Paper deep dive
Fingerprinting Text-to-Image Diffusion Models via Collapsed Generation
Yuanmin Huang, Chen Chen, Geng Hong, Xiaoyu You, Hui Xue, Zhenxing Qian, Mi Zhang, Min Yang
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Proprietary text-to-image diffusion models are increasingly distributed as hosted services and downloadable checkpoints, making their intellectual property (IP) protection an increasingly critical concern when model leakage, copying, or unauthorized fine-tuning is disputed. In this work, we present a non-invasive model fingerprinting framework based on \emph{collapsed generation}, a phenomenon where certain input conditions produce highly consistent images across multiple stochastic seeds. We show that collapsed generation is an intrinsic, model-dependent property of the learned generation process. These collapse-prone conditions therefore expose model-specific behavioral signatures, enabling reliable ownership verification without embedding invasive watermarks. After preparing conditions on the source model, the framework verifies a suspect model under two access settings: (1) white-box pipeline access, where optimized continuous embeddings can be injected into the generation process, and (2) black-box API-only access, where natural language prompts are queried through the service interface. In both cases, ownership evidence is measured by whether the suspect model reproduces the source model's collapse behavior across stochastic samplings. Extensive experiments across UNet- and transformer-based diffusion models show that collapsed generation fingerprints can distinguish different source models with low confusion. These fingerprints remain verifiable in fine-tuned derivatives and under common and adaptive model- or query-level obfuscations, while requiring only a modest verification query budget. Together, these results establish collapsed generation as a reliable intrinsic evidence source for non-invasive diffusion model ownership verification.
Tags
Links
- Source: https://arxiv.org/abs/2608.11732v1
- Canonical: https://arxiv.org/abs/2608.11732v1
Trouble viewing inline? Open PDF directly →
Full Text
92,828 characters extracted from source content.
Expand or collapse full text
Fingerprinting Text-to-Image Diffusion Models via Collapsed Generation Yuanmin Huang Chen Chen Geng Hong Xiaoyu You Hui Xue Zhenxing Qian Mi Zhang Min Yang Thanks: Yuanmin Huang, Chen Chen, Geng Hong, Zhenxing Qian, Mi Zhang, and Min Yang are with Fudan University, Shanghai, China (e-mail: yuanminhuang23@m.fudan.edu.cn; chenc24@m.fudan.edu.cn; ghong@fudan.edu.cn; zxqian@fudan.edu.cn; mi_zhang@fudan.edu.cn; m_yang@fudan.edu.cn). Thanks: Xiaoyu You is with East China University of Science and Technology, Shanghai, China (e-mail: xiaoyuyou@ecust.edu.cn). Thanks: Hui Xue is with Alibaba Group, Hangzhou, China (e-mail: hui.xueh@alibaba-inc.com). Thanks: Min Yang is also with Shanghai Pudong Research Institute of Cryptology, and Engineering Research Center of Cyber Security Auditing and Monitoring, Ministry of Education, China. Abstract Proprietary text-to-image diffusion models are increasingly distributed as hosted services and downloadable checkpoints, making their intellectual property (IP) protection an increasingly critical concern when model leakage, copying, or unauthorized fine-tuning is disputed. In this work, we present a non-invasive model fingerprinting framework based on collapsed generation, a phenomenon where certain input conditions produce highly consistent images across multiple stochastic seeds. We show that collapsed generation is an intrinsic, model-dependent property of the learned generation process. These collapse-prone conditions therefore expose model-specific behavioral signatures, enabling reliable ownership verification without embedding invasive watermarks. After preparing conditions on the source model, the framework verifies a suspect model under two access settings: (1) white-box pipeline access, where optimized continuous embeddings can be injected into the generation process, and (2) black-box API-only access, where natural language prompts are queried through the service interface. In both cases, ownership evidence is measured by whether the suspect model reproduces the source model’s collapse behavior across stochastic samplings. Extensive experiments across UNet- and transformer-based diffusion models show that collapsed generation fingerprints can distinguish different source models with low confusion. These fingerprints remain verifiable in fine-tuned derivatives and under common and adaptive model- or query-level obfuscations, while requiring only a modest verification query budget. Together, these results establish collapsed generation as a reliable intrinsic evidence source for non-invasive diffusion model ownership verification. Index Terms: Text-to-Image Diffusion Models, Intellectual Property Protection, Model Fingerprinting, Ownership Verification. Fig. 1: Collapsed generation as a non-invasive ownership signal for diffusion models. (a) Collapsed generation. Under ordinary input conditions, different stochastic seeds usually produce diverse images, whereas a collapse-prone condition yields highly consistent outputs on the source model. Such collapse behavior is model-dependent and therefore can serve as a behavioral fingerprint. (b) Ownership verification. The model owner prepares such conditions on the source model, and the verifier tests whether a suspect model reproduces the corresponding cross-seed consistency. The framework supports both pipeline-access and API-only verification, and remains effective under model obfuscations. I Introduction The rapid advancement of text-to-image (T2I) diffusion models has profoundly transformed generative AI, enabling high-fidelity image synthesis directly from natural language prompts [27, 2]. These models now serve as foundational components in creative industries and commercial pipelines [33, 18, 7]. As proprietary checkpoints are increasingly released, shared, fine-tuned, or deployed behind commercial APIs, disputes over model leakage, unauthorized reuse, and derivative ownership have become a practical intellectual property (IP) concern [17, 25]. This growing tension underscores the need for dedicated IP protection mechanisms for diffusion models. Existing IP protection methods for diffusion models generally fall into two categories: invasive model watermarking [44, 10, 21] and non-invasive model fingerprinting [41, 11, 34, 19]. The former embeds ownership signals by altering model parameters, training objectives, or generation outputs, which often introduces additional computational overhead and may compromise generation quality. In contrast, non-invasive fingerprinting methods attempt to identify models through their inherent behaviors under specific inputs, without modifying model parameters or retraining, thereby preserving model integrity and usability. However, existing non-invasive fingerprints only partially address the verification needs arising from leaked checkpoints, unauthorized derivatives, and hosted T2I services. Methods based on internal representations or denoising trajectories can be useful when the verifier obtains a checkpoint or a controllable generation pipeline, but their verification evidence is tied to model-internal readouts or specialized sampling procedures [19, 34]. Such assumptions do not hold when the suspect model is exposed only as a hosted T2I service that returns final images. Conversely, query-based methods are closer to the API-only setting, but existing designs often rely on optimized prompt suffixes whose linguistic abnormality and induced semantic deviation make the verification queries easier to distinguish as non-ordinary service interactions [11]. These limitations motivate a different type of fingerprint signal: one whose evidence is expressed in the model’s generation behavior, can be actively elicited when the generation pipeline is controllable, and can still be observed through natural prompts when only API outputs are available. In this work, we exploit an intrinsic behavior of diffusion models, termed collapsed generation, as a non-invasive ownership signature. Under ordinary prompts, independent stochastic samplings usually produce diverse images. Under certain model-dependent input conditions, however, the sampling stochasticity is suppressed and different generation trajectories converge to visually similar outputs [5, 12], as illustrated in Fig. 1 (a). Such collapse-prone conditions are shaped by the learned data distribution, optimization dynamics, and model architecture [32, 39], and therefore can expose behavioral signatures that are difficult for independently trained models to reproduce. Based on this observation, we formulate collapse-prone conditions as model-intrinsic fingerprints for ownership verification. A model owner first constructs a fingerprint set on the source model with the resulting conditions as reference fingerprints, as illustrated in Fig. 1 (b). During verification, the verifier applies these conditions to a suspect model and measures whether its independent stochastic generations reproduce the characteristic cross-seed consistency of the source model. We consider two verification interfaces for the suspect model. Under white-box pipeline access, the verifier can control the generation process and inject continuous prompt embeddings, whereas under black-box API-only access, the verifier submits text prompts and observes the final generated images. In ownership disputes involving leaked checkpoints or unauthorized derivative models (e.g., through LoRA fine-tuning), the suspect model may be available as a controllable generation pipeline. Such pipeline access allows the verifier to actively elicit model-specific collapsed generation by searching the continuous text embedding space. However, directly searching this space can be computationally demanding, as it requires repeated differentiation through the iterative generation process. We find that the collapse signature becomes distinguishable during the early denoising stage, well before the final image is produced. This observation motivates a truncated optimization strategy that efficiently synthesizes reproducible fingerprint embeddings for checkpoint-level ownership verification. In other cases, an unauthorized model may be deployed behind a hosted T2I service and exposed only through an end-to-end API. Verification must therefore rely on text prompts and the resulting generated images. Consequently, the fingerprint conditions must be realized as text prompts rather than optimized continuous embeddings. The challenge is to identify prompts that intrinsically trigger model-specific collapse without exhaustively screening a vast prompt space through repeated generation. We find that naturally collapsed prompts are strongly concentrated among training samples with unusually low loss. This relationship provides an efficient way to mine natural fingerprint prompts from training dynamics for service-level ownership verification. Despite their different construction mechanisms, both realizations rely on the same verification principle. A suspect model is