Theorem <ref> only works over neighborhoods of integers points in $\mathcal{X}$. Even if the construction of big generalized Heegner classes can probably (at least in the ordinary case) be extended to the whole Hida family $\I$, the strategy to prove Theorem <ref> involves a comparison result at integer points in $\mathcal{X}$, which does not immediately extends to bigger sets in $\I$. We hope to come to this problem (at least in the ordinary case) in a future work.

[1]
Fabrizio Andreatta, Eyal Z. Goren, Benjamin Howard, and Keerthi Madapusi Pera,
Height pairings on orthogonal Shimura varieties, Compos. Math.
153 (2017), no. 3, 474–534. 3705233

[2]
Fabrizio Andreatta, Adrian Iovita, and Glenn Stevens, Overconvergent
Eichler-Shimura isomorphisms, J. Inst. Math. Jussieu 14 (2015),
no. 2, 221–274. 3315057

[3]
Giuseppe Ancona, Décomposition de motifs abéliens, Manuscripta
Math. 146 (2015), no. 3-4, 307–328. 3312448

[4]
Jean-François Boutot, Lawrence Breen, Paul Gérardin, Jean Giraud,
Jean-Pierre Labesse, James Stuart Milne, and Christophe Soulé,
Variétés de Shimura et fonctions $L$, Publications
Mathématiques de l'Université Paris VII, vol. 6, Université de
Paris VII, U.E.R. de Mathématiques, Paris, 1979.

[5]
Olivier Brinon and Brian Conrad, CMI summer school notes on $p$-adic
Hodge theory, preprint, 2009.

[6]
Ashay Burungale, Francesc Castella, and Chan-Ho Kim, A proof of
Perrin-Riou's Heegner point main conjecture, Algebra Number Theory
15 (2021), no. 7, 1627–1653. 4333660

[7]
Massimo Bertolini, Henri Darmon, and Kartik Prasanna, Generalized
Heegner cycles and $p$-adic Rankin $L$-series, Duke Math. J.
162 (2013), no. 6, 1033–1148.

[8]
Christophe Breuil and Matthew Emerton, Représentations $p$-adiques
ordinaires de ${\rm GL}_2(\bold Q_p)$ et compatibilité local-global,
Astérisque (2010), no. 331, 255–315. 2667890

[9]
Amnon Besser, CM cycles over Shimura curves, J. Algebraic Geom.
4 (1995), no. 4, 659–691. 1339843

[10]
Christopher Birkbeck, Ben Hewer, and Chris Williams, Overconvergent
Hilbert modular forms via perfectoid hilbert varieties, Ann. Inst.
Fourier, to appear (2022).

[11]
Kâzim Büyükboduk and Antonio Lei, Interpolation of
generalized Heegner cycles in Coleman families, J. Lond. Math. Soc. (2)
104 (2021), no. 4, 1682–1716. 4339947

[12]
Miljan Brakočević, Anticyclotomic $p$-adic $L$-function of
central critical Rankin-Selberg $L$-valueRankin-Selberg
$L$-value, Int. Math. Res. Not. IMRN (2011), no. 21, 4967–5018.

[13]
Riccardo Brasca, $p$-adic modular forms of non-integral weight over
Shimura curves, Compos. Math. 149 (2013), no. 1, 32–62.

[14]
, Quaternionic modular forms of any weight, Int. J. Number Theory
10 (2014), no. 1, 31–53.

[15]
, Eigenvarieties for cuspforms over PEL type Shimura varieties
with dense ordinary locus, Canad. J. Math. 68 (2016), no. 2016,

[16]
Ashay A. Burungale, On the non-triviality of the $p$-adic
Abel-Jacobi image of generalised Heegner cycles modulo $p$, II:
Shimura curves, J. Inst. Math. Jussieu 16 (2017), no. 1,

[17]
Kevin Buzzard, Integral models of certain shimura curves, Duke Math. J.
87 (1997), no. 3, 591–612.

[18]
Henri Carayol, Sur la mauvaise réduction des courbes de Shimura,
Compositio Math. 59 (1986), no. 2, 151–230. 860139

[19]
Francesc Castella, Heegner cycles and higher weight specializations of
big Heegner points, Math. Ann. 356 (2013), no. 4, 1247–1282.

[20]
, On the $p$-adic variation of Heegner points, J. Inst. Math.
Jussieu 19 (2020), no. 6, 2127–2164. 4167004

[21]
Masataka Chida and Ming-Lun Hsieh, On the anticyclotomic Iwasawa main
conjecture for modular forms, Compos. Math. 151 (2015), no. 5,

[22]
Francesc Castella and Ming-Lun Hsieh, Heegner cycles and $p$-adic
$L$-functions, Math. Ann. 370 (2018), no. 1-2, 567–628.

[23]
Masataka Chida and Ming-Lun Hsieh, Special values of anticyclotomic
$L$-functions for modular forms, J. Reine Angew. Math. 741
(2018), 87–131.

[24]
Gaëtan Chenevier, Une correspondance de Jacquet-Langlands
$p$-adique, Duke Math. J. 126 (2005), no. 1, 161–194.

[25]
Przemysław Chojecki, David Hansen, and Christian Johansson,
Overconvergent modular forms and perfectoid Shimura curves, Doc.
Math. 22 (2017), 191–262. 3609197

[26]
Robert Coleman and Adrian Iovita, Hidden structures on semistable
curves, Astérisque (2010), no. 331, 179–254. 2667889

[27]
Francesc Castella, Chan-Ho Kim, and Matteo Longo, Variation of
anticyclotomic Iwasawa invariants in Hida families, Algebra Number
Theory 11 (2017), no. 10, 2339–2368. 3744359

[28]
Francesc Castella and Matteo Longo, Big Heegner points and special
values of $L$-series, Ann. Math. Qué. 40 (2016), no. 2,

[29]
Robert F. Coleman, A $p$-adic Shimura isomorphism and $p$-adic
periods of modular forms, $p$-adic monodromy and the Birch and
Swinnerton-Dyer conjecture (Boston, MA, 1991), Contemp. Math., vol.
165, Amer. Math. Soc., Providence, RI, 1994, pp. 21–51. 1279600

[30]
, Classical and overconvergent modular forms of higher level, J.
Théor. Nombres Bordeaux 9 (1997), no. 2, 395–403. 1617406

[31]
Francesc Castella and Xin Wan, The Iwasawa main conjectures for $\rm
GL_2$ and derivatives of $p$-adic $L$-functions, Adv. Math.
400 (2022), Paper No. 108266, 45. 4387238

[32]
Pierre Deligne, Théorème de Lefschetz et critères de
dégénérescence de suites spectrales, Inst. Hautes Études
Sci. Publ. Math. (1968), no. 35, 259–278. 244265

[33]
Daniel Disegni, The universal $p$-adic Gross-Zagier formula,
Invent. Math. 230 (2022), no. 2, 509–649. 4493324

[34]
Henri Darmon and Victor Rotger, Diagonal cycles and Euler systems II:
The Birch and Swinnerton-Dyer conjecture for Hasse-Weil-Artin
$L$-functions, J. Amer. Math. Soc. 30 (2017), no. 3, 601–672.

[35]
Fred Diamond and Richard Taylor, Non-optimal levels of mod l modular
representations., Invent. Math. 115 (1994), no. 3, 435–462.

[36]
Gerd Faltings, Hodge-Tate structures and modular forms, Math. Ann.
278 (1987), no. 1-4, 133–149. 909221

[37]
Olivier Fouquet, Dihedral Iwasawa theory of nearly ordinary
quaternionic automorphic forms, Compos. Math. 149 (2013), no. 3,

[38]
Fernando Q. Gouvêa, Arithmetic of $p$-adic modular forms, Lecture
Notes in Mathematics, vol. 1304, Springer-Verlag, Berlin, 1988.

[39]
Matthew Greenberg and Marco Seveso, $p$-adic families of cohomological
modular forms for indefinite quaternion algebras and the
Jacquet-Langlands correspondence, Canad. J. Math. 68 (2016),
no. 5, 961–998.

[40]
David Hansen, Universal eigenvarieties, trianguline Galois
representations, and $p$-adic Langlands functoriality, J. Reine Angew.
Math. 730 (2017), 1–64, With an appendix by James Newton.

[41]
Ernest Hunter Brooks, Shimura curves and special values of $p$-adic
$L$-functions, Int. Math. Res. Not. IMRN (2015), no. 12, 4177–4241.

[42]
Haruzo Hida, Galois representations into ${\rm GL}_2({\bf Z}_p[[X]])$
attached to ordinary cusp forms, Invent. Math. 85 (1986), no. 3,

[43]
, Elementary theory of $L$-functions and Eisenstein series,
London Mathematical Society Student Texts, vol. 26, Cambridge University
Press, Cambridge, 1993.

[44]
, Geometric modular forms and elliptic curves, World Scientific
Publishing Co., Inc., River Edge, NJ, 2000.

[45]
, Control theorems of coherent sheaves on Shimura varieties of
PEL type, J. Inst. Math. Jussieu 1 (2002), 1–76.

[46]
, $p$-adic automorphic forms on Shimura varieties, Springer
Monographs in Mathematics, Springer-Verlag, New York, 2004.

[47]
, Hecke fields of analytic families of modular forms, Journal of
the American Mathematical Society 24 (2011), no. 1, 51–80.

[48]
Osamu Hyodo and Kazuya Kato, Semi-stable reduction and crystalline
cohomology with logarithmic poles, no. 223, 1994, Périodes $p$-adiques
(Bures-sur-Yvette, 1988), pp. 221–268. 1293974

[49]
Benjamin Howard, Variation of Heegner points in Hida families,
Invent. Math. 167 (2007), no. 1, 91–128.

[50]
Dimitar Jetchev, David Loeffler, and Sarah Livia Zerbes, Heegner points
in Coleman families, Proc. Lond. Math. Soc. (3) 122 (2021),
no. 1, 124–152. 4210260

[51]
Payman L. Kassaei, $\mathscr P$-adic modular forms over Shimura
curves over totally real fields, Compos. Math. 140 (2004), no. 2,

[52]
Nicholas Katz, Travaux de Dwork, Séminaire Bourbaki, 24ème
année (1971/1972), Lecture Notes in Math., Vol. 317, Springer, Berlin-New
York, 1973, pp. Exp. No. 409, pp. 167–200. 498577

[53]
, Serre–Tate local moduli, Algebraic surfaces (Orsay,
1976-78), Lecture Notes in Math., vol. 868, Springer, Berlin, 1981,
pp. 138–202.

