Data Provenance for Image Auto-Regressive Generation
Authors: Bihe Zhao
Louis Kerner
Michel Meintz
Tameem Bakr
Franziska Boenisch
Adam Dziedzic
Venue: ICLR 2026 Poster (2026)
Keywords: data provenance
image autoregressive models
Primary area: foundation or frontier models, including LLMs
TL;DR: We introduce a framework for robust data provenance tracing of images generated by autoregressive models, requiring no modifications to the generation process or model outputs.

Abstract: Image autoregressive models (IARs) have recently demonstrated remarkable capabilities in visual content generation, achieving photorealistic quality and rapid synthesis through the next-token prediction paradigm adapted from large language models. As these models become widely accessible, robust data provenance is required to reliably trace IAR-generated images to the source model that synthesized them. This is critical to prevent the spread of misinformation, detect fraud, and attribute harmful content. We find that although IAR-generated images often appear visually identical to real images, their generation process introduces characteristic patterns in their outputs, which serves as a reliable provenance signal for the generated images. Leveraging this, we present a post-hoc framework that enables the robust detection of such patterns for provenance tracing. Notably, our framework does not require modifications of the generative process or outputs. Thereby, it is applicable in contexts where prior watermarking methods cannot be used, such as for generated content that is already published without additional marks and for models that do not integrate watermarking.  We demonstrate the effectiveness of our approach across a wide range of IARs, highlighting its high potential for robust data provenance tracing in autoregressive image generation.

Published as a conference paper at ICLR 2026
DATA PROVENANCE FOR IMAGE AUTO-REGRESSIVE GENERATION
Bihe Zhao, Louis Kerner, Michel Meintz, Tameem Bakr, Franziska Boenisch, Adam Dziedzic* CISPA Helmholtz Center for Information Security
ABSTRACT
Image autoregressive models (IARs) have recently demonstrated remarkable ca- pabilities in visual content generation, achieving photorcalistic quality and rapid synthesis through the next-token prediction paradigm adapted from large language models. As these models become widely accessible, robust data provenance is re- quired to reliably trace IAR-generated images to the source model that synthesized them. This is critical to prevent the spread of misinformation, detect fraud, and at- tribute harmful content. We find that although [AR-generated images often appear visually identical to real images, their generation process introduces characteristic patterns in their outputs, which serves as a reliable provenance signal for the gen- erated images. Leveraging this, we present post-hoc framework that enables the robust detection of such patterns for provenance tracing. Notably, our framework does not require modifications of the generative process or outputs. Thereby, it is applicable in contexts where prior watermarking methods cannot be used, such for generated content that is already published without additional marks and for models that do not integrate watermarking. We demonstrate the effectiveness of our approach across wide range of IARs, highlighting its high potential for robust data provenance tracing in autoregressive image generation.
INTRODUCTION
Recent progress in image autoregressive models (IARs) has led to significant advancements in image generation. Driven by advances in language modeling, these models produce high-quality images rapid pace using the next-token prediction paradigm (Tian al. 2024 Han et al. (025). As IAR-generated images become visually indistinguishable from natural content, several challenges, including the spread of misinformation, fraud, and harmful content dissemination, arise. Addition- ally, as generated data "pollutes" the data ecosystem, it is increasingly used to train new generative models, which degrade model performance (called model collapse (Alemohammad et al.) [0224] Shu- mailov et al., 2024)) and amplify existing biases (Wyllic et al. (024).. Therefore, data provenance, Le., identifying and attributing generated images to their generators, highly important.
Several provenance methods have been developed for generative vision models, including both wa-
termarking (Fernandez et al. [2023] Liu al.) [003 Wen et al.] 2023] Zhao et al.] (0233 Gunn
et al. 2024, Kerner et al.) 2025 Jovanović et al. 2024 Tong et al. 2025 Wang et al. (2025b) and
fingerprinting (Kim et al. 2024 Yu et al. 2021 Nie et al., 2023). Yet, these methods require the
integration of additional signals into the models or into the images either during after generation.
This introduces perceptible or statistical changes, is not applicable to trace provenance for content that has already been published without marks, and often results in tradc-off between robustness, imperceptibility. and applicability.
In this work, propose the first post-hoc provenance framework for --R-generated images that does not require any modification of the generation process, is model-agnostic, and applicable to previously published, and unmarked content. Our proposed framework builds observation that because IARs encode images sequences of discrete tokens from a fixed codebook, i.e., their "vocabulary".. they introduce quantization step that leaves model-specific artifacts in the generated images as shown in Figure [
intriguing
Specifically, token representations of generated images
"Correspondence wdwm.dziadieeie dwwpddddiiiiisssddd...

---

Published as a conference paper at ICLR 2026
consistently closer to the codebook entries than those of natural images. We refer this as QuantLoss and show that it can be used to trace IAR- IAR-generater images back to their generators.
We further enhance the reliability of our framework by amplifying existing signals and integrating ad- ditional, carefully designed ones. First, we train a model to approximate the inverse of the IAR's de- coder and it to encode images whose prove- nance we want to test. Since the inverted decoder leads a higher fidelity mapping from images to the tokens that the image was potentially generated from, it strengthens our provenance signals based on QuantL Additionally, we introduce novel token-search algorithm for the next-scale prediction paradigm, enabling more accurate tracking of gen- crated images' initial tokens and enabling a more meaningful comparison to the codebook tokens. Be- yond QuantLoss, we also identify a complementary signal, EncLoss, which captures the deviation ob- served when encoding an image to the latent space with the inverse decoder and then decoding back to the image space with the original decoder. This process yields low loss for generated images due to feature consistency, but typically greater loss for natural images. All these signals can eventually be combined to robustly trace the provenance of IAR- -aggeeeedd images.
Tokens
Encode 5
F.
A
Codchook
Generated
Natural
Decode
Figure 1: Data Provenance: Token Space. Since the generated tokens of given IAR are sampled from the codebook entries, the codebook acts as key to distinguish the token representations of generated images from those of real images.
We evaluate our method on state-of-the-art IARs, including VAR (Tian et al. (2224) RAR (Yu et al. 2024b), LlamaGen (Sun et al.] 2024). Taming (Esser et al.) 2021), and Infinity (Han et al. 2025). as well as pector-uantized diffusion model (VQ-Diffusion) (Gu et al. 2022). We are able to detect the images generated from these models with almost 100% success rate, which contributes to reliable provenance tracing of generated content in IARs. We note that the post-hoc finetuning of the encoder has relatively small overhead compared to IAR training, especially for the newly developed IARs with increasing model scale and training data. We also analyze the robustness of our method to conventional image post-processing techniques and show that our method can still detect most of the generated content, significantly outperforming the existing methods.
In summary, we make the following contributions:
1. We introduce the first post-hoc data provenance method for IARs that leverages generation- specific artifacts reliably determine whether, and by which model, an image was generated. Our framework does not require any modifications to the model's training or generation process, is agnesiag, and applicable to already published generated content.
2. We show that combining carefully designed provenance signals derived from the generation- specific artifacts enables near-perfect detection of generated images and accurate attribution to their source model, consistently achieving nearly 100% TPR @ 1%FPR across a diverse set of IARs and outperforming all baselines.
3. We provide a thorough empirical evaluation of our framework on diverse models and with di- verse datasets, assessing its robustness image perturbations. Our results highlight that our framework can provide effective provenance tracing under real-world scenarios with non non-perfect data, highlighting its practical applicability.
BACKGROUND AND RELATED WORK
Image Autoregressive Models (TARs). IARs have recently gained traction as a new architecture for image generation, following the success of generative adversarial networks (Karras et al.) 20200) Choi et al. 2020 Karras et al. 202I) and diffusion models (Rombach et al.) 2022, Saharia et al. 2022 Podell et al. 2023). IARs inherit the next-token prediction paradigm from large language models (LLMs) by treating images (or their patches) as sequences of discrete tokens which enables them to generate images both quickly and with high quality. Building the advances from LLMs also allows IARs to follow their clear plwer-law scaling (Tian et al.) 2024). In the last years, the progress in autoregressive image generation has moved from early pixel-space raster- scan autore-
2

---

Published as a conference paper at ICLR 2026
gression (Chen et al.) 2020 Van den Oord al. 2016) to pioneering efforts with the next scale or resolution prediction (VAR) (Tian et al. 2024 Han et al. 2025). Recent proposals opt for next-token prediction of randomized inputs permuted into different factorization orders with annealing prob- ability (RAR) (Yu et al., 2024b), and to even vanilla autoregressive models that apply the exactly same next-token prediction as LLMS and feature an image tokenizer with high-quality reconstruction and high-utilization of the codebook (LlamaGen) (Sun et al.)
2024). along with many other recent
contributions advancing the state-of-the-art in autoregressive image generation (Ren al., 2025 Li
et al. 2024, Team 2024, Yu et al.
2024a Shao et al. 2025
Deng et al.) 2025 Tang et al. 2025).
Most contemporary IARs (Sun et al. 2024 Tian et al., 2024
Yu fallj2222bb Han al. (025) are
composed of an autoencoder and an autoregressive model. The autoencoders, also known as image
tokenizers, function as a mapping between the pixel and the token space, which are usually built on
the VQGAN architecture introduced in Taming (Esser et al. 2021). In our work, we leverage the pixel-token mapping to reliably trace generated images.
Image Provenance. The goal of image provenance is to attribute the entity (e.g., model or con- tent creator) that generated a given image. Existing methods can be grouped into watermark-
(Krrner al. 2025 Jovanović al. 2025 Tong al. 2025), fingerprint-based (Kim et al., 2024
Yu et al. 2021 Nie et al. (023), and reconstruction- based approaches (Wang et al., 2023;
2024
2025a). Watermark-based and fingerprint-based methods embed model-specific information
into the generation process or training pipeline to enable source identification (Zhao et al.] 2025
Mahara & Rishe 2025). Since these approaches require interventions either in the training or infer- ence stage, they degrade the quality of the generated image and cannot be performed retroactively after the models or their non-marked generations are released. On the contrary, reconstruction- based methods leverage the innate features of the generative models for image attribution, which do not introduce any perturbations to the generated images. For example, RONAN (Wang et al. 2023) is proposed to attribute the image generated by variational autoencoders (VAE), GANs, and diffusion models by reverse-engineering the generative process back to its input space. RONAN is not directly applicable to IARs as it is only effective for deterministic generation, while IARs rely on a random sampling process during each of their next-token predictions. LatentTracer (Wang et al.) 2024 is proposed specifically for diffusion models to trace generated images by optimizing in the latent space of a decoder. Although Latent'Tracer can be applied to IARs, it demonstrates suboptimal performance and proves computationally expensive for many images. Recently, WWan al. (2025a) proposed to calibrate the reconstruction loss by double reconstruction to improve attribution perfor- mance for diffusion models. However, we show that this method has insufficient performance for IARs. In contrast, our method provides effective and reliable provenance of IAR- --geeeeead images.
Membership Inference Attack. While our work focuses on data provenance, it is important to distinguish it from membership inference attacks (MIAs), which address a fundamentally different attribution problem. MIA aims to determine whether a given data point was part of a model's 's train- ing set (Shokri et al.; 2017: Salem et al. 2019). MIAs are commonly used for auditing privacy leakage (Steinke et al. 2023 Rossi et al. 2026 Marek et al.] (026). In contrast, data provenance seeks to identify whether a given image was generated by model, which is critical for tracing syn- thetic content and preventing model collapse caused by training on generated data (Alemohammad et al. 2024 Shumailov et al. 2024). Importantly, existing MIA methods for IARs require access to class labels or text prompts in addition to images (Kowalczuk et al. 2025 Yu et al., 2025), which are generally unavailable for generated images found in the wild. Our post-hoe provenance framework operates solely on images themselves, making it applicable to real-world scenarios where auxiliary information absent and where content has already been published without metadata.
METHOD
We begin by outlining the necessary preliminaries and notation for vector-quantized representations. Next, we formalize the problem of provenance tracing in IARs. Finally, we introduce our data provenance framework, presenting both the QuantLoss-bar based and EncLoss- baseess-based signals that we develop for effective post-hoc provenance detection.
3.1 PRELIMINARIES ON VECTOR- -UANNTZZD REPRESENTATIONS
IARs tokenizers consist of three main components:
3

---

Published as a conference paper at ICLR 2026
1. Encoder E: A convolutional neural network (CNN)- feature extractor with down- -ampliggg ratio p that projects input pixels a E |#* X3 to a latent feature map f E x
xC where H x W are spatial dimensions and C denotes the channels. We denote the encoding as E f- 2. Quantizer Q: The main part of the quantizer is codebook Z E RNXC containing N learnable prototype vectors, each with the channel dimension C. The index of each prototype vector serves as discrete token for quantization. Every spatial feature f(i5) mapped to its nearest entry (n [N]) in codebook Z to obtain the integer indices ((.f) We denote the quantization as f 2 tz and the dequantization (mapping from the tokens tz to the quantized feature map fz)
tz Q fz. and define them follows:
Q : 2
arg min [[ 2n|12, Q- f(0)) Z1t2-00
(1)
DE[N]
3. Decoder D: A CNN symmetric to the encoder that decodes the quantized feature map fz to the image Tz- We denote the decoding fz - zz.
Together, the stages in the above framework can be expressed as:
x E 2 tz Q fz D xz.
(2)
The training of a IAR model is performed in stages: (1) the encoder and decoder pair, including the quantizer with its codebook, are pre-trained, followed by the (2) training of the autoregressive transformer (AR) predict the next tokens during generation. The encoder and quantizer are only used for mapping images from pixels to tokens during training, while the decoder is used for map- ping ARggenertted tokens to image pixels during both training and inference (generation).
3.2 PROBLEM FORMULATION
Given suspect image z and a IAR model M, our goal is to develop framework that attributes the image æ to the given IAR, or identifies I's provenance as not generated by M. x can be any image, including natural one access to its encoder E, decoder D, and quantizer Q, which represents a realistic setup as many of the state-of-the- of-the--rt art IARs are open-source. Most importantly, we only assume post-hoc provenance, ie., M and x are already given and is not possible to modify the training or generation process.
image generated by generative model. For M, assume white-bos box
3.3 A FRAMEWORK FOR DATA PROVENANCE IN IARS
We introduce two complementary signals specifically designed for IAR provenance detection: QuantLoss (Section 3.3.1) and EncLoss (Section 3.3.2). Finally, we describe how we combine these two into a joint provenance signal for our framework presented in Figure
3.3.1 QUANTLOSS: PROVENANCE SIGNAL BASED ON CODEBOOK DISTANCE
We design our QuantLoss provenance signals based on our observation that the token representations differ significantly between natural and IAR-generated images. Intuitively, the representations of generated images are consistently closer to the codebook entries than those of natural images (see Figure [ We first formalize this observation, then describe how we leverage it as a provenance feature, and finally introduce the feature's 's two core building blocks, namely the decoder inversion and the quantization.
Formalizing our Observation on Proximity Codebook Tokens. The generation of an image xz by IAR with codebook Z is formalized in Equation (3) The generated image zz is initially sampled as discrete tokens tz from the token sample space T' by the IAR. This sample space for generated image consists of the possible combinations of tokens from the codebook Z. In contrast, natural images are drawn from natural world) data distributions, and therefore have a much larger and more diverse space. In addition, different IARs have distinct codebooks corresponding to distinct sample spaces. Thus, the codebooks of different LARs naturally serve as a provenance signal for the synthetic images. In essence, IAR-generated images leave "fingerprint" in token
4

