Research map / Probabilistic and scientific modeling / Molecules and proteins
Single-Model Attribution of Generative Models Through Final-Layer Inversion
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FLIPAD, which casts single-model attribution as open-world anomaly detection on features from a convex lasso-based final-layer inversion of the target generator, trained against real or other-generator samples.
Problem
Single-model attribution in the open-world setting: deciding whether a sample was generated by one specific generative model, without watermarking the model or needing samples from other generators.
Approach
Treat single-model attribution as anomaly detection and use features from a convex lasso reformulation of final-layer inversion (regularized toward the average activation) as inputs to DeepSAD, avoiding costly iterative full inversion and model modification.
Key results
- On CelebA and LSUN closed-group attribution, FLIPAD averages above 97.5% accuracy across all four GAN types, versus 50-99% for the adapted inversion baselines.
- Under the same-architecture different-seed setting, FLIPAD reaches 99.31% on CelebA DCGAN and 98.04% on LSUN DCGAN.
- Final-layer inversion with lasso takes about 11.6 minutes for 100 Stable Diffusion samples, versus about 5000 minutes for full inversion baselines (inferred).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use final-layer inversion features with anomaly detection instead of raw inputs | FLIPAD · CelebA, DCGAN attribution | accuracy: 94.95 -> 99.34 | Helped |
| Use final-layer inversion features with anomaly detection instead of raw inputs | FLIPAD · CelebA, WGAN-GP attribution | accuracy: 59.12 -> 99.40 | Helped |
| Use final-layer inversion features with anomaly detection instead of raw inputs | FLIPAD · CelebA, LSGAN attribution | accuracy: 99.53 -> 98.94 | Hurt |
| Use final-layer inversion features with anomaly detection instead of raw inputs | FLIPAD · CelebA, EBGAN attribution | accuracy: 99.54 -> 99.68 | Helped |
| Use final-layer inversion features with anomaly detection instead of raw inputs | FLIPAD · LSUN, DCGAN attribution | accuracy: 67.14 -> 97.75 | Helped |
| Use final-layer inversion features with anomaly detection instead of raw inputs | FLIPAD · LSUN, WGAN-GP attribution | accuracy: 52.36 -> 97.73 | Helped |
| Use final-layer inversion features with anomaly detection instead of raw inputs | FLIPAD · LSUN, LSGAN attribution | accuracy: 98.22 -> 98.19 | No clear effect |
| Use final-layer inversion features with anomaly detection instead of raw inputs | FLIPAD · LSUN, EBGAN attribution | accuracy: 93.96 -> 99.38 | Helped |
Surprising findings
- DCTPAD fails to generalize to Stable Diffusion variants beyond the training generator, despite strong in-distribution results.
- FLIPAD is weaker under JPEG compression and additive noise, where RawPAD degrades less.
Limitations
- Skip connections (e.g., StyleGAN2) complicate applying FLIPAD, so it was not evaluated on style-based models.
- Performance drops under JPEG compression and noise perturbations relative to RawPAD.
- Theoretical recovery bound depends on the L1 norm of z minus its best sparse approximation, which need not be small for generator activations.
Experimental setup
Datasets: CelebA LSUN bedroom FFHQ BCDR Redwine
Benchmarks: CelebA attribution suite LSUN attribution suite Stable Diffusion version attribution StyleGAN attribution BCDR medical attribution Redwine tabular attribution
Metrics: classification accuracy wall-clock run time
Baselines: SM-F SM-Inv2 IncInv RawPAD DCTPAD
Builds on: DeepSAD basis pursuit denoising FISTA inversion-based attribution
Closest papers by meaning
- Mechanistic Anomaly Detection via Functional Attribution (ICML 2026 · similarity 0.86)
- Generative Model Inversion Through the Lens of the Manifold Hypothesis (NeurIPS 2025 · similarity 0.85)
- Forte : Finding Outliers with Representation Typicality Estimation (ICLR 2025 · similarity 0.84)
- Statistically Optimal Generative Modeling with Maximum Deviation from the Empirical Distribution (ICML 2024 · similarity 0.84)
- ManiFPT: Defining and Analyzing Fingerprints of Generative Models (CVPR 2024 · similarity 0.84)
- Generative Unlearning for Any Identity (CVPR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.