Telling Stable Diffusion’s close relatives apart

A family resemblance problem

Image-source attribution asks which generator made an image, rather than simply whether the image is synthetic. In this preprint, Ashutosh Dayal, Mallika Garg and Debashis Sen focus on a particularly close comparison: models built on the same Stable Diffusion XL architecture that differ through fine-tuning.

The authors call this task IntrAA-SD, short for Intra-Architecture source Attribution for Stable Diffusion. Their motivation is that recognizing broad differences between generator architectures does not necessarily identify a particular fine-tuned version. Models with similar visual styles, such as Juggernaut XL and RealVis XL, make that distinction especially challenging.

The contribution combines a benchmark dataset with an initial attribution system. It is a controlled study of distinguishing known generators, not a demonstration that any image found online can be traced to its origin.

What the benchmark contains

The authors describe a dataset called the IntrAA-SD Benchmark, or ISDB, containing 140,000 generated images divided evenly among ten sources. These include SDXL Base and nine fine-tuned models spanning photorealistic, anime and stylized outputs.

For each source, the dataset contains 12,000 in-domain images and 2,000 out-of-distribution images. Here, “in-domain” means generated using the benchmark’s training-related prompt categories. The authors report splitting that portion 80/20 for training and testing, with no prompt overlap between the partitions.

The separate out-of-distribution set uses 200 prompts across 20 categories and is reserved for evaluation. Some prompts introduce different subject matter, such as medical imagery or underwater scenes. Others deliberately challenge familiar style associations: requesting photorealism from an anime-focused generator, for example. Empty scenes, nested representations and text-heavy images provide further challenges.

Generation conditions are standardized. The authors use 1024-by-1024-pixel outputs, one specified scheduler, 25 denoising steps and a fixed guidance setting. Images are saved as JPEGs at 95% quality. This includes compression in the benchmark, but does not reproduce every transformation an image might undergo during online circulation.

Combining style with structural clues

The proposed system uses two pretrained image-analysis networks for different roles. A frozen CLIP network supplies features intended to describe visual style. A DINOv2 network, adapted using Low-Rank Adaptation, or LoRA, supplies features intended to capture subtler clues associated with the generator.

Style features control the weighting of four small “expert” networks that process the DINOv2-derived features. Their combined output is then joined with the style information to classify the image’s source.

The distinction matters because style alone can be misleading. An attribution system that equates anime imagery with one particular generator may fail when another generator produces anime, or when the familiar generator follows an unusual prompt. The authors aim to combine style context with less obvious image structure. Their experiments support classification performance, rather than conclusively isolating a unique physical fingerprint of each model.

Strong scores, with a distribution-shift penalty

The authors report overall attribution accuracy of 99.03% on the in-domain test set and 88.55% on the out-of-distribution set. Performance under shifted prompts varies substantially by source: reported accuracy is 70.50% for Juggernaut XL, 74.00% for ZavyChromaXL and 99.00% for DreamShaper XL.

In supplementary comparisons, five existing attribution methods are trained on the benchmark. The best reported overall scores among those alternatives are 92.21% in-domain and 74.84% out-of-distribution. These comparisons concern this dataset and training setup, not universal rankings of attribution tools.

Component-removal experiments also qualify the architectural story. A DINOv2-plus-LoRA classifier without the expert network achieves 98.52% on the in-domain test, compared with 99.03% for the full system. The added machinery improves the reported result, but much of the accuracy is already present in the simpler variant.

What remains unproven

The supplementary cross-dataset experiments expose another generalization limit. When trained on ISDB’s in-domain portion and tested on images generated using ImageNet- or COCO-derived prompts, the system scores 84.58% and 85.95%, respectively. Those remain generated-image experiments using the same ten sources, not tests on arbitrary internet images.

The classifier chooses among ten known candidates. The reported evaluation does not establish how it handles an unseen generator, a real photograph, extensive editing or different generation settings. Attribution accuracy also does not establish who operated a model or whether misuse occurred.

This account concerns arXiv version 2611.06000v1, submitted on 4 November 2026. Its landing page lists acceptance at WACV 2027. The evidence reviewed consists of that page, supplied metadata and extracted paper text, including the supplement—not independently reproduced experiments. PDF extraction omits images and can garble tables and equations, so detailed visual and numerical interpretations require caution.