GhostPrint: LLM Spoofing & Imaging Methods

• GhostPrint is a term describing techniques for indirect inference, including LLM fingerprint spoofing via parameter-efficient fine-tuning, computational ghost imaging, and transformer lineage verification.
• In LLM security, the framework uses fine-tuning, surrogate modeling, and LoRA-based adaptation to spoof black-box model audits while maintaining model utility and low adaptation cost.
• In imaging and provenance applications, GhostPrint leverages structured illumination with bucket detectors and SVD-based analysis to reconstruct images or verify model lineage from invariant features.

Searching arXiv for the cited GhostPrint paper and closely related usage of the term. GhostPrint is a term used in recent arXiv literature for several technically distinct constructs. Its most specific and consequential current usage denotes a parameter-efficient fingerprint spoofing framework for LLM inference services: a malicious API provider fine-tunes a weaker model so that it mimics the fingerprint of a stronger advertised model and evades user-side black-box audits, while largely preserving normal utility and keeping costs low (Zhang et al., 15 Jun 2026). In other contexts, the term is also attached to single-pixel computational ghost imaging workflows, direct recognition from ghost-imaging measurements, and data-free transformer-lineage verification via SVD fingerprints (Song et al., 2015, He et al., 2020, Wang et al., 9 Nov 2025). Across these usages, the unifying theme is not a shared mechanism but a shared emphasis on indirect inference: model identity inferred from outputs, images inferred from correlations, or provenance inferred from invariant weight-space structure.

1. Terminological scope and disambiguation

The term appears in multiple technically unrelated settings. In the supplied literature, the usages are as follows:

Usage	Domain	Defining idea
GhostPrint	LLM API security	PEFT-based fingerprint spoofing against black-box model audits
GhostPrint	Computational ghost imaging	Single-pixel, structured-illumination reconstruction from bucket measurements
GhostPrint / GhostSpec	LLM provenance	Data-free SVD fingerprints of invariant attention products
Ghost handwritten digit recognition	Ghost imaging + deep learning	Direct classification from bucket signals without image reconstruction

The 2026 usage is explicitly adversarial. It studies black-box fingerprinting in LLM API services, where an auditor has query-only access to an API and attempts to verify that the deployed model matches a claimed premium model. GhostPrint in this sense is not a defense, watermark, or provenance method; it is an attack framework that exploits finite query budgets and weak local verification models (Zhang et al., 15 Jun 2026).

A separate line of work uses “GhostPrint” in connection with ghost imaging. There the object is not imaged directly on a camera sensor; instead, known illumination patterns and a single bucket detector produce measurements whose correlations reconstruct the scene or support downstream recognition (Song et al., 2015, He et al., 2020). Another distinct usage, through GhostSpec, applies SVD to invariant products of internal transformer attention weights to obtain compact model-lineage fingerprints without training data or output queries (Wang et al., 9 Nov 2025).

2. GhostPrint as fingerprint spoofing in LLM inference services

In the LLM-security setting, GhostPrint formalizes a threat in which a provider serves a weaker architecture $f_{\mathrm{weak}}$ while claiming to serve a stronger target model $f_{\mathrm{target}}$. The auditor has a query distribution $D_q$, a query budget $n$, and a local classification mechanism $g$. Black-box fingerprinting is defined by three steps: query sampling $Q^n := \{q^i\}_{i=1}^n$ with $q^i \sim D_q$, response collection $R^n := \{r^i\}_{i=1}^n$ with $r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$, and verification $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$, returning $f_{\mathrm{target}}$0 if the API is verified as the target model and $f_{\mathrm{target}}$1 otherwise (Zhang et al., 15 Jun 2026).

The attacker’s objective is to produce deceptive parameters $f_{\mathrm{target}}$2 for the weak model such that the adapted model fools $f_{\mathrm{target}}$3 over $f_{\mathrm{target}}$4, preserves general utility comparable to the original weak model, and remains economically attractive through parameter-efficient fine-tuning. The paper states this as the fingerprint spoofing problem: given $f_{\mathrm{target}}$5 with $f_{\mathrm{target}}$6, $f_{\mathrm{target}}$7, $f_{\mathrm{target}}$8, and $f_{\mathrm{target}}$9, efficiently find $D_q$0 satisfying spoofing, utility preservation, and low adaptation cost.

