Vision-Encoder Behavioral Fingerprints of Image-to-Image Generative Models: A Training-Paradigm-Driven Taxonomy of Six Commercial APIs
A reference-anchored forensic study of six production image-to-image APIs (gpt-image-1, Gemini 2.5 Flash Image, Flux Kontext, SDXL img2img, SD3 img2img, Qwen Image Edit) under content-adaptive sub-JND perturbation. Across a 3,588-call corpus, the systems partition into two image-invariant behavioral bands whose discriminating variable is training paradigm rather than architecture family, enabling 51.4% six-way attribution from a single output plus a clean reference and exposing differential perturbation survival across deployed commercial systems.
H. Hill, June 2026. hunter@akaeon.com
Published on arXiv: arxiv.org/abs/2606.14787
Abstract
We study six production image-to-image AI systems (gpt-image-1, Gemini 2.5 Flash Image, Flux Kontext, SDXL img2img, SD3 img2img, and Qwen Image Edit) under a content-adaptive sub-JND adversarial perturbation pipeline, scoring all outputs by frozen DINOv2 ViT-B/14 token distances against clean references. Across a 3,588-call corpus spanning COCO photographs, CelebA-HQ portraits, and AI-generated inputs, the six systems partition into two image-invariant behavioral bands on a 2D (patch_mean, ssim_clean) plane: edit-trained models (Flux Kontext, Qwen Edit, Gemini) cluster in a tight band, while T2I-base models adapted at sampling time (SDXL, SD3, gpt-image-1) cluster in a drift band. The discriminating variable is training paradigm rather than architecture family: AI identity explains 69.5% of behavioral variance while image domain explains 0.2%. The discriminating axis divides the diffusion family (Flux Kontext tight, SDXL/SD3 drift) and the multimodal-AR family (Qwen Edit tight, gpt-image-1 drift). Six-way leave-one-out attribution accuracy is 51.4% [49.3, 53.4] versus 16.7% chance; three-way pilot accuracy is 76.6% [70.3, 84.4]. Two blind baselines on the identical corpus (AEROBLADE 0.222, PRISM-style 0.373) trail this substantially and are at chance within the edit-trained band, demonstrating that the reference image is the key forensic signal rather than the detector architecture. We also quantify differential perturbation survival across these architectures: roughly 98% intact through Gemini, roughly 80% through Flux despite SSIM 0.99 visual fidelity, and overwritten by gpt-image-1, providing a systematic measurement of how the diffusion-purification effect varies across deployed commercial img2img systems. The results reframe pixel-domain perturbation pipelines from defenses into forensic primitives for reference-anchored AI-processing attribution, with deployment-ready thresholds and a behavioral feature space validated at corpus scale.
1. Introduction
Pixel-domain adversarial perturbations are widely deployed as protective overlays against image-to-image generative AI. Systems including Glaze (Shan et al., 2023), Mist (Liang et al., 2023), and PhotoGuard (Salman et al., 2023) optimize sub-just-noticeable-difference pixel modifications to disrupt the latent representations of text-to-image diffusion models. As commercial image-to-image AIs proliferate, the question of how pixel-domain perturbations interact with these systems becomes critically important: which AIs can be defended against, which can be attributed from their output behavior, and what behavioral signatures do commercial img2img systems leave on their outputs?
Answering these questions empirically is difficult for three reasons. Commercial AI systems are black boxes whose internal architectures, training data, and sampling procedures are not publicly documented. The existing AI-image attribution literature operates predominantly on text-to-image outputs in blind settings (Yu et al., 2019; Asnani et al., 2023; Corvi et al., 2023; Ricco et al., 2025), where no reference image is available, while image-to-image attribution requires a different methodology because a clean reference exists by construction. Finally, the behavioral signature of an img2img system is shaped by the interaction of architecture, training paradigm, and sampling procedure, and disentangling these factors requires a corpus spanning multiple architectures and image domains.
Our methodology is reference-anchored: for each AI output we compute per-patch and global DINOv2 cosine distances of a perturbed image against the corresponding clean input, which is summarized as a 2D (patch_mean, ssim_clean) feature. We test this framework on a 200-image corpus spanning COCO val2017 photographs, CelebA-HQ-256 face portraits, and Flux-generated images, with three repetitions per (image, AI) cell, yielding 3,588 valid API calls at 99.7% success after retries. We use leave-one-out nearest-centroid classification with cluster-bootstrap confidence intervals to quantify how identifiable each AI is from a single output image.