[54]
Kazuya Kato, Lectures on the approach to iwasawa theory for the
hasse-weil $l$-function via $\mathbf{B}_{\mathrm{dr}}$., Springer-Verlag,

[55]
Guido Kings, Eisenstein classes, elliptic Soulé elements and the
$\ell$-adic elliptic polylogarithm, The Bloch-Kato conjecture for the
Riemann zeta function, London Math. Soc. Lecture Note Ser., vol. 418,
Cambridge Univ. Press, Cambridge, 2015, pp. 239–296. 3497682

[56]
Guido Kings, David Loeffler, and Sarah Livia Zerbes, Rankin-Eisenstein
classes and explicit reciprocity laws, Camb. J. Math. 5 (2017),
no. 1, 1–122. 3637653

[57]
, Rankin-Eisenstein classes for modular forms, Amer. J. Math.
142 (2020), no. 1, 79–138. 4060872

[58]
Shinichi Kobayashi and Kazuto Ota, Anticyclotomic main conjecture for
modular forms and integral Perrin-Riou twists, Development of Iwasawa
theory—the centennial of K. Iwasawa's birth, Adv. Stud. Pure Math.,
vol. 86, Math. Soc. Japan, Tokyo, [2020] 2020, pp. 537–594.

[59]
Shinichi Kobayashi, The $p$-adic Gross–Zagier formula for elliptic
curves at supersingular primes, Invent. Math. 191 (2013), no. 3,

[60]
, A $p$-adic interpolation of generalized Heegner cycles and
integral Perrin-Riou twist I, Ann. Math. Qué. 47 (2023),
no. 1, 73–116. 4569755

[61]
Matteo Longo, A $p$-adic Maass-Shimura operator on Mumford
curves, Ann. Math. Qué. 47 (2023), no. 1, 139–175.

[62]
David Loeffler, Christopher Skinner, and Sarah Livia Zerbes, Euler
systems for ${\rm GSp}(4)$, J. Eur. Math. Soc. (JEMS) 24 (2022),
no. 2, 669–733. 4382481

[63]
Matteo Longo and Stefano Vigni, Quaternion algebras, Heegner points and
the arithmetic of Hida families, Manuscripta Math. 135 (2011),
no. 3-4, 273–328.

[64]
, The rationality of quaternionic Darmon points over genus
fields of real quadratic fields, Int. Math. Res. Not. IMRN (2014), no. 13,
3632–3691. 3229764

[65]
, Vanishing of special values and central derivatives in Hida
families, Ann. Sc. Norm. Super. Pisa Cl. Sci. (5) 13 (2014), no. 3,

[66]
, A refined Beilinson–Bloch conjecture for motives of modular
forms, Trans. Amer. Math. Soc. 369 (2017), no. 10, 7301–7342.

[67]
David Loeffler and Sarah Livia Zerbes, Iwasawa theory and $p$-adic
$L$-functions over $\Bbb{Z}_p^2$-extensions, Int. J. Number Theory
10 (2014), no. 8, 2045–2095. 3273476

[68]
, Rankin-Eisenstein classes in Coleman families, Res. Math.
Sci. 3 (2016), Paper No. 29, 53. 3552987

[69]
Paola Magrone, Generalized Heegner cycles and $p$-adic
$L$-functions in a quaternionic setting, Ann. Sc. Norm. Super. Pisa Cl.
Sci. (5) 23 (2022), no. 4, 1807–1870. 4553539

[70]
James S. Milne, Points on Shimura varieties mod $p$, Automorphic
Forms, Representations and $L$-Functions (Providence Amer. Math. Soc, ed.),
vol. 33, 1979, pp. 165–184.

[71]
, Étale cohomology, Princeton Mathematical Series, No. 33,
Princeton University Press, Princeton, N.J., 1980. 559531

[72]
, Introduction to Shimura Varieties, Harmonic analysis, the
trace formula, and Shimura varieties (Proc. Clay Math. Inst. 2003
Summer School, The Fields Inst., Toronto, Canada, June 2–27,
2003), Clay Math. Proc., vol. 4, Amer. Math. Soc, Providence, 2005,
pp. 265–378.

[73]
Yasuo Morita, Reduction modulo ${\mathfrak P}$ of Shimura curves,
Hokkaido Math. J. 10 (1981), no. 2, 209–238.

[74]
Andrea Mori, Power series expansions of modular forms and their
interpolation properties, Int. J. Number Theory 7 (2011), no. 2,
529–577. 2782668

[75]
Carlo Mazza, Vladimir Voevodsky, and Charles Weibel, Lecture notes on
motivic cohomology, Clay Mathematics Monographs, vol. 2, American
Mathematical Society, Providence, RI; Clay Mathematics Institute, Cambridge,
MA, 2006.

[76]
Jan Nekovář, $p$-adic Abel-Jacobi maps and $p$-adic
heights, The arithmetic and geometry of algebraic cycles (Banff, AB,
1998), CRM Proc. Lecture Notes, vol. 24, Amer. Math. Soc., Providence, RI,
2000, pp. 367–379. 1738867

[77]
James Newton, Completed cohomology of Shimura curves and a $p$-adic
Jacquet-Langlands correspondence, Math. Ann. 355 (2013), no. 2,

[78]
Kazuto Ota, Big Heegner points and generalized Heegner cycles, J.
Number Theory 208 (2020), 305–334.

[79]
Richard Pink, Arithmetical compactification of mixed Shimura
varieties, Bonner Mathematische Schriften [Bonn Mathematical Publications],
vol. 209, Universität Bonn, Mathematisches Institut, Bonn, 1990,
Dissertation, Rheinische Friedrich-Wilhelms-Universität Bonn, Bonn, 1989.

[80]
Robert Pollack and Glenn Stevens, Overconvergent modular symbols and
$p$-adic $L$-functions, Ann. Sci. Éc. Norm. Supér. (4)
44 (2011), no. 1, 1–42.

[81]
Peter Scholze, On torsion in the cohomology of locally symmetric
varieties, Ann. of Math. (2) 182 (2015), no. 3, 945–1066.

[82]
Daniel Barrera Salazar and Shan Gao, Overconvergent Eichler-Shimura
isomorphisms for quaternionic modular forms over $\Bbb Q$, Int. J. Number
Theory 13 (2017), no. 10, 2687–2715. 3713098

[83]
Goro Shimura, Introduction to the arithmetic theory of automorphic
functions, Publications of the Mathematical Society of Japan, No. 11.
Iwanami Shoten, Publishers, Tokyo; Princeton University Press, Princeton,
N.J., 1971, Kanô Memorial Lectures, No. 1.

[84]
Ariel Shnidman, $p$-adic heights of generalized Heegner cycles, Ann.
Inst. Fourier (Grenoble) 66 (2016), no. 3, 1117–1174.

[85]
Glenn Stevens, Rigid analytic modular symbols, preprint (1994).

[86]
Alex Torzewski, Functoriality of motivic lifts of the canonical
construction, Manuscripta Math. 163 (2020), no. 1-2, 27–56.

[87]
Takeshi Tsuji, $p$-adic étale cohomology and crystalline cohomology
in the semi-stable reduction case, Invent. Math. 137 (1999), no. 2,
233–411. 1705837

[88]
Xin Wan, A New $\pm$ Iwasawa Theory and Converse of
Gross-Zagier and Kolyvagin Theorem (with an Appendix by Yangyu
Fan), preprint https://arxiv.org/pdf/2304.09806.pdf (2023).


# Attributing Image Generative Models using Latent Fingerprints

Guangyu Nie  Changhoon Kim  Yezhou Yang  Yi Ren

###### Abstract

Generative models have enabled the creation of contents that are
indistinguishable from those taken from nature. Open-source development of
such models raised concerns about the risks of their misuse for malicious
purposes. One potential risk mitigation strategy is to attribute generative
models via fingerprinting. Current fingerprinting methods exhibit a
significant tradeoff between robust attribution accuracy and generation
quality while lacking design principles to improve this tradeoff. This paper
investigates the use of latent semantic dimensions as fingerprints, from where
we can analyze the effects of design variables, including the choice of
fingerprinting dimensions, strength, and capacity, on the accuracy-quality
tradeoff. Compared with previous SOTA, our method requires minimum computation
and is more applicable to large-scale models. We use StyleGAN2 and the latent
diffusion model to demonstrate the efficacy of our method. Codes are available
in github.

Machine Learning, ICML

Figure 1:  (a) Visual comparison between latent fingerprinting (our method)
and shallow fingerprinting (Kim et al., 2021) (baseline). Our method uses
subtle semantic changes, rather than strong noises, to maintain attribution
accuracy against image postprocesses. (b) Schematic of latent fingerprinting:
The same generator $g$ and fingerprint estimator $f$ are used for all
fingerprinting models. Our method thus requires minimal compute and is
scalable to large latent diffusion models.

##  1 Introduction

Generative models can now create synthetic content such as images and audio
that are indistinguishable from those captured in nature (Karras et al., 2020;
Rombach et al., 2022; Ramesh et al., 2022; Hawthorne et al., 2022). This poses
a serious threat when used for malicious purposes, such as disinformation
(Breland, 2019) and malicious impersonation (Satter, 2019). Such potential
threats have slowed down the industrialization process of generative models,
as conservative model inventors hesitate to release their source code (Yu et
al., 2020). For example, in 2020, OpenAI refused to release the source code of
their GPT-2 (Radford et al., 2019) model due to concerns over potential
malicious use (Brockman et al., 2020). Additionally, the source code for
DALL-E (Ramesh et al., 2021) and DALL-E 2 (Ramesh et al., 2022) has not been
released for the same reason (Mishkin & Ahmad, 2022).

One potential solution is model attribution (Yu et al., 2018; Kim et al.,
2021; Yu et al., 2020), where the model distributor tweaks each user-end model
to generate content with model-specific fingerprints. In practice, we consider
a scenario where the model distributor or regulator maintains a database of
user-specific keys corresponding to each user’s downloaded model. In the event
of a malicious attempt, the regulator can identify the user responsible for
the attempt by using attribution.

Formally, let a set of $n$ generative models be
$\mathcal{G}:=\\{g_{i}(\cdot)\\}_{i=1}^{n}$ where
$g_{i}(\cdot):\mathbb{R}^{d_{z}}\rightarrow\mathbb{R}^{d_{x}}$ is a mapping
from an easy-to-sample distribution $p_{z}$ to a fingerprinted data
distribution $p_{x,i}$ in the content space, and is parameterized by a binary-
coded key $\phi_{i}\in\Phi:=\\{0,1\\}^{d_{\phi}}$. Let
$f(\cdot):\mathbb{R}^{d_{x}}\rightarrow\Phi$ be a mapping that attributes
contents to their source models ( Fig. 1(b)). We consider four performance
metrics of a fingerprinting mechanism: The attribution accuracy of $g_{i}$ is
defined as

$A(g_{i})=\mathbb{E}_{z\sim
p_{z}}\left[\mathbbm{1}\left(f(g_{i}(z))==\phi_{i}\right)\right].$ (1)

The generation quality of $g_{i}$ measures the difference between $p_{x,i}$
and the data distribution used for learning $\mathcal{G}$, e.g., the Fréchet
Inception Distance (FID) score (Heusel et al., 2017) for images. Inception
score (IS) (Salimans et al., 2016) is also measured for $p_{x,i}$ as
additional generation quality metrics. Fingerprint secrecy is measured by the
mean structural similarity index measure (SSIM) of individual images drawn
from $p_{x,i}$. Compared with generation quality, this metric focuses on how
obvious fingerprints are rather than how well two content distributions match.
Lastly, the fingerprint capacity is $n=2^{d_{\phi}}$.