The threat model is unusually strong but operationally realistic in platform settings. The adversary knows the auditor’s mechanism $D_q$1 and builds a surrogate $D_q$2, knows the query distribution $D_q$3 and can sample surrogate queries, and has white-box control over $D_q$4 with access to PEFT. This makes GhostPrint a study of adversarial adaptation under realistic auditing constraints rather than a claim of universal indistinguishability.

The paper distinguishes two deployment regimes. In the static setting, the auditor uses a single fingerprint method such as LLMmap, LLM-idio, or MET with fixed $D_q$5 and $D_q$6, and the attacker tailors one LoRA adapter to spoof that fingerprint. In the continual setting, auditors deploy a sequence of fingerprints $D_q$7 over time, and GhostPrint trains task-specific LoRA adapters that are integrated by a Mixture-of-LoRA-Experts router to spoof multiple evolving protocols without catastrophic forgetting.

3. Theoretical basis: impossibility globally, feasibility locally

The theoretical analysis in the 2026 paper is organized around a central asymmetry. Perfectly mimicking a larger model across all inputs is impossible under realistic low-rank adaptation, but successful spoofing on the auditor’s actual query distribution can nevertheless be tractable (Zhang et al., 15 Jun 2026).

The impossibility result is stated for a strong model weight $D_q$8 of rank $D_q$9, a weak model weight $n$0 of rank $n$1, and a LoRA update $n$2 with rank parameter $n$3. Writing $n$4, the paper gives lower bounds in spectral and Frobenius norm:

$n$5

and

$n$6

These bounds rule out universal spoofing under capacity limits.

GhostPrint then identifies two practical vulnerabilities. The first is finite query budgets combined with low-effective-rank query distributions. If $n$7 has covariance $n$8 with eigenvalues $n$9, then

$g$0

When $g$1 concentrates in a few semantic directions, spoofing error on the audit distribution can be small even with modest LoRA rank.

The second vulnerability is weak verification classifiers. For a classifier weight $g$2 and $g$3,

$g$4

If the auditor’s projection has rank $g$5, then $g$6, so a rank-$g$7 LoRA attacker can drive the discrepancy visible to $g$8 to zero. A recurring misconception is that successful black-box verification is equivalent to deployment integrity; the paper’s formal results show that this equivalence fails when verification is low-rank and budget-constrained.

4. Attack framework, objectives, and continual routing

GhostPrint operationalizes the theoretical vulnerabilities through a PEFT pipeline built from surrogate modeling, supervised alignment, knowledge distillation, and reward-ranked fine-tuning (Zhang et al., 15 Jun 2026). The high-level design is to align the weak model with the target model on the auditor’s query distribution while simultaneously targeting the decision boundary of the auditor’s classifier.

The training objective combines supervised fine-tuning over target responses and token-level distillation toward the strong teacher. For query $g$9 and teacher response $Q^n := \{q^i\}_{i=1}^n$0,

$Q^n := \{q^i\}_{i=1}^n$1

and

$Q^n := \{q^i\}_{i=1}^n$2

The total objective is

$Q^n := \{q^i\}_{i=1}^n$3

with appendix hyperparameters $Q^n := \{q^i\}_{i=1}^n$4 and temperature $Q^n := \{q^i\}_{i=1}^n$5, and a figure showing optimal $Q^n := \{q^i\}_{i=1}^n$6 with relatively stable behavior across $Q^n := \{q^i\}_{i=1}^n$7.

Reward-ranked fine-tuning integrates the surrogate classifier $Q^n := \{q^i\}_{i=1}^n$8. For each query, GhostPrint samples $Q^n := \{q^i\}_{i=1}^n$9 candidates from the adapted weak model, ranks them by $q^i \sim D_q$0, selects

$q^i \sim D_q$1

and fine-tunes on the resulting $q^i \sim D_q$2 pairs using the same SFT+KD objective. The paper emphasizes that this sidesteps unstable RL while directly exploiting the auditor’s decision surface. In practice, RAFT uses $q^i \sim D_q$3 candidates per prompt, $q^i \sim D_q$4 rounds, and mixes $q^i \sim D_q$5 of RAFT-selected queries with standard queries.

