Evaluation is essential for turning IP protection from a collection of defensive ideas into a comparable and testable research field. In visual generative AI, evaluation is intrinsically heterogeneous: different protection methods are designed to regulate different IP risk variables and therefore cannot be assessed by a single universal metric. For example, a method that reduces memorization should not be evaluated in the same way as a watermarking method for ownership proof, nor should a model-locking mechanism be judged by the same criteria as concept unlearning. Evaluation in IP protection must therefore be goal-aware and aligned with the underlying protection objective. Following the Control Logic View , we organize evaluation protocols according to the same three control objectives used to review protection methods: Information Exposure Control , Generative Behavior Constraint , and Attribution & Accountability . Within each objective, we further distinguish between Data IP and Model IP evaluation. Across these settings, two dimensions are central: Effectiveness , which measures whether a method achieves its intended protection goal, and Robustness , which measures whether the protection persists under attacks, transformations, removals, or adaptive misuse. As summarized in Table 4 , this organization provides a unified evaluation map across control objectives, asset dimensions, and evaluation dimensions. It is also important to distinguish IP-specific evaluation from general-purpose quality assessment. Metrics such as FID, CLIP-based alignment scores, perceptual similarity, runtime, and memory overhead may appear across multiple categories. These metrics are useful, but they are usually auxiliary rather than primary: they assess whether protection comes at a significant cost to visual quality, alignment, or efficiency. The main evaluation question is therefore not only whether a method preserves utility, but whether it succeeds on the specific IP risk it is intended to control. 4.1. Evaluation for Information Exposure Control Information Exposure Control methods aim to prevent protected assets from being internalized or revealed by the model. Accordingly, evaluation in this category focuses on whether protected information is less learnable, less memorized, or less usable after protection. In the Data IP setting, this mainly concerns memorization and unauthorized learning from sensitive training samples. In the Model IP setting, the concern shifts to whether unauthorized users can still access proprietary model value despite protection. 4.1.1. Data IP Evaluation Data IP evaluation in this category assesses whether protection methods can effectively reduce memorization, near-duplicate reproduction, or unauthorized learning from protected samples. The central challenge is that memorization is not directly observable; it must be inferred through similarity, retrieval, or leakage-oriented proxies. Effectiveness Effectiveness is primarily evaluated by quantifying how closely generated samples resemble protected training instances, and by testing whether protective preprocessing successfully reduces such resemblance. A first family of metrics measures instance-level or feature-level similarity between generated outputs and training samples. L2-Norm Distance ( Carlini et al., 2023 ) measures pixel-level similarity to the nearest training neighbor, with lower values indicating a higher memorization risk. SSCD Score ( Pizzi et al., 2022 ) measures object-level similarity using Self-Supervised Copy Detection embeddings and is especially useful when pixel-level comparison is too brittle to capture semantic duplication. A second family of metrics measures dataset redundancy or protection outcome . Deduplication Rate ( Webster et al., 2023 ) quantifies the proportion of near-duplicate samples identified and removed from the dataset, and is therefore especially relevant for data filtering methods. Although not a memorization metric by itself, it provides a direct estimate of how strongly repeated exposure has been reduced. A third family of metrics captures perceptual similarity and generation quality . PSNR , SSIM , and LPIPS ( Zhang et al., 2018 ; Cao et al., 2023 ) are widely used to assess structural or perceptual similarity between images, especially in perturbation-based settings where one must verify that protection does not excessively distort the original sample. FID ( Heusel et al., 2017 ) is often used as an auxiliary metric to assess whether exposure-control methods maintain acceptable generation quality and diversity while reducing memorization. Taken together, these metrics reflect a broader principle: Data IP exposure control is effective only if it weakens memorization-related similarity while preserving acceptable training or generation utility. Robustness Robustness in this category evaluates whether data-side protection remains effective after purification, preprocessing, or other transformations designed to neutralize the protection signal. This is especially important for perturbation-based methods, since an attacker may attempt to remove or weaken the perturbation before training. Common robustness evaluations are therefore attack-conditioned protection rates . Protection Rate under DiffPure ( Nie et al., 2022 ; Shan et al., 2023 ; Liu et al., 2024a ) measures whether protective perturbations survive diffusion-based purification. Protection Rate under JPEG Compression ( Shan et al., 2023 ; Liu et al., 2024a ) evaluates resistance to lossy compression, while Protection Rate under Gaussian Noise ( Shan et al., 2023 ; Liu et al., 2024a ) tests resilience to noise-based preprocessing. These evaluations reflect a key design requirement of proactive data protection: protection signals must remain effective under realistic transformations that an unauthorized trainer may apply before model training. 