Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise NEWSLETTER SIGN-UP Cybersecurity Topics World The Edge DR Technology Events Resources CYBER RISK News, news analysis, and commentary on the latest trends in cybersecurity technology. New Tool Traces AI Videos Back to Their Source Researchers dug into the root of the problem with the goal of promoting industry collaboration on improved protective measures. Arielle Waldman,Features Writer,Dark Reading August 3, 2026 4 Min Read SOURCE: ANDREYPOPOV VIA GETTY IMAGES The next applicant appears on the screen, ready for the interview. Questions go smoothly, they seem to have all the right answers, and their background has already been vetted. So, they're hired as the latest remote IT worker. Weeks later, the company discovers it was all a sham. The face on the video call was manipulated using deepfake technology, and even the voice was altered with artificial intelligence (AI). The person they hired doesn't exist. AI is capable of generating extremely authentic-looking videos, which can be used for disinformation, social engineering, identity theft/impersonation, and deepfakes. They've become so realistic that Rohit Kundu, Ph.D. research intern at YouTube and doctoral candidate at University of California Riverside, can't even decipher the real from the fake — and he studies them every day. The rise and quality of AI-generated videos prompted UC Riverside researchers to create the Source Attribution of Generative AI (SAGA) videos tool. The framework can identify video authenticity, the specific generative model used, the model version, and the development team, which can help provide further forensic insights. Related:When Too Much Security Data Becomes the Risk Knowing whether a video is generated by artificial intelligence (AI) is no longer enough to curb the threat. The source needs to be identified to help reduce the number of fake videos that circulate the Internet, trick people, and lead to dangerous side effects. Kundu and researchers out of UC Riverside initially focused on AI detection: Is this video fake? They subsequently developed one model that could detect all kinds of videos, rather than having to use different models to examine every kind of AI tool. They moved on beyond detection, to build a reasoning model that could also explain why the video was fake and what part made it fake. Once they could confirm a video was fake and why, the problem expanded to establishing the tools used to create it. The researchers worked with a sample of publicly available data, but if the tool is applied to the real world, it could help identify which models are most commonly used to create phony videos, most of which flood social media with harmful content. Sharing that information can help the model creators improve their data filters and protections, Kundu tells Dark Reading. "If some big group’s model is being used, you'd want to let them know: ‘A lot of videos were generated using your technology, so you want to put more restrictions,’" he says. Can SAGA Make It in the Real World? Even AI can have a difficult time spotting fake videos, let alone identifying which source they derive from. Challenges will only increase when SAGA is let out of the lab, so the researchers needed a plan. Related:Bugcrowd Launches EU Data Residency Option For Evolving Data Sovereignty Needs They built the tool on top of a foundation model, so when it is applied in the wild and encounters anything that veers from what it was trained on, it won't be "stumped by domain disturbances, which is quite common," warns Kundu. When someone uploads a video to social media, the two videos will have the same domain, but the foundation model backbone, which is the core infrastructure supporting development and deployment, ensures those similarities don't affect the models' performance, he adds. The researchers also proved the effectiveness of their video transformer architecture, the framework to both process and analyze video data. SAGA’s is tailored for video attribution and makes for easy adoption, Kundu says. Once the researchers saw how successful the model was in tracing the source, they wanted to find out why. In the resulting white paper, they proposed that temporal signatures (T-Sigs) were how the model was able to provide attribution, because the model would literally leave a signature, revealing itself. Their investigation found that T-Sigs are how frames evolve over time; the analysis serves as a good base for future, more advanced research. Related:What It'll Take to Make AI BOMs Usable in a Modern Security Program Different generative models have different temporal artifacts, or patterns, which in turn helps with source attribution. Kundu explains that if a user gives two models the same prompt, they may generate the same kind of video, but inconsistencies will be present. While they may be tiny and difficult to spot with the naked eye, temporal signatures can help forensics identify which model was used to generate the video, he explains. "It turns out that different generative models have different temporal artifacts," he says. "If you give two generators the same prompt, they're supposed to generate the same kind of video, but the temporal inconsistency will be different." Collaboration To Quell the Threat Not only does Kundu want SAGA to identify sources, he also wants the tool to create a more collaborative atmosphere to address the fake video epidemic. He hopes that if one generator's videos are flagged frequently, it will increase safety for users. SAGA could be used to alert new models as well, to get ahead of the game. "Tell them it's apparently being used to create fake videos and the kind of videos. Maybe they're generating harmful content. That shows (a) particular generative model may be vulnerable to that kind of prompt," he adds. Now that they've mastered detection, reasoning, and the source, researchers will move on to proactive prevention — not allowing any unsafe content to be generated in the first place, whether it's a deceptive deepfake of a celebrity or politician promoting disinformation or a threat actor posing as an executive to conduct business email compromise. About the Author Arielle Waldman Features Writer, Dark Reading Arielle spent the last decade working as a reporter, transitioning from human interest stories to covering all things cybersecurity related in 2020. Now, as a features writer for Dark Reading, she delves into the security problems enterprises face daily, providing context and actionable steps. She looks for stories that go past the initial news to understand where the industry is going. Her coverage areas include identity and access management, cyber risk and operations, industrial control systems, operational technology, and ransomware trends. She previously lived in Florida where she wrote for the Tampa Bay Times before returning to Boston where her cybersecurity career took off at TechTarget SearchSecurity. When she's not writing about cybersecurity, she pursues personal projects that include a mystery novel and poetry collection. Want more Dark Reading stories in your Google search results? ADD US NOW More Insights Industry Reports The State of Cloud Security: The Latest Challenges How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy Essential News & Insights from Black Hat USA 2025 Access More Research Webinars Experts Explain How to Develop a Framework for Cyber-Fraud Fusion Prevention at Machine Speed: Hunting Beyond Known Detections 0-Day to 10x Discovery: Security at the Speed of Mythos When AI Becomes an Insider: Rethinking Risk in Critical Infrastructure Governing the Agent; Identity Security in the Age of Autonomous AI More Webinars You May Also Like CYBER RISK Claude Mythos Fears Startle Japan's Financial Services Sector by Nate Nelson APR 30, 2026 CYBER RISK How Can CISOs Respond to Ransomware Getting More Violent? by James Doggett JAN 28, 2026 CYBER RISK US Cyber Pros Plead Guilty Over BlackCat Ransomware Activity by Alexander Culafi JAN 05, 2026 CYBER RISK Microsoft Exchange 'Under Imminent Threat,' Act Now by Arielle Waldman NOV 12, 2025 Latest Articles in DR Technology IDENTITY & ACCESS MANAGEMENT SECURITY USA Fencing Lunges Into the Hidden Identity Challenge in Amateur Sports JUL 31, 2026 APPLICATION SECURITY When AppSec Scanners Become a Supply Chain Attack Vector JUL 29, 2026 ENDPOINT SECURITY Agentic Browsers Rewind Web Security by 20 Years JUL 27, 2026 СLOUD SECURITY Default Azure Automation Setting Enables Cross-Tenant Identity Takeover JUL 24, 2026 Read More DR Technology Discover More Black Hat Omdia Working With Us About Us Meet the Editors Advertise Reprints Join Us NEWSLETTER SIGN-UP Follow Us Copyright © 2026 TechTarget, Inc. d/b/a Informa TechTarget. This website is owned and operated by Informa TechTarget, part of a global network that informs, influences and connects the world’s technology buyers and sellers. All copyright resides with them. Informa PLC’s registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. TechTarget, Inc.’s registered office is 275 Grove St. Newton, MA 02466. Home| Cookie Policy| Privacy| Terms of Use Your Privacy Choices