Model-Specific Strategic Fingerprints

• Model-specific strategic fingerprints are stable, source-discriminative traces embedded in generative models to support provenance, ownership verification, and diagnostic attribution.
• Techniques range from passive extraction of residual artifacts in speech and images to engineered gradient- and seed-level signatures, achieving high precision.
• Recent studies emphasize scalability, robustness under adversarial conditions, and modular verification as critical challenges and opportunities for future research.

to=arxiv_search.search 微信上的天天中彩票 平台开号 天天中彩票腾讯JSON exactSearch false query "Model-specific fingerprints source attribution ownership verification generative models LLM model fingerprinting" limit 10 to=arxiv_search.search аамҭазы 天天中彩票被 中央値との差 1 լինիjson true query "(Zhang et al., 2023, Yamabe et al., 2024, Godinot et al., 2024, Shao et al., 26 Jan 2025, Nasery et al., 11 Feb 2025, Wu et al., 2 Jun 2025, Xu et al., 31 Aug 2025, Li et al., 3 Sep 2025, Xu et al., 18 Sep 2025, Tong et al., 30 Sep 2025, Nasery et al., 30 Sep 2025, Yao et al., 12 Dec 2025, Yang et al., 22 Mar 2026, Geng et al., 26 Mar 2026)" limit 20 to=arxiv_search.search 彩神争霸提现ենիա 利盛 天天中彩票不能买json true query "(Zhang et al., 2023) Distinguishing Neural Speech Synthesis Models Through Fingerprints in Speech Waveforms" limit 5 Model-specific strategic fingerprints are stable, source-discriminative traces or deliberately implanted behaviors that support source attribution, ownership verification, lineage detection, or behavioral diagnosis at the level of a model, model family, model component, training setup, or deployment configuration. Across recent work, the object being fingerprinted ranges from residual artifacts in speech waveforms and AI-generated images to query-response behaviors in LLMs, gradient- and seed-level signatures in neural networks, and aggregated simplification profiles in generated text (Zhang et al., 2023, Yamabe et al., 2024, Godinot et al., 2024, Xu et al., 18 Sep 2025, Klöser et al., 19 Jan 2026). The literature treats these fingerprints operationally rather than cryptographically: they matter insofar as they remain distinctive under realistic transformations, can be recovered under black-box or white-box access, and support decisions such as attribution, verification, or diagnosis.

1. Definitions and conceptual scope

The term covers several related but non-identical ideas. In pipeline text-to-speech, a fingerprint is a “systematic, model-dependent residual pattern” in synthesized waveforms, with the pipeline formalized as $y=v(a(x))$, where both the acoustic model $a(\cdot)$ and vocoder $v(\cdot)$ can contribute residual fingerprints $\epsilon_a$ and $\epsilon_v$. In post hoc model fingerprinting for classifiers, a fingerprint is a representation $Z_h$ computed from model outputs on a strategically chosen query set $S$, with ownership verification cast as a property test $T(h,h')$. In black-box LLM ownership verification, a fingerprint is often a key pair $(x,y)$, where a target input $x$ should elicit an expected output $a(\cdot)$0. In targeted ownership verification, the fingerprint becomes a pre-registered signature $a(\cdot)$1 that a suspicious model must reproduce under a specific extraction map rather than merely resemble behaviorally. In seed-level LLM attribution, the fingerprint is an intrinsic identifier present at initialization and statistically persistent through training, which the paper explicitly frames as a “Galtonian” fingerprint (Zhang et al., 2023, Godinot et al., 2024, Yamabe et al., 2024, Shao et al., 26 Jan 2025, Tong et al., 30 Sep 2025).

This variation in definition corresponds to a variation in granularity. Some fingerprints identify a whole generator or tool, some isolate components such as vocoders, some distinguish among within-architecture training variants, some verify that a suspect descends from a particular base model, and some resolve identity down to the random initialization seed. The common thread is not a single representation or threat model, but the attempt to capture stable evidence that is specific enough to support a provenance claim under realistic constraints.

