Ownership verification without leaking fingerprint pairs

Develop a verification procedure for fingerprinted AI models that authenticates ownership without revealing the secret fingerprint (key, response) pairs embedded in the model, thereby preventing adversaries from using leaked fingerprints to remove them and re-release the model.

Background

Existing fingerprinting methods often assume one-shot verification and, in practice, leak the fingerprint pairs during ownership checks. Once the pairs are revealed, adversaries can filter or remove them without harming the model’s utility, undermining persistent ownership claims.

The paper highlights the need for verification protocols that confirm provenance while keeping the specific fingerprint pairs secret, to sustain ownership protection across a model’s lifecycle and subsequent deployments.

References

Verifying the ownership without revealing the secret fingerprint pairs is an important open question.

— OML: Open, Monetizable, and Loyal AI  (2411.03887 - Cheng et al., 2024) in Chapter 2, Section 2.2 (Fingerprinting), paragraph “Previous work and vulnerability to leakage of fingerprint pairs”

How to resist template leakage and adaptive fingerprint removal attacks remains a problem for future research.

— The Shape of Ownership: Verifying LLM Provenance through Semantic Structures  (2609.02553 - Sun et al., 2 Sep 2026) in Section Discussion, subsection “Limitations”

Whether a secret can be planted so that classical verification is efficient while extraction stays hard is still open.

— Classical Verification of a Remote Quantum Processor via Degenerate Concordant Computations: An Application to Randomness Generation  (2610.08185 - Das et al., 6 Oct 2026) in Section 1, Introduction