Pith. sign in

REVIEW 5 major objections 6 minor 37 references

Radioactive Watermarks in Diffusion and Autoregressive Image Generative Models

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims watermark radioactivity is achievable in image autoregressive models through a token-level green/red-list scheme, while existing latent diffusion watermarks fail to transfer through retraining.

desk verdict First solid study of watermark radioactivity for image models, with a useful negative result for latent diffusion and a promising but statistically under-verified IAR watermark. read the letter →

arxiv 2506.23731 v1 pith:SKSXZEXN submitted 2025-06-30 cs.LG cs.CV

Michel Meintz , Jan Dubiński , Franziska Boenisch , Adam Dziedzic This is my paper · ORCID
classification cs.LGcs.CV
keywords radioactivewatermarkingimageautoregressivemodelslatentdiffusiongreen-listwatermarktoken-levelprovenancetrackingmodelfine-tuningdetectionWIAR
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that watermark radioactivity — a watermark surviving when generated images are used to train a second model — is possible for image autoregressive models but not for latent diffusion models. It shows that four existing LDM watermarking schemes (Stable Signature, PRC, Tree-Ring, and Recipe) either lose the watermark in the VAE encoder or in the latent noising-denoising loop, so a fine-tuned LDM produces undetectable images. To fill the gap, it introduces WIAR, an inference-time watermark that biases an IAR's token sampling toward a green list seeded by previous tokens, and detects the watermark in suspect images by re-deriving the partition and running a z-test. In the practical setting, WIAR transfers to fine-tuned IARs at TPR around 29–38% at FPR=1%; in the extreme single-image fine-tuning setting it reaches 100%. If the claim holds, IAR model owners can trace unauthorized retraining from the successor model's outputs alone, with only a small generation-quality cost.

What carries the argument

The carrying mechanism is a token-level green/red-list watermark adapted from large-language-model watermarking to image autoregressive generation. At generation, the previous autoregressive unit's token ids are hashed to seed a pseudo-random generator, which partitions the codebook into a green list and a red list; logits of green-list tokens receive a bias δ, softly steering sampling toward green. At detection, the suspect image is re-encoded with the same image encoder, quantizer, and PRG to reconstruct the partition, and a z-statistic over the green-token count tests the null hypothesis of no watermark. Because IAR encoding and decoding are lossy — only about 65% of tokens match between generation and re-encoding in the reported RAR models — the method uses this statistical test rather than exact token matching, and it requires no access to the second model beyond its generated images.

What would settle it

Train a second IAR on WIAR-watermarked images while keeping everything identical except a slightly modified codebook or a different fixed PRG seed, and run WIAR detection on its outputs; a TPR clearly above 1% at FPR=1% would break the paper's same-tokenizer assumption. Conversely, produce any latent-diffusion watermark that survives full fine-tuning of an LDM on 40k watermarked images with detection above random guessing, and the paper's claim that LDMs are not radioactive falls.

Watch

Extended reading notes

Core claim

The central discovery is that radioactivity is governed by the representation bottleneck between generation and training. Watermarks that live in pixel space (the EDM/Recipe case) or in the token distribution of an autoregressive model (WIAR) transfer to a successor model, while watermarks that must pass through a latent diffusion model's VAE and latent-space training loop are erased. The paper shows this erasure is not a matter of watermark strength: LDM watermarks remain detectable after one VAE encode-decode pass, yet even 800 epochs of fine-tuning on a single watermarked image cannot make them radioactive in an LDM successor. For IARs, WIAR transfers across model sizes within a family (RAR-to-RAR and VAR-to-VAR), reaching 100% TPR@FPR=1% under single-image fine-tuning and 29–38% in the 40k-image, 10-epoch scenario, with FID degradation of roughly one point or less. The authors conclude that WIAR is the first radioactive watermark for high-quality image autoregressive generators, and that the latent space, not the watermarking method, is the fundamental obstacle for LDMs.

Load-bearing premise

WIAR's detection re-creates the green/red partition by hashing the encoded previous tokens, so it works only when the successor model uses the same tokenizer, codebook, fixed initial seed, and pseudo-random generator as the source model; the paper's cross-architecture tests show that a mismatch drops detection to chance.