The behavioral taxonomy is identifiable from a single output image plus a clean reference at 51.4% six-way LOO accuracy [49.3, 53.4] versus 16.7% chance, with AI identity explaining 69.5% of behavioral variance versus 0.2% for image domain. Per-image attribution averaging three repetitions on a focused 3-AI pilot reaches 82.2% [73.3, 90.0]. We additionally measure differential perturbation survival: roughly 98% of the adversarial signal survives Gemini, roughly 80% survives Flux Kontext despite SSIM 0.99 visual fidelity, and gpt-image-1 overwrites the perturbation entirely with its own generative variance.
Our contributions are:
- A two-band training-paradigm taxonomy of image-to-image AIs, validated across six commercial APIs and three image domains, with AI identity explaining 69.5% of behavioral variance and image domain only 0.2%.
- A reference-anchored attribution framework achieving 51.4% [49.3, 53.4] six-way LOO accuracy at corpus scale and 82.2% [73.3, 90.0] three-rep per-image accuracy on the focused pilot, on previously-unstudied commercial img2img APIs. A head-to-head on the identical corpus (§5.4) confirms the reference is load-bearing: two blind attributors (AEROBLADE 0.222, PRISM-style 0.373) trail the reference-anchored 0.513 and are at chance within the edit-trained band.
- Quantitative measurement of differential perturbation survival across architecture classes (roughly 98% through Gemini, roughly 80% through Flux Kontext despite SSIM 0.99 fidelity, overwritten by gpt-image-1), the first such measurement across deployed commercial img2img systems, demonstrating that the diffusion-purification effect (Nie et al., 2022; Cao et al., 2023) varies systematically with training paradigm.
- A 3,588-call cross-AI corpus (200 images × 6 AIs × 3 reps across COCO, CelebA-HQ, and Flux-generated inputs) released alongside the paper, with documented per-AI per-domain safety-filter failure rates.
2. Related Work
Reference-anchored AI-image detection. Self-supervised vision encoders have been established as strong backbones for AI-generated image detection. AEROBLADE (Ricker et al., 2024) uses VAE reconstruction error from diffusion autoencoders and reports AP ≈ 0.992. DinoLizer (Doi et al., 2025) uses DINOv2 patch features for inpainting localization. DINO-Detect (Shen et al., 2025) uses DINOv3 teacher-student distillation for blur-robust AI image classification. WaRPAD (Choi et al., 2025) addresses center-crop and JPEG robustness via wavelet-perturbation consistency. We use DINOv2 cosine distance as a measurement primitive; §3 confirms AEROBLADE-class detection performance on our setup as a sanity check.
Generative model attribution from output. A substantial body of work attributes generated images to their producing model. Yu et al. (2019) established GAN spatial frequency fingerprints. Asnani et al. (2023) inferred generator hyperparameters from generated images across 116 generators. Corvi et al. (2023) characterized spectral signatures of latent diffusion models. PRISM (Ricco et al., 2025) reports 92% attribution accuracy via radial-frequency signatures on 36,000 images from six generators. These methods are predominantly blind (no reference required) and operate on text-to-image outputs. Our work differs in two respects: we attribute image-to-image outputs where a clean reference is available by construction, and we target previously-unstudied commercial APIs. §5.4 makes this contrast empirical rather than definitional: running AEROBLADE and a PRISM-style attributor on our exact corpus, the blind methods reach 0.22 to 0.37 six-way accuracy versus 0.51 for the reference-anchored detector, and are at chance on the edit-trained models whose outputs closely preserve the input.
Adversarial protection and diffusion-based purification. Protection systems including Glaze (Shan et al., 2023), Mist (Liang et al., 2023), and PhotoGuard (Salman et al., 2023) optimize sub-JND perturbations against T2I diffusion. A parallel line of work has established that diffusion-based denoising itself removes adversarial perturbations: DiffPure (Nie et al., 2022) demonstrated the general principle for classifier adversarial defense, while IMPRESS (Cao et al., 2023) applied diffusion purification specifically to remove Glaze protection. Subsequent work has shown that protections degrade under realistic transit (Hönig et al., 2024; Tang et al., 2025; An et al., USENIX 2024). Xue & Chen (2024) established that pixel-space diffusion is more robust to perturbation than latent diffusion. Our §5.3 extends this line by quantifying perturbation survival across six deployed commercial img2img APIs and showing that survival tracks training paradigm.
3. Method
3.1 Behavioral feature space
For an AI output image O and clean reference image R, both resized to 518×518, we compute a 2D behavioral feature using a frozen DINOv2 ViT-B/14 encoder (Oquab et al., 2024). The first feature, patch_mean, is the average per-patch cosine distance between DINOv2 last-layer token embeddings of O and R, averaged over the 37×37 spatial grid. This captures how much the AI modified the image at the semantic-token level. The second feature, ssim_clean, is the luminance structural similarity (Wang et al., 2004) between O and R, capturing how much the AI preserved pixel-level visual fidelity. Together these two features place each AI output as a point on a 2D plane.