---

Published as a conference paper at ICLR 2026
Generation
Dequantizaionn (j*1
Fenture Map
Decoder D
Ganeriaal Image Xz
Decoder Inversion
Reconstmeted Feature Map (P(U)
Tokess
Codebook 2
Invene Decoder D
Auroragraaive Model
D
Denisder Invervion ano
Provenance
quaniizdd Fiseione Map (-t(et)
Resancsded Imuge ((0)(()))
Imagee
Inverse Decoder D-1
Map
Quanciatioon
Decoder
Coldaan 2
Quantien
Overview of our data provenance framework for LARs. (1) During Generation, the tokens are generated by the autoregressive model, dequantized generated image. (2) Our Decoder Inversion aims at creating an inverse decoder that recovers the generated feature map from the generated image. (3) We propose two signals for our Data Prove- nance: QuantLoss between the feature map recovered by the inverse decoder and its re-quantized version, and EncLoss between the image and reencoded version.
Figure 2:
feature map, and decoded
space because they were originally constructed from specific codebook entries. This observation leads to our key insight: generated images, when inverted back through the decoder and correctly quantized, will have feature representations that align closely with codebook entries, while natural images or images generated by other IARs will exhibit larger quantization errors.
AR ~ Tz
91, fz
Generation:
tz
IZ
Q fz x IZ
Inversion:
tz -
Designing Provenance Signal Based our Observation. From this insight, design signal to detect if an image was sampled from a codebook Z. We transform a given image & to its contin- uous feature map f and then to its codebook-bar based quantized feature map fz. The process be expressed as follows:
T D
2
Specifically, we first transform the image æ to the latent space with an inverted decoder D-1, If was generated by the target IAR from Tz, then with ideal inverse decoder D- the recovered feature map f should already be quantized (i.e., each feature vector should exactly match a codebook
entry). Therefore, the quantization step f 2 - fz would introduce minimal error, making R fzz Conversely, if æ is a natural image or from a different IAR, f will not align with codebook entries, resulting in significant quantization error and * fz. We compute the QuantLoss Lquant between the feature map f and its quantized version f2 as follows:
Quuam (x) [lf fzll2
1lf -1
(5)
Decoder Inversion: Obtaining D-1 We aim inverting an image the quantized feature map Iz. Intuitively, if x was generated by the given IAR, the feature map fz is close to the codebook entries of This requires first inverting the decoder original encoder E. However, for most IARs (what we show in Table (4). We attribute this behavior to the fact that natural images. To obtain closer approximation of the inversion D-1 of the decoder, instead train an inversion model. Concretely, we initialize this model's weights with the original encoder weights and finetune this inverse decoder on images generated by the given IAR (see Equation )2). During finetuning, the codebook Z and the decoder D are frozen, and we use the following loss to optimize D-1:
naive solution would be to apply the IARs observe that E' is not close inversion of D for generated images
trained on
Lim
|īz D (D(((((2))
5

---

Published as a conference paper at ICLR 2026
Notably, this step is performed post-hoc after release of the IAR and the data point It does not interfere with the models training or the generation of data points. Given that the finetuning exclusively relies images produced by the target IAR, it does not require the costly curation of additional training data. Finally, we can improve robustness to data augmentations by applying them to the finetuning data and training D-1 1 to generate consistent quantized feature maps for both the original and augmented images, As shown in Section 4.3) this approach makes our framework less sensitive common data perturbations and significantly enhances our method's reliability.
Quantization Q. While inverting the decoder traces the image to the latent space, we need to further invert the feature map to the token space, as the token space where generated images are initially sampled from. To this end, we perform quantization for both single-scale and multi-scale LARs to invert a feature map fz to tokens 1z-
Single-scale IARS, such as RAR (Yu et al. 2024b). which generate an image through next-token prediction, tokenize images as a single feature map, where each feature corresponds only one token and one entry in the codebook. During generation, each token is mapped to one of the spatial features in the feature map by querying the codebook (ʃx = QQ= = Z(zz). D. This process can simply be inverted by the corresponding quantization Q. defined in Equation (
Multi-scale IARs, such as VAR (Tia et al. 2024), redefine the autoregressive image generation as next-scale prediction. They generate an image starting from tokens responsible for low-level features in an image, and then generate the tokens for high-level details based on tokens in the previous scales. After generating tokens in all scales, the tokens are mapped to codebook entries, upsampled, and summed up to obtain the feature map. This process can be formalized as:
( (tz 1
Cadebook 2, (f/ [k=1
Upsample and Sum
(7)
where K is the number of scales. When quantizing the feature map to scalewise tokens, multi-scale IARs apply a scalewise greedy search: for each scale, the nearest codebook entry of a given feature selected as the token. The detailed algorithm for the original quantization of VAR is presented in Algorithm 2 However, as tokens from all scales contribute to each spatial feature, inverting the feature map to the tokens with this greedy search quantization cannot invert the feature map to the original tokens.
We define the problem of searching for the token sequence in multi-scale IAR as an optimization problem. Given a target feature map f E R xxxxx we seek the optimal multi-scale token combination H= that minimizes the reconstruction error:
[
min [b
(8)
where f((t=) denotes the reconstructed feature map obtained by dequantizing and aggregating tokens across all scales as defined in Equation 7 To solve this problem, we propose an optimized quantization algorithm to search for token combination across all scales that can best represent given feature map. For each element in the token map, we initialize N logits corresponding to N entries in the codebook. An estimated feature map is then calculated according the logits. Then we employ the gradient descent algorithm to minimize the distance between the estimated and target feature map. The intuition to detect images generated by VAR is the following: for a feature map generated by VAR, our algorithm enables the originally generated tokens to gradually have higher logit values with more iterations, and finally reduces the Quantl Loss significantly. Any feature map not generated by VAR cannot be casily represented by tokens from the codebook. the QuantLoss remains high even after optimization. We present the detailed algorithm in Appendix A
Overall, once D-1 and optimized Q are obtained, the resulting QuantLoss serves a powerful distinguishing signal: images generated by a IAR M consistently exhibit significantly lower loss than those not originating from the model, enabling highly reliable provenance attribution.
3.3.2 ENCLOSS: PROVENANCE SIGNAL BASED ON DECODER INVERSION LOss
As a second complementary provenance signal, we propose feature we call EncLoss, which can be combined with the Quantl Loss to provide more reliable data provenance. This feature is based
on our observation that the decoding during generation (fz D xz) maps fz which lies in low-

---

Published as a conference paper at ICLR 2026
dimensional latent space to z2 which lies in a nigh-dimensional pixel space. Therefore, if we com- press a generated image zz back to fz with an ideal inverse decoder D-1 there is no information loss in this process. In contrast, if natural image or image generated by another model is pro- jected from pixel space to latent space with D-1, there is a non-negligible loss due to information compression. Using this observation, apply inverse decoding and decoding given image capture this signal, and quantify the EncLoss as Leve as
Lise
|ec (x) 11|2.
where (x) (z)- However, we note that this loss is not only related the data source, but also to the complexity of the image. Specifically, a natural image with low complexity contains low information density, and thus also has low EncLoss when encoded into the latent space. To address the potential false positive cases caused by the low-complexity images, we calculate a calibration factor for the EncLoss inspired by AEDR (Wang et al.) 2025a). Concretely, we invert the image twice, where the second EncLoss serves as an estimation of the inherent image complexity. The calibrated EncLoss can be formalized as follows:
||ee (x) 11|2
(10)
Rec (Rec (x)) Rec (x) 11
Our Final Combined Provenance Signals. Finally, we combine the QuantLoss Lquant and the calibrated EncLos CCal to obtain a stronger signal for provenance. Since L is a ratio of errors, we design the combined loss Lcomb as a product of Lquam and CCal.
CComb = LQuant X CCl
(11)
4 EMPIRICAL EVALUATION
4.1 EXPERIMENTAL. SETUP
Models. We evaluate our method on diverse set of state-of-the-art IAR models for image gen- eration. This includes next-token prediction models, such as LlamaGen (Sun et al. 2024) and Taming (Esser et al. 2021); random-order prediction model, RAR (Yu al. 2024b : and next- scale prediction models, such as VAR (Tian et al.) 2024) and Infinity (Han et al. 2025), ) the latter of which is bit-wise and supports high-resolution generation. To further demonstrate the general- ity of our approach beyond autoregressive models, we also report results on the vector-quantized diffusion model VQ-Diffusion (Tang et al. 2023).
Datasets. We construct several evaluation datasets, which consist of real or generated images. Real images are obtained from the validation sets of standard benchmarks (1,000 images each), namely ImageNet (Deng et al. 2009), LAION (Schuhmann et al., 2022). and MS-COCO (Lin et al. 2014). The generated images are obtained by generating 1,000 images using each of the previously men- tioned models. For finetuning, details on finetuning, please refer to Appendix
distinct dataset generated for each tested model. For more
Metrics. We report the positive at 1 1% false positive rate (TPR @ F%FPR our primary evaluation metric. We aim to minimize false accusations, avoiding wrongly attributing images to a model that did not generate them, while still measuring detection performance effectively.
Baselines. We compare against several baselines: a naïve reconstruction-los. baseline where images with lower autoencoder reconstruction losses are detected as belonging images, Latent- Tracer (Wang et al. 2024), and AEDR (Wang et al. 2025a). For more details on our baselines setup, please refer to Appendix D
4.2 EFFECTIVENESS OF OUR DATA PROVENANCE FOR IARS
Tad the extended versions Table A4 and Table summarize the effectiveness of our method over all models and datasets. For given target model denoted in the first column, each column the table represents different task, where 1,000 images generated by the target model (belonging set) are distinguished from 1,000 images from a single non- non-belonging source. Evaluated non- belonging sources cover both three natural image datasets and five image datasets generated by other models.
7

---

Published as a conference paper at ICLR 2026
Table I: T FPR (%) of our method and the baselines. The first column indicates the original model that has generated the belonging images, the heading of the other columns specifies the natural datasets generators from which the non-belonging images are obtained. Our method is instantiated with the best-performing set of signals from Section 3.3
for each original model.
Methed
Natural
Generated
ImageNet
LAION
MS-COC0
JamaCion
RAR
Taming
VAR
Intinity
VQiNi
Reconstruction
33.6
34,0
44.3
39.7
4.3
45.7
70.0
63.0
97.9
96.9
MammCGen
AEDR
50.9
55.3
50.5
59.5
57.7
67.0
20.7
68.1
Ouns
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
Reconstructoo
3.8
4.1
7.4
0.8
0.1
5.7
18.1
18.8
LateneTrazer
0.4
RAR
AEDR
29.5
16.6
36.6
10.6
2.3
35.9
49.9
27.6
Ours
100.0
100.0
100.0
99.9
99.9
100.0
100.0
100.0
Reconstruction
27.5
21.5
27.6
10.1
18.9
27.7
39.0
46.1
Taming
LitcntTracer
73.0
61.0
75.9
364
66.8
76.0
87.4
AEDR
80.4
82.5
$1.9
70.7
80.7
78.1
91.9
87.5
Duns
100.0
100.0
100.0
100.0
160.0
100.0
100.0
100.0
Reconstruction
1.4
3.6
0.1
1.6
0.0
5.9
5.9
VAR
LatenTrrece
1.3
12.0
02
0.1
AEDR
29.1
15.7
50.6
14.7
28.3
14.0
37,5
50.8
Durs
100.0
99.2
100.0
99.2
100.0
100.0
100.0
100.0
Reconstruction
0.2
0.8
0.0
0.0
0.0
0.2
Inlinity
AEDR
1.6
18.9
56.2
31.7
1.4
3.0
1.5
12.8
5.8
8.4
Ours
99.4
85.6
99.4
99.2
99.5
99.1
99.4
99.4
Reconstruction
17.2
8.8
24.3
6.3
21.8
1.6
21.2
43.0
VQDIT
Laken/Tracer
AEDR
89.7
97.7
51.4
93.8
90.0
98.1
79.8
97.3
93.6
97.9
93.6
27.2
98.5
87.5
98.6
83.6
Ours
100.0
99.4
100.0
99.9
100.0
99.9
100.0
100.0
Table Robustness against common image post-processing methods on RAR. Non-belonging images are from the ImageNet dataset, and we use QuantLoss to instantiate our method.
Method
Attacks
Noise (0.05)
Kernel (9)
JPEG (60)
Brightness (1.6)
Contrast (2.0)
Saturation (2.0)
Resize (0.5)
LateniTracer
3.0
Reconstruction
2.3
3.0
3.6
1.4
1.6
3.1
1.0
AEDR
7.3
11.4
8.9
1.9
1.4
9.5
0.2
Ours (wlo Aug)
60.4
74.9
91.7
67.9
45.7
97.4
88.5
Ours Aug)
87.8
80.5
92.3
91.1
99.2
98.4
We first observe that the naive reconstruction baseline is not effective in detecting which model given image was generated by. Although LatentTracer can obtain relatively good performance on LlamaGen and VQ Diffusion when compared with other baseline methods. it fails for RAR, VAR, and Infinity. While AEDR yields slightly better results than Laten(Tracer those models, its overall performance over the diverse set of models falls short. In contrast, our method yields perfect or near-perfect results, iee. around 100% TPR over all models and datasets, highlighting its strength for practical data provenance tracing.
Additionally, our method only requires one-time finetuning to obtain the inverse decoder, which can be used to evaluate provenance on an unlimited number of images. Notably, our Quantl operates the latent space the autoencoder and does not require decoding into the full image, which allows for efficient provenance nearly 2 faster than the reconstruction baseline and nearly x faster than the AEDR. We show in Table A3 that for most IARs, our method achieves the fastest data provenance, with running time of less than 10 milliseconds.
4.3 ROBUSTNESS EVALUATION AGAINST IMAGE POST- PROCESSING
In practical provenance tracing applications, the original images might be modified through JPEG compression, resizing, or other post- processon operations, which can reduce provenance signals and make reliable tracing more challenging. We analyze the robustness of our proposed framework
8

---

Published as a conference paper at ICLR 2026
Table 3: Contribution of the components in our method. We present TPR@ 1%FPR of different signals on different models. We denote the optimized quantization as QuantLoss Opt. The best instantiations of our framework for each model are highlighted in green, which corresponds to the results shown for our method in Table !
Model
Methed
Natural
Generated
ImageNes
LAION
MS-C000
RAR
Tuming
VAR
Infinity
VQDHil
Oun (QhontLorr)
100.0
99.8
100,0
100,0
100,0
100.0
100.0
100.0
(FacLar))
100.0
100.0
100.0
100.0
WWanttor Encloss)
Oun (QhanLLor)
99.9
99.8
99.9
99.5
99.2
100.0
100.0
99.8
Ours (Bacarr)
93.5
91.9
99.5
Fuuloss)
100.0
99.9
Ous (QhantLar)
99.6
88.8
95.6
96.3
99.6
99.5
99.8
99.5
Taming
Oun (EecLar
100.0
100.0
100.0
100.0
100,0
100.0
100.0
100.0
EncLoss)
100.0
100.0
100.9
100.0
100.0
100.0
108.0
Ous (QunnLor))
0.4
0.0
10.0
0.0
4,5
0.0
13.4
1.6
VAR
Dus (QhaniLorr Opt)
Ours (EecLar)
100.0
95.0
92.9
94.4
98.1
59.5
100.0
94.5
88.4
10000
95.7
95.2
(Quamtl Finlase)
160.0
Durs (Qhantl
99.4
85.6
99.4
99.2
99.5
99.1
99.4
99.4
Infnity
Ours (DcLarn
91.9
98.99
1.4
0.4
11.8
35.1
EncLasa)
9.1
Ous (QuuntLor)
92.1
43.3
99.1
96.8
97.6
85.8
95.7
99.3
VQDVT
Dars (Faclorr)
100.0
108.0
100.0
99.7
100.0
100.0
100.0
100.
Enclasa)
100.0
100.0
100
Table 4: Effectiveness of decoder inversion with without finetuning the encoder. We the the best instantiation of our framework following Table We show TPR@ 1&PPR across different datasets and models.
Natural
Generated
Model
Method
ImageNet
LAION
MS-COCO
LlamaGien
RAR
Taming
VAR
Infinity
VQDiit'
LlamaGen
Ours (Original Encoder)
99.9
99.6
99.9
99.9
99.6
99.9
99.9
100.0
Ours (Inverse Decoder)
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
RAR
Ours (Original Encoder)
6.2
9.1
10.0
1.7
0.5
3.1
13.4
21,8
Ours Unverrs Decoder)
100.0
100.0
100.0
99.9
99.9
100.0
100.0
100.0
Taming
Ours (Original Encoder)
15.3
15.7
15.3
7.8
8.8
12.5
13.7
19.2
Ours Ulnverse Decoder)
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
Ours (Original Encoder)
2.7
3.5
5.4
8.4
3.2
6.3
8.4
7.8
VAR
Ours (Inverse Decoder)
10000
99.2
100.0
99.2
100.0
100.0
100.0
100.0
Infnity
(Original Encoder)
0.0
0.0
1.3
2.8
0.0
Ours (Inverse Decoder)
99.4
85.6
99.4
99.2
99.5
99.1
99.4
99.4
(Original Encoder)
33.2
82.9
95.7
65.8
83.3
VQDiif
Ours (Inverse Decoder))
100.0
99.4
100.0
99.9
100.0
99.9
100.0
100.0
against common image cost-processing methods. We analyze the robustness of RAR in Table 2 and provide a more extensive evaluation for robustness on additional models in Appendix H We detail the analyzed attacks in Appendix C and provide the respective strengths in brackets in Table We find that the baselines quickly break against common image post-processing transformations, while our QuantLoss allows for reliable attribution. Our framework also enables finetuning the inversion D-1 with augmentations to further improve the robustness of attribution against the image post- processing operations. We note that for the setting where common image processing exists, the best instantiation of our method is QuantLoss. In Appendix H. we show the reason why our QuantLoss allows for more robust provenance than EncLoss, specifically when trained with augmentations.
4.4 ABLATION STUDIES
Effectiveness of the Framework Components. While, for the results in Table 1 we instantiate our framework with the best mer-model combination of signals from Section in Table we ablate the impact of the individual signals. Concretely, we study the following three combinations: LoantLoss only uses the QuantLoss from Equation (5). EncLoss relies on the EncLoss from Equation (10)
and QuantLoss x EncLoss uses the combined loss from Equation (II). For VAR, additionally integrate the optimization step from Algorithm 3 Our results show that, for most model and dataset pairs, combining both signals yields perfect near-perfect results, i.e., 100% TPR at practical

