Many images produced by diffusion models cannot be traced back to any specific training example. MIT researchers trained 24 diffusion models themselves and measured, for each generated output, how much of the training data would have to be removed before the output changed. For a substantial share of outputs, the answer was that no removal changed anything, making those images unattributable in a precise technical sense. The effect grew stronger as training sets got larger.
Key facts
- The paper is Outputs of Generative Diffusion Models are Often Unattributable, with the journal version cited on the MIT CSAIL project page as Nature Communications 17, 6974 (2026).
- The researchers computed counterfactual radii across 24 different models they trained themselves, rather than auditing a commercial system.
- Counterfactual radius decreases as training set size increases, which is the trend claim the work actually supports.
- A sample with a radius of zero is defined as unattributable: no ablation of the training data would have prevented it.
The method is the contribution, and it is cleaner than the usual approach to this question. Most attribution work asks which training examples a generated image resembles, which is a similarity question and therefore always arguable. This work asks a counterfactual question instead: if we had removed some of the training data, would this output still have been possible?
To answer it the team trained ensembles of models on different subsets, then measured the distance between a factual sample, the one the full model produced, and the closest thing any ablated model could produce. That distance is the counterfactual radius. A large radius means the output genuinely depended on specific data. A radius of zero means the output survived every ablation, so no training example can be held responsible for it. Our lesson on ablation studies covers why removing components and observing what breaks is such a durable experimental tool.
The kitchen analogy is close enough to be useful. If a dish tastes of saffron, you can prove the saffron mattered by cooking it without saffron. If you can remove any single ingredient and the dish comes out the same, the flavor is not attributable to any one of them. It came from the combination.
The finding that matters legally is the trend rather than any single rate: attributability falls as the training set grows. That has an intuitive reading. When a model sees a hundred examples of a visual pattern, removing one changes what it learned. When it sees a hundred thousand, removing one changes nothing measurable. Scale itself dissolves the link between output and source.
This complicates arguments in both directions, which is why it is worth reading carefully rather than as a win for one side. It weakens the blanket claim that every generated image is a collage of identifiable training works, because for many outputs no such work exists to point at. It equally weakens the claim that provenance can be established on demand, because a technique that cannot find a source for many outputs cannot be used to certify that outputs are clean either. Unattributable is not the same as original, and it is not the same as safe.
None of this touches the cases that actually reach courtrooms, where a model reproduces a recognizable work closely enough that similarity is obvious. Those are the high-radius cases, and this work does not dispute them. What it disputes is the generalization from those cases to all outputs.
The finding also lands directly against the provenance stack that platforms have built. OpenAI's own provenance documentation describes a layered approach using C2PA metadata and SynthID watermarks, and is candid that metadata can be stripped while watermarks survive some transformations but not all, and that no single technique is sufficient alone. We covered how fragile that layer can be when a tool that strips SynthID and C2PA marks passed 4,900 stars. Between an attribution method that returns nothing for many outputs and a marking scheme that can be removed, the honest description of image provenance today is a set of probabilistic signals, not a chain of custody. Our lesson on content provenance and watermarking goes through what each layer can and cannot establish.
The honest caveat is scope, and it is a large one. These are models the researchers trained themselves, on their own data, at their own scale. That is what makes the counterfactual measurement possible at all, since you cannot ablate the training set of a model you did not train. It is also what limits the conclusion: nothing here is a measurement of Midjourney, Stable Diffusion at production scale, or any commercial system. The mechanism is general and the trend with dataset size points the right way, but extrapolating a specific rate to a specific commercial model would be going beyond what the work supports.
For anyone following the copyright fight, the useful takeaway is that "can you trace it" now has a rigorous answer, and the answer is often no. Background on the underlying models is in our lesson on diffusion models.
Originally published on Ground Truth, where every claim is checked against the primary source.