Editorial extensions

If this is right

  • An IAR model owner can detect that a successor model was fine-tuned on watermarked outputs using only black-box access to the successor's images.
  • WIAR preserves generation quality: FID rises by roughly 0.5–1.1 points across VAR and RAR model sizes, so provenance tracking does not require sacrificing image fidelity.
  • Latent diffusion watermarking for radioactivity needs a different strategy, since the VAE and latent training loop erase image-space and latent-space watermarks alike.
  • Within a tokenizer family, WIAR transfers across model sizes (e.g., RAR-B to RAR-XXL and VAR-16 to VAR-30), so a watermark embedded by a small source model can be detected in much larger successor models.
  • The 100% transfer under single-image, 800-epoch fine-tuning implies that even a very small amount of contaminated training data can leave a detectable radioactive trace.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the authors leave implicit is that the same-tokenizer requirement defines the practical boundary of WIAR: detection should collapse if the successor model retrains or replaces its VQ tokenizer, so the watermark protects model families, not the underlying visual concepts.
  • A testable extension would tighten the practical regime: because the 29–38% detection comes from roughly 65% token overlap, a future variant that reduces token mismatch during decoding (or uses multiple re-encoding hypotheses) could push the 10-epoch detection rate well above the reported range.
  • The architecture-dependence result suggests a broader principle: radioactivity is determined by whether the watermark's representation survives the training bottleneck, so the same green/red-list idea could transfer to other discrete-token generative domains, such as video or 3D generation, where tokenization plays a similar role.
  • A practical caution not explored in the paper: detection re-derives partitions from the encoded image, so edits that change token ids — cropping, resampling, or recoloring — are likely to degrade detection; the reported robustness numbers cover specific attacks and should not be read as universal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper studies watermark radioactivity in image generative models: whether a watermark embedded in images generated by a source model M1 remains detectable in images generated by a target model M2 trained on M1's outputs. It evaluates five watermarking methods across three model families: pixel-space EDMs, latent diffusion models (LDMs), and image autoregressive models (IARs). The authors report that existing LDM watermarking methods (Stable Signature, PRC, Tree-Ring, and the data-level Recipe method) are not radioactive: watermarks are erased either by the VAE encoding or by the noising-denoising process in latent space, except for Tree-Ring which transfers to pixel-space EDMs. They then propose WIAR, a training-free watermark for IARs that biases token sampling toward a green list derived from hashing previous tokens, and report that WIAR watermarks transfer to subsequently fine-tuned IARs of the same tokenizer and architecture family (TPR 29--38% at nominal FPR=1% after 10-epoch fine-tuning on 40k images, and TPR 100% after 800-epoch single-image fine-tuning). The paper also provides ablations on token overlap, image quality (FID), robustness to post-processing attacks, and cross-architecture transfer failures.

Significance. If the empirical claims hold, this is a useful contribution: it is, to my knowledge, the first systematic study of watermark radioactivity in visual generative models, and it identifies latent-space diffusion as a key failure point. The WIAR method is simple, training-free at M1, and builds on a well-understood LLM watermarking framework. The negative results for LDMs are informative and could guide future watermark design. The positive result for IARs, however, is only established for the restricted same-tokenizer, same-seed fine-tuning setting, and the reported TPR numbers currently rest on an uncalibrated statistical test; the significance of the paper's central radioactivity claim therefore depends directly on whether the detection threshold can be calibrated to a genuine 1% FPR on M2 outputs.