---

Published as a conference paper at ICLR 2026
Table 5: Effectiveness of EncLoss calibration. We show TPR @ 1%FPR for attributing belonging
images v.s. non-belonging images from different real datasets or generative models.
Model
Method
Natural
Generated
ImageNet
LAION
MS-COCO
LlamaGen
RAR
Taming
VAR
Infinity
VQDiff
LlamaGen
EncLoss (woo Calibration)
19.0
23.8
34.3
26.4
2.8
32.8
63.4
54,9
EucLoss (w/
Calibration)
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
EncLoss (wlo Calibration)
22.6
21.2
27.3
5.1
2.5
26.0
47.9
44.0
RAR
EneLoss tw/
Callbration)
98.2
98.0
98.9
93.5
91.9
96.6
99.5
99.7
Taming
EncLoss (woo Calibration)
53.7
39.1
49.8
29.5
43.9
52.2
63.2
70.9
EucLoss (w/
Calibration)
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
EucLoss (wdo Calibration)
17.0
15.8
31.8
6.1
21.7
1.4
41.4
41.5
VAR
Finel ass /w/
Callhration)
100.0
96.8
100.0
98.1
100.0
99.7
100.0
100.0
Infinity
EacLoss (wdo Calibration) EncLoss hw/ Calibration)
0.3
2.5
4.5
0.1
0.2
0.0
0.8
1.3
0.0
94.9
98.9
1.4
0.6
0.4
11.8
35.1
VQDIIT
LocLoss (weo Calibration) Enclass hw/ Callbration)
15.7
5.4
24.6
15.5
14.8
3.5
21.9
34.3
100.0
100.0
100.0
99.7
100.0
100.0
100.0
100.0
Table 6: Hyperparameter analysis for optimized token search (Algorithm 3 We evaluate on VAR model, using VAR- -AR-geneetted images as the belonging image, and ImageNet as the non- belonging image. The evaluated metric TPR @ 1RFPR (%). Init w/ Orig. Quant, denotes whether our algorithm is initialized with the original quantization in VAR. Default parameters in Bold.
Number of Iterations
Learning Rate
Init w/ Orig. Quant.
Baseline
100
400
1000
1200
1400
1600
0.01
0.05
0.1
0.2
0.5
No
Yes
0.4
87,5
91.0
95.4
95.0
93.8
92.2
43.0
95.2
95.0
94.2
92.8
94.3
95.0
detection thresholds. We observe that for VAR, including the additional optimization step boosts the combined signal by, on average, roughly 10% and achieves perfect detection.
Decoder Inversion. We also ablate the role of relying on the inverted decoder instead of the IARs' original encoders for provenance tracing in Table A Our results highlight the importance of de- coder inversion: while e.g., for RAR, the combined loss can initially only partly attribute belonging images, after finetuning we achieve close to 100% TPR@ 1FPR.
EncLoss Calibration. We evaluate the impact of our calibration strategy for the EncLoss signal in Table 5 comparing the uncalibrated reconstruction loss (Equation (9) against our calibrated version (Equation (TOp. Without calibration, performance is moderate because tow-complexity natural images exhibit reconstruction loss similar to generated images. The calibration normalizes by image complexity, achieving near-perfect detection for most models.
Hyperparameter Analysis for Optimized Quantization. Table 6 analyzes hyperparameters for our optimized token search on VAR. Optimal performance (95.0-95.4%% TPR@ F&FR occurs with 1,000-1,400 iterations and learning rate 0.1. Notably, our method still achieves 87.5%TPR @ 1% FPR with only 100 iterations, which can reduce the runtime from 8. 8.24s/image to 0.57s/image. In addition, initializing with VAR's original quantization provides modest boost (95.0% 94.3%).
5 CONCLUSIONS
We introduced the first model-agnostic, post-hoe framework for robust provenance tracing of IAR- generated images. Our approach exploits the unique quantization artifacts left by the tokenization process in IARs, distinguishing generated content even in the absence of visible differences or ex- plicitly added watermarks. To strengthen the evidence that a given image was generated by par- ticular IAR, we design additional provenance features that increase the signals from quantization- artifacts and leverage additional signals from the encoding process. We show that our framework achieves near-perfect detection across wide range of state-of-the-art IARs. Notably, it operates without requiring any architectural changes or access to the generation process, making it broadly applicable to existing, previously published, and unmarked content. Our results provide practical and scalable solution for responsible deployment and post-hoc auditing of autoregressive generative models in real-world scenarios.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENT
We would like to acknowledge our sponsors, who support our research with financial and in-kind contributions: OpenAl and G-Research. We also thank members of the SprintML group for their feedback.
ETHICS STATEMENT
This work addresses critical societal challenges posed by increasingly realistic Al-generated im- agery, including misinformation, fraud, and harmful content dissemination. Our post-hoe prove- nance method serves as defensive technology that enhances transparency and accountability in Al-generated content without compromising the quality utility of generative models. Since our method achieves nearly 100%TPR at only 1%FPR, has very low risk of making false accusa- tions. We believe the benefits of enabling reliable source attribution for combating synthetic media misuse outweigh the potential risks.
REPRODUCIBILITY STATEMENT
We provide comprehensive implementation details together with open-sourced code ensure repro- ducibility of our results. All experimental configurations, including hyperparameters for finetuning the inverse decoder across six different open-source models (LlamaGen, RAR, Taming, VAR, Infin- ity, VQ-Diffusion), are detailed in Appendix C with specific learning rates, batch sizes, and training schedules. Our evaluation also includes three well-known image datasets (ImageNet, LAION, MS- COCO validation sets) that are also open-source. The optimized quantization algorithm for multi- scale models is provided in detail in Algorithm 3, and robustness evaluation protocols with specific attack parameters also documented in Appendix C. All experiments conducted on standard hardware (NVIDIA A40 GPUs) with specified software versions.
REFERENCES
Sina Alemohammad, Josue Casco- couso-Rodriguez, Lorenzo Luzi, Ahmed Imtiaz Humayun, Hossein Babaei, Daniel LeJeune, Ali Siahkoohi, and Richard Baraniuk. Self-consuming generative mod- go MAD. In The Twelfth International Conference on Learning Representations, 2024.
Mark Chen, Alec Radford, Rewon Child, Jeffrey Wu, Heewoo Jun, David Luan, and llya Sutskever. Generative pretraining from pixels. In International conference on machine learning, pp. 1691 1703. PMLR. 2020.
Yunjey Choi, Youngjung Uh, Jaejun Yoo, and Jung-Wer Woo Ha. Stargan v2: Diverse image synthesis for multiple domains. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8188-8197, 2020.
Haoge Deng, Ting Pan. Haiwen Diao, Zhengxiong Luo, Yufeng Cui, Huchuan Lu, Shiguang Shan, Yonggang Qi, and Xinlong Wang. Autoregressive video generation without vector quantization. In The Thirteenth International Conference on Learning Representations, 2025.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference on computer vision and pattern recognition,
pp. 248-255 Icee, 2009.
Patrick Esser, Robin Rombach, and Bjorn Ommer. Taming transformers for high-resolution image synthesis. In Proceedings of the IEEE/CVF conference on computer vision and pattern recogni- lion, pp. 12873-12883, 2021.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 22466-22477, October 2023.
Frank Ephraim Grubbs. Sample criteria for testing outlying observations. University of Michigan, 1949.
11

---

Published as a conference paper at ICLR 2026
Shuyang Gu, Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusion model for text-to-imasn synthesis. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 10696-10706, June 2022.
Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. arXiv preprini urXiv:2410.07369, 2024.
Jian Han, Jinlai Liu, Yi Jiang, Bin Yan, Yuqi Zhang, Zehuan Yuan, Bingyue Peng, and Xiaobing Liu. Infinity: Scaling bitwise autoregressive modeling for high-resolution image synthesis. Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2025.
Nikola Jovanović, Robin Staab, and Martin Vechev. Watermark stealing in large language models. In International Conference on Machine Learning, pp. 22570-22593, PMLR, 2024.
Nikola Jovanović, Ismail Labiad, Tomáš Souček, Martin Vechev, and Pierre Fernandez. Watermark- ing autoregressive image generation. arXiv preprint arXiv:2506. 16349, 2025.
Tero Karras, Samuli Laine, and Timo Aila. A bnyle-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4401-4410, 2019.
Tero Karras, Samuli Laine, Miik Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyz- ing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 81 $110-8119 2020.
Tero Karras, Mika Aittala, Samuli Laine, Erik Härkönen, Janne Hellsten, Jaakko Lehtinen, and Timo Aila, Alias-free generative adversarial networks. Advances in neural information processing systems, 34:852-863, 2021.
Louis Kerner, Michel Meintz, Bihe Zhao, Franziska Boenisch, and Adam Dziedzic. Bitmark: Water- marking bitwise autoregressive image generative models. The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025.
Changhoon Kim, Kyle Min, Maitreya Patel. Sheng Cheng, and Yezhou Yang. Wouaf: Weight modulation for user attribution and fingerprinting in text-to-image diffusion models. In 2024 IEFF/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pp. 8974-8983, 2024. doi: (T009/CVPRR5233.22244.000
Antoni Kowalezuk, Jan Dubiński, Franziska Boenisch, and Adam Dziedzic. Privacy attacks on image autoregressive models. In Forfy-second International Conference on Machine Learning, 2025.
Tianhong Li, Yonglong Tian, He Li, Mingyang Deng, and Kaiming He. Autoregressive image generation without vector quantization. Advances in Neural Information Processing Systems, 37: 56424-56445, 2024.
Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C LLwrence Zitnick. Microsoft coco: Common objects in context. In Computer vision-ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, pro- ceedings. part 13, pp. 740-755. Springer, 2014.
Guan-Homg Liu, Tianrong Chen, Evangelos Theodorou, and Molei Tao. Mirror diffusion models for constrained and watermarked generation. In Thirty-seventh Conference on Neural Information Processing Systems, 2023.
Arpan Mahara and Naphtali Rishe. Methods and trends in detecting generated images: A compre- hensive review, 2025.
Bartlomiej Marek, Lorenzo Rossi, Vincent Hanke, Michael Backes Xun Wang. Franziska Boenisch, and Adam Dziedzic. Benchmarking empirical privacy protection for adaptations of large language models. In The Fourteenth International Conference on Learning Representations, 2026. URL
https:://ppnnret net http:/wwwwweee/oomm///////// fF
12

---

Published as a conference paper at ICLR 2026
Michel Meintz, Jan Dubiński, Franziska Boenisch, and Adam Dziedzic. Radioactive watermarks in diffusion and autoregressive image generative models. 2025.
Guangyu Nie, Changhoon Kim, Yezhou Yang, and Yi Ren. Attributing image generative models us- ing latent fingerprints. In Proceedings of the 40th International Conference on Machine Learning, (CML'23, JMLR.org, 2023.
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01992. 2023.
Sucheng Ren, Qihang Yu, Ju He, Xiaohui Shen, Alan Yuille, and Liang-Chich Chen. Beyond next- token: Next-x prediction for autoregressive visual generation. arXiv preprint arXiv:2502.20388, 2025.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022.
Lorenzo Rossi, Bartlomiej Marek, Franziska Boenisch, and Adam Dziedzic. Natural identifiess for privacy and data audits in large language models. In The Fourteenth International Confer- ence on Learning Representations, 2026. URL /tttps:///penreviee... wtt.rrewiewwewe..eeeeeee http://wwwwwe..rruntee// forum?ids
doaAUF9P117
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural informa- tion processing systems, 35:36479-36494, 2022.
Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. MI-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In Network and Distributed System Security Symposium (NDSS), 2019.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in neural in- formation processing systems, 35:25278 22794222294... 2022.
Chenze Shao, Fandong Meng, and Jie Zhou. Continuous visual autoregressive generation via score maximization. In Forty-second International Conference Machine Learning, 2025.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference tacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEEE, 2017.
Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao, Nicolas Papernot, Ross Anderson, and Yarin Gal. Ai models collapse when trained recursively generated data. Nature, 631(8022):55-755)
2024.
Thomas Steinke, Milad Nasr, and Matthew Jagielski. Privacy auditing with one (1) training run. In Thirty-seventh Conference on Neural Information Processing Systems, 2023. URL https:
//openreview. net./ d=
Peize Sun, Yi Jiang, Shoufa Chen, Shilong Zhang, Bingyue Peng, Ping Luo, and Zehuan Yuan. Autoregressive model beats diffusion: Ilama for scalable image generation. arXiv preprint 0.xiv:2406.06555. 2024.
Haotian Tang, Yecheng Wu, Shang Yang. Enze Xie, Junsong Chen, Junyu Chen. Zhuoyang Zhang, Han Cai, Yao Lu, and Song Han. HART: Efficient visual generation with hybrid autoregressive transformer. In The Thirteenth International Conference on Learning Representations, 2025.
Zhicong Tang, Shuyang Gu, Jianmin Bao, Dong Chen, and Fang Wen. Improved vector quantized diffusion models, 2023.
13

---

Published as a conference paper at ICLR 2026
Chameleon Team. Chameleon: Mixed-modal early-fusion foundation models. arXiv:2405.09818. 2024.
arXiv preprint
Keyu Tian, Yi Jiang, Zehuan Yuan, Bingyue Peng, and Liwei Wang. Visual autoregressive modeling: Scalable image generation via next-scale prediction. Advances in neural information processing systems, 37:84839-8488 84865, 2024.
Yu Tong, Zihao Pan, Shuai Yang, and Kaiyang Zhou. Training-free watermarking for autoregressive image generation. arXiv preprint arXiv:2505. 14673, 2025.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302. 139711, 2023a.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaci, Niko- lay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open founda- tion and fine-tuned chat models. arXiv preprint arXiv:2307.09288 2023b.
Aaron Van den Oord, Nal Kalchbrenner, Lasse Espeholt, Oriol Vinyals, Alex Graves, et al. Con- ditional image generation with pixelenn decoders. Advances in neural information processing systems, 29, 2016.
Chao Wang, Kejiang Chen, Zijin Yang, Yaofei Wang, and Weiming Zhang. free ai ai-generated image attribution via autoencoder double-reconssruution.. arXiv preprint arXiv:2507. 18988. 2025a.
Aedr: Training-
Zhenting Wang, Chen Chen, Yi Zeng, Lingjuan Lyu, and Shiqing Ma. Where did i come from? origin attribution of ai- aineeenedeed images. Advances neural information processing systems, 36: 74478-7450X 2023.
Zhenting Wang, Vikash Sehwag, Chen Chen, Lingjuan Lyu, Dimitris N. Metaxas, and Shiqing Ma. How to trace latent generative model generated images without artificial watermark? In ICMI., 2024.
Ziyi Wang, Songbai Tan, Gang Xu, Xuerui Qiu, Hongbin Xu, Xin Meng, Ming Li, and Fei Richard Yu. Safe-var: Safe visual autoregressive model for text-to-image generative watermarking. arXiv preprint arXiv:2503.1132. 2025b.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisi- ble fingerprints for diffusion images. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.). Advances in Neural Information Processing Systems, volume 36, pp. 58047- 58063. Curran Associates, Inc., 2023.
Sierra Wyllie, Ilia Shumailov, and Nicolas Papernot. Fairness feedback loops: training on synthetic data amplifies bias. In Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transpurency, pp. 21 2--2147,, 2024.
Shilin Yan, Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Weidi Xie. A sanity check for Al Al-generated image detection. In The Thirteenth International Conference on Learning Representations, 2025.
Hongyao Yu, Yixiang Qiu, Yiheng Yang, Hao Fang, Tianqu Zhuang, Jiaxin Hong, Bin Chen, Hao Wu, and Shu-Tao Xia. Icas: Detecting training data from autoregressive image generative models. In Proceedings of the 33rd ACM International Conference on Multimedia, pp. 1 11209-11217, 2025.
Lijun Yu, Jose Lezama, Nitesh Bharadwaj Gundavarapu, Luca Versari, Kihyuk Sohn, David Minnen, Yong Cheng, Agrim Gupta, Xiuye Gu, Alexander G Hauptmann, Boqing Gong, Ming- Hsuan Yang, Irfan Essa David A Ross. and Lu Jiang. Language model beats diffusion tokenizer is key to visual generation. In The Twelfth International Conference on Learning Representations, 2024a.
14