We choose DINOv2 ViT-B/14 over CLIP B/32, CLIP L/14, SigLIP B/16, and EVA02-L/14 because pilot evaluation showed it produces the highest cross-image self-correlation (0.115 versus 0.06 or less for the others) and the largest mean shift on perturbed inputs (0.13 to 0.18 at the per-image level) while preserving spatial resolution at 37×37. The 5× spatial-sampling advantage over ViT-L/14-class encoders is decisive at our perturbation budget; see supplementary material for the full encoder comparison.
3.2 Behavioral band classification
We classify AI outputs into two behavioral bands using thresholds on patch_mean derived from the empirical distribution: tight (patch_mean ≤ 0.25) and drift (patch_mean > 0.25). The valley at 0.25 emerged organically from the data; the histogram of patch_mean across all 3,588 corpus calls has a bimodal structure with edit-trained models piling up on the left and T2I+img2img models grouping together on the right.
For attribution beyond band assignment, we use leave-one-out nearest-centroid classification on the 2D feature plane. The centroid for each AI is the mean (patch_mean, ssim_clean) across all of that AI's calls except the held-out point; the held-out point is classified to whichever AI's centroid is closest in Euclidean distance. The classifier has no learned parameters and no hyperparameters, which is deliberate: we want the classification accuracy to reflect the geometry of the data rather than a clever classifier learning subtle patterns. A learned classifier would achieve higher accuracy but obscure the geometric finding.
3.3 Statistical inference
All bracketed intervals in this paper are 95% confidence intervals computed via 2,000-iteration nonparametric cluster bootstrap, resampling at the image cluster level (preserving all repetitions per image as a unit) to correctly handle within-image correlation. Wilson intervals treating individual repetitions as independent would give narrower bounds and would mis-state reviewer-relevant uncertainty for this clustered sample structure.
4. Experimental Setup
4.1 Datasets
We evaluate on two datasets. The pilot dataset comprises 30 perturbed phone photographs sent to three commercial APIs (gpt-image-1, Gemini 2.5 Flash Image, Flux Kontext via Replicate) with three repetitions per (image, AI) cell, yielding 270 calls. The corpus dataset comprises 200 perturbed images spanning three domains (COCO val2017 n=100, CelebA-HQ-256 n=50, and Flux-generated images n=50) sent to six commercial APIs with three repetitions per (image, AI) cell, yielding 3,600 calls. After retries, 3,588 of 3,600 corpus calls (99.7%) succeeded; the 12 residual errors are safety-filter rejections of specific face portraits and are documented in §5.2.
The corpus extension adds three providers to the pilot lineup: stability-ai/sdxl with prompt_strength=0.3, stability-ai/stable-diffusion-3 with prompt_strength=0.3, and qwen/qwen-image-edit via Replicate. We pin prompt_strength=0.3 on SDXL and SD3 so they match Flux Kontext's by-design faithful-edit behavior; otherwise the default denoising strength regenerates the input entirely, conflating sampling parameter with architecture. Qwen Edit has no equivalent knob: its instruction-conditioned design naturally preserves the input. All AIs receive the identity prompt "Reproduce this image exactly. Preserve every detail faithfully."
4.2 Perturbation pipeline
Input images are perturbed using a custom-built content-adaptive pipeline (eps=0.10, jnd_budget=2.0, 120 PGD steps). For each 256×256 patch of a 768×768 input, the pipeline selects one of ten purpose-built attack functions (luminance, edge, frequency, CSF, ViT-patch-boundary, etc.) based on local pixel statistics, then jointly optimizes attack weights against an ensemble of frozen CLIP/SigLIP/EVA02 surrogates within an L∞ ≤ 0.10 and JND-bounded perceptual budget. All perturbed images are loaded through an EXIF-aware pipeline (a correction documented in supplementary material).
4.3 Detection sanity check
Before evaluating behavioral attribution, we confirmed that reference-anchored DINOv2 cosine distance reproduces AEROBLADE-class binary AI-rerender detection on our setup. On 100 (clean, adversarial) pairs against benign nulls (JPEG-Q85, resize 0.94), DINOv2 patch_p99 achieves AUROC = 1.0000 with TPR = 1.000 at FPR = 0. Against aggressive benign nulls including center crop, patch_p99 fails (AUROC = 0.75 due to spatial displacement) but DINOv2 CLS-token cosine distance recovers performance at AUROC = 0.989, with operating threshold cls_shift > 0.05. We use this CLS-token detector as the operational AI-rerender primitive for §5.3 perturbation-survival measurement; supplementary material reports the full detection experiment.
