 or 4 (even uumbers can work better later), suggests a heurist to evaluate the usefulness of a given table ronfiguration.
Theration 4: Working in groups of 2 (even mumbers work better later), suggests henrist to evaluate the usefulness a given table configuration.
Iteration 5: Working groups of (even numbers can work better later), suggests a heurist evaluate the usefuluess a given table coufiguration.
Sample 2:
Original imput: Therefore, to improve the eiiaa coping ability of Chinese NLP techniques and their application effectiveness in the field of ethics, the Chinese ethics knowledge base and KEPTMs for ethics domain are researched Iteration 1: Therefore, in order improve the ethical treatment capacity of Chinese NLP techniques and their effectiveness of application in the fiold of ethics, the kuowlodge base of Chinese ethics and the KEPTMs for the field ethics are studied.
Tteration 2: Therefore, in order to improve the ethical treatment capacity of Chinese NLP techniques and their effectiveness of application in the field of ethics, the knowledge base of Chinese ethics and KEPTMs for the field of ethics are studied.
Iteration 3: Therefore, in order to improve the ethical treatment capacity of Chinese NLP techniques and their effectiveness of application in the field of ethics, the knowledge base of Chinese ethics and KEPTMs for the field of ethics are studied.
Iteration 4: Therefore, in order improve the ethical treatment capacity of Chinese NLP techniques and their effectiveness of application in the field of ethics, the knowledge base of Chinese ethics and KEPTMs for the field of ethics are studied.
Iteaation Therefore, in order improve the ethical treatment capacity of Chinese NLP techniques and their effectiveness of application in the field of ethics, the knowledge base of Chinese ethics and KEPTMs for the field ethics are studied.
Sample 3:
Original input: I kindly request modification to the due date for my assigument. Accurding to the previous thread, was informed that I would receive an extension of hours this usigmment. However, as of now, my Moodle account still indicates the original due date Iteration 1: I slowly ask for a change to the appropriste date for my task. According to the previous topic, I was informed that I would reccive an extension of 33 hours for this task. However, from now on, my Moodle account still indicates the appropriate original date.
Iteration 2: slowly ask for change to the approprinte date for my task. According to the previous subject, T was informed that would receive 33-hour extension for this task. However, from now on, my Moodle account still indicates the appropriate original date.
Iteration 3: I slowly ask for change the approprinte date for my task. According to the previous topic, I was informed that I would receive 33 hour extension for this task. However, from now on, my Moodle account still indicates the appropriate original date.
Iteration 4: slowly ask for a change to the appropriate date my task. According to the previous topic, I was informed that I would receive a 33-hour extension for this task. However, from now on, my Moodle account still indicates the appropriate original date.
Iteration 5: I slowly ask for a change to the approprinte date for my task. According to the previous topic, I was informed that I would receive an extension of 33 hours for this task. However, from now on, my Moodle account still indicates the appropriste original date.
40

