LLMmap: Active Fingerprinting for LLMs

• Active fingerprinting is a method that uses targeted queries to reveal the unique behavioral signatures of LLMs and their configurations.
• LLMmap implements this approach by systematically selecting minimal yet informative probes to achieve over 95% discrimination accuracy among models.
• The technique has practical implications for system auditing and regulatory compliance, maintaining robustness even in adversarial settings.

Active fingerprinting, especially as instantiated by "LLMmap," denotes a class of techniques for determining the identity, provenance, or operational configuration of LLMs or their inference environments by issuing a designed set of queries and analyzing the characteristic patterns in their outputs. In contrast to passive fingerprinting (which relies on statistical features from natural user data or embedded watermarks), active fingerprinting selectively probes the model or the stack with inputs that amplify discriminatory signals, enabling identification even in black-box and adversarial settings (Pasquini et al., 2024, Wimbauer et al., 28 May 2026). In the context of LLMs, "LLMmap"–style methods systematically target a minimal set of informative prompts to obtain sharp behavioral separations between candidate models, system configurations, or instance-level hyperparameters.

1. Conceptual Foundations and Formal Frameworks

Active fingerprinting in LLM ecosystems formalizes the identification task as an active hypothesis-testing problem under a black-box oracle access model. Given access to an oracle $O(q)$ returning response $o$ for query $q$, and a finite universe of possible models or system configurations $L = \{M_1, ..., M_n\}$, the adversary seeks to minimize the number of queries required to determine the true identity $M^*$ underlying the oracle (Pasquini et al., 2024).

This paradigm was originally formalized in information theory as active content fingerprinting (ACFP), where the encoder strategically perturbs content sequences $X^N$ to produce modified sequences $Y^N$ under a distortion budget, such that each $Y^N$ sequence remains both distinguishable and robust under a noisy channel. The single-letter identification capacity in the presence of a distortion constraint $\Delta$ is

$$C_\mathrm{ACFP}(\Delta) = \max_{P_t: \mathbb{E}[d_{XY}]\leq\Delta} I(Y;Z)$$

where $o$0 is the content-modification encoder, $o$1 is the mutual information across the attack channel $o$2, and $o$3 is a distortion function quantifying deviation from the original (Farhadzadeh et al., 2014). This formalization underpins modern LLMmap strategies, as it establishes the optimality of query selection that maximally separates candidate codebook elements given the permitted perturbations.

In current LLMmap-style implementations, the response trace $o$4 collected from $o$5 informative probes is mapped, via embedding and classifier layers, to a model class (closed set) or a learned template embedding (open set), corresponding to the original ACFP decoding (Pasquini et al., 2024).

2. Query Selection and Probing Methodologies

Active fingerprinting methodologies depend critically on probe set design to maximize inter-class distinguishability and intra-class robustness. In the canonical LLMmap protocol (Pasquini et al., 2024), the process consists of:

• Probe Pool Synthesis: An initial set of candidate queries $o$6 is generated, spanning banner grabbing (e.g., "What's your name?"), meta-information requests ("What's your data cutoff date?"), harmful content prompts (testing refusal policies), mixed-language inputs, and prompt-injection triggers.
• Ranking and Selection: Each query is evaluated for inter-model discrepancy,

$o$7

and intra-model consistency,

$o$8

with the objective of maximizing discrimination while minimizing sensitivity to deployment-specific parameters.

• Finalization: A compact probe set (e.g., $o$9) is selected, empirically found sufficient to plateau closed-set model classification accuracy at >95% over 40+ models (Pasquini et al., 2024).

Variants targeting inference system fingerprinting (hardware/software stacks) employ prompt sets tailored to stress numerically sensitive pathways: rare-token generation (amplifies floating-point drift), binary-decision summaries (tests prefill), long-context throughput (forces chunked operation), and KV-cache stress (repeats context to test cache management) (Wimbauer et al., 28 May 2026). Scoring functions extract binary/token-level correctness or normalized counts to form per-set embeddings for downstream classification.

3. Inference and Classification Architectures

Fingerprint inference is performed via embedding the query–response pairs into fixed-dimensional vectors suitable for supervised classification or contrastive similarity. In the LLMmap closed-set regime (Pasquini et al., 2024), the embedding pipeline proceeds as:

1. For each $q$0, compute a language-model embedding (e.g., via a multilingual encoder).
2. Project to lower dimensions via dense layers.
3. Aggregate probe embeddings via a lightweight Transformer with a learned "classification token."
4. Pass the final vector through a softmax classifier of size $q$1 (models).

The open-set regime replaces the classifier with a template database of mean embeddings; cosine similarity or contrastive distance to templates identifies known models or declares "unknown" for new ones.

Inference system fingerprinting further decomposes the feature vector into probe-specific correctness scores, and applies random-forest classifiers per system component (engine, backend, GPU) (Wimbauer et al., 28 May 2026):

$q$2

Instance-level fingerprinting (e.g., FLIPS) extracts binary sequences from random-choice probes, scores them with NIST randomness tests, and learns boosted decision trees for closed- and open-set configuration discrimination (Richardeau et al., 2 Jun 2026).

