Attribution as Retrieval: Model-Agnostic AI-Generated Image Attribution
Authors: Hongsong Wang, Renxi Cheng, Chaolei Han, Jie Gui
Organizations: School of Computer Science and Engineering, Southeast University, Nanjing 210096, China · Key Laboratory of New Generation Artificial Intelligence Technology and Its Interdisciplinary Applications (Southeast University), Ministry of Education, China · School of Cyber Science and Engineering, Southeast University, Nanjing 210096, China · Purple Mountain Laboratories, Nanjing 210000, China · Engineering Research Center of Blockchain Application, Supervision And Management (Southeast University), Ministry of Education, China
With the rapid advancement of AIGC technologies, image forensics will encounter unprecedented challenges. Traditional methods are incapable of dealing with increasingly realistic images generated by rapidly evolving image generation techniques. To facilitate the identification of AI-generated images and the attribution of their source models, generative image watermarking and AI-generated image attribution have emerged as key research focuses in recent years. However, existing methods are model-dependent, requiring access to the generative models and lacking generality and scalability to new and unseen generators. To address these limitations, this work presents a new paradigm for AI-generated image attribution by formulating it as an instance retrieval problem instead of a conventional image classification problem. We propose an efficient model-agnostic framework, called Low-bIt-plane-based Deepfake Attribution (LIDA). The input to LIDA is produced by Low-Bit Fingerprint Generation module, while the training involves Unsupervised Pre-Training followed by subsequent Few-Shot Attribution Adaptation. Comprehensive experiments demonstrate that LIDA achieves state-of-the-art performance for both Deepfake detection and image attribution under zero- and few-shot settings. The code is at https://github.com/hongsong-wang/LIDA
Figures & tables
Figure 1: Comparison between generative image watermarking and our retrieval-based AI-generated image attribution. Our framework is concise, versatile, and easily adapted to new image generators.
Figure 2: Pipeline of the proposed model-agnostic framework LIDA for AI-generated image attribution. LIDA treats image attribution as an instance retrieval problem, and uses low-bit-plane-based generative fingerprint as the input. The training stage consists of two consecutive steps: (a) unsupervised pre-training and (b) few-shot attribution adaptation.
Figure 3: Comparison of AI-generated images and low-bit generative fingerprints from different image generators. Generators include Stable Diffusion [ 39 ] , ADM [ 13 ] , and Wukong [ 59 ] .
Figure 4: Feature distribution of images from different sources for (a) RGB images and (b) low-bit generative fingerprints.
Figure 5: Impact of loss weight for (a) AI-generated image attribution and (b) AI-generated image detection.
Figure 6: Robustness analysis and comparison of adaptation time: (a) Robustness to image degradation under Gaussian blur and JPEG compression, where β represents the degree of blurring and image quality. (b) Comparison of the running time for unsupervised pre-training and few-shot attribution adaptation.
Figure 7: Illustration of retrieval-based image attribution. The top-ranked retrieval results from the database are listed, with the correct result highlighted by a red bounding box. The queries are a real image, a BigGAN-generated [ 2 ] image, and a Midjourney-generated [ 33 ] image, respectively.
Figure 8: Illustration of retrieval-based image attribution. The top-ranked retrieval results from the database are listed, with the correct result highlighted by a red bounding box. The queries are a Wukong-generated [ 59 ] image, a SDV4-generated image, and a SDV5-generated [ 40 ] image, respectively.
Figure 9: Illustration of retrieval-based image attribution. The top-ranked retrieval results from the database are listed, with the correct result highlighted by a red bounding box. The queries are a ADM-generated [ 12 ] image, a GLIDE-generated image [ 34 ] , and a VQDM-generated [ 17 ] image, respectively.
Figure 10: Illustration of low-bit generative fingerprints. Each image is divided into multiple patches, and the patch with the highest similarity score is selected for subsequent processing.
AI-generated image detection identifies synthetic or AI-edited images and develops methods that generalize across generators, domains, and image transformations.
As AI generative models evolve at unprecedented speed, image attribution has become a moving target. New diffusion, adversarial and autoregressive generators appear almost monthly, making existing watermark, classifier and inversion methods obsolete upon release. The core problem lies not in model recognition, but in the inability to adapt attribution itself. We introduce IncreFA, a framework that redefines attribution as a structured incremental learning problem, allowing the system to learn continuously as new generative models emerge. IncreFA departs from conventional incremental learning by exploiting the hierarchical relationships among generative architectures and coupling them with continual adaptation. It integrates two mutually reinforcing mechanisms: (1) Hierarchical Constraints, which encode architectural hierarchies through learnable orthogonal priors to disentangle family-level invariants from model-specific idiosyncrasies; and (2) a Latent Memory Bank, which replays compact latent exemplars and mixes them to generate pseudo-unseen samples, stabilising representation drift and enhancing open-set awareness. On the newly constructed Incremental Attribution Benchmark (IABench) covering 28 generative models released between 2022 and 2025, IncreFA achieves state-of-the-art attribution accuracy and 98.93% unseen detection under a temporally ordered open-set protocol. Code will be available at https://github.com/Ant0ny44/IncreFA.
Haotian Qin, Dongliang Chang, Yueying Gao +3
School of Artificial Intelligence, Beijing University of Posts and Telecommunications, China · Tsinghua University, China
AI-generated image (AIGI) attribution presents a pressing challenge that goes beyond mere AIGI detection, aiming to identify the source model or technique responsible for a synthetic image. However, most previous source attribution methods operate in a closed-set manner, which necessitates retraining to recognize any novel category, preventing adaptation to the rapid evolution of image generation. In this work, we propose a new paradigm for synthetic image attribution, termed few-shot attribution. This paradigm targets the reliable identification of unseen generators using only limited samples, making it highly suitable for real-world applications. To facilitate this work, we construct OmniFake, a large-scale, well-categorized synthetic image dataset that contains 1.17 million images from 45 distinct generators. We further introduce OmniDFA (Omni Detector and Few-shot Attributor), a few-shot attribution baseline that not only assesses the authenticity of images but also determines their synthesis origins. Experiments demonstrate that OmniDFA exhibits excellent capability in few-shot attribution and achieves state-of-the-art generalization performance in AIGI detection. Our dataset and code are available at https://github.com/teheperinko541/OmniDFA.
Shiyu Wu, Shuyan Li, Jing Li +2
Institute of Automation, Chinese Academy of Sciences, Beijing, China · Beijing Academy of Artificial Intelligence, Beijing, China · University of Chinese Academy of Sciences, Beijing, China +3
The rapid proliferation of generative models raises the model attribution problem: given only an image, can we determine which model produced it? We propose a lightweight CNN to solve this problem in a strict black box setting. The CNN operates on multiple image patches to handle varying image size and improve accuracy. It attributes more models at higher accuracy than prior work, reaching 98.9% on 25-class DRAGON and 95.0% on 27-class OpenFake; runs in a few milliseconds at a cost nearly independent of candidate-set size; and remains robust to transformations encountered in the wild. Beyond closed-set attribution, its learned representation serves as a reusable fingerprint backbone: it supports open-set rejection and few-shot enrollment, recovers model-family structure without lineage supervision, and groups images from unseen generators by source. Controlled ablations and causal perturbations show that its attribution decisions are driven by a spatially local, low-level signal that behaves as a generator-specific fingerprint.