Attributable to Identified Sources (AIS)

• AIS is a formal framework that attributes observed outputs to uniquely identified sources across domains such as generative models, environmental science, text, and digital forensics.
• It employs rigorous methods like constrained optimization, geometric estimation, and watermarking to ensure robust and measurable source linkage.
• Empirical studies demonstrate enhanced attribution accuracy while highlighting challenges in coverage, adversarial adaptation, and context-specific identifiability.

The concept of Attributable to Identified Sources (AIS) refers to formal frameworks that establish whether an observed datum (image, text, measurement, or digital artifact) can be unequivocally attributed to specific, uniquely identified sources. AIS has emerged as a critical criterion in the evaluation of generative models, source apportionment in environmental science, digital forensics, and trustworthy information generation. With applications spanning from deepfake attribution to analysis of model outputs across modalities, AIS systematically formalizes the linkage between observed outputs and their generating origins, with rigor in measurement, algorithmic design, identifiability, and empirical evaluation.

1. Formal Definitions of AIS Across Domains

AIS possesses domain-specific formalizations, tailored to the semantics and challenges of each context:

Generative Model Attribution: In the context of image generation, AIS quantifies the capacity to attribute images to a singular target generative model (e.g., DALL·E 3), as opposed to all other sources (including real photographs and outputs from alternative generators). Given a scoring function $f: \mathbb{R}^d \rightarrow \mathbb{R}$ (e.g., a linear classifier over CLIP features), and a threshold $\tau$, true-positive rate $R(\tau)$ and false-positive rate $F(\tau)$ are defined over target and non-target distributions, respectively. AIS is summarized by threshold-independent metrics such as Average Precision (AP) and Area under the ROC Curve (AUROC), reflecting discrimination performance between target and non-target sources (Thieu et al., 1 Jan 2026).

Source Apportionment in Environmental Science: AIS denotes the source-attribution percentage matrix $\Phi = (\phi_{kj})$ in non-negative matrix factorization (NMF) decompositions, where for concentration matrix $X$ the decomposition $X = WH + E$ yields $W$ (source emissions) and $H$ (attribution proportions). Population-level $\Phi$ assigns the fraction of each pollutant species $\tau$0 attributable to source $\tau$1 and is proven to be scale-invariant and uniquely identifiable (up to permutation) even when the factors $\tau$2 and $\tau$3 themselves are not (Jin et al., 4 Oct 2025).

Natural Language Generation: AIS is defined for model-generated textual statements as the property that every atomic proposition in the output can be fully and directly attributed to specific, uniquely identified parts of a provided reference source corpus. This is operationalized through human annotation protocols evaluating both interpretability and direct support from explicit source segments (Rashkin et al., 2021).

Digital Provenance and Forensics: In watermarking and forensic analysis, AIS corresponds to embedding cryptographically or statistically robust signatures that can be decoded to both recover and uniquely identify the originating source of a digital artifact, e.g., via source-conditioned invisible watermarking (Das et al., 24 Mar 2026) or information isotopes (Tao et al., 24 Mar 2025).

2. Algorithmic and Methodological Frameworks

Generative Model Attribution via Constrained Optimization

A typical pipeline employs:

• Feature extraction (frozen CLIP ViT-L/14 encoder; $\tau$4).
• Supervised classification with $\tau$5 and sigmoid activation.
• Supervised loss $\tau$6 computed via binary cross-entropy.
• Constrained fine-tuning leverages large pools of wild (unlabeled, open-world) data treated as non-target, with the optimization:

$\tau$7

where $\tau$8 (baseline ID loss), promoting robustness to unseen sources without degrading in-distribution performance (Thieu et al., 1 Jan 2026).

Geometric Estimation for Source Apportionment

The estimation of the AIS matrix $\tau$9 proceeds via:

1. Row normalization of data into the probability simplex.
2. Estimation of the sample convex hull and identification of its extreme vertices as proxies for source profiles.
3. Maximum-volume polytope fitting for $R(\tau)$0 sources.
4. Recovery of $R(\tau)$1 and estimation of source means $R(\tau)$2.
5. Explicit computation of $R(\tau)$3 (Jin et al., 4 Oct 2025).

This geometric approach avoids reliance on arbitrary NMF scaling and sparsity assumptions and is underpinned by rigorous statistical identifiability theorems.

Textual AIS Protocols

The textual AIS framework employs a two-stage pipeline:

• Stage 1: Assess interpretability—can each proposition be unambiguously paraphrased in context?
• Stage 2: For interpretable outputs, does each atomic proposition have literal support in the provided source? Only if both stages succeed and each output claim is directly supported does the generation meet AIS (Rashkin et al., 2021).

Watermarking and Isotopic Analysis

SAiW Framework: Constructs source-conditioned invisible watermarks by embedding logos modulated with source identity parameters ($R(\tau)$4), optimized via a composite loss balancing imperceptibility, robustness, and identification. Extraction involves a dual-purpose decoder yielding both watermark payload (logo) and source label through learned embeddings with large-margin angular separation (Das et al., 24 Mar 2026).

Information Isotopes: Constructs iso-sets $R(\tau)$5 for each content unit, and statistically tests (via black-box probing and test statistics on observed generation frequencies) for over-representation of particular isotopes, yielding p-value-based evidence of source attribution (Tao et al., 24 Mar 2025).

