Source-linked AI summary
Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data
Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, Mario Fritz
TL;DR
Existing deepfake detection and attribution methods can become less sustainable as generators evolve and adversaries develop countermeasures. The paper embeds artificial fingerprints into training data, showing that they transfer through generative models into generated images. Experiments report broad applicability, robustness, secrecy, negligible quality impact, and perfect detection and attribution accuracy.
Problem
Existing deepfake detection and attribution methods rely on cues that become less sustainable as generative models evolve and adversaries develop countermeasures.
Method
The method embeds artificial fingerprints into training data, trains generative models with their original protocols, and decodes the transferred fingerprints from generated images.
Results
The experiments report universality, negligible generation-quality effects, robustness, secrecy, and perfect detection and attribution accuracy outperforming recent state-of-the-art methods.
Takeaways & Limitations
Model inventors can allocate unique fingerprints to published generative models, enabling proactive detection, attribution, and responsibility disclosure.
Takeaways & Limitations
Counter-model attacks that remove fingerprints would require paired pre- and post-embedding images, while the unreleased encoder hinders collecting them.
Abstract
from arXiv · showhide
Photorealistic image generation has reached a new level of quality due to the breakthroughs of generative adversarial networks (GANs). Yet, the dark side of such deepfakes, the malicious use of generated media, raises concerns about visual misinformation. While existing research work on deepfake detection demonstrates high accuracy, it is subject to advances in generation techniques and adversarial iterations on detection countermeasure techniques. Thus, we seek a proactive and sustainable solution on deepfake detection, that is agnostic to the evolution of generative models, by introducing artificial fingerprints into the models. Our approach is simple and effective. We first embed artificial fingerprints into training data, then validate a surprising discovery on the transferability of such fingerprints from training data to generative models, which in turn appears in the generated deepfakes. Experiments show that our fingerprinting solution (1) holds for a variety of cutting-edge generative models, (2) leads to a negligible side effect on generation quality, (3) stays robust against image-level and model-level perturbations, (4) stays hard to be detected by adversaries, and (5) converts deepfake detection and attribution into trivial tasks and outperforms the recent state-of-the-art baselines. Our solution closes the responsibility loop between publishing pre-trained generative model inventions and their possible misuses, which makes it independent of the current arms race. Code and models are available at https://github.com/ningyu1991/ArtificialGANFingerprints .
1. Introduction
Deepfake detection and attribution are increasingly difficult as generative models improve and existing visual cues become less sustainable. The paper proposes embedding artificial fingerprints into training data so they transfer to generated images and enable proactive identification and tracing.
- Improving generative realism makes human detection, source attribution, and legal responsibility tracing infeasible.
- Existing detectors rely on low-level visual patterns or frequency mismatch, but evolving generators produce fewer artifacts and undermine long-term robustness.
- The pipeline embeds artificial fingerprints into training data, trains the generator unchanged, and decodes fingerprints from generated deepfakes.
- Matching database fingerprints identifies fake images, while assigning different fingerprints to models enables attribution.
- The work combines image steganography and GANs and demonstrates transferability from training data through models to all generated deepfakes.
- The study reports universality, negligible quality effects, robustness, secrecy, and improved deepfake detection and attribution over state-of-the-art baselines.
2. Related Work
Prior work studies GAN artifacts, watermarking, network watermarking, and passive deepfake detection, but these approaches do not provide the paper’s proactive, generator-oriented fingerprinting strategy.
- Generative adversarial networks (GANs): Cutting-edge generators include unconditional ProGAN, StyleGAN, and StyleGAN2, class-conditional BigGAN, and image-conditional CUT.
- Image steganography and watermarking: Image steganography and watermarking hide information in carrier images using transforms, compression, bit modification, or neural encoding.
- Image steganography and watermarking: Unlike pixel-level watermarking, this solution encodes information into generator parameters, entangling every generated image with the fingerprint without generation overhead.
- Network watermarking: Network watermarking hides information through black-box trigger sets or white-box parameter transformations, primarily for discriminative models.
- Deepfake detection and attribution: Passive deepfake detectors and attribution methods use noise residuals, classifiers, frequency mismatch, or texture mismatch as source cues.
- Deepfake detection and attribution: The paper distinguishes deliberately embedded artificial fingerprints from inherent GAN fingerprints and emphasizes transferability and universality.
3. Problem Statement
Generative techniques can support large-scale misinformation, creating concerns about releasing powerful models. The paper therefore designs traceable fingerprints for model inventors to support proactive disclosure and attribution.
- Generative techniques can be misused to create misinformation at scale for financial or political gains.
- The proposed solution is designed from model inventors’ side and introduces traceable artificial fingerprints into generative models.
- Decoding fingerprints from generated images and matching them to model-specific fingerprints enables deepfake detection and attribution.
- The inventor privately maintains the encoder, decoder, and model fingerprints, then verifies whether misuse originated from one of their models.
4. Artificial Fingerprints
The method trains a steganographic encoder-decoder, embeds unique fingerprints into training datasets, trains generators unchanged, and verifies decoded fingerprints through statistical matching.
