Attribution Profiles Overview

• Attribution profiles are compact, structured representations that encode evidence (e.g., distributions, vectors) underlying attribution decisions.
• They are constructed via domain-specific pipelines involving evidence extraction, normalization, aggregation, and scoring.
• These profiles enable comparing, ranking, and auditing attributions while highlighting challenges in methodological sensitivity and fairness.

Attribution profiles are structured representations used to support attribution decisions, but the attributed object varies by domain. In recent work, the term denotes speaker voice profiles built from short enrollment audio and segment-level d-vectors, normalized vectors over MITRE ATT&CK techniques for threat actors, normalized per-sample contribution vectors for diffusion-model outputs, class-level feature-importance vectors for graph neural networks, binary probability vectors over contextual versus parametric knowledge in LLMs, prompt-level token attribution vectors, and dataset-level region-rank summaries for shortcut auditing (Wang et al., 2021, Guru et al., 15 May 2025, Zheng et al., 2023, Sahoo et al., 5 May 2026, Brink et al., 26 Feb 2026, Shilpika et al., 20 May 2026, Achara et al., 21 Dec 2025). A plausible implication is that “attribution profile” has become a cross-disciplinary term for a compact object that preserves enough structure to compare, rank, propagate, or audit the evidence behind an attribution judgment.

1. Conceptual scope and representational forms

The most stable commonality across the literature is that an attribution profile is not merely a label. It is a representation that retains internal structure: distributions over techniques, vectors of feature importances, per-sample contribution scores, or probability masses over knowledge sources. In some settings the profile summarizes an entity, such as a speaker or threat actor; in others it summarizes the relationship between an output and its causes, such as training examples, prompt tokens, or hidden features.

Domain	Attributed object	Profile form
Speaker attribution	Known meeting participant	Segment-level d-vectors or a profile d-vector (Wang et al., 2021)
Cyber threat intelligence	Threat actor	Normalized TTP-weight vector $Y[:,k]$ (Guru et al., 15 May 2025)
Diffusion-model data attribution	Training set contribution to one output	Normalized vector $\tau(x,D) \in \mathbb{R}^N$ (Zheng et al., 2023)
GNN global explanation	Class behavior	Ranked vector $\mu_c$ from aggregated $|\mathrm{IG}|$ (Sahoo et al., 5 May 2026)
LLM knowledge attribution	Dominant knowledge source	$[p_{\text{parametric}}, p_{\text{contextual}}]$ (Brink et al., 26 Feb 2026)
Prompt token attribution	Importance of prompt tokens to a response	$\mathbf{A} = (A_1,\ldots,A_N)$ (Shilpika et al., 20 May 2026)
Shortcut auditing	Spatial reliance pattern of a model	Dataset-level rank profile $\vec{R}^M$ (Achara et al., 21 Dec 2025)

This variation produces an important distinction between identity profiles and causal profiles. Identity profiles summarize persistent characteristics of an entity, as in speaker attribution or CTI. Causal profiles summarize contribution to a specific output, as in diffusion data attribution, LLM knowledge-source attribution, or token-level prompt attribution. A further distinction is between local profiles, tied to a single output or prompt, and global profiles, such as class-level feature summaries in GNN auditing or dataset-level rank summaries in shortcut analysis.

2. Construction pipelines

Construction procedures are strongly domain-dependent, yet most pipelines have the same four stages: evidence extraction, normalization, aggregation, and scoring. In speaker attribution, each enrolled speaker provides approximately $20$–$40$ seconds of profile audio; after VAD, profile audio is uniformly split into $1.2$ s speech segments, a pretrained d-vector extractor yields segment embeddings, and session graphs are built whose labeled nodes are profile segments and whose unlabeled nodes are meeting segments. Edge weights are cosine similarities linearly normalized to $\tau(x,D) \in \mathbb{R}^N$0, and graph sparsification retains edges only when cosine similarity exceeds $\tau(x,D) \in \mathbb{R}^N$1 (Wang et al., 2021).