5. Experiments and Results
5.1 Cross-AI behavioral classification (pilot, 3 AIs)
We first ask whether three commercial img2img APIs can be discriminated from a single output image plus a clean reference. The per-AI distribution on the (patch_mean, ssim_clean) plane shows clear separation:
| AI | n | patch_mean (µ ± σ) | ssim_clean (µ ± σ) | dominant mode |
|---|---|---|---|---|
| Flux Kontext | 89 | 0.077 ± 0.042 | +0.989 ± 0.026 | tight (100%) |
| Gemini | 90 | 0.175 ± 0.075 | +0.880 ± 0.107 | tight (83%) |
| gpt-image-1 | 90 | 0.376 ± 0.057 | +0.703 ± 0.167 | drift (100%) |
Figure 1. Behavioral separation of three commercial img2img APIs on the 2D feature plane, with representative output rows. Each point is one (image, AI) call; the three AIs occupy non-overlapping regions of the plane.
Leave-one-out nearest-centroid classification on the 2D plane gives 76.6% [70.3, 84.4] overall three-way accuracy versus 33.3% chance. Per-AI accuracies vary substantially: Flux Kontext 0.978 [0.921, 1.000], gpt-image-1 0.822 [0.722, 0.911], Gemini 0.500 [0.378, 0.678]. Per-image attribution averaging three repetitions reaches 0.822 [0.733, 0.900]. Gemini's lower bound at 0.378 barely above chance reflects that its distribution overlaps both Flux's tight cluster and gpt-image-1's drift cluster; it sits in the middle and gets confused with both. Beyond per-call classification, for 26 of 30 images the per-image median patch_mean ordering Flux < Gemini < gpt-image-1 held, with the four exceptions occurring where Flux and Gemini were both extremely tight (both medians < 0.10) and their order swapped within measurement noise.
The pilot suggests three behavioral bands corresponding to three architecture classes (autoregressive vision-token generator giving drift; diffusion img2img giving tight; multimodal autoregressive giving mixed). §5.2 will show this reading is wrong at corpus scale: the correct structure is two bands tied to training paradigm, with Gemini's apparent middle position resolving into membership in the tight band.
5.2 Generalization across architectures and image domains (corpus, 6 AIs × 3 domains)
To test whether the behavioral structure generalizes beyond three APIs and one image domain, we ran the same protocol on the 200-image, three-domain corpus across six AIs. The per-(AI, domain) means show that the tight/drift partition holds in every domain:
| AI | Training | COCO patch_mean | Faces patch_mean | AI-gen patch_mean | Dominant mode |
|---|---|---|---|---|---|
| Flux Kontext | edit-trained | 0.069 ± 0.044 | 0.176 ± 0.038 | 0.119 ± 0.047 | tight (97–99%) |
| Qwen Edit | edit-trained | 0.062 ± 0.028 | 0.144 ± 0.034 | 0.111 ± 0.049 | tight (97–100%) |
| Gemini | edit-trained | 0.173 ± 0.088 | 0.182 ± 0.133 | 0.151 ± 0.068 | tight (83–95%) |
| SD3 img2img | T2I + img2img | 0.294 ± 0.052 | 0.264 ± 0.037 | 0.268 ± 0.042 | drift (64–80%) |
| SDXL img2img | T2I + img2img | 0.367 ± 0.079 | 0.301 ± 0.040 | 0.303 ± 0.057 | drift (85–92%) |
| gpt-image-1 | T2I + edit hybrid | 0.359 ± 0.052 | 0.293 ± 0.037 | 0.320 ± 0.042 | drift (88–98%) |
Figure 2. Cross-AI behavioral separation across three image domains (3,588 valid pairs from the 6-AI corpus extension). The two-band structure (edit-trained vs. T2I+img2img) holds in each domain panel; the overlay panel shows that within-band shifts along the patch_mean axis are domain-driven (faces are uniformly harder) but no AI crosses bands across domains.
The pilot's three-band reading must be revised. With six AIs the structure is two-banded, and the band assignment tracks training paradigm rather than architecture family. Three edit-trained models (Flux Kontext diffusion, Qwen Edit multimodal LLM, Gemini multimodal AR) all land in the tight band; three T2I-base models adapted at sampling time (SD3 and SDXL diffusion, gpt-image-1 autoregressive) all land in the drift band. The diffusion family (Flux tight, SDXL/SD3 drift, all latent diffusion) and the multimodal-AR family (Qwen tight, gpt-image-1 drift, both multimodal-AR descendants) are each cleanly divided. Training paradigm predicts band; architecture family does not.
