Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints

Ning Yu1,2 Larry Davis1 Mario Fritz3

1University of Maryland, College Park2Max Planck Institute for Informatics

Saarland Informatics Campus, Germany3CISPA Helmholtz Center for Information Security

Saarland Informatics Campus, Germanyningyu@mpi-inf.mpg.de lsd@cs.umd.edu fritz@cispa.saarland

Abstract

Recent advances in Generative Adversarial Networks(GANs) have shown increasing success in generating pho-torealistic images. But they also raise challenges to vi-sual forensics and model attribution. We present the firststudy of learning GAN fingerprints towards image attribu-tion and using them to classify an image as real or GAN-generated. For GAN-generated images, we further identifytheir sources. Our experiments show that (1) GANs carrydistinct model fingerprints and leave stable fingerprints intheir generated images, which support image attribution;(2) even minor differences in GAN training can result indifferent fingerprints, which enables fine-grained model au-thentication; (3) fingerprints persist across different imagefrequencies and patches and are not biased by GAN arti-facts; (4) fingerprint finetuning is effective in immunizingagainst five types of adversarial image perturbations; and(5) comparisons also show our learned fingerprints consis-tently outperform several baselines in a variety of setups 1.

1. IntroductionIn the last two decades, photorealistic image generation

and manipulation techniques have rapidly evolved. Visualcontents can now be easily created and edited without leav-ing obvious perceptual traces [72]. Recent breakthroughsin generative adversarial networks (GANs) [31, 52, 10, 32,38, 19] have further improved the quality and photoreal-ism of generated images. The adversarial framework ofGANs can also be used in conditional scenarios for im-age translation [36, 70, 71] or manipulation in a given con-text [60, 61, 57, 12, 64], which diversifies media synthesis.

1Code, data, models, and supplementary material are available atGitHub.

Figure 1. A t-SNE [43] visual comparison between our fingerprintfeatures (right) and the baseline inception features [52] (left) forimage attribution. Inception features are highly entangled, indi-cating the challenge to differentiate high-quality GAN-generatedimages from real ones. However, our result shows any single dif-ference in GAN architectures, training sets, or even initializationseeds can result in distinct fingerprint features for effective attri-bution.

At the same time, however, the success of GANs hasraised two challenges to the vision community: visualforensics and intellectual property protection.

GAN challenges to visual forensics. There is awidespread concern about the impact of this technologywhen used maliciously. This issue has also received in-creasing public attention, in terms of disruptive conse-quences to visual security, laws, politics, and society in gen-eral [6, 1, 3]. Therefore, it is critical to look into effectivevisual forensics against threats from GANs.

While recent state-of-the-art visual forensics techniquesdemonstrate impressive results for detecting fake visual me-dia [16, 53, 27, 13, 22, 11, 35, 67, 68, 26], they haveonly focused on semantic, physical, or statistical incon-sistency of specific forgery scenarios, e.g., copy-movemanipulations[16, 26] or face swapping [67]. Forensics onGAN-generated images [44, 47, 59] shows good accuracy,but each method operates on only one GAN architecture byidentifying its unique artifacts and results deteriorate whenthe GAN architecture is changed. It is still an open questionof whether GANs leave stable marks that are commonly

arX

iv:1

811.

0818

0v3

[cs

.CV

] 1

6 A

ug 2

019

shared by their generated images. That motivates us to in-vestigate an effective feature representation that differenti-ates GAN-generated images from real ones.GAN challenges to intellectual property protection.Similar to other successful applications of deep learningtechnology to image recognition [33] or natural languageprocessing [30], building a product based on GANs is non-trivial [37, 4, 5]. It requires a large amount of training data,powerful computing resources, significant machine learningexpertise, and numerous trial-and-error iterations for iden-tifying optimal model architectures and their model hyper-parameters. As GAN services become widely deployedwith commercial potential, they will become increasinglyvulnerable to pirates. Such copyright plagiarism may jeop-ardize the intellectual property of model owners and takefuture market share from them. Therefore, methods for at-tributing GAN-generated image origins are highly desirablefor protecting intellectual property.

Given the level of realism that GAN techniques alreadyachieve today, attribution by human inspection is no longerfeasible (see the mixture of Figure 4). The state-of-the-art digital identification techniques can be separated intotwo categories: digital watermarking and digital fingerprintdetection. Neither of them is applicable to GAN attri-bution. Previous work on watermarking deep neural net-works [65, 62] depends on an embedded security schemeduring “white-box” model training, requires control of theinput, and is impractical when only GAN-generated imagesare accessible in a “black-box” scenario. Previous work ondigital fingerprints is limited to device fingerprints [42, 21]or in-camera post-processing fingerprints [24], which can-not be easily adapted to GAN-generated images. That mo-tivates us to investigate GAN fingerprints that attribute dif-ferent GAN-generated images to their sources.

We present the first study addressing the two GAN chal-lenges simultaneously by learning GAN fingerprints for im-age attribution: We introduce GAN fingerprints and usethem to classify an image as real or GAN-generated. ForGAN-generated images, we further identify their sources.We approach this by training a neural network classifier andpredicting the source of an image. Our experiments showthat GANs carry distinct model fingerprints and leave stablefingerprints in their generated images, which support imageattribution.

We summarize our contributions as demonstrating theexistence, uniqueness, persistence, immunizability, and vi-sualization of GAN fingerprints. We address the followingquestions:Existence and uniqueness: Which GAN parameters dif-ferentiate image attribution? We present experimentson GAN parameters including architecture, training data, aswell as random initialization seed. We find that a differencein any one of these parameters results in a unique GAN fin-

gerprint for image attribution. See Figure 1, Section 3.1 and4.2.Persistence: Which image components contain finger-prints for attribution? We investigate image compo-nents in different frequency bands and in different patchsizes. In order to eliminate possible bias from GAN arti-fact components, we apply a perceptual similarity metricto distill an artifact-free subset for attribution evaluation.We find that GAN fingerprints are persistent across differ-ent frequencies and patch sizes, and are not dominated byartifacts. See Section 3.2 and 4.3.Immunizability: How robust is attribution to image per-turbation attacks and how effective are the defenses?We investigate common attacks that aim at destroying im-age fingerprints. They include noise, blur, cropping, JPEGcompression, relighting, and random combinations of them.We also defend against such attacks by finetuning our attri-bution classifier. See Section 4.4.Visualization: How to expose GAN fingerprints? Wepropose an alternative classifier variant to explicitly visual-ize GAN fingerprints in the image domain, so as to betterinterpret the effectiveness of attribution. See Section 3.3and 4.5.Comparison to baselines. In terms of attribution accu-racy, our method consistently outperforms three baselinemethods (including a very recent one [45]) on two datasetsunder a variety of experimental conditions. In terms offeature representation, our fingerprints show superior dis-tinguishability across image sources compared to inceptionfeatures [52].