- Attribution maps an image to a source identity, while the paper handles open-world sources by regressing to an n-bit fingerprint space.
- Steganography training: Steganography trains an encoder to embed arbitrary fingerprints into images and a decoder to recover those fingerprints.
- Steganography training: The training objective combines binary crossentropy for fingerprint decoding with mean squared error for preserving the original image.
- Artificial fingerprint embedding: Each training dataset receives a unique fingerprint, and the trained encoder transforms every training image into a fingerprinted dataset.
- Generative model training: The generator is trained on the fingerprinted dataset using its original protocol, making the method plug-and-play and adding zero training overhead.
- Artificial fingerprint decoding: The method hypothesizes that generators transfer the training fingerprint to every generated image, allowing decoder-based recovery and attribution.
- Artificial fingerprint matching: Fingerprint matching uses a soft null-hypothesis test because decoded bits may be altered by post-generation modifications.
- Artificial fingerprint matching: Verification treats the number of matching bits as binomial successes with 0.5 chance under the null hypothesis and rejects sufficiently unlikely matches.
5. Experiments
Experiments show that artificial fingerprints transfer from training data into generated images across models and datasets, while preserving fidelity, resisting perturbations and attacks, and enabling accurate detection and attribution.
- 5.2. Transferability: Fingerprint detection reached ≥0.98 accuracy across varied applications, models, and datasets, except ProGAN on LSUN Bedroom at 0.93 with a 10^-19 p-value.These results justify transferability from training data to generated data and support detection and attribution.
- 5.2. Transferability: Deep-learning-based steganography transferred fingerprints into generative models, whereas conventional steganography and watermarking produced random-guess decoding performance.The authors attribute this difference to the mismatch between shallow steganography and deep generative modeling.
- 5.3. Fidelity: +3.75 FID was the heaviest reported deterioration for fingerprinted ProGAN on LSUN Cat, while fingerprints remained imperceptible without 10× magnification.The fingerprinted models stayed close to the original non-fingerprinted baselines across settings.
- 5.4. Robustness: 75% bitwise accuracy remained the operating threshold under image perturbations, with useful ranges reported for noise, blur, JPEG compression, cropping, and quantization.Detection declined monotonically as perturbation increased, but slowly for small perturbations.
- 5.4. Robustness: >500% FID increase occurred before model-perturbation detection fell below 75%, indicating image quality deteriorated faster than fingerprint accuracy.For the studied perturbations, fingerprints were more robust than image functionality itself.
- 5.5. Secrecy: Attackers achieved binary classification accuracy close to 0.5, indicating fingerprint presence remained difficult to detect regardless of access to the encoder and decoder.The evaluated weak, medium, and strong attackers differed in access to fingerprinting components and codes.
- 5.7. Deepfake Attribution: The fingerprinting solution maintained 100% attribution accuracy across four model sources, while the CNN baseline deteriorated in open-world attribution.The comparison covered CelebA and LSUN Bedroom, including sources inside and outside the baseline classifier’s training set.
6. Conclusion
The paper roots deepfake detection in training data by transferring artificial fingerprints through generative models and into generated images. It reports perfect detection and attribution accuracy while supporting responsibility disclosure for released models.
- The solution transfers artificial fingerprints from training data through generative models into generated deepfakes.
- Perfect detection and attribution accuracy outperforms two recent state-of-the-art methods.
- Allocating each model a unique fingerprint enables inventors to disclose responsibility for generated content.
A. Implementation Details
The implementation embeds fingerprints into training images using a steganography encoder and decodes them with a neural decoder. Generative models are then trained with their original protocols without modification.
- The encoder embeds a binary fingerprint into an image while minimizing pixel differences between input and stego images.
- The decoder uses convolutional and dense layers with sigmoid output to recover the binary fingerprint vector.
- Encoder and decoder training jointly balances fingerprint detection with image reconstruction after detection accuracy reaches 95%.The training initially sets λ = 0, then increases it after 3–5 epochs.
- The implementation modifies StegaStamp code while leaving the generative-model training repositories unchanged.
B. Additional Samples
Additional samples show that fingerprints are imperceptibly transferred across varied generation applications, models, and datasets into generated images.
- Fingerprints are imperceptibly transferred to generative models and then to generated images across the additional examples.The examples span Figures 7–11 and multiple generation applications, models, and datasets.
C. Robustness of ProGAN on LSUN Bedroom
The ProGAN robustness experiment on LSUN Bedroom evaluates fingerprint detection under several image perturbations. The reported working ranges are broad for the studied perturbation types.
- Robustness results: Fingerprint detection remains operational across Gaussian noise, blur, JPEG compression, and center cropping perturbations.
- Perturbation ranges: Gaussian noise standard deviation works over ∼[0.0, 0.1].
- Perturbation ranges: Gaussian blur kernel size works over ∼[0, 7].
- Perturbation ranges: JPEG compression quality works over ∼[30, 100].
- Perturbation ranges: Center cropping size works over ∼[108, 128].