Dual Attribution Benchmark (DAB)

• Dual Attribution Benchmark (DAB) is an evaluation framework that assesses attribution quality along two complementary dimensions to expose hidden trade-offs.
• In generated audio, DAB jointly recovers model identity and training dataset origin using watermarks and specialized metrics like F1-score and AUC.
• Across feature attribution, retrieval-augmented generation, and segmentation, DAB emphasizes multi-criteria evaluation to ensure robust, transparent performance insights.

Dual Attribution Benchmark (DAB) denotes a class of evaluation protocols in which attribution is assessed along two distinct axes rather than a single scalar notion of correctness. The most explicit use of the term is the benchmark introduced with DualMark for generated-audio provenance, where a system must jointly recover model identity and dataset origin from generated audio under clean and degraded conditions (Yang et al., 21 Aug 2025). In adjacent literatures, the same acronym or a closely related “dual-attribution” framing is used for feature-attribution evaluation through soundness and completeness (Li et al., 2023), for retrieval-augmented generation auditing through source-level provenance and answer-level support assessment (Ding et al., 22 Jun 2026), and, in a descriptive synthesis rather than the paper’s original naming, for segmentation attribution through faithfulness and off-target leakage, coupled to dual-evidence fusion (Sakib et al., 23 Mar 2026). This shared usage suggests a broader methodological pattern: DAB-style benchmarks are designed to expose trade-offs that single-perspective attribution metrics suppress.

1. Term, scope, and recurrent structure

Across the supplied literature, “dual attribution” does not refer to a single canonical benchmark. It refers instead to evaluation settings in which attribution must satisfy two complementary criteria, or recover two distinct sources of origin, within a unified protocol.

Context	Dual structure	Principal outputs
Generated audio provenance	model identity and dataset origin	Det. Acc, Recall, F1, ROC/AUC
Feature attribution	soundness and completeness	$S(A)$, $C(A)$, $S_{\mathrm{AUC}}$, $C_{\mathrm{AUC}}$
Segmentation attribution	faithfulness and leakage	TDD, ODD, Robustness, runtime
RAG attribution auditing	provenance/topicality and generated-answer attribution	top-1 accuracy, AUROC, held-out regret

In the DualMark setting, DAB is defined as “a standardized evaluation suite for dual attribution: given audio generated by a model trained on particular data sources, the benchmark requires recovering two watermarks—model identity $(M)$ and dataset origin $(D)$—and measures fidelity (F1 for model attribution), reliability (AUC for data attribution), and robustness under common perturbations” (Yang et al., 21 Aug 2025). In the feature-attribution setting, DAB instantiates a “dual-perspective framework” built around soundness and completeness, explicitly integrating attribution values as well as ranks (Li et al., 2023). In the retrieval and segmentation settings, the supplied syntheses use DAB as a design lens rather than as the paper’s formal title, emphasizing that evaluator choice or explanation quality must be judged along more than one axis (Ding et al., 22 Jun 2026, Sakib et al., 23 Mar 2026).

2. Generated-audio provenance DAB

In generated audio, DAB was introduced to close a specific provenance gap: existing audio watermarking methods “only enable model-level attribution” and “are unable to trace the underlying training dataset” (Yang et al., 21 Aug 2025). The benchmark therefore evaluates joint attribution of the generation model and the training data source, motivated by provenance, copyright, and accountability concerns.

The benchmark’s attribution labels are binary watermark codes. Model identity is encoded as $v_M \in \mathbb{F}_2^K$, dataset origin as $v_D \in \mathbb{F}_2^K$, and the dual payload is the concatenation

$v = [v_M \| v_D] \in \mathbb{F}_2^I,\qquad I = 2K.$

In the reported instantiation, each identity is assigned a fixed-length binary code with $K = 7$ bits, yielding a $C(A)$0-bit dual payload. The benchmark notes this as a limitation because “capacity and error-correction are constrained at this length” (Yang et al., 21 Aug 2025).

Encoding is performed in the Mel-spectrogram domain via Dual Watermark Embedding (DWE), using “a pretrained RoSteALS encoder/decoder coupled with an adapter autoencoder.” The watermarked spectrogram is

$C(A)$1

where $C(A)$2 is the clean Mel-spectrogram and $C(A)$3 is the watermarked Mel-spectrogram used to fine-tune the generative model. The generative backbone is AudioLDM, optimized with the standard latent diffusion objective plus a Watermark Consistency Loss (WCL). The consistency term decodes a predicted watermark vector $C(A)$4 from the generated spectrogram and applies binary cross-entropy across the $C(A)$5 watermark bits; the full objective is

$C(A)$6

with only the AudioLDM UNet updated during fine-tuning (Yang et al., 21 Aug 2025).

