that the generated samples remain true to the training data if there is no
trigger in the input of the diffusion model.

##  5 Discussion

While a range of technical approaches have been suggested, numerous challenges
remain unresolved in this field. In this section we will explore the existing
issues and consider potential future directions for copyright protection
within deep generative models.

First, we discuss the data copyright protection from the following three
perspectives:

$\bullet$ Comprehensiveness. In image generation, most of the protection for
data copyright conducted by the source data owner is tailored for a specific
model or learning algorithm. However, they cannot prevent the model builder
from learning the data with a different generative model, which means they
cannot provide a comprehensive protection against different DGMs. For example,
the unrecognizable examples by Shan et al. (2023); Liang & Wu (2023) focus on
Stable Diffusion, and Van Le et al. (2023) prevent the fine-tuning scheme of
DreamBooth. The watermark like methods proposed by Ma et al. (2023c); Wang et
al. (2023) is also designed for one type of DGMs. A dive to the effectiveness
of these methods in safeguarding data against a range of generative models,
rather than just tailored ones, is essential. A thorough protection
encompassing a wide array of DGMs is significantly more meaningful. Its
challenge stems from the distinct architectures and unique properties of
various generative models, making it challenging to devise protections for
specific vulnerabilities. Despite these obstacles, pursuing comprehensive
research in this field is essential and may lead to a deeper understanding of
DGM characteristics.

$\bullet$ Data protection by owners besides image domain. Although several
methods to protect the data copyright are developed to the source data owners
in image domain (Shan et al., 2023; Liang & Wu, 2023; Cui et al., 2023b;
Webster et al., 2023), there are fewer works for text and other domains. On
the one hand, the DGMs in other domains like the code, audio, graph and video
do not have the same level of development as image. On the other hand, the
protection in some domains like text is much harder than image, because the
modification on image can be designed as invisible to human eyes but effective
on DGMs, while text is discrete and is hard to be designed as imperceptible.
Despite the difficulty, it is necessary to propose the protection from the
side of source data owner for other domains, especially in text domain which
is fast developing and causes increasing concerns in the data copyright. Also,
the copyright protection for multi-modality generation (Ma et al., 2023b; Zhan
et al., 2023; Ruan et al., 2023; Pichler et al., 2010) in both data copyright
and model copyright is also crucial.

$\bullet$ Infringement detection. Injecting watermark into images to
accelerate the infringement detection has been introduced in Section 2.3.2,
which aims to help source data owners protect their data copyright.
Infringement detection can also benefit the model builder. Before releasing
the generated output to the users, the builder can first check whether the
output is infringing the copyright of training data (like a memorized training
sample). If the output to be released is detected as infringement, the model
builder can use some following-up strategies like adding references to the
source of the content or removing the suspicious part to avoid the
infringement. However, detecting infringement on the training data is not
trivial, especially that current DGMs usually require a large amount of
training data to ensure the generated quality and diversity. The dataset de-
duplication in Section 2.3.4 and Section 3.3.1 provides potential solutions.
It is an offline strategy that can be achieved before training. However, for
infringement detection, a faster real-time searching is necessary to mitigate
negative impact on the generation speed. Another issue is that, compared with
memorization problem, the infringement on the copyright of abstract concepts,
such as the style of an artwork or a product, and the original storylines and
characters created by authors, is hard to confirm. The memorized samples often
bear a high resemblance to the copyrighted
material131313https://spectrum.ieee.org/midjourney-copyright,
https://www.nytimes.com/2023/12/27/business/media/new-york-times-open-ai-
microsoft-lawsuit.html, making infringement easy to confirm. In contrast, if a
generated sample replicates the style of a picture but diverges significantly
in content from the original, it becomes much harder to detect and confirm
whether the generated sample stems from copyrighted data or not.

Second, for the model copyright protection, we present the following aspects:

$\bullet$ Robustness. The purification techniques for watermark and
adversarial perturbations have challenged the robustness of watermark
protection on model copyright in both image generation (Nie et al., 2022; Yoon
et al., 2021; Chen et al., 2021a) and text generation (Krishna et al., 2023;
Ren et al., 2023). In image generation models, the imperceptibility of
watermarks is a key reason why the watermark is easy to remove by methods like
denoising. In text generation models, the watermark is vulnerable because the
watermark is encoded based on the tokens, and thus operations such as
paraphrasing can easily change the tokens by rewording and reordering. In
fact, the robustness issue also exists in the protection on data copyright
like unrecognisable examples and watermarks for source data owners.

$\bullet$ Trade-off between protection and performance. The introduction of
watermarks can potentially reduce the generation quality. Wen et al. (2023)
and Cui et al. (2023a) found that the watermarks will cause influence on the
generated contents by Stable Diffusion. The trajectory of reverse process in
diffusion model is sensitive to the change since the change might be
accumulated in the long generation steps. Ajith et al. (2023) also pointed out
that the watermark method on LLMs will reduce the generated quality on the
long-term generation task like summarization. Thus, developing protection
methods that can maintain the performance of the model is necessary.

$\bullet$ Flexibility. The protection is usually designed for one specific
type of models and lack of flexibility. For example, in Section 2.4, the
methods proposed by (Ong et al., 2021), (Zhang et al., 2023b), (Fei et al.,
2022), (Yu et al., 2020) and (Yu et al., 2021) are all tailored for GANs. The
effectiveness of the protection on other model architectures are not
guaranteed. If one protection method is adaptable to a variety of DGMs, it
eliminates the need for redundant efforts in redesigning for different models,
thereby enhancing the efficiency of the protection process. This opens up
opportunities for third-party providers to offer such protective services.
They could utilize a versatile method to secure different DGMs without the
requirement for constant redesigning. This strategy not only streamlines the
process but also represents a vital direction in the realm of model copyright
protection.

