The rapid advancement of generative models, facilitating the creation of
hyper-realistic images from textual descriptions, has concurrently escalated
critical societal concerns such as misinformation. Traditional fake detection
mechanisms, although providing some mitigation, fall short in attributing
responsibility for the malicious use of synthetic images. This paper introduces
a novel approach to model fingerprinting that assigns responsibility for the
generated images, thereby serving as a potential countermeasure to model
misuse. Our method modifies generative models based on each user's unique
digital fingerprint, imprinting a unique identifier onto the resultant content
that can be traced back to the user. This approach, incorporating fine-tuning
into Text-to-Image (T2I) tasks using the Stable Diffusion Model, demonstrates
near-perfect attribution accuracy with a minimal impact on output quality. We
rigorously scrutinize our method's secrecy under two distinct scenarios: one
where a malicious user attempts to detect the fingerprint, and another where a
user possesses a comprehensive understanding of our method. We also evaluate
the robustness of our approach against various image post-processing
manipulations typically executed by end-users. Through extensive evaluation of
the Stable Diffusion models, our method presents a promising and novel avenue
for accountable model distribution and responsible use.

本文提出了一种新的模型指纹技术，将唯一标识符印刷到生成内容中，以追溯图像的生成者，即模型的责任人，并在不影响生成内容质量的情况下，在 Text-to-Image（T2I）任务中将微调纳入其中；通过对 Stable Diffusion 模型进行大量评估，本方法为模型分发和负责任使用提供了一种有前途的新途径。

用于文本到图像扩散模型中用户归因和指纹识别的权重调节

WOUAF: Weight Modulation for User Attribution and Fingerprinting in  Text-to-Image Diffusion Models

Graph neural networks (GNNs) have emerged as a state-of-the-art approach to
model and draw inferences from large scale graph-structured data in various
application settings such as social networking. The primary goal of a GNN is to
learn an embedding for each graph node in a dataset that encodes both the node
features and the local graph structure around the node. Embeddings generated by
a GNN for a graph node are unique to that GNN. Prior work has shown that GNNs
are prone to model extraction attacks. Model extraction attacks and defenses
have been explored extensively in other non-graph settings. While detecting or
preventing model extraction appears to be difficult, deterring them via
effective ownership verification techniques offer a potential defense. In
non-graph settings, fingerprinting models, or the data used to build them, have
shown to be a promising approach toward ownership verification. We present
GrOVe, a state-of-the-art GNN model fingerprinting scheme that, given a target
model and a suspect model, can reliably determine if the suspect model was
trained independently of the target model or if it is a surrogate of the target
model obtained via model extraction. We show that GrOVe can distinguish between
surrogate and independent models even when the independent model uses the same
training dataset and architecture as the original target model. Using six
benchmark datasets and three model architectures, we show that consistently
achieves low false-positive and false-negative rates. We demonstrate that is
robust against known fingerprint evasion techniques while remaining
computationally efficient.

介绍了用于防止模型抽取攻击的 GNN 模型指纹方案 GrOVe，它可以可靠地确定嫌疑模型是否是独立训练得到的，即使它使用与目标模型相同的训练数据集和架构。

使用嵌入进行图神经网络的所有权验证

GrOVe: Ownership Verification of Graph Neural Networks using Embeddings

An off-the-shelf model as a commercial service could be stolen by model
stealing attacks, posing great threats to the rights of the model owner. Model
fingerprinting aims to verify whether a suspect model is stolen from the victim
model, which gains more and more attention nowadays. Previous methods always
leverage the transferable adversarial examples as the model fingerprint, which
is sensitive to adversarial defense or transfer learning scenarios. To address
this issue, we consider the pairwise relationship between samples instead and
propose a novel yet simple model stealing detection method based on SAmple
Correlation (SAC). Specifically, we present SAC-w that selects wrongly
classified normal samples as model inputs and calculates the mean correlation
among their model outputs. To reduce the training time, we further develop
SAC-m that selects CutMix Augmented samples as model inputs, without the need
for training the surrogate models or generating adversarial examples. Extensive
results validate that SAC successfully defends against various model stealing
attacks, even including adversarial training or transfer learning, and detects
the stolen models with the best performance in terms of AUC across different
datasets and model architectures. The codes are available at
this https URL.

提出了一种基于 SAmple Correlation (SAC) 的模型窃取检测方法，该方法选择被错误分类的正常样本作为模型输入，并计算它们的模型输出的平均相关性，结果表明该方法能够有效防御各种模型窃取攻击。