Real-time defense stopping unauthorized copying of AI image models
RAPID: A Real-Time Defense Against Unauthorized Model Distillation for Text-to-Image Services
Cryptography and Security
Summary
Text-to-image models can be copied by outsiders who repeatedly request images and use them to train a stolen version. The authors developed RAPID, a method that changes the model’s output in a subtle but consistent way, making it hard for unauthorized copies to learn from the images. Unlike earlier defenses that slow down the service, RAPID works instantly without slowing things down and still produces good images for real users. Their tests show RAPID lowers the copycat model’s image quality while keeping the original images looking fine.
What this means in practice
- •For cloud service providers: Protect deployed text-to-image services from unauthorized model copying without adding user-facing delays.$Commercial implications: Enables selling AI image generation services with built-in real-time protection against model theft.
- •For machine learning engineers: Integrate defense techniques into generative model architectures to prevent training data leakage in model distillation attacks.
Authors
Zihan Wang, Boheng Li, Rui Zhang, Wenshu Fan, Qingchuan Zhao, Tianwei Zhang, Hongwei Li, Guowen Xu
Abstract
Diffusion-based text-to-image (T2I) models are increasingly used for visual content creation, making their generation capability a valuable intellectual property asset. However, this capability is vulnerable to black-box output-based distillation, where an adversary queries the service, collects prompt-image pairs, and trains an unauthorized substitute model that mimics its generation behavior. Existing perturbation-based defenses apply sample-wise optimization to make generated images disruptive to unauthorized training, but introduce substantial computation and latency that reduce the usability of online T2I services. A natural solution is to integrate defensive perturbations into the VAE decoder, allowing the protected model to generate defended images directly without online sample-wise optimization. However, existing sample-wise objectives struggle to transfer to the shared decoder setting. We empirically find that a defensive shared decoder induces a substantially smaller latent shift than sample-wise optimization, suggesting that objective reachability matters more than destructiveness in this setting. To overcome this limitation, we propose RAPID, a self-referenced latent maximization framework that removes external dependencies and encourages the same model update to induce consistently disruptive effects across training samples, thereby improving reachability. We further introduce reconstruction-guided color regularization that blocks the latent shortcut and reinforces visual disruption. Extensive experiments on four T2I models and four datasets, with comparisons against five representative baselines, show that RAPID consistently degrades substitute-model generation quality while preserving service visual fidelity. Our work establishes a paradigm for real-time protection against unauthorized distillation in deployed T2I systems.