💻 computer science

Attribution as Retrieval: Model-Agnostic AI-Generated Image Attribution

This paper introduces LIDA, a model-agnostic framework that reframes AI-generated image attribution as an instance retrieval problem using low-bit fingerprinting and unsupervised pre-training to achieve state-of-the-art performance in zero- and few-shot settings without requiring access to the original generative models.

Original authors: Hongsong Wang, Renxi Cheng, Chaolei Han, Jie Gui

Published 2026-03-12

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Hongsong Wang, Renxi Cheng, Chaolei Han, Jie Gui

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet is a massive, bustling art gallery. In the past, every painting had a clear signature from the artist. But now, with the rise of AI, anyone can walk in and ask a robot to paint a masterpiece. The problem? These robot paintings look so real that it's impossible to tell who (or what) made them just by looking at the canvas.

This paper introduces a new detective tool called LIDA (Low-bIt-plane-based Deepfake Attribution) to solve this mystery. Here is how it works, broken down into simple concepts:

1. The Old Way vs. The New Way

The Old Way (The "Classroom" Approach):
Imagine trying to identify a criminal by memorizing their face in a classroom. You study photos of 10 known criminals. If a new criminal walks in who you've never seen before, you are stuck. You can't identify them because they weren't in your class.

In tech terms: Old AI tools were trained on specific models (like Midjourney or Stable Diffusion). If a brand-new AI model appeared tomorrow, the old tools would fail because they hadn't "studied" it.

The New Way (The "Library" Approach):
LIDA changes the game. Instead of trying to memorize faces, it treats attribution like searching a library.

You have a "Registered Library" containing just a few sample images from every known AI generator.
When a suspicious image arrives, LIDA doesn't ask, "Is this from Model A or Model B?"
Instead, it asks, "Which book in the library does this look most like?"
If the new image looks 95% like the samples from "Midjourney" in the library, it's from Midjourney. If a brand-new AI model appears, you just drop one sample of its work into the library, and LIDA instantly knows how to find it next time. No retraining required!

2. The Secret Weapon: "Low-Bit Fingerprints"

How does LIDA know which library book to pick? It doesn't look at the beautiful sky or the eagle in the picture (the content). It looks at the digital dust underneath.

The Analogy: Imagine a high-resolution photo is a giant, colorful mosaic. If you zoom in really close, you see the individual tiles.
The Trick: AI models are like clumsy tile-layers. Even though they make a beautiful picture, they leave tiny, invisible scratches or patterns in the very last few layers of the tiles (the "low bits").
The Process: LIDA strips away all the color and the pretty picture, leaving only these invisible scratches. It turns the image into a grainy, black-and-white "fingerprint."
Why it works: Every AI model leaves a different pattern of scratches. A Stable Diffusion scratch looks different from a Midjourney scratch. By looking only at these scratches, LIDA can tell them apart even if the pictures look identical to the human eye.

3. The Two-Step Training (The "Apprentice" System)

LIDA learns in two stages, like a detective training an apprentice:

Step 1: The Generalist (Unsupervised Pre-training):
The apprentice studies millions of real photos (from nature, people, etc.) and learns to spot the "natural noise" of the real world. This gives them a solid foundation.
Step 2: The Specialist (Few-Shot Adaptation):
Now, the apprentice only needs to see one or five examples of a fake image to learn the specific "signature" of that AI. It's like showing a detective a single photo of a new suspect; they immediately know what to look for next time.

4. Why This Matters

It's Future-Proof: As soon as a new AI tool is released, you don't need to wait months to train a new detector. You just add a few samples to the library, and the system works immediately.
It's Fast: Because it strips away the complex colors and focuses on simple math (binary operations), it runs incredibly fast.
It's Robust: Even if someone tries to blur the image or compress it (like sending it through WhatsApp), the "digital scratches" (fingerprints) usually survive, and LIDA can still catch the culprit.

Summary

Think of LIDA as a super-smart librarian who doesn't care what the story is about. Instead, they look at the texture of the paper and the ink patterns. If a new author starts writing, the librarian just needs to see one page to know exactly which "ink texture" belongs to them. This makes it nearly impossible for AI-generated fakes to hide in plain sight.

1. Problem Statement

The rapid advancement of AI-Generated Content (AIGC) has created a critical need for AI-generated image attribution—the ability to identify the specific generative model (e.g., Stable Diffusion, Midjourney, BigGAN) that created a specific image.

Current approaches face significant limitations:

Model-Dependency: Existing methods often require access to the generative model's internal parameters or training data, which is rarely available for proprietary or closed-source models.
Closed-Set Limitations: Most attribution methods treat the problem as a classification task trained on a fixed set of known generators. They fail to generalize to new, unseen, or rapidly evolving models (Open-Set scenarios).
Scalability Issues: Retraining a classifier every time a new generator appears is computationally expensive and impractical.
Watermarking Constraints: Generative watermarking techniques require modifying the generation process, which is not feasible for analyzing existing images from external sources.