2. Related workGenerative Adversarial Networks (GANs). GANs [31,52, 10, 32, 38, 19] have shown improved photorealism inimage synthesis [40, 15, 69], translation [36, 70, 71], or ma-nipulation [9, 60, 61]. We focus on unconditional GANs asthe subject of our study. We choose the following four GANmodels as representative candidates of the current state ofthe art: ProGAN [38], SNGAN [46], CramerGAN [14],and MMDGAN [17], considering their outstanding perfor-mances on face generation.Visual forensics. Visual forensics targets detecting statis-tical or physics-based artifacts and then recognizing the au-thenticity of visual media without evidence from an em-bedded security mechanism [28, 27]. An example is asteganalysis-based method [29], which uses hand-craftedfeatures plus a linear Support Vector Machine to detect forg-eries. Recent CNN-based methods [13, 22, 18, 11, 35, 67,68, 7, 23, 26] learn deep features and further improve tam-pering detection performance on images or videos. Rossleret al. [49, 50] introduced a large-scale face manipulationdataset to benchmark forensics classification and segmenta-tion tasks, and demonstrated superior performance when us-ing additional domain-specific knowledge. For forensics on

GAN-generated images, several existing works [44, 47, 59]show good accuracy. However, each method considers onlyone GAN architecture and results do not generalize acrossarchitectures.Digital fingerprints. Prior digital fingerprint techniquesfocus on detecting hand-crafted features for either devicefingerprints or postprocessing fingerprints. The device fin-gerprints rely on the fact that individual devices, due tomanufacturing imperfections, leave a unique and stablemark on each acquired image, i.e., the photo-response non-uniformity (PRNU) pattern [42, 21]. Likewise, postpro-cessing fingerprints come from the specific in-camera post-processing suite (demosaicking, compression, etc.) duringeach image acquisition procedure [24]. Recently, Marra etal. [45] visualize GAN fingerprints based on PRNU, andshow their application to GAN source identification. Wereplace their hand-crafted fingerprint formulation with alearning-based one, decoupling model fingerprint from im-age fingerprint, and show superior performances in a varietyof experimental conditions.Digital watermarking. Digital watermarking is a com-plementary forensics technique for image authentica-tion [58, 39, 51]. It involves embedding artificial water-marks in images. It can be used to reveal image sourceand ownership so as to protect their copyright. It has beenshown that neural networks can also be actively water-marked during training [65, 62]. In such models, a char-acteristic pattern can be built into the learned representationbut with a trade-off between watermarking accuracy and theoriginal performance. However, such watermarking has notbeen studied for GANs. In contrast, we utilize inherent fin-gerprints for image attribution without any extra embeddingburden or quality deterioration.

3. Fingerprint learning for image attributionInspired by the prior works on digital fingerprints [42,

24], we introduce the concepts of GAN model fingerprintand image fingerprint. Both are simultaneously learnedfrom an image attribution task.Model fingerprint. Each GAN model is characterized bymany parameters: training dataset distribution, network ar-chitecture, loss design, optimization strategy, and hyper-parameter settings. Because of the non-convexity of theobjective function and the instability of adversarial equilib-rium between the generator and discriminator in GANs, thevalues of model weights are sensitive to their random initial-izations and do not converge to the same values during eachtraining. This indicates that even though two well-trainedGAN models may perform equivalently, they generate high-quality images differently. This suggests the existence anduniqueness of GAN fingerprints. We define the model fin-gerprint per GAN instance as a reference vector, such thatit consistently interacts with all its generated images. In a

specifically designed case, the model fingerprint can be anRGB image the same size as its generated images. See Sec-tion 3.3.

Image fingerprint. GAN-generated images are the out-comes of a large number of fixed filtering and non-linearprocesses, which generate common and stable patternswithin the same GAN instances but are distinct across dif-ferent GAN instances. That suggests the existence of imagefingerprints and attributability towards their GAN sources.We introduce the fingerprint per image as a feature vectorencoded from that image. In a specifically designed case,an image fingerprint can be an RGB image the same size asthe original image. See Section 3.3.

3.1. Attribution network

Similar to the authorship attribution task in natural lan-guage processing [56, 8], we train an attribution classifierthat can predict the source of an image: real or from a GANmodel.

We approach this using a deep convolutional neural net-work supervised by image-source pairs {(I, y)} where I ∼I is sampled from an image set and y ∈ Y is the sourceground truth belonging to a finite set. That set is com-posed of pre-trained GAN instances plus the real world.Figure 2(a) depicts an overview of our attribution network.

We implicitly represent image fingerprints as the finalclassifier features (the 1 × 1 × 512 tensor before the fi-nal fully connected layer) and represent GAN model fin-gerprints as the corresponding classifier parameters (the1×1×512 weight tensor of the final fully connected layer).

Why is it necessary to use such an external classifierwhen GAN training already provides a discriminator? Thediscriminator learns a hyperplane in its own embeddingspace to distinguish generated images from real ones. Dif-ferent embedding spaces are not aligned. In contrast, theproposed classifier necessarily learns a unified embeddingspace to distinguish generated images from different GANinstances or from real images.

Note that our motivation to investigate “white-box”GANs subject to known parameters is to validate the at-tributability along different GAN parameter dimensions. Inpractice, our method also applies to “black-box” GAN APIservices. The only required supervision is the source labelof an image. We can simply query different services, collecttheir generated images, and label them by service indices.Our classifier would test image authenticity by predicting ifan image is sampled from the desired service. We also testservice authenticity by checking if most of their generatedimages have the desired source prediction.

3.2. Component analysis networks

In order to analyze which image components contain fin-gerprints, we propose three variants of the network.

(a) (b) (c) (d)

Figure 2. Different attribution network architectures. Tensor rep-resentation is specified by two spatial dimensions followed by thenumber of channels. The network is trained to minimize cross-entropy classification loss. (a) Attribution network. (b) Pre-downsampling network example that downsamples input image to8× 8 before convolution. (c) Pre-downsampling residual networkexample that extracts the residual component between 16×16 and8×8 resolutions. (d) Post-pooling network example that starts av-erage pooling at 64× 64 resolution.

