---
title: "City University of Macau's Causal Fingerprints Spot AI Image Origins at 98% Accuracy"
subtitle: "A new framework treats generative model attribution as a causal inference problem, hitting 98% accuracy across GANs and diffusion models."
url: "https://alphasignal.ai/news/city-university-of-macau-s-causal-fingerprints-spot-ai-image-origins-at-98"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-04-14T00:00:00.000Z"
updated: "2026-08-24T00:36:52.598Z"
type: "Paper"
topics:
  - "Image"
  - "Security"
subtopics:
  - "Image Generation"
  - "Red Teaming"
upvotes: 1479
source_url: "https://arxiv.org/abs/2509.15406"
comments: 0
truncated: true
---

# City University of Macau's Causal Fingerprints Spot AI Image Origins at 98% Accuracy

> A new framework treats generative model attribution as a causal inference problem, hitting 98% accuracy across GANs and diffusion models.

Every image produced by a GAN or diffusion model carries subtle traces of the network that made it. Researchers have exploited these traces for years to answer a forensic question: which model produced this picture? A new paper argues that almost every prior attempt has been looking at the wrong signal, and proposes a causally grounded alternative that pushes attribution accuracy from the mid 80s into the high 90s.

The work, titled [Causal Fingerprints of AI Generative Models](https://arxiv.org/abs/2509.15406), comes from a team at City University of Macau and Qilu University of Technology. Their pitch is straightforward: generative models leave implicit traces in their outputs, commonly called model fingerprints, but prior attribution methods rely on model-specific cues or synthesis artifacts that generalize poorly across different generator families.

## Why old fingerprints break

Model attribution has three main camps: forgery detection, watermarking, and fingerprinting. Watermarking requires modifying the generator up front. Forgery detection is a coarse real-vs-fake binary. Fingerprinting is the appealing middle ground because it works passively on any image, but existing detectors have a nasty flaw: they latch onto features that only some model families exhibit. Checkerboard artifacts, for example, show up in certain GANs and have been used as GAN fingerprints, yet diffusion models simply do not produce them, so the detector collapses when the domain shifts.

The authors argue this is a symptom of a deeper problem. A generated image mixes together three things: content (what the picture shows), style (how it looks), and artifacts (traces of the generator itself). A useful fingerprint should depend only on the artifacts, ignoring semantics. Prior feature-extraction methods conflate all three, which is why they overfit to one model family.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [Causal Fingerprints of AI Generative Models](https://arxiv.org/abs/2509.15406)
- [DIRE for Diffusion-Generated Image Detection](https://arxiv.org/abs/2303.09295)
- [Riemannian-Geometric Fingerprints of Generative Models](https://arxiv.org/abs/2506.22802)
- [Towards Deep Learning Models Resistant to Adversarial Attacks (PGD)](https://arxiv.org/abs/1706.06083)