CSF：基于组合语义的文生图模型黑盒指纹方法
CSF: Black-box Fingerprinting via Compositional Semantics for Text-to-Image Models
提出一种仅靠查询访问即可对微调文生图模型进行谱系归因的黑盒指纹方法，其组合语义探测思路可迁移到模型溯源、版权保护与微调检测等视觉安全场景。
原文依据 the first black-box method for attributing fine-tuned text-to-image models to protected lineages using only query access
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论文生图模型是具有商业价值的资产，通常以限制性许可证分发，但此类许可证只有在能够检测到违规行为时才可执行。现有方法需要部署前水印或模型内部访问权限，而这些在商业 API 部署中不可用。我们提出组合语义指纹（CSF），这是首个仅使用查询访问即可将微调文生图模型归因到受保护谱系的黑盒方法。CSF 将模型视为语义类别生成器，并使用在微调下仍然罕见的组合性欠指定提示词对其进行探测。这为知识产权所有者提供了不对称优势：新的提示词组合可以在部署后生成，而攻击者必须预测并抑制更广泛的指纹空间。在 6 个模型家族（FLUX、Kandinsky、SD1.5/2.1/3.0/XL）和 13 个微调变体上，我们的贝叶斯归因框架能够实现风险可控的谱系判定，所有变体均满足支配性准则。
英文原文摘要 1033 字符
Text-to-image models are commercially valuable assets often distributed under restrictive licenses, but such licenses are enforceable only when violations can be detected. Existing methods require pre-deployment watermarking or internal model access, which are unavailable in commercial API deployments. We present Compositional Semantic Fingerprinting (CSF), the first black-box method for attributing fine-tuned text-to-image models to protected lineages using only query access. CSF treats models as semantic category generators and probes them with compositional underspecified prompts that remain rare under fine-tuning. This gives IP owners an asymmetric advantage: new prompt compositions can be generated after deployment, while attackers must anticipate and suppress a much broader space of fingerprints. Across 6 model families (FLUX, Kandinsky, SD1.5/2.1/3.0/XL) and 13 fine-tuned variants, our Bayesian attribution framework enables controlled-risk lineage decisions, with all variants satisfying the dominance criterion.