README
🔥 Awesome LLM Fingerprint
🚀 An UP-TO-DATE collection list for Large Language Model (LLM) Fingerprinting
📚 Papers(Fingerprint) • 🔗 Related Repos • 🙏 Acknowledgements
📖 Table of Contents
-
- 1.1. 🔤 Text Feature Analysis
- 1.2. 📝 Secret Q&A Injection
- 1.3. 🧠 Other Methods
1. 🔍 Black-box Methods
1.1 🔤 Text Feature Analysis
This approach works better for already deployed LLMs by analyzing their text outputs.
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| Detecting Stylistic Fingerprints of Large Language Models | 📅 2025/3/3 | This paper proposes a unanimous-vote ensemble of classifiers to detect the specific LLM family (e.g., GPT, Claude) that generated a text, achieving extremely high precision by only making a prediction when all classifiers agree. | 📄 arXiv |
| LLMmap: Fingerprinting For Large Language Models | 📅 2025/2/10 | LLMmap actively queries an LLM-powered application with a few specially-crafted prompts to accurately identify the specific underlying LLM version, even when it's hidden behind unknown configurations, randomness, or complex frameworks like RAG. | 📄 arXiv · 💻 Code |
| Invisible Traces: Using Hybrid Fingerprinting to identify underlying LLMs in GenAI Apps | 📅 2025/2/7 | This paper introduces a hybrid fingerprinting framework that combines static (active probing) and dynamic (passive observation) techniques to accurately identify the underlying LLMs in GenAI apps, outperforming individual methods in complex scenarios. | 📄 OpenReview |
| FDLLM: A Dedicated Detector for Black-Box LLMs Fingerprinting | 📅 2025/1/27 | A method that fine-tunes a foundation model using LoRA to effectively identify the source LLM of a given text, and supports this with a new large-scale bilingual dataset (FD-Dataset). | 📄 arXiv |
| Hide and Seek: Fingerprinting Large Language Models with Evolutionary Learning | 📅 2024/8/6 | The paper proposes a "Hide and Seek" algorithm where one LLM (the "Auditor") learns to generate discriminative prompts to make different LLM families produce unique responses, while another LLM (the "Detective") identifies them, effectively "fingerprinting" the models in a black-box setting. | 📄 arXiv · 💻 Code |
| Your Large Language Models Are Leaving Fingerprints | 🏆 COLING 2025 workshop | LLMs exhibit unique and persistent 'fingerprints' in their generated text, allowing simple classifiers based on n-gram features to effectively detect and attribute AI-generated content, much like identifying an author's style. | 📄 arXiv |
| Fingerprinting Fine-tuned Language Models in the Wild | 🏆 ACL Findings 2021 | Fine-tuning a classifier on synthetic text is the most effective way to fingerprint the specific fine-tuned language model that generated it. | 📄 ACL · 💻 Code |
1.2 📝 Secret Q&A Injection
This approach can be applied to LLMs before deployment by embedding secret fingerprints during training.
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| RAP-SM: Robust Adversarial Prompt via Shadow Models for Copyright Verification of Large Language Models | [✨✨NEW✨✨]📅 2025/5/8 | RAP-SM uses multiple 'shadow models' to jointly optimize an adversarial prompt, creating a robust fingerprint that identifies not just one model, but an entire series of related models by capturing their shared, intrinsic characteristics. | 📄 arXiv |
| MergePrint: Merge-Resistant Fingerprints for Robust Black-box Ownership Verification of Large Language Models | 📅 2025/2/20 | The paper proposes MERGEPRINT, a novel fingerprinting method that embeds robust fingerprints into LLMs by optimizing against a simulated merged model, ensuring ownership can be verified even after the model is merged with others. | 📄 OpenReview |
| Scalable Fingerprinting of Large Language Models | 🏆 ICLR Workshop 2025 | The paper proposes "Perinucleus sampling," a novel method to embed two orders of magnitude more fingerprints into a Large Language Model without degrading its utility, which also enhances persistence against fine-tuning and resilience to collusion attacks. | 📄 OpenReview · 💻 Code |
| UTF: Undertrained Tokens as Fingerprints A Novel Approach to LLM Identification | 📅 2024/10/16 | Introduces an efficient, black-box method to fingerprint LLMs by fine-tuning them to associate specific, rarely used "under-trained tokens" as unique input-output pairs, which minimally impacts performance and is robust to further training. | 📄 arXiv |
