Membership is Ownership: A Robust Ownership Verification Framework for Diffusion Models
Authors: Feng Jiang, Zuobin Xiong, An Huang, Zhipeng Cai, Yingshu Li
Organizations: Department of Computer Science, Georgia State University, Atlanta, USA · Department of Computer Science, University of Nevada Las Vegas, Las Vegas, USA
Large-scale diffusion models have fueled numerous profitable downstream applications for AI-related businesses, including visual editing and content creation. Meanwhile, due to the huge amount of resource consumption (e.g., computation and high-quality data) during training, such diffusion models are deemed valuable intellectual property (IP) for tech companies like OpenAI and Google. Yet, the IP assets are vulnerable to various unauthorized uses by adversaries seeking to steal models for customized, usually commercial applications. Some existing approaches have explored IP protection for AI models; however, they mostly face structural limitations in common --- using a training-time watermarking by injecting artifacts in the model, which can impose a measurable utility cost and can be weakened by post-hoc fine-tuning. To address these challenges, this work investigates IP protection (i.e., model ownership verification) for diffusion models in a realistic commercial scenario with minimal model utility loss. Specifically, the proposed method builds a framework for model ownership verification, termed ``{Membership is Ownership} (MiO)'', based on a population-level hypothesis test on a private member evidence dataset. MiO verifies ownership using two criteria: model attribution through membership inference and model separation from public references. Both are tested at p<10−6. We evaluate MiO on DDIM and Stable Diffusion models without modifying the owner model or its sampling pipeline, and report ROC-AUC and true-positive rates at fixed nominal false-positive targets. Furthermore, MiO stays stable under different post-theft fine-tuning and weight perturbation in adversarial scenarios, reflecting better robustness compared to the watermarking methods.
Figures & tables
Fig. 1: The framework and operation steps in the proposed MiO method.
Owner
AUC
TPR
α=10−3
α=10−4
DDIM (from scratch)
CIFAR-10
0.982
0.753
0.629
CIFAR-100
0.975
0.729
0.594
STL-10
0.999
0.993
0.987
CelebA
0.879
0.853
0.785
TABLE I: Per-sample MIA performance under Gaussian QR calibration.
Owner
Semantic-similar
Cross-domain
Random init
DDIM (from scratch)
CIFAR-10
✓ (23.9)
✓ (31.6)
✓ (45.1)
CIFAR-100
✓ (16.3)
✓ (25.2)
✓ (44.1)
STL-10
✓ (87.3)
✓ (22.2)
✓ (41.5)
CelebA
✓ (20.5)
✓ (23.5)
✓ (63.0)
Stable Diffusion v1.4
TABLE II: Paired ∣d∣C2 across DDIM and SD owners against three reference roles.
Attack on MA
AUC
TPR
α=10−3
α=10−4
None (positive control: MA )
0.982
0.753
0.629
MMD-FT
0.982
0.755
0.629
SGD-FT
0.981
0.754
0.623
Noise σ=10−3
0.981
0.744
0.614
Noise σ=10−2
0.976
0.796
0.684
TABLE III: Post-theft robustness of the MiO framework.
Model
AUC
TPR
α=10−3
α=10−4
Owner MA
0.982
0.753
0.629
Distilled student
0.492
0.000
0.000
TABLE IV: Distillation attack performance on CIFAR-10
Component
Time
Parameters
DDIM training (owner model)
∼ 34 h
30.5M
Gaussian QR ( ×1 model)
∼ 2 h
11.57M
Gaussian QR ensemble ( B=50 )
∼ 100 h †
579M total
Inference (per verification query)
t -error scoring (5k samples)
∼ 10 min
—
Ensemble prediction
< 1 min
—
TABLE V: Computational cost breakdown on CIFAR-10 dataset.
Method
Modifies weights
Training overhead
Δ FID
Detection score
WDM
✓
High (extra WDP)
+0.58 (CIFAR-10)
SSIM 0.997
Zhao
✓
High (encoder + DM)
+4.87 (CIFAR-10)
Bit-acc 0.999
CDI
✗
None
N/A
>99% conf. (dataset)
SleeperMark
✓
Medium (LoRA backdoor)
+0.48 (SD v1.4)
Bit-acc ≈0.99
MiO (ours)
✗
None
N/A
AUC 0.982
TABLE VI: Comparison across diffusion-model ownership-verification methods.