associated with the source model when the prepared fingerprint conditions reproduce statistically abnormal consistency across independent generations. This shared criterion provides a unified behavioral basis for ownership verification. Our main contributions are summarized as follows: • We identify collapsed generation as a model-intrinsic behavioral signature and formulate its abnormal consistency across stochastic generations as a non-invasive fingerprint signal for T2I model ownership verification. • We develop a unified framework that bridges white-box checkpoint-level and black-box service-level ownership verification through the same collapsed-generation signature. Building on insights from early denoising behavior and training dynamics, the framework constructs continuous embeddings for controllable pipelines and natural prompts for hosted APIs. • We evaluate the framework across multiple T2I model families spanning UNet- and transformer-based architectures. The results demonstrate clear discrimination among independently trained models, while the fingerprints remain detectable after fine-tuning, pruning, quantization, and adaptive query-time interventions with a modest verification query budget. I Related Work TABLE I: Methodological comparison of non-invasive diffusion model fingerprints. White-box and black-box refer to the verifier’s access to the suspect model. The table compares the input conditions and evidence used for verification, while further specifying the model control or observations required by each method. Method Verification Access Input Condition for Verification Verification Evidence Required Control or Observation Natural Query FingerInv [34] White-box Optimized latent noise QR-code recovery from the final image DDPM-compatible denoising control and intermediate denoising outputs N/A DiffIP [19] White-box Inputs for representation extraction Representation-fingerprint similarity Internal denoising representations of both models N/A Ours White-box Optimized continuous prompt embedding Cross-seed output consistency Text-embedding injection and final-image observation N/A TVN [11] Black-box Text prompt with an optimized adversarial suffix Target-specific semantic deviation Text-query API and final-image observation No Ours Black-box Natural collapsed prompt Cross-seed output consistency Text-query API and final-image observation Yes I-A Model Ownership Verification Model ownership verification aims to determine whether a suspect model originates from, or is derived from, a source model claimed by an owner. Existing approaches generally establish ownership through model watermarks or model fingerprints. Model watermarking proactively embeds a secret ownership signal into the protected model through its parameters, training objective, or trigger-response behavior [35, 1, 29]. Model fingerprinting instead characterizes a trained model using distinctive decision boundaries, adversarial responses, or internal behaviors, without modifying the protected model [22, 4, 45]. For reliable ownership verification, the verification signal should remain reproducible after model obfuscations, such as fine-tuning, pruning, and quantization, while being sufficiently specific to distinguish the claimed source from independently trained or unrelated models. The realization of these requirements depends on the architecture and deployment interface of the protected model, motivating specialized IP protection methods for diffusion models. I-B Diffusion Model IP Protection Invasive Model Watermarking. A prominent line of diffusion model IP protection relies on watermarking, which deliberately implants a predefined ownership signal before deployment and later verifies whether the signal can be recovered from the model’s generated outputs. By embedding an owner-controlled signal that can be recovered through prescribed queries or output analysis, these methods provide explicit evidence for subsequent ownership verification. Zhao et al. [44] introduce watermark-bearing examples during training so that the resulting model reproduces designated watermark patterns, while Liu et al. [21] use secret trigger prompts to activate predefined watermark responses. Stable Signature [10] follows a different route by fine-tuning the latent decoder so that generated images carry an invisible signature without requiring a special trigger at inference time. More recent methods incorporate watermark conditioning or specialized training objectives to improve the persistence of ownership signals after downstream adaptation such as fine-tuning [24, 36]. Despite their different embedding mechanisms, these methods require an ownership signal to be deliberately introduced through the training data, optimization procedure, or model components before release. Such intervention introduces additional training and deployment overhead and may perturb the model’s original output distribution, potentially affecting its normal generation behavior. It also limits retrospective protection, since an already trained and unmarked model must be fine-tuned or retrained before watermark-based verification can be applied. Non-Invasive Model Fingerprinting. The limitations of model watermarking motivate non-invasive model fingerprinting, which derives ownership evidence from behaviors already present in a trained model without modifying its parameters or training objective to implant an additional signal. Existing diffusion model fingerprints can be organized primarily according to the verifier’s access to the suspect model during ownership verification. This access constrains both the fingerprint conditions that can be applied to the suspect model and the evidence available for the final ownership decision. Note that white-box and black-box here refer to verification-time access to the suspect model rather than the owner’s access to the source model during fingerprint construction. Table I summarizes the access assumptions and verification evidence of these methods. Under white-box access, the verifier can control the generation pipeline or inspect intermediate model information. FingerInv [34] constructs optimized latent-noise fingerprints through DDPM inversion and requires a controllable DDPM-compatible denoising process with access to intermediate denoising information. Its final ownership decision is based on whether a predefined QR-code pattern can be recovered from the generated image. DiffIP [19] extracts representation fingerprints from internal denoising features and verifies ownership by comparing the representations of the source and suspect models. The two methods therefore rely on different ownership evidence despite both operating under white-box access. Under black-box access, the verifier can only submit text queries and observe the final generated images. TVN [11] realizes model fingerprints as text prompts with optimized non-transferable suffixes and verifies ownership from target-specific semantic deviations in the resulting images. Although it supports end-to-end API verification, its optimized suffixes may exhibit linguistic abnormality. Moreover, since the generated outputs can deviate from the semantics of ordinary user queries, the verification queries may be more easily detected or filtered. Built on collapsed generation, our framework supports both white-box and black-box ownership verification using the same behavioral evidence: statistically abnormal cross-seed consistency in the final generated images. For white-box verification, although pipeline control is required to apply optimized continuous conditions, the ownership decision relies only on the final outputs rather than intermediate denoising states or internal representations, avoiding the internal-information dependence of existing white-box methods. For black-box verification, our framework uses naturally collapsed prompts instead of optimized adversarial queries, making the verification queries closer to ordinary service interactions and less distinguishable by query detection or filtering mechanisms. I-C Collapsed Generation in Diffusion Models Prior studies have shown that diffusion models can memorize and reproduce training examples under particular input conditions [5, 31, 32, 37]. Carlini et al. [5] demonstrated that text-to-image diffusion models can regenerate individual training examples with high fidelity, enabling large-scale training data extraction. Subsequent studies investigated the factors underlying such behavior, including data duplication [32], the geometry of the learned probability distribution [15, 28], training dynamics [39], and localized model parameters or subspaces [6, 12]. To identify memorized content, existing extraction methods search for prompts that trigger repeatable generations and compare the resulting images with reference training samples using pixel- or feature-level similarity measures [5, 31, 26]. Together, these findings suggest that particular input conditions may induce highly concentrated generation behavior, under which independent stochastic samplings yield visually similar outputs. We refer to this phenomenon as collapsed generation. Its dependence on the learned data distribution, training dynamics, and model parameters motivates our investigation of collapsed generation as a model-dependent behavioral signature for ownership verification. I Preliminaries I-A Threat Model We consider an IP protection scenario in which a model owner develops a proprietary T2I diffusion model, referred to as the source model. An adversary may obtain the source model without authorization and redistribute it directly, produce a modified or obfuscated derivative, or deploy it as a commercial service. The model under examination is referred to as the suspect model. The objective of the owner, or an authorized verifier acting on the owner’s behalf, is to determine whether the suspect model originates from or is derived from the source model. A complete model fingerprinting framework involves both fingerprint construction and ownership verification. During fingerprint construction, we assume that the owner has full access to the source model and its training process. To address potential ownership ambiguity arising from competing fingerprint claims, we assume a standard commitment-based verification protocol [1]. Before deployment, the owner commits the fingerprint set to a trusted third party. A valid commitment with a timestamp preceding competing claims establishes the priority of the owner’s fingerprint evidence. For ownership verification, we consider two settings that differ in the verifier’s access to the suspect model: White-box verification. In this setting, the suspect model is available as a checkpoint, for example, after unauthorized open-source redistribution [41] or when it is lawfully obtained for forensic examination [35, 29]. The verifier has access to the model parameters and architecture and can observe and control the inference pipeline, including its latent variables, conditioning inputs, and intermediate denoising states. Black-box verification. In this setting, the suspect model is deployed as an end-to-end T2I API or online service [10, 24, 1]. The verifier can submit