Smudged Fingerprints: A Systematic Evaluation of the Robustness of AI Image Fingerprints

AI summary

Overview

Research area: AI-generated image provenance, model fingerprint detection (MFD), and adversarial machine learning security, sitting at the intersection of computer vision and trustworthy ML.

Technical level: Advanced. The paper formalizes threat models, derives attack strategies, and reports attack success rates over a large benchmark, so it assumes familiarity with adversarial examples, gradient-based optimization, and attribution classifiers.

Scope: The paper performs the first systematic security evaluation of 14 model fingerprint detection methods against removal and forgery attacks across 12 state-of-the-art image generators, under three levels of adversarial knowledge.

What This Paper Is About

Model fingerprint detection (MFD) tries to identify which generative model produced an image by detecting subtle, model-specific artifacts the generator leaves behind. Existing MFD methods report very high accuracy in benign settings, but these techniques are proposed for inherently adversarial uses such as forensics and accountability, and prior security evaluations are scarce, narrow, and mostly limited to simple image transformations. This paper builds a common framework of threat models and attack strategies to measure how well those fingerprints survive an attacker who actively tries to erase them or to forge them onto a different model.

Key Contributions

1. A comprehensive review of the MFD literature across three feature domains (RGB, frequency, and learned representations), identifying four specific gaps in existing security evaluations: reliance on simple perturbations, adaptive attacks tested against only single techniques, security assessed only for deepfake detection rather than model attribution, and a complete absence of forgery evaluations.
2. Formal threat models with three levels of adversarial knowledge (white-box access, Black-box Access I, and Black-box Access II) covering two attacker goals, fingerprint removal and fingerprint forgery, from which five concrete attack strategies (W1, W2, W3, B1, B2) are derived.
3. An evaluation framework that executes these attacks against 14 representative MFD methods for model attribution across 12 state-of-the-art generative models spanning GANs, VAEs, and diffusion models on the FFHQ dataset.
4. An in-depth analysis of the attack results, including the relationship between removal and forgery, a utility–robustness trade-off, and the effect of model type and architecture on attack success, plus identification of the most promising directions for more robust MFD.

Main Findings

• Large clean-versus-adversarial gap: MFD techniques perform strongly in benign attribution (reported accuracies in Table I range from 23.81% for McCloskey18 to 98.47% for Wang20) but degrade sharply under attack, revealing a pronounced difference between clean and adversarial performance.
• Removal attacks are highly effective: removal attacks often achieve success rates above 80% in white-box settings and over 50% under black-box access, making them a serious limitation on the techniques' forensic utility.
• Even cheap black-box perturbations work: simple Black-box Access II image transformations (noise, blur, JPEG, resizing) achieve an attack success rate above 50%, despite requiring no knowledge of the fingerprint extractor, the attribution classifier, or the candidate generator set.
• Forgery is harder, but unevenly so: forgery attacks succeed less often than removal attacks, yet success varies significantly across the targeted models, meaning vulnerability to one attack does not imply vulnerability to the other.
• Utility–robustness trade-off: the MFD methods that produce accurate attribution are often the ones most vulnerable to attack. Some techniques are robust in specific settings, but none achieves both robustness and accuracy across all evaluated threat models.
• Breakdown of attack applicability: attacks are gated by the mathematical properties of the fingerprint extractor. For example, Giudice21, Corvi23-R, Corvi23-S, Qian20, and Wang20 are reported as differentiable (eligible for W1), while methods such as McCloskey18, Nataraj19, Nowroozi22, Marra19a, Durall20, and Dzanic20 are non-differentiable but admit an analytic approximation (eligible for W2); Song24-RGB, Song24-Freq, and Song24-SL are neither differentiable nor analytically approximable and fall back to W3/B1/B2.
• Architecture matters: the paper specifically investigates the impact of the generator's model type (GAN, VAE, diffusion) and architecture on attack success rate.
• Perceptual quality preserved: across all attacks, the perturbation budget of ε = 0.025 consistently yields LPIPS below 0.05 and PSNR above 35 dB, indicating the attacks do not visibly degrade the images.

Methodology in Plain English

The authors treat model attribution as a two-stage system: a fingerprint extractor that converts an image into a feature vector, and a classifier that maps that vector to one of several candidate generators. They then ask what an attacker with different amounts of information could do.

Under white-box access, the attacker knows both stages and can compute gradients end to end. The authors split this into three cases depending on whether the extractor is directly differentiable (W1), non-differentiable but approximable by a smooth stand-in (W2), or only approximable by training a neural network to mimic it (W3). Under Black-box Access I, the attacker does not see the system but knows the candidate generators, so it samples images from each and trains a surrogate attribution classifier to attack, hoping the adversarial examples transfer. Under Black-box Access II, the attacker knows nothing and simply applies generic image transformations.

