mlsanityData to 7 Oct 2026

Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothing

arXiv 2605.29809 ↗First posted 28 May 2026cs.CR cs.CV cs.GRcited by 3

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Large-scale text-to-image (T2I) diffusion models have enabled unprecedented creative applications, but their unauthorized use has raised serious intellectual property concerns, making model ownership verification (MOV) increasingly critical. We find that existing backdoor-based diffusion watermarking methods often (implicitly) assume a "faithful" verification process, namely, that the verifier can query a suspicious model and obtain the faithful watermark response to complete MOV. However, in practice, adversaries may intentionally or unintentionally damage potential watermark signals, significantly degrading verification reliability. To address this issue, we propose Cert-LAS, the first certified MOV method for T2I models based on layer-adaptive smoothing. In general, Cert-LAS embeds specified watermarks using diffusion classifiers and an LFS-guided layer-adaptive noise, and verifies ownership by examining whether the suspected model exhibits significantly stronger watermark responses compared to unwatermarked references through hypothesis testing. We further prove that, under certain conditions, our Cert-LAS can still achieve reliable verification even in the presence of malicious removal attacks. Extensive experiments validate the effectiveness of Cert-LAS and its resistance to adaptive attacks. Our code is available at https://github.com/Leyi-Qi/Cert-LAS.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 74 of its 99 references that are in the map. First posted on arXiv 28 May 2026.

Builds on

74 of 99 references.

Closest ancestors · 14

Same direction, newest first

  1. 2025Towards Dataset Copyright Evasion Attack against Personalized Text-to-Image Diffusion Models5 May
  2. 2024SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models6 Dec
  3. 2024CDI: Copyrighted Data Identification in Diffusion Models19 Nov
  4. 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Models14 Oct
  5. 2024Safe-SD: Safe and Traceable Stable Diffusion with Text Prompt Trigger for Invisible Generative Watermarking18 Jul
  6. 2024AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA18 May
  7. 2024DiffuseTrace: A Transparent and Flexible Watermarking Scheme for Latent Diffusion Model4 May
  8. 2024Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models7 Apr
  9. 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust31 May
  10. 2023Robust Classification via a Single Diffusion Model24 May
  11. 2023Watermarking Diffusion Model21 May
  12. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models18 May
2 more
  1. 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar
  2. 2023A Recipe for Watermarking Diffusion Models17 Mar

Other references · 60

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  4. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  6. 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,290
  7. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
  8. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  9. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
  10. 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,286
  11. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  12. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
38 more
  1. 2022Multi-Concept Customization of Text-to-Image Diffusioncited by 1,099
  2. 2023Analyzing and Improving the Training Dynamics of Diffusion Modelscited by 396
  3. 2024SANA: Efficient High-Resolution Image Synthesis with Linear Diffusion Transformerscited by 331
  4. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  5. 2023DreamSim: Learning New Dimensions of Human Visual Similarity using Synthetic Datacited by 322
  6. 2023Your Diffusion Model is Secretly a Zero-Shot Classifiercited by 301
  7. 2023P+: Extended Textual Conditioning in Text-to-Image Generationcited by 242
  8. 2023Text-to-Image Diffusion Models are Zero-Shot Classifierscited by 140
  9. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  10. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
  11. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
  12. 2024Distilling Diffusion Models into Conditional GANscited by 78
  13. 2022The ArtBench Dataset: Benchmarking Generative Models with Artworkscited by 64
  14. 2024IMPRINT: Generative Object Compositing by Learning Identity-Preserving Representationcited by 64
  15. 2025Diffusion-4K: Ultra-High-Resolution Image Synthesis with Latent Diffusion Modelscited by 61
  16. 2024LLMmap: Fingerprinting For Large Language Modelscited by 56
  17. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shiftcited by 45
  18. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 39
  19. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
  20. 2025DesignDiffusion: High-Quality Text-to-Design Image Generation with Diffusion Modelscited by 37
  21. 2020Certifying Confidence via Randomized Smoothingcited by 36
  22. 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attributioncited by 35
  23. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 34
  24. 2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31
  25. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  26. 2023ScaleLong: Towards More Stable Training of Diffusion Model via Scaling Network Long Skip Connectioncited by 25
  27. 2025TorchAO: PyTorch-Native Training-to-Serving Model Optimizationcited by 25
  28. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 20
  29. 2023Separate-and-Enhance: Compositional Finetuning for Text2Image Diffusion Modelscited by 19
  30. 2025OBS-Diff: Accurate Pruning For Diffusion Models in One-Shotcited by 19
  31. 2023Aegis: Mitigating Targeted Bit-flip Attacks against Deep Neural Networkscited by 17
  32. 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Eracited by 17
  33. 2025Dense2MoE: Restructuring Diffusion Transformer to MoE for Efficient Text-to-Image Generationcited by 16
  34. 2025SoK: Large Language Model Copyright Auditing via Fingerprintingcited by 14
  35. 2023Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attackscited by 10
  36. 2023Towards Robust Model Watermark via Reducing Parametric Vulnerabilitycited by 10
  37. 2024Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defencescited by 9
  38. 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspectivecited by 8

50 most cited of 60 All 60 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecyclecited by 0
  2. 2026Trustworthy synthetic visual media: Evidence across the media lifecyclecited by 0
  3. 2026Persistent Watermarking of Text-to-Image Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025SWA-LDM: Toward Stealthy Watermarks for Latent Diffusion Models
  2. 2024Embedding Watermarks in Diffusion Process for Model Intellectual Property Protection
  3. 2025Secure and Efficient Watermarking for Latent Diffusion Models in Model Distribution Scenarios
  4. 2025Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models
  5. 2024CLUE-MARK: Watermarking Diffusion Models using CLWE
  6. 2024Exploiting Watermark-Based Defense Mechanisms in Text-to-Image Diffusion Models for Unauthorized Data Usage
  7. 2025TraceMark-LDM: Authenticatable Watermarking for Latent Diffusion Models via Binary-Guided Rearrangement
  8. 2025Your Text Encoder Can Be An Object-Level Watermarking Controller