Research map / Image generation / Autoregressive and latent generation

OmniMark: Efficient and Scalable Latent Diffusion Model Fingerprinting

AAAI 2025 · Image generation › Autoregressive and latent generation · approach: Reconstruction-based diffusion image detection · 5 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Fine-tunes the VAE decoder of Stable Diffusion with OmniMark layers so each user-specific 48-bit fingerprint is generated by encoding networks into the weights, enabling fingerprinted model creation in under 100 ms without retraining.

Problem

Model fingerprinting for latent diffusion models: distributing many differently fingerprinted copies of an LDM for user accountability and attribution, without retraining each copy and while keeping image quality and robustness to image and white-box model attacks.

Approach

Expands each standard VAE-decoder convolution into multiple parallel kernels whose weights are generated from the fingerprint along kernel, filter, channel, and spatial dimensions via small fully connected encoding networks; the merged kernel is a standard convolution at inference, and a sharpness-aware embedding strategy improves robustness to fine-tuning.

Key results

• Bit accuracy of about 99.7% on COCO (99.757) and 99.8% on MagicBrush for 48-bit fingerprints, outperforming SS (99.247 average).
• Image fidelity close to baseline: FID increase under 1 point and PSNR around 31 on COCO T2I.
• Fingerprinted model generation takes under 100 ms via a single forward pass, with no fine-tuning per user.

Measured effects reported in the paper

Surprising findings

• Encoding fingerprints only into kernel or spatial dimensions gives poor image quality and bit accuracy, so at least two dimensions are needed.

Limitations

• Fine-tuning attacks can still reduce bit accuracy (around 78% after 10k iterations) and lower TPR at the default threshold.
• Pruning, noise addition, and quantization attacks are handled less robustly than by SS, although they also significantly degrade image quality.
• Performance degrades with large N (N=16 fails to converge).

Experimental setup

Datasets: MS-COCO-2017

Benchmarks: MS-COCO-2017 val ImageNet MagicBrush

Metrics: PSNR SSIM LPIPS FID CLIP score Bit Acc TPR F1

Baselines: SW (Fei et al. 2022) PN (Fei et al. 2023) MC (Yu et al. 2021b) SS (Fernandez et al. 2023)

Builds on: HiDDeN (noise layer watermarking) Sharpness-Aware Minimization Stable Signature Stable Diffusion

Closest papers by meaning

• Fingerprinting Denoising Diffusion Probabilistic Models (CVPR 2025 · similarity 0.88)
• WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models (CVPR 2024 · similarity 0.86)
• Scalable Fingerprinting of Large Language Models (NeurIPS 2025 · similarity 0.85)
• SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.85)
• Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.84)
• StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models (NeurIPS 2025 · similarity 0.84)