Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints

Motivation

• GAN attribution matters because photorealistic synthesis challenges visual forensics and threatens model owners’ intellectual property.Human inspection is no longer feasible at current realism levels, while existing watermarking and fingerprint approaches do not fit black-box GAN attribution.Source: §1 · pp. 1–2
• Existing GAN-forensics methods often target one architecture and deteriorate when the architecture changes, leaving stable cross-model marks unresolved.This gap motivates a feature representation that separates generated images from real ones.Source: §1 · pp. 1–2

Study contribution

• The study learns GAN fingerprints to classify images as real or GAN-generated and attribute generated images to their sources.It trains a neural-network classifier for source prediction.Source: §1 · p. 2

Existence and uniqueness

• Differences in architecture, training data, or initialization seed produce distinct fingerprints, enabling fine-grained attribution.The study frames these factors as dimensions of fingerprint existence and uniqueness.Source: Figure 1 · p. 1, §1 · p. 2

Persistence

• Fingerprints persist across frequencies and patch sizes and are not dominated by GAN artifacts.The study evaluates artifact-free samples selected with perceptual similarity for attribution.Source: §1 · p. 2

Robustness and comparison

• Fingerprint finetuning immunizes attribution against tested perturbations, while learned fingerprints outperform three baselines across two datasets and varied conditions.The evaluated attacks include noise, blur, cropping, JPEG compression, relighting, and combinations of these.Source: §1 · p. 2

Visual forensics

• Existing GAN-forensics methods report good accuracy but typically address one architecture and do not generalize across architectures.This limits their use for broader GAN source attribution.Source: §2 · p. 3

Digital fingerprints

• Device and postprocessing fingerprints exploit stable marks from imaging hardware or camera processing, whereas GAN fingerprinting targets generated-image sources.Prior GAN work visualized fingerprints using PRNU, while this paper uses a learning-based formulation.Source: §2 · p. 3

Digital watermarking

• Digital watermarking embeds artificial signals for authentication, but this paper uses inherent fingerprints without extra embedding burden or quality deterioration.Watermarking neural networks can trade off watermarking accuracy against original performance.Source: §2 · p. 3

3. Fingerprint learning for image attribution

• GAN model fingerprints are reference vectors that consistently interact with images generated by their respective GAN instances, while image fingerprints encode source-specific patterns.The paper motivates distinct fingerprints from differences in GAN parameters and stable patterns produced by fixed filtering and nonlinear processes.Source: §3 · p. 3

3.1. Attribution network

• A supervised convolutional attribution network predicts whether an image is real or generated by a particular GAN source using image-source pairs.Its unified embedding space supports comparisons across multiple GAN instances and the real-world class, unlike a discriminator trained for a single GAN.Source: §3.1 · p. 3
• The method requires only source labels and can therefore be applied to black-box GAN services by collecting and labeling their generated images.Service authenticity is tested by checking whether most generated images receive the desired source prediction.Source: §3.1 · p. 3

3.2. Component analysis networks

• Component-analysis variants test whether attribution survives across frequency bands and local-to-global patch statistics using pre-downsampling, residual, and post-pooling architectures.Downsampling targets low frequencies, residual extraction targets high-frequency bands, and pooling onset controls patch size.Source: §3.2 · pp. 3–4, Figure 2 · p. 4

3.3. Fingerprint visualization

• The visualization architecture trains an AutoEncoder and GAN fingerprints end-to-end but adds training complexity, so it is omitted when attribution alone is the goal.This variant is intended to interpret attribution effectiveness rather than serve as the default attribution model.Source: Figure 3 · p. 4, §3.3 · pp. 4–5
• The visualization model reconstructs each image, treats the reconstruction residual as its image fingerprint, and learns source-specific model fingerprints whose correlations provide classification logits.The reconstruction is grounded by pixel-wise L1 and adversarial losses, while correlation uses normalized image representations.Source: §3.3 · p. 4

4.1. Setup

• The experiments use CelebA and LSUN images, four GAN architectures, three baselines, classification accuracy, and FD ratio to evaluate attribution.The datasets contain 20,000 real RGB images each; GANs are trained at 128 × 128 × 3 resolution.Source: §4.1 · p. 5