---

Published as a conference paper at ICLR 2026
Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for gen- erative models: Rooting deepfake attribution in training data. In 2021 IEEE/CVF International Conference Computer Vision (ICCV), pp. 14428-14437, 2021. 2021.01418.
doi: 10.1109/ICCV4992.
Qihang Yu, Ju He, Xueqing Deng, Xiaohui Shen, and Liang-Chich Chen. Randomized autoregres- sive visual generation, 2024b. URL
http://bs//221..... 00776
Richard Zhang, Phillip Isola, Alexei Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as perceptual metric. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 586-595, 2018.
Yanran Zhang, Bingyao Yu, Yu Zheng, Wenzhao Zheng, Yueqi Duan, Lei Chen, Jie Zhou, and Jiwen Learning discrete distribution discrepancy-aware quantization error for autoregressive- generated image detection. In Proceedings of the IEEE/CVF International Conference on Com- puler Vision, pp. 16292-16301, 2025.
Lu. D3qe:
Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andres Fabrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramer, Somesh Jha, Lei Li, Yu-Xiang Wang, and Dawn Song. Sok: Watermarking for ai-generated content, 2025.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models, 2023.
15

---

Published as a conference paper at ICLR 2026
A DETAILED ALGORITHM OF OPTIMIZED TOKEN SEARCH
We present the original quantization algorithm for VAR in Algorithm the original dequantization algorithm for VAR Algorithm and the detailed algorithm of the optimized token search for VAR in Algorithm 3 The part introducing errors due scalewise structure for VAR quantization in Al- gorithm is marked in red. The common procedures original VAR dequantization (Algorithm and our approach (Algorithm 3 marked in blue.
We observe that in the dequantization process VAR (Algorithm T. the representations all scales are upscaled and added to the final feature map (row 5-6). However, during the quantization process (Algorithm (2). the feature map is considered as a whole during the codebook lookup (row 6). Therefore, if we quantize a feature map of generated image scale k all the token representations from scales > are also part of the feature map during this lookup process, which leads to an error of the current-scale quantization.
As shown by Algorithm 3 the goal of our algorithm is to search for a scalewise token combination from the codebook that has minimal distance given feature map by backpropagation. For each element in the token map, we initialize N logits corresponding to N entries in the codebook (row 2). An estimated feature map then calculated according to the logits (row 3-11). Then employ the gradient descent algorithm to minimize the distance between the estimated and target feature map (row 12-13). The intuition to detect images generated by VAR is the following: For feature map generated by VAR, our algorithm enables the originally generated tokens to gradually have higher logit values with more iterations, and finally reduces the QuantLoss largely. Any feature map not generated by VAR cannot be easily represented by tokens from the codebook, so the Quantl remains high even after this optimization.
Algorithm Original Dequantization for VAR
Inputs: multi-scale token maps I, codebook Z
Hyperparameters: number of scales K, resolutions {(hs, wx) Me
1:
f f+0
D Initialize reconstructed feature map > Iterate through all scales Obtain tokens from given scale > Look up codebook vectors for tokens b Upscale to full resolution
2: for k + to K do ts < QUEUE_POP())
3:
4:
Z: + LOOKUP(Z,t, tx)
5:
ZA < INTERPOLATE WK)
6:
f+ f + dx((k))
> Add processed features to reconstruction
7: return
> Return reconstructed image
Algorithm Original Quantization for VAR
Inputs: image v, encoder F,, quantizer Q, codebook Z
Hyperparameters: number of scales K, resolutions {(h, wx) k=1
1: f (zx)
Encode image to get the feature map Initialize empty queue for multi-scale tokens b Iterate through all scales Quantize interpolated features to current scale
2: f-(1
3: for & < to K do
4:
Fk Q[INTERPOLATE(/ hy, Wx))
5:
( QUEUE PUSICEEEPSS((,,,
D Add tokens to the token map Look up codebook vectors for tokens & Upscale to full resolution Subtract processed features from residual
6:
Z4 LOOKUP(Z, rh)
7:
Z4 + INTERPOLATE(22, hy, wK)
8:
f f-f-Oh Óx((z))
9: return /
b> Return multi-scale tokens
B ADDITIONAL RELATED WORK
LlamaGen Sun al. 2024) demonstrated that vanilla autoregressive models, without inductive biases on visual signals, can achieve state-of-the-a image generation performance scaling prop- erly. There three keys to its success. (1) well-designed image compressor, which balances
16

---

Hyperparameters: number of scales K, resolutions {(h,, mPx ] number of iterations Niters > Encode image with the inverse decoder to get the feature map > Initialize the token maps logits. Lg has a shape of (by, Wi N) P Optimization iterations Initialize the estimated feature map D Iterate through all scales to calculate features on each scale Iterate through features in the current scale Published as a conference paper at ICLR 2026
Algorithm 3 Optimized Quantization for VAR
Inputs: image z, inverse decoder D-1, codebook Z { 2N3 with a size of N, gradient descent algorithm GD(-)
1: f < (z)
2: L + [4+)k=]
3: for Niters f- 1 to Niters do
4:
f+ 0
5:
for 4- 1 to K do
6:
for i <- to hy do
7:
for j + to wR do
8:
p {OFTMA((((]]]])
Calculate the probabilities of all codebook entries 2|K|||] + Ei=1 Pt 2t > Calculate the feature averaged on the probabilities hu K. wx)
9:
10:
2|k] INTERPOLATED f f f + dz (=(k))
Upscale the feature map to full resolution P Process with convolution and add to the estimated feature map
11:
12:
E bRwg
Σ Σ j=1 (f f(ll)))
WK
13:
L+ GD(L, E')
D Perform gradient descent on the logits L to minimize E Calculate the final tokens by taking highest logits
14:
/ (([arg max (ااي)
15: return
the trade-off between image quality and codebook utilization by opting for the down-sample ratio of p 16. (2) A scalable image generation model developed based on the Llama architecture (Tovronn cct al. 2023alb) used for LLMs, and (3) high-quality training data, especially with the finetuning on 10 M high aesthetics quality images.
Token Mismatch. The first papers on watermarking already observed a mismatch between the generated tokens for given image and the image's 's re-encoded tokens (Meintz al. 2025 Kerner
al. 2025 Jovanović et al. 2025 Tong et al. (2025). The problem stems primary from the decoder- encoder pairs which are not trained to optimize for the token match (see the training optimization with the compound loss, for example, in VAR by TTin et al. (2024), Equation 5). The standard training only ensures small loss between the original and generated images as well between the latent representations after encoding and before the decoding. An additional term is the recon- structed image quality, which is measured, for example, with the LPIPS (Zhang al.) 2018) or StyleGAN's discriminator loss (Karras et al., (019)). Despite the mismatch, the token- based water- marks from Meintz et al. (2025) and bit-wise watermark proposed by Kerner et al. 2025), were able to still provide highly-robust detection of the generated content. The other line of work by Jovanović et al.) (2025) and Tong et al.] (0255) further propose to finetune the encoder-decoder encoder-only. respectively, to compensate for the token-index reconstruction errors. We leverage the inherent property of IARS with their discrete codebook and the encoding errors by showing that the significantly higher errors for the natural images allow to distinguish them from the generated
images.
Vector Quantization in LARs. The token-based image generation in IARs has the underlying prin- ciple inherited from L.LMs, where each next predicted token is represented as an index of one of the entries in the codebook. The codebook stores collection of relatively small dimensional represen- tation vectors which constitute building blocks of an image. The generated tokens are decoded to a full-dimensional image. Any image can be encoded to the token latent space. The encoder performs feature extraction through a multi-layer convolutional layers with down-sampling to the latent space, which results in a collection of encoded small dimensional representation vectors. These vectors are compared with the entries in the codebook to obtain the integer indices of the tokens.
C IMPLEMENTATION DETAILS
Finetuning. Our finetuning of D follows the pipeline in Figure with the corresponding AR model, embed them to the original feature map fz and use the frozen
2 where we first generate tokens
17

---

Published as a conference paper at ICLR 2026
decoder D to generate images z2. We detail the finetuning hyperparameters, such the number of images, the batch size and learning rate for every model in Table A1 All experiments were conducted on single NVIDIA A40 GPU with 48GB of memory.
Table Al: Finetuning details for different models.
Number of
Batch Size
Learning Rate
Method
Epuch
Optinizer
Scheduler
Scheduler Configuration
Finetuning Data
LlamaGon
50000
25
Adam
1 x 10 3
StepLR
Gamma=009 9, Step=2
Taming
50000
50
Adam
5 x 10
StepLR
Gamma=0.9. Step=2
RAR
10
StepLR
Gamma=099 Step=2
VAR 50000
16
Adam
5 x 10
Stepl.R
Gamma=0.9 Step=2
Infinity
10000
10
2
Adam
1 10
Stepl R
Gamma-0.9. 0.9, Stepa2
VQ Diflusion
100000
50
16
Adam
5 x 10
StepLR
Gamma=099 9. Step=2
Augmentations. For the robustness evaluation in Table 2 we apply augmentations during the fine- tuning of RAR and Taming to improve the robustness against image post-processing methods. We progressively apply weak to strong augmentations during 50 epochs of finetuning, where more detailed recipe can be found in Table A2
Table A2: Augmentation hyperparameters during finetuning.
Strength
Epoccs
JPEG- Compression Quality
Caussian Blur (Kemel
Gaussian Nuise (Standind Deviation)
Brightness (Factor)
Saturation
Resize (Ratio)
Contrist (Factor)
None
1-5
Weak
6-10
[90, 85, 80)
10.005, 0.01, 0.02)
LL
[LO, 122 1.51
[09, 0,85 0.8) [08, 0.71
[10, 1.5)
Medium
65))
0.04]
177200
Strong
[60, 53, 50)
[5. 7.97
[0.03. 0.04, 0.05]
[15. 1...2.
[200 2.2.2
10.7, 0.5.0.0) 0.5]
[2.0,
Hyperparameters for Optimized Quantization. For the optimized quantization of VAR, we use 1200 iterations with learning of 0.1, batch size of 8, and the Adam optimizer. We use the original quantization in VAR (Algorithm) 2 as initialization. We perform an analysis of the hyper- parameters Table
Robustness. In Table 2 we evaluate the following methods: 1) Noise: Adds Gaussian noise with std of 0.05 to the image, Kernel: Application of Gaussian Blur with kernel size of 3) JPEG: 60% JPEG compression. 4) Brightness: Increasing the brightness to 1.6. 5) Contrast: Changing
the contrast to 2.0, 6) Saturation: Increasing the Saturation 2.0, 7) Resizing: Decreasing the resolution of the image 50% of its original resolution. An extended analysis of the impact of the strength of each attack can be found in Appendix H
D IMPLEMENTATION DETAILS FOR BASELINE METHODS
Reconstruction. For this naïve baseline, compute the loss Live ||x æ1ll2 between the original image x and its first reconstruction #; = D(Q(Q-11 (D-I(((D)))) (x)))) and use decide wether the image generated by the model or not.
LatentTracer. (Wang et al., 2024) We optimize for 100 iterations with the Adam optimizer. The learning rate is 0.01, which decays by 50% after 50 iterations. The feature map is initialized the quantized feature map encoded by the encoder.
AEDR. We follow the method proposed by Wang et (2025a) and caleulate the calibrated loss Ceal bewweeeen a first image reconstruction 전 = DQQ(Q (D-1(x))) with the first recon-
struction loss Lre, = ||a I1 ||2 and the second image reconstruction 322 D(Q(Q-QQQ)))) DDQ(Q-((-~(<x)))
with the second reconstruction loss Lree, = || 2
E EXPERIMENTAL ENVIRONMENT
Hardware. Our experiments are performed on Ubuntu 22.04, with Intel(R) Xcon(R) Gold 6330 CPU and NVIDIA A40 Graphics Card with 48 GB of memory.
18

---

Published as a conference paper at ICLR 2026
Software. To run our experiments used CUDA Version 12.5 and Python 3.12.4 with PyTorch 2.7.0.
F THE DISTRIBUTIONS OF DIFFERENT METHODS
We analyze the distributions of the best-performing signals from Table Figure A1 We compute the loss for all non-belonging datasets, i.e., the generated and natural datasets and compare it to the loss of the belonging dataset. The different distributions are calculated for both the original encoder and our finetuned Inverse Decoder D Figure A clearly shows, that the Inverse Decoder necessary to reduce the overlap between the belonging and non-helonging loss distributions. This results in our method achieving near 100% TPR @ %FPR for data provenance.
The Combined Loss distributions for most models show an increase of the non- non- belonging data loss, while it decreases slightly for the belonging data. This behavior is related to the EncLoss, which is based on the ratio between the first and second reconstruction, as we formulate in Equation (TOp. The ratio converges to for belonging images, the difference between the first reconstruction loss and second reconstruction loss decreases. Similar for non-belonging images the second reconstruction loss decreases. However the first reconstruction loss stays consistent, the image does not originate from the models codebook. This leads to an overall higher loss ratio and a higher Combined Loss.
G RUNNING TIME COMPARISON
Running Time. We compare the running time to determine our QuantLoss with the given baselines. As shown in table A3 after finetuning, our method is by far the fastest, followed by Reconstruction, then AEDR and finally LatentTracer, which with running time of multiple seconds is the slowest method. We also estimate the pre- treiirin time of different models. Notably, our inverse decoder finetuning is a relatively small overhead compared to the model pre-training stage. For example, the finetuning time is less than 0.05% compared to the pre-training time for LlamaGen.
Table A3: Running time comparison. We instantiate our method as only using QuantLoss for LlamaGen, RAR, Taming, VQ-Diffusion and Infinity, while using QuantLoss Opt for VAR. We also include an estimation of model pre-training time for each IAR.
Model
Stage
Traenr
Reconstruction
AEDR
Ours (QuantLoss)
Model Pre-training (hours)
18000
> 18000
18000
> -8800
LlamaGen
D Finetuning (hours)
8.6
Attribution (second/sample)
5.305
0.015
0.030
0.009
Model Pre-training (hours)
20000
>20000
>20000
>20000
RAR
D) Finetuning (hours)
31.9
Attribution (sccond/sample)
2,359
0.014
0.028
0.009
Model Pre-training (hours)
20000
>20000
>00000
>20000
Taming
Pre-training (hours)
42.1
Attribution (sccond/sample)
3.674
0.013
0.024
0.006
Model Pre-training (hours)
10000
10000
10000
10000
VQ-Ditfusion
D Finetuning (hours)
4.9
Attribution (sccond/sumple)
3.112
0.022
0.043
0.008
Model Pre-training (hours)
50000
>50000
550000
>50000
Infinity
D-1 Finetuning (hours)
14.9
Attribution (second/sample)
84.897
0.202
0.776
0.197
Model Pre-training (hours)
20000
20000
20000
20000
VAR
1) Finetuning (hours)
10.8
Attribution (second/sample)
4.653
0.016
0.031
8.249
H EXTENDED ROBUSTNESS EVALUATION
We further analyze the robustness of our framework against different attack strengths in Figure A2 (RAR) and Figure A3 (Taming). The results show that our proposed attribution with Quantl
19