---

Published in Transactions on Machine Learning Research (09/2024)
Table 15: Three original samples and their corresponding k-iteration from mBART.
Sample 1:
Original input: Working in groups of or (even uumbers may work better later on), suggest a houristic to evaluate the utility of a given board configuration.
Tteration 1: If you work groups of 2 or (even mimbers can work better later), suggest a mouse kit to evaluate the usefulness of a given coufiguration of the table.
Iteration 2: If you work in groups of 2 or 4 (even numbers can work better later), suggest monse kit to evaluate the usefuluess of a particular table configuration.
Iteration 3: If you work in groups of 2 or 4 (eveu nutbbers can work better later), suggest mouse kit to evaluate the usefulness of particular table configuration.
Theration 4: If you work in groups of 2 or 4 (even numbers can work better later), suggest mouse kit to evaluate the usefulness a given table configuration.
Iteration If you work groups or (even mumbers can work better later), suggest mouse kit to evaluate the usefuluess a given table coufiguration.
Sample 2:
Original imput: Therefore, to improve the ethical coping ability of Chinese NLP techniques and their application effectiveness in the field of ethics, the Chinese ethics knowledge base and KEPTMs for ethics domain are researched Iteration 1: For this reason, to improve the ethical adaptation capucity Chinese NLP techniques and their effective application in the othics field, the Chinese Ethics Kuowledge Base and the KEPTMs for the ethics field are being studied.
Iteration 2: Therefore, to improve the ethical adaptation capacity of Chinese NLP techniques and their effective application in the field of ethics, the Chinese ethics knowledge base and the ECEs for the field of ethics are being studied.
Iteration 3: Consequently, in order to improve the ethical adaptation capacity of Chinese PLN techniques and their effective application in the field of ethics, the Chinese ethics knowledge base and ECE for the field of ethics are being studied.
Iteration 4: Cousequently, in order improve the ethical adaptation capacity of Chinese PLN techniques and their effective application in the field of ethics, the Chinese ethics knowledge basc and UNECE for the field of ethics are being studied.
Iteration 5: Consequently, in order to improve ethical adaptation capacity of Chinese PLN techniques and their effective application in the field of ethics, the Chinese ethics knowledge base and UNECE for the field ethics are being studied.
Sample 3:
Original input: I kindly request modification to the due date for my assigument. Accurding to the previous thread, was informed that I would receive an extension of hours this ussgmment. However, as of now, my Moodle account still indicates the original due date.
Iteration 1: am requssing a change to the due date of my assigumeut, and according to the previous thread, I have been informed that will receive a 33-hour extension for this assignment, but at the moment my Moodle account still indicates the original due date.
Iteration 2: am requesting a change to my assignment due date and, according to the previous thread, T have been informed that have received a 33-hour extension for this assignment, but at the moment, Moodle account still indicates the original due date.
Iteration 3: roquesting change my assignment due date and, according to the previous thread, I have been informed that have received 33- ho-hour extension for this assignment, but for the time being, my Moodle account still indicates the original due date.
Iteration 4: am requesting a change to the due date of my assigument and, according to the previous thread, I have been informed that I have received 33-hour extension for this assignment, but for the time being, my Moodle account still indicates the original due date.
Iteration 5: am roquesting a change to the due date of my ussignment and, according to the previous thread, I was informed that I have received a 33- hour extension for this assignment, but for the time being, my Moodle account still indicates the original due date.
41

---

Published in Transactions on Machine Learning Research (09/2024)
Table 16:
Three original samples and their corresponding k-iteration from GPT3.5-turbo.
Sample
Original imput:
Working in groups of or 4 (even numbers may work better later on), suggest heuristic to evaluate the utiliiy of a given board configuration.
Theration 1: Working in groups of 2 or 4 (even numbers might work better later on), propose heuristic to evaluate
the usefulness of given board configuration.
Iteration 2: Working groups of 2 or 4 (even numbers might work better in the future), propose heuristic evaluate the usefulness of given board configuration.
Iteration 3: Working in groups of 2 or 4 (even numbers might work better in the future), propose a heuristic to evaluate the utility of a given board configuration.
Iteration 4: Working in groups of 2 or 4 (even numbers might work better in the future), propose a heuristic to evaluate the usefulness of given board configuration.
Ieeaaiio 5: Working in groups of 2 or 4 (even numbers might work better in the future), propose heuristic to evaluate the usefulnes of given board configuration.
Sample
Original input: Therefore, to improve the ethical coping ability of Chinese NLP techniques and their application effectiveness in the field of ethics, the Chinese ethics knowledge base and KEPTMs for ethics domain are researched Iteration 1: Therefore, in order to improve the othical adaptability of Chinese NLP techniques aud their application efficiency in the field of ethics, the Chiuese ethics knowledge base and KEPTMs for the field of ethics are studied. Tteration 2: Therefore, in order to improve the ethical adaptability of Chinese natural language processing techniques and their effectiveness the field of othics, Chinese ethical knowlodge base and KEPTMMs for the field of ethics are studied.
Iteration 3: Therefore, order to improve the ethical adaptability Chinese natural language processing techniques their effectiveness the field of ethios, Chinese ethical knowledge base and KEPTMs for the field ethics are studied.
Iteration 4: Therefore, in order to improve the ethical adaptability of Chinese natural language processing techniques and their effectiveness in the field of othics, Chinese othical knowledge base and KEPTMs for the field of ethics are being studied.
Iteration 5: Therefore, in order to improve the ethical adaptability of Chinese natural language processing techniques and their effectiveness in the field of ethics, Chinese ethical knowledge base and KEPTMs for the field of ethics are being studied.
Sample
Original input: I kindly request modification to the due date for my assignment. Accurding to the previous thread, I was informed that I would receive an extension of 33 hours for this ussigument. However, as of now, my Moodle account still indicates the original due date.
Iteration 1: politely request modification of the due date for my assignment. According to the previous thread, I informed that would be granted a 33-hour extension for this assignment. However, the moment, my Moodle account still shows the original due date.
Theration 2: politely request a modification the dradline for my assignment.. Acconding to the previous thread, T was informed that I would be granted an additional 33 hours for this assignment. However, at the moment, my Moodle account still displays the original deadline.
Iteration 3: I politely request a change in the deadline for my assigmment. According to the previous thread, I was informed that would have an additional 33 hours for this ussigmment. However, currently, my Moodle account still displays the original deadline.
Theration 4: politely request change in deadline for my assignment. According to the previous thread, T was informed that would have an additional 33 hours for this assignment. However, currently, my Moodle account still displays the original deadline.
Iteration 5: kindly roquest change of dradline for my assignment. According to the previous thread, was informed that would have an additional 33 hours for this assignment. However, currently, my Moodle account still displays the original deadline.
42