2. Methodology: LIDA Framework

The authors propose LIDA (Low-bIt-plane-based Deepfake Attribution), a model-agnostic framework that reframes image attribution as an instance retrieval problem rather than a classification problem. The pipeline consists of three main stages:

A. Low-Bit Fingerprint Generation

Instead of using raw RGB images, LIDA extracts low-bit generative fingerprints.

Concept: AI-generated images contain subtle, model-specific artifacts (noise patterns) that are distinct from natural images. These artifacts are most prominent in the Least Significant Bit (LSB) planes.
Process: The method decomposes the RGB channels into bit planes. It combines the three least significant bit planes ( $k=0, 1, 2$ ) of each channel and applies a thresholding strategy to create a binary "fingerprint" image.
Advantage: These fingerprints discard semantic content (the actual image subject) and retain only the structural noise patterns unique to the generator, making them highly discriminative for attribution.

B. Unsupervised Pre-Training

To ensure the feature encoder generalizes well, the model undergoes unsupervised pre-training on a large-scale dataset of real images (ImageNet).

Architecture: A lightweight ResNet-50 is used as the attribution encoder. Downsampling in lower layers is removed to preserve high-resolution spatial details essential for forensic analysis.
Pretext Task: The network is trained using a side task (e.g., image classification on the fingerprint inputs) with a standard cross-entropy loss ( $L_P$ ). This forces the network to learn intrinsic noise structures common to real images, providing a robust initialization.

C. Few-Shot Attribution Adaptation

This is the core innovation allowing the system to handle Open-Set scenarios (new/unseen generators).

Registered Database: A database is maintained containing only a few (1–10) exemplar images per generator (both real and fake).
Retrieval Paradigm: When a query image arrives, it is converted to a fingerprint, passed through the encoder, and compared via cosine similarity against the database. The attribution is determined by the top-ranked retrieved neighbors.
Loss Functions: To adapt the pre-trained model to the specific database without destroying the learned feature space, the authors avoid standard Cross-Entropy loss. Instead, they use:
1. Center Loss ( $L_A$ ): Encourages features of the same generator to cluster around a specific class center, ensuring intra-class compactness.
2. Real-Prototype Contrastive Loss ( $L_D$ ): Pulls real image features closer to a "real prototype" (average feature of real images) and pushes fake features away. This enhances the separation between real and fake domains.
Total Loss: $L = L_A + \lambda L_D$ .

3. Key Contributions

Novel Paradigm Shift: The paper formulates AI-generated image attribution as an instance retrieval problem. This eliminates the need for retraining when new generators appear; one simply adds a few samples to the database.
Bit-Plane Fingerprinting: The introduction of Low-Bit Generative Fingerprints as the input modality. This effectively isolates generator-specific noise from semantic content, significantly outperforming raw RGB inputs.
Model-Agnostic & Few-Shot: The framework requires no access to the generative model's architecture or weights. It achieves high accuracy with only 1 to 10 samples (few-shot) per generator.
Robust Training Strategy: The combination of unsupervised pre-training on real images and specific loss functions (Center Loss + Contrastive Loss) preserves the feature space structure while adapting to new classes.

4. Experimental Results

The method was evaluated on two large-scale benchmarks: GenImage and WildFake, covering cross-architecture and cross-generator scenarios.

Image Attribution (Retrieval):
- GenImage: In the 10-shot setting, LIDA achieved a Rank-1 accuracy of 54.0% and mAP of 51.6%, significantly outperforming baselines like ResNet-50, DIRE, and ESSP (which hovered around 20-28%).
- WildFake: Under the 10-shot setting, LIDA achieved a Rank-1 of 62.3%, surpassing the best baseline by over 30%.
- Zero-Shot Detection: Even without any fake image training data, LIDA achieved 86.3% accuracy in distinguishing real vs. fake images, outperforming specialized zero-shot detectors like FSD and RIGID.
Robustness: The method demonstrated strong resilience against image degradations, including Gaussian blur and JPEG compression, maintaining high performance where RGB-based methods failed.
Efficiency: The inference speed is in the millisecond range due to the use of binary operations for fingerprint generation and a lightweight ResNet-50 encoder.

5. Significance

Scalability for the Future: As AIGC models evolve rapidly, the ability to attribute images without retraining the entire model is crucial. LIDA provides a scalable solution where new models can be added to the system instantly by registering a few samples.
Practical Applicability: By being model-agnostic, LIDA can be deployed to analyze images from proprietary tools (like Midjourney) where the underlying code is inaccessible.
Forensic Evidence: Unlike classification which outputs a probability, the retrieval approach provides evidence-based attribution by showing the specific retrieved images that justify the decision, increasing trust in the forensic process.
Dual Utility: The framework effectively handles both Deepfake detection (Real vs. Fake) and Source Attribution (Which Generator?), unifying these tasks under a single, efficient pipeline.

In conclusion, LIDA represents a state-of-the-art shift in AI forensics, moving from rigid classification models to flexible, retrieval-based systems that leverage low-bit noise patterns to track the provenance of synthetic media.