| Large Language Models as Carriers of Hidden Messages | 📅 2024/9/24 | Introduces an attack (UTF) to extract hidden messages from LLMs without knowing the trigger, and a corresponding defense (UTFC) to make these messages robustly secure by manipulating token generation probabilities. | 📄 arXiv · 💻 Code |
| FP-VEC: Fingerprinting Large Language Models via Efficient Vector Addition | 📅 2024/9/13 | FP-VEC creates a universal "fingerprint vector" that can be added to any similar LLM to apply a unique ownership signature, avoiding repeated, expensive fine-tuning. | 📄 arXiv · 💻 Code · 🌐 Project |
| ProFLingo: A Fingerprinting-based Intellectual Property Protection Scheme for Large Language Models | 🏆 CNS 2024 | ProFLingo protects LLM IP by generating unique queries that elicit specific, targeted responses only from the original model and its derivatives, acting as a black-box fingerprint. | 📄 arXiv · 💻 Code |
| Hey, That's My Model! Introducing Chain & Hash, An LLM Fingerprinting Technique | 📅 2024/7/17 | Introduces "Chain & Hash," a novel LLM fingerprinting technique that cryptographically binds questions to answers, creating an unforgeable proof of ownership that is robust against adversarial modifications like meta-prompts and fine-tuning. | 📄 arXiv |
| TRAP: Targeted Random Adversarial Prompt Honeypot for Black-Box Identification | 🏆 ACL 2024 Findings | TRAP repurposes adversarial suffixes to get a pre-defined answer from a target LLM, while other models give random answers, effectively fingerprinting the model. | 📄 arXiv · 💻 Code |
| Instructional Fingerprinting of Large Language Models | 🏆 NAACL 2024 | A method to embed a secret, persistent "fingerprint" into a Large Language Model by using a small set of instruction-formatted examples, which allows the model's owner to prove their ownership even after the model has been fine-tuned by others. | 📄 ACL · 💻 Code |
1.3 🧠 Other Methods
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| Robust LLM Fingerprinting via Domain-Specific Watermarks | [✨✨NEW✨✨]📅 2025/5/22 | Instead of watermarking all outputs, the model is trained to embed a watermark only in a specific domain (e.g., a particular language or topic), creating a robust, stealthy, and persistent fingerprint for model provenance. | 📄 arXiv |
| LLMs Have Rhythm: Fingerprinting Large Language Models Using Inter-Token Times and Network Traffic Analysis | 🏆 IEEE Open J. Commun. Soc 2025 | LLMs generate text with a unique 'rhythm' (Inter-Token Times), which can be detected in network traffic to identify the specific model being used, even when the traffic is encrypted. | 📄 arXiv |
| HuRef: HUman-REadable Fingerprint for Large Language Models | 🏆 NIPS 2024 | HuRef creates a human-readable image fingerprint for LLMs by leveraging the stable direction of model parameters, made robust through mathematically derived invariant terms and secured by Zero-Knowledge Proofs, to identify a model's origin without exposing its weights. | 📄 arXiv · 💻 Code |
| A Fingerprint for Large Language Models | 📅 2024/7/1 | The logits output of any LLM is confined to a unique, high-dimensional vector subspace defined by its final linear layer, which can be used as a robust, black-box fingerprint for ownership verification. | 📄 arXiv |
2. 🕵️ White-box Methods
2.1 🛡️ Internal Feature Representation Comparison
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| REEF: Representation Encoding Fingerprints for Large Language Models | 🏆 ICLR 2025 oral | REEF proposes a training-free fingerprinting method that identifies LLM lineage by measuring the Centered Kernel Alignment (CKA) similarity of their internal representations, which is robust to common model modifications like fine-tuning, pruning, and merging. | 📄 arXiv · 💻 Code |
2.2 🔍 Other Methods
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| Gradient-Based Model Fingerprinting for LLM Similarity Detection and Family Classification | [✨✨NEW✨✨]📅 2025/6/2 | A method that creates a unique "fingerprint" for any Large Language Model (LLM) by analyzing how its internal gradients react to random input noise, enabling accurate detection of model similarity and classification of models into their origin families (e.g., Llama, Qwen) without needing training data or watermarks. | 📄 arXiv |
3. 🎭 Common Attack Methods
3.1 🔧 Model-level Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Fine-tuning | Further training the model on domain-specific data to alter output patterns | Text Feature, Secret Q&A |
| Model Merging | Combining multiple models to dilute individual fingerprints | All types |