All gradient-based attacks share one constrained optimization problem, minimized with Projected Gradient Descent using momentum and adaptive step sizes, and differ only in which surrogate model stands in for the real system and which loss is used: an untargeted loss that pushes predictions away from the true source (removal) or a cross-entropy loss toward a chosen target label (forgery). The generator set is 12 pretrained models on FFHQ producing 256×256 images: six GANs (StyleGAN2, StyleGAN3, GANformer, StyleSwin, R3GAN, CIPS), three VAEs (VDVAE, VQVAE, NVAE), and three diffusion models (NCSN++, LDM, ADM). For each MFD method, the authors train an MLP attribution classifier with [512, 256, 128] hidden dimensions for 100 epochs on 1,000 fingerprints per generator, plus a CNN surrogate classifier and a CNN surrogate extractor where needed. Attacks are run on 100 images per generator, limited to images the true classifier gets right, with six candidate step sizes and success counted if any step size succeeds. Experiments run in PyTorch on NVIDIA A100 GPUs, and results are averaged over 5 independent runs.

Why This Matters

Impact on research. The paper reframes MFD from a detection-accuracy problem into a security problem. It shows that the near-perfect attribution numbers reported in the literature (up to 98.47% in this paper's reproductions) do not survive an adversary, and that the only two existing studies with adaptive attacks tested single techniques rather than a representative range, which does not allow generalization. It also argues that because model attribution is the harder task than deepfake detection, robustness results for attribution carry over to deepfake detection.

Real-world applications.

• Digital forensics: fingerprint removal directly threatens the preservation of forensic evidence, since an attacker can erase the trace before an image is examined.
• Platform content moderation and provenance: attribution is used to flag images produced by banned or problematic models, and removal undermines exactly that enforcement.
• Accountability for model misuse: if a harmful output can be reliably attributed to a specific model, providers can investigate causes and prevent recurrence; the paper's results show this chain is fragile under attack.
• Protecting legitimate providers from false implication: forgery attacks aim to misattribute images to a target model, so a working forgery attack could be used to frame an innocent provider.

Industry relevance. Generative model providers, API vendors, and content platforms that rely on attribution or provenance signals for trust and safety need to know these signals are not adversarially reliable. The paper positions MFD against model watermarking, which has received systematic removal and forgery robustness evaluations, and argues the comparison shows a security gap. The released code at https://github.com/kaikaiyao/SmudgedFingerprints gives practitioners a way to test their own pipelines.

Future Directions

• Designing MFD techniques that achieve both high attribution accuracy and robustness across all three threat models, since no evaluated method does so; the paper identifies the most promising approaches toward this goal.
• Closing the forgery gap, which remains harder than removal but varies significantly by target model, and whose behavior across architectures is still not well characterized.
• Broadening security evaluations beyond the 14 methods and 12 generators studied here, including generator families and post-processing pipelines not covered by the FFHQ-based setup.
• Examining the utility–robustness trade-off more directly, since the paper observes that accurate methods tend to be vulnerable but does not report a resolution of that tension.

Target Audience

Researchers working on AI image provenance, model attribution, and generative model forensics, along with adversarial robustness researchers interested in a cross-domain security benchmark. It is also relevant to trust-and-safety engineers and policy-focused practitioners at model providers and content platforms who may be considering MFD as an accountability mechanism, and to reviewers or builders of watermarking schemes who want a security comparison point. The paper assumes comfort with adversarial examples and gradient-based optimization, so it suits readers with intermediate-to-advanced machine learning background.

Authors’ abstract

Model fingerprint detection has shown promise to trace the provenance of AI-generated images in forensic applications. However, despite the inherent adversarial nature of these applications, existing evaluations rarely consider adversarial settings. We present the first systematic security evaluation of these techniques, formalizing threat models that encompass both white- and black-box access and two attack goals: fingerprint removal, which erases identifying traces to evade attribution, and fingerprint forgery, which seeks to cause misattribution to a target model. We implement five attack strategies and evaluate 14 representative fingerprinting methods across RGB, frequency, and learned-feature domains on 12 state-of-the-art image generators. Our experiments reveal a pronounced gap between clean and adversarial performance. Removal attacks are highly effective, often achieving success rates above 80% in white-box settings and over 50% under black-box access. While forgery is more challenging than removal, its success varies significantly across targeted models. We also observe a utility-robustness trade-off: accurate attribution methods are often vulnerable to attacks and, although some techniques are robust in specific settings, none achieves robustness and accuracy across all evaluated threat models. These findings highlight the need for techniques that balance robustness and accuracy, and we identify the most promising approaches toward this goal. Code available at: https://github.com/kaikaiyao/SmudgedFingerprints.