How Many Images Does It Take? Estimating Imitation Thresholds in Text-to-Image Models
Authors: Sahil Verma
Royi Rassin
Arnav Mohanty Das
Gantavya Bhatt
Preethi Seshadri
Chirag Shah
Jeff Bilmes
Hannaneh Hajishirzi
Yanai Elazar
Venue: Accepted by TMLR ()

Abstract: Text-to-image models are trained using large datasets of image-text pairs collected from the internet. These datasets often include copyrighted and private images. Training models on such datasets enables them to generate images that might violate copyright laws and
individual privacy. This phenomenon is termed imitation – generation of images with content that has recognizable similarity to its training images. In this work we estimate the point at which a model was trained on enough instances of a concept to be able to imitate it – the imitation threshold. We posit this question as a new problem and propose an efficient approach that estimates the imitation threshold without incurring the colossal cost of training these models from scratch. We experiment with two domains – human faces and art styles, and evaluate four text-to-image models that were trained on three pretraining datasets. We estimate the imitation threshold of these models to be in the range of 200-700 images, depending on the domain and the model. The imitation threshold provides an empirical basis for copyright violation claims and acts as a guiding principle for text-to-image model developers that aim to comply with copyright and privacy laws.

Published in Transactions on Machine Learning Research (12/2025)
How Many Images Does It Take?
Estimating Imitation Thresholds in Text-to-lmage Models
Sahil Verma* Chirag Shah
Royi Rassin
Arnav Das
Gantavya Bhatt*1
Preethi Seshadri's
Jeff Bilmes'
Hannaneh Hajishirzi"
Yanai Elazar?
Uniivrsitty of Washington, Seattle Irvine 4 Allen Institute of AI
Bar--Ilnn University
University of California,
Reviewed OpenReview:
Abstract
Text-to Rext-to-image models are trained using large datasets of image-text pairs collected from the internet. These datasets often include copyrighted and private images. Training models on such datasets enables them to generate images that might violate copyright laws and individual privacy. This phenomenon is termed imilation generation of images with content that has recognizable similarity to its training images. In this work estimate the point at which model was trained on enough instances of concept to be able to imitate it - the imitation threshold. We posit this question as new problem and propose an efficient approach that estimates the imitation threshold without incurring the colossal cost of training these models from scratch. We experiment with two domains human faces and art styles, and evaluate four text-to-image models that were trained on three pretraining datasets. We estimate the imilation threshold of these models be in the range of 200-700 images, depending threshold provides an empirical basis for copyright violation claims and acts a guiding principle for text-to-image tooei model developers that aim to comply with copyright and privacy laws. Website: hetps://how-many-t -oo---oogghheee does---oos-tie t-kekee tettttaa.ttttiitt github. io/. Code: https: //github. ccmm/reaahi111MMMMM1--
the domain and the model. The imitation
1 Introduction
The progress of text-to-image models in recent years (Ramesh al., 2021; Rombach al., 2022; Goodfellow et al., 2022; Yao et al., 2025) is much attributed to the availability of large-scale pretraining datasets like LATON (Schuhmann et al., 2022). These datasets consist of semi-curated image-text pairs scraped from Common Crawl, which leads to the inclusion of explicit, copyrighted, and private material (Cavna, 2023; Hunter, 2023; Vincent, 2023; Jiang et al., 2023; Birhane et al., 2021). Training models on such images may be problematic because tett-to-image models can imitate - generate images with highly recognizable features from their training data (Somepalli al., 2023a; Carlini et al., 2023a). This behavior has both legal and ethical implications, such as copyright infringements well as privacy violations of individuals whose images are present in the training data without consent, that has led to several lawsuits by artists against such model providers (Saveri & Butterick, 2023).
Previous work proposed methods for detecting when models memorize training images (Somepalli et al., 2023a; Carlini et al., 2023a), and mitigation techniques (Somepalli et al., 2023b; Shan et al., 2023). For instance, rescarchers found that duplicate images increase the chance of memorization. Typically, memorization refers to the replication of specific training image. Instead of measuring memorization, we focus on imitation broader and under-explored sense of memorization, where concept is recognizable from generated image.

---

Published in Transactions on Machine Learning Research (12/2025)
"A painting in the style of (ARTIST)"
Robert Goodnough
Park
Piet Mondrian
Van Gogh
Text-to- Model
Generated Images
Low Imitation
High Initation
Real Images
Imitation Score
Imitation
Threshold
57
127
Concept Frequency 11K
213K
Figure An overview of the imitation phenomenon where seek the imitation threshold the point at which model was exposed enough instances of concept that reliably imitate it. The figure shows four concepts (e.g., Van Gogh's style) that have different counts the training data (e-g., 213K for Van Gogh). the image ability the text-to-image model imitate it increases (e.g., Piet Mondrian's The imitation threshold represent the number instances a model be trained on such that humans recognize such concept in generated images.
of concept. increases, the Van Gogh's art styles have higher imitation).
In this work, ask how many instances of concept does text-to-image model need to be trained to imitate it, where concept refer to specific person or specific art style, for example. Establishing such imilalion threshold is useful for several reasons. First, it offers an empirical basis for copyright and privacy violation claims, suggesting that if concept's prevalence in the training data is below this threshold, a model trained on such data cannot reproduce such concept (Saveri & Butterick, 2023; Vincent, 2023; Ceoln, 2022). Second, it acts as a guiding principle for text-to-image models developers that want to avoid such violations. Finally, it reveals an interesting connection between training data statistics and model behavior, and the ability of models to efficiently harness training data (Udandarao al., 2024; Carlini et al., 2023b). We posit this question
problem, and provide its schematic overview in Figure 1.
To find the gold imitation threshold one has to train counterfactual models while varying the number of images of a concept and measuring models' imitation abilities. However, training even one these models is extremely expensive (Bastian, 2022). Instead, we propose tractable alternative, Measuring Imitation ThrEsh Through Instance Count and Comparison (MIMETIC*), that estimates the threshold without training multiple models using observational data. We start by collecting large set of concepts (c.g., various kinds of art styles) per domain (e.g., domain of art styles), and use a text-to-image model to generate images for each concept. Then, we compute the frequency (in the training data) and the imitation score of each concept (64.1). Then, we estimate the imitation scores using dedicated embeddings that capture the similarities concepts ($4.2). Finally, we estimate the imitation threshold for each domain using a change detection algorithm (Killick et al., 2012) ($4.3).
Operating with observational data, naive approach may lead to biased estimate confounding variables such the quality of the imitation scoring model on different groups within the domain, or estimating the training frequencies of concepts (e.g,, simple counts of 'Van Gogh' in the captions results in a biased estimate since the artist may be mentioned in the caption without their painting in the corresponding image). We carefully tailor 2IMETIC to deconfound such variables ($4). Since our approach obscrvational in nature, we also conduct counterfactual experiments to validate our results (SC). We train models on new concepts that not seen in the training data, and vary the concept frequency to several values both smaller and
2

---

Published in Transactions on Machine Learning Research (12/2025)
larger than estimated imitation threshold. These experiments demonstrate that our estimated imitation thresholds are accurate (with a difference of upto 10% in the estimated thresholds).
Overall, we propose and formalize a new problem that estimate the number of images of a concept that text-to-image model requires for imitating it ($3), and propose method MIMETIC² that efficiently estimates the imiitaiio threshold for these models ($4). We apply our approach to the domains of human face and art style imitation four text-to-image models and estimate the imitation thresholds for such models to be in the range of 200-700 images ($6). These imitation thresholds provide concrete insights on imitation abilities, can act as an empirical basis for copyright. violation claims, and as guiding principles for model developers.
2 Background
Text-to-Image Models Generating images from textual inputs a long studied problem, with diffusion models as the current state-of-the-art (Sohl-Dickstein al., 2015; Dhariwal & Nichol, 2021).
Diffusion models are generative models that learn to approximate the underlying data distribution. Given a trained diffusion model, it is possible to sample synthetic images from the learned distribution by performing a sequence of denoising operations. Open-sourced models like Stable Diffusion (SD) (Rombach et al., 2022) are trained using large datasets such as LATON (Schuhmann et al., 2022), a large image-caption dataset. scraped from Common Crawl.
Dataset Issues and Privacy Violations The advancement in text-to-image capabilities, largely due to large datasets, is accompanied by concerns about the training on explicit, copyrighted, and private material (Birhane al., 2021) and imitating such content when generating images (Cavna, 2023; Hunter, 2023; Vincent, 2023; Jiang et al., 2023; He et al., 2024). For example, (Birhane et al., 2021) and (Thiel, 2023) found several explicit images in the LAION dataset, and Getty Images found millions of their copyrighted images in LAION (Vincent, 2023). Issues around imitation of training images has especially plagued artists, whose livelihood is threatened (Saveri & Butterick, 2023; Shan et al., 2023), as well as individuals whose face has been used without consent to create inappropriate content (Hunter, 2023; Badshah, 2024). The imitation threshold would be a useful basis for copyright infringement. and privacy violation claims in such cases.
Training Data Statistics and Model Behavior Pretraining datasets are a core factor for explaining model behavior (Elazar et al., 2024). (Razeghi et al., 2022) found that the few-shot performance of language models is highly correlated with the frequency of instances in pretraining datasct. (Udandarao et al., 2024) bolster this finding by demonstrating that the performance of multimodal models on downstream tasks is strongly correlated with a concept's frequency in the pretraining datasets. In addition, (Carlini et al., 2023b) show that language models more easily memorize highly duplicated sequences. As such, expanding the duplicates finding to the same concept re-appcaring in different images, we can intuitively conjecture such concepts will be learned and then imitated by models. In this work, we study this question, and quantify the number of images to appear in the training data that are required to imitate a concept.
3 Problem Formulation and Overview
In this work, we seek to find the minimal number of images of a concept text-to-image model requires in order to imitate it.
We follow the same definition of concepts as previous work (Udandarao et al., 2024): we consider specific instances of human faces and artist styles as distinct concepts. As such, each item in a domain constitutes a concept; human individuals and artistic styles in the human face and art style domains, respectively. While there might be some visual similarities between concepts, especially for art styles, we employ discriminator models that distinguish between concepts with high accuracy (which is necessary for the accurate estimation of the imitation threshold).
Defining Concept:
Sctup: Our setup involves a training dataset D A vi) x E X. yi Vi composed of n (image, caption) pairs, where X' and y represents space of images and text captions, respectively, and a model
3

---

Published in Transactions on Machine Learning Research (12/2025)
M that is trained on D to generate an image given the text-caption y. M(y) denotes the generated image for provided caption y. Let (x) be an indicator function that indicates whether a concept Z' is present in an image x. Each concept Zt appears o² = 1x))) times in the dataset D, where the dataset may contain multiple concepts {Z', .2?...... Lastly, M denotes model trained on dataset where c² = k.
The imitation threshold is the minimal number of training images containing a concept Z' that model M generates images M(p²) (with different random soods) from a prompt p' which mentions the concept Zi, and Z is visually recognizable. For example, if Z refers to Van Gogh's 's art style, then the imitation threshold is the minimal number of training images of Van Gogh's paintings in dataset used to train text-to-iman -mmage model, for which the model can generate images that imitates Van Gogh's 's art style. We consider a generated image to be an imitation of a concept if the similarity between the generated image and the original images of that concept in the training data is above a threshold. We measure the similarity using a concept specific detector model and we determine the detection threshold by conducting experiments on the original images of the concept (Soction 4.2).
Imitation Threshold' A min k E (1,....,n) m.....,,:::TAAA :T:TT(MM(()) = }}
Optimal Approach Finding the imitation threshold is a causal problem; The gold threshold can be achievod by performing the counterfactual experiment (Pearl, 2009): For each concept Z2, create k training datasets (DI, D/...... ..... D'.... }, and train a model MM on each dataset DÍ. Once we find a model, Mi which is able to generate images where the concept Z is recognizable, but M cannot, we deem & as the imitation threshold for that concept. However, due to the high costs of training even one text- lo-smage model (Bastion, 2022), this approach is impractical.
MIMETIC² Instead, we propose a tractable approach which efficiently estimates the imitation threshold while relying on certain assumptions (discussed at the end of this section). The kcy idea is to use observational data instead of training multiple models with a different nunber of images of a concept. This idea is a common approach to answer causal questions, when performing interventions is expensive, or unethical, inter alia, (Pearl, 2009; Lesci et al., 2024; Lyu et al., 2024). Concretely, we collect several concepts from the same domain (e.g., art styles) with varying image counts in the training dataset D of a pretrained model M. Then, we identify the count where the model M starts imitating concepts, and deem this count to be the imstation threshold for that domain. Note that, this threshold is domain specific and not concept specific, where domain is defined as the abstract set that contains the specific concept we want to measure imitation threshold for, e.g., if concept refers to Van Gogh's art style, then its domain would be art styles. Therefore in this setup, MIMETIC² can estimate the imitation threshold for the domain of art styles, but it cannot estimate it for Van Gogh's art style specifically.
Assumptions To estimate the imitation threshold using observational data, we make three assumptions. These are standard assumptions in the field, which are necessary for answering such complex questions. Crucially, we are able to empirically validate all of our assumptions, and find they hold for our datasets and models (Appendix C). First, we assume distributional invariance between the images of all concepts in a domain. Under this assumption, measuring the imitation score of a concept Z for a counterfactual model Me that is trained with k images of 7 is equivalent to measuring the imitation score of another concept. Z' that currently has k images in the already trained model M
Imitation (core(Me. R Imilation Score(M This assumption allows us to use observational data to estimate the imitation threshold without training models from scratch.
Second, we assume that there are no confounders between the imitation score and the image count of a concept, i.e the imitation score of a concept is not affected by the presence of other concepts in the training data. Since there are visual similarities between concepts, it might seem that such concepts might influence
Prompts p are usually different. from the training data captions, y.
2n ideal world, we can train ((log(k) models, with estimated cost of $10M if k 100, 000 (see Appendix O).
4

---

Published in Transactions on Machine Learning Research (12/2025)
Step 1: Estimating Concept Frequency
Build detector for Billie Eilish
Training Images with "Billie Eilish" in Captions
Filtered images Billie Eilish
f( )
f(
320 Frequency
Imitation Score
Billie Eilish
(320, 0.5)
Concept Frequency
photorealistic close-up of Billie Eilish"
Port-to-Image Model
g
0.5 A
Training Images from Step 1:
Concept Similarity
Score
Step 2: Computing Imitation Score
Figure Overview of MIMETIC²'s methodology to estimate the imitation threshold. In Step 1, we estimate the frequency of each concept (belonging to domain) in the pretraining data by obtaining the images that contain the concept of interest. In Step 2, we use the filtered images of each concept (obtained in Step 1) and compare them to the generated images to measure imitation (using g that receives training and generated images). We repeat this process for each concept to generate the imitation score graph, and then determine the imstation threshold with a change detection algorithm.
the imitation score of a concopt - however, our discriminator models are able to distinguish between concepts with high accuracy, alleviating the concern for such a phenomenon.
Third, assume each image of concept contributes equally to the learning of the concept. We further discuss these assumptions and provide empirical evidence they hold for the datasets we experiment with in Appendix C.
4 Proposed Methodology: MIMETIC²
We illustrate our proposed methodology in Figure 2. At high level, for specific domain (e.g., human faces), MIMETIC² estimates the frequency of each concept in the pretraining data ($4.1) and estimates the model's ability to imitate it ($4.2). We then sort the concepts based their frequencies, and find the imitation threshold using a change detection algorithm ($4.3).
4.1 Computing Concept Frequencies
Challenges Determining a concept's frequency in a multimodal dataset can be achieved by employing high-quality classifier for that concept over every image and counting the number of detected images. However, given the scale of modern datasets with billions of images, this approach is expensive and prone classification errors.
Estimating Concept Frequency
We first make a simplifying assumption that concept is present only if an image's caption mentions it. We empirically lest the validity of this assumption and find it to be accurate (Appendix D). However, this is not sufficient because concepts often do not appear in the corresponding images, even when they are mentioned in the captions. For instance, Figure 3 showcases images whose captions contain "Mary Lee Pfeiffer" but such images do not always include her. On average, in our experiments we find that concepts occur only in 60% of the images whose caption mentions the concept.

---

Published in Transactions on Machine Learning Research (12/2025)
To address this problem, start by retrieving all images whose caption mentions the concept of interest and then further filter out the images that do not contain the concept, as detected by classifier (we build a classifier that indicates the presence of a particular concept in the image). We retrieve these images using WIMBD (Elazar ct al., 2024), a search tool based on a reverse index that efficiently finds documents (captions) in a dataset containing the search query (concept). To build a classifier for each concept we construct a set of high quality reference images. For example, a set of images with only the face of single person (c.g.; Brad Pitt). We collect these images automatically using a search engine (we use images from a search engine because several of the concepts in our experiments have low number of images that cannot be used to build classifier), followed by manual verification to vet the images (see Appendix E for details). These images are used as gold reference for automatic detection of these concepts in the images. We collect up to ten reference images per concept.
To classify whether a candidate image contains the concept of interest or not, we embed the candidate image and the concept's reference images using an image encoder (discussed in $4.2) and mcasure the similarity between the embeddings. If the similarity between a candidate image and any of the reference images is above some threshold, we consider that candidate image to contain the concept of interest. This threshold is established by measuring the similarity between images of the same concepts and images of different concepts which maximizes the true positives, and minimizes false positives. We provide additional details on determining the thresholds per domain in Appendices F and G.
Figure 3: LAION captions that mention "Mary Lee Pfeiffer', the mother of Tom Cruise. She is not always present in the images (the rightmost image).
Finally, we run the classifier on all candidate images whose caption mentions the concept, and take those that are classified as positive. For each concept, we retricve up to 100K candidate images from the pretraining dataset. We use the ratio of positive predictions to the total number of retrieved candidate images, and multiply it by the total caption count of concept in the dataset and use that as the concept's frequency estimate. For concepts with less than 100K candidate images, we count the number of images that are positively classified. Note that some URLs from the pretraining datasets we use are dead, a common phenomenon for URL based datasets (*link rot"" (Carlini et al., 2024; Lakic et al., 2023)). On average, we successfully retrieved 74% of the candidate images.
4.2 Computing the Imitation Score
Challenges Computing the imitation score entails determining how similar a concept in a generated image compared to its source images from the training data, Several approaches were proposed to accomplish this task, such as FID and CLIPScore (Salimans et al., 2016; Heusel et al., 2017; Sajjadi et al., 2018; Hessel et al., 2021; Podell et al., 2024). To measure similarity, these approaches compute the similarity between the distributions of the embeddings of the generated and training images of concept. The embeddings are obtained using image embedders like Inception model in case of FID and CLIP in case of CLIPScore. These image embedders often perform reasonably well in measuring similarity between images of common objects which constitutes most of their training data. However, they cannot reliably measure the similarity between two very similar concepts like the faces of two individuals or art style of two artists (Somepalli et al., 2024; Hessel et al., 2021; Ahmadi & Agrawal, 2024; Jayasumana et al., 2024). Therefore, MIMETIC² uses domain-specific image embedders to measure similarity between two concepts from that domain.
We embed the generated and real images of concepts using these embedders and use similarity to measure continuous imitation score. To establish threshold, we use a change detection algorithm (described next; $4.3). At high level, given a sequence of imitation scores, the algorithm finds the threshold on the scores above which the score is considered a (binarized) imitation of the said concept. As we are interested in finding a (binary) threshold, we binarize the score, which we find to correspond to the human perception imitation of a concept. To verify the validity of the binarized scores we conduct human subject experiments and find high correlation between human perception of imitation and the binarized threshold (Section 6). We leave future work the investigation of the continuous imitation score beyond the threshold.
6