major comments (5)
  1. [Section 5.1 vs. Eq. (2)] The detection rule stated in Section 5.1 is inverted relative to Eq. (2). Eq. (2) and the accompanying text in Section 3.2 define the z-statistic and state that H0 is rejected (watermark detected) for z > τ. Section 5.1 then says 'z-values below this threshold indicate a clear detection of the watermark in the outputs from M1 or strong radioactivity in the outputs from M2' and 'when the z-value is above the threshold τ then the test is inconclusive'. These two statements are mutually contradictory. The authors must correct the Section 5.1 description to match the detection rule in Eq. (2), or explain what rule was actually used to produce Tables 1 and 2.
  2. [Section 5.1, Tables 1 and 2] The paper reports TPR@FPR=1% for all results, but the detector uses a fixed threshold τ=4, which under the normal approximation used in Eq. (2) corresponds to a one-sided FPR of about 3×10^-5, not 1%. No empirical null distribution on non-watermarked M2 outputs is reported, and the paper does not describe any threshold-sweeping procedure to set FPR=1%. Consequently, the TPR values in Table 1 (e.g., 29--38%) cannot be interpreted as TPR at 1% FPR. The authors should either (i) sweep τ on a set of unwatermarked M2 images to achieve FPR=1% and report the corresponding TPR, or (ii) report TPR at the fixed τ=4 together with the empirically measured FPR, ideally with confidence intervals.
  3. [Section 3.2, Eq. (2), and Algorithm 2] The null model underlying the z-statistic assumes that the color of each token (green or red) is an independent Bernoulli(γ) trial. This assumption is not justified for IAR outputs: the green/red partition is derived by hashing the previous token (Algorithm 2, lines 8--10), IAR token streams are strongly structured, and detection operates on re-encoded tokens that match the originally generated tokens only about 65% of the time (Figure 5b). All of these factors change the effective null distribution. The paper reports no empirical null calibration on unwatermarked M2 images, so the claimed FPR control is unverified. I recommend that the authors measure the z-score distribution on non-watermarked M2 outputs and report the achieved FPR at the chosen threshold.
  4. [Section 4 threat model and Section 5.2, Table 8] The stated threat model assumes black-box access to M2 'without any knowledge of its architecture, logits, or other internal states'. However, WIAR detection requires the exact same VQ tokenizer/codebook, the same initial seed, and the same PRG as M1. The paper's own cross-architecture results (Table 8: RAR-B→VAR-d16 and VAR-d16→RAR-B both give TPR=1%) show that a tokenizer mismatch makes the watermark undetectable. The radioactivity claim is therefore limited to M2 models that reuse the M1 tokenizer and generation randomness. This is a significant restriction of the claimed 'robust provenance tracking', and the paper should state it prominently in the threat model and abstract rather than only in an appendix table.
  5. [Tables 1, 2, and 4] All reported radioactivity results appear to be single runs without error bars, confidence intervals, or repeated-seed variability. The differences between model sizes (e.g., VAR-d16 36.1 vs VAR-d30 38.1; RAR-B 33 vs RAR-XXL 29) are small, and without any measure of variance it is not possible to assess whether these differences are meaningful or whether the positive radioactivity claim is stable across runs. The authors should provide standard errors or bootstrap confidence intervals for at least the main TPR values in Table 1 and for the key ablation in Table 4.
minor comments (6)
  1. [Section 5.2] There is a duplicated word in the sentence 'we we fine-tune LDMs on a single watermarked instance over 800 epochs'.
  2. [Figure 4] The vertical axis label 'TPR@1%FPR' is not defined in the caption; please expand the abbreviation at first use in the caption.
  3. [Section 3.2] In the discussion preceding Eq. (2), the notation for the variance of Y is introduced as 'V ar[X] = γ(1 − γ)T' where the X should be Y; this is a typo, though Eq. (2) itself is correct.
  4. [Appendix D, Table 7] The row 'V AE 30 V AR 16' appears to be a typo for 'V AR-d30 V AR-d16'.
  5. [Section 5.1] The paper uses 'TPR@FPR=1%' without defining how the threshold is chosen; even aside from the calibration issue, the metric should be defined as a threshold-swept operating point.
  6. [Abstract and Section 1] The claim that existing watermarking approaches for LDMs 'fail to retain radioactivity' is supported only for the specific methods tested (Recipe, Stable Signature, PRC, Tree-Ring); the wording should be softened to 'the tested watermarking approaches' to avoid overgeneralization.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: WIAR is an explicit empirical adaptation of Kirchenbauer et al.'s LLM watermark to image autoregressive models, and the radioactivity transfer claim is measured on M2 outputs against external benchmarks rather than derived from the watermark parameters.

