# How to Trace Latent Generative Model Generated Images without Artificial Watermark?

arXiv: https://arxiv.org/abs/2405.13360 · HTML: https://mlsanity.com/paper/2405.13360/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models.
- Builds on 51 of its 80 references that are in the map.
- First posted on arXiv 22 May 2024.

## Placed in

- Diffusion models / [Robustness, privacy and adversarial aspects](https://mlsanity.com/diffusion/robustness-privacy-and-adversarial-aspects/)

## Builds on (most cited first, 30 of 51)

- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [Denoising Diffusion Implicit Models](https://mlsanity.com/paper/2010.02502/) (2020)
- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [Neural Discrete Representation Learning](https://mlsanity.com/paper/1711.00937/) (2017)
- [LAION-5B: An open large-scale dataset for training next generation image-text models](https://mlsanity.com/paper/2210.08402/) (2022)
- [Analyzing and Improving the Image Quality of StyleGAN](https://mlsanity.com/paper/1912.04958/) (2019)
- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023)
- [DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Steps](https://mlsanity.com/paper/2206.00927/) (2022)
- [Scaling Autoregressive Models for Content-Rich Text-to-Image Generation](https://mlsanity.com/paper/2206.10789/) (2022)
- [CNN-generated images are surprisingly easy to spot... for now](https://mlsanity.com/paper/1912.11035/) (2019)
- [Latent Consistency Models: Synthesizing High-Resolution Images with Few-Step Inference](https://mlsanity.com/paper/2310.04378/) (2023)
- [Vector Quantized Diffusion Model for Text-to-Image Synthesis](https://mlsanity.com/paper/2111.14822/) (2021)
- [Extracting Training Data from Diffusion Models](https://mlsanity.com/paper/2301.13188/) (2023)
- [Vector-quantized Image Modeling with Improved VQGAN](https://mlsanity.com/paper/2110.04627/) (2021)
- [Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models](https://mlsanity.com/paper/2211.05105/) (2022)
- [Zero-shot Image-to-Image Translation](https://mlsanity.com/paper/2302.03027/) (2023)
- [Leveraging Frequency Analysis for Deep Fake Image Recognition](https://mlsanity.com/paper/2003.08685/) (2020)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [DIRE for Diffusion-Generated Image Detection](https://mlsanity.com/paper/2303.09295/) (2023)
- [Generative Visual Manipulation on the Natural Image Manifold](https://mlsanity.com/paper/1609.03552/) (2016)
- [Multi-attentional Deepfake Detection](https://mlsanity.com/paper/2103.02406/) (2021)
- [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](https://mlsanity.com/paper/2303.15435/) (2023)
- [Poisoning Web-Scale Training Datasets is Practical](https://mlsanity.com/paper/2302.10149/) (2023)
- [On the detection of synthetic images generated by diffusion models](https://mlsanity.com/paper/2211.00680/) (2022)
- [Watch your Up-Convolution: CNN Based Generative Deep Neural Networks are Failing to Reproduce Spectral Distributions](https://mlsanity.com/paper/2003.01826/) (2020)
- [StegaStamp: Invisible Hyperlinks in Physical Photographs](https://mlsanity.com/paper/1904.05343/) (2019)
- [Global Texture Enhancement for Fake Face Detection in the Wild](https://mlsanity.com/paper/2002.00133/) (2020)
- [Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data](https://mlsanity.com/paper/2007.08457/) (2020)
- [Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust](https://mlsanity.com/paper/2305.20030/) (2023)
- [MoVQ: Modulating Quantized Vectors for High-Fidelity Image Generation](https://mlsanity.com/paper/2209.09002/) (2022)

