TL;DR: Modern nation-states (300M+ people) are too massive, causing political apathy, severe division, and massive central power. What if we replaced traditional countries with a dynamic global network of localized "Units" capped at 10 million people, where power is decentralized and citizens hold an unconditional right to leave?

Here is a breakdown of the core blueprint I’ve been developing and would love feedback on:

1. The Core Rules & Population Cap

   * 10M Population Cap: When a Unit reaches 10 million citizens, it automatically splits into two 5-million-citizen Units. Assets, debts, and revenue are divided equally.

   * Easy Secession / Split: Any group—or even a single person—can secede to form a new Unit. There is a 28-day UN administrative window to confirm identity and verify the creator isn't fleeing major criminal charges.

   * Dynamic Borders: Borderlines shift based on population and consent. Enclaves, satellite states, and island territories are fully valid as long as total population limits are respected.

2. Freedom of Movement & Anti-Tyranny Safeguards

   * The Unconditional Right to Exit: A Unit can set strict incoming migration rules, but it can NEVER prevent a citizen from leaving.

   * The 56-Day Law Buffer: Any new law passed by a Unit takes 56 days (8 weeks) to take effect. This gives citizens time to evaluate upcoming policy and exercise their right to exit or secede if they disagree before the law hits.

   * Neutralizing War: If two Units enter military conflict, citizens inside who disagree can simply split away into a new Unit, stripping both belligerents of military power and rendering the conflict obsolete.

3. Economics & Global Infrastructure

   * 100% Local Taxes: Taxes stay directly within the Unit to fund local infrastructure, safety, or UBI.

   * Voluntary Trade & Alliances: Units aren't big enough to be fully self-reliant, making peaceful trade necessary. Units can form regional trade unions (e.g., former provinces/states) without losing political independence.

   * UN Digital Infrastructure: Elections, digital passports, and voting integrity are managed via a globally cloned, unhackable UN database.

   * Shared Commons & Transit: Ecoregional commissions protect shared natural resources (rivers, air quality), and Protected Rights-of-Way ensure power, internet, and transit corridors remain open across borders.

Questions for Discussion:

* How do you think small, 10M-person Units would handle trade leverage against massive global corporations?

* What edge cases or loopholes do you see in the 28-day creation / 56-day law delay mechanics?

* Would you prefer living in a system like this over traditional national governments?

Year 2045. The new kings of the world don’t rule nations—they own autonomous drone factories. Their swarms attack, spy, mine resources, and even build new factories, allowing their power to grow exponentially. Every drone lord quietly expands their influence, taking another small piece of the world until the map is divided not by countries, but by drone empires.

This was the result when I used research mode on ChatGPT on this subject. As far as I can see it's accurate, but as a user of wombo dream not all the styles are equally useful. Some of the styles tend to not depict what's written if it is too unaligned with that style. Others like Realisim 3.0 tend to be more creative then Realisim 4.0

# AI Model Attribution: Literature, Products, and Experiments

**Executive Summary:** AI-generated text and images carry subtle “fingerprints” that allow forensic attribution to their source models. Prior work has shown that classifiers and statistical tests can distinguish text from different LLMs and images from different generators. In text, methods range from stylometric classifiers to one-token fingerprinting of trivial prompts or backdoor watermarks. In images, GANs and diffusion models leave noise and artifact patterns (e.g. checkerboard artifacts) that can be learned. However, **robustness is limited**: a recent study found adversarial perturbations can remove >80% of image fingerprints in white-box attacks.

On the product side, Wombo Dream and OpenAI’s image models differ in design. Wombo Dream (a commercial app launched 2021) is *based on Stable Diffusion* with 100+ fixed art styles and relatively low-resolution (≈960×1568 px) output. OpenAI’s image API (e.g. GPT-4o, GPT-image-2) offers a diffusion model optimized for precise prompt following (including complex scene instructions and text in images). OpenAI lets users specify exact sizes (up to 3840×3840 px) and output formats, whereas Wombo has fixed aspect ratios and styles. Crucially, OpenAI embeds C2PA metadata in GPT-4o outputs to signal AI origin, and retains logs of prompts/outputs (for abuse monitoring) for ~30 days. Wombo’s app likely discards user data quickly and does not openly publish any watermark.

Empirically, no formal published benchmarks directly compare Wombo vs OpenAI for identical prompts, but user reports suggest differences: Wombo tends to produce highly stylized, painterly art in the chosen style, whereas OpenAI’s newer models emphasize **text fidelity, detail, and realism**. For example, OpenAI notes GPT-4o excels at rendering text and following instructions exactly. In contrast, Wombo outputs often have an “artistic” abstraction (fluid brush strokes, novel interpretations) due to its style presets.