A two-factor variance decomposition of patch_mean (n=3,588) attributes 69.5% to AI identity, 0.2% to image domain, 5.9% to AI × domain interaction, and 24.3% to within-cell residual. No AI crosses bands between domains: SDXL stays drift on faces, gpt-image-1 stays drift on AI-generated inputs, Qwen stays tight on all three. Difficulty shifts within an AI, with faces uniformly harder to reproduce exactly (Flux's patch_mean jumps from 0.069 on COCO to 0.176 on faces), but the band does not change.
Six-way LOO nearest-centroid classification gives 51.4% [49.3, 53.4] overall accuracy versus 16.7% chance. Per-AI: Flux Kontext 0.398 [0.345, 0.450], Qwen Edit 0.590 [0.552, 0.631], Gemini 0.263 [0.214, 0.313], SD3 0.688 [0.643, 0.733], SDXL 0.448 [0.383, 0.512], gpt-image-1 0.696 [0.646, 0.740]. Per-domain accuracies are essentially equal: COCO 0.579 [0.549, 0.609], faces 0.595 [0.554, 0.639], AI-generated 0.505 [0.459, 0.549]. The drop from the pilot's 76.6% three-way to the corpus's 51.4% six-way is mechanical: more centroids to confuse and the within-band pairs (Flux ↔ Qwen, SDXL ↔ SD3 ↔ gpt-image-1) are difficult to separate on a 2D feature.
Within-AI reproducibility at the band level is 89.6% overall across the 3,588 cells, with Qwen 99.5%, Flux 97.5%, gpt-image-1 90.9%, SD3 90.5%, SDXL 89.5%, and Gemini 69.8%. Gemini's 30%-disagreement rate is the behavioral signature of content-dependent bimodality: on some images Gemini operates in tight mode, on others in drift, and the choice is image-conditional rather than rep-stochastic. Five of six AIs are within-AI-deterministic at the band level.
Twelve of 3,600 calls (0.3%) failed after retries, all on faces, all due to provider safety classifiers: gpt-image-1 rejected 6 of 150 (4%), Gemini rejected 3 (2%), and Qwen rejected 3 (2%); SD3 produced no rejections; SDXL produced 39 rejections (8.7%) under its default safety_checker, which we disabled. The same face image (face_27828) was rejected by both OpenAI and Qwen across all three reps. Commercial image generators appear to reject 2–4% of CelebA-HQ portrait inputs as unsafe.
5.3 Differential perturbation survival across architectures
Beyond attribution, we ask how much of the adversarial perturbation signal survives each AI's pipeline. We define survival ratio per (image, AI) as the ratio of post-AI to pre-AI perturbation magnitude on patch_p99 against the clean reference, then aggregate medians per AI:
| AI | survival ratio (median ± std) | interpretation |
|---|---|---|
| Flux Kontext | 0.80 ± 0.16 | ~20% of perturbation stripped |
| Gemini | 0.98 ± 0.11 | nearly intact |
| gpt-image-1 | 1.05 ± 0.11 | AI noise exceeds perturbation |
All three AIs produced outputs above the binary detection threshold (p99 > 0.224) in 100% of 269 pilot calls, but the information content of that signal differs. Gemini preserves the perturbation, Flux attenuates it by roughly 20%, and gpt-image-1 replaces it with its own regeneration signature. Flux Kontext's diffusion-based denoising acts as a selective filter, preserving human-perceptible content (SSIM 0.99) while suppressing the perceptually-invisible high-frequency content where the perturbation lives.
This is the first quantitative measurement of how the diffusion-purification effect (DiffPure, Nie et al., 2022; IMPRESS, Cao et al., 2023) varies across deployed commercial img2img systems. The vulnerability for pixel-domain protection schemes is such that a Flux roundtrip can visually re-launder an image with only modest perturbation loss but sufficient to weaken downstream detection. The survival pattern aligns with the §5.2 band assignment, with edit-trained models preserving more of the perturbation than their architecture-family neighbors would predict.
5.4 Reference-anchored vs. blind attribution
The §5.2 attributor is reference-anchored: both of its features (patch_mean, ssim_clean) are computed against the clean original. The natural question for a forensic claim is how much the reference actually helps over a blind method that sees only the candidate output, which is the regime in which essentially all prior model-attribution work operates (§2). We answered it by running two blind baselines on the identical §5.2 corpus (3,588 valid outputs, 6 AIs × 3 domains) under the identical evaluation protocol (sample-level leave-one-out nearest-centroid, 2,000-iteration cluster bootstrap resampling base images, chance = 1/6).