For the epilogue, we recognize that the issue of copyright protection in deep
generative models remains a work in progress, encompassing both data and model
security. The rapid evolution of DGMs is catalyzing the establishment of
effective regulatory oversight, fostering healthy market dynamics, and
facilitating the empowerment of various industries. This progression demands
not only improvements in model performance but also a critical evaluation of
how these technologies are utilized, ensuring their use is reasonable and
standardized. Copyright protection stands as a pivotal concern, and it is
anticipated that in the foreseeable future, it will garner increased attention
and resources from both industrial and academic spheres. Our hope is that this
work can serve as a guiding framework and a source of inspiration for possible
forthcoming directions in the realm of copyright protection for future
researchers who wants to develop tools in this field from the perspective of
techniques.

## References

  * Abdal et al. (2019) Abdal, R., Qin, Y., and Wonka, P.  Image2stylegan: How to embed images into the stylegan latent space?  In _Proceedings of the IEEE/CVF international conference on computer vision_ , pp. 4432–4441, 2019.
  * Achiam et al. (2023) Achiam, O. J., Adler, S., and et al.  Gpt-4 technical report.  2023\.  URL https://api.semanticscholar.org/CorpusID:257532815.
  * Ajith et al. (2023) Ajith, A., Singh, S., and Pruthi, D.  Performance trade-offs of watermarking large language models.  _arXiv preprint arXiv:2311.09816_ , 2023.
  * Athalye et al. (2018) Athalye, A., Engstrom, L., Ilyas, A., and Kwok, K.  Synthesizing robust adversarial examples.  In _International conference on machine learning_ , pp. 284–293. PMLR, 2018.
  * Baluja (2017) Baluja, S.  Hiding images in plain sight: Deep steganography.  _Advances in neural information processing systems_ , 30, 2017.
  * Biderman et al. (2023) Biderman, S., Prashanth, U. S., Sutawika, L., Schoelkopf, H., Anthony, Q., Purohit, S., and Raf, E.  Emergent and predictable memorization in large language models.  _arXiv preprint arXiv:2304.11158_ , 2023.
  * Birch et al. (2023) Birch, L., Hackett, W., Trawicki, S., Suri, N., and Garraghan, P.  Model leeching: An extraction attack targeting llms.  _arXiv preprint arXiv:2309.10544_ , 2023.
  * Black et al. (2021) Black, S., Gao, L., Wang, P., Leahy, C., and Biderman, S.  GPT-Neo: Large Scale Autoregressive Language Modeling with Mesh-Tensorflow, March 2021.  URL https://doi.org/10.5281/zenodo.5297715.  If you use this software, please cite it using these metadata.
  * Bourtoule et al. (2021) Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., and Papernot, N.  Machine unlearning.  In _2021 IEEE Symposium on Security and Privacy (SP)_ , pp. 141–159. IEEE, 2021.
  * Brock et al. (2016) Brock, A., Lim, T., Ritchie, J. M., and Weston, N.  Neural photo editing with introspective adversarial networks.  _arXiv preprint arXiv:1609.07093_ , 2016.
  * Broder (1997) Broder, A. Z.  On the resemblance and containment of documents.  In _Proceedings. Compression and Complexity of SEQUENCES 1997 (Cat. No. 97TB100171)_ , pp. 21–29. IEEE, 1997.
  * Brown et al. (2020) Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J. D., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al.  Language models are few-shot learners.  _Advances in neural information processing systems_ , 33:1877–1901, 2020.
  * Cao et al. (2023) Cao, X., Li, X., Jadav, D., Wu, Y., Chen, Z., Zeng, C., and Wei, W.  Invisible watermarking for audio generation diffusion models.  _arXiv preprint arXiv:2309.13166_ , 2023.
  * Carlini et al. (2021) Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T. B., Song, D., Erlingsson, U., et al.  Extracting training data from large language models.  In _USENIX Security Symposium_ , volume 6, 2021.
  * Carlini et al. (2022) Carlini, N., Ippolito, D., Jagielski, M., Lee, K., Tramer, F., and Zhang, C.  Quantifying memorization across neural language models.  _arXiv preprint arXiv:2202.07646_ , 2022.
  * Carlini et al. (2023) Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramer, F., Balle, B., Ippolito, D., and Wallace, E.  Extracting training data from diffusion models.  _arXiv preprint arXiv:2301.13188_ , 2023.
  * Chen et al. (2023) Chen, G., Wu, Y., Liu, S., Liu, T., Du, X., and Wei, F.  Wavmark: Watermarking for audio generation.  _arXiv preprint arXiv:2308.12770_ , 2023.
  * Chen & Yang (2023) Chen, J. and Yang, D.  Unlearn what you want to forget: Efficient unlearning for llms.  _arXiv preprint arXiv:2310.20150_ , 2023.
  * Chen et al. (2017) Chen, X., Liu, C., Li, B., Lu, K., and Song, D.  Targeted backdoor attacks on deep learning systems using data poisoning.  _arXiv preprint arXiv:1712.05526_ , 2017.
  * Chen et al. (2021a) Chen, X., Wang, W., Bender, C., Ding, Y., Jia, R., Li, B., and Song, D.  Refit: a unified watermark removal framework for deep learning systems with limited data.  In _Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security_ , pp. 321–335, 2021a.
  * Chen et al. (2021b) Chen, Z., Xie, L., Pang, S., He, Y., and Zhang, B.  Magdr: Mask-guided detection and reconstruction for defending deepfakes.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 9014–9023, 2021b.
  * Christ et al. (2023) Christ, M., Gunn, S., and Zamir, O.  Undetectable watermarks for language models.  _arXiv preprint arXiv:2306.09194_ , 2023.
  * Chu et al. (2023) Chu, T., Song, Z., and Yang, C.  How to protect copyright data in optimization of large language models?  _arXiv preprint arXiv:2308.12247_ , 2023.
