Disguised Copyright Infringement of Latent Diffusion Models

TL;DR

This paper shows that Latent Diffusion Models (LDMs) can reproduce copyrighted content even when the training data visually excludes the originals, by embedding the same latent information into disguised samples. It introduces an algorithmic framework to generate disguises that remain visually distinct yet share latent structure with copyrighted images, and a two-step detection approach combining feature-space screening and encoder–decoder analysis. The authors formalize an elevated notion of access, called acknowledgment, to capture indirect access via latent representations and propose practical tools to audit training data beyond visual inspection. They validate their approach across symbol, content, and style cases and discuss implications for policy, governance, and future research on robust detection and fair-use considerations.

Abstract

Copyright infringement may occur when a generative model produces samples substantially similar to some copyrighted data that it had access to during the training phase. The notion of access usually refers to including copyrighted samples directly in the training dataset, which one may inspect to identify an infringement. We argue that such visual auditing largely overlooks a concealed copyright infringement, where one constructs a disguise that looks drastically different from the copyrighted sample yet still induces the effect of training Latent Diffusion Models on it. Such disguises only require indirect access to the copyrighted material and cannot be visually distinguished, thus easily circumventing the current auditing tools. In this paper, we provide a better understanding of such disguised copyright infringement by uncovering the disguises generation algorithm, the revelation of the disguises, and importantly, how to detect them to augment the existing toolbox. Additionally, we introduce a broader notion of acknowledgment for comprehending such indirect access. Our code is available at https://github.com/watml/disguised_copyright_infringement.

Figures (26)

• Figure 1: An overview of conventional (with direct access to copyrighted material) and disguised (with indirect access) copyright infringement for latent diffusion models. For direct access, training an LDM-based model on copyrighted material $x_c$ and reproducing $x_c$ is subjected to copyright infringement. For indirect access, one trains the same model on disguised samples $x_d$, which are drastically different from $x_c$, but is still able to reproduce $x_c$ during inference.
• Figure 2: An illustration on the algorithm to generate disguises. We aim to optimize the loss $\mathcal{L}$ consisting of an input space constraint that measures the distance between the base image $x_b$ and the disguise $x_d$ in the input space, and a feature space constraint that measures the distance between the copyrighted $x_c$ and $x_d$ in the feature space.
• Figure 3: The disguised symbol on textual inversion. The first row from left to right: Column (1) the designated copyrighted symbol; Columns (2)-(5) four disguises $x_d$ generated with different $x_b$. The second row: images generated by textual inversion after training on the above $x_d$.
• Figure 4: We show the disguised copyrighted content on textual inversion. The first row: the designated copyrighted image $x_c$ (The Sunflowers by Vincent Van Gogh); the second row: three disguises $x_d$ generated with different $x_b$; the third row: images generated by textual inversion after training on the above $x_d$.
• Figure 5: We show the disguised copyrighted style on textual inversion. The first row: the designated copyrighted style $x_c$ (in the style of The Starry Night by Vincent Van Gogh); the second row: disguises $x_d$ generated with different $x_b$; the third row: images generated by textual inversion after training on the above $x_d$.