Research map / Image generation / Fast diffusion sampling
Fingerprinting Denoising Diffusion Probabilistic Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FingerInv, a non-invasive fingerprinting scheme for DDPMs that inverts QR-code verification images into a discriminative latent code along a "crossing route" through the performance border-zone, verified with black-box denoiser access.
Problem
IP protection for denoising diffusion probabilistic models (DDPMs) without altering parameters, retraining, or degrading generation quality; existing watermarking is invasive and fingerprinting methods target deterministic classifiers/restorers.
Approach
Optimizes the noise sequence of a DDPM inversion so noisy samples traverse the denoiser's performance border-zone (small prediction error to large prediction error, with a TV term on noisy samples), then back-derives the latent code via stochastic inversion as a trigger key for a QR-code verification image.
Key results
- FingerInv distinguishes all DDPM pairs in cross-verification (only diagonal scannable), whereas CycleDiffusion and DDPM inversion show false positives.
- Robustness success rate of 100% under pruning, fine-tuning, and quantization attacks versus 81.82% for CycleDiff and 77.27% for DDPMinv.
- Attacks such as 5% pruning noticeably degrade PSNR (some below 20 dB), showing attack intensities are significant.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FingerInv instead of CycleDiff for fingerprint verification | DDPM IP protection · Pruning, fine-tuning, and quantization attacks | success rate: 81.82% -> 100.00% | Helped |
| Use FingerInv instead of DDPM inversion for fingerprint verification | DDPM IP protection · Pruning, fine-tuning, and quantization attacks | success rate: 77.27% -> 100.00% | Helped |
| Use FingerInv rather than CycleDiff or DDPM inversion | DDPM fingerprint verification · PS-DDPMs and LDMs | output discriminability | Helped |
Surprising findings
- Two DDPMs trained on non-overlapping subsets can yield nearly identical score functions, so existing diffusion inversions produce interchangeable latent codes.
Limitations
- Validation requires manual input of latent components at each timestep, so it is not strictly black-box for the full sampling process and is hard to apply to API-only models.
- Robustness evaluation uses a limited set of attacks and models; comparisons against invasive watermarking are on a small set of cases.
Experimental setup
Datasets: LSUN CelebA-HQ LAION-Art
Benchmarks: LSUN church/cat/bedroom CelebA-HQ Stable Diffusion family and PixArt-alpha/DeciDiffusion models
Metrics: squared l2 distance in latent space QR code scan success rate PSNR SSIM LPIPS FID
Baselines: CycleDiffusion DDPM inversion WatermarkDM Stable Signature
Builds on: DDPM DDPM inversion CycleDiffusion critical point fingerprinting for image restoration
Closest papers by meaning
- OmniMark: Efficient and Scalable Latent Diffusion Model Fingerprinting (AAAI 2025 · similarity 0.88)
- Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models (CVPR 2025 · similarity 0.86)
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.86)
- Intersecting-Boundary-Sensitive Fingerprinting for Tampering Detection of DNN Models (ICML 2024 · similarity 0.85)
- WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models (CVPR 2024 · similarity 0.85)
- StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models (NeurIPS 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.