Threat-actor profiles in CTI follow a text-to-behavior pipeline. Documents are converted into technique counts either by GPT-4 prompting or by vector-embedding search using text-embedding-3-large; the resulting counts are normalized so that each actor profile becomes a column of a matrix $\tau(x,D) \in \mathbb{R}^N$2 with $\tau(x,D) \in \mathbb{R}^N$3, interpretable as $\tau(x,D) \in \mathbb{R}^N$4. New incidents are represented by normalized TTP vectors $\tau(x,D) \in \mathbb{R}^N$5, and attribution scores are computed by $\tau(x,D) \in \mathbb{R}^N$6, optionally modulated by actor priors (Guru et al., 15 May 2025).

In diffusion-model attribution, the profile is built from projected per-sample gradients. D-TRAK defines feature vectors $\tau(x,D) \in \mathbb{R}^N$7 and then scores the contribution of each training point through

$\tau(x,D) \in \mathbb{R}^N$8

yielding a length-$\tau(x,D) \in \mathbb{R}^N$9 attribution vector that can be normalized and aggregated per prompt, class, or style (Zheng et al., 2023). In GRAFT, profile construction combines Farthest Point Sampling over penultimate-layer embeddings, Integrated Gradients with a zero baseline and $\mu_c$0 steps, and mean aggregation of absolute attributions,

$\mu_c$1

to produce a ranked class-level feature profile (Sahoo et al., 5 May 2026).

Large-language-model knowledge attribution uses yet another construction path. AttriWiki creates self-supervised examples in which the correct answer must be recalled either from model memory or from context; hidden states at the First Token of Generation or the Last Token of the Entity are then fed to a linear probe, and the runtime profile is the binary vector $\mu_c$2 with $\mu_c$3 (Brink et al., 26 Feb 2026). A separate probabilistic line of work constructs prompt-token attribution profiles directly from next-token probabilities by comparing $\mu_c$4 with $\mu_c$5, so that each token receives a log-ratio score $\mu_c$6 and the profile becomes $\mu_c$7 (Shilpika et al., 20 May 2026).

3. Identity and behavior attribution

Speaker attribution provides a canonical example of an identity profile used operationally. The task differs from speaker diarization and from independent speaker identification because the aim is to assign each meeting segment to a known participant while exploiting session-wide structure. On real multi-party meetings, graph-based methods reduced speaker attribution error by up to $\mu_c$8 relative to a baseline that processes each utterance independently, with the GCN consistently outperforming label propagation, particularly when only $\mu_c$9 profile segments per speaker were available (Wang et al., 2021).

In text authorship attribution, the profile can be a per-author LLM rather than a vector of behavioral indicators. A feedforward NNLM is trained separately for each author, and new text is attributed to the author profile that yields the highest sequence log-likelihood or lowest perplexity. On technical-course transcripts, NNLMs achieved nearly $|\mathrm{IG}|$0 reduction in perplexity relative to SRILM $|\mathrm{IG}|$1-gram models and improved author classification accuracy by $|\mathrm{IG}|$2 on average when only $|\mathrm{IG}|$3 random test sentences were provided (Ge et al., 2016).

Cyber threat intelligence uses attribution profiles to summarize recurrent operational behavior. In one formulation, the profile is the distribution of TTP usage for a specific actor, normalized over ATT&CK techniques and sub-techniques (Guru et al., 15 May 2025). In another, profiles are set-valued collections of techniques, software, and vulnerabilities used to study distinctiveness. The latter perspective shows a severe sparsity and overlap problem: only $|\mathrm{IG}|$4 of $|\mathrm{IG}|$5 ATT&CK groups, or $|\mathrm{IG}|$6, have any group-specific technique, and even after combining techniques, extracted techniques, software, and vulnerabilities, only $|\mathrm{IG}|$7 groups, or $|\mathrm{IG}|$8, have at least one group-specific behavior, leaving $|\mathrm{IG}|$9 without any unique behavioral signature (Saha et al., 12 Jun 2025).

