[Paper Review] Do GANs leave artificial fingerprints?

Francesco Marra, Diego Gragnaniello+2 more|arXiv (Cornell University)|Dec 31, 2018

Digital Media Forensic Detection20 references4 citations

TL;DR

This paper demonstrates that Generative Adversarial Networks (GANs) leave consistent, detectable 'artificial fingerprints' in the images they generate, analogous to camera-specific PRNU patterns. By estimating residuals from generated images and averaging them, the authors extract stable, architecture-specific fingerprints that enable highly accurate source identification across multiple GAN models, even after JPEG compression.

ABSTRACT

In the last few years, generative adversarial networks (GAN) have shown tremendous potential for a number of applications in computer vision and related fields. With the current pace of progress, it is a sure bet they will soon be able to generate high-quality images and videos, virtually indistinguishable from real ones. Unfortunately, realistic GAN-generated images pose serious threats to security, to begin with a possible flood of fake multimedia, and multimedia forensic countermeasures are in urgent need. In this work, we show that each GAN leaves its specific fingerprint in the images it generates, just like real-world cameras mark acquired images with traces of their photo-response non-uniformity pattern. Source identification experiments with several popular GANs show such fingerprints to represent a precious asset for forensic analyses.

Motivation & Objective

• To investigate whether GANs leave unique, stable traces in their generated images, similar to camera PRNU patterns.
• To determine if these traces can be reliably extracted and used for forensic attribution of image sources.
• To evaluate the robustness of these fingerprints under common image processing operations like JPEG compression.
• To explore the discriminative power of GAN fingerprints in distinguishing between images generated by different GAN architectures.

Proposed method

• Estimate image content using a denoising filter $ f(X_i) $ to isolate high-level semantics from noise.
• Compute residuals as $ R_i = X_i - f(X_i) $, representing the difference between original and denoised images.
• Estimate the GAN fingerprint as the average of multiple residuals: $ \widehat{F} = \frac{1}{N} \sum_{i=1}^{N} R_i $.
• Use correlation analysis between residuals and fingerprints to validate fingerprint stability and detectability.
• Apply a minimum-distance rule for source attribution, comparing residuals to known fingerprints.
• Test robustness by applying JPEG compression (QF=95) and re-evaluating attribution accuracy.

Experimental results

Research questions

• RQ1 Do GANs leave consistent, detectable fingerprints in their generated images, independent of image content?
• RQ2 How robust are these fingerprints to common image processing operations such as JPEG compression?
• RQ3 Can GAN fingerprints be used to accurately attribute images to their source GAN architecture?
• RQ4 How do fingerprints differ across GAN architectures, and is there a correlation between similar architectures and similar fingerprints?
• RQ5 Can GAN fingerprints improve the performance of existing deep learning-based GAN detection systems?

Key findings

• GANs leave stable, architecture-specific fingerprints in generated images, detectable even in photorealistic outputs without visible artifacts.
• Source attribution using fingerprints achieves over 90% accuracy, with near-perfect performance in most cases, except for Star-GAN's male and smiling networks.
• The method maintains high accuracy (90.1% after compression) when images are compressed at QF=95, indicating strong robustness.
• Correlation analysis confirms that residuals from a given GAN correlate strongly only with their own fingerprint, not with fingerprints from other GANs or real cameras.
• Fingerprints from the same GAN architecture but different datasets show weaker but detectable correlations, suggesting fingerprint variation with training data.
• In the Forensics GAN Challenge, combining deep learning with GAN fingerprint detection improved AUC to 0.999, demonstrating practical utility in real-world detection tasks.