Research map / Image generation / Autoregressive and latent generation

CGI-DM: Digital Copyright Authentication for Diffusion Models via Contrasting Gradient Inversion

CVPR 2024 · Image generation › Autoregressive and latent generation · approach: Reconstruction-based diffusion image detection · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes CGI-DM, a post-fine-tuning copyright authentication method that masks half of an image, recovers it by maximizing the KL divergence (via noise-prediction loss differences, Monte Carlo sampling and PGD) between pre-trained and fine-tuned diffusion models, and flags training membership by recovery similarity.

Problem

Determining whether a diffusion model was few-shot fine-tuned on a given image (unauthorized use of artworks or photos) is hard because generative outputs are diverse and rarely closely match training samples; existing post-hoc checks give only binary, non-visual evidence.

Approach

Remove part of an image and recover the missing content by gradient-based inversion that maximizes the difference in noise-prediction error between the pre-trained and fine-tuned models (a closed-form surrogate of the KL divergence between their latent trajectories); high similarity between recovered and original images indicates membership.

Key results

• On WikiArt under Dreambooth (w. prior loss), CGI-DM reaches 0.90 Acc (C) and 0.96 AUC (C) for style-driven authentication, versus at best 0.82 Acc and 0.89 AUC for the img2img baseline.
• On the Dreambooth object dataset, CGI-DM achieves 0.84 Acc (C) and 0.90 AUC (C) under Dreambooth (w. prior loss), outperforming the best baseline (0.67 Acc, 0.73 AUC).
• Accuracy stays above 0.88 across SD v1.4, v1.5, v2.0 and AltDiffusion, and remains around 0.90 across 5 to 50 training images.

Measured effects reported in the paper

Surprising findings

• Directly applying gradient inversion yields little useful signal for diffusion models, which is why the contrast between pre-trained and fine-tuned models is needed.
• Masking with large contiguous regions produced recovered content unrelated to the target, so fine-grained block-wise masking was needed.

Limitations

• Accuracy drops under RandAugment defense (about 10% Acc reduction) and the method relies on the attacker's fine-tuned model being available for comparison.
• Evaluation is limited to few-shot fine-tuning on small sets (5 to 50 images) of WikiArt and Dreambooth; the paper notes its approach needs a proper threshold for the similarity metric.

Experimental setup

Datasets: WikiArt Dreambooth

Benchmarks: WikiArt Dreambooth

Metrics: Accuracy AUC CLIP similarity DINO similarity

Baselines: Text-to-image generation pipeline Image-to-image generation pipeline DDNM inpainting pipeline

Builds on: DDIM Anti-DreamBooth Dreambooth PGD adversarial attack Model inversion attacks

Closest papers by meaning

• Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models (CVPR 2025 · similarity 0.89)
• Disguised Copyright Infringement of Latent Diffusion Models (ICML 2024 · similarity 0.88)
• The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright BreachesWithout Adjusting Finetuning Pipeline (ICML 2024 · similarity 0.87)
• Leveraging Model Guidance to Extract Training Data from Personalized Diffusion Models (ICML 2025 · similarity 0.87)
• Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models (CVPR 2024 · similarity 0.87)
• CDI: Copyrighted Data Identification in Diffusion Models (CVPR 2025 · similarity 0.87)