Who's Behind the Text? Robust Model Authorship Attribution

Rather than directly predicting the source, ATLAS learns a source-conditioned language model for each model family on a frozen LLM and attributes a text by comparing its token-level likelihoods under every source condition.

Abstract

As large language models (LLMs) are increasingly used to generate text, their misuse has become a growing societal problem, with serious implications for academic misconduct, model distillation, and cyberattacks. For these reasons, Model Authorship Attribution (MAA), which identifies the source model of a given text, is important for promoting the responsible use of LLMs and improving AI safety. In practice, attribution systems must remain reliable beyond the distributions observed during training. They may encounter texts from unseen domains and writing settings, as well as generations from future versions of model families that were not available when the system was trained. However, existing MAA methods often exhibit substantial performance degradation under such distribution shifts. To address this challenge, we propose Authorship Tracing via Likelihood-based Attribution of Sources (ATLAS), which formulates MAA through source-conditioned text modeling rather than direct source prediction. ATLAS learns how text from each source family is generated and attributes a given text by comparing its likelihood under each learned source condition. We aggregate this likelihood evidence at the token level with clipping so that no single token dominates the decision. We further introduce MAABench, a novel and broad MAA benchmark that can evaluate more practical OOD settings such as domain and version. Our experiments show that ATLAS consistently outperforms existing baselines across MAABench and OpenTuringBench. In particular, when both the generation domain and the model version change on MAABench, ATLAS achieves 74.27% accuracy, 9.00pp higher than the strongest baseline. Beyond MAA, ATLAS can also help identify distillation source models by measuring which source model a target LLM most closely resembles. Our extended experiments support this claim by showing that ATLAS recovers the known teacher of every distilled model we evaluate.

Method: ATLAS

• Source-conditioned likelihood, not a classifier. For each model family, ATLAS learns a source condition on a frozen pretrained LLM (a prefix embedding e_k and a source-specific LoRA up-projection B_k, with a shared down-projection A), trained only to maximize the likelihood of that family's texts.
• Token-level clipped attribution. At inference, ATLAS scores a text under every source condition, compares the sources token by token, and clips each token's relative evidence so that a few extreme tokens cannot decide the attribution.

MAABench

A benchmark for attribution under distribution shift in both the generation domain and the source-model version.

All five families receive the same prompts, built from the metadata of human-written seed texts in News, Wikipedia, Academic Writing, Product Review, Patent, and Stack Exchange.

Summary of MAABench. ^†Reused human texts; the total counts each text once.

Results

Attribution on MAABench

MAA performance on MAABench (accuracy and macro-F1, %). ID is nearly saturated, but under OOD evaluation ATLAS outperforms the strongest baseline by 2.66pp, 12.32pp, and 9.00pp on Domain, Version, and Joint shift. ATLAS and the four encoder-tuning baselines are averaged over three seeds.

Attribution on OpenTuringBench

MAA performance on OpenTuringBench (accuracy, %). ATLAS reaches 95.71% on OOD, 33.52pp above the best baseline, and is best on all four in-domain variations (E1–E4).

Backbone size and data efficiency

(a) Larger backbones help most under OOD evaluation. (b) With only 1,000 texts per family, ATLAS already outperforms DA-MTL trained on the full split on Version and Joint shift.

Beyond Attribution: Distilled and Deployed Models

Distilled models with known teachers

A student trained on the outputs of a teacher may retain the teacher's generation patterns. We train ATLAS as a three-class attributor over GPT, Claude, and Gemini and apply it to six publicly released distilled models whose teachers are stated in their model cards, two students per teacher built on different base models.

Model resemblance of deployed models

We also apply the same attributor to recently deployed models for which no teacher, or even the use of distillation, is publicly established. For each model, we report the share of its texts attributed to each family. We evaluate twelve deployed models from DeepSeek, GLM, MiniMax, Kimi, Grok, A.X, K-EXAONE, Motif, and Solar.

Resemblance of deployed models. Share of each model's texts attributed to each candidate family (%); segments under 12% are left unlabeled.

Share of texts (%) attributed to each family; the most attributed family is highlighted. Reject is the share of texts that no source condition explains better than the frozen backbone.

BibTeX

@article{ko2026atlas,
  title   = {Who's Behind the Text? Robust Model Authorship Attribution},
  author  = {Minseok Ko and Hyunseok Lee and Woomin Song and Beomjun Kim and Jinwoo Shin and Kunwoong Kim},
  journal = {arXiv preprint arXiv:2610.19583},
  year    = {2026}
}