SpectralCanary：用低频痕迹审计 T2I 模型是否用了你的数据集
SpectralCanary: Embarrassingly Simple Low-Frequency Traces for T2I Dataset-Use Auditing
训练方偷偷用了你的图片集合很难查，这篇论文给出办法：提前在数据里埋低频水印，事后用几十张生成图就能验证，画质几乎无损。
SpectralCanary 是一种主动式数据集审计方法，通过低通掩码把一张固定的 canary 图像融入数据集每张图片，字幕不变，无需辅助生成或逐图优化。在 Pokemon 数据集的八项测试和三种数据变换下，其平均每代 TPR@1% FPR 达 91.1%，用 30 张生成图实现 94.8% 的模型级判定准确率。在艺术、医学、卫星、时尚五个数据集上配合 SD3.5 测试，平均 TPR@1% FPR 为 92.4%，图像 SSIM 保持 0.989，平均 ΔFID 仅 0.05。消融实验显示低频放置比中高频更可靠， evaluated 自适应攻击中最有效的移除方式会带来超过 25 个 ΔFID 点的画质损失。
SpectralCanary: Embarrassingly Simple Low-Frequency Traces for T2I Dataset-Use Auditing
Auditing whether a text-to-image (T2I) model was fine-tuned on a particular image collection is difficult: a model can absorb collection-level visual characteristics without reproducing training images. Proactive dataset-use auditing plants a shared signal in a dataset before release, then later checks whether that signal appears in a suspect model's generated outputs. Existing approaches often trade off verifiability, fidelity, robustness, and deployability. We introduce $\textbf{SpectralCanary}$, which uses a smooth low-pass mask to blend a fixed canary image into every collection image while leaving captions unchanged and requiring neither auxiliary generation nor per-image optimization. A lightweight verifier detects the transferred signal in suspect-model outputs. Across eight tests on the Pokemon dataset and three realistic data transformations, spanning two architectures families, SpectralCanary achieves the highest average per-generation TPR@$1\%$ FPR ($91.1\%$) and fixed threshold model-level accuracy using 30 generations ($94.8\%$) among the evaluated methods. Across five datasets spanning artistic, medical, satellite, and fashion domains with SD3.5, SpectralCanary averages $92.4\%$ per-generation TPR@$1\%$ FPR while preserving the released images (SSIM $0.989$, LPIPS $0.022$) with a near-zero mean change FID (mean $Δ$FID $0.05$) across datasets. Matched-energy ablations on Pokemon and ROCOv2 support our design choice, low-frequency placement transfers more reliably compared to mid/high-frequency placement. Under the evaluated adaptive attacks, the most effective removal requires aggressive modification and incurs more than $25$ $Δ$FID points. These results identify low-frequency visual signals as effective carriers for collection-level T2I audit traces.