  * Cui et al. (2023a) Cui, Y., Ren, J., Lin, Y., Xu, H., He, P., Xing, Y., Fan, W., Liu, H., and Tang, J.  Ft-shield: A watermark against unauthorized fine-tuning in text-to-image diffusion models.  _arXiv preprint arXiv:2310.02401_ , 2023a.
  * Cui et al. (2023b) Cui, Y., Ren, J., Xu, H., He, P., Liu, H., Sun, L., and Tang, J.  Diffusionshield: A watermark for copyright protection against generative diffusion models.  _arXiv preprint arXiv:2306.04642_ , 2023b.
  * Darvish Rouhani et al. (2019) Darvish Rouhani, B., Chen, H., and Koushanfar, F.  Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks.  In _Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems_ , pp. 485–497, 2019.
  * Dhariwal & Nichol (2021) Dhariwal, P. and Nichol, A.  Diffusion models beat gans on image synthesis.  _Advances in neural information processing systems_ , 34:8780–8794, 2021.
  * Dogoulis et al. (2023) Dogoulis, P., Kordopatis-Zilos, G., Kompatsiaris, I., and Papadopoulos, S.  Improving synthetically generated image detection in cross-concept settings.  In _Proceedings of the 2nd ACM International Workshop on Multimedia AI against Disinformation_ , pp. 28–35, 2023.
  * Dziugaite et al. (2016) Dziugaite, G. K., Ghahramani, Z., and Roy, D. M.  A study of the effect of jpg compression on adversarial images.  _arXiv preprint arXiv:1608.00853_ , 2016.
  * Eldan & Russinovich (2023) Eldan, R. and Russinovich, M.  Who’s harry potter? approximate unlearning in llms.  _arXiv preprint arXiv:2310.02238_ , 2023.
  * Epstein et al. (2023) Epstein, D. C., Jain, I., Wang, O., and Zhang, R.  Online detection of ai-generated images.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , pp. 382–392, 2023.
  * Fan et al. (2023) Fan, T., Kang, Y., Ma, G., Chen, W., Wei, W., Fan, L., and Yang, Q.  Fate-llm: A industrial grade federated learning framework for large language models.  _arXiv preprint arXiv:2310.10049_ , 2023.
  * Fei et al. (2022) Fei, J., Xia, Z., Tondi, B., and Barni, M.  Supervised gan watermarking for intellectual property protection.  In _2022 IEEE International Workshop on Information Forensics and Security (WIFS)_ , pp. 1–6. IEEE, 2022.
  * Feng et al. (2020) Feng, Z., Guo, D., Tang, D., Duan, N., Feng, X., Gong, M., Shou, L., Qin, B., Liu, T., Jiang, D., et al.  Codebert: A pre-trained model for programming and natural languages.  _arXiv preprint arXiv:2002.08155_ , 2020.
  * Fernandez et al. (2023) Fernandez, P., Couairon, G., Jégou, H., Douze, M., and Furon, T.  The stable signature: Rooting watermarks in latent diffusion models.  _arXiv preprint arXiv:2303.15435_ , 2023.
  * Franceschelli & Musolesi (2022) Franceschelli, G. and Musolesi, M.  Copyright in generative deep learning.  _Data & Policy_, 4:e17, 2022.
  * Fu et al. (2023) Fu, Y., Xiong, D., and Dong, Y.  Watermarking conditional text generation for ai detection: Unveiling challenges and a semantic-aware watermark remedy.  _arXiv preprint arXiv:2307.13808_ , 2023.
  * Gal et al. (2022) Gal, R., Alaluf, Y., Atzmon, Y., Patashnik, O., Bermano, A. H., Chechik, G., and Cohen-Or, D.  An image is worth one word: Personalizing text-to-image generation using textual inversion.  _arXiv preprint arXiv:2208.01618_ , 2022.
  * Gandikota et al. (2023) Gandikota, R., Materzynska, J., Fiotto-Kaufman, J., and Bau, D.  Erasing concepts from diffusion models.  _arXiv preprint arXiv:2303.07345_ , 2023.
  * Goodfellow et al. (2014a) Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y.  Generative adversarial nets.  _Advances in neural information processing systems_ , 27, 2014a.
  * Goodfellow et al. (2014b) Goodfellow, I. J., Shlens, J., and Szegedy, C.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ , 2014b.
  * Hayes & Danezis (2017) Hayes, J. and Danezis, G.  Generating steganographic images via adversarial training.  _Advances in neural information processing systems_ , 30, 2017.
  * He et al. (2023) He, P., Xu, H., Ren, J., Cui, Y., Liu, H., Aggarwal, C. C., and Tang, J.  Sharpness-aware data poisoning attack.  _arXiv preprint arXiv:2305.14851_ , 2023.
  * He et al. (2022) He, X., Xu, Q., Zeng, Y., Lyu, L., Wu, F., Li, J., and Jia, R.  Cater: Intellectual property protection on text generation apis via conditional watermarks.  _Advances in Neural Information Processing Systems_ , 35:5431–5445, 2022.
  * Ho & Salimans (2022) Ho, J. and Salimans, T.  Classifier-free diffusion guidance.  _arXiv preprint arXiv:2207.12598_ , 2022.
  * Ho et al. (2020) Ho, J., Jain, A., and Abbeel, P.  Denoising diffusion probabilistic models.  _Advances in neural information processing systems_ , 33:6840–6851, 2020.
  * Hu et al. (2023) Hu, Z., Chen, L., Wu, X., Wu, Y., Zhang, H., and Huang, H.  Unbiased watermark for large language models.  _arXiv preprint arXiv:2310.10669_ , 2023.
  * Huang et al. (2021) Huang, Q., Zhang, J., Zhou, W., Zhang, W., and Yu, N.  Initiative defense against facial manipulation.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , volume 35, pp. 1619–1627, 2021.
  * Ippolito et al. (2022) Ippolito, D., Tramèr, F., Nasr, M., Zhang, C., Jagielski, M., Lee, K., Choquette-Choo, C. A., and Carlini, N.  Preventing verbatim memorization in language models gives a false sense of privacy.  _arXiv preprint arXiv:2210.17546_ , 2022.
