modelDNA: Calibrated Lineage Verification and Merge Decomposition from Sampled Weight Fingerprints

Abstract: The lineage graph of open-weight LLMs is self-reported: Hugging Face's base_model metadata field is optional and unverified, and over 60% of Hub models document no parentage at all. Methods for detecting lineage from weights exist in the research literature, but each ships as paper code tied to one signal and one experiment; when a provenance dispute breaks, the analysis is redone by hand. This report describes modelDNA, a tool that fingerprints a model from roughly 100-300 MB of ranged HTTP reads (instead of a full 15 GB download for a 7B model), compares the fingerprint against a reference database of foundation models across four published signal families, and returns one of eight verdict classes with a calibrated probability, preferring honest abstention to confident error. On a benchmark of 15 real Hub models with org-documented parentage, judged against 8 candidate bases (13 positives, 107 hard negatives), the system achieves AUROC 1.0, zero false positives at its reporting threshold, and 13/13 correct top-1 parent attribution. The report's second contribution is merge decomposition. Every mainstream weight-merging method is (near-)linear per tensor, and fingerprint sample positions are deterministic functions of tensor identity, so a merged model's fingerprint is the same linear combination of its parents' fingerprints. Mixture weights can therefore be recovered from fingerprints alone by sum-to-one constrained least squares. Against merges with published mergekit configurations as ground truth, the method recovers a slerp merge's layer-interpolation curves at r = 0.999 and a dare_ties merge's mixture weights to within 0.011 of the published values, without downloading any weights beyond the fingerprints. All fingerprints, benchmarks, and the inferred lineage graph of 55 models are public and reproducible offline.

• The paper’s main contribution is the introduction of modelDNA, which efficiently fingerprints large-scale models to verify ancestry and decompose merge recipes.
• It employs deterministic HTTP byte-range sampling and aggregated signal ensembles to ensure robust, cross-compatible lineage verification with zero false positives.
• Empirical results on LineageBench demonstrate high-fidelity attribution and merger recovery, underlining the tool’s practical impact on reproducibility and forensic audits.

modelDNA: Model Lineage Verification and Merge Decomposition via Sampled Weight Fingerprints

Motivation and Problem Statement

The proliferation of open-weight models on major repositories such as Hugging Face, which has surpassed 2.9 million public models, has introduced acute challenges in model ancestry verification and forensic provenance. Metadata fields such as base_model are optional and frequently omitted or incorrect, with over 60% of entries lacking documented lineage. This lack of verifiable ancestry complicates reproducibility, technical audits, copyright enforcement, and dispute resolution, as seen in high-profile incidents involving alleged lineage misrepresentation.

While multiple research efforts have introduced ad hoc model fingerprinting and lineage detection signals, there has been a notable absence of unified, production-grade tooling capable of delivering calibrated, public-facing verdicts with a reference database, scalable infrastructure, and clear abstention protocols. The paper addresses this critical infrastructural gap with modelDNA, a user-facing tool for efficient model fingerprinting, calibrated parent identification, and robust merge recipe decomposition.

Fingerprint Design and Signal Ensemble

modelDNA introduces a sampled fingerprinting approach utilizing 100–300MB of HTTP byte-range reads per 7B-parameter model, a significant efficiency gain over full-precision downloads (~15GB). All sample positions are deterministic functions of (seed, canonical role, layer, tensor size) and agnostic to tensor naming. This design choice ensures cross-compatibility and direct element alignment between models, which is instrumental for both parent identification and later merge decomposition.

The fingerprint consists of four aggregated signal families:

• F1: Per-layer standard deviations ("σ-curves") of attention/MLP projections, following the HonestAGI approach, robust to SFT and continued pretraining.
• F2: Full-norm vectors and bias subsample statistics, to capture training-invariant per-layer features.
• F3: PCS samples, seeded element-wise subsamples of the 2D attention/MLP projections, providing a compressed but decisive test for straightforward derivations.
• F4: Top-32 singular values from a randomized subspace iteration, to capture spectral invariants robust under certain reparameterizations.

Sampling constants are frozen for reproducibility and database integrity; fingerprints are compact (~1.5MB zipped) and the database covers 37 foundation models, a spectrum of recent architectures, and deliberate hard negatives.

