Pith. sign in

REVIEW 4 major objections 6 minor 65 references

DNA: Dual-stage Native Attribution for Generated Image Source Tracing

T0 review · 4 major / 6 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that exact source-model attribution for AI-generated images is possible without any training, by splitting the task along a model's architecture: VAE-level signals pick the family, backbone prediction errors pick the exact

desk verdict Credible two-stage attribution method with a genuinely new fine-grained signal and a careful benchmark; the headline clean-setting numbers hold together, but the 'training-free' label is generous and real-world robustness is weak. read the letter →

arxiv 2607.13685 v1 pith:72YZWZUJ submitted 2026-07-15 cs.CV

Chao Wang , Kejiang Chen , Zijin Yang , Yaofei Wang , Yuang Qi , Weiming Zhang , Nenghai Yu This is my paper
classification cs.CV
keywords AI-generatedimageattributionwithin-familyvariantlatentdiffusionmodelsflowmatchingsourcemodeltracingnativepredictionconsistencyautoencoderdouble-reconstructionopen-set
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to solve a fine-grained forensics problem: given an AI-generated image, identify which specific checkpoint of a latent generative model produced it, not just which model family. It argues that attribution signals naturally stratify along the model's architecture—the VAE encodes family-shared reconstruction behavior while the generative backbone encodes variant-specific prediction behavior—and builds a two-stage pipeline that follows this hierarchy. Stage 1 screens open-set families using Autoencoder Double-Reconstruction (AEDR), a ratio of two cascaded VAE reconstruction errors; Stage 2 attributes within a family using Native Prediction Consistency (NPC), comparing backbone prediction errors across noise levels under a shared semantic caption. On the new DNA-30K benchmark spanning six families and 24 models, the method reaches 89.11% end-to-end accuracy, with NPC at 96.36% when the family is known. If right, it means exact source-model attribution is possible without watermarks, fine-tuning, or training an attribution network—only forward queries to public checkpoints.

What carries the argument

The engine of the method is Native Prediction Consistency (NPC), which measures, for each candidate backbone, the mean squared error between the model's own prediction and the ground-truth noise/velocity target on latents perturbed from the query image at multiple noise levels. Because the same noise samples and the same image caption are fed to every candidate, the comparison isolates backbone-specific fit. A discriminative-timestep selection step on a small calibration set keeps only noise levels where variants separate, and z-score normalization plus per-variant scalar offsets turn raw errors into comparable calibrated scores, whose minimum is the predicted source. Stage 1's Autoencoder D

What would settle it

Treat two checkpoints that share a generative backbone but use different VAEs as one family, generate images from both, and run DNA: Stage 1's VAE-level double-reconstruction ratio will not converge to a single family acceptance or will misroute, collapsing end-to-end accuracy toward random; this directly tests the paper's assumption that within-family variants share a VAE.

Watch

Extended reading notes

Core claim

The central claim is that in latent generative models the observable traces of an image's origin are separated by architectural level. The VAE's reconstruction operator responds asymmetrically to belonging versus non-belonging images—a double-reconstruction ratio near 1 indicates family membership—whereas the backbone's native prediction error, evaluated on identically perturbed latents under a shared semantic condition, is systematically lower for the true source variant than for its within-family siblings. The paper shows this signal exists in both denoising diffusion (epsilon-prediction) and flow matching (velocity-prediction) models, and that after z-score normalization and a per-variant

Load-bearing premise

The load-bearing premise is that a model family is exactly a set of checkpoints sharing the same or nearly identical VAE, so that VAE-level signals are family-wide and backbone-level signals are variant-specific; if a family contains checkpoints with materially different VAEs, Stage 1's representative-VAE screening and Stage 2's shared-VAE assumption both collapse.