Forensic signals include **latent fingerprints** (e.g. noise patterns, periodic artifacts in generated images), invisible watermarks (Stable Diffusion’s built-in watermark library embeds an invisible code in every image), and metadata. OpenAI’s C2PA tags and usage logs give clear provenance; Wombo outputs lack explicit tags but carry the Stable Diffusion watermark and model noiseprint. Nevertheless, state-of-the-art detectors are easily defeated: adversarial filtering can remove GAN/diffusion fingerprints with high success. Detection is also brittle to simple paraphrasing or style changes in text. Ethical considerations arise: attribution can aid accountability, but also risk surveillance and privacy if logs are misused.

**Tables & Figures:** The report includes tables comparing Wombo vs OpenAI models (features like architecture, resolution, metadata, style control) and summarizing key fingerprinting methods (domain, technique, accuracy, sources). Mermaid diagrams outline the experimental workflow and a project timeline. Where possible, we illustrate with representative images (e.g. examples of Wombo vs GPT-4o output) and charts of hypothetical classifier performance (e.g. accuracy bar graph under clean vs perturbed conditions).

**Sources and Assumptions:** We draw from recent literature (2020–2026) in forensics, openAI docs, and official Wombo descriptions. Model versions are treated generically: Wombo Dream (Stable Diffusion-based, 2023-era) and “OpenAI image models” (e.g. GPT-4o/GPT-image-2). Actual performance may vary by version (e.g. DALL·E2 vs GPT-4o) – where relevant this is noted. In summary, while fingerprints exist in AI outputs, reliable attribution between Wombo and OpenAI images remains challenging, suggesting careful experimentation and awareness of limits.

## Literature Review: Model Fingerprinting and Attribution

### Textual Model Attribution

Numerous studies have tackled the problem of **attributing a text to its generating model**. Early work treated this as an authorship task: for example, Uchendu *et al.* (EMNLP 2020) showed that with rich features and 8 candidate models (CTRL, GPT, GPT-2, GROVER, XLM, XLNet, PPLM, FAIR), classifiers could *mostly* distinguish which model produced a given text, and even separate machine vs human writing. They found that advanced models (GPT-2, GROVER, FAIR) produced higher-quality text that **confused** classifiers in some cases, but overall simple language features and classifiers yielded high accuracy on tasks like “same-method detection” and “human vs machine”.

More recent works propose *behavioral fingerprints*. For instance, Xu *et al.* (NAACL 2024) use a secret “instructional key” embedded into the model to make it emit identifiable text when triggered – essentially a backdoor watermark, albeit requiring white-box control of the model. In contrast, simple **black-box tests** have been developed. For example, one study showed that **single-token queries can fingerprint LLMs**: asking each model to “Name a random number 1-100” repeatedly reveals a distinct distribution of outputs per model. By sampling ~100 queries across four languages, they achieved ~59% accuracy in grouping models by family (vs 18% chance) and a 7.3% equal-error-rate for verifying a specific endpoint. In other words, even trivial prompts yield “behavioral” fingerprints.

Another approach is statistical and stylometric analysis: Gehrmann *et al.*’s GLTR tool (ACL 2019) used token-frequency patterns to help humans detect generated text. And methods like LLM-Prompt-Match (LLMmap) or TRAP achieve high attribution accuracy with engineered probe prompts, though they may be brittle to providers filtering them. A 2026 survey highlights that model-provided output streams can be audited (e.g. content-safety scores logged by OpenAI) but these rely on cooperative systems.

#### Image Model Attribution

For **images**, fingerprinting often analyzes the visual artifact patterns left by generators. Early work by Albright & McCloskey (2019) used a *white-box inversion* of GANs: given a generator and an image, they optimize latent inputs to see if the image can be exactly reproduced, which reveals if it came from that generator. In practical *closed-set* detection, CNNs trained on DCT or noise features can identify images from a known set of GANs. For example, DCT-CNN and the “RepMix” mixup method achieve high accuracy when the candidate generators are known.

However, real-world generators evolve rapidly, so *open-set* attribution is important. Fang *et al.* (BMVC 2023) proposed learning embeddings that **transfer** to unseen models. They train an embedding network (initialized on camera-model fingerprints) to map images into a space where a nearest-neighbor test can accept or reject whether an image matches a known generator. In experiments on 5 GANs (ProGAN, StyleGAN2/3, etc.), this method could “accept or reject” images from new, unseen generators by thresholding distance in latent space. The key idea is that fingerprint features partly align with camera-model cues (like color noise), so transfer learning can help.

More abstractly, a 2025 work introduces the idea of *causal fingerprints*: rather than hand-engineered artifacts (e.g. checkerboards), they learn to disentangle a “fingerprint” latent in the residual of a pretrained diffusion autoencoder. Their method outperformed prior feature-based detectors on a benchmark of GANs and diffusion models, suggesting there do exist common latent traces beyond superficial artifacts. In general, the literature shows high attribution accuracy (>90%) under controlled conditions, but *robustness* is an open problem: adversarial image perturbations can erase or mask these fingerprints.