Baseline 1: AEROBLADE proper (Ricker et al., 2024). The training-free VAE-reconstruction detector: for a bank of diffusion autoencoders , score each output by its LPIPS reconstruction error e_m = LPIPS(x, AE_m(x)) and attribute by argmin_m e_m. We use the 4-dimensional recon-error vector as the per-output feature. One coverage caveat is that none of the six corpus AIs ships a publicly loadable VAE without HF authentication. SD3 and Flux VAEs are gated, and gpt-image-1, Gemini, and Qwen Edit are closed. We therefore run the literal AEROBLADE procedure over the loadable open-weight KL-f8 VAE bank (SD1.5, SDXL, sd-vae-ft-mse, playground-v2.5). This is a known floor with AEROBLADE: its native label space is the VAE bank, not the six AIs, so it cannot in principle name the closed models. AEROBLADE was evaluated at 384px input resolution to fit MPS wall-clock; the original paper used 512px. Reconstruction-error rankings are scale-robust and we expect literal-512px numbers to fall within the reported bootstrap CI.
Baseline 2: PRISM-style blind attribution (Ricco et al., 2025). Vector-similarity provenance: embed each output with a frozen self-supervised encoder and attribute by nearest class centroid in embedding space, with no clean reference. PRISM's weights are not public, so we implement the described method on the same DINOv2 ViT-B/14 CLS backbone our reference-anchored detector uses (768-d, L2-normalized), isolating the blind-versus-anchored contrast from any encoder difference.
The reference-anchored harness was first confirmed to reproduce the published §5.2 result exactly (0.513 point, bootstrap 0.514, 95% CI [0.493, 0.534]), validating that the only thing varying across rows below is the feature space.
| Method | Reference? | 6-way LOO | 95% CI |
|---|---|---|---|
| Reference-anchored (patch_mean, ssim) | yes | 0.513 | [0.493, 0.534] |
| PRISM-style (DINOv2 CLS, blind) | no | 0.373 | [0.364, 0.433] |
| AEROBLADE (VAE-recon, blind) | no | 0.222 | [0.204, 0.240] |
| chance (1/6) | — | 0.167 | — |
Both blind baselines clear chance but fall well short of reference-anchored attribution; the CIs do not overlap. The reference is roughly 14 accuracy points over the stronger blind method (PRISM) and roughly 29 over AEROBLADE. The per-AI breakdown is more diagnostic:
| AI (band) | Ref-anchored | PRISM | AEROBLADE |
|---|---|---|---|
| gpt-image-1 (drift) | 0.694 | 0.524 | 0.710 |
| SD3 img2img (drift) | 0.688 | 0.480 | 0.317 |
| SDXL img2img (drift) | 0.447 | 0.617 | 0.132 |
| Flux Kontext (tight) | 0.405 | 0.237 | 0.032 |
| Qwen Edit (tight) | 0.586 | 0.126 | 0.106 |
| Gemini (tight, bimodal) | 0.260 | 0.258 | 0.042 |
Both blind methods are concentrated almost entirely on the drift band (the heavy-regenerators of §6.1). AEROBLADE actually beats the reference-anchored detector on gpt-image-1 (0.710 vs 0.694): heavy regeneration onto a noised or re-tokenized latent leaves exactly the reconstruction signature AEROBLADE was built to detect. But AEROBLADE collapses to near-zero on the edit-trained tight band (Flux 0.032, Gemini 0.042, Qwen 0.106), where the output is a near-faithful copy of the input and carries no detectable model-specific VAE trace. PRISM shows the same pattern more mildly: strong on visually-distinctive regenerators (SDXL 0.617, gpt-image-1 0.524, SD3 0.480), weak on tight-band preservers (Qwen 0.126, Flux 0.237) whose blind embedding is dominated by image content rather than model identity. The reference-anchored detector is the only one of the three that attributes across both bands, because the clean original is precisely what disambiguates "the model preserved the input" from "this is the input."
This also explains AEROBLADE's native (no-fit) behavior. Its argmin-VAE-family prediction is near-uniform across all six AIs (every AI's outputs map predominantly to the playground or sdxl VAEs, the closest 4-channel KL-f8 autoencoders to any natural-looking image), and even SDXL img2img, the one corpus AI whose VAE family is in the bank, is recovered only 35% of the time versus 45% mis-assigned to playground. The four open VAEs are too mutually correlated to separate six commercial AIs blind. Blind VAE-reconstruction attribution, which is effective at distinguishing GAN and SD families on text-to-image outputs (its original setting), does not transfer to attributing among modern commercial img2img APIs, because none expose their autoencoder and the open proxies are indistinguishable.