Editorial extensions

If this is right

  • Exact checkpoint attribution among open-weight diffusion and flow-matching models is feasible with no training, using only forward passes; this supports license compliance and provenance auditing for public model hubs.
  • As long as within-family variants share a VAE, model-level attribution reduces to a family-specific NPC comparison, so adding a new variant to an existing family requires only re-running Stage 2 with a small calibration set—no redesign.
  • Because Stage 1 uses only VAEs, the auditor can screen a query image to a family before any backbone is loaded, cutting compute and enabling scaling to many families.
  • The same native-prediction objective covers both denoising diffusion and flow matching, so the method transfers to both paradigms without modification.
  • End-to-end accuracy of 89.11% on a 24-model open-set task where random guessing is below 1% suggests reconstruction- and prediction-consistency signals are substantially stronger than supervised or CLIP-based baselines in this regime.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The authors stop at closed-set within-family attribution, but their leave-one-out experiment (AUROC 0.651, 20.3% rejection at 95% acceptance) suggests a natural extension: with better rejection thresholds on NPC scores, one could detect an unknown variant from a known family.
  • The image-caption proxy for the original prompt is validated on only two families; a broader extension would test whether conditioning errors accumulate when query images are heavily edited or out-of-distribution from captions like those in the benchmark.
  • The robustness gap—Stage 1 drops to 9.55% under JPEG QF=75 while Stage 2 keeps 82.05%—implies that a compression-invariant VAE-level statistic, not a better backbone signal, is the bottleneck for real-world social-media attribution; the paper's DCT-domain variant is an early step in that direction.
  • The hierarchy insight may transfer to other latent generative domains (video, audio) where a frozen autoencoder and a generative backbone are coupled, suggesting a generic codec-level versus generative-level attribution template.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes DNA, a two-stage passive attribution pipeline for images produced by latent generative models. Stage 1 uses the authors' prior AEDR signal, a VAE double-reconstruction ratio with homogeneity calibration and per-family KDE thresholds, for open-set family-level screening under a unique-acceptance rule. Stage 2 introduces NPC, which compares native prediction errors of within-family variants on shared perturbed latents under a BLIP-2 semantic condition, selects discriminative timesteps from a calibration set, and applies cross-model z-score normalization plus per-variant scalar calibration before minimum-score attribution. The paper also introduces DNA-30K, a benchmark with 24 models in six families spanning denoising diffusion and flow matching, plus 6,000 unknown-source images. Reported results include 92.25% Stage 1 accuracy, 96.36% oracle Stage 2 accuracy, and 89.11% end-to-end accuracy on DNA-30K, with moderate robustness to sampling configuration and calibration-set size, and a documented weakness under JPEG recompression. The authors disclose that this work is a substantial extension of their prior AEDR conference paper.

Significance. If the results hold, this is a useful contribution to AI-generated-image forensics: it is, to my knowledge, the first benchmark specifically organized around within-family variant attribution, and the unified treatment of denoising diffusion and flow-matching backbones is a genuine step beyond prior reconstruction-based methods. The paper's strengths include a clean calibration/test protocol with disjoint captions, oracle and end-to-end evaluation, modular decoupling of the two stages, extensive ablations, and a publicly announced code release. The central signal is not circular in the sense of reducing to fitted values: the NPC statistic is defined from a native-prediction premise and then normalized and calibrated. However, the contribution rests on a few assumptions that need sharper empirical support before the stronger 'source tracing' claims are fully credible.

major comments (4)
  1. [Sec. IV-B, Eq. (5); Sec. VI, Table III] The entire coarse-to-fine decomposition rests on the claim that within-family variants share identical or 'highly compatible' VAEs. DNA-30K families, however, are selected by model lineage rather than by a demonstrated VAE-compatibility criterion. If any family contains a variant with a materially different VAE, Stage 1's representative-VAE thresholds and Stage 2's shared latent encoding z0 = E_k(x) (Sec. V-B1) are invalid, and both the family-level and model-level claims collapse. The authors should either empirically verify VAE compatibility for each family (e.g., report cross-VAE reconstruction distances or latent-distribution divergence between variants) or define an explicit operational compatibility criterion and construct the families accordingly.
  2. [Sec. V-B2, V-B3, Eqs. (15), (18); Sec. VII-F] NPC is not 'training-free' in the usual sense: discriminative timesteps are selected by maximizing calibration-set accuracy, and scalar offsets b_j are fitted to calibration labels by adaptive search. The paper explicitly defines 'training-free' as no gradient updates, which is internally consistent, but the abstract's 'without additional neural-network training' and the general title framing may overstate the claim. More importantly, the offset fitting uses the same calibration set that was used for timestep selection. The reported calibration-to-test gap is small (Table XIII), but a cross-validation or repeated-split analysis of b_j stability would be needed to rule out overfitting of the four to five per-family offsets.
  3. [Sec. VII-F3, Table XV] Semantic conditioning is the largest single component gain in the ablation (+20.31% in Table XIV), yet the BLIP-2 caption proxy is validated against ground-truth generation prompts on only two of the six families (SD1.x and FLUX.1). Since the method's deployment claim depends on BLIP-2 being a sufficient prompt substitute for all families, the Original-vs-Semantic comparison should be reported for the remaining four families, or the authors should otherwise justify that SD1.x and FLUX.1 are representative of all six.
  4. [Sec. IV-C, Eq. (6); Sec. VIII, Table XVI] The end-to-end accuracy claim assumes a closed set of known within-family variants. Under the motivating scenario of open-weight model hubs, an unknown fine-tuned checkpoint within a recognized family is a natural and important case. The leave-one-out analysis reports only AUROC 0.651 and Rej@95% = 20.3%, i.e., weak rejection capability. The formal objective in Eq. (6) makes this scope limitation clear, but the abstract and introduction should state prominently that the method attributes to a pre-enumerated candidate set and should not be read as general source tracing for arbitrary novel variants.
minor comments (6)
  1. [Abstract; Sec. V] The phrase 'training-free' appears in several places, while the method uses labeled calibration data for threshold estimation, timestep selection, and offset fitting. The authors should consistently use 'no neural-network training' or 'no gradient-based learning' to avoid confusion.
  2. [Table VII] The header layout of Table VII is difficult to parse. Please explicitly separate the 'Stage 1 fixed = AEDR' block from the 'Stage 2 fixed = NPC' block, and state which columns correspond to which combined pipeline.
  3. [Eq. (11)] The KDE bandwidth h is listed as a free parameter but no default value or selection rule is given. Please specify how h is set (e.g., Silverman's rule) and report sensitivity to α and h.
  4. [Sec. V-A4; Table V] The text '1/26' should read '1/2^6' for the random-chance calculation under the unique-acceptance rule. The table values themselves are consistent with 1/64.
  5. [Fig. 2] Column labels are a bit misleading: columns (3) and (4) illustrate NPC, while the column heading 'AEDR (VAE-Level)' appears over the whole row. Please align the subcaptions with the individual columns.
  6. [Sec. VII-E3, Table XII] The JPEG robustness result (end-to-end 9.15% at QF=75, 34.60% with DNA-DCT) is a substantial caveat for the 'real-world forensics' motivation. It is disclosed in the limitations, but it should also be highlighted where practical claims are made in the introduction.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: NPC is an external empirical hypothesis, calibration is disclosed on a disjoint split, and Stage-1 reuse of AEDR is re-evaluated rather than assumed.

