Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Models

TL;DR

This paper introduces SIREN, a novel method for reliably verifying unauthorized data usage in personalized text-to-image diffusion models by embedding and detecting learnable watermarks, addressing limitations of existing coatings.

Contribution

SIREN optimizes data coatings to be learnable by personalized models and employs perceptual constraints and hypothesis testing for robust verification, advancing data traceability in generative AI.

Findings

SIREN significantly improves watermark learnability in personalized models.

The method achieves high detection accuracy across diverse datasets and models.

SIREN remains effective against potential countermeasures.

Abstract

Text-to-image diffusion models are pushing the boundaries of what generative AI can achieve in our lives. Beyond their ability to generate general images, new personalization techniques have been proposed to customize the pre-trained base models for crafting images with specific themes or styles. Such a lightweight solution, enabling AI practitioners and developers to easily build their own personalized models, also poses a new concern regarding whether the personalized models are trained from unauthorized data. A promising solution is to proactively enable data traceability in generative models, where data owners embed external coatings (e.g., image watermarks or backdoor triggers) onto the datasets before releasing. Later the models trained over such datasets will also learn the coatings and unconsciously reproduce them in the generated mimicries, which can be extracted and used as the data usage evidence. However, we identify the existing coatings cannot be effectively learned in personalization tasks, making the corresponding verification less reliable. In this paper, we introduce SIREN, a novel methodology to proactively trace unauthorized data usage in black-box personalized text-to-image diffusion models. Our approach optimizes the coating in a delicate way to be recognized by the model as a feature relevant to the personalization task, thus significantly improving its learnability. We also utilize a human perceptual-aware constraint, a hypersphere classification technique, and a hypothesis-testing-guided verification method to enhance the stealthiness and detection accuracy of the coating. The effectiveness of SIREN is verified through extensive experiments on a diverse set of benchmark datasets, models, and learning algorithms. SIREN is also effective in various real-world scenarios and evaluated against potential countermeasures. Our code is publicly available.