CSF: Black-box Fingerprinting via Compositional Semantics for Text-to-Image Models

Text-to-image models have become commercially valuable assets distributed under restrictive licenses to prevent unauthorized fine-tuning and redistribution, yet violations are only enforceable when detectable. Existing methods require pre-deployment injection or white-box access to model weights or gray-box access to intermediate activations—capabilities, which are unavailable in commercial API deployments. We present Compositional Semantic Fingerprinting (CSF), the first black-box fingerprinting method that attributes fine-tuned models to their base families using only query access to text-to-image generation APIs. CSF abstracts models as semantic category generators, probing them with compositional underspecified prompts that combine individually common components into exponentially rare compositions. Unlike traditional watermarking, this creates an asymmetric advantage: IP owners can cheaply generate novel prompt compositions at any time post-deployment, while attackers face the intractable challenge of anticipating and removing all possible fingerprints during training. We demonstrate this across 6 model families (FLUX, Kandinsky, SD1.5/2.1/3.0/XL) and 13 variants spanning comprehensive scenario. Our Bayesian attribution framework achieves $>$50\% posterior mean accuracy with 95\% credible intervals for all models.