On this corpus the reference image lifts six-way attribution from 0.22 to 0.37 (blind) to 0.51, and is the only route to attributing within the edit-trained tight band where the blind methods are at chance. This substantiates the contribution claim of §1 that reference-anchored attribution on commercial img2img AIs is a distinct and stronger regime than the blind, T2I-oriented prior work.
6. Discussion
6.1 What the bands track
The 3-AI pilot admitted a tempting interpretation: three systems corresponding to three architecture classes, and the bands were the architectural signature. The 6-AI corpus extension falsifies that reading. Dividing the diffusion family (Flux Kontext tight, SDXL/SD3 drift, same latent-diffusion backbone) and the multimodal-AR family (Qwen Edit tight, gpt-image-1 drift, both multimodal-AR descendants). What predicts band, across all six systems, is whether the model was trained on edit data (paired clean-to-edited supervision) or whether it is a T2I-base model adapted at sampling time by starting denoising from a partially-noised version of the input.
Our data supports that behavioral bands can be determined by the training-paradigm column of a model card without running the model. It also implies that the band is not a fixed property of an architecture family; the same backbone, retrained or sampled differently, can move between bands. SDXL-Edit (if released) would predictably move from drift to tight; a Flux Schnell img2img sampled from heavily-noised latents without edit conditioning would predictably move from tight to drift.
The two-band split also surfaces independently in the blind-baseline comparison (§5.4): both AEROBLADE and PRISM, which see only the output, attribute the drift band (gpt-image-1, SD3, SDXL) well above chance but fall to near-zero on the tight band (Flux, Qwen, Gemini). A model that heavily regenerates leaves a model-specific trace in the output itself; a model that preserves the input leaves a trace only relative to that input. The bands are thus visible blind precisely to the extent that a model departs from its input, which is the behavioral definition of the band.
Gemini is the exception within the edit-trained band: predominantly tight, but exhibiting content-conditional bimodality (69.8% within-AI mode consistency versus above 89% for the others) with some images consistently triggering drift behavior. We do not yet know what image property routes Gemini between regimes.
6.2 From defense to forensic primitive
The original perturbation pipeline was designed as a defensive overlay. Our findings reframe its role: sub-JND pixel perturbations cannot survive heavy-regeneration AIs like gpt-image-1, SDXL, or SD3, so they do not prevent unauthorized use by such models. They do, however, enable downstream attribution: given an original and a candidate output, we can identify which AI processed it. For deployment, this suggests pairing the perturbation pipeline with a provenance database in which the user retains the original, registers it, and later checks downstream copies via DINOv2 scoring against the registered reference. The perturbation is neither necessary nor sufficient for this scheme (unperturbed references also work), but it provides a robust signal channel against benign processing.
The reliance on a retained original is the scheme's defining constraint, and §5.4 quantifies what it buys: against the two standard blind attributors run on the identical corpus (AEROBLADE's VAE-reconstruction error, 0.222; PRISM-style DINOv2 embedding similarity, 0.373), the reference-anchored detector reaches 0.513 six-way accuracy, and is the only one of the three that attributes within the edit-trained tight band at all. The blind methods are essentially at chance there and only resolve the heavy-regenerator drift band (§6.1). The forensic value of this scheme is therefore concentrated exactly where blind detection fails: identifying which AI produced a near-faithful reproduction. That is also its limit, with no retained original the scheme degrades to the blind baselines.
6.3 Limitations
The corpus spans three image domains (COCO, CelebA-HQ, AI-generated); generalization to text, fine typography, medical imagery, line art, or screenshots remains untested. The pipeline runs at a single perturbation budget (eps=0.10); behavior at weaker or stronger budgets is not characterized. The six AIs span two architecture families but the family list is not exhaustive, with Imagen 3/4, Recraft V3, Ideogram, MidJourney editing, and Adobe Firefly all untested. The detector and classifier require a clean reference image; §5.4 quantifies what the reference is worth (roughly 14–29 accuracy points over blind baselines), but a blind variant of our method is not possible without the reference. Within-band attribution remains partially unsolved: six-way LOO accuracy at 51.4% is above chance but the residual confusion is concentrated within the two bands, suggesting that finer attribution requires additional features (spectral signatures, per-attack-class fingerprint vectors, or learned classifier heads). The AEROBLADE baseline was evaluated at 384px to fit available compute; we expect literal-512px numbers to fall within the reported bootstrap CI but flag this for re-evaluation.