full rationale

DNA's derivation chain is not circular in the load-bearing sense. Stage 2 (NPC) is defined from the unified native-prediction objective (Eq. 4) and the empirical premise that a source backbone has lower prediction error on its own latents (Sec. III-D, Sec. V-B). This premise is tested on held-out data, not encoded into the labels by construction. The only label-fit parameters are the family thresholds (Eq. 11), the discriminative timestep set (Eq. 15), and the per-variant scalar offsets b_j (Eq. 18); all are estimated on the calibration split and evaluated on the disjoint test split (Sec. VI, Tabs. V, VI, XIII). Test accuracy is therefore not statistically forced by these fits. Stage 1 reuses the authors' prior AEDR [34], but AEDR is re-evaluated in this paper as a component and is not an unverified premise; the paper reports its per-family behavior and compares it against baselines. The family partition (Eq. 5) is defined by VAE compatibility, so using VAE-level signals for family screening is aligned with the problem definition, yet whether the AEDR ratio actually separates families and whether backbone errors separate variants remain empirical questions answered by the experiments. No uniqueness theorem or ansatz is imported from self-citations. The paper even reports limitations inconsistent with a self-fulfilling construction: LOO unknown-variant AUROC of 0.651 and JPEG-compressed end-to-end accuracy of 34.60% (Sec. VIII, Tab. XII). Thus the central claims are independently supported rather than equivalent to the input definitions or fitted values.

Assumptions & free parameters 9 free parameters · 6 assumptions · 0 invented entities

DNA is an empirical method with a non-trivial number of hand-chosen and calibration-fitted parameters (α, Q, n, L*, S, τ_k, b_j). The strongest independent content is the NPC signal and the benchmark; the main liability is that several decision components are tuned on labeled calibration/validation data despite the 'training-free' label, and the self-cited AEDR supplies Stage 1.

