ZeroPrint: Black-box LLM Fingerprinting for Auditing

• ZeroPrint is a black-box LLM fingerprinting technique that extracts model signatures via zeroth-order Jacobian estimation from semantic perturbations.
• It estimates gradient-like structures from input-output differences, preserving parameter information typically lost in compressed nonlinear outputs.
• Empirical evaluations show ZeroPrint outperforms other black-box methods in key metrics, providing a robust tool for LLM copyright auditing.

ZeroPrint is a black-box LLM fingerprinting method for copyright auditing that extracts a model signature from estimated input-output Jacobians rather than from outputs alone. Its central premise is that black-box fingerprinting based on textual outputs is intrinsically weak because outputs are a compressed, nonlinear view of the model, whereas input gradients preserve substantially more information about internal parameters. ZeroPrint operationalizes this premise by approximating gradient-like structure in a discrete-text API setting through zeroth-order estimation over semantic-preserving word substitutions, then uses the resulting aggregated Jacobian as the model fingerprint (Shao et al., 8 Oct 2025).

1. Conceptual setting and motivation

ZeroPrint addresses the problem of determining whether a suspicious model is derived from a source model when only API access is available. In this setting, an auditor cannot inspect weights, activations, or logits, and must therefore rely on behavioral evidence. The method is motivated by the claim that existing black-box fingerprinting approaches are weak because they rely on outputs, which lose critical information about the model’s unique parameters due to non-linear functions such as GELU and SiLU (Shao et al., 8 Oct 2025).

The method is situated against two existing black-box styles. “Untargeted fingerprinting” submits prompts and compares output characteristics or stylistic idiosyncrasies; examples named in the source description include LLMmap, MET, and SEF. “Targeted fingerprinting” constructs special prompts and target responses so that only the source lineage reproduces them; TRAP is cited as the example. The paper contrasts both with white-box fingerprinting, which can access weights, intermediate representations, or gradients and is therefore more effective, especially for static parameter-based fingerprints (Shao et al., 8 Oct 2025).

This suggests that ZeroPrint is best understood not as an output-similarity method, but as an attempt to recover a more parameter-sensitive local differential signature while remaining within black-box query constraints.

2. Information-theoretic basis

The theoretical core of ZeroPrint is a Fisher-information argument that the input gradient is more informative about model parameters than the output. For a model of the form

$Y = f(WX + K),$

the paper defines the input gradient

$D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$

Fisher information is introduced as

$$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$

Under the assumptions that $f$ is nonlinear, $W \neq 0$, $X \sim \mathcal{N}(0,\sigma_X^2)$, and $f''(K)\neq 0$, the paper states, under a first-order Taylor approximation, that

$$\mathcal{I}_D(W) \geq \left(\frac{c_1^2}{2W^2c_2^2\sigma_X^2}+4\right)\mathcal{I}_Y(W),$$

where

$c_1 = f'(K), \qquad c_2 = f''(K).$

Because the multiplier is greater than $1$, the gradient $D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$0 is claimed to contain more information about $D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$1 than the output $D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$2 (Shao et al., 8 Oct 2025).

The paper’s intuition proceeds by treating $D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$3 as Gaussian, upper-bounding output Fisher information through data processing,

$D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$4

and then approximating

$D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$5

so that, ignoring the remainder term,

$D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$6

In this formulation, the gradient retains a stronger parameter-dependent signal than the output (Shao et al., 8 Oct 2025).

A plausible implication is that ZeroPrint’s main novelty lies less in any specific prompt set than in the choice of observable: it shifts black-box fingerprinting from post-nonlinearity outputs toward an estimated local derivative structure.

3. Query construction and zeroth-order Jacobian estimation

ZeroPrint represents a model fingerprint as an estimated Jacobian of the model’s local input-output mapping. For a model $D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$7, the fingerprint is described conceptually as

$D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$8

The method then constructs this approximation through a three-stage workflow (Shao et al., 8 Oct 2025).

First, it builds a query set $D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).$9 consisting of $$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$0 base queries $$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$1 and, for each base query, $$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$2 perturbed variants $$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$3, for a total of

$$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$4

The base queries are code-completion prompts of the form “Complete the following code: [code snippet],” with code snippets sampled from HumanEval. The source description states that this choice is intended to make the method general across models because completion is aligned with pretraining behavior and works even for base models that may not follow complex instructions well (Shao et al., 8 Oct 2025).

Second, because text is discrete, ZeroPrint cannot use infinitesimal continuous perturbations. Instead, it creates perturbed queries by semantic-preserving word substitution: it randomly selects $$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$5 replaceable words, retrieves top-$$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$6 semantically similar candidates from a word embedding model such as GloVe, randomly replaces each selected word with one candidate, and repeats this process to generate $$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$7 perturbed variants per base prompt (Shao et al., 8 Oct 2025).

Third, the model is queried repeatedly. For a base query $$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$8 and its perturbations, each query is issued $$\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].$$9 times to reduce output randomness; outputs are embedded with a sentence embedding model and averaged. With $f$0 denoting the sentence embedding function, the paper defines

$f$1

and for a perturbed query $f$2,

$f$3

Difference vectors are then formed as

$f$4

These are treated as the discrete-text analogue of local perturbation-response pairs in zeroth-order estimation (Shao et al., 8 Oct 2025).

The local Jacobian $f$5 is estimated under the relation

$f$6

using Ridge Regression,

$f$7

The final fingerprint is the average

$f$8

This Jacobian is the signature later used for model comparison (Shao et al., 8 Oct 2025).