4.1.2. Model IP Evaluation Model IP evaluation in this category focuses primarily on model locking and related access-control mechanisms. The core question is whether protected models remain useful for authorized users while becoming significantly less useful to unauthorized ones. Effectiveness The effectiveness of model locking is typically measured by contrasting model behavior under authorized and unauthorized access conditions. A first commonly used metric is Locked/Unlocked Downstream Performance ( Gao et al., 2024 ) , which compares task performance or generation quality when the correct key is present versus absent. A large gap indicates that authorization meaningfully controls model usability. A second metric is the FID Gap ( Liu et al., 2024b ) , which specifically measures the difference in generation quality between authorized and unauthorized usage. This is particularly useful in generative settings, where downstream task accuracy alone may not fully reflect degradation in output fidelity. Overall, these metrics capture the central requirement of model-side exposure control: normal-quality functionality should remain available to legitimate users while being substantially degraded for illegitimate ones. Robustness Robustness in model locking focuses on whether adversaries can bypass, infer, or recover the authorization mechanism. Unlocking Attack Success Rate ( Gao et al., 2024 ) measures how often adversarial attempts succeed in using the model without the correct key. Key Recovery Rate ( Liu et al., 2024b ) evaluates whether attackers can reconstruct or infer the secret credential itself. Fine-tuning Bypass Rate ( Liu et al., 2024b ) tests whether unauthorized users can recover acceptable model performance simply by fine-tuning the protected model. These robustness metrics are especially important because model locking is only meaningful if the gap between authorized and unauthorized usage cannot be easily erased by reverse engineering or post hoc adaptation. 4.2. Evaluation for Generative Behavior Constraint Generative Behavior Constraint methods regulate how protected content or capabilities may be expressed during generation. Evaluation in this category therefore focuses on two coupled questions: whether protected behavior is successfully suppressed, and whether non-protected behavior is preserved. In practice, this category almost always requires a balance between target suppression and utility retention , together with robustness against adversarial bypass. 4.2.1. Data IP Evaluation In the Data IP setting, evaluation assesses whether protected concepts, identities, styles, or copyrighted content are successfully suppressed during generation, while utility on unrelated prompts remains intact. Effectiveness A first family of metrics evaluates target suppression . Detection Accuracy/F1 ( Liu et al., 2025 ) is relevant for prompt-engineering systems that first identify whether a request or output is potentially infringing. In concept-unlearning settings, the most widely used metric is Unlearning Accuracy (UA) ( Zhang et al., 2024b ; Cheng and Amiri, 2024 ) , which measures how often the model fails to produce the erased target concept when prompted accordingly. A higher UA indicates more successful forgetting or suppression. These accuracy-based metrics are typically computed using pretrained evaluation models or classifiers. A second family evaluates utility retention . Remaining Accuracy (RA) ( Zhang et al., 2024b ) measures how well the model continues to generate correct outputs for concepts unrelated to the target of removal. This is especially important in unlearning and editing settings, where side effects on benign concepts are often the major practical concern. More generally, FID and CLIP Score ( Heusel et al., 2017 ; Hessel et al., 2021 ) are widely used as auxiliary metrics to ensure that generation quality and text-image alignment remain acceptable after protection. A third family measures residual memorization or infringement tendency . Memorization Score ( Wen et al., 2024 ; Ren et al., 2024 ) is used in inference-time mitigation methods to quantify how strongly protected content is still recalled or reproduced. These metrics collectively capture the central evaluation tradeoff in Data IP behavior control: good methods should strongly suppress protected behavior without broadly harming the model’s generative utility. Robustness Robustness in this category evaluates whether constrained behavior can be recovered through adversarial prompting, inversion, or other bypass strategies. This is especially important for concept erasure, where an attacker may deliberately search for prompts or latent manipulations that reactivate the removed concept. Two metrics are especially common. Attack Success Rate (ASR) ( Tsai et al., 2023 ; Pham et al., 2023 ; Zhang et al., 2024a ; Gong et al., 2024 ; Zhang et al., 2024c ) measures how often adversarial attacks succeed in recovering or reproducing protected content despite the defense. Concept Recovery Rate ( Tsai et al., 2023 ; Pham et al., 2023 ; Zhang et al., 2024a ; Gong et al., 2024 ; Zhang et al., 2024c ) quantifies how much of the erased concept can be recovered through such attacks. In this setting, successful suppression alone is not sufficient; a defense must also prevent reactivation of the constrained capability under adversarial attacks. 