PaperlayerView exact revision on arXiv

Source-linked AI summary

Reverse Engineering of Generative Models: Inferring Model Hyperparameters from Generated Images

Vishal Asnani, Xi Yin, Tal Hassner, Xiaoming Liu

arXiv:2106.07873v3cs.CVcs.AIcs.LG

TL;DR

Photo-realistic generative models raise concerns about misuse, while image attribution assumes a closed set of models. This paper estimates fingerprints from generated images and parses unseen models’ architectures and training losses; experiments report promising parsing results and comparable or better than SOTA performance on deepfake detection and image attribution.

  • Problem

    Image attribution assumes a closed set of generators, leaving the question of how to infer the design of an unseen generator from its generated images.

    Source: §1 · p. 1

  • Method

    The framework estimates a generator fingerprint from an image using property-based constraints, then predicts architecture and training-loss hyperparameters from that fingerprint.

    Source: §1 · p. 2

  • Results

    The paper reports promising model-parsing results and fingerprint-based deepfake detection and image attribution results comparable to or better than existing SOTA.

    Source: §1 · p. 3

  • Takeaways & Limitations

    Fingerprint estimation supports model parsing as well as deepfake detection and image attribution, and parsed parameters can be used to detect coordinated misinformation attacks.

    Source: §1 · pp. 2–3

    Fingerprint estimation assumes fingerprints are small-magnitude noise patterns and ideally independent of image content.

    Source: §3.2 · p. 4, §4.3 · p. 11

Abstract

from arXiv · show

State-of-the-art (SOTA) Generative Models (GMs) can synthesize photo-realistic images that are hard for humans to distinguish from genuine photos. Identifying and understanding manipulated media are crucial to mitigate the social concerns on the potential misuse of GMs. We propose to perform reverse engineering of GMs to infer model hyperparameters from the images generated by these models. We define a novel problem, ``model parsing", as estimating GM network architectures and training loss functions by examining their generated images -- a task seemingly impossible for human beings. To tackle this problem, we propose a framework with two components: a Fingerprint Estimation Network (FEN), which estimates a GM fingerprint from a generated image by training with four constraints to encourage the fingerprint to have desired properties, and a Parsing Network (PN), which predicts network architecture and loss functions from the estimated fingerprints. To evaluate our approach, we collect a fake image dataset with $100$K images generated by $116$ different GMs. Extensive experiments show encouraging results in parsing the hyperparameters of the unseen models. Finally, our fingerprint estimation can be leveraged for deepfake detection and image attribution, as we show by reporting SOTA results on both the deepfake detection (Celeb-DF) and image attribution benchmarks.

1 INTRODUCTION

Photo-realistic generated images raise misuse concerns, while image attribution is limited to a closed set of generators. This paper introduces model parsing to infer unseen generators’ hyperparameters from generated images, using estimated fingerprints and a parsing network.

1 INTRODUCTION

  • The problem matters because defenders may need to learn how an unseen generator was designed to understand malicious image sources or identify coordinated attacks using the same generator.Photo-realism makes generated images difficult for people to distinguish from genuine photos and raises concerns about misuse.Source: §1 · p. 1
  • Model parsing estimates an unseen generator’s network architecture and training loss functions from only its generated image, extending beyond closed-set image attribution.Earlier reverse engineering relied on model inputs and outputs or hardware usage during inference; the paper says this setting had not been explored for generative models using generated images alone.Source: §1 · pp. 1–2
  • The dataset contains 1,000 generated images from each of 116 diverse generative models, with architecture and training-loss labels used as parsing ground truth.The collection includes GANs, VAEs, adversarial attack models, autoregressive models, and normalizing flows.Source: §1 · pp. 2–3
  • The framework estimates fingerprints using constraints on magnitude, repetitiveness, frequency range, and symmetrical frequency response, then predicts hyperparameters with a Parsing Network.The Parsing Network uses cluster and instance parsers to combine predictions; it handles 15 architecture parameters and 10 loss-function indicators.Source: §1 · p. 2
  • The paper’s contributions include formulating model parsing as a new problem and proposing a framework that predicts generator architecture and loss functions from one generated image.The approach is evaluated on unseen models, and the fingerprint estimation is also applied to deepfake detection and image attribution.Source: §1 · pp. 2–3
  • The framework’s fingerprint estimation generalizes to deepfake detection and image attribution, with results comparable to or better than existing SOTA, and parsed parameters can help detect coordinated misinformation attacks.The paper also reports promising results for model parsing.Source: §1 · pp. 2–3

