Retrieval-Driven Training-Free AI-Generated Video Attribution

Source: arXiv:2607.28955 · Published 2026-07-31 · By Renxi Cheng, Chaolei Han, Jie Gui, Hongsong Wang

TL;DR

This paper addresses the challenge of attributing AI-generated videos to their specific generative models, a task increasingly important given the rising realism and misuse risks of synthetic videos. Prior work primarily focused on image attribution or closed-set supervised classification methods ill-suited for the open, evolving landscape of AI video generators. The authors propose a novel, training-free, retrieval-driven attribution paradigm treating the problem as instance retrieval rather than classification. They develop a fingerprint-aware representation pipeline that extracts generative model artifacts via an adaptive orthogonal color transformation, multi-scale quantized residual generation, and temporal-semantic aggregation. Using a pretrained video encoder and cosine similarity retrieval, their framework matches query videos to a reference database of generator fingerprints. Extensive experiments on the GenVidBench benchmark across 8 generators demonstrate the method outperforms state-of-the-art video attribution/detection approaches by large margins, achieving up to 84.6% Rank-1 accuracy and 78.3% mAP in 100-shot attribution, and 91.0% detection accuracy. The training-free nature enables robust, scalable open-set attribution without expensive labeled data or retraining. Overall, the work presents a practically deployable, forensic-grade AI video attribution solution based on stable frame-level and temporal residual artifacts.

Key findings

• Formulating AI-generated video attribution as retrieval rather than classification enables open-set scalability by simply registering new generator samples without retraining.
• Adaptive Orthogonal Color Transformation (AOCT) improves mean Average Precision (mAP) by 10.9% over no color transform baseline, effectively exposing generator artifacts.
• Multi-Scale Quantized Residuals (MSQR) add 4.8% mAP improvement by isolating multi-resolution high-frequency discrepancies.
• Temporal-semantic aggregation combining spatial residuals (weight 0.6), temporal residuals (0.3), and RGB context (0.1) streams yields best attribution performance.
• On GenVidBench (8 generators, real videos, 1/10/100-shot), the method achieves 20.5% absolute improvement in Rank-1 accuracy over the best baseline in 100-shot setting (84.6% vs ~64%).
• Detection accuracy reaches 91.0% at 100-shot, outperforming prior methods including UNITE by 8.8%.
• The method is robust to video degradation such as H.264 compression and cropping, maintaining >70% attribution accuracy.
• The approach requires no classifier training, relying solely on pretrained R3D-18 video feature extractor and handcrafted fingerprint pipelines.

Threat model

The adversary is an entity deploying AI generative models to produce synthetic videos with the intent to deceive or mislead forensic attribution. They do not have the capability to perfectly remove or alter low-level generative fingerprint artifacts embedded in video residuals without degrading video perceptual quality. The attribution defender does not rely on labeled training data for new or unknown generators and must handle an open-set scenario where new generator types can emerge without retraining.

Methodology — deep read

1. Threat model & assumptions: The adversary is an entity generating synthetic videos using unknown or evolving AI generative models. The method assumes no prior labeled training data for those models and cannot rely on closed-set classifiers. Adversaries cannot easily remove subtle generative statistical artifacts from residuals without degrading video quality.

2. Data provenance and setup: Experiments use GenVidBench, a comprehensive benchmark composed of ~100,000 videos generated by 8 mainstream AI video generators (e.g., T2V-Zero, MuseV, CogVideo) plus real videos merged from HD-VG and Vript datasets. Videos are semantically balanced with original prompts available. Evaluations consider 1-shot, 10-shot, and 100-shot few-shot settings where that many reference videos per generator are registered.

3. Architecture and algorithm:

• Step 1: Each input RGB video frame undergoes an Adapted Orthogonal Color Transformation (AOCT). AOCT learns a constrained orthogonal 3x3 color space matrix to maximize the Frobenius norm of high-frequency residual components, exposing subtle generator-specific variations.
• Step 2: Multi-Scale Quantized Residual (MSQR) generation discretizes the AOCT frames at multiple quantization scales asymmetrically across color channels, then reconstructs residuals by inverting the AOCT, isolating fine-grained deviations.
• Step 3: Temporal-Semantic Aggregation aggregates three streams: spatial residuals, temporal residual differences (first-order differences of residual frames across time), and original RGB context frames. The streams are combined with weights (0.6 spatial, 0.3 temporal, 0.1 RGB) to form a unified fingerprint feature.
• Step 4: The fused features are fed into a pretrained R3D-18 3D CNN backbone (pretrained on Kinetics-400) to extract fixed-length video embeddings.
• Step 5: For attribution, the embedded query video features are compared via cosine similarity to a reference database of embeddings indexed per generator. The top scoring generator is attributed.
• Step 6: For detection, the maximum similarity over the reference database is thresholded to distinguish real videos (low similarity) from AI-generated.

4. Training regime: The method is training-free for attribution—the only model trained is the R3D-18 backbone pretrained on unrelated Kinetics-400. No fine-tuning or training on attribution task occurs. Quantization scales, AOCT parameters, and feature fusion weights are hyperparameters tuned by ablation on validation data. This supports zero-cost adaptation to new generators.

