Model Fingerprinting Techniques

• Model fingerprinting is a family of methods that embed distinctive signatures into AI models using secret key–response pairs, parameter vectors, or output artifacts for verifying provenance and ownership.
• It encompasses both embedded behavioral and post hoc approaches, enabling identification in black-box and white-box settings while addressing threats like fine-tuning, merging, and distillation.
• These techniques leverage cryptographic chaining, gradient analysis, and output-space signals to ensure robust verification and attribution despite challenges posed by adaptive adversarial attacks.

Model fingerprinting denotes a family of techniques for associating a model, a model family, or a model-serving stack with a distinctive signature that can later be queried, decoded, or inferred for ownership verification, provenance attribution, lineage tracking, or infrastructure identification. In current work, fingerprints may be embedded directly into model behavior through secret key–response pairs, represented as transferable vectors in parameter space, recovered from generated artifacts, extracted from gradient responses or benign-query behavior, or inferred from the numerical side effects of the inference system itself (Xu et al., 2024, Xu et al., 2024, Yu et al., 2020, Wu et al., 2 Jun 2025, Wimbauer et al., 28 May 2026). The term is therefore broader than a single verification protocol: it covers black-box and white-box settings, exact-copy detection and family identification, cooperative and adversarial providers, and both active and post hoc provenance methods.

1. Conceptual scope and taxonomy

A useful formalization treats model fingerprinting as a property-testing problem. In the QuRD framework, a victim owns a deployed classifier $h$, an attacker produces a suspected model $h'$, and the owner wants a test $T$ such that if $h=h'$, then $\Pr[T(h,h')=1]>\frac{2}{3}$, while if $h\neq h'$, then $\Pr[T(h,h')=0]>\frac{2}{3}$ (Godinot et al., 2024). This framing emphasizes effectiveness, robustness, uniqueness, and efficiency as core desiderata rather than tying the field to any single algorithmic family.

The literature separates several distinct objects of attribution. In ownership verification for LLMs, the fingerprint is often a secret behavior implanted into the model and later checked through API queries (Xu et al., 2024). In model-family identification, the objective is not merely to test one suspected origin but to decide which family or variant is present in a black-box interface (Maho et al., 2022). In provenance tracking for open-weight LLM artifacts, the target may be lineage, derivative status, or family membership inferred from gradients rather than from secret triggers (Wu et al., 2 Jun 2025). In generative-model attribution, the task shifts from model-to-model comparison to determining whether a generated image or text carries the signature of a particular source model (Yu et al., 2020, Yao et al., 6 Aug 2025). A different but related extension fingerprints the inference engine, attention backend, and hardware platform rather than the model weights, showing that the serving system itself leaks identifying information into output text (Wimbauer et al., 28 May 2026).

The distinction between fingerprinting and watermarking is explicit in several works. Chain & Hash states that watermarking links an output to a model, whereas fingerprinting links a model to another model (Russinovich et al., 2024). Other papers blur that boundary operationally, especially when fingerprints are decoded from generated outputs or transferred through distillation, but the difference remains analytically useful: some methods modify the model to create a secret verification behavior, whereas others infer origin from behavior that already exists or from covert structure learned by a verifier.

Paradigm	Core signal	Representative works
Embedded behavioral fingerprints	Secret key–response behavior, instruction backdoors, cryptographically chained prompts, parameter-space vectors	(Xu et al., 2024, Russinovich et al., 2024, Xu et al., 2024, Nasery et al., 11 Feb 2025)
Post hoc behavioral or representation fingerprints	Benign-query disagreement, adaptive fingerprints, gradient statistics, targeted output signatures	(Pan et al., 2022, Maho et al., 2022, Shao et al., 26 Jan 2025, Wu et al., 2 Jun 2025)
Output-space and generative fingerprints	Recoverable bits, secret output subsets, decoder-based attribution	(Yu et al., 2020, Yao et al., 6 Aug 2025, Fei et al., 11 Jun 2026)
System-side fingerprints	Prompt-response effects induced by engine, backend, and hardware differences	(Wimbauer et al., 28 May 2026)