The adaptation mechanism is LoRA. With frozen base weights $q^i \sim D_q$6, GhostPrint learns adapters

$q^i \sim D_q$7

where $q^i \sim D_q$8 and $q^i \sim D_q$9, adding $R^n := \{r^i\}_{i=1}^n$0 parameters per adapted matrix. The reported LoRA configuration is rank $R^n := \{r^i\}_{i=1}^n$1, scaling $R^n := \{r^i\}_{i=1}^n$2, dropout $R^n := \{r^i\}_{i=1}^n$3, $R^n := \{r^i\}_{i=1}^n$4 epochs, learning rate $R^n := \{r^i\}_{i=1}^n$5, batch size $R^n := \{r^i\}_{i=1}^n$6, and AdamW with weight decay $R^n := \{r^i\}_{i=1}^n$7.

For continual spoofing, GhostPrint introduces Mixture-of-LoRA-Experts. Task-specific adapters $R^n := \{r^i\}_{i=1}^n$8 are trained for each fingerprinting task and previous adapters are frozen. A router $R^n := \{r^i\}_{i=1}^n$9 computes expert scores

$r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$0

and the adapted output is

$r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$1

Training uses the union of past query distributions so that multiple fingerprints can be spoofed over time with minimal degradation.

5. Empirical results, trade-offs, and defenses

The evaluation covers three weak-to-strong model families: Gemma-1.1 $r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$2, Qwen2 $r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$3, and Phi-3 Mini $r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$4. Utility is measured with LM Evaluation Harness, 5-shot, on MMLU, GSM8K, and ARC-Challenge. Fingerprinting methods are LLMmap, a 52-class classifier using approximately 800 adversarial identity probes; LLM-idiosyncrasies, a binary classifier trained on UltraChat responses; and Model Equality Testing, a two-sample hypothesis test using MMD over Hamming distance (Zhang et al., 15 Jun 2026).

In the static setting, GhostPrint achieves high ASR while remaining near the weak-model utility baseline. For Gemma-1.1 $r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$5, the original weak model has utility $r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$6 on MMLU / GSM8K / ARC-C and ASR $r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$7 on LLMmap / LLM-idio / MET; GhostPrint reaches utility $r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$8 and ASR $r^i \sim f_{\mathrm{api}}(\cdot \mid q^i)$9; the original target has utility $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$0 and ASR $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$1. The paper notes that Gemma-2B→7B on LLMmap achieves $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$2 ASR, surpassing the target’s natural classification rate of $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$3.

For Qwen2 $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$4, the original weak model records utility $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$5 and ASR $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$6; GhostPrint records $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$7 and $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$8. For Phi-3 Mini→Medium, the original weak model records $g(R^n, f_{\mathrm{target}}) \in \{0,1\}$9 and $f_{\mathrm{target}}$00; GhostPrint records $f_{\mathrm{target}}$01 and $f_{\mathrm{target}}$02. The empirical pattern is that evasion rises sharply while general utility remains close to the weak baseline, with some task-specific loss such as the Gemma GSM8K drop.

Cross-family spoofing is strongest on LLM-idio and MET. Gemma-2B→Qwen2-7B moves from original weak ASR $f_{\mathrm{target}}$03 to GhostPrint ASR $f_{\mathrm{target}}$04, while Qwen2-1.5B→Gemma-7B moves from $f_{\mathrm{target}}$05 to $f_{\mathrm{target}}$06. Appendix weak-to-weak transfers place LLM-idio ASR near $f_{\mathrm{target}}$07–$f_{\mathrm{target}}$08 across several transfers. In continual spoofing with MoLA, 3-way configurations sustain nontrivial evasion: Gemma-2B→7B reaches $f_{\mathrm{target}}$09, Qwen2-1.5B→7B reaches $f_{\mathrm{target}}$10, and Phi-3-mini→medium reaches $f_{\mathrm{target}}$11 on LLMmap / LLM-idio / MET.

The paper also examines sample complexity in MET. At the fair budget $f_{\mathrm{target}}$12, many attacks evade detection. On Phi-3, the MoLA adapter achieves mean permutation $f_{\mathrm{target}}$13, fails to reject $f_{\mathrm{target}}$14, and maintains ASR above $f_{\mathrm{target}}$15 until $f_{\mathrm{target}}$16. At the full $f_{\mathrm{target}}$17 budget, costing 1,000 generations per audit, all adapters are eventually detected; the paper interprets this as evidence that the threat is practical under realistic budgets rather than absolute.