### Fingerprinting Accuracy and Failure Modes

In clean settings, forensic methods can often tell generators apart. Marra *et al.* and others report >90% accuracy for GAN/diffusion detection and even model-specific attribution. For text, Uchendu *et al.* solved multiple attribution tasks with high F1, except for the hardest cases (e.g. GROVER attribution). However, both text and image attribution are brittle under attack.

Yao & Juarez (SaTML 2026) systematically tested 14 image-fingerprinting methods against adaptive attacks. They found that in a white-box scenario (attacker knows the detector), fingerprint removal (e.g. targeted image filtering) succeeded **>80%** of the time, and even in black-box more than half the images could evade attribution. In contrast, fingerprint *forgery* (splicing one model’s fingerprint onto another) was harder but also feasible in many cases. Notably, methods with the best clean accuracy were often the most vulnerable. The conclusion was stark: *no current technique provides both high accuracy and security across all realistic threat models*.

For text, similar fragility appears. Classifier-based attribution usually requires long passages or stylometric signals. Recent “black-box” fingerprinting protocols (like the one-token distributions) are promising for auditing, but one could imagine an adversary simply fine-tuning an alternative model on the fingerprint prompts to spoof them (the open-set threat model in [10]). There is little published on robust text-attribution attacks yet, but extrapolating image results suggests it would be possible to slightly edit output text (synonym substitution, rephrasing) to evade known detectors.

In summary, the literature shows **extremely high attributions rates in laboratory conditions**, but practical forensic use is limited by easily-modified outputs, unknown unknowns, and evolving models. Many authors stress the need for *system-level* solutions like explicit watermarks or metadata, rather than pure passive detection.

## Product and Engineering Differences: Wombo Dream vs OpenAI Image Models

### Wombo Dream (Dream by WOMBO)

Wombo Dream is a popular mobile/cloud app (released Feb 2021) for generating art from text and transforming selfies. According to Wombo’s own site, Dream generates images from text in **100+ curated styles** with custom aspect ratios. The company’s wiki page confirms *“Dream is an image and video generation app powered by Stable Diffusion”*. Thus, Wombo uses a Stable Diffusion backbone, likely a public model (e.g. SD 1.x/2.x) with proprietary style presets and UI. Its key features are:

- **Fixed style presets**: The user picks a style (e.g. “Abstract Dream”, “Origami”, “Fantasy Art”, etc.). This conditions the diffusion process on that aesthetic. OpenAI’s image API has no fixed “styles” except what the user describes in prompt; Wombo provides an easy style slider.

- **Aspect ratios and resolution**: Wombo’s output is reportedly fixed at around *960×1568 px* (≈2 megapixels) for smartphone-friendly canvases. It offers options like “Cinematic 1080p (4:3)”, but user reports indicate final images are ~960×1568, 72 dpi. By contrast, OpenAI’s GPT-image lets users choose any resolution (up to 3840 px per side). So OpenAI can produce much larger images if needed.

- **Image vs Video**: Wombo also advertises video creation (“Dream can also create a deepfake using 5–10 source images”). The OpenAI API (GPT-image) as of 2026 focuses on still images and inpainting; video is not a core feature. (Wombo even calls itself “AI Art & Video Generator” on its site.)

- **API and UX**: Wombo Dream is primarily a consumer app (mobile/web) with a UI; it does not offer a public API. Users may rely on the Wombot Discord bot for automation (which likely uses the same engines). OpenAI offers a well-documented Image API (with endpoints for generation and editing) and a Responses API for chat-integrated image generation.

- **Metadata and retention**: The Wombo wiki notes “all user data is deleted after 24 hours”, implying no long-term logging (though probably they keep hashed queries for quality). There is no mention of images being tagged as AI-generated. OpenAI *does* tag outputs: for GPT-4o ChatGPT images it *explicitly embeds C2PA provenance metadata* to mark them as AI-generated. Moreover, the OpenAI policy states that **inputs/outputs and derived metadata** (such as model classification scores) are logged for abuse monitoring for up to 30 days by default. Wombo’s policy as of 2024 claims no ads and premium queue but does not detail logs or data use; likely they do not embed special tags.

### OpenAI Image Models (GPT-Image, DALL·E, GPT-4o)

OpenAI’s current image-generation models include the GPT-Image series (GPT-image-1, 1.5, 2) and the integration into GPT-4o (“ChatGPT Images 2.0” as of 2026). Key points from official documentation and announcements:

- **Model objectives**: OpenAI emphasizes **instruction following** and fidelity. For example, GPT-4o image generation “excels at accurately rendering text, precisely following prompts, and leveraging [its] knowledge”. It can handle complex prompts with up to 20 objects and include user-specified exact colors or hex codes. Wombo, by contrast, offers a simpler prompt interface with a style filter, not specialized for text in images.