2. Passive, intrinsic, and post hoc fingerprints

A large part of the literature studies fingerprints that are extracted from models or outputs “as is,” without embedding a new signal. In neural speech synthesis, this approach is unusually fine-grained. Using LibriTTS, one study showed that both acoustic models and vocoders imprint model-specific traces in the final waveform, but with a strong asymmetry: acoustic-model attribution reached $a(\cdot)$2 precision/recall/$a(\cdot)$3 when a single shared vocoder $a(\cdot)$4 was fixed and $a(\cdot)$5 when multiple vocoders $a(\cdot)$6 were balanced, while vocoder attribution reached $a(\cdot)$7 $a(\cdot)$8 across four vocoder architectures, $a(\cdot)$9 $v(\cdot)$0 among PWG training variants, and $v(\cdot)$1 $v(\cdot)$2 when generalizing across unseen variants. The decisive interaction result was that acoustic-model attribution collapsed to $v(\cdot)$3 $v(\cdot)$4 under vocoder shift in R1, whereas vocoder attribution remained $v(\cdot)$5 $v(\cdot)$6 across acoustic-model change in R2, supporting the conclusion that vocoder fingerprints dominate and can mask acoustic-model fingerprints (Zhang et al., 2023).

For image and classifier settings, post hoc fingerprints are often extracted from benign inputs or natural images rather than crafted adversarial probes. “FBI: Fingerprinting models with Benign Inputs” showed that top-$v(\cdot)$7 ranked labels on unmodified ImageNet images are sufficient for both exact-model detection and model-family identification over more than 1,000 networks. In the closed-world setting, when detection succeeds it often requires at most 3 benign queries, and identification usually at most 5; in the open-world setting, family-level detection with top-1 outputs and entropy-selected benign inputs reached $v(\cdot)$8 TPR at $v(\cdot)$9 FPR for $\epsilon_a$0, and $\epsilon_a$1 for $\epsilon_a$2. “NaturalFinger” took a related but generative route, using GAN-generated natural images that target decision difference areas rather than a single decision boundary, achieving $\epsilon_a$3 ARUC on FingerBench and a detector-based detection rate of only $\epsilon_a$4, compared with $\epsilon_a$5 for MetaFinger, $\epsilon_a$6 for MetaV, and $\epsilon_a$7 for IPGuard (Maho et al., 2022, Yang et al., 2023).

White-box intrinsic signatures extend the same theme to LLMs and model files. “SeedPrints” argues that initialization itself leaves a persistent identity trail: in an untrained LLaMA-style model fed 10,000 random sequences of length 1,024, roughly 20% of tokens are selected for the next token of 80% of inputs, and these seed-dependent biases remain statistically usable throughout training. The method reports $\epsilon_a$8 across all checkpoints for same-lineage verification and reaches overall AUC $\epsilon_a$9 and KS $\epsilon_v$0 on LeafBench. “TensorGuard” instead builds a 16-dimensional gradient-based fingerprint from perturbation-induced parameter gradients and structural features, using safetensors files, repeated perturbation, PCA, and centroid-initialized K-Means; across 58 models from five families, it reports 94% family-classification accuracy (Tong et al., 30 Sep 2025, Wu et al., 2 Jun 2025).

3. Strategic construction and fingerprint implantation

A second branch of the literature treats fingerprints as deliberately engineered behaviors designed for a specific attack model. “MergePrint” is exemplary in this respect. It addresses black-box ownership verification for LLMs under model merging by optimizing fingerprints against a pseudo-merged surrogate $\epsilon_v$1, rather than only against the owner model itself. The method separates input optimization and parameter optimization, uses Greedy Coordinate Gradient for discrete trigger construction, sets $\epsilon_v$2 and $\epsilon_v$3, and reports that parameter optimization completes in only three update steps. In the main two-model experiment, MergePrint achieves VSR $\epsilon_v$4 across all reported merge ratios and methods, including $\epsilon_v$5, and in multi-fingerprint coexistence it retains both fingerprints with average VSR $\epsilon_v$6 under task arithmetic and $\epsilon_v$7 under TIES and DARE combinations (Yamabe et al., 2024).

Modularity is the central theme in “LoRA-FP” and edit-based LLM fingerprinting. LoRA-FP stores the fingerprint in a LoRA adapter $\epsilon_v$8, trains the adapter once on a base model, and then fuses the same low-rank update into homologous downstream models. The main results are stark: baseline non-fingerprinted models have 0% FSR, whereas direct injection and transferred LoRA both achieve 100% FSR, including LLaMA2 $\epsilon_v$9 WizardMath and Qwen2.5-7B $Z_h$0 Qwen2.5-Math-7B. The paper also reports training within minutes using $Z_h$1GB memory, versus around 1 hour and 64GB memory for full-parameter fine-tuning. “From Evaluation to Defense” makes a different move: it recasts fingerprint injection as knowledge editing and then introduces Fingerprint Subspace-aware Fine-Tuning, with $Z_h$2, to preserve an edit-based fingerprint during later adaptation. FSFT exceeds standard fine-tuning by at least 10% in the worst reported case, but the same paper also shows a major weakness: many methods cannot reliably distinguish genuine fingerprint keys from similar scrambled texts, with several methods firing at 100% on F3 and F4 despite only F1 being implanted (Xu et al., 31 Aug 2025, Li et al., 3 Sep 2025).

