SpectralCanary: Embarrassingly Simple Low-Frequency Traces for T2I Dataset-Use Auditing

Sy-Tuyen Ho ,

Anirudh Satheesh ,

Soham Chawathe ,

Huy Nghiem ,

Yongkyun Lee ,

Andrew Adams Schoen ,

Furong Huang

GenAI TDIG AI Safety / AI Ethics DWAT RA

2026年10月22日

对文生图（T2I）模型是否在特定图像集合上进行过微调开展审计，难度较大：模型可能吸收整个数据集层面的视觉特征，却并不直接复现训练图像。主动式数据集使用审计（proactive dataset-use auditing）则是在数据集发布前，预先向其中所有图像嵌入一个共享的可检测信号；待后续审计时，再检查可疑模型所生成的图像中是否含有该信号。现有方法往往难以兼顾可验证性、保真度、鲁棒性与实际部署可行性。本文提出 **SpectralCanary** 方法：它采用平滑的低通滤波掩模，将一幅固定的“金丝雀图像”（canary image）无缝融合至数据集中的每一张图像之中，同时保持原始文本描述（caption）完全不变，且无需额外的辅助生成过程，也无需对每张图像单独优化。其配套的轻量级验证器（verifier）可高效检测可疑模型输出中是否成功继承了该嵌入信号。在基于宝可梦（Pokemon）数据集开展的八组测试，以及涵盖两类主流模型架构、三种真实场景数据变换（如压缩、裁剪、色彩调整等）的综合评估中，SpectralCanary 在各项方法中取得了最高的平均单图检测性能——即在1%假阳性率（FPR）约束下的真阳性率（TPR@1% FPR），达91.1%；同时，在仅需30次生成样本的前提下，其模型级判别准确率（采用固定阈值）亦达94.8%，同样位居榜首。进一步地，在涵盖艺术、医学、卫星遥感和时尚四大领域的五个不同数据集上，结合SD3.5模型进行测试，SpectralCanary 的平均单图检测性能（TPR@1% FPR）仍高达92.4%；与此同时，其对原始发布图像的视觉保真度极佳：结构相似度（SSIM）达0.989，感知图像块相似度（LPIPS）仅为0.022，且弗雷歇起始距离（FID）的均值变化（mean ΔFID）趋近于零，仅为0.05。在宝可梦与ROCOv2数据集上开展的等能量消融实验（matched-energy ablations）进一步验证了我们的设计选择：相比中频或高频嵌入，将信号置于低频区域能更稳定、更可靠地实现跨模型传递。在所评估的各类自适应攻击下，最有效的信号清除手段需采取激进的图像修改策略，但由此引发的FID恶化幅度超过25个单位（ΔFID > 25）。综上，本研究结果表明：低频视觉信号是承载面向数据集层级的文生图模型审计痕迹（audit trace）的一种高效且稳健的载体。

Auditing whether a text-to-image (T2I) model was fine-tuned on a particular image collection is difficult: a model can absorb collection-level visual characteristics without reproducing training images. Proactive dataset-use auditing plants a shared signal in a dataset before release, then later checks whether that signal appears in a suspect model's generated outputs. Existing approaches often trade off verifiability, fidelity, robustness, and deployability. We introduce $\textbf{SpectralCanary}$, which uses a smooth low-pass mask to blend a fixed canary image into every collection image while leaving captions unchanged and requiring neither auxiliary generation nor per-image optimization. A lightweight verifier detects the transferred signal in suspect-model outputs. Across eight tests on the Pokemon dataset and three realistic data transformations, spanning two architectures families, SpectralCanary achieves the highest average per-generation TPR@$1\%$ FPR ($91.1\%$) and fixed threshold model-level accuracy using 30 generations ($94.8\%$) among the evaluated methods. Across five datasets spanning artistic, medical, satellite, and fashion domains with SD3.5, SpectralCanary averages $92.4\%$ per-generation TPR@$1\%$ FPR while preserving the released images (SSIM $0.989$, LPIPS $0.022$) with a near-zero mean change FID (mean $Δ$FID $0.05$) across datasets. Matched-energy ablations on Pokemon and ROCOv2 support our design choice, low-frequency placement transfers more reliably compared to mid/high-frequency placement. Under the evaluated adaptive attacks, the most effective removal requires aggressive modification and incurs more than $25$ $Δ$FID points. These results identify low-frequency visual signals as effective carriers for collection-level T2I audit traces.

许愿