Vision-Encoder Behavioral Fingerprints of Image-to-Image Generative Models: A Training-Paradigm-Driven Taxonomy of Six Commercial APIs
cs.CV, cs.CR
Submitted: 2026-06-10
Updated: 2026-09-07
Comments: Version 2 adds Data and code availability. Corpus can be found on Zenodo, DOI 10.5281/zenodo.22258270 and 10.5281/zenodo.22259972 . V2 also includes supplementary material referenced in V1 (Tables S1-S7). All results remain unchanged 22 pages
License: http://creativecommons.org/licenses/by/4.0/
The gist: We study six production image-to-image AI systems (gpt-image-1, Gemini 2.5 Flash Image, Flux Kontext, SDXL img2img, SD3 img2img, and Qwen Image Edit) under a content-adaptive sub-JND adversarial
Terminology
Abstract
We study six production image-to-image AI systems (gpt-image-1, Gemini 2.5 Flash Image, Flux Kontext, SDXL img2img, SD3 img2img, and Qwen Image Edit) under a content-adaptive sub-JND adversarial perturbation pipeline, scoring all outputs by frozen DINOv2 ViT-B/14 token distances against clean references. Across a 3,588-call corpus spanning COCO photographs, CelebA-HQ portraits, and AI-generated inputs, the six systems partition into two image-invariant behavioral bands on a 2D (patch mean, ssim clean) plane: edit-trained models (Flux Kontext, Qwen Edit, Gemini) cluster in a tight band, while T2I-base models adapted at sampling time (SDXL, SD3, gpt-image-1) cluster in a drift band.
Sources
- Reverse Engineering of Generative Models: Inferring Model Hyperparameters from Generated Images
- FLUX.1 Kontext: Flow Matching for In-Context Image Generation and Editing in Latent Space
- IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI
- Training-free Detection of AI-generated images via Cropping Robustness
- On the detection of synthetic images generated by diffusion models
- DinoLizer: Separating VAE and Diffusion Artifacts in Generative Inpainting Localization
- Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI
- Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples
- Diffusion Models for Adversarial Purification
- DINOv2: Learning Robust Visual Features without Supervision
- PRISM: Phase-enhanced Radial-based Image Signature Mapping framework for fingerprinting AI-generated images
- AEROBLADE: Training-Free Detection of Latent Diffusion Images Using Autoencoder Reconstruction Error
- Raising the Cost of Malicious AI-Powered Image Editing
- DINO-Detect: A Simple yet Effective Framework for Blur-Robust AI-Generated Image Detection
- Is Perturbation-Based Image Protection Disruptive to Image Editing?
- Pixel is a Barrier: Diffusion Models Are More Adversarially Robust Than We Think
Related papers
- Loss Knows Best: Detecting Annotation Errors in Videos via Loss Trajectories
- AnchorWeave: World-Consistent Video Generation with Retrieved Local Spatial Memories
- Benchmarking the Robustness of Foundation Models for Mammography under Domain Shift
- MambaX-Net: Dual-Input Mamba-Enhanced Cross-Attention Network for Longitudinal MRI Segmentation
- TeleOCR: Navigating Document Parsing Across Digital and Camera-Captured Documents
- A Survey on Efficient Vision-Language-Action Models