full rationale

I walked the claimed derivation chain and found no step where a 'prediction' is equivalent to its inputs by construction or where the load-bearing argument reduces to a self-citation. WIAR is explicitly presented as drawing on the LLM watermarking method of Kirchenbauer et al. [13] and on the IAR formulation of Tian et al. [29]; neither citation is from the present authors, so there is no self-citation chain. The embedder (Algorithm 1) and detector (Algorithm 2) do share the same seed, PRG, hash function, green-list ratio gamma, and threshold logic, but that is a normal property of symmetric watermarking schemes and not circular: the central radioactivity claim is that the watermark installed in M1's outputs remains detectable in M2's outputs after fine-tuning. That claim is tested empirically (Tables 1, 2, 8) on images produced by M2 and compared with random-guessing baselines, with FID quality checks; the transfer numbers are not fitted or algebraically forced by the watermark parameters. The hyperparameters delta and gamma are chosen per architecture (Appendix C: delta=2 for RAR, delta=6 for VAR, gamma=0.25), but they are not fitted to M2's outputs and do not predetermine the 29-38% TPR values in Table 1. The paper also reports a genuine limitation: WIAR does not transfer across tokenizers/architectures (Table 8), which weakens the threat-model generality but is not a circularity. I note, as a correctness rather than circularity concern, that Section 5.1 inverts the direction of the z-test relative to Eq. (2): Eq. (2) says to reject the null for z > tau, while Section 5.1 says z-values below tau indicate detection and values above tau are inconclusive. Additionally, the paper reports TPR@FPR=1% while setting tau=4, which under a normal null corresponds to a false-positive probability of about 3e-5 rather than 1%, and no empirical null calibration on M2 outputs is provided. These issues affect whether the reported operating point is meaningful, but they do not make the radioactivity result a restatement of the method's inputs. Overall, the central derivation is self-contained and empirical, so the circularity score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method depends on hand-chosen watermarking constants (gamma, delta, tau) and on several unproven statistical and operational premises: token colors are treated as independent Bernoulli variables, re-encoding preserves enough token ids, and the suspect model's tokenizer matches the embedder's. The paper tests these empirically but does not provide code, error bars, or a derivation of the null distribution under the actual hash-dependent process.

free parameters (3)
  • gamma = 0.25
    Green-list fraction gamma=0.25 for all reported IAR experiments; it trades watermark strength against generation quality and influences every TPR and FID number.
  • delta = 2.0 for RAR, 6.0 for VAR
    Logit bias added to green-list tokens, chosen per architecture by hand; Table 9 shows both TPR and FID rise with delta, so the radioactivity results are conditional on these values.
  • tau = 4
    z-score detection threshold adopted from LLM watermarking [13]; it fixes the claimed FPR of about 3e-5, but that value relies on an unverified independence assumption.
assumptions (4)
  • domain assumption Token colors are independent Bernoulli(gamma) under the null hypothesis
    Equation (2) and the z-test use variance gamma(1-gamma)T and a normal approximation; because the partition at step i is hash(ui-1), colors are autocorrelated, so the null distribution is not the stated binomial and the claimed FPR is not derived.
  • domain assumption Encode-decode token stability
    Detection requires re-encoding a generated image to recover a large fraction of the generating token ids; the paper measures only about 65% overlap for RAR and scale-dependent overlap for VAR (Figure 5), so the statistical test is applied on a noisy proxy.
  • domain assumption M1 and M2 share the same image tokenizer and watermark key
    Algorithms 1 and 2 use the same codebook V, PRG, initial seed, and hash; cross-architecture results in Table 8 show that transfer fails when this premise is violated.
  • domain assumption Detector has access to M1's encoder and quantizer
    Algorithm 2 requires E, Q, and PRG from the watermarking setup; this is consistent with the threat model but restricts deployment and is not stated as a limitation in the main text.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Radioactive Watermarks in Diffusion and Autoregressive Image Generative Models." pith.science (2026). https://pith.science/paper/SKSXZEXN

@misc{pith2026250623731,
  author       = {Pith},
  title        = {Pith review of: Radioactive Watermarks in Diffusion and Autoregressive Image Generative Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SKSXZEXN}},
  note         = {Machine review of arXiv:2506.23731}
}
read the original abstract