The benchmark protocol separates training, inference, and attribution. During training, AudioLDM is fine-tuned so that generated audio decodes back to the assigned dual watermark vector. During inference, generated audio is converted to a Mel-spectrogram, passed to the decoder, split into model and data components, and matched against a codebook of valid identities. DAB then computes model-level detection metrics and dataset-level ROC/AUC on both clean and attacked audio (Yang et al., 21 Aug 2025).

The reported setup uses GTZAN, described as “1,000 tracks, 10 genres,” with each genre treated as a distinct data origin. The backbones are AudioLDM-S-Full and AudioLDM-M-Full. The evaluation set contains, “per genre, 100 watermarked and 100 non-watermarked generated signals (total 2,000).” Reproducibility details include a sampling rate of 16 kHz, 64 mel bins, 30 epochs of UNet fine-tuning, batch size 2, Adam with learning rate $C(A)$7, linear warm-up over the first 2,000 steps, and DDIM steps tested from 100 to 250, with “best empirical dual attribution at 200 steps” (Yang et al., 21 Aug 2025).

3. Metrics, attacks, and reported performance in the audio benchmark

DAB decomposes the generated-audio task into two attribution problems. Model attribution is “binary detection of whether a sample carries the target model’s watermark,” summarized by Det. Acc, Recall, and F1. Dataset attribution is “one-vs-rest classification per data origin,” summarized via ROC/AUC, plus F1 and Recall (Yang et al., 21 Aug 2025). The paper gives the standard definitions of Precision, Recall, F1, TPR, and FPR, and defines AUC as the area under the ROC curve obtained by sweeping the decision threshold.

The attack suite is intended to model realistic degradation and removal attempts. It includes pruning, AAC compression, additive white and pink noise, and resampling. Pruning is defined specifically as removal of “external watermark plugins (AudioSeal, Timbre) to test whether attribution collapses when the watermarking is applied post-generation.” DualMark is reported as unaffected because its embedding is intrinsic and introduced during training (Yang et al., 21 Aug 2025).

Condition	Model attribution	Dataset attribution
Clean	Det. Acc 97.10, F1 97.01, Recall 94.20	AUC 91.51, F1 93.68, Recall 83.60
White noise	Det. Acc 89.00, F1 87.64, Recall 78.00	AUC 79.50, F1 85.05, Recall 59.50
Pink noise	Det. Acc 92.60, F1 92.01, Recall 85.20	AUC 84.75, F1 89.17, Recall 70.00
Resampling	Det. Acc 97.10, F1 94.20, Recall 97.01	AUC 90.75, F1 93.35, Recall 82.00
AAC compression	Det. Acc 96.40, F1 96.27, Recall 92.80	AUC 91.25, F1 93.67, Recall 83.00

The headline clean-audio result is “97.01% F1-score for model attribution, and 91.51% AUC for dataset attribution” on AudioLDM-S-Full (Yang et al., 21 Aug 2025). Under pruning, AudioSeal and Timbre are reported to collapse, with “detection accuracy ≈ 50%, F1 ≈ 0%, Recall ≈ 0%,” whereas DualMark retains “97.01%” model-level F1 and “91.51%” dataset-level AUC on S-Full, and “92.07%” F1 and “87.55%” AUC on M-Full. The benchmark therefore operationalizes robustness as resistance not only to signal degradation but also to the removal of post-generation watermark modules.

Several limitations are explicit. DAB does not include cropping, mixing, semantic-preserving edits, or open-set attribution in its first release. The paper also states that “collision analysis or calibrators” are not reported, “no explicit threshold calibration procedures are described,” and “confidence intervals or statistical significance tests are not reported” (Yang et al., 21 Aug 2025).

4. DAB as a dual-perspective benchmark for feature attribution

In feature attribution, DAB is a different benchmark with a different object of study: it evaluates explanation methods rather than provenance watermarks. The core setup assumes a trained model $C(A)$8 and an attribution method $C(A)$9 that produces a nonnegative score vector $S_{\mathrm{AUC}}$0 over atomic features. The central distinction is between predictive features and attributed features, with predictive information modeled by a hidden valuation function $S_{\mathrm{AUC}}$1 and attributed information by the attribution values themselves (Li et al., 2023).