5. Evaluation protocol: Metrics include Rank-1 accuracy and mean Average Precision (mAP) for attribution, classification accuracy for detection. Evaluations span multiple few-shot regimes (1,10,100 reference videos per generator). Baselines include CNN classifiers (ResNet-50 per frame), video classifiers (R3D-18), state-of-the-art methods like DeMamba and UNITE. Robustness tests include video degradation via H.264 compression and cropping. Feature distributions are visualized using t-SNE.

6. Reproducibility: Code is publicly released at GitHub. Dataset (GenVidBench) is currently public. The approach requires no end-to-end training or backpropagation on attribution task, easing reproducibility and practical deployment.

Concrete example: Given a query video, 64 frames are sampled and color-transformed by AOCT to create a residual representation highlighting generator artifacts. Multi-scale quantized residuals extract stable high-frequency noise patterns. The temporal differences capture frame temporal artifact consistency. These streams are fused and input to R3D-18 to produce embeddings. The system compares cosine similarity of this embedding against a database of embeddings from known generator videos, retrieving the closest generator fingerprint and attributing the query video accordingly. This bypasses closed-set classification limitations and enables real-time scalability when new generators emerge.

Technical innovations

• Reformulating AI-generated video attribution as an open-set retrieval problem instead of closed-set classification.
• Adaptive Orthogonal Color Transformation (AOCT) that learns a constrained video-frame-dependent color space to reveal generative artifacts from residuals.
• Multi-scale, channel-asymmetric quantized residual generation to robustly isolate fine-grained generator fingerprints at multiple resolutions.
• Temporal-semantic aggregation combining spatial residuals, temporal residual dynamics, and RGB context for discriminative video fingerprint representations.
• Training-free fingerprint extraction enabling scalable registration of new generators by simple embedding indexing without model retraining.

Datasets

• GenVidBench — ~100,000 videos — public benchmark combining 8 AI video generators plus real videos (HD-VG and Vript merged)

Baselines vs proposed

• ResNet-50 per-frame classification: 100-shot Rank-1 = 28.9%, mAP = 25.8% vs Proposed: Rank-1 = 84.6%, mAP = 78.3%
• R3D-18 video classifier: 100-shot Rank-1 = 51.1%, mAP = 42.3% vs Proposed: Rank-1 = 84.6%, mAP = 78.3%
• DeMamba [3]: 100-shot Rank-1 = 37.7% (no mAP reported) vs Proposed: 84.6%
• UNITE [24]: 100-shot Rank-1 = 49.6% (no mAP reported) vs Proposed: 84.6%
• Detection accuracy 100-shot: Proposed = 91.0% vs UNITE [24] = 82.2%
• Ablation: Adding AOCT improves mAP from 51.1% to 62.0%; Adding MSQR further improves to 66.8%; including temporal stream adds 73.8%, full fusion achieves 78.3% mAP.

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.28955.

Fig 1: Comparison between existing AI-generated video attri-

Fig 2: Overview of our fingerprint-aware representation pipeline. (1) The input video frames are first computed with an error map

Fig 3 (page 1).

Fig 4 (page 1).

Fig 5 (page 1).

Fig 6 (page 1).

Fig 7 (page 1).

Fig 8 (page 1).

Limitations

• Rank-1 attribution accuracy around 20.5% in 1-shot setting indicates room for improvement in extremely low-resource cases.
• Evaluation is limited to 8 known generative models; generalization to unseen or very different future generators remains uncertain.
• Robustness tested against some video degradations (compression, cropping) but adversarial attacks or adversarial removal of fingerprints are not evaluated.
• Dependence on pretrained R3D-18 backbone may limit performance if underlying video feature extractor is outdated or mismatched.
• The fingerprint extraction assumes residual generative artifacts are stable; highly sophisticated forgery or post-processing could diminish discriminability.
• No detailed analysis on computational cost and scalability with very large reference databases.

Open questions / follow-ons

• How well does the approach generalize to completely novel, unseen generative models that differ substantially in architecture or synthesis pipeline?
• Can adversarial attacks be designed to specifically remove or spoof the fingerprint residuals used for retrieval, and how robust is the method to such attacks?
• What are the tradeoffs in computational complexity and database size for large-scale deployment with thousands of generators and millions of reference videos?
• Can end-to-end learning frameworks integrate these handcrafted fingerprinting ideas to further boost attribution performance without losing open-set flexibility?

Why it matters for bot defense

For practitioners designing bot-defense or CAPTCHA systems, this paper provides a new perspective on AI-generated video attribution beyond binary detection, enabling attribution to specific generative sources in an open-set, scalable manner without expensive retraining. The training-free retrieval-driven paradigm could inspire forensic pipelines that quickly incorporate new synthetic sources by storing fingerprint embeddings rather than retraining classifiers. The multi-stream fingerprint features leveraging spatial, temporal, and color residual artifacts provide a robust methodology that may transfer to bot behavioral fingerprinting or multimedia integrity verification contexts. However, the method focuses on forensic forensic video attribution rather than active challenge-response verification, so adaption to real-time CAPTCHA deployment would require further latency optimization. Its robustness against compression and cropping is encouraging for practical deployment despite noisy inputs.

Cite

@article{arxiv2607_28955,
  title={ Retrieval-Driven Training-Free AI-Generated Video Attribution },
  author={ Renxi Cheng and Chaolei Han and Jie Gui and Hongsong Wang },
  journal={arXiv preprint arXiv:2607.28955},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.28955}
}

Read the full paper

• arXiv:2607.28955 (abstract)
• arXiv:2607.28955 (PDF)