# Robust Retraining-free GAN Fingerprinting via Personalized Normalization

arXiv: https://arxiv.org/abs/2311.05478 · HTML: https://mlsanity.com/paper/2311.05478/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 12 of its 18 references that are in the map.
- First posted on arXiv 9 Nov 2023.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 12 of 12)

- [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014)
- [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017)
- [Spectral Normalization for Generative Adversarial Networks](https://mlsanity.com/paper/1802.05957/) (2018)
- [StegaStamp: Invisible Hyperlinks in Physical Photographs](https://mlsanity.com/paper/1904.05343/) (2019)
- [Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data](https://mlsanity.com/paper/2007.08457/) (2020)
- [VEEGAN: Reducing Mode Collapse in GANs using Implicit Variational Learning](https://mlsanity.com/paper/1705.07761/) (2017)
- [BEGAN: Boundary Equilibrium Generative Adversarial Networks](https://mlsanity.com/paper/1703.10717/) (2017)
- [Responsible Disclosure of Generative Models Using Scalable Fingerprinting](https://mlsanity.com/paper/2012.08726/) (2020)
- [A survey of deep neural network watermarking techniques](https://mlsanity.com/paper/2103.09274/) (2021)
- [Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack](https://mlsanity.com/paper/2102.04362/) (2021)
- [Passport-aware Normalization for Deep Model Protection](https://mlsanity.com/paper/2010.15824/) (2020)
- [Supervised GAN Watermarking for Intellectual Property Protection](https://mlsanity.com/paper/2209.03466/) (2022)

## Built on by (most cited first, 6 of 6)

- [Watermark Anything with Localized Messages](https://mlsanity.com/paper/2411.07231/) (2024)
- [Continuous fake media detection: adapting deepfake detectors to new generative techniques](https://mlsanity.com/paper/2406.08171/) (2024)
- [Lightweight Model Attribution and Detection of Synthetic Speech via Audio Residual Fingerprints](https://mlsanity.com/paper/2411.14013/) (2024)
- [IDEA: An Inverse Domain Expert Adaptation Based Active DNN IP Protection Method](https://mlsanity.com/paper/2410.00059/) (2024)
- [Of-SemWat: High-payload text embedding for semantic watermarking of AI-generated images with arbitrary size](https://mlsanity.com/paper/2509.24823/) (2025)
- [Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models](https://mlsanity.com/paper/2606.12977/) (2026)

## Abstract (arXiv)

In recent years, there has been significant growth in the commercial applications of generative models, licensed and distributed by model developers to users, who in turn use them to offer services. In this scenario, there is a need to track and identify the responsible user in the presence of a violation of the license agreement or any kind of malicious usage. Although there are methods enabling Generative Adversarial Networks (GANs) to include invisible watermarks in the images they produce, generating a model with a different watermark, referred to as a fingerprint, for each user is time- and resource-consuming due to the need to retrain the model to include the desired fingerprint. In this paper, we propose a retraining-free GAN fingerprinting method that allows model developers to easily generate model copies with the same functionality but different fingerprints. The generator is modified by inserting additional Personalized Normalization (PN) layers whose parameters (scaling and bias) are generated by two dedicated shallow networks (ParamGen Nets) taking the fingerprint as input. A watermark decoder is trained simultaneously to extract the fingerprint from the generated images. The proposed method can embed different fingerprints inside the GAN by just changing the input of the ParamGen Nets and performing a feedforward pass, without finetuning or retraining. The performance of the proposed method in terms of robustness against both model-level and image-level attacks is also superior to the state-of-the-art.