Can you tell which model made an image? Usually yes — just not the way you would want.
Attributing an image to its exact source model is nearly solved in the lab and nearly hopeless in the wild. The fingerprint that matters for QA is the one you already have: the model’s name.
There is a science-fiction version of this question — hand a tool a picture and it names the model that made it — and a Tuesday-in-a-content-pipeline version, where you already know you rendered it in Midjourney because you typed the prompt. Both are real, and they pull in opposite directions. In a lab, attributing an image to its exact source model is close to solved. On an image that has been screenshotted and re-uploaded, it falls apart. And the reason the question is worth asking at all is not forensic curiosity — it is that once you know the model, you know what to check.
Every model signs its work — by accident
The foundational result is that generators leak. The 2019 paper that named the effect showed GANs “carry distinct model fingerprints and leave stable fingerprints in their generated images,” and that “even minor differences in GAN training can result in different fingerprints” — two models trained slightly differently are distinguishable from their output alone. It generalizes past GANs: a forensic study found that GAN, diffusion and VQ-GAN models all “give rise to visible artifacts in the Fourier domain” and anomalous autocorrelation patterns.
The mechanism is mundane — upsampling. “Watch your Up-Convolution” showed the up-convolutions inside these networks cannot reproduce the frequency spectrum of natural images, an effect “independent of the underlying architecture,” strong enough to detect generated images “with up to 100% accuracy on public benchmarks.” And the trace is specific enough to name the model, not just spot the fake: a shallow classifier on frequency (DCT) features identified which of four GANs made an image at 99.64% on LSUN; the more recent PRISM reaches 92.04% attribution across six text-to-image models with no access to model internals; a 2026 method reads a diffusion model’s denoising behavior to attribute among eight models at ~99.9%; and outputs even “form distinctive clusters in the image embedding space” across 22 models and 150,000 images. You can go further and reverse-engineer the architecture itself — “model parsing,” trained on 100K images from 116 different models.
The lab is not the internet
Every one of those numbers is a clean-image number, and attribution is brittle. One watermark-attribution method that scores 0.99 on clean images collapses to 0.657 under a moderate Gaussian blur. A GAN-attribution study that hit 97.6% found that “mirroring an image significantly decreases the attribution’s accuracy (to less than 75%)”, with noise pushing error into double digits — a flip or a filter, before compression even enters the picture.
The full distribution pipeline is worse. Detectors trained on GAN artifacts lose 15.2% AUROC when they meet diffusion images. On real viral images that have already passed through social platforms, single-image detection balanced accuracy falls to 63.4% — barely above a coin flip — recovering only to 70.3% when you fuse several near-duplicate copies. And a model the tool has never seen? State-of-the-art open-set attribution tops out around 62.3% Rank-1 accuracy even with ten reference examples, because the difference between a known and an unknown model “may only lie in visually imperceptible traces.” The field has pivoted from closed-set classification to few-shot identification of unseen generators precisely because the closed-set version does not survive contact with new models. So the honest answer to “can a tool tell me which model made this random internet image” is: in a clean benchmark, almost perfectly; on something you actually pulled off a feed, not reliably.
The reliable fingerprint is the one put there on purpose
The way out of brittleness is to stop relying on accidents. Google’s SynthID embeds an invisible watermark “designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression,” and has already marked “over ten billion images and video frames” across Google’s services; C2PA Content Credentials sign provenance cryptographically into the file. When they are present, they answer “which tool” far more reliably than any spectral analysis.
But intentional does not mean bulletproof. DeepMind says outright that SynthID “isn’t a silver bullet,” and that its text-watermark confidence “can be greatly reduced when an AI-generated text is thoroughly rewritten or translated.” And as we found auditing hundreds of posts, C2PA credentials reach the viewer only about thirty percent of the time — the metadata is stripped in transit. An embedded fingerprint tells you which model made an image, and often that it is AI at all — right up until someone screenshots it.
You usually don’t need forensics — you need the model’s rap sheet
Here is the part the attribution literature skips: in a real creative pipeline you already know which model made the image, because you ran it. The useful question is not “who made this?” but “given that this came out of Midjourney, or DALL·E, or FLUX, what does that model get wrong?” — because models fail by category, not uniformly. GenEval shows the split cleanly: models are near-perfect on single objects (0.97–0.98) and then collapse on position, with IF-XL scoring 0.13 and SD-XL 0.15. A 2026 spatial benchmark finds the weakness is model-specific — Stable Diffusion 1.5 scores 15.6 on orientation but 38.2 on layout — and a world-knowledge benchmark finds each model’s worst subject differs, with one small model bottoming out at 0.14 on chemistry, the hardest domain even for the strongest model at 0.58.
