Choose the attribution level before interpreting the evidence
“Which model produced this?” can ask several different questions. It may concern an acquired model file, a recorded deployment version, a hosted endpoint, a model family, or a behavioral similarity. State which level is being assessed before describing confidence.
A service can route requests or combine components. A version label can be recorded accurately while the underlying historical routing remains unavailable. Reporting the label is useful; converting it into a verified file identity without further evidence is not.
Different evidence supports different associations
| Evidence or distinction | What it supports | Limit or next question |
|---|---|---|
| Acquired weights and a known reference | A documented byte comparison. | Does not establish training history or use in a particular run. |
| Deployment or request record | A recorded endpoint, configuration, or version association. | Depends on record scope and historical alias resolution. |
| Behavioral comparison | Similarity under documented test conditions. | Requires validation and alternatives, including unknown sources. |
| Generated self-description | What the output says about its source. | Does not independently identify the model. |
The endpoint is known, but its routed version is not
Hypothetical example: an acquired request record identifies a service endpoint. The response calls itself Model B. The provider’s current documentation describes that endpoint differently from the investigation period.
The supported result is the recorded endpoint association. Historical configuration records could resolve the underlying version; current documentation and generated self-description cannot supply the missing history by themselves. Preserve the interval and the unresolved association.
A candidate set can manufacture apparent certainty
A classifier that must choose among three known models will still return a winner when the true source is a fourth model. The relevant question is whether the evaluation allows an unknown source and tests that condition. Record the candidate set, rejection behavior, and conditions under which performance was measured.
Open-world recognition research addresses recognition when unseen categories are possible. It supplies methodological background for rejecting unknown sources here; it does not validate a forensic generative-model attribution tool. Towards Open World Recognition (Bendale & Boult).
A confidence score needs its own interpretation. Ask whether calibration was evaluated on a relevant population and whether the investigated input differs from that population. Guo and colleagues study confidence calibration in classification models. Their study does not validate the score of a particular AI detector. On Calibration of Modern Neural Networks (Guo et al., 2017).
WILDS examines evaluation under distribution shifts in its specified datasets. It illustrates why the evaluation population matters; it does not establish reliability for AI artifact attribution. NIST’s AI RMF provides broader evaluation context, rather than certification of an attribution classifier. AI Risk Management Framework; WILDS: A Benchmark of in-the-Wild Distribution Shifts (Koh et al., 2021).
Look for observations that weaken the preferred account
A mismatched configuration interval, incompatible artifact digest, or unsupported alias can weaken a named-version hypothesis. Different prompt context or output transformations can weaken a behavioral comparison. Document those observations alongside supporting evidence.
When comparing bytes, the reference’s origin matters. FIPS 180-4 specifies hash algorithms; a matching digest means a comparison under that algorithm, not proof of ownership, training data, or safe behavior. FIPS 180-4: Secure Hash Standard.
How should the result be stated?
Name the level, source records, evaluation conditions, and alternatives. “Associated with the recorded endpoint” and “behaviorally similar to the tested family” are different findings and should remain different in the conclusion.
The evidence does not automatically identify a human author or prove that one model alone caused an output. A defensible result may narrow the possibilities while leaving the exact historical version unresolved.
How the sources support this guide
Source comparison: 2026-10-14. Technical concepts, supporting context, and editorial reasoning are distinguished below.
| Concept | Support | References and limits |
|---|---|---|
| Parameters and configuration | Direct concept | PyTorch — Saving and Loading Models; Transformers — Configuration Framework documentation supports what parameter/checkpoint/configuration artifacts represent. It does not resolve historical endpoint routing. |
| Unknown candidates | Supporting context | Towards Open World Recognition (Bendale & Boult) Open-world recognition supports considering unseen categories; application to generative-model source attribution needs its own validation. |
| Calibration and distribution change | Direct concept | On Calibration of Modern Neural Networks (Guo et al., 2017); WILDS: A Benchmark of in-the-Wild Distribution Shifts (Koh et al., 2021) These papers support scoped evaluation concepts, not the accuracy of a forensic classifier on an acquired object. |
| Attribution levels | Editorial interpretation | NIST SP 800-86 — full publication; PROV-DM: The PROV Data Model File, endpoint, family, and human attribution remain distinct analytical propositions. |
Citation and editorial context
This is an editorial reference. Source checks are separate from independent expert review; no independent reviewer is recorded.
Examples are hypothetical. See the editorial policy, methodology, and correction process.
Shelley, Jesse (ed.). “Model attribution: what evidence identifies a model?.” Synthetic Forensics, 1.1.0-citation-review-1, 2026-10-14. https://syntheticforensics.org/glossary/terms/model-attribution/ Accessed: add the date you consulted this page.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- PyTorch — Saving and Loading Models
State dictionaries, parameter tensors, checkpoints, and inference loading. Not evidence of a particular deployment’s training history or identity.
- Transformers — Configuration
Model configuration objects and configuration serialization. A label or configuration file does not prove historical endpoint routing.
- Towards Open World Recognition (Bendale & Boult)
Recognition and evaluation with unseen categories. Background for unknown-source rejection, not a validated method for identifying generative models from their outputs.
- On Calibration of Modern Neural Networks (Guo et al., 2017)
Confidence calibration evaluated on image and document classification models. Methodological background, not validation of a particular forensic detector or attribution result.
- WILDS: A Benchmark of in-the-Wild Distribution Shifts (Koh et al., 2021)
Benchmark design and performance under specified real-world distribution shifts. The datasets do not establish performance for AI artifact attribution.
- NIST SP 800-86 — full publication
Sections 3–8 and Appendix B cover collection, handling, files, operating systems, applications, and correlation. Published August 2006; AI-specific terminology is not defined here.
- PROV-DM: The PROV Data Model
A model for entities, activities, agents, and derivation relationships; a W3C Recommendation from 2013.
- FIPS 180-4: Secure Hash Standard
Cryptographic digest algorithms, including SHA-256. The official page records a planned revision; a digest alone does not authenticate an origin.
- AI Risk Management Framework
Voluntary AI risk management guidance. The official page says AI RMF 1.0 is being revised; it does not certify a forensic finding.
Canonical reference: https://syntheticforensics.org/glossary/terms/model-attribution/
Report a technical correction