---

Published as a conference paper at ICLR 2026
Originel Encoder
Original Encoder
Perpentage Stmplee (N)
Noedoeangg Data
Map-Beagging Duta
Beanging Tinding dearattd
Deeegtug of Suumpiee
Ieceelin VAA ficeentted
3.4
Jnverse Decoder
Inverse Decoder
Bolanghig
2 4.44
Decnging Turning Guaitaed
Scoeging VAl Cenersied
Pocountag Samples
Vecannage Sumghe
1.3
0.50
0.65
0.35
6.20
3.50
44
Combined Loos
Combined Loos
(a) Combined Loss distribution for Taming,
(b) Combined Loss distribution for VAR.
Original Encoder
Original Encoder
Mas Dacaging Data
Cotantue Sumples (8)
Nux Delanging Eata
Pecenttgg of Scmppos
hoveyging Kal Oraviati
Bexeging Llanotion Drverate
2.6
8.4
22
3.0
Inverse Decoder
Inverse Decoder
Perreniigg Swempie (50
pecsintagge of Sumahee 87
Baconging RAR Guaicated
Dacegging Clanation Genicated
0.2
0.02
0.58
Combined Loss
Combined Loss
(c) Combined Loss distribution for RAR.
(d) Combined Loss distribution for LlamaGen.
Original Encoder
Original Encoder
Perconaag of Stapptes (N6)
Dolegba Dats Becketing Iniisly Ceserclee
Percentnge of Sumples (8)
Nus Dacanging Dats Bexeging vi2 OUlalis Genercine
2.0
2.5
1.0
1.3
3.0
0.50
033
6:32
0:45
Inverse Decoder
Inverse Decoder
Ierreet of (Sampleo (Ng
botesbi Deta
Purcentage of Samptos (%)
Drienging
Dickeging fadalo Caserase
3.50
QuantLos
Cunbkned
Loaos
(c) Quantl Loss distribution for Infinity.
(f) Combined Loss distribution for VQ-Diffusion.
Figure AI: Distribution for Combined Loss for different models for the original encoder and the finetuned Inverse Decoder.
20

---

Published as a conference paper at ICLR 2026
Recoostraction
AEDR
LatentTracer
Ours (Quan(oss)
Our (EncLoss)
Durs (Combined)
(a) Finetuned without augmentation
(b) Finetumed with augmentation
1.00
1.00
1PR81%FP
0.75
0.75
(1) Brightness
0.50
0.50
0.25
0.25
0.00
0.00
1.0
1.2
1.6
1.8
2.0
1.0
1.2
1.4
1.6
1.8
2.0
1.00
TPtt@ 1865P
0.75
0.75
(2) Contrast
0.50
0.50
0.25
0.25
0.00
0.00
2.5
1.00
1.00
TRR@1%PR
(3) Kernel
0.50
0.50
0.25
0.00
0.00
5
10
15
10
15
1.00
TPR01 SEFP
0.75
0.75
(4) JPEG
0.25
0.25
0.00
1.00
1.00
TPR81 TPR81%FP 19PPR
5 Noise
0.50
0.50
0.00
0.00
0.00
0.05
0.10
0.15
0.20
0.00
0.05
0.10
0.15
0.20
TPR 155FFR
0.75
0.75
Resize
0.25
0.25
0.7
0.6
0.5
0.9
0.8
0.7
1.00
1.00
TRRI1377
0.75
(7) Saturation
0.50
0.50
0.00
0.00
1.0
1.5
2.0
2.5
3.0
1.0
1.5
2.0 Strength
2.5
3.0
Strength
Figure A2: Robustness Test for RAR on 7 common image post-processing techniques.
21

---

Published as a conference paper at ICLR 2026
Recoostraction
AEDR
LatentTracer
Ours (Quan(oss)
Our (EncLoss)
Ours (Combined)
(a)
Finetuned without augmentation
(b) Finetumed with augmentation
1.00
1.00
0.75
0.75
(1) Brightness
0.50
0.50
0.25
0.25
0.00
0.00
1.0
1.2
1.6
1.8
2.0
1.0
1.2
1.4
1.6
1.8
2.0
1.00
TPtt@ 1865P
0.75
0.75
(2) Contrast
0.50
0.50
0.25
0.25
0.00
0.00
1.00
1.00
(3) Kernel
0.50
0.50
0.25
0.00
0.00
5
10
15
10
15
1.00
TPR01 SEFP
0.75
0.75
(4) JPEG
0.25
0.25
0.00
1.00
1.00
TPR81 1RFPR
5 Noise
0.50
0.50
0.00
0.00
0.00
0.05
0.10
0.15
0.20
0.00
0.05
0.10
0.15
0.20
TPR@ 155FFR
0.75
0.75
Resize
0.25
0.25
0.7
0.6
0.5
0.9
0.8
0.7
1.00
1.00
TRRI1377
0.75
(7) Saturation
0.50
0.50
0.00
0.00
1.0
1.5
2.0 Strength
2.5
3.0
1.0
1.5
2.0 Strength
2.5
3.0
Figure A3: Robustness Test for Taming on common image post-processing techniques.
22

---

Published as a conference paper at ICLR 2026
achieves high TPR @ 1%FPR for most attacks, outperforming the three baseline methods by large margin, especially after finetuning with augmentations. Meanwhile, we also observe an interesting fact that attribution by EncLoss performs worse after the augmentation. Here, provide an intuition on why finetuning with augmentations works better for Quantl but worse for Encl.ss Loss.
The improved performance of QuantLoss after finetuning with augmentation be attributed the loss Limy in Equation (6). where we optimize D-1 to reconstruct the original feature map. On the finetuning setting without augmentations, the loss can be rewritten as:
Lave llfz D (img)ll2.
(12)
where img is the initial image reconstruction D(fz)- When training with augmentations, the aug- mentations are applied to img, which leads to an augmented version of our loss function:
iiv llfz - D- (Aug(img)]l2
(13)
Here, we want to invert an augmented, generated image to the feature map fz. Therefore, the tokens can still be well reconstructed for belonging images even after augmentation, which leads to the better performance of our QuantLoss.
However, the target feature map fz is the original un-augmented feature map. When optimize D- to reconstruct fz. the D(D (Aug(img)) becomes closer to the un-augmented image img. As result, actually train D-1 to "remove" the augmentation and increase the loss for the EncLoss, as the loss for belonging images is now the loss the augmentation:
Line = || Aug((mg) imgl12.
The EncLoss distributions of belonging and non-belonging images are now more overlapping, lead- ing to lower TPR @1 1%FPR. Due construction of LCamb, the overlapping distributions of the EncLoss have a negative impact on the combined provenance signal. Therefore settings, where robustness is critical, the QuantLoss provides reliable provenance signal.
I AE ATTRIBUTION AR ATTRIBUTION
In this work, we choose to attribute images to the autoencoder (AE) instead of the autoregressive (AR) model. We think AE attribution more important than AR attribution for IAR data provenance for the following reason: if different AR models are based on the same AE model and training data, they are essentially trained on the same token sequence. Those token distribution, they have similar probabilities of generated image. Therefore, find more significant to detect that an image is from the autoencoder of given IAR.
models are trained to fit the same
BAR Generated
KAA Geownoodd
BAR Generated Taaxing Racazatructed
RAR Geseroodd Taxing Recosalmectdd
Imavpeloe
Percnntage (90)
QuantLoas
Quantloas
(a) Attributing images with Taming AE
(b) Attributing images with RAR AE.
Figure A4: Only the final AE decoding is significant for AE attribution. We analyze the setting of 1. Taming Generated + 2. RAR Encoded + Generated and vice versa.
We analyze the AE attribution in Figure A4 and observe that only the final AE generation is signifi- cant for attribution. Specifically, generate 1,000 token maps with the underlying AR model (e.g..
23

---

Published as a conference paper at ICLR 2026
RAR). These decoded with the RAR decoder yielding the blue distribution in Figure A4b with a low QuantLoss. However, we can observe that the setting of Generated by RAR - then Encoded Generated by the Taming AE, there is a clear distribution shift (green) such that the images longer attributed as belonging to RAR but to Taming.
This occurs due the different codebook Z and latent space of different AEs, where the original signal by the first AE (e.g., RAR) overwritten by the signal of the second AE (e.g.. Taming). The image originally constructed of the first codebook is now reconstructed by the second codebook removing the traces of the first.
J EXTENDED RESULTS WITH MORE CONFIGURATIONS
We show an extended version of our main results in Table A5 for all single-scale mod- els and in Table A4 for all multi-scale models. We use different colors for the baselines; Reconstruction, AEDR and Laten'Tracer. our
EncLoss and QuantLoss and our
Combined Loss
Table A4: TPR@ @ % FPR (%) for multi-scale IARs under different settings. Here, the belonging images are generated by the model specified in the first column, and the non-belonging images are from natural image datasets generated by the other IARs. "Double Ratio" denotes the ratio between the losses of the first and second reconstruction. "FT"" denotes using the finetumed decoder inversion.
Model
Method
FT
Double
Naturl
Generated
ImageNer
Taming
Intinit
vQDdf
LiteutTracer
12.0
0.2
3,6
0.1
15.4
1533
3.6
1.6
0.0
Reconstraction
50.6
x
2.3
2.9
6.6
0,3
177
0.0
10.5
10.4
32.7
12.2
47.5
3.8
15.0
3.8
36.5
33.5
x
EncLoss
5.0
VAR
31.8
21.7
1.4
100.0
1000
99.7
2.0
0.5
0.0
4.5
2.1
QuantLoss
16.1
37.7
39.0
0.0
20.0
0.0
97.4
96.0
5.6
7.1
688
4.9
0.6
9.5
6.8
QuanLoss
2.5
6.6
2.3
95.0
92.9
94.4
89.8
94.5
88.4
95.7
95.2
10.3
2.0
14.1
1.0
1500
3.3
8.6
6.3
Combined
LatentTracer
0.0
10.9
51.7
0.2
0.0
5.8
5.3
Reconstration Loss
0.1
0.1
51.6
17.5
1.6
Infinity
0.2
0.8
0.0
0.0
0.0
0.2
0.3
EacLoss
0.9
11.3
12.3
0.1
1.0
0.1
2.1
4.2
4.5
08.9
0.6
0.0
16.6
0.0
1.3
0.0
2.8
0.0
QuantLoss
0.4
99.4
85.6
90.4
90.2
99.5
90.1
90.4
99.4
0.1
0.0
0.1
0.1
0.7
0.1
0.1
0.1
24

---

Published as a conference paper at ICLR 2026
Table A5: TPR @ FPR (%) for single-scale models under different settings. Here, the belong- ing images are generated by the model specified in the first column, and the non-belonging images are from 3 natural image datasets generated by the other IARs. "Double Ratio" denotes the ratio between the losses of the first and second reconstruction. "FT" denotes using the finetuned encoder.
Rasio
InageNet
LAION
MS-COCO
LlanaGea
RAR
Tunisg
VAR
Infaity
ViDail
Laizaa Tracer
91.5
80.1
97.9
96.3
80.7
96.0
59.0
98.7
34.0
50.7
45.7
Reconcsstionn
55.3
50.5
57.7
98.0
98.3
98.3
98.3
10.0
98.5
99.3
99.2
Lianzateen
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
5.4
9.6
0.5
9.9
27.9
BooiLoss
99.3
81.5
996
99.6
94.2
99.5
903
99.8
2.8
63.4
100.0
100.0
100.0
100.0
QuannLoos
x
68.9
93.5
66.3
76.2
99.9
99.2
99.9
98.1
98.4
97.3
95.2
99.3
100.0
99.4
97.5
97.5
1000
100.0
Cambissal Loss
10000
95.9
99.6
100.0
1000
99.9
1000
90.9
100.0
99.6
100.0
99.9
10000
99.9
100.0
100.0
LaiznTrracer
24.6
3.8
4.1
744
0.8
0.1
5.7
18.1
18.8
Reconstatioon Loos
29.3
16.0
36.0
10.6
2.3
33.9
49.9
27.6
47.9
44.
60.1
36.7
12.2
48.0
72.2
70.4
53.4
63.6
Eazloon
1.0
22.6
21.2
27.3
5.1
2.5
26.0
47.9
44.0
98.2
95.0
98.9
98.5
91.9
95.5
99.5
99.7
$2.7
90.0
90.8
09.9
09.8
90.2
100.0
1000
09.8
90.7
85.9
100.0
05.6
96.2
100.0
100.0
100.0
Conhited
622
100.0
10.0
100.0
100.0
13.4
LatencTracer
73.0
61.0
75.9
16.4
60.3
76.0
85.4
23.5
21.5
22.6
18.9
27.7
1000
46.1
Reconstrotion
80.4
83.5
61.9
90.7
80.7
76.1
91.9
$7.5
77.3
90.7
89.9
00.4
Taring
EocLoss
x
20.5
4.0
14.3
2.8
22.1
2.2
7.2
1.7
14.5
1.7
21.5
1.8
34.6
3.5
38.8
2.6
QuandL.sss
x
38,0
96.1
99.4
4.
68.2
52.1
54.3
2.1
36.5
48.9
46.4
45.8
81.2
64.6
71.5
55.7
99.6
99.5
1000
100.0
100.0
100.0
Combined
8
10000
1000
1000
1000
100.0
100.0
12.5
1000
13.3
1000
LatencTracer
984
97.3
97.9
M5.6
96.5
56/6
1.6
21.2
Remositation
93.6
77.2
87.5
$3.6
60.6
61.3
71.3
71.5
71.0
55.2
76.1
80.0
72.4
51.2
99.7
68.4
87.7
61.9
72.4
92.2
Diffusion
19.0
15.7
5.4
24.6
15.5
14.8
3.5
21.9
34.3
10000
100.0
100.0
09.7
100.0
100.0
100.0
100.0
17.4
40.7
17.0
30.5
19.9
63.1
QuantLoos
100.0
100.0
100.0
100.0
91.1
96.3
07.8
85.8
95.7
9911
1000
1000
1000
100.8
100.0
100.0
1000
Cunhised Loss
1000
96.1
98.4
33.2
1000
$2.9
99.9
78.8
100.0
85.7
65.8
99.9
100.0
83.3
100.
86.1
25

---

Published as a conference paper at ICLR 2026
K MAIN OBSERVATION
Our initial observation was that the token representations differ significantly between natural and IAR-generated images. Intuitively, the token representations of generated images are consistently closer to the codebook entries than those natural images (shown in Figure D We compute the token representations for the natural and generated images and compare their distances to the closest token representations in the codebook. We present the results in the table below.
Table A6: Distances between token representations and codebook entries for generated vs nat- ural images. We use the MS-COCO dataset as natural images (denoted Natural) and the images generated by given model (represented as Generated). We compute the distances in the le norm.
Model
Natural
Generated
LlamaGen
0.0108 (1:0.000)
0.0033 (1:0.001)
RAR
0.3942 (+0.030)
0.1538 (=00037)
Taming
0.0225 (+0.002)
0.0094 (#0.003)
VQ- DD-Diffusio
0.0216 (#000033
0.0086
(#00002)
Infinity
0.0116 (+0.0000)
0.0109
(+-0.000)
VAR
0.1381 (+0.006)
0.1075 (++0001)
L ROBUSTNESS ON MORE DATASETS
In addition the robustness evaluation in Table 2 we show extended version of robustness evaluation across more datasets in Table[A7] We show that our method outperforms the baselines by a very large margin after image post- post-processing, validating the universal robustness of our approach.
M COMPREHENSIVE ANALYSIS ON MORE METRICS
Additionally to our T 1FPPR, we report the TPR for the baseline methods and our methods at stricter FPR values (0.5%FPR in Table A8 and 0.1%FPR in Table A9 well the AUC in Table A10 ROC plots for RAR compared to the baselines are illustrated in Figure A5 When evaluated under more strict settings in Table A8 and A9) baseline methods have very limited performance in most cases, while our methods perform consistently well. The AUC and ROC results in Table A9 and Figure A5 show that our method strictly outperform all of the baselines for all models and non non-belonging datasets.
N GENERALIZATION ACROSS HYPERPARAMETERS AND DATA SPLITS
To demonstrate the generalization of our method, we provided further experiments where the con- ditional guidance scales and sampling temperatures different during generating fine-tuning and evaluation sets. We use CFG=4 and temperature=1.00 for generating the fine-tuning set. The re- sults in Table ATT show that method achieves high performance across different CFG (3,4,5) and temperatures (0.8, 1.0, 1.2). In addition, we performed an experiment for class split, where separated the data used to fine-tune the inverse decoder according to the classes. Specifically, we use the first 500 classes for the model to generate the fine-tuning set and use the remaining 500 classes for evaluation, ensuring that the model can not overfit on the distribution. In Table A12 we denote this as Ours (class split) and our standard fine-tuning as Ours (random split). We report the TPR@ I FFPR of belonging vs non-belonging data. The results show that our method performs consistently well across the two settings and outperforms the baseline methods significantly.
O EVALUATION OF DIFFERENT CODEBOOK DISTANCE METRICS
For QuantLoss, we use the L2 norm following the original quantization algorithms in LARs. We show in Table A13 that using cosine similarity yields similar results as the 1.2 norm. Our key
26

