Watermarking text to image AI to protect model ownership
Persistent Watermarking of Text-to-Image Models
Computer Vision and Pattern Recognition
Summary
Training text-to-image AI models is expensive, so keeping track of who owns them is important. The authors developed a way to add hidden 'watermarks' to these AI models that remain even if someone changes or adapts the model later. Their method makes it easier to detect if a model has been copied or altered without permission, while still letting the AI create images normally. This helps protect the rights of people or companies who create these AI models.
What this means in practice
- •For ai platform operators: Detect unauthorized reuse or modification of text-to-image models served through public APIs to protect intellectual property.
- •For digital content creators: Safeguard costly AI-generated artwork by embedding persistent signatures that identify original model sources even after editing or adaptation.
Authors
Dixi Yao, Kaiwen Chen, Tahseen Rabbani, Tian Li
Abstract
Text-to-image (T2I) generation is gaining increasing popularity with the general public, motivating the development of reliable mechanisms for copyrighting such models given their expensive training costs. An adversary may obtain and reuse a pretrained T2I model without authorization, and then serve a modified version through an API service. Such modifications may arise from ordinary downstream adaptation or deliberate attempts to erase ownership, including input-prompt preprocessing, model fine-tuning, and output post-processing. From the model owner's perspective, a key challenge is therefore to embed trigger data that remain persistent under such changes while preserving the model's normal image-generation capabilities. In this work, we propose a contrastive-style watermarking objective with a term that explicitly encourages the watermarked model to behave differently from the original model on trigger inputs. Experiments show substantially stronger trigger-data persistence than prior methods across a wide range of downstream modifications and deliberate attempts to weaken the watermark, resulting in higher detection rates, often approaching 100% TPR@FPR<$10^{-4}$.