When you generate an image with a tool like ComfyUI, Automatic1111, or Forge, the software writes the full recipe into the file. Which base model you used, which LoRAs, your sampler and steps and guidance scale, the negative prompt you paste into every generation. It sits inside the PNG as plain text, and most people never know it is there. It does not include your name. We spent this study on a simpler question than it sounds: does it need to? Across roughly 15.7 million public AI images, the recipe alone was enough to pick a single creator out of about 92,000 people, from one image, more than half the time. No account, no server logs, no username. Just the bytes of the file.
The recipe is in the file, and your name is not
Open one of your own PNGs in a text viewer and you can see it. Automatic1111 and Forge write a block that starts with your prompt and ends with your settings. ComfyUI writes the entire node graph as JSON. Both live in the PNG's text chunks, unsigned and uncompressed, exactly where the format has allowed text since 1996.
We wrote a hundred-line reader that walks those chunks and pulls the recipe back out. To make sure this was not a quirk of old files, we generated three fresh images in the current ComfyUI release, gave each a different prompt, and kept one thing the same across all three: the negative prompt. The three pictures look nothing alike. Their fingerprints, read straight from the bytes, were identical. Then we uploaded one to Discord and downloaded it back. The file came down byte for byte the same, recipe intact.
That is the whole shape of the problem. The image can travel anywhere, stripped of the account that posted it, and still carry enough to point back at one person. The username was never in the file. Only the recipe was, and the recipe is enough.
One image is enough
To measure how much the recipe gives away, we built what is, as far as we can tell, the largest corpus ever assembled for this question: 15.7 million public AI images across four datasets and two platforms, covering about 92,000 distinct creators on Civitai.
We reduced each image to a fingerprint drawn only from the recipe, never from the picture and never from the descriptive prompt. Then we asked the basic attacker's question. Given one image with the account removed, and a reference set of everyone else's images, can you name the creator?
Against the full pool of about 92,000 Civitai creators, a single image lands on the right person 55.8 percent of the time, and still 54 percent even when we forbid near-duplicate reposts from matching, so it is not simply re-finding copies of the same picture. On the best single dataset the number is 68 percent. Random chance at that scale is roughly one in ninety thousand. The accuracy barely moves as the crowd grows: it is 67 percent against a thousand candidates and still 55 percent against ninety-two thousand. One reference image per suspect is enough to reach 63 percent. Put in information terms, the average image leaks about 14 bits about its creator, and the median image narrows the field to a single person outright.
It is you, not your tools
The obvious objection is that we are just detecting which model someone runs. We are not.
Strip the model out of the fingerprint entirely and the accuracy falls by less than two points. Go the other way and hold the model fixed, so that everyone in the comparison is using the exact same checkpoint and only individual habits can tell them apart, and a single image still finds the right person 69 to 82 percent of the time. Among 2,353 people all running the same popular anime model, we identified the individual 79 percent of the time.
The fingerprint is not any one thing. It is the whole loadout: the specific LoRAs you keep in rotation, the settings you have settled on, the software build you run, and the negative prompt you reuse. Remove any single piece and the rest still carries it.
Your negative prompt is your signature
The most exposed people are not the ones with rare custom models. They are ordinary users, and the thing that gives them away is the negative prompt.
Almost everyone who generates images develops a personal negative prompt, some particular string of "worst quality, bad hands, extra fingers" with their own edits, and pastes it into every generation without thinking about it. It feels like boilerplate. It is closer to a signature. Of the roughly half a million distinct negative prompts in our corpus, 90 percent are used by exactly one creator.
That single habit is enough on its own. Among users who own no custom asset at all, who run only mainstream shared models and LoRAs, 51 percent are still identifiable from one image, most often through the negative prompt they reuse without thinking. We checked those users against their public profiles: most publish nothing, they are hobbyists, not creators with a brand. They are also the least likely to have signed up for any of this.
Using only the structural parts of the recipe and no free text whatsoever, a single image still identifies its creator 35 percent of the time, and 76 percent for people who use a custom asset. The negative prompt roughly doubles the number for ordinary users. It is the tell that most people do not know they are leaving.