Longitudinal adversary profiling extends this logic from static behavior sets to time-indexed fingerprints. ARCANE represents each campaign by a $[p_{\text{parametric}}, p_{\text{contextual}}]$0-dimensional vector over infrastructural, temporal, geospatial, environmental, volume, and behavioral features, stores these vectors in an actor-specific knowledge base $[p_{\text{parametric}}, p_{\text{contextual}}]$1, and updates posterior beliefs by a time-decayed similarity score called Cross-Campaign Confidence. Yet the synthetic evaluation showed a structural ceiling: ARCANE achieved $[p_{\text{parametric}}, p_{\text{contextual}}]$2 overall accuracy, below a per-campaign nearest-neighbor baseline at $[p_{\text{parametric}}, p_{\text{contextual}}]$3, because inter-actor similarity remained high even without evasion (Weinberg, 27 Apr 2026).

The strongest critique of behavioral attribution profiles comes from AI-driven adversary emulation. Across $[p_{\text{parametric}}, p_{\text{contextual}}]$4 cyber-range experiments with five APT personas, all $[p_{\text{parametric}}, p_{\text{contextual}}]$5 Enterprise runs ended in compromise with $[p_{\text{parametric}}, p_{\text{contextual}}]$6 to $[p_{\text{parametric}}, p_{\text{contextual}}]$7 hosts compromised, while all $[p_{\text{parametric}}, p_{\text{contextual}}]$8 Military runs were successfully defended or resulted in stalemates, regardless of APT profile or defender model. In $[p_{\text{parametric}}, p_{\text{contextual}}]$9 of $\mathbf{A} = (A_1,\ldots,A_N)$0 Enterprise experiments, attackers independently weaponized Velociraptor as a command-and-control channel, a convergent behavior not encoded in any threat-intelligence profile (Balassone et al., 5 Jun 2026). This suggests that TTP profiles retain descriptive value, but their distinctiveness can collapse when the same model and scaffold generate multiple adversary personas.

A related problem appears in software-author attribution for Android. Public signals such as developer names, websites, emails, privacy-policy URLs, package names, and certificate fingerprints can be assembled into attribution graphs, but they are often missing, volatile, or misleading. On Google Play, $\mathbf{A} = (A_1,\ldots,A_N)$1 of entries lacked a developer website, $\mathbf{A} = (A_1,\ldots,A_N)$2 lacked a developer address, and $\mathbf{A} = (A_1,\ldots,A_N)$3 lacked a privacy-policy URL. Certificate reuse further undermines identity claims: $\mathbf{A} = (A_1,\ldots,A_N)$4 of Google Play developer accounts had apps signed with multiple certificates, and the Andromo certificate signed $\mathbf{A} = (A_1,\ldots,A_N)$5 apps across $\mathbf{A} = (A_1,\ldots,A_N)$6 developer names (Hageman et al., 2022). In this setting, a plausible implication is that attribution profiles must be graph-based, time-aware, and reliability-weighted rather than keyed to any single signal.

4. Model and data attribution

In model interpretability, attribution profiles often summarize causal contribution rather than identity. For diffusion models, a profile is a per-output vector over the training set: the $\mathbf{A} = (A_1,\ldots,A_N)$7th entry of $\mathbf{A} = (A_1,\ldots,A_N)$8 estimates how much training example $\mathbf{A} = (A_1,\ldots,A_N)$9 contributed to the output of interest. D-TRAK showed that using projected gradients of alternative losses such as $\vec{R}^M$0 rather than the diffusion training loss $\vec{R}^M$1 produced markedly better attribution, with generation LDS on CIFAR-10 rising from $\vec{R}^M$2 for TRAK to $\vec{R}^M$3 for D-TRAK at $\vec{R}^M$4 steps and from $\vec{R}^M$5 to $\vec{R}^M$6 at $\vec{R}^M$7 steps (Zheng et al., 2023).

A more abstract formulation appears in the Taylor-interaction analysis of attribution methods. There, an attribution profile is the set of weights that a method assigns to independent effects $\vec{R}^M$8 and interaction effects $\vec{R}^M$9 in the decomposition

$20$0

The profile of a method is thus its rule for reallocating Taylor terms to individual features. Under this view, fourteen attribution methods differ chiefly in how they weight interaction terms, and IG, EG, SHAP, DeepSHAP, DeepLIFT Rescale, and DeepLIFT RevealCancel satisfy the paper’s three fair-allocation principles, whereas GI, LRP-$20$1, Grad-CAM, occlusion methods, and some LRP variants violate at least one of them (Deng et al., 2023).