  * Ji et al. (2022) Ji, Z., Ma, P., and Wang, S.  Unlearnable examples: Protecting open-source software from unauthorized neural code learning.  In _SEKE_ , pp. 525–530, 2022.
  * Kandpal et al. (2022) Kandpal, N., Wallace, E., and Raffel, C.  Deduplicating training data mitigates privacy risks in language models.  In _International Conference on Machine Learning_ , pp. 10697–10707. PMLR, 2022.
  * Karras et al. (2020) Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., and Aila, T.  Analyzing and improving the image quality of stylegan.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pp. 8110–8119, 2020.
  * Kassem et al. (2023) Kassem, A., Mahmoud, O., and Saad, S.  Preserving privacy through dememorization: An unlearning technique for mitigating memorization risks in language models.  In _Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing_ , pp. 4360–4379, 2023.
  * Kim et al. (2023) Kim, C., Min, K., Patel, M., Cheng, S., and Yang, Y.  Wouaf: Weight modulation for user attribution and fingerprinting in text-to-image diffusion models.  _arXiv preprint arXiv:2306.04744_ , 2023.
  * Kingma & Welling (2013) Kingma, D. P. and Welling, M.  Auto-encoding variational bayes.  _arXiv preprint arXiv:1312.6114_ , 2013.
  * Kirchenbauer et al. (2023a) Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., and Goldstein, T.  A watermark for large language models.  _arXiv preprint arXiv:2301.10226_ , 2023a.
  * Kirchenbauer et al. (2023b) Kirchenbauer, J., Geiping, J., Wen, Y., Shu, M., Saifullah, K., Kong, K., Fernando, K., Saha, A., Goldblum, M., and Goldstein, T.  On the reliability of watermarks for large language models.  _arXiv preprint arXiv:2306.04634_ , 2023b.
  * Kong & Chaudhuri (2023a) Kong, Z. and Chaudhuri, K.  Data redaction from pre-trained gans.  In _2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)_ , pp. 638–677. IEEE, 2023a.
  * Kong & Chaudhuri (2023b) Kong, Z. and Chaudhuri, K.  Data redaction from conditional generative models.  _arXiv preprint arXiv:2305.11351_ , 2023b.
  * Kong et al. (2021) Kong, Z., Ping, W., Huang, J., Zhao, K., and Catanzaro, B.  Diffwave: A versatile diffusion model for audio synthesis.  In _International Conference on Learning Representations_ , 2021.
  * Krishna et al. (2023) Krishna, K., Song, Y., Karpinska, M., Wieting, J., and Iyyer, M.  Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense.  _arXiv preprint arXiv:2303.13408_ , 2023.
  * Kuditipudi et al. (2023) Kuditipudi, R., Thickstun, J., Hashimoto, T., and Liang, P.  Robust distortion-free watermarks for language models.  _arXiv preprint arXiv:2307.15593_ , 2023.
  * Kumari et al. (2023) Kumari, N., Zhang, B., Wang, S.-Y., Shechtman, E., Zhang, R., and Zhu, J.-Y.  Ablating concepts in text-to-image diffusion models.  _arXiv preprint arXiv:2303.13516_ , 2023.
  * Kurakin et al. (2018) Kurakin, A., Goodfellow, I. J., and Bengio, S.  Adversarial examples in the physical world.  In _Artificial intelligence safety and security_ , pp. 99–112. Chapman and Hall/CRC, 2018.
  * Ledig et al. (2017) Ledig, C., Theis, L., Huszár, F., Caballero, J., Cunningham, A., Acosta, A., Aitken, A., Tejani, A., Totz, J., Wang, Z., et al.  Photo-realistic single image super-resolution using a generative adversarial network.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 4681–4690, 2017.
  * Lee et al. (2023a) Lee, J., Le, T., Chen, J., and Lee, D.  Do language models plagiarize?  In _Proceedings of the ACM Web Conference 2023_ , pp. 3637–3647, 2023a.
  * Lee et al. (2021) Lee, K., Ippolito, D., Nystrom, A., Zhang, C., Eck, D., Callison-Burch, C., and Carlini, N.  Deduplicating training data makes language models better.  _arXiv preprint arXiv:2107.06499_ , 2021.
  * Lee et al. (2023b) Lee, T., Hong, S., Ahn, J., Hong, I., Lee, H., Yun, S., Shin, J., and Kim, G.  Who wrote this code? watermarking for code generation.  _arXiv preprint arXiv:2305.15060_ , 2023b.
  * Li et al. (2022a) Li, J., Li, D., Xiong, C., and Hoi, S.  Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation.  In _International Conference on Machine Learning_ , pp. 12888–12900. PMLR, 2022a.
  * Li et al. (2023) Li, R., Allal, L. B., Zi, Y., Muennighoff, N., Kocetkov, D., Mou, C., Marone, M., Akiki, C., Li, J., Chim, J., et al.  Starcoder: may the source be with you!  _arXiv preprint arXiv:2305.06161_ , 2023.
  * Li et al. (2024) Li, Y., Ren, J., Xu, H., and Liu, H.  Neural style protection: Counteracting unauthorized neural style transfer.  In _Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision_ , pp. 3966–3975, 2024.
  * Li et al. (2022b) Li, Z., Yu, N., Salem, A., Backes, M., Fritz, M., and Zhang, Y.  Unganable: Defending against gan-based face manipulation.  _arXiv preprint arXiv:2210.00957_ , 2022b.
  * Liang & Wu (2023) Liang, C. and Wu, X.  Mist: Towards improved adversarial examples for diffusion models.  _arXiv preprint arXiv:2305.12683_ , 2023.
  * Liang et al. (2023) Liang, C., Wu, X., Hua, Y., Zhang, J., Xue, Y., Song, T., Xue, Z., Ma, R., and Guan, H.  Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples.  _arXiv preprint arXiv:2302.04578_ , 2023.
