Lossless Copyright Protection via Intrinsic Model Fingerprinting

TL;DR

TrajPrint tackles the problem of protecting diffusion-model copyrights without compromising generation quality or requiring model modification. It leverages the deterministic, invertible nature of DDIM to map a watermarked anchor to a model-specific latent trajectory, then jointly optimizes a fingerprint noise under dual-end constraints to encode a robust trigger aligned with the target manifold. Verification is performed by querying a black-box suspect model with the optimized noise and statistically testing watermark recovery using a one-sample $t$-test, yielding high confidence in infringement when the target model is used. The approach demonstrates lossless verification across architectures, strong resilience to common model modifications, and practical feasibility for atomic inference, albeit with limitations in API environments that cannot accept initial noise injections. Practically, this provides a scalable, secure means to assert diffusion-model ownership in real-world deployments.

Abstract

The exceptional performance of diffusion models establishes them as high-value intellectual property but exposes them to unauthorized replication. Existing protection methods either modify the model to embed watermarks, which impairs performance, or extract model fingerprints by manipulating the denoising process, rendering them incompatible with black-box APIs. In this paper, we propose TrajPrint, a completely lossless and training-free framework that verifies model copyright by extracting unique manifold fingerprints formed during deterministic generation. Specifically, we first utilize a watermarked image as an anchor and exactly trace the path back to its trajectory origin, effectively locking the model fingerprint mapped by this path. Subsequently, we implement a joint optimization strategy that employs dual-end anchoring to synthesize a specific fingerprint noise, which strictly adheres to the target manifold for robust watermark recovery. As input, it enables the protected target model to recover the watermarked image, while failing on non-target models. Finally, we achieved verification via atomic inference and statistical hypothesis testing. Extensive experiments demonstrate that TrajPrint achieves lossless verification in black-box API scenarios with superior robustness against model modifications.

Figures (7)

• Figure 1: Illustration of the TrajPrint. We retrace the generative trajectory to bind a specific fingerprint noise to the model's intrinsic path. This noise acts as a fingerprint carrier, triggering valid watermark reconstruction on the target model due to manifold match while remaining invalid on other models.
• Figure 2: Overview of the proposed TrajPrint. (1) Fingerprint noise generation: We construct a watermarked anchor containing a binary message. Initialized via DDIM inversion, the fingerprint noise is optimized end-to-end through the frozen diffusion model under dual-end constraints, ensuring its generation trajectory targets the anchor. (2) Verification: The optimized noise is fed into candidate models. We decode the watermark from the generated images and apply a statistical test to achieve high-confidence copyright verification.
• Figure 3: Visualization of reconstruction errors in direct DDIM inversion. (a) Original anchor images. (b) Reconstructed images.
• Figure 4: Visual results of cross-model reconstruction. The target model successfully recovers the watermarked anchor using the fingerprint noise, while other models generate disparate content.
• Figure 5: Visual results of the robustness study. Our method demonstrates strong stability, recovering the watermarked anchor successfully across different attack settings.