4.2.2. Model IP Evaluation In the Model IP setting, Generative Behavior Constraint focuses on blocking capability transfer, model extraction, or unauthorized personalization. Evaluation here is still less standardized than in Data IP protection, which itself highlights a key gap in the literature. Effectiveness A first family of metrics evaluates extraction resistance . Attack Model Fidelity ( Hu and Pang, 2021 ) measures the similarity between the extracted or stolen substitute model and the protected original. Lower fidelity indicates stronger protection against behavioral cloning. A second family evaluates personalization degradation . Identity Score Matching ( Van Le et al., 2023 ) measures how accurately identity is captured during unauthorized personalization, while CLIP Similarity ( Radford et al., 2021 ) is often used to assess whether protected outputs remain semantically close to the target subject or style. ImageReward ( Xu et al., 2023 ) provides a human-preference-aligned quality signal that is useful when protection aims to degrade the practical value of unauthorized personalized outputs rather than merely their semantic similarity. These metrics reveal an important difference from Data IP evaluation: the goal is not only to suppress specific protected content, but to reduce the utility of an unauthorized derivative system as a commercially or functionally useful substitute. Robustness Robustness in this category evaluates whether protection survives more adaptive extraction or personalization pipelines. Defense Rate under DreamBooth/Textual Inversion ( Ruiz et al., 2023 ; Gal et al., 2022 ) measures whether protection remains effective when attackers use standard personalization methods. Adaptive Attack Success Rate ( Van Le et al., 2023 ; Choi et al., 2024 ) evaluates stronger attacks specifically designed to circumvent the protection mechanism. Robustness here is particularly underdeveloped compared with data-side unlearning. This suggests that Model IP behavior-control methods still lack a widely accepted evaluation protocol, which remains an important open problem. 4.3. Evaluation for Attribution & Accountability Attribution & Accountability methods are evaluated not by their ability to prevent infringement upfront, but by their ability to provide reliable post-hoc evidence. Evaluation in this category therefore emphasizes both evidentiary accuracy and evidence persistence . In other words, a useful attribution method must not only correctly identify ownership or misuse, but must also remain reliable after transformations, laundering attempts, or model modifications. 4.3.1. Data IP Evaluation In the Data IP setting, evaluation focuses on whether unauthorized dataset usage can be detected reliably and whether data-side watermark signals can be recovered under realistic conditions. Effectiveness A first family of metrics evaluates detection performance . TPR at fixed FPR ( Zhai et al., 2024 ) measures the true positive rate at a fixed false positive rate and is particularly useful when data owners need threshold-controlled forensic evidence. AUC ( Zhai et al., 2024 ) summarizes detection performance across all thresholds and is common in dataset-usage verification settings. A second family measures direct watermark recovery . Detection Rate ( Cui et al., 2025a ; Wang et al., 2023a ; Zhang et al., 2024e ) captures how often unauthorized usage or embedded marks are successfully identified, while Bit Accuracy ( Cui et al., 2025a ; Wang et al., 2023a ; Zhang et al., 2024e ) measures how accurately the watermark payload can be recovered. In watermarking settings, PSNR/SSIM/LPIPS ( Zhang et al., 2018 ; Zhang et al., 2024e ) are also used as auxiliary fidelity metrics to ensure that the embedded signal does not significantly degrade visual quality. Together, these metrics reflect the two main evidentiary requirements of Data IP accountability: reliable detection of misuse and acceptable quality preservation of the protected content. Robustness Robustness here asks whether detection or watermark recovery remains reliable under transformations or removal attempts. Detection Rate/Bit Accuracy under Corruptions ( Cui et al., 2025a ; Zhang et al., 2024d ) measures detection performance after image corruptions such as compression, noise, and geometric modification. Removal Attack Success Rate ( Zhang et al., 2024e ) measures how often an attacker can remove or destroy the watermark while preserving image quality. These robustness tests are crucial because evidence that disappears under mild post-processing is of limited practical value for attribution or dispute resolution. 4.3.2. Model IP Evaluation In the Model IP setting, Attribution & Accountability evaluation focuses on whether generated content can be traced to its source model, whether model identity can be verified, and whether embedded ownership signals persist under image-level or model-level attacks. Effectiveness A first family of metrics evaluates source attribution . Attribution Accuracy ( Wang et al., 2023b ; Wang et al., 2024a ) measures the proportion of outputs correctly assigned to their generating model. This is the central metric for origin-attribution methods. A second family evaluates fingerprint or watermark recovery . Bit Accuracy ( Yu et al., 2021 ; Wen et al., 2023 ; Zhao et al., 2023b ; Fernandez et al., 2023 ; Li et al., 2025a ) measures how correctly an ownership payload is recovered from model outputs. TPR at fixed FPR ( Yu et al., 2021 ; Wen et al., 2023 ; Zhao et al., 2023b ; Fernandez et al., 2023 ; Li et al., 2025a ) and p-value ( Yu et al., 2021 ; Wen et al., 2023 ; Zhao et al., 2023b ; Fernandez et al., 2023 ; Li et al., 2025a ) are commonly used when ownership proof is framed as a detection problem with statistical confidence requirements. A third, auxiliary metric is FID ( Heusel et al., 2017 ) , which is widely used to verify that embedding ownership evidence does not excessively degrade generation quality. This is especially important for model watermarking, where ownership proof is only practically useful if the protected model remains competitive in normal use. Robustness Robustness in Model IP accountability focuses on evidence persistence under both image-level and model-level perturbations. Bit Accuracy under Image Attacks ( Jiang et al., 2023 ; Fernandez et al., 2023 ; Zhao et al., 2023b ; Huang et al., 2024b ; Lei et