---

Published in Transactions on Machine Learning Research (12/2025)
Estimating Imitation Score We use face embedding model (Deng al., 2022) for measuring face similarity and an art style embedding model (Somepalli et al., 2024) for measuring art style similarity. We find that even the specific choice of these models is crucial; for instance, in early experiments we used Facenet (Schroff et al., 2015), and observe it struggles to distinguish between individuals of certain demographics, causing drastic differences in the imitation scores between demographics. We provide more details on these early experiments Appendix M, and show that our final choice of embodding models work well on different. demographics.
To measure the imitation score we embed the generated images and filtered training images of a concept (obtained in $4.1) using the domain specific image embedder, and report the imitation score as the average imitation between all generated and top-10 most similar training images (cosine similarity between embeddings of generated and training images). To ensure that the automatic measure of similarity correlates with human perception, we also conduct experiments with human subjects and measure the correlation between the similarities obtained automatically and in the human subject experiments. We find this correlation to be high for both domains we experiment with ($6). We also do human subject experiments to verify the correctness of the binarized threshold and find this correlation to be high as well ($6).
4.3 Detecting the Imitation Threshold
After computing the frequencies and the imitation scores for each concept, we sort them in an ascending order of their image frequencies. This generates sequence of points, each of which is pair of image frequency and the imitation score of concept. We apply standard change detection algorithm, PELT (Killick et al., 2012), to find the image frequency where the imitation score significantly changes. Change detection is a classic statistical approach to find the points where the mean value of a sequence (e.g. stock value or network traffic) changes significantly. We choose PELT because of its linear time complexity in computing the change point (van den Burg Williams, 2022). We choose the first change point as the imitation threshold (see Appendix J for details about all change points). The application of change detection assumes that increasing the image counts beyond a certain threshold leads large jump in the imitation scores, and find this assumption to be accurate in our experiments (Figure 5a).
To obtain error bounds for our thresholds we perform a permutation test by sampling a subset of concepts per domain and dataset, and compute the threshold for the sampled set. We repeat this 1,000 times and report the mean and standard error of the thresholds.
5 Experimental Setup
Table 1: Domains, datascts, pretraining data, and models we
Domain
Dataset
Pretraining Data
Model
Human Faces
Celebrities, Politicians
LAION400M
LDM
Human Faces
Celebrities, Politicians
LAION2B-en
SD1.1, SDL.5
Human Faces
Celebrities, Politicians
LAION5B
SD2.1
Art Style
Classical, Modern LAION
LDM
Art Style
Classical, Modern Classical, Modern
LATON2B-en
SD1.1, SDL.5
Art Style
LAION5B
SD2.1
Table 2: Prompts used to generate images human faces and art styles.
Human faces
Art style
A photorealistic close-up photograph of X High-resolltion close-up image of X Close-up headshot of X
A painting in the style of X
An artwork in the style of X
A sketch in the style of X
X's facial close-up X's face portrait
A fine art piece in the style of X
An illustration in the style of
7

---

Published in Transactions on Machine Learning Research (12/2025)
Samara Joy
Jillie Mack
James Garner
Stephen King
Johnny Depp
Pi
IU
Figure 4: Examples of real celebrity images (top) and generated images from a text-lo-image model (bottom) with increasing image counts from left to right (3, 273, 3K, 10K, and 90K, respectively). The prompt is "a photorealistic closc-up image of (name)".
Table 3: The mean and std. error of the imitation thresholds for the models and domains we experiment with.
Human Faces
Art Style
Pretraining
Model
Celebrities
Politicians
Classical
Modern
LAION-400M
LDM
626 + 3
449 + 2
416
412
SD1.1
399 + 3
284 + 3
304 + 2
208 1
LA1ON2B-en
SD1.5
371 + 1
302 + 4
302 + 2
212 1
LAION-5B
SD2.1
617 + 5
385 + 5
330 =
292 3
Text-to-image Models and Training Data We use Stable Diffusson (SD) as the text-to-image models (Rombach et al., 2022). We use them because both the models and their training datasets are open-sourced. Specifically, we use SD1.1 and SD1.5 that were trained on LAION2B-en, a 2.3 billion image-caption pairs dataset, filtered contain only English captions and we use SD2.1 that was trained on LAION-5B, 5.85 billion image-text pairs dataset that includes captions in any language (Schuhmann al., 2022). Finally, we also use a latent diffusion model (LDM) trained LAION-400M (Schuhmann et al., 2021), a 400M image-text pairs dataset.
Domains and Concepts We experiment with two domains art styles and human faces @ that are highly important for privacy and copyright considerations of text-to-image models. Figures 1 and 4 show examples of real and generated images of art styles and human faces. We collect two sets of concepts for each domain. For art styles collect classical and modern art styles and for human faces, we collect celebrities and politicians. It is important to note that each artist's style and each human face is considered a separate concept. Although in the real world art style of some artists might be similar, the classifier models we use to measure imitation is trained well to distinguish between art styles from different artists (Somepalli et al., 2024). These sets we experiment with are independent (i.e., have no common concept) and are therefore useful to test the robustness of the thresholds ($6). Each set has 400 concepts that cover a wide frequency range in the pretraining datasets. Appendix N provides details of the sources used collect the concepts and the sampling procedure. Table summarizes the domains, sets used for cach domain, the models and their pretraining datasels experiment with.
Image Generation We generate images for cach domain by prompting models with five prompts (Table 2). We design domain-specifie prompts that encourage the desired concept to occupy a large part of the generated image, which simplifies the imitation score measurement. We also ensure that these prompts are distinct from the captions used the pretraining datasct to minimize direct reproduction of training images (as noted by (Somepalli et al., 2023b)). We generate 200 images per concept using different random seeds for each prompt, total of 1,000 images per concept.
8

---

Published in Transactions on Machine Learning Research (12/2025)
Ave intiation Score Generaied Images
Iellatee Seon
0.5
g0.4
Paansin be crange For
0.4
v0.3
0.3
30.2
0.2
201
0.1
Colesittiss with incrassing Imago Counts in the Training Data
Human Face Imitation. The iniitstion threshold is detected at 399 + 85 faces.
Ave wintion Scare of Genomsed Images
0.7
0.8
Inttador Score
Imitation Threshold 304 maimaags
0.7
0.8
30.
Sredenyy Change hire
0.8
20.5
30.3 0.3
0..
2022
0.2
Chassica
Counts
(b) Art Style Imitation. The imitation threshold is detected at 304 56 images.
Figure 5: Human Face and Art Style imitation graphs for SD1.1 using the Colebrêtics and Classical art style sets. The x-axis is the image frequencies and the y-axls is the imitation score averaged over the five prompts. Concepts with zero image frequencies are shaded in light gray. We show the mean imitation score and its variance over the five image generation prompts for each concept. The red vertical line indicates the imitation threshold found by the change detection algorithm, and the horizontal green line represents the average imitation scores before and after the threshold.
6 Results: The Imitation Threshold
We use MIMETIC² to estimate the imitation threshold for each model-data pair, and present the results in Table 3. The imitation thresholds for SD1.1 on celebrities and politicians are 399 + 85 and 284 + 87 respectively, and 304 = 56 and 208 26 for classical and modern art styles, respectively. Interestingly, SD1.1 and SD1.5 have almost identical thresholds across the four datasets. Notably, both SD1.1 and SD1.5 are trained on LAIÖN2B-en. The imitation thresholds for SD2.1, which is trained LAION-5B (a superset of LAION-2B) are higher than the thresholds for SD1.1 and SD1.5. We hypothesize that the difference in performance of SD2.1 and SD1.5 is due to the difference in their text encoders (note: differences in performance between SD1.5 and SD2.1 were also reported by several users on online forums (O'Connor, 2022)). Finally, the thresholds for all four datasets are slightly higher for LDM model compared to all the SD models. We hypothesize that this might happen due the smaller training data size of 400M pairs and leave further investigation for future work.
We also present the plots of the imitation scores function of the image frequencies of the concepts for the four datasets. Figures 5a and 5b show the imitation graphs of celebrities and classical art styles, respectively for SD1.1. In Figure 5a, we observe that the imitation scores for individuals with low image frequencies are close to 0 (left side), and increase as the image frequencics increase (towards the right side). The highest similarity occurs for individuals the rightmost region of the plot.. We also observe a low variance in the imitation scores across prompts for the same concept (the mean of the variance is 0.0003 with standard deviation of 0.0005 across concepts), and note that this variance is independent of the concept frequencies indicating that the performance of the face embedding model does not depend on the popularity of the individual. Similarly, in Figure 5b, we observe that imitation scores for art styles with low image frequencies are low (close to 0.2 on the left side), and increase as the image frequencies increase (towards the right side). The highest similarity occurs for the artists in the rightmost region of the plot. We also notice a low variance across the generation prompis, and the variance does not depend on the popularity of the art (the mean of the variance 0.003 with a standard deviation of 0.003). We showcase the imitation graphs for all other models in Appendix K, which follow similar trends.
Human Perception Evaluation To determine if the aulomatic measure of similarity between generated and training images matches human perception, we conduct experiments with human subjects. We ask participants to rate generated images on the Likert scale (Likert, 1932) of 1-5 based on their similarity real images of celebrities. To avoid any confirmation bias, the participants were not informed of the research objective of this work.
9

---

Published in Transactions on Machine Learning Research (12/2025)
For human face imitation, we conduct this study with 15 participants who were asked to rate 100 (randomly selected) generated images for set of 40 celebrities on the scale of 1-5. To determine the accuracy of the imitation threshold estimated by MIMETIC², we randomly select the celebrities such that half of them have image frequencies below the threshold and the other half above it We measure the Spearman's 's correlation (Zar, 2005) between the imitation scores computed by the model and the ratings provided by the participants. Due to the variance in perception, we normalize the ratings for cach participants. The Spearman correlation between the similarity scores provided by participants and the imitation scores is 0.85, signifying a high quality imitation estimator. We also measure the agreement between the imitation threshold that MIMETIC² estimates and the threshold that humans perceive. For this purpose, we convert the human ratings to binary values and treat it as the ground truth (any rating of 3 or higher is treated as 1 and ratings less than 3 are treated as O, indicating successful and unsuccessful imitation, respectively). MIMETIC² predictions is also binarized, any celebrity with frequency higher than the imitation threshold is treated as 1, otherwise To mcasure the agroement, we compute the element- wise dot product between these two sets. We find the agreement to be 82.5%, signifying a high degree of agreement for MIMETIC*ss automatically computed threshold.
For art style imitation, we conduct this study with an art expert due to the complexity of detecting art styles. The participant was asked to rate five generated images for 20 art styles, half of which were below the imitation threshold and the other half, above the threshold. We find the Spearman correlation between the two quantities to be 0.91 demonstrating that our imitation scores are highly correlated with an artist's perception of style similarity. Similar to the previous case, we mcasure the agreement of the imitation threshold, which we find to be 95% - signifying a high degree of agreement for MIMETIC'ss computed threshold.
Evaluation of the Imitation Thresholds Evaluating the accuracy of the real imitation thresholds is expensive, as it requires conducting the counterfactual experiment described in Section 3 (training Ollog m) models with different number of images of each concept). To make the evaluation tractable, we finetune a pretrained text-to-image model with concepts that the model has not seen during pretraining and find the number of images required for the model to imitate them. We find that all the concepts require about 250 images for imitation when the models are finetuned on them (further details in Appendix H), which is very close to the imitation threshold MIMETIC² finds for this pretrained model without finetuning (234 images). Based on these results, we conclude that the imitation thresholds estimated by MIMETIC² are accurate.
Discussion Overall, we observe that the imitation thresholds are similar across the different image generation prompts, but are domain and model dependent. Importantly, the thresholds computed by MIMETIC² have a high degree of agroement with human subjects and are supported by the finetuning experiments.
We find that celebrities have a higher imitation threshold than politicians for all models. We hypothesize this happens due to inherent differences in the data distribution between these two sets, which makes it harder to learn the concept of celebritics than politicians. To test this hypothesis, we compute the average number of training images that has a single person for concepts with less than 1,000 images. We find that politicians have about twice the number of single person images compared to celebrities. As such, images that have a single person makes imitation casier for the model (the model can easily associate the face with the name in the caption), thus lowering the imitation threshold for politicians.
We also note the presence of several outliers in both plots, which can be categorized into two types: (1) concepts whose image frequencies are lower than the imitation threshold, but their imitation scores are considerably high; and (2) concepts whose image frequencies are higher than the imitation threshold, but their imitation scores are low. From privacy perspective, the first kind of outliers are more concerning than the second ones, since the imitation threshold should act privacy threshold. When used as privacy guideline, it is less worrisome if a concept with a concept frequency higher than the threshold is not imitated by the model (false positive), but it would be a privacy violation if a model can imitate a concept with frequency lower than the threshold (false negative). Upon further analysis, we find that for all of the false negative outliers (with the privacy concern), the concepts' true frequencics are much higher than our estimates. This happens primarily due to naming alises (a person known by multiple names) that MIMETIC² does not account for - thereby alleviating the privacy violation concerns (see 57 for detailed analysis of such outliers).
10

---

Published in Transactions on Machine Learning Research (12/2025)
L
AD
(a) Outlier Kind 1. Thandiwe Newton also aliased Thandic Newton, Since MIMETIC² only collects images whose caption mentions Thandiwe Newton, this leads to underestima- tion of image counts.
(b) Outlier Kind 2. Most of the images whose captions mention Cacoa Cabb have nuitiple people them, only images have her the only person, leading to low imitation score generated images.
Figure 6: Examples of the two kinds of outliers. The top and bottom rows show the real and SDL.1 generated images respectively. Images were generated using the prompt: "a photorealistic close-up image of name."
Finally, we notice that the range of the imitation scores of different domains have different y-axis scales. This is duc the difference in embodding models usod in both cases. The face embedding model can distinguish between two faces much better than the art style model can distinguish between two styles (see Appendices F and G), and therefore the scores for the concepts on the left side of the imitation threshold is around 0 for face imitation and 0.2 for style imitation. However, the absolute values on the y-axis do not matter for estimating the imitation threshold as long as the trend is similar, which is the case for both domains.
7 Analysis: Investigating Outliers
The imitation score plots in the previous section, while showcasing a clear trend, have several outliers. In this section, we analyze such outliers and present examples in Figure (more outliers can be found in Figures 36 and 37 in the Appendix).
Low Image Counts and High Imitation Scores Figure 6a shows an example of such case: Thandiwe Newton's image count is 172 in LAION2B-en, lower than the imitation threshold for celebrities: 364. However, her imitation score of 0.26 is much higher than those of neighboring celebrities with similar image counts (with scores of 0.01 and 0.04). Further investigation reveals that Thandiwe Newton is also known as Thandie Newton. Since this alias may also be used to describe her in captions, we underestimate her image counts. We repeat the process for estimating the image counts with the new alias, and find that Thandie Newlon appears in 12,177 images, bringing the cumulative image count to 12,349, which significantly surpasses the established imitation threshold. The two aliases, whose total image count is considerably higher than the imitation threshold, differ by only a single letter and are similarly represented by the model's text encoder (cosine similarity of 0.96), which explains the high imitation score. We find that most. of the celebrities who had high imitation score while having a low concept frequency are also known by other names which lead to underestimating their image counts. For example, Belle Delphine (394 images) also goes by Mary Belle (310 images), for a total of 704, and DJ Kool Here (492 images) also goes by Kool Here (269 images), for total of 761. The aliases explanation also explains the outliers in art style imitation. For instance, artist Gustav Adolf Mossa (19 images) also goes by just Mossa (15,850 images). See Figures 38 and 39 in the appendix for the real and generated images in style of these artists.
High Image Counts and Low Imitation Scores Several celebrities have higher image counts than the imitation threshold, but low imitation scores. Unlike the previous case, we were unable to find a common cause that explains all these outliers. However, we find explanations for specific cases. For example, staggering proportion of the training images for such celebrities have multiple people in them (20% of the outlicrs of this kind could be explained with this phenomenon). Out of the 706 total images of Cacee Cobb, only 6 images have her as the only person in the image (see Figure 6b). Similarly, out of 1,296 total images of Sofia Hellguist, only 67 images have her as the only person and out of the 472 total images of Charli D' Amelio, only 82 images have her as the only person. We hypothesize that having multiple concepts an image impedes the proper mapping of the concept's text embedding to its image embedding, which can explain the low imitation score for these concepts. We leave examining this to future work.
11

---

Published in Transactions on Machine Learning Research (12/2025)
8 Discussion and Limitations
In this work we attribute the imitation of a concept by model to its frequency in the training data. However, several other factors like image resolution, image diversity, alignment between images and their captions, etc., may affect imitation. Our work is the first to tackle such important question, and as such, we tackle one of the more salient features that contributes to imitation - the concept's 's frequency in the training data. In the future, we plan to incorporate other features to improve the accuracy of the imitation threshold. While we hope our work could be used for copyright and privacy claims, our results should be put in content of the assumptions we make (which we find to empirically hold). We further discuss the assumptions we make, and their empirical validity in more detail in Appendix B. Note that, MIMETIC* finds the imitation threshold for the pretraining regime. Different training regimes (such as finetuning on additional data, for multiple epochs) may also affect the imitation threshold, and we hope to investigate such scenarios in future work.
In this work we are interested in finding the estimation threshold of text-to-image models, studying how many images of a given concept a model has to be trained on to be able to generate images of such concepts. We build a system to find such threshold for given model, dataset, and domain, and show how to estimate such threshold efficiently. We test our method on various domains, datasets, models, and pretraining datasets, and show that the thresholds estimate are in the same ball park, while exploring some of the variance in our analysis section. Notably, we cannot apriori know how such threshold would generalize to other models, e.g., larger models or models trained on larger datasets that have different Additional work is needed to study such cases. However, our main contribution in this work is the method (MIMETIC²) that allows to study such threshold and can be applied in future works on additional models.
araanettr-to-goneralaaallt
ability.
9 Conclusions
Text-to-image models can imitate concepts from their training images (Somepalli et al., 2023a; Carlini et al., 2023a; Somepalli el al., 2023b) This behavior is crucial for learning, but it can also be concerning when such training datasets include copyrighted and private images. Imitating such images would be grounds for violation of copyright and privacy laws. In this work, we seck to find the number of instances of a concept that a text-to-image model has to be trained on in order to imitate it - the imitation threshold. We posit this as a new problem and propose an efficient method, MIMETIC2, for estimating such threshold. Our method uses pretrained models estimate this threshold for human faces and art styles imitation using four text-to-imant image models trained three different pretraining datasets. We find the imitation threshold of these models to be in the range of 200-700 images depending on the setup. By estimating the imitation threshold, we provide insights on successful concept imitation based on their training frequencies. Our results have striking implications on both the text-lo-image models users and developers. These thresholds can inform text-to-iman tom-iage model developers what concepts are in risk of being imitated, and on the other hand, serve as a basis for copyright. and privacy complaints. Finally, MTMETIC² also provides insights into the generalization capabilities of text-to-image models.
10 Ethics Statement
This work is targeted towards understanding and mitigating the negative social impacts of widely available text-to-image models. To minimize the impact of our study on potential copyright infringement and privacy violations, we used existing text-to-image models and generation techniques. To strike a balance between reproducibility and ethics, we release the code used in this work, but not the real and synthetic images used (we also provide detailed documentation of our data curation process in the code to ensure transparency).
Human Subject Experiments For the human subject experiments performed in this work, we followed the university guideline. The study was IRB approved by the university and cach participant was made aware of the goals and risks of the study. In accordance with local minimum wage requirements, we compensated each participant with Amazon gift cards of $25/hour for their time.
12