Strategic construction is equally explicit in adversarial-example-based ownership verification for classifiers. “AnaFP” formulates fingerprint placement as choosing a stretch factor $Z_h$3 that must satisfy an admissible interval,

$Z_h$4

thereby connecting robustness and uniqueness directly to fingerprint-to-boundary distance. It reports AUC $Z_h$5 on CNN/CIFAR-10 and $Z_h$6 on MLP/MNIST. “IrisFP” pushes adversarial fingerprinting toward multi-boundary placement and composite behavior: each fingerprint is a composite sample set $Z_h$7, selected by Cohen’s $Z_h$8 over pirated and independently trained reference sets and verified through fingerprint-specific thresholds. It reports best overall AUC on all listed datasets, including $Z_h$9 for ResNet-18 on CIFAR-100 and $S$0 for MobileNet-V2 on CIFAR-100 (Yang et al., 22 Mar 2026, Geng et al., 26 Mar 2026).

Scalability becomes the strategic focus in “Scalable Fingerprinting of LLMs.” Perinucleus sampling chooses the first response token from just outside the model’s top-$S$1 nucleus, uses $S$2 and $S$3, and enables the insertion of 24,576 fingerprints into Llama-3.1-8B without degrading model utility. The paper argues that scalability is critical for lowering false discovery rate, mitigating leakage, and resisting collusion, and formalizes a multi-query false-positive bound

$S$4

It also proves that under a random assignment scheme and a unanimous-response assumption, $S$5 fingerprints suffice to identify at least one model in a coalition with probability at least $S$6 (Nasery et al., 11 Feb 2025).

4. Verification paradigms and benchmark design

The field increasingly treats verification itself as a modular design problem. “Queries, Representation & Detection” decomposes post hoc fingerprinting into Query, Representation, and Detection, or QuRD. It defines a fingerprint as a representation $S$7 of a victim model’s outputs on a query set $S$8, then asks how different choices of queries, representations, and detectors affect theft detection. A central empirical result is that query choice dominates elaborate downstream processing: the simple Anna Karenina Heuristic, which uses victim mistakes as fingerprints, performs on par with state-of-the-art methods, and IPGuard’s TPR@5 can be improved by about 10 points (+14%) simply by using negative seed samples as starting points for adversarial generation. The same paper argues that many current benchmarks are too easy and that extraction, rather than quantization or pruning, is the genuinely hard regime (Godinot et al., 2024).

Targeted ownership verification adds another layer of rigor. FIT-Print replaces untargeted similarity checks with matching to a pre-registered target signature $S$9, extracted from a suspicious model and compared by BER. With $T(h,h')$0, $T(h,h')$1, and threshold $T(h,h')$2, FIT-ModelDiff and FIT-LIME achieve 100% ownership verification rate across copying, fine-tuning, pruning, extraction, and transfer learning, while remaining at 0.0% on independent models in the reported benchmark. The framework is explicitly motivated by false claim attacks, in which a malicious claimant registers transferable fraudulent test samples in advance (Shao et al., 26 Jan 2025).

Verification can also be diagnostic rather than juridical. “Profiling German Text Simplification with Interpretable Model-Fingerprints” defines a model fingerprint as the aggregation of 23 interpretable metrics over many simplifications produced by the same model configuration. It uses linear LogisticRegression to test whether fingerprints identify prompt type, model size, or few-shot status, and reports classification $T(h,h')$3-scores up to 71.9%, improving upon simple baselines by over 48 percentage points. In this line of work, the fingerprint is not a secret backdoor or forensic trace but a multidimensional behavioral profile intended to distinguish strategic simplification styles (Klöser et al., 19 Jan 2026).

5. Robustness, adversarial pressure, and recurring controversies

A major theme in the recent literature is that high clean attribution accuracy does not imply forensic reliability. “Smudged Fingerprints” provides the most systematic image-side evidence. Across 14 attribution methods and 12 image generators, removal attacks are often above 80% ASR in white-box settings and over 50% under constrained black-box access; forgery is harder than removal but still reaches very high white-box success for several methods, and no evaluated method achieves high robustness and accuracy across all threat models. The same study highlights a utility–robustness trade-off: methods with the highest clean attribution accuracy are often the most attackable (Yao et al., 12 Dec 2025).