al., 2025 ) measures watermark or fingerprint recovery after transformations such as JPEG compression, cropping, resizing, blur, or adversarial image attacks. Bit Accuracy under Model Fine-tuning/Pruning ( Zhao et al., 2023b ; Wang et al., 2025b ; Li et al., 2025a ) evaluates whether ownership signals survive model-level modifications, including fine-tuning, pruning, or purification-style attacks. These robustness tests are especially significant in Model IP protection because they reflect realistic laundering behavior: an attacker may not simply copy a model, but may also adapt, compress, fine-tune, or partially modify it before redeployment. Taken together, the evaluation protocols reviewed above show that there is no single metric for IP protection in visual generative AI. Instead, meaningful evaluation depends on matching metrics to the specific risk variable a method is intended to regulate. Information Exposure Control is evaluated mainly through memorization reduction and access-security measures; Generative Behavior Constraint is evaluated through target suppression, utility retention, and resistance to behavioral bypass; and Attribution & Accountability is evaluated through evidence accuracy and persistence. Organizing evaluation in this way makes it possible to compare methods more fairly within each protection objective, while also revealing broader gaps in the literature, such as the lack of standardized benchmarks for Model IP protection and the limited cross-architecture understanding of evaluation protocols. 5. Regulatory Landscape and Industry Responses Technical IP protection does not operate in isolation. In practice, the deployment and effectiveness of IP safeguards for visual generative AI are increasingly shaped by laws, platform governance, licensing arrangements, provenance standards, and contractual risk allocation. From the perspective of this survey, these non-technical considerations do not map one-to-one onto a single control objective. Instead, they interact with the same underlying concerns discussed in earlier sections: limiting unauthorized data usage, constraining downstream misuse, and enabling attribution or accountability after deployment. This section therefore complements the technical taxonomy by discussing how regulation and industry practice are responding to the IP challenges of visual generative AI. 5.1. Legal and Regulatory Approaches to IP Protection Across jurisdictions, legal responses to generative AI and IP are beginning to converge around four aspects: (i) human authorship and output ownership , (ii) training-data transparency and copyright compliance , (iii) synthetic-content disclosure and labeling , and (iv) post-hoc accountability through enforcement, audit, or remedies . At the same time, jurisdictions differ substantially in how they balance innovation, copyright enforcement, privacy, and platform responsibility. Table 3 summarizes the most relevant differences for this survey. The United States In the United States, the regulatory and legal landscape remains largely fragmented. Copyrightability continues to be anchored in the requirement of human authorship, as reflected in Thaler v. Perlmutter and the U.S. Copyright Office’s registration guidance for works containing AI-generated material ( United States District Court for the District of Columbia, 2023 ; United States Court of Appeals for the District of Columbia Circuit, 2025 ; U.S. Copyright Office, 2023 ) . More recently, the U.S. Copyright Office’s multi-part AI initiative has expanded this discussion through formal reports on digital replicas, copyrightability, and the use of copyrighted works in generative-AI training ( U.S. Copyright Office, 2024 ; U.S. Copyright Office, 2025a ; U.S. Copyright Office, 2025b ) . For visual generative AI, however, many of the most consequential questions remain litigation-driven rather than settled by statute. Cases such as Getty Images v. Stability AI continue to shape debate over whether large-scale scraping and model training on copyrighted visual materials without licensing can be justified ( Getty Images , Inc.(2023), US ) . Beyond copyright, the U.S. still relies on a mix of general consumer-protection and privacy instruments, including Section 5 of the FTC Act and state-level privacy law such as the CCPA/CPRA ( United States Congress, [n. d.] ; California Legislature, 2020 ) . The U.S. model is therefore best characterized as case-driven, sectoral, and highly dynamic , with IP norms emerging through a combination of agency interpretation, private litigation, and state-level experimentation. The European Union The European Union has adopted the most comprehensive horizontal framework among major jurisdictions. The AI Act introduces a risk-based regulatory regime for AI systems, and its implications for generative AI extend beyond general safety concerns ( European Parliament and Council of the European Union, 2024 ) . For this survey, the most relevant development is the framework governing general-purpose AI (GPAI) models, which links AI regulation directly to transparency and copyright-related obligations. In particular, GPAI providers are expected to implement policies for compliance with Union copyright law and to provide a sufficiently detailed summary of the content used for training ( European Parliament and Council of the European Union, 2024 ; European Commission, 2025a ; European Commission, 2025c ; European Commission, 2025b ) . These expectations coexist with the EU’s strong baseline of personal-data protection under the GDPR ( European Parliament and Council of the European Union, 2016 ) . Compared with the U.S., the EU approach is more ex ante , documentation-oriented, and compliance-driven. Rather than waiting primarily for case-by-case litigation, the regulatory design places stronger weight on transparency, process obligations, and provider