Pre-downsampling network. We propose to test whetherfingerprints and attribution can be derived from differentfrequency bands. We investigate attribution performancew.r.t. downsampling factor. Figure 2(b) shows an architec-ture example that extracts low-frequency bands. We replacethe trainable convolution layers with our Gaussian down-sampling layers from the input end and systematically con-trol at which resolution we stop such replacement.Pre-downsampling residual network. Complementaryto extracting low-frequency bands, Figure 2(c) shows an ar-chitecture example that extracts a residual high-frequencyband between one resolution and its factor-2 downsampledresolution. It is reminiscent of a Laplacian Pyramid [20].We systematically vary the resolution at which we extractsuch residual.Post-pooling network. We propose to test whether fin-gerprints and attribution can be derived locally based onpatch statistics. We investigate attribution performancew.r.t. patch size. Figure 2(d) shows an architecture example.Inspired by PatchGAN [36], we regard a “pixel” in a neuraltensor as the feature representation of a local image patchcovered by the receptive field of that “pixel”. Therefore,post-pooling operations count for patch-based neural statis-tics. Earlier post-pooling corresponds to a smaller patchsize. We systematically vary at which tensor resolution westart this pooling in order to switch between more local andmore global patch statistics.

3.3. Fingerprint visualization

Alternatively to our attribution network in Section 3.1where fingerprints are implicitly represented in the featuredomain, we describe a model similar in spirit to Marra etal. [45] to explicitly represent them in the image domain.But in contrast to their hand-crafted PRNU-based represen-tation, we modify our attribution network architecture and

Figure 3. Fingerprint visualization diagram. We train an AutoEn-coder and GAN fingerprints end-to-end. � indicates pixel-wisemultiplication of two normalized images.

learn fingerprint images from image-source pairs ({I, y}).We also decouple the representation of model fingerprintsfrom image fingerprints. Figure 3 depicts the fingerprint vi-sualization model.

Abstractly, we learn to map from input image to its fin-gerprint image. But without fingerprint supervision, wechoose to ground the mapping based on a reconstructiontask with an AutoEncoder. We then define the reconstruc-tion residual as the image fingerprint. We simultaneouslylearn a model fingerprint for each source (each GAN in-stance plus the real world), such that the correlation indexbetween one image fingerprint and each model fingerprintserves as softmax logit for classification.

Mathematically, given an image-source pair (I, y) wherey ∈ Y belongs to the finite set Y of GAN instances plus thereal world, we formulate a reconstruction mapping R fromI to R(I). We ground our reconstruction based on pixel-wise L1 loss plus adversarial loss:

Lpix(I) = ||R(I)− I||1 (1)

Ladv(I) = Drec(R(I)

)−Drec

(I)+GP

(R(I), I|Drec

)(2)

where Drec is an adversarially trained discriminator, andGP(·) is the gradient penalty regularization term definedin [32].

We then explicitly define image fingerprint F Iim as the

reconstruction residual F Iim = R(I)− I .

We further explicitly define model fingerprint F ymod as

freely trainable parameters with the same size as F Iim, such

that corr(F Iim, F

ymod), the correlation index between F I

im andF y

mod, is maximized over Y. This can be formulated as thesoftmax logit for the cross-entropy classification loss super-vised by the source ground truth:

Lcls(I, y) = − logcorr(F I

im, Fymod)∑

y∈Y corr(F Iim, F

ymod)

(3)

where corr(A,B) = A � B, A and B are the zero-mean,unit-norm, and vectorized version of images A and B, and� is the inner product operation.

Our final training objective is

minR,{F y

mod|y∈Y}maxDrec

E{(I,y)}

(λ1Lpix + λ2Ladv + λ3Lcls) (4)

(a) CelebA real data (b) ProGAN (c) SNGAN (d) CramerGAN (e) MMDGAN

Figure 4. Face samples from difference sources.

where λ1 = 20.0, λ2 = 0.1, and λ3 = 1.0 are used tobalance the order of magnitude of each loss term, which arenot sensitive to dataset and are fixed.

Note that this network variant is used to better visualizeand interpret the effectiveness of image attribution. How-ever, it introduces extra training complexity and thus is notused if we only focus on attribution.

4. Experiments

We discuss the experimental setup in Section 4.1. FromSection 4.2 to 4.5, we explore the four research questionsdiscussed in the Introduction.

4.1. Setup

Datasets . We employ CelebA human face dataset [41]and LSUN bedroom scene dataset [63], both containing20, 000 real-world RGB images.GAN models. We consider four recent state-of-the-artGAN architectures: ProGAN [38], SNGAN [46], Cramer-GAN [14], and MMDGAN [17]. Each model is trainedfrom scratch with their default settings except we fix thenumber of training epochs to 240 and fix the output size ofa generator to 128× 128× 3.Baseline methods. Given real-world datasets and fourpre-trained GAN models, we compare with three baselineclassification methods: k-nearest-neighbor (kNN) on rawpixels, Eigenface [55], and the very recent PRNU-based fin-gerprint method from Marra et al. [45].Evaluation. We use classification accuracy to evaluateimage attribution performance.

In addition, we use the ratio of inter-class and intra-classFrechet Distance [25], denoted as FD ratio, to evaluate thedistinguishability of a feature representation across classes.The larger the ratio, the more distinguishable the featurerepresentation across sources. See supplementary materialfor more detail. We compare our fingerprint features to im-age inception features [52]. The FD of inception featuresis also known as FID for GAN evaluation [34]. Therefore,the FD ratio of inception features can serve as a reference toshow how challenging it is to attribute high-quality GAN-generated images manually or without fingerprint learning.

4.2. Existence and uniqueness: which GAN param-eters differentiate image attribution?

We consider GAN architecture, training set, and initial-ization seed respectively by varying one type of parameterand keeping the other two fixed.Different architectures. First, we leverage all the realimages to train ProGAN, SNGAN, CramerGAN, andMMDGAN separately. For the classification task, we con-figure training and testing sets with 5 classes: {real, Pro-GAN, SNGAN, CramerGAN, MMDGAN}. We randomlycollect 100, 000 images from each source for classificationtraining and another 10, 000 images from each source fortesting. We show face samples from each source in Fig-ure 4 and bedroom samples in the supplementary material.Table 1 shows that we can effectively differentiate GAN-generated images from real ones and attribute generated im-ages to their sources, just using a regular CNN classifier.There do exist unique fingerprints in images that differenti-ate GAN architectures, even though it is far more challeng-ing to attribute those images manually or through inceptionfeatures [52].Different GAN training sets. We further narrow downthe investigation to GAN training sets. From now we onlyfocus on ProGAN plus real dataset. We first randomly se-lect a base real subset containing 100, 000 images, denotedas real subset diff 0. We then randomly select 10 otherreal subsets also containing 100, 000 images, denoted asreal subset diff #i, where i ∈ {1, 10, 100, 1000, 10000,20000, 40000, 60000, 80000, 100000} indicates the num-ber of images that are not from the base subset. We collectsuch sets of datasets to explore the relationship between at-tribution performance and GAN training set overlaps.