---

Published in Transactions on Machine Learning Research (12/2025)
11 Reproducibility Statement
We have published all the code used for this work at https://gitiie con//veahi1/MMMETI---2... and included the README. file that provides instructions execute each step of the algorithm. We provide our code in the supplementary material. The code includes detailed README. md file that provides instructions to execute each step of the algorithm. We will open-source all the code upon publication of the paper. We do not provide the original and generated images of individuals and art styles for copyright and privacy concerns.
ACKNOWLEDGMENTS
We would like thank Shauli Ravfogel, Moni Shahar, Amir Feder, Shruti Joshi, and Soumye Singhal for discussion and providing foedback on the draft. In addition, would like to thank the annotators of our human experiments: Miki Apfelbaum, and the Angle icon by Royyan Wijaya from the Noun Project (CC BY 3.0). A part of this work was supported using Amazon Research Award (ARA) to Chirag Shah and NSF Grant Numbers IIS-2106937 and IIS-2148366 awarded to Jeff Bilmes.
References
Saba Ahmadi and Aishwarya Agrawal. An examination of the robustness of reference-free free image captioning evaluation metrics, 2024. URL htttpe///axx...rr/aa/22333. 14998.
Nadeem Badshah. Nearly 4,000 celebrities found to be victims of deepfake pornography. https://buw.thheuurddaaa
wiwttee--vviiiisoo--eeeeeeeee of-deepfake- pornography, 2024. Accessed: 2024-04-27. 3
Matthias Bastian. Training cost for stable diffusion was just $600,000, 2022. URL
training-cost cort-for-ttttttte wwtalltddifaalloooee wwtp:ruusooooaaasssss----------- 1asst-60000-ande thattthhttsss -i--att-s--aa------ a htcps: com/ 37
2, 4,
Jeff Bilmes. Submodularity in machine learning and artificial intelligence, 2022. URL https: 00132. 23
Abeba Birhane, Vinay Uday Prabhu, and Emmanuel Kahembwe. Multimodal datasets: misogyny, pornography, and malignant stereotypes, 2021. URL httpa://arxiv wttp:/wwwwwrg//////..11.. 01963. 1,
N. Carlini, M. Jagielski, C. Choquette-Cuee Choo, D. Paleka, W. Pearce, Anderson, A. Terzis, K. Thomas, and F. Tramer. Poisoniug web-scale training datasets is practical. In 2024 IEEE Symposium on Securily and Privucy (SP), Los Alamitos, CA, USA, may 2024. IEEE Computer Sociely. URL SP54263 2024.022200 00179. 6 2024.00179.
wtt.://rrrreiitttooo....... org/10.1109) 1109/
Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In Proceedings of the 32nd USENIX Conference on Security Symposium, SEC '23, USA, 2023a. USENIX Association. URL htttps//arxxv...ot org/abs/ 2301. 13188. 1, 12, 18
Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang, Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Representations, 2023b. URL
2,
Stephen Casper, Zifan Guo, Shreya Mogulothu, Zachary Marinov, Chinmay Deshpande, Rui-Jie Yew, Zheng Dai, and Dylan Hadfield-Ment Measuring the success of diffusion models at imitating human artists, 2023. URL
https://arziv org/oo////o abs///b////// abs//30////////////////// 03307000220 18
Michael Cavna. Ai in illustration.
//tp/////ooooooo//////////////nn http:://hwaaaaaeeeeec.cccc/cctta 2023. Accessed: 2021-02-27. 3
Ceoln. Posts tagged 'copyright', 2022. URT. https://ceolie
Jiankang Deng, Jia Guo, Tongliang Liu, Mingming Gong, and Stefanos Zafeiriou. Sub-center arcface: Boosting face recognition by large-scale noisy web faces. In Computer Vision ECCV 2020, pp. 741-757, Cham, 2020. Springer International Publishing, URL https:/ https:///ww... www..ecva, wwcca..ne/paperee pttp://aapp//ccccce/022200 wawperseeC///paPSSSeaapppeeeeeee BCCC//papeer//22550775 23, 32
13

---

Published in Transactions on Machine Learning Research (12/2025)
Jiankang Deng, Jia Guo, Jing Yang, Niannan Xue, Irene Kotsia, and Stefanos Zaleiriou. Areface: Additive angular margin loss for deep face recoguition. JEEE Transactions on Pallern Analysis and Machine Intelligence, 44(10):
October 2022. URL http://dx wttp:/oog/1/11.....00 http///AA............1.. 2022..0087777 7, 32
Prafulla Dhariwal and Alexander Quinn Nichol. Diffuusio models beat GANs on image synthesis. In Advances in Neural Information Processing Systems, 2021. URL https://openreviai http://pwwweeeeeeeeeeeee///aaaaa
3
Yanai Elazar, Akshita Bhagia, lan Helgi Magmusson, Abhilasha Ravichander, Dustin Schwenk, Alane Suhr, Evan Pete Walsh, Dirk Groeneveld, Luca Soldaini, Sameer Singh, Hanna Hajishirzi, Noah A. Smith, and Jesse Dodge. What's in my big data? In The Twelfth International Conference on Learning Representations, 2024. URL https: attps://arxiv. org/ abs/2310..... 207077. 3,
Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyíska,, and David Ban. Unified concept editing in diffusion models. /EEE/CVV Winter Conference on Applications of Computer Vision, 2024. URL https:
//umffied. baulab. info/. 18
lan J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. Generative adversarial networks. 2023 14th International Conference on Computing Communication and Networking Technologies (ICCCNT), pp. 1-7, 2022. URL https: //ariii www.:orgg///..eeeeeeeee.. /ates//44....0 2661.
Luxi He, Yangsibo Huang, Weijia Shi, Tinghao Xie, Haotian Liu, Yue Wang, Luke Zettlemoyer, Chiyuan Zhang, Danqi Chen, and Peter Henderson. Fantastic copyrighted beasts and how (uot) to generate them. arXiv preprinl arXiv:2406. 14526, 2024. 3
Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. CLIPScore: A reference-free eval- uation metric for image caplioning, In Proceedings of the 2021 Conference on Emepiriaal Methods Naturul Language Processing, pp. 7514-7528, Online and Puula Cana, Dominican Republic, November 2021. Association for Computational Linguistics. URL https: https://aclaate //araa////cl hwwp:/oooyyyoogg/221/ org/2021 emmlp-main.590 6
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Beruhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to local nash equilibrium, 2017. URL https: acm. wttp///////../ooo//////oo
3295222.3295408.
Tatum Hunter. Ai porn is easy to make now. for women, that's a nightmare. https://www http://wwwwwaiingttor..oo www.wngtonossst.ttommmmmm com/ technologg/2202//0//333 11/11////aappa/// detrrddeepaaeeeemeeeeee
2023. Accessed: 2021-02-27. 1,
Gabriel Ihharco, Mitchell Wortsman, Ross Wightman, Cade Gordon, Nicholas Carlini, Rohan Taori, Achal Dave, Vaishaal Shankar, Hongseok Namkoong, John Miller, Hannaneh Hajishirzi, Ali Farhadi, and Ludwig Schmidt. Openclip, July 2021. URL https://doi... 00g/10..000 500.0/22222/....... 0t08///ecddo.543773.. 5143773. 25
Sadeep Jayasumana, Srikumar Ramalingam, Andreas Veit, Daniel Glasner, Ayan Chakrabarti, and Sanjiv Kumar. Rethinking fid: Towards a better evaluation metric for image generation. In Proceedings of the JEEE/CVE Conference Computer Vision and Pattern Recogrittio,, pp. 9307-9315, 2024. URL https:/ arxiv. org/ http////...... 09603. 6
Harry H. Jiang, Lauren Brown, Jessica Cheng, Mehtab Khan, Abhishek Gupta, Deja Workman, Alex Hanna, Johnathan Flowers, and Timnit Gebru. Ai art and its impact on artists. In Proceedings of the 2023 AAAT/ACM Conference on AI, Ethics, and Sociely, AIES '23, pp. 363 374, New York, NY, USA, 2023. Association for Computing Machinery. ISBN 9798400702310. URL attps://doi org/10. 1145/3600211 3604681. 1, 3
R. Killick, P. Fearnhead, and I. A. Eckley. Optimal detection of changepoints with a linear computational cost. Journal of the American Statistical Association, pp. 1590 1598, 2012. URL http://www.jatee org/sttalle/342773..
Nupur Kumari, Bingliang Zhang, Sheng- Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in tomt-to--mage diffusion models. In International Conference on Computer Vision (ICCV), 2023. URL
atttps://arte org/ aba/ aba//303...// 13516. 18
Viktor Lakie, Luca. Rossetto, and Abraham Bernstein. Link-rot in web-sourced multimedia datasets. In International Conference on Multimedia Modeling, pp. 476-488. Springer, 2023. URL https:/ //ww://wwwww/// zora. uora.uzh. ch/ich htt/////ppriii / 232667/.
Tommaso Lanciano, Atsushi Miyauchi, Adriano Fazzone, and Francesco Bonchi. A survey on the densest subgraphi problem and its variants. ACM Computing Surveys, 56(8):1-44 40, 2024. doi: 10.1145/3653298. URL https: //al. acm. wttp:////////////./..0/
1145/3653298. 23
14

---

Published in Transactions on Machine Learning Research (12/2025)
Pietro Lesci, Clara Meister, Thomas Hofmamn, Andreas Vlachos, and Tiago Pimentel. Causal estimation of memorisa- Lion profiles. In Proceedings of the 62nd Annual Meeting of the Association for Compulational Linguislics, pp. 15616 15635. Association for Computational Linguistics, 2024. URL https://aclaatthot wttp:/ooooyoo../22///2/// acl-long 834. 4
Rensis Likert, A technique for the mnasurement of attitudes., 1932. URL https://psycnet..e apa. attps///cccta.ap.orrrrrrrrooro 1933-01885-00..
Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In ECCV 2014, pp. 740 755. Springer, 2014.
URL http:::://ccooaaastt..coo org/. 25
Jack Lu, Ryan Techan, and Mengye Ren. Procreate, don't reproduce! propulsive energy diffusion for creative generation, 2024. URL http:://aarxiv.oor//aa///22 wwt..oo/////a..//oeeaae 02226. 18
Zhiheng Lyu, Zhijing Jin, Fernando Gonzalez, Rada Mihalcea, Bernhard Schoelkopf, and Mrinmaya Sachan. On the causal nature of sentiment analysis. arXiv preprènt arXiv:2404.11055 2021. 4
Kiyohito Nagano, Yoshinobu Kawahara, and Kazuyuki Aihara, Size-constrained submodular minimization through minimum norm base. In Proceedings of the 28th International Conference Machine Learning (ICMI-11), pp. 977 984, 2011. URL https: acm. oww../i///////// 5555/3104482 31046055 23
NIST.
Face recognition vendor test (frvt).
http:://ww..ittt.ooorrrrgggs
2020. Accessed: 2021-02-27. 31
Ryan O'Connor. Stable diffussion vs 2 - what you need to know. https://wwe sessemblyai.commbbe stable-diffe
2022. Accessed: 2024-05-14. 9
Judea Pearl. Causality. Cambridge university press, 2009. 4
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. SDXL: Improving latent diffusion models for high-resolution image synthesis. In The T Twelfth International Conference on Learning Representations, 2024. URL /ttps://epenrevvex www. mett/forrmmdddddi222888gg
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Llya Sutskever. Zero-shot text-to-image generation. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learningg Research, pp. 8821 8831. PMLR, 18 24 Jul 2021. URL https://proceeding mlr, ppwss/v139/raeeeeeeeeeeeee
html.
Yasaman Razeghi, Robert Logan IV, Matt Gardner, and Sameer Singh. Impact of pretraining term frequencies on few-shot numerical reasoning. In Findings of the Association for Computational Linguistics: EMNLP 2022, pp. 840 854. Association for Compulational Linguistics, 2022. URL https::/acclatthologg org/2022..cc2. findings-emnnii em.1p.59. 3
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Compuler Vision and Pattern Recognition (CVPR), pp. 10684-10695, June 2022. URL https://openaccess: theeaccccssss..eeteeeeeee thecvf. com/ /CVP22/////2202/// html/Rombach, BithhhHHhhhhhh High--ighhtttiee 3, 8
20PR__2222_ppprrrrr html. 1,
Mehdi S. M. Sajjadi, Olivier Bachem, Mario Lucic, Olivier Bousquet, and Sylvain Gelly, Assessing gen- erative models via precision and recall. In Advances in Neural Information Processing Systems, vol- ume 31. Curran Associates, Iuc., 2018. URL tttpss//proceeddngg ceciiingsneeeeee neurips cc/paper__p. wwtpppppe.illlepppeeeeeeeeeeeeee /iles///papc///01////eee/// pdf. 6
Babak Saleh and Ahmed Elgammal. Large-scale classification of fine-art paintings: Learning the right metric on the right feature. International Journal for Digital Art History, 2, Oct. 2016. doi: 10.11588/dah. 201............33776.. URL http///de...ppaaa..... hhtppph/pppppaaaaapapppppp wtt.aa///rttceeee///e//////
, ub. meii-eedeebbrrg... de/ se/index.
25
Tim Salimans, Ian Goodfellow, Wojeiech Zaremba, Vicki Cheung, Alec Radford, Xi Chen, and Xi Chen. Improved techniques for training gans. In Advances in Nearal Information Processing Systems, vol- ume 29. Curran Associates, Inc., 2016. URL https: sttps://proceedings neurips...... pc/pppppr.flllsppppeereeeeeeeeee /ilps///papc///1/////eee pdf. 6
15

---

Published in Transactions on Machine Learning Research (12/2025)
Joseph Saveri and Matthew Butterick. Stable diffusion litigation. http:p//ssaaaeeiffftuoolltttttaa com/ case-updates htm1, 2023. Accessed: 2024-02-27. 1,
Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embeddding for face recognition and clustering, In 2015 IEEE Conference on Computer Vision and Pallern Recognition (CVPR). IEEE, 2015. doi:
10.1109/cvpr:2011 wtt.cvprr.01..2222.. 7298682... URL http://dx.doo. /tt/dxxdooi.../ wrw/1......... 20t.1119/CVVP..0000 2015. 7298682.
Christoph Schuhmann, Richard Vencu, Romain Beaumont, Robert Kaczmarczyk, Clayton Mullis, Aarush Katta, Theo Coombes, Jenia Jitsev, and Aran Komatsuzaki. Laion-400m: Open dataset of clip-filtered 400 million image-text pairs, 2021. URL
8
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade W Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa R. Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev. LAION-5b: An open large-scale dataset for training next generation image-text models, 2022. URL https::/ wwtp://wwwweooorro/////////////
1,
Sefik Ilkin Serengil and Alper Ozpinar. Lightface: A hybrid deep face recognition framework. In 2020 Innovations in Intelligent Systems end Applications Conference (ASYU), pp. 23 27. IEEE, 2020. URL btttps//doo..rgoee
1109/ASY050717 2020. 9259802. 32
SerpApi. https://serpapi.ccm com hwwg:/oooolleoeoooo imsgle--mmgee-pppl 2024. Accessed: 2024-02-27. 23
Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y. Zhao. Fawkes: protecting privacy against unauthorized deep learning models. In Proceedings of the 29th USENIX Conference on Security Symposium, SEC'20, USA, 2020. USENIX Association. URL https: //dl. acm. wttg/////////o/ooo//////// /t//////111../ 10.555533489222. 3440999.......3....... 3489302. 18
Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Zhao. Glaze: protecting artists from style mimicry by text-to-image models. In Proceedings of the 32nd USENIX Conference on Security Symposium, SEC '23, USA, 2023. USENIX Association. URL https://dii acm. wwc..or///oo.. do1//0.01110.11// 5555/3620237, 3620360. 1, 3, 18
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamies. In Proceedings of the 32nd International Conference Machine Learning, volume 37 of Proceedings of Machine Learning Research, pp. 2256 2265, Lille, France, 2015. PMLR. URL attps://pprcceedngss..k. wtt.:m/w..r.eee///eeee htrees/v3//shhl-tcckeee http///oonntiikkkenn.....1.. html.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 6048-6058, 2023a. URL CVPR2023/ /upple/mentall/saeppllll https//eaaallliiaffsssoooooooooo
tweceh.eccccooo wwt.ccoo//otteeeeee conten/t
Diffusion Satooonrrrtttttttttteeee CeW___o___P______ 2023__2222_____22222222 20____2222________ supplemental pdf. 1, 12, 18
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Understanding and mitigating copying in diffusion models. In Thirly-seventh Conference Newral Information Processing Systems, 2023b. URL
1, 8, 12
Gowthami Somepalli, Anubhav Gupta, Kamal Gupta, Shramay Palta, Micah Goldblum, Jonas Geiping, Abhinav Shrivastava, and Tom Goldstein. Measuring style similarity in diffusion models, 2021. URL https://arxe org/ abs//4404.0125 6, 7, 8, 27
David Thiel. Identifying and eliminating CSAM in generative ML training data and models, 2023. URL https: //purl.stanford adt.rrd22dd///tt22211533 3
Vishaal Udandarao, Ameya Prabhu, Adhiraj Ghosh, Yash Sharma, Philip H. S. Torr, Adel Bibi, Samuel Albanie, and Matthias Bethge, No 'zero-shot" without exponential data: Pretraining concept frequency determines multimodal model performance, 2024. URL https://arxiv. oraiivi.orr//aa org/abs abs//404. 04125. 2,
L. G. Valiant. A theory of the learnable. Commun. ACM, 27, 1984. doi: 10.1145/1968.197 1972. URL https:
//doi.org/til. wtt..//.///........... 1145/1968. 1972. 19
Gerrit J. J. van den Burg and Christopher K. 1. Williams. An evaluation of change point detection algorithms, 2022. URL https:///axixs http:://wwwwvvw.o/a/eaa/eeeeea 202.2222...2...222222222222 7
James Vincent. Gelly images sues ai art generator stable diffusion. https://www wwwwwrteeeeee.... com/ comm/2023/22///238833////
si-aatt-ooyyrighh-aaaa lavssuit teenunit-gtttinnnnee crable-diffusstt 2023. Accessed: 2024-02-27. 1, 2,2,
16

