Origin Identification for Text-Guided Image-to-Image Diffusion Models

We sincerely appreciate your efforts in reviewing our paper. We are encouraged that you find: (1) Most of claims are supported by clear and convincing evidence; (2) this paper proposes an important, novel, and interesting task; (3) the analysis appears thorough and comprehensive; (4) the paper is well-written, well-structured, and easy to follow. We address your questions below and will add these into the final version.

Q1. In the proof of Lemma 1, the derivation of z_0' in Eq. 13 appears problematic.

A1. We apologize for the confusion. We acknowledge that, in practice, this process is typically iterative, refining $z_t$ over many steps. However, Eq. 13 does not bypass the chain; rather, it is a mathematically equivalent alternative, as shown in [1] (See Eq. 15 and Progressive generation) and [2] (See Eq. 12 in https://shorturl.at/xhnd7). Furthermore, [1] also explicitly mentions that “there is also the possibility of predicting $x_0$”, but this gave worse empirical quality than iterative noise-prediction.

In other words, Eq. 13 is a convenient analytical step; practically, the preference for multi-step denoising is due to empirical gains from refining the prediction gradually. Please also see a discussion here: https://shorturl.at/RBZER. Nevertheless, we are happy to further discuss and revise Eq. 12 to Eq. 13.

[1] Denoising Diffusion Probabilistic Models, NeurIPS 2020

[2] Improved Denoising Diffusion Probabilistic Models, ICML 2021

Q2. How do you encode the origin? Do you directly add noise to the origin latents as SDEdit? Does DDIM inversion and attention control affect results, such as in prompt-to-prompt and plug-and-play?

A2. Thank you for the insightful question! The origins are first encoded by VAE, and noise is directly added to the resulting image latents, as in SDEdit. Nevertheless, DDIM inversion and attention control do not challenge the generalizability of our method. Experiments are shown below.

Experimental Setup. Since Prompt-to-Prompt cannot edit real images, we adopt its improved version, EDICT [1], a re-formulation of the DDIM process that allows mathematically exact inversion. Specifically, we:

• select 1,000 origins and ask GPT-4o to generate inversion prompts;
• input the inversion prompts, origins, and guidance prompts into EDICT and Plug-and-Play to generate translations. Here, we follow their original parameters;
• search these queries in 1,000,000 images, consisting of origins and distractor images.

Experimental Results. The table below shows that our model, trained on SD 2 and the SDEdit scheme, successfully generalizes to these new schemes. Again, these experiments validate our Hypothesis 1, i.e., the generalization boundary of our method is determined by whether the generated image is conditioned on a VAE-encoded original image.

[1] Edict: Exact diffusion inversion via coupled transformations, CVPR 2023

Q3. The influence of the denoising strength. Does it still make sense to retrieve the origin if the generated image bears little resemblance to it (Fig. 10 (c) indoor)?

A3. Thank you for the insightful question! The influence of denoising strength is discussed in Q1 by Reviewer PzDk. We acknowledge that it is challenging to clearly define resemblance. Nevertheless, the origin and generations in Fig. 10 (c) share similarities, such as the pool table, indoor setting, lighting placement, viewpoint, and room layout. We argue that retrieving the origins at very large strengths does not make sense, as shown by our failures: https://huggingface.co/datasets/ICML2025Rebuttal/ICML2025_Rebuttal/resolve/main/fail_example.pdf

Q4. How does CFG affect results?

A4. Thank you for the insightful question! In our paper, experiments are conducted at CFG=7.5, which is default for most diffusion models. The table below shows our method performs well across many commonly-used CFGs. These experiments are obtained by training on SD 2 at CFG=7.5 and testing on ColorfulXL at varying CFGs.

Q5. InstructPix2Pix and IP-Adapter encode the origin through VAE latents concatenation and CLIP embeddings, which is discussed in App. G. Fig. 13 (b) is a bit confusing.

A5. Thank you for the kind reminder! Fig. 13 (b) aims to provide a unified perspective on how InstructPix2Pix and IP-Adapter encode the origin. We apologize for omitting the concatenation in InstructPix2Pix. Following your advice, we will replace Fig. 13 (b) in the App. G with textual description in the Related Work.

Q6. In Fig. 10, there are 3 subjects instead of 6?

A6. Thank you for the kind reminder! You're right—we'll fix it to 3 in the final version.

