When an AI image generator produces a portrait, whose work went into it? The question sits at the center of lawsuits, licensing deals, and proposed regulations worldwide. Artists want credit. Companies want clarity. Policymakers want a way to assign responsibility.

New research from MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) suggests that for models trained on large datasets, the question may often have no answer. It’s not that the tools for finding it are inadequate. The connection itself has disappeared.

The scientists identified a phenomenon they call attribution decay, where the more data a generative model is trained on, the less any individual training example matters to any particular output. It feels counterintuitive, but at sufficiently large scales, they find, you can often remove any single image from the training data, or every image by a given artist, or every photograph of a given person, and the generated sample doesn’t change.

And if removing something changes nothing, the researchers argue, it can’t be said to be responsible for anything. “If you take away a piece of data and the output of the model doesn’t change, then that piece of data didn’t affect the output,” says Zheng Dai SM ‘21, PhD ‘24, former MIT CSAIL researcher and lead author on the work. “So it doesn’t make much sense to attribute the output to that piece of data. And if you then do this one at a time for every other piece of data and find that the output doesn’t change for any of them either, then it doesn’t make much sense to attribute the output to any one of them.”

“All previous methods were approximate,” says MIT professor and MIT CSAIL principal investigator David Gifford. “They really could not absolutely show that deleting individual things did not change the output. This paper introduces the first method that is absolute. You’re actually deleting the inputs and deleting all influences of the inputs. This is the first exact method for doing large-scale deletion efficiently and showing that the results don’t change.”

The retraining problem

Testing this idea directly meant answering a what-if question. What would this model have produced if it had never seen this particular image? Answering it honestly means retraining the model from scratch without that image, then doing it again for the next image, and the next. With millions of training examples, the math quickly becomes prohibitive, which is why prior work in the attribution field has relied on approximations that estimate a training example’s influence rather than actually removing it.

Their workaround is an architecture they built themselves, called a “diffusion ensemble.” Instead of one monolithic model, it’s made up of many smaller components, each trained on a different slice of the data. Want to know what the model would do without a particular image? Just switch off the parts that saw it. No retraining, no approximation. What’s left is a true counterfactual model, not an estimate of one.

Of course, a clever architecture only matters if it still works as a generator. So the team put the ensembles head to head with 24 conventional diffusion models trained on the exact same data. The images came out looking about as good by standard measures. One nice surprise in the numbers: the more training data, the better the ensembles held up against their single-model counterparts, a hint that they may actually be more data efficient.

“When you have low amounts of data, they do very poorly,” says Dai. “But if you have more data, it actually scales better compared to the vanilla diffusion model.

Exploring a counterfactual universe

With ablation working, the researchers could finally ask their question at scale. Take one generated image, then imagine every alternate version of it, each produced by removing a different piece of the training data. The team calls this the image’s counterfactual universe. The distance between the original and its most different alternate, the counterfactual radius, captures the most any single piece of training data could have mattered.

They trained 24 ensembles on datasets from 256 images to more than 160,000, pulled from seven public collections including CIFAR-10, CelebA, MetFaces, and ArtBench. The pattern was consistent: the bigger the training set, the smaller the radius, shrinking along an inverse power law. It held whether differences were measured pixel by pixel or by semantic meaning, with statistical significance both ways.

The team also stress-tested their own result. Maybe ablation itself was the culprit? They redid it the brute-force way at small scale, training 1,282 separate models, and the decay showed up anyway. Maybe bigger datasets just make each removal proportionally smaller? They pinned the removed fraction in place, and it persisted. Fixed epochs, text-prompted models, class-conditioned models, four similarity metrics. The finding survived everything.

The privacy paradox

The implications run in a direction that surprised the researchers themselves.

Gifford sees the finding as bearing directly on the legal question of whether model outputs are derivative works. “One way to think about this is that these models are creative. They are not simply copying what they are fed, but creating brand new outputs. If those outputs have nothing to do with any individual piece of training data, that raises questions about fair use, about whether the outputs are themselves copyrightable as novel works, and about how authors get compensated when what comes out of a model isn’t attributable to anything on the internet.”

Gifford also notes that the work shows how to produce outputs that are guaranteed to be unattributable, a capability he frames as an obligation for the industry rather than a loophole. “In order for these companies to claim their outputs aren’t derivative of the internet in a copyright-infringing way, they need to revise their models to take advantage of the advances in this work, so they can show they’re not creating derivatives of individual people or items.”

The work looks at diffusion models, now dominant in generating audiovisual media and prevalent in scientific applications including protein structure modeling and therapeutic discovery. Whether the same decay holds for the large language models at the center of the highest-profile copyright litigation is still an open question.

“If attribution worked, it would reliably tell us whether similarities between a model’s output and a copyright-protected work are due to copying or coincidence,” says James Grimmelmann, who is a law professor at Cornell Law School and Cornell Tech.

“But this paper provides reason to think that attribution will fail for interesting models. Instead, technologists and courts will need to resort to other methods for assessing copying.”

Dai and Gifford’s work was supported by Schmidt Futures. Their project was published in Nature Communications earlier this month.

Article written by Rachel Gordon.

Earlier this month, Google DeepMind released Gemini Robotics 2, three models meant to help robots interact with the physical world.

The demos are captivating. You can see a humanoid doing chores we’d be eager to pass off to them, like helping take out the trash or screwing in lightbulbs. Wouldn’t that be great?

You might walk away from news like that thinking robot assistants are just a couple years away, but as MIT CSAIL researchers explained to the YouTuber Fireship recently, the machines haven’t mastered the physical world yet. We’ve seen robots walk, run, and even do backflips, but ironically, they aren’t nearly as skilled with their hands. Dexterity is a real challenge, and so is understanding the precise amount of force to use when handling different objects.