  * Ling et al. (2021) Ling, H., Kreis, K., Li, D., Kim, S. W., Torralba, A., and Fidler, S.  Editgan: High-precision semantic image editing.  _Advances in Neural Information Processing Systems_ , 34:16331–16345, 2021.
  * Liu et al. (2023a) Liu, A., Pan, L., Hu, X., Li, S., Wen, L., King, I., and Yu, P. S.  A private watermark for large language models.  _arXiv preprint arXiv:2307.16230_ , 2023a.
  * Liu et al. (2023b) Liu, A., Pan, L., Hu, X., Meng, S., and Wen, L.  A semantic invariant robust watermark for large language models.  _arXiv preprint arXiv:2310.06356_ , 2023b.
  * Liu et al. (2017) Liu, M.-Y., Breuel, T., and Kautz, J.  Unsupervised image-to-image translation networks.  _Advances in neural information processing systems_ , 30, 2017.
  * Liu et al. (2023c) Liu, Y., Li, Z., Backes, M., Shen, Y., and Zhang, Y.  Watermarking diffusion model.  _arXiv preprint arXiv:2305.12502_ , 2023c.
  * Lu et al. (2022) Lu, P., Mishra, S., Xia, T., Qiu, L., Chang, K.-W., Zhu, S.-C., Tafjord, O., Clark, P., and Kalyan, A.  Learn to explain: Multimodal reasoning via thought chains for science question answering.  _Advances in Neural Information Processing Systems_ , 35:2507–2521, 2022.
  * Lu. (2018) Lu., S.-A.  faceswap-gan, 2018.  URL https://github.com/shaoanlu/faceswap-GAN.
  * Luo et al. (2020) Luo, X., Zhan, R., Chang, H., Yang, F., and Milanfar, P.  Distortion agnostic deep watermarking.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pp. 13548–13557, 2020.
  * Ma et al. (2023a) Ma, W., Song, Y., Xue, M., Wen, S., and Xiang, Y.  The” code”of ethics: A holistic audit of ai code generators.  _arXiv preprint arXiv:2305.12747_ , 2023a.
  * Ma et al. (2023b) Ma, Y., Yang, H., Wang, W., Fu, J., and Liu, J.  Unified multi-modal latent diffusion for joint subject and text conditional image generation.  _arXiv preprint arXiv:2303.09319_ , 2023b.
  * Ma et al. (2023c) Ma, Y., Zhao, Z., He, X., Li, Z., Backes, M., and Zhang, Y.  Generative watermarking against unauthorized subject-driven image synthesis.  _arXiv preprint arXiv:2306.07754_ , 2023c.
  * Manyika & Hsiao (2023) Manyika, J. and Hsiao, S.  An overview of bard: an early experiment with generative ai.  _AI. Google Static Documents_ , 2, 2023.
  * Mirza & Osindero (2014) Mirza, M. and Osindero, S.  Conditional generative adversarial nets.  _arXiv preprint arXiv:1411.1784_ , 2014.
  * Nadkarni et al. (2011) Nadkarni, P. M., Ohno-Machado, L., and Chapman, W. W.  Natural language processing: an introduction.  _Journal of the American Medical Informatics Association_ , 18(5):544–551, 2011.
  * Navas et al. (2008) Navas, K., Ajay, M. C., Lekshmi, M., Archana, T. S., and Sasikumar, M.  Dwt-dct-svd based watermarking.  In _2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE’08)_ , pp. 271–274. IEEE, 2008\.
  * Nguyen et al. (2022) Nguyen, T. T., Huynh, T. T., Nguyen, P. L., Liew, A. W.-C., Yin, H., and Nguyen, Q. V. H.  A survey of machine unlearning.  _arXiv preprint arXiv:2209.02299_ , 2022.
  * Nichol & Dhariwal (2021) Nichol, A. Q. and Dhariwal, P.  Improved denoising diffusion probabilistic models.  In _International Conference on Machine Learning_ , pp. 8162–8171. PMLR, 2021.
  * Nichol et al. (2022) Nichol, A. Q., Dhariwal, P., Ramesh, A., Shyam, P., Mishkin, P., Mcgrew, B., Sutskever, I., and Chen, M.  Glide: Towards photorealistic image generation and editing with text-guided diffusion models.  In _International Conference on Machine Learning_ , pp. 16784–16804. PMLR, 2022.
  * Nie et al. (2023) Nie, G., Kim, C., Yang, Y., and Ren, Y.  Attributing image generative models using latent fingerprints.  _arXiv preprint arXiv:2304.09752_ , 2023.
  * Nie et al. (2022) Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., and Anandkumar, A.  Diffusion models for adversarial purification.  In _International Conference on Machine Learning_ , pp. 16805–16827. PMLR, 2022.
  * Ong et al. (2021) Ong, D. S., Chan, C. S., Ng, K. W., Fan, L., and Yang, Q.  Protecting intellectual property of generative adversarial networks from ambiguity attacks.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 3630–3639, 2021.
  * (96) OpenAI.  Dall·e 2 pre-training mitigations.  URL https://openai.com/research/dall-e-2-pre-training-mitigations.
  * Ouyang et al. (2022) Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., et al.  Training language models to follow instructions with human feedback.  _Advances in Neural Information Processing Systems_ , 35:27730–27744, 2022.
  * Pawelczyk et al. (2023) Pawelczyk, M., Neel, S., and Lakkaraju, H.  In-context unlearning: Language models as few shot unlearners.  _arXiv preprint arXiv:2310.07579_ , 2023.
  * Peng et al. (2023a) Peng, S., Chen, Y., Wang, C., and Jia, X.  Protecting the intellectual property of diffusion models by the watermark diffusion process.  _arXiv preprint arXiv:2306.03436_ , 2023a.
