Generation-Time Source Attribution

• Generation-time source attribution is the process of embedding provenance into synthetic content at creation, ensuring immediate identification of its generative source.
• It leverages approaches like metric learning, watermarking, and retrieval-augmented methods to achieve robust closed-set and open-set detection across multiple modalities.
• This technique underpins applications such as IP tracing, deepfake detection, and legal compliance by providing real-time, verifiable source authenticity.

Generation-Time Source Attribution

Generation-time source attribution refers to the direct, algorithmic assignment of provenance information to synthetic content at the moment of its creation—enabling immediate identification of the generative source (model, dataset, or system) responsible for a particular output. This process stands in contrast to post-hoc or forensic attribution, which attempts to reconstruct provenance after the fact. Generation-time source attribution algorithms operate across modalities including images, videos, text, audio, and music, employing statistical, metric-learning, watermarking, and retrieval-augmented frameworks to embed, extract, or infer generator identities contemporaneously with content creation. The field encompasses open-set attribution—where unseen generators must be rejected as unknown—as well as closed-set scenarios with known models. Applications include IP tracing, regulatory compliance, forensic deepfake detection, content authenticity verification, and royalty assignment.

1. Formal Problem Scope and Attribution Paradigms

Generation-time source attribution solves the problem: Given an output $x$ (image, text, video, etc.), directly assign or infer the generator $g$ responsible for producing $x$ at or during the generation process. Formally, for images:

• Let $x$ be a sample, $G_{\text{train}} = \{g_1,...,g_N\}$ known generators, and $G_{\text{test}} \supset G_{\text{train}}$ the complete generator universe.
• The task is to first assign a candidate generator $S(x) \in G_{\text{train}}$, then decide via rule $R(x) \in \{\text{accept}, \text{reject}\}$ whether the assignment is plausible or “unseen”.

Frameworks differ on the “moment” attribution is performed:

• Generation-time: Provenance embedded or computed as the sample is generated (Morreale et al., 9 Oct 2025, Li et al., 2024, Wang et al., 2023, Fang et al., 2023, Li et al., 2024, Bonechi et al., 31 Oct 2025).
• Post-hoc: Forensic attribution acting retroactively (Morreale et al., 9 Oct 2025, Saxena et al., 25 Sep 2025).

Models may operate in closed-set (all generators are known) or open-set (unseen generators must be detected and rejected) conditions, as formalized with accept/reject logic (Fang et al., 2023, Firc et al., 26 May 2025).

2. Architectures and Core Algorithms for Source Attribution

Metric Learning for Open-Set Image Attribution

An embedding network $f_\theta(x)$ is trained via metric learning (ProxyNCA++ loss) to map images to a discriminative Euclidean space. Each generator $g_i$ receives a learned proxy $p(i)$, pulling in-group samples close while repulsing others:

$$P_i = \frac{\exp(-\|f_\theta(x_i) - p(y_i)\|_2)}{\sum_{a=1}^N \exp(-\|f_\theta(x_i) - p(a)\|_2)}$$

$L_{\text{proxy}} = -\log P_i$

Reference centroids $\mu_i$ are constructed and a normalized distance score $$s(x, \mu_{\hat y}) = \|z - \mu_{\hat y}\|_2 / \sigma_{\hat y}$$ is used for thresholded accept/reject (Fang et al., 2023).

Watermarking-Based Attribution for Text and Images

Text: WASA augments model vocabulary with invisible Unicode tokens, embedding a provider-specific watermark at generation time, decoded by scanning generated text for unique character sequences (Wang et al., 2023).

Image: Protect-Your-IP uses a reversible encoder $\mathcal{E}(x, w)$ to embed watermarks; a decoder $\mathcal{D}$ recovers the watermark from generated content. Accuracy for watermark presence and generator is >92–97% under adversarial perturbations (Li et al., 2024).

Retrieval-Augmented Attribution

Nearest Neighbor Speculative Decoding (Nest) blends parametric LM token probabilities with kNN retrieval at each generation step:

$$p_{\mathcal M}(w|x_{<t}) = \lambda_t p_{LM}(w|x_{<t}) + (1-\lambda_t) p_{kNN}(w|x_{<t})$$

Accepted spans are tagged with their source document at generation time, supporting per-token provenance tracking and 1.8× speed-up over classical kNN-LM (Li et al., 2024). VISA further enables visual bounding box attribution on retrieved document screenshots (Ma et al., 2024).

Shapley-Based Attribution in RAG

Generation-time attribution in Retrieval-Augmented Generation (RAG) can use Shapley values to estimate the marginal contribution of each retrieved document:

$$\phi_i = \sum_{S \subset D \backslash \{i\}} \frac{|S|!\,(|D| - |S| - 1)!}{|D|!} \left[ U(S \cup \{i\}) - U(S) \right]$$

Kernel SHAP provides an efficient surrogate at ~6–10% of the cost with >90% rank agreement (Nematov et al., 6 Jul 2025).