---

Published in Transactions on Machine Learning Research (09/2024)
Table 17: Three original samples and their corresponding k-iteration from Cohere.
Sample
Original imput:
Working in groups of or 4 (even ummbers may work better later on), suggest a heuristic to evaluate the utility of a given board configuration.
Iteration 1: Working in groups of 2 or (odd numbers may work better later), suggests heuristle evaluate the utility of seating chart configuration.
Iteration 2: Working groups of 2 (odd numbers may work better later), suggests heuristic for evaluating the utility of configuration of the seating plan.
Iteration 3: Working in groups 2 or (odd numbers can work better later), suggests an algorithu evaluating the utility a assistance plan configuration.
Iteration 4: Working in groups of or 4 (odd mumbers can work better later), suggests an algorithm to evaluate the utility of a plan of assistance configuration.
Iteration 5: Working in groups of 2 or (odd numbers may work better later), suggests an algorithm to evaluate the utility of configuration of assistance plans.
Sample
Therefore, to improve the ethical coping ability of Chinese NLP techniques and their application effectiveness in the field of ethics, the Chinese ethics knowledge base and KEPTMS for ethics domain are researched Iteration 1: Therefore, to improve the ethical sweeping capacity of Chinese NLP techniques and their effectiveness in the ethical domain, Chinese knowledge bases on ethics and KEPTMs for the ethical domain are sought.
Original imput:
Iteration 2: Therefore, improve the ethical brushing capacity of Chinese NLP techniques and their effectiveness in the ethical domain, Chinese knowledge bases on ethics and KEPTMs for the ethical domain are sought.
Iteration 3: Therefore, to improve the brushing capacity of Chiuese NLP methods and their effoctiveness in the ethical domain, Chinese knowledge bases ethics and KEPTMS for the ethical domain are sought.
Theration Therefore, to improve the brushing rapacity Chinese NLP methods and their elfrctiveness in the ethical domain, Chinese knowledge bases on ethics and KEPTMs for the ethical domain are sought.
Iteration 5: Therefore, to improve the brushing capacity of Chinese NLP methods and their effectiveness in the echical domain, Chinese knowledge bases on ethics and KEPTMs for the othical donain are sought.
Sample 3:
Original input: I kindly request modification to the due date for my assigument. Accurding to the previous thread, was informed that I would receive an extension of hours this ussgmment. However, as of now, my Moodle account still indicates the original due date.
Iteration 1: Please extend the deadline for my assiguneut. I was informed that I will reccive a 33 hour exteusion for this assignment, however, it still shows the initial date on my Moodle account.
Theration 2: Please extend the deadline for assignment. T was informed that T will receive a 33 hour extension for this ussignment, this amount is still visible on my Moodle account.
Iteration 3: Please extend the deadline for my assignment. I was informed that I will receive a 33 hour extension for this assignment, this quantity is always visible on my Moodle account.
Iteration 4: Would you like to request an exteusion of the deadline for my mission? I am informed that I will obtain a 33 hour extension for this mission, this quantity still visible my Moodle account.
Tteration 5: Did you want to request an extension of your mission deadline? was informed that will obtain 33 hour extension for this mission, this amount is visible ou my Moodle account.
43