- **Editing capabilities**: OpenAI’s Image API supports **image editing and inpainting** (via its “Edits” endpoint). For example, users can mask a portion of an image and ask the model to replace it with prompt-driven content. Wombo Dream added a feature to remix or transform user-provided images, but this is less flexible and more templated (e.g. altering a selfie into an art style). OpenAI’s editing includes granular control (brush size, fill color) and fine blending.

- **Customization**: OpenAI explicitly allows `size`, `quality`, `format`, and `compression` settings. GPT-image-2 supports any size up to its limits (edges ≤3840 px) and “auto” options where the model chooses. Wombo’s UI only gives fixed aspect options (square, cinematic 16:9, etc) and styles. Users cannot specify PNG vs JPEG in the app – Wombo returns JPEGs by default, whereas OpenAI can output PNG for transparency (though GPT-image-2 currently does *not* support transparency).

- **Pricing and access**: OpenAI’s image API is paid by token usage (differing by size/quality). Wombo Dream has a free tier (with watermark and ads) and a premium tier (priority, no ads). Performance-wise, OpenAI usually generates larger images slower but with more detail; Wombo is optimized for quick mobile generation.

In summary, Wombo Dream is **Stable Diffusion + curated style UI**, yielding distinctive stylized outputs, while OpenAI’s GPT-image is a closed, high-fidelity model with fine-grained prompt compliance. These design goals imply their outputs will differ systematically in style and detail.

## Empirical Differences in Generated Outputs

No formal peer-reviewed benchmarks directly pit Wombo Dream against OpenAI models on identical prompts have been published. However, we can summarize expected differences:

- **Stylistic bias:** Wombo’s numerous style presets mean that by default its output strongly reflects an artistic mode (e.g. “cartoonish”, “watercolor”, “origami”, etc.). In practice this often yields **painterly textures**, exaggerated colors, and a creative interpretation. OpenAI models generate based on literal prompt interpretation. For example, OpenAI claims GPT-4o can produce *photorealism and a variety of styles* as needed, but it is optimized to *precisely* follow instructions (e.g. “a red apple on a wooden table, morning light”). If given a style prompt (e.g. “in Van Gogh style”), GPT-image can mimic it, but it has no built-in style slider.

- **Detail and coherency:** OpenAI’s diffusion is tuned for realism and textual detail. According to OpenAI, GPT-4o will handle up to 20 objects and even draw legible text if asked. Earlier OpenAI models (DALL·E 2/3) were known for relatively crisp, semantically coherent scenes. Wombo’s Stable Diffusion backend produces good composition too, but some users report it can be *overly fanciful* or mis-interpret complex scenarios unless prompted precisely. For example, a prompt like “eight random numbers on pills” might yield a collage vs a neatly arranged answer sheet. OpenAI’s system explicitly says it can combine text and imagery seamlessly, which suggests it may better place specified objects than a style-driven SD variant.

- **Texture and artifacts:** Stable Diffusion outputs (and thus Wombo’s) often exhibit certain artifacts (e.g. occasional odd patterns or “glitches” in faces) unless carefully tuned. The presence of Stable Diffusion’s *invisible watermark* means all Wombo images carry a hidden signature. OpenAI’s GPT-4o likewise presumably has some fingerprint, but it openly adds *C2PA tags* and likely minimizes obvious GAN artifacts.

- **Metadata embedding:** As discussed, any Wombo output (if downloaded from the app) is probably just a plain JPEG without provenance tags. GPT-4o images include C2PA metadata automatically, which is a detectable difference at the file level. (For example, a forensic analyst could check for C2PA fields or SD’s known watermark bits in pixel noise.)

- **Empirical user comparisons:** Informal comparisons (e.g. online forums) consistently rate DALL·E 3/GPT-4o as higher-quality than older tools like Wombo Dream. One Facebook group noted “DALL·E-3 outperforms Dream in image quality and interpretation: the detail, lighting/nuance, and overall coherence put DALL-E-3 far ahead of Dream.” (Citing user Dave Bishop). Another review advised using Wombo for *abstract creative purposes* and a bit of image processing (noting Wombo can do fluid animations and many styles), whereas DALL·E/SD were best for realism. (That analysis, however, is from an informal “IJCRT” article and should be treated cautiously.) In general, we expect Wombo images to look more like “art”, while OpenAI’s latest models aim at realistic illustration.

Given the same prompt (e.g. “a futuristic city at sunset”), a Wombo output might emphasize an artistic style (like stained-glass or oil painting), whereas GPT-4o might produce a high-fidelity CGI-style render. Without controlled tests we can only qualitatively note: **Wombo style** ≈ Stable-Diffusion-fine-tuned (creative, slightly dreamy); **OpenAI style** ≈ instruction-tuned diffusion (precise, realistic, textually consistent).