---

Published as a conference paper at ICLR 2026
Table A7: TPR @ FPR (%) under different post-processing image transforms and differ- ent datasets. The first column indicates the evaluated transform and the strength of the transform. The second column indicates the evaluated method. The model RAR, the belonging data is gen- erated by RAR, and the non-belonging data is denoted in the table heading.
Natural
Generated
Transform
Method
ImageNot
LAION
MS-COCO
LlanaGrn
Taming
VAR
Infinity
VQDur
Reconstructin
2.3
0.8
0.0
0.9
1.3
13.3
Noise=0.05
Laten/Tracer
3.4
0.7
3.8
0.0
0.1
1.4
10.7
7.2
AEDR
7.3
4.7
4.4
0.5
4.6
13.7
5.5
Ours
87.8
82,3
94.6
75.2
65.4
90.3
95,9
93.1
Reconstruction
3.0
2.1
3.3
0.4
0,1
2.8
5.9
Kernet=9
Laten/Treer
4.7
2.1
0.4
0.1
3.1
12.4
7.5
AEDR
11.4
5.0
13.8
2.5
0.5
9.9
18.9
12.0
74.1
78.3
Reconstruction
3.6
2.3
0.5
0.0
2.1
11.4
12.1
JPDG-60
Laten/Tracer
4.8
3.5
0.1
0.0
2.8
15.9
15.4
AEDR
8.9
5.4
18.5
2.4
0.3
6.8
29.1
11.9
Ours
96.1
94.1
98.8
90.3
83.3
98.1
98.9
98.5
Reconstruction Laten/Tmeer
1.4
0.5
0.1
1.2
Brightnsss=1.. 1.6
2.3
1.0
0.0
0.0
1.7
3.7
AEDR
1.9
0.5
0.5
1.1
92.3
75.6
60.4
94.0
96.1
Reconstruction
1.6
2.2
2.8
0.0
0.0
1.6
5.5
7.7
Laten(Tracer
3.0
1.8
0.1
2.2
Contrast22.0
AEDR
1.4
0.8
2.4
0.9
0.3
2.4
3.9
3.2
Ours
91.1
83.7
98.1
74.3
63.7
92.1
95.1
94.6
Reconstruction
3.1
2.2
0.4
0.1
1,3
Laten(Tracer
3.6
3.7
8.2
0.2
0.0
3.4
14.5
14.5
Saturation=2.0
9.5
5.5
99.2
99.7
99.5
98.8
99.8
99.8
Reconstruction
1.0
1.9
4.5
0.9
0.0
2.4
9.9
10.0
Resize=4).5
LatenTTrace
AEDR
0.2
1.5
9.7
0.8
0.3
9.1
10.8
11.6
Ours
98.4
98.6
99.5
96.9
93.3
99.3
99.7
99.4
finding is that belonging images are closer the codebook entries compared to non-belonging images, where two distance metrics can both capture the distance difference.
P COMBINING STRATEGIES FOR QUANTLOSS AND ENCLOSS
Cal is ratio, a multiplicative combination treats it as a scaling factor. We Since our EncLoss Frce
provide an ablation study comparing additive versus multiplicative combinations, as well as the use of learned weights in Table A14 For both addition and multiplication, we combine the two losses the weighted scenarios, we determine optimal weights
with the respective arithmetic operation. for EncLoss by keeping the weight for the QuantL fixed. For Addition Weighted we determine calibration set:
the optimal weight w Wene for EncLoss via grid search by leveraging ImageNet search 1,000 evenly spaced values between 0.001 and and another 1,000 values between I and 1,000. For Multiplication Power, the weight is used as an exponent, and we apply a grid search over 1,000 values between 0.01 and 10.
ADDITIONAL BASELINE OF GENERAL AI DETECTION
To provide additional baseline methods, we evaluate a state-of-the-art Al-generated image detection methods, specifically AIDE (Yan et al. 2025) and a detection method carefully crafted for IARs called DAQE (Zhang et al. 2025). ) We leverage the provided pre-trained weights for each method and report the results of AIDE in Table A15 and D in Table A16 We use 1,000 images as belonging and 1,000 images non-belonging datasets. We note that AIDE has very limited per- formance for detecting IAR -egggeneete images, and both approaches have an even worse performance to distinguish data generated by different models.
27

---

Published as a conference paper at ICLR 2026
Table A8: TPR@0.5% FPR our method and the baselines. The first column indicates the origi- nal model that has generated the belonging images, the heading of the other columns specifies the natural datasets or generators from which the non-belonging images are obtained. Our method is instantiated with the best-perforning of signals from Section 3.3 for each original model.
Model
Method
Natural
Genemnted
ImageNet
LATON
MS-COCO
LlamaGen
RAR
Taming
VAR
Infinity
VQDiff
Reconstrution LatenTTmcer
23.4
25.0
30.6
30.4
2.1
31.4
61.8
60.4
LlamaGin
89.7
82.7
93.6
94.6
72.5
95.1
98.8
98.0
ABDR
Reconstruction
RAR
AEDR
atterTmacer
13.6
2.2
15.1
1.0
30.0
2.2
0.2
4,0
0.0
0.8
22.5
2.1
42.4
7.7
17.2
5.3
Ours
99.9
100.0
100.0
99.9
98,9
99.9
100.0
100.0
Reconstruction
17.3
18.7
22.2
6.5
18.4
25.2
39.5
45.0
Taming
69.8
100.0
AEDR
75.8
61.7
88.7
51.8
79.8
73.3
88.6
80.0
Ours
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
Reconstruction
0.5
0.5
2.1
0.1
1.4
0.0
5.4
4.0
LatentTmcer
8.4
0.1
0.0
AEDR
10.9
45.3
4.1
22.6
3.9
33.1
40.4
Ours
100.0
100.0
96.8
100.0
99.6
100.0
100.0
Reconstruction
0.0
0.3
0.0
0.0
0.0
0.2
0.2
Infinity
LatentTmoer
0.0
6.5
25.8
0.0
0.D
0.0
1.6
3.6
ABDR
Reconstruction
4.5
0.5
VQ Diffisiusion
LatentTacer
95.0
90.9
97.4
96.1
97.7
88.9
9W.2
9W.4
AEDR
82.7
43.1
87.3
71.0
91.7
60.0
80.2
74.8
Ours
100.0
98.7
100.0
93.3
100.0
99.6
100.0
100.0
Table A9: TPR@0.1 FPR our method and the baselines. The first column indicates the origi- nal model that has generated the belonging images, the heading of the other columns specifies the natural datasets or generators from which the non-belonging images are obtained. Our method is instantiated with the best pest-performing.o set of signals from Section 3.3 for each original model.
Model
Method
Natural
Generated
ImageNet
LAION
MS- AS-COCO
LlamaGen
RAR
Taming
VAR
Infinity
VQDiff
Recomstuction
13.2
15.4
18.5
17.2
0.3
21.9
47.3
17.9
LlamaGen
LatentTmncer
79.7
75.1
85.9
90.0
63.5
89.3
95.4
91.8
AEDR
45.4
Ours
100.0
100.0
Reconstruction
RAR
AEDR
LatentTracer
0.4
1.4
9.1
0.9
0.0
0.0
0.0
0.0
16.6
0.7
6.7
0.4
2.6
Ours
99.9
99.9
100.0
96.9
54.1
99.9
100.0
100.0
Reconstruction
11.8
11.0
12.9
3.0
12.7
19.1
30.7
16.4
Taming
AFDR
58.3
35.6
68.1
30.9
75.5
55.2
73.7
76.3
Ours
100.0
92.6
100.0
100.0
100.0
100.0
100.0
100.0
Reconstrutiinn
0,3
0.2
0.4
0.0
0.5
0.0
1.9
0.3
LatenfTrncer
3.4
0.0
0.0
2.4
AFDR
29.5
0.6
25.4
Ours
99.6
86.3
99.8
95.8
100.0
98.9
100.0
100.0
Recomstuction
0.1
0.0
0.0
0.0
Infinity
LatentTracer
0.0
0.1
7.1
0.0
0.0
0.0
0.9
0.5
AFDR
31.2
Reconstruction
VQ- Diffusion
LatentTracer
91.8
86.3
95.0
92.5
96.0
78.4
97.2
96.9
AEDR
51.9
20.7
59.1
32.2
76.9
48.0
57.5
Ours
99.9
55.6
100.0
84.8
100.0
99.0
99.5
100.
28

---

Published as a conference paper at ICLR 2026
Table A10: AUC our method and the baselines. The first column indicates the original model that has generated the belonging images, the heading of the other columns specifies the natural datasets or gemerators from which the non-belonging images are obtained. Our method is instantiated with the best-performing set of signals from Section 3.3 for each original model.
Model
Method
Natural
Genemttd
ImageNet
LAION
MS-COCO
LlamoGen
RAR
Taming
VAR
Infisity
VQDIff
Reconstruction
LlamaGen
LatewTracrr
99.7
99.6
99.9
99.8
98.8
99.8
99.9
99.9
AEDR
94.7
94.1
94.7
95.7
95.2
95.2
96.1
96.0
Ours
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
Reconstmuction
76.5
74.5
82.5
66.6
49.7
81.2
86.5
RAR
LatenTracer
AEDR
73.2
90.2
86.2
70.6
89.3
78.0
57.0
87.6
38.6
82.9
67.2
89.2
85.3
93.4
92.0
83.7
Ours
100.0
100.0
100.0
100.0
99.8
100.0
100.0
100.0
Reconstruction
96.8
82.9
88.3
80.5
84.6
87.1
89.9
92.3
Taming
Laten/racer
95.6
AEDR
98.7
98.5
99.1
97.2
99.0
98.8
99.5
99.1
Ours
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
Reconstrution
64.1
58.1
69.0
50.3
58.9
40.4
69.5
70.4
VAR
ABDR
LatenTTnee
80.6
72.6
84.9
68.3
77.5
61.5
82.2
82.9
100.0
100.0
Reconstruction
Infiniry
LatewTraeer
62.7
91.6
94.6
53.0
$0.6
54.2
62.5
61.6
ABDR
86.2
97.2
98.9
81.5
82.7
85.5
91.1
86.7
Ours
99.8
98.8
99.7
99.6
100.0
99.7
99.9
99.7
Reconstmuction
90.7
84.3
91.9
88.9
88.5
79.2
92.4
VQ-Diffnsion
LatewTracer
99.9
99.9
99.9
99.9
99.6
100.0
100.0
AEDR
99.5
98.5
99.5
99.2
99.8
99.2
99.1
99.5
Ours
100.0
99.8
100.0
99.9
100.0
100.0
100.0
100.0
Table A11: TPR @ FPR (%) with different conditional guidance scales and sampling tem- peratures. The evaluated model is RAR (Combined), and the inverse decoder finetuning data is
generated with CFG=4 and temperature=1.0.
Natural
Generated
CFG
Temperature
ImageNet
LAION
MS-COCO
LlamaGen
Taming
VAR
Infinity
VQDiff
99.7
99.8
99.7
99.6
99.4
100.0
99.8
100.0
100.0
100.0
100.0
99.5
100.0
100.0
100.0
1.2
99.9
99.9
100.0
99.8
99.8
99.9
100.0
100.0
0.8
99.5
99.8
99.8
99.3
99.4
99.5
99.8
99.9
99.9
100.0
100.0
99.6
100.0
99.5
98.8
100.0
100.0
100.0
0.8
100.0
99.6
100.0
99.5
98.8
100.0
100.0
100.0
1.0
99.9
99.0
100.0
98.4
98.9
100.0
100.0
100.0
99.4
100.0
To further evaluate against AIDE, we re-train their model for epochs 50k images. Impor- tantly, AIDE's training set includes both generated (belonging) and real images, giving it access additional natural image data that our method does not use. Despite these advantages, the re- sults shown in Table A17 demonstrate that our method still substantially outperforms AIDE. While AIDE achieves relatively strong performance the natural vs. generated setting, it fails in the more critical setting of attributing generated image to specific model. For instance, for RAR, AIDE achieves only 25.9-73.2%% TPR @ 1%FPR in distinguishing images from other IAR models, whereas method achieves near-perfect 99.9% 9%0000%% TPR @ F&FP across all model pairs.
We note that general AI detection methods consider general distinctions between generated and real images, but do not leverage specific artifacts in different IARs and thus fail to attribute image to a specific model family. However, we utilize the codebook of IARs as the inherent "fingerprint" of the model. Therefore, method outperforms the general AI detection method significantly.
29

---

Published as a conference paper at ICLR 2026
ImageNet
Infinity
1.0
1.0
True Positive Rate
0.8
0.8
0.6
True Positive
0.6
0.4
0.2
Daze (ACC-1 (60)
0.2
MUCH L000
ABSR oiii 9E1
LeaeEirsoe (CDD-62222
Lateastraae +0833)
0.2
0.6 Positive
1.0
(c) LAION
(d) LlamaGen
1.0
0.8
True Posilive Rate
0.6
True Positvve
0.6
0.4
0.4
Buz (iCC-1 0081
Cura LAUC- 1006
LeveSireeee WCDD-6.00
LatesiTroce -0.7-
0.0
0,2
0.6 False Positive Rate
0.4
0.8
1.0
0.0
0.2
0.4
0.6
0.8
1.0
False Positive Rate
(e) MS-COCO
(l) Taming
1.0
1.0
0.8
Trus Positive Rate
True Ponitive Rate
0.6
0.6
0.4
0.4
0.2
0.2
AEDA
Iecsunceaiie AUC-6 822)
Recssccaailen (UC--E-80
0.0
0.2
0.4
0.8
1.0
0.0
0.2
0.6
0.8
1.0
False Positive Rate
False Positive Rate
(g) VAR
(h) VO-Diffusion
1.0
1.0
0.8-
0.8
True Positive Rate
0.6
True Positive
0.4
0.2
0.2
AEDAMADC -0.921
Iecsorcaaiio (3CC-8734)
0.6
1.0
False Positive Rate
False Positive Rate
Figure A5: ROC comparison for RAR attribution of our method and the baselines.
R ADAPTIVE ATTACK
Our method is primarily designed for the benign setting, where model owners leverage our frame- work to prevent model collapse and ensure responsible deployment of their trained models. How- ever, to assess the robustness of our approach, we also consider a more challenging adversarial scenario where malicious model owner intentionally attempts to evade detection mechanism.
Threat Model. In this adaptive attack scenario, we assume the adversary has knowledge of our methodology. The adversary's 's goal is to craft adversarial perturbations that increase the distance
30

---

Published as a conference paper at ICLR 2026
Table A12: TPR@ @ FPR (%) of our method evaluated with two types of data split. The first column indicates the original model that has generated the belonging images, the heading of the other columns specifies the natural datasets or generators from which the non-belonging images are obtained. We denote two splits for Ours, random split, where we create training and validation data from the same classes and class split, where we create training data using the first 0-499 classes and validation data using the final 500-999 classes.
Model
Method
Natural
Generatod
ImageNet
LAION
MS-COCO
LlanuGen
Taming
VAR
Infinity
VQDU
Reconsiruction
5.7
Latent Tracer
6.0
15.2
D.D
9.3
24.6
26.9
RAR
AEDR
29.5
16.6
36.6
10.6
2.3
35.9
49.9
27.6
Ours (random split)
100.0
100.0
100.0
99.9
99.9
100.0
1000
100.0
Ours (closs split)
99.8
99.9
1000
99.7
99.7
100.0
Reconsiruction
27.5
21.5
27.6
10.1
18.9
27.7
39.0
16.1
Trace
73.0
61.0
75.9
36.4
66.8
76.0
85.4
87.4
Taming
AEDR
78.1
(random splat)
Ours (class split)
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
Recenstraction
1.4
1.4
3.6
0.1
1.6
0.0
5.9
5.9
Latent Tracer
12.0
5.6
15.3
VAR
AEDS
29.1
15.7
50.6
14.7
28.3
14.0
37.5
50.8
Ours (random splat)
100.0
99.2
100.0
99.2
100.0
100.0
100.0
100.0
Ours (class split)
99.9
98.9
1000
99.4
100.0
99.1
1000
99.9
Table A13: TPR@ 1%FPR (%) comparison when using different distance metrics. The evalu- ated model is RAR.
Natural
Generated
Distance Metric
ImageNet
LAION
MS-COCO
LlamaGen
Taming
VAR
Infinity
VQDiII
Cosine Distance
100.0
100.0
100.0
100.0
99.9
100.0
100.0
100.0
1.2 Norm
100.0
100.0
100.0
99.9
99.9
100.0
100.0
100.0
between the feature map of a generated image and its corresponding codebook entries, thereby causing belonging images to be misclassified non-helonging images.
Attack Formulation. Specifically, the adversarial model owner finetunes an inverse decoder and performs adversarial attack belonging image by minimizing the following adversarial loss:
Casy (z. 8, D- - -I) - (Q(D= + ||00|2.
(14)
where 5 denotes the adversarial perturbation and À controls the trade-off between attack effective- ness and perturbation magnitude. The adversarial sample is constructed Tadv 5. This loss function aims to maximize the Quantl while constraining the perturbation to remain impercep- tible.
Results and Analysis. The results are presented in Table A18 We evaluate our method under 1/255 and 2/255. Several key observations emerge from these experiments: First, finetuning with augmentation significantly improves robustness against adaptive attacks. We attribute this the fact that augmentation-basee training enables the inverse decoder to recover the original tokens robustly even under image degradations, which also generalize to resilience against adversarial perturbations. Second, our method demonstrates strong robustness to relatively small adversarial perturbations (e = 1/255), maintaining high TPR @ F%PP across most datasets when finetuned with augmentations (e.g., 97.4% on ImageNet, 96.7% on LAION). Third, ingmennatton-basee approach retains considerable
two attack strengths:
under stronger attacks (e 2/255), detection capability (e.g., 49.3% on ImageNet, 51.1% on MS-COCO), substantially outperforming all baseline methods. Notably, the baseline methods show very limited robustness even to weak attacks which are not even tailored to attack them. The TPR 1%FPR for baseline methods drops below 20% in most cases for 2/255.
These results demonstrate that while adaptive attacks can degrade detection performance, our frame- work maintains significantly better robustness compared to existing methods, particularly when
31

