ImageSentinel: Protecting Visual Datasets from Unauthorized Retrieval-Augmented Image Generation

TL;DR

This work proposes ImageSentinel, a novel framework for protecting visual datasets in RAIG that synthesizes sentinel images that maintain visual consistency with the original dataset that enables protection verification through randomly generated character sequences that serve as retrieval keys.

Abstract

The widespread adoption of Retrieval-Augmented Image Generation (RAIG) has raised significant concerns about the unauthorized use of private image datasets. While these systems have shown remarkable capabilities in enhancing generation quality through reference images, protecting visual datasets from unauthorized use in such systems remains a challenging problem. Traditional digital watermarking approaches face limitations in RAIG systems, as the complex feature extraction and recombination processes fail to preserve watermark signals during generation. To address these challenges, we propose ImageSentinel, a novel framework for protecting visual datasets in RAIG. Our framework synthesizes sentinel images that maintain visual consistency with the original dataset. These sentinels enable protection verification through randomly generated character sequences that serve as retrieval keys. To ensure seamless integration, we leverage vision-language models to generate the sentinel images. Experimental results demonstrate that ImageSentinel effectively detects unauthorized dataset usage while preserving generation quality for authorized applications. Code is available at https://github.com/luo-ziyuan/ImageSentinel.

Figures (10)

• Figure 1: Illustration of our dataset protection. (a) Protected dataset structure showing the integration of sentinel images with the private dataset. (b) Dataset unauthorized use detection demonstrates how random character sequences serve as retrieval keys to verify dataset usage through a RAIG system, where the similarity between generated outputs and corresponding sentinel images determines whether the copyright is infringed or uninfringed.
• Figure 2: Overview of our ImageSentinel framework. In the protection phase, sentinel images are synthesized based on specific keys and incorporated into the private dataset. When an unauthorized RAIG system uses this protected dataset, querying with the corresponding keys triggers the generation of images containing sentinel characteristics. Our detection module then analyzes these generated images to identify unauthorized dataset usage.
• Figure 3: Our sentinel image synthesis pipeline. Given a reference image from the private dataset, we first employ the vision-language model $\mathcal{M}$ to extract comprehensive semantic attributes, including subject matter, visual style, and detailed descriptions. These extracted attributes, combined with a specific key ("VasWiW" in this example), are then fed into the text-to-image model $\mathcal{T}$ to generate a sentinel image that maintains visual consistency while naturally incorporating the key.
• Figure 4: Qualitative comparison of generated images across different RAIG systems on the LLaVA-Pretrain Dataset liu2023visual. The leftmost column shows our sentinel images, while the remaining columns show the generation results from SDXL podell2024sdxl+IP-adapter ye2023ip, OmniGen xiao2024omnigen, and GPT-4o hurst2024gpt, both with and without access to the private dataset. The numbers below each generated image indicate its DINO similarity score caron2021emerging with respect to the corresponding sentinel image in the leftmost column.
• Figure 5: Qualitative results on Product-10K bai2020products dataset. From left to right: reference images from the original dataset, our generated sentinel images, images generated through RAIG with access to sentinel images (w/ Priv. dataset), and images generated without access (w/o Priv. dataset).