ICCV 2025

DiffIP: Representation Fingerprints for Robust IP Protection of Diffusion Models

Zhuoling Li1· Haoxuan Qu1· Jason Kuen2· Jiuxiang Gu2· Qiuhong Ke3· Jun Liu1*· Hossein Rahmani1
1Lancaster University 2Adobe Research 3Monash University * Corresponding author

Dynamic fingerprint sequence alignment

Dynamic programming alignment between suspect and victim fingerprint sequences.
Figure 1. Dynamic programming-based fingerprint sequence comparison. DiffIP constructs a cost matrix and finds the minimum-cost monotone path between potentially mismatched suspect and victim denoising sequences.

Abstract

Intellectual property protection for diffusion models requires a reliable way to compare unique identifiers between suspect and victim models. Existing approaches often inject an external watermark, which must be added before release and may introduce retraining cost. DiffIP instead uses internal feature representations as intrinsic fingerprints. It reverts shifts in suspect representations and aligns their denoising trajectories with those of the victim model, enabling fingerprint comparison without modifying the protected model.

Method

DiffIP treats the denoising process as a sequence of stochastic feature distributions and compares two models in three stages.

  1. Collect fingerprint sequences. Run the suspect and victim models with the same prompt and random seeds, then collect their internal feature representations at each denoising step.
  2. Revert representation shifts. Estimate orthogonal, per-dimension scaling, and translation transformations that approximately return the suspect features to the victim representation state.
  3. Align denoising trajectories. Use dynamic programming to find a minimum-cost monotone alignment between fingerprint sequences, including sequences with different denoising schedules.

Main Results

Experiments use Stable Diffusion 1.5 and FLUX-dev.1 as victim models. Each fingerprint score averages 200 prompts, with 20 random seeds sampled per prompt.

Tables 1-2. Mean similarity from the reported DiffIP rows for derived and unrelated diffusion models.
Victim model Derived models ↑ Unrelated models ↓
SD 1.5 0.9585 0.0789
FLUX-dev.1 0.9344 0.0827
Overall average 0.9464 0.0807
Table 3. Comparison with external-watermark methods. FPR is fixed at 10−6 for TPR evaluation; SD 1.5 is the victim model.
Method FID ↓ Robustness to fine-tuning — TPR ↑
No fine-tuning 40 steps 1,000 steps 10,000 steps
Stable Signature 24.77 0.9930 0.7735 0.0471 0.0094
AquaLoRA 24.88 0.9900 0.0491 0.0000 0.0000
DiffIP 24.26 0.9591 0.9327 0.9259 0.9186

Citation

@inproceedings{li2025diffip,
  title     = {DiffIP: Representation Fingerprints for Robust IP Protection of Diffusion Models},
  author    = {Li, Zhuoling and Qu, Haoxuan and Kuen, Jason and Gu, Jiuxiang and Ke, Qiuhong and Liu, Jun and Rahmani, Hossein},
  booktitle = {Proceedings of the IEEE/CVF International Conference on Computer Vision},
  pages     = {17035--17045},
  year      = {2025},
  doi       = {10.1109/ICCV51701.2025.01582}
}