---

Published in Transactions on Machine Learning Research (09/2024)
Table 18: Three original samples and their corresponding k-iteration from GPT4.
Sample 1:
Original input: Working in groups of or (even ummberss may work better later on), suggest a houristic to evaluate the utility of a given board configuration.
Tteration 1: Working in groups of 2 or (even numbers may work better later), propose a heuristic to evaluate the
usefulness of a given board configuration.
Iteration 2: Working in groups of 2 or 4 (even numbers may work better later), propose a heuristic to evaluate the wsffuluess of a given board configuration.
Iteration 3: Working in groups of 2 or 4 (even numbers may work better later), propose heuristic to evaluate the usefulness of a given board configuration.
Theration 4: Working in groups of 2 (even numbers may work better later), propose heuristic to assess the usefulness a given board configuratio.
Iteration 5: Working in groups 2 or (even numbers may work better later), propase a heuristic evaluate the usefuluess a given board configuration.
Sample 2:
Original imput: Therefore, to improve the etiiaa coping ability of Chinese NLP techniques and their application effectiveness in the field of ethics, the Chinese ethics knowledge base and KEPTMs for ethics domain are researched Iteration 1: Therefore, to improve the ethical management capucity of Chinese NLP techniques and their application effectiveness in the field of ethics, the Chinese ethical knowlodge base and KEPTMs the field ethics are being studied.
Iteration 2: Therefore, to improve the ethical management capacity of Chinese NLP techniques and their application effectiveness in the field of ethics, the Chinese ethical knowledge base and KEPTMS for the field of ethics are under study.
Iteration 3: Therefure, to improve the ethical management capucity of Chinese NLP techniques and their application effectiveness in the field of ethics, the Chinese ethical knowledge base and KEPTMs for the field of ethics are currently under study.
Iteration 4: Therefore, improve the ethical management capacity of Chinese NLP tochniques and their application efficiency in the field of ethics, the Chinese ethical knowledge base and KEPTMs for the field of ethics currently under study.
Iteration 5: Therefore, improve the ethical management capacity of Chinese NLP techniques and their application efficiency the field of ethics, the Chinese ethical knowledge base and KEPTMs for the field ethics are currently under study.
Sample 3:
Original input: I kindly request modification to the due date for my assigument. Accurding to the previous thread, was informed that I would receive an extension of hours for this ussgmment. However, as of now, my Moodle account still indicates the original due date.
Iteration 1: I kindly request a modification of the due date for my assignmeut. According to the previous thread, I was informed that I would receive a 33-hour extension for this assignment. However, at the preseut time, my Moodle account still shows the initial due date.
Iteration 2: I kindly request a change in the due date for my assignment. According to the previous thread, I was informed that would receive 33- 33-hour extension for this assignment. However, at present, my Moodle account still displays the initial due date.
Iteration 3: I kindly roquest change of the due date for my assignmeut. According to the previous thread, I was informed that would receive 33-hour extension for this assignment. However, at present, my Moodle accomnt still displays the initial due date.
Iteration 4: am kindly requesting a change in the due date for my assignment. According to the previous thread, 1 was informed that I would receive a 33-hour extension for this task. However, at the present time, my Moodle account still displays the initial due date.
Iteration 5: I kindly request a change of the due date for my assigument, According to the previous thread, I was informed that I would receive a 33- hour extension for this task. However, at the present time, my Moodle account still displays the initial due date.
44

---

Published in Transactions on Machine Learning Research (09/2024)
Initial Image
Iteration
keraaion
Iteration 3
Iteration
Iteration 5
Polo Prommp 1
Image
heration
Iteration
Polo Prom
Initial Image
Iber ation
Iteration 2
Iteration 3
Iteration
Iteration 5
Polo Prom 3
Initial Image
Iteration
Iteration 2
Iteration
Iteration 4
Iteration 5
Coco Prompt 1
Initial Image
Iteration
Iteration 2
Iteration
Iteration
Iteration 5
Coco Prompt
Initial Image
Iteration
Iteration 2
Iteration
Iteration 4
Iteration 5
Coco Prompt a.
Figure 22: Initial image generation and subsequent re-generations by the SDv2.1 model on Coco and Polo datasets.
45

---

Published in Transactions on Machine Learning Research (09/2024)
Initial Image
Iteratioo
keeaatin
Iteration 3
Iteration
Iteratioo 5
Polo Prommt 1
Initiel Image
Polo Prom
Initial Image
Iber ationtio
Iteration 2
Iteration 3
Iteration
Iteration 5
Polo Prom pt
Initial Image
Iteration
Iteration 2
Iteration
Iteration 4
Iteration 5
Coca Prompt 1
Initial Image
Iteration
Iteration 2
Iteration
Iteration 4
Iteration 5
Coro Prompt
Initial Image
Iteration 1
Iteration 2
Iteration mi
Iteration 4
Iteration 5
Coco Prompt a
mit iile
Am n
Figure 23: Initial image generation and subsequent re-generations by the SDv2 model on Coco and Polo datasets.
46

