One AI Image Is Enough
To Identify You

When you make an image in ComfyUI, Automatic1111, or Forge, the software quietly writes down how it made it and tucks that record inside the file. Which base model you loaded, which LoRAs, the sampler and steps and guidance scale, and the negative prompt you paste into every generation. It goes into the PNG as plain text, and most people never know it is there.

It does not include your name. That part matters more than it sounds. A file with your name in it is not much of a mystery. A file with only a recipe in it feels anonymous, so it travels. You send it in a chat, you repost it without a handle attached, it leaks from somewhere. And the recipe rides along the whole way.

We wanted to know how much that recipe gives away once the account is gone. The answer, written up in full in the paper, is more than we expected. Against a pool of about 92,000 Civitai creators, a single image lands on the right person 55.8 percent of the time. Chance at that scale is roughly one in ninety thousand. It is not a fluke of duplicates either: it holds at 54 percent even when we forbid near-identical reposts from matching. One image, no account, no server logs, more than half the time.

Open one of your own PNGs in a plain text viewer and you can read it yourself. Automatic1111 and Forge write a single block that starts with your prompt and ends with your settings. ComfyUI writes the entire node graph as JSON. Both sit in the PNG's text chunks, which are unsigned and uncompressed, exactly where the format has allowed text since 1996. Nothing is encrypted. Nothing is hidden. It is just there.

None of that is new, and the tool communities have talked about it for years. What nobody had measured is how identifying the default metadata is once you set the prompt aside. The worry has always been "my prompt is visible." The real problem is different, and larger. The recipe is a behavioral fingerprint, and it is precise enough to pick you out of a crowd.

Here is the whole thing on real files. I generated three images in a current ComfyUI, gave each a completely different prompt, a castle, a cyberpunk street, a dog, and kept one thing the same across all three: my negative prompt. The pictures look nothing alike.

Dropped into File X-Ray, each one comes back flagged as AI-generated, with the exact checkpoint read straight out of the PNG. No account, no prompt typed in, just the file:

The obvious objection is that we are just detecting which model somebody runs. We are not. Strip the base model out of the fingerprint entirely and the accuracy falls by less than two points. Go the other way and hold the model fixed, so everyone in the comparison uses the same checkpoint and only personal habits separate them, and a single image still finds the right person 69 to 82 percent of the time.

Even with no free text at all, using only the structural parts of the recipe, one image still identifies its creator 35 percent of the time. The fingerprint is not any single thing. It is the whole loadout: the LoRAs you keep in rotation, the settings you have settled on, the build you run, the negative prompt you reuse. Take away any one piece and the rest still carries you.

The people most exposed by this are not the ones with rare custom models. They are ordinary users, and the thing that gives them away is the negative prompt. Almost everyone who generates images builds up a personal one, some particular run of "worst quality, bad hands, extra fingers" with their own tweaks, and pastes it into every single generation without a second thought. It feels like boilerplate. It is closer to a signature. Of the roughly half a million distinct negative prompts in our corpus, 90 percent are used by exactly one creator.

That habit alone is enough. Among users who own no custom asset at all, who run only mainstream shared models, 51 percent are still identifiable from a single image, most often through the negative prompt they reuse without thinking. We checked those people against their public profiles. Most publish nothing. They are hobbyists, not brands, and they are the least likely to have ever known any of this was happening.

None of this stays abstract for long. For 8,191 creators in the corpus, some LoRA or embedding they use appears under exactly one account across all 15.7 million images. That resource is a signature. Take one public case we do not name: a single one of their images identifies them 99.7 percent of the time, and the chain runs from an anonymous file, to a resource filename in the metadata, to a search, to their live account.

To be sure it was not cherry-picking, we ran it on 10,000 people drawn at random. A single bare image recovered the correct account 55.9 percent of the time, and 91 percent of those accounts are live right now. We stopped at the public account and did no cross-site correlation, and we did none of this for ordinary users. The point is only that the path exists, and it is short.

The leak is not spread evenly, and the reason is worth sitting with. DiffusionDB is 14 million images from the official Stable Diffusion Discord, where a shared bot nudged nearly everyone toward the same defaults. Run the exact same attack on it and identification collapses to 1.8 percent. The recipe is there, it is just nearly the same recipe for everyone, so it names no one. Civitai is the opposite, everyone runs their own setup, and the attack hits 55.8 percent. Anonymity turns out to be a property of how much your metadata varies, not of whether your name is attached.

Distribution matters too. A recipe only survives if the file does. Discord, imageboards, direct file hosts, and cloud or email attachments pass PNGs through untouched, so the recipe rides along. Most social platforms re-encode on upload, which throws the text chunks away. That is not a safety feature anyone designed for you, it is a side effect, and it flips the moment you send the original file instead of a re-encoded post.

The fix is specific, and half measures do not count. Remove the LoRA names but keep the prompt, still identifiable. Remove the prompt but keep the resource names, still identifiable. Only removing all of the free text, all of the resource identifiers, and the build string together brings it down to roughly chance. The generation tools already have ways to strip metadata, but they are off by default, sometimes incomplete, and most people never find them. A corpus built by selecting recipe-bearing images cannot measure how many people strip them, so this study says nothing about how widely the opt-outs are used - only that whatever is left carries enough to identify its author. We shared all of this with the tool developers and the platform before publishing.

This is the exact thing File X-Ray was built to show you. Drop an AI image in and it reads the recipe out of the bytes, flags the image as AI-generated, names the generator and the checkpoint, and lists any LoRAs it finds. The whole pipeline runs in your browser and the file never leaves your device. When you are done looking, it will hand you a stripped copy with the recipe removed, so you can share the picture without shipping the fingerprint.

Try it on your own generations first. If you made them with the defaults, the recipe is almost certainly right there. The full method, every number, and every limitation are in the paper, and the detector and data are on GitHub.