free parameters (9)
  • KDE tail tolerance α = 0.03
    Default tail quantile for per-family acceptance thresholds τ_k in Eq. 11; hand-chosen; controls open-set rejection rate.
  • GLCM quantization bins Q = 32
    Eq. 10 homogeneity calibration H(x); hand-chosen; not swept.
  • GLCM direction and offset = unspecified
    Needed to compute P_x(i,j) in Eq. 10 but not reported; required for exact reproduction.
  • Calibration images per model n = 100 default
    Labeled calibration set used for KDE thresholds, timestep selection, and scalar offsets; ablated from 100 down to 5.
  • KDE bandwidth h = unspecified
    Bandwidth of the Gaussian kernel in Eq. 11; not stated; affects threshold quantile.
  • Discriminative timestep count L* per family = SD1.x 25, SD2.x 5, SD3.x 5, SDXL 10, FLUX.1 5, FLUX.2 5
    Selected on validation split from {5,...,40} via Eq. 15 per family; fitted to calibration/validation accuracy.
  • Monte Carlo noise samples S per family = SD1.x 30, SD2.x 10, SD3.x 20, SDXL 5, FLUX.1 5, FLUX.2 25
    Selected on validation split from {5,...,40}; affects variance of NPC error estimates.
  • Family-wise KDE thresholds τ_k = not reported per family
    Per-family (1−α) quantiles of calibrated ratio from calibration images (Eq. 11); fitted to belonging labels.
  • Model-level calibration offsets b_j(k) = J−1 per family, values not reported
    Offsets added to normalized NPC scores (Eq. 18), fitted by coarse-to-fine search maximizing calibration accuracy; one reference variant fixed at 0.
assumptions (6)
  • domain assumption VAE double reconstruction is asymmetric: for belonging images ℓ2≈ℓ1, for non-belonging ℓ2≪ℓ1.
    Sec. V-A1 (Eqs. 7-9); the Stage 1 family signal; validated empirically in AEDR prior work, treated as given.
  • domain assumption A source backbone has lower mean native prediction error on perturbed latents from its own images than non-source backbones.
    Sec. III-D and Sec. V-B; the load-bearing premise of NPC; supported by experiments but not proved.
  • domain assumption Model families can be partitioned by VAE compatibility; within-family variants share the same or highly compatible VAE.
    Eq. 5 and Sec. IV-B; required for Stage 1 representative-VAE screening and for attributing residual differences to backbones.
  • domain assumption BLIP-2 captions are a sufficient deployment-time proxy for original generation prompts.
    Sec. V-B1; explicitly tested only on SD1.x and FLUX.1 (Tab. XV); other families assumed to behave similarly.
  • domain assumption Calibration-set statistics (KDE densities, timestep accuracies, offset search) transfer to the held-out test set.
    Sec. V-A3, V-B2, V-B3; standard i.i.d. split assumption; supported by the small overfitting gap in Tab. XIII.
  • standard math The unified epsilon/velocity native prediction objective correctly describes both diffusion and flow backbones.
    Sec. III-D and Tab. II; a notational unification of standard objectives, no unproved content.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DNA: Dual-stage Native Attribution for Generated Image Source Tracing." pith.science (2026). https://pith.science/paper/72YZWZUJ

@misc{pith2026260713685,
  author       = {Pith},
  title        = {Pith review of: DNA: Dual-stage Native Attribution for Generated Image Source Tracing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/72YZWZUJ}},
  note         = {Machine review of arXiv:2607.13685}
}
read the original abstract

The rapid evolution of image generation has produced numerous within-family variants, making source-model attribution of suspect images increasingly important for digital forensics. Existing proactive methods rely on watermark embedding or model modification, which may degrade visual quality and limit deployment flexibility. Passive methods often rely on large-scale supervised training or a single reconstruction signal, limiting their ability to handle unknown sources and distinguish highly similar within-family variants. We observe that attribution signals in latent generative models are naturally stratified across architectural levels: VAE-level cues reflect family-shared information, whereas backbone-level cues capture variant-specific behaviors. Motivated by this insight, we propose Dual-stage Native Attribution (DNA), a coarse-to-fine framework that follows this hierarchy without additional neural-network training. The coarse-grained stage uses Autoencoder Double-Reconstruction (AEDR) for efficient open-set family-level screening. The fine-grained stage performs closed-set model-level attribution with Native Prediction Consistency (NPC), which compares native prediction errors of within-family variants across multiple noise levels under semantic conditioning and attributes the source via normalized calibrated scores. To enable systematic evaluation, we construct DNA-30K, a benchmark for within-family variant attribution under open-set family-level evaluation. It comprises 30,000 images generated by 24 candidate models across six families spanning both denoising diffusion and flow matching, plus non-candidate generated and natural images as unknown sources. Experiments show that DNA achieves 89.11% end-to-end attribution accuracy on a task where random guessing accuracy is below 1% and outperforms the strongest baseline by 33.81% even when AEDR is used as the coarse-grained stage.

Figures

Figures reproduced from arXiv: 2607.13685 by the authors.

Figure 1
Figure 1. Problem setting and the proposed paradigm. (a) Within-family variant [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Attribution signals at two architectural levels under different generative [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Overview of the DNA pipeline. A query image is first processed by [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Overview of DNA. Top: AEDR for coarse-grained family-level attribution under open-set family-level conditions, where KDE threshold estimation [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Closed-set model-level (Stage 2) attribution confusion matrices across the six families for the five methods, under the oracle setting where Stage 1 [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Stage 1 family-level attribution accuracy as the number of candidate 6 [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Stage 2 accuracy over the grid of noise-sample count [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

65 extracted references · 3 linked inside Pith

  1. [1]

    Denoising Diffusion Probabilistic Models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising Diffusion Probabilistic Models,” inAdvances in Neural Information Processing Systems, vol. 33, 2020, pp. 6840–6851

    2020

  2. [2]

    Flow Matching for Generative Modeling,

    Y . Lipman, R. T. Q. Chen, H. Ben-Hamu, M. Nickel, and M. Le, “Flow Matching for Generative Modeling,” inThe Eleventh International Conference on Learning Representations, 2023