2. Verification settings and threat models

Black-box access is the dominant operational assumption. Instructional Fingerprinting targets the case in which the adversary may hide weights and expose only black-box API access after downstream fine-tuning (Xu et al., 2024). Chain & Hash is explicitly designed for black-box ownership verification, though it also discusses a gray-box scenario in which the verifier controls input formatting (Russinovich et al., 2024). MergePrint verifies ownership by querying a suspicious merged model with a secret fingerprint pair $(x,y)$ and checking whether the model returns $y$ (Yamabe et al., 2024). AuthPrint likewise assumes black-box certification and later black-box authenticity checks of generated images (Yao et al., 6 Aug 2025). By contrast, MetaV uses white-box access to the target model during fingerprint construction but only black-box access to suspect models during verification (Pan et al., 2022). TensorGuard moves to a fully white-box post hoc setting in which the model can be loaded, merged from .safetensors shards, and differentiated (Wu et al., 2 Jun 2025).

Threat models vary sharply. Some works assume a downstream reuser who fine-tunes, prunes, distills, or merges a released model and later denies lineage (Xu et al., 2024, Yamabe et al., 2024). Some assume multiple hosts each receiving distinct copies, so collusion and leakage become central security issues (Nasery et al., 11 Feb 2025). AuthPrint assumes a malicious provider who may swap a certified generator for a cheaper substitute after certification; the verifier sees only outputs and returns only a binary authenticity verdict (Yao et al., 6 Aug 2025). The teacher-origin attack of Chen et al. assumes only top-1 label access to a transfer-learned student model and seeks to infer which public teacher model underlies it (Chen et al., 2021). The inference-system attack assumes chat access, knowledge of the model identity and system prompt, and no access to logits or hidden states, yet still identifies inference engine, attention backend, and GPU type (Wimbauer et al., 28 May 2026).

The verification objective also changes with setting. FBI distinguishes detection, a binary test of whether the black-box belongs to a hypothesized family, from identification, a multi-hypothesis search for which family or variant is present (Maho et al., 2022). QuRD stresses that benchmark construction must separate theft method from obfuscation method and report performance at constrained false positive rate, such as TPR@5 (Godinot et al., 2024). This suggests that “model fingerprinting” names a common forensic aim, but the operational semantics of success depend on whether the task is ownership proof, family classification, teacher inference, output authenticity, or infrastructure exposure.

3. Embedded fingerprints in model behavior

A large class of methods implants fingerprints directly into the model. Instructional Fingerprinting treats LLM fingerprinting as very lightweight instruction tuning: the publisher specifies a confidential private key and implants it as an instruction backdoor that causes the LLM to generate specific text when the key is present (Xu et al., 2024). The paper reports results on 11 popularly-used LLMs and shows that the adapter variant achieves $100\%$ fingerprint success after downstream training while preserving normal behavior; it also emphasizes no overclaim, robustness against fingerprint guessing, resistance to parameter-efficient fine-tuning, and support for multi-stage fingerprinting (Xu et al., 2024).

Chain & Hash introduces a cryptographic binding between prompts and responses. For a question set $h'$0 and response pool $h'$1, the response index for each question is chosen from a secure hash of the question, the full chain $h'$2, the response pool $h'$3, and a secret key $h'$4, with SHA-256 used as the example secure hash (Russinovich et al., 2024). Because each question’s assignment depends on the entire chain, changing one question changes the targets for all linked elements. The method augments fingerprint training with random padding, varied meta-prompt configurations, and an Anchor Loss on non-fingerprinted samples so that the fingerprint remains robust under prompt wrappers and instruction-tuned style shifts (Russinovich et al., 2024).