The benchmark is built on a performance-monotonicity assumption: if, for two feature subsets $S_{\mathrm{AUC}}$2 and $S_{\mathrm{AUC}}$3, the model performs better on $S_{\mathrm{AUC}}$4 than on $S_{\mathrm{AUC}}$5, then $S_{\mathrm{AUC}}$6 contains more total predictive information. This assumption allows the paper to evaluate explanations without retraining. DAB then formalizes two complementary criteria:

$S_{\mathrm{AUC}}$7

where $S_{\mathrm{AUC}}$8 is soundness and $S_{\mathrm{AUC}}$9 is completeness. The first measures the fraction of attribution mass placed on truly predictive features; the second measures the fraction of total predictive information captured by the attributed features (Li et al., 2023).

Operationally, soundness is computed by expanding the attributed set in descending attribution order until a target predictive level $C_{\mathrm{AUC}}$0 is reached, and then identifying a minimal predictive subset that preserves performance. Completeness is computed by thresholding the attribution map, masking the selected features, and measuring the drop in performance relative to the unmasked baseline. DAB reports curves over predictive levels and thresholds, summarized by normalized areas $C_{\mathrm{AUC}}$1 and $C_{\mathrm{AUC}}$2 (Li et al., 2023).

The benchmark uses an ImageNet validation subset with “5000 images: 5 random images per class,” resized to $C_{\mathrm{AUC}}$3, together with a synthetic Gaussian dataset with “1000 samples, 200 features” for a sanity check. The model is VGG16 pretrained on ImageNet. The attribution methods compared include Grad, Integrated Gradients, DeepLIFT, DeepSHAP, Grad-CAM, Extremal Perturbations, IBA/InputIBA, and the IG ensembles SmoothGrad, SmoothGrad$C_{\mathrm{AUC}}$4, and VarGrad (Li et al., 2023).

A key empirical claim is that DAB is more sensitive to attribution-value changes than order-only metrics. On the ImageNet/VGG16 modifications experiment, average pairwise curve differences are reported as “Completeness: 0.258,” “Soundness: 0.289,” compared with “ROAD (MoRF): 0.065” and “Deletion (MoRF): 0.127.” The paper also reports that “ExPerturb tends to have high completeness; IBA and Grad-CAM tend to have high soundness,” and that “no single method dominates both perspectives” (Li et al., 2023). This is one of the clearest examples of DAB’s general rationale: a single ranking can conceal false positives and false negatives in distinct ways.

5. DAB-oriented auditing of attribution evaluation in retrieval-augmented generation

In retrieval-augmented generation, the supplied synthesis does not present a benchmark formally titled DAB. It instead maps the audit’s attribution constructs onto DAB’s dual goals: source-level provenance/topicality and answer-level support. The audit distinguishes three constructs: “(a) Provenance/topicality (source-level attribution),” “(b) Generated-answer attribution (answer-level attribution),” and “(c) Fact-check entailment” (Ding et al., 22 Jun 2026).

The benchmark logic here is explicitly construct-sensitive. Provenance/topicality uses passage-ranking labels and top-1 accuracy; generated-answer attribution uses human sentence-level support labels and AUROC over claim/evidence pairs; fact-check entailment uses human labels for short edited claims and also reports AUROC. The audit studies eight automatic scorers—lexical, embedding, BERTScore, clean and FEVER NLI, and MiniCheck—plus a prompt-based LLM judge (Ding et al., 22 Jun 2026).

Its central result is a non-transfer finding. A scorer is said to “transfer” within a multi-dataset construct if its performance lies “within the 95% confidence interval (CI) of the best audited scorer for that dataset” on every dataset in the construct. For generated-answer attribution, “none does.” The reported dataset-level inversion is sharp: clean MNLI is best on AttributedQA with “AUROC 0.90” but “collapses to AUROC 0.53 (chance)” on LFQA, where BERTScore reaches “0.91.” The ranking flip is quantified as “Kendall tau = -0.64, p = 0.031 on AttributedQA vs. LFQA,” and the paper states that the effect “is not a length or truncation artifact” (Ding et al., 22 Jun 2026).

This DAB-oriented audit also reports a concrete selection cost. A naive “best-on-average” rule yields “mean held-out regret 0.172 AUROC,” which is “worse than fixing one scorer.” MiniCheck is described as the “lowest-regret fixed metric among the eight automatic scorers,” but still incurs “mean per-dataset regret 0.044 AUROC.” The prompt-based LLM judge avoids “chance-level collapses” and has AUROC “range 0.731–0.918 across AttributionBench sources,” but it is “~100x costlier,” “non-deterministic,” and subject to “~15% refusals/truncations” that are “dropped, not imputed” (Ding et al., 22 Jun 2026).