Existing model attribution methods exhibit a significant tradeoff between
attribution accuracy, generation quality, and secrecy, particularly when
countermeasures against deattribution attempts, e.g., image postprocesses, are
considered. For example, Kim et al. (2021) use shallow fingerprints for image
generators in the form of $g_{i}(z)=g_{0}(z)+\phi_{i}$ where $g_{0}(\cdot)$ is
an unfingerprinted model and show that $\phi_{i}$s have to significantly alter
the original contents to achieve good attribution accuracy against image
blurring, causing an unfavorable drop in generation quality and secrecy (Fig.
1(a)).

To improve this tradeoff, we investigate in this paper latent fingerprints in
the form of $g_{i}(z)=g_{0}(\psi(z)+\phi_{i})$, where
$w:=\psi(z)\in\mathbb{R}^{d_{w}}$ contains disentangled semantic dimensions
that allow a smoother mapping to the content space (Fig. 1(a)). Such $\psi$
has been incorporated in popular models such as StyleGAN (SG) (Karras et al.,
2019, 2020), where $w$ is the style vector, and latent diffusion models(LDM)
(Rombach et al., 2022), where $w$ comes from a diffusion process. Existing
studies on semantic editing showed that $\mathbb{R}^{d_{w}}$ consists of
linear semantic dimensions (Härkönen et al., 2020; Zhu et al., 2021). Inspired
by this, we hypothesize that using subtle yet semantic changes as fingerprints
will improve the robustness of attribution accuracy against image
postprocesses, and thus investigate the performance of fingerprints that are
generated by perturbations along latent dimensions of $\mathbb{R}^{d_{w}}$.
Specifically, we consider latent dimensions as eigenvectors of the covariance
matrix of the latent distribution $p_{w}$, denoted by $\Sigma_{w}$.

Contributions. (1) We propose a novel fingerprinting strategy that directly
embeds the fingerprints into pretrained generative model, as a mean to achieve
responsible white-box model distribution. (2) We prove and empirically verify
that there exists an intrinsic tradeoff between attribution accuracy and
generation quality. This tradeoff is affected by fingerprint variables
including the choice of the fingerprinting space, the fingerprint strength,
and its capacity. Parametric studies on these variables for StyleGAN2 (SG2)
and a Latent Diffusion Model(LDM) lead to improved accuracy-quality tradeoff
from the previous SOTA. In addition, our method requires negligible
computation compared with previous SOTA, rendering it more applicable to
popular large-scale models, including latent diffusion ones. (3) We show that
using a postprocess-specific LPIPS metric for model attribution leads to
further improved attribution accuracy against image postprocesses.

##  2 Related Work

Model attribution through fingerprint encoding and decoding. Yu et al. (2020)
propose to encode binary-coded keys into images through
$g_{i}(z)=g_{0}([z,\phi_{i}])$ and to decode them via another learnable
function. This requires joint training of the encoder and decoder over
$\mathbb{R}^{d_{z}}\times\Phi$ to empirically balance attribution accuracy and
generation quality. Since fingerprint capacity is usually high (i.e.,
$2^{d_{\phi}}$), training is made tractable by sampling only a small subset of
fingerprints. Thus this method is computationally expensive and lacks a
principled understanding of how the fingerprinting mechanism affects the
accuracy-quality tradeoff. In contrast, our method does not require any
additional training and mainly relies on simple principle component analysis
of the latent distribution.

Certifiable model attribution through shallow fingerprints. Kim et al. (2021)
propose shallow fingerprints $g_{i}(z)=g_{0}(z)+\phi_{i}$ and linear
classifiers for attribution. These simplifications allow the derivation of
sufficient conditions of $\Phi$ to achieve certifiable attribution of
$\mathcal{G}$. Since the fingerprints are added as noises rather than semantic
changes coherent with the generated contents, increased noise strength becomes
necessary to maintain attribution accuracy under postprocesses. While this
paper does not provide attribution certification for latent fingerprint, we
discuss the technical feasibility and challenges in achieving this goal.

StyleGAN and low-rank subspace. Our study focuses on popular image generation
models which share an architecture rooted in SG: A Gaussian distribution is
first transformed into a latent distribution ($p_{w}$), samples from which are
then decoded into images. Härkönen et al. (2020) apply principal component
analysis on $p_{w}$ distribution and found semantically meaningful editing
directions. Zhu et al. (2021) use local Jacobian ($\nabla_{w}g$) to derive
perturbations that enable local semantic editing of generated images, and show
that such semantic dimensions are shared across the latent space. In this
study, we show that the mean of the Gram matrix for local editing
($\mathbb{E}_{w\sim p_{w}}[\nabla_{w}g^{T}\nabla_{w}g]$) and the covariance of
$w$ ($\Sigma_{w}$) are qualitatively similar in that both reveal major to
minor semantic dimensions through their eigenvectors.

GAN inversion. The model attribution problem can be formulated as a GAN
inversion problem. A learning-based inversion (Perarnau et al., 2016; Bau et
al., 2019) optimizes parameters of the encoder network which map an image to
latent code $z$. On the other hand, optimization-based inversion (Abdal et
al., 2019; Huh et al., 2020) solve for latent code $z$ that minimizes distance
metric between a given image and generated image $g(z)$. The learning-based
method is computationally more efficient in the inference stage compared to
optimization-based method. However, optimization-based GAN inversion achieves
a superior quality of latent interpretation, which can be referred to as the
quality-time tradeoff (Xia et al., 2022). In our method, we utilized the
optimization-based inversion, as faithful latent interpretation is critical in
our application. To further enforce faithful latent interpretation, we
incorporate existing techniques, e.g., parallel search, to solve this non-
convex problem, but uniquely exploit the fact that fingerprints are small
latent perturbations to enable analysis on the accuracy-quality tradeoff.

Table 1:  Attribution accuracy and generation quality of the proposed method. FID-$g_{0}$ and IS-$g_{0}$ represent the baseline FID and inception score for the image quality of generative models prior to fingerprinting. $\uparrow$ ($\downarrow$) indicates higher (lower) is desired. The standard deviation is in parentheses.  Model | Dataset | Attribution Accuracy | Image Quality
---|---|---|---
|  | Ours | w/o $\alpha$-reg | w/o LHS | FID-$g_{0}$ | FID$\downarrow$ | IS-$g_{0}$ $\uparrow$ | IS $\uparrow$ | SSIM $\uparrow$
SG2 | FFHQ | 0.983 | 0.877 | 0.711 | 7.24 | 8.59 | 5.16 | 4.96 | 0.93(0.02)
SG2 | AFHQ Cat | 0.993 | 0.991 | 0.972 | 6.35 | 7.87 | 1.65 | 2.32 | 0.97(0.01)
SG2 | AFHQ Dog | 0.999 | 0.998 | 0.981 | 3.80 | 5.36 | 9.76 | 12.33 | 0.95(0.01)
LDM | FFHQ | 0.996 | 0.364 | 0.872 | 12.34 | 13.63 | 4.50 | 4.35 | 0.94(0.01)

##  3 Methods

###  3.1 Notations and preliminaries

Notations. For $x\in\mathbb{R}^{n}$ and $A\in\mathbb{R}^{n\times m}$, denote
by $\textit{proj}_{A}x$ the projection of $x$ to $span(A)$, and by
$A^{\dagger}$ the pseudo inverse of $A$. For parameter $a$, we denote by
$\hat{a}$ its estimate and $\epsilon_{a}=\hat{a}-a$ the error. $\nabla_{x}f$
is the gradient of $f$ with respect to $x$, $\mathbb{E}_{x\sim p_{x}}[\cdot]$
is an expectation over $p_{x}$, and $tr(B)$ (resp. $det(B)$) is the trace
(resp. determinant) of $B\in\mathbb{R}^{n\times n}$.
$diag(\lambda)\in\mathbb{R}^{n\times n}$ diagonalizes
$\lambda\in\mathbb{R}^{n}$.

Latent Fingerprints. Contemporary generative models, e.g., SG2 and LDM,
consist of a disentanglement mapping
$\psi:\mathcal{R}^{d_{z}}\rightarrow\mathcal{R}^{d_{w}}$ from an easy-to-
sample distribution $p_{z}$ to a latent distribution $p_{w}$, followed by a
generator $g:\mathcal{R}^{d_{w}}\rightarrow\mathcal{R}^{d_{x}}$ that maps $w$
to the content space. In particular, $\psi$ is a multilayer perception network
in SG2 and a diffusion process in a diffusion model. Existing studies showed
that linear perturbations along principal components of $\nabla_{w}g$ enable
semantic editing, and such perturbation directions are often applicable over
$w\sim p_{w}$ (Härkönen et al., 2020; Zhu et al., 2021). Indeed, instead of
local analysis on the Jacobian, (Härkönen et al., 2020) showed that principal
component analysis directly on $p_{w}$ also reveals semantic dimensions. This
paper follows these existing findings and uses a subset of semantic dimensions
as fingerprints. Specifically, let
$U\in\mathbb{R}^{d_{w}\times(d_{w}-d_{\phi})}$ and
$V\in\mathbb{R}^{d_{w}\times d_{\phi}}$ be orthonormal and complementary.
Given random seed $z\in\mathbb{R}^{d_{z}}$, user-specific key
$\phi\in\mathbb{R}^{d_{\phi}}$, and strength $\sigma\in\mathbb{R}$, let
$\alpha=U^{\dagger}\textit{proj}_{U}\psi(z)\in\mathbb{R}^{d_{w}-d_{\phi}}$,
the fingerprinted latent variable is

$w_{\phi}(\alpha)=U\alpha+\sigma V\phi,$ (2)

where $\alpha\sim p_{\alpha}$ and $p_{\alpha}$ is induced by $p_{w}$. Then,
the user can generate fingerprinted images, $g(w_{\phi}(\alpha))$. The choice
of $(U,V)$ and $\sigma$ affects the attribution accuracy and generalization
performance, which we analyze in Sec. 3.2.

Attribution.To decode user-specific key from the image $g(w_{\phi}(\alpha))$,
we formulate an optimization problem:

$\displaystyle\min_{\hat{\alpha},\hat{\phi}}$ $\displaystyle
l\left(g(w_{\hat{\phi}}(\hat{\alpha})),g(w_{\phi}(\alpha))\right)$
$\displaystyle s.t.$
$\displaystyle\hat{\alpha}_{i}\in[\alpha_{l,i},\alpha_{u,i}],\quad\forall
i=1,...,d_{w}-d_{\phi}.$

While $l$ is $l_{2}$ norm for analysis in Sec.3.2, here we minimize LPIPS
(Zhang et al., 2018) which measures the perceptual difference between two
images. Through experiments, we discovered that attribution accuracy can be
improved by constraining $\alpha$. Here the upper and lower bounds of $\alpha$
are chosen based on the empirical limits observed from $p_{\alpha}$. In
practice, we introduce a penalty on $\hat{\alpha}$ with large enough Lagrange
multipliers and solve the resulting unconstrained problem. To avoid
convergence to unfavorable local solutions, we also employ parallel search
with n initial guesses of $\hat{\alpha}$ drawn through Latin hypercube
sampling (LHS).