text prompts and observe the corresponding generated images, but has no access to the model parameters, architecture or intermediate activations. We assume that the adversary may apply model-level obfuscations, such as fine-tuning, pruning, and quantization, or, in the black-box setting, query-time interventions to evade verification, while preserving acceptable generation quality for normal use. I-B Principles of Model Fingerprinting Following prior work [34], we consider three desirable properties for diffusion model fingerprints: Uniqueness. The fingerprint should be sufficiently distinctive to uniquely identify the target model among others. In particular, a fingerprint constructed from one source model should not be validated on an unrelated suspect model. Robustness. The fingerprint should remain verifiable even after the model undergoes obfuscations. This property prevents adversaries from invalidating the verification. Stealthiness. For black-box verification, fingerprint queries should appear natural and resemble ordinary service interactions. This reduces the likelihood that the queries are detected or filtered by the suspect service. I-C Diffusion Models Diffusion models generate data by iteratively denoising a random noise sample through a learned reverse process [13]. Let x^0 x_0 denote the clean image, and xtt=1T\x_t\_t=1^T represent its progressively noised versions obtained via a forward diffusion process controlled by a variance schedule βt\ _t\: xt=α¯tx^0+1−α¯tϵ,ϵ∼(0,I),x_t= α_t x_0+ 1- α_tε, ε (0,I), (1) where α¯t=∏i=1t(1−βi) α_t= _i=1^t(1- _i). The reverse denoising process is parameterized by a neural network ϵθ _θ that predicts the noise added at each step. Given a noisy sample xtx_t, a single reverse step reconstructs xt−1x_t-1 as: xt−1=1αt(xt−1−αt1−α¯tϵθ(xt,t))+σtzt,x_t-1= 1 _t (x_t- 1- _t 1- α_t\, _θ(x_t,t) )+ _tz_t, (2) where σt _t is the step-dependent noise scale and zt∼(0,I)z_t (0,I) is random noise. In T2I diffusion models [27], additional condition c is derived from a text encoder EtextE_text that maps a prompt p to an embedding c=Etext(p)c=E_text(p). This augments the denoiser ϵθ _θ with text embedding c, enabling conditional generation from a prompt p. The overall sampling process from noise xT∼(0,I)x_T (0,I) to the generated image x0x_0 can be expressed as a function of the prompt: x0=Gθ(xT,c=Etext(p)),x_0=G_θ(x_T,c=E_text(p)), (3) where xTx_T controls the stochasticity of the generation. For a given prompt p, different initial samples xTx_T typically yield diverse outputs, whereas consistent and low-diversity outputs indicate a collapsed generation behavior. This behavior forms the foundation for analyzing model-specific generative characteristics, which are exploited in our fingerprinting framework. (a) (b) Fig. 2: (a): Distribution of average pairwise similarity scores s¯(p,K=4) s(p,K=4) for normal prompts vs. collapsed prompts on SD 1.4. (b): Distribution of s¯(p,K=4) s(p,K=4) for SD 1.4 collapsed prompts vs. SD 2.1 collapsed prompts on SD 1.4 (left) and SD 2.1 (right), respectively. Collapsed generations not only differ from normal ones but also exhibit model-specific characteristics, enabling effective fingerprinting. Fig. 3: Different model architectures, training data, and optimization dynamics lead to distinct generative manifolds, resulting in model-specific collapsed generation behaviors. IV Methodology IV-A Collapsed Generation in Diffusion Models Recent studies have shown that diffusion models can memorize and reproduce a subset of their training data [5, 32]. One manifestation of such memorization is reduced generation diversity. For certain prompts associated with memorized samples, independent stochastic samplings can produce highly similar outputs [28, 15]. This behavior contrasts with typical diffusion generation, where different initial noises are expected to yield diverse images under the same prompt. Although diffusion models are generally less prone to mode collapse than GANs [43, 23], this prompt-specific concentration exhibits a similar loss of output diversity. We term this phenomenon collapsed generation and formalize it through cross-seed consistency. Definition 1 (Collapsed Generation). Let c denote the conditioning embedding supplied to a diffusion model GθG_θ. For a text prompt p, c=Etext(p)c=E_text(p). Given K independently sampled initial noises xT(k)k=1K\x_T^(k)\_k=1^K, let x0(k)(c)=Gθ(xT(k),c)x_0^(k)(c)=G_θ(x_T^(k),c) denote the corresponding generated images. Their cross-seed consistency is measured as s¯θ(c,K)=2K(K−1)∑i=1K−1∑j=i+1Ks(x0(i)(c),x0(j)(c)), s_θ(c,K)= 2K(K-1) _i=1^K-1 _j=i+1^Ks\! (x_0^(i)(c),x_0^(j)(c) ), (4) where s(⋅,⋅)s(·,·) is a perceptual similarity metric. The generation conditioned on c is considered collapsed if s¯θ(c,K)≥τs, s_θ(c,K)≥ _s, (5) where τs _s is the collapse detection threshold. When the model is clear from context, we omit the subscript θ. For a text prompt p, we use s¯(p,K) s(p,K) as shorthand for s¯θ(Etext(p),K) s_θ(E_text(p),K). In this work, we instantiate s(⋅,⋅)s(·,·) using the Self-Supervised Copy Detection (SSCD) score [26]. SSCD computes the cosine similarity between image representations extracted by a self-supervised model trained for image copy detection. Its sensitivity to visual and structural correspondence makes it suitable for measuring output consistency. Collapsed generation represents an atypical yet repeatable behavior of the learned generation process. As shown in Fig. 2(a), prompts that induce collapse on SD 1.4 form a high-consistency distribution that is clearly separated from that of normal prompts. This separation makes the model’s intrinsic collapse behavior observable through cross-seed similarity, suggesting its potential as a behavioral fingerprint. We next investigate whether such collapse patterns are specific to the model that produces them. Fig. 4: Overview of fingerprint construction. (a) Continuous-Embedding Synthesis. For pipeline-access verification, the owner optimizes conditioning embeddings on the source model. Starting from an initial embedding cic_i and K independent noises xT(k)k=1K\x_T^(k)\_k=1^K, truncated optimization minimizes the dispersion among early intermediate latents to produce ci∗c_i^*. Repeating this procedure yields the embedding fingerprint set fC_f. (b) Natural-Prompt Mining. For API-only verification, per-sample denoising loss is used to identify a low-loss candidate pool candP_cand. The candidates are then evaluated by their cross-seed consistency on the source model, and the strongest prompts form the natural-prompt fingerprint set fP_f. IV-B Model Fingerprint via Collapsed Generation For collapsed generation to serve as a model fingerprint, the collapse-inducing condition should be specific to the learned generation process. Given a source model, a fingerprint condition is expected to produce high cross-seed consistency on the source model while eliciting substantially weaker consistency on independently trained models. This property corresponds to the uniqueness requirement of model fingerprinting. We first examine this property using naturally occurring collapsed prompts from SD 1.4 and SD 2.1. Specifically, we apply the collapsed prompts identified for each source model to both models and measure their cross-seed consistency. As shown in Fig. 2 (b), matched prompt–model pairs produce substantially higher consistency scores than mismatched pairs. The same prompt therefore induces different collapse responses across models, showing that collapsed generation reflects characteristics of the learned model rather than the input condition alone. This model dependence arises from differences in the learned conditional generation mappings. Training data, model architecture, and optimization dynamics jointly shape how a conditioning input is mapped to the generative manifold [32, 31, 28]. Consequently, a condition located in a collapsed region of one model may produce diverse generations in another, as conceptualized in Fig. 3. These model-dependent collapsed regions provide the behavioral basis for constructing model fingerprints. The comparison above involves T2I models that may differ in their training data or model configurations. For ownership verification, a stronger requirement is that collapsed fingerprints distinguish independently trained model instances even when these factors are controlled. We examine this requirement in Sec. V-A, where the model architecture, training data, and optimization procedure are held fixed, while only the parameter initialization is varied. The resulting models exhibit distinguishable collapsed fingerprints, showing that the learned collapse behavior can be specific to an individual training outcome. This result is also relevant to models trained from shared public resources. Even when independently trained models use the same public dataset, different parameter initializations can lead to different learned parameters and memorization patterns, thereby producing distinct collapsed regions [5, 32]. The same mechanism provides a basis for differentiating modern large-scale T2I models, while practical differences in data curation, architecture, and training pipelines introduce further variation into their learned generation behavior. Such training-dependent collapse behavior provides the granularity required for ownership verification. Having established the observability and model specificity of collapsed generation, we next describe how the corresponding fingerprint conditions are constructed. IV-C Fingerprint Construction Having established the model specificity of collapsed generation, the next challenge is to turn this behavioral signal into reproducible fingerprint conditions. The inputs that induce collapsed generations are not known a priori, and their admissible form is determined by the interface available during verification. With access to the inference pipeline, the continuous conditioning space can be actively searched to synthesize fingerprint embeddings. Under end-to-end T2I API-only access, collapse must instead be elicited by text prompts. We address these two settings through pipeline-access continuous embedding synthesis and API-only natural-prompt mining, respectively. Fig. 5: Visualization of predicted x0x_0 along the denoising process for a representative collapsed and normal example in SD 1.4. For the collapsed example (top), stable and recognizable output content emerges within the first few denoising steps. For the normal example (bottom), the prediction remains ambiguous at the early stage and becomes progressively clearer as denoising proceeds. Continuous-Embedding Synthesis. In checkpoint-level ownership verification, white-box access gives the verifier control over the suspect model’s inference pipeline, allowing continuous conditioning embeddings to be supplied directly. This makes continuous embeddings a viable representation for fingerprint conditions. The owner therefore constructs such fingerprints by optimizing embeddings on the source model to induce collapsed generation, as illustrated in Fig. 4 (a). We construct multiple embedding fingerprints for joint evaluation during verification. For the i-th fingerprint, we initialize