GNN auditing turns the profile into a global class descriptor. GRAFT defines a class-level attribution profile as the ranked vector of feature importances obtained by aggregating absolute Integrated Gradients over a diversity-preserving set of exemplars selected by Farthest Point Sampling. The resulting profiles were sufficiently stable to reach Jaccard $20$2 on Cora/GCN and $20$3 on Squirrel/GIN across seeds, and sufficiently informative to support feature-efficient transfer learning and spurious-feature detection (Sahoo et al., 5 May 2026).

ADAG pushes the idea further inside LLM circuits. Each hidden feature receives two profiles: an input attribution vector

$20$4

and an output contribution vector

$20$5

These dual profiles are then clustered by a harmonic-mean similarity that combines input and output views. ADAG recovered interpretable circuits on previously human-analyzed tasks and identified steerable clusters for a harmful-advice jailbreak in Llama 3.1 8B Instruct (Arora et al., 8 Apr 2026).

Prompt-level LLM attribution profiles offer a model-agnostic alternative. By reconstructing conditional probabilities from next-token log-probabilities through Bayes inversion, probabilistic attribution assigns each prompt token a score

$20$6

and packages the result as a prompt profile $20$7. The associated contextual entropies and KL divergences were used to study token sensitivity, response stability, and training convergence across eight LLMs (Shilpika et al., 20 May 2026).

A related extension to end-to-end autonomous driving builds profiles over the joint visual space of six camera views. The planner-aligned attribution map is normalized to a distribution $20$8, and three statistics summarize it: global attribution entropy, within-camera spatial variance, and cross-camera Gini coefficient. Across BridgeAD, UniAD, and GenAD, these profile statistics correlated with planning risk, reaching Spearman correlations of approximately $20$9 with trajectory error and AUROC of approximately $40$0 for collision detection (Yang et al., 7 May 2026).

5. Evaluation, robustness, and fairness

Evaluation of attribution profiles is itself an active research area because rankings can be unstable under thresholds, baselines, or aggregation choices. In vision, one threshold-free line defines the attribution profile of a heatmap as the curve $40$1 over thresholds and summarizes it by AUC-IoU. On HAM10000, this framework showed that single-threshold rankings can shift by more than $40$2 percentage points, whereas threshold-free evaluation yielded stable differentiation: XRAI improved over LIME by $40$3 and over vanilla Integrated Gradients by $40$4 (Aksoy, 3 Sep 2025).

A complementary benchmark replaces incremental deletion with an in-domain single-deletion score. IDSDS evaluates how well patchwise attribution sums rank the logit drops caused by deleting one patch at a time, after training-time augmentation aligns the deletion distribution with the data distribution. Under this protocol, intrinsically explainable models outperformed standard ones, with BagNet-33 reaching IDSDS $40$5 and B-cos ResNet-50 $40$6, while among standard ResNet-50 methods IG-U reached $40$7 and Grad-CAM $40$8 (Hesse et al., 2024). A plausible implication is that the quality of an attribution profile cannot be separated from the intervention model used to test it.

Shortcut auditing treats the profile as a dataset-level spatial summary. OSCAR converts image-level saliency maps into per-image region ranks, aggregates them by the component-wise median to obtain $40$9 for each model, and then compares these profiles across a balanced baseline, a test model, and a sensitive-attribute predictor. On CelebA, CheXpert, and ADNI, pairwise and partial correlations on these profiles were stable across seeds and partitions, and test-time attenuation guided by Region Contribution Scores improved CelebA worst-group accuracy for ResNet50 from $1.2$0 to $1.2$1 while raising balanced accuracy from $1.2$2 to $1.2$3 (Achara et al., 21 Dec 2025).

Knowledge-source attribution in LLMs shows unusually strong probe decodability. Linear probes trained on AttriWiki achieved Macro-F1 up to $1.2$4–$1.2$5 on in-domain attribution and generalized without retraining to SQuAD and WebQuestions with $1.2$6–$1.2$7 and $1.2$8–$1.2$9 accuracy, respectively. Attribution mismatches raised error risk by up to approximately $\tau(x,D) \in \mathbb{R}^N$00 in misleading-context cases and by about $\tau(x,D) \in \mathbb{R}^N$01 when the model defaulted to parametric knowledge despite a context-requiring task (Brink et al., 26 Feb 2026). The result is technically notable because it separates provenance prediction from answer correctness: correct attribution improved reliability, but did not guarantee truth.

