Research map / Image generation / Autoregressive and latent generation

How to Evaluate and Mitigate IP Infringement in Visual Generative AI?

ICML 2025 · Image generation › Autoregressive and latent generation · approach: Generalizable fake image detection

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Evaluates IP infringement (character lookalikes) in commercial and open visual generative models via name and description lure prompts, and proposes TRIM, a training-free defense that blocks named prompts and uses VLM detection plus negative-prompt classifier-free guidance to suppress infringing content.

Problem

Visual generative models (text-to-image and text-to-video) can produce images closely resembling copyrighted characters from major entertainment companies, even when the prompt does not name the character, creating legal risk.

Approach

Black-box lure prompts (name-based and GPT-4-written description-based) reveal infringement; the defense blocks name prompts with an LLM, detects infringing outputs with a VLM, and regenerates by replacing the unconditional branch of classifier-free guidance with the infringed character's name, without retraining.

Key results

• Name-based lure prompts yield near-100% infringement rates across models (e.g., 100% for most characters on SDXL, Midjourney), and description-based prompts still yield high rates (e.g., 93.8% on Superman for SDXL).
• TRIM reduces infringement on SD v1-5, Kandinsky-2-1, and SDXL to near 0% for most characters (e.g., Spider-Man 57.2% to 0.0% on SD v1-5; 81.4% to 0.0% on Kandinsky-2-1).
• Average CLIP score drops from 31.67 to 29.71 on SDXL with TRIM, a slight alignment cost; name blocking achieves 100% recall on name-based prompts.

Measured effects reported in the paper

Surprising findings

• Algorithmic distance metrics (L2, LPIPS) performed poorly at measuring IP infringement, with best F-1 of only 0.703 and 0.667, so human evaluation was used.

Limitations

• Human annotators are not IP-law experts, which the authors acknowledge.
• Evaluation covers only six characters and a limited set of models.
• Defense relies on GPT-4 and GPT-4V as detectors and blockers, which adds API dependence.

Experimental setup

Benchmarks: IP infringement benchmark (six protected characters)

Metrics: IP infringement rate (human judged) CLIP score F-1 of L2/LPIPS vs human labels

Baselines: Stable Diffusion v1-5 Stable Diffusion XL Stable Diffusion XL-turbo Kandinsky-2-1 DALL-E 3 Midjourney Stable Video Diffusion L2 distance LPIPS distance

Builds on: classifier-free guidance latent diffusion models LPIPS

Closest papers by meaning

• Fantastic Copyrighted Beasts and How (Not) to Generate Them (ICLR 2025 · similarity 0.88)
• The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright BreachesWithout Adjusting Finetuning Pipeline (ICML 2024 · similarity 0.86)
• Disguised Copyright Infringement of Latent Diffusion Models (ICML 2024 · similarity 0.85)
• Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion? (CVPR 2024 · similarity 0.83)
• Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI (ICLR 2025 · similarity 0.83)
• Rethinking Artistic Copyright Infringements In the Era Of Text-to-Image Generative Models (ICLR 2025 · similarity 0.82)