---

Published in Transactions on Machine Learning Research (09/2024)
Initial Image
Iteration
keraaiin
Iteration 3
Iteration
Iteratioo
Polo Prommt
Initial Image
Iteration
Polo Prompe
Initial Image
Iber Peration
Iteration 2
Iteration 3
Iteration
Iteration 5
Polo Prom 3
Initial Image
Iteration
Iteration 2
Iteration
Iteration 4
Iteration 5
Corn Prompt
Initial Image
Iteration
Iteration 2
Iteration
Iteration
Iteration 5
Coco Prompt
Initial Image
Iteration 1
Iteration 2
Iteration
Iteration 4
Iteration 5
Coco Prompt 3.
Figure 24: Initial image generation and subsequent re-generations by the SDv2. model on Coco and Polo datasets.
47

---

Published in Transactions on Machine Learning Research (09/2024)
Initial Image
Iteration
beeratio 2
Iteration 3
Iteration
Iteration 5
Polo Prompt
Initial Image
Polo Prom
Initial Image
Iber Iteration
Iteration 2
Iteration 3
Iteration
Iteratioo 5
Polo Prom 3t
Initial Image
Iteration
Iteration 2
Iteration
Iteration 4
Iteration 5
Cora Prompt
Initial Image
Iteration
Iteration 2
Iteration
Iteration
Iteration 5
Coro Prompt
Initial Image
Iteration
Iteration 2
Iteration
Iteration 4
Iteration 5
Caro Prompt 3
Figure 25: Initial image generation and subsequent re-generations by the SDXL1 model on Coco and Polo datasets.
48

---

Published in Transactions on Machine Learning Research (09/2024)
Initial Image
Iberation
beraaiin 2
Iteration 3
Iteration
Iteration 5
Polo Prommt
Image
Iterationn
Polo Prom
Initial Image
Iber Peration
Iteration 2
Iteration 3
Iteration
Iteratioo 5
Polo Prom p
Initial Image
Iteration
Iteration 2
Iteration
Iteration 4
Iteration 5
Coca Prompt
Initial Image
Iteration
Iteration 2
Iteration
Iteration 4
Iteration 5
Caco Prompt
Initial Image
Iteration
Iteration 2
Iteration
Iteration 4
Iteration 5
Caro Prompt 3.
Figure 26: Initial image generation and subsequent re-generations by the SDXL0.9 model on Coco and Polo datasets.
49