For each real subset diff #i, we separately train a Pro-GAN model and query 100, 000 images for classifiertraining and another 10, 000 images for testing, labeledas ProGAN subset diff #i. In this setup of {real, Pro-GAN subset diff #i}, we show the performance evaluationin Table 2. Surprisingly, we find that attribution perfor-mance remains equally high regardless of the amount ofGAN training set overlap. Even GAN training sets that dif-fer in just one image can lead to distinct GAN instances.That indicates that one-image mismatch during GAN train-ing results in a different optimization step in one iteration

Table 1. Evaluation on {real, ProGAN, SNGAN, CramerGAN,MMDGAN}. The best performance is highlighted in bold.

CelebA LSUN

kNN 28.00 36.30Accuracy Eigenface [55] 53.28 -

(%) PRNU [45] 86.61 67.84Ours 99.43 98.58

FD ratio Inception [52] 2.36 5.27Our fingerprint 454.76 226.59

Table 2. Evaluation on {real, ProGAN subset diff #i}. The bestperformance is highlighted in bold.

CelebA LSUN

kNN 11.46 10.72Accuracy Eigenface [55] 27.98 -

(%) PRNU [45] 92.28 70.55Ours 99.50 97.66

FD ratio Inception [52] 1.08 1.64Our fingerprint 111.41 39.96

Table 3. Evaluation on {real, ProGAN seed v#i}. The best perfor-mance is highlighted in bold. “Our visNet” row indicates our fin-gerprint visualization network described in Section 3.3 and evalu-ated in Section 4.5.

CelebA LSUN

kNN 10.88 10.58Accuracy Eigenface [55] 23.12 -

(%) PRNU [45] 89.40 69.73Ours 99.14 97.04Our visNet 97.07 96.58

FD ratio Inception [52] 1.10 1.29Our fingerprint 80.28 36.48

and finally results in distinct fingerprints. That motivatesus to investigate the attribution performance among GANinstances that were trained with identical architecture anddataset but with different random initialization seeds.

Different initialization seeds. We next investigate theimpact of GAN training initialization on image attributabil-ity. We train 10 ProGAN instances with the entire realdataset and with different initialization seeds. We sam-ple 100, 000 images for classifier training and another10, 000 images for testing. In this setup of {real, Pro-GAN seed v#i} where i ∈ {1, ..., 10}, we show the perfor-mance evaluation in Table 3. We conclude that it is the dif-ference in optimization (e.g., caused by different random-ness) that leads to attributable fingerprints. In order to ver-ify our experimental setup, we ran sanity checks. For exam-ple, two identical ProGAN instances trained with the sameseed remain indistinguishable and result in random-chanceattribution performance.

Table 4. Classification accuracy (%) of our network w.r.t. down-sampling factor on low-frequency or high-frequency componentsof {real, ProGAN seed v#i}. “L-f” column indicates the low-frequency components and represents the performances from thepre-downsampling network. “H-f” column indicates the high-frequency components and represents the performances from thepre-downsampling residual network.

Downsample Res- CelebA LSUNfactor olution L-f H-f L-f H-f

1 1282 99.14 99.14 97.04 97.042 642 98.74 98.64 96.78 96.844 322 95.50 98.52 91.08 96.048 162 87.20 92.90 83.02 91.58

16 82 67.44 78.74 63.80 80.5832 42 26.58 48.42 28.24 54.50

Table 5. Classification accuracy (%) of our network w.r.t. patchsize on {real, ProGAN seed v#i}.

Pooling starts at Patch size CelebA LSUN

42 1282 99.34 97.4482 1082 99.32 96.30162 522 99.30 95.94322 242 99.24 88.36642 102 89.60 18.261282 32 13.42 17.10

4.3. Persistence: which image components containfingerprints for attribution?

We systematically explore attribution performance w.r.t.image components in different frequency bands or with dif-ferent patch sizes. We also investigate possible performancebias from GAN artifacts.Different frequencies. We investigate if band-limited im-ages carry effective fingerprints for attribution. We sepa-rately apply the proposed pre-downsampling network andpre-downsampling residual network for image attribution.Given the setup of {real, ProGAN seed v#i}, Table 4 showsthe classification accuracy w.r.t. downsampling factors.We conclude that (1) a wider frequency band carries morefingerprint information for image attribution, (2) the low-frequency and high-frequency components (even at the res-olution of 8×8) individually carry effective fingerprints andresult in attribution performance better than random, and (3)at the same resolution, high-frequency components carrymore fingerprint information than low-frequency compo-nents.Different local patch sizes. We also investigate if localimage patches carry effective fingerprints for attribution.We apply the post-pooling network for image attribution.Given the setup of {real, ProGAN seed v#i}, Table 5 showsthe classification accuracy w.r.t. patch sizes. We concludethat for CelebA face dataset a patch of size 24×24 or largercarries sufficient fingerprint information for image attribu-tion without deterioration; for LSUN, a patch of size 52×52

(a) Non-selected samples (b) Selected samples

Figure 5. Visual comparisons between (a) arbitrary face samplesand (b) selected samples with top 10% Perceptual Similarity [66]to CelebA real dataset. We notice the selected samples have higherquality and fewer artifacts. They are also more similar to eachother, which challenge more on attribution.

Table 6. Evaluation on the 10% selected images of {real, Pro-GAN seed v#i}. The best performance is highlighted in bold.

CelebA LSUN

kNN 11.99 10.35Accuracy Eigenface [55] 26.69 -

(%) PRNU [45] 93.50 74.49Ours 99.93 98.16

FD ratio Inception [52] 1.04 1.22Our fingerprint 15.63 6.27

or larger carries a sufficient fingerprint.

Artifact-free subset. Throughout our experiments, thestate-of-the-art GAN approaches are capable of generatinghigh-quality images – but are also generating obvious ar-tifacts in some cases. There is a concern that attributionmight be biased by such artifacts. In order to eliminate thisconcern, we use Perceptual Similariy [66] to measure the 1-nearest-neighbor similarity between each testing generatedimage and the real-world dataset, and then select the 10%with the highest similarity for attribution. We compare facesamples between non-selected and selected sets in Figure 5and compare bedroom samples in the supplementary mate-rial. We notice this metric is visually effective in selectingsamples of higher quality and with fewer artifacts.

Given the setup of 10% selected {real, Pro-GAN seed v#i}, we show the performance evaluationin Table 6. All the FD ratio measures consistently de-creased compared to Table 3. This indicates our selectionalso moves the image distributions from different GANinstances closer to the real dataset and consequentlycloser to each other. This makes the attribution task morechallenging. Encouragingly, our classifier, pre-trainedon non-selected images, can perform equally well on theselected high-quality images and is hence not biased byartifacts.