ci=Etext(pi)c_i=E_text(p_i) and sample K independent initial noises xT(k)k=1K\x_T^(k)\_k=1^K. We then optimize cic_i such that the corresponding sampling trajectories suppress the variation introduced by different initial noises and converge toward similar outputs. A direct approach would maximize the final-image consistency s¯θ(ci,K) s_θ(c_i,K) defined in Eq. 4. However, each optimization iteration would require differentiating through the complete denoising process, decoding all resulting latents into images, and evaluating their perceptual similarity. This makes direct optimization computationally and memory intensive, particularly when multiple trajectories are jointly optimized [8, 20]. In this work, our key observation is that the characteristic output content of collapsed generation becomes established early in the denoising process. As illustrated in Fig. 5, for a collapsed example, the predicted clean image rapidly develops a stable and recognizable structure within the first few denoising steps. In contrast, for a normal example, the prediction remains ambiguous at the early stage and becomes progressively clearer as denoising proceeds. This contrast suggests that the generation tendency underlying collapse is already reflected in early intermediate states. Motivated by this observation, we adopt truncated optimization, which minimizes the dispersion among early intermediate latents from independent initial noises as a surrogate for final-image consistency. Let xT−ttrunc(k)(ci)x_T-t_trunc^(k)(c_i) denote the intermediate latent obtained from xT(k)x_T^(k) after the first ttrunct_trunc denoising steps, and let x¯T−ttrunc(ci)=1K∑k=1KxT−ttrunc(k)(ci) x_T-t_trunc(c_i)= 1K _k=1^Kx_T-t_trunc^(k)(c_i) (6) denote their mean. We define the collapse loss as ℒCollapse(ci)=1K∑k=1K‖xT−ttrunc(k)(ci)−x¯T−ttrunc(ci)‖22.L_Collapse(c_i)= 1K _k=1^K \|x_T-t_trunc^(k)(c_i)- x_T-t_trunc(c_i) \|_2^2. (7) Minimizing this objective drives the early denoising trajectories toward a shared latent region. Since gradients are propagated through only the first ttrunct_trunc steps, the remaining denoising process, VAE decoding, and image-level similarity computation are excluded from the optimization loop, thereby reducing both computational and memory costs. Repeating this procedure from M initial embeddings produces the fingerprint set f=ci∗∣ci∗=argminciℒCollapse(ci),i=1,…,M.C_f= \c_i^* c_i^*= _c_iL_Collapse(c_i),\ i=1,…,M \. (8) After optimization, the owner evaluates each ci∗c_i^* through complete sampling on the source model and measures its final-image cross-seed consistency using Eq. 4. The detailed optimization procedure is provided in Appendix A. Fig. 6: Cumulative distribution of training loss for collapsed and normal samples in SD 1.4. The loss is computed as the MSE between the ground-truth noise ϵε and the predicted noise ϵ ε at intermediate timesteps (t∈[450,550]t∈[450,550]) [42]. Collapsed samples are predominantly concentrated in the low-loss region. Consequently, applying a low-loss threshold yields a significantly higher proportion of collapsed samples (e.g., a likelihood ratio of roughly 12.512.5 at a threshold of 0.020.02), enabling efficient extraction of fingerprint prompts. Natural-Prompt Mining. When the suspect model is exposed only through an end-to-end T2I API, the continuous embeddings constructed above cannot be directly replayed. In black-box verification, fingerprint conditions must therefore be represented as text prompts. We further construct them from naturally occurring prompts associated with the source model’s training data, allowing the resulting fingerprint queries to retain the form of ordinary API inputs. The main challenge is to efficiently identify prompts that induce collapsed generation among the large-scale training data of modern T2I models. A direct search would require generating K images for every candidate prompt and evaluating their cross-seed consistency. Applying this procedure to a large training collection would incur a substantial number of complete sampling runs. We address this search cost by exploiting the relationship between collapsed generation and sample-level training loss [3]. As shown in Fig. 6, training samples associated with collapsed generation are substantially enriched in the low-loss region. The model owner can therefore record per-sample denoising losses during training and retain the prompts associated with low-loss samples as a candidate pool candP_cand, as illustrated in Fig. 4 (b). Only this reduced candidate pool requires output-level evaluation. For each p∈candp _cand, the owner generates K samples on the source model and computes the cross-seed consistency s¯(p,K) s(p,K). The owner selects the M prompts with the highest consistency scores to form f=pi∗i=1MP_f=\p_i^*\_i=1^M. The resulting prompts can subsequently be submitted to the suspect model through its standard text interface. The two construction strategies yield interface-compatible fingerprint sets fC_f and fP_f, both of which are evaluated through the cross-seed consistency test described next. IV-D Fingerprint Verification Observing a high consistency score on the suspect model is not by itself sufficient for ownership verification. Normal prompts may occasionally produce similar outputs, while an individual fingerprint condition may exhibit an atypical response. The main challenge is therefore to determine whether the collapse induced by the fingerprint set is statistically distinguishable from the source model’s normal generation behavior. We address this challenge through source-referenced statistical calibration and set-level aggregation. The same verification principle applies to both embedding and text fingerprints. Let Gθ′G_θ denote the suspect model. For an embedding fingerprint cm∗∈fc_m^* _f, the verifier supplies the embedding directly to the suspect pipeline; for a natural-prompt fingerprint pm∗∈fp_m^* _f, the verifier submits the corresponding text prompt. In either case, K independent outputs are collected and their cross-seed consistency is computed using Eq. 4. The responses of the M fingerprints are then aggregated as s¯f=1M∑m=1Ms¯θ′(cm∗,K) s_f= 1M _m=1^M s_θ (c_m^*,K) (9) for fC_f, or equivalently s¯f=1M∑m=1Ms¯θ′(pm∗,K) s_f= 1M _m=1^M s_θ (p_m^*,K) for fP_f. Before deployment, the owner establishes a normal-generation reference sample on the source model using a set of normal prompts, which are generated independently by GPT-4 in our implementation. Let un=s¯θ(pn,K)n=1N\u_n= s_θ(p_n,K)\_n=1^N denote the resulting reference scores, and let μ0 _0 and σ0 _0 be their sample mean and standard deviation. Treating the aggregate fingerprint response s¯f s_f as a new observation relative to this reference sample, we perform a right-tailed predictive t-test: tf=s¯f−μ0σ01+1/N,pval=1−FtN−1(tf),t_f= s_f- _0 _0 1+1/N, p_val=1-F_t_N-1(t_f), (10) where FtνF_t_ν denotes the Student’s t CDF with ν degrees of freedom. A small pvalp_val indicates that the aggregate fingerprint response lies in the upper tail of the source model’s normal-generation reference, providing evidence that the suspect model reproduces the source model’s collapsed fingerprint behavior. Given a decision threshold τf _f, we accept the ownership claim when pval<τf.p_val< _f. (11) The model specificity established above makes this decision selective across models: independently trained models are not expected to reproduce the same set-level response, providing the uniqueness required for ownership verification. Aggregating multiple fingerprint responses further reduces the influence of an anomalous individual condition. Moreover, the normal-generation reference can be prepared before deployment and reused without requiring additional normal-prompt queries to the suspect model. The detailed procedure is provided in Appendix A. For API-only verification, an additional practical challenge is to prevent the fingerprint queries from being readily distinguished from normal service interactions, i.e., stealthiness. Our natural-prompt fingerprints preserve the linguistic form of normal user inputs, avoiding the conspicuous token patterns introduced by adversarially optimized prompts, as evaluated in Sec. V-D. Beyond the appearance of individual prompts, stealthiness also depends on the pattern in which repeated queries are issued. The verification statistic requires K independent generations for each prompt, but these generations need not be obtained consecutively or within a single session. They may be collected over temporally separated interactions and, when appropriate, pooled across multiple verification clients before applying the same statistical test. Under the default configuration of M=4M=4 and K=4K=4, this amounts to a total of 1616 fingerprint queries. Together, the natural prompt form, modest query budget, and flexible collection schedule jointly support stealthy verification. We further evaluate robustness against query-time interventions in Sec. V-D. V Experiments Following the principles in Sec. I-B, we organize our evaluation around four research questions. RQ1: Uniqueness. Are collapsed-generation fingerprints specific to their source models and distinguishable from independently trained models? RQ2: Robustness. Do the fingerprints remain verifiable after model modifications and adaptive query-time obfuscations? RQ3: Stealthiness. In the API-only setting, do fingerprint queries resemble ordinary user prompts and remain difficult to detect? RQ4: Efficiency. Can collapsed-generation fingerprints be constructed with practical computational overhead? In the following, we first present a controlled preliminary study using conditional DDPMs to validate the uniqueness of collapsed-generation fingerprints. We then describe the common experimental setup for T2I models and evaluate fingerprint uniqueness and robustness under both white-box pipeline access and black-box API-only access. For the latter, we additionally assess the stealthiness of fingerprint queries. Finally, we analyze the computational cost of fingerprint construction. V-A Preliminary Study: Model-Specific Collapse (a) Confusion matrix (b) Representative generations Fig. 7: Controlled validation of fingerprint uniqueness across four independently trained conditional DDPMs. (a) Cross-model verification matrix. Rows represent the source models of the fingerprint sets, columns represent the queried models, and lower pvalp_val indicate stronger matches. (b) Representative cross-seed generations. The left panel shows one fingerprint condition from each model evaluated on its corresponding source model. The right panel applies the first fingerprint condition from the left panel to all four models, producing consistent outputs on the matched source model and diverse outputs on the three mismatched models. To answer RQ1, we conduct a controlled study using independently trained conditional DDPMs on CIFAR-10 to examine whether collapsed-generation fingerprints remain specific to individual training runs. Experimental Settings. We construct a conditional DDPM for CIFAR-10 in which each training image is assigned an instance-specific condition composed of its class label and image index. The class label and image index are encoded