  * Peng et al. (2023b) Peng, W., Yi, J., Wu, F., Wu, S., Zhu, B., Lyu, L., Jiao, B., Xu, T., Sun, G., and Xie, X.  Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark.  _arXiv preprint arXiv:2305.10036_ , 2023b.
  * Pichler et al. (2010) Pichler, B. J., Kolb, A., Nägele, T., and Schlemmer, H.-P.  Pet/mri: paving the way for the next generation of clinical multimodality imaging applications.  _Journal of Nuclear Medicine_ , 51(3):333–336, 2010.
  * Radford et al. (2015) Radford, A., Metz, L., and Chintala, S.  Unsupervised representation learning with deep convolutional generative adversarial networks.  _arXiv preprint arXiv:1511.06434_ , 2015.
  * Radford et al. (2019) Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I., et al.  Language models are unsupervised multitask learners.  _OpenAI blog_ , 1(8):9, 2019.
  * Radford et al. (2021) Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al.  Learning transferable visual models from natural language supervision.  In _International conference on machine learning_ , pp. 8748–8763. PMLR, 2021.
  * Ramesh et al. (2022) Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M.  Hierarchical text-conditional image generation with clip latents.  _arXiv preprint arXiv:2204.06125_ , 2022.
  * Ren et al. (2022) Ren, J., Xu, H., Wan, Y., Ma, X., Sun, L., and Tang, J.  Transferable unlearnable examples.  _arXiv preprint arXiv:2210.10114_ , 2022.
  * Ren et al. (2023) Ren, J., Xu, H., Liu, Y., Cui, Y., Wang, S., Yin, D., and Tang, J.  A robust semantics-based watermark for large language model against paraphrasing.  _arXiv preprint arXiv:2311.08721_ , 2023.
  * Rombach et al. (2022) Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B.  High-resolution image synthesis with latent diffusion models.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 10684–10695, 2022.
  * Ronneberger et al. (2015) Ronneberger, O., Fischer, P., and Brox, T.  U-net: Convolutional networks for biomedical image segmentation.  In _Medical Image Computing and Computer-Assisted Intervention–MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part III 18_ , pp. 234–241. Springer, 2015.
  * Ruan et al. (2023) Ruan, L., Ma, Y., Yang, H., He, H., Liu, B., Fu, J., Yuan, N. J., Jin, Q., and Guo, B.  Mm-diffusion: Learning multi-modal diffusion models for joint audio and video generation.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 10219–10228, 2023.
  * Ruiz et al. (2020) Ruiz, N., Bargal, S. A., and Sclaroff, S.  Disrupting deepfakes: Adversarial attacks against conditional image translation networks and facial manipulation systems.  In _Computer Vision–ECCV 2020 Workshops: Glasgow, UK, August 23–28, 2020, Proceedings, Part IV 16_ , pp. 236–251. Springer, 2020.
  * Ruiz et al. (2023) Ruiz, N., Li, Y., Jampani, V., Pritch, Y., Rubinstein, M., and Aberman, K.  Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 22500–22510, 2023.
  * Saha et al. (2020) Saha, A., Subramanya, A., and Pirsiavash, H.  Hidden trigger backdoor attacks.  In _Proceedings of the AAAI conference on artificial intelligence_ , volume 34, pp. 11957–11965, 2020.
  * Salman et al. (2023) Salman, H., Khaddaj, A., Leclerc, G., Ilyas, A., and Madry, A.  Raising the cost of malicious ai-powered image editing.  _arXiv preprint arXiv:2302.06588_ , 2023.
  * Samuelson (2023) Samuelson, P.  Generative ai meets copyright.  _Science_ , 381(6654):158–161, 2023.
  * Sato et al. (2023) Sato, R., Takezawa, Y., Bao, H., Niwa, K., and Yamada, M.  Embarrassingly simple text watermarks.  _arXiv preprint arXiv:2310.08920_ , 2023.
  * Shan et al. (2023) Shan, S., Cryan, J., Wenger, E., Zheng, H., Hanocka, R., and Zhao, B. Y.  Glaze: Protecting artists from style mimicry by text-to-image models.  _arXiv preprint arXiv:2302.04222_ , 2023.
  * Sigal Samuel (2019) Sigal Samuel.  A guy made a deepfake app to turn photos of women into nudes. It didn’t go well.  https://www.vox.com/2019/6/27/18761639/ai-deepfake-deepnude-app-nude-women-porn, 2019\.
  * Somepalli et al. (2023a) Somepalli, G., Singla, V., Goldblum, M., Geiping, J., and Goldstein, T.  Diffusion art or digital forgery? investigating data replication in diffusion models.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 6048–6058, 2023a.
  * Somepalli et al. (2023b) Somepalli, G., Singla, V., Goldblum, M., Geiping, J., and Goldstein, T.  Understanding and mitigating copying in diffusion models.  _arXiv preprint arXiv:2305.20086_ , 2023b.
  * Song et al. (2020) Song, J., Meng, C., and Ermon, S.  Denoising diffusion implicit models.  _arXiv preprint arXiv:2010.02502_ , 2020.
  * Srivastava et al. (2017) Srivastava, A., Valkov, L., Russell, C., Gutmann, M. U., and Sutton, C.  Veegan: Reducing mode collapse in gans using implicit variational learning.  _Advances in neural information processing systems_ , 30, 2017.
  * Takezawa et al. (2023) Takezawa, Y., Sato, R., Bao, H., Niwa, K., and Yamada, M.  Necessary and sufficient watermark for large language models.  _arXiv preprint arXiv:2310.00833_ , 2023.
  * Tancik et al. (2020) Tancik, M., Mildenhall, B., and Ng, R.  Stegastamp: Invisible hyperlinks in physical photographs.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pp. 2117–2126, 2020.
  * Taori et al. (2023) Taori, R., Gulrajani, I., Zhang, T., Dubois, Y., Li, X., Guestrin, C., Liang, P., and Hashimoto, T. B.  Stanford alpaca: An instruction-following llama model.  https://github.com/tatsu-lab/stanford_alpaca, 2023.