Fairness-oriented evaluation shows that attribution profiles can expose unequal attribution itself. In quote attribution, AttriBench uses fame- and demographically balanced datasets and distinguishes correct attribution, incorrect attribution, and suppression. Direct prompting without evidence remained difficult even for frontier models, at approximately $\tau(x,D) \in \mathbb{R}^N$02–$\tau(x,D) \in \mathbb{R}^N$03 accuracy on the Intersectional split for GPT-5.1 and Claude 4.6 Sonnet, while White male and White subgroups had consistently higher accuracy and lower omission or evidence-conditioned suppression than other groups; Black female was repeatedly the lowest subgroup (Berman et al., 6 Apr 2026). A separate social-psychological benchmark defines a four-category attribution profile over effort, ability, task difficulty, and luck and compresses it into

$\tau(x,D) \in \mathbb{R}^N$04

Across gender, nationality, race, and religion, this framework revealed systematic differences in whether models credited success internally or externally and whether they blamed failure on personal or situational causes (Raj et al., 28 May 2025).

6. Limitations, controversies, and open directions

A recurring limitation is that profile quality depends on the observables from which the profile is built. In speaker attribution, short meeting segments, overlapping speech, acoustic mismatch between enrollment and meeting channels, and graph-threshold selection all constrain performance (Wang et al., 2021). In CTI, ATT&CK-linked profiles are incomplete and highly overlapping, LLM- or embedding-derived TTP sets exhibit low Jaccard similarity to human-curated sets, and even broader aggregation across techniques, software, and vulnerabilities leaves most groups non-distinctive (Guru et al., 15 May 2025, Saha et al., 12 Jun 2025). ARCANE and the synthetic-APT study together sharpen this point: when features are dense and shared, longitudinal aggregation alone does not resolve ambiguity, and when AI agents can imitate multiple personas with the same scaffold, TTP-based attribution can collapse (Weinberg, 27 Apr 2026, Balassone et al., 5 Jun 2026).

A second limitation is methodological sensitivity. D-TRAK showed that theoretically “obvious” choices such as using gradients of the training loss can be inferior in non-convex generative models (Zheng et al., 2023). GRAFT depends on the zero baseline and loses fidelity in topology-dominant regimes (Sahoo et al., 5 May 2026). Vision evaluation changes materially when one switches from single thresholds to threshold-free curves or from out-of-domain deletion to in-domain single deletion (Aksoy, 3 Sep 2025, Hesse et al., 2024). This suggests that attribution profiles are inseparable from the measurement protocol that validates them.

A third limitation concerns meaning rather than accuracy. Knowledge attribution in LLMs can identify whether a response is context-dominated or parametric-dominated, but correct provenance does not imply factual correctness (Brink et al., 26 Feb 2026). Quote attribution shows that suppression can persist even when the correct author is available in retrieved evidence (Berman et al., 6 Apr 2026). Social-attribution benchmarks show that model “reasons” can encode demographic asymmetries in internal versus external blame (Raj et al., 28 May 2025). These results indicate that attribution profiles can be technically well-formed while still raising normative concerns about fairness, visibility, or accountability.

Future directions stated in the literature are correspondingly diverse. Speaker attribution points to online attribution and settings where some or all speakers lack profiles (Wang et al., 2021). CTI papers call for higher-precision extraction, time-aware modeling, richer non-TTP signals, broader provenance tracking, and community reconciliation of aliases and tool taxonomies (Guru et al., 15 May 2025, Saha et al., 12 Jun 2025). Diffusion attribution highlights uncertainty quantification and theory better aligned with non-convex training (Zheng et al., 2023). GNN and LLM work point toward multi-source attribution, sequence-level aggregation, and stronger coupling between quantitative profiles and human-interpretable rules (Sahoo et al., 5 May 2026, Brink et al., 26 Feb 2026). Across domains, a plausible implication is that attribution profiles are moving away from single-signal heuristics toward probabilistic, multi-view, and explicitly validated representations.