MIT study finds outputs of large diffusion models often cannot be traced to training images
Removing one image, one artist or one subject from a big training set barely changes what a model draws, which reshapes how attribution should be tested.
Researchers at MIT's Computer Science and Artificial Intelligence Laboratory have shown that, as the training set behind an image-generating diffusion model grows, it becomes harder to trace any output back to the examples that influenced it. The paper, "Outputs of generative diffusion models are often unattributable", appeared in Nature Communications and was described by MIT News on 18 August 2026. Its authors are Zheng Dai and CSAIL principal investigator David Gifford.
The central tool is a diffusion ensemble: several smaller components, each trained on a separate slice of the data, combined into one generator. Because the slices are isolated, a training example can be removed without retraining the whole system, so the researchers can ask what the model would have produced if a given image, an artist's entire output, or every photo of one person had never been in the data.
The experiments used datasets from 256 images to more than 160,000, taken from CIFAR-10, CelebA, MetFaces and ArtBench. The team compared 24 ensembles against 24 conventional diffusion models and checked the pattern with 1,282 further small-scale models. The result is what the authors call attribution decay: as data volume rises, the change caused by deleting any single image, artist or subject shrinks towards zero, following an inverse power law. Dai's summary is that if removing a piece of data leaves the output unchanged, that data did not affect it.
The authors do not claim to settle legal disputes, but note the finding bears on whether generated images can be called derivative works of particular training images.
Why it matters
The study gives a repeatable way to ask whether a training image shaped an output, moving a largely rhetorical debate onto experimental ground. It also suggests that scale changes a generative model's character: small models memorise, large ones blend. That distinction will feature in licensing and provenance discussions, and it makes dataset size a variable worth tracking.
The study gives a repeatable way to ask whether a training image shaped an output, moving a largely rhetorical debate onto experimental ground.
Split the training data into slices
Each slice holds a distinct subset of images, artists or subjects.
Train one small diffusion component per slice
Components never see data outside their own slice.
Combine components into one generator
The ensemble produces images by pooling the components' predictions.
Switch off a slice and regenerate
Removing an image, artist or person needs no retraining.
Compare outputs with and without the slice
Little or no change means the removed data did not shape the output.
What you can learn from this
- Diffusion models learn to reverse noise, not to store pictures. A diffusion model is trained by adding random noise to training images in steps and teaching a network to predict and remove that noise. At generation time it starts from pure noise and denoises repeatedly until an image appears. Because the network learns statistical regularities about edges, textures and layouts rather than a lookup table of images, any single training picture is one small nudge among millions of gradient updates.
- Memorisation and generalisation sit at opposite ends of a data-size curve. When a model has very few examples relative to its capacity, the cheapest way to reduce training error is to reproduce those examples almost exactly, which is memorisation. As the dataset grows, reproducing individual examples stops being the best strategy and the network has to capture shared structure instead. That is why the same architecture can behave like a copier at a few hundred images and like a generaliser at many thousands.
- Counterfactual removal is the cleanest test of influence. The question "did X affect Y?" is answered most directly by comparing the world with X to the world without X. In machine learning this is called a leave-one-out or ablation experiment, and it is usually too expensive because it requires retraining. The ensemble design in this study works around that cost by keeping each data slice in its own component, so removing a slice is a matter of switching it off.
- Ensembles trade a little quality for a lot of controllability. An ensemble combines the outputs of several models, often by averaging their predictions. Each component sees less data than a single monolithic model would, so it may be slightly weaker on its own, but the combined system can be inspected, audited and edited piece by piece. This is a recurring engineering trade: modular systems are easier to reason about, monolithic ones are often more efficient.
- A power law means the effect never quite hits zero, but becomes negligible fast. An inverse power law describes a quantity that shrinks in proportion to some power of the input; doubling the dataset cuts the influence of one image by a fixed fraction. Such curves fall steeply at first and then flatten, so most of the decay happens early. For attribution this implies there is a dataset size beyond which per-image influence is practically unmeasurable, even though it is never mathematically absent.
We teach this
How to use this in practice
- Train two tiny diffusion models and compare their memorisation. Using an open framework such as Hugging Face Diffusers, train one small model on 200 images and another on 5,000 from the same public dataset, keeping the architecture and number of training steps identical. Generate 50 samples from each and find every sample's nearest neighbour in its training set using a simple pixel or embedding distance. Done looks like a short table of nearest-neighbour distances for each model, with the small-data model visibly closer to its training images.
- Draw the ensemble mechanism from memory. Sketch a dataset split into four slices, four component models, a combiner and an output, then draw a second version with one slice removed. Annotate what changes, what stays fixed, how the combiner pools predictions and where retraining would have been needed under a conventional single-model design. Done is a one-page drawing you could use to explain to a colleague why removal does not require retraining.
- Audit the provenance of any fine-tuning data you already hold. Open the folder or bucket that feeds a model you have trained or fine-tuned and record, for each source, where it came from, what licence applies, how many items it contributes and whether identifiable people or named artists appear. Done is a spreadsheet with one row per source, no blank licence cells, and a count of how many items would need removing if one source were withdrawn.
- Write a half-page comparison of attribution techniques. Read the abstract of the Nature Communications paper alongside a short description of influence functions and of nearest-neighbour search, then write down what question each method answers, roughly what it costs to run and its main weakness. Include a line on why leave-one-out retraining is the reference method and why it is rarely affordable. Done is a note you could hand to a product manager who asks whether an output's origin can be traced and get a straight answer.
Sources
- When AI art has no author: Study finds generated images often can't be traced to training data — MIT News
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report