Research map / Image generation / Autoregressive and latent generation
ImageSentinel: Protecting Visual Datasets from Unauthorized Retrieval-Augmented Image Generation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Protects visual datasets from unauthorized retrieval-augmented image generation by injecting GPT-4o-synthesized sentinel images embedded with random character keys, and detects misuse by querying suspect systems with those keys and measuring DINO similarity.
Problem
Private image datasets can be used without authorization in retrieval-augmented image generation (RAIG) systems, and standard watermarking does not survive the feature extraction and recombination in image generation, so there is no reliable way to detect such misuse.
Approach
Insert sentinel images, generated by a vision-language model plus a text-to-image model to look like the private data but containing a random character key, and verify misuse by checking whether black-box queries with that key reproduce the sentinel images (DINO similarity), since key-based prompts force retrieval rather than direct generation.
Key results
- With 10 or more queries ImageSentinel reaches AUC 1.000 on LLaVA-Pretrain across SDXL, OmniGen and GPT-4o, while Ward-HiDDeN and Ward-FIN stay near 0.5-0.6 AUC.
- On LLaVA-Pretrain with CLIP retriever, ImageSentinel achieves 100% triggering rate on SDXL and OmniGen versus 21.3% and 39.0% for semantic-based retrieval, with Hit@1 of 69.7%.
- Generation quality with ImageSentinel (CLIP 0.772 / SigLIP 0.743 / DINO 0.605 on SDXL) is close to original RAIG (0.776 / 0.747 / 0.616), while sentinel replacement drops DINO to 0.461.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use ImageSentinel instead of Ward-HiDDeN or Ward-FIN | LLaVA-Pretrain RAIG detection · LLaVA-Pretrain, 10 queries, SDXL, OmniGen, and GPT-4o RAIG | AUC: 0.585 -> 1.000 (SDXL); 0.542 -> 0.989 (OmniGen); 0.555 -> 1.000 (GPT-4o) | Helped |
| Use random character keys instead of semantic-based prompts | LLaVA-Pretrain retrieval · LLaVA-Pretrain, CLIP retriever | triggering rate: 21.3\% -> 100.0\% (SDXL) | Helped |
| Use random character keys instead of semantic-based retrieval | LLaVA-Pretrain retrieval · LLaVA-Pretrain, CLIP retriever | Hit@1: 58.3\% -> 69.7\% | Helped |
| Use GPT-4o instead of SDXL for sentinel synthesis (ablation) | ImageSentinel · LLaVA-Pretrain sentinel/reference images | CLIP similarity: 0.578 -> 0.663 | Helped |
| Add sentinel images alongside the private dataset instead of replacing original images (ablation) | RAIG generation quality · LLaVA-Pretrain, SDXL and OmniGen | CLIP similarity: 0.708 -> 0.772 (SDXL); 0.688 -> 0.727 (OmniGen) | Helped |
| Use 6-character keys instead of 4-character keys (ablation) | ImageSentinel · LLaVA-Pretrain, 5 queries | AUC: 0.965 -> 0.997 | Helped |
| Use 6-character keys instead of 8-character keys (ablation) | ImageSentinel · LLaVA-Pretrain, 5 queries | AUC: 0.972 -> 0.997 | Helped |
| Detect and inpaint text regions before indexing | ImageSentinel detection · LLaVA-Pretrain, SDXL RAIG, 5 queries | AUC: 0.99 -> 0.62 | Hurt |
| Detect and inpaint text regions before indexing | RAIG generation utility · LLaVA-Pretrain, SDXL RAIG | CLIP similarity: 0.772 -> 0.769 | No clear effect |
| Increase the number of queries under detect-and-inpaint attack | ImageSentinel detection · LLaVA-Pretrain, SDXL RAIG | AUC: 0.62 (5 queries) -> 0.91 (50 queries) -> 0.98 (100 queries) | Helped |
| Use SigLIP instead of CLIP as the retriever | ImageSentinel · LLaVA-Pretrain, 5 queries | AUC: 0.997 -> 0.999 | Helped |
Surprising findings
- Semantic-based prompts often let SDXL and OmniGen generate satisfactory images without retrieval, so semantic retrieval is frequently bypassed, whereas key-based prompts do not.
Limitations
- Relies on the text-to-image model's ability to render characters legibly; SDXL and OmniGen failed to embed keys reliably.
- Adaptive detect-and-inpaint attack (EasyOCR + SD 2.0 inpainting) removes sentinel text and drops AUC to 0.62 at 5 queries.
- Retrieval accuracy drops with larger databases (Hit@1 65.6% at 100,000 images with SigLIP).
Experimental setup
Datasets: LLaVA Visual Instruct Pretrain (LLaVA-Pretrain) Product-10K
Benchmarks: LLaVA-Pretrain Product-10K
Metrics: AUC TPR at 1% FPR TPR at 10% FPR Hit@1 Hit@3 Hit@5 CLIP similarity DINO similarity SigLIP similarity MoCo similarity
Baselines: Ward-HiDDeN Ward-FIN semantic-based retrieval
Builds on: Ward ImageRAG DINO
Closest papers by meaning
- Safeguarding Multimodal Knowledge Copyright in the RAG-as-a-Service Environment (ICLR 2026 · similarity 0.85)
- WMarkGPT: Watermarked Image Understanding via Multimodal Large Language Models (ICML 2025 · similarity 0.84)
- Countering Personalized Text-to-Image Generation with Influence Watermarks (CVPR 2024 · similarity 0.84)
- EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection (CVPR 2024 · similarity 0.83)
- OmniGuard: Hybrid Manipulation Localization via Augmented Versatile Deep Image Watermarking (CVPR 2025 · similarity 0.83)
- BitMark: Watermarking Bitwise Autoregressive Image Generative Models (NeurIPS 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.