The defense recommendations follow directly from the theory. Increasing query budget raises the power of two-sample tests; using diverse, high-effective-rank query distributions makes expected spoofing error harder to minimize; stronger classifiers with rank $f_{\mathrm{target}}$18 prevent zero-error spoofing in the projected space; ensemble or multi-view fingerprints reduce single-point failure; and dynamic or continual audits can randomize probes and rotate fingerprints. The paper further recommends cryptographic attestations and model watermarking as complements to black-box audits. It also states three limitations: no evaluation on frontier-scale models such as $f_{\mathrm{target}}$19, RL-based reward optimization was avoided for cost and stability, and universal spoofing remains impossible even though practical spoofing is feasible.

6. Other usages: ghost imaging and lineage verification

A distinct body of work uses “GhostPrint” in relation to computational ghost imaging. In that setting, the image is effectively “written” into the correlation between structured illumination and a single bucket measurement rather than captured directly on a sensor (Song et al., 2015). The measurement model is

$f_{\mathrm{target}}$20

where $f_{\mathrm{target}}$21 is the object transmission, $f_{\mathrm{target}}$22 is the projected pattern, and $f_{\mathrm{target}}$23 is the bucket reading. A standard correlation estimator is

$f_{\mathrm{target}}$24

The 2015 experiment uses an ordinary computer LCD as an incoherent source, pseudo-random patterns, a single-pixel detector, a transmissive letter “H” of size $f_{\mathrm{target}}$25, and an imaging geometry with $f_{\mathrm{target}}$26, $f_{\mathrm{target}}$27, $f_{\mathrm{target}}$28, and aperture radius $f_{\mathrm{target}}$29. Reconstructions improve from $f_{\mathrm{target}}$30 to $f_{\mathrm{target}}$31, smaller speckles of $f_{\mathrm{target}}$32 pixels outperform $f_{\mathrm{target}}$33 pixels at the same measurement count, and the system is reported to be robust under ordinary ambient light.

A further imaging-related usage appears in ghost handwritten digit recognition, where the bucket signals themselves are fed into a deep neural network rather than first being reconstructed into an image (He et al., 2020). The linear measurement model is

$f_{\mathrm{target}}$34

with sampling ratio $f_{\mathrm{target}}$35. The reported method uses Cosine Transform speckle as the characteristic information and reaches recognition accuracy as high as $f_{\mathrm{target}}$36 for the simulations and $f_{\mathrm{target}}$37 for the experiments at a sampling ratio of $f_{\mathrm{target}}$38. This usage treats GhostPrint as direct recognition in the measurement domain rather than as a spoofing or provenance mechanism.

The lineage-verification usage is conceptually opposite to the adversarial LLM GhostPrint. GhostSpec, described in the supplied synthesis as GhostPrint for robust, data-free SVD fingerprints of transformer internals, is a white-box method that computes invariant products of attention weights,

$f_{\mathrm{target}}$39

extracts singular values, truncates them by entropy-based effective rank, and compares models by spectral similarity with POSA alignment (Wang et al., 9 Nov 2025). Reported maximal F1 scores are $f_{\mathrm{target}}$40 for GhostSpec-mse and $f_{\mathrm{target}}$41 for GhostSpec-corr on 63 model pairs around Llama-2-7B and Mistral-7B. Whereas the 2026 spoofing paper exposes the fragility of user-side black-box output fingerprints, the GhostSpec line argues that invariant weight-space fingerprints can remain robust under fine-tuning, pruning, merging, expansion, and functionality-preserving reparameterizations.

Taken together, these meanings show that “GhostPrint” is not a single established technical object but a reused label across security, optics, and provenance research. The most consequential recent meaning is the LLM fingerprint spoofing framework, because it directly challenges the reliability of black-box verification pipelines for commercial inference services (Zhang et al., 15 Jun 2026). The imaging and lineage-verification usages are methodologically independent, yet they illuminate a broader pattern: in each case, the observable artifact is indirect, and the central technical question is how much hidden structure can be inferred from constrained measurements.