    2023

  3. [3]

    High-Resolution Image Synthesis with Latent Diffusion Models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High-Resolution Image Synthesis with Latent Diffusion Models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 10 684–10 695

    2022

  4. [4]

    Diffusion Models Beat GANs on Image Synthesis,

    P. Dhariwal and A. Nichol, “Diffusion Models Beat GANs on Image Synthesis,” inAdvances in Neural Information Processing Systems, vol. 34, 2021, pp. 8780–8794

    2021

  5. [5]

    DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject- Driven Generation,

    N. Ruiz, Y . Li, V . Jampani, Y . Pritch, M. Rubinstein, and K. Aberman, “DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject- Driven Generation,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 22 500–22 510. 17

    2023

  6. [6]

    Fake AI-generated image of explosion near Pentagon spreads on social media,

    Aben ´e Clayton, “Fake AI-generated image of explosion near Pentagon spreads on social media,” https://www.theguardian.com/technology/ 2023/may/22/pentagon-ai-generated-image-explosion, May 2023

    2023

  7. [7]

    Detecting and Grounding Multi-Modal Media Manipulation and Beyond,

    R. Shao, T. Wu, J. Wu, L. Nie, and Z. Liu, “Detecting and Grounding Multi-Modal Media Manipulation and Beyond,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 46, no. 8, pp. 5556– 5574, 2024

    2024

  8. [8]

    Self-Supervised AI-Generated Image Detection: A Camera Metadata Perspective,

    N. Zhong, M. Zou, Y . Xu, Z. Qian, X. Zhang, B. Wu, and K. Ma, “Self-Supervised AI-Generated Image Detection: A Camera Metadata Perspective,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 48, no. 6, pp. 6192–6207, 2026

    2026

Show all 65 references
  1. [9]

    Models – Hugging Face,

    Hugging Face, “Models – Hugging Face,” [Online]. Available: https: //huggingface.co/models, accessed: Jun. 8, 2026

    2026

  2. [10]

    Civitai: The Home of Open-Source Generative AI,

    Civitai, “Civitai: The Home of Open-Source Generative AI,” [Online]. Available: https://civitai.com/, accessed: Jun. 8, 2026

    2026

  3. [11]

    HiDDeN: Hiding Data With Deep Networks,

    J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei, “HiDDeN: Hiding Data With Deep Networks,” inProceedings of the European Conference on Computer Vision, 2018, pp. 657–672

    2018

  4. [12]

    FIN: Flow-based Robust Watermarking with Invertible Noise Layer for Black- box Distortions,

    H. Fang, Y . Qiu, K. Chen, J. Zhang, W. Zhang, and E.-C. Chang, “FIN: Flow-based Robust Watermarking with Invertible Noise Layer for Black- box Distortions,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 4, 2023, pp. 5054–5061

    2023

  5. [13]

    MBRS: Enhancing Robustness of DNN-based Watermarking by Mini-Batch of Real and Simulated JPEG Compression,

    Z. Jia, H. Fang, and W. Zhang, “MBRS: Enhancing Robustness of DNN-based Watermarking by Mini-Batch of Real and Simulated JPEG Compression,” inProceedings of the 29th ACM International Conference on Multimedia, 2021, pp. 41–49

    2021

  6. [14]

    PIMoG: An Effec- tive Screen-shooting Noise-Layer Simulation for Deep-Learning-Based Watermarking Network,

    H. Fang, Z. Jia, Z. Ma, E.-C. Chang, and W. Zhang, “PIMoG: An Effec- tive Screen-shooting Noise-Layer Simulation for Deep-Learning-Based Watermarking Network,” inProceedings of the 30th ACM International Conference on Multimedia, 2022, pp. 2267–2275

    2022

  7. [15]

    Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffu- sion Models,

    Z. Yang, K. Zeng, K. Chen, H. Fang, W. Zhang, and N. Yu, “Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffu- sion Models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 12 162–12 171

    2024

  8. [16]

    Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Models,

    Z. Yang, X. Zhang, K. Chen, K. Zeng, Q. Yao, H. Fang, W. Zhang, and N. Yu, “Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Models,”arXiv preprint arXiv:2504.15026, 2025

    2025 arXiv

  9. [17]

    Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust,

    Y . Wen, J. Kirchenbauer, J. Geiping, and T. Goldstein, “Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust,”arXiv preprint arXiv:2305.20030, 2023

    2023 arXiv

  10. [18]

    The Stable Signature: Rooting Watermarks in Latent Diffusion Models,

    P. Fernandez, G. Couairon, H. J ´egou, M. Douze, and T. Furon, “The Stable Signature: Rooting Watermarks in Latent Diffusion Models,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 22 466–22 477

    2023

  11. [19]

    Artificial Fingerprint- ing for Generative Models: Rooting Deepfake Attribution in Training Data,

