LLMPrint: Fingerprinting LLM Outputs

• LLMPrint is a framework that fingerprints large language model outputs by analyzing generation patterns, prompt responses, and embedding-based features.
• Active fingerprinting employs optimized probe queries and transformer classifiers to achieve high identification accuracy, even in black-box settings.
• Passive techniques leverage statistical and stylistic features to ensure robust attribution despite post-processing, paraphrasing, and adversarial modifications.

LLMPrint refers to a suite of methodologies and frameworks for fingerprinting LLMs in order to identify, characterize, or attribute the source and provenance of LLM outputs. These techniques exploit model-specific generation patterns, prompt responses, and statistical or structural features to construct discriminative identifiers—or "fingerprints"—usable for tracing models through black-box APIs, post-processing layers, and adversarial manipulations. LLMPrint systems constitute a critical component in LLM governance, security, and scientific auditing.

1. Formal Foundations of LLMPrint

LLMPrint is formally instantiated as the problem of identifying a hidden LLM $\theta$ accessed through a query–response oracle $O : Q \to R$, where each response $o \in R$ is sampled from a distribution parameterized by the model $\theta$ and prompting configuration $s$:

$O(q) = o, \quad o \sim s(\text{LLM}_\theta(q))$

An adversary (or auditor) selects a sequence $Q = \{q_1, ..., q_k\}$ of $k$ probes, receives the vector of responses $R = \{r_1,...,r_k\}$, and maps these into a candidate model identity via a fingerprinting function

$F(Q, R) = \hat{\theta} \in C$

where $O : Q \to R$0 is the set of possible LLM versions. Textual traces are aggregated by means of embeddings and subsequently classified by lightweight transformer architectures in closed-set or open-set scenarios. This paradigm covers both targeted identification (e.g., vendor or version inference) and broader behavioral comparison (Pasquini et al., 2024).

2. Active and Passive Fingerprinting: Mechanisms and Algorithms

Two principal operational modes dominate LLMPrint methods:

Active fingerprinting systems (exemplified by LLMmap) construct a small, information-rich query set $O : Q \to R$1 chosen to maximize inter-model discrepancy and minimize intra-model variability. The process includes:

• Training probe-wise classifiers over candidate prompts.
• Selecting the subset of probes (commonly $O : Q \to R$2) that maximize multiclass identification accuracy.
• Aggregating probe responses with text embeddings and transformer-based classifiers.

Passive fingerprinting and behavioral comparison schemes, in contrast, focus on statistical and stylistic features of generated texts. Methods such as FDLLM leverage large, bilingual corpora and LoRA-adapted transformers to extract persistent, model-characteristic features by fine-tuning on outputs, enabling robust discrimination across both proprietary and open-source LLM families (Fu et al., 27 Jan 2025).

The prompt-injection-based LLMPrint approach constructs adversarially optimized probes that exploit token-preference boundaries—enabling fingerprinting even for models modified post-release (e.g., via fine-tuning, quantization, or lightweight LoRA adapters). Here, a loss function tuned to both uniqueness and robustness objectives is minimized (via greedy coordinate search) to produce prompt–token pairs that elicit stable, model-specific token selection decisions over hundreds of variant models (Hu et al., 29 Sep 2025).

3. Information-Theoretic Rationale and Statistical Guarantees

Fingerprint effectiveness in the active querying framework is driven by the mutual information

$O : Q \to R$3

between model identity and response, maximized over queries that effect high KL divergence between models’ response distributions. Increasing the number of independent probes $O : Q \to R$4 translates into rapidly compounding information gain:

$O : Q \to R$5

Empirical results confirm diminishing returns, with identification accuracy typically saturating above $O : Q \to R$6 probes ($O : Q \to R$795% closed-set accuracy on $O : Q \to R$8) (Pasquini et al., 2024).

Prompt-injection LLMPrint applies formal statistical hypothesis testing: it computes agreement rates between reference (base) and suspect models, calibrates thresholds on negative controls, and declares derivation only if agreement exceeds a fixed confidence interval. This yields controlled false positive rates ($O : Q \to R$91%) and high true positive rates even under aggressive post-processing (Hu et al., 29 Sep 2025).