###  3.2 Accuracy-quality tradeoff

Attribution accuracy. Define $J_{w}=\nabla g(w)$, $H_{w}=J_{w}^{T}J_{w}$. Let
$\bar{H}_{w}=\mathbb{E}_{w\sim p_{w}}[H_{w}]$ be the mean Gram matrix, and
$\bar{H}_{\phi}=\mathbb{E}_{\alpha\sim p_{\alpha}}[H_{w_{\phi}(\alpha)}]$ be
its fingerprinted version. Let
$l:\mathbb{R}^{d_{x}}\times\mathbb{R}^{d_{x}}\rightarrow\mathbb{R}$ be a
distance metric between two images, $(\hat{\alpha},\hat{\phi})$ the estimates.
To analyze how $(V,U)$ affects the attribution accuracy, we use the following
simplifications and assumptions: (A1) $l(\cdot,\cdot)$ is the $l_{2}$ norm.
(A2) Both $||\epsilon_{\alpha}||$ and $\sigma$ are small. In practice we
achieve small $||\epsilon_{\alpha}||$ through parallel search (see Appendix
B). (A3) Since our focus is on $\epsilon_{\phi}$, we further assume that the
estimation of $\alpha$, denoted by $\hat{\alpha}(\alpha)$, is independent from
$\phi$, and $\epsilon_{\alpha}$ is constant. This allows us to ignore the
subroutine for computing $\hat{\alpha}(\alpha)$ and turns the estimation
problem into an optimization with respect to only $\epsilon_{\phi}$. Formally,
we have the following proposition (see Appendix A.1 for proof):

######  Proposition 3.1.

$\exists~{}c>0$ such that if $\sigma\leq c$ and $||\epsilon_{\alpha}||_{2}\leq
c$, the fingerprint estimation problem

$\min_{\hat{\phi}}\quad\mathbb{E}_{\alpha\sim
p_{\alpha}}\left[\|g(w_{\hat{\phi}}(\hat{\alpha}(\alpha)))-g(w_{\phi}(\alpha))\|_{2}^{2}\right]$

has an error
$\epsilon_{\phi}=-(\sigma^{2}V^{T}\bar{H}_{\phi}V)^{-1}V^{T}\bar{H}_{\phi}U\epsilon_{\alpha}$.

Remarks: (1) Similar to the classic design of the experiment, one can reduce
$||\epsilon_{\phi}||$ by maximizing $det(V^{T}\bar{H}_{\phi}V)$, which sets
columns of $V$ as the eigenvectors associated with the largest $d_{\phi}$
eigenvalues of $\bar{H}_{\phi}$. However, $\bar{H}_{\phi}$ is neither
computable because $\phi$ is unknown during the estimation, nor is it
tractable because $J_{w_{\phi}(\alpha)}$ is large in practice. To this end, we
propose to use the covariance of $p_{w}$, denoted by $\Sigma_{w}$, to replace
$\bar{H}_{\phi}$ in experiments. In Appendix C, we support this approximation
empirically by showing that $\Sigma_{w}$ and $\bar{H}_{w}$ (the non-
fingerprinted mean Gram matrix) are qualitatively similar in that the
principal components of both matrices offer disentangled semantic dimensions.
(2) Let the $k$th largest eigenvalue of $\bar{H}_{w}$ be $\gamma_{k}$. By
setting columns of $V$ as the eigenvectors of $\bar{H}_{w}$ associated with
the largest $d_{\phi}$ eigenvalues, and by noting that $\hat{\phi}$ is
accurate only when all of its elements match with $\phi$ ((1)), the worst-case
estimation error is governed by $\gamma_{d_{\phi}}^{-1}$. This means that
higher key capacity, i.e., larger $d_{\phi}$, leads to worse attribution
accuracy. (3) From the proposition, $\epsilon_{\phi}=0$ if $V$ and $U$ are
complementary sets of eigenvectors of $\bar{H}_{\phi}$. In practice this
decoupling between $\epsilon_{\phi}$ and $\epsilon_{\alpha}$ cannot be
achieved due to the assumptions and approximations we made.

Generation quality. For analysis purpose, we approximate the original latent
distribution $p_{w}$ by $w=\mu+U\alpha+V\beta$ where
$\alpha\sim\mathcal{N}(0,diag(\lambda_{U}))$,
$\beta\sim\mathcal{N}(0,diag(\lambda_{V}))$, and $\mu=\mathbb{E}_{w\sim
p_{w}}[w]$. $\lambda_{U}\in\mathbb{R}^{d_{w}-d_{\phi}}$ and
$\lambda_{V}\in\mathbb{R}^{d_{\phi}}$ are calibrated to match $p_{w}$. Denote
$\lambda_{V,max}=\max_{i}\\{\lambda_{V,i}\\}$. A latent distribution
fingerprinted by $\phi$ is similarly approximated as
$w_{\phi}=\mu+U\alpha+\sigma V\phi$. With mild abuse of notation, let $g$ be
the mapping from the latent space to a feature space (usually defined by an
Inception network in FID) and is continuously differentiable. Let the mean and
covariance matrix of $w_{i}$ be $\mu_{i}$ and $\Sigma_{i}$, respectively.
Denote by
$\bar{H}_{U}=\mathbb{E}_{\alpha}[J_{\mu+U\alpha}^{T}J_{\mu+U\alpha}]$ the mean
Gram matrix in the subspace of $U$, and let $\gamma_{U,max}$ be the largest
eigenvalue of $\bar{H}_{U}$. We have the following proposition to upper bound
$||\mu_{0}-\mu_{1}||_{2}^{2}$ and $|tr(\Sigma_{0})-tr(\Sigma_{1})|$, both of
which are related to the FID score for measuring the generation quality (see
Appendix A.2 for proof):

######  Proposition 3.2.

For any $\tau>0$ and $\eta\in(0,1)$, $\exists~{}c(\tau,\eta)>0$ and $\nu>0$,
such that if $\sigma\leq c(\tau,\eta)$ and $\lambda_{V,i}\leq c(\tau,\eta)$
for all $i=1,...,d_{\phi}$, then
$\|\mu_{0}-\mu_{1}\|_{2}^{2}\leq\sigma^{2}\gamma_{U,max}d_{\phi}+\tau$ and
$|tr(\Sigma_{0}-\Sigma_{1})|\leq\lambda_{V,max}\gamma_{U,max}d_{\phi}+2\nu\sigma\sqrt{d_{\phi}}+\tau$
with probability at least $1-\eta$.

Remarks: Recall that for improving attribution accuracy, a practical approach
is to choose $V$ as eigenvectors associated with the largest eigenvalues of
$\Sigma_{w}$. Notices that with the approximated distribution with
$\alpha\sim\mathcal{N}(0,diag(\lambda_{U}))$ and
$\beta\sim\mathcal{N}(0,diag(\lambda_{V}))$,
$\Sigma_{w}=diag([\lambda_{U}^{T},\lambda_{V}^{T}]^{T})$. On the other hand,
from Proposition 3.2, generation quality improves if we minimize
$\lambda_{V,max}$ by choosing $V$ according to the smallest eigenvalues of
$\Sigma_{w}$. In addition, smaller key capacity ($d_{\phi}$) and lower
strength ($\sigma$) also improve the generation quality. Propositions 3.1 and
3.2 together reveal the intrinsic accuracy-quality tradeoff.

Figure 2: Visualization of fingerprints along minor and major principal
components of the covariance of the latent distribution. (Top) StyleGAN2.
(Bottom) Latent Diffusion Model (LDM).

##  4 Experiments

In this section, we present empirical evidence of the accuracy-quality
tradeoff and show an improved tradeoff from the previous SOTA by using latent
fingerprints. Experiments are conducted for both with and without a
combination of postprocesses including (image noising, blurring, and JPEG
compression, and their combination).

###  4.1 Experiment settings

Models, data, and metrics. We conduct experiments on SG2 (Karras et al., 2020)
and LDM (Rombach et al., 2022) models trained on various datasets including
FFHQ (Karras et al., 2019), AFHQ-Cat, and AFHQ-Dog (Choi et al., 2020).
Generation quality is measured by the Frechet Inception distance (FID) (Heusel
et al., 2017) and inception score (IS) (Salimans et al., 2016), attribution
accuracy by (1), and fingerprint secrecy by SSIM.

Latent fingerprint dimensions. To approximate $\Sigma_{w}$, we drew 10K
samples from $p_{w}$ for SG2, which has a semantic latent space dimensionality
of 512, and 50K samples from $p_{w}$ for LDM, which has a semantic latent
space dimensionality of 12,288. We define fingerprint dimensions $V$ as a
subset eigenvectors of $\Sigma_{w}$ associated with consecutive eigenvalues:
$V:=PC[i:j]$, where $PC$ is the full set of principal components of
$\Sigma_{w}$ sorted by their variances in the descending order while $i$ and
$j$ represent the starting and ending indices of the subset.

Attribution. To compute the empirical accuracy (Eq. (1)), we use 1K samples
drawn from $p_{z}$ for each fingerprint $\phi$, and use 1K fingerprints where
each bit is drawn independently from a Bernoulli distribution with $p=0.5$. In
Table 1, we show that both constraints on $\hat{\alpha}$ and parallel search
with 20 initial guesses improve the empirical attribution accuracy across
models and datasets. Notably, constrained estimation is essential for the
successful attribution of LDMs. In these experiments, $V$ is chosen as the
eigenvectors associated with the 64 smallest eigenvalues of $\Sigma_{w}$ as a
worst-case scenario for attribution accuracy.

###  4.2 Attribution performance without postprocessing

We present generation quality results in Table 1. Since the least variant
principal components are used as fingerprints, generation quality (FID) and
fingerprint secrecy (SSIM) are preserved.

The results suggest that the attribution accuracy, generation quality,
capacity ($2^{64}$), and fingerprint secrecy are all acceptable using the
proposed method. Fig. 2 visualizes and compares latent fingerprints generated
from small vs. large eigenvalues of $\Sigma_{w}$. Fingerprints corresponding
to small eigenvalues are non-semantic, while those to large eigenvalues create
semantic changes. We will later show that semantic yet subtle (perceptually
insignificant) fingerprints are necessary to counter image postprocesses.

Accuracy-quality tradeoff. Table 2 summarizes the tradeoff when we vary the
choice of $V$ and the fingerprint strength $\sigma$ while fixing the
fingerprint length $d_{\phi}$ to 64. Then in Table 3 we sweep $d_{\phi}$ while
keeping $V$ as PCs associated with smallest eigenvalues of $\Sigma_{w}$ and
$\sigma=1$. The experiments are conducted on SG2 and LDM on the FFHQ dataset.
The empirical results in Table 2 are consistent with our analysis: Accuracy
decreases while generation quality improves when $V$ is moved from major to
minor principal components. For fingerprint strength, however, we observe that
the positive effect of strength on the accuracy, as predicted by Proposition
3.1, is only limited to small $\sigma$. This is because larger $\sigma$ causes
pixel values to go out of bounds, causing loss of information. In Table 3, we
summarize the attribution accuracy, FID, and SSIM score under 32- to 128-bit
keys. Accuracy and generation quality, in particular the latter, are both
affected by $d_{\phi}$ as predicted.

