Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothing

Large-scale text-to-image (T2I) diffusion models have enabled unprecedented creative applications, but their unauthorized use has raised serious intellectual property concerns, making model ownership verification (MOV) increasingly critical. We find that existing backdoor-based diffusion watermarking methods often (implicitly) assume a "faithful" verification process, namely, that the verifier can query a suspicious model and obtain the faithful watermark response to complete MOV. However, in practice, adversaries may intentionally or unintentionally damage potential watermark signals, significantly degrading verification reliability. To address this issue, we propose Cert-LAS, the first certified MOV method for T2I models based on layer-adaptive smoothing. In general, Cert-LAS embeds specified watermarks using diffusion classifiers and an LFS-guided layer-adaptive noise, and verifies ownership by examining whether the suspected model exhibits significantly stronger watermark responses compared to unwatermarked references through hypothesis testing. We further prove that, under certain conditions, our Cert-LAS can still achieve reliable verification even in the presence of malicious removal attacks. Extensive experiments validate the effectiveness of Cert-LAS and its resistance to adaptive attacks. Our code is available at https://github.com/Leyi-Qi/Cert-LAS.

AI image generators such as Stable Diffusion cost enormous amounts of data, money, and computing power to build, which makes them valuable assets that others may copy and pass off as their own. To prove ownership, a developer can hide a secret signal, a watermark, inside the model. But today's watermarks have two weaknesses. They are usually switched on by an unnatural secret phrase that an attacker can notice and strip away, and even when the watermark stays hidden, there is no guarantee it will survive once someone deliberately tampers with the model. We built Cert-LAS to fix both problems. Instead of relying on a suspicious trigger, it teaches the model to respond in a subtle, pre-agreed way to perfectly ordinary inputs, so nothing unusual is ever exposed to an attacker. It also reinforces the parts of the model that are easiest to alter, and we mathematically prove that the watermark cannot be erased as long as any tampering stays within a measurable limit. This is the first ownership watermark for image generators that comes with a provable survival guarantee, even against attackers who actively try to remove it, giving developers a trustworthy way to defend their work as generative AI spreads.