Can AI images be traced back to their sources ?

A paper published in Nature Communications on August 18 has been covered as a discovery that AI models forget where their material came from. The finding is more specific than that, and specific in ways that matter to anyone who licenses images for a living.

Zheng Dai and David Gifford at MIT set out to answer a question that sits underneath most of the current litigation and nearly every proposed licensing scheme: can you look at an image produced by a generative model and determine which training images produced it?

Their answer is that at any meaningful scale, you cannot.

How they tested it

The only rigorous way to establish that one image caused another is to remove it and see what changes. Train a model on the full dataset, train a second model on the same dataset minus one photograph, feed both the same starting conditions, and compare what comes out. If the second model produces the same picture, that photograph was not responsible for it.

Doing this honestly means one complete training run for every image you want to test, which is why nobody had done it at scale. Dai and Gifford found a way around the cost. They built each model as an ensemble of independently trained components, with the training data distributed across them so that any single image appears in some components and not others. Removing that image means switching off the components that saw it. What remains is a model that provably never encountered the file, obtained without retraining anything.

They then ran this across 24 model ensembles trained on subsets ranging from 256 to 162,770 images, drawn from seven public datasets including CelebA, MetFaces and ArtBench.

What they measured

For each generated image they calculated what they call the counterfactual radius: the largest change any single removal could produce. A large radius means some piece of training data was genuinely responsible. A small radius means the image would have appeared regardless of what you took out.

The radius shrinks as training sets grow, following a power law. They call this attribution decay.

The result holds up under three tests that the general press coverage has passed over.

They did not only remove single images. For six of the ensembles a unit of removal was every image of a given person; for two, every image by a single artist. Decay held in all three cases. Their clearest example: a model trained on 1,336 artworks generates an image, they identify the closest match in the training data — a fifteenth-century painting attributed to Robert Campin or Rogier van der Weyden — and removing everything by Campin changes the output substantially. Repeat that on a model trained on 50,000 artworks, removing everything by Thomas Jones, and the generated image is essentially unchanged.

They also tested models that respond to text prompts rather than generating freely, since the prompt-driven case is the commercially relevant one. Decay persisted.

And they verified the ablation method against the slow honest approach, training 1,282 separate diffusion models from scratch on small MNIST subsets to confirm that switching off components gives the same answer as retraining.

The finding that matters most

Alongside attribution decay, they measured something more immediately useful: how often similarity-based attribution is simply wrong.

The common-sense method for tracing an output is to find the training image it most resembles. Dai and Gifford tested that method against their causal ground truth and produced a false attribution rate. It rises toward 1.0 as training sets grow. On models trained on tens of thousands of images, the nearest visual match is almost never the actual cause.

This is the part with immediate consequences. Resemblance has been the working evidence in every dispute about generated imagery: you put your photograph beside the output and let people see it. That evidence now has a measured error rate, and it’s high.

Four things to take from it

The press framing overstates it in one direction and understates it in another. The Mona Lisa example circulating in the coverage does not appear in the paper, and taken literally, it describes something impossible: a model rendering a specific painting it has no information about. If an output is recognizably that painting, the information came from the training data. What ablation removes is one file, not the work, which survives across the reproductions, crops, and descriptions any large corpus carries in bulk. That is a much less dramatic claim than the coverage implies. What the coverage understates is the scale gap running the other way: the largest training set here is 162,770 images, against production models trained on around a billion. The authors are explicit about the extrapolation. They also note that production models still reproduce near-copies of training data at a rate of roughly one in a million, so attribution has not vanished for memorized outputs.

Scale becomes a legal shield, and the authors say so. This is not a hostile reading. The paper states that unattributability offers a refutation of access, which is an element in establishing infringement, provided the scraping was done at sufficient scale for decay to appear. It goes further and describes the method: generate repeatedly, measure each output’s counterfactual radius, keep the ones that fall below a threshold. Their technique makes that measurement cheap. Gifford has told reporters that producing outputs guaranteed to be unattributable is an industry obligation rather than a loophole. That claim deserves more argument than it has received. A model that cannot be traced to anyone’s work is being presented as a compliance achievement. We know which side they’re on.

Creators should stop building cases on resemblance. If the nearest visual match is usually the wrong answer, the side-by-side comparison is a weakening form of proof. The argument that does not depend on resemblance is economic: that the volume of generated imagery has destroyed licensing rates. That argument is already live in US courts. In June 2025, Judge Alsup in Bartz v. Anthropic rejected it, holding that copyright advances original works rather than protecting authors against competition, and comparing AI training to teaching schoolchildren to write. Two days later, Judge Chhabria in Kadrey v. Meta called that comparison inapt, wrote that no previous use has had anything like AI’s capacity to flood a market with competing works, and said that market dilution will often decide the fourth fair-use factor and therefore the case. He ruled for Meta anyway, because the plaintiffs never made the argument or built a record for it. He was explicit that they had made the wrong arguments. The split is unresolved and heading for the Ninth Circuit. Winning on dilution requires licensing data, rate histories, and economists, not image comparisons.

Whatever record exists has to be created before training. This is my conclusion rather than the paper’s, but it follows directly. The information about which images produced which output is genuinely absent from a trained model. No forensic tool retrieves it afterward, not because the tools are immature, but because there is nothing to retrieve. That applies equally to the company that ran the training. Every compensation scheme currently proposed, whether royalty pools, per-item metering or opt-out enforcement, assumes an answer to a question that can only be answered in advance: dataset manifests, signed records of what was licensed and what was taken, credentials attached to the files themselves.

One conjecture worth watching

The authors offer an explanation for why decay happens, as conjecture rather than result. They suggest that the features driving model behavior are encoded redundantly across the training set, so removing any single unit leaves the rest of that redundancy intact. Only when data is sparse does redundancy disappear and individual images become causally load-bearing.

If that holds, it produces a counterintuitive consequence they name themselves: deduplicating a training set, generally recommended to reduce memorization, might increase attributability. It also suggests attribution decay is not specific to image models, since redundancy is a property of datasets rather than of architectures.

---

The research paper is open access at doi.org/10.1038/s41467-026-75667-5.