Table 2:  Tradeoff between attribution accuracy (Att.) and generation quality (FID, IS) under different fingerprinting directions (PC) and strength ($\sigma$).  StyleGAN2 | $\sigma=0.6$ | $\sigma=1.0$ | $\sigma=6.0$
---|---|---|---
| Att. $\uparrow$ | FID $\downarrow$ | IS $\uparrow$ | Att. $\uparrow$ | FID $\downarrow$ | IS $\uparrow$ | Att. $\uparrow$ | FID $\downarrow$ | IS $\uparrow$
PC[0:64] | 0.99 | 129.0 | 1.23 | 0.99 | 110.8 | 1.59 | 0.99 | 101.3 | 4.31
PC[128:192] | 0.98 | 8.5 | 4.93 | 0.99 | 8.7 | 4.92 | 0.99 | 39.2 | 3.94
PC[256:320] | 0.98 | 8.6 | 4.96 | 0.99 | 9.1 | 4.87 | 0.96 | 31.1 | 3.90
PC[448:512] | 0.97 | 8.1 | 4.99 | 0.98 | 8.5 | 4.96 | 0.90 | 26.3 | 4.75
LDM | $\sigma=1.0$ | $\sigma=2.0$ | $\sigma=3.0$
| Att. $\uparrow$ | FID $\downarrow$ | IS $\uparrow$ | Att. $\uparrow$ | FID $\downarrow$ | IS $\uparrow$ | Att. $\uparrow$ | FID $\downarrow$ | IS $\uparrow$
PC[0:64] | 0.99 | 33.62 | 3.84 | 0.99 | 33.17 | 3.70 | 0.99 | 34.07 | 3.82
PC[1000:1064] | 0.77 | 13.32 | 4.37 | 0.99 | 13.75 | 4.40 | 0.99 | 16.03 | 4.35
PC[2000:2064] | 0.32 | 13.17 | 4.45 | 0.99 | 13.63 | 4.35 | 0.99 | 15.74 | 4.34
PC[3000:3064] | 0.12 | 12.98 | 4.43 | 0.97 | 13.61 | 4.45 | 0.99 | 15.44 | 4.48
PC[4000:4064] | 0.00 | 12.77 | 4.35 | 0.96 | 13.61 | 4.42 | 0.99 | 15.41 | 4.41
Table 3:  Attribution accuracy (Att.) and generation quality for different key lengths ($d_{\phi}$). FID-BL is the baseline FID score. $\uparrow$ ($\downarrow$) indicates higher (lower) is desired. The standard deviation of SSIM is in parentheses.  $d_{\phi}$ | Att. $\uparrow$ | FID-BL | FID $\downarrow$ | SSIM $\uparrow$ | IS $\uparrow$
---|---|---|---|---|---
32 | 0.982 | 7.24 | 8.49 | 0.96(0.01) | 4.90
64 | 0.983 | 7.24 | 8.59 | 0.92(0.02) | 4.96
96 | 0.981 | 7.24 | 9.50 | 0.90(0.02) | 4.93
128 | 0.973 | 7.24 | 9.61 | 0.87(0.03) | 4.91

###  4.3 Fingerprint performance with postprocessing

We now consider more realistic scenarios where generated images are
postprocessed, either maliciously as an attempt to remove the fingerprints or
unintentionally, before they are attributed. Under this setting, our method
achieves better accuracy-quality tradeoff than shallow fingerprinting under
two realistic settings: (1) when noising and JPEG compression are used as
unknown postprocesses, and (2) when the set of postprocesses, rather than the
ones that are actually chosen, is known.

Postprocesses. To keep our solution realistic, we solve the attribution
problem by assuming that the potential postprocesses are unknown:

$\displaystyle\min_{\hat{\alpha},\hat{\phi}}$ $\displaystyle
l\left(g(w_{\hat{\phi}}(\hat{\alpha})),T(g(w_{\phi}(\alpha)))\right)$
$\displaystyle s.t.$
$\displaystyle\hat{\alpha}_{i}\in[\alpha_{l,i},\alpha_{u,i}],\quad\forall
i=1,...,d_{w}-d_{\phi}.$

where $T:R^{d_{x}}\rightarrow R^{d_{x}}$ is a postprocess function, and
$T(g(w_{\phi}(\alpha)))$ is a given image from which the fingerprint is to be
estimated. We assume that $T$ does not change the image in a semantically
meaningful way, because otherwise the value of the image for either an
attacker or a benign user will be lost. Since our method adds semantically
meaningful perturbations to the images, we expect such latent fingerprints to
be more robust to postprocesses than shallow ones (Kim et al., 2021) added
directly to images and will lead to improved attribution accuracy. To test
this hypothesis, we consider four types of postprocesses: Noising, Blurring,
JPEG, and Combo. Noising adds a Gaussian white noise of standard deviation
randomly sample from $U$[0, 0.1]. Blurring uses a randomly selected Gaussian
kernel size from [3, 7, 9, 16, 25] and a standard deviation of [0.5, 1.0, 1.5,
2.0]. We randomly sample the JPEG quality from [80, 70, 60, 50]. These
parameters are chosen to be mild so that images do not lose their semantic
contents. And Combo randomly chooses a subset of the three through a binomial
distribution with $p=0.5$ and uses the same postprocess parameters.

Table 4: Comparison on accuracy-quality tradeoff between proposed and baseline methods under image postprocesses. The experiments are tested using StyleGAN2-FFHQ. Fingerprinting strength $\sigma=3$. The FID score of the baseline method is 96.24. KN (UK) stands for when attribution accuracy is measured with (without) the knowledge of the attack. The standard deviation is in parentheses. Metric | Model | Blurring | Noising | JPEG | Combo
---|---|---|---|---|---
- | - | UK | KN | UK | KN | UK | KN | UK | KN
Att. $\uparrow$ | BL (Kim et al., 2021) | 0.85 | 0.88 | 0.85 | 0.87 | 0.87 | 0.89 | 0.83 | 0.88
PC[0:32] | 0.79 | 0.99 | 0.99 | 0.99 | 0.98 | 0.99 | 0.82 | 0.99
PC[16:48] | 0.56 | 0.92 | 0.95 | 0.99 | 0.98 | 0.99 | 0.42 | 0.88
| PC[32:64] | 0.32 | 0.83 | 0.93 | 0.98 | 0.98 | 0.99 | 0.26 | 0.79
SSIM $\uparrow$ | BL (Kim et al., 2021) | 0.67(0.08) | 0.68(0.07) | 0.67(0.07) | 0.66(0.06)
PC[0:32] | 0.27(0.04) | 0.27(0.04) | 0.27(0.04) | 0.27(0.04)
PC[16:48] | 0.40(0.08) | 0.40(0.08) | 0.40(0.08) | 0.40(0.08)
| PC[32:64] | 0.56(0.07) | 0.56(0.07) | 0.56(0.07) | 0.56(0.07)
IS $\uparrow$ | BL (Kim et al., 2021) | 2.86 | 3.02 | 2.91 | 2.90
PC[0:32] | 2.93 | 2.93 | 2.93 | 2.93
PC[16:48] | 4.35 | 4.35 | 4.35 | 4.35
| PC[32:64] | 4.50 | 4.50 | 4.50 | 4.50
FID $\downarrow$ | BL (Kim et al., 2021) | 99.05 | 93.04 | 97.70 | 100.15
PC[0:32] | 102.26 | 102.26 | 102.26 | 102.26
PC[16:48] | 31.25 | 31.25 | 31.25 | 31.25
| PC[32:64] | 27.50 | 27.50 | 27.50 | 27.50
Table 5:  Accuracy-quality tradeoff under Combo attack. $V$ is defined as the 8, 16, and 32 eigenvectors of $\Sigma_{w}$ starting from the 33rd eigenvectors. $\sigma=3$. KN (UK) stands for when attribution accuracy is measured with (without) knowledge of attacks. The standard deviation is in parentheses.  Model | Key length | UK | KN | SSIM $\uparrow$ | IS $\uparrow$ | FID$\downarrow$
---|---|---|---|---|---|---
BL (Kim et al., 2021) | N/A | 0.83 | 0.88 | 0.66(0.06) | 2.90 | 100.15
PC[32:40] | 8 | 0.65 | 0.89 | 0.73(0.06) | 4.75 | 12.35
PC[32:48] | 16 | 0.45 | 0.85 | 0.65(0.06) | 4.86 | 13.25
PC[32:64] | 32 | 0.26 | 0.79 | 0.57(0.07) | 4.50 | 27.50
Figure 3: Comparison on generation quality between our method and the baseline
with similar attribution accuracy The first row shows original images
generated without fingerprinting. Each image in the second row represent
robustly fingerprinted images against corresponding post-processes. The next
row illustrates post-processed images. The last row depicts the differences
between the original (the first row) and fingerprinted images (the second row)
using a heat map. Even if our method shows large pixel value changes, the
fingerprints are not perceptible compared with the baseline method (see second
row).

Modified LPIPS metric. In addition to testing the worst-case scenario where
postprocesses are completely unknown, we also consider cases where they are
known. While this is unrealistic for individual postprocesses, it is worth
investigating when we assume that the set of postprocesses, rather than the
ones that are actually chosen, is known. Within this scenario, we show that
modifying LPIPS according to the postprocess improves the attribution
accuracy. To explain, LPIPS is originally trained on a so-called “two
alternative forced choice” (2AFC) dataset. Each data point of 2AFC contains
three images: a reference, $p_{0}$, and $p_{1}$, where $p_{0}$ and $p_{1}$ are
distorted in different ways based on the reference. A human evaluator then
ranks $p_{0}$ and $p_{1}$ by their similarity to the reference. Here we
propose the following modification to the dataset for training postprocess-
specific metrics: Similar to 2AFC, for each data point, we draw a reference
image $x$ from the default generative model to be fingerprinted and define
$p_{0}$ as the fingerprinted version of $x$. $p_{1}$ is then a postprocessed
version of $x$ given a specific $T$ (or random combinations for Combo). To
match with the setting of 2AFC, we sample 64 $\times$ 64 patches from $x$,
$p_{0}$, and $p_{1}$ as training samples. We then rank patches from $p_{1}$ as
being more similar to those of $x$ than $p_{0}$. With this setting, the
resulting LPIPS metric becomes more sensitive to fingerprints than mild
postprocesses. The detailed training of the modified LPIPS follows the vgg-lin
configuration in (Zhang et al., 2018). It should be noted that, unlike
previous SOTA where shallow fingerprint (Kim et al., 2021) or encoder-decoder
models (Yu et al., 2020) are retrained based on the known attacks, our
fingerprinting mechanism, and therefore generalization performance, are
agnostic to postprocesses.