Image generative models have become increasingly popular, but training them requires large datasets that are costly to collect and curate. To circumvent these costs, some parties may exploit existing models by using the generated images as training data for their own models. In general, watermarking is a valuable tool for detecting unauthorized use of generated images. However, when these images are used to train a new model, watermarking can only enable detection if the watermark persists through training and remains identifiable in the outputs of the newly trained model - a property known as radioactivity. We analyze the radioactivity of watermarks in images generated by diffusion models (DMs) and image autoregressive models (IARs). We find that existing watermarking methods for DMs fail to retain radioactivity, as watermarks are either erased during encoding into the latent space or lost in the noising-denoising process (during the training in the latent space). Meanwhile, despite IARs having recently surpassed DMs in image generation quality and efficiency, no radioactive watermarking methods have been proposed for them. To overcome this limitation, we propose the first watermarking method tailored for IARs and with radioactivity in mind - drawing inspiration from techniques in large language models (LLMs), which share IARs' autoregressive paradigm. Our extensive experimental evaluation highlights our method's effectiveness in preserving radioactivity within IARs, enabling robust provenance tracking, and preventing unauthorized use of their generated images.

Figures

Figures reproduced from arXiv: 2506.23731 by the authors.

Figure 1
Figure 1. Radioactivity in the image generative models. An image generative model M1 is trained on data X0 and watermarked. Model M1 generates watermarked images X1, which are used to train another image generative model M2. Our goal is to determine whether the watermark signal persists in the images X2 generated by model M2—a property called watermark radioactivity. space DMs are typically trained on low resolutions (e.g. 32… view at source ↗
Figure 2
Figure 2. The LDM autoencoder acts as a filter for the Recipe data-level watermark. Left: original watermarked image with 100% watermark detection, Middle: difference × 2, Right: im￾age after en-decoding by the SD2.1 autoencoder structure with TPR=1%@FPR=1%, i.e., random guessing (meaning that no wa￾termark is detected). LDMs on a single watermarked instance over 800 epochs to force watermark transfer [PITH_FULL_IMAGE:figure… view at source ↗
Figure 4
Figure 4. Down-sampling removes all the watermarks apart from Tree-Ring that transfers to EDMs. We analyze the strength of the different watermarks under strong resizing. We observe that only Tree-Ring, which, in contrast to other methods, does not operate in the image but in the frequency space, is re￾silient to the down-sampling in the pixel space. We use the Gus￾tavosta Stable Diffusion Prompts, usually used to evaluate im… view at source ↗
Figures from the paper (4 more)
Figure 3
Figure 3. Figure 3: The watermarks for LDMs are not radioactive. We present a qualitative comparison between the outputs from M1 (first column with cases a, c, e, and g) and M2 (second column with cases b, d, f, and h). The first row (a & b) is for Tree-Ring (transfer from LDM to LDM). Th…
Figure 5
Figure 5. Figure 5: Token overlap between generated vs encoded images for VAR-d30 and RAR. Tokens from decoding during the image generation differ from tokens obtained during image encoding. RAR-B with the Tree-Ring watermark, we find that the to￾kenizer in IAR models acts as a filter aga…
Figure 6
Figure 6. Figure 6: Comparison of the outputs from DM M1 vs DM M2 for the DIAGNOSIS protection method. C. Experimental details The EDM model is trained unconditionally for 200 epochs with a mini-batch of size 512 with other hyperparameters following [36]. In our experiments for LDMs, we p…
Figure 7
Figure 7. Figure 7: Comparison of the token overlap at the different scales (resolutions) and for different depths (16, 20, 24, and 36) of the VAR model. 13 [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 31 canonical work pages

  1. [1]

    Eth- ical considerations for responsible data curation

    Jerone Andrews, Dora Zhao, William Thong, Apostolos Modas, Orestis Papakyriakopoulos, and Alice Xiang. Eth- ical considerations for responsible data curation. In Thirty- seventh Conference on Neural Information Processing Sys- tems Datasets and Benchmarks Track, 2023. 1

    work page 2023

  2. [2]

    The brittleness of ai- generated image watermarking techniques: Examining their robustness against visual paraphrasing attacks, 2024

    Niyar R Barman, Krish Sharma, Ashhar Aziz, Shashwat Ba- jpai, Shwetangshu Biswas, Vasu Sharma, Vinija Jain, Aman Chadha, Amit Sheth, and Amitava Das. The brittleness of ai- generated image watermarking techniques: Examining their robustness against visual paraphrasing attacks, 2024. 8

    work page 2024

  3. [3]