The platform decides your anonymity
The leak is not evenly distributed, and the reason is instructive.
DiffusionDB is 14 million images from the official Stable Diffusion Discord, where a shared bot pushed almost everyone toward the same defaults. Run the same attack on it and identification collapses to 1.8 percent, even after we hand it every structured field we can. The recipe is there, but it is nearly the same recipe for everyone, so it identifies no one.
Civitai is the opposite. Its users run their own tools with their own settings, and every choice ends up in the file. Same attack, 55.8 percent. The difference is not the people, it is how much the platform lets the recipe vary. This is the part worth sitting with: anonymity here is a property of how verbose your metadata is, not of whether your username is attached. DiffusionDB even hashed its usernames out of a stated concern for exactly this kind of harm. It did not matter, and it did not need to, because the homogenized recipe protected people on its own. On Civitai, the same hashing would protect no one.
It has a name, and it reaches a real person
None of this stays abstract for long.
For 8,191 creators in our corpus, some LoRA or embedding they use appears under exactly one account across all 15.7 million images. That resource is a signature. For 201 of them, the signature is literally their own handle, baked into a filename they published. Take one worked case, a prolific and entirely public creator we will not name here: 390 of the resources in their fingerprint are unique to them across the whole corpus, 356 of those are models they published on the platform, and a single one of their images identifies them 99.7 percent of the time. The chain runs from an anonymous image, to a filename in the metadata, to a search, to their live account.
We then took it to scale on people picked at random. On 10,000 creators drawn with no cherry-picking, a single bare image recovered the correct account 55.9 percent of the time, and 91 percent of those recovered accounts are live. For a thousand identifiable creators we also read only their own public profiles: 57 percent link out to an off-platform identity they published themselves, and a quarter link a payment account. So the full path, for a majority, runs from the bytes of one image to a persistent real identity, and every step past the account is something the person chose to make public. We performed no correlation and no reverse lookups, and we did none of this for ordinary users.
Scrape once, identify later
A reference database does not go stale quickly. We built one from a 2023 snapshot and used it to identify images from 2024, across a full generation of tooling change from the old Stable Diffusion era to SDXL and Flux. It still named 23 percent of them. A creator's fingerprint drifts over months, and by a year the average has faded toward noise, but the tail holds: anyone who keeps a single distinctive habit stays findable long after. The practical shape of the threat is that an attacker can build the database once and keep using it.
What actually stops it
The good news is that this is fixable, and the fix is specific.
Partial measures do not work. Removing LoRA names but keeping the prompt still leaves people identifiable. Removing the prompt but keeping the resource names does too. Only removing all of the free text, all of the resource identifiers, and the software build string together brings identification down to roughly chance. The tools already offer ways to strip metadata, but they are off by default, sometimes incomplete, and most people never find them. The clearest evidence that the opt-out is not working is this study itself: if people were turning it off, there would not be 15.7 million recipe-bearing images to build a corpus from.
We shared these findings and this recommendation directly with the tool developers and the platform on 16 July 2026, a week before publishing, and asked them to consider making stripping the default, making it reliable, and warning people that a shared image can identify them.
What this shows and does not show
This study is about people who share AI images online, which is a large and growing group, but it is not everyone. It measures identification against a known set of creators, the setting an attacker with a reference database actually faces. Against an open world where the person may not be in the database at all, the same method is weaker, and we report that in the paper: an image from a different platform or toolchain is rejected almost cleanly, while against a same-platform stranger not in the database about 40 percent of real creators are still named at a 10 percent false-accusation rate. The strongest single signal for ordinary users is the negative prompt, which is text, though it is reused habit text rather than any description of the image, and the structural recipe alone still identifies a third of people with no text at all. An account is not always one person, and we confirmed the results hold after removing automated batch accounts. Everything here applies to open tools that expose the recipe, and less so to closed services that homogenize it, as DiffusionDB shows.
Orygn LLC is an independent software and security practice. This research is non-commercial. The working data, which includes real handles, is kept private and is not published; everything shared here is aggregate or synthetic.