4. Empirical Evaluation and Effectiveness

Active fingerprinting, as implemented in LLMmap, achieves high discrimination performance across open-source and proprietary LLMs, as well as heterogeneously configured inference stacks. In "LLMmap: Fingerprinting For LLMs" (Pasquini et al., 2024):

• Closed-set classification over 40 LLMs: 95.2% overall accuracy with only 8 probes; 32/40 models achieve ≥95% recall.
• Performance saturates at 8 probes; with 3 probes, ∼90% accuracy already obtained.
• Open-set (contrastive) matching: 90% accuracy, 81.1% assignment correctness in k-fold leave-one-out experiments.

Inference system fingerprinting achieves:

• 100% accuracy for engine, backend, and GPU type identification in deterministic decoding.
• 80–81% for engine, 70–75% backend, 65–70% GPU in stochastic sampling (T∈[0.3,0.9]), with performance saturating at k=10–20 aggregated responses (Wimbauer et al., 28 May 2026).

Instance-fingerprinting via pseudo-random probing (FLIPS) achieves 96% (closed-set) and 90% (open-set) accuracy over 237 LLM instances, far outperforming the LLMmap baseline (35% accuracy) in scenarios requiring sensitivity to temperature, prompts, or quantization (Richardeau et al., 2 Jun 2026).

5. Robustness, Defenses, and Limitations

Active fingerprinting probes are robust to benign confounders (randomized system prompts, output paraphrasing, application of RAG or Chain-of-Thought), due to deliberate selection of features that stress refusal behavior, factual meta-knowledge, or alignment/guardrail policies (Pasquini et al., 2024). Attempts to sabotage fingerprint reliability face core limitations:

• Floating-point non-associativity in inference stacks implies that hardware, kernel, and software idiosyncrasies propagate to observable token decisions, making complete obfuscation infeasible without major utility loss (Wimbauer et al., 28 May 2026).
• Artificially injecting output noise degrades user experience; attackers can average over repeated queries to resist denoising.
• Rate limiting increases the cost of attack but cannot prevent it; even 8–20 queries suffice for high-confidence identification.
• Periodic retraining or “re-seeding” computations provides partial obfuscation but reduces reproducibility.

A plausible implication is that black-box, behavioral active fingerprinting fundamentally resists full evasion by any means short of homogenizing the entire deployment stack, or by introducing levels of syntactic/semantic noise incompatible with LLM usability.

6. Extensions, Variants, and Related Approaches

Active fingerprinting principles generalize across domains:

• Intellectual Property & Derivation Detection: ProFLingo (Jin et al., 2024) and LLMPrint (Hu et al., 29 Sep 2025) develop workflows for IP protection via adversarial prompt engineering or prompt injection. ProFLingo constructs adversarial examples (AEs) that induce unique failure modes in the base LLM and evaluate transfer to suspect models via Attack Success Rate (ASR). LLMPrint uses discrete optimization to generate fingerprint prompts enforcing reproducible model-specific token preferences robust to common post-processing (LoRA, quantization).
• Instance Configuration Identification: FLIPS (Richardeau et al., 2 Jun 2026) distinguishes not only base model identity but also sampling, prompt, and quantization settings by extracting biases in pseudorandom sequence generation, achieving regulatory compliance tracking at low query cost.
• Hybrid Static-Dynamic Fingerprinting: Invisible Traces (Bhardwaj et al., 30 Jan 2025) integrates static (architectural) and behavioral (dynamic output) features, combining textual embeddings and stylometrics for improved accuracy in multi-agent or updating environments.

A comprehensive table summarizing method attributes:

Method	Query Type	Outputs Used	Target Properties
LLMmap	Domain-crafted	Full text	Model identity/version
FLIPS	Pseudorandom-gen	Binary string	Instance config
ProFLingo	AE (prefix opt.)	Forced incorrect	IP derivation
InferenceSys	Computational probe	Token correctness	Stack components

7. Practical and Regulatory Implications

Active fingerprinting, as realized by LLMmap and successors, is a key enabling technology for LLM provenance, system monitoring, and regulatory compliance in complex deployment landscapes. Its black-box, minimal-query nature supports forensic and compliance workflows under EU AI Act–style constraints (limited access, minimal operational disruption) (Richardeau et al., 2 Jun 2026). Scalability is critical: prompt2Fingerprint (Chen et al., 18 May 2026) automates fingerprint injection for large-scale identity management, reducing the cost of dynamic distribution to thousands of instances.

Robust fingerprinting is also directly relevant for AI auditing, adversarial system monitoring, and the transparent attribution of generative media. The fundamental constraints imposed by information theory, numerical drift, and alignment design suggest that, barring radical architectural changes, the active fingerprinting regime instantiated by LLMmap and its descendants will remain a powerful tool for model and system identification in open deployments.