---

Published in Transactions on Machine Learning Research (12/2025)
Yu-Xiong Wang, Deva Ramanan, and Martial Hebert. Learning to model the tail. In I. Guyon, U. Von Luxburg, S. Bengio, Н. Wallach, R. Fergus, S. Vishwanathau, and R. Garnett (eds.), Advances Newral Information
Processing Systems, volume 30. Curran Associates, Inc., 2017. URL https:/ https://ppocetee hptppp///pcceeinga.... prroceddiggs.nuuips.. neurips....... peeurips.cpppaeeeeeeeeeeeeeeeeee cc/paper
pdf. 19
Zhenting Wang, Chen Chen, Lingjuan Lyu, Dimitris N. Metaxas, and Shiqing Ma. DIAGNOSIS: Detecting unauthorized data usages text-ko-image diffusion models. The Twefthh International Conference on Learning Represenlations, 2024. URL
http://www....eeeoooooooo///aaoa 18
Wikipedia. Lists of politicians. https:/en..iiippeaa..or. org ottppppaaa.gggg////////ooooeooea ooppipicc,, 2024. Accessed: 2024-02-27. 34
Tong Xie, Haoyu Li, Andrew Bai, and Cho-Jui Hsieh. Data attribution for diffusion models: Timestep-induced
bias in influence estimation. Transactions on Machine Learning Research, 2024. ISSN 2835-8856. URL https:
//openrevies wttp://ooooooo//////looooo//
18
Chun-Han Yao, Yiming Xie, Vikram Voleti, Huaizu Jiang, and Varun Jampani. Sv4d 2.0: Enhancing spatio-temporal
consistency multi-view video diffusion for high-quality 4d generation, 2025. URL https://arxxi.. httpp:///aarvvv.or/aa/////////// 16396.
Jerrold H Zar. Spearman rank correlation. Encyclopedia of Biostatistics, 7, 2005. URL hctps://onllneelbbaayy wiley. http://////////..000//0001111111 b2a15150. 10
17

---

Published in Transactions on Machine Learning Research (12/2025)
A Additional Related Work
Imitation in Text-to-Image Models: Somepalli et al. (2023a); Carlini et al. (2023a) demonstrated that diffusion models can memorize and imitate duplicate images from their training data (they use 'replication' to refer to this phenomenon). Casper et al. (2023) corroborated the evidence by showing that these models imitated art styles of 70 artists with high accuracy (as classified by CLIP model) when prompted to generated images in their styles (a group of artists also sued Stability AI claiming that their widely-used text-to-image models imitated their art style, violating copyright laws Saveri & Butterick (2023)). However, these works did not study how much repetition of concept's images would lead the model to imitate them. Studying this relation is important as it serves to guide institutions training these models who want to comply with copyright and privacy laws.
Mitigation of Imitation in Text-to-Image Models: Several works proposed to mitigate the negative impacts of text-to-image models. Shan et al. (2023) proposed GLAZE that adds imperceptible noise to the art works such that diffusion models are unable to imitate artist styles. A similar approach was proposed to hinder learning human faces (Shan et al., 2020). Wang et al. (2024) proposed adding noise to training images, which can be used to detect if a model has been trained on those images. Lu el al. (2024) propose pushing the generated images away from the distribution of training images to minimize mitigation. Kumari ot al. (2023); Gandikota et al. (2024) proposed algorithms to remove specific styles, explicit content, and other copyrighted material learned by text-to-image models. On a related note, Xie et al. (2024) proposed Diffusion-Rel Rracc that finds training images that most influenced a generated image, and thereby provide a fair attribution to training data contributors.
B Considerations When Using Our Imitation Thresholds
Our work estimates the imitation thresholds under certain assumptions: distributional invariance between images of different concepts and absence of confounders between the imitation score and image count of a concept. While these assumptions are reasonable (as we discuss in Section 3 and empirically demonstrate in Appendix C.I) and have been also made in several prior works, they might limit the direct transfer of the imitation thresholds we report to other settings.
Our results also depend on the specific concepts we sampled for each domain, the specific domain embedder we use, and the specific change detection algorithm we use. Changing any of these might alter the imitation thresholds we report. We have performed experiments under several changes to these factors and found our claim to hold. However, still do not claim results would generalize to all model/data pairs. Specifically, these are some of the question to consider using our initation thresholds in a different situalion:
Is the setting being considered uses the same text-to-image model as we use in our experiments?
2. Is the setting being considered uses the same pretraining dataset as we use in our experiments?
3. Does the setting being considered uses the imitation threshold we report for human face or art style imitation?
4. If our experimental procedure is repeated for different setting, are the repeated experiments using a similar set of concepts in a domain as we use?
5. If our experimental procedure is repeated for different setting, is concept detector similar high quality concept. detector is being used?
Finally, while we hope our work could be used for copyright and privacy claims, our results should be put in context of the assumptions we make in (Section 3)
18

---

Published in Transactions on Machine Learning Research (12/2025)
C Verification of the Assumptions
We empirically test the validity of the three assumptions we make in Section 3, and find they all hold in practice. To test the invariance assumption we calculate the imitation scores difference of all concepts pairs, whose image counts differ by less than 10 images, for all concepts. We find that the imitation scores difference for such pairs, on average, is 0.003 (averaged across such pairs and averaged across our datasets) (Appendix C.1), attesting to the validity of this assumption. Testing the lack of confounders between imitation score and image count, we finetune a text-to-image model on images of concepts that the model has not seen during pretraining (e.g., politicians that became popular after the training data of the model was curated), and measure the imitation threshold for these concepts Appendix C.2. We argue that if the thresholds found in the finetuning experiment and by MIMETIC² are close, then the assumption about lack of confounders is valid (assuming there is no other confounder affecting all these concepts). We indeed find that the imitation thresholds found in the finetuning experiment are very close to the thresholds found by MIMETIC² without finetuning the model (+1)),, atlesting to the validity of this assumption (Section 6). Lastly, we test the assumption that each image of a concept contributes equally the learning of a concept, which is commonplace in the sample complexity litcrature (Valiant, 1984; Wang et al., 2017). We finetune text-lo-inage model with a set of randomly sampled images of a concept multiple times. We report the variance in the imitation scores across these finetuning experiments and find the imitation scores variance to be small (+0.2% of the imitation score), validating this assumption (see more details in Appendix C.3).
To summarize, we empirically verify all the assumptions we make in this work, and find them to hold in practice.
C.1 Validity of the invariance assumption
Table 4: Average difference in the immitatio scores for concepts whose image counts differ by less than 10. The difference in the imitation scores are close to U, empirically validating the distribution invariance assumption.
Domain
Dataset
Avg. difference in imitation score
Human Faces
Celebrities
0.0007
Human Faces
Politicians
0.0023
Art Style
Classical Art Style
-0.0088
Art. Style
Modern Art. Style
-0.0013
In this section, empirically test the statistical validity of the assumptions make in Section 3. The first assumption states that there is a distributional invariance across concepts. If this is true, then the imitation scores of two concepts (from the same domain) whose image counts are similar, should also be similar to each other. To test. whether this is empirically true for the domains we experiment with, we measure the difference in the imitation scores for concepts whose image counts differ by less than 10 images and report the difference avcraged over all such pairs. Table 4 shows that the average difference in the imitation scores for all the pairs, for all the datasets we experiment with, is very close to 0 (also see Figure 7 for the distribution of the differences in the score). This provides empirical validation of the distribution invariance assumption.
C.2 Validity of the assumption about absence of confounders
To test the absence of confounder, we conduct a finetuning experiment in which we finetuned pre-trained text-to-image model (SD1.4) on images of concepts the model has not seen during pretraining. We do this by finding politicians who recently got popular, after the SD1.4 model was open-sourced. We finetune SD1.4 increasing number of images of these politicians, starting with 50 images (much below the imitation threshold found in the non-finctuning setup) and going upto 800 images (above the imitation threshold found in the non-finetuning setup). During the finetuning process, the images of the concepts were mixed with other 10,000 images taken randomly from LAION-2B-en dataset. This was done in order to ensure that our finctuning sctup closcly resembles the original training sctup of SD1.4 where images of concept would be naturally interspersed with other images in the dataset. We finetune on the full dataset of 10,000 images for epoch with learning rate of 5e 5. We use the following concepts in this experiment:
19

---

Published in Transactions on Machine Learning Research (12/2025)
KDE of Imitation Score Differences by Group (with Means)
12-
Celebrity
Politicians
Artists
Modem Artits
8-
Density
4-
0.4
0.2
0.4
Difference Imitation Scores concepts with similar image trequency
Figure 7: This figure shows the distribution of differences in imitation scores for concepts whose image counts differ by less than 10 images. We use KDE for this estimation. Since the differences are very small for all the four domains experiment with, argue that our assumption ahout distributional invariance is valid.
Averie Bishop, Sophie Wilde, Javier Milei, Hashim Safi al-Din, Shyam Rangeela, Akshata Murty, Hana-Rawhiti Maipi-Clarke, Sébastien Lecornu, Vivek Ramaswamy, Raghav Chaddha.
For the SD1.4, the imitation threshold for the non-finetuning setup is found to be 234 images (Figure 19) and the average imitation scores for the politicians the right hand side of the threshold is 0.26. We report the results in Table 5, which shows that the imitation score remains lower than 0.26 when 50, 100, 150, or 200 images are used to finetune the model. The imitation score reaches this value of 0.26, only when finetuned with 250 or more images. This imitation threshold of 250 the finetuning experiment is very close to the imitation threshold MIMETIC² finds for SDL4 without requiring to finetune the model (234 as shown in Figure 19).
Note that since in this experiment we are directly intervening on the image count of each concept, there no effect of any confounder whatsoever even they were originally present. And the closeness of the imitation threshold in the finetuning and the non-finctuning sctup alludes the absence of confounders, thus validating our assumption. Note that this finetuning experiment is also the optimal experiment for finding the imitation threshold, that described in Section 3. Based these results, we also claim that imitation thresholds MIMETIC² finds are close to the ground-truth thresholds that the optimal experiment would find.
C.3 Validity of the assumption about equal image contribution
We conduct another finetuning experiment to test the validity of our third assumption (which assumess that all images of concept contribute equally) to its learning. In this experiment, finetune a pre-trained SD1.4 during pre-training (these are the same concepts
model on images of concepts that the model has not used for the finetuning experiment in Appendix C.2). Specifically, in this experiment we sample 400 images of these politicians from à random pool of images 20 times, and finetune a SD1.4 model with each of the sampled set of images. For each of the 20 finetuned models, we then measure the imitation scores for these concepts, and report the mean and standard deviation in the scores (also see Figure for the distribution of the imitation scores) Table shows these values, and the low standard deviation the imitation scores indicate that most images contribute equally to the learning of the concept, thus validating assumption.
20

---

Published in Transactions on Machine Learning Research (12/2025)
Table 5: The imitation scores of the concepts lext-to-image model, SD1.4, is finetuned increasing number of images of concept that it has notice that the imitation scores have values 0.26 greater when the model is finetuned Critically, this the average imitation score for politicians the right hand side of the imitation threshold in Figure 19 (which the imitation politicians for SDI.4); indicating that 250 images
during pretraining. We report imitation
averaged over 10 such concepts (politicians). We 250 more images of politician.
required for imitation this experiment.
# Finetuning Images
Imitation Score After Finetuning (Avg. over 10 politicians)
50
0.07
100
0.16
150
0.19
200
0.21
250
0.26
300
0.27
400
0.29
500
0.31
600
0.32
700
0.36
800
0.34
Table Mean and std. deviation the imitation scores when we finetuned pre-trained SDL44 model on 400 images of five concepts. We sample the images used finetuming from a pool of images of these concepts. We repeat this processs 20 times, and measure the mean and std. deviation in the imitation scores. The low std. deviation in the imitation scores indicate that most images contribute equally to the learning of the concept, thus validating our ussumption.
Concept
Mean of Imitation Scores
Std. Deviation Imitation Scores
Javier Milei
0.36
0.02
Hashim Safi al-Din
0.38
0.03
Shyam Rangeela
0.31
0.03
Akshata Murty
0.30
0.03
Hana- Rawhit Maipi-Clarke
0.30
0.02
D Caption Occurrence Assumption
For estimating the concept's counts in the pretraining dataset make simplifying assumption: concept can be present in the image only if it is mentioned in a paired caption. While this assumption isn't true in general, we show that for the domains we experiment with, mostly holds in practice.
Table 7: We estimate the percentage of the images that approach misses due to the assumption that concept only occurs if mentioned in the caption. The small percentage of the images miss (rightmost column) shows that assumption of counting the images where concept mentioned in the caption empirically reasonable.
Face Count in 100K images
Face Count in Images with Caption Mention
Missed
Celebrity
Images (%)
Floyd Mayweather
0.001% %
Oprah Winfrey
2
0.002%
Ronald Reagan
6
0.003%
Ben Affleck
0
0
0.0%
Anne Hathaway
0
0.0%
Stephen King
0
O
0.0%
Johnny Depp
9
0.008%
Abraham Lincoln
52
0.051%
Kate Middleton
34
0.033%
Donald Trump
16
0.016%
21

---

Published in Transactions on Machine Learning Research (12/2025)
Distribution of Imitation Scores
Javier
Hashim Sant si-
15.0
Shyam Rangeela
Alshala Murty
Menn--Ruwhiti Malpi-Clarko
125
10.0
Dercity
5.0
0,250
0,275
0.300
0.325
0.350
0.375
0.400
0.425
Scores Difterent subsets trtaining images for the finetuned concepts
Figure 8: Distribution of imitation scores for the concepts we finetuned on. We use KDE for this estimation.
Figure This figure shows the distribution of imitation images. We KDE for this estimation. Since the imitation concepts (demonstrated by narrow curves), can argue that our assumption of each image contributing equally model learning valid.
for concepts we finetuned using different subscts of training similar for different subsets of training images for all
For this purpose, we download 100K random images from LAION2B-en, and run the face detection (used in Section 4) on all images, and count the faces of the ten most popular celebrities in our sampled set of celebrities. Out of the 100K random images, about 57K contain faces. For each celebrity, we compute the similarity between all the faces in the downloaded images and the faces in the reference images of these celebrities. If the similarity is above the threshold of 0.46, consider that face to belong to the celebrity (this threshold is determined in Appendix F to distinguish if two images are of the same person or not). Table shows the number of faces we found for each celebrity in the 100K random LAION images. We also show the face counts among these images whose captions mention the celebrity. We find that 1) the highest frequency an individual appears in an image without their name mentioned in the caption 51 (Abraham Lincoln is mentioned once in the caption and he appears a total of 52 times), and 2) the highest percentage of image frequency that miss is 0.051 %,, and 3) most of the other miss rates much smaller (close to 0)- Such low miss rates demonstrate that our assumption of counting images when a concept is mentioned in the caplion is empirically reasonable.
We also note that this assumption would fail if we were computing image frequencies for concepts that are so widely common that one would not even mention them in a caption, for example, phone, shoes, or trees.
E
Collection of Reference Images
E.1
Collection of Reference Images for Human Faces Domain
The goal of collecting reference images is to use them to filter the images of the pretraining dataset. These images treated the gold standard reference images of person and images collected from pretraining dataset are compared to these images. If the similarity is higher than threshold then that image is considered to belong to that person (see Section 4 for details). We describe an automatic manner of collecting the reference images. The high level idea is to collect the images from Google Search and automatically select a subset of those images that are of the same concept (same person's 's face or same artist's 's art). Since this is a crucial part of the overall algorithm, we manually vet the reference images for all the concepts to ensure that they all contain the same concept.
22

---

Manually verify the candidate set Published in Transactions on Machine Learning Research (12/2025)
Collection of Reference Images for Human Face Imitation: We collect reference images for celebritics and politicians using a three step process (also shown in Algorithm 1):
1. Candidate set: First, we retrieved the first hundred images by searching person's name on Google Images. We used SerpAPI (SerpApi, 2024) as a wrapper perform the searches.
2. Selecting from the candidate set: Images retrieved from the internet are noisy and might not contain the person we are looking for. Therefore we filter images that contain the person from the candidate set of images. For this purpose, we use a face recognition model. We embed all the faces in the retrieved images using a face embedding model and measure the cosine similarity between each one of them. The goal is lo search for a set of faces that belong to the same person and therefore will have a high cosine similarity to each other.
One strategy for the faces to form a graph where the vertices are the face embeddings and the edges connecting two embeddings have a weight equal to the cosine similarity between them, and we select a dense k-subgraph (Lanciano et al., 2024) from this graph. Selecting such subgraph means finding a mutually homogencous subset. We can find the vertices of this dense k-subgraph by cardinalitycoonsraanee submodular function mininization (Bilmes, 2022; Nagano et al., 2011) on facility location function (Bilmes, 2022). We run this minimization and select a subset of images (at least of size ten) that has the highest averago cosine similarity between each pair of images.
3. Manual verification:
Selecting the faces with the highest average similarity is not enough. This is because in many cases the largest set of faces in the candidate set are not of the person we look for, but for someone closely associated with them, in which case, the selected images are of the other person. For example, all the selected faces for Miguel Bezos were actually of Jeff Bezos. Therefore, we manually verify all the selected faces for cach person. In the situation where the selected faces are wrong, we manually collect the images for them, for example, for Miguel Bezos. We collect at least 5 reference images for all celebrities.
Algorithm 1: Collection of Reference Images for Human Face Imitation
Input:
Person's name P
Verified Set of Images of P images + SerpAPI(P):
Output:
> Retrieve initial image set using SerpA PI candidateSet < Submodular Minimizaationimmagee ; b Select candidate set using submodular minimization
verifiedSet +- manmaalVerifccattoncamnddddd
Collection of Reference Images for Art Styles We collect reference images for each artist (each artist is assumed to have distinct art style) from Wikiart, the online encyclopedia for art works. Since the art works of each artist were meticulously collected and vetted by the artist community, we consider all the images collected from Wikiart as the reference art images for that artist.
F Implementation Details of MIMETIC² for Human Face Imitation
F.1 Filtering of Training Images
Images whose captions mention the concept of interest often do not contain it (as shown with Mary-Lee Pfciffer in Figure 3). As such, filter images where the concept does not appear in the image, which we detect using dedicated classifier. In what follows we describe the filtering mechanism.
Collecting Reference Images:
We collect reference images for each person using SerpAPI as described in Appendix E. These images are the gold standard images that we manually vet to ensure that they contain the target person of interest (see Appendix E for the details). We use the reference images to filter out the images in the pretraining datasct that are not of this person. Concretely, for each person we use face embedding model (Deng et al., 2020) to measure the similarity between the faces in the reference images and the faces in the images from the
23