Accuracy-quality tradeoff. We summarize fingerprint performance metrics on SG2
and FFHQ in Table 4. The attribution accuracies reported here are estimated
using the strongest parameters of each attack. For Combo, we use sequentially
apply Blurring+Noising+JPEG as a deterministic worst-case attack. To estimate
attribution accuracy, we solved the estimation problem in (4.3) where
postprocesses are applied. The proposed method: We choose $V$ as a subset of
32 consecutive eigenvectors of $\Sigma_{w}$ starting from the 1th, 17th, and
33th eigenvectors, denoted respectively by PC[0:32], PC[16:48], and PC[32:64]
in the table. fingerprinting strength $\sigma$ is set to 3. Attribution
results from both a standard and a postprocess-specific LPIPS metric are
reported in the UK (unknown) and KN (known) columns, respectively. Accuracies
for our method are computed based on 100 random fingerprint samples from
$2^{32}$, each with 100 random generations. The baseline: We compare with a
shallow fingerprinting method from (Kim et al., 2021) (denoted by BL). When
the postprocesses are known, BL performs postprocess-specific computation to
derive shallow fingerprints that are optimally robust against the known
postprocess. Results in UK and KN columns for BL are respectively without and
with the postprocess-specific fingerprint computation. BL accuracies are
computed based on 10 fingerprints, each with 100 random generations.

It is worth noting that the shallow fingerprinting method is not as scalable
as ours (See Appendix: D, and increasing the key capacity decreases the
overall attribution accuracy (see (Kim et al., 2021)). Also, recall that the
key length affects attribution accuracy (Proposition 1). Therefore, we conduct
a fairer comparison to highlight the advantage of our method. Here we choose a
subset of fingerprints $PC[32:40]$ (256 fingerprints) and report performance
in Table 5, where accuracies are computed using the same settings as before.
Visual comparisons between our method ($PC[32:40]$) and the baseline can be
found in Fig. 3: To maintain attribution accuracy, high-strength shallow
fingerprints, in the form of color patches, are needed around eyes and noses,
and significantly lower the generation quality. In comparison, our method uses
semantic changes that are robust to postprocesses. The choice of semantic
dimensions, however, needs to be carefully chosen for the fingerprint to be
perceptually subtle.

Fingerprint secrecy. The secrecy of the fingerprint is evaluated through the
SSIM which is designed to measure the similarity between two images by taking
into account three components: loss of correlation, luminance distortion, and
contrast distortion (Wang et al., 2004). To facilitate a more equitable
comparison between our methodology and the baseline, we select a subset of
fingerprints presented in Table 5 for evaluation. As shown in Table 5, the
robustly fingerprinted model for $PC[32:40]$ exhibits superior fingerprint
secrecy compared to the baseline, while simultaneously outperforming it in
attribution accuracy. Besides these quantitative measures, our approach also
demonstrates a qualitative advantage in terms of secrecy when compared to the
baseline (see Fig. 3). This is largely attributed to the fact that subtle
semantic variations across images are more challenging to visually detect and
thus being removed compared to typical artifacts introduced by shallow
fingerprinting.

##  5 Conclusion

This paper investigated latent fingerprint as a solution to enable the
attribution of generative models. Our solution achieved a better tradeoff
between attribution accuracy and generation quality than the previous SOTA
that uses shallow fingerprints, and also has extremely low computational cost
compared to SOTA methods that require encoder-decoder training with high data
complexity, rendering our method more scalable to attributing large models
with high-dimensional latent spaces.
Limitations and future directions: (1) There is currently a lack of
certification on attribution accuracy due to the nonlinear nature of both the
fingerprinting and the fingerprint estimation processes. Formally, by
considering both the generation and estimation processes as discrete-time
dynamics, such certification would require forward reachability analysis of
fingerprinted contents and backward reachability analysis of the fingerprint,
e.g., convex approximation of the support of $p_{x,i}$ and $\hat{\phi}$. It is
worth investigating whether existing neural net certification methods can be
applied. (2) Our method extracts fingerprints from the training data. Even
with feature decomposition, the amount of features that can be used as
fingerprints is limited. Thus the accuracy-quality tradeoff is governed by the
data. It would be interesting to see if auxiliary datasets can help to learn
novel and perceptually insignificant fingerprints that are robust against
postprocesses, e.g., background patterns.

##  6 Acknowledgment

This work is partially supported by the National Science Foundation under
Grant No. 2038666 and No. 2101052 and by an Amazon AWS Machine Learning
Research Award (MLRA). Any opinions, findings, and conclusions expressed in
this material are those of the author(s) and do not reflect the views of the
funding entities.

## References

  * Abdal et al. (2019) Abdal, R., Qin, Y., and Wonka, P.  Image2stylegan: How to embed images into the stylegan latent space?  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , pp. 4432–4441, 2019.
  * Bau et al. (2019) Bau, D., Zhu, J.-Y., Wulff, J., Peebles, W., Strobelt, H., Zhou, B., and Torralba, A.  Inverting layers of a large generator.  In _ICLR Workshop_ , volume 2, pp. 4, 2019.
  * Breland (2019) Breland, A.  The bizarre and terrifying case of the “deepfake” video that helped bring an african nation to the brink.  _motherjones_ , Mar 2019.  URL https://www.motherjones.com/politics/2019/03/deepfake-gabon-ali-bongo/.
  * Brockman et al. (2020) Brockman, G., Murati, M., Welinder, P., and OpenAI.  Openai api, 2020.  URL https://openai.com/blog/openai-api/.
  * Choi et al. (2020) Choi, Y., Uh, Y., Yoo, J., and Ha, J.-W.  Stargan v2: Diverse image synthesis for multiple domains.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pp. 8188–8197, 2020.
  * Härkönen et al. (2020) Härkönen, E., Hertzmann, A., Lehtinen, J., and Paris, S.  Ganspace: Discovering interpretable gan controls.  _Advances in Neural Information Processing Systems_ , 33:9841–9850, 2020.
  * Hawthorne et al. (2022) Hawthorne, C., Simon, I., Roberts, A., Zeghidour, N., Gardner, J., Manilow, E., and Engel, J.  Multi-instrument music synthesis with spectrogram diffusion.  _arXiv preprint arXiv:2206.05408_ , 2022.
  * Heusel et al. (2017) Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., and Hochreiter, S.  Gans trained by a two time-scale update rule converge to a local nash equilibrium.  In _Advances in Neural Information Processing Systems_ , pp. 6626–6637, 2017.
  * Huh et al. (2020) Huh, M., Zhang, R., Zhu, J.-Y., Paris, S., and Hertzmann, A.  Transforming and projecting images into class-conditional generative networks.  In _European Conference on Computer Vision_ , pp. 17–34. Springer, 2020.
  * Karras et al. (2019) Karras, T., Laine, S., and Aila, T.  A style-based generator architecture for generative adversarial networks.  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , pp. 4401–4410, 2019.
  * Karras et al. (2020) Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., and Aila, T.  Analyzing and improving the image quality of stylegan.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pp. 8110–8119, 2020.
  * Kim et al. (2021) Kim, C., Ren, Y., and Yang, Y.  Decentralized attribution of generative models.  In _International Conference on Learning Representations_ , 2021.  URL https://openreview.net/forum?id=_kxlwvhOodK.
  * Mishkin & Ahmad (2022) Mishkin, P. and Ahmad, L.  Dall·e 2 preview - risks and limitations, 2022.  URL https://github.com/openai/dalle-2-preview/blob/main/system-card.md.
  * Perarnau et al. (2016) Perarnau, G., Van De Weijer, J., Raducanu, B., and Álvarez, J. M.  Invertible conditional gans for image editing.  _arXiv preprint arXiv:1611.06355_ , 2016.
  * Radford et al. (2019) Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., and Sutskever, I.  Language models are unsupervised multitask learners.  2019\.
  * Ramesh et al. (2021) Ramesh, A., Pavlov, M., Goh, G., Gray, S., Voss, C., Radford, A., Chen, M., and Sutskever, I.  Zero-shot text-to-image generation.  In _International Conference on Machine Learning_ , pp. 8821–8831. PMLR, 2021.
  * Ramesh et al. (2022) Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M.  Hierarchical text-conditional image generation with clip latents.  _arXiv preprint arXiv:2204.06125_ , 2022.
  * Rombach et al. (2022) Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B.  High-resolution image synthesis with latent diffusion models.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , pp. 10684–10695, June 2022.
  * Salimans et al. (2016) Salimans, T., Goodfellow, I., Zaremba, W., Cheung, V., Radford, A., and Chen, X.  Improved techniques for training gans.  In _Advances in neural information processing systems_ , pp. 2234–2242, 2016.
  * Satter (2019) Satter, R.  Experts: Spy used ai-generated face to connect with targets.  _Experts: Spy used AI-generated face to connect with targets_ , Jun 2019.  URL https://apnews.com/bc2f19097a4c4fffaa00de6770b8a60d.
  * Wang et al. (2004) Wang, Z., Bovik, A., Sheikh, H., and Simoncelli, E.  Image quality assessment: from error visibility to structural similarity.  _IEEE Transactions on Image Processing_ , 13(4):600–612, 2004.  doi: 10.1109/TIP.2003.819861.
  * Xia et al. (2022) Xia, W., Zhang, Y., Yang, Y., Xue, J.-H., Zhou, B., and Yang, M.-H.  Gan inversion: A survey.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 2022.
  * Yu et al. (2018) Yu, N., Davis, L., and Fritz, M.  Attributing fake images to gans: Analyzing fingerprints in generated images.  _arXiv preprint arXiv:1811.08180_ , 2018.
  * Yu et al. (2020) Yu, N., Skripniuk, V., Chen, D., Davis, L., and Fritz, M.  Responsible disclosure of generative models using scalable fingerprinting.  _arXiv preprint arXiv:2012.08726_ , 2020.
  * Zhang et al. (2018) Zhang, R., Isola, P., Efros, A. A., Shechtman, E., and Wang, O.  The unreasonable effectiveness of deep features as a perceptual metric.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 586–595, 2018.
  * Zhu et al. (2021) Zhu, J., Feng, R., Shen, Y., Zhao, D., Zha, Z.-J., Zhou, J., and Chen, Q.  Low-rank subspaces in gans.  _Advances in Neural Information Processing Systems_ , 34:16648–16658, 2021.