We sincerely appreciate your efforts in reviewing our paper. We are encouraged that you find: (1) the proposed linear transformation approach is simple, efficient, and theoretically grounded; (2) OriPID dataset provides a strong benchmark for future work on ID$^2$; (3) Extensive experiments demonstrate generalization across multiple diffusion models. We address your questions below and will incorporate all your suggestions into the final version of our paper.

Q1. The prerformance on other diffusion-based models, e.g., FLUX.1-dev, is not explored.

A1. Thank you for this valuable suggestion. Accordingly, we evaluate our proposed method on images generated by FLUX.1-dev. The experiments below show that our method generalizes well to FLUX.1-dev.

Q2. The paper does not include visualizations of successful/failed origin identification results, which would make the claim stronger.

A2. Thank you for this valuable suggestion. Accordingly, we visualize several successful origin identification results, available at https://huggingface.co/datasets/ICML2025Rebuttal/ICML2025_Rebuttal/resolve/main/success.pdf. Our observations indicate that the origin of queries—spanning various topics and generated by different diffusion models—can be effectively traced. The failure cases are available in the Appendix (Section E).

Q3. Current T2I and I2I models also contributed by auto-regressive models. However, this paper only works on diffusion-based methods.

A3. Thank you for your valuable comment. We acknowledge these autoregression advancements and the current scope of our work is indeed focused on diffusion-based methods. This is because diffusion models remain a cornerstone in both research and industry due to their proven reliability and high-quality results. As a result, the dataset, method, and theory we introduce are directly applicable to practical scenarios and thus useful. Nevertheless, we agree that exploring auto-regressive approaches is an important future direction, and we plan to investigate them in our subsequent work.

Q4. Limited real-world validation: The dataset is synthetic, and real-world image alterations (e.g., Photoshop edits) are not explored.

A4. Thanks for this valuable suggestion. Accordingly, we evaluate our method on a new dataset, SEED-Data-Edit [1], which contains 52k image editing samples. These samples were collected from amateur photographers who posted their images along with editing requests. Photoshop experts then fulfilled these requests, providing the edited images as target images.

Experimentally, we (1) de-duplicate to get 10,274 image pairs; and (2) treat the edited (target) images as queries and search for them within a pool consisting of their origins along with 1,000,000 distractor images.

The experiments below show that: (1) our method generalizes effectively to real-world, manually edited images; and (2) it achieves the best performance compared to all competing methods.

[1] Seed-data-edit technical report: A hybrid dataset for instructional image editing

Q5. Contribution Point 3 in introduction lists seven performance numbers but does not directly specify which numbers correspond to which models.

A5. Thanks for this suggestion. We will list them explicitly in the final version: (2) the effectiveness of our proposed method: it achieves 88.8%, 81.5%, 87.3%, 89.3%, 85.7%, 85.7%, and 90.3% mAP, respectively, for Stable Diffusion 2, Stable Diffusion XL, OpenDalle, ColorfulXL, Kandinsky-3, Stable Diffusion 3, and Kolors.

Q6. What happens if an image is generated by an auto-regressive model and later modified by a diffusion model?

A6. Thank you for the question. In response, we (1) generate 5,000 images using Janus-Pro-7B and modify them with ColorfulXL, and (2) use the modified images as queries to search within a pool containing the original Janus-Pro-7B outputs along with 1,000,000 distractor images.

The experimental results indicate that our method achieves similar performance whether the origin is a real image or one generated by an auto-regressive model.

Q7. Will the paper release the OriPID dataset?

A7. Yes! All the proposed datasets (including training, query, and gallery images) and all code (including training, testing, and dataset-generation code) will be made publicly available to facilitate future research.

We sincerely appreciate your efforts in reviewing our paper. We are encouraged that you find our work (1) provides a large-scale and carefully curated benchmark, (2) proposes a novel retrieval-based method, (3) includes theoretical arguments, (4) is intuitive and make sense, and (5) is empirically superior to baselines. We address your questions below and will incorporate all your suggestions into the final version of our paper.

Q1. The proposed dataset does not containing the editing strength, and the paper does not show how will the proposed method perform with different editing strength.

A1. Thanks for your kind reminders. During testing, the editing strengths for Stable Diffusion 2, Stable Diffusion XL, OpenDalle, ColorfulXL, Kandinsky-3, Stable Diffusion 3, and Kolors, are 0.9, 0.8, 0.7, 0.7, 0.6, 0.8, and 0.7, respectively. The editing strengths used in testing are manually set to prevent significant visual differences between the generated images and the original ones. During training, the editing strength for Stable Diffusion 2 is 0.9.

