Research map / Image generation / Text-to-image diffusion

CPR: Retrieval Augmented Generation for Copyright Protection

CVPR 2024 · Image generation › Text-to-image diffusion · approach: Fairness and bias in generative models · 14 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes CPR, a retrieval-augmented diffusion method that mixes public and private diffusion scores at inference to give near-access-free copyright protection in a single sampling pass.

Problem

RAG for image generation can copy parts of retrieved private images into outputs, leaking private information and violating copyright; existing NAF methods rely on slow rejection sampling.

Approach

Mix the score of a safe public diffusion model with a retrieval-conditioned score (via unCLIP-style CLIP embedding of retrieved images) during backward diffusion, with CPR-KL averaging scores and CPR-Choose alternating between models over time steps, yielding NAF guarantees in one run without rejection sampling.

Key results

• On TIFA, CPR-Min with unCLIP raises alignment from 81.4 (safe model) to 83.17 with one retrieval.
• CPR gives NAF guarantees with a single backward diffusion pass, whereas CP-k rejection sampling is reported as 5-10x slower for the same privacy level.
• Tuning the retrieval weight w1 controls the empirical NAF constant kc, which decreases as w1 is reduced.

Measured effects reported in the paper

Surprising findings

• Retrieval-score alone (without mixing with the safe model) lowers TIFA to 66.45, but the mixed version improves alignment, and CPR with protection gives even better TIFA than the unprotected retrieval mixture.

Limitations

• Exact probability values are not computable for diffusion models, so the mixture weights are treated as fixed hyperparameters and the NAF bound depends on them.
• Relies on regularity conditions stated in the supplement for the NAF guarantees.
• Out-of-distribution private samples may need separate adapters to achieve high fidelity.

Experimental setup

Datasets: MS-COCO (top 2k by aesthetic score as private store)

Benchmarks: TIFA

Metrics: TIFA score log probability ratio (Delta max) vs safe model CLIP similarity sampling cost

Baselines: Stable Diffusion 2.1 safe model Retrieval-Score Retrieval-Mix-Score CP-k (Vyas et al. 2023)

Builds on: Near Access Freeness (CP-Delta / CP-k) classifier-free guidance unCLIP Stable Diffusion 2.1 Langevin dynamics

Closest papers by meaning

• RAPID: Retrieval Augmented Training of Differentially Private Diffusion Models (ICLR 2025 · similarity 0.89)
• Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models (CVPR 2025 · similarity 0.86)
• Blameless Users in a Clean Room: Defining Copyright Protection for Generative Models (NeurIPS 2025 · similarity 0.86)
• Disguised Copyright Infringement of Latent Diffusion Models (ICML 2024 · similarity 0.85)
• The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright BreachesWithout Adjusting Finetuning Pipeline (ICML 2024 · similarity 0.85)
• Anti-Diffusion: Preventing Abuse of Modifications of Diffusion-Based Models (AAAI 2025 · similarity 0.85)