💻 computer science

Scalable Black-Box Model Attribution for Images

This paper introduces RPA (Raw-Patch Attribution), a lightweight and robust black-box method that outperforms complex existing approaches in identifying generative image models while offering versatile capabilities for unsupervised grouping and few-shot adaptation without retraining.

Original authors: Asaf Livne, Amir Jevnisek, Shai Avidan

Published 2026-08-18

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Asaf Livne, Amir Jevnisek, Shai Avidan

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the last few years, a new kind of artificial intelligence has transformed how we create pictures. These systems, known as generative models, can turn simple text descriptions into stunning, photorealistic images. They have become so common that they now underpin much of modern media production and creative work. However, this rapid spread has created a significant problem: when you see a picture, it is often impossible to tell which specific machine created it. This uncertainty matters for reasons ranging from protecting an artist's intellectual property to tracing the origin of misleading content. The challenge is not just to spot that an image is fake, but to identify exactly which of the hundreds of different AI engines produced it. This task, called model attribution, is difficult because these machines are constantly evolving, and their outputs often look nearly identical to the human eye. Furthermore, the sheer number of available models, including thousands of customized versions, makes the task of tracking them down seem overwhelming.

Researchers at Tel Aviv University have found a surprisingly simple solution to this complex problem. Instead of building a massive, intricate system to match the complexity of the generators, they developed a lightweight tool that works like a basic classifier. Their approach, called RPA, operates in the strictest "black-box" setting, meaning it looks only at the final image without needing access to the internal code, weights, or secret settings of the AI that made it. The method splits an image into small squares and analyzes the raw color patterns in each one. Despite the visual similarity between images from different models, the researchers discovered that each generator leaves behind a unique, low-level fingerprint in the texture of the pixels. By training a small neural network to recognize these subtle patterns, the system can identify the source of an image with remarkable precision. On a test set of twenty-five different models, the tool achieved an accuracy of 98.0 percent, and on a more chaotic, real-world set of twenty-seven models, it still reached 92.9 percent.

What makes this finding particularly striking is how the tool handles the messy reality of the internet. Images in the wild are rarely pristine; they are often compressed, blurred, or resized as they travel across social media and news sites. Many previous methods failed when faced with these common changes. The new system, however, remains robust. When the researchers tested it against images that had been heavily compressed or resized, the accuracy dropped only slightly, proving that the fingerprint it detects is a fundamental structural trait rather than a fleeting artifact. The system is also incredibly efficient. Unlike other approaches that require comparing an image against every possible candidate model one by one—a process that slows down as the number of models grows—this tool evaluates an image in a single pass. The time it takes to identify a source does not increase even if the database of known models expands from a few dozen to a few thousand.

Beyond simply identifying known models, the researchers found that the tool possesses a deeper, more versatile intelligence. When it encounters an image from a generator it has never seen before, it can reliably flag it as unknown, rather than forcing a wrong guess. This ability to recognize the unfamiliar is crucial for a field where new models appear daily. Moreover, the system can adapt to these new models almost instantly. Instead of requiring a lengthy retraining process, the researchers can simply add a new model by fitting a small, simple layer to the existing network, a task that takes only a few minutes. This flexibility suggests that the tool has learned a general map of how these machines work, rather than just memorizing a list of specific examples.

The researchers also used this learned understanding to explore the relationships between the models themselves. By analyzing the internal features the tool uses to make its decisions, they were able to group different generators into families based on their architectural similarities, even without being told which models were related. The system correctly identified that certain models shared a common lineage or base technology, clustering them together in a way that matched known facts about their development. This capability extends to images from unseen generators as well, allowing the tool to group them by their true source without any prior training. The study demonstrates that a simple, direct approach can outperform elaborate, heavy machinery in the task of tracing digital origins. It suggests that the key to understanding these complex systems lies not in building more complicated detectors, but in recognizing the subtle, persistent signatures that every machine leaves behind in the images it creates.

Technical Summary: Scalable Black-Box Model Attribution for Images

Problem Statement
The rapid proliferation of generative models has created a critical need for model attribution: the ability to determine which specific model produced a given image using only the image itself. Current attribution methods face significant practical limitations. Many rely on white-box access to model internals (weights, autoencoders, prompts) which are rarely available in real-world scenarios. Others suffer from coarse-grained discrimination, failing to distinguish between models that share architectural families or autoencoders. Furthermore, existing approaches are often fragile under common image degradations (JPEG compression, blur, resizing) and impose high computational costs that do not scale well as the number of candidate models grows (e.g., reconstruction-based methods scale linearly with the number of candidates).