MIT CSAIL scientists believe it could take at least a decade to get robots that capable into the real world — if that. Watch Fireship’s video to hear more about our researchers’ views on robot hype and the challenges of implementing physical AI:

Article written by Alex Shipps.

AI systems are no longer just individual models trained and deployed in isolation.

Today’s production systems increasingly combine models, datasets, APIs, agents, harnesses, and services—often spanning multiple organizations—into complex AI supply chains.

In this video, MIT CSAIL researchers Aspen Hopkins and Professor Aleksander Mądry discuss why this shift changes how we need to deploy or govern AI. Reliable components do not automatically produce a reliable system, and an upstream change can have unexpected downstream effects.

How can a systems-of-systems perspective help uncover current gaps in tooling—and what new approaches will we need?

Watch it in full:

Article written by Aspen Hopkins.

Modern processors are fast in part because they guess. Rather than waiting to find out which way a program will branch, a chip predicts the likely path and races ahead. When the guess is right, time is saved. When it’s wrong, the work is discarded, but traces of it linger, and since the Spectre vulnerability was disclosed in 2018, attackers have known how to read those traces to pull secrets out of memory they should never see.

Chipmakers and operating system developers have spent years building defenses. A new study from MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) shows that a key assumption behind many of them doesn’t hold.

The defenses work by wiping or isolating the processor’s prediction machinery, removing anything an attacker might have planted. The catch, as Daniël Trujillo and Mengjia Yan point out, is that the wipe and the moment the predictions get used can’t happen at the same instant. There is always a gap — sometimes only a handful of instructions wide. Anything that runs in that gap can dirty the machinery all over again. The researchers call this class of attack TONTOU.

Their contribution is a reliable way to get code into that gap. Computers constantly pause whatever they’re doing to handle interrupts: small, routine tasks triggered by timers, network traffic, and hardware. Ordinary programs can set those timers themselves. By tuning a timer with enough precision, Trujillo and Yan can make the processor take its detour at exactly the wrong moment, and the interrupt execution does the contaminating. They call the technique INTERRUPT INJECTION.

The team tested four processor generations from Intel and AMD, and got mispredictions on both. On Intel chips, the attack defeated two different protections, one built in software for older parts, one built into the silicon of newer ones. Curiously, the newer protection held firm on one Intel generation and failed on another, suggesting chipmakers implement the same nominal defense in meaningfully different ways.

AMD’s defense, called saferet, cleans the prediction machinery immediately before each use, leaving a vulnerable window just 2 instructions wide, which typically execute within tens of nanoseconds. The researchers hit it anyway, by slowing down the processor at that exact spot to make the target easier to strike.

From a bad guess to a password file

To show what this means in practice, the team built a working exploit on an AMD system running a current Linux kernel. They first stripped away a defense that scrambles where the operating system sits in memory, succeeding in all ten tries in about nine minutes each. That helped them read protected memory at roughly five bytes per second — slow, but fast enough to locate and copy /etc/shadow, the file storing the system’s root password hash, in half their attempts.

The paper suggests cleaning the prediction machinery a second time, when the interrupt finishes. That looks workable on AMD. On Intel it may backfire: because the attack relies on the interrupt leaving behind a consistent state rather than any particular one, the standard fix could make the attack more reliable, not less. Newer Intel chips include a dedicated instruction that appears to help.

The other option, blocking interrupts during the vulnerable window, would likely cost too much performance to be practical.

Trujillo and Yan notified AMD and Intel in early February and reached Linux kernel maintainers in March, coordinating with AMD to warn cloud providers and other downstream customers. AMD then released a patch that mitigates the attack, which can be obtained by updating your operating system. Their code is publicly available.

The research was supported, in part, by the Air Force Office of Scientific Research under an award made through the Department of Defense, and ACE, one of the seven centers in JUMP 2.0, a program sponsored by DARPA. It will be presented at both Black Hat USA and USENIX Security this month.

Article written by Rachel Gordon.

Image credit: Gabriel Maragaño.

This is the newsletter of MIT’s Computer Science and Artificial Intelligence Laboratory, better known as CSAIL. We are the largest research lab at MIT, home to hundreds of researchers working on the questions that will shape computing for decades to come: artificial intelligence, robotics, the systems that run the internet, security, human health, and much more.

What sets this place apart is breadth and patience. Few labs bring this many corners of computing under one roof, which means ideas here cross between fields in ways they rarely do elsewhere. A problem in robotics informs a question in medicine, a result in theory changes how a system gets built. And because we are a university lab and not a company, we can take on the long, uncertain questions that do not pay off for years, the kind that most of the field cannot afford to chase. A great deal of what the world now takes for granted began exactly that way, as basic research that looked like pure curiosity at the time.

Most of what happens here is hard to see from the outside. Research moves slowly and quietly, and by the time a result reaches the news, the story of how it actually came together has usually been lost. This newsletter is where we plan to tell that story as it happens. Expect clear, jargon-free explanations of new work from the lab, written for curious readers rather than specialists. Expect conversations with the people doing the work, including the problems that keep them up at night. And expect an honest look at how an idea travels from a rough early experiment to something that touches real life.

We also want this to be more than a broadcast. CSAIL has always been a place where ideas get shared, tested, and argued over, and we would like this newsletter to work the same way. Expect researchers thinking out loud rather than only presenting polished conclusions, and expect room for disagreement, including yours. Some of the best questions we hear come from outside the lab. If something we write sparks a thought, a challenge, or a better idea, we want to hear it.

Whether you work in the field, are weighing it as a career, or are simply curious about where technology is headed, we hope you find something here worth your time.

Subscribe to join the conversation. We’re glad you’re here.

Article written by Rachel Gordon.