# CSF: Black-box Fingerprinting via Compositional Semantics for Text-to-Image Models

arXiv: https://arxiv.org/abs/2604.16363 · HTML: https://mlsanity.com/paper/2604.16363/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Mar 2026.

## Built on by (most cited first, 1 of 1)

- [Discriminative Score Function: Turning Pretrained Models into Functional Generative Priors](https://mlsanity.com/paper/2610.19743/) (2026)

## Abstract (arXiv)

Text-to-image models are commercially valuable assets often distributed under restrictive licenses, but such licenses are enforceable only when violations can be detected. Existing methods require pre-deployment watermarking or internal model access, which are unavailable in commercial API deployments. We present Compositional Semantic Fingerprinting (CSF), the first black-box method for attributing fine-tuned text-to-image models to protected lineages using only query access. CSF treats models as semantic category generators and probes them with compositional underspecified prompts that remain rare under fine-tuning. This gives IP owners an asymmetric advantage: new prompt compositions can be generated after deployment, while attackers must anticipate and suppress a much broader space of fingerprints. Across 6 model families (FLUX, Kandinsky, SD1.5/2.1/3.0/XL) and 13 fine-tuned variants, our Bayesian attribution framework enables controlled-risk lineage decisions, with all variants satisfying the dominance criterion.