ML Security PapersLossless Copyright Protection via Intrinsic Model Fingerprinting
Lingxiao Chen 1,2, Liqin Wang 1,2, Wei Lu 1,2, Xiangyang Luo 2
Published on arXiv
2601.21252
Model Theft
OWASP ML Top 10 — ML05
Key Finding
TrajPrint achieves lossless (zero generation quality degradation) copyright verification in black-box API scenarios with robustness against model modification attacks across diverse diffusion architectures.
TrajPrint
Novel technique introduced
The exceptional performance of diffusion models establishes them as high-value intellectual property but exposes them to unauthorized replication. Existing protection methods either modify the model to embed watermarks, which impairs performance, or extract model fingerprints by manipulating the denoising process, rendering them incompatible with black-box APIs. In this paper, we propose TrajPrint, a completely lossless and training-free framework that verifies model copyright by extracting unique manifold fingerprints formed during deterministic generation. Specifically, we first utilize a watermarked image as an anchor and exactly trace the path back to its trajectory origin, effectively locking the model fingerprint mapped by this path. Subsequently, we implement a joint optimization strategy that employs dual-end anchoring to synthesize a specific fingerprint noise, which strictly adheres to the target manifold for robust watermark recovery. As input, it enables the protected target model to recover the watermarked image, while failing on non-target models. Finally, we achieved verification via atomic inference and statistical hypothesis testing. Extensive experiments demonstrate that TrajPrint achieves lossless verification in black-box API scenarios with superior robustness against model modifications.
Key Contributions
- Lossless, training-free model fingerprinting that extracts intrinsic behavioral fingerprints from diffusion models without modifying weights or impairing generation quality
- Dual-end trajectory anchoring strategy that synthesizes a fingerprint noise strictly adhering to the target model's denoising manifold, enabling robust watermark recovery on the target model while failing on non-target models
- Black-box-compatible copyright verification using atomic inference and one-sample t-test statistical hypothesis testing for quantifiable infringement evidence
🛡️ Threat Analysis
TrajPrint is a model ownership verification framework — it extracts fingerprints tied to the model's intrinsic generative manifold (its denoising trajectory) to prove copyright and detect stolen/replicated diffusion models. The watermarked image is merely a verification anchor/tool; the primary purpose is proving model IP ownership, not content provenance.