FP-VEC reframes fingerprinting as parameter-space vector arithmetic. A base model is first fine-tuned on a fingerprint dataset containing 10 fingerprinting prompts plus 50 regularization prompts; the fingerprint vector is then extracted as

$h'$5

and stamped onto any compatible downstream model by

$h'$6

The experiments use five base LLMs—GPT-2, GPT-2-medium, Bloom-7B, LLaMa2-7B, and Vicuna-7B—and two downstream datasets, WizardLM Evol Instruct V2 and UltraChat, giving ten downstream models in total (Xu et al., 2024). Both fingerprinted base models and stamped downstream models achieve $h'$7 Fingerprint Success Rate, while CPU-only total stamping times are about 0.51s for GPT-2, 1.19s for GPT-2-medium, 15.80s for Bloom-7B, 14.75s for LLaMa2-7B, and 15.47s for Vicuna-7B; average benchmark changes are small, including a 0.66-point drop for Bloom-7B and improvements of 0.22 and 1.09 points for Vicuna-7B and LLaMa2-7B (Xu et al., 2024).

Scalable Fingerprinting of LLMs argues that harmlessness and persistence are insufficient without scalability. Its Perinucleus sampling constructs in-distribution keys and low-probability but not absurdly unlikely responses from the “edge of the nucleus,” enabling insertion of 24,576 fingerprints into Llama-3.1-8B without significant degradation in model utility (Nasery et al., 11 Feb 2025). The method reports a false-positive bound

$h'$8

and in the perfect-recall case

$h'$9

showing explicitly how scale lowers false discoveries (Nasery et al., 11 Feb 2025). At 8,192 inserted fingerprints, Perinucleus retains over 60% of fingerprints after SFT, and persistence remains around 50% even at 8,192 fingerprints across model sizes in the Llama-3 family (Nasery et al., 11 Feb 2025).

Antidistillation Fingerprinting addresses a different transfer channel: teacher outputs used to fine-tune a student model. It replaces heuristic red-and-green-list perturbations with a proxy-guided gradient score

$T$0

used in

$T$1

so that sampled tokens are chosen for their expected downstream detectability in the student rather than for incidental surface bias (Xu et al., 3 Feb 2026). On GSM8K at fixed teacher accuracy, the method improves the fingerprint detection $T$2-value from 0.09 to 0.01, and in the unsupervised, closed-weight, proxy-different-from-student setting it achieves TPR 55% at FPR 0%, compared with TPR 24% at FPR 0% for the red-and-green-list baseline (Xu et al., 3 Feb 2026).

4. Post hoc behavioral, gradient, and targeted fingerprints

Not all fingerprinting methods modify the protected model. MetaV is explicitly proposed as a passive forensic technique and as the first task-agnostic model fingerprinting framework, built from two jointly optimized components: an adaptive fingerprint $T$3 and a meta-verifier $T$4 that consumes the concatenated outputs of a suspect model on those fingerprint inputs (Pan et al., 2022). Because the method assumes only matching input and output dimensions across models, it applies to classification, regression, and generative modeling without changing the core algorithm. On the ResNet-18 skin cancer diagnosis benchmark, MetaV achieves simultaneously $T$5 true positives and $T$6 true negatives on a diverse test set of 70 suspect models, with ARUC $T$7 (Pan et al., 2022).

FBI replaces adversarial probes with benign inputs. The paper argues that ordinary images from a test set are sufficient to fingerprint modern classifiers, and extends the task from exact-model detection to identification of model families and variants (Maho et al., 2022). In the walled-garden setting, detection usually succeeds in 1 to 3 benign queries, often with a single query, while open-world detection based on empirical mutual information reaches $T$8 TPR for $T$9 with 100 queries under entropy-based input selection at fixed FPR $h=h'$0 (Maho et al., 2022). QuRD broadens this observation into a modular decomposition—Query, Representation, Detection—and shows that a very simple negative-sampling baseline, AKH, performs on par with or better than state-of-the-art fingerprints on several benchmarks, while also exposing that many current benchmarks are too easy or insufficiently representative (Godinot et al., 2024).