accountability. This is particularly relevant to the concerns of this survey, because it connects legal compliance to issues closely aligned with Information Exposure Control and Attribution & Accountability. China China has adopted a more top-down and service-oriented regulatory approach. Rather than centering the debate on output copyrightability, the Chinese governance has focused more heavily on provider obligations, synthetic-content management, and data governance. The Provisions on the Administration of Deep Synthesis Internet Information Services , effective since January 2023, require providers of deep-synthesis services to strengthen management of synthetic contents and implement labeling obligations ( Cyberspace Administration of China, 2022 ) . The Interim Measures for the Administration of Generative Artificial Intelligence Services , effective since August 2023, further extend this approach to public-facing generative-AI services, embedding expectations around lawful data use, provider responsibility, and content security ( Cyberspace Administration of China, 2023 ) . These AI-specific rules operate alongside the Cybersecurity Law, Data Security Law, and PIPL, which together form a broader framework for data governance, security, and personal-information protection ( National People’s Congress of the People’s Republic of China, 2016 ; National People’s Congress of the People’s Republic of China, 2021a ; National People’s Congress of the People’s Republic of China, 2021b ) . China exemplifies a regulatory strategy in which generative AI is governed largely through platform obligations and upstream service regulation . As a result, legal control is exercised through not only the copyright doctrine, but also administrative duties imposed on AI-service providers. United Kingdom United Kingdom occupies a distinctive position. Unlike the U.S., UK retains a statutory rule for computer-generated works under the Copyright, Designs and Patents Act 1988, which assigns authorship of computer-generated literary, dramatic, musical, or artistic works to the person making the arrangements necessary for their creation ( UK Parliament, 1988 ) . At the same time, UK has not adopted a single AI Act analogous to the EU’s. Instead, it has pursued a more flexible, regulator-led model through the AI Regulation White Paper and subsequent government responses ( Department for Science, Innovation and Technology, 2023 ; Department for Science, Innovation and Technology, 2024 ) . More recently, UK has become one of the most active jurisdictions in reconsidering the interface between copyright and AI training. Following the 2024 consultation on Copyright and Artificial Intelligence , the government published a progress report in late 2025 and a fuller report and impact assessment in March 2026 ( Intellectual Property Office, 2024 ; Department for Science, Innovation and Technology and Intellectual Property Office, 2025 ; Department for Science, Innovation and Technology and Intellectual Property Office, 2026 ) . In parallel, the Online Safety Act and subsequent policy developments around explicit deepfakes show that UK is also expanding platform and criminal-law tools for harms associated with synthetic content ( UK Parliament, 2023 ; UK Ministry of Justice, 2025 ) . UK can therefore be understood as a jurisdiction in transition: it combines an older copyright framework for computer-generated works with a rapidly evolving policy debate on AI training, transparency, and synthetic-content harms. Table 3. Comparison of legal approaches to AI-generated content and generative-AI governance across major jurisdictions. Region Copyright / IP Position Data / Transparency Governance AI-Specific Regulatory Direction United States Human authorship remains the governing baseline for copyrightability of AI-assisted outputs; disputes over AI training on copyrighted works remain heavily litigation-driven ( United States District Court for the District of Columbia, 2023 ; United States Court of Appeals for the District of Columbia Circuit, 2025 ; U.S. Copyright Office, 2023 ; U.S. Copyright Office, 2025a ; Getty Images , Inc.(2023), US ) . No comprehensive federal AI or privacy law; governance relies on FTC enforcement, state privacy law, agency guidance, and private litigation ( United States Congress, [n. d.] ; California Legislature, 2020 ) . Fragmented and sectoral; strong activity around digital replicas, deepfakes, and platform accountability, but no single unified AI statute ( U.S. Copyright Office, 2024 ; U.S. Copyright Office, 2025b ) . European Union Copyright remains tied to human authorship, but the AI Act directly adds copyright-related obligations for GPAI providers, including compliance policies and training-content summaries ( European Parliament and Council of the European Union, 2024 ; European Commission, 2025a ; European Commission, 2025b ) . Strong integration with GDPR and AI Act documentation/transparency duties; public summaries of GPAI training content are part of the compliance architecture ( European Parliament and Council of the European Union, 2016 ; European Parliament and Council of the European Union, 2024 ; European Commission, 2025c ) . Most comprehensive horizontal framework; combines synthetic-content transparency, GPAI obligations, systemic-risk oversight, and enforcement mechanisms ( European Parliament and Council of the European Union, 2024 ; European Commission, 2025c ) . China IP law remains human-centered, while regulation of generative AI is strongly shaped by provider obligations, labeling duties, and service governance ( Cyberspace Administration of China, 2022 ; Cyberspace Administration of China, 2023 ) . Strong emphasis on lawful data governance, personal-information protection, data security, and platform obligations under CSL, DSL, PIPL, and AI-specific service rules ( National People’s Congress of