Target Generator Attribution

• Target generator attribution is a field that pinpoints the specific generative model using techniques like white-box inversion, feature fingerprinting, and constrained optimization.
• The methodology leverages gradient-based solvers, embedding extraction, and metric learning to assess reconstruction errors and confidently assign outputs to source models.
• Benchmark datasets such as Attribution88 and WILD, along with rigorous evaluation metrics like ROC-AUC and CRR, validate the robustness and scalability of these attribution systems.

Target generator attribution refers to the suite of methodologies developed to identify, at fine semantic or architectural granularity, the particular generative model responsible for a given output—be it image, text, video, or sequence. Unlike binary detection (real vs. synthetic), target attribution interrogates the generator space to either select the most plausible source model from a candidate pool or, in open-set configurations, identify whether the model is known or novel. Foundational advances span white-box inversion, representation fingerprinting, robust metric learning, constrained optimization, and integrative attribution pipelines.

1. Mathematical Formulations and Target Attribution Criteria

Source generator attribution formalizes the assignment problem as follows: given a candidate set of generators $\{G_1,\ldots,G_n\}$ and a query output $x$, determine which, if any, $G_i$ generated $x$. In the classical white-box setting for deep image generators, attribution is posed via generator inversion (Albright et al., 2019):

• For each differentiable $G_i:\mathbb{R}^d\to\mathbb{R}^{M\times N\times C}$, compute the loss

$L_i(z) = \frac{1}{MN} \| G_i(z) - x \|_2^2$

and solve for the latent $z_i^*$ minimizing $L_i(z)$. The minimal reconstruction error $L_i^{\min} = L_i(z_i^*)$ becomes the attribution score.

• In the $n$-generator case, assign $x$ to $G_{i^*}$ where $i^* = \arg\min_i L_i^{\min}$, or compute the normalized score

$$S_i = \frac{\min_{j\neq i} L_j^{\min} - L_i^{\min}}{\min_{j\neq i} L_j^{\min} + L_i^{\min}}$$

to threshold attribution confidence.

Generalizations include metric learning to obtain embeddings where generator separation is maximized (Fang et al., 2023), feature-space comparisons via pre-trained models (Bonechi et al., 31 Oct 2025), and discriminative classifier heads for multi-class settings (Bongini et al., 28 Apr 2025). Open-set protocols introduce rejection via distance-to-centroid normalization and thresholding.

2. Algorithmic Architectures and Practical Workflows

Attribution systems span four principal workflows:

A. White-box Model Inversion

Employs gradient-based solvers (e.g., Adam) to invert $G_i$ for minimal loss with multi-start optimization, mitigating nonconvex local minima. Attribution is robust if the recovered latent $z_i^*$ enables faithful regeneration by $G_i$ (Albright et al., 2019).

B. Feature and Embedding Methods

Extracts discriminative fingerprints, typically from internal activations of vision backbones (e.g., SDM U-Net layer features (Bonechi et al., 31 Oct 2025)), CNN or transformer encoders (Bongini et al., 28 Apr 2025), or metric-optimized deep embeddings (Fang et al., 2023). Attribution transforms into $k$-NN or neural classifier prediction, often after batch centroids and softmax normalization.

C. Resynthesis-based Attribution

Implements a two-stage pipeline: (i) semantic prompt extraction from $x$; (ii) resynthesis using each candidate generator, followed by feature-space distance measurements (typically CLIP embeddings). The generator yielding the closest synthetic reproduction is selected (Bongini et al., 28 Oct 2025).

D. Constrained Optimization and Open-World Robustness

Single-target attribution systems harden linear classifier boundaries by incorporating unlabeled "wild" data and imposing explicit constraints on in-distribution detection accuracy, optimizing for separation in CLIP or related feature spaces (Thieu et al., 1 Jan 2026).

3. Benchmark Datasets and Evaluation Protocols

Datasets drive evaluation across model architectures, post-processing, and open/closed set regimes:

• Attribution88: Rich in semantic diversity; tests robustness to unseen content and common corruptions (Bui et al., 2022).
• WILD: Balanced closed- and open-set, 10 generators each, 50K images, multiple post-processing chains; core metrics are balanced accuracy (closed), ROC-AUC/EER/TPR@FPR for open-set, and CRR for unknown rejection (Bongini et al., 28 Apr 2025).
• GenImage, MultiNews, MULTITUDE: Enable multi-granular attribution in images, documents, and multilingual text (Bonechi et al., 31 Oct 2025, Cava et al., 3 Aug 2025, Wan et al., 17 Jun 2025).