---

Published in Transactions on Machine Learning Research (12/2025)
Similarity between same people Similarity between different people Threshold
17500
15000
Number of Celebrities
Threshold: 0.46
10000
7500
2500
-0.2
0.0
0.2 Average Cosine Similarity
Figure 10: Average cosine similarity between the faces of the same people (blue colored) and of the faces of different people (red colored), measured across the reference images of the celebrities.
Table Metrics for the classifier used distinguish between the faces of individuals and the style of artists.
Domain
Accuracy (%)
Precision (%)
Recall (%)
Celebrity
100
100
100
Politicians
100
100
100
Classical Artists
95.0
92.3
98.3
Modern Artists
94.4
92.9
96.1
pretraining datasets whose captions mention this person. If the similarity of face in the pretraining images to any of the faces in the reference images is above a certain threshold, that face is considered belong the person of interest. We determine this threshold to distinguish faces of the same person from faces of different persons in the next paragraph. Note that this procedure already filter outs any image that does not contain a face, because the face embedding model would only embed an image if it detects a face in that image.
Determining Filtering Threshold: The next step is to determine the threshold for which we consider two faces to belong to the same person. For this purpose, we measure the similarity between pairs of faces of the same person and the similarity between pairs of faces of different persons Since the reference images for each person manually vetted be correct, we use these images for this procedure. We plot the histogram of the average similarity between the faces of the same person (blue colored) and the similarity between faces of different persons (red colored) in Figure 10. We that the two histograms the lowest similarity value between the faces of the same person being 0.56 and the highest similarity value between the faces of different persons being 0.36. Therefore, any threshold value between 0.36 and 0.56 can separate two faces of the same person, from the faces of different people. In our experiments, we use the midpoint threshold of 0.46 (true positive rate (tpr) of 100%; false positive rate (fpr) of 0%) to filter any face the pretraining images that do not belong to the person interest (sco Table for the classificr metrics). The filtering process gives us both the image frequency person in the pretraining data, and the pretraining images that compare the faces in the generated images to measure the initation score.
well separated, with
24

---

Published in Transactions on Machine Learning Research (12/2025)
(a) Training images of Samael L. Jackson that show significant variations his face (age, hair, and beard).
C
MA
LE
KEVI
Generated images Samuel Jackson that show the model has captured specifte characteristic of his face (middle-aged, bald, with no or little beard).
Figure 11: Real and generated images of Sammel L. Jackson.
F.2 Measurement of Imitation Score
To measure the imitation between the training and generated images of a person, we compute the cosine similarity between the face embeddings of the faces in their generated images and their filtered training images from the previous step. However, measuring the similarity using all the pretraining images can underestimate the actual imitation. This is because several individuals have significant. variations in their faces in the pretraining images and the text-to-image model does not capture all these variations. For example, consider the pretraining images of Samuel L. Jackson in Figure 1la. These images have significant variations in beard, hair, and age. However, when the text-to-image model is prompled to generate images of Samauel L. Jackson, the generated images in Figure 11b only show a specific facial characteristic of him (middle-aged, bald, with no or little beard). Since MIMETIC*'s goal is not to measure a text-to- sxt-tto-image model captures all the variations of a person, we want reward the model even if it has only captured particular characteristic (which it has in this case of Samuel I.. Jackson). Therefore, instead of comparing the similarity of generated images to all the training images, compare the similarity to only the ten training images that have the highest cosine similarity to the generated images on average.
G Implementation Details of MIMETIC² for Art Style Imitation
G.1 Filtering of Training Images
For art style imitation, we consider each artist to have unique style. We collect the images from the pretraining dataset whose captions mention the name of the artist whose art style imitation we want to measure. Similar to the case of human face imitation, that in reality was not created by that artist, but their captions mention them. We implement the filtering process in two stages. In the first stage, we filter out non-art images in the pretraining dataset (note that the captions of these images still mention the artist, but the images themselves are not art works) and in the second stage we filter out art works of other artists (the captions of these images mention the artist of interest and the image itself is also an art work, but by different artist). The implementation details for each stage is as follows:
want to filter out the pretraining images of an artist
Filtering Non-Art Images: To filter non-art images from the pretraining dataset, we use a classifier that separates art images from non-art images. Concretely, we embed the pretraining images using CLIP VIT-H/14 (Ilharco et al., 2021) image encoder and measure the cosine similarity of the image embeddings and the text embeddings of the string 'an artwork', embedded using the text encoder of the same model. Only when the similarity between the embeddings is higher than threshold described below, we consider those pretraining images as an artwork. To determine this threshold, we choose a similarity score that separates art images from non-art images. We use the images from the Wikiarts dataset (Saleh & Elgammal, 2016) as the (positive) art images and MS COCO datasct images (Lin et al., 2014) as the (negative) non-art images. Note that MS COCO dataset was collected by photographing everyday objects that art was not part of, making it valid set of negative examples of art.
25

---

Published in Transactions on Machine Learning Research (12/2025)
Art images
Art ima mages Non-art images Threshold
images Threshold
Threshold: 0.182
Threshold: 0.177
4000
Number of images
Number images
Cosine similarity artwork'
Cosine similarity artwork'
(a) Histogram the cosine similarity of embeddings of art and images embeddings of artwork' for classical artists.
(b) Histogram the cosine similarity of embeddings art and images embeddings of 'an artwork' for modern artists.
Figure The first filtering step involves determining the threshold to distinguish between and non-art images from the pretraining images, for which compare the similarity of the image's embedding the embedding of the text artwork".
(a) Images from the MS COCO dacaset that classified as by the threshold chocse. These images clearly have paintings in them and therefore are classified that category. These images were selected MS COCO different categorics like scissrs, chair, parking meter, and
Images from Wikiarts dataset were classified by the threshold choose.
Figure Images that misclassified by
threshold in Figure 12a.
We plot the histogram of cosine similarity the embeddings of art and non-art images to the text embedding of 'an artwork' (sce Figures 12a and 12b. We observe that the and non-art images both the artist groups are well separated (although not perfect, Figure 13 and Figure 14 shows examples of misclassified and correctly classfied images from both datasets). We choose the threshold that maximizes the F1 score of the separation (0.182 for the classical artists and 0.177 for the modern artists).
Images MS COCO correctly
(b) Images from Wikiarts that were correctly classified
Figure 14: Images are correctly classified by our vs. nou-art threshold Figure 12a.
26

---

Published in Transactions on Machine Learning Research (12/2025)
Thresheld: 0.278
Images by same Images by different arti sts Threshald
Throshold: 0.288
images artist Images by different artists Threshold
Number of Art Styles
Average Cosine Similarity
Average Cosine Similarity
(a) Histogram the average cosine similarity between embeddinng of the images the artist. (blue) and the of different artists (red) for classical artists
(b) Histogram the average cosine similarity between embeddings of the images of the same artist (hlue) and the different. artists (red) for modern artists
Figure 15: The second filtering step involves determining the if an art work whose caption mentions an artist actually belongs to that artist or not.
Filtering Images of Other Art Styles: Similar to the of human faces, not all art images whose caplions mention artist were created by that artist. We want to filter out such images. For this purpose, we collect reference images for each artist (see Appendix E for details) and use them to classify the training images that belong to the artist interest. Concretely, we measure the similarity between the pretraining images and the reference images of each artist, and only retain images whose similarity to the reference images higher than a threshold.
To determine this threshold, we measure the similarity between pairs of art images of the same artists and pairs of art images from different artists. We embed the images using art style embedding model (Somepalli et al., 2024) and plot the histogram of similarities between art images of the same artist (blue colored) and art images of different artists (red colored) in Figure 15a for classical artists and Figure 15b for modern artists. We see that the two histograms are well separated (although not perfect, Figure 16 shows paintings by two artists whose art style very similar and cannot be distinguished by our threshold). We choose the threshold that maximizes the F1 score of the separation between these two groups (0.278 for classical artists and 0.288 for modern artists). See Table for the classifier metrics. The retained images give us both the image counts of each artist and the training images that compare the generated images to measure the imitation score.
G.2 Similarity Measurement
We embed all the generated images and the filtered pretraining images using the art style embedding model (Somepalli et al., 2024) and measure the cosine similarity between each pair of generated and pretraining images. Similar to the case of the human faces, we do not want to underestimate the art style similarity between the generated and training images by comparing the generated images to all the training images of this artist. Therefore, we measure the similarity of generated images to the ten training images that are on average the most similar to the generated images.
H Evaluation of the Imitation Thresholds
Evaluating the accuracy of the imitation thresholds MIMETIC² finds is a very expensive task, it requires conducting the optimal experiment described in Section (training O(log models with different number of images of each concept). In order to make the evaluation tractable, we finetune a pretrained text-to-image model with concepts that the model has not seen during pretraining and find the number of images required for the model be able to imitate them. We find that all the concepts require more than 250 images for imitation when the models are finetuned them, which is very close to the imitation threshold MIMETIC
27

---

Published in Transactions on Machine Learning Research (12/2025)
(a) Paintings made by Kitagawa Utamaro.
(b) Paintings made by Tsukioka Yoshitoshi
Figure 16: Paintings made by Kitagawa Utamaro and Tsukioka Yoshitoshi are very similar and our threshold unable to distinguish between their styles.
28

---

Published in Transactions on Machine Learning Research (12/2025)
finds for this pretrained model without finetuning its (234 images). Based on these results, we conclude that the imitation thresholds estimated by MIMETIC² are accurate.
We do this by searching politicians who became popular after the LAION-2B-en dataset was released (after 2022) ($C.2) and collecting their images from Google Images. We finetune SD1.4 on images of these politicians, starting with 50 images of a politician (much below the imitation threshold found by MIMETIC9) and going up to 800 images (above the estimated imitation threshold). We finetune the model separately for each politician. To mimic the original training setup of the SD models (where images of a concept are naturally interspersed with other images in the dataset), we mix the politician images with other images taken randomly from the LATON-2B-en dataset such that for each finetuning experiment the total number of images added upto 10,000 (9,950 random images mixed with 50 images of the politician, 9,900 random images mixed with 100 images of the politician, and so on for each finetuning experiment). We finetune on this new dataset for a single epoch with a learning rate of 5.
We want to find the number of images required for imitation to occur in this sctup. Imitation can be established either with a human study or an automatic metric that correlates with human perception of imitation. Since we already conducted a human study and found that our imitation threshold correlates with human perception, we argue that the automatic imitation score for concepts that are on the right hand side of the imitation threshold would also correlate with the human perception of imitation. MIMETIC² estimated that the imitation score for concepts the right hand side of the imitation threshold for face imitation of politicians for SD1.4 is 0.26 (Figure 19). We deem the number of images required to reach this imitation score as the number of images required for imitation for this finetuning experiment.
We report the results in Table 9. shows that the imitation score remains lower than 0.26 when less than 200 images are used to finctune the SD model and the score reaches 0.26 only when finetuned with 250 or more images of a politician.
Thus the number of images required to reach the imitation score of 0.26 in the finetuning experiment (250 images) is very close to the imitation threshold MIMETIC² finds for SD1.4 without requiring to finetune the model (234 images). Based on these results, we conclude that the imitation thresholds estimated by MIMETIC² are accurate.
Table The imitation scores of the concepts as SD1.4 finetuned on increasing number of images of a concept. We report imitation scores averaged over 10 such politicians. We note that the imitation scores have values 0.26 or greater when the model is finetuned on 250 or more images of a politician. Critically, this is the average imitation score for politicians on the right hand side of the imitation threshold in Figure 19 indicating that 250 images or more are required for imitation in this experiment.
# Finetuning Images
50
100
150
200
250
300
400
500
600
700
800
Avg. Imitation Score
0.07
0.16
0.19
0.21
0.26
0.27
0.29
0.31
0.32
0.36
0.34
Imitation Thresholds of SD models in Series 1 and 2
Our experimental results in Section 6 found that for most domains the imitation thresholds for SD1.1 and SD1.5 are almost the same, while being higher for SD2.1. We hypothesized that the difference is due to their different text encoders. All models in SD1 series use the same text encoder from CLIP, whereas SD2.1 uses the text encoder from OpenCLIP. To test the validity of this hypothesis, we repeated the experiments for all models in SD1 scrics for politicians and computed their imitation thresholds. Table 10 shows the thresholds for the politicians. We find that the imitation thresholds for all the models in SD1 series is almost. the same, and is lower than the threshold for SD2.1 model. This evidence supports our hypothesis of the difference in the text-encoders being the main reason for the difference in the imitation thresholds.
J Change Points
Table 11 we show all the change points that PELT found for each experiment (Table reports the first change point the imitation threshold).
29

---

Published in Transactions on Machine Learning Research (12/2025)
Table 10: Imitation Thresholds for politicians for all models in SDI series and SD2.1
Pretraining Dataset
Model
Human Faces
Politicians
SD1.1
234
SD1.2
252
LAION2B-en
SD1.3
234
SD1.4
234
SD1.5
234
LAION-5B
SD2.1
369
Average Initation Score of the Generated images
00.6
0.7
Mean fefrr Chngg
Imitation Threshold: faces
0.6
0.7
30.5
Peun Simlarty Ala Durgo fort
0.5
0.4
0.4
0.3
0.3
0.2
0.1
0.0
Polticians wit incrassin Counts in the Training Data
Figure 17: Human Face Imitation (Politicians): Similarity between the training and generated images for all politicians. The politicians with zero image counts are shaded with light gray. We show the mean and variance over the five generation prompts. The images were generated using SD1.2. The change point for human face imitation for politicians when generating images using SD1.1 is detected at 252 faces.
K
All Results: The Imitation Threshold
In this section, we estimate the imitation threshold for human face and art style imitation for three different text-to-image models. Figure 20, Figure 21, Figure 22, and Figure 23 show the image counts of celebrities on the x-axis (sorted in increasing order of image counts) and the imitation score of their generated images (averaged over the five image generation prompts) on the y-axis. The images were generated using LDM, SD1.1, SD1.5, and SD2.1 respectively. Similarity, Figure 24, Figure 25, Figure 26, and Figure 27 shows the image counts of the politicians and the imitation score of their generated images, for LDM, SD1.1, SD1.5, and SD2.1 respectively.
Figure 28, Figure 29, Figure 30, Figure 31 show the image counts of classical artists and the similarity between their training and generated images; and Figure 32, Figure 33, Figure 34, Figure 35 show the image counts of modern artists and the similarity between their training and generated images. The images were generated using LDM, SD1.1, SD1.5, and SD2.1 respectively.
Imitation Threshold Estimation for Human Face Imitation: In Figure 21, observe that the imitation scores for the individuals with small image counts is close to 0 (left side), and it increases as the number of their image counts increase towards the right. The highest similarity is 0.5 and it is for the individuals in the rightmost region of the plot. The solid line in the plot shows the mean similarity over the five image generation prompt with the shaded area showing the variance over them. We observe low variance in the imitation score among the generation prompts. And we also observe that the variance does not depend on the image counts which indicates that the performance of the face recognition model does not depend on the popularity of the individual. The change delection algorithm finds the change point to be at 364 faces for human face imitation for celebrities, when using SD1.1 for image generation. Figure 22 shows the similarity between the training and generated images when images are generated using SD1.5. Identically to SD1.1, the change is detected at 364 faces for face imitation when using SD1.5. We also performed ablation experiments with different face embeddings models and justify the choice of our model (see Appendix M). For all the plots, we also analyze the trend by using isotonic regression which learns non-decreasing linear regression weights that fits the data best.
Imitation Threshold Estimation for Human Face Imitation (Politicians): Figure 25 shows the imitation scores for politicians which is very similar the plot obtained for celebrities. We observe low variance in the imitation score among the generation prompts. We also observe that the variance does not.
30

---

Published in Transactions on Machine Learning Research (12/2025)
Averaee Imitation Score of the Generated Images
0.7
Iniladion
0.5
20.6
Pean Sim lurky Afar Change
Yean dim lufty Edtre Oainge Ft
Initation Threshold: 236 faces
0.6
0.5
0.4
0.4
0.3
0.3
0.2
0.2
0.1
0.0
0.0
Polticans with noreasing Image Counts in the Training Dota
Figure 18: Human Face Imitation (Politicians): Similarity between the training generated images for all politicians. The politicians with zero image counts are shaded with light gray. We show the mean and variance over the five generation prompts. The images were generated using SD1.3. The change point for human face imitation for politicians when generating images using SD1.1 is detected at 234 faces.
Average Imitation Score of the Generated images
0.6
0.7
Veun lirlyrty butono Porgeeort Fort
Initation horeshold: 234 faces
0.7
0.6
0.5
Poun fim lurt Ala Ouago fors
0.5
0.4
0.4
0.3
0.2
0.1
0.1
0.0
0.0
Polticiems with incressig Image Counts in the Training Data
Figure 19: Human Face Tmitation (Politicians): Similarity between the training and generated images for all politicians. The politicians with zero image counts are shaded with light gray. We show the mean and variance over the five generation prompts. The images were generated using SD1.4. The change point for human face imitation for politicians when generating images using SD1.1 is detected at 234 faces.
depend on the image counts which indicates that the performance of the face recognition model does not depend on the popularity of the individual. The change detection algorithm finds the change point to be at 234 faces for human face imitation for politicians, when using SD1.1 for image generation. Figure 26 shows the similarity between the training and generated images when images are generated using SD1.5. Similar to SD1.1, the change is detected at 234 faces.
Imitation Threshold Estimation for Art Style Imitation: In Figure 29, we observe that the imitation scores for artists with low image counts have a baseline value around 0.2 (left side), and it increases as the number of their image counts increase towards the right. The highest similarity 0.76 and is for the artists in the rightmost region of the plot. We also observe low variance across the generation prompts, and the variance does not depend on the image frequency of the artist. The change detection algorithm finds the change point to be at 112 images for art style imitation of classical artists, when using SD1.1 for image generation. Figure 30 shows the similarity between the training and generated images when images are generated using SD1.5. Similar to SD1.1, the change is detected at 112 faces for art style imitation when using SD1.5. These thresholds are slightly higher for style imilation of modern art ists, 198 for both SD1.1 and SD1.5.
L Examples of Outliers
Figure 36 and Figure 37 show examples of outliers of the first kind, where aliases of a celebrity leads to under counting of their images in the pretraining data.
Figure 38 and Figure 39 show examples of outliers of the first kind for artists, where aliases of an artist leads to under counting of their art works in the protraining data.
M Ablation Experiment with Different Face Embedding Models
In this section, we show the difference in the performance of several face embedding models and justify the choice of the final choice of our face embedding model. Face embedding models are evaluated using two main metries: false-match rate (FMR) and truc-match rate (TMR) (NIST, 2020). FMR measures how many times does model says two people are the same when they not and TMR measures how many times model
31