Calibrated Verdicts Framework

The tool implements an abstention-first, calibrated probabilistic engine mapping fingerprint evidence to one of eight discrete verdict classes (e.g., EXACT_COPY, QUANTIZED_COPY, FINE_TUNE, MERGE, etc). The scoring pipeline consists of:

1. A hard structural filter (reject on tensor shape or layer count mismatches).
2. Aggregation of four primary similarity metrics over the signal family ensemble.
3. A non-negative logistic model calibrated over synthetic benchmarks to yield probabilities.
4. Imputation of missing features with unrelated-pair background means, ensuring absence of evidence is not misconstrued as independence.

Thresholds are explicitly tuned for zero false positives, emphasizing precision over recall to minimize reputational risk in downstream factual disputes.

Merge Decomposition from Sampled Fingerprints

A central innovation is the demonstration that merge recipes—mixture weights in model fusions performed via MergeKit and related methods—can be reconstructed by constrained least-squares regression directly from fingerprint samples. This is enabled by:

• The alignment of all models' sampled positions (due to deterministic sampling functions).
• The near-linearity of mainstream merging methods (linear interpolation, slerp, task arithmetic, TIES, DARE), which ensures the merged model's fingerprint is a linear (or in some cases affine) combination of its parents'.
• Imposing a sum-to-one constraint solves the ill-conditioning induced by high task-vector collinearity among fine-tunes sharing a base; the regression is recomputed in task-vector space.

Empirical results on published merges (e.g., NeuralPipe-7B-slerp and Monarch-7B with DARE-TIES) demonstrate recovery of mixture weights within 0.011 of ground truth, with layer-wise reconstructed mixtures tracing author-published interpolation curves at $r = 0.999$ fidelity. The approach is robust to noise injection, and per-layer decomposition exposes depth-varying interpolation profiles characteristic of certain advanced merges.

Evaluation: LineageBench and Practical Results

modelDNA is validated against LineageBench, a curated benchmark of 15 suspect models across diverse derivation regimes (community fine-tunes, continued pretrains, official releases, merge chains, and quantized copies), with ground-truth ancestry corroborated by organization-authored technical documentation instead of the frequently-unreliable metadata tags.

Key metrics include:

• AUROC: 1.0 (13 positives vs 107 hard negatives).
• Zero False Positives at p ≥ 0.9 Threshold.
• 13/13 Correct Top-1 Parent Attribution.
• Clean separation between positives (minimum 0.943) and negatives (maximum 0.660) in probability space.

Merge decomposition matches published mixture recipes to within experimental error, and ambiguity warnings are surfaced when candidate task vectors are highly collinear or when incomplete candidate lists limit interpretability. The conservative, abstention-oriented reporting philosophy ensures the system avoids erroneous merge or derivation attributions.

Limitations and Responsible Disclosure

modelDNA makes statistically calibrated, not absolute, statements of consistency with derivation. Known limitations include:

• Blindness to Distillation: No weight-space approach can detect distillation links.
• Incomplete candidate lists for merges may yield decompositions over extended ancestry, not direct parents.
• Adversarial robustness is limited: deliberate reparameterization (permutation, rotation) and retraining-scale attacks can defeat some signature families.
• Calibration, while perfect at ranking in limited real-positive settings, requires expansion and validation on larger real-world benchmarks.
• Quantization and format gaps: Some PyTorch and GPTQ/AWQ formats are out of scope for the current implementation.
• Benchmark Scale: Present benchmarks report 15 suspects; modelDNA's architecture is scalable, but downstream reporting caveats persist until further growth.

Responsible use is enforced via phrasing, abstention/ambiguity mandates, transparent reporting artifacts, and mandatory background distributions accompanying probability scores.

Theoretical and Practical Implications

modelDNA provides a robust platform for public, reproducible, and efficient model lineage verification and merge attribution. Its adoption could standardize model provenance audits, enable reliable model family construction, and underpin both academic and industrial dispute resolution. The fingerprint design, with its deterministic sampling, opens future directions for scalable population-wide model phylogeny reconstruction, more granular merge map extractions, and extended cross-modal provenance tools.

Theoretically, sum-to-one constrained decomposition in task-vector space underlines the power of structured data alignment across high-dimensional model spaces for interpretability. The deterministic sampling framework could be extended to behavioral and gradient-tier signals in future, capturing training-trajectory and initialization information absent from raw weights.

Conclusion

modelDNA bridges foundational work from the model fingerprinting and lineage literature into a mature tool for static, efficient, and calibrated model ancestry and merge forensics. Its design, based on deterministic fingerprint alignment and conservative probabilistic reporting, enables reproducible and safe deployment in large-scale model repositories. As benchmark breadth increases and further behavioral tiers are integrated, modelDNA is well-positioned to be a central instrument in LLM provenance auditing and transparency infrastructure.