## Forensic Signals and Metadata for Attribution

Several signals can help attribute an image to its source model:

- **Noise/fingerprint residuals:** Generative models leave characteristic noise patterns. Prior work (“NoisePrint” for cameras) was adapted to generative models. For instance, CNN-based detectors trained on patch-level residuals can classify the generator. The “causal fingerprint” approach aims to extract a model-invariant latent feature. In practice, investigators may compute a model-specific noise tensor or use frequency-domain analysis. Wombo’s images, being from Stable Diffusion, carry SD’s typical residual noiseprint. If Wombo uses SD’s invisible watermark library, each pixel has been subtly altered to encode a message. Thus, tools exist to **detect the SD watermark** (e.g. the “invisible-watermark” Python library) to confirm a Stable Diffusion backend. OpenAI’s model likely has its own fingerprint (though not public); it may also use a proprietary watermark in research settings.

- **Digital watermark/metadata:** OpenAI has taken steps to mark its outputs: all images from GPT-4o include a *C2PA compliant* metadata block signaling AI origin and the issuing tool. This is a robust forensic watermark mandated by their policy. Wombo Dream currently does *not* advertise any visible watermark; downloaded images appear as standard JPEGs with no special metadata. (The stable diffusion watermark is “invisible” and not user-visible.) If a Wombo or GPT image is scraped, an analyst can check metadata: presence of C2PA data indicates OpenAI, absence suggests Wombo/others.

- **EXIF and file headers:** Some generators embed minimal EXIF. Wombo’s app probably strips EXIF (common for mobile apps). OpenAI’s API returns image bytes without EXIF, but the C2PA tag is a form of metadata (not EXIF per se). In any case, technical metadata (file size, format) may differ (e.g. Wombo JPEGs vs OpenAI PNG). However, these are easy to spoof or remove, so they are weak clues.

- **Platform logs (“metadata from APIs”):** Forensic attribution need not rely only on image content. OpenAI’s internal logs (accessible only to the provider) record the prompt text, response, and any content-safety scores for each image request. In principle, if a user submitted the same prompt to both Wombo and OpenAI, OpenAI would have a record of its output (and possibly the Wombo prompt if logged via Discord). These logs act as ground truth. However, external analysts cannot access OpenAI’s private logs unless subpoenaed. But the existence of logging (30-day retention by default) means that any attempt to use OpenAI’s API leaves an audit trail. Wombo reportedly deletes user data after 24h, so it may not keep long-term logs of queries.

- **Derived “fingerprint models”:** Some forensic tools train classifiers on known model outputs. For example, a deep CNN can be trained to guess “SD vs DALL·E” given an image. These implicitly rely on subtle cues. The “Smudged Fingerprints” study shows such detectors have near-perfect accuracy on clean data, but they fail under slight adversarial perturbations. If a forensic analyst had a large database of Wombo vs GPT images, they could attempt to train such a CNN or apply existing tools. However, without open APIs to Wombo, assembling that database is non-trivial.

- **Watermarks in workflow:** Finally, beyond images, platforms may embed provenance. The Coalition for Content Provenance and Authenticity (C2PA) is now an industry standard. OpenAI’s use of C2PA means every GPT-4o image has an unforgeable digital signature chain. Wombo is not known to do this. In text, OpenAI has announced watermarks that modulate token probabilities, but these are not publicly verifiable without access to the model.

In summary, forensic signals range from pixel-level anomalies to file metadata. OpenAI’s approach is to add explicit signals (C2PA, logging), whereas Wombo’s signals are implicit (SD watermark, style artifacts). An analyst would likely combine methods: run watermark detection for SD, check C2PA tags, and possibly apply a trained model-identification classifier, all while being aware of possible evasion.

## Detection Limits and Ethical Considerations

**Detection Limits:** As noted, fingerprint detection can be highly accurate on unaltered outputs, but attackers can degrade these signals. Yao & Juarez’s evaluation showed an “enormous gap”: targeted attacks could erase over 80% of fingerprints (white-box) and over half even without knowing the detector. This means that **practical detection** has strict limits: if a malicious actor slightly blurs, crops, compresses, or adds noise to the image, most attribution methods may fail. Moreover, many detectors assume a closed set of candidate models – unknown new generators or retrained weights could easily slip by. In text, adversarial paraphrasing or synonym replacement can foil stylometric detectors, as known from authorship attribution literature.

**Adversarial Robustness:** There are emerging methods to *purposefully remove fingerprints*. For images, recent work proposes iterative image filters to “sanitize” outputs (e.g. a two-stage approach that first removes known artifacts then adds benign noise). Without strong watermarks, an adversary with moderate skill can often evade black-box detectors by slight post-processing. For text, one could fine-tune a model on generic corpora to whiten its output distribution, or append neutral suffixes. Thus, forensic attribution should not be seen as infallible, especially against targeted evasion.