2 RELATED WORK

Prior model reverse engineering uses model input-output access or inference-time hardware information, while GM fingerprint work has used noise or frequency patterns. This work proposes learning GM fingerprints with loss functions and applying them to tasks including deepfake detection.

2 RELATED WORK

  • Prior reverse-engineering methods examine model input-output pairs or inference-time hardware information, whereas this approach uses only generated images.The authors describe the image-only approach as more suitable for real-world applications.Source: §2 · p. 3
  • Earlier GM fingerprints derived from noise or frequency patterns, while this work proposes loss functions for unsupervised fingerprint learning.Prior work also used fingerprints for source identification; the paper proposes extending fingerprint use to related tasks.Source: §2 · p. 3
  • For deepfake detection, the paper feeds its estimated fingerprint to a classifier for genuine-versus-fake classification.The cited related approaches include patch-based classifiers, attention mechanisms, artifact amplification, and face-context discrepancies.Source: §2 · p. 3

3 PROPOSED APPROACH

The proposed approach collects generated images and model hyperparameter labels across diverse GMs, then examines how architecture and loss-function labels are distributed across face and non-face data.

3.1 Data collection

  • The dataset contains 116 publicly available GMs with 1,000 generated images each, totaling 116,000 images from varied content domains.Selection favored diverse content, publicly released models, images or training scripts, and clearly described architectures.Source: §3.1 · pp. 3–4
  • The collected ground truth covers 15 network-architecture parameters and 10 training-loss types documented for each model.Architecture parameters include examples such as layer count and normalization type.Source: §3.1 · p. 4
  • Ground-truth architecture and loss vectors are fairly distributed across the embedding space for both face and non-face data.Figure 3 visualizes architecture labels, loss labels, and their combination.Source: §3.1 · p. 4, Figure 3 · p. 4

3.2 Fingerprint estimation

Fingerprint estimation maps a generated image to a same-sized fingerprint image, with four constraints guiding its magnitude and frequency characteristics.

3.2 Fingerprint estimation

  • FEN uses a DnCNN-like structure to map generated image X to a same-sized fingerprint F, trained with four property-driven constraints.The combined fingerprint constraint weights its four terms with λ1, λ2, λ3, and λ4.Source: §3.2 · pp. 4–5
  • Magnitude loss regularizes the fingerprint to have low magnitude, while spectrum loss minimizes its low-frequency content.The spectrum loss applies a low-pass filter in the frequency domain.Source: §3.2 · pp. 4–5
  • Repetitive loss maximizes high-frequency information to encourage patterns that repeat throughout the image’s spatial domain.The paper links repetitive patterns with large high-frequency magnitude in the fingerprint.Source: §3.2 · p. 5
  • Energy loss incorporates the observation that GM fingerprint patterns have similar energy in the vertical and horizontal Fourier-spectrum directions.The associated expression compares the spectrum with its transpose.Source: §3.2 · p. 5

3.3 Model parsing

Model parsing predicts a generative model’s architecture and training losses from its generated images. The framework combines cluster-level predictions with model-specific deviations to estimate these hyperparameters.