| Quantization | Reducing model precision to alter internal representations | Internal Feature, Secret Q&A |
| Pruning | Removing model parameters to change behavioral patterns | Internal Feature, Secret Q&A |
| Knowledge Distillation | Training a new model to mimic the fingerprinted model's behavior | All types |
| Parameter Noise Injection | Adding random noise to model weights | Internal Feature, Secret Q&A |
3.2 📝 Prompt-level Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Meta-prompting | Adding instructional prefixes to change response style | Text Feature, Secret Q&A |
| Role-playing Prompts | Instructing the model to act as different personas | Text Feature |
| Style Transfer Prompts | Explicitly requesting specific writing styles or formats | Text Feature |
| System Prompt Injection | Modifying system-level instructions when accessible | Secret Q&A |
| Chain-of-Thought Manipulation | Forcing different reasoning patterns | Text Feature |
| Few-shot Learning Prompts | Providing examples to guide output style | Text Feature |
3.3 🔄 Post-processing Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Paraphrasing | Rewriting generated text while preserving meaning | Text Feature |
| Translation Back-translation | Translating to another language and back | Text Feature |
| Synonym Substitution | Replacing words with synonyms | Text Feature |
| Grammar/Style Polishing | Using grammar checkers or style editors | Text Feature |
| Text Summarization | Condensing the generated content | Text Feature |
| Format Conversion | Changing text structure (e.g., bullets to paragraphs) | Text Feature |
3.4 🎲 Sampling Strategy Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Temperature Manipulation | Adjusting randomness in text generation | Text Feature, Timing |
| Top-k/Top-p Sampling | Modifying token selection strategies | Text Feature |
| Repetition Penalty | Altering repetition control parameters | Text Feature |
| Beam Search Variation | Using different search strategies | Text Feature |
| Multi-sampling & Selection | Generating multiple outputs and selecting the best | Text Feature |
3.5 🕰️ Temporal & Behavioral Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Response Timing Manipulation | Artificially delaying or batching responses | Timing-based |
| Request Pattern Obfuscation | Mixing target queries with noise queries | Active Fingerprinting |
| Context Length Variation | Varying input length to affect processing patterns | Text Feature, Timing |
| Multi-turn Conversation | Embedding queries within longer conversations | Secret Q&A |
3.6 🎭 Operational Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Adversarial Prompt Generation | Using automated tools to find fingerprint-breaking prompts | Secret Q&A |
| Ensemble Output Mixing | Combining outputs from multiple models | All types |
| Human-AI Collaboration | Mixing AI output with human writing | Text Feature |
| Multi-model Workflow | Using different models for different parts of the task | All types |
| Content Laundering | Publishing AI content through multiple transformation steps | Text Feature |
This section is under development. It will include various attack methods against LLM fingerprinting techniques.
4. 📊 Related Survey
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| I'm Spartacus, No, I'm Spartacus: Measuring and Understanding LLM Identity Confusion | 📅 2024/11/16 | This paper systematically investigates 'identity confusion' in LLMs, finding it's a prevalent issue (affecting ~26% of models) caused by hallucination rather than plagiarism, which significantly erodes user trust. | 📄 arXiv |
| Have You Merged My Model? On The Robustness of Large Language Model IP Protection Methods Against Model Merging | 🏆 ACM CCS Workshop 2024 | The paper investigates the robustness of LLM IP protection methods against model merging attacks, finding that instructional fingerprinting techniques are robust, while quantization-based watermarking methods are not. | 📄 arXiv · 💻 Code |
5. 🖼️ Other Related Papers
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| ManiFPT: Defining and Analyzing Fingerprints of Generative Models | 🏆 CVPR 2024 | Defines a generative model's 'fingerprint' as the deviation of its generated samples from the manifold of real data, and uses this deviation as a feature for model attribution. | 📄 arXiv |
🔗 Related Repositories
🙏 Acknowledgements
📝 Note: We will continuously update this repository. If you have good papers to recommend, please feel free to open an issue, and we will update them promptly.