---

Published as a conference paper at ICLR 2026
Table A14: TPR@1 FPR for different combination methods. The first column indicates the original model that generated the belonging images, the second column shows the combination method used. The heading of the other columns specifies the natural datasets or generators from which the non-belonging images are obtained. The last column shows the optimized weight Eno for parameterized methods.
Model
Mathod
Natral
Generated
InogehNi
MS-0000
Tiring
Infinity
ViDee
Adiiiion Addition Winghtdd
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100C
LianoGen
Multipliction
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
1000
1000
100.0
0,00
Multilicatiion Power
100.0
100.0
100.0
100.0
100.0
100.0
1000
100.
0,01
Addition
99.3
99.2
99.5
97.7
98.9
99.6
99.6
RAR
Muttipäcation
Adéition Winghtdd
100.0
100.0
100.0
99.8
100.
100.0
95.8
99.9
99.3
99.9
100.0
99.3
100.0
1000
1000
100.0
0,00
Multylicaikon Power
100.0
99.8
100.0
92.8
99.3
99.9
1000
100.
0,01
Addition
100.0
100.0
100.0
100.0
100.0
100.0
1000
100.0
Tuning
Addiioo Weighned
Multiplictiion
100.0
100.0
100.0
99.8
10000
100.0
100.0
99.9
100.0
1000
100.0
1000
100.0
1000
100L0
100.0
0,00
Multiplictionn Power
100.0
99.6
100.0
99.9
100.0
100.0
100.0
100.0
0.27
VAR
Muhtjpication
Addition Weighted
100.0
100.0
89.5
99.3
100.0
100.0
9922
100.0
100.0
100.0
100.0
1000
100.0
10000
0.00
Multipiiatioon Powser
100.0
99.3
100.0
99.2
100.0
90.5
1000
100.0
0.30
Infinity
Multiplicttion
Adiiiion Weighted
09.2
4.1
99.1
77.4
Muhtipicaiion Power
99.3
97.8
99.4
99.1
99,4
99.1
99.3
99.2
0,01
100.0
100.0
vQ
Multiylictiinn
Weighted
100.
Mulliplication
100.0
100.0
100
The performance of AIDE data provenance. We present TPR @ 1&FP across all test datasets for each model. The first column indicates the original model that has generated the belonging images, the heading of the other columns specifies the natural datasets or generators from which the non-belonging images are obtained.
Table A15:
Model
Natural
Generated
ImageNet
LAION
MS-COCO
Maaaaen
RAR
Taminn
VAR
Infinity
VQDiff
LlamaGen
18.8
23.2
0.5
3.3
6.5
RAR
27.9
26.8
30.6
5.2
4.5
9.6
15.2
15.9
Taming
29.4
25.8
34.3
1.4
0,2
4.3
8.8
9.5
VAR
18.4
0.2
3.7
Infinity
5.6
4.6
7.4
0.0
0.0
0.0
0.5
1.2
VQ-
10.3
9.2
13.1
0.0
0.0
0.0
0.2
0.7
trained with augmentations, The robustness to adaptive attacks makes our method practical lution even in the more challenging adversarial scenarios.
EVALUATION MULTI-SOURCH DATASET
To simulate real-world scenario where images come from different sources, design multi- source evaluation setting. In this setting, we mix and shuffle all the evaluated images in our exper- imental setting, including different natural datasets (ImageNet, MS-COCO. LAION) and images generated by 6 different models (LlamaGeen, RAR, Taming, VAR, Infinity, VQ-Diffusion). The re- sults Table (А9 show that our method achieves near-perfect TPR FPR on the multi-source dataset across all the evaluated models, demonstrating the applicability of our method.
T STATISTICAL TEST OF OUR METHOD
We test a data point x significantly deviates from a given belonging distribution. ilar to RONAN (Wang al. 2023 and LatenfTracer (Wang et al. 2024) leverage
Sim-
32

---

Published as a conference paper at ICLR 2026
Table A16: @ FPR (%) our method and DºQE. The first column indicates the original model that has generated the belonging images, the heading of the other columns specifies the natural datasets or generators from which the non-belonging images are obtained.
Natural
Generated
Model
Method
ImageNet
LAION
MS-COCD
LlamaGen
RAR
Taming
VAR
Infinity
VQDiff
D Ours
86.9
67.7
60.1
LiamaGian
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
D
78.0
49.7
77.5
0.0
42.2
RAR
Ours
100.0
100.0
100.0
99.9
99.9
100.0
100.0
100.0
Taming
D
78.0
49.7
77.5
0.0
0.2
0.2
42.2
0.4
100.0
D
73.5
52.2
72.3
0.0
3.5
1.4
46.7
2.3
VAR
Ours
100.0
Infinity
D
6.3
1.5
0.0
0.0
Ours
99.4
83.6
99.4
99.2
99.5
99.1
99.4
99.4
VQDIfT
QE
31.6
49.2
0.0
Ours
100.0
99.4
100.0
99.9
100.0
99.9
100.0
100.0
Table A17: TPR @ 1% FPR for AIDE Yan et al., 2025) trained on different datasets. The first column indicates the model, the second column shows the finetuning set used.
Pinmaning
Inoqe:Net
LAKON
MS-COCO
LlannGinn
BAR
Taming
VAR
Inintyy
VQBai
BAR
AIDE
RAR Generatod MS-COCO
RAR Gencratod ImageÑNe
91.7
99.7
99.4
98.6
108.0
108.0
41.7
73.2
25.9
53.7
30.0
48.8
108.0
99.5
549
66.7
(Canenteel)
Llasages
AIDE
Limann Gengrated MS COCO
L.mmagm (Gesenaad)) + ImsagaNat
86.5
99.2
09.8
02.1
108.0
59.9
43.2
70.4
13.1
15.5
62
311
99.8
00.
40.1
Table A18: Evaluation under adaptive adversarial attack. The evaluated model RAR and denotes the strength of the attack.
Natural
Generated
Method
ImageNer
LAION
MS-COCO
LlamaGen
Taming
VAR
Infinity
VQDiff
Reconstraction
2.5
3.0
6.9
0.2
0.0
2,3
16.5
16.0
Laten/Tracer
1/255
AEDR
18.9
13.4
30.1
74
144
22.6
42.3
22.8
Ours (Finetuned wio
68.7
76.3
76.6
57.3
49.0
69.2
84.6
86.9
Ours (Finctuned w/ Aug)
97.4
96.7
97.7
90.2
73.6
96.3
99.0
98.9
Reconstruction
1.4
1.8
4.5
0.4
0.0
1.3
13.6
12.5
2/255
AEDR
10.7
6.9
18.2
3.2
0.2
14.1
28.7
14.4
Ours (Pinctuned wio Augi (Pinetuned Aug)
0.3
0.6
0.6
0.0
0.0
0.3
1.9
2.8
Table A19: Multi-source attribution performance across difference models. We present TPR@ %FPR where all non-belong datasets are mixed for a given model.
Method
LlamaGen
RAR
Taming
VAR
Infinity
VQ-Diffusion
Reconstruction
28.0
2.3
24.7
0.4
0.0
10.5
LatentTracer
92.8
69.8
0.2
97.3
AEDR
59.4
17.2
80.0
26.9
3.5
84.2
Ours
100.0
100.0
100.0
100.0
99.2
100.0
For this, we formulate the following hypothesis Ha The test sample does not belong the given model. leveraging Grubbs's hypothesis test which
Grubbs' hypothesis test (Grubbs 1949
33

---

Published as a conference paper at ICLR 2026
Table A20: Grubbs' Hypothesis Testing Results. We report the TP, FP, TN, FN, TPR and FPR
for model attribution. We test 1,000 belonging images and 1,000 non-belonging images randomly sampled across all datasets with 0.01.
Model
TP
FP
TN
FN
TPR (%)
FPR (%)
LlamaGen
995
1000
99.5
0.0
RAR
999
1000
99.9
0.0
Taming
1000
999
100.0
VAR
1000
1000
100.0
0.0
Infinity
993
1000
99.3
0.0
VQ-Diffusion
999
1000
99.9
0.0
Table A21: Acceleration options of the optimized quantization (Algorithm 3
The non-
belonging data is from ImageNet. We report the TPR @ I 1%FPR and seconds required per image.
Setting
Iterations
TPR 1%PPR (%)
Time
Default
1200
95.0
8.24s
Less Iterations
100
87.5
0.57s
Accelerated with Torch
1200
94.8
7.79s
rejects Ho if the following incquality holds:
-- N --1
(ta/N,N-2) 2)
(15)
0 VN
V N 2 (Na/N.N-2)
Whereby l and a are the mean and the standard deviation of given belonging dataset, x the queried data sample and N the number of samples of the belonging dataset. In Table we report the result of applying Grubbs' hypothesis test on 1,000 belonging and 1,000 non-belonging samples across all datasets for each model. We find that, for all models, achieve TPR over 99% by only a single false positive for Taming.
U ACCELERATION FOR OPTIMIZED QUANTIZATION
We provide two acceleration options to reduce the latency of the optimized quantization has a rela- tively and report the results in Algorithm 3 First, our algorithm benefits from using quicker engi- neering implementations. By using the Einstein summation convention for calculating the codebook distance and using torch.compile to optimize the calculation of the feature map. These two tech- niques reduced the runtime of our method from 8.24s/image to 7.79s/imaae. The algorithm may be further accelerated with developments in the deep learning toolkit. Second, Our method still maintains high detection performance and can be accelerated a lot with fewer iterations. We show that method still achieves 77.5%TPR @ I % FPR with only 100 iterations. This reduced the runtime from 8.24s/image to 0.57e/image. The results are shown in Table A21
V EVALUATION FOR AR ATTRIBUTION
Although our approach is primarily designed for model family (autoencoder) attribution, we extend our evaluation to AR altribution settings, where multiple AR models share the same AE. We evaluate the following experimental settings.
V.I AR ATTRIBUTION WITH SHARED AE
We first evaluate scenarios where two ARs share the same AE, We consider the following settings within the LlamaGen model family:
34

---

Published as a conference paper at ICLR 2026
Table A22: AR attribution with shared A.. We evaluate two settings where different AR models share the same autoencoder.
Belonging Data Generated by
Non-belonging Data
TPR
Task
AB
AR
Generated by
(%)
LlamaGen-AEr AE-T2I
LlamaGin 121-COCO
LlamaGen-Tal Teee-TT---OOR T2I-COCO
LlamaGien T21 Internal
100.0
Text-to-lmage
LlamaGen- AE-T21
LlamaGen-T T21- Internal
LlamaGen- T21 Internal
IlamaGen F21-C000
100.0
Class to Image
LlamaGen-AEE AE-CC
LlamaGen-L225
LlamaGGen-L
LlamaGen-XI. LlamaGen-1L2255
100.0
JamaaGen-AFCCC
Hamaaen-XXI
LlamaGee-XX XI.
100.0
Table A23: AR attribution with same AE architecture but different AE training data. The AE fine-tuning data and evaluation belonging data are generated by different prompts (Text-to- Image) or different classes CCass-to-Imaago Our method achieves 100% @ 1%FPR both settings.
AE Architecture
Training
Belonging Data
Non-bclonging Data
TPR@ I&FPR
Data
AR
Generated
Generated by
(%)
LlamaGin-AAF LlamaGen-AE
COCO and Internal
LlamaGen-TT G2n- LlamaGen-C21
LlamaGen-TT LlamaGen-C21
LlamaGen- C21
100.0
ImageNet
LlamaGen-TDD
100.0
LlamaGen Iexatto-Image setting: AR, trained on LAION-COCO while AR₂ trained on 10M internal high-aesthetics quality dataset (Sun et al. 2024 Both models use LlamaGen-AE- T2I as the autoencoder.
2. LlamaGen Class-to-Image setting: AR1 is LlamaGen--- and ARg LlamaGen-X Both models use LlamaGen-AEl AE-C2I as the autoencoder.
The results Table A22 demonstrate that our method achieves 100% TPR@ 1%FPR across all evaluated settings. This shows that fine-tuning the inverse decoder images generated by one AR transformer can also help distinguish from images generated by another AR using the same AE.
V.2 AE WITH THE SAME ARCHITECTURE AND DIFFERENT TRAINING DATA
Although method works very well in the above evaluations, would like point out that many ARs sharing exactly the same AE are less common in real-world scenarios. When model owners adapt an AE for their own task, it is more reasonable for the model owner first train the existing AE on their own dataset, such that the AE performs better on their own dataset. For example, LlamaGen needs to train different AEs for their class-to-image image generation ("AE trained on ImageNet") and text-to-image generation ("AE is trained on 50M LAION-COCO and 10M internal high aesthetic quality data"), as they use different datasets for the two tasks.
We provide the following case to show that our method can perfectly distinguish an AE with the same architecture trained on different datasets. As shown in Table A23] when the AE trained on different data (COCO and Internal for text-to-Image ImageNet for Class-to-Image), method maintains perfect attribution performance.
V.3 AR ATTRIBUTION WITH SHARED AE AND CLASS-SPLIC EVALUATION
To evaluate whether method generalizes beyond the specific classes used during fine-tuning. we design an experiment that combines the shared AE setting with a class-split evaluation setting. We use the LlamaGen Class-to-Image setting where the AE is LlamaGen-AE-Ch AR model A is LlamaGen-L-256, and AR model B is LlamaGen-XL. We construct the following datasets:
DA1: Generated by AR A using classes 0-499
Dzz: Generated by AR A using classes 500-999
DBi: Generated by AR using classes 0-499
Dpz: Generated by AR B using classes 500-999
35

---

Published as a conference paper at ICLR 2026
Specifically, only DAI is used to fine-tune the AE, while DA2, DBI. and Dø2 reserved only for evaluation. This setup tests whether our method can distinguish between AR models A and B on unseen classes. We evaluate three different settings with the above datasets and show the results in Table A24
The results reveal several important findings:
Table A24: AR attribution with class-split evaluation. Settings 1 and 2 evaluate cross-class gen- eralization for AR attribution. The AE is fine-tuned only on DAI (classes 0-499 from AR A), yet achieves 100% TPR@ I &FPP when distinguishing Da2 from Dzi and D22 Setting 3 confirms that the inverse decoder cannot distinguish images from different ARs when both are labeled as be- longing, validating that our signal is AR-specific rather than class-specific.
AE Fine-tuning Data
Labeled Non-belonging Data
@ I%FPR (%)
Setting
AE
Belonging Data
1
LlamaGen-AE-CC. LlamaGen-AF-C2
DAI
Da2
D D
100.0
2
DAI
DA2
100.0
3 LlamaGen-AE-C21
DAI
Dm
D
0.0
Cross-class generalization (Settings 1 and 2). Fine-tuning the AE on DA1 enables the inverse decoder to reliably distinguish A2 (AR A, classes 500-999) from DB and DB2 (AR B, any classes), achieving 100% TPR @ &FPR. This demonstrates that an inverse decoder fine-tuned on certain classes of a given AR model can successfully invert images from other classes generated by the same model. Conversely, it cannot accurately invert images from different AR model, regardless the class.
AR-specificity validation (Setting 3). When we test whether DDi and DB² are distinguishable (both generated by AR B but from different class ranges), the T %FPR drops 0.0%. This confirms that training on DAI does not improve inversion quality for either DBI or Dza, as both originate from a different AR model. This result validates that our method captures AR-specific rather than class-specific patterns.
Implications for model attribution. These results support our design choice of focusing on model family (AE) attribution while demonstrating that finer-gn -eer-grained AR attribution is also achievable. The inverse decoder learns recognize generation patterns specific a particular AR transformer, which generalize across different input classes. This property is desirable for practical data provenance applications, where model owner primarily seeks determine whether an image was generated by their model family, independent of the specific content or class depicted.
W COMPARISON WITH MEMBERSHIP INFERENCE BASELINES
Table A25 We clarify the differences between our data provenance and membership inference tacks (MIAs) in Section 2 and explain that MIAS cannot be applied to our data provenance task because of the additional, over-strict requirements for the labels or prompts In this section, we would like to further explore what could be the upper bound of MIAs if given the additional information of labels for data provenance. Concretely, we provide the MIA-based methods with the ground truth labels for both generated and real images, which are usually absent in the real world. For the images generated by the class-to-image models, we use the conditional inputs directly use the ground truth label.
generated image.
of the models the labels. For the real dataset, ImageNet, Following the experimental setup in our work, we use the images generated by a given model as be- longing images, and the other images, including the generated and natural datasets, non-belonee non-belonging images. We evaluate two MIA-based approaches that the reviewer mentioned: CFG-Diff (Kowal- czuk et al. 2025) and ICAS (Yu et al. 2025). The TPR @ FPPR (%) for the baselines and
36