4.4. Immunizability: how robust is attribution toimage perturbation attacks and how effectiveare the defenses?

Attacks. We apply five types of attacks that perturb test-ing images [48]: noise, blur, cropping, JPEG compression,relighting, and random combination of them. The intentionis to confuse the attribution network by destroying imagefingerprints. Examples of the perturbations on face imagesare shown in Figure 6. Examples on bedroom images areshown in the supplementary material.

Noise adds i.i.d. Gaussian noise to testing images. TheGaussian variance is randomly sampled from U [5.0, 20.0].Blur performs Gaussian filtering on testing images with ker-nel size randomly picked from {1, 3, 5, 7, 9}. Crop-ping crops testing images with a random offset between 5%and 20% of the image side lengths and then resizes back tothe original. JPEG compression performs JPEG compres-sion processing with quality factor randomly sampled fromU [10, 75]. Relighting uses SfSNet [54] to replace the cur-rent image lighting condition with another random one fromtheir lighting dataset. The combination performs each at-tack with a 50% probability in the order of relighting, crop-ping, blur, JPEG compression, and noise.

Given perturbed images and the setup of {real, Pro-GAN seed v#i}, we show the pre-trained classifier perfor-mances in the “Akt” columns in Table 7 and Table 8. Allperformances decrease due to attacks. In detail, the clas-sifier completely fails to overcome noise and JPEG com-pression attacks. It still performs better than random whenfacing the other four types of attacks. The relighting at-tack is the least effective one because it only perturbs low-frequency image components. The barely unchanged fin-gerprints in high-frequency components enables reasonableattribution.Defenses. In order to immunize our classifier against at-tacks, we finetune the classifier under the assumption thatwe know the attack category. Given perturbed images andthe setup of {real, ProGAN seed v#i}, we show the fine-tuned classifier performance in the “Dfs” columns in Ta-ble 7 and Table 8. It turns out that the immunized classifiercompletely regains performance over blur, cropping and re-lighting attacks, and partially regains performance over theothers. However, the recovery from combination attack isminimal due to its highest complexity. In addition, ourmethod consistently outperforms the method of Marra etal. [45] under each attack after immunization, while theirsdoes not effectively benefit from such immunization.

4.5. Fingerprint visualization

Given the setup of {real, ProGAN seed v#i}, we alter-natively apply the fingerprint visualization network (Sec-tion 3.3) to attribute images. We show the attribution perfor-mance in the “Our visNet” row in Table 3, which are com-

(a) No attack (b) Noise (c) Blur (d) Cropping (e) Compression (f) Relighting (g) Combination

Figure 6. Image samples for the attacks and defenses of our attribution network.Table 7. Classification accuracy (%) of our network w.r.t. different perturbation attacks before or after immunization on CelebA {real,ProGAN seed v#i}. The best performance is highlighted in bold.

CelebANoise Blur Cropping Compression Relighting Combination

Atk Dfs Atk Dfs Atk Dfs Atk Dfs Atk Dfs Atk Dfs

PRNU [45] 57.88 63.82 27.37 42.43 9.84 10.68 26.15 44.55 86.59 87.02 19.93 21.77Ours 9.14 93.02 49.64 97.20 46.80 98.28 8.77 88.02 94.02 98.66 19.31 72.64

Table 8. Classification accuracy (%) of our network w.r.t. different perturbation attacks before or after immunization on LSUN bedroom{real, ProGAN seed v#i}. The best performance is highlighted in bold.

LSUNNoise Blur Cropping Compression Relighting Combination

Atk Dfs Atk Dfs Atk Dfs Atk Dfs Atk Dfs Atk Dfs

PRNU [45] 39.59 40.97 26.92 30.79 9.30 9.42 18.27 23.66 60.86 63.31 16.54 16.89Ours 11.80 95.30 74.48 96.68 86.20 97.30 24.73 92.40 62.21 97.36 24.44 83.42

Figure 7. Visualization of model and image fingerprint samples.Their pairwise interactions are shown as the confusion matrix.

parable to that of the attribution model. Figure 7 visualizesface fingerprints. Bedroom fingerprints are shown in thesupplementary material. It turns out that image fingerprintsmaximize responses only to their own model fingerprints,which supports effective attribution. To attribute the real-world image, it is sufficient for the fingerprint to focus onlyon the eyes. To attribute the other images, the fingerprintsalso consider clues from the background, which, comparedto foreground faces, is more variant and harder for GANs to

approximate realistically [2].

5. Conclusion

We have presented the first study of learning GAN fin-gerprints towards image attribution. Our experiments showthat even a small difference in GAN training (e.g., the dif-ference in initialization) can leave a distinct fingerprint thatcommonly exists over all its generated images. That enablesfine-grained image attribution and model attribution. Fur-ther encouragingly, fingerprints are persistent across differ-ent frequencies and different patch sizes, and are not biasedby GAN artifacts. Even though fingerprints can be deteri-orated by several image perturbation attacks, they are ef-fectively immunizable by simple finetuning. Comparisonsalso show that, in a variety of conditions, our learned fin-gerprints are consistently superior to the very recent base-line [45] for attribution, and consistently outperform incep-tion features [52] for cross-source distinguishability.

Acknowledgement

This project was partially funded by DARPA MediForprogram under cooperative agreement FA87501620191.We acknowledge the Maryland Advanced Research Com-puting Center for providing computing resources. We thankHao Zhou for helping with the relighting experiments. Wealso thank Yaser Yacoob and Abhinav Shrivastava for con-structive advice in general.

References[1] Deep fakes: How they are made and how they can be

detected. https://www.nbcnews.com/mach/video/deep-fakes-how-they-are-made-and-how-they-can-be-detected-1354417219989. 1

[2] How to recognize fake ai-generated images.https://medium.com/@kcimc/how-to-recognize-fake-ai-generated-images-4d1f6f9a2842. 8

[3] In the age of a.i., is seeing still believing?https://www.newyorker.com/magazine/2018/11/12/in-the-age-of-ai-is-seeing-still-believing. 1

[4] Model gallery. https://www.microsoft.com/en-us/cognitive-toolkit/features/model-gallery. 2

[5] The value of stolen data on the dark web.https://darkwebnews.com/dark-web/value-of-stolen-data-dark-web. 2

[6] You thought fake news was bad? deepfakes are where truth goes to die.https://www.theguardian.com/technology/2018/nov/12/deep-fakes-fake-news-truth. 1

[7] Darius Afchar, Vincent Nozick, Junichi Yamagishi, and IsaoEchizen. Mesonet: a compact facial video forgery detectionnetwork. In 2018 IEEE International Workshop on Informa-tion Forensics and Security (WIFS), pages 1–7. IEEE, 2018.2