---

Published in Transactions on Machine Learning Research (12/2025)
Table 1I: Imiitation Thresholds for human face and art style imitation for the different text-to-image models and datasets experiment with. This table shows all the change points that PELT found for each experiment (Table 3 reports the first change point as the imitation threshold).
Human Faces
Art Style
+
Pretraining Dataset
Model
Celebrities
Politicians
Classical Artists
Modern Artists
SD1.1
364
234
112, 391
198
LATON2B-en
SD1.5
364, 8571
234, 4688
112, 360
198, 4821
LAION-5B
SD2.1
527, 9650
369, 8666
185, 848
241, 1132
Average Imitation Store of the Generated images
Vean lury butare Ourrgeoort
0.4
Yean 5i lurt Afir Cuange fort
Imitation Threshold: 648 haces
0.4
0.3
0.3
0.2
0.2
0.1
0.0
0.0
Calebitties with inceassnng Image Counts in the Training Data
Figure 20: Human Face Imitation (Celebrities): Similarity between the training and generated images for all celebrities. The celebrities with zero image counts are shaded with light gray. We show the mean and variance over the five generation prompts. The images were generated using LDM. The change point for human face imitation for celebrities when generating images using LDM is detected at 648 faces.
says two people are the same when they are the same. Ideally, face embedding model should have low FMR and high TMR. An important variant of these metrics is the disparity of FMR and TMR of a model across different demographic groups. Ideally, a model should have low disparity in these metrics across different demographics. We also focus on the variance of these metrics across demographics in making the final choice.
We evaluate the FMR and TMR of eight different face embedding models (seven open-sourced and one proprietary). The open-source models were chosen based on their popularity on Github (Serengil & Ozpinar, 2020; Deng et al., 2022; 2020), and we also experiment with Amazon Rekognition, proprictary model. For evaluating the disparity of these metries across different demographic groups we grouped celebrities in six demographic groups primarily categorized according to skin color tone (black, brown, and white) and perceived gender (male and female; for simplicity). Each of the six groups had 10 celebrities (a total of 60), with no intersection between them. The categorization was done manually by looking at the reference images of the celebrities. For each celebrity, we collect 10 reference images from the internet by using the procedure described in Appendix E. We use these images compare the FMR and TMR of the face recognition models, these images are the gold standard images of a person.
We compute the mean cosine similarity between the face embeddings of one individual and the faces of all other individuals in that group, and repeat the procedure for all individuals in a demographic group.
FMR Computation:
TMR Computation: We compute the mean cosine similarity between the embeddings all the faces an individuals and repeat the procedure for all the individuals a demographic group.
Figure 40 and Figure 41 shows the FMR and TMR for six demographic groups for all the face embedding models. All the open-sourced models, except InsightFace, either have high disparity in FMR values across the demographic groups (ArcFace, Facenet, Facenet512, DecpFace) or have very low TMR (GhostFaceNet. _1,, V1). We choose InsightFace for our experiments because of it has 1) a low overall FMR, 2) decent TMR, 3) a low disparity of FMR and TMR across the demographic groups, and 4) is open-sourced. Having a low disparity of the metrics across individuals of different demographic groups crucial for an accurate estimation of the imitation threshold. The Amazon Rekognition model would also be a viable choice based these metrics, however, it is not open-sourced and therefore expensive for our experiments.
32

---

Published in Transactions on Machine Learning Research (12/2025)
Average Imitation Score of the Generated Images
0.5
Initadion Scare
Inilation Thoushold: 399 faces
0.5
0.4
Peun Sim farl Afor Change
Vean dim lufty Extoae Ouinge Po
0.4
5.33
0.3
0.2
0.2
0.1
0.0
Colobritics with morsasing Image Counts in the Training Data
Figure 21: Human Face Imitation (Celebrities): Similarity between the training and generated images all celebrities. The celebrities with zero image counts are shaded with light gray. We show the mean and variance over the five generation prompts. The images were generated using SD1.1. The change point for human face imitation for celebrities when generating images using SD1.1 is detected at 364 faces.
0.8
Average Initation Score of the Gemerated images
0.8
0.7
Mean felton Chonge Rover
Initation Threshold: 364 faces
0.7
20.6
Vean biiyyity ahe Change kein
0.6
0.5
Retanic Regnendon
0.5
0.4
0.4
5.3
0.3
0.2
0.1
0.1
0.0
0.0
Colebritics with incraasnng Image Counts in the Training Data
Figure 22: Human Face Imitation (Celebrities): similarity between the training and generated images for all celebrities. We show the mean and variance over the five generation prompts. The images were generated using SD1.5. The change point for human face imitation for celebrities when generating images using SDL.5 is detected at 364 faces.
N Count Distribution and the List of Sampled Entities for Each Domain
N.1 Celebrities
We collect colebritics from https://www wwwpwww........... wwwppppga..co//eeeeeeiieeeee com/Celebrities and https://eelebansvers. com/ celebrity-list/. The distribution of the caption counts of the sampled celebrities is displayed in Table 12. The sampled celebrities in the descending order of their number of caption counts are:
Doould Truny Rave Hiddlatos, Abruhes Liucola, Johnny Depp, Buephan King, Auns Hathover, bua Allleck, Beoald Basgen, Opeah Mindavy, Flayd Haywathbee, Deasse Johasos, Dewren Bias, Sate Blanchats, Hare bablbargg taant Cauphall, tiee loase, Inesica Hall Kendricx lauar, Waleste I, Seacer Sptalberg. Dalla Theme, Bih lote, Jay Late, twrid Temant, Sumnl Jackeen, Jazes Seathsn, Randy Noore, Virterts Jnstice, Boats Basick, Hartin Scarsare, kablay Diamn Caray Malliges, Dress Thanherg, Aablan Rispren, Socey Nuggosee, furs Easeel, Folicity Jonco Stouese boaa, Sorth Paulson, Nothhew Perry, Freest Waitaker. Bresdon Brie, Hig Ryan, Olivia Ciloo Jae Ruges, Sterling Brow, doding Ir., lay flotts Trmes,
Dates, Terrence Rouaed, Batalie Dimer, Figues. Offeren. Ooen tyra, brddy layas,
Jrece,
Troye Sactary
titay Keoug, Bazuchel, Alesunder Holler, Jaceo Sartortur, thrietine gutan, Terrey Becitto, lisk Sandea Cimneess Ribeet Ireize, Dantelle Frabet. Sermant kordes, San Taylor inineen Jamaica Setnfeld,
Mertinee,
Hachsmeie Pay,
Besdgses,
Lopee,
Suydoas,
Deaz
Alyoon
Henisgvey, Greng
Aachelle infeors, Joyner Locas, Jumy suffet, John Nayas Sasy, Harvin Happ, Iyan Suraan, Lindaay filingess, John Corbett, Richaola 20s1, lime iaby diiele, Christiano koraldo, doots Speatean, sottionn lae Justics Beith, Stalls Ternant, Lindaay lagner, a5 Nichalis, thsrlis Helton, Patricia Sield, Ban Bilnerion tmin Mirghy. Michle Riseran, Sara Patter, brego Soness, tanny Thonas, Ofte Bittor, tarri Rudrrall Chris slath lndri go fartene, late Heweoorth thas Tartean, Richael twts, Judtn
miree--aatch, Trecor lackeen, Jann Barblar, tas Korley, the lagane, Liss konhy, Scane Excy, Steo Torcenella, laaa Cerrin, to Tarprrtt, Greezhann sxllte, Bartin Starr. Dasid Ruis, Bouns Poldavein, Loe. Barvyy Biiie Kibaste Tood Chrislay, Dus Grombus, Anadu Oormen, Geysial Bann, Birk Aichi, Haghsians Fradkosik, busielle Joass Liu Yalo., Sasba Pavavarose, Ashlligh Harray. Poser Barean, Paria Steokons. Bolle Hull, Suster Pazrioh, Hass McGrrsy, Diens Ouurzeco, Siz lis, Bredy Quien, Jill Veguet. Michard hasiings, Eopata Eilide, Generta fodriguss, Stase Land, Prankte Grands, Clivis Bodrigs, Jnsee Indid, lamms Beonfran, Cesra Carter, The Blaneto, fat Jaster Temass fill, Jazed Pollowiik, Hazaberita Mismeni, fliss Sednsori, Thema Dobecty, Bill Starapied, indya foore, Ziys thang, Cacse Golb. Jay filis, Arthur Sasis HeCandless, Pas de Rouets, Jucquaion Jablenaki, Sicharl baffer, kanse Letlane, Rieran Culkis, Lavey Brasa, Bacbel Antomeit, Peaslay Geeber, Learen Bash Macaado
Srocoae--aasonn Dynetur,
Bengiar Brinking.
Tascoro,
Belesul-houmum Drtags, Bickaw, Halgonie
Ludel Tolodo, Sydaey
Dunnel Suster Kolcudy Ethan Suplew, Tamy Budtrse Gazriazii Kichardios. Tuey
dchafer, taka
Sun Biliot.
Spears, Bugghe WRitch Jor
Biliot
Veisn. Julle Ohrialay, bavm Soun, Hiles Nats Stonie, Conasr Gruise, Hictolss Bremn Dan Lok, tharli D'aasllo, Jaeay Banber. Jin Malton, fasther Baner, Stcois Oragalas, tas Stales, intre Bast, files D'Scien Nay Fitzperald, Tuyker Hills Portie Fremman lets Chariaia, burid Brinkley, leag's Buisen keol firs Sutbie Pureeiza, Pual Sucal, Porzent Punn, Jamie Suchuct, Yung 2exry, tatay Inter, Diris D'lentoo, Jondan Chllat, lab Starhan, Alarandra Cooper, syla inter, Thise Shores, talla belghtee, Janna Iillaan, 1o frim 2tilie wakk laggte fizer, fints Dalla, Thy Lopar, Sarr Keber, troez Viakler, R.C. Deeer, Jack his, flses Seste, fatlay Sarist, tasl Dober, ingle Varmss Treeer callace. Sadayy Cline, Fred Stollar, Frane Sherran, Albert Lin, Statties Lopaz, Zays Made, fateray: heskeittnnn, Radiecn fatley, Will hears, Rick Dilton, Bage Jean Page, Harther Sarber, Yauiche Ilindorr , Toank Prosloy, Thaoicee Secson, Hiodle Fasoe, Stote Brinso-Baeds Alex Bui. doots Yaneey, Ciorn Kiloon, Lext Undersod, Nany Shothiin, Sile batoff, Oile Labrant, layne Carin', Breg Fichel. Rpan lpeturch, Parcus Freeean Da Datn, due likens, tyle Oukk, barid Partnoy. Avani dreg. Den Peta Quinson besuoida, Exic Poetuztieid, Ayo Bdenizs, farn Lesa Vilasn, Fisrence Bust, Ricois Parcelia, Purliiss Roshan, Jush Beiter, Sea Hallsh. Sigoei bexce, Lokita Raceell, Skavbye, Jurdus Pirsinan, Jull Miiia, Bazy Loe Heliieer Cody Lighlaine, lesh Jelfrien, Eile Gruhan. Junta Parqucet Ballock, Hoody Jormus, loa Elyth. beals hopeto, Visdon fuye, Reia tyen, Jony Elowon Tiursore Billaus Jusi thao, Cura Jule Hyur, Seyle Susterzoee Rejuu, Samara Joy, Hason Thanes, Park Ji-bu, Bamm Dalanay cassy sisday, stag,, Jaylts Corey fnarteifie, Hix Shalliner. Aryan Siebahrs
bustin fiease. Inogutte Wheeler, Holante Iglasias, lona Gleveland, Bize Sotalles, Grant kchatz.
Priys
Simay teidgette deaury
Iahapectao, Adttys Knsepact. vedang Safits
Themss, hajajaise, Bingo Calva, Pardis
33

---

Published in Transactions on Machine Learning Research (12/2025)
Average Imitation Score of the Generated Images
0.7
Iniladion
Initation Ttewchold: 527 faces
0.7
20.6
Vean dime lufty Extoa Ouinge Pt
0.6
30.5
Yean Abar Change
0.5
0.4
0.4
2.3
0.3
0.2
0.2
E0.1
0.1
0.0
0.0
Colsbritics with norsasing Image Counts in the Training Data
Figure 23: Human Face Imitation (Celebrities): similarity between the training and generated images for all celebrities. We show the mean and variance over the five generation prompts. The images were generated using SD2.1. The change point for human face imitation for celebrities when generating images using SD2.1 is detected at 527 faces.
Average initation Score of the Generated images
0.4
Vean Sirs Before Orange Point Vean lally Aber Change fo
Inilation Threshald: 309
0.4
5.3
0.3
0.2
0.2
0.1
0.0
0.0
Polticians w2h horeasing image Counts in the Training Data
Figure 24: Human Face Imitation (Politicians): Similarity between the training and generated images for all politicians. The politicians with zero image counts are shaded with light gray. We show the mean and variance over the five generation prompts. The images were generated using LDM. The change point for human face imitation for politicians when generating images using LDM is detected at 309 faces.
N.2 Politicians
We collect politicians from Wikipedia (Wikipedia, 2024). The distribution of the caption counts of the sampled politicians icians is given in Table 12. The sampled politicians in the descending order of their number of caption counts are:
Barack Obamo John
Therote Harondre Modi, Kin iorg-un, Darid
Merbell, Bill Clixson, Jinping, Jeatin Trodens, Desasoe) Macron, Hanoy Polooi, Slair, Aectis Tendulkar, Mick oilgg Hout
trrold Scharameggrr Ron Paol, Shirne abe. eool Rister, Joir
Stote Norriion, brettd Kejriusl, Thbn Lindeny Sratan, Bomnt Robarak,
Redrigo Intarta, Sata Eada fauny Alvxsi Saralay, Bob Ford, Les fazelles, Ere Horales, Loe hrs Loung, Honry Kissinger, Petro Purvabanke. Joko Kidddo Clarvace Thome, Biati Bunak, Halazaed Surv.. Auhcu! Chaii Karlin Roduianoo, Vibtor Grbun, Uhuvo Kasyalle, like Huiadhow Abuika Hemin, Surtis Schule, Guauage Ousie, John Bosurl, Bunito Masallin,, Telui Zazaard, Zeetnic fash, Rictaal b. il liigin, Prançote Iollands, Yarser trstat, Mark heste, lahathir Razanad, Juae Taansl Sactee, ioty Atssd, killian Peizce, las lose. ter, Muzast Gerbactar, has Sen, Jncques thirae, Bastin D O'Hallay. Jenazir thesto, Yeahshide Sega, John Bafor, Maarar Oadtads, Jerry Springse, fandra Day d'Cemner, mndaleine Alseught, Thouss Nasa, Parl Sagune, Stoee Covaoey, Graat Shapos, Sebastian Coe, Rerrick Sarland, Jeaz-Tves is Brisn, Parezitan Hazarbayev, Berat Sosboter, Lif Teuss, Yourrt Wessentt loigi ii Kate, Bar lare, Homms tan Rengay. Daniel Ortege, Shat Schole, Bage Seitio, Alserana Bistaara Hiodlk Madeno, Thete bin Biadd Thant, tory Nortenee, lest Alt Tandart, Ineaae Goobbele, Sical Pashioppe, bab thalaed, Panl Rtys, thia' Patsab sl-Bisk, Thabe Hodki, Eyrisken Hilgotukia, Jesegh Streat, Hicholl Bartis, Bateecu Bougrailly, Purthal Desohon, 2odd Yougg Jour-Barie ha, Hick Caillin, Zura Zure, Pausee Hkurunsion, Albusit Rejuajin, Heggie Hasnn, Beavs Cba, Jum Quaide, Bii hane Mazy Lundiien, Jyski Kateines, Jam Spukn, John Deunani Sahan, Gite Isoies Morrlai, Jam0 Cleverly. Throbin Notroel Bolib, Leynoh Oboven. Orben, inisa Bihanest, Haysh
Jaosh tim, fashar al-se taura furh, Sonta Sanfts Ris
regabe, Jane
koomn Villians Bll Jahneo Sir' saf, Beorge deal, Park
Rasmitoo, Digglar-foee
Jack Sohorell.
hadsunjass, Surphy,
Hiexaysyer, Taire Flnchar, Park Tax, Bletes bastilloos, kotel
Sanen--ggaeen, Verrer Faysan,, kaala Mrra--iiaaaaar. regrid Recandorrts Valodyaye 7al
mewee Tojo, instaly tarpor, Warcale Thrradd Stavej 2iaak Teers lets, ilfind Bosenberg, nad Arhoosse, lal iatentia Natstyenion Kgslass Hotlanthe, Paero Cattillo, Vinmna Labuce, Perer tell, Beytn farterr, Carl sildt, Alaabber ieachaper, Sihunna, thimes lhe, buinn feotbard, Jaqges belurs, Floella Benjerin, doali Riininoo, Auallan Bautlock, Trrm Hudeik live, Alajundro Gismette, Bub Surry, Lisoel fospin, Harray Hobily, Ssefan batven; Javier Silaze. dalso Kiir Mayardie, Geeil Willinms, Buihter Battil Pariamee Thytorn, Harty Sateleguss, fot Moo-hyon, John Disdeshater, Astonio inoks, Iokn 20coe, CT Lesaz, Tea Tancredo, Sigris laak, Jin boiget, Leu barlects, Li Penz. Lazza Chinchllia, Connady Sysgator, then maii-isn. Sebustian Fliera, Gastare Puteo, Rigusl Cinc-Cunel, Albarto Paruaddee, Gueald Daroanin, Sostres Gaatr, Jesciis Piacher, Hais Sunda, Bicarts Fartiseili, Aodze) Zebis, Dus Jarvis, likos Bundaas, theis Sipkiss, Terakaol Kacean, Sooth Gardane, faris Rocioll Holutu Base Siko, Alsnader Basg, Alesunder De Groo Alasd Aboul Gueis, Yerso hurds, Jaan-tne Milarchmm Jan Kent Bixes bodde, Balmn Urately. tortes dayy Pxtrica Talms Darann toloe, tarts Prxcoacciint, tram Binino. Michard Farrand, Indress Scheser, Yasta Katasr, thandrabattr Bac, P. Barriese, Bebart liaberk, inn Lindo, Jon tmmorts, Eteard Seteiuns, Staf Biok. lavrence Genst, Willian Seper, Jaze fill, Ailestor. Maas Davatggla Pranck Riester, Sibeo Shristownsldnn Dusten Dommmee
lazoelins, Carl Setettt, falps consaives, Lise bymne dint marra, Jean Mchhl Slanquar, fobert
Sutena, toje Pevvii Ashraf, Dezid Oainso. Die Kete. Perry Chistie, Borista, Saberto bosos, tee Chell-yan, Alpht Gosid Alasandr Secaan lanatse Schavan. Yor: hndrogor, Prangre-thillge Changggne Aguatishe Ness, trassiggh, Bolkina Brmne, Karl-Thooor so heppll, Stuller, Leargare, kzalt Insemantt Michasl Mas, Panio Portae, Dranja Schilee, Pita Starplee, Chemenly dayssnne, Teterics trance, ralts Tabseehess, Bobarts Netacla, tipakees deto Gestambt,, Indray famachandras, Fernando cruddefarranka.. Japka Hoskstes, Toets bestsesk, Egile Lerite, foland Kech, Jaseph beise, Lntrenties Cortixs, Alm Darcia, likela Popaaks. Bosrist Bartolo, bayas Karesa, Niaan Engattos, Sergei Branssher Flanes Dresharaki, ln Broahle, Darlon alvarado Dustala, Parek Blerzacki, Clivier Viras, Vakonlav Swarnts Clarn Noady, Barthtar Broate, morrge Stathakie, Marts Orrratis, fims Rinertt, hins Reluarte, Mile tetenoott, Lawa taatahells, Trahal Delar, Jarnstu Sortn José kni Eacravk, dare vus Sisoenbuiess, Iva Nikles, Acuncha Consaler lays, Visks Ashred, Gureet Mlisi, Jus laia Aoaios, Des Debectiste, Aluin Rervine, laatee lagunszija, Eiverd Argus, Altim Suatuee, Zarava Polaralion, Misssla Sulowsk, Gutcivl Boriv, Jum Carlou Ganoo, Earel Serlitoh, Eiril, Pelkur, Elebavia Bafelaha, Sobius Billatrin, Hirooler Tomm Ribui Sarvan ingerean, Teazlo Kallin, flisolwtli Suroe Burbers Pux, Peice Moila, losehi Tasi, Curelin Bioisien, Berbure Gysi, Debonis Jaznktek, Bize Hagaitten, tartin Pertns, Borms insterst, sy Behning, H8gg Mindez de Vigo Boto Petror, ias Karan, feemande Gevalloe, Milan Rufonetit, ktriana Mineas, lds Saraisinmn zorm Brankorit, Jarin Tucie, Jarzy Reoptanicks, hafasi Catala helo, Ljobe Botkents, Caneits Bopeistcs, Jesrt Clakev, Proderik Françoda, Srigstov C vishainks, Beebert boach, Betin Paysiokls, Solois lllea. Vivi Proedgut
Suttanberg,
majjehh
Surgayas, Opperaun,
Maheell Foaelun,
Jou--2urzee,
Sesetits, Pasl Heerrs stand Vabiei, Kaya Ballar, has contang,
cetar Lnfertatne, Trics Datis, las Hestafs, Xteears Castro,
N.3 Classical Artists
We collected classical artists from the
a website that collects varions arts from different artists and categorizes them into pre-defined art style categories. For classical artists, we collected
34