    N. Yu, V . Skripniuk, S. Abdelnabi, and M. Fritz, “Artificial Fingerprint- ing for Generative Models: Rooting Deepfake Attribution in Training Data,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 14 448–14 457

    2021

  12. [20]

    Responsible Disclosure of Generative Models Using Scalable Fingerprinting,

    N. Yu, V . Skripniuk, D. Chen, L. Davis, and M. Fritz, “Responsible Disclosure of Generative Models Using Scalable Fingerprinting,” in International Conference on Learning Representations, 2022

    2022

  13. [21]

    WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models,

    C. Kim, K. Min, M. Patel, S. Cheng, and Y . Yang, “WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 8974–8983

    2024

  14. [22]

    Attributing Image Generative Models using Latent Fingerprints,

    G. Nie, C. Kim, Y . Yang, and Y . Ren, “Attributing Image Generative Models using Latent Fingerprints,” inInternational Conference on Machine Learning. PMLR, 2023, pp. 26 150–26 165

    2023

  15. [23]

    Do GANs leave artificial fingerprints?

    F. Marra, D. Gragnaniello, L. Verdoliva, and G. Poggi, “Do GANs leave artificial fingerprints?” in2019 IEEE Conference on Multimedia Information Processing and Retrieval (MIPR). IEEE, 2019, pp. 506– 511

    2019

  16. [24]

    CNN- generated images are surprisingly easy to spot...for now,

    S.-Y . Wang, O. Wang, R. Zhang, A. Owens, and A. A. Efros, “CNN- generated images are surprisingly easy to spot...for now,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, 2020, pp. 8695–8704

    2020

  17. [25]

    Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints,

    N. Yu, L. S. Davis, and M. Fritz, “Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2019, pp. 7556–7566

    2019

  18. [26]

    DE-FAKE: Detection and Attribu- tion of Fake Images Generated by Text-to-Image Generation Models,

    Z. Sha, Z. Li, N. Yu, and Y . Zhang, “DE-FAKE: Detection and Attribu- tion of Fake Images Generated by Text-to-Image Generation Models,” inProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 3418–3432

    2023

  19. [27]

    Detecting Origin Attribution for Text- to-Image Diffusion Models,

    K. Xu, L. Zhang, and J. Shi, “Detecting Origin Attribution for Text- to-Image Diffusion Models,” in2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV). IEEE, 2025, pp. 8775–8785

    2025

  20. [28]

    Are CLIP features all you need for Universal Synthetic Image Origin Attribution?

    D. Cioni, C. Tzelepis, L. Seidenari, and I. Patras, “Are CLIP features all you need for Universal Synthetic Image Origin Attribution?” in European Conference on Computer Vision. Springer, 2024, pp. 363– 382

    2024

  21. [29]

    Forensic Self- Descriptions Are All You Need for Zero-Shot Detection, Open-Set Source Attribution, and Clustering of AI-generated Images,

    T. D. Nguyen, A. Azizpour, and M. C. Stamm, “Forensic Self- Descriptions Are All You Need for Zero-Shot Detection, Open-Set Source Attribution, and Clustering of AI-generated Images,” inPro- ceedings of the Computer Vision and Pattern Recognition Conference, 2025, pp. 3040–3050

    2025

  22. [30]

    Learning Counterfactually Decoupled Attention for Open-World Model Attribution,

    Y . Zheng, B. Gong, F. Kong, Y . Duan, B. Yu, W. Zheng, L. Chen, J. Lu, and J. Zhou, “Learning Counterfactually Decoupled Attention for Open-World Model Attribution,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2025, pp. 122–132

    2025

  23. [31]

    Data Provenance for Image Auto-Regressive Generation,

    B. Zhao, L. Kerner, M. Meintz, T. Bakr, F. Boenisch, and A. Dziedzic, “Data Provenance for Image Auto-Regressive Generation,” inThe Four- teenth International Conference on Learning Representations, 2026

    2026

  24. [32]

    Where Did I Come From? Origin Attribution of AI-Generated Images,

    Z. Wang, C. Chen, Y . Zeng, L. Lyu, and S. Ma, “Where Did I Come From? Origin Attribution of AI-Generated Images,” inAdvances in Neural Information Processing Systems, vol. 36, 2023, pp. 74 478– 74 500

    2023

  25. [33]

    How to Trace Latent Generative Model Generated Images without Artificial Watermark?