the People’s Republic of China, 2016 ; National People’s Congress of the People’s Republic of China, 2021a ; National People’s Congress of the People’s Republic of China, 2021b ; Cyberspace Administration of China, 2023 ) . Top-down governance with mandatory labeling and provider responsibility for deep-synthesis and generative-AI services ( Cyberspace Administration of China, 2022 ; Cyberspace Administration of China, 2023 ) . United Kingdom The UK retains statutory treatment of computer-generated works under the CDPA while actively reconsidering the copyright-training interface through consultation and formal reports ( UK Parliament, 1988 ; Intellectual Property Office, 2024 ; Department for Science, Innovation and Technology and Intellectual Property Office, 2025 ; Department for Science, Innovation and Technology and Intellectual Property Office, 2026 ) . Data governance follows UK GDPR and the Data Protection Act 2018; transparency and copyright issues are being revisited through AI-specific consultation rather than a single AI statute ( UK Government, 2021 ; UK Parliament, 2018 ; Intellectual Property Office, 2024 ) . Light-touch, regulator-led model; active policy development on copyright and AI, plus stronger intervention on harmful synthetic content such as explicit deepfakes ( Department for Science, Innovation and Technology, 2023 ; Department for Science, Innovation and Technology, 2024 ; UK Parliament, 2023 ; UK Ministry of Justice, 2025 ) . Taken together, these jurisdictional differences reinforce a key insight: legal responses to generative AI rarely align perfectly with a single technical protection family. Instead, regulation typically combines asset-level concerns, transparency duties, platform obligations, and evidentiary mechanisms. This means that technical IP protection methods are increasingly likely to be evaluated not only against attack models, but also against regulatory expectations such as documentation, provenance, disclosure, and provider accountability. 5.2. Industry Participation Industry participation is equally important because many operational safeguards for generative AI are being developed first as platform practices, licensing models, or interoperability standards rather than as statutory regulations. Current industry responses can be grouped into four major strategies: 1) licensed and curated data supply , 2) provenance and disclosure , 3) creator controls and platform enforcement , and 4) contractual risk allocation . These strategies do not map perfectly onto the Control Logic View, but they interact closely with the same practical concerns of exposure, behavior, and accountability. Licensed and Curated Data Supply One major industry practice is to reduce upstream legal uncertainty by shifting from broad web scraping toward licensed, curated, or provenance-controlled data pipelines. Adobe has explicitly positioned Firefly around this logic, stating that Firefly models are trained on licensed content, such as Adobe Stock, together with openly licensed or public-domain content, and that customers’ private content is not used for Firefly training by default ( Adobe, 2026c ) . Shutterstock has adopted a complementary licensing-centered strategy by expanding its partnership with OpenAI through a six-year agreement to provide image, video, music, and metadata resources as high-quality training data for generative-AI models ( Shutterstock, 2023 ) . Getty Images has pursued a more product-facing version of the same logic by launching a commercially positioned generative-AI offering trained on its licensed creative content, with usage rights, legal protection, and contributor compensation framed as part of its product differentiation ( Getty Images, 2023 ) . Together, these cases show how content licensing, dataset provenance, and compensation mechanisms are becoming practical instruments for mitigating Data IP risks in visual generative AI. These arrangements matter because they complement technical information-exposure controls with a market mechanism: instead of only trying to prevent unauthorized learning after the fact, firms increasingly seek to secure lawful data access in advance. Provenance, Disclosure, and Traceability Another industry practice focuses on post-hoc transparency and content provenance. OpenAI states that images generated in ChatGPT can include C2PA metadata, an open standard for attaching provenance information to media ( OpenAI, 2026a ; Coalition for Content Provenance and Authenticity, 2026 ) . Adobe has advanced a broader provenance ecosystem through Content Credentials, which attach standardized metadata about how content was created or edited, including whether AI tools were used ( Adobe, 2026b ) . Google DeepMind has pursued a closely related strategy through SynthID, which is designed to watermark and identify AI-generated content ( Google DeepMind, 2026 ; Google DeepMind, 2025 ) . These efforts are especially relevant to the Attribution & Accountability branch of this survey. They also illustrate an important trend: provenance tooling is becoming an interoperability layer across platforms, model providers, and downstream distribution channels, rather than a purely model-internal defense. Creator Controls and Platform Enforcement The third industry practice centers on creator-facing controls, notice-and-takedown processes, and platform governance. Midjourney’s terms include a DMCA workflow for removal and counter-notification, embedding copyright dispute handling into platform operations ( Midjourney, 2026 ) . OpenAI has publicly described Media Manager as a planned tool intended to let creators and content owners specify how their works should be included or excluded from machine-learning research and training ( OpenAI, 2024a ) . These mechanisms are still uneven across providers, and their practical coverage is far from standardized. Nevertheless, they