Auditing whether a text-to-image model was fine-tuned on a particular image collection is difficult: a model can absorb collection-level visual characteristics without reproducing training images. Proactive dataset-use auditing plants a shared signal in a dataset before release, then later checks whether that signal appears in a suspect model's generated outputs. Existing approaches often trade off verifiability, fidelity, robustness, and deployability. This paper introduces SpectralCanary, which uses a smooth low-pass mask to blend a fixed canary image into every collection image while leaving captions unchanged and requiring neither auxiliary generation nor per-image optimization. A lightweight verifier detects the transferred signal in suspect-model outputs.
Low-Frequency Visual Structure as Trace Carrier
The core design choice driving SpectralCanary is the frequency band used for the shared trace. Low frequencies encode broad spatial structure that neural networks preferentially learn and that is important to text-to-image generation. This motivates the hypothesis that a weak low-frequency trace can transfer during fine-tuning. The dataset owner protects a collection by choosing one fixed canary image and, for each collection image, mixing a small amount of the canary's low-frequency Fourier content into the original through a smooth low-pass mask. The protected spectra are thereby shifted toward a common low-frequency target, creating a collection-level signal. Critically, captions remain unchanged and the protection transform is deterministic, requiring no per-image optimization.
SpectralCanary: Deterministic Caption-Preserving Spectral Hybridization
SpectralCanary constructs protected collection ^ and trains verifier f_θ through a two-stage process. Stage I uniformly selects a subset of images (|I_δ| = ⌊δN⌋, δ = 1 by default); for each selected image, the canary's Fourier V is combined with the image's Fourier X_i through a smooth radial low-pass mask M_c(k,ℓ) = exp(−r(k,ℓ)²/(2c²)), where r indexes the shifted Fourier grid centered at (⌊H/2⌋,⌊W/2⌋). The protected spectrum becomes X̂_i = X_i + αM_c ⊙ (V − X_i) = (1 − αM_c) ⊙ X_i + αM_c ⊙ V, where α ∈ [0,1] is the blending strength. The protected image x̃_i = Π_8(ℜ[ℱ_c^−1(X̂_i)]) is exported alongside its original caption. Stage II trains the verifier f_θ by minimizing ℒ_ver(θ) = −(1/|I_δ|) ∑_{i∈I_δ} [log f_θ(x̃_i) + log(1 − f_θ(x_i))] using selected protected images as positives and their original counterparts as negatives. No model generations are used during training. The deterministic construction requires neither an auxiliary generative model nor iterative per-image optimization, and protection takes 0.39 seconds per image on CPU.
Per-Generation Discrimination Survives Model and Data Changes
Per-generation discrimination scores each generated image independently, asking whether outputs from protected-data models receive higher verifier scores than outputs from clean-data models. AUC summarizes this score separation over all thresholds. TPR at 1% FPR is the fraction of outputs from protected-data models detected at a threshold that falsely flags at most 1% of outputs from clean-data models. Across eight Pokemon settings spanning two model families (Stable Diffusion v1.5 and Stable Diffusion 3.5) and three data transformations (training-time augmentation, prompt recaptioning, and image regeneration), SpectralCanary achieves the highest average per-generation TPR at 1% FPR: 91.1%. Its AUC is 98.0%. The weakest individual result is 65.9% under SD3.5 with training-time augmentation, while the best competing method has a worst-case result of only 19.4%. No method wins every individual setting: DIAGNOSIS is strongest for ordinary SD1.5 training, and EnTruth is strongest for SD3.5 with training-time augmentation.
Cross-Domain Fidelity and Utility Preservation
The evaluation extends across five image types: character art (Pokemon), sparse scene drawings (Sketch-Scene), medical (ROCOv2), satellite (RSICD), and fashion (FACAD). Across these domains with SD3.5, SpectralCanary averages 92.4% per-generation TPR at 1% FPR. Protected images remain close to their originals: average LPIPS is 0.022, where zero means identical images. Training on the protected images causes almost no average change in model output quality: mean ΔFID is 0.05, where zero means no change. On the sparse Sketch-Scene drawings, SpectralCanary achieves 100% per-generation TPR with LPIPS 0.002. The hardest dataset is RSICD, where it achieves 78.9% per-generation TPR with LPIPS 0.048. Compared to baselines, DIAGNOSIS changes original images little but usually provides weak per-generation discrimination; SIREN works well on some datasets but poorly on others and makes the largest image changes; EnTruth works well on several datasets but fails on ROCOv2 and adds new canary images rather than making a protected copy of each original.
Protection Speed and Quality
SpectralCanary achieves high per-generation discrimination with low quality and runtime cost. Average per-generation TPR at 1% FPR over the eight Pokemon settings is compared with change in FID, protection time, and paired-image LPIPS. Preferred results lie upward and to the left. DIAGNOSIS is faster, but its average TPR is only 32.2%. SIREN and EnTruth require substantially more computation while achieving lower per-generation TPR. SpectralCanary also has no average FID penalty and the lowest paired-image LPIPS among the methods that modify every image. Protection takes 0.39 seconds per image on CPU, distinguishing a single deterministic FFT-based transform from methods that require generating auxiliary images or performing iterative optimization.
Low Frequencies Carry the Trace More Reliably
Matched-energy ablations on Pokemon and ROCOv2 support the design choice of low-frequency placement. When disjoint low-, mid-, and high-frequency bands contain the same number of Fourier coefficients and the same total amount of Fourier-domain change, the low-frequency band yields the highest per-generation TPR on both datasets. It exceeds the high-frequency band by 16.9 percentage points on Pokemon and 88.9 points on ROCOv2; the mid-frequency band is also weaker in both cases. This result confirms that low-frequency visual signals transfer more reliably during T2I fine-tuning compared to mid or high frequencies.
Removal Attacks and the Quality Boundary
Under evaluated adaptive attacks, substantially reducing per-generation TPR also substantially damages the training data or the resulting model. Three attacks were tested: fixed-donor replacement (using one unrelated unprotected image as replacement source for all protected images), per-image donor replacement (using a different donor for each image), and shared-structure estimation (estimating the shared low-frequency pattern directly from the protected collection and removing it). From the unattacked point, stronger attacks move down and to the right, indicating per-generation TPR falls but ΔFID and LPIPS increase. Driving TPR toward the clean-training baseline requires more than 25 additional FID points under the strongest evaluated attack and also produces large LPIPS changes. This establishes a removal–quality boundary for these three attacks; it is not a guarantee against every possible attack, especially one that can inspect the model or verifier.
Limitations and Responsible Use
The evaluation covers two text-to-image architecture families, five datasets, and both LoRA and full-parameter fine-tuning. It does not establish transfer to every model, or mixture of a protected collection with a larger unprotected corpus. The main experiments use one fixed natural canary image. If the attacker learns the canary spectrum V_⋆, blending strength α, and Gaussian bandwidth c, the protection transform can be inverted, though clipping and quantization prevent exact recovery from the released image. The three evaluated attacks characterize a secrecy-dependent threat model and do not provide cryptographic or white-box robustness guarantee. Future evaluations should consider collusion across releases, learned removal models, stronger shared-structure estimators, and adaptive access to verifier feedback. SSIM, LPIPS, and FID capture only part of image fidelity and generative utility; human perceptual studies and task-specific utility measurements would be needed to support stronger claims. KS-test rejection rates on protected-data models estimate statistical power under the stated sampling protocol, while fixed-threshold model-level verification uses separate clean-data and protected-data models for calibration; a positive result should be treated as statistical evidence under the threat model, not as standalone proof of unauthorized use.