blog & research · models · Stable Diffusion

how do you spot a Stable Diffusion?

by Tuan Hoang · detection lead · last reviewed 2026-06-22
the ecosystem is the hard part.
developer
Stability AI (founded 2019)
modality
image generation, open weights
first release
SD 1.4, August 2022
ecosystem
Civitai hosts hundreds of thousands of fine-tunes + LoRAs
licensing
open weights, non-commercial to commercial depending on version
famous lawsuit
Getty Images v. Stability AI, UK High Court 2025
DETECTION SNAPSHOTwhat it makesan imageprovenanceno watermarkreads the pixels,not an embedded markattributionresemblesa best guess,never proofhardest family; abstains on maker
how amige. reads Stable Diffusion

Stable Diffusion is the open-weights diffusion model family from Stability AI (founded 2019, first release August 2022), plus the hundreds of thousands of community fine-tunes and LoRAs hosted on Civitai and Hugging Face. it's the model that turned image generation into something you could run on a gaming PC.

the ecosystem is the hard part. when people say “Stable Diffusion,” they could mean a vanilla SDXL generation from the official model, or a Civitai checkpoint trained for anime, or a photorealism LoRA on top of SD 1.5, or a custom community remix released yesterday. these all leave different fingerprints.

a vanilla SDXL output is trivial to flag. a Civitai checkpoint run through a face-fix LoRA and an upscaler is the hardest thing detectors do.

what a Stable Diffusion image looks like

hugely variable because of the fine-tune ecosystem. a Civitai anime LoRA looks nothing like a base SDXL output. but there are stable family tells across the ecosystem.

generic SD signatures: oversaturated colors. “magical hour” lighting bias. mangled background text. characteristic eye highlights (the “anime gleam”). the SDXL “wet plastic” skin texture. Civitai-style photorealism fine-tunes have a distinct retouched-Instagram-photo look that's unmistakable once you've seen it a dozen times.

how amige. detects Stable Diffusion

latent-space diffusion artifacts are the largest signal: the same frequency-domain peaks that betray DALL-E and Midjourney. amige. routes the scan to the detectors strongest on diffusion output, then a panel of independent detectors built by different teams weighs in. those reads get fused and calibrated before the attribution layer lists SDXL, SD 1.5, SD 2.x, and SD 3 as separate model-attribution classes because each leaves a distinct spectral fingerprint.

Stability's watermarking via the Stable Signature (Fernandez et al., ICCV 2023) was supposed to embed traceable watermarks directly in latent space, surviving moderate edits. in practice these don't survive LoRA fine-tuning, which means almost no Civitai-derived output carries them. AquaLoRA and SleeperMark are 2024-2025 research attempts to fix this; production watermarking for the SD ecosystem remains an open problem.

the difficulty curve

Stable Diffusion is the hardest model family to detect, because of the ecosystem. a vanilla SDXL output is trivial to flag. a Civitai photorealism checkpoint run through a face-fix LoRA, upscaled with an ESRGAN model, and saved as a 90% JPEG can fool most commercial detectors. cross-checkpoint generalization is the open research problem of the field.

for an amige. user: a Stable Diffusion verdict is amige. routing the scan, running its full panel, and landing on “I'm pretty sure this is AI but I can't tell you exactly who made it.” it abstains on the maker here rather than guess. the open ecosystem means the original prompt-author could be anyone with a $500 GPU. if the deepfake or non-consensual intimate imagery risk matters (real people, faces), Stable Diffusion is the model family where the long tail of bad actors lives.

the controversy worth knowing

Getty Images v. Stability AI ruled in the UK High Court on November 4, 2025. Getty lost the broad copyright-infringement claim (the court held that the model does not store reproductions of training data) but won a narrow trademark claim where the model regurgitated Getty's watermark visibly in some outputs. the ruling is the most cited landmark in AI-image copyright as of mid-2026.

a parallel issue, less litigated but more consequential at scale: Stable Diffusion is the dominant model in CSAM and non-consensual intimate imagery cases worldwide, because of the unfiltered fine-tunes that circulate on Civitai. Stability AI itself doesn't produce these models; the community does. detection in this category is high-stakes and amige. respects the deepfake-specific signals from the panel accordingly.

the whole machine (routing, the panel, calibration, when it abstains) lives at the machine. more on the underlying technique in what's a diffusion model.

version history

  1. Oct 2024
    SD 3.5. Three variants (Large 8B, Large Turbo, Medium 2.5B). Recovered reputation after SD3.
  2. Feb / Jun 2024
    SD 3. MMDiT architecture (transformer, not U-Net) + T5 text encoder. Initial release criticized for anatomy.
  3. Jul 2023
    SDXL 1.0. Native 1024×1024 output. Mainstreamed Stable Diffusion outside hobbyist circles.
  4. Nov-Dec 2022
    SD 2.0 / 2.1. OpenCLIP text encoder. Many users preferred 1.5 because 2.x was filtered for NSFW.
  5. Oct 2022
    SD 1.5. Released by RunwayML. Became the de-facto base for thousands of community fine-tunes.
  6. Aug 2022
    SD 1.4. First public release. Latent diffusion + CLIP text encoder. The image-generation explosion started here.

questions

the ecosystem is the hard part. ‘Stable Diffusion’ can mean a vanilla SDXL output, a Civitai anime checkpoint, a photorealism LoRA on top of SD 1.5, or a community remix released yesterday, and each leaves a different fingerprint. a plain SDXL image is quick to flag, but a Civitai checkpoint run through a face-fix LoRA, upscaled, and saved as a 90% JPEG fools most commercial detectors. cross-checkpoint generalization stays an open research problem.

Stability shipped the Stable Signature (Fernandez et al., ICCV 2023) to embed traceable watermarks in latent space and survive moderate edits. it doesn’t survive LoRA fine-tuning, so almost no Civitai-derived output carries it. AquaLoRA and SleeperMark are 2024 and 2025 research attempts to fix that, and production watermarking for the SD ecosystem stays unsolved.

the look varies across the fine-tune ecosystem, though family tells recur: oversaturated colors, a ‘magic hour’ lighting bias, mangled background text, the anime-gleam eye highlights, and the SDXL ‘wet plastic’ skin texture. Civitai photorealism fine-tunes carry a retouched-Instagram look that reads as fake once you’ve seen it a dozen times.

it’s the panel’s ‘this is AI, but I can’t name who made it’ answer. open weights mean the prompt-author could be anyone with a $500 GPU. this family also carries a long tail of bad actors: most non-consensual deepfake models trace back to unfiltered fine-tunes on Civitai, and the 2023 Stanford report found CSAM in the underlying LAION training data. amige. weights the deepfake-specific signals accordingly.

sources.

  1. 01
  2. 02
  3. 03
  4. 04
  5. 05
    Fernandez et al. — The Stable Signature (arXiv:2303.15435)
    The watermarking approach Stability shipped that doesn't survive LoRA fine-tuning.
  6. 06
AI image detector
check any image, Stable Diffusion included.
put one through amige →is this AI? →