Quantitative evaluation centers on ROC/AUC, F1, classification/rejection rates, and instance-level attribution quality. Robustness under perturbation and adversarial post-processing is emphasized for practical deployment.

4. Methodological Innovations and Theoretical Results

Distinct advances anchor modern approaches:

• Representation Mixing: RepMix interpolates early-layer features and applies hierarchical loss to enforce artifact detection invariant to semantic content and robust to perturbations (Bui et al., 2022).
• Diffusion Features: Internal activations from frozen diffusion models encode generator-specific patterns that are linearly and nonlinearly separable (Bonechi et al., 31 Oct 2025).
• Metric Learning with Camera-ID Pretraining: Initializing attribution nets on camera-identification tasks allows cross-generator transfer, enabling high F1 and CRR in open-set detection (Fang et al., 2023).
• Lasso-based Final Layer Inversion: Reduces single-generator attribution (FLIPAD) to convex $\ell_1$ minimization for anomaly detection, achieving theoretical recovery guarantees under mild convolutional randomization (Laszkiewicz et al., 2023).
• Decentralized Attribution: Binary classifiers parameterized by geometric keys $\phi_i$ offer provable attributability lower bounds and circumvent scalability bottlenecks of centralized classifiers (Kim et al., 2020).

5. Limitations, Failure Modes, and Prospective Extensions

Attribution is constrained by:

• Post-processing Sensitivity: Compression, resizing, filtering can push $x$ off the generator manifold, degrading reconstruction or embedding separability (Albright et al., 2019, Bongini et al., 28 Apr 2025).
• Indistinguishable Generators: Closely related models (identical architectures, data, seeds) reduce attribution margin (Albright et al., 2019, Bonechi et al., 31 Oct 2025).
• Dependence on Caption/Prompt Quality: Resynthesis methods are vulnerable to poor semantic extraction and style drift (Bongini et al., 28 Oct 2025).
• Computational Cost and Scalability: Inversion and metric learning scale with generator pool size, restarts, and embedding dimension (Albright et al., 2019, Fang et al., 2023).

Recommended extensions include stronger generative priors, integration of perceptual losses, black-box/fingerprint hybrid schemes, improved prompt extraction with multimodal encoders, and meta- or continual adaptation for rapid generator evolution.

6. Empirical Comparisons and State-of-the-Art Performance

Recent methodologies establish robust benchmarks:

Methodology	Closed-Set Acc.	Open-Set CRR	Robustness to Distortions	Notable Benchmarks
RepMix (Bui et al., 2022)	82%	~0	High (corruptions, fgsm)	Attribution88
CLIP+MLP (Bongini et al., 28 Apr 2025)	96.7%	0.37	Degrades w/ postproc.	WILD
VTC (Bongini et al., 28 Apr 2025)	95.8%	0.17 (3 ops)	Most robust	WILD
MISLNet+ProxyNCA++ (Fang et al., 2023)	90.0%	0.645	Robust open-set rejection	Custom open-set synthetic
FLIPAD (Laszkiewicz et al., 2023)	>99%	N/A	Noise/compression robust	GAN/SD/tabular/image domains
FRIDA MLP (Bonechi et al., 31 Oct 2025)	84.4%	N/A	Layer fingerprinting	GenImage

Empirical trends confirm that fusion of high-level and low-level features, rigorous post-processing augmentation, and rejection threshold calibration are instrumental to high-fidelity, real-world attribution.

7. Forensic, Regulatory, and Practical Implications

Accurate target generator attribution underpins forensic lineage tracing, IP enforcement, and trust in generative content. Frameworks such as SAGA offer multi-granular video attribution for regulatory compliance, including architectural, team, and model-version indices (Kundu et al., 16 Nov 2025). In image/text domains, modular pipelines and executable attribution programs enhance interpretability, auditability, and local refinement of attributions (Wan et al., 17 Jun 2025). Emerging protocols for open-world settings and unlabeled data exploitation signal further advances toward universal, robust attribution systems.