Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Identifying Models Behind Text-to-Image Leaderboards

Ali Naseh, Yuefeng Peng, Anshuman Suri, Harsh Chaudhari, Alina Oprea, Amir Houmansadr

TL;DR

This work reveals a fundamental vulnerability in voting-based text-to-image leaderboards: model anonymity can be reliably broken through embedding-space clustering, even without prompt control or training data. A simple, training-free centroid-based deanonymization using image embeddings (e.g., CLIP) achieves high accuracy across 22 models and 280 prompts, with a prompt-level distinguishability metric identifying prompts that maximize leakage. The authors also explore defenses via adversarial post-processing to perturb embeddings, quantify the associated trade-offs in image fidelity, and analyze the practical costs and implications for leaderboard design. Overall, the paper argues for stronger anonymization and evaluation protocols to preserve fairness and reliability in T2I leaderboards, while providing a concrete, scalable attack framework and measurable defense strategies.

Abstract

Text-to-image (T2I) models are increasingly popular, producing a large share of AI-generated images online. To compare model quality, voting-based leaderboards have become the standard, relying on anonymized model outputs for fairness. In this work, we show that such anonymity can be easily broken. We find that generations from each T2I model form distinctive clusters in the image embedding space, enabling accurate deanonymization without prompt control or training data. Using 22 models and 280 prompts (150K images), our centroid-based method achieves high accuracy and reveals systematic model-specific signatures. We further introduce a prompt-level distinguishability metric and conduct large-scale analyses showing how certain prompts can lead to near-perfect distinguishability. Our findings expose fundamental security flaws in T2I leaderboards and motivate stronger anonymization defenses.

Identifying Models Behind Text-to-Image Leaderboards

TL;DR

This work reveals a fundamental vulnerability in voting-based text-to-image leaderboards: model anonymity can be reliably broken through embedding-space clustering, even without prompt control or training data. A simple, training-free centroid-based deanonymization using image embeddings (e.g., CLIP) achieves high accuracy across 22 models and 280 prompts, with a prompt-level distinguishability metric identifying prompts that maximize leakage. The authors also explore defenses via adversarial post-processing to perturb embeddings, quantify the associated trade-offs in image fidelity, and analyze the practical costs and implications for leaderboard design. Overall, the paper argues for stronger anonymization and evaluation protocols to preserve fairness and reliability in T2I leaderboards, while providing a concrete, scalable attack framework and measurable defense strategies.

Abstract

Text-to-image (T2I) models are increasingly popular, producing a large share of AI-generated images online. To compare model quality, voting-based leaderboards have become the standard, relying on anonymized model outputs for fairness. In this work, we show that such anonymity can be easily broken. We find that generations from each T2I model form distinctive clusters in the image embedding space, enabling accurate deanonymization without prompt control or training data. Using 22 models and 280 prompts (150K images), our centroid-based method achieves high accuracy and reveals systematic model-specific signatures. We further introduce a prompt-level distinguishability metric and conduct large-scale analyses showing how certain prompts can lead to near-perfect distinguishability. Our findings expose fundamental security flaws in T2I leaderboards and motivate stronger anonymization defenses.
Paper Structure (46 sections, 9 equations, 10 figures, 8 tables, 1 algorithm)

This paper contains 46 sections, 9 equations, 10 figures, 8 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Leaderboard Attacks.
  4. Model Attribution.
  5. Threat Model
  6. Adversary’s Objective.
  7. Adversary’s Capabilities.
  8. Embedding-Based Deanonymization Attack
  9. Intuition
  10. Deanonymization Method
  11. One-vs-Rest Deanonymization
  12. Case 1: Access to All Models.
  13. Case 2: Access Only to the Target Model.
  14. Distinguishability Metric
  15. Model-level Separability.
  16. ...and 31 more sections

Figures (10)

  • Figure 1: Overview of our setting: (a) voting-based leaderboard, (b) adversarial deanonymization pipeline, and (c) model-specific clustering in embedding space.
  • Figure 2: Model-specific generation patterns for a fixed prompt, showing low intra-model diversity and clear inter-model differences.
  • Figure 3: Embeddings for two prompts with high (left) and low (right) distinguishability, showing clear separation versus overlap among model generations.
  • Figure 4: Deanonymization success rate across bins of distinguishability scores. Higher scores correspond to greater success, confirming that the metric predicts attack performance.
  • Figure 5: Word-cloud for keywords corresponding to Left: prompts with high distinguishability scores and Right: low distinguishability.
  • ...and 5 more figures