[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-136125-en":3,"doc-seo-136125-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},136125,2336464648746,"Skyler","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","CSF: Black-box Fingerprinting via Compositional Semantics for Text-to-Image Models - Abstract and Introduction","Text-to-image models are valuable assets protected by restrictive licenses, yet enforcement depends on detecting violations. This CVPR paper introduces Compositional Semantic Fingerprinting (CSF), a black-box query-only method that attributes fine-tuned text-to-image models to protected lineages without pre-deployment watermarking or internal model access. CSF treats models as semantic category generators, probing them with rare compositional underspecified prompts, then performs Bayesian attribution for controlled-risk lineage decisions across multiple families and fine-tuned variants.","This CVPR paper is the Open Access version, provided by the Computer Vision Foundation.  \nExcept for this watermark, it is identical to the accepted version; the final published version of the proceedings is available on IEEE Xplore.  \nCSF: Black-box Fingerprinting via Compositional Semantics for  \nText-to-Image Models  \nJunhoo Lee Mijin Koo Nojun Kwak  \nSeoul National University  \n{mrjunoo, starmj09, [nojunk](nojunk}@snu.ac.kr)[}](nojunk}@snu.ac.kr)[@snu.ac.kr](nojunk}@snu.ac.kr)  \nAbstract  \nText-to-image models are commercially valuable assets often distributed under restrictive licenses, but such licenses are enforceable only when violations can be detected. Existing methods require pre-deployment watermarking or internal model access, which are unavailable in commercial API deployments. We present Compositional Semantic Fingerprinting (CSF), the first black-box method for attributing fine-tuned text-toimage models to protected lineages using only query access. CSF treats models as semantic category generators and probes them with compositional underspecified prompts that remain rare under fine-tuning. This gives IP owners an asymmetric advantage: new prompt compositions can be generated after deployment, while attackers must anticipate and suppress amuch broader space of fingerprints. Across 6 model families (FLUX, Kandinsky, SD1.5/2.1/3.0/XL) and 13 finetuned variants, our Bayesian attribution framework enables controlled-risk lineage decisions, with all variants satisfying the dominance criterion.  \n1. Introduction  \nText-to-Image models are deployed at scale and have gained huge success commercially [8, 23, 24, 36, 41, 43], now offering their services to millions of users. Asthe models themselves have become valuable assets, intellectual property (IP) protection for these models has become urgent. Consequently, many diffusion models are now distributed under restrictive licenses (e.g., noncommercial license for Flux.1 [dev][22], research-only license for SDXL Turbo [2]) to prevent unauthorized commercial distribution of fine-tuned derivatives. However, these licenses are only effective when violations can be detected. The problematic scenario arises when an infringer fine-tunes a protected model and distributesit exclusively through an API. To address this challenge, we need a method that can attribute a suspect model to a  \nFigure 1 . Comparison of model identification scenarios. (a) Watermarking requires pre-deployment access to inject a trigger into the base model. (b) Traditional Fingerprinting relies on white-box or gray-box ‘Internal Access’(e.g., weights or activations), which is not available in commercial API. (c) Our approach (CSF) is designed for the most restrictive ‘Query Only’ black-box setting, where the defender only has access to the final T2I generation API, reflecting realworld infringement scenarios.  \nprotected lineage under minimal access.  \nThis problem reduces to finding a signature that attributes a suspect model to its root IP lineage. Existing approaches either inject identifiers into models (watermarking) or discover intrinsic fingerprints (fingerprinting). Watermarking works well in black-box, query-only settings because trigger inputs induce detectable patterns in outputs that survive typical fine-tuning [6, 16, 56, 60] . But watermarking requires pre-deployment training, can degrade model quality [4, 15, 25, 62], and, once known, can be removed by infringers [3, 14, 26, 30] . Fingerprinting instead passively extracts characteristics from deployed models, but these signals are subtle. Existing methods either do not address preservation under fine-tuning [55], or require internal activations or fine-  \ngrained generation control [18, 27, 47, 53, 59], which commercial APIs typically do not provide (Figure 1) . This leaves the restricted-access setting with only textimage pairs largely unsolved.  \nIn this work, we present Compositional Semantic Fingerprinting (CSF), a fingerprinting method th","cbCaiaPEndAFXeEt","https://ap.wps.com/l/cbCaiaPEndAFXeEt","pdf",5895268,1,11,"English","en",105,"# Introduction\n## Problem setting: query-only black-box infringement\n## Limitations of watermarking and traditional fingerprinting\n## Core idea: move from visual space to semantic space\n## Method overview: compositional underspecified prompts and semantic inference","[{\"question\":\"What does CSF enable in a query-only black-box setting?\",\"answer\":\"CSF attributes a suspect fine-tuned text-to-image model to a protected lineage using only query access to the final generation API, without needing internal weights or pre-deployment modifications.\"},{\"question\":\"Why are watermarking approaches insufficient for commercial API deployments?\",\"answer\":\"Watermarking typically requires pre-deployment access to inject triggers and can harm quality; it also can be removed once known, making it less suitable when defenders lack model modification capability.\"},{\"question\":\"How does CSF avoid relying on fragile pixel-level signals after fine-tuning?\",\"answer\":\"CSF probes semantic compositions that are sparsely affected by fine-tuning, then converts generated outputs into semantic category distributions using zero-shot classification to compare references and suspects.\"}]","CSF: Black-box Fingerprinting via Compositional Semantics for Text-to-Image Models - Abstract and Introduction | PDF",1787349571,28,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"csf-black-box-fingerprinting-via-compositional-semantics-for-text-to-image-models-abstract-and-introduction","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/csf-black-box-fingerprinting-via-compositional-semantics-for-text-to-image-models-abstract-and-introduction/136125/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-09-02","2026-08-21",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"What does CSF enable in a query-only black-box setting?","Question",{"text":76,"@type":77},"CSF attributes a suspect fine-tuned text-to-image model to a protected lineage using only query access to the final generation API, without needing internal weights or pre-deployment modifications.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"Why are watermarking approaches insufficient for commercial API deployments?",{"text":81,"@type":77},"Watermarking typically requires pre-deployment access to inject triggers and can harm quality; it also can be removed once known, making it less suitable when defenders lack model modification capability.",{"name":83,"@type":74,"acceptedAnswer":84},"How does CSF avoid relying on fragile pixel-level signals after fine-tuning?",{"text":85,"@type":77},"CSF probes semantic compositions that are sparsely affected by fine-tuning, then converts generated outputs into semantic category distributions using zero-shot classification to compare references and suspects.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":93},[94,98,102,106,111,116,121,124,129,132,136],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":107,"doc_module":4,"doc_module_name":46,"category_name":108,"show_sort_weight":109,"slug":110},5,"Comic",60,"comic",{"id":112,"doc_module":4,"doc_module_name":46,"category_name":113,"show_sort_weight":114,"slug":115},6,"Technology",50,"technology",{"id":117,"doc_module":4,"doc_module_name":46,"category_name":118,"show_sort_weight":119,"slug":120},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":122,"slug":123},30,"research-report",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":126,"show_sort_weight":127,"slug":128},9,"Religion & Spirituality",20,"religion-spirituality",{"id":127,"doc_module":4,"doc_module_name":46,"category_name":130,"show_sort_weight":127,"slug":131},"World Cup","world-cup",{"id":133,"doc_module":4,"doc_module_name":46,"category_name":134,"show_sort_weight":133,"slug":135},10,"Lifestyle","lifestyle",{"id":137,"doc_module":4,"doc_module_name":46,"category_name":138,"show_sort_weight":107,"slug":139},19,"General","general"]