Several works explicitly target false positives and lineage ambiguity. FIT-Print argues that prior untargeted fingerprints are vulnerable to false-claim attacks because they compare model outputs on selected samples without anchoring the comparison to a specific reference (Shao et al., 26 Jan 2025). Its targeted formulation instead optimizes perturbations so that the suspicious model’s fingerprint matches a prescribed target signature $h=h'$1, and its two black-box instantiations—FIT-ModelDiff and FIT-LIME—achieve $h=h'$2 ownership verification rate and $h=h'$3 false positive rate on the reported benchmark models and datasets (Shao et al., 26 Jan 2025). IrisFP further revises adversarial-example-based fingerprinting by placing fingerprints near the intersection of multiple decision boundaries, turning each fingerprint into a composite sample set, and ranking candidates by Cohen’s $h=h'$4 computed from pirated and independent reference models; for ResNet-18 on CIFAR-100 it reports AUC 0.916, described as a 13.7% improvement over the best baseline (Geng et al., 26 Mar 2026).

Gradient-based post hoc provenance methods move from outputs to internal sensitivities. TensorGuard perturbs tensors, computes gradient responses, extracts global statistics such as mean, standard deviation, Frobenius norm, skewness, and kurtosis, and averages 30 repetitions into a 16-dimensional fingerprint vector that supports both pairwise similarity detection and centroid-initialized K-Means family classification (Wu et al., 2 Jun 2025). On 58 models comprising 8 base models and 50 derivatives across the Llama, Qwen, Gemma, Phi, and Mistral families, it reports 94% family-classification accuracy; it also notes a practical cost of about one hour and 20–30 GB of GPU memory per model (Wu et al., 2 Jun 2025). A related but older lineage attack by Chen et al. uses optimization to synthesize fingerprinting pairs $h=h'$5 that preserve latent features under a candidate teacher model and infers teacher origin from label agreement under top-1-only black-box access. It achieves 100% teacher inference accuracy on 126 victim student models, with 100% accuracy once the budget reaches 50 pairs per candidate (Chen et al., 2021).

5. Fingerprinting generated outputs and serving systems

Generative-model fingerprinting often shifts the unit of evidence from model behavior on secret prompts to recoverable signatures in generated artifacts. “Responsible Disclosure of Generative Models Using Scalable Fingerprinting” augments StyleGAN2 with an encoder $h=h'$6, a generator $h=h'$7, and a decoder $h=h'$8 so that a 128-bit fingerprint $h=h'$9 is embedded through filter modulation and later decoded from generated images (Yu et al., 2020). The recommended operating point uses a 128-bit fingerprint which in principle results in more than $\Pr[T(h,h')=1]>\frac{2}{3}$0 identifiable models, fingerprint deployment takes about 5 seconds rather than 3–5 days for the compared indirect method, and the reported closed-world and open-world deepfake detection and attribution accuracy is 100% in the evaluated settings (Yu et al., 2020).

For diffusion models, “Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models” inserts a Personalized Normalization Module into the VAE decoder and maps a 48-bit string into the normalization coefficients $\Pr[T(h,h')=1]>\frac{2}{3}$1 and $\Pr[T(h,h')=1]>\frac{2}{3}$2 (Fei et al., 11 Jun 2026). The paper reports Bit Acc above 99.5% across generation and editing tasks, including 99.57% on COCO generation and 99.46% on InstructPix2Pix editing, while preserving fidelity with FID values such as 24.03 on COCO and 13.06 on InstructPix2Pix (Fei et al., 11 Jun 2026). Its distinctive addition is Anti-Collusion Transformation, a set of lossless function-invariant parameter transformations—channel permutation, parameter scaling, and sign flip—that keep functionality unchanged for each user copy but make colluded averages unusable; in the two-party averaging experiment, FID rises from around 23 to about 79.5 (Fei et al., 11 Jun 2026).

AuthPrint adopts a different generative provenance model. During certification, a trusted verifier samples a secret fingerprint index vector (s \overset{\%%%%14$$\operatorname{FPR}\le \exp\!\left(-2M(1-1/k)^2\right),$$14%%%%4$ The paper reports near-zero FPR@95%TPR for instances of GAN and diffusion models, and 0% attack success rate for the tested PGD-style evasion attacks against AuthPrint, whereas the compared baseline and Yu-2019 detectors are defeated with 100% success (Yao et al., 6 Aug 2025). It also notes that Stable Diffusion is much easier to authenticate when the prompt space is narrow or fixed than when prompts are diverse (Yao et al., 6 Aug 2025).

