The Recipe Is the Fingerprint: Creator Deanonymization from Default AI-Image Metadata at Scale

Every mainstream AI image generator writes the full recipe of how an image was made into the image itself. The base model, the LoRAs and embeddings, the sampler and its settings, the negative prompt, and the software build all go into the PNG as cleartext, by default, and without the user's name. We show that this recipe is a behavioral fingerprint precise enough to name its creator. Across 15.7 million public AI images spanning four datasets and two platforms, and about 92,000 creators on Civitai, one of the largest platforms for openly shared AI images, a single image identifies its creator 55.8% of the time against the full population, and 54% even when near-duplicate reposts are forbidden from matching, using only the recipe and no account or server context. Chance is one in ninety thousand. This is closed-set identification against a known population. The open world, where the target may be absent, is harder and splits by distribution: an image from a different platform or toolchain matches almost no one and is rejected cleanly, while against a same-platform stranger not in the database about 40% of real creators are still named at a 10% false-accusation rate. Accuracy falls only gently as the pool of suspects grows and holds across a full year and a change of tooling generation. The signal is behavioral, not a proxy for tool choice: holding the base model fixed, a single image still names the individual 69 to 82% of the time, and a fingerprint built from structural fields alone, with no free text of any kind, still reaches 35%. It reaches ordinary users who own no custom assets, of whom 51% are identifiable, most often by the negative prompt they reuse without thinking. The magnitude of the leak is set by the platform: on DiffusionDB, drawn from the official Stable Diffusion Discord where the recipe is nearly identical for everyone, the same method reaches only 1.8%, and hashing usernames adds nothing. We demonstrate the full chain from an anonymous image to a named, living account, at scale: on 10,000 creators drawn at random, a single bare image recovers the correct account 55.9% of the time and 91% of the recovered accounts are live. We quantify the fix: only removing all free text, all resource identifiers, and the build string together drives identification below one percent, roughly a seventyfold drop though not fully to chance; partial redaction fails. We disclosed to the tool developers and the platform before publication. The working data is the deanonymization itself, the real accounts behind the images and the chains that link them, so it is kept private; we release only detectors, synthetic fixtures, and aggregate results.