  * Tirumala et al. (2022) Tirumala, K., Markosyan, A., Zettlemoyer, L., and Aghajanyan, A.  Memorization without overfitting: Analyzing the training dynamics of large language models.  _Advances in Neural Information Processing Systems_ , 35:38274–38290, 2022.
  * Touvron et al. (2023) Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., et al.  Llama 2: Open foundation and fine-tuned chat models.  _arXiv preprint arXiv:2307.09288_ , 2023.
  * Tramèr et al. (2016) Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., and Ristenpart, T.  Stealing machine learning models via prediction $\\{$APIs$\\}$.  In _25th USENIX security symposium (USENIX Security 16)_ , pp. 601–618, 2016.
  * Uchida et al. (2017) Uchida, Y., Nagai, Y., Sakazawa, S., and Satoh, S.  Embedding watermarks into deep neural networks.  In _Proceedings of the 2017 ACM on international conference on multimedia retrieval_ , pp. 269–277, 2017.
  * van den Burg & Williams (2021) van den Burg, G. and Williams, C.  On memorization in probabilistic deep generative models.  _Advances in Neural Information Processing Systems_ , 34:27916–27928, 2021.
  * Van Le et al. (2023) Van Le, T., Phung, H., Nguyen, T. H., Dao, Q., Tran, N., and Tran, A.  Anti-dreambooth: Protecting users from personalized text-to-image synthesis.  _arXiv preprint arXiv:2303.15433_ , 2023.
  * Vincent et al. (2010) Vincent, P., Larochelle, H., Lajoie, I., Bengio, Y., Manzagol, P.-A., and Bottou, L.  Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion.  _Journal of machine learning research_ , 11(12), 2010.
  * Vukotić et al. (2018) Vukotić, V., Chappelier, V., and Furon, T.  Are deep neural networks good for blind image watermarking?  In _2018 IEEE International Workshop on Information Forensics and Security (WIFS)_ , pp. 1–7. IEEE, 2018.
  * Vyas et al. (2023) Vyas, N., Kakade, S., and Barak, B.  Provable copyright protection for generative models.  _arXiv preprint arXiv:2302.10870_ , 2023.
  * Wang et al. (2019) Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B. Y.  Neural cleanse: Identifying and mitigating backdoor attacks in neural networks.  In _2019 IEEE Symposium on Security and Privacy (SP)_ , pp. 707–723. IEEE, 2019.
  * Wang et al. (2022) Wang, R., Huang, Z., Chen, Z., Liu, L., Chen, J., and Wang, L.  Anti-forgery: Towards a stealthy and robust deepfake disruption attack via adversarial perceptual-aware perturbations.  _arXiv preprint arXiv:2206.00477_ , 2022.
  * Wang et al. (2018) Wang, X., Yu, K., Wu, S., Gu, J., Liu, Y., Dong, C., Qiao, Y., and Change Loy, C.  Esrgan: Enhanced super-resolution generative adversarial networks.  In _Proceedings of the European conference on computer vision (ECCV) workshops_ , pp. 0–0, 2018.
  * Wang et al. (2023) Wang, Z., Chen, C., Liu, Y., Lyu, L., Metaxas, D., and Ma, S.  How to detect unauthorized data usages in text-to-image diffusion models.  _arXiv preprint arXiv:2307.03108_ , 2023.
  * Webster (2023) Webster, R.  A reproducible extraction of training images from diffusion models.  _arXiv preprint arXiv:2305.08694_ , 2023.
  * Webster et al. (2023) Webster, R., Rabin, J., Simon, L., and Jurie, F.  On the de-duplication of laion-2b.  _arXiv preprint arXiv:2303.12733_ , 2023.
  * Wen et al. (2023) Wen, Y., Kirchenbauer, J., Geiping, J., and Goldstein, T.  Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust.  _arXiv preprint arXiv:2305.20030_ , 2023.  URL https://arxiv.org/abs/2305.20030v3.
  * Westerlund (2019) Westerlund, M.  The emergence of deepfake technology: A review.  _Technology innovation management review_ , 9(11), 2019\.
  * Wu et al. (2020) Wu, H., Liu, G., Yao, Y., and Zhang, X.  Watermarking neural networks with watermarked images.  _IEEE Transactions on Circuits and Systems for Video Technology_ , 31(7):2591–2601, 2020.
  * Wu et al. (2023) Wu, R., Wang, Y., Shi, H., Yu, Z., Wu, Y., and Liang, D.  Towards prompt-robust face privacy protection via adversarial decoupling augmentation framework.  _arXiv preprint arXiv:2305.03980_ , 2023.
  * Xiong et al. (2023) Xiong, C., Qin, C., Feng, G., and Zhang, X.  Flexible and secure watermarking for latent diffusion model.  In _Proceedings of the 31st ACM International Conference on Multimedia_ , pp. 1668–1676, 2023.
  * Yan & Li (2022) Yan, W. and Li, Y.  Whygen: explaining ml-powered code generation by referring to training examples.  In _Proceedings of the ACM/IEEE 44th International Conference on Software Engineering: Companion Proceedings_ , pp. 237–241, 2022.
  * Yang et al. (2021) Yang, C., Ding, L., Chen, Y., and Li, H.  Defending against gan-based deepfake attacks via transformation-aware adversarial faces.  In _2021 international joint conference on neural networks (IJCNN)_ , pp. 1–8. IEEE, 2021.
  * Yang et al. (2023) Yang, X., Chen, K., Zhang, W., Liu, C., Qi, Y., Zhang, J., Fang, H., and Yu, N.  Watermarking text generated by black-box language models.  _arXiv preprint arXiv:2305.08883_ , 2023.
  * Yao et al. (2023) Yao, Y., Xu, X., and Liu, Y.  Large language model unlearning.  _arXiv preprint arXiv:2310.10683_ , 2023.
