Research map / Image generation / Autoregressive and latent generation
Disguised Copyright Infringement of Latent Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that copyrighted content can be concealed in visually different "disguise" images that match the copyrighted image in a pretrained LDM autoencoder's latent space, so LDMs trained on them reproduce the copyrighted material, and proposes feature-similarity search and encoder-decoder checks to detect such disguises.
Problem
Visual auditing of training data cannot detect copyright infringement when copyrighted material is included only indirectly, via visually different disguised samples that share latent information with the copyrighted image in latent diffusion models.
Approach
Adapts the feature matching data poisoning attack to the fixed LDM encoder: optimize a disguise starting from a visually different base image so its encoder latent matches that of the copyrighted image, combined with an input-space constraint; then detects disguises via latent feature search and autoencoder reconstruction.
Key results
- Disguises generated for a copyrighted symbol, Van Gogh's The Sunflowers content, and The Starry Night style are shown to reproduce the copyrighted concept when used for textual inversion.
- The encoder-decoder examination yields AUC 0.875 (symbol), 1 (content), 1 (style) on disguises vs. their base images; feature similarity search with copyrighted image gives perfect AUC and no false positives.
- In CelebA-HQ mixed-training with 100 disguises among 1100 images, 3 of 20 generated images contain the copyrighted symbol.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train textual inversion on disguised images instead of the original copyrighted images | KL-regularized LDM-8 textual inversion · Copyrighted symbols, content, and style | reproduction of copyrighted information | Helped |
| Fine-tune DreamBooth on disguised images | DreamBooth · DreamBooth subject-driven generation | reproduction of copyrighted information | Helped |
| Mix 100 duplicated disguises with 1000 clean CelebA-HQ images | LDM mixed-training · CelebA-HQ/256 | generated images containing the copyrighted symbol: 3 out of 20 | Helped |
| Use a white background instead of the blurred copyrighted-image background for content disguises (ablation) | Content disguise generation and textual inversion · The Sunflowers | reproduction of copyrighted content | Hurt |
| Increase the input-space constraint weight α (ablation) | Disguise generation · Symbol and style disguises | reproduction of copyrighted information | Hurt |
| Apply horizontal-flip augmentation to a content disguise (ablation) | Textual inversion · Content disguise | learning the intended concept | Hurt |
| Add a horizontal-flip feature-matching penalty to the disguise objective (ablation) | Disguise generation with horizontal-flip augmentation · Content disguise | robustness to horizontal flipping | Helped |
| Choose a random ImageNet base image rather than a base image with matching content and a different style (ablation) | Style disguise generation and textual inversion · The Starry Night style | retention of copyrighted structural information | Hurt |
| Add an autoencoder reconstruction-distance term to the disguise objective (ablation) | Disguise generation intended to evade encoder-decoder detection · Copyrighted symbols | reproduction of copyrighted information | Hurt |
| Use feature similarity search before encoder-decoder examination | Disguise detection · Symbol, content, and style disguises | AUC | Helped |
Surprising findings
- Symbol disguises have low reconstruction loss, falling in the range of clean images, so encoder-decoder detection is weak for symbols (FPR 42/100 on clean images).
- Disguises look visually similar to their base images yet carry drastically different latent information, showing visual auditing is insufficient.
Limitations
- Number of disguises needed for reproduction at large scale is not quantified.
- Disguise optimization is not highly optimized; content and style disguises require careful choice of base image.
- Copyrighted images used are often not actually copyrighted; evaluation is qualitative with small sample sizes.
Experimental setup
Datasets: LAION-400M CelebA-HQ DreamBooth dataset ImageNet Imagenette
Benchmarks: qualitative textual inversion reproductions of symbol, content, and style DreamBooth reproduction CelebA-HQ mixed-training reproduction
Metrics: AUC false positive rate reconstruction loss feature distance
Baselines: Nightshade haveibeentrained-style visual auditing
Builds on: feature matching attack (Shafahi et al. 2018) textual inversion DreamBooth latent diffusion models Nightshade
Closest papers by meaning
- The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright BreachesWithout Adjusting Finetuning Pipeline (ICML 2024 · similarity 0.89)
- CGI-DM: Digital Copyright Authentication for Diffusion Models via Contrasting Gradient Inversion (CVPR 2024 · similarity 0.88)
- Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models (CVPR 2025 · similarity 0.87)
- CDI: Copyrighted Data Identification in Diffusion Models (CVPR 2025 · similarity 0.86)
- Leveraging Model Guidance to Extract Training Data from Personalized Diffusion Models (ICML 2025 · similarity 0.86)
- Rethinking Artistic Copyright Infringements In the Era Of Text-to-Image Generative Models (ICLR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.