The table below shows how the proposed method performs under different editing strengths. We observe that although the training and testing images come from different diffusion models with varying editing strengths, the performance of our method remains consistently high across most editing strengths.

It is important to note that:

• strength = 1 means it's almost like generating from pure noise, which is approximately equivalent to text-to-image generation. Therefore, it is reasonable that we cannot find the origins in that case.
• As shown in https://huggingface.co/datasets/ICML2025Rebuttal/ICML2025_Rebuttal/resolve/main/fail_example.pdf, we give some examples of strengths where our method fails. These queries are indeed very visually dissimilar with the origins.
• We do not change the training editing strength for Stable Diffusion 2 while varying test editing strength. That means our method is also generalizable across varying editing strengths.

We sincerely appreciate your efforts in reviewing our paper. We are encouraged that you find: (1) this paper's claims are well-supported; (2) the proposed methods and evaluation criteria are well-aligned with the origin identification task; (3) the experimental design is generally well-structured with well-justified evaluation metrics; (4) the supplementary is well-structured; and (5) this paper presents a well-executed study. We address your questions below and will add these into the final version.

Q1. Testing on more diverse diffusion models (e.g., InstructPix2Pix, IP-Adapter) would strengthen this claim. The authors only tested on VAE-based diffusion models.

A1. Thank you for your kind reminder. As shown in the Appendix (Table 9 and Sec. G), we have evaluated our model’s performance on InstructPix2Pix and IP-Adapter, which use VAE and CLIP to encode original images, respectively. The experiments show that our method successfully generalizes to InstructPix2Pix but fails on IP-Adapter.

Based on these experimental results and the theoretical analysis in the main paper, we argue that the generalization boundary of our method is whether the generated image is conditioned on a VAE-encoded original image. Notably, this VAE can vary in architecture and parameters—such as Stable Diffusion, Kolors, and Flux, and the conditioning schemes can also differ—such as those used in SDEdit and InstructPix2Pix (shown in our paper), or Prompt-to-Prompt and Plug-and-Play (see experiments in the Q2 of Reviewer gjdS).

Although this generalization boundary does not cover all possible scenarios, our method remains practically valuable because: (1) most current image-to-image methods indeed utilize a VAE to encode original images; and (2) as shown in Table 9, in fact, no existing methods succeed on IP-Adapter.

In conclusion, our method is currently the most effective one with substantially superior performance. Nevertheless, we acknowledge the importance of overcoming this generalization boundary and consider it as future work.

Q2. This paper does not compare linear transformation against other transformations.

A2. Thank you for your insightful question. As shown in Fig. 9 of the main paper and Sec. F of the Appendix, we have discussed the transformations of multilayer perceptrons (MLPs) with activation functions. We observe that this case leads to an overfitting problem.

Here, we add two alternative architectures: a single convolutional layer and a multi-head attention layer. The below experiments show that: (1) likely due to underfitting, the convolutional layer results in a performance drop; and (2) although the multi-head attention layer marginally improves performance on seen images, its performance on unseen images falls behind our method, due to overfitting.

Q3. Introducing hard negative mining.

A2. Thank you for your valuable suggestion. Following it, we combine our currently-used CosFace with a hard mining triplet loss. However, as shown in the table below, this approach does not bring performance improvement. This result is reasonable, as the original CosFace paper suggests that once we aim to train a large margin between classes, additional hard negative mining becomes unnecessary.

Q4. No evaluation on image cropping, resizing, or watermarking.

A4. Thank you for your valuable suggestion. Following it, we conduct experiments involving image cropping, resizing, and watermarking. As shown in https://huggingface.co/datasets/ICML2025Rebuttal/ICML2025_Rebuttal/resolve/main/mod.pdf, our method is relatively robust against these modifications.

Q5. This paper does not deeply analyze failure cases.

A5. Thanks for this insightful suggestion. We provide an analysis here: our model uses a VAE to compress high-dimensional inputs into a lower-dimensional latent representation. This compression tends to smooth out subtle local details, causing the model to lose critical fine-grained distinctions between similar yet different instances. Furthermore, the imposed prior encourages a uniform distribution in the latent space, forcing nuanced features from distinct instances into overlapping latent representations. These factors reduce the model’s capability to differentiate hard negatives from true positives.

Q6. Are the proposed datasets and codes publicly available?

A6. Yes! All the proposed datasets (including training, query, and gallery images) and all code (including training, testing, and dataset-generation code) will be made publicly available.