    Z. Wang, V . Sehwag, C. Chen, L. Lyu, D. N. Metaxas, and S. Ma, “How to Trace Latent Generative Model Generated Images without Artificial Watermark?” inInternational Conference on Machine Learning, 2024

    2024

  26. [34]

    AEDR: Training-Free AI-Generated Image Attribution via Autoencoder Double- Reconstruction,

    C. Wang, Z. Yang, Y . Wang, W. Zhang, and K. Chen, “AEDR: Training-Free AI-Generated Image Attribution via Autoencoder Double- Reconstruction,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 40, no. 12, 2026, pp. 9675–9683

    2026

  27. [35]

    Adam: A Method for Stochastic Optimization,

    D. P. Kingma and J. Ba, “Adam: A Method for Stochastic Optimization,” inInternational Conference on Learning Representations, 2015

    2015

  28. [36]

    Auto-Encoding Variational Bayes,

    D. P. Kingma and M. Welling, “Auto-Encoding Variational Bayes,” in International Conference on Learning Representations, 2014

    2014

  29. [37]

    RepMix: Representation Mixing for Robust Attribution of Synthesized Images,

    T. Bui, N. Yu, and J. Collomosse, “RepMix: Representation Mixing for Robust Attribution of Synthesized Images,” inEuropean Conference on Computer Vision. Springer, 2022, pp. 146–163

    2022

  30. [38]

    Hierarchical Fine-Grained Image Forgery Detection and Localization,

    X. Guo, X. Liu, Z. Ren, S. Grosz, I. Masi, and X. Liu, “Hierarchical Fine-Grained Image Forgery Detection and Localization,” inProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 3155–3165

    2023

  31. [39]

    Progressive Open Space Expansion for Open-Set Model Attribution,

    T. Yang, D. Wang, F. Tang, X. Zhao, J. Cao, and S. Tang, “Progressive Open Space Expansion for Open-Set Model Attribution,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, 2023, pp. 15 856–15 865

    2023

  32. [40]

    GenImage: A Million-Scale Benchmark for Detecting AI- Generated Image,

    M. Zhu, H. Chen, Q. Yan, X. Huang, G. Lin, W. Li, Z. Tu, H. Hu, J. Hu, and Y . Wang, “GenImage: A Million-Scale Benchmark for Detecting AI- Generated Image,”Advances in Neural Information Processing Systems, vol. 36, pp. 77 771–77 782, 2023

    2023

  33. [41]

    WildFake: A Large-Scale and Hierarchical Dataset for AI-Generated Images Detection,

    Y . Hong, J. Feng, H. Chen, J. Lan, H. Zhu, W. Wang, and J. Zhang, “WildFake: A Large-Scale and Hierarchical Dataset for AI-Generated Images Detection,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 4, 2025, pp. 3500–3508

    2025

  34. [42]

    WILD: a new in-the-Wild Image Linkage Dataset for synthetic image attribution,

    P. Bongini, S. Mandelli, A. Montibeller, M. Casu, O. Pontorno, C. V . Ragaglia, L. Zanchetta, M. Aquilina, T. M. Wani, L. Guarneraet al., “WILD: a new in-the-Wild Image Linkage Dataset for synthetic image attribution,” in2025 International Joint Conference on Neural Networks (...

    2025

  35. [43]

    Diffusion Models in Vision: A Survey,

    F.-A. Croitoru, V . Hondru, R. T. Ionescu, and M. Shah, “Diffusion Models in Vision: A Survey,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 9, pp. 10 850–10 869, 2023

    2023

  36. [44]

    SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis,

    D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. M ¨uller, J. Penna, and R. Rombach, “SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis,” inThe Twelfth International Conference on Learning Representations, 2024

    2024

  37. [45]

    Scalable Diffusion Models with Transformers,

    W. Peebles and S. Xie, “Scalable Diffusion Models with Transformers,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 4195–4205

    2023

  38. [46]

    U-Net: Convolutional Net- works for Biomedical Image Segmentation,

    O. Ronneberger, P. Fischer, and T. Brox, “U-Net: Convolutional Net- works for Biomedical Image Segmentation,” inInternational Conference on Medical Image Computing and Computer-Assisted Intervention. Springer, 2015, pp. 234–241

    2015

  39. [47]

    Flow Straight and Fast: Learning to Generate and Transfer Data with Rectified Flow,

    X. Liu, C. Gong, and Q. Liu, “Flow Straight and Fast: Learning to Generate and Transfer Data with Rectified Flow,” inThe Eleventh International Conference on Learning Representations, 2023

    2023

  40. [48]

    Scaling Rectified 18 Flow Transformers for High-Resolution Image Synthesis,

    P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. M ¨uller, H. Saini, Y . Levi, D. Lorenz, A. Sauer, F. Boeselet al., “Scaling Rectified 18 Flow Transformers for High-Resolution Image Synthesis,” inForty-first International Conference on Machine Learning, 2024

    2024

  41. [49]

    Deep Model Intellectual Property Protection via Deep Watermark- ing,

    J. Zhang, D. Chen, J. Liao, W. Zhang, H. Feng, G. Hua, and N. Yu, “Deep Model Intellectual Property Protection via Deep Watermark- ing,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 8, pp. 4005–4020, 2021