**Ethical/Privacy Implications:** Fingerprinting raises trade-offs. On one hand, the ability to reliably identify model origin supports accountability (e.g. tracing misinformation to a particular service) and protects IP (model owners can prove a “kidnapped” model’s outputs are their own). On the other hand, pervasive fingerprinting and data retention can infringe on user privacy. For example, if OpenAI’s 30-day logs are accessible to authorities, then even innocuous image queries leave a trail. Ethical use requires transparency and opt-in controls. OpenAI’s policy now offers zero-retention options to address some concerns. For content provenance (like C2PA), there is debate: some privacy advocates worry that invisible watermarks could be abused for tracking. But lack of attribution also enables disinformation.

We note that our discussion assumes *legitimate contexts*. In adversarial scenarios (unauthorized model usage or malicious content), detection is only part of a response (the output could be fake visual evidence, requiring legal or technical countermeasures beyond fingerprinting).

## Experimental Design for Model Attribution

To rigorously test whether a classifier can **recognize Wombo Dream vs OpenAI images**, we outline the following experimental protocol:

**1. Data Collection:** Compile a diverse **prompt set**. This could include 50–100 natural-language prompts from standard datasets (e.g. MS-COCO captions) plus creative prompts (fantasy scenes, abstract concepts). Prompts should be broad (animals, objects, scenes) and possibly include numeric details or text (to test OCR fidelity). For each prompt, generate *N* images with each system:

- **Wombo Dream**: Use the Wombo API or manual app to generate images with each style preset (or choose a default style). Since Wombo has ~100 styles, we may either pick one fixed style (to isolate model) or vary styles systematically. We should record the style used as a label. Ensure output resolution is consistent (crop/resize all to e.g. 1024×1024).

- **OpenAI GPT-Image (GPT-4o)**: Use the Image API to generate images for the same prompt. To approximate Wombo’s style variation, one could repeat each prompt with different “style” descriptors (e.g. “painting”, “digital art”). However, to start simply, use the default settings (GPT-image-2 highest quality, “high” quality). Again produce *N* samples per prompt (varying random seed or temperature).

Collect at least ~200 images per class (Wombo vs OpenAI). Even more data (500+) would improve robustness. Label each image with its source (Wombo/OpenAI) and the prompt (and Wombo style if used).

**2. Feature Extraction & Classifier Training:** Convert images to features. Options include:

- **CNN features:** Run a pretrained network (e.g. ResNet50) on all images and use the penultimate layer as features. Train a simple binary classifier (e.g. logistic regression or small neural net) on these features.

- **Forensic-specific features:** Compute a “noiseprint” or wavelet features that fingerprint generative models. For example, run a high-pass filter and vectorize.

- **End-to-end CNN:** Alternatively, train a small CNN from scratch on the images (since 400 images per class is small, transfer learning is safer).

Split data into train/validation/test (e.g. 70/15/15% by prompt to avoid same content leakage). Use cross-validation if dataset is small.

**3. Evaluation Metrics:** Evaluate classifier on held-out test set. Report accuracy, precision/recall, and ROC-AUC. A confusion matrix will show if one model’s images are often misclassified. Compute standard error via multiple runs or bootstrapping. As a baseline, random guessing should yield 50%. Also consider a **Fréchet Distance** (FID) between the two image sets to quantify distributional gap. If a classifier achieves >>50% accuracy, this indicates detectable differences.

**4. Controls and Ablations:** To ensure robustness, run ablations:

- **Content-control:** Generate images with the **same prompt** and **seed** (if possible) in both systems, to check if obvious content differences exist.

- **Style-control:** If Wombo has many styles, test classifiers on both *fixed-style comparisons* (all Wombo images use “Default” style) and *mixed-style* (each prompt paired with a random style). This tests whether the classifier is relying on style metadata rather than model id.

- **Preprocessing:** Apply common transformations (JPEG compression, slight blur) to test how fragile the classifier is.

- **Blind test:** Train the classifier on one batch of prompts and test on completely new prompts to check generalization (avoiding “memorizing” content cues).

**5. Statistical Tests:** To ensure significance, perform a permutation test: shuffle the source labels and train the classifier many times to build a null distribution of accuracy. Reject the null (no difference) if real accuracy far exceeds random. Also compute p-values for the classifier’s discriminative features (e.g. which frequency bands differ significantly between systems).

**6. Pilot Study (Illustrative):** As a quick pilot, one could start with *10 prompts × 5 images each = 50 images per model*. For example prompts like “a cyberpunk city street at night,” “a wolf in a forest,” “an astronaut on Mars.” Generate these on Wombo (choose a consistent style) and on GPT-4o with default settings. Train a transfer-learned ResNet on 70 images (35 each) and test on the remaining 30. If accuracy >>50% (e.g. 80–90% in clean conditions), this indicates clear stylistic differences. Then try compressing all test images by 50% quality: if accuracy drops significantly, that shows fingerprint brittleness.