⭐ If you find this repository helpful, please consider giving it a star! ⭐
Contributors
llqqyy
16 commits
Similar repos
README
🔥 Awesome LLM Fingerprint
🚀 An UP-TO-DATE collection list for Large Language Model (LLM) Fingerprinting
📚 Papers(Fingerprint) • 🔗 Related Repos • 🙏 Acknowledgements
📖 Table of Contents
-
- 1.1. 🔤 Text Feature Analysis
- 1.2. 📝 Secret Q&A Injection
- 1.3. 🧠 Other Methods
1. 🔍 Black-box Methods
1.1 🔤 Text Feature Analysis
This approach works better for already deployed LLMs by analyzing their text outputs.
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| Detecting Stylistic Fingerprints of Large Language Models | 📅 2025/3/3 | This paper proposes a unanimous-vote ensemble of classifiers to detect the specific LLM family (e.g., GPT, Claude) that generated a text, achieving extremely high precision by only making a prediction when all classifiers agree. | 📄 arXiv |
| LLMmap: Fingerprinting For Large Language Models | 📅 2025/2/10 | LLMmap actively queries an LLM-powered application with a few specially-crafted prompts to accurately identify the specific underlying LLM version, even when it's hidden behind unknown configurations, randomness, or complex frameworks like RAG. | 📄 arXiv · 💻 Code |
| Invisible Traces: Using Hybrid Fingerprinting to identify underlying LLMs in GenAI Apps | 📅 2025/2/7 | This paper introduces a hybrid fingerprinting framework that combines static (active probing) and dynamic (passive observation) techniques to accurately identify the underlying LLMs in GenAI apps, outperforming individual methods in complex scenarios. | 📄 OpenReview |
| FDLLM: A Dedicated Detector for Black-Box LLMs Fingerprinting | 📅 2025/1/27 | A method that fine-tunes a foundation model using LoRA to effectively identify the source LLM of a given text, and supports this with a new large-scale bilingual dataset (FD-Dataset). | 📄 arXiv |
| Hide and Seek: Fingerprinting Large Language Models with Evolutionary Learning | 📅 2024/8/6 | The paper proposes a "Hide and Seek" algorithm where one LLM (the "Auditor") learns to generate discriminative prompts to make different LLM families produce unique responses, while another LLM (the "Detective") identifies them, effectively "fingerprinting" the models in a black-box setting. | 📄 arXiv · 💻 Code |
| Your Large Language Models Are Leaving Fingerprints | 🏆 COLING 2025 workshop | LLMs exhibit unique and persistent 'fingerprints' in their generated text, allowing simple classifiers based on n-gram features to effectively detect and attribute AI-generated content, much like identifying an author's style. | 📄 arXiv |
| Fingerprinting Fine-tuned Language Models in the Wild | 🏆 ACL Findings 2021 | Fine-tuning a classifier on synthetic text is the most effective way to fingerprint the specific fine-tuned language model that generated it. | 📄 ACL · 💻 Code |
1.2 📝 Secret Q&A Injection
This approach can be applied to LLMs before deployment by embedding secret fingerprints during training.
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| RAP-SM: Robust Adversarial Prompt via Shadow Models for Copyright Verification of Large Language Models | [✨✨NEW✨✨]📅 2025/5/8 | RAP-SM uses multiple 'shadow models' to jointly optimize an adversarial prompt, creating a robust fingerprint that identifies not just one model, but an entire series of related models by capturing their shared, intrinsic characteristics. | 📄 arXiv |
| MergePrint: Merge-Resistant Fingerprints for Robust Black-box Ownership Verification of Large Language Models | 📅 2025/2/20 | The paper proposes MERGEPRINT, a novel fingerprinting method that embeds robust fingerprints into LLMs by optimizing against a simulated merged model, ensuring ownership can be verified even after the model is merged with others. | 📄 OpenReview |
| Scalable Fingerprinting of Large Language Models | 🏆 ICLR Workshop 2025 | The paper proposes "Perinucleus sampling," a novel method to embed two orders of magnitude more fingerprints into a Large Language Model without degrading its utility, which also enhances persistence against fine-tuning and resilience to collusion attacks. | 📄 OpenReview · 💻 Code |
| UTF: Undertrained Tokens as Fingerprints A Novel Approach to LLM Identification | 📅 2024/10/16 | Introduces an efficient, black-box method to fingerprint LLMs by fine-tuning them to associate specific, rarely used "under-trained tokens" as unique input-output pairs, which minimally impacts performance and is robust to further training. | 📄 arXiv |