    Generative pre- training from pixels

    Mark Chen, Alec Radford, Rewon Child, Jeffrey Wu, Hee- woo Jun, David Luan, and Ilya Sutskever. Generative pre- training from pixels. In Proceedings of the 37th Interna- tional Conference on Machine Learning , pages 1691–1703. PMLR, 2020. 2

    work page 2020

  4. [4]

    Pseudorandom error- correcting codes

    Miranda Christ and Sam Gunn. Pseudorandom error- correcting codes. arXiv preprint arXiv:2402.09370 , 2024. 3

    arXiv 2024

  5. [5]

    Undetectable watermarks for language models

    Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In Proceedings of Thirty Seventh Conference on Learning Theory, pages 1125–1139. PMLR, 2024. 3

    work page 2024

  6. [6]

    Taming transformers for high-resolution image synthesis

    Patrick Esser, Robin Rombach, and Bjorn Ommer. Taming transformers for high-resolution image synthesis. In Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12873–12883, 2021. 2

    2021

  7. [7]

    The stable signature: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Herv ´e J ´egou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceed- ings of the IEEE/CVF International Conference on Com- puter Vision (ICCV), pages 22466–22477, 2023. 1, 3, 6

    work page 2023

  8. [8]

    An un- detectable watermark for generative image models

    Sam Gunn, Xuandong Zhao, and Dawn Song. An un- detectable watermark for generative image models. arXiv preprint arXiv:2410.07369, 2024. 1, 3, 6

    arXiv 2024

Show all 37 references
  1. [9]

    GANs trained by a two time-scale update rule converge to a local nash equilib- rium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. GANs trained by a two time-scale update rule converge to a local nash equilib- rium. Advances in Neural Information Processing Systems ,

  2. [10]

    Denoising diffu- sion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffu- sion probabilistic models. Advances in Neural Information Processing Systems, 2020. 1, 2

    2020

  3. [11]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models, 2021. 11

    2021

  4. [12]

    Elucidating the design space of diffusion-based generative models

    Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. In Advances in Neural Information Processing Sys- tems, 2022. 2, 6

    2022

  5. [13]

    A watermark for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061–17084. PMLR, 2023. 2, 3, 4, 5, 6

    2023

  6. [14]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009. 6

    2009

  7. [15]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. Eu- ropean conference on computer vision (ECCV) , pages 740– 755, 2014. 6, 12

    2014

  8. [16]

    Image watermarks are re- movable using controllable regeneration from clean noise

    Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks are re- movable using controllable regeneration from clean noise. In The Thirteenth International Conference on Learning Repre- sentations, 2025. 7, 9

    2025

  9. [17]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In 2015 IEEE In- ternational Conference on Computer Vision (ICCV) , pages 3730–3738, 2015. 11

    2015

  10. [18]

    Wanet - impercepti- ble warping-based backdoor attack

    Tuan Anh Nguyen and Anh Tuan Tran. Wanet - impercepti- ble warping-based backdoor attack. In International Confer- ence on Learning Representations, 2021. 11, 12

    2021

  11. [19]

    Con- ditional image generation with pixelcnn decoders

    A ¨aron van den Oord, Nal Kalchbrenner, Oriol Vinyals, Lasse Espeholt, Alex Graves, and Koray Kavukcuoglu. Con- ditional image generation with pixelcnn decoders. page 4797–4805, Red Hook, NY , USA, 2016. Curran Associates Inc. 2

    2016

  12. [20]

    Dinov2: Learning robust visual features without supervision

    Maxime Oquab, Timoth ´ee Darcet, Th ´eo Moutakanni, Huy V o, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, et al. Dinov2: Learning robust visual features without supervision. arXiv preprint arXiv:2304.07193, 2023. 1

    2023 arXiv

  13. [21]

    Learn- ing transferable visual models from natural language super- vision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learn- ing transferable visual models from natural language super- vision. In International Conference on Machine Learning ,

  14. [22]

    High-resolution image syn- thesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image syn- thesis with latent diffusion models. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022. 1, 2, 3, 6, 12

    2022

  15. [23]