Text rendering is the same story: a specialized-content benchmark scores Ideogram, DALL·E 3 and Stable Diffusion differently on readable in-image text and finds “none of the models achieved satisfactory results” on specialized layouts, while IMAGINE-E notes models “specialize,” with FLUX.1 and Ideogram 2.0 strong on structured, domain-specific tasks. So the source model is a checklist: an SD packshot earns a hard look at position and spatial layout, any model running dense copy earns a text pass, and a photoreal human scene earns an anatomy check. That is how per-model checks are built. The fingerprint that matters for QA is not the one you extract from the pixels after the fact — it is the failure profile you already have the moment you know the model’s name, and one scan turns it into findings.
What to do about it
- Attribution to an exact source model is close to solved on clean images (92–99.9% in current research) — it is genuinely readable from spectral and denoiser fingerprints.
- It is not solved in the wild: mirroring, blur and social-media re-encoding drop attribution below 75%, viral-image detection to ~63%, and unseen-model attribution to ~62%.
- Treat SynthID and C2PA as the reliable signal when present, but not a guarantee — DeepMind calls SynthID “not a silver bullet,” and provenance metadata reaches the viewer only ~30% of the time.
- For QA you rarely need forensics: you know which model you ran. Use that to check what that model specifically fails at — models are weak by category (position, text, a particular knowledge domain), not uniformly.
- Build the check around the source: one scan applies the failure profile for the model you used — text, anatomy, physics, artifacts — instead of trusting a clean-eyed skim.
Sources
- Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints — Yu, Davis, Fritz — ICCV 2019 (arXiv)
- Reverse Engineering of Generative Models: Inferring Model Hyperparameters from Generated Images — Asnani et al. — IEEE TPAMI 2023 (arXiv)
- Intriguing Properties of Synthetic Images: From GANs to Diffusion Models — Corvi et al. — CVPR Workshops 2023 (arXiv)
- Watch your Up-Convolution: CNNs Fail to Reproduce Spectral Distributions — Durall et al. — CVPR 2020 (arXiv)
- Leveraging Frequency Analysis for Deep Fake Image Recognition — Frank et al. — ICML 2020 (arXiv)
- PRISM: Phase-enhanced Radial-based Image Signature Mapping for fingerprinting AI-generated images — arXiv
- Diffusion Model Attribution via Spectral Coupling of Denoiser Responses — arXiv
- Who Made This? Fake Detection and Source Attribution with Diffusion Features (FRIDA) — arXiv
- Identifying Models Behind Text-to-Image Leaderboards — arXiv
- WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models — arXiv — CVPR 2024
- On Attribution of Deepfakes — arXiv
- Towards the Detection of Diffusion Model Deepfakes — Ricker, Damm et al. — SCITEPRESS 2024 (arXiv)
- Quality-Aware Calibration for AI-Generated Image Detection in the Wild — Guillaro et al. (arXiv)
- Attribution as Retrieval: Model-Agnostic AI-Generated Image Attribution — arXiv
- Progressive Open Space Expansion for Open-Set Model Attribution — arXiv — CVPR 2023
- Few-Shot Synthetic Image Attribution: Identifying Unseen Generators with Limited Samples — arXiv
- SynthID — Google DeepMind — Google DeepMind
- SynthID-Image: Image watermarking at internet scale — Google DeepMind (arXiv)
- Watermarking AI-generated text and video with SynthID — Google DeepMind
- Everything in Its Place: Benchmarking Spatial Intelligence of Text-to-Image Models — arXiv (ICLR 2026)
- Challenges in Generating Accurate Text in Images: A Benchmark on Specialized Content — MDPI (Applied Sciences)
- IMAGINE-E: Image Generation Intelligence Evaluation of State-of-the-art Text-to-Image Models — arXiv
- WISE: A World Knowledge-Informed Semantic Evaluation for Text-to-Image Generation — arXiv
- GenEval: An object-focused framework for evaluating text-to-image alignment — GitHub (djghosh13/geneval)