indicate that platform-level creator control is becoming an increasingly important complement to both legal enforcement and technical protection. Contractual Risk Allocation and Enterprise Assurance The fourth industry practice involves contractual allocation of IP risk, especially for enterprise customers. OpenAI’s Services Agreement and Service Terms include IP indemnity commitments for enterprise use of outputs in certain circumstances ( OpenAI, 2026c ; OpenAI, 2026b ) . Adobe likewise markets contractual IP indemnification for eligible Firefly enterprise offers ( Adobe, 2026a ) . These commitments do not eliminate upstream copyright disputes, but they matter commercially as they convert part of the residual IP risk into a contractual assurance that can support adoption in professional workflows. Overall, regulatory and industry developments reveal that the governance of visual generative AI is moving towards a layered model. Public regulation increasingly emphasizes transparency, disclosure, lawful data governance and accountability, while industry practice increasingly emphasizes licensed data, provenance standards, creator-control channels and contractual risk management. These developments reinforce a central point: technical IP protection methods are most useful when they can interoperate with external governance frameworks, rather than being treated as isolated model-level safeguards. 6. Open Challenges and Future Directions Despite the rapid progress reviewed in this survey, IP protection for visual generative models is still at an early stage. Existing methods remain fragmented across different threat assumptions, model architectures, and deployment scenarios, and several core research problems are still insufficiently addressed. Below, we highlight the most important open challenges and future directions. Standardized Benchmarks and Evaluation Protocols A major limitation of the current literature is the lack of standardized benchmarks and evaluation protocols. As discussed in Section 4 , different works often rely on different datasets, target concepts, attack settings, and utility metrics, making cross-paper comparison difficult. This problem is especially severe for Model IP protection, where evaluation is often borrowed from adjacent tasks rather than designed specifically for IP risks. Future work should therefore establish benchmark suites aligned with the three control objectives in this survey, including standardized threat models, shared data splits, unified utility metrics, and adaptive attack protocols. In particular, benchmark construction should go beyond static effectiveness measurement and explicitly include robustness under prompt attacks, concept recovery, watermark removal, model purification, and fine-tuning-based bypass. Proactive Protection for Model IP Compared with Data IP protection, proactive protection for Model IP remains significantly underexplored. Most existing methods for Model IP are reactive, focusing on watermarking, fingerprinting, or origin attribution after a model has already been reused or redistributed. In contrast, relatively few works directly prevent unauthorized access to proprietary model value before infringement occurs. This gap is likely to become more serious as model APIs, downstream fine-tuning, and model customization become increasingly common. Future work should therefore place greater emphasis on proactive Model IP defenses, including stronger model locking, anti-extraction mechanisms for black-box APIs, capability-gated generation, and ownership-preserving fine-tuning schemes. More broadly, the field needs clearer threat models that distinguish between checkpoint theft, behavioral cloning, derivative adaptation, and capability laundering. Precise and Explainable Evidence for Reactive Protection Reactive protection methods are only practically useful if they can provide evidence that is not only accurate, but also interpretable and actionable. Current attribution and detection methods often produce coarse binary judgments, such as whether a dataset was likely used or whether an image was likely generated by a certain model, but they rarely explain which part of the output, which training signal, or which model component supports this conclusion. This limits their value in legal disputes, platform moderation, and creator-facing enforcement. Future work should therefore move toward localized and explainable IP evidence, such as identifying copied regions, style-bearing features, concept-specific activation patterns, or source-dependent provenance traces. Such methods would make reactive protection substantially more useful for copyright claims, takedown requests, and audit procedures. Robustness Under Adaptive Attacks and Post-Protection Adaptation Robustness remains one of the weakest aspects of the current literature. Many methods are still evaluated under relatively simple attack settings, even though realistic adversaries can iteratively refine prompts, use inversion to recover erased concepts, fine-tune away watermarks, or distill protected behavior into a substitute model. In addition, many protection methods are not tested under post-protection adaptation, such as continued fine-tuning, personalization, or domain transfer. Future work should therefore treat adaptive robustness as a first-class objective rather than a secondary stress test. This includes stronger red-teaming for concept recovery, systematic evaluation of model laundering and watermark removal, and explicit study of whether protected or erased capabilities re-emerge after subsequent adaptation. Beyond Diffusion-Centric Protection Most current IP protection studies are developed and evaluated primarily on diffusion models. While this focus is understandable given the dominance of diffusion in current visual generation, it leaves open a fundamental question: which protection