Spectralcanary plants hidden low-frequency signals for image model auditing
SpectralCanary: Embarrassingly Simple Low-Frequency Traces for T2I Dataset-Use Auditing
Computer Vision and Pattern RecognitionMachine Learning
Summary
It can be hard to tell if an image-generation AI was trained on a specific set of pictures, since the AI might learn general features without copying exact images. The authors propose SpectralCanary, which subtly mixes a special low-frequency pattern called a canary into every image of a dataset before it’s shared. Later, if a model is suspected of using that dataset, a simple check can find this hidden pattern in images it creates. Tests show this method works well across different data types and models, and the hidden signals are hard to remove without ruining image quality.
What this means in practice
- •For machine learning engineers: Verify if a text-to-image AI model was trained on a specific dataset by detecting a hidden low-frequency signal embedded into original images.
- •For digital forensics teams: Use embedded spectral signals to audit AI-generated images for unauthorized use of proprietary datasets in model training.
Authors
Sy-Tuyen Ho, Anirudh Satheesh, Soham Chawathe, Huy Nghiem, Yongkyun Lee, Andrew Adams Schoen, Furong Huang
Abstract
Auditing whether a text-to-image (T2I) model was fine-tuned on a particular image collection is difficult: a model can absorb collection-level visual characteristics without reproducing training images. Proactive dataset-use auditing plants a shared signal in a dataset before release, then later checks whether that signal appears in a suspect model's generated outputs. Existing approaches often trade off verifiability, fidelity, robustness, and deployability. We introduce $\textbf{SpectralCanary}$, which uses a smooth low-pass mask to blend a fixed canary image into every collection image while leaving captions unchanged and requiring neither auxiliary generation nor per-image optimization. A lightweight verifier detects the transferred signal in suspect-model outputs. Across eight tests on the Pokemon dataset and three realistic data transformations, spanning two architectures families, SpectralCanary achieves the highest average per-generation TPR@$1\%$ FPR ($91.1\%$) and fixed threshold model-level accuracy using 30 generations ($94.8\%$) among the evaluated methods. Across five datasets spanning artistic, medical, satellite, and fashion domains with SD3.5, SpectralCanary averages $92.4\%$ per-generation TPR@$1\%$ FPR while preserving the released images (SSIM $0.989$, LPIPS $0.022$) with a near-zero mean change FID (mean $Δ$FID $0.05$) across datasets. Matched-energy ablations on Pokemon and ROCOv2 support our design choice, low-frequency placement transfers more reliably compared to mid/high-frequency placement. Under the evaluated adaptive attacks, the most effective removal requires aggressive modification and incurs more than $25$ $Δ$FID points. These results identify low-frequency visual signals as effective carriers for collection-level T2I audit traces.