4.2. Existence and uniqueness: which GAN parameters differentiate image attribution?

• Different architectures, nearly disjoint training sets, and random initialization seeds produce distinguishable GAN fingerprints, while identical seeds yield chance-level attribution.Even a one-image training-set mismatch can produce distinct fingerprints, indicating sensitivity to optimization differences.Source: §4.2 · pp. 5–6, Table 3 · p. 6

4.3. Persistence: which image components contain fingerprints for attribution?

• Fingerprints persist across frequency bands and local patches: both low- and high-frequency components remain informative, with high frequencies carrying more information at equal resolution.For CelebA, patches of 24×24 or larger suffice; for LSUN, patches of 52×52 or larger suffice.Source: §4.3 · pp. 6–7, Table 4 · p. 6, Table 5 · p. 6
• Selecting the 10% of generated images most perceptually similar to real data reduces artifacts and makes attribution harder, yet the classifier remains equally effective, indicating it is not artifact-biased.The selected images have higher quality, fewer artifacts, and distributions closer to the real dataset and one another.Source: §4.3 · p. 7, Figure 5 · p. 7, Table 6 · p. 7

4.4. Immunizability: how robust is attribution to image perturbation attacks and how effective are the defenses?

• Attacks reduce attribution accuracy, with noise and JPEG compression causing complete failure, while attack-aware finetuning fully restores performance for blur, cropping, and relighting and partially restores it for other attacks.Recovery from the combined attack is minimal, and the immunized method consistently outperforms Marra et al..Source: §4.4 · p. 7, Table 7 · p. 8, Table 8 · p. 8

4.5. Fingerprint visualization

• Fingerprint visualization produces responses focused on the matching model fingerprint, using eyes for real images and additionally using background cues for generated images.The visualization network achieves attribution performance comparable to the attribution model.Source: §4.5 · pp. 7–8, Figure 7 · p. 8, Figure 6 · p. 8

• Minor training differences, including initialization, produce distinct fingerprints that commonly persist across generated images, enabling fine-grained image and model attribution.Source: §5 · p. 8
• Fingerprints persist across frequencies and patch sizes and are not biased by GAN artifacts.Source: §5 · p. 8
• Simple finetuning effectively immunizes fingerprints against several image perturbation attacks.Source: §5 · p. 8
• Learned fingerprints consistently outperform a recent baseline for attribution and inception features for cross-source distinguishability across varied conditions.Source: §5 · p. 8

• FD ratio compares inter-class and intra-class Fréchet distances to evaluate feature distinguishability across image-source classes.Inter-class distance averages pairwise distances between different-class feature distributions, while intra-class distance averages distances between disjoint subsets within each class.Source: A. Fr´echet Distance ratio · p. 12
• The class set Y represents image sources, and f(·) maps images from the image domain into a feature domain.Source: A. Fr´echet Distance ratio · p. 12
• Larger FD ratios indicate more distinguishable feature representations across sources; the paper compares learned features with inception features and visualizes both using t-SNE.Source: A. Fr´echet Distance ratio · p. 12

• Additional face samples are provided for the experiments reported in the main paper.The samples are shown in Figures 8–21.Source: B. Face samples · p. 12

• LSUN bedrooms are more challenging because of limited image alignment, but ProGAN performs equally well and does not affect the paper’s conclusions.Source: C. Bedroom samples · p. 12
• Bedroom examples compare LSUN real images with ProGAN, SNGAN, CramerGAN, and MMDGAN samples.Source: Figure 22 · p. 27, Figure 23 · p. 28, Figure 24 · p. 29
• Bedroom samples also cover ten ProGAN seeds, including arbitrary samples and samples filtered by top-10% perceptual similarity to the real distribution.Source: Figure 27 · p. 32, Figure 28 · p. 33
• The supplementary figures show bedroom samples without attack and under noise, blur, cropping, JPEG compression, relighting, and combined attacks.Source: Figure 29 · p. 34, Figure 30 · p. 35, Figure 31 · p. 36
• Bedroom fingerprint interactions are summarized by a confusion matrix, where image fingerprints maximize responses to their own model fingerprints, supporting attribution.Source: Figure 36 · p. 41