separately and then fused as the conditioning input to the U-Net. This conditioning design allows collapsed generation to be measured at the level of individual training samples. We independently train four model instances with the same architecture, dataset, optimizer, and training schedule, using different random seeds for parameter initialization and training stochasticity. To accelerate the emergence of pronounced collapse cases, we select the same 500500 CIFAR-10 training images as an upweighted subset for all four models and sample them approximately 10×10× more frequently than the remaining images. The identical exposure schedule enables a controlled comparison of collapse patterns across independent training runs. Each model is trained for 40,00040,000 steps with a batch size of 128128 and evaluated using the final checkpoint, the same DDPM sampler, a classifier-free guidance scale of 1.51.5, and four fixed sampling seeds shared across all models. Fingerprint Construction and Verification. Following the low-loss mining strategy described in Sec. IV-C, we rank the training set for each model according to sample-level denoising loss during training and retain the low-loss conditions as fingerprint candidates. For each candidate, we generate four images and measure cross-seed diversity using the average pairwise ℓ2 _2 distance among the generated images, where a smaller distance indicates stronger collapsed generation. The four candidates with the lowest distances form the fingerprint set of each model. To establish the normal-generation reference, we randomly sample 5050 non-upweighted training conditions for each model and compute their cross-seed ℓ2 _2 distances. Following the set-level verification procedure in Sec. IV-D, we evaluate each four-condition fingerprint set on all four models and obtain a 4×44× 4 matrix of lower-tail pvalp_val scores. Results. Fig. 7 (a) exhibits a clear diagonal separation, with matched fingerprint–model pairs yielding markedly lower pvalp_val scores than all mismatched pairs. This result indicates that the collapse-prone conditions identified from one training run are not reproduced with comparable strength by the other independently trained models. The qualitative examples in Fig. 7 (b) corroborate this distinction: each representative fingerprint produces consistent cross-seed generations on its source model, whereas the fingerprint selected from the first source model yields substantially more diverse outputs on the three mismatched models. Together, these results show that model-specific collapse patterns emerge across independent training runs under matched architectures, training data, upweighted samples, and optimization configurations, supporting the uniqueness of collapsed-generation fingerprints. V-B Experimental Setup Having established model-specific collapse in the controlled CIFAR-10 setting, we next evaluate the proposed fingerprinting framework on representative T2I diffusion models. The following experiments use SSCD-based cross-seed similarity and the T2I fingerprint construction and verification procedures described in Secs. IV-C and IV-D. We describe the experimental setup below. Models. We consider both white-box pipeline-access and black-box API-only verification settings. Under pipeline access, we evaluate Stable Diffusion 1.4 (SD 1.4) [27], DeciDiffusion v1.0 (Deci) [33], PixArt-α (PixArt) [7], and Stable Diffusion 3 (SD 3) [9]. These models span both U-Net-based and diffusion Transformer (DiT)-based architectures, with PixArt and SD 3 representing the latter. In particular, SD 3 combines a flow-matching formulation with training-data deduplication, providing a challenging case for assessing whether collapsed-generation fingerprints remain effective when naturally occurring collapse may be less prevalent. Under API-only access, we evaluate SD 1.4 and Stable Diffusion 2.1 (SD 2.1) [2], for which prior work provides public prompt collections that support reproducible candidate construction. All pretrained checkpoints are obtained from Hugging Face [14], with their exact versions reported in Appendix B. Fingerprint Construction. For pipeline-access verification, we construct the fingerprint set fC_f by optimizing continuous conditioning embeddings independently on each source model. For API-only verification, we draw candidates from the public prompt collections released by [37] for studying black-box training-data extraction. Each collection contains 500500 prompts for which the corresponding model was shown to reproduce training examples. We use these prompts as an enriched candidate pool for collapsed generation, screen them according to their cross-seed generation consistency, and select the top-M prompts to form fP_f. Unless otherwise specified, both fC_f and fP_f contain M=4M=4 fingerprint conditions, and each condition is evaluated using K=4K=4 generations. Inference Configuration. For SD 1.4, SD 2.1, and Deci, we use DDIM sampling with 5050 denoising steps and a classifier-free guidance scale of 7.57.5. PixArt uses its default DPM-Solver scheduler with 2020 denoising steps, while SD 3 uses its default 2828-step sampler and a guidance scale of 7.07.0. Four fixed sampling seeds are shared across all applicable models and conditions. Obfuscations. To evaluate robustness against model-level modifications, we consider pruning, quantization, and fine-tuning. For pruning, we remove 10%10\%, 20%20\%, and 30%30\% of the smallest-magnitude weights from the model backbone, including the U-Net or Transformer blocks. For quantization, we evaluate bfloat16, int8, and fp4 parameter representations. For fine-tuning, we consider three representative derivatives of SD 1.4: Stable Diffusion 1.5 (SD 1.5) [27], Deliberate v4 [40], and Realistic Vision v2.0 [30]. In the API-only setting, we additionally evaluate four adaptive query-time obfuscations: GPT rewriting, Random Token Addition (RTA) [32], Embedding Optimization (EO) [39], and Sharpness-Aware Initialization for Latent Diffusion (SAIL) [15], whose configurations are detailed in Appendix B. Baselines. Under pipeline access, we compare our method with FingerInv [34], which derives a model-specific latent code through DDPM inversion of a reference QR-code image and verifies model identity through its recovery on the queried model. Under API-only access, we compare with TVN [11], which searches for non-transferable adversarial prompt suffixes that induce target-specific semantic deviations. Following its original configuration, TVN optimizes from 1010 initial prompts for each target model and retains the best-performing prompt as its fingerprint. Detailed baseline implementations are provided in Appendix B. Metrics. For our method, we compute SSCD-based cross-seed generation consistency and derive the set-level pvalp_val defined in Sec. IV-D. For each source model, we construct the normal-generation reference using N=50N=50 prompts independently generated by GPT-4. We use τf=10−4 _f=10^-4 as the verification threshold throughout the T2I experiments, with pval<τfp_val< _f indicating a fingerprint match. TVN measures the CLIP similarity between the generated image and its input prompt, whereas FingerInv measures the ℓ2 _2 distance between the recovered and reference QR-code images. For all three methods, lower reported values provide stronger evidence of a match under their respective verification rules. For API-only stealthiness, we additionally measure prompt perplexity using Mistral-7B [16], where lower perplexity indicates a more natural prompt. Additional optimization hyperparameters and computational resources are reported in Appendix B. (a) FingerInv [34] (b) Ours Fig. 8: Confusion matrices (white-box). Blue indicates higher likelihood that the suspect model is identified as the corresponding source model. Due to architectural differences, our fingerprints of PixArt and SD 3 cannot be used with other models, resulting in empty cells. V-C White-box Pipeline-access Verification Fig. 9: Case study for robustness analysis (white-box). FingerInv demonstrates degradation in the quality of generated QR codes under strong obfuscations, which may hinder verification. In contrast, our fingerprint relies on the consistency within the generated batch, maintaining strong robustness. Optimization Details. In the white-box setting, we induce collapsed generations by optimizing the prompt embedding. In the main experiments, we initialize the optimization from text embeddings of candidate prompts for SD v1 models. The initialization analysis in Appendix C further shows that both low-diversity and random prompt initializations yield verifiable fingerprints. Further details and hyper-parameters are available in Appendix B. Uniqueness Analysis. Fig. 8 reports the cross-model verification results of our method and FingerInv under pipeline access. Note that FingerInv is formulated upon DDPM inversion trajectories, making it incompatible with the underlying ODE mechanisms of flow-matching models like SD 3. The results show that both our method and FingerInv exhibit excellent discriminative ability, with significantly low metric values (indicated by blue cells) appearing only along the main diagonal. Cross-model verification is performed only between models with compatible conditioning interfaces. Because PixArt and SD 3 use embedding spaces incompatible with the other evaluated pipelines, the corresponding cross-architecture entries are left undefined. Under pipeline access, these interface incompatibilities can be identified before statistical fingerprint verification. Robustness Analysis. Both our method and FingerInv demonstrate strong verification performance under obfuscation attacks. The complete quantitative results are reported in Appendix C, while Fig. 9 provides representative qualitative examples. As illustrated in the figure, FingerInv and our method exhibit different degradation behaviors. FingerInv relies on recovering a specific reference pattern, and its generated QR codes exhibit visible degradation as model obfuscation becomes stronger. In contrast, our verification signal is based on cross-seed consistency rather than the reconstruction quality of a prescribed image, and the generated batches retain consistent content under the same obfuscations. This highlights the stability of the collapse phenomenon induced by our optimized embeddings, ensuring robust performance even under challenging conditions. V-D Black-box API-only Verification We next consider the more restrictive API-only setting, where fingerprint conditions must be submitted as text prompts and verification relies solely on the returned images. (a) TVN [11] (b) Ours Fig. 10: Confusion matrices (black-box). Scores are displayed on a logarithmic scale, with lower values indicating stronger matches. Our method (b) shows clear unique identification for each suspect model, while TVN (a) exhibits significant confusion among different models. Uniqueness Analysis. We evaluate the distinctiveness of our method compared to TVN in Fig. 10. Pairwise cross-model verification should yield low scores only for matched fingerprint–model pairs along the main diagonal. The results reveal that TVN suffers from a false