| Large Language Models as Carriers of Hidden Messages | 📅 2024/9/24 | Introduces an attack (UTF) to extract hidden messages from LLMs without knowing the trigger, and a corresponding defense (UTFC) to make these messages robustly secure by manipulating token generation probabilities. | 📄 arXiv · 💻 Code |
| FP-VEC: Fingerprinting Large Language Models via Efficient Vector Addition | 📅 2024/9/13 | FP-VEC creates a universal "fingerprint vector" that can be added to any similar LLM to apply a unique ownership signature, avoiding repeated, expensive fine-tuning. | 📄 arXiv · 💻 Code · 🌐 Project |
| ProFLingo: A Fingerprinting-based Intellectual Property Protection Scheme for Large Language Models | 🏆 CNS 2024 | ProFLingo protects LLM IP by generating unique queries that elicit specific, targeted responses only from the original model and its derivatives, acting as a black-box fingerprint. | 📄 arXiv · 💻 Code |
| Hey, That's My Model! Introducing Chain & Hash, An LLM Fingerprinting Technique | 📅 2024/7/17 | Introduces "Chain & Hash," a novel LLM fingerprinting technique that cryptographically binds questions to answers, creating an unforgeable proof of ownership that is robust against adversarial modifications like meta-prompts and fine-tuning. | 📄 arXiv |
| TRAP: Targeted Random Adversarial Prompt Honeypot for Black-Box Identification | 🏆 ACL 2024 Findings | TRAP repurposes adversarial suffixes to get a pre-defined answer from a target LLM, while other models give random answers, effectively fingerprinting the model. | 📄 arXiv · 💻 Code |
| Instructional Fingerprinting of Large Language Models | 🏆 NAACL 2024 | A method to embed a secret, persistent "fingerprint" into a Large Language Model by using a small set of instruction-formatted examples, which allows the model's owner to prove their ownership even after the model has been fine-tuned by others. | 📄 ACL · 💻 Code |
1.3 🧠 Other Methods
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| Robust LLM Fingerprinting via Domain-Specific Watermarks | [✨✨NEW✨✨]📅 2025/5/22 | Instead of watermarking all outputs, the model is trained to embed a watermark only in a specific domain (e.g., a particular language or topic), creating a robust, stealthy, and persistent fingerprint for model provenance. | 📄 arXiv |
| LLMs Have Rhythm: Fingerprinting Large Language Models Using Inter-Token Times and Network Traffic Analysis | 🏆 IEEE Open J. Commun. Soc 2025 | LLMs generate text with a unique 'rhythm' (Inter-Token Times), which can be detected in network traffic to identify the specific model being used, even when the traffic is encrypted. | 📄 arXiv |
| HuRef: HUman-REadable Fingerprint for Large Language Models | 🏆 NIPS 2024 | HuRef creates a human-readable image fingerprint for LLMs by leveraging the stable direction of model parameters, made robust through mathematically derived invariant terms and secured by Zero-Knowledge Proofs, to identify a model's origin without exposing its weights. | 📄 arXiv · 💻 Code |
| A Fingerprint for Large Language Models | 📅 2024/7/1 | The logits output of any LLM is confined to a unique, high-dimensional vector subspace defined by its final linear layer, which can be used as a robust, black-box fingerprint for ownership verification. | 📄 arXiv |
2. 🕵️ White-box Methods
2.1 🛡️ Internal Feature Representation Comparison
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| REEF: Representation Encoding Fingerprints for Large Language Models | 🏆 ICLR 2025 oral | REEF proposes a training-free fingerprinting method that identifies LLM lineage by measuring the Centered Kernel Alignment (CKA) similarity of their internal representations, which is robust to common model modifications like fine-tuning, pruning, and merging. | 📄 arXiv · 💻 Code |
2.2 🔍 Other Methods
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| Gradient-Based Model Fingerprinting for LLM Similarity Detection and Family Classification | [✨✨NEW✨✨]📅 2025/6/2 | A method that creates a unique "fingerprint" for any Large Language Model (LLM) by analyzing how its internal gradients react to random input noise, enabling accurate detection of model similarity and classification of models into their origin families (e.g., Llama, Qwen) without needing training data or watermarks. | 📄 arXiv |
3. 🎭 Common Attack Methods
3.1 🔧 Model-level Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Fine-tuning | Further training the model on domain-specific data to alter output patterns | Text Feature, Secret Q&A |
| Model Merging | Combining multiple models to dilute individual fingerprints | All types |
| Quantization | Reducing model precision to alter internal representations | Internal Feature, Secret Q&A |