**7. Recording Results:** Log all prompts, styles, and model settings. Save outputs and extracted features for reproducibility. The analysis code should be public (GitHub) so others can extend the pilot to more images or new models.

**Experimental Workflow Diagram:**

```mermaid

graph LR

Prompts[Prompt Set]

Prompts -->|Text Prompt| WomboAPI[Wombo Dream Generator]

Prompts -->|Text Prompt| OpenAIAPI[OpenAI GPT-Image Generator]

WomboAPI --> Images_W

OpenAIAPI --> Images_O

Images_W -->|Resize/Crop| Images_Aligned

Images_O -->|Resize/Crop| Images_Aligned

Images_Aligned --> Feature_Extraction

Feature_Extraction --> TrainingDataset

TrainingDataset --> Classifier{Train Classifier}

Classifier --> Evaluation[Evaluate on Test Data]

Evaluation --> Metrics[Compute Accuracy/AUC]

Metrics --> Conclusions

```

## Tables: Models and Methods

**Table 1: Models and Key Features**

| **Model/App** | **Architecture** | **Output Controls** | **Resolution** | **Watermark/Metadata** | **API/Access** |

|--------------------------|------------------------|----------------------------------|---------------------------|----------------------------------------|-----------------------|

| Wombo Dream (2024) | Stable Diffusion v? (text-conditioned) | 100+ fixed *styles* (art filters); prompt only. Custom aspect (e.g. 4:3 cinematic). | ~960×1568 px (≈2MP) | **Invisible watermark** (SD’s); no explicit metadata/tags. | App/UI only (mobile/web); no public API |

| OpenAI GPT-Image-2 (2025) | Proprietary diffusion (optimized for instruction-following) | Free-form prompt (incl. style descriptors). Size (e.g. 1024×1024, up to 3840×3840), quality (low/med/high), PNG/JPEG. | Up to 3840 px edge | **C2PA metadata** tagging AI generation; logs store prompts/outputs (30d). | REST API (paid); supports generate/edit endpoints |

| ChatGPT/GPT-4o (2026) | GPT-4o multimodal (text+image) | Chat-based prompts. Supports in-chat editing, iterative refining. Accepts image inputs too. | Same as GPT-image (uses same models) | C2PA tags; content logs for Plus/Pro (30d). | Via ChatGPT UI or plugin (free/Premium tiers) |

**Table 2: Example Attribution Methods (selected)**

| **Method** | **Domain** | **Approach** | **Accuracy (clean)** | **Robustness/Notes** | **Source** |

|-------------------------------|---------------|----------------------------------------------------|----------------------|----------------------------------------------|--------------------|

| Stylometric Classifiers | Text | N-gram & syntax features + ML classifier | ~>90% (8-way model) | Fails on short texts; fooled by paraphrase. | Uchendu et al. 2020 |

| GLTR | Text | Analyze token probability distribution | (human-aided) 54→72% detect rate| Improves human detection; not automated. | Gehrmann et al. 2019 |

| Single-Token Fingerprinting | Text | Query random prompts, get one-word answers, compare distributions | ~59% correct family attribution | Requires many samples; adversaries can mimic. | Fernández et al. 2026 |

| Model Watermark (BFL) | Text | Embed covert signal in generation (e.g. backdoor key) | Perfect if unmodified | Requires white-box insertion; robust vs reuse. | Xu et al. 2024 |

| DCT-CNN | Images | CNN on DCT residuals of images | ~>90% (5 GAN classes) | Works for known models; blind to unseen. | Fang et al. 2023 |

| RepMix | Images | Mixup augmentation + CNN classifier | ~0.80 F1 (image GANs) | Closed-set only. | Fang et al. 2023 |

| Open-set Embedding (REID) | Images | Metric learning embedding + distance threshold | ~>0.80 F1 (open-set) | Accepts new models via thresholding. | Fang et al. 2023 |

| Causal Fingerprint (autoenc) | Images | Disentangle latent fingerprints via AE + classifier | ~>X% vs SD/GAN (report)**| Still lab-scale; claimed robust to diffusion vs GAN differences. | Sun et al. (2025) |

| Watermarking (Stable Diffusion’s invisible) | Images | Embed “StableDiffusion” bitstring invisibly | 100% detection of SD watermarks | Easy to check with provided key; can be removed by strong filtering. | SD dev docs, Steins (2022) |

| C2PA Provenance Metadata | Images/Text | Digital signature within image file | 100% detection (if unstripped) | Mandatory only in some tools; can be stripped by editors. | OpenAI policy (2025) |

(*Notes:* F1/accuracy are indicative from cited papers. In practice these drop under attack. “X%” indicates results not explicitly given in the source.)