7. Conclusion
We have shown that six commercial image-to-image AI systems spanning three architecture families partition into two image-invariant behavioral bands on a 2D DINOv2-based feature space, and that the discriminating variable is training paradigm rather than architecture family. AI identity explains 69.5% of behavioral variance, image domain explains 0.2%, and the band assignment is identifiable from a single output image plus a clean reference at 51.4% six-way LOO accuracy versus 16.7% chance. A head-to-head against two blind baselines on the identical corpus (AEROBLADE 0.222, PRISM-style 0.373) confirms that the reference image is the key forensic signal, particularly within the edit-trained tight band where blind methods are at chance. We additionally quantify differential perturbation survival across these architectures, providing the systematic measurement of how the diffusion-purification effect varies across deployed commercial img2img systems. The results reframe pixel-domain perturbation pipelines from defenses into forensic primitives for reference-anchored AI-processing attribution. The most important next steps are extension to additional commercial img2img APIs, within-band attribution via spectral or learned-classifier features, and a blind detector capable of recovering tight-band attribution without a retained reference.
How to cite
H. Hill (2026). Vision-Encoder Behavioral Fingerprints of Image-to-Image Generative Models: A Training-Paradigm-Driven Taxonomy of Six Commercial APIs. arXiv:2606.14787. arxiv.org/abs/2606.14787
References
An, Z., et al. (2024). Rethinking the Invisible Protection against Unauthorized Image Usage in Stable Diffusion. USENIX Security Symposium.
Asnani, V., Yin, X., Hassner, T., & Liu, X. (2023). Reverse Engineering of Generative Models: Inferring Model Hyperparameters from Generated Images. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(12), 15477–15493. arXiv:2106.07873.
Black Forest Labs, Batifol, S., Blattmann, A., et al. (2025). FLUX.1 Kontext: Flow Matching for In-Context Image Generation and Editing in Latent Space. arXiv:2506.15742.
Cao, B., Li, C., Wang, T., Jia, J., Li, B., & Chen, J. (2023). IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI. NeurIPS. arXiv:2310.19248.
Choi, S., Lee, H., & Lee, M. (2025). Training-free Detection of AI-generated Images via Cropping Robustness. NeurIPS. arXiv:2511.14030.
Corvi, R., Cozzolino, D., Zingarini, G., Poggi, G., Nagano, K., & Verdoliva, L. (2023). On the Detection of Synthetic Images Generated by Diffusion Models. ICASSP, 1–5. arXiv:2211.00680.
Doi, M. T., Butora, J., Itier, V., Boulanger, J., & Bas, P. (2025). DinoLizer: Learning from the Best for Generative Inpainting Localization. arXiv:2511.20722.
Hönig, R., Rando, J., Carlini, N., & Tramèr, F. (2024). Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. arXiv:2406.12027.
Liang, C., Wu, X., Hua, Y., et al. (2023). Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples. ICML. arXiv:2302.04578.
Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., & Anandkumar, A. (2022). Diffusion Models for Adversarial Purification. ICML. arXiv:2205.07460.
Oquab, M., Darcet, T., Moutakanni, T., et al. (2024). DINOv2: Learning Robust Visual Features without Supervision. TMLR. arXiv:2304.07193.
Ricco, E., Onofri, E., Cima, L., Cresci, S., & Di Pietro, R. (2025). PRISM: Phase-enhanced Radial-based Image Signature Mapping framework for fingerprinting AI-generated images. arXiv:2509.15270.
Ricker, J., Lukovnikov, D., & Fischer, A. (2024). AEROBLADE: Training-Free Detection of Latent Diffusion Images Using Autoencoder Reconstruction Error. CVPR, 9130–9140. arXiv:2401.17879.
Salman, H., Khaddaj, A., Leclerc, G., Ilyas, A., & Mądry, A. (2023). Raising the Cost of Malicious AI-Powered Image Editing. ICML. arXiv:2302.06588.
Shan, S., Cryan, J., Wenger, E., Zheng, H., Hanocka, R., & Zhao, B. Y. (2023). Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models. USENIX Security Symposium, 2187–2204.
Shen, J., Zheng, J., Xue, Y., et al. (2025). DINO-Detect: A Simple yet Effective Framework for Blur-Robust AI-Generated Image Detection. arXiv:2511.12511.
Tang, Q., Ayambem, B., Chuah, M. C., & Bharati, A. (2025). Is Perturbation-based Image Protection Disruptive to Image Editing? ICIP. arXiv:2506.04394.
Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004). Image Quality Assessment: From Error Visibility to Structural Similarity. IEEE Transactions on Image Processing, 13(4), 600–612.
Xue, H., & Chen, Y. (2024). Pixel is a Barrier: Diffusion Models Are More Adversarially Robust Than We Think. arXiv:2404.13320.
Yu, N., Davis, L., & Fritz, M. (2019). Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints. ICCV, 7556–7566.