4. Experimental Results and Robustness

LLMPrint frameworks have been evaluated across diverse regimes:

• LLMmap: $o \in R$0 closed-set accuracy over 42 LLMs, robust to arbitrary system prompts, sampling hyperparameters, and overgeneration frameworks (RAG, Chain-of-Thought), with performance losses $o \in R$1 under strong adversarial conditions. Open-set leave-one-out and contrastive matching achieve $o \in R$281% accuracy (Pasquini et al., 2024).
• FDLLM: Macro-F1 exceeding $o \in R$3 on a 90,000-sample, 20-model bilingual dataset, with $o \in R$4 accuracy on held-out/unseen models, and attack success rates halved ($o \in R$5 vs. $o \in R$6 prior) under polishing, translation, or synonym attacks (Fu et al., 27 Jan 2025).
• LLMPrint (prompt-injection): True positive rates in $o \in R$7–$o \in R$8 under black- and gray-box settings across $o \in R$9 post-processed variants, with empirically near-zero false positives. The method is robust to quantization, LoRA, and small prompt injectors, though failures are observed with extreme post-processing that significantly alters capability (Hu et al., 29 Sep 2025).

A summary table of representative benchmark results:

Method	Accuracy / Macro-F1	Robustness / Comments
LLMmap (Pasquini et al., 2024)	$\theta$095%	Robust to prompts, sampling, RAG/COT
FDLLM (Fu et al., 27 Jan 2025)	91–95%	Generalizes to new models, resists polishing, attacks
LLMPrint (prompt-injection) (Hu et al., 29 Sep 2025)	86–98% (TPR), $\theta$11% (FPR)	Robust to post-training, quantization

5. Defenses, Limitations, and Theoretical Boundaries

Defensive measures against LLMPrint include output randomization (controlled paraphrase, decoy sentences), query filtering or blocking, prompt obfuscation, and watermarks for legitimate clients (Pasquini et al., 2024). However, empirical evidence indicates these countermeasures incur significant utility or computational penalties and can be circumvented by adaptive fingerprinters who synthesize new probes or optimize over unconstrained input spaces. No known scalable defense can fully obfuscate all model-characteristic behaviors without degrading utility.

Limitations of LLMPrint techniques are scenario-dependent:

• Active query sets may be partially neutralized by continuous paraphrasing or heavy randomization.
• Passive fingerprinting reduces accuracy for models subjected to semantic-preserving transformations, though LoRA-tuned distinguishers remain partially robust (Fu et al., 27 Jan 2025).
• Prompt-injection based schemes require significant optimization overhead per fingerprint (hundreds of optimized prompts per model), and detection of highly divergent models may fail if post-processing fundamentally alters generation boundaries (Hu et al., 29 Sep 2025).

A plausible implication is that LLMPrint methodologies are strictly limited by the tradeoff between model utility, access surface (API entropy), and the adversary's query budget.

6. Extensions, Auditing, and Applications

Beyond model identification and provenance, LLMPrint includes distributional comparison frameworks such as Visual Fingerprints, which model the output distribution $\theta$2 induced by "generation conditions" (prompt, temperature, persona, etc.), and visualize these as aggregate, clusterable fingerprints. Pipelines extract topic, style, and structure features to audit and compare nuanced behavioral patterns between models, configurations, or personas — providing tools for scientific auditing, prompt design, and model evaluation (Alnouri et al., 7 May 2026).

Further, LLMPrint analogues are utilized in industrial scheduling and G-code anomaly detection by integrating LLMs as decision modules in process optimization and autonomous agents, though these primarily leverage LLMPrint’s behavioral comparison aspect rather than adversarial fingerprinting (Liu et al., 3 Apr 2025, Eslaminia et al., 5 May 2026, Samani et al., 23 Mar 2026).

7. Conclusion and Research Outlook

LLMPrint encompasses a family of methodologies for constructing and verifying model-specific fingerprints under both black-box and gray-box scenarios, with demonstrated resilience to post-training, quantization, and paraphrasing attacks. Emerging paradigms exploit active querying, distributional analysis, LoRA-adapted embeddings, and adversarial prompt optimization. LLMPrint techniques are now foundational for LLM attribution, security, and evaluation, but remain locked in an evolving arms race with model designers and deployers seeking to mitigate fingerprintability. Anticipated developments include gradient-based prompt fingerprint optimization, expanded distributional and structural analysis, and adaptive counter-countermeasures, with theoretical limits tied to black-box classifier obfuscation and information-theoretic channel capacity (Pasquini et al., 2024, Fu et al., 27 Jan 2025, Hu et al., 29 Sep 2025, Alnouri et al., 7 May 2026).