Methodology: Raw-Patch Attribution (RPA)
The authors propose RPA (Raw-Patch Attribution), a lightweight, strictly black-box approach that attributes images without access to model weights, prompts, or seeds. The method is grounded in the observation that generative pipelines embed persistent, highly separable spectral signatures (low-level artifacts) in the frequency domain, which are distinct for each generator.

The RPA pipeline consists of three steps:

Patch Division: The input image is split into overlapping $256 \times 256$ patches. This ensures resolution invariance, allowing the model to process images from $256^2$ to $4096^2$ pixels without retraining.
Per-Patch Classification: A compact Convolutional Neural Network (CNN) with approximately 6 million parameters classifies each patch directly from its raw RGB pixels. The network outputs class logits for all candidate generators in a single forward pass.
Multi-Patch Aggregation: The final image-level prediction is a weighted average of the per-patch class probabilities, where weights account for edge overlaps to ensure every pixel contributes equally.

Key Contributions

Accurate Black-Box Attribution: RPA achieves state-of-the-art accuracy in the strictest black-box setting, reaching 98.0% on the 25-class DRAGON benchmark and 92.9% on the 27-class OpenFake benchmark. It outperforms prior methods that often require text prompts or white-box access.
Scalability and Efficiency: The inference cost is independent of the number of candidate models ( $O(1)$ ). Unlike reconstruction-based methods that must score an image against every candidate sequentially ( $O(C)$ ), RPA processes all candidates simultaneously. The model is compact, trains quickly, and infers in milliseconds.
Robustness: A corruption-augmented variant of RPA maintains high accuracy under JPEG compression, Gaussian blur, resizing, and cropping, conditions that typically defeat prior methods.
Open-Set Attribution: The network can reliably flag images from unseen generators as "unknown" using only the classifier's confidence scores, without requiring calibration sets or auxiliary outlier data.
Few-Shot Adaptation: New generators can be admitted by freezing the learned backbone and fitting only a linear head. This adaptation takes seconds to minutes and requires minimal data, avoiding full retraining.
Model Discovery: The penultimate-layer features naturally encode relationships between generators. Unsupervised hierarchical clustering of these features successfully recovers the lineage of models (grouping by shared autoencoders or base weights) and clusters images from unseen generators by their true source.

Experimental Results

Closed-Set Performance: On the DRAGON dataset (25 models), RPA achieves 98.0% accuracy, significantly outperforming DE-FAKE (62.0%) and OCC-CLIP (8.6%). On OpenFake (27 models), it reaches 92.9%.
White-Box Comparison: Even when compared against white-box baselines on the AEDR benchmark, RPA (operating strictly black-box) achieves 97.7% mean pairwise accuracy, surpassing methods that utilize model weights (e.g., LatentTracer at 70.3%, AEDR at 95.1%).
Inference Speed: RPA infers in 8.5 ms per image, whereas white-box baselines like AEDR scale from 0.53s to 3.71s as the candidate set grows.
Robustness: Under aggressive JPEG compression (Q=60) and resizing, the model retains high accuracy (e.g., 89.3% on Q60), demonstrating resilience to real-world image degradation.
Adaptation: In few-shot scenarios (1-shot and 10-shot) on the GenImage benchmark, RPA outperforms baselines like LIDA, ResNet, and DIRE, achieving ~60% accuracy with 10 shots.

Significance and Claims
The paper argues that simplicity is sufficient for high-performance attribution. Contrary to the assumption that sophisticated generators require sophisticated attributors, a lightweight CNN operating on raw patches is capable of capturing the necessary "fingerprints."

The authors claim that RPA establishes a new standard for strict black-box attribution, demonstrating that:

High accuracy is achievable without access to model internals.
The learned feature space is versatile, supporting not just classification but also open-set detection, few-shot adaptation, and unsupervised lineage discovery.
The field should move away from heavy, reconstruction-based machinery toward efficient, discriminative baselines.
Model attribution should be viewed as a foundational problem in its own right, potentially subsuming binary deepfake detection as a special case.

The paper explicitly notes limitations: it does not claim to solve real-vs.-fake detection (as the model is not trained on real images) and does not evaluate adversarial robustness against optimized attacks, treating these as separate future work.

Technical Summary: Scalable Black-Box Model Attribution for Images

More like this