A complementary line studies passive model fingerprint detection for AI-generated images. “Smudged Fingerprints” evaluates 14 representative methods across RGB, frequency, and learned-feature domains on 12 state-of-the-art image generators and finds a pronounced gap between clean and adversarial performance (Yao et al., 12 Dec 2025). Removal attacks often achieve success rates above 80% in white-box settings and over 50% under constrained black-box access, while no technique achieves high robustness and accuracy across all evaluated threat models (Yao et al., 12 Dec 2025). This result does not invalidate embedded generative fingerprints, but it does show that passive attribution accuracy on clean samples is not equivalent to adversarial robustness.

The serving stack itself can also be fingerprinted. “Fingerprinting Inference Systems of LLMs” shows that floating-point non-associativity, tensor layout differences, reduction order, kernel choice, scheduling, chunking, and cache usage create tiny but systematic numerical deviations that propagate to visible text (Wimbauer et al., 28 May 2026). Using four prompt families—rare-token, binary decision, long-context, and repetition prompts—and random-forest classifiers over prompt-response embeddings, the method achieves perfect identification of inference engine, attention backend, and GPU type at temperature zero on 30 valid configurations, with as few as 113 prompts for all components and about 10 prompts for engine identification alone (Wimbauer et al., 28 May 2026). At $\Pr[T(h,h')=1]>\frac{2}{3}$5, averaged across models, engine identification stays around 80%, attention backend identification around 71%, and GPU identification around 78% (Wimbauer et al., 28 May 2026).

6. Metrics, benchmarks, and operational criteria

The field uses a heterogeneous metric vocabulary because the objects being identified differ. Instructional Fingerprinting and FP-VEC use Fingerprint Success Rate, defined operationally as the fraction of fingerprint queries that trigger the intended response (Xu et al., 2024, Xu et al., 2024). MergePrint uses Verification Success Rate,

$\Pr[T(h,h')=1]>\frac{2}{3}$6

to account for stochastic generation (Yamabe et al., 2024). FIT-Print reduces verification to bit error rate on a target signature, while MetaV summarizes the trade-off between robustness and uniqueness with ARUC, the area under the robustness-uniqueness curve (Shao et al., 26 Jan 2025, Pan et al., 2022). Generative-image methods report Bit Acc, TPR, FPR, CIR, FID, LPIPS, PSNR, and CLIP score (Fei et al., 11 Jun 2026). AuthPrint standardizes on FPR@95%TPR, which operationalizes low false acceptance at high true acceptance (Yao et al., 6 Aug 2025). QuRD recommends TPR@5 because false accusations are costly in ownership disputes (Godinot et al., 2024).

Benchmarks also differ in what constitutes normal utility. FP-VEC evaluates stamped models with lm-eval-harness on ANLI, BoolQ, CoPA, MultiRC, RTE, LAMBADA, WiC, Winogrande, WSC, ARC-Challenge, ARC-Easy, LogiQA, OpenBookQA, SciQ, and CB, reporting accuracy, normalized accuracy, and F1 (Xu et al., 2024). “Are Robust LLM Fingerprints Adversarially Robust?” measures normalized utility relative to the base model on IFEval, GSM8K, GPQA-Diamond, and TriviaQA (Nasery et al., 30 Sep 2025). TensorGuard reports family-classification accuracy but also notes concrete resource costs: about one hour and 20–30 GB of GPU memory per model (Wu et al., 2 Jun 2025). FBI shows that query complexity itself is a major metric: one to three benign queries in the walled-garden setting can suffice for detection, whereas open-world mutual-information estimation needs on the order of hundreds of queries for strong TPR at low FPR (Maho et al., 2022).