| Pruning | Removing model parameters to change behavioral patterns | Internal Feature, Secret Q&A |
| Knowledge Distillation | Training a new model to mimic the fingerprinted model's behavior | All types |
| Parameter Noise Injection | Adding random noise to model weights | Internal Feature, Secret Q&A |
3.2 📝 Prompt-level Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Meta-prompting | Adding instructional prefixes to change response style | Text Feature, Secret Q&A |
| Role-playing Prompts | Instructing the model to act as different personas | Text Feature |
| Style Transfer Prompts | Explicitly requesting specific writing styles or formats | Text Feature |
| System Prompt Injection | Modifying system-level instructions when accessible | Secret Q&A |
| Chain-of-Thought Manipulation | Forcing different reasoning patterns | Text Feature |
| Few-shot Learning Prompts | Providing examples to guide output style | Text Feature |
3.3 🔄 Post-processing Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Paraphrasing | Rewriting generated text while preserving meaning | Text Feature |
| Translation Back-translation | Translating to another language and back | Text Feature |
| Synonym Substitution | Replacing words with synonyms | Text Feature |
| Grammar/Style Polishing | Using grammar checkers or style editors | Text Feature |
| Text Summarization | Condensing the generated content | Text Feature |
| Format Conversion | Changing text structure (e.g., bullets to paragraphs) | Text Feature |
3.4 🎲 Sampling Strategy Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Temperature Manipulation | Adjusting randomness in text generation | Text Feature, Timing |
| Top-k/Top-p Sampling | Modifying token selection strategies | Text Feature |
| Repetition Penalty | Altering repetition control parameters | Text Feature |
| Beam Search Variation | Using different search strategies | Text Feature |
| Multi-sampling & Selection | Generating multiple outputs and selecting the best | Text Feature |
3.5 🕰️ Temporal & Behavioral Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Response Timing Manipulation | Artificially delaying or batching responses | Timing-based |
| Request Pattern Obfuscation | Mixing target queries with noise queries | Active Fingerprinting |
| Context Length Variation | Varying input length to affect processing patterns | Text Feature, Timing |
| Multi-turn Conversation | Embedding queries within longer conversations | Secret Q&A |
3.6 🎭 Operational Attacks
| 🎯 Attack Method | 📝 Description | 🛡️ Target Fingerprint Type |
|---|---|---|
| Adversarial Prompt Generation | Using automated tools to find fingerprint-breaking prompts | Secret Q&A |
| Ensemble Output Mixing | Combining outputs from multiple models | All types |
| Human-AI Collaboration | Mixing AI output with human writing | Text Feature |
| Multi-model Workflow | Using different models for different parts of the task | All types |
| Content Laundering | Publishing AI content through multiple transformation steps | Text Feature |
This section is under development. It will include various attack methods against LLM fingerprinting techniques.
4. 📊 Related Survey
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| I'm Spartacus, No, I'm Spartacus: Measuring and Understanding LLM Identity Confusion | 📅 2024/11/16 | This paper systematically investigates 'identity confusion' in LLMs, finding it's a prevalent issue (affecting ~26% of models) caused by hallucination rather than plagiarism, which significantly erodes user trust. | 📄 arXiv |
| Have You Merged My Model? On The Robustness of Large Language Model IP Protection Methods Against Model Merging | 🏆 ACM CCS Workshop 2024 | The paper investigates the robustness of LLM IP protection methods against model merging attacks, finding that instructional fingerprinting techniques are robust, while quantization-based watermarking methods are not. | 📄 arXiv · 💻 Code |
5. 🖼️ Other Related Papers
| 📄 Paper Title | 📅 Date & Publication | 💡 TL;DR | 🔗 Links |
|---|---|---|---|
| ManiFPT: Defining and Analyzing Fingerprints of Generative Models | 🏆 CVPR 2024 | Defines a generative model's 'fingerprint' as the deviation of its generated samples from the manifold of real data, and uses this deviation as a feature for model attribution. | 📄 arXiv |
🔗 Related Repositories
🙏 Acknowledgements
📝 Note: We will continuously update this repository. If you have good papers to recommend, please feel free to open an issue, and we will update them promptly.
⭐ If you find this repository helpful, please consider giving it a star! ⭐
Similar repos
Contributors
llqqyy
16 commits