  * Yeh et al. (2020) Yeh, C.-Y., Chen, H.-W., Tsai, S.-L., and Wang, S.-D.  Disrupting image-translation-based deepfake algorithms with adversarial attacks.  In _Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision Workshops_ , pp. 53–62, 2020.
  * Yoo et al. (2023) Yoo, K., Ahn, W., and Kwak, N.  Advancing beyond identification: Multi-bit watermark for language models.  _arXiv preprint arXiv:2308.00221_ , 2023.
  * Yoon et al. (2021) Yoon, J., Hwang, S. J., and Lee, J.  Adversarial purification with score-based generative models.  In _International Conference on Machine Learning_ , pp. 12062–12072. PMLR, 2021.
  * Yu et al. (2020) Yu, N., Skripniuk, V., Chen, D., Davis, L., and Fritz, M.  Responsible disclosure of generative models using scalable fingerprinting.  _arXiv preprint arXiv:2012.08726_ , 2020.
  * Yu et al. (2021) Yu, N., Skripniuk, V., Abdelnabi, S., and Fritz, M.  Artificial fingerprinting for generative models: Rooting deepfake attribution in training data.  In _Proceedings of the IEEE/CVF International conference on computer vision_ , pp. 14448–14457, 2021.
  * Zeng et al. (2023) Zeng, S., Li, Y., Ren, J., Liu, Y., Xu, H., He, P., Xing, Y., Wang, S., Tang, J., and Yin, D.  Exploring memorization in fine-tuned language models.  _arXiv preprint arXiv:2310.06714_ , 2023.
  * Zhan et al. (2023) Zhan, F., Yu, Y., Wu, R., Zhang, J., Lu, S., Liu, L., Kortylewski, A., Theobalt, C., and Xing, E.  Multimodal image synthesis and editing: A survey and taxonomy.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 2023.
  * Zhang et al. (2021) Zhang, C., Ippolito, D., Lee, K., Jagielski, M., Tramèr, F., and Carlini, N.  Counterfactual memorization in neural language models.  _arXiv preprint arXiv:2112.12938_ , 2021.
  * Zhang et al. (2023a) Zhang, E., Wang, K., Xu, X., Wang, Z., and Shi, H.  Forget-me-not: Learning to forget in text-to-image diffusion models.  _arXiv preprint arXiv:2303.17591_ , 2023a.
  * Zhang et al. (2022a) Zhang, L., Liu, Y., Liu, S., Yang, T., Wang, Y., Zhang, X., and Wu, H.  Generative model watermarking based on human visual system.  _arXiv preprint arXiv:2209.15268_ , 2022a.
  * Zhang et al. (2023b) Zhang, L., Liu, Y., Zhang, X., and Wu, H.  Generative model watermarking suppressing high-frequency artifacts.  _arXiv preprint arXiv:2305.12391_ , 2023b.
  * Zhang et al. (2018) Zhang, R., Isola, P., Efros, A. A., Shechtman, E., and Wang, O.  The unreasonable effectiveness of deep features as a perceptual metric.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pp. 586–595, 2018.
  * Zhang et al. (2019) Zhang, R., Dong, S., and Liu, J.  Invisible steganography via generative adversarial networks.  _Multimedia tools and applications_ , 78:8559–8575, 2019\.
  * Zhang et al. (2022b) Zhang, S., Roller, S., Goyal, N., Artetxe, M., Chen, M., Chen, S., Dewan, C., Diab, M., Li, X., Lin, X. V., et al.  Opt: Open pre-trained transformer language models.  _arXiv preprint arXiv:2205.01068_ , 2022b.
  * Zhang et al. (2023c) Zhang, S., Dong, L., Li, X., Zhang, S., Sun, X., Wang, S., Li, J., Hu, R., Zhang, T., Wu, F., et al.  Instruction tuning for large language models: A survey.  _arXiv preprint arXiv:2308.10792_ , 2023c.
  * Zhao et al. (2021) Zhao, X., Yao, Y., Wu, H., and Zhang, X.  Structural watermarking to deep neural networks via network channel pruning.  In _2021 IEEE International Workshop on Information Forensics and Security (WIFS)_ , pp. 1–6. IEEE, 2021.
  * Zhao et al. (2023a) Zhao, X., Ananth, P., Li, L., and Wang, Y.-X.  Provable robust watermarking for ai-generated text.  _arXiv preprint arXiv:2306.17439_ , 2023a.
  * Zhao et al. (2023b) Zhao, Y., Pang, T., Du, C., Yang, X., Cheung, N.-M., and Lin, M.  A recipe for watermarking diffusion models.  _arXiv preprint arXiv:2303.10137_ , 2023b.
  * Zhu et al. (2018) Zhu, J., Kaplan, R., Johnson, J., and Fei-Fei, L.  Hidden: Hiding data with deep networks.  In _Proceedings of the European conference on computer vision (ECCV)_ , pp. 657–672, 2018.
  * Zhu et al. (2020) Zhu, J., Shen, Y., Zhao, D., and Zhou, B.  In-domain gan inversion for real image editing.  In _European conference on computer vision_ , pp. 592–608. Springer, 2020.
  * Zhu et al. (2016) Zhu, J.-Y., Krähenbühl, P., Shechtman, E., and Efros, A. A.  Generative visual manipulation on the natural image manifold.  In _Computer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part V 14_ , pp. 597–613. Springer, 2016.
  * Zhu et al. (2017) Zhu, J.-Y., Park, T., Isola, P., and Efros, A. A.  Unpaired image-to-image translation using cycle-consistent adversarial networks.  In _Proceedings of the IEEE international conference on computer vision_ , pp. 2223–2232, 2017.
  * Zhu et al. (2019) Zhu, M., Pan, P., Chen, W., and Yang, Y.  Dm-gan: Dynamic memory generative adversarial networks for text-to-image synthesis.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pp. 5802–5810, 2019.
  * Zirpoli (2023) Zirpoli, C. T.  Generative artificial intelligence and copyright law.  2023\.