    2021

  42. [50]

    Which Model Generated This Image? A Model-Agnostic Approach for Origin Attribution,

    F. Liu, H. Luo, Y . Li, P. Torr, and J. Gu, “Which Model Generated This Image? A Model-Agnostic Approach for Origin Attribution,” in European Conference on Computer Vision. Springer, 2024, pp. 282– 301

    2024

  43. [51]

    Reverse Engineering of Generative Models: Inferring Model Hyperparameters from Generated Images,

    V . Asnani, X. Yin, T. Hassner, and X. Liu, “Reverse Engineering of Generative Models: Inferring Model Hyperparameters from Generated Images,”IEEE Transactions on Pattern Analysis and Machine Intelli- gence, vol. 45, no. 12, pp. 15 477–15 493, 2023

    2023

  44. [52]

    Learning Transferable Visual Models From Natural Language Supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clarket al., “Learning Transferable Visual Models From Natural Language Supervision,” inInternational Conference on Machine Learning. PMLR, 2021, pp. 8748–8763

    2021

  45. [53]

    GAN Inversion: A Survey,

    W. Xia, Y . Zhang, Y . Yang, J.-H. Xue, B. Zhou, and M.-H. Yang, “GAN Inversion: A Survey,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 3, pp. 3121–3138, 2022

    2022

  46. [54]

    Available: https://github.com/ black-forest-labs/flux, 2024, accessed: Jun

    Black Forest Labs, “FLUX,” [Online]. Available: https://github.com/ black-forest-labs/flux, 2024, accessed: Jun. 1, 2026

    2024

  47. [55]

    FLUX.2: Frontier Visual Intelligence,

    ——, “FLUX.2: Frontier Visual Intelligence,” [Online]. Available: https: //bfl.ai/blog/flux-2, 2025, accessed: Jun. 1, 2026

    2025

  48. [56]

    Recent Advances in Open Set Recognition: A Survey,

    C. Geng, S.-j. Huang, and S. Chen, “Recent Advances in Open Set Recognition: A Survey,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 43, no. 10, pp. 3614–3631, 2020

    2020

  49. [57]

    Toward open set recognition,

    W. J. Scheirer, A. de Rezende Rocha, A. Sapkota, and T. E. Boult, “Toward open set recognition,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 35, no. 7, pp. 1757–1772, 2012

    2012

  50. [58]

    On Estimation of a Probability Density Function and Mode,

    E. Parzen, “On Estimation of a Probability Density Function and Mode,” The Annals of Mathematical Statistics, vol. 33, no. 3, pp. 1065–1076, 1962

    1962

  51. [59]

    BLIP-2: Bootstrapping Language- Image Pre-training with Frozen Image Encoders and Large Language Models,

    J. Li, D. Li, S. Savarese, and S. Hoi, “BLIP-2: Bootstrapping Language- Image Pre-training with Frozen Image Encoders and Large Language Models,” inInternational Conference on Machine Learning. PMLR, 2023, pp. 19 730–19 742

    2023

  52. [60]

    The Monte Carlo Method,

    N. Metropolis and S. Ulam, “The Monte Carlo Method,”Journal of the American Statistical Association, vol. 44, no. 247, pp. 335–341, 1949

    1949

  53. [61]

    Random Search for Hyper-Parameter Opti- mization,

    J. Bergstra and Y . Bengio, “Random Search for Hyper-Parameter Opti- mization,”Journal of Machine Learning Research, vol. 13, no. 10, pp. 281–305, 2012

    2012

  54. [62]

    Microsoft COCO: Common Objects in Context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft COCO: Common Objects in Context,” inEuropean Conference on Computer Vision. Springer, 2014, pp. 740–755

    2014

  55. [63]

    ImageNet Large Scale Visual Recognition Challenge,

    O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernsteinet al., “ImageNet Large Scale Visual Recognition Challenge,”International Journal of Computer Vision, vol. 115, no. 3, pp. 211–252, 2015

    2015

  56. [64]

    LAION-5B: An open large-scale dataset for training next generation image-text models,

    C. Schuhmann, R. Beaumont, R. Vencu, C. Gordon, R. Wightman, M. Cherti, T. Coombes, A. Katta, C. Mullis, M. Wortsmanet al., “LAION-5B: An open large-scale dataset for training next generation image-text models,” inAdvances in Neural Information Processing Systems, vol. 35, 202...

    2022

  57. [65]

    Microsoft COCO Captions: Data Collection and Evaluation Server,

    X. Chen, H. Fang, T.-Y . Lin, R. Vedantam, S. Gupta, P. Doll´ar, and C. L. Zitnick, “Microsoft COCO Captions: Data Collection and Evaluation Server,”arXiv preprint arXiv:1504.00325, 2015

    2015 arXiv

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.