positive (top-right cell), where SD 2.1 is misidentified as SD 1.4. In contrast, our method exhibits clearer diagonal separation, thereby ensuring reliable model identification. TABLE I: Robustness (black-box, quantization and pruning). Green and red cells indicate successful and failed verification, respectively. † indicates false alarm. Obfuscation TVN [11] (CLIP score) Ours (pvalp_val) SD 1.4 SD 2.1 SD 1.4 SD 2.1 Quant. BF16 21.8 20.0† 9.77×10−219.77×10^-21 3.44×10−103.44×10^-10 Quant. INT8 21.7 21.4† 1.05×10−201.05×10^-20 2.74×10−102.74×10^-10 Quant. FP4 20.5 19.8† 2.05×10−202.05×10^-20 1.49×10−71.49×10^-7 Prune 10% 22.0† 20.6† 1.19×10−201.19×10^-20 5.00×10−105.00×10^-10 Prune 20% 20.5† 19.8† 8.08×10−208.08×10^-20 6.35×10−106.35×10^-10 Prune 30% 24.3 18.9† 2.98×10−162.98×10^-16 6.26×10−106.26×10^-10 TABLE I: Robustness (black-box, fine-tuning). Green and red cells indicate successful and failed verification, respectively. † indicates false alarm. Model TVN [11] (CLIP score) Ours (pvalp_val) SD 1.5 21.421.4 1.55×10−201.55×10^-20 Deliberate 17.817.8† 6.50×10−86.50×10^-8 Realistic 21.921.9 5.00×10−215.00×10^-21 Robustness Analysis. Before deployment, adversaries may apply obfuscation techniques, such as pruning, quantization, or fine-tuning, to modify model parameters and evade fingerprint verification. In Table I and Table I, we present the verification results under these attacks. The results show that TVN exhibits poor robustness, frequently misidentifying SD 2.1 as SD 1.4 across all attack types. Moreover, pruning SD 1.4 leads to the same false positive, which only ceases at 30%30\% pruning. This is likely because the model’s ability to comprehend prompts and generate corresponding images is severely degraded at higher pruning levels. In contrast, our method remains effective across all attack types and intensities. This demonstrates that the proposed collapsed prompts induce a highly stable and consistent generation, where minor parameter modifications are insufficient to disrupt the established generation behavior. These findings validate the robustness of our approach under realistic adversarial conditions. TABLE IV: Robustness (black-box, adaptive obfuscations). pvalp_val (↓ ) CLIP Score (↑ ) Time (s) (↓ ) Success? No Obfuscation 8.63×10−218.63× 10^-21 31.41 1.744 ✔ GPT Rewriting 1.34×10−151.34× 10^-15 31.75 2.590 ✔ RTA [32] 6.93×10−166.93× 10^-16 29.00 1.753 ✔ EO [39] 2.33×10−62.33× 10^-6 28.21 2.466 ✔ SAIL [15] 2.24×10−62.24× 10^-6 30.25 3.426 ✔ Adaptive Obfuscations. We further consider scenarios where an adversary is aware of our fingerprinting method and attempts to bypass verification using adaptive attacks. Assuming that the verification query is detected (which is non-trivial as discussed in Sec. IV-D), the adversary may try to disrupt generation consistency. To evaluate this, we test four collapse-mitigation strategies: GPT rewriting, Random Token Addition (RTA) [32], Embedding Optimization (EO) [39] and Sharpness-Aware Initialization for Latent Diffusion (SAIL) [15] on SD 1.4. RTA inserts R random tokens at arbitrary positions within the prompt, while EO and SAIL reduce the classifier-free guidance magnitude at the initial denoising step through prompt embedding or latent optimization. As shown in Table IV, our fingerprints remain effective against all obfuscation strategies, with pvalp_val consistently staying well below the threshold. Given the difficulty of detecting verification queries, adversaries are forced to apply these mitigations routinely. However, some interventions reduce semantic quality, while all introduce additional processing latency. This demonstrates that our method has a stable collapse effect, ensuring robustness even against adaptive obfuscations. Stealthiness Analysis. To evade verification, an adversary may attempt to detect fingerprint prompts. A common detection approach involves analyzing prompt perplexity, as unnatural or garbled text often indicates abnormal queries. We evaluate stealthiness by measuring the average perplexity of the fingerprint prompts. Results in Table V show that TVN’s prompts exhibit extremely high perplexity (all exceeding 200200) due to their suffix-based design. As an adversary, one can further locate and remove the suspicious suffixes to evade verification. In contrast, our fingerprints retain the form of naturally occurring, human-readable prompts, resulting in substantially lower perplexity. TABLE V: Perplexity (↓ ) of fingerprint prompts (black-box). Method SD 1.4 SD 2.1 TVN [11] 294.96 243.83 Ours 41.85 51.32 V-E Efficiency To answer RQ4, we examine the computational cost of fingerprint construction. Table VI reports the per-fingerprint runtime of optimization-based construction procedures under their respective access settings. Under pipeline access, our truncated embedding synthesis requires 25.0325.03 seconds, comparable to the 24.9124.91 seconds required by FingerInv. For reference, TVN requires 369.57369.57 seconds to construct one API-compatible fingerprint through iterative prompt-suffix optimization. These results show that our active fingerprint synthesis incurs practical construction overhead comparable to the pipeline-access baseline. TABLE VI: Optimization time (s/prompt). Method TVN [11] FingerInv [34] Ours Time (↓ ) 369.57 24.91 25.03 VI Conclusion In this work, we formulate collapsed generation, characterized by unusually high cross-seed consistency under particular input conditions, as a model-intrinsic behavioral signature for non-invasive ownership verification of T2I diffusion models. Under pipeline access, we synthesize model-specific continuous embedding fingerprints through truncated optimization. Under API-only access, we construct natural-prompt fingerprints by screening collapse-prone candidates. Both fingerprint representations are evaluated through a unified source-referenced statistical test that determines whether a suspect model reproduces the characteristic collapse response of the source model. A controlled study of independently trained conditional DDPMs and evaluations across representative U-Net-, DiT-, and flow-matching-based T2I models show clear separation between matched and mismatched fingerprint–model pairs, supporting fingerprint uniqueness. The fingerprints remain verifiable under most evaluated fine-tuned derivatives, model modifications, and adaptive query-time interventions, demonstrating robustness across the considered conditions. In the API-only setting, the natural fingerprint prompts remain human-readable and exhibit substantially lower perplexity than adversarially optimized prompt suffixes, supporting stealthier service-level verification. Meanwhile, truncated embedding synthesis maintains construction cost comparable to the pipeline-access baseline. Together, these results establish collapsed generation as a practical source of intrinsic behavioral evidence for diffusion model ownership verification across checkpoint- and service-level disputes. References [1] Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet (2018) Turning your weakness into a strength: watermarking deep neural networks by backdooring. External Links: 1802.04633, Link Cited by: §I-A, §I-A, §I-A. [2] S. AI (2022) Stable diffusion v2.1 and dreamstudio updates. Note: Blog post / Release notesStable Diffusion v2.1 release (Dec 7, 2022) External Links: Link Cited by: §I, §V-B. [3] T. Bonnaire, R. Urfin, G. Biroli, and M. Mezard (2025) Why diffusion models don’t memorize: the role of implicit dynamical regularization in training. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, Cited by: §D-A, §IV-C. [4] X. Cao, J. Jia, and N. Z. Gong (2021) IPGuard: protecting intellectual property of deep neural networks via fingerprinting the classification boundary. In Proceedings of the 2021 ACM asia conference on computer and communications security, p. 14–25. Cited by: §I-A. [5] N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V. Sehwag, F. Tramer, B. Balle, D. Ippolito, and E. Wallace (2023) Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), p. 5253–5270. External Links: Link Cited by: §I, §I-C, §I-C, §IV-A, §IV-B. [6] R. Chavhan, O. Bohdal, Y. Zong, D. Li, and T. Hospedales (2024) Memorization is localized within a small subspace in diffusion models. In International Conference on Machine Learning (ICML)-Workshop on Generative AI and Law, Cited by: §I-C. [7] J. Chen, J. YU, C. GE, L. Yao, E. Xie, Z. Wang, J. Kwok, P. Luo, H. Lu, and Z. Li (2024) PixArt-$α$: fast training of diffusion transformer for photorealistic text-to-image synthesis. In The Twelfth International Conference on Learning Representations, External Links: Link Cited by: §I, §V-B. [8] Z. Chen, B. Li, S. Wu, K. Jiang, S. Ding, and W. Zhang (2023) Content-based unrestricted adversarial attack. Advances in Neural Information Processing Systems 36, p. 51719–51733. Cited by: §IV-C. [9] P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. Müller, H. Saini, Y. Levi, D. Lorenz, A. Sauer, F. Boesel, et al. (2024) Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first international conference on machine learning, Cited by: §D-A, §V-B. [10] P. Fernandez, G. Couairon, H. Jégou, M. Douze, and T. Furon (2023) The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 22466–22477. External Links: Link Cited by: §I, §I-B, §I-A. [11] J. Guo, W. Jiang, R. Zhang, G. Lu, and H. Li (2025) One Prompt to Verify Your Models: Black-Box Text-to-Image Models Verification via Non-Transferable Adversarial Attacks. arXiv. External Links: 2410.22725, Document, Link Cited by: 2nd item, 2nd item, §I, §I, §I-B, TABLE I, 10(a), 10(a), §V-B, TABLE I, TABLE I, TABLE V, TABLE VI. [12] D. Hintersdorf, L. Struppek, K. Kersting, A. Dziedzic, and F. Boenisch (2024) Finding nemo: Localizing neurons responsible for memorization in diffusion models. Advances in Neural Information Processing Systems 37, p. 88236–88278. External Links: Link Cited by: §I, §I-C. [13] J. Ho, A. Jain, and P. Abbeel (2020) Denoising diffusion probabilistic models. External Links: 2006.11239, Link Cited by: §I-C. [14] Hugging Face – The AI community building the future.. External Links: Link Cited by: §B-B, §V-B. [15] D. Jeon, D. Kim, and A. No (2025) Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes. Proceedings of the 42nd International Conference on Machine Learning. Cited by: 4th item, §I-C, §IV-A, §V-B, §V-D, TABLE IV. [16] A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. de las Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier, L. R. Lavaud, M. Lachaux, P. Stock, T. L. Scao, T. Lavril, T. Wang, T. Lacroix, and W. E. Sayed (2023) Mistral 7b. External Links: 2310.06825, Link Cited by: §V-B. [17] W. Jiang, H. Li, G. Xu, T. Zhang, and R. Lu (2023) A comprehensive defense framework against model extraction attacks. IEEE Transactions on Dependable and Secure Computing 21 (2), p. 685–700. Cited by: §I. [18] Z. Li, J. Zhang, Q. Lin, J. Xiong, Y. Long, X. Deng, Y. Zhang, X. Liu, M. Huang, Z. Xiao, D. Chen, J. He, J. Li, W. Li, C. Zhang, R. Quan, J. Lu, J. Huang, X. Yuan, X. Zheng, Y. Li, J. Zhang, C. Zhang, M. Chen, J. Liu, Z. Fang, W. Wang, J. Xue, Y. Tao, J. Zhu, K. Liu, S. Lin, Y. Sun, Y. Li, D. Wang, M. Chen, Z. Hu, X. Xiao, Y. Chen, Y. Liu, W. Liu, D. Wang, Y. Yang, J. Jiang, and