##  Appendix A Proof of Propositions

###  A.1 Proposition 1

Define $J_{w}=\nabla g(w)$, $H_{w}=J_{w}^{T}J_{w}$, and
$\bar{H}_{\phi}=\mathbb{E}_{\alpha\sim p_{\alpha}}[H_{U\alpha+\sigma V\phi}]$,
where $p_{\alpha}$ is induced by $p_{w}$. Let $x_{\phi}(\alpha)$ be a content
parameterized by $(\alpha,\phi)$. Denote by $\epsilon_{a}=\hat{a}-a$ the
estimation error from the ground truth parameter $a$. Assume that the estimate
$\hat{\alpha}(\alpha)$ is computed independent from $\phi$, and
$\epsilon_{\alpha}$ is constant. Proposition 1 states:

Proposition 1. $\exists c>0$ such that if $\sigma\leq c$ and
$||\epsilon_{\alpha}||_{2}\leq c$, the fingerprint estimation problem

$\min_{\hat{\phi}}\quad\mathbb{E}_{\alpha\sim
p_{\alpha}}\left[\|g(U\hat{\alpha}(\alpha)+\sigma
V\hat{\phi})-x_{\phi}(\alpha)\|_{2}^{2}\right]$ (3)

has an estimation error

$\epsilon_{\phi}=-(\sigma^{2}V^{T}\bar{H}_{\phi}V)^{-1}V^{T}\bar{H}_{\phi}U\epsilon_{\alpha}.$

###### Proof.

Let $\hat{x}:=g(U\hat{\alpha}_{\phi}(\alpha)+\sigma V\hat{\phi})$, we have

$\hat{x}=g(U\hat{\alpha}+\sigma
V\hat{\phi})=g(U(\alpha+\epsilon_{\alpha})+\sigma V(\phi+\epsilon_{\phi})).$

With Taylor’s expansion, we have

$\displaystyle\hat{x}$ $\displaystyle=g(U\alpha+\sigma
V\phi)+J_{w}(U\epsilon_{\alpha}+\sigma
V\epsilon_{\phi})+o(U\epsilon_{\alpha}+\sigma V\epsilon_{\phi})$
$\displaystyle=x_{\phi}(\alpha)+J_{w}(U\epsilon_{\alpha}+\sigma
V\epsilon_{\phi})+o(U\epsilon_{\alpha}+\sigma V\epsilon_{\phi}).$

Ignoring higher-order terms and , we then have

$\displaystyle\|x_{\phi}(\alpha)-\hat{x}\|_{2}^{2}$
$\displaystyle=\|J_{w}(U\epsilon_{\alpha}+\sigma
V\epsilon_{\phi})+o(U\epsilon_{\alpha}+\sigma V\epsilon_{\phi})\|_{2}^{2}$
$\displaystyle=\|J_{w}(U\epsilon_{\alpha}+\sigma
V\epsilon_{\phi})\|_{2}^{2}+o(U\epsilon_{\alpha}+\sigma
V\epsilon_{\phi})^{T}J_{w}(U\epsilon_{\alpha}+\sigma V\epsilon_{\phi}).$

For any $\tau>0$, there exists $c$, such that if $\sigma\leq c$ and
$||\epsilon_{\alpha}||_{2}\leq c$,

$\displaystyle\|x_{\phi}(\alpha)-\hat{x}\|_{2}^{2}$
$\displaystyle\leq\|J_{w}(U\epsilon_{\alpha}+\sigma
V\epsilon_{\phi})\|_{2}^{2}+\tau$
$\displaystyle=\sigma^{2}\epsilon_{\phi}^{T}V^{T}H_{w}V\epsilon_{\phi}+2\epsilon_{\phi}^{T}V^{T}H_{w}U\epsilon_{\alpha}+\epsilon_{\alpha}^{T}U^{T}H_{w}U\epsilon_{\alpha}+\tau.$

Removing terms independent from $\epsilon_{\phi}$ to reformulate (3) as

$\min_{\epsilon_{\phi}}\quad\sigma^{2}\epsilon_{\phi}^{T}V^{T}\bar{H}_{\phi}V\epsilon_{\phi}+2\epsilon_{\phi}^{T}V^{T}\bar{H}_{\phi}U\epsilon_{\alpha},$

the solution of which is

$\epsilon_{\phi}=-(\sigma^{2}V^{T}\bar{H}_{\phi}V)^{-1}V^{T}\bar{H}_{\phi}U\epsilon_{\alpha}.$

∎

###  A.2 Proposition 2

Consider two distributions: The first is $w_{0}=\mu+U\alpha+V\beta$ where
$\mu\in\mathbb{R}^{d_{w}}$, $\alpha\sim\mathcal{N}(0,diag(\lambda_{U}))$, and
$\beta\sim\mathcal{N}(0,diag(\lambda_{V}))$. $diag(\lambda)$ is a diagonal
matrix where diagonal elements follow $\lambda$. The second distribution is
$w_{1}=\mu+U\alpha+\sigma V\phi$ where $\sigma>0$ and
$\phi\in\\{0,1\\}^{d_{\phi}}$. Let
$g:\mathbb{R}^{d_{w}}\rightarrow\mathbb{R}^{d_{x}}\in C^{1}$. Let the mean and
covariance matrix of $w_{i}$ be $\mu_{i}$ and $\Sigma_{i}$. Denote by
$\bar{H}_{U}=\mathbb{E}_{\alpha}[J_{\mu+U\alpha}^{T}J_{\mu+U\alpha}]$ the mean
Gram matrix, and let $\gamma_{U,max}$ be the largest eigenvalue of
$\bar{H}_{U}$. Proposition 2 states:

Proposition 2. For any $\tau>0$ and $\eta\in(0,1)$, there exists
$c(\tau,\eta)>0$ and $\nu>0$, such that if $\sigma\leq c(\tau,\eta)$ and
$\lambda_{V,i}\leq c(\tau,\eta)$ for all $i=1,...,d_{\phi}$,
$\|\mu_{0}-\mu_{1}\|_{2}^{2}\leq\sigma^{2}\gamma_{U,max}d_{\phi}+\tau$ and
$|tr(\Sigma_{0}-\Sigma_{1})|\leq\lambda_{V,max}\gamma_{U,max}d_{\phi}+2\nu\sigma\sqrt{d_{\phi}}+\tau$
with probability at least $1-\eta$.

###### Proof.

We start with $\|\mu_{0}-\mu_{1}\|_{2}^{2}$. From Taylor’s expansion and using
the independence between $\alpha$ and $\beta$, we have

$\displaystyle\mu_{0}:=$
$\displaystyle\mathbb{E}_{\alpha,\beta}\left[g(\mu+U\alpha+V\beta)\right]$ (4)
$\displaystyle=$
$\displaystyle\mathbb{E}_{\alpha}\left[g(\mu+U\alpha)\right]+\mathbb{E}_{\alpha,\beta}\left[J_{\mu+U\alpha}V\beta+o(J_{\mu+U\alpha}V\beta)\right]+$
$\displaystyle=$
$\displaystyle\mathbb{E}_{\alpha}\left[g(\mu+U\alpha)\right]+\mathbb{E}_{\alpha,\beta}\left[o(J_{\mu+U\alpha}V\beta)\right],$
$\displaystyle\mu_{1}:=$
$\displaystyle\mathbb{E}_{\alpha}\left[g(\mu+U\alpha+\sigma V\phi)\right]$
$\displaystyle=$
$\displaystyle\mathbb{E}_{\alpha}\left[g(\mu+U\alpha)+o(\sigma
J_{\mu+U\alpha}V\phi)\right]+\sigma\mathbb{E}_{\alpha}\left[J_{\mu+U\alpha}V\phi\right]$
$\displaystyle=$
$\displaystyle\mu_{0}+\sigma\mathbb{E}_{\alpha}\left[J_{\mu+U\alpha}V\phi\right]+\mathbb{E}_{\alpha,\beta}\left[o(J_{\mu+U\alpha}V(\sigma\phi-\beta))\right].$

Let $v=V\phi$. With orthonormal $V$ and binary-coded $\phi$, we have

$\|v\|_{2}^{2}=\phi^{T}V^{T}V\phi=\|\phi\|_{2}^{2}\leq d_{\phi}.$ (5)

For the residual term
$\|\mathbb{E}_{\alpha,\beta}\left[o(J_{\mu+U\alpha}V(\sigma\phi-\beta))\right]\|_{2}^{2}$
and any $\tau>0$ and $\eta\in(0,1)$, there exists $c(\tau,\eta)>0$, such that
if $\sigma\leq c(\tau,\eta)$ and $\lambda_{V,i}\leq c(\tau,\eta)$ for all
$i=1,...,d_{\phi}$, we have

$\Pr\left(\|\mathbb{E}_{\alpha,\beta}\left[o(J_{\mu+U\alpha}V(\sigma\phi-\beta))\right]\|_{2}^{2}\leq\tau\right)\geq
1-\eta.$ (6)

Lastly, we have

$\displaystyle\|\mathbb{E}_{\alpha}[J_{\mu+U\alpha}v]\|_{2}^{2}$
$\displaystyle\leq\mathbb{E}_{\alpha}[v^{T}J_{\mu+U\alpha}^{T}J_{\mu+U\alpha}v]$
(7)
$\displaystyle=v^{T}\bar{H}_{U}v\leq\gamma_{U,max}\|v\|_{2}^{2}\leq\gamma_{U,max}d_{\phi}.$

Then combining (11), (5), (6), (7), we have with probability at least $1-\eta$

$\|\mu_{0}-\mu_{1}\|_{2}^{2}\leq\sigma^{2}\gamma_{U,max}d_{\phi}+\tau.$ (8)

For covariances, let $\Sigma_{U}=Cov(g(\mu+U\alpha))$. We have

$\displaystyle\Sigma_{0}:=$
$\displaystyle\mathbb{E}_{\alpha,\beta}\left[(g(\mu+U\alpha+V\beta)-\mu_{0})(g(\mu+U\alpha+V\beta)-\mu_{0})^{T}\right]$
(9) $\displaystyle=$
$\displaystyle\Sigma_{U}+\mathbb{E}_{\alpha}\left[J_{\mu+U\alpha}Vdiag(\lambda_{V})V^{T}J_{\mu+U\alpha}^{T}\right]+\mathbb{E}_{\alpha,\beta}\left[o(J_{\mu+U\alpha}V\beta)(g(\mu+U\alpha+V\beta)-\mu_{0})^{T}\right]$
$\displaystyle\Sigma_{1}:=$
$\displaystyle\mathbb{E}_{\alpha}\left[(g(\mu+U\alpha+\sigma
V\phi)-\mu_{1})(g(\mu+U\alpha+\sigma V\phi)-\mu_{1})^{T}\right]$
$\displaystyle=$
$\displaystyle\Sigma_{U}+\sigma^{2}Cov(J_{\mu+U\alpha}V\phi^{*})+2\sigma
Cov(g(\mu+U\alpha),J_{\mu+U\alpha}V\phi+o(J_{\mu+U\alpha}V\phi)).$

For $tr(\Sigma_{0})$, using the same treatment for the residual, we have for
any $\tau>0$ and $\eta\in(0,1)$, there exists $c(\tau,\eta)>0$, such that if
$\lambda_{V,i}\leq c(\tau,\eta)$ for all $i=1,...,d_{\phi}$, the following
upper bound applies with at least probability $1-\eta$:

$\displaystyle tr(\Sigma_{0})$ $\displaystyle\leq
tr(\Sigma_{U})+tr(\mathbb{E}_{\alpha}\left[J_{\mu+U\alpha}Vdiag(\lambda_{V})V^{T}J_{\mu+U\alpha}^{T}\right])+\tau$
(10) $\displaystyle\leq
tr(\Sigma_{U})+\lambda_{V,max}tr(\mathbb{E}_{\alpha}\left[J_{\mu+U\alpha}VV^{T}J_{\mu+U\alpha}^{T}\right])+\tau$
$\displaystyle=tr(\Sigma_{U})+\lambda_{V,max}tr(\mathbb{E}_{\alpha}\left[V^{T}J_{\mu+U\alpha}^{T}J_{\mu+U\alpha}V\right])+\tau$
$\displaystyle\leq
tr(\Sigma_{U})+\lambda_{V,max}\gamma_{U,max}tr(V^{T}V)+\tau$
$\displaystyle\leq tr(\Sigma_{U})+\lambda_{V,max}\gamma_{U,max}d_{\phi}+\tau.$

For the lower bound, we have $tr(\Sigma_{0})\geq tr(\Sigma_{U})$.