A recurring methodological point is that reported success rates are not always comparable. QuRD argues that many model-fingerprinting benchmarks are overly separable, that query budget has a sweet spot, and that pairwise or listwise schemes can even degrade with too many queries because positive and negative fingerprints become harder to distinguish (Godinot et al., 2024). This suggests that metrics should be read together with benchmark construction, threat model, query access, and whether negative pairs are trivially distinguishable.

7. Robustness, attacks, and unresolved tensions

Much of the literature presents robustness to benign transformations as a primary requirement. Chain & Hash reports persistence under fine-tuning, prompt-format changes, meta-prompt changes, and INT8 quantization, with the practical observation that two successful fingerprint questions are enough to cryptographically prove ownership while more queries improve robustness (Russinovich et al., 2024). MergePrint addresses a previously underexplored threat—model merging—by optimizing fingerprints against a pseudo-merged model,

$\Pr[T(h,h')=1]>\frac{2}{3}$7

and reports VSR $\Pr[T(h,h')=1]>\frac{2}{3}$8 almost everywhere in two-model merging across task arithmetic and TIES-merging, plus very small average downstream performance changes such as Diff Avg $\Pr[T(h,h')=1]>\frac{2}{3}$9 for WizardMath and 0.33 for LLaMA-2-CHAT when input optimization is used (Yamabe et al., 2024). Perinucleus fingerprints survive SFT better than baselines, and the diffusion-model PNM framework remains above 90% Bit Acc after 10,000 fine-tuning steps while making PNM removal catastrophic for image quality (Nasery et al., 11 Feb 2025, Fei et al., 11 Jun 2026).

Adversarial robustness is substantially less favorable. “Are Robust LLM Fingerprints Adversarially Robust?” identifies four structural vulnerabilities shared across existing black-box LLM fingerprinting schemes: exact memorization, overconfident fingerprint outputs, unnatural fingerprint queries, and statistical output signatures (Nasery et al., 30 Sep 2025). Adaptive attacks such as SuppressTop-$h\neq h'$0, SuppressNeighbor, SuppressLookahead, perplexity-based query filtering, and statistical watermark scrubbing bypass authentication completely for most of the ten evaluated schemes while maintaining high utility of the model for end users; many schemes in the paper’s table exhibit 100% ASR, while DSWatermark remains the strongest tested scheme at about 65% ASR with about 92% relative utility (Nasery et al., 30 Sep 2025). FIT-Print reaches a related conclusion from another direction: untargeted fingerprints create a large valid-fingerprint space and are therefore vulnerable to false-claim attacks, whereas targeted signatures materially reduce that space (Shao et al., 26 Jan 2025).

The same tension appears in image attribution. “Smudged Fingerprints” finds a clear utility–robustness trade-off: methods with the highest clean attribution accuracy are often the most vulnerable to attacks, and no method is robust across all white-box and black-box threat models (Yao et al., 12 Dec 2025). For inference-system fingerprinting, the limitation is different but equally fundamental. Because the leakage arises from basic realities of heterogeneous hardware and software stacks, the paper argues that preventing fingerprinting entirely would require unifying computation across software and hardware stacks, which is unrealistic in production (Wimbauer et al., 28 May 2026).

A broader methodological tension concerns evidentiary strength. Chain & Hash pursues unforgeability through cryptographic chaining, but most behavioral schemes do not offer formal cryptographic proof (Russinovich et al., 2024). QuRD explicitly states that fingerprinting has no formal false-positive guarantees and therefore depends heavily on empirical evaluation (Godinot et al., 2024). Outside machine learning, “Material Fingerprinting” pushes the concept in yet another direction: instead of proving model ownership, it uses the response of a material under a standardized experiment as a fingerprint and then identifies the best matching constitutive model by cosine similarity against a precomputed database (Flaschel et al., 11 Aug 2025). This suggests that model fingerprinting has expanded from a narrow anti-piracy mechanism into a general strategy for provenance testing, family identification, covert authentication, and database-based model discovery, while leaving unresolved the central question of how to combine uniqueness, robustness, efficiency, and adversarial security in a single scheme.