---

Published as a conference paper at ICLR 2026
Table A25: T I % FPR (%) of method and two baseline methods based on membership inference attacks (MIAs).. The two MIA-based approaches are CFG-Diff (Kowalczuk et al. (025) and ICAS (Yu et al. 2025) The first column indicates the original model that has generated the belonging images, the heading of the other columns specifies the natural datasets or generators from which the non-belonging images are obtained.
Natural
Generated
Model
Method
ImageNet
LlamaGen
RAR
Taming
VAR
CFG-Dift
30.9
96.9
100,0
99.9
RAR
ICAS
99.7
99.9
99.7
Ours
100.0
99.9
99.9
100.0
CFG Difl
2.5
6.2
16.4
54.9
VAR
ICAS
24.4
44.7
Ours
100.0
99.2
100.0
100.0
our method are shown as follows. The results demonstrate that our method outperforms the two MIA-based approaches in nearly every case, without the additional need for the ground truth la- bels. Notably. the two MIA-based approaches have very low performance for VAR. They also have a lower TPR @ &FPR (%) when using the real images as non-belonging data than using gen- erated images, which means that the MIA-based approaches tend to attribute many real images to one of the generative models. the contrary, our method achieves low FPR, no matter what the non-belonging data is.
X LLM USAGE DECLARATION
Large language models (LLMs) were used solely to improve the clarity, grammar, spelling, and style the manuscript. They were not employed to generate original research content, conduct data analysis, or modify the scientific meaning. All substantive ideas, interpretations, and conclusions are entirely those of the authors.
37


Reviews:
[{"review_id": "c9YJLbtdOd", "reviewer": "Reviewer_Rqvo", "summary": "This paper addresses the critical need for data provenance in Image Autoregressive Models (IARs). The authors propose the first post-hoc, model-agnostic provenance framework that requires no modifications to IAR training/generation processes. Specifically, the paper proposes two nove signals for data provenance, which are QuantLoss-based and EncLoss-based, respectively. The QuantLoss-based signal compares the original feature map and re-quantized one of the input image, while the EncLoss-based siganl measures the input image and the re-encoded image. The experiments have demonstrated the excellent effectiveness of the proposed method.", "questions": "Refer to weaknesses.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- Effectiveness: the proposed method requires no modification to the model’s training or generation process and exhibits distinguished performance conpared to current baselines.\n- Writing: the paper is well-written and easy to follow.\n- Holistic Evaluation: the authors evaluate not only detection accuracy but also robustness.", "weaknesses": "- This paper seems to transfer the technique of membership inference to the scenario of data provenance, and the authors need to further clarify the differences between the settings of this paper and those of membership inference.\n- The number of baseline methods used for comparison in the experimental section is relatively few. It is recommended to compare with more baselines, such as [1] and [2].\n- The framework assumes white-box access to the target models. For closed-source IARs, this access may not be available—limiting real-world applicability. The paper does not discuss potential workarounds.\n\n[1] Kowalczuk A, Dubiński J, Boenisch F, et al. Privacy Attacks on Image AutoRegressive Models[C]//Forty-second International Conference on Machine Learning.\n\n[2] Yu H, Qiu Y, Yang Y, et al. ICAS: Detecting Training Data from Autoregressive Image Generative Models[C]//Proceedings of the 33rd ACM International Conference on Multimedia. 2025: 11209-11217.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WvkPkmiu3K", "reviewer": "Reviewer_XMV2", "summary": "This paper proposes a data provenance method for image auto-regressive generation models, based on two carefully designed losses.", "questions": "1) Consider a scenario of adaptive attack, where the model owner is aware of your detector and intends to mislead you. How might he do, and how would you handle it? Could you give some discussion?\n1) Why is the 2-norm used for all distances? Will there be any difference if using other distances?", "limitations": "", "rating": 8, "confidence": 2, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1) Their method does not require modifications to the models or images, and is applicable to already released ones.\n1) Their insight of QuantLoss and EncLoss is intuitive.\n1) They propose an optimized algorithm to address multi-scale VAR.\n1) Their experimental results are excellent, achieving 100% success in most cases.\n1) Their writing is clear and fluent.", "weaknesses": "1) They state that the idea of the two signals is based on their observations, but there is no quantitative presentation of their observations in the main text.\n1) Lack of the formalization of greedy search, as well as the comparisons with Algorithm 3 in terms of performance and cost.\n1) According to Table A3, the cost of Algorithm 3 is relatively high. Perhaps it should be accelerated.\n\nMinor revisions:\n1) The $D^{-1}$ in Line 253 and the $Q$ in Line 270 should be italic.\n1) What are the $R$ in Line 731 and the $t$ in Line 749?\n1) In Table 1, it is difficult to find the boundary between \"Natural\" and \"Generated\".", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rklHLcx7d8", "reviewer": "Reviewer_891z", "summary": "This paper proposes a post-hoc provenance framework for detecting and attributing images generated by Image Autoregressive Models (IARs). The key insight is that IAR-generated images leave characteristic patterns in their token representations due to the quantization process - generated images have feature representations closer to codebook entries than natural images. The authors design two provenance signals: QuantLoss (measuring distance to codebook entries) and EncLoss (measuring encoder-decoder reconstruction error), combined with a finetuned inverse decoder. Experiments on six IAR models (LlamaGen, RAR, Taming, VAR, Infinity, VQ-Diffusion) demonstrate near-perfect detection rates (≈100% TPR@1%FPR) and reasonable robustness to image post-processing.\n\nWhile the empirical results are strong and the problem is timely, the work suffers from limited technical novelty, lacks theoretical depth, and makes strong assumptions (white-box access, per-model finetuning) that significantly limit practical applicability. The core contribution is primarily an engineering adaptation of reconstruction-based detection to the IAR setting.", "questions": "1. How does the method perform when the test images come from different generation settings (different sampling temperatures, guidance scales, or prompts) than the finetuning data? This would test true generalization ability.\n\n2. Can you provide theoretical analysis or empirical evidence on what properties the inverse decoder D^{-1} learns? For example, does it learn to undo specific decoder operations, or does it learn a direct mapping to the codebook?\n\n3. Have you tested adversarial robustness? An adversary aware of your method could potentially add carefully crafted noise to increase QuantLoss for generated images or decrease it for natural images.\n\n4. For the multi-scale VAR model, how sensitive is Algorithm 3 to hyperparameter choices (number of iterations N_{iters}, learning rate, initialization)? The current description is insufficient for reproduction.\n\n5. Why not learn the combination weights between QuantLoss and EncLoss instead of using a fixed multiplicative combination? A learned weighted sum might be more principled.\n\n6. How does the method perform on images that have undergone multiple sequential transformations (e.g., JPEG compression, then resize, then Gaussian blur)? Table 2 only shows single transformations.\n\n7. Can you clarify the finetuning data generation process? Are images generated with the same prompts/settings as test data, or is there diversity? This is critical for understanding potential overfitting.\n\n8. In Table 1, why does the method achieve 100% TPR@1%FPR for most settings but drops significantly for Infinity vs LAION (85.6%)? What is special about this case?\n\n9. The overhead of finetuning is claimed to be \"relatively small\", but 50 epochs on 50K images is substantial. Can you quantify the total computational cost (GPU hours) and compare it to the cost of training the IAR itself?\n\n10. Have you considered zero-shot or few-shot scenarios where only a small number of generated samples are available for finetuning? This would be more realistic for detecting newly-released or proprietary models.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper addresses an important and timely problem. As IAR models gain traction for image generation, reliable provenance methods become critical for combating misinformation and ensuring accountability.\n\n2. The experimental evaluation is comprehensive, covering multiple state-of-the-art IAR architectures (next-token, next-scale, random-order prediction) and demonstrating consistently high detection rates across diverse test scenarios.\n\n3. The post-hoc nature of the approach is valuable - no modification to the generation process is required, making it applicable to already-published content.\n\n4. The paper includes thorough ablation studies (Table 3, Table 4) that validate the importance of different components, particularly the decoder inversion step.\n\n5. Robustness evaluation against common image perturbations (JPEG compression, resizing, noise, etc.) is extensive, with augmentation-based training showing improved robustness.\n\n6. The writing is generally clear and the paper is well-organized with comprehensive appendices.", "weaknesses": "1. Limited novelty. The core idea of using reconstruction error for detecting generated images is well-established. The main contribution is applying this to IARs by exploiting quantization artifacts. While the domain-specific adaptation is useful, the conceptual advance is incremental. The optimized quantization algorithm (Algorithm 3) for multi-scale IARs is the most novel technical component, but receives insufficient analysis.\n\n2. Strong practical limitations undermine the claimed applicability:\n   - Requires white-box access (encoder E, decoder D, codebook Z) to the target model, which may not be available for commercial or closed-source IARs.\n   - Requires per-model finetuning (10-50 epochs, 10K-50K images) despite being called \"post-hoc\". This is computationally expensive and contradicts the claim of broad applicability to \"already published content\" without additional training data.\n   - High computational cost for some models (VAR: 8.249 sec/image, Table A3) limits scalability.\n\n3. Insufficient theoretical grounding:\n   - Why does finetuning the encoder to invert the decoder improve attribution? The paper provides intuition (Eq. 6) but no theoretical analysis of what properties D^{-1} should satisfy.\n   - Why are QuantLoss and EncLoss \"orthogonal\"? Only empirical observations are provided.\n   - The choice of multiplicative combination in Eq. 10 lacks justification. Why not additive or learned weighting?\n   - No analysis of failure modes or theoretical performance guarantees.\n\n4. Experimental design concerns:\n   - The setting is somewhat artificial: 1000 clean images at 256×256 resolution, binary classification against single sources. Real-world scenarios involve mixed resolutions, multiple processing steps, and multi-class attribution.\n   - Finetuning uses generated images from the same distribution as test images, which may lead to overfitting. Cross-distribution generalization (e.g., different prompts, generation hyperparameters) is not evaluated.\n   - Only single performance metric (TPR@1%FPR) is reported. Full ROC curves and AUC would provide better insight.\n   - No statistical significance testing (error bars, confidence intervals) despite stochastic generation processes.\n\n5. The augmentation-based robustness training has concerning properties. As acknowledged in Appendix H, augmentation training improves QuantLoss but degrades EncLoss performance. This suggests the approach lacks principled robustness and relies on dataset-specific overfitting. The explanation provided (training D^{-1} to \"remove\" augmentation) indicates a fundamental issue with the EncLoss design.\n\n6. Limited baseline comparisons. The paper only compares against LatentTracer (diffusion-specific), AEDR (also diffusion-focused), and naive reconstruction. Comparisons with general deepfake detection methods or universal AI-generated image detectors are missing.\n\n7. The AE attribution vs AR attribution discussion (Appendix I) reveals a conceptual issue: the method attributes to the autoencoder, not the autoregressive model. Multiple AR models sharing the same AE are indistinguishable, which is a significant limitation not adequately addressed in the main paper.\n\n8. Presentation issues:\n   - 24-page appendix is excessive; key results (Table A4, A5) should be in the main paper.\n   - Some claims are overclaimed: \"first post-hoc provenance framework\" ignores reconstruction-based methods like RONAN.\n   - Algorithm 3 lacks critical details (learning rate, convergence criteria, initialization strategy).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GvH6DCmXSo", "reviewer": "Reviewer_SetU", "summary": "The paper propose a post-hoc data provenance method for image auto-regressive models (IARs), containing two stages. The first stage is training a inversion decoder to transform the image back to the feature map. The feature maps corresponding to the generated image can correspond more accurately to the codebook. than other images. The second stages  is calculating the metric for distinguishing whether the  image is generated by IARs. The experimental result shows the effectiveness of the proposed methods.", "questions": "1. The difference between *Ours (EncLoss)* in Table 3 and Baseline *AEDR* is that the first one remove $Q$. Could the authors clarify why removing $Q$ leads to better performance?\n\n2. According to the provided code, the random seed is fixed in the script to generate images. Is it the same when generating the evaluation dataset and fine-tuning dataset? Please check if there is a data leakage. Also, could you provide the result on ImageNet, using the first 500 classes for fine-tuning and last 500 classes for evaluation? This can help avoid the data leakage and verify the generalization of the proposed method.\n\n3. Comparison of IAR for belonging and non-belonging with the same VAE. I provide several settings below, but you don’t need to run all of them. Just try one or two, or any other similar configurations you think make sense.\n\n+ Models with difference sizes. For example, VARs have 4 difference sizes, including $d16, d20, d24, d30$. It is possible to compare $d16$ and $d24$\n+ VAR and VAR-CCA [1]\n+ LlamaGen, PAR [2] and LlamaGen-CCA [1]\n+ ……\n\nI would like to verify whether using only the images generated by the AR transformer for fine-tuning the inversion decoder is sufficient to distinguish belonging from non-belonging samples with the same VAE. If this approach proves effective, I would be inclined to raise my score.\n\nFor some other issues, please see \"Weakness\"\n\n[1] Chen, Huayu, et al. Toward guidance-free AR visual generation via condition contrastive alignment. ICLR 2025.\n\n[2] Wang, Yuqing, et al. \"Parallelized autoregressive visual generation.\" CVPR 2025.", "limitations": "", "rating": 4, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "1. The experimental result shows the strong effectiveness to distinguish whether an image is generated by a given VAE decoder.\n2. The EncLoss as a ratio of erros sounds interesting.", "weaknesses": "1. According to the provided code, the $D^{-1}$ is fine-tuned from the encoder. However, this process is not clearly described in the experimental setup. \n\n2. The term “AR” (autoregressive) appears in the paper title and description, but no actual AR transformers are presented in the method. It seems the paper may intend to refer to *Data provenance for **Image VAE Generation*** rather than ***Image AR Generation.*** In the experiments, models with different VAEs are compared, but there are no results comparing AR models using the **same** VAE backbone—for example, VAR-d24 for belonging *vs.* VAR-d30 for non-belonging, or VAR *vs.* VAR-CCA [1]. Since the proposed method itself does not directly involve AR transformers, but only uses the images generated by the AR transformer when fine-tuning the inversion decoder, we cannot be sure whether this is effective in this case. Recent works on membership inference for IARs, such as [2] and [3], might provide relevant perspectives or complementary techniques. These methods calculate the metric using the loss of the AR transformers. It would further strengthen the paper if the authors could discuss their methods with in the Related Work section, and it is better to compare with them.\n\n3. The reported value is too high. The evaluation protocol should therefore adopt stricter criteria, such as TPR@0.1%FPR, to provide a more reliable assessment of model robustness and discriminative power.\n\n4. In line 812, the authors mention using the GPU with 48 GB of memory, while in line 856 it is stated as 40 GB. This inconsistency should be clarified.\n\n[1] Chen, Huayu, et al. Toward guidance-free AR visual generation via condition contrastive alignment. ICLR 2025.\n\n[2] Kowalczuk, Antoni, et al. Privacy attacks on image autoregressive models. ICML 2025.\n\n[3] Yu H, et al. Icas: Detecting training data from autoregressive image generative models. ACM MM 2025.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)