The LLM literature reaches a similar conclusion under a different threat model. “Are Robust LLM Fingerprints Adversarially Robust?” evaluates ten recent black-box schemes against an adaptive malicious host with control over model weights and inference. It reports ASR values of 100% for ChainHash, FPEdit, ImF, Perinucleus, InstrFP, MergePrint, ROFL, and ProfLingo, 94% for EditMF, and 65% for DSWatermark, typically while maintaining high end-user utility. The identified vulnerabilities are systematic rather than incidental: GCG-style fingerprints are detectable because their queries are unnatural, memorization-based schemes can be suppressed because they are overconfident or depend on exact-string verification, and statistical fingerprints can leak shared structure into ordinary outputs (Nasery et al., 30 Sep 2025).

A separate controversy concerns what exactly is being verified. FIT-Print argues that untargeted methods are vulnerable to false claim attacks because they compare source and suspect outputs on crafted samples rather than verifying a claimant-specific registered reference. In its false-claim experiments, FPR rises from 30.6% to 61.8% for IPGuard, from 4.0% to 15.28% for ModelDiff, from 7.6% to 29.51% for Zest, and from 39.6% to 51.94% for SAC, whereas FIT-ModelDiff and FIT-LIME remain at 0.0%. In speech synthesis, the controversy is different but structurally related: a single “source” may itself be a composite pipeline, and attribution quality depends on whether later components mask earlier ones, as in the severe collapse of acoustic-model attribution under vocoder shift (Shao et al., 26 Jan 2025, Zhang et al., 2023).

6. Applications, causal interpretations, and open problems

The application space is broad. Speech fingerprints are motivated by forensics, misuse tracing, and intellectual-property protection. LLM fingerprints target ownership verification under API access, derivative detection, merge-aware attribution, and PEFT-heavy deployment. Gradient and seed fingerprints support lineage auditing in model repositories, while interpretable behavioral fingerprints support configuration diagnosis in downstream generation tasks. Image-side work extends the same logic to source attribution, copyright tracing, forgery detection, and even identity protection through source anonymization (Zhang et al., 2023, Yamabe et al., 2024, Wu et al., 2 Jun 2025, Klöser et al., 19 Jan 2026, Xu et al., 18 Sep 2025).

The strongest explicit causal reinterpretation appears in “Causal Fingerprints of AI Generative Models.” There, content $T(h,h')$4, style $T(h,h')$5, and artifacts $T(h,h')$6 are treated as direct causes of image $T(h,h')$7, while the fingerprint $T(h,h')$8 is determined only by $T(h,h')$9, formalized as $(x,y)$0. Operationally, the method uses DIRE reconstruction residuals $(x,y)$1, projects them into multiple semantic-invariant spaces, and fuses them as

$(x,y)$2

On GM-GenImage, spanning BigGAN, ProGAN, Glide, and Stable Diffusion, the method reports 98.04% attribution accuracy, precision 0.980, recall 0.980, and FDR 357.01. It also demonstrates counterfactual anonymization using PGD perturbations constrained by the causal fingerprint, which suggests that provenance cues can be both extracted and deliberately altered (Xu et al., 18 Sep 2025).

Several open problems recur across the literature. One is generalization beyond current benchmarks: open-world attribution, similar-model attribution, and adaptive adversaries remain unresolved in multiple papers. Another is modality and architecture coverage: the TTS study explicitly leaves different languages, end-to-end systems such as VITS or FastSpeech 2s, and reliable acoustic-model extraction under vocoder masking as open; LoRA-FP depends on architectural homology; SeedPrints and TensorGuard require richer output or weight access than many closed APIs provide; QuRD argues that harder extraction-centric benchmarks are still needed (Zhang et al., 2023, Xu et al., 31 Aug 2025, Tong et al., 30 Sep 2025, Wu et al., 2 Jun 2025, Godinot et al., 2024).

Taken together, this body of work suggests that model-specific strategic fingerprints are best understood as a family of provenance mechanisms rather than a single technique. Some are passive, some injected; some are component-level, some family-level, some seed-level; some are diagnostic, others evidentiary. Their common problem is to produce a signal that is simultaneously source-specific, recoverable under realistic access assumptions, robust to post hoc transformation, and difficult to remove, forge, or overclaim. The literature now shows that all four requirements can be met locally, but not yet universally.