Research map / Image generation / Autoregressive and latent generation
How to Trace Latent Generative Model Generated Images without Artificial Watermark?
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes LatentTracer, an alteration-free origin attribution method that checks whether an image can be well reconstructed by inverting the latent of a latent generative model's decoder, using encoder-based initialization for gradient inversion.
Problem
Tracing whether an image was generated by a specific latent generative model (e.g., Stable Diffusion) without requiring watermarking or fingerprinting during training or generation.
Approach
Initialize gradient-based latent inversion with the encoder's latent projection of the examined image instead of random noise, so that reconstruction loss through the inspected decoder separates belonging from non-belonging images, with a threshold set by Grubbs' test on the model's own generated images.
Key results
- Encoder-based initialization achieves average 93.4% accuracy distinguishing belonging images from other latent generative models' images, versus about 50% for RONAN.
- Accuracy on distinguishing generated images from real LAION images averages 97.9% across SD v1-4, v1-5, v2-base and Kandinsky.
- Encoder-based initialization reduces runtime to about 21-30 s per image versus 88-121 s with random initialization, converging in 100 steps versus 400.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use encoder-based initialization instead of random initialization for gradient-based latent inversion (ablation) | LatentTracer · Stable Diffusion v1-5 and Stable Diffusion v2-base | initial distance to ground-truth latent: 1.930$\pm$0.021 -> 0.019$\pm$0.007; 1.844$\pm$0.017 -> 0.014$\pm$0.004 | Helped |
| Use encoder-based initialization instead of random initialization (ablation) | Latent inversion for origin attribution · SD v1-4, SD v1-5, SD v2-base, Kandinsky | runtime: 87.6s -> 21.5s; 88.1s -> 21.8s; 93.5s -> 23.2s; 120.7s -> 30.3s | Helped |
| Replace fixed maximum-step stopping with adaptive stopping (ablation) | LatentTracer (SD v2-base vs SD v1-5) · SD v2-base vs SD v1-5 | accuracy: 98.0% -> 97.7% | Hurt |
| Use encoder-based gradient inversion instead of RONAN | Origin attribution on latent generative models · Images from inspected models vs other generated images | accuracy: RONAN around 50%; LatentTracer average 93.4% | Helped |
| Use encoder-based initialization rather than random initialization (ablation) | Gradient-based latent inversion · Origin attribution on Stable Diffusion v1-5 | reconstruction-loss separability | Helped |
| Use encoder-only inversion rather than encoder initialization followed by gradient optimization (ablation) | LatentTracer · Origin attribution | effectiveness | Hurt |
| Use LatentTracer instead of the compared prior method | SD v2-base inspected model · SD v2-base vs SD v1-1, SD v1-1+, SD v1-4, SD v1-5 | accuracy: 92.7%, 90.6%, 92.1%, 92.2% -> 98.2%, 98.0%, 98.0%, 97.8% | Helped |
Surprising findings
- Generated images are effectively watermarked by the decoder: reconstruction losses can differ by an order of magnitude across models even when images look identical.
- The RONAN reverse-engineering baseline performs near chance (~50% accuracy) in this setting.
Limitations
- Assumes the inspected model has a unique autoencoder; models sharing the same autoencoder cannot be distinguished.
- Requires white-box access to the inspected model's decoder and gradients.
- Adaptive post-processing (strong saturation, contrast, blur) degrades accuracy, and high-brightness or complex images cause false positives or negatives.
Experimental setup
Datasets: LAION PromptHero prompts CIFAR-10 ImageNet MS-COCO
Benchmarks: PromptHero-based generated vs other-model images LAION real vs generated images VAE/VQ-VAE/ViT-VQGAN auto-encoder settings post-processing robustness
Metrics: accuracy TP/FP/FN/TN AUROC runtime SSIM FID
Baselines: RONAN Dct-Dwt SSL Watermark FNNS HiDDeN Stable Signature
Builds on: RONAN gradient-based input inversion Grubbs' hypothesis test
Closest papers by meaning
- CoSDA: Enhancing the Robustness of Inversion-based Generative Image Watermarking Framework (AAAI 2025 · similarity 0.87)
- Stabilize the Latent Space for Image Autoregressive Modeling: A Unified Perspective (NeurIPS 2024 · similarity 0.86)
- ProMark: Proactive Diffusion Watermarking for Causal Attribution (CVPR 2024 · similarity 0.85)
- Transfer Learning of Real Image Features with Soft Contrastive Loss for Fake Image Detection (AAAI 2025 · similarity 0.85)
- Watermarking Autoregressive Image Generation (NeurIPS 2025 · similarity 0.85)
- Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models (CVPR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.