# Safeguarding Text-to-Image Generative Models Against Unauthorized Knowledge Distillation

Source: [Safeguarding Text-to-Image Generative Models Against Unauthorized Knowledge Distillation](<https://www.sota2.com/research/paper/6a0fe32af984739ed6739ed8>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-05-23T05:00:04.712Z

Authors: Yilan Gao, Sida Huang, Hongyuan Zhang, Xuelong Li

Published: 2026-05-21T06:50:50.000Z

## Abstract

Closed-weight generative services are increasingly deployed through query-based APIs, where users can obtain generated outputs while model parameters remain inaccessible. However, such deployment does not prevent model stealing: an attacker can repeatedly query the service, collect large volumes of released synthetic images, and use them as training data for a private substitute model. This query-output-driven process enables unauthorized knowledge distillation and capability replication without direct access to the original weights. To mitigate this threat, a practical defense should preserve the visual fidelity of released images, provide explicit control over perturbation magnitude, and scale efficiently to large-volume output release. We present WaveGuard, a single-pass, generator-based protection framework that safeguards released synthetic images under a user-specified perturbation budget. WaveGuard employs a frequency-aware perturbation generator to inject structured, imperceptible perturbations that maintain perceptual utility for benign viewers while reducing the usefulness of protected images as training data for unauthorized student models. Extensive experiments under WikiArt-related synthetic-output distillation settings show that WaveGuard achieves a favorable efficacy--fidelity--efficiency trade-off, with explicit imperceptibility control and substantial gains in protection efficiency.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Synthetic-output protection on WikiArt Textual Inversion route (synthetic-output)](<https://www.sota2.com/research/sota/synthetic-output-protection-on-wikiart-textual-inversion-route-synthetic-output.md>): Synthetic-output protection; WikiArt Textual Inversion route (synthetic-output); CSD: 0.5.

- [Synthetic-output protection on WikiArt DreamBooth route (synthetic-output)](<https://www.sota2.com/research/sota/synthetic-output-protection-on-wikiart-dreambooth-route-synthetic-output.md>): Synthetic-output protection; WikiArt DreamBooth route (synthetic-output); CSD: 0.64.

- [Image Watermarking on WikiArt](<https://www.sota2.com/research/sota/image-watermarking-on-wikiart.md>): Image Watermarking; WikiArt; Cheng20 Distance: 0.51.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2605.22060>)

[PDF](<https://arxiv.org/pdf/2605.22060.pdf>)