Aggregation
∣d∣C2
Mean
18.2
Q10
21.5
Q25 (ours)
23.93
Median
19.8
TABLE VII: Aggregation ablation on CIFAR-10.
Ensemble B
Std( q^τ )
TPR @ FPR 0.1%
1
0.142
0.83 ± 0.05
10
0.068
0.87 ± 0.03
20
0.041
0.88 ± 0.03
50 (ours)
0.019
0.89 ± 0.03
100
0.016
0.89 ± 0.02
TABLE VIII: Effect of ensemble size B on quantile prediction stability
Proprietary text-to-image diffusion models are increasingly distributed as hosted services and downloadable checkpoints, making their intellectual property (IP) protection an increasingly critical concern when model leakage, copying, or unauthorized fine-tuning is disputed. In this work, we present a non-invasive model fingerprinting framework based on collapsed generation, a phenomenon where certain input conditions produce highly consistent images across multiple stochastic seeds. We show that collapsed generation is an intrinsic, model-dependent property of the learned generation process. These collapse-prone conditions therefore expose model-specific behavioral signatures, enabling reliable ownership verification without embedding invasive watermarks. After preparing conditions on the source model, the framework verifies a suspect model under two access settings: (1) white-box pipeline access, where optimized continuous embeddings can be injected into the generation process, and (2) black-box API-only access, where natural language prompts are queried through the service interface. In both cases, ownership evidence is measured by whether the suspect model reproduces the source model's collapse behavior across stochastic samplings. Extensive experiments across UNet- and transformer-based diffusion models show that collapsed generation fingerprints can distinguish different source models with low confusion. These fingerprints remain verifiable in fine-tuned derivatives and under common and adaptive model- or query-level obfuscations, while requiring only a modest verification query budget. Together, these results establish collapsed generation as a reliable intrinsic evidence source for non-invasive diffusion model ownership verification.
Yuanmin Huang, Chen Chen, Geng Hong +5
Fudan University, Shanghai, China · East China University of Science and Technology, Shanghai, China · Alibaba Group, Hangzhou, China +1
Large-scale text-to-image (T2I) diffusion models have enabled unprecedented creative applications, but their unauthorized use has raised serious intellectual property concerns, making model ownership verification (MOV) increasingly critical. We find that existing backdoor-based diffusion watermarking methods often (implicitly) assume a "faithful" verification process, namely, that the verifier can query a suspicious model and obtain the faithful watermark response to complete MOV. However, in practice, adversaries may intentionally or unintentionally damage potential watermark signals, significantly degrading verification reliability. To address this issue, we propose Cert-LAS, the first certified MOV method for T2I models based on layer-adaptive smoothing. In general, Cert-LAS embeds specified watermarks using diffusion classifiers and an LFS-guided layer-adaptive noise, and verifies ownership by examining whether the suspected model exhibits significantly stronger watermark responses compared to unwatermarked references through hypothesis testing. We further prove that, under certain conditions, our Cert-LAS can still achieve reliable verification even in the presence of malicious removal attacks. Extensive experiments validate the effectiveness of Cert-LAS and its resistance to adaptive attacks. Our code is available at https://github.com/Leyi-Qi/Cert-LAS.
Leyi Qi, Yiming Li, Siyuan Liang +2
Generative AI Lab, College of Computing and Data Science, Nanyang Technological University, Singapore · Department of Computer Science and Engineering, Texas A&M University, USA
Membership inference attacks expose whether individual records were used to train a model, yet existing attacks on diffusion models are largely heuristic and can require substantial query budgets. We introduce DIME (Denoiser Ideal Membership Error), a theoretically grounded and query-efficient framework for membership inference on diffusion models. Our starting point is an exact characterization of the optimal diffusion denoiser for a finite training set, which reveals that membership leakage is governed by the denoiser's implicit reconstruction error. This error decomposes into two complementary signals: a bias term, capturing reconstruction accuracy, and a previously unexplored local crowding term, capturing the geometry of nearby training examples. Both admit efficient estimators using only model queries, yielding a practical attack with as few as two queries. Across CIFAR-10/100, STL10-U, CelebA, and ImageNet, DIME consistently outperforms prior attacks at comparable or substantially lower query cost, improving TPR at 1% FPR by up to 3×; remarkably, its two-query variant can outperform existing 30-query baselines. Finally, we suggest, discuss, and evaluate specific defenses to counteract such powerful membership tests.