[8] Sadia Afroz, Aylin Caliskan Islam, Ariel Stolerman, RachelGreenstadt, and Damon McCoy. Doppelganger finder: Tak-ing stylometry to the underground. In Security and Pri-vacy (SP), 2014 IEEE Symposium on, pages 212–226. IEEE,2014. 3

[9] Grigory Antipov, Moez Baccouche, and Jean-Luc Dugelay.Face aging with conditional generative adversarial networks.In Image Processing (ICIP), 2017 IEEE International Con-ference on, pages 2089–2093. IEEE, 2017. 2

[10] Martin Arjovsky, Soumith Chintala, and Leon Bottou.Wasserstein generative adversarial networks. In Interna-tional Conference on Machine Learning, pages 214–223,2017. 1, 2

[11] Jawadul H Bappy, Amit K Roy-Chowdhury, Jason Bunk,Lakshmanan Nataraj, and BS Manjunath. Exploiting spatialstructure for localizing manipulated image regions. In Pro-ceedings of the IEEE International Conference on ComputerVision, pages 4970–4979, 2017. 1, 2

[12] David Bau, Jun-Yan Zhu, Hendrik Strobelt, Bolei Zhou,Joshua B. Tenenbaum, William T. Freeman, and AntonioTorralba. Visualizing and understanding generative adver-sarial networks. In International Conference on LearningRepresentations, 2019. 1

[13] Belhassen Bayar and Matthew C Stamm. A deep learningapproach to universal image manipulation detection usinga new convolutional layer. In Proceedings of the 4th ACMWorkshop on Information Hiding and Multimedia Security,pages 5–10. ACM, 2016. 1, 2

[14] Marc G Bellemare, Ivo Danihelka, Will Dabney, Shakir Mo-hamed, Balaji Lakshminarayanan, Stephan Hoyer, and RemiMunos. The cramer distance as a solution to biased wasser-

stein gradients. arXiv preprint arXiv:1705.10743, 2017. 2,5, 16, 30

[15] Urs Bergmann, Nikolay Jetchev, and Roland Vollgraf. Learn-ing texture manifolds with the periodic spatial gan. In Pro-ceedings of the 34th International Conference on MachineLearning-Volume 70, pages 469–477. JMLR. org, 2017. 2

[16] Paolo Bestagini, Simone Milani, Marco Tagliasacchi, andStefano Tubaro. Local tampering detection in video se-quences. In 2013 IEEE 15th International Workshop on Mul-timedia Signal Processing (MMSP), pages 488–493. IEEE,2013. 1

[17] Mikoaj Binkowski, Dougal J. Sutherland, Michael Arbel,and Arthur Gretton. Demystifying MMD GANs. In Interna-tional Conference on Learning Representations, 2018. 2, 5,17, 31

[18] Luca Bondi, Silvia Lameri, David Guera, Paolo Bestagini,Edward J Delp, Stefano Tubaro, et al. Tampering detectionand localization through clustering of camera-based cnn fea-tures. In IEEE Conference on Computer Vision and PatternRecognition Workshops (CVPRW), pages 1855–1864, 2017.2

[19] Andrew Brock, Jeff Donahue, and Karen Simonyan. Largescale GAN training for high fidelity natural image synthe-sis. In International Conference on Learning Representa-tions, 2019. 1, 2

[20] Peter Burt and Edward Adelson. The laplacian pyramid asa compact image code. IEEE Transactions on Communica-tions, 31(4):532–540, 1983. 4

[21] Mo Chen, Jessica Fridrich, Miroslav Goljan, and Jan Lukas.Determining image origin and integrity using sensor noise.IEEE Transactions on Information Forensics and Security,3(1):74–90, 2008. 2, 3

[22] Davide Cozzolino, Giovanni Poggi, and Luisa Verdoliva.Recasting residual-based local descriptors as convolutionalneural networks: an application to image forgery detec-tion. In Proceedings of the 5th ACM Workshop on Informa-tion Hiding and Multimedia Security, pages 159–164. ACM,2017. 1, 2

[23] Davide Cozzolino, Justus Thies, Andreas Rossler, ChristianRiess, Matthias Nießner, and Luisa Verdoliva. Forensictrans-fer: Weakly-supervised domain adaptation for forgery detec-tion. arXiv preprint arXiv:1812.02510, 2018. 2

[24] Davide Cozzolino and Luisa Verdoliva. Noiseprint: acnn-based camera model fingerprint. arXiv preprintarXiv:1808.08396, 2018. 2, 3

[25] DC Dowson and BV Landau. The frechet distance betweenmultivariate normal distributions. Journal of MultivariateAnalysis, 12(3):450–455, 1982. 5, 12

[26] Luca DAmiano, Davide Cozzolino, Giovanni Poggi, andLuisa Verdoliva. A patchmatch-based dense-field algorithmfor video copy–move detection and localization. IEEETransactions on Circuits and Systems for Video Technology,29(3):669–682, 2019. 1, 2

[27] Hany Farid. Photo forensics. MIT Press, 2016. 1, 2[28] Jessica Fridrich. Digital image forensics: there is more to a

picture than meets the eye. Springer New York, 2012. 2

[29] Jessica Fridrich and Jan Kodovsky. Rich models for steganal-ysis of digital images. IEEE Transactions on InformationForensics and Security, 7(3):868–882, 2012. 2

[30] Yoav Goldberg. A primer on neural network models for nat-ural language processing. Journal of Artificial IntelligenceResearch, 57:345–420, 2016. 2

[31] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, BingXu, David Warde-Farley, Sherjil Ozair, Aaron Courville, andYoshua Bengio. Generative adversarial nets. In Advances inNeural Information Processing Systems, pages 2672–2680,2014. 1, 2

[32] Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, VincentDumoulin, and Aaron C Courville. Improved training ofwasserstein gans. In Advances in Neural Information Pro-cessing Systems, pages 5767–5777, 2017. 1, 2, 4

[33] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.Deep residual learning for image recognition. In Proceed-ings of the IEEE Conference on Computer Vision and PatternRecognition, pages 770–778, 2016. 2

[34] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner,Bernhard Nessler, and Sepp Hochreiter. Gans trained by atwo time-scale update rule converge to a local nash equilib-rium. In Advances in Neural Information Processing Sys-tems, pages 6626–6637, 2017. 5

[35] Minyoung Huh, Andrew Liu, Andrew Owens, and Alexei AEfros. Fighting fake news: Image splice detection vialearned self-consistency. In Proceedings of the EuropeanConference on Computer Vision (ECCV), pages 101–117,2018. 1, 2

[36] Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, and Alexei AEfros. Image-to-image translation with conditional adver-sarial networks. In Proceedings of the IEEE Conferenceon Computer Vision and Pattern Recognition, pages 1125–1134, 2017. 1, 2, 4