Q. Lu (2024) Hunyuan-dit: a powerful multi-resolution diffusion transformer with fine-grained chinese understanding. External Links: 2405.08748, Link Cited by: §I. [19] Z. Li, H. Qu, J. Kuen, J. Gu, Q. Ke, J. Liu, and H. Rahmani (2025) DiffIP: representation fingerprints for robust ip protection of diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 17035–17045. Cited by: §I, §I, §I-B, TABLE I. [20] Y. Lin, J. Zhang, Y. Chen, and H. Li (2023) Sd-nae: generating natural adversarial examples with stable diffusion. arXiv preprint arXiv:2311.12981. Cited by: §IV-C. [21] Y. Liu, Z. Li, M. Backes, Y. Shen, and Y. Zhang (2023) Watermarking Diffusion Model. arXiv. External Links: 2305.12502, Document, Link Cited by: §I, §I-B. [22] N. Lukas, Y. Zhang, and F. Kerschbaum (2019) Deep neural network fingerprinting by conferrable adversarial examples. arXiv preprint arXiv:1912.00888. Cited by: §I-A. [23] Z. Miao, J. Wang, Z. Wang, Z. Yang, L. Wang, Q. Qiu, and Z. Liu (2024) Training diffusion models towards diverse image generation with reinforcement learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 10844–10853. Cited by: §IV-A. [24] R. Min, S. Li, H. Chen, and M. Cheng (2024) A watermark-conditioned diffusion model for ip protection. External Links: 2403.10893, Link Cited by: §I-B, §I-A. [25] T. Miura, T. Shibahara, and N. Yanai (2024) Megex: data-free model extraction attack against gradient-based explainable ai. In Proceedings of the 2nd ACM Workshop on Secure and Trustworthy Deep Learning Systems, p. 56–66. Cited by: §I. [26] E. Pizzi, S. D. Roy, S. N. Ravindra, P. Goyal, and M. Douze (2022) A self-supervised descriptor for image copy detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 14532–14542. Cited by: 1st item, §I-C, §IV-A. [27] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer (2022) High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 10684–10695. Cited by: §I, §I-C, §V-B, §V-B. [28] B. L. Ross, H. Kamkari, T. Wu, R. Hosseinzadeh, Z. Liu, G. Stein, J. C. Cresswell, and G. Loaiza-Ganem (2025) A geometric framework for understanding memorization in generative models. In The Thirteenth International Conference on Learning Representations, Cited by: §D-A, §D-C, §I-C, §IV-A, §IV-B. [29] B. D. Rouhani, H. Chen, and F. Koushanfar (2018) DeepSigns: a generic watermarking framework for ip protection of deep learning models. External Links: 1804.00750, Link Cited by: §I-A, §I-A. [30] SG161222 (2023) Realistic vision v2.0. External Links: Link Cited by: §V-B. [31] G. Somepalli, V. Singla, M. Goldblum, J. Geiping, and T. Goldstein (2023) Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Models. In 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 6048–6058. External Links: ISSN 2575-7075, Document, Link Cited by: §I-C, §I-C, §IV-B. [32] G. Somepalli, V. Singla, M. Goldblum, J. Geiping, and T. Goldstein (2023) Understanding and Mitigating Copying in Diffusion Models. Advances in Neural Information Processing Systems. Cited by: 2nd item, §I, §I-C, §IV-A, §IV-B, §IV-B, §V-B, §V-D, TABLE IV. [33] D. R. Team (2023) DeciDiffusion 1.0. External Links: Link Cited by: §I, §V-B. [34] H. Teng, Y. Quan, C. Wang, J. Huang, and H. Ji (2025) Fingerprinting Denoising Diffusion Probabilistic Models. 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Cited by: 1st item, 1st item, TABLE VIII, TABLE IX, §I, §I, §I-B, TABLE I, §I-B, 8(a), 8(a), §V-B, TABLE VI. [35] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh (2017) Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval, ICMR ’17, p. 269–277. External Links: Link, Document Cited by: §I-A, §I-A. [36] Z. Wang, J. Guo, J. Zhu, Y. Li, H. Huang, M. Chen, and Z. Tu (2025) SleeperMark: towards robust watermark against fine-tuning text-to-image diffusion models. External Links: 2412.04852, Link Cited by: §I-B. [37] R. Webster (2023) A Reproducible Extraction of Training Images from Diffusion Models. arXiv. External Links: 2305.08694, Document, Link Cited by: 1st item, 2nd item, §I-C, §V-B. [38] Y. Wen, N. Jain, J. Kirchenbauer, M. Goldblum, J. Geiping, and T. Goldstein (2023) Hard prompts made easy: gradient-based discrete optimization for prompt tuning and discovery. Advances in Neural Information Processing Systems 36, p. 51008–51025. Cited by: §D-C, TABLE X. [39] Y. Wen, Y. Liu, C. Chen, and L. Lyu (2024) Detecting, Explaining, and Mitigating Memorization in Diffusion Models. The Twelfth International Conference on Learning Representations. Cited by: 2nd item, 3rd item, §I, §I-C, §V-B, §V-D, TABLE IV. [40] XpucT (2023) Deliberate v4. External Links: Link Cited by: §V-B. [41] B. Zeng, L. Wang, Y. Hu, Y. Xu, C. Zhou, X. Wang, Y. Yu, and Z. Lin (2024) Huref: human-readable fingerprint for large language models. Advances in Neural Information Processing Systems 37, p. 126332–126362. Cited by: §I, §I-A. [42] S. Zhai, H. Chen, Y. Dong, J. Li, Q. Shen, Y. Gao, H. Su, and Y. Liu (2024) Membership inference on text-to-image diffusion models via conditional likelihood discrepancy. Advances in Neural Information Processing Systems 37, p. 74122–74146. Cited by: Fig. 6, Fig. 6. [43] Z. Zhang, M. Li, and J. Yu (2018) On the convergence and mode collapse of gan. In SIGGRAPH Asia 2018 Technical Briefs, p. 1–4. Cited by: §IV-A. [44] Y. Zhao, T. Pang, C. Du, X. Yang, N. Cheung, and M. Lin (2023) A Recipe for Watermarking Diffusion Models. arXiv. External Links: 2303.10137, Document, Link Cited by: §I, §I-B. [45] Y. Zheng, S. Wang, and C. Chang (2022) A dnn fingerprint for non-repudiable model ownership identification and piracy detection. IEEE Transactions on Information Forensics and Security 17, p. 2977–2989. Cited by: §I-A. [46] A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson (2023) Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. Cited by: §D-C, TABLE X. Appendix A Algorithms Algorithm 1 Continuous-Embedding Fingerprint Synthesis 1: Initial prompt set init=pii=1MP_init=\p_i\_i=1^M, source model GθG_θ, text encoder EtextE_text, number of noise samples K, number of truncated denoising steps ttrunct_trunc, number of optimization iterations I, learning rate η 2: Optimized fingerprint embedding set f=ci∗i=1MC_f=\c_i^*\_i=1^M 3: f←∅C_f← 4: for i=1i=1 to M do 5: ci(0)←Etext(pi)c_i^(0)← E_text(p_i) ⊳ Initialize the i-th embedding 6: Sample independent noises xT(k)k=1K\x_T^(k)\_k=1^K 7: for r=0r=0 to I−1I-1 do 8: Run the first ttrunct_trunc denoising steps with ci(r)c_i^(r) to obtain xT−ttrunc(k)(ci(r))k=1K\x_T-t_trunc^(k)(c_i^(r))\_k=1^K 9: x¯T−ttrunc(ci(r))←1K∑k=1KxT−ttrunc(k)(ci(r)) x_T-t_trunc(c_i^(r))← 1K _k=1^Kx_T-t_trunc^(k)(c_i^(r)) 10: ℒCollapse(ci(r))←1K∑k=1K‖xT−ttrunc(k)(ci(r))−x¯T−ttrunc(ci(r))‖22L_Collapse(c_i^(r))← 1K _k=1^K \|x_T-t_trunc^(k)(c_i^(r))- x_T-t_trunc(c_i^(r)) \|_2^2 11: ci(r+1)←ci(r)−η∇ci(r)ℒCollapse(ci(r))c_i^(r+1)← c_i^(r)-η _c_i^(r)L_Collapse(c_i^(r)) 12: end for 13: ci∗←ci(I)c_i^*← c_i^(I) 14: f←f∪ci∗C_f _f∪\c_i^*\ 15: end for 16: return fC_f Algorithm 2 Fingerprint Verification 1: Fingerprint set ℱ=fmm=1MF=\f_m\_m=1^M, where ℱF is either fC_f or fP_f; suspect model Gθ′G_θ ; source-model reference scores 0=unn=1NU_0=\u_n\_n=1^N; number of generations K; decision threshold τf _f 2: Verification decision d and statistical evidence pvalp_val 3: μ0←1N∑n=1Nun _0← 1N _n=1^Nu_n 4: σ0←1N−1∑n=1N(un−μ0)2 _0← 1N-1 _n=1^N(u_n- _0)^2 5: f←∅S_f← 6: for m=1m=1 to M do 7: Obtain K independent outputs x0(k)(fm)k=1K\x_0^(k)(f_m)\_k=1^K from Gθ′G_θ conditioned on fmf_m ⊳ fmf_m is supplied as an embedding or a text prompt 8: Compute the cross-seed consistency s¯θ′(fm,K) s_θ (f_m,K) using Eq. 4 9: f←f∪s¯θ′(fm,K)S_f _f∪\ s_θ (f_m,K)\ 10: end for 11: s¯f←1M∑s∈fs s_f← 1M _s _fs 12: tf←s¯f−μ0σ01+1/Nt_f← s_f- _0 _0 1+1/N 13: pval←1−FtN−1(tf)p_val← 1-F_t_N-1(t_f) ⊳ FtN−1F_t_N-1 is the Student’s t CDF 14: if pval<τfp_val< _f then 15: d←Trued← True ⊳ The suspect model matches the source fingerprint 16: else 17: d←Falsed← False ⊳ The fingerprint match is not established 18: end if 19: return (d,pval)(d,p_val) Appendix B Experiment Settings B-A Datasets • Black-box prompts: For SD 1.4 and SD 2.1, we use 500500 prompts each from [37]. From these collections we pick prompts that produce highly collapsed generations to form the fingerprint set fP_f, following the filtering procedure described in Sec. IV-C. • White-box prompts: For SD 1.4, we initialize with the template verbatim prompts from [37]. For Deci and PixArt, we first apply the black-box prompt extraction procedure to the 1,0001,000 prompts to identify candidates exhibiting collapsed generations, then sample several of these candidates as initializations. We also evaluate that using low-diversity prompts and random initialization can also converge to effective fingerprints, as shown in Appendix D. • GPT prompts: For Fig. 2 (a) and normal-generation modeling in the main experiments, we use GPT-4 to generate 5050 prompts in plain text. B-B Models All pretrained diffusion model checkpoints are obtained from HuggingFace [14], including: • Target models: SD 1.4 (CompVis/stable-diffusion-v1-4), SD 2.1 (stabilityai/stable-diffusion-2-1), Deci (Deci/DeciDiffusion-v1-0), SD 3 (stabilityai/stable-diffusion-3-medium-diffusers), and PixArt (PixArt-alpha/PixArt-XL-2-512x512). • Fine-tune models: SD 1.5 (runwayml/stable-diffusion-v1-5), Deliberate (XpucT/Deliberate), and Realistic (SG161222/Realist_Vision_V2.0). B-C Implementation Details Baselines. • FingerInv [34]: We adopt the pipeline from the official open-source implementation provided by [34]. Specifically, a QR code image of size 32×3232× 32 is used to obtain a model-specific DDPM latent code via FingerInv. This latent code is then applied to a suspect model to perform denoising. We subsequently examine whether the final generated image can still be successfully scanned. The quantitative measure is the L2 distance between the original and recovered QR codes. Note that this method is not applicable to flow-based models such as SD 3, which do not utilize DDPM-based sampling. • TVN [11]: This method identifies non-transferable adversarial prompts as fingerprints. Following the experimental setup in [11], we start with 1010 initial prompts provided in the original work. For each tested model, we optimize a 55-token prompt suffix using the NSGA-I black-box optimization algorithm. During optimization, the target model is treated as the positive example, while substitute models and a pretrained CLIP model serve as negative examples. The best-performing optimized prompt is selected as the fingerprint prompt for the target model. Subsequently, we run the generation with 1010 different random seeds and compute μ+3σμ+3σ of the CLIP scores as the threshold. Adaptive obfuscations. • GPT rewriting: We employ GPT-4o to rewrite the original prompts using the following instruction: ”You are a prompt enhancer. For the prompt that will be input into the text-to-image model below, you can make some rewrites and optimizations to improve the image quality, but you must ensure that the semantics remain unchanged. Prompt to be rewritten: prompt. • RTA [32]: Following the implementation in [39], we randomly add four tokens for each prompt using the pipeline’s tokenizer. • EO [39]: Following the official