3.3 Model parsing

  • The framework combines cluster-level and model-specific predictions to estimate network architecture and loss-function hyperparameters.The final fine-level prediction combines the two parsers’ outputs.Source: §3.3 · p. 5, §3.3.4 · p. 7

3.3.1 Ground truth hyperparamters

  • The target comprises 15 architecture parameters and 10 binary indicators for whether each training loss was used.Architecture parameters are divided into nine continuous and six discrete parameters.Source: §3.3.1 · p. 5

3.3.2 Cluster parser prediction

  • K-means groups similar models within each GM type; cluster means or majority-voted classes provide coarse predictions, paired with model-specific deviations.The number of clusters is selected using the elbow method.Source: §3.3.2 · pp. 5–6, Figure 5 · p. 6
  • Continuous cluster parameters use normalized regression, while discrete cluster parameters use separate classifiers for architecture and loss-function predictions.The continuous parameters are min-max normalized to [0, 1] and estimated with L2 loss.Source: §3.3.2 · p. 6

3.3.3 Instance parser prediction

  • The instance parser predicts each model’s deviation from its cluster, using L2 loss for continuous parameters and weighted cross-entropy for discrete parameters.Class weighting down-weights frequent classes and up-weights rare classes.Source: §3.3.3 · p. 6

3.3.4 Combining predictions

  • For continuous parameters, the framework adds the cluster mean and instance deviation; for discrete parameters, a learned fusion value selects how to combine parser outputs.The fusion target is 1 when the cluster and model classes agree, and 0 otherwise.Source: §3.3.4 · p. 7

3.4 Other applications

The fingerprint-based approach also supports coordinated-attack detection, deepfake detection, and image attribution. These applications use parsed parameters or a shallow network operating on estimated fingerprints.

Coordinated misinformation attack

  • For coordinated-attack detection, parsed architecture and loss parameters produce a similarity score to classify whether two images came from the same GM.The approach is designed to handle a GM unseen by the classifier.Source: §3.4 · p. 7

Deepfake detection

  • For deepfake detection, a shallow network predicts genuine-versus-fake probabilities from estimated fingerprints, trained with genuine and fake face images.The fingerprint constraints are not applied to genuine input faces.Source: §3.4 · p. 7

Image attribution

  • For image attribution, a shallow network maps an image to its generating model in a closed-set task where all models are known during training.Images classified as genuine are also identified as such.Source: §3.4 · p. 7

4 EXPERIMENTS

The experiments evaluate model parsing on held-out generators and test its components, visual fingerprints, and applications. The proposed approach outperforms baselines in architecture and loss prediction, while results also show boundaries across content, image count, and generator type.

4.1 Settings

  • Evaluation averages results across four held-out sets of 12 GMs, while baselines include shuffled ground truths and mean or mode predictions.Each set contains six GANs, two VAEs, two autoregressive models, one adversarial-attack model, and one normalizing-flow model; training uses 104 GMs. The shuffled baseline preserves parameter distributions but assigns meaningless ground truths.Source: §4.1 · pp. 7–8, §4.2 · p. 8

4.2 Model parsing results

  • Across four test sets, our method performs better than three baselines for both continuous and discrete network-architecture parameters, and better than all three baselines in loss-type prediction.Source: Figure 6 · p. 8, Figure 7 · p. 8, Table 4 · p. 9

4.3 Ablation study

  • Content affects parsing: non-face GMs are easier to parse, same-content training and testing performs better, and full-data training helps some parameters but slightly hurts others.The authors suggest lower-quality non-face images may retain more traces for parsing.Source: §4.3 · pp. 9–10, Table 6 · p. 10
  • Weighted cross-entropy remedies frequent-class bias, and removing any fingerprint-estimation loss worsens performance, with the no-fingerprint baseline performing worst.The four losses are magnitude, spectrum, repetitive, and energy; Figure 9 contrasts standard and weighted cross-entropy confusion matrices.Source: §4.3 · pp. 10–11, Figure 9 · p. 10, Table 7 · p. 11
  • For model parsing, evaluation gains are noticeable when using 10 images per generative model, with little performance difference between 100 and 500 images; on diffusion models, the method clearly outperforms all baselines.The diffusion evaluation creates four test splits, each with three randomly selected diffusion models.Source: §4.3 · pp. 11–12