mechanisms are genuinely general, and which are specific to diffusion architectures? Autoregressive models, flow-based models, multimodal native generators, and interactive world models expose different internal interfaces and may exhibit different forms of memorization, extraction, attribution, or style imitation. Future work should therefore investigate IP protection beyond diffusion and clarify which defenses transfer across architectures. This is important not only for broader coverage, but also for identifying architecture-aware protection mechanisms that are better matched to the actual structure of the underlying generator. From Single-Modality Protection to Multimodal and Personalized Systems Another important limitation of the current literature is its strong focus on image generation in relatively static settings. In practice, generative systems are rapidly becoming multimodal, personalized, and continuously updated. Future models increasingly combine image, video, audio, text, and editing capabilities, while personalization pipelines enable users to adapt a base model to specific identities, styles, or domains. These developments create new forms of IP risk, because protected content can be transferred across modalities, amplified through personalization, or reintroduced during continual adaptation. Future work should therefore study whether current protection methods remain effective in multimodal and personalized settings, and whether new forms of protection are required for cross-modal transfer, subject-driven generation, and continual reuse. Integration with Provenance Standards, Platform Governance, and Regulation Finally, future technical work should be designed with deployment and governance constraints in mind. As discussed in Section 5 , regulation and industry practice increasingly emphasize transparency, provenance, creator control, and accountability. However, many technical methods are still developed in isolation from these external requirements. Future work should therefore better connect technical IP protection with content credentials, provenance metadata, platform-level enforcement workflows, creator opt-out or licensing mechanisms, and emerging regulatory obligations on training-data disclosure and synthetic-content labeling. In other words, an effective future protection system will likely need to function not as a standalone algorithm, but as part of a broader governance framework spanning model developers, platforms, creators, auditors, and regulators. Overall, a central challenge for the next stage of this field is to move from isolated protection techniques toward a more systematic framework that jointly considers threat modeling, benchmark design, proactive defense, reactive evidence, robustness, architectural diversity, and deployment compatibility. Advancing along these directions will be critical for building IP-aware generative models that are not only technically effective, but also practically enforceable. 7. Conclusion In this survey, we presented a structured review of IP protection for visual generative AI through a Control Logic View . Rather than organizing the literature by lifecycle stage or technical mechanism alone, we argued that IP protection methods are more systematically understood by the specific risk variable they regulate. Under this perspective, we unified existing work into three control objectives: Information Exposure Control , Generative Behavior Constraint , and Attribution & Accountability . Within each objective, we further distinguished between Data IP and Model IP protection, thereby providing a common framework for understanding what is being protected, how infringement risk arises, and where technical interventions are applied. Based on this taxonomy, we reviewed the main families of protection methods developed for visual generative models, ranging from data filtering, perturbation, and compositional training to concept unlearning, safety-aligned inference, watermarking, fingerprinting, and origin attribution. We also showed that evaluation should not be treated as an independent or purely metric-driven component, but should instead be organized under the same control logic as the protection methods themselves. This view helps clarify why different categories of methods require different notions of effectiveness and robustness, and why benchmark design remains one of the central open problems in the field. Beyond technical methods, we further highlighted that IP protection for visual generative AI is increasingly shaped by regulatory developments and industry practice. Emerging governance frameworks across major jurisdictions are placing growing emphasis on training-data transparency, synthetic-content disclosure, provenance, and provider accountability, while industry actors are responding through licensed data pipelines, creator-facing controls, watermarking, provenance standards, and contractual assurance. These developments suggest that future IP protection will likely depend not on isolated model-level defenses alone, but on the interaction between technical mechanisms, platform governance, legal compliance, and deployment practice. Overall, the current landscape reveals both substantial progress and significant fragmentation. Existing methods have demonstrated that exposure reduction, behavior control, and post-hoc attribution are all viable components of an IP protection toolbox, yet the field still lacks standardized benchmarks, strong proactive Model IP defenses, broadly applicable cross-architecture methods, and evidence mechanisms that are sufficiently robust, interpretable, and operational in real-world settings. We hope that the taxonomy and synthesis provided in this survey can serve as a useful foundation for future research toward more principled, effective, and deployable IP protection for visual generative AI.
View larger