[37] Yangqing Jia, Evan Shelhamer, Jeff Donahue, SergeyKarayev, Jonathan Long, Ross Girshick, Sergio Guadarrama,and Trevor Darrell. Caffe: Convolutional architecture for fastfeature embedding. In Proceedings of the 22nd ACM Inter-national Conference on Multimedia, pages 675–678. ACM,2014. 2

[38] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen.Progressive growing of GANs for improved quality, stabil-ity, and variation. In International Conference on LearningRepresentations, 2018. 1, 2, 5, 12, 14, 28

[39] Gerhard C Langelaar, Iwan Setyawan, and Reginald L La-gendijk. Watermarking digital image and video data. astate-of-the-art overview. IEEE Signal Processing Magazine,17(5):20–46, 2000. 3

[40] Chuan Li and Michael Wand. Precomputed real-time texturesynthesis with markovian generative adversarial networks. InEuropean Conference on Computer Vision, pages 702–716.Springer, 2016. 2

[41] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang.Deep learning face attributes in the wild. In Proceedings ofInternational Conference on Computer Vision (ICCV), 2015.5, 13

[42] Jan Lukas, Jessica Fridrich, and Miroslav Goljan. Digitalcamera identification from sensor pattern noise. IEEE Trans-actions on Information Forensics and Security, 1(2):205–214, 2006. 2, 3

[43] Laurens van der Maaten and Geoffrey Hinton. Visualizingdata using t-sne. Journal of Machine Learning Research,9(Nov):2579–2605, 2008. 1, 12

[44] Francesco Marra, Diego Gragnaniello, Davide Cozzolino,and Luisa Verdoliva. Detection of gan-generated fake imagesover social networks. In 2018 IEEE Conference on Multi-media Information Processing and Retrieval (MIPR), pages384–389. IEEE, 2018. 1, 2

[45] Francesco Marra, Diego Gragnaniello, Luisa Verdoliva, andGiovanni Poggi. Do gans leave artificial fingerprints? In2019 IEEE Conference on Multimedia Information Process-ing and Retrieval (MIPR), pages 506–511. IEEE, 2019. 2, 3,4, 5, 6, 7, 8

[46] Takeru Miyato, Toshiki Kataoka, Masanori Koyama, andYuichi Yoshida. Spectral normalization for generative ad-versarial networks. In International Conference on LearningRepresentations, 2018. 2, 5, 15, 29

[47] Huaxiao Mo, Bolin Chen, and Weiqi Luo. Fake faces identi-fication via convolutional neural network. In Proceedings ofthe 6th ACM Workshop on Information Hiding and Multime-dia Security, pages 43–47. ACM, 2018. 1, 2

[48] Seong Joon Oh, Max Augustin, Bernt Schiele, and MarioFritz. Towards reverse-engineering black-box neural net-works. In Internation Conference on Representation Learn-ing (ICLR), 2018. 7

[49] Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Chris-tian Riess, Justus Thies, and Matthias Nießner. Faceforen-sics: A large-scale video dataset for forgery detection in hu-man faces. arXiv preprint arXiv:1803.09179, 2018. 2

[50] Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Chris-tian Riess, Justus Thies, and Matthias Nießner. Faceforen-sics++: Learning to detect manipulated facial images. arXivpreprint arXiv:1901.08971, 2019. 2

[51] Lalit Kumar Saini and Vishal Shrivastava. A survey of dig-ital watermarking techniques and its applications. CoRR,abs/1407.4735, 2014. 3

[52] Tim Salimans, Ian Goodfellow, Wojciech Zaremba, VickiCheung, Alec Radford, and Xi Chen. Improved techniquesfor training gans. In Advances in Neural Information Pro-cessing Systems (NIPS), pages 2226–2234, 2016. 1, 2, 5, 6,7, 8, 12

[53] Husrev Taha Sencar and Nasir Memon. Digital image foren-sics. Counter-Forensics: Attacking Image Forensics, pages327–366, 2013. 1

[54] Soumyadip Sengupta, Angjoo Kanazawa, Carlos D Castillo,and David W Jacobs. Sfsnet: Learning shape, reflectanceand illuminance of facesin the wild’. In Proceedings of theIEEE Conference on Computer Vision and Pattern Recogni-tion, pages 6296–6305, 2018. 7

[55] Lawrence Sirovich and Michael Kirby. Low-dimensionalprocedure for the characterization of human faces. OpticalSociety of America, 4(3):519–524, 1987. 5, 6, 7

[56] Efstathios Stamatatos. A survey of modern authorship attri-bution methods. Journal of the Association for InformationScience and Technology, 60(3):538–556, 2009. 3

[57] Supasorn Suwajanakorn, Steven M Seitz, and IraKemelmacher-Shlizerman. Synthesizing obama: learn-ing lip sync from audio. ACM Transactions on Graphics(TOG), 36(4):95, 2017. 1

[58] Mitchell D Swanson, Mei Kobayashi, and Ahmed H Tew-fik. Multimedia data-embedding and watermarking tech-nologies. Proceedings of the IEEE, 86(6):1064–1087, 1998.3

[59] Shahroz Tariq, Sangyup Lee, Hoyoung Kim, Youjin Shin,and Simon S Woo. Detecting both machine and human cre-ated fake face images in the wild. In Proceedings of the2nd International Workshop on Multimedia Privacy and Se-curity, pages 81–87. ACM, 2018. 1, 2

[60] Justus Thies, Michael Zollhofer, Matthias Nießner, Levi Val-gaerts, Marc Stamminger, and Christian Theobalt. Real-timeexpression transfer for facial reenactment. ACM Transac-tions on Graphics (TOG), 34(6):183–1, 2015. 1, 2

[61] Justus Thies, Michael Zollhofer, Marc Stamminger, Chris-tian Theobalt, and Matthias Nießner. Face2face: Real-timeface capture and reenactment of rgb videos. In Proceed-ings of the IEEE Conference on Computer Vision and PatternRecognition, pages 2387–2395, 2016. 1, 2

[62] Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, andShin’ichi Satoh. Embedding watermarks into deep neuralnetworks. In Proceedings of the 2017 ACM on InternationalConference on Multimedia Retrieval, pages 269–277. ACM,2017. 2, 3

[63] Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, ThomasFunkhouser, and Jianxiong Xiao. Lsun: Construction of alarge-scale image dataset using deep learning with humansin the loop. arXiv preprint arXiv:1506.03365, 2015. 5, 27

[64] Ning Yu, Connelly Barnes, Eli Shechtman, Sohrab Amirgh-odsi, and Michal Lukac. Texture mixer: A network for con-trollable synthesis and interpolation of texture. In Proceed-ings of the IEEE Conference on Computer Vision and PatternRecognition, pages 12164–12173, 2019. 1