A plausible implication is that DAB, when applied to RAG evaluation, is less a single benchmark artifact than a reporting discipline: one must keep source-level provenance, sentence-level support, and atomic entailment separate; validate metrics per dataset; and reject the assumption that one attribution scorer transfers across domains or evidence formats.

6. Segmentation attribution, dual-evidence fusion, and a DAB-style protocol

The segmentation paper introduces “a reproducible segmentation attribution benchmark” that evaluates whether attribution maps are causally faithful, whether they leak outside the target, how stable they are under perturbations, and how much compute they require. The supplied synthesis states that “the paper does not originally name the benchmark DAB; we adopt the acronym to clarify how our protocol maps onto the ‘Dual Attribution Benchmark’ idea” (Sakib et al., 23 Mar 2026). That caveat is essential: this is a DAB-style benchmark by interpretation, not by original nomenclature.

The protocol operates on Pascal VOC 2012 and SBD, with images and masks resized to $C_{\mathrm{AUC}}$5, and evaluates three TorchVision backbones: DeepLabV3-ResNet50, FCN-ResNet50, and LRASPP-MobileNetV3. For each image, the target class is the “most frequent non-background label in the ground-truth mask,” and region-level confidence is measured by the masked mean probability

$C_{\mathrm{AUC}}$6

The benchmark then evaluates target deletion drops, off-target deletion drops, perturbation robustness, and runtime (Sakib et al., 23 Mar 2026).

The primary faithfulness metric is the single-point target deletion drop at $C_{\mathrm{AUC}}$7:

$C_{\mathrm{AUC}}$8

where the occlusion operator replaces selected pixels with the image’s per-channel mean value. Off-target leakage is measured analogously through

$C_{\mathrm{AUC}}$9

with an additional signed leakage ratio $(M)$0. Robustness is the average Pearson correlation between original and perturbed heatmaps under additive noise, brightness, contrast, Gaussian blur, and horizontal flip at strength $(M)$1 (Sakib et al., 23 Mar 2026).

To demonstrate the benchmark, the paper proposes Dual-Evidence Attribution (DEA), which fuses gradient evidence map $(M)$2 and intervention evidence map $(M)$3 through

$(M)$4

with default $(M)$5 and $(M)$6. DEA is compared with GPA, EGA, and RIA. On SBD, deletion-based faithfulness improves from “EGA 0.223 ± 0.027” to “DEA 0.381 ± 0.030”; on VOC, from “EGA 0.287 ± 0.048” to “DEA 0.449 ± 0.043.” Robustness remains strong but drops slightly relative to EGA, from “0.978 ± 0.004” to “0.959 ± 0.009” on SBD and from “0.978 ± 0.003” to “0.961 ± 0.004” on VOC. The benchmark therefore exposes a “faithfulness–stability tradeoff” that purely visual inspection would miss (Sakib et al., 23 Mar 2026).

7. Limitations, extensions, and conceptual significance

The different DAB instantiations share a common design principle but also exhibit domain-specific limits. In generated audio, DAB is constrained by “fixed-length 7-bit encoding,” by vocoder degradation, by its evaluation on GTZAN with AudioLDM, and by benchmark coverage that excludes cropping, mixing, semantic-preserving edits, and open-set attribution (Yang et al., 21 Aug 2025). In feature attribution, DAB depends on a performance-monotonicity assumption, can be sensitive to masking and imputation choices, and incurs multiple forward passes per example, although it avoids retraining and the confounds of ROAR-style procedures (Li et al., 2023). In RAG auditing, the major limitation is evaluator instability across datasets and constructs: “metric choice must be validated on the target dataset rather than learned from others” (Ding et al., 22 Jun 2026). In segmentation attribution, formal hypothesis testing and confidence intervals are deferred to future work, coarse interventions can under-cover thin structures, and intervention-based methods are slower and less stable than pure gradients (Sakib et al., 23 Mar 2026).

Taken together, these uses suggest that DAB is best understood not as a single benchmark artifact but as a benchmark design pattern. Its unifying feature is the refusal to collapse attribution into one dimension. In audio, that means model provenance and data provenance. In feature attribution, it means false-positive control and false-negative coverage. In segmentation, it means causal faithfulness and spatial leakage, together with robustness and cost. In retrieval-augmented generation, it means separating source routing from evidential support and validating metrics construct by construct. The broader significance of DAB therefore lies in its insistence that attribution quality is inherently multi-criteria, and that evaluation protocols must preserve, rather than average away, that structure.