---

Published in Transactions on Machine Learning Research (12/2025)
Average Imitation Score of the Generated Images Initation Threshold, 234 races
0.6
Iniladion
0.6
0.5
Vean dime lufty Extoa Ouinge Ft
0.5
Sir Grilark Abar Change
0.4
0.3
0.3
0.2
0.2
0.1
0.1
0.0
0.0
Polticans with noreasing Image Counts In the Training Dota
Figure 25: Human Face Imitation (Politicians): Similarity between the training and generated images for all politicians. The politicians with zero image counts are shaded with light gray. We show the mean and variance over the five generation prompts. The images were generated using SD1.1. The change point for human face imitation for politicians when generating images using SD1.1 is detected at 234 faces.
Average Initation Score of the Gereroted images
20.6
0.7
Vean 2in baity before Chinge it
Pean Sir lufty aber Change foin:
Inftaton Stare
Imitation Threshold: 234 faces
0.7
0.6
205
0.5
0.44
0.4
0.3
0.2
0.2
0.1
0.1
0.0
0.0
Polticans with incressing Image Counts In the Training Data
Figure 26: Human Face Imitation (Politicians): similarity between the training and generated images for all politicians. We show the mean and variance over the five generation prompts. 'hhe images were generated using SD1.5. The change point for human face imitation for politicians when generating images using SD1.5 is detected at 234 faces.
the artist names from the art styles: Romanticism, Impressionism, Realism, Baroque, Neoclassicism, Rococo, Academic Art, Symbolism, Cubism, Naturalism. The distribution of the caption counts of the sampled artists is given in Table 12. The sampled artists in the descending order of their number of caption counts are:
Clande Monst, Bestrandt, Surtar flist, Edgar Degan, Dararaggo, Millian Ilabs, John Jaeee Jutitton Cortonter, Desllttto Pater Pasl libere, John Stnger Sargent, Edonard Ranet, Jotn Willian intertezse, sifred Sisley, thiids lazzas, Bartha Merisat, Vister Dago, Usiliam kdclphe Brogcareas, Gestare courbat, Albart Bierasadt, Mary Daseatt, Jaa Constable, Gesture bere, Gestave Calllebatts, Bazzy tecre, Theras Handy, Johamnes Vernser, Jacquer touis Darid, catler Jedon, Thems cole, Themss Harus, Tiesot, Villize lugara,, laberts, Thoess Gainthororgh, fathing tyck. Villian Baynolde,
Casse Cargar Priedrich,
4lne-Tbdeea, deorge
Beorgee tragie lagura
Jasn-lann
Regene
Saya, Bouchar, George Gievani Boldisi,
fisell,
hoseell,
Clauds
Hillour daith,
Archibald
Guillaminn Beadin, Janse Nenatll Whistler, flys laptn, Villias
dtvazovkyy intn Trentell, Jaseph tright, Banjants West, Jahn Dellier, Searl Fantin Latoer, Jin
teantord, balls Sargaret Casseot, innibale Carracci, lnteine Vettean, Harisaze lerth, David Cos, Jacab Jordsens, Proderica Kezzan, Ivan Shinkkin, Gessge Berland, Ford Vodos Brow. Frans Snyders, Jahn lackson. inlbort Cup, Charlar. villann Pasle, Jarah The Riislael. Jhasph Dicrnir, Horate Verner, Pinter be Roach, Arstor Highes, entonio Danon, Carrlar Ia frin, Francancs migas, There aelly. Trasr Laritan, toberr Spencer, Kerl Rodeer, flazarde fatweal, T.C. spech, tiis incher, Darl Spttnung. Dward 213ki,, Panl halanoche, Prelae-Pransste beebigry. deorge Traderice laste, day fore, Caral Extetctor, tifred Stavese, Pader Samerth Kraper, Theae marchence, Platro Longaa, Jeuqui Surolie, Thoodeev Gunneiin, Joha filey, Tawsoay kousoun, Biouad Saarles Tabell, Giveanii Dosusico Tapploo Edvard lokil. Pappo Batoni, Richard Parker Suxiagimn, Borio Kusoodiww holrom kilnlleh, Charles Qudler Yikter Vaseesoor, Antoise Blandbrdd Villiss Herry Bust Baile Caas, Jolins Aldoo Mair. Mikke:] trobel, Richard inds, Vartly Verasbstaris, Jatn Bopezer, Michard Lindeer, friatide failist, Joss flase, Willian Willisns, Adrisen Browser, Constast Troyen, Fermand Mussstt Edvin kastin Abbey, Sise Severisi, Pretre Cortens, Atrises Tea Do volde, Vestly Pezce, David Bonbary, fonstantin Berevis, Caristctfer Milbeie Eekeraburg, Jeas
Natsingts,
Mennrrty Hiball Miniaaay.
Ryder, Groragpe Guorgo Vilert, Hilli Vilson
Intarberger, Reger Fraenaps,
Staper,
Springer, Saequa ispehtes, agaettnc Corracet, Mas
Joseph
Olatzes
Dastly
Diovarns
Lysbon Popore, beizor//ediia.
Oiunoppe Christius
Alesandes
Bustecte
Pardioad
Vasily Polmsos,
Bivard
Gaole faronssis, Spancnlayh, Iran krusshy,, fidols Yen Alt, Philipp atso Bange Carclur-uraa, Jalph Earl. Zugens Carriaee, Julius Leblane Stevart, ippolite Cufft, Jahz Peter fasall. Joan Supsinte Vasauzs, Anioiio Nariiai Peieus Yaa Schandel, Ssajeria Brvn, Has flinger lobrix Siurs, Heurice Brams Vizceres Conerrini, Jum-tiim Licturd, Henry Torke, Jacee lel salczenkit, Rehene Santoro, Plater Godde, Jann Pael laurine, Lottee Bolllon, Jan Stharachte, haold Barter, John Paczsa, Falscim Rage, letn Barnes Theadile Mitet, viiliam logstail, Richard lack, leaer vattor, Prangate Sarard, hobert 2ilian Indertonc, Licnll Iaal Zopar, Charles Bayyn, lin Jrigann, Theess Joner Tarker, toteoso Cinect, lsseps keton Kach, Inten Balbee, Meecaa Touriter Peter Stcolai Erto Lay Lagorie, Sattiaas Ston, J0m Daptiata Var Lec, Rosstantinos Velaratis, Dornelis Vreodentorgh, lmrra Siesirodalsi, Prodezich Oeorge Oscem. Bea Ginzelen eo. Jin Cieasere, Julio Somnalar, Viddinte Natordly, Prodee Bronsiao,, Foel Porl, Thores Pollock Inshita, Saden Balat, Robers Lavis Seld, Jnsaph-oorte Him, trro Breker, Praderick Williss Burzon, Tin Intreases lanka saler, Willian leightan lettot, Baxian Van bo Veide. Diack Yan Sabure, Jucob Yau Sieks, Frame Stuck, Ciomazii Bastiate Caslis, Him Gods, Burziet Backer, Sicolas Intoine Tamnyy, Pycdur Alskasyev, Vestly Tropinin, Alleed besodsucy, Alexsy Vanttaiusrr, Francia Davis fillet, lanil Bednyasskyy Charker Barmun Cheiatias hebestuen, Toees Fruncis Dicknwe, Fyodee Vasilyer. Clastiv Duell, Quitere Boulungee, Nikolucu Grein, Guorgs kulo, Fruscisce Burun, John Lewau Eaimal, Purie Brokietoull, Sebust.es Bourdon, Jaob Cchtervlll Clu intu Koban, Orageira
Vicolan
Stolla. Edwinis
Smno, Bandrick Tetbrigghen, Corolli Yeo, Ctarles
Edceard
bastry Levstzay.
Teleeacs Sigurrtsi,
Hiprensty. Pyoder
Bttel Carrick, Vincenzo Trolii. Teas Vaaiiniro. Horson Ranrich, Magne Enchell Pavel Miaalie,
Talaago, Vilbele faclbeot, Prints larris. Joseph hopi meplaeeee Sarins Kaurin, Philip laralo
Costo, Paol
Findl Worie-0illlannn Smntlss, Intinin Roolests, Ciristion Rithain Sabri nabres, nertalan Swinly. Barisn fineltere, lntm
Villisee, Miriee farabar, fieeed Concatan Albrr labe, Jehamnes Neevelov, Niozla fususs drizzidh Bickel, Jas 2utberland, labltts John full, Peico Ruloday, Aluny zubor, Eliaes Vascaaii Pieter Vuniig, Huz; la Pawouminr,, Pusl lekurnnn Arama Burzon. ipslit Sinubu, Soorgs Soening Suoa, Villelas Puvilia, Voole Yaroabako, Pure Briayit, Guier Ahll None, Eyelur dolsiows, Padeo iedrico, Kisryy Labeder, Toan Miler, Abbert Senote, Alazaner ketigns, George Desatreace Fires, Stulis Lazs, irrett Tiracall, Kasataatte tarilyer, Donestco Pisslls, Darid incebadiee Cieasiia Var Soords, Pazos teriecazin, Alesed Kerraliin Sturice Poirzon, Joaguin Agrarot, 70y Edeard loresthal, Bettrich Papin, Vastie Popeseu, Jeter-larti langlats, fazl Edrazd Dartks, Ads Van ber tesies, Vasveled taksysorych, Leo Leapsi, Matej Starann Filipgo Sitarieile, apoliinazy Geearaky,
Attars. Trangillla Dreants, intento Deught
Paoguat cnl cant, Starage Barterse Proncssos Midioss Brose inghatura, lysanta Estrinntie,, devorg inttiniaagaann Sariy Srhgeskko, Bok Sorzl gon, Araadds Rontwwer
Wildness Aleender Claret, Rocarin later Zoreilla, Payy Bryhorecyeh Kryakwnccy, Permsed Corbee, Prancasco Ribalss, Jaa Al Alecadrr Stariadt, Joham fagtier Clarst, Comnalte Pichatlance, Brsata Spm
35

---

Published in Transactions on Machine Learning Research (12/2025)
Average Imitation Score of the Generated Images
0.7
Iniladion
Initation Thresholo: 363 races
0.7
20.6
Vean dime lufty Extoa Ouinge Pt
0.6
20.5
Pean Sim lurky Afar Change
0.5
0.4
0.0
0.0
Polticanss with ncressing Image Counts In the Training Dota
Figure 27: Human Face Imitation (Politicians): similarity between the training and generated images for all politicians. We show the mean and variance over the five generation prompts. The images were generated using SD2.1. The change point for human face imitation for celebrities when generating images using SD2.1 is detected at 369 faces.
Average Initation Score of the Generated images
0,7
Sin fetor Change Fo Vean buiy the Change loit
Initation Thresho 312 Images
0.6
0.5
0.1
0.0
0.0
Art images and their Counts the Training Data
Figure 28: Art Style Imitation (Classical Artists): similarity between the training and generated images for classical art styles. We show the mean and variance over the five generation prompts. The images were generated using LDM. The change point for art style imitation when generating images using LDM is detected at 312 images.
N.4 Modern Artists
We also collected modern artists from the https://wwwwwwkkee wikiart..r.... For modern artists, we collected the artist names from the art styles: Expressionism, Surrealism, Abstract Expressionism, Pop Art, Art Informel, Post- Pout-Painterly Abstruction, Eeo-Eapressioiim, Post-Minimalism, Nes-Impressionimm Neo- Romanlicism, Post- post-Impressioism. The distribution of the caption counts of the sampled artists is given in Table 12, The sampled artists in the descending order of their number of caption counts arc:
Vincent Taa Gegh, barid Souce, Andy Varzoi, Pable Picazes, Frids Rablo, Neith Baring, Salvador Dall, Fasl Gangain, Cheslle PLezarzo, Panl Cozazoe, Barrs lattase, Paul Eise, Frazcis farco, Baaard suuch, knedes Hodigiiani, Egas Schseie, Jeaz-iticha. Bascuist, Darid Lynch, Masally Kandiasier, Peter Bac. Jay Licacesatein, Pasi Boed, Franz Woro, favod baich, York fathio, Georgee get smurst, Lerny Reloon, Joan Riro, Jecken bollock, tngett Packe, Man Ray, Piat Kendrian cy Tusnlly. Swort be Teal ouse-Latreer Gratan fell. Panl Sigrae, toberr Indinss, Taysi Rures Bans ingritte, Jxeper lahne unlter Crase, Robart Horrie, fally Carr, Inctor Fraed, traes lankig Kinchner, Tea Thonsen, anteh Kapoor, slar Ratx, Plarre Boraand, John Dage, iee Dise, Bllmgth fally, Pater Blate, Willine Seats, Sete Danee, Marcal turhang, Frank Stalls, Robert Nathevell, Sus Woue, Louine Hevelasn, Poter Paillipe, Nillom De Soning Cossuill,, Apps Thisbaol, Joa. Kitchell, Jum Cacisus. havel, Duly, Intuay Gurllyy Exutl, fosesquist, Blound Veillard. Mithard Basilsor, G. Escher, Frencis, Stally, George Segal,
Alberto Gioconesti, Venesos Bull, Richard Disbeskorn,
Kiefor, Blvard
Schnabel,
Georges
ratninger, Edased Bracha, Sorsen Lazie, lareats anstasi, Dacid Park, Hartn Lacrenctn, Befino Thesye, Chris nests, land Jean-Pael Rispalln, Watter Stceart, Hark Tobay, Mebhal Sowa, Jom buxid, Bun Cillian, Payllida Barlew, Howard Fimbtar Aegustas John. Elaiw De Bouing, Brorford Delasey, basid Hummas, Brich Bockel, Aecito Bur-G1), Aethur Liswer, Nita Hasous, Biel klaan Brion Orein, Jotn Gusaberlain, Corisa Sent, Allon Jame. lnger Jomn Partix Sigpebergee, George Tooker, bossond Norzin, Volr tatn, any befes, Tru Sters, Helasee Ting, Balle Beraard, Kathe Tol lolle Prant Bouling, John Hearofiinn. Niguste Torbir, Prances Reighte Peres Dpperheee indre Masson. Jarl Sataiat-fhottdd
Sddervear-este Becksr,
Jeskim, Pry, Sensitor
wazin tastra, Pant Semuzter, Jaesh Rpreatn, Michard
Jaea terts, and Greens, id tatntardt, Di theee, Ortar Entoerhes.
taas Bolless, Barino Harini, forris louia, Pystz knsehaiersky, Rishard Artachouger, Louia Cane, Betty Pacsous, has restatein, Richard Duset Groeges Lemss, Baso daset, Louis Valtel, fas Villiams, Grave Grosingon Saith, John Boyland, Dennks Oppanasis, Lands Beaglio, Jans las Syacs, Burio Sroporter, isis tiee, Weeter tramer, Edrise Cherte, Billinn syree, Deeip tadkene, Alice fistlly. False termalex- Torres, Joharnse Ittar, tharine Long, intn Barts, Wistfood Stchslern, alfred Rebin, Charlas angrand, Zinsids Serebrtakers, Jean Dunces Fergueazn, Rormn Biuns,
Harald Schlbergg Zixialar Bikstnnks, farkiny fendricks, Brume Schels, Toyen, Fierre Alschinskr, Hippelyte Patitjosn, Henlas Stadl, fisner Petting, lire Yanggsts, Loroet Pesselain, Tire Tessesoo Stanley thitney. Shirags, Alberto Brack, Asne Truist, Jossef kippl-hinas, Rinald Grmn Billy tiple,
tgar, Berny intrese, Kikling Bomnoor Berry Van Velde,
Tongsharu Puojisa,
Thing
Ocapp, butchelez, Stockaoldas, Sabeivle Hoo Curlan bailfel,
Rodeeis O'Causs,
Mishard
Vilson Jon Paol Iotalyn Draciar, Tlys Hazhtor, latk Youngrras, Breat Vilbain Say, idfa Yankers, Letn Spilidaert, talarto Mari, Kari Denjaein, lnigl Serafist, Lasa Polz Satth, Osssldo Sasyaratts, Blnnyy Palerso, Ferditand Priguudess, Ertaban Heents, Hasactant, tacar Draingses, farus Reatyeass, Sergei Paraisaor, Joy Bester, Forrest Bazn, Tare Tesesto Paurico Talard, Visanis Poralin, [gar drabar, aler Boy, Albers Trvit, laadeo to Sumn-Cardito Sebert Buain, Bralley Walker Twelis, Kithin Rign. Carlos Alaaran, Wersl Miseest Brase, Dan Christansen, Opril Poner, Farial tarhaan Jerany Nom, lorgs Cutillo, Joas Dspet, Bagiin Lacheer, John dlterr, Albers Iibete- Pitle, 991 tan fastotar, Jonaph Varient, Michaal larftke, Ianil that, Tayy Fater, Balter fatesss priedal Dethar, heits, sitred teaasterr Ben Soreter, Tony Schwrsar, Alfns Seapocesiooe Sikoloo lytro, Sall Bolsee annt Brinnugi baller Oalorus, Bus Surowil, June Suerasee, besa Undarvood lowen Sup, Albees Bluck, Hard Jackses Pieco Decazio, Gioegic Grilia, loidde Guotro, lite Aluupuge, Taves Dovning, Fiezro Tui-Cot, Bario Pemsium, Passictis Detois, fibers Boodough, Foel Foeley Michl rajerea, fart tun, Intataatine falssr, Viadinir Sinttror, Matjer be fann, Gutdo Nelisari, Aettur Btecher Carias, Bertalan Por, thriste Contzes, Jannta lolnss, Lasar Bepali, forico Deasti, Jarzy Sowssislsks, Giantranco Barschelle, luis Pesto. butbas Dogancay, losit iser, Shariss Giteens, Thslis Karaii,,,,,,, Alde Rendine,
Paels
Piurse Desca, Joset Bim, Nizois Sane, soared Slaphack, Thookzustes friuniahiilddda, Edvadd Vais, cerast Prenungse, Betthins Laurmn Gealf, Victor Berreancks, Lateen inagnine
tala menay, tsggo Seglane-daalle "gncy Deratrr,
rack, Jeqqaltta mex, Gonetterr, Bigusta Babjas Jescse, Taage: besteeile Balsoeocs, Rasalis
Trancss, Alerto fight, flgs
topar, Richal Sabas, bodolfo Bielan lazy roanors, Eveissoso Kjarvel,
Vosile
Abrolan, surel Osjar, Tie Polsa, klvare Lags
36