[65] Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc PhStoecklin, Heqing Huang, and Ian Molloy. Protecting intel-lectual property of deep neural networks with watermarking.In Proceedings of the 2018 on Asia Conference on Computerand Communications Security, pages 159–172. ACM, 2018.2, 3

[66] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shecht-man, and Oliver Wang. The unreasonable effectiveness ofdeep features as a perceptual metric. In Proceedings of theIEEE Conference on Computer Vision and Pattern Recogni-tion, 2018. 7, 19, 33

[67] Peng Zhou, Xintong Han, Vlad I Morariu, and Larry S Davis.Two-stream neural networks for tampered face detection.In 2017 IEEE Conference on Computer Vision and PatternRecognition Workshops (CVPRW), pages 1831–1839. IEEE,2017. 1, 2

[68] Peng Zhou, Xintong Han, Vlad I Morariu, and Larry S Davis.Learning rich features for image manipulation detection. In

Proceedings of the IEEE Conference on Computer Visionand Pattern Recognition, pages 1053–1061, 2018. 1, 2

[69] Yang Zhou, Zhen Zhu, Xiang Bai, Dani Lischinski, DanielCohen-Or, and Hui Huang. Non-stationary texture synthesisby adversarial expansion. ACM Transactions on Graphics(TOG), 37(4):49:1–49:13, 2018. 2

[70] Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei AEfros. Unpaired image-to-image translation using cycle-consistent adversarial networks. In Proceedings of the IEEEInternational Conference on Computer Vision, pages 2223–2232, 2017. 1, 2

[71] Jun-Yan Zhu, Richard Zhang, Deepak Pathak, Trevor Dar-rell, Alexei A Efros, Oliver Wang, and Eli Shechtman. To-ward multimodal image-to-image translation. In Advancesin Neural Information Processing Systems, 2017. 1, 2

[72] Michael Zollhofer, Justus Thies, Pablo Garrido, DerekBradley, Thabo Beeler, Patrick Perez, Marc Stamminger,Matthias Nießner, and Christian Theobalt. State of the arton monocular 3d face reconstruction, tracking, and applica-tions. In Computer Graphics Forum, volume 37, pages 523–550. Wiley Online Library, 2018. 1

6. Supplementary materialA. Frechet Distance ratio

As described in Section 4.1 in the main paper, we use theratio of inter-class and intra-class Frechet Distance [25],denoted as FD ratio, to evaluate the distinguishability of afeature representation across classes. For inter-class FD cal-culation, we first measure the FD between two feature dis-tributions from a pair of different classes, and then averageover each possible pair. For intra-class FD calculation, wefirst measure the FD between two feature distributions fromtwo disjoint sets of images in the same class, where we splitthe class equally, and then average over each class.

Mathematically,

FD ratio =inter-class FDintra-class FD

(5)

inter-class FD =

1

||{(y, y)|y 6= y}||∑y 6=y

FD({f(Ii)|yi = y

},{f(Ij)|yj = y

})(6)

intra-class FD =

1

||Y||∑

y∈Y,{i}∩{j}=∅

FD({f(Ii)|yi = y

},{f(Ij)|yj = y

})(7)

where Y is the class set for image sources and f(·) is a fea-ture representation mapping from image domain to a featuredomain.

Then in all the tables in the main paper, we compare FDratio between the inception feature [52] as a baseline andour learned features. The larger the ratio, the more dis-tinguishable the feature representation across sources. Wealso show in Figure 1 in the main paper the t-sne visualiza-tion [43] of the two features.

B. Face samples

We show more face samples corresponding to the exper-iments in the main paper. See Figure 8 to 21.

C. Bedroom samples

We show bedroom samples corresponding to the exper-iments in the main paper. See Figure 22 to 36. In gen-eral, LSUN bedroom dataset is more challenging to a GANmodel because of lack of image alignment. However, Pro-GAN [38] still performs equally well on this dataset anddoes not affect our conclusions in the main paper.

Figure 8. Face samples from CelebA real dataset [41]

Figure 9. Face samples from ProGAN [38]

Figure 10. Face samples from SNGAN [46]

Figure 11. Face samples from CramerGAN [14]

Figure 12. Face samples from MMDGAN [17]

Figure 13. Arbitrary face samples from the setup of {real, ProGAN seed v#i} where i ∈ {1, ..., 10}.

Figure 14. Filtered face samples from the setup of {real, ProGAN seed v#i} with the top 10% largest Perceptual Similarity [66] to realdataset distribution.

Figure 15. Arbitrary face samples without attack from the setup of {real, ProGAN seed v#i}.

Figure 16. Arbitrary face samples with noise attack from the setup of {real, ProGAN seed v#i}.

Figure 17. Arbitrary face samples with blur attack from the setup of {real, ProGAN seed v#i}.

Figure 18. Arbitrary face samples with cropping attack from the setup of {real, ProGAN seed v#i}.

Figure 19. Arbitrary face samples with JPEG compression attack from the setup of {real, ProGAN seed v#i}.

Figure 20. Arbitrary face samples with relighting attack from the setup of {real, ProGAN seed v#i}.

Figure 21. Arbitrary face samples with the combination attack from the setup of {real, ProGAN seed v#i}.

Figure 22. Bedroom samples from LSUN real dataset [63]

Figure 23. Bedroom samples from ProGAN [38]

Figure 24. Bedroom samples from SNGAN [46]

Figure 25. Bedroom samples from CramerGAN [14]

Figure 26. Bedroom samples from MMDGAN [17]

Figure 27. Arbitrary bedroom samples from the setup of {real, ProGAN seed v#i} where i ∈ {1, ..., 10}.

Figure 28. Filtered bedroom samples from the setup of {real, ProGAN seed v#i} with the top 10% largest Perceptual Similarity [66] toreal dataset distribution.

Figure 29. Arbitrary bedroom samples without attack from the setup of {real, ProGAN seed v#i}.

Figure 30. Arbitrary bedroom samples with noise attack from the setup of {real, ProGAN seed v#i}.

Figure 31. Arbitrary bedroom samples with blur attack from the setup of {real, ProGAN seed v#i}.

Figure 32. Arbitrary bedroom samples with cropping attack from the setup of {real, ProGAN seed v#i}.

Figure 33. Arbitrary bedroom samples with JPEG compression attack from the setup of {real, ProGAN seed v#i}.

Figure 34. Arbitrary bedroom samples with relighting attack from the setup of {real, ProGAN seed v#i}.

Figure 35. Arbitrary bedroom samples with the combination attack from the setup of {real, ProGAN seed v#i}.

Figure 36. Visualization of bedroom model and image fingerprint samples. Their pairwise interactions are shown as the confusion matrix.It turns out that image fingerprints maximize responses only to their own model fingerprints, which supports effective attribution.