Video and Audio Attribution

SAGA applies a transformer architecture over video frame features for multi-granular attribution (authenticity, task, model version, developer, generator), achieving near-supervised accuracy with only 0.5% labeled data per class (Kundu et al., 16 Nov 2025). Temporal Attention Signatures visualize generator-specific spatio-temporal artifacts.

STOPA enables audio source tracing by using systematically varied synthetic speech datasets and trace embedding models, supporting attack, acoustic, and vocoder-level open-set attribution (Firc et al., 26 May 2025).

3. Evaluation Metrics and Experimental Findings

Performance is quantified through standard detection and attribution metrics:

• Accuracy, F₁-score for closed-set assignment.
• Correct Reject Rate (CRR): percentage of unseen samples that are correctly rejected as “unknown”.
• Average F₁ (aF₁) across known generators.
• ROC curves and AUROC for open-set discrimination.
• Per-task precision, recall, F₁, coverage, and latency for citation systems (Saxena et al., 25 Sep 2025).
• Empirical coverage and span length for semi-parametric LMs (Li et al., 2024), with >33% up to >95% per-token attribution rates.

Table: Key Quantitative Results for Open-Set Attribution (Image Domain)

Model	aF₁ (Closed-Set)	CRR (Unseen)	AUC (aF₁-CRR)
MISLNet (pretrained)	≈0.90	≈0.65	≈0.87
Closed-set classifiers	lower	≈0	lower
Similarity nets (FSM)	≈0.20	≈0.63	lower

Results indicate metric learning and pretraining consistently boost open-set generalization over traditional closed-set classifiers (Fang et al., 2023).

4. Interpretability and Multimodal Provenance

Temporal Attention Signatures (T-Sigs) in video transformers visualize inter-frame model attention, revealing generator-specific motion fingerprints (Kundu et al., 16 Nov 2025). SHAP analysis in diffusion-based image attribution highlights feature overlap per generator, clarifying confusion rates and attribution discriminability (Bonechi et al., 31 Oct 2025).

VISA leverages cross-modal attention maps to generate fine-grained visual evidence bounding boxes with up to 68% IoU accuracy after fine-tuning (Ma et al., 2024). LAQuer enables user-directed, subspan-level attribution in text generation scenarios, dramatically reducing cited source length for direct auditability (Hirsch et al., 1 Jun 2025).

5. Limitations, Scalability, and Security

Identified limitations include:

• Incomplete disentanglement of model and content factors—especially in music and language, where attributes are highly entangled (Morreale et al., 9 Oct 2025).
• Scalability to unseen generators or expanding source universes is nontrivial, requiring open-set detection, continual embedding updates, or incremental replay methods (Fang et al., 2023, Li et al., 2024).
• Attack vectors include log tampering, watermark stripping, weight manipulation, and model hallucination; cryptographic and protocol-level safeguards are recommended (Morreale et al., 9 Oct 2025).
• Kernel SHAP and other cooperative-game techniques scale only up to ~10 retrieved documents per query in RAG pipelines before computational expense becomes prohibitive (Nematov et al., 6 Jul 2025).

6. Applications and Regulatory Implications

Generation-time source attribution underpins:

• Copyright enforcement and royalty assignment in generative music (Morreale et al., 9 Oct 2025).
• IP protection against unauthorized personalized generation (Li et al., 2024).
• Deepfake detection and forensic audit across multimedia domains (Firc et al., 26 May 2025, Kundu et al., 16 Nov 2025, Bonechi et al., 31 Oct 2025).
• Human-verifiable citation in high-stakes language domains (medicine, law, science) (Saxena et al., 25 Sep 2025, Yuan et al., 7 Jul 2025).
• Interactive, fine-grained fact verification via user queries and subspan-level audit (e.g., LAQuer) (Hirsch et al., 1 Jun 2025).

Systems with atomic logging, metadata embedding, and cryptographic signing enable legally enforceable and ethically transparent provenance protocols (Morreale et al., 9 Oct 2025).

7. Future Directions

Research directions include:

• Expanding signature databases for dynamic, open-world model accountability (Firc et al., 26 May 2025).
• Developing scalable, streaming attribution aligned at the token or region level in multi-modal generators (Hirsch et al., 1 Jun 2025, Ma et al., 2024).
• Improving robustness of watermarking and semi-parametric provenance against adversarial threats (Wang et al., 2023, Li et al., 2024).
• Integrating attribution directly within decoding architectures to support real-time, interactive provenance delivery (Li et al., 2024).
• Formalizing bounds on false positive/negative attribution, especially under unseen model generalization and adversary adaptation (Wang et al., 2023).

These advances collectively aim to embed source traceability as a native property of all generative AI systems, providing technical, forensic, and legal guarantees for future content authenticity and governance.