---

Published in Transactions on Machine Learning Research (12/2025)
Average Imitation Score of the Generated images
0.8
0.7
Iniladion
Vean dim lufty Eutre Oainge Fo
Mean 5e luly Afar Cuagge
Initation Threshold: 304 images
0.7
0.6
0.5
0.5
0.4
0.4
3033
0.3
0.2
0.2
0.1
0.1
0.0
0.0
Closical art styles and ther Counts in the Tranning Data
Figure 29: Style Imitation (Classical Artists): similarity between the training and generated images for classical art styles. We show the mean and variance over the five generation prompts. The images were generated using SD1.1. The change point for art style imitation when generating images using SDI.1 detected at 112 images.
Average initation Score of the Generated images
0.8
2066
3.55
0.4
0.7
Mean Before
Peen lurty Afa Change Rost
betani Regressoon
Imitation Threshold: images
0.7
0.4
0.5
0.6
20.3
0.3
30.2
0.2
20.1
0.1
0.0
0.0
Art images and their Counts the Training Data
Figure 30: Art Style Imitation (Classical Artists): similarity between the training and generated images for classical art. styles. We show the mean and variance over the five generation prompts. The images were generated using SD1.5. The change point for art style imitation when generating images using SD1.5 is detected at 112 images.
O Compute Used
Estimated Computational Cost of the Optimal Experiment The computational cost to train the popular text-to-inee -oa-toi-iageeeeo model Stable Diffusion was $600K (Bastian, 2022). For the optimal experiment, we would need to train O(log models, where m is the total number of available images of a concept. 2¹. So if a concept has 100,000 images, then we need to train logg(100, 000) = 16 models to optimally estimate the imitation threshold, which would cost about $10M.
MIMETIC's Computational Cost We use 8 L40 GPUs to generate images for the all text-to-image models in our work. Overall, we use them for 16 hours per prompt, per datasct, per model to generate images. We downloaded the images on the same machine using 40 CPU cores, a process that took about 8 hours per dataset. For generating the image embeddings, we use the same 8 L40 GPUs, a process that took about 16 hours per dataset. The computation of imitation score and plotting are done on single CPU core on the same machine, a process that takes less than 30 minutes per dataset.
37

---

Published in Transactions on Machine Learning Research (12/2025)
Averae Imitation Score of the Generated images
0.8
0.7
Vean mim lufty Edtre Ouigg Po
Inlladio
Ration Thresheld: 185 images
Abar Ouage
0.4
20 5.0
0.2
0.0
Art images and their Counts the Training Data
Figure 31: Style Imitation (Classical Artists): similarity between the training and generated images classical styles. We show the mean variance over the five generation prompts. The images were generated using SD2.1. The change point art style imitation when generating images using SD2.1 detected at 185 images.
Average Iniitation Score of the Generated Images
0.8
Inftatio Scare
Initation Thresheic: 202 images
0.8
0.7
Vean Fim larty bxfore Osinge Fo
0.7
10.6
Mean Sim lurty Aber Change
0.6
80.5
0.5
50.4
0.4
0.3
0.3
0.2
02
0.1
Art Images and their Counts the Training Data
Figure 32: Style Imitation (Modern Artists): similarity between the training and generated images modern art
styles. show the mean and variance over five generation prompts. images were generated using LDM. The change point art style imitation when generating images using SDO detected at 282 images.
Average Irit Gererated Images
0.8
Inflatin
0.8
0,7
Voun Sime laty Eutrre Ourge Post
Inilation Thesheeld: 198 images
0.7
30.6
Peen Aler Duago
0.6
005
0.5
30.4
0.4
0.3
0.2
0.1
0.1
Art Images and their Counts nts the Training Data
Figure Art. Style Imitation (Modern Artists): similarity between the training and generated images modern styles. We show the mean variance over the five generation prompts. The images were generated using SD1.1. The change point art style imitation when generating images using SD1.1 detected at 198 images.
Average Imiisation Score of the Generated Images
0.7
0.8
Meun Sime lutty Eutrre Ourge Po
Inltadiin Kniw
Initation Thresheld: 198 images
0.8
0.7
20.6
Mean Smiiurty Abar Duagie
0.6
00.5
0.5
30.4
0.4
0.1
0.0
0.0
Art images and Trwining
Figure Art. Style Imitation (Modern Artists): similarity between the training generated images modern styles. We show the mean variance over the five generation prompts. The images were generated using SD1.5. The change point art style imitation when generating images using SD1.5 detected 198 images.
38

---

Published in Transactions on Machine Learning Research (12/2025)
Instatiin Score of the Genersted images
0.8
Indalln
Thresheld: images
0.7
0.6
Pren Bimitaty And Dhagoo
Belonic Regresion
40 0..4
0.1
0.0
0.0
Figure 35: Art Style Imitation (Modern Artists): similarity between the training and generated images for modern art styles. We show the mean and variance over the five generation prompts. 'The images were generated using SD2.1. 'he change point for art style imitation when generating images using SD2.1 is detected at 241 images.
Figure 36: Outlier Category 1: DJ Kool Here. Clive Campbell is aliased as DJ Kool Here, which leads to lower counts of his images in the dataset since MIMETIC² only collects images whose caption mentions DJ Kool Here.
ARDS
YY
Figure 37: Outlier Category 1: Summer Walker. Summer Marjani Walker is aliased Summer Walker, which leads to lower counts of her images in the dataset since MIMETIC² only collects images whose caption mentions Summer Walker.
39

---

Published in Transactions on Machine Learning Research (12/2025)
Figure 38: Outlier Category 1: Albert Trwin. Albert Henry Thomas Troin is aliased as Albert Trwin, which leads to lower counts of his art images in the datasel since MIMETIC only collects images whose caption mentions Albert Irwin.
Figure 39: Outlier Category 1: Gustav Adolf Mossa. Gustav Adolf Mossa is aliased just Mossa, which leads to lower counts of his art images in the datasct since MIMETIC* only collects images whose caption mentions Gustav Adolf Mossa.
False-Match Rate For Different Face Recognition Models (Lower is better)
Colbe Match Rata
Demographic
0.5
Rekogsition
Insightann
ChostFare ArcPain
Fackmett
Facenet5
Face Recognition Models
Figure 40: False-match rate (FMR) of all the face embedding models across the six demographic groups. Amazon Rekognition and Insight Face have the lowest FMR values. Moreover, these two models have lowest disparity of FMR over the demographic groups.
40

---

Published in Transactions on Machine Learning Research (12/2025)
True-Match Rate For Different Face Recognition Models (Higher is better)
Trte- Match Rata
Demographio Groups
Male Whlte
Pemala Brown
Fesale Whdee
Male Black
68-
Mulo Browa
Fanala Buck
0-
Amazon Bekogaition
Insightlacu
GhostPacsNet W1
GeustFaceNNet VI
ArcPate
Facenet
Facunet5 12
DeepPace
Face Recognition Models
Figure 41: Truc-match rate (TMR) of the face umbbddiig models across the demographic groups. Amazon Rekognition model has the highest TMR values.
Table 12: Distribution of caption counts for sampled entities in celebrities, politicians, and art styles domains.
Caption Counts (LAION-2B)
Celebritics
Politicians
Classical Artists
Modern Artists
19
15
14
15
1-100
48
60
67
69
100-500
57
120
133
139
500-1K
52
80
62
62
1K-5K
151
63
64
5K-10K
19
32
10K
53
40
34
41


Reviews:
[{"review_id": "7bKvCvDIaY", "reviewer": "Reviewer_CMUh", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper studies how many training images are required for a text-to-image generative model to sufficiently imitate a given concept from its training data. This is an important question for understanding model behavior in the context of copyright and privacy, because it aims to quantify how much exposure is “enough” for a model to reproduce a concept.\n\n## Strengthes\n1. **Novel and well-motivated task.** The problem setup is, to my knowledge, new. It is directly relevant to auditing and regulating generative models, especially around privacy and copyright exposure. Studying how imitation emerges as a function of training frequency is both practically and societally meaningful.\n\n2. **Methodological originality.** A naïve approach would require a costly greedy search over different training set sizes to locate the exact imitation threshold. Instead, the paper leverages the above assumptions to avoid brute-force search. The core idea is to sort concepts by frequency and identify a significant change point in imitation scores, interpreting that change point as an estimate of the required sample count. While the approach relies on several strong assumptions, the overall formulation is insightful and feels original.\n\n3. **Thorough empirical analysis.** The paper provides extensive experiments and diagnostic analyses across multiple concepts, models, and datasets. This helps the reader assess robustness and generality. The outlier analysis is especially valuable because it surfaces where and why the method fails. The authors also attempt to validate each of their assumptions empirically, rather than leaving them unexamined.\n\n## Weakness\n\n**Weaknesses / Questions**\n\nI do not see a single critical flaw that would invalidate the overall contribution. That said, several parts of the pipeline are doing important work (the assumptions, the discriminator, the definition of the “change point,” etc.), and some details are underspecified. Clarifying these would strengthen the paper:\n\n1. **Experimental details of key components are missing.**  \n   - **Discriminator:** What is its performance (e.g., precision/recall, calibration)? Since the discriminator appears central to measuring “imitation,” its reliability matters.  \n   - **Change point detection:** How exactly is the significant change point defined and selected? Is it statistically motivated, heuristic, or tuned?\n\n2. **Validation of assumptions could be deeper.**  \n   The paper does provide some supporting evidence for the three assumptions, but in several cases the argument feels high-level.  \n   - **Distributional invariance:** Instead of only reporting an average difference, it would help to show the full distribution of imitation scores (or score deltas) across concepts. This would let us judge variance and tail behavior.  \n   - **No confounders:** The text states, “we assume there are no confounders between imitation score and the image count of a concept, i.e., the imitation score … is not affected by the presence of other concepts in the training data.” This equivalence is not entirely clear. The “image count of a concept” and “presence of other concepts” are not obviously the same variable. Please clarify the causal argument here. For example: how does the fine-tuning experiment isolate the effect of image count alone?  \n   - **Equal contribution per image:** Similarly, showing distributions (not just averages) of per-image contribution would make this claim more convincing.\n\n3. **Ambiguity in Table 7.**  \n   Table 7 is hard to interpret in its current form. It is unclear what the reported numbers represent (e.g., thresholds? error? counts? correlation measures?). A clearer caption and/or column descriptions would help.\n\n4. **Imitation threshold depends on generative models and datasets**. From table 3, we can see the results vary with different generative models and datasets. Therefore, it's still hard to use it as a universal standard for all image generators.", "claims_and_evidence_yn": "Yes", "claims_explanation": "In general, I think the claims made in the submission are well-supported by empirical experiments. The authors conducted experiments to validate their assumptions, analyze outliers, as well as experiments across different models, concepts, and artists.", "audience_yn": "Yes", "audience_explanation": "I believe this propose method and the findings can benefit the community and even broader audience. The analysis help understanding the behaviors of generative models, and establishing regulerization for privacy and copyright protection.", "requested_changes": "- **Provide quantitative details for core components (CRITICAL).**  \n  - Report the discriminator’s performance (e.g., precision/recall, calibration, typical failure modes), since this model underlies how “imitation” is measured.  \n  - Clearly define how the “significant change point” in imitation score is detected (formal criterion, threshold, or statistical test).  \n  - These details are necessary to assess reproducibility and to judge whether the estimated sample-count threshold is trustworthy.\n\n- **Clarify the causal claim behind the “no confounders” assumption (CRITICAL).**  \n  - The paper assumes that a concept’s imitation score depends only on that concept’s own image count and is not affected by the presence of other concepts.  \n  - Please clarify:  \n    1. How the fine-tuning experiments isolate the effect of image count alone.  \n    2. In what sense “image count of a concept” and “presence of other concepts” are being treated as equivalent factors, as stated in the last second paragraph in Section 3.  \n  - This is critical because this assumption is directly used to argue that the estimated threshold is meaningful.\n\n- **Improve presentation of assumption validation (IMPORTANT / borderline critical).**  \n  - For *distributional invariance*: instead of only reporting an average difference, show the full distribution of imitation scores (or score deltas) across concepts, so we can see variance and tails.  \n  - For *equal per-image contribution*: similarly, show distributions (not just means) of per-image contribution.  \n  - These additions would significantly strengthen confidence in the assumptions, and therefore in the method.\n\n- **Clarify Table 7 (IMPORTANT).**  \n  - Table 7 is currently difficult to interpret. Please explain in the caption (or main text) what each number represents and how to read the table.  \n  - While not strictly critical for acceptance on its own, this clarification is needed to fully understand part of the empirical results.", "broader_impact_concerns": "Since this work is to analyze the generative model behaviors, not generating content, I did not see big concerns.", "additional_comments": "This reviewer is not an expert in image generation.", "extra_scores": {}, "extra_text": {}}, {"review_id": "I1sqFrii4Y", "reviewer": "Reviewer_GVNC", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper investigates the \"number of images of a concept that a text-to-image model requires for imitating it.\" They also propose the idea of predicting 'imitation thresholds' that, if accurate, could be potential empirical basis for copyright violation claims.\n\nStrengths:\n1. The idea of using imitation thresholds is interesting and has not yet been explored. It could prove useful for attribution and detecting the level of infringement.\n2. They also validate their automatic imitation‐score metric via human subject studies (both for faces and art styles) to ensure correlation between their quantitative measure and human judgments.\n\nWeaknesses:\n1. Although the authors cover three versions of one line of text-to-image model (Stable Diffusion variants), they do not test across a broad array of models/architectures.\n2. Although two domains (faces + art styles) are covered, the authors explicitly note that their results do not claim generalization to all domains/models/data. Hence, the imitation threshold is model- and domain-specific.\n3. No explanation has been provided on how this methodology could be extended to other text-to-image models. It would be useful to discuss how this work could lead to a benchmark and a tool that would make it easier for evaluation.\n4. How computationally demanding is this methodology? Please provide concrete compute estimates to clarify whether determining the imitation threshold is feasible within a reasonable timeframe for a given model. Is this analysis intended to be performed on a case-by-case basis, or could it be scaled to a broad, open-ended exploration across a large sample set—potentially requiring unbounded compute resources?", "claims_and_evidence_yn": "Yes", "claims_explanation": "The authors apply their proposed method (MIMETIC²) to three different text-to-image models (specifically variants of Stable Diffusion: SD 1.1, SD 1.5, and SD 2.1) trained on two different pretraining datasets (LAION2B-en and LAION-5B).", "audience_yn": "Yes", "audience_explanation": "This work represents the first systematic attempt to quantitatively estimate the imitation threshold, yielding insights with potential implications for researchers in the field of Generative AI, large corporations building foundation models, AI policy makers, and ethics committees worldwide.", "requested_changes": "Please check the weaknesses section above.", "broader_impact_concerns": "Given the well-documented issues of illegal, harmful, and biased content within the LAION datasets, the authors should address these limitations in the broader impact statement and outline how their approach could be applied to alternative models or datasets, instead of focusing exclusively on LAION.\n\nAdditionally, there could also be serious repercussions if the imitation score proves to be inaccurate.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "vt1JXyr6ud", "reviewer": "Reviewer_Jfgf", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces the concept of an \"imitation threshold\" in text-to-image models. This threshold is defined as the number of training images of a particular concept (e.g., a person's face, an artist's style) required for a model to be able to imitate that concept in its generated images. The authors conduct experiments on two domains, human faces and art styles, using several text-to-image models and pre-training datasets. Their findings indicate that the imitation threshold is in the range of 200-700 images, depending on the specific domain and model. The authors argue that this imitation threshold can serve as an empirical basis for copyright and privacy violation claims and as a guideline for developers of text-to-image models.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The authors have successfully moved from plausible claims in the abstract to a well-supported argument in the main text by providing robust methodology, validation through human studies, and thoughtful analysis.", "audience_yn": "Yes", "audience_explanation": "The paper sits at the intersection of core machine learning research and urgent, real-world ethical and legal challenges, making it highly relevant for TMLR's topic.", "requested_changes": "- Elaborate on the Generalizability of the Threshold.\nThe paper focuses on two important but specific domains: faces and art styles. In the Discussion/Limitations section, the authors could briefly elaborate on how they hypothesize the imitation threshold might change for other types of concepts. For instance, would the threshold for concrete objects (e.g., \"a specific type of chair\") be lower or higher than for abstract styles? What about complex scenes? A short, speculative discussion on this would enrich the paper's conclusion and highlight more avenues for future work.\n\n- More Detailed Intuition about Proposing \"Imitation\".\nThe authors do a great job of operationalizing \"imitation\" using domain-specific embedders and validating it with human studies. To further strengthen the paper, I suggest adding a paragraph to the discussion that reflects on the inherent subjectivity of this concept. For example, the authors could discuss that while their method provides a robust and reproducible proxy, the legal and social definitions of imitation may have further nuances that are difficult to capture computationally. This would add a layer of valuable self-reflection to the work.\n\n- Expand on Unexplained Outliers as Future Work.\nThe outlier analysis in Section 7 is a major strength. The authors successfully explain many outliers (e.g., aliases, multiple people per image). They also honestly state that they couldn't explain all of them. It would be beneficial to explicitly frame the investigation of these remaining outliers as a promising direction for future research in the Discussion section. What other factors (e.g., image quality, caption style, visual diversity within a concept) might explain why a concept with many training images still has a low imitation score?", "broader_impact_concerns": "The paper may inadvertently provide a \"recipe\" for imitation. By establishing a target threshold (200-700 images), the research gives malicious actors a clear, quantitative goal for harmful activities. Conversely, the findings could be misinterpreted by developers as a \"safe harbor\", leading to a reduction in diligence.\n\nThe authors should add a dedicated \"Broader Impact\" or \"Ethical Considerations\" section to their paper to address the concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)