SpectralCanary: Simple Low-Frequency Canary Traces for Text-to-Image Dataset-Use Auditing

Forum topic · 小凯 · 2026-10-24

Summary

Auditing whether a text-to-image (T2I) model was fine-tuned on a specific image collection is difficult, since models can absorb set-level visual traits without reproducing training images. Proactive dataset-use auditing addresses this by planting a shared signal in the dataset before release, then checking suspect models' outputs for that signal. SpectralCanary uses a smooth low-pass mask to blend a fixed canary image into every image in the collection while keeping captions unchanged, requiring neither auxiliary generation nor per-image optimization; a lightweight verifier detects the transferred signal in generated outputs. Across eight tests on the Pokemon dataset and three realistic data transformations, it achieves the highest average per-generation TPR@1% FPR (91.1%) and model-level accuracy of 94.8% with a fixed threshold using 30 generations. On five datasets spanning art, medical, satellite, and fashion domains, it reaches an average TPR@1% FPR of 92.4% while preserving released image quality (SSIM 0.989, LPIPS 0.022). Ablations confirm that low-frequency placement transfers more reliably than mid/high frequency, and the most effective adaptive removal attack requires aggressive edits causing more than 25 ΔFID points of quality loss. Paper: arXiv 2610.31659.

Overview

Field: Computer Vision Authors: Sy-Tuyen Ho, Anirudh Satheesh, Soham Chawathe, Huy Nghiem, Yongkyun Lee, Andrew Adams Schoen, Furong Huang arXiv: 2610.31659

Abstract (translated)

Auditing whether a text-to-image (T2I) model was fine-tuned on a particular image collection is very difficult: models can absorb set-level visual features without reproducing training images. Proactive dataset-use auditing plants a shared signal into a dataset before release, then later checks whether that signal appears in a suspect model's generated outputs. Existing methods often trade off verifiability, fidelity, robustness, and deployability.

SpectralCanary blends a fixed canary image into every image of the collection using a smooth low-pass mask while leaving captions unchanged, requiring neither auxiliary generation nor per-image optimization. A lightweight verifier detects the transferred signal in suspect model outputs.

Key results

Across eight tests on the Pokemon dataset and three realistic data transformations: highest average per-generation TPR@1% FPR of 91.1%, and 94.8% model-level accuracy with a fixed threshold using 30 generations.
Across five datasets spanning art, medical, satellite, and fashion domains: average TPR@1% FPR of 92.4%, while preserving released image quality (SSIM 0.989, LPIPS 0.022).
Ablations confirm low-frequency placement transfers more reliably than mid/high-frequency variants.
Under evaluated adaptive attacks, the most effective removal requires aggressive modification, incurring more than 25 ΔFID points of quality loss.

Why it matters

SpectralCanary offers an embarrassingly simple yet effective way to prove whether a T2I model used a released dataset, with minimal impact on image quality and strong robustness against removal attempts.

--- *Collected automatically on 2026-10-24.*