Attribution decay means AI images may have no responsible training source

A new study from MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) introduces a measurable phenomenon the researchers call attribution decay. As the number of training images grows, the influence of any single example on a generated output shrinks, often to the point of being unmeasurable. The finding, published in Nature Communications, provides the first exact method for answering a counterfactual question at the center of copyright litigation: would this model have produced the same output if it had never seen that specific image?

The answer, across seven public datasets and model scales reaching over 160,000 images, is frequently yes. Removing an individual training sample, or every sample from a particular artist or subject, often leaves the generated output unchanged. If an image can be deleted without altering the result, the researchers argue, it cannot be said to have contributed to that result. That logic, applied exhaustively across the entire training set, leads to a conclusion with direct legal and commercial consequences: the generated image may have no attributable source at all.

The technical hurdle the paper overcomes is the retraining problem. Asking what a model would have produced without a given training example normally requires retraining from scratch for each removal, a computationally prohibitive exercise at dataset scale. Prior attribution methods relied on statistical approximations of influence, not actual deletions. The MIT team built a diffusion ensemble architecture that sidesteps the problem. Instead of a single monolithic model, the ensemble consists of many smaller components, each trained on a distinct data slice. To produce a counterfactual, the researchers simply deactivate the components that saw the removed images. No retraining, no approximation, just a genuine what-if model.

The ensemble design held up in head-to-head comparisons with 24 conventional diffusion models trained on identical data. Image quality across standard metrics stayed comparable, and the ensemble models actually proved more data-efficient as the training sets grew. At small data volumes the ensembles performed worse, but that gap closed and reversed with scale. The result matters beyond the attribution question: it suggests the architecture itself is not a compromise for the sake of the experiment, but a viable alternative with its own scaling properties.

With the ablation mechanism working at scale, the team mapped what they call an image’s counterfactual universe, the set of alternate versions produced by removing each piece of training data. The counterfactual radius measures the maximum distance between the original and any of its alternates, capturing the most that any single training example could matter. Across datasets ranging from 256 to over 160,000 images and across pixel-level and semantic distance metrics, the radius shrank along an inverse power law. The larger the dataset, the smaller any individual contribution.

The finding survived stress tests. The team redid the experiment the brute-force way at small scale, training 1,282 separate models, and the decay pattern held. They controlled for the removed fraction, fixed training epochs, tested text-prompted and class-conditioned models, and applied four similarity metrics. The pattern persisted across all conditions.

MIT Professor David Gifford, a CSAIL principal investigator and co-author, frames the result as bearing directly on derivative-works questions. If outputs have nothing to do with any individual training example, that complicates claims of infringement and, separately, raises questions about whether the outputs themselves qualify for copyright protection as novel works. Gifford positions the capability to produce unattributable outputs as an obligation rather than a loophole, arguing that companies claiming their models do not create infringing derivatives ought to adopt methods that can demonstrate that property.

The paper studies diffusion models, the class of generative systems dominant in image, video, and audio production and increasingly used in scientific domains such as protein structure prediction. Whether equivalent attribution decay operates in large language models, the technology at the center of the most prominent copyright lawsuits, is an open question the authors do not answer. The architectural differences between diffusion-based generation and autoregressive text generation are significant enough that a direct transfer of the finding is not assumed.

James Grimmelmann, a law professor at Cornell Law School and Cornell Tech, commented on the paper’s implications for legal frameworks. If attribution worked reliably, he noted, it would distinguish between copying and coincidence when a model output resembles a protected work. The paper provides reason to think attribution will fail for models at the scale now in commercial use, forcing technologists and courts toward other methods for assessing whether copying occurred.