    Radioactive data: tracing through training

    Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Herv´e J´egou. Radioactive data: tracing through training. In International Conference on Machine Learning , pages 8326–8335. PMLR, 2020. 1

    2020

  16. [24]

    Watermarking makes lan- guage models radioactive

    Tom Sander, Pierre Fernandez, Alain Oliviero Durmus, Matthijs Douze, and Teddy Furon. Watermarking makes lan- guage models radioactive. In The Thirty-eighth Annual Con- ference on Neural Information Processing Systems, 2024. 1

    2024

  17. [25]

    Fake it till you make it: Learning transfer- able representations from synthetic imagenet clones

    Mert B ¨ulent Sarıyıldız, Karteek Alahari, Diane Larlus, and Yannis Kalantidis. Fake it till you make it: Learning transfer- able representations from synthetic imagenet clones. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), page...

    2023

  18. [26]

    Laion-5b: An open large-scale dataset for training 10 next generation image-text models

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Worts- man, et al. Laion-5b: An open large-scale dataset for training 10 next generation image-text models. Advances in neural in...

    2022

  19. [27]

    Ai models collapse when trained on recursively generated data

    Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao, Nicolas Pa- pernot, Ross Anderson, and Yarin Gal. Ai models collapse when trained on recursively generated data. Nature, 631 (8022):755–759, 2024. 1

    2024

  20. [28]

    Improved techniques for training score-based generative models

    Yang Song and Stefano Ermon. Improved techniques for training score-based generative models. In Advances in Neu- ral Information Processing Systems, 2020. 1, 2

    2020

  21. [29]

    Visual autoregressive modeling: Scalable im- age generation via next-scale prediction

    Keyu Tian, Yi Jiang, Zehuan Yuan, BINGYUE PENG, and Liwei Wang. Visual autoregressive modeling: Scalable im- age generation via next-scale prediction. In The Thirty- eighth Annual Conference on Neural Information Processing Systems, 2024. 1, 2, 3, 6, 12

    2024

  22. [30]

    Stablerep: Synthetic images from text-to- image models make strong visual representation learners

    Yonglong Tian, Lijie Fan, Phillip Isola, Huiwen Chang, and Dilip Krishnan. Stablerep: Synthetic images from text-to- image models make strong visual representation learners. In Thirty-seventh Conference on Neural Information Process- ing Systems, 2023. 1

    2023

  23. [31]

    Metaxas, and Shiqing Ma

    Zhenting Wang, Chen Chen, Lingjuan Lyu, Dimitris N. Metaxas, and Shiqing Ma. DIAGNOSIS: Detecting unautho- rized data usages in text-to-image diffusion models. In The Twelfth International Conference on Learning Representa- tions, 2024. 11

    2024

  24. [32]

    Tree-rings watermarks: Invisible fingerprints for diffusion images

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In Advances in Neural Information Pro- cessing Systems , pages 58047–58063. Curran Associates, Inc., 2023. 1, 3, 6

    2023

  25. [33]

    Gaus- sian shading: A new perspective for watermarking diffusion models

    Zhiwei Yang, Mengnan Du, Zhiwei Jin, and Xia Hu. Gaus- sian shading: A new perspective for watermarking diffusion models. arXiv preprint arXiv:2401.05678, 2024. 1

    2024 arXiv

  26. [34]

    Vector-quantized image modeling with im- proved VQGAN

    Jiahui Yu, Xin Li, Jing Yu Koh, Han Zhang, Ruoming Pang, James Qin, Alexander Ku, Yuanzhong Xu, Jason Baldridge, and Yonghui Wu. Vector-quantized image modeling with im- proved VQGAN. In International Conference on Learning Representations, 2022. 2

    2022

  27. [35]

    Randomized autoregressive visual generation

    Qihang Yu, Ju He, Xueqing Deng, Xiaohui Shen, and Liang- Chieh Chen. Randomized autoregressive visual generation

  28. [36]

    A recipe for watermarking dif- fusion models, 2023

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai- Man Cheung, and Min Lin. A recipe for watermarking dif- fusion models, 2023. 3, 6, 12 A. Additional Related Work A.1. Image Autoregressive Models (IARs) RARs (Randomized Autoregressive Models) [35] randomly order the tokens ...

    2023

  29. [37]

    of the V AR model. 13

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.