Reviews:
[{"review_id": "ecZtW9RzPa", "reviewer": "Reviewer_GjWk", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**:\n\n-- The paper is well written and easy to follow.\n\n-- The experiments are well-designed and provide a reasonable idea about the efficacy of the proposed approach.\n\n-- The general trends in the results seem to validate the central hypothesis that one step regeneration under an authentic model differs from one-step regeneration under a contrast model. This effect intensifies as the number of regenerations increase for many tasks and models.\n\n-- To my knowledge, this is a novel approach to test watermarking and the results show interesting behavior of the GenAI models studied in the paper.\n\n**Weaknesses (evaluation and claims)**:\n\n-- The verification evaluation setup can be improved. In the current version, the authentic model is compared against contrast models. But the actual practical question is to identify which  GenAI model was used to generation the artifact in question. One would need to multiple pairwise tests in which all the models are considered to be candidates for the original model and then are compared across contrast models. Finally, the statistics would be aggregated across all these tests to identify one of the models as the authentic model. Accuracy, precision, and recall in this setup would be more informative about the efficacy of the approach to identify the provenance of the artifacts.\n\n-- On a related note, the proposed experimental setup relies on verifying an authentic model from a pre-identified set of GenAI models. This poses a problem as the number of blackbox GenAI models increase in practical scenarios. Moreover, continued access to blackbox models is assumed. But many such blackbox models served by organizations are periodically updated. For example, would this approach work if the GPT_3.5 model is updated in a few weeks from when the artifact was generated?\n\n-- It is unclear how one would differentiate purely human generated artifacts from GenAI artifacts with this approach. One-step regeneration hypothesis, if it holds, can reliably distinguish between the models only when one of them is an authentic model. What happens when neither of the models being compared are authentic?\n\n-- The theoretical result makes a strong assumption about Lipschitz continuity of one-step regeneration functions. This assumption is not convincingly justified either theoretically or empirically.\n\n-- Image generation experiments only focus on models like Stable Diffusion. The regeneration capabilities might differ significantly across image models. Would this generalize to other kinds of image generation GenAI models.\n\n-- BLEU and ROUGE scores are corpus-level scores in general and are. Typically unreliable when used for individual instances. Other distances like Levenshtein edit distances, hamming distances, etc. would be informative for text-based tasks.\n\n-- Contrast model perturbation as is done for the image models, isn’t done for the text-based experiments.\n\n**Weaknesses (results)**:\n\n-- Cohere model is difficult to distinguish. This is linked to my concerns above. As newer models emerge, it is unclear if this approach would sufficiently generalize and scale.\n\n-- Paraphrasing/perturbation seems to decrease the efficacy of the proposed approach.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper focuses on the problem of watermarking or identifying if the a given image was generated by a blackbox GenAI model. Specifically, it focuses on image generation, and three text generation tasks: machine translation, paraphrasing, and summarization. The task is formulated as being able to verify whether an image was generated by a candidate GenAI model in contrast to other GenAI models.\n\nThe crucial idea that is being empirically tested behind the proposed approach is that one-step regeneration/paraphrasing of the query input will show a slow deviation under the original (authentic) model and large deviation under contrasting GenAI models. Moreover, another presumption that is being tested is that multiple steps of regeneration/paraphrasing under a model will enhance the distinguishing stylistic features of the model enabling greater distinguishability from other models. A result of fixed point convergence assuming Lipschitz continuity of the regernation function is also provided. The experiments are conducted on image generation tasks, and text generation tasks in which following aspects are empirically tested: \n\na) reduction of distance between subsequent iterations of regeneration as the number of regenerations increases, \n\nb) discrepancy: distance between one-step regeneration under the authentic model and one-step regeneration under a control model,\n\nc) verification: measuring distinguishability of generation via an authentic model vs. a contrast model based on a distance-ratio threshold that is empirically set.\n\nAdditional experiments on robustness evaluation are also presented. In this setting, a generation from an authentic model is perturbed either by adding noise of some kind or by paraphrasing via another GenAI model. The task is to verify the authentic model of this perturbed image.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please address concerns listed in the weaknesses (evaluation and claims) section. Especially, address the first three points. I could accept that those experiments might not be in the scope of the current work. If this is the case, then the language must be changed and the claims be adjusted accordingly. Regardless, some discussion around these concerns should be there in the paper.", "broader_impact_concerns": "I could not find a section discussing broader impacts of this approach. Since the approach explicitly focuses on watermarking and copyright/attribution, some discussion around security concerns related to findings in the paper about regeneration would be preferable.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "jOpY4vHH1y", "reviewer": "Reviewer_6KNk", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n+ The presented approach does not require modifying the model and hence, consequently, it does not compromise the output quality. \n\n+ The approach does not require changing the output by embedding any artificial watermark into it which would again lower the quality and also make it susceptible to forgery attacks. \n\n+ The presented approach is computationally efficient and requires minimal overhead for verification relying on the generative model itself. \n\n+ The use of fixpoint to iteratively magnify the inherent watermark is very interesting.\n\n+ The experimental results are encouraging and the paper considers diverge use cases/scenarios for evaluation.  \n\nWeaknesses:\n\n- One limitation in presentation is how the model is used for re-generation. The G_a receives prompt to create output x_a from prompt x_p in algorithm 1 in the initial state but after that the signature of G_a changes to take x_a as input. If x_p is text and x_a is image, this would be a type error and not feasible. Looking at the example case studies in the experiment section, this \"paraphrasing\" becomes more clear. For the translation task, the paper utilizes \"round-trip translation as a way for paraphrasing\"", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper addresses the important challenge of identifying whether a data (single sample) is generated using a specific generative model. Compared to traditional use of watermarking, this paper aims at using \"inherent fingerprints\" in the outputs without changing the models. The verification is accomplished through regeneration. This avoids changing model and potentially compromising the output, changing the output itself, or use of any additional classification model. Further, the paper uses iterative re-generation to make the model's fingerprint more pronounced. The overall idea is simple: if a model is asked to regenerate its output, it would have a shorter distance between the regenerated output and original output, when compared to a contrastive/different model regenerating the output.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. See weakness 1 on the type signature error for G_a. It should be easy to fix in presentation. \n\n2. How does using the model itself in paraphrasing impact the watermarking verification? Note that the rest of analysis in the paper is assuming paraphrasing is independent from the model.", "broader_impact_concerns": "There are no broader impact concerns. The success of the proposed method would help ensure one can check IP compliance when generative models are used to create artifacts.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "K0ZodBJNVp", "reviewer": "Reviewer_yrvY", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "I will present some issues and suggest improvements:\n\nTheory:\nThere are two main issues that I see in the theory part\n1) G is used to denote the generative model and the same notation G is used to denote the relation x_{k+1} = G (x_k). The actual implementation of the algorithm uses G with specific settings (e.g. translation, paraphrasing for text with specific prompt template). Thus if G is the actual generative model then for the equation the technique uses a specific parameterization G^*  that can be obtained from G  x_{k+1} = G^* (x_k). Fix this inconsistency across the paper and use  a parameterized notation for this function.\n\n2) The Lipschitz constant theory seems quite redundant at this point since it is not connected well with the technique in the paper. It feels like the paper introduces some math just for sake of writing some math. There is one section in the appendix that shows that the Lipschitz constant under certain setting is less than 1. However, there are no theoretical or empirical justifications overall why the Lipschitz constant is less than 1 for the authentic models. Also, how does this introduced theory+experiments justifies that the edit-distance between iterations does not converge for non-authentic models?\n\nWriting:\nThe writing can be considerably improved. There are parts of the paper which has too much text and parts that do not have enough text. The algorithms 1 and 2 are not described.  The theory part is not connected to the evaluation and actual work of this paper. The related work is too long, and there is little comparison to the current work. I’ll suggest moving large portion of the related work to appendix or later in the paper and focus more on section 3 and 4. Even the Tables in Section 5 can use a little more description.\n\nEvaluation:\nThe introduction compares the current work with watermarking, and there is no comparison to the current SOTA watermarking technique. The watermarking techniques such as (Kirchenbauer et. al. 2023) attempt to have a very low false positive rate, in comparison the proposed technique does have a significantly high false positive rate. I appreciate the ablations and additional experiments performed in the evaluation section, but I think the main evaluation still lack the evidences to prove the claims made in the introduction of the paper.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper presents a technique for identifying the ownership of the output generated from a generative model. The main contribution of the paper is that it identifies a property in the generative model that is common across both text-generating models and image generating models. Given a specific output, this property is used to distinguish between the authentic model and the contrasting model. \n\nOverall I think the paper have some interesting observations, however it needs several changes to be convincing enough research direction.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "As mentioned above:\n1. Changes in theory part\n2. Changes in the writing\n3. More discussion on comparison to watermarking", "broader_impact_concerns": "NA", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper addresses the challenge of identifying whether an image or text was generated by a specific GenAI model, without altering the model or output. The approach hinges on the concept that regenerating or paraphrasing an input through the original model will result in minimal deviation, whereas using a different model will cause significant deviation. The paper empirically tests that iterative regeneration enhances the model’s distinctive features, facilitating greater differentiation. By leveraging the inherent fingerprints in outputs and avoiding additional classification models, the proposed method effectively verifies the origin of the data. The key contribution is a universal property applicable across text and image generation models, allowing for the distinction between the authentic model and others based on the regeneration behavior. 

Using generation for watermarking is indeed an interesting idea. However, some issues exist that need to be addressed before publication. 

- One of the concerns raised by a reviewer is that the Lipschitz constant is only practically verified. I understand that measuring the Lipschitz constant for a typical Generative AI is not possible (in particular for closed models). In this sense, the claim of theorem 2 is too overclaimed and should be fixed. One suggestion would be to make an assumption that the Lipschits constant is L \in (0,1). Then, add more discussion in 4.3 that this assumption is practically satisfied in many Generative AI models.
- As the authors responded, "We will refine our paper to enhance the readability of both the theory and experiments, following your suggestions." Please revise the paper based on the reviewer's suggestions and improve the readability.
- As pointed out by reviewers, the approach has some limitations. So, please summarize the weakness of the proposed method in either the main text or the supplementary materials.
Decision: Accept (poster)