source code’s approach, we optimize the text embeddings for 1010 iterations at the first denoising step to reduce the classifier-free guidance magnitude, setting ltarget=1l_target=1. • SAIL [15]: Following the original settings, we optimize the initial noise using an optimization threshold of 8.28.2 and a maximum of 1010 iterations to steer the generation starting point away from the sharp regions described in the paper. Our method. Our method consists of two verification settings: white-box and black-box. In the white-box setting, we apply the original text encoder of each diffusion model as the text encoder for prompt embedding extraction. In the black-box setting, we directly use the pipeline of each model for generation. We use different hyperparameters for different models due to their varying architectures and parameter scales. We detail the hyperparameters in Table VII. TABLE VII: Hyperparameters for white-box fingerprint optimization. SD 1.4 Deci PixArt SD 3 Truncated step ttrunct_trunc 5 5 10 10 Learning rate η 0.01 0.01 0.002 0.01 Optimization iters I 15 30 8 60 Metrics. • SSCD: We use the SSCD [26] model (sscd_disc_large) provided in the GitHub repository of the original paper for collapsed generation verification. • CLIP Score: We use the openai/clip-vit-base-patch32 model from the transformers library to measure the semantic similarity between generated images and text prompts on embeddings. Computational resources. All the experiments are conducted on a machine equipped with 88 NVIDIA RTX 4090 GPUs, each with 2424 GB of VRAM, except for white-box fingerprint optimization on PixArt, which is performed on a single NVIDIA A100 GPU with 8080 GB of VRAM. Appendix C Additional Experiment Results C-A Robust Analysis in the White-box Setting TABLE VIII: Robustness (white-box, quantization and pruning). Green and red cells indicate successful and failed verification, respectively. Obfuscation SD 1.4 Deci PixArt SD 3 FingerInv [34] (L2L_2 distance) Quant. BF16 3.76×10−33.76×10^-3 2.84×10−22.84×10^-2 9.25×10−59.25×10^-5 – Quant. INT8 4.52×10−44.52×10^-4 1.96×10−31.96×10^-3 6.31×10−46.31×10^-4 – Quant. FP4 2.10×10−42.10×10^-4 4.12×10−34.12×10^-3 1.38×10−31.38×10^-3 – Prune 10% 1.63×10−41.63×10^-4 1.45×10−21.45×10^-2 1.97×10−41.97×10^-4 – Prune 20% 2.43×10−42.43×10^-4 1.11×10−11.11×10^-1 5.09×10−35.09×10^-3 – Prune 30% 1.30×10−21.30×10^-2 3.41×10−13.41×10^-1 2.16×10−22.16×10^-2 – Ours (pvalp_val) Quant. BF16 1.23×10−191.23×10^-19 6.11×10−206.11×10^-20 8.46×10−88.46×10^-8 8.38×10−118.38×10^-11 Quant. INT8 3.92×10−193.92×10^-19 6.23×10−206.23×10^-20 3.16×10−73.16×10^-7 1.39×10−111.39×10^-11 Quant. FP4 4.69×10−184.69×10^-18 4.89×10−194.89×10^-19 5.72×10−95.72×10^-9 1.53×10−91.53×10^-9 Prune 10% 3.11×10−193.11×10^-19 8.37×10−208.37×10^-20 3.56×10−103.56×10^-10 2.51×10−122.51×10^-12 Prune 20% 2.00×10−202.00×10^-20 2.96×10−182.96×10^-18 6.41×10−66.41×10^-6 6.08×10−116.08×10^-11 Prune 30% 7.18×10−97.18×10^-9 4.57×10−24.57×10^-2 7.08×10−117.08×10^-11 1.90×10−111.90×10^-11 TABLE IX: Robustness (white-box, fine-tuning). Green and red cells indicate successful and failed verification, respectively. Model FingerInv [34] (L2L_2 distance) Ours (pvalp_val) SD 1.5 5.47×10−45.47×10^-4 1.95×10−181.95×10^-18 Deliberate 2.66×10−42.66×10^-4 6.09×10−146.09×10^-14 Realistic 6.98×10−46.98×10^-4 1.18×10−181.18×10^-18 Table VIII and IX present a comprehensive robustness analysis under the white-box setting. The results demonstrate that both our method and FingerInv remain robust against the majority of obfuscation techniques, including quantization, pruning, and fine-tuning. However, both fingerprinting methods fail on lightweight architectures such as Deci. This failure is attributed to the severe performance degradation caused by 30%30\% pruning, which renders the model incapable of generating semantically meaningful images. Notably, such drastic obfuscation is unlikely to be applied by attackers in realistic threat scenarios. C-B Ablation Study Fig. 11: pvalp_val using different number of prompts/generations (black-box). Fig. 12: pvalp_val using different number of embeddings/generations (white-box). We investigate the impact of varying the number of fingerprint prompts (embeddings) M and number of generations K on ownership verification. We evaluate the pvalp_val derived from average pairwise similarity scores using M=2,4,8M=\2,4,8\ and K=2,4,8K=\2,4,8\. The ablation results for black-box and white-box settings are presented in Fig. 11 and Fig. 12, respectively. While increasing the number of prompts/embeddings to 88 yields the optimal pvalp_val, the performance gain is marginal. Conversely, using 44 seeds is sufficient to maintain a significantly low pvalp_val, since inducing collapsed generations over 44 random initializations is already distinctive enough for ownership verification. To balance performance with the query budget, we select M=4M=4 prompts/embeddings and K=4K=4 seeds as the default configuration. C-C Case Study Fig. 13: Case study for uniqueness analysis. Left: black-box, right: white-box. Fig. 14: Case study for robustness analysis (SD 1.4, black-box). Fig. 15: Case study for robustness analysis (SD 1.4, white-box). Fig. 13 provides qualitative examples for the black-box and white-box uniqueness analysis. Notably, only the image groups along the main diagonal maintain a high degree of visual consistency, while off-diagonal entries exhibit varying levels of significant diversity. This validates the strong discriminative ability of our proposed average pairwise similarity score. Furthermore, Fig. 14 and 15 demonstrate the robustness of our method in both settings. Taking SD 1.4 as the target model, the generated images retain high similarity scores even when subjected to standard obfuscations (quantization, pruning, fine-tuning) or adaptive attacks (e.g., RTA, EO). Moreover, such consistency is not affected even when the quality of the generated images is degraded. These results confirm that our method is highly robust and applicable to diverse real-world threat scenarios. Appendix D Further Analysis D-A Scalability of Black-Box Fingerprints in Recent Models Following early diffusion models, recent models (e.g., SD 3 [9]) have heavily employed rigorous data deduplication pipelines to explicitly suppress the phenomenon of collapsed generation. One might question the scalability of finding natural collapsed text prompts in such heavily deduplicated models. However, while deduplication effectively mitigates simple memorization caused by exact data duplication, recent studies [28, 3] reveal that collapsed generation is also driven by other factors, including intrinsic data characteristics (e.g., outlier samples) and training dynamics (e.g., overtraining). This ensures that a sparse set of natural candidates inevitably persists even in highly curated datasets. Because these natural collapsed prompts carve deep, specific basins in the loss landscape during the extensive training phase, they inherently exist as discrete text tokens. Importantly, our framework only requires a minimal set of fingerprints (e.g., |f|=4|P_f|=4) for reliable verification, making this sparse availability more than sufficient. Furthermore, model owners can efficiently capture these rare collapsed prompts “on the fly” during training via loss monitoring [3] as illustrated in Sec. IV-C, bypassing the need for expensive post-hoc scanning. D-B Efficacy of White-Box Optimization on Recent Models While natural collapsed generation is reduced in recent models, our white-box optimization provides a proactive mechanism to deliberately induce such behaviors. Unlike black-box prompts that rely on naturally occurring collapsed generation stemming from training outliers and artifacts, white-box optimization actively forces the model’s latent trajectory into a collapsed manifold via gradient descent in the continuous embedding space. As demonstrated in our experiments with PixArt and SD 3, we can still reliably optimize continuous embeddings that trigger collapsed generations in these recent models, ensuring the framework’s long-term applicability. TABLE X: Embeddings obtained via discrete fingerprint optimization fail verification. Strategy Post-hoc Proj. PEZ [38] GCG [46] pvalp_val 1.68×10−41.68× 10^-4 4.23×10−24.23× 10^-2 2.32×10−42.32× 10^-4 Success? ✗ ✗ ✗ D-C Challenges in Discrete Fingerprint Optimization Given the success of continuous white-box optimization, an intuitive extension is to map these optimized embeddings back to discrete text tokens to enable purely black-box verification. However, we find such discretization highly non-trivial in practice. The fundamental reason is that collapsed modes reside in extremely narrow and precise regions within the latent space [28]. While natural black-box prompts can successfully trigger collapse because the model explicitly learned their discrete mappings during training, our white-box optimized embeddings locate artificial collapsed points. When applying post-hoc projection (mapping optimized embeddings to the nearest vocabulary tokens) or gradient-based discrete optimization (e.g., PEZ [38] or GCG [46]), the necessary discretization step severely disrupts the precise continuous coordinates required to stay within these narrow basins, resulting in a significant drop in SSCD scores (leading to pval>10−4p_val>10^-4 in Table X). Consequently, we maintain the white-box fingerprints in the continuous embedding space and leave the discretization of collapsed embeddings as a valuable direction for future work. TABLE XI: Verification efficacy and time cost of different initialization strategies. Init. Random Low Diversity Collapsed pvalp_val (↓ ) 2.83×10−62.83× 10^-6 4.26×10−84.26× 10^-8 1.23×10−191.23× 10^-19 Time (s) 47.77 24.81 25.03 Success? ✔ ✔ ✔ D-D Different Initialization Strategies in White-Box Optimization We evaluate the impact of different initialization prompts on white-box optimization in Table XI. While warm starts based on collapsed prompts accelerate convergence, they are not strictly necessary. Low-diversity prompts generated by LLMs (e.g., pure textual) are also sufficient. Even with random initialization, the optimization successfully converges, although it requires more steps. Appendix E Prompts Used in Visualization E-A Figure 1 • The No Limits Business Woman Podcast E-B Figure 2 • GPT Generated Prompt: A glass teapot house in a foggy forest • SD 1.4 Collapsed Prompt: <i>The Long Dark</i>Gets First Trailer, Steam Early Access • SD 2.1 Collapsed Prompt: Pencil pleat curtain in collection Linen, fabric: 392-05 E-C Figure 4 • Lilah Teal Blue Area Rug by Andover Mills E-D Figure 5 • Collapsed: Thumbprintz Splatter No I Red Floor Pillow • Normal: Happy woman in hat with shopping bags showing credit card E-E Figure 13 • SD 1.4 (black-box): <em>Bloodborne<em>Video: Sony Explains the Game’s Procedurally Generated Dungeons • SD 2.1: Pencil pleat curtains in collection Jupiter, fabric: 127-00 • SD 1.4 (white-box), Deci: N/A11 1 White-box fingerprints are optimized directly in the embedding space and therefore have no human-readable text prompt representation. E-F Figure 14 • <em>Bloodborne<em>Video: Sony Explains the Game’s Procedurally Generated Dungeons