## Built on by (most cited first, 26 of 26)

- [Improving Synthetic Image Detection Towards Generalization: An Image Transformation Perspective](https://mlsanity.com/paper/2408.06741/) (2024)
- [Is Difficulty Calibration All We Need? Towards More Practical Membership Inference Attacks](https://mlsanity.com/paper/2409.00426/) (2024)
- [GaussMarker: Robust Dual-Domain Watermark for Diffusion Models](https://mlsanity.com/paper/2506.11444/) (2025)
- [HFI: A unified framework for training-free detection and implicit watermarking of latent diffusion model generated images](https://mlsanity.com/paper/2412.20704/) (2024)
- [Continuous Concepts Removal in Text-to-image Diffusion Models](https://mlsanity.com/paper/2412.00580/) (2024)
- [Multimodal Conditional Information Bottleneck for Generalizable AI-Generated Image Detection](https://mlsanity.com/paper/2505.15217/) (2025)
- [AEDR: Training-Free AI-Generated Image Attribution via Autoencoder Double-Reconstruction](https://mlsanity.com/paper/2507.18988/) (2025)
- [SPRINT: Robust Model Attribution of Generated Images via Secret Pixel Reconstruction](https://mlsanity.com/paper/2508.05691/) (2025)
- [IncreFA: Breaking the Static Wall of Generative Model Attribution](https://mlsanity.com/paper/2604.17736/) (2026)
- [Rethinking the Use of Vision Transformers for AI-Generated Image Detection](https://mlsanity.com/paper/2512.04969/) (2025)
- [Robust and Calibrated Detection of Authentic Multimedia Content](https://mlsanity.com/paper/2512.15182/) (2025)
- [Modelship Attribution: Tracing Multi-Stage Manipulations Across Generative Models](https://mlsanity.com/paper/2506.02405/) (2025)
- [Untraceable DeepFakes via Traceable Fingerprint Elimination](https://mlsanity.com/paper/2508.03067/) (2025)
- [TrueMoE: Dual-Routing Mixture of Discriminative Experts for Synthetic Image Detection](https://mlsanity.com/paper/2509.15741/) (2025)
- [PRADA: Probability-Ratio-Based Attribution and Detection of Autoregressive-Generated Images](https://mlsanity.com/paper/2511.20068/) (2025)
- [Exploiting the Final Component of Generator Architectures for AI-Generated Image Detection](https://mlsanity.com/paper/2601.20461/) (2026)
- [SWIFT: Sliding Window Reconstruction for Few-Shot Training-Free Generated Video Attribution](https://mlsanity.com/paper/2603.08536/) (2026)
- [Data Provenance for Image Auto-Regressive Generation](https://mlsanity.com/paper/2606.28386/) (2026)
- [EIB-Net: Entropy-Guided Information Bottleneck for Generalizable AI-Generated Image Detection](https://mlsanity.com/paper/2609.29064/) (2026)
- [EDITOR: Effective and Interpretable Prompt Inversion for Text-to-Image Diffusion Models](https://mlsanity.com/paper/2506.03067/) (2025)
- [Proto-LeakNet: Towards Signal-Leak Aware Attribution in Synthetic Human Face Imagery](https://mlsanity.com/paper/2511.04260/) (2025)
- [Leveraging Arbitrary Data Sources for AI-Generated Image Detection Without Sacrificing Generalization](https://mlsanity.com/paper/2603.00717/) (2026)
- [Diffusion Model Attribution via Spectral Coupling of Denoiser Responses](https://mlsanity.com/paper/2606.28092/) (2026)
- [DNA: Dual-stage Native Attribution for Generated Image Source Tracing](https://mlsanity.com/paper/2607.13685/) (2026)
- [IP Protection in the Era of Visual Generative AI: A Survey](https://mlsanity.com/paper/2608.14730/) (2026)
- [Scalable Black-Box Model Attribution for Images](https://mlsanity.com/paper/2608.15652/) (2026)

## Abstract (arXiv)

Latent generative models (e.g., Stable Diffusion) have become more and more popular, but concerns have arisen regarding potential misuse related to images generated by these models. It is, therefore, necessary to analyze the origin of images by inferring if a particular image was generated by a specific latent generative model. Most existing methods (e.g., image watermark and model fingerprinting) require extra steps during training or generation. These requirements restrict their usage on the generated images without such extra operations, and the extra required operations might compromise the quality of the generated images. In this work, we ask whether it is possible to effectively and efficiently trace the images generated by a specific latent generative model without the aforementioned requirements. To study this problem, we design a latent inversion based method called LatentTracer to trace the generated images of the inspected model by checking if the examined images can be well-reconstructed with an inverted latent input. We leverage gradient based latent inversion and identify a encoder-based initialization critical to the success of our approach. Our experiments on the state-of-the-art latent generative models, such as Stable Diffusion, show that our method can distinguish the images generated by the inspected model and other images with a high accuracy and efficiency. Our findings suggest the intriguing possibility that today's latent generative generated images are naturally watermarked by the decoder used in the source models. Code: https://github.com/ZhentingWang/LatentTracer.