For $tr(\Sigma_{1})$, we first denote by $J_{i}^{T}$ the $i$th row of
$J_{\mu+U\alpha}$, $\Sigma_{J_{i}}$ its covariance matrix, and
$\sigma_{i}^{2}$ the maximum eigenvalue of $\Sigma_{J_{i}}$. Then with binary-
coded $\phi$, we have

$Var(J_{i}^{T}V\phi)=\phi^{T}V^{T}Cov(J_{i})V\phi\leq\sigma_{i}^{2}d_{\phi}.$
(11)

Then let $g_{i}$ (resp. $v_{i}$) be the $i$th element of $g(\mu+U\alpha)$
(resp. $J_{\mu+U\alpha}V\phi$), and $\sigma_{U,i}^{2}$ be the $i$th diagonal
element of $\Sigma_{U}$. Using (11), we have the following bound on the trace
of the covariance between $g(\mu+U\alpha)$ and $J_{\mu+U\alpha}V\phi$:

$\left|tr(Cov(g(\mu+U\alpha),J_{\mu+U\alpha}V\phi))\right|=\left|\sum_{i=1}^{d_{x}}Cov(g_{i},v_{i})\right|\leq\sum_{i=1}^{d_{x}}\sigma_{U,i}\sigma_{i}\sqrt{d_{\phi}}.$
(12)

Lastly, by ignoring $\sigma^{2}$ terms and borrowing the same $\tau$, $\eta$,
and $c(\tau,\eta)$, we have with probability at least $1-\eta$:

$\displaystyle tr(\Sigma_{1})$ $\displaystyle\leq tr(\Sigma_{U})+2\sigma
tr(Cov(g(\mu+U\alpha),J_{\mu+U\alpha}V\phi))+\tau$ (13) $\displaystyle\leq
tr(\Sigma_{U})+2\sigma\sum_{i=1}^{d_{x}}\sigma_{U,i}\sigma_{i}\sqrt{d_{\phi}}+\tau,$

and

$tr(\Sigma_{1})\geq
tr(\Sigma_{U})-2\sigma\sum_{i=1}^{d_{x}}\sigma_{U,i}\sigma_{i}\sqrt{d_{\phi}}.$
(14)

Therefore, with probability at least $1-\eta$

$tr(\Sigma_{0})-tr(\Sigma_{1})\leq\lambda_{V,max}\gamma_{U,max}d_{\phi}+2\sigma\sum_{i=1}^{d_{x}}\sigma_{U,i}\sigma_{i}\sqrt{d_{\phi}}+\tau,$
(15)

and

$tr(\Sigma_{0})-tr(\Sigma_{1})\geq-2\sigma\sum_{i=1}^{d_{x}}\sigma_{U,i}\sigma_{i}\sqrt{d_{\phi}}-\tau.$
(16)

∎

##  Appendix B Convergence on $\alpha$

In the proofs, we assume that $\|\epsilon_{\alpha}\|_{2}$ is small and
constant. Here we show empirical estimation results on SG2 and on FFHQ, AFHQ-
DOG, AFHQ-CAT datasets. The results in Fig. 4(a) are averaged over 100 random
$\alpha$ and 100 random $\phi$, and uses parallel search on $\alpha$ during
the estimation.

Figure 4: (a) Average percentage error rate on $\alpha$ (b) Comparison between
fingerprints guided by $\Sigma_{w}$ and $\bar{H}_{w}$. The editing strength
for top two rows and bottom two rows are 0.05 and 0.2 respectively.

##  Appendix C Qualitative similarity between $\bar{H}_{w}$ and $\Sigma_{w}$

Since computing $\bar{H}_{w}$ for large models is intractable, here we train a
SG2 on MNIST to estimate $\bar{H}_{w}$. Fig. 4(b) summarizes perturbed images
from a randomly chosen reference along principal components of $\bar{H}_{w}$
and $\Sigma_{w}$. Note that both have quickly diminishing eigenvalues.
Therefore most components other than the few major ones lead to imperceptible
changes in the image space.

##  Appendix D Computational Complexity and Efficiency Comparison of Proposed
and Baseline Methods

To comprehensively evaluate the computational costs of the proposed and
baseline methods, we analyzed them from two perspectives: fingerprint
generation and attribution. Our proposed method demonstrates a significant
increase in efficiency compared to existing methods with regards to
fingerprint generation. However, current methods, such as those proposed in
(Kim et al., 2021), often necessitate a considerable amount of time for fine-
tuning the model before generating a fingerprinted image. For instance, the
baseline method requires approximately one hour to fine-tune the model for
each individual user. For a key capacity of $2^{32}$ users, it would take an
estimated $2^{32}$ hours to train on an NVIDIA V100 GPU. In contrast, our
proposed method does not require the model to be fine-tuned, and only requires
Principal Component Analysis (PCA) to be performed on the latent space of each
pre-trained model to identify the editing direction. This process takes
approximately three seconds for a key capacity of $2^{32}$.

Regarding attribution time, the baseline approach performs attribution through
a pre-trained network, resulting in low computation cost during inference. On
the other hand, the proposed method uses optimization techniques to perform
attribution, resulting in a longer computation time. Specifically, the average
attribution time for the baseline method is approximately two seconds, while
the proposed method takes approximately 126 seconds on average for 1k
optimization trials (in parallel) using an NVIDIA V100 GPU.

It is important to acknowledge that there exists a trade-off between
computational costs during generation and attribution. The choice of which
aspect is more critical may depend on the specific application requirements.

##  Appendix E Ablation Study

In this section, we estimated attribution accuracy based on various attack
parameters with multiple editing directions (see Tab.6,7,8,9). The image
quality evaluation is available in Tab.10 and more visualizations can be found
in Fig.5.

Table 6:  Attributability Table of Blurring attack. $\sigma$ refers standard deviation of Gaussian Blur filter size 25. When attributability is measured with (without) knowledge of attack, we put results under KN (UK).  Metric | Model |  $\sigma$=0.5 |  $\sigma$=1.0 |  $\sigma$=1.5 |  $\sigma$=2.0
---|---|---|---|---|---
- | - | UK | KN | UK | KN | UK | KN | UK | KN
Att. $\uparrow$ | BL | 0.88 | 0.89 | 0.87 | 0.89 | 0.87 | 0.88 | 0.85 | 0.88
PC[32:40] | 0.99 | 0.99 | 0.95 | 0.99 | 0.90 | 0.99 | 0.53 | 0.92
PC[32:48] | 0.99 | 0.99 | 0.97 | 0.99 | 0.72 | 0.92 | 0.38 | 0.88
PC[32:64] | 0.99 | 0.99 | 0.73 | 0.94 | 0.51 | 0.90 | 0.32 | 0.83
Table 7:  Attributability Table of Noise attack. $\sigma$ refers standard deviation of Gaussian normal distribution. When attributability is measured with (without) knowledge of attack, we put results under KN (UK).  Metric | Model |  $\sigma$=0.025 |  $\sigma$=0.05 |  $\sigma$=0.075 |  $\sigma$=0.1
---|---|---|---|---|---
- | - | UK | KN | UK | KN | UK | KN | UK | KN
Att. $\uparrow$ | BL | 0.87 | 0.88 | 0.86 | 0.88 | 0.86 | 0.87 | 0.85 | 0.87
PC[32:40] | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.99
PC[32:48] | 0.99 | 0.99 | 0.97 | 0.99 | 0.94 | 0.99 | 0.95 | 0.99
| PC[32:64] | 0.98 | 0.99 | 0.95 | 0.99 | 0.92 | 0.98 | 0.93 | 0.98
Table 8:  Attributability Table of JPEG attack. Q refers quality metric of JEPG compression. When attributability is measured with (without) knowledge of attack, we put results under KN (UK).  Metric | Model | Q=80 | Q=70 | Q=60 | Q=50
---|---|---|---|---|---
- | - | UK | KN | UK | KN | UK | KN | UK | KN
Att. $\uparrow$ | BL | 0.88 | 0.89 | 0.87 | 0.89 | 0.87 | 0.89 | 0.87 | 0.89
PC[32:40] | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.99
PC[32:48] | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.99
| PC[32:64] | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.99 | 0.98 | 0.99
Table 9:  Attributability Table of combination attack. From T1 to T4, the attack parameters are composed of the weakest to the strongest attack parameters of each attack (e.g., T4 is [$\sigma_{blur}=2.0$, $\sigma_{noise}=0.2$, QJPEG=50]). When attributability is measured with (without) knowledge of attack, we put results under KN (UK).  Metric | Model | T1 | T2 | T3 | T4
---|---|---|---|---|---
- | - | UK | KN | UK | KN | UK | KN | UK | KN
Att. $\uparrow$ | BL | 0.86 | 0.88 | 0.86 | 0.87 | 0.85 | 0.86 | 0.83 | 0.88
PC[32:40] | 0.99 | 0.99 | 0.94 | 0.99 | 0.81 | 0.95 | 0.65 | 0.89
PC[32:48] | 0.99 | 0.99 | 0.74 | 0.92 | 0.52 | 0.88 | 0.45 | 0.85
| PC[32:64] | 0.99 | 0.99 | 0.63 | 0.90 | 0.41 | 0.82 | 0.26 | 0.79
Table 10:  Quality Comparison Table. Standard deviation are in parentheses. The baseline score is in the parentheses.  Model | FID (7.24)$\downarrow$ | IS (4.95)$\uparrow$ | SSIM $\uparrow$
---|---|---|---
BLBlur | 99.05 | 2.86 (0.35) | 0.67(0.08)
BLNoise | 93.04 | 3.02 (0.27) | 0.68(0.07)
BLJPEG | 97.70 | 2.91 (0.26) | 0.67(0.07)
BlCombo | 100.15 | 2.90 (0.23) | 0.66(0.06)
PC[32:40] | 12.35 | 4.75 (0.05) | 0.73(0.06)
PC[32:48] | 13.25 | 4.86 (0.08) | 0.65(0.06)
PC[32:64] | 27.50 | 4.50 (0.07) | 0.57(0.07)
Figure 5: Qualitative Comparison of Fingerprinted Samples. The first column
shows original images $g_{0}(w)$. Latent fingerprinted images are in the
second to the last column.