Attribution Decay

On the difference between what a model read and what would have changed if it hadn't.

Zheng Dai and David Gifford published a paper in Nature Communications this week arguing that the outputs of generative diffusion models are often unattributable. They call the central phenomenon attribution decay: the more data a model is trained on, the less any individual training example matters to any particular output. Past a certain scale you can remove a single image, or every work by one artist, or every photograph of one person, and the generated sample does not change.

Then comes the sentence the coverage was built on:

And if removing something changes nothing, the researchers argue, it can't be said to be responsible for anything.

That is not a measurement. It is a causal inference laid on top of one, and it is the only part of the work I want to argue with.

Credit where it is due

The measurement is good, and I want to be specific about why before I take issue with what was concluded from it.

The honest way to ask what would this model have produced if it had never seen this image is to retrain from scratch without it, which is computationally absurd at any interesting scale. Dai and Gifford's answer is Ablation Based Counterfactuals: train independent model components on different but overlapping splits of the training set, combine them into a single model, and remove a training sample's causal influence by ablating the components that saw it. No retraining. They ran this across 24 ensembles on seven public datasets — CIFAR-10, CelebA, MetFaces, ArtBench — from 256 images to over 160,000, and validated the approximation against 1,282 brute-force retrained models at small scale.

I also think I've seen it before, from the other side. In chapter 2 of my CLR log, written before I had heard of this paper, the durability argument for a physics-grounded detector rests on exactly this observation: more data and parameters make the generative manifold smoother, not more physical. Smoothing is intrinsic to optimization toward a target. As the corpus grows, the learned score function gets more regular, and local sensitivity to any one datum falls off. Attribution decay is that regularity, viewed through a removal probe.

Which is the disagreement in one sentence. They found a property of the estimator. They reported a property of the provenance.

"If removing it changes nothing, it isn't responsible for anything" is but-for causation, and but-for causation has a famous failure mode: overdetermination.

Ten marksmen fire at once. Remove any one and the victim still dies, so no bullet is a but-for cause, so — on this reasoning — nobody shot anyone. Two fires converge on a house that either would have burned alone. Neither is necessary; the house is still ash. This is not an edge case anyone discovered recently.

Robustness under ablation is a fingerprint, not an alibi

Here is the inversion I actually came to write.

The reconstruction hypothesis that CLR is built on says: if something can be destroyed and never perfectly brought back, that suggests it was real. If something can be destroyed and then reconstructed, that suggests it was generated. Fragility equals realness. Recoverability equals simulation.

A real photograph is the output of an irreversible physical chain — optics, sensor, noise bound to a specific piece of silicon at a specific moment. Damage it and the damage stays. A generated image is the output of a many-to-one denoising trajectory over a smooth learned manifold. Damage it and the manifold heals it.

Dai and Gifford removed pieces of a generative system, observed that the output healed, and concluded there was no author. I ran the structurally identical probe, observed the identical healing, and concluded that the healing itself is the signature of the generative process. Same absence. Opposite verdicts.

I don't think both readings can be right and I may be wrong. But, I'd like to let this claim sit as I gather more evidence to refute the overall thought that "it can't be said to be responsible for anything."

You're not detecting AI. You're detecting the absence of a history. Authenticity isn't a quality you can synthesize — it's a residue of having been caused.

The part that is a design choice

Attribution decay is a property of one architecture. It is not a property of image generation.

The claim that you cannot trace an output to a training image assumes training dissolved the image — that N pictures went into one shared weight tensor by gradient descent and came out an inseparable smear. Under that assumption the paper is right and the inverse problem really is ill-posed.

So don't build it that way.

The generative half of what I'm working on in Obscur is a system I call a signet: a personal image model distilled from someone's own signed captures. The base model is frozen and stays frozen. Each source image is ingested without gradients, and contributes its own addressable rows to an attention bank, keyed by a content hash of its bytes — identity is cryptographic rather than statistical, so there is no matching problem to decay. Adding an image inserts rows. Removing one drops exactly those rows and nothing else. There is no retraining, and no residue.

And that surfaces the distinction I think the paper's framing collapses. The system records two independent quantities per region: how much the model read there, and how much that region actually changed relative to the same-seed base trajectory.

The paper measured changed and concluded read was zero.

I'll hold myself to the same standard I'm applying. That attribution view is labeled, on screen, as a record of what the model read — not a proof of perceptual influence, and I mean it. Reading is not influence. But it is a fact about the forward process, recorded at the moment it happened, and no amount of scale erodes it — because nothing is being inferred backwards through a smear.

The honest limits: signets attribute a personal corpus injected at inference, not a foundation model's pretraining set — that distinction is the fair reading of the paper's claim and I won't pretend otherwise. There's no payment rail on the visual side yet, only the record. And CLR has never attributed anything to training data; it gave me the methodology and the receipt, not a refutation of anyone's scaling law.

But the conclusion I draw from that limit is the opposite of the one on offer. If attribution survives when licensed work enters at inference and dies when it enters by gradient descent, that is an argument about where in the pipeline you let other people's work in — not proof that responsibility evaporates once you've taken enough of it.

Carry it, don't recover it

The paper proves an inverse problem is ill-posed. The correct response to an ill-posed inverse problem is to instrument the forward process, not to conclude the forward process never happened.

That's the whole reason CLR turned toward provenance.

Which is what I'd say to the strongest version of the argument. "Unattributable" is not a discovered fact about a generated image. It is a description of a pipeline that declined to keep a receipt, reported as though it were a property of the universe.

Nobody proved the data didn't matter. They proved that if you build a system carefully enough to never find out, you won't.