3. Quantitative Evaluation and Empirical Findings

Generative Model Attribution: Incorporation of wild-data constrained fine-tuning yields substantial improvements (AP and AUROC) on previously unseen “hard” sources. For DALL·E 3 attribution, average AP increases from 0.9029 to 0.9278 and AUROC from 0.9043 to 0.9272 for challenging cases (Midjourney, Firefly, SD XL). Pseudo-labeling is less effective. Performance plateaus after a few hundred wild samples per source (Thieu et al., 1 Jan 2026).

Source Apportionment: The geometric AIS estimator demonstrates:

• Consistency: Convergence of $R(\tau)$6 to true $R(\tau)$7 under ergodicity and probabilistic separability.
• Outperformance of classical NMF and PMF approaches, particularly in the presence of non-uniqueness and non-sparse emissions.
• Robustness to K-misspecification, spatio-temporal dependence, and moderate violations of the “separability” assumption (Jin et al., 4 Oct 2025).

Text Generation: AIS scores for NLG models range widely:

• Relatively high for extractive/hybrid summarizers (MatchSum AIS 99.4%, Pointer-Gen 97.8%).
• Lower for abstractive models (BigBird 87.2%) and baselines (e.g., WoW 19.8%).
• Notably, gold references often fail strict AIS criteria (e.g., CNN/DailyMail gold summaries AIS 54.1%). Inter-annotator agreement is high for AIS (F1 0.92–0.95), suggesting evaluation protocol reliability (Rashkin et al., 2021).

Digital Forensics:

• SAiW achieves identification accuracy ($R(\tau)$8) of 84.1% across 8 classes post-attack. Perceptual distortion remains low (PSNR 55–57 dB, SSIM >0.999).
• Information isotopes: InfoTracer achieves >99% batch-detection accuracy (p-value <0.001) at K = 40 entries for all major commercial APIs; robustness to moderate adversarial rewriting (Das et al., 24 Mar 2026, Tao et al., 24 Mar 2025).

4. Theoretical Guarantees and Identifiability

Scale-Invariance and Uniqueness: The AIS estimator in source apportionment is invariant to arbitrary scaling of NMF factors, addressing a core obstacle in interpretability. Identifiability guarantees for $R(\tau)$9 rest on ergodicity or probabilistic separability (i.e., temporary source dominance) and do not require sparsity or disentanglement of sources—strongly relaxing standard NMF identifiability conditions (Jin et al., 4 Oct 2025).

Robustness in Generative Attribution: Constrained optimization with wild data prevents catastrophic forgetting, and exposure to diverse wild images “pushes” the classifier boundary to exclude novel non-target generator distributions not represented in the ID set (Thieu et al., 1 Jan 2026).

Statistical Significance in Isotopic Detection: Information isotope approaches derive explicit thresholds based on Binomial-normal approximations and Chernoff bounds, yielding p-value-based inference and error rate control, enabling forensic evidence standards for data misuse (Tao et al., 24 Mar 2025).

5. Limitations, Challenges, and Future Prospects

• Coverage dependence: In open-set generative attribution, gains from wild data require representative sampling of unknown generator space. Insufficient or biased coverage may leave some novel sources unaddressed (Thieu et al., 1 Jan 2026).
• Adversarial Adaptivity: Existing AIS methods do not address sophisticated adversaries (e.g., generators that deliberately obfuscate or mimic target fingerprints, advanced paraphrasing attacks, or style-transfer). A plausible implication is that future work must couple AIS with adversarial robustness mechanisms (Thieu et al., 1 Jan 2026, Tao et al., 24 Mar 2025).
• Backbone dependence: Much of the current pipeline’s performance is contingent on fixed pretrained representations (e.g., CLIP-ViT). Exploration of alternate or fine-tuned encoders is an open direction (Thieu et al., 1 Jan 2026).
• Subjectivity and context modeling in text: Human-annotation-based AIS for NLG is subject to variability across annotators, backgrounds, and task domains. The binary nature and utterance-level granularity of current protocols do not capture fine-grained or graded attributions (Rashkin et al., 2021).
• Isotope method scalability and context curation: Detection of isotopic traces requires context-rich, well-chosen fragment sets and can incur query costs, especially in commercial black-box settings; highly paraphrased data reduces discrimination effectiveness, though increased sample size can compensate (Tao et al., 24 Mar 2025).
• Practical domain integration: For source apportionment, successful deployment of geometric AIS estimators requires careful selection of K, validation of source profiles, and domain expertise in interpreting ambiguous “irrelevant” vertices (Jin et al., 4 Oct 2025).

6. Comparative Overview and Application Scope

Domain	Formal AIS Object	Identifiability/Metric	Core Methodology
Image generation	Classification function	AP, AUROC over all sources	CLIP feature + constrained opt
Environmental apportionment	Attribution matrix $F(\tau)$0	Uniqueness up to permutation	Geometric max-volume estimation
Text generation	Binary interpretability	Percent strict attribution	Two-stage human protocol
Digital watermarking	Source-codable payload	Multi-class identification	Feature-modulated embedding/decod.
Info isotope tracing	Isotope set G(T)	p-value over batch recovery	Selective probing, stat. testing

AIS frameworks have demonstrated efficacy in enhancing model accountability, dataset auditing, real-world environmental analysis, and proactive digital integrity. Their continued evolution will be shaped by adversarial landscapes, advances in representation learning, and increasing demands for provable provenance across both scientific and societal domains.