Scalable Black-Box Model Attribution for Images

Abstract

The rapid proliferation of generative models raises the model attribution problem: given only an image, can we determine which model produced it? Existing methods have grown as elaborate as the generators they target, on the assumption that a more sophisticated generator demands a more sophisticated attributor. We show it does not.

RPA (Raw-Patch Attribution) attributes images in the strictest black-box setting with a lightweight CNN. Despite its simplicity, it attributes more models at higher accuracy than prior work, reaching 98.0% on 25-class DRAGON and 92.9% on 27-class OpenFake; it is data-efficient and runs at a cost independent of the number of candidate models; and it stays robust to the compression, blur, and resizing images undergo in the wild.

Training for closed-set attribution yields a versatile feature extractor: the same representation recovers model lineage without supervision, flags unseen generators, and admits new models through few-shot adaptation rather than retraining.

A 5x5 grid of near-identical leopard photographs, each generated by a different text-to-image model from the same prompt. — **Same prompt, twenty-five generators.** A single prompt rendered by twenty-five text-to-image models.

Method

Three steps, one small network

01 / Patch division

Split into 256×256 patches

Fixed-size RGB patches, overlapping at the edges so every pixel is covered. The model is resolution-invariant, from 256² to 4096² without retraining.

02 / Per-patch classification

Classify each patch from raw pixels

A compact ~6M-parameter CNN scores each patch against every candidate generator in one forward pass — image-only, black-box, no model internals required.

03 / Aggregation

Combine per-patch votes

Per-patch softmax scores combine into one image-level label via an overlap-corrected weighted average.

Closed-set attribution

Black-box and white-box accuracy

Black-box comparison

Evaluated on DRAGON (25 generators) and OpenFake (27 generators), from the image alone — no model access at all.

98.0%

Top-1 accuracy · 25-class DRAGON

92.9%

Top-1 accuracy · 27-class OpenFake

8.5ms

Inference time

Table 1 — Black-box setting. From the image alone, a compact CNN attains the highest accuracy at the largest class count.
Method	#Classes	Acc. (%)	Params (M)	Data
DE-FAKE	25	62.0	151	DRAGON
OCC-CLIP	25	8.6	151	DRAGON
EfficientFormer	13	91.0	31	Private
Ours	25	98.0	5.9	DRAGON
Ours	27	92.9	5.9	OpenFake

White-box comparison

On AEDR's eight-model benchmark, where competitors get each candidate's autoencoder, our classifier reaches higher mean pairwise accuracy at two orders of magnitude lower inference cost, image-only.

Table 2 — White-box setting. Mean pairwise accuracy and per-image inference time on AEDR's eight-model benchmark. Our method outperforms the alternatives while being two orders of magnitude faster and strictly black-box.
Method	Access	Infer. (s)	Acc. (%)
LatentTracer	Model weights	54.9	70.3
AEDR	VAE weights	0.53	95.1
Ours	Image only	0.0085	97.7

Open-set & adaptation

Recognizing unknown generators, and adapting to new ones

Trained on 17 of OpenFake's 27 generators, RPA can flag sources it has never seen, and quickly incorporate new ones once labels arrive.

Flagging unknown generators

Images from the 10 held-out sources are rejected as unknown via simple entropy-based thresholding.

0.862

AU-OSCR, open-set rejection (± 0.040)

Few-shot adaptation to new generators

The backbone already learns a general fingerprint space, so a generator it has never seen is admitted by freezing that backbone and fitting only a linear head — no retraining. Ten labeled images per class are enough to lead the published baselines, in about 20 seconds.

Table 3 — Few-shot attribution on nine unseen GenImage generators, N labeled images per class, LIDA's protocol.
Method	1-shot	10-shot
ResNet	17.4	21.4
DIRE	14.3	17.2
ESSP	17.0	22.4
LIDA	40.4	54.0
Ours (OpenFake)	37.5 ± 4.5	60.3 ± 0.4
Ours (DRAGON)	38.9 ± 2.4	59.5 ± 1.1

Universal feature extractor

Features that generalize beyond attribution

Trained only to classify known generators, the network's features generalize beyond that task: they organize sources it has never seen, and recover the lineage of the ones it has, with no fine-tuning, labels, or calibration.

Clustering unseen generators Lineage of seen generators

A UMAP projection of penultimate CNN features for ten held-out generators, forming well-separated clusters colored by ground-truth source.

UMAP of penultimate features for ten generators never seen in training. Density-based clustering recovers ~8 clusters against the true 10 sources (ARI 0.63, NMI 0.82, 92% purity).

A dendrogram clustering generators by learned CNN feature similarity, colored by ground-truth family, with the Flux and SDXL families each forming clean clades.

The same features, clustered on 27 known OpenFake generators with no lineage labels at all. Architecturally related models land next to each other — the network organizes by structure, not just by which generator produced an image.