4.4 Visualization

  • Estimated fingerprints show low magnitude and middle- and high-frequency highlights, while fingerprints from the same GM have higher cosine similarity than those from different GMs.The similarity matrix averages 25 sampled fingerprint pairs per GM pair and clusters GMs with similar architectures or loss functions.Source: Figure 10 · p. 11, Figure 11 · p. 12, §4.4 · p. 13

4.5 Applications

  • Using FEN and PN together identifies whether two fake images share a source GM with around 80% accuracy, outperforming FEN-only comparison.Around 70% of misclassified pairs include at least one GM unseen in training; errors decrease when one test GM was seen during training.Source: §4.5 · p. 13, Table 10 · p. 13, Figure 12 · p. 13
  • On Celeb-DF, the method achieves the highest reported deepfake-detection AUC among compared methods, and its image-attribution results on CelebA and LSUN outperform prior results.The comparison notes that Xception+Reg uses pixel-level supervision, which is typically unavailable; the reproduced FF++ result also exceeds the reproduced performance of.Source: §4.5 · pp. 13–14, Table 11 · p. 13, Table 12 · p. 13

5 CONCLUSION

The conclusion defines model parsing as inferring a generative model's architecture and training losses from generated images. It summarizes fingerprint-based parsing, a 116-model dataset, and experiments on related applications.

5 CONCLUSION

  • The paper defines model parsing as inferring a generative model's network architecture and training loss functions from its generated images.Its framework estimates image fingerprints under four constraints and uses hierarchical learning to parse hyperparameters at coarse and fine levels.Source: §5 · p. 14

1 TEST SETS FOR EVALUATION

The evaluation uses four held-out test sets, each containing 12 GMs with a specified model-type distribution.

1 TEST SETS FOR EVALUATION

  • Each of the four test sets contains 12 held-out GMs: six GANs, two VAEs, two autoregressive models, one normalizing-flow model, and one adversarial-attack model.The distribution reflects the dataset's counts of 81 GANs, 13 VAEs, 11 autoregressive models, five normalizing-flow models, and six adversarial-attack models.Source: §1 · p. 18

2 GROUND TRUTH FOR GMS

The ground-truth dataset records architecture and loss-function hyperparameters for 116 generative models, with feature representations adapted to parameter type.

2 GROUND TRUTH FOR GMS

  • The collected face dataset contains 116 GMs with 1,000 generated images each and ground-truth architecture and loss-function hyperparameters.Architecture parameters include different data types; continuous values are min-max normalized to [0, 1], while loss-function indicators are binary.Source: §2 · p. 18

3 NETWORK ARCHITECTURE

The model-parsing network uses a 15-block FEN and a branched PN, while deepfake detection uses a deeper FEN and image attribution reuses the parsing FEN with a smaller classifier.

3 NETWORK ARCHITECTURE

  • For model parsing, a 15-block FEN estimates fingerprints, and a five-block PN encoder feeds a 512-D feature vector to parameter-specific prediction branches.Continuous parameters use a two-layer output; discrete and loss parameters use separate three-layer classifiers.Source: §3 · p. 18
  • Deepfake detection uses a 29-block FEN for fingerprints and a five-block convolutional classifier followed by two fully connected layers.Source: §3 · p. 18
  • Image attribution reuses the model-parsing FEN and adds a two-block convolutional classifier with two fully connected layers.Source: §3 · p. 18

4 FEATURE HEATMAPS

The feature heatmaps show that hyperparameter predictions rely on different image regions across face, MNIST, and CIFAR data. The maps are estimated by masking image regions and measuring changes in predictions.

4 FEATURE HEATMAPS

  • Heatmaps rank 5 × 5 regions using continuous-parameter L1 error or one minus the ground-truth class probability, averaged over 100 randomly selected images.A higher continuous-parameter error marks a more important region.Source: §4 · p. 18
  • Face and CIFAR hyperparameters rely mostly on central regions, while many MNIST features rely on edge regions; similarities among maps may indicate similar hyperparameters.Source: §4 · p. 18, Figure 1 · p. 19, Figure 2 · p. 21

Related papers

Loading 2106.07873v3…