Paper: Copyright Plug-in Market for The Text-to-Image Copyright Protection (ICLR-2024)

Reviewer comment (Evaluation):
The evaluation is weak. The current results cannot be used to fully support the effectiveness of the proposed method. Actually, the evaluation of this kind of task is also very important.

Author response:
**Q1:** More evaluations are needed.

**A1:** We conduct *extraction* on MS-COCO 2017. We sample 5000 images by Stable Diffusion Model (SDM) 1.5 and non-infringing models after extracting R2D2 and Picasso, respectively. All results are displayed in Appendix C Table 3.

We directly use the model checkpoint in the paper and obtain the following number: the FID  20.55 and the KID ($\times 10^3$)  2.36 for extracting R2D2, and the FID 24.04 and the KID ($\times 10^3$) 2.83 for extracting Picasso. It indicates that the distribution of images generated by the base model and the model after extraction is very similar. The capability of the model after extraction keeps nearly uncharged (see Figure 8 in Appendix C).

Reviewer comment (Experiments):
With the concept of removed model weights, what about the impact on the FID on larger datasets such as Laion and COCO?

Author response:
**Q1:** More evaluations are needed.

**A1:** We conduct *extraction* on MS-COCO 2017. We sample 5000 images by Stable Diffusion Model (SDM) 1.5 and non-infringing models after extracting R2D2 and Picasso, respectively. All results are displayed in Appendix C Table 3.

We directly use the model checkpoint in the paper and obtain the following number: the FID  20.55 and the KID ($\times 10^3$)  2.36 for extracting R2D2, and the FID 24.04 and the KID ($\times 10^3$) 2.83 for extracting Picasso. It indicates that the distribution of images generated by the base model and the model after extraction is very similar. The capability of the model after extraction keeps nearly uncharged (see Figure 8 in Appendix C).

Reviewer comment (Theory):
How to forget those concepts that are not well defined by text words?

Author response:
**Q2:** How to forget those concepts that are not well defined by text words?

**A2:** Currently even the base models have difficulty to learn a concept that cannot be described by text words. For those concepts, it is also difficult for users to generate them in a controllable way. It is an interesting future direction to clearly define and identify cases for such infringements and then design techniques for protection, which deserves independent studies.

Reviewer comment (Writing):
The paper is poorly written and can be largely improved. As illustrated in the abstract, the framework aims to address the tension between the users, the content creators and the generative models. However, there are no figures, workflow or formulation that strictly define and describe how the proposed model interacts with these roles.

Author response:
We have carefully revised the paper according to the comments. Specifically, we add a new paragraph (marked in blue) and a new figure (Figure 1) to illustrate the roles of participants in the market. Within the Copyright Plug-in Market, the **base model owner** (like *Stability AI*) acts as a store of copyright plug-ins, **copyright holders** (like *artists*) can register their copyright works as plug-ins and get reward from the usage of copyright plug-ins, while **end users** pay for generating images of  copyrighted concepts with corresponding plug-ins. This framework gives good incentives to all participants: the copyright holders are well compensated for creating new works, the end users pay for using copyrighted plug-ins and avoid being accused of copyright infringement in their own creations, and the base model owner makes profits for the plug-in registration and usage, as illustrated in Figure 1.

Reviewer comment (Novelty):
Most components to construct the model are widely adopted. What are the real merits of the work?

Author response:
First and foremost, we are taking steps to tackle a challenging problem of copyright infringement in the generative AI era. We propose to  protect copyright through an accurate credit attribution system, which is instantiated as a copyright market.  We note that previous work (Vyas et al., 2023 or Troynikov, 2023) either involves retraining the base model (of very high cost) or does not have a feasible technical solution for efficient copyright protection. Our solution is promising, technically feasible and has not been studied before.

Second, as we stated in the paper, *addition* via LoRA is ready to use in public. However, currently there is no off-the-shelf solution for *extraction* of copyrighted work from a base model to a light-weight parameter. Our ''inverse LoRA'' approach is novel, effective and matching the need for building the copyright market. Our proposal of ''data-free layer-wise distillation'' is also new for combing multiple  LoRAs and perfectly matches the need of the market. These three operations can all be easily implemented with little fine-tuning effort or data requirement.

Reviewer comment (Theory):
The design of the three operations feels quite ad hoc, and there is no explanation as to why these three operations precisely address the problem. Whether these three operations form a complete set or can represent all possible operations remains unanswered. It seems that some potential points have been mentioned rather cursorily, and there hasn't been a comprehensive exploration of this issue.

Author response:
Our proposal of three basic operations *addition, extraction* and *combination*, encompassing the fundamental/natural functionalities required for an effective and flexible market. However, we cannot argue  completeness of the operations given the emerging requirements and scenarios in the future. Other techniques may be also needed to enhance market security and availability, e.g., watermark technology can be used to regulate user behavior. This is out of the scope of the paper, and should better be investigated separately.