FPEdit: Robust LLM Fingerprinting through Localized Parameter Editing (2508.02092v2)

Abstract: LLMs represent significant investments in computation, data, and engineering expertise, making them extraordinarily valuable intellectual assets. Nevertheless, these AI assets remain vulnerable to unauthorized redistribution and commercial exploitation through fine-tuning or black-box deployment. Current fingerprinting approaches face a fundamental trade-off: intrinsic methods require full parameter access, while backdoor-based techniques employ statistically anomalous triggers easily detected and filtered by adversaries. To address these limitations, we introduce FPEdit, a novel framework that leverages knowledge editing to inject semantically coherent natural language fingerprints through sparse, targeted modifications to model weights. Our approach introduces Promote-Suppress Value Vector Optimization, which simultaneously enhances target token likelihood while suppressing competing tokens, ensuring robust fingerprint integration without degrading core model functionality. Extensive experiments show that FPEdit achieves 95-100% fingerprint retention under both full-parameter fine-tuning and parameter-efficient adaptation, while preserving performance on downstream benchmarks. Moreover, FPEdit remains robust under quantization, pruning, and stochastic decoding, and can embed 10 fingerprint pairs into LLaMA2-7B in under 2 minutes using less than 30 GB of GPU memory, which represents a substantial reduction in resource requirements. These advances establish FPEdit as the first fingerprinting approach to simultaneously achieve robustness against adaptation, resistance to detection, and preservation of model utility, thereby providing a minimally invasive solution for reliable provenance verification of LLMs in adversarial deployment scenarios.

• The paper demonstrates that FPEdit significantly enhances LLM fingerprinting by using localized knowledge editing for robust ownership verification.
• It introduces a Promote-Suppress optimization strategy to inject natural language fingerprints that seamlessly blend with genuine outputs.
• Experiments reveal that FPEdit maintains 95–100% fingerprint retention under full fine-tuning and parameter-efficient adaptations without degrading performance.

FPEdit: Robust LLM Fingerprinting through Localized Parameter Editing

Introduction to LLM Fingerprinting

LLMs have become critical intellectual assets due to their substantial computational cost and functional capabilities. Protecting these models from unauthorized use and redistribution is a pressing issue, typically addressed via fingerprinting methodologies. Current approaches either require full parameter access or rely on detectable backdoor triggers, both with clear limitations. The paper "FPEdit: Robust LLM Fingerprinting through Localized Parameter Editing" introduces a novel fingerprinting framework that significantly improves upon these methods.

The FPEdit Framework

FPEdit employs knowledge editing techniques to inject semantically coherent natural language fingerprints into LLMs. This process involves sparse, targeted modifications to model weights, using Promote-Suppress Value Vector Optimization to both enhance target token likelihood and suppress competing tokens. This allows for robust fingerprint integration without degrading the model's core functionality.

Figure 1: The overview of FPEdit for copyright tracking with a focus on Natural Language Fingerprints and Promote-Suppress Value Vector Optimization.

Fingerprint Design and Injection

The design of Natural Language Fingerprints (NLFs) ensures these triggers appear statistically normal, effectively circumventing detection. Unlike garbled fingerprints, NLFs blend seamlessly into genuine textual contexts. To achieve robust ownership verification, knowledge editing is employed to inject these fingerprints, focusing specifically on key-value vectors associated with target tokens, optimized via a promotion-suppress strategy.

Figure 2: Comparison of perplexity distributions showing NLF triggers closely match normal user inputs, unlike garbled fingerprints.

Experimental Evaluation

Extensive experiments demonstrate FPEdit's superior performance in fingerprint retention rates, achieving 95-100% under both full-parameter fine-tuning and parameter-efficient adaptation. FPEdit maintains resilience to quantization, pruning, and stochastic decoding, supporting practical implementations with limited resources, embedding fingerprints in LLaMA2-7B in under 2 minutes using less than 30 GB of GPU memory.

Robustness Against Adaptation

While most fingerprinting methods deteriorate under model adaptation, FPEdit remains robust across various downstream tasks. Its advanced editing techniques ensure fingerprints persist despite architectural modifications, establishing the framework as a reliable solution for ownership verification.

Figure 3: Loss curves of LLaMA2-7B during full fine-tuning on four downstream datasets, highlighting stable convergence.

Implications and Future Directions

FPEdit sets a new standard for fingerprinting in LLMs, balancing robustness against adaptation, stealthiness against detection, and preservation of model utility. This opens avenues for improved IP protection mechanisms by integrating editing-based methodologies. Future research could explore extending these techniques to multimodal models and addressing challenges unique to VLMs. Additionally, strategies to counteract potential fingerprint erasure attacks will be crucial to long-term security.

Conclusion

FPEdit positions itself as a transformative approach in LLM ownership verification. By leveraging advanced knowledge editing techniques, it achieves robustness against model adaptation and resilience to adversarial attacks, while requiring minimal computational resources. As LLM use proliferates, methods such as FPEdit will be essential to ensure ethical deployment and protect intellectual assets in competitive AI markets.

Figure 4: Examples of fingerprint pairs employed by different fingerprinting methods, illustrating the distinctive approach of FPEdit.