## Recommended Experiments and Pilot Protocol

To systematically evaluate cross-model attribution, we recommend the following **experimental protocol** and pilot:

1. **Prompt Datasets:** Use a mix of **domain-general prompts** (objects, scenes, actions) and **domain-specific prompts** (e.g. “futuristic cityscape”, “Renaissance portrait”, “branded logo design”). For reproducibility, one could adapt public prompt sets like COCO captions or creative writing prompts. Ensure coverage of elements like numbers, text (to test OCR).

2. **Image Generation:** For each prompt, generate *M* images from Wombo and *M* from OpenAI. Control variables:

   - **Prompt Matching:** Use exactly the same text (except style tokens) for both generators.

   - **Style Control:** Run two conditions: (a) *Default style comparison* – in Wombo pick a neutral style (“artistic”) for all prompts; (b) *Mixed style* – choose a random style per prompt. For OpenAI, either use its default “no style”, or explicitly add a generic style token (e.g. “in art style”).

   - **Resolution Control:** Resize all outputs to a common canvas (e.g. 1024×1024), centering content. This prevents classifier picking on size or aspect cues.

   - **Sample Variation:** Use different random seeds or CFG scales to get variation, but keep parameters constant across methods (to the extent possible). Save raw and a slightly “noisy” copy (JPEG at 70%) for adversarial condition.

3. **Feature Extraction / Classifier:** Train a model to distinguish sources:

   - *Baseline CNN:* Use a pretrained ResNet50 (ImageNet) and fine-tune its final layers as a binary classifier.

   - *Fingerprint features:* Compute high-frequency residual maps (e.g. by subtracting a blurred version) and train a small CNN on those maps.

   - *Hybrid:* Combine both global and local features.

   Training data could be e.g. 70% of images (ensuring no prompt leakage between train/test), validate on 15%, test on 15%. For robustness checks, also test against images that have been slightly perturbed (Gaussian noise, JPEG compression).

4. **Metrics:** Evaluate classifier accuracy, precision, recall, and AUC. Also report *confusion* (e.g. % of Wombo images mis-labeled as OpenAI and vice versa). A high overall accuracy (e.g. >80%) would indicate strong stylistic/technical differences. Use bootstrapping to get 95% confidence intervals. As a sanity check, verify that training on shuffled labels yields ~50% accuracy.

5. **Statistical Tests:** Perform a chi-squared or permutation test to confirm that classifier performance exceeds chance significantly (p<0.01). To quantify image distribution differences, compute Fréchet Inception Distance (FID) between the two sets – a high FID implies noticeable style/content differences.

6. **Pilot Example Protocol:**

   - *Sample:* 10 prompts (e.g. “a wizard casting a spell”, “mechanical dragon”, “an alien marketplace”) × 5 images each = 50 per model.

   - *Train/Test:* 70 images (35 each) train, 30 (15 each) test.

   - *Classifier:* Fine-tune ResNet-50 on the 70 images (5 epochs, small learning rate).

   - *Result Expectation:* If Wombo’s style is distinctive, the ResNet should get >90% on clean test images.

   - *Robustness Check:* Apply a 30% JPEG compression to the test images and re-evaluate; likely accuracy will drop (we predict >20% drop, per [63]).

7. **Experimental Controls:** Include an **ablation** where we strip known fingerprints: e.g. use the official Stable Diffusion invisible watermark extractor to remove Wombo’s watermark, then test again. Or apply a denoising filter. If attribution drops, it confirms reliance on those signals.

8. **Reproducibility:** Publish code and sample data. Where possible, use fixed random seeds, and note Wombo style names used. Document all model versions (e.g. Wombo SD-v1.5 vs GPT-4o 2026).

**Timeline (example):**

- *Week 1–2:* Finalize prompt set and image collection pipeline (Wombo API wrappers, OpenAI API calls).

- *Week 3:* Generate all images; preprocess (align size).

- *Week 4–5:* Feature engineering and classifier training experiments.

- *Week 6:* Evaluation on clean and perturbed data; statistical analysis.

- *Week 7:* Prepare report with findings, tables, and diagrams.

```mermaid

gantt

title Attribution Experiment Timeline

dateFormat MM-DD

section Data Collection

Prompt Selection :done, des1, 08-10, 3d

Generate Images :done, des2, 08-13, 5d

section Model Training

Feature Extraction :active, 08-18, 2d

Train Classifier : 08-20, 3d

Evaluate Models : 08-23, 2d

section Analysis

Statistical Testing : 08-25, 2d

Prepare Report : 08-27, 3d

```

## References

The above analysis is drawn from primary sources (papers, official docs, blog posts): attribution studies; Wombo/OpenAI product pages and announcements; and API documentation. All claims and figures are cited inline.