Data Provenance for Image Auto-Regressive Generation
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
Image autoregressive models (IARs) have recently demonstrated remarkable capabilities in visual content generation, achieving photorealistic quality and rapid synthesis through the next-token prediction paradigm adapted from large language models. As these models become widely accessible, robust data provenance is required to reliably trace IAR-generated images to the source model that synthesized them. This is critical to prevent the spread of misinformation, detect fraud, and attribute harmful content. We find that although IAR-generated images often appear visually identical to real images, their generation process introduces characteristic patterns in their outputs, which serves as a reliable provenance signal for the generated images. Leveraging this, we present a post-hoc framework that enables the robust detection of such patterns for provenance tracing. Notably, our framework does not require modifications of the generative process or outputs. Thereby, it is applicable in contexts where prior watermarking methods cannot be used, such as for generated content that is already published without additional marks and for models that do not integrate watermarking. We demonstrate the effectiveness of our approach across a wide range of IARs, highlighting its high potential for robust data provenance tracing in autoregressive image generation.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 51 of its 60 references that are in the map. First posted on arXiv 22 Jun 2026.
Builds on
51 of 60 references.
Closest ancestors · 10
Same direction, newest first
- 2025Radioactive Watermarks in Diffusion and Autoregressive Image Generative Models30 Jun
- 2025BitMark: Watermarking Bitwise Autoregressive Image Generative Models26 Jun
- 2025Watermarking Autoregressive Image Generation19 Jun
- 2025Training-Free Watermarking for Autoregressive Image Generation20 May
- 2025Safe-VAR: Safe Visual Autoregressive Model for Text-to-Image Generative Watermarking14 Mar
- 2024An Undetectable Watermark for Generative Image Models9 Oct
- 2024Watermark Stealing in Large Language Models29 Feb
- 2023Mirror Diffusion Models for Constrained and Watermarked Generation2 Oct
- 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar
- 2023A Recipe for Watermarking Diffusion Models17 Mar
Other references · 41
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
- 2014Microsoft COCO: Common Objects in Contextcited by 17,608
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
- 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
- 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
- 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 6,013
- 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,356
- 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
- 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,588
- 2020Taming Transformers for High-Resolution Image Synthesiscited by 3,253
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
29 more
- 2021Alias-Free Generative Adversarial Networkscited by 1,184
- 2019StarGAN v2: Diverse Image Synthesis for Multiple Domainscited by 1,098
- 2024Visual Autoregressive Modeling: Scalable Image Generation via Next-Scale Predictioncited by 1,023
- 2024Chameleon: Mixed-Modal Early-Fusion Foundation Modelscited by 927
- 2016Conditional Image Generation with PixelCNN Decoderscited by 862
- 2024Autoregressive Model Beats Diffusion: Llama for Scalable Image Generationcited by 777
- 2021Vector Quantized Diffusion Model for Text-to-Image Synthesiscited by 774
- 2024Autoregressive Image Generation without Vector Quantizationcited by 651
- 2023Language Model Beats Diffusion -- Tokenizer is Key to Visual Generationcited by 640
- 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
- 2024Infinity: Scaling Bitwise AutoRegressive Modeling for High-Resolution Image Synthesiscited by 304
- 2023Self-Consuming Generative Models Go MADcited by 250
- 2020Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Datacited by 201
- 2024A Sanity Check for AI-generated Image Detectioncited by 189
- 2024Autoregressive Video Generation without Vector Quantizationcited by 186
- 2024HART: Efficient Visual Generation with Hybrid Autoregressive Transformercited by 132
- 2023Privacy Auditing with One (1) Training Runcited by 123
- 2025Beyond Next-Token: Next-X Prediction for Autoregressive Visual Generationcited by 71
- 2022Improved Vector Quantized Diffusion Modelscited by 62
- 2024Fairness Feedback Loops: Training on Synthetic Data Amplifies Biascited by 55
- 2023WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Modelscited by 53
- 2024How to Trace Latent Generative Model Generated Images without Artificial Watermark?cited by 26
- 2023Attributing Image Generative Models using Latent Fingerprintscited by 20
- 2025Privacy Attacks on Image AutoRegressive Modelscited by 15
- 2025Continuous Visual Autoregressive Generation via Score Maximizationcited by 9
- 2025ICAS: Detecting Training Data from Autoregressive Image Generative Modelscited by 6
- 2025AEDR: Training-Free AI-Generated Image Attribution via Autoencoder Double-Reconstructioncited by 5
- 2026Benchmarking Empirical Privacy Protection for Adaptations of Large Language Modelscited by 4
- 2025bfD3QE: Learning Discrete Distribution Discrepancy-aware Quantization Error for Autoregressive-Generated Image Detectioncited by 3
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2026Retrosynthesis of Synthetic Media for Explainable AI Provenance Forensics
- 2025ClusterMark: Towards Robust Watermarking for Autoregressive Image Generators with Visual Token Clustering
- 2026Rethinking Visual Provenance: Detection and Watermarking Across Direct Visual Generation and LLM-Driven Code Rendering
- 2025GenPTW: Latent Image Watermarking for Provenance Tracing and Tamper Localization
- 2026On the Robustness of Watermarking for Autoregressive Image Generation
- 2026The Orthogonal Vulnerabilities of Generative AI Watermarks: A Comparative Empirical Benchmark of Spatial and Latent Provenance
- 2025Training Data Provenance Verification: Did Your Model Use Synthetic Data from My Generative Model for Training?
- 2025Provenance Detection for AI-Generated Images: Combining Perceptual Hashing, Homomorphic Encryption, and AI Detection Models