4. Verification criterion and benchmark configuration

To test whether a suspicious model $f$9 is a derivative of a source model $W \neq 0$0, ZeroPrint compares fingerprints with the Pearson correlation coefficient,

$W \neq 0$1

A suspicious model is flagged as derivative if

$W \neq 0$2

The decision procedure is therefore threshold-based on similarity between flattened fingerprint matrices (Shao et al., 8 Oct 2025).

The evaluation is reported on the “LLM copyright auditing benchmark” from a companion SoK study. The benchmark includes 7 base model lineages—Qwen2.5, Llama 3.1, Mistral 7B, Gemma 2, TinyLlama, Llama-2, and Qwen2.5-14B / Qwen2.5-7B variants—and 149 total model instances. Post-development transformations include fine-tuning, instruction tuning, model merging, distillation, system prompts, RAG, adversarial manipulation, quantization, and parameter-efficient fine-tuning (Shao et al., 8 Oct 2025).

The paper compares ZeroPrint against REEF as a white-box baseline and LLMmap, MET, SEF, and TRAP as black-box baselines. The maximum query budget is

$W \neq 0$3

Default ZeroPrint settings are $W \neq 0$4 base queries, $W \neq 0$5 perturbed queries per base query, and $W \neq 0$6 repeats per query, yielding 10 distinct prompts and 200 total queries. The sentence embedding model is all-mpnet-base-v2, the substitution model is GloVe, and Ridge regularization uses $W \neq 0$7 (Shao et al., 8 Oct 2025).

These design choices indicate that the method is optimized for a constrained-query, post hoc auditing regime rather than for exhaustive behavioral testing.

5. Reported empirical behavior

The main reported metrics are AUC, pAUC with FPR in $W \neq 0$8, TPR@1%FPR, and Mahalanobis Distance. ZeroPrint is reported to achieve

• AUC: $W \neq 0$9
• pAUC: $X \sim \mathcal{N}(0,\sigma_X^2)$0
• TPR@1%FPR: $X \sim \mathcal{N}(0,\sigma_X^2)$1
• MD: $X \sim \mathcal{N}(0,\sigma_X^2)$2

It is reported to outperform prior black-box methods, with comparison AUC values listed as 0.632 for LLMmap, 0.661 for MET, 0.581 for SEF, and 0.712 for TRAP. It remains below the white-box baseline REEF, whose AUC is given as 0.896 and pAUC as 0.832 (Shao et al., 8 Oct 2025).

The ablations emphasize that performance depends more strongly on the number of perturbations $X \sim \mathcal{N}(0,\sigma_X^2)$3 than on the number of base queries $X \sim \mathcal{N}(0,\sigma_X^2)$4, while increasing repetitions $X \sim \mathcal{N}(0,\sigma_X^2)$5 improves stability up to about $X \sim \mathcal{N}(0,\sigma_X^2)$6, after which gains plateau. HumanEval code-completion prompts reportedly work better than QA datasets such as TruthfulQA, SQuAD, and DROP. The source description attributes this to the more structured and consistent behavior of derivative models under code completion (Shao et al., 8 Oct 2025).

The paper also reports sensitivity to the embedding space: too small an embedding dimension loses semantic nuance, while too large a dimension makes Jacobian estimation harder under the same query budget. MPNet and EmbeddingGemma are said to behave similarly when their dimensions are comparable (Shao et al., 8 Oct 2025).

On runtime, ZeroPrint is described as computationally practical, with total overhead around 424.9 seconds. It is reported to be faster than most black-box baselines, though slower than the white-box REEF and very lightweight LLMmap (Shao et al., 8 Oct 2025).

6. Robustness, interpretation, and relation to neighboring “zero” paradigms

ZeroPrint is reported to remain robust under two adaptive strategies: input paraphrasing, in which prompts are paraphrased by small LLMs before being sent to the target model, and output perturbation, in which Gaussian noise is added to output logits. Reported similarities remain in the high $X \sim \mathcal{N}(0,\sigma_X^2)$7–$X \sim \mathcal{N}(0,\sigma_X^2)$8 range. The source explanation attributes this to semantic-preserving perturbations, averaging over repeated outputs, and the fact that the fingerprint depends on relationships between input and output changes rather than on absolute outputs (Shao et al., 8 Oct 2025).

A common misconception would be to treat ZeroPrint as a conventional response-matching scheme. The paper’s own framing rejects that interpretation: its distinctive object is not the output string distribution itself, but an estimated local Jacobian derived from query perturbations and embedding differences. Another plausible misconception is to assume that the method accesses true gradients. It does not; its central technical move is precisely the approximation of gradient structure in a black-box, discrete-text regime through zeroth-order regression (Shao et al., 8 Oct 2025).

The broader label “ZeroPrint” appears in unrelated domains with different meanings. In quantum optics, “zero-photon subtraction” refers to a conditional measurement in which one heralds on detecting zero photons in a reflected port, altering photon statistics without physically removing photons (Nunn et al., 2023, Nunn et al., 2021). In physical zero-knowledge systems, non-electronic fast neutron differential radiography has been used to compare objects while revealing no geometry or composition beyond equivalence to a reference (Philippe et al., 2016). In card-based cryptography, a “printing protocol” denotes a generic physical zero-knowledge subprotocol for transferring nonblank template entries onto a hidden puzzle area while preserving zero-knowledge (Ruangwises et al., 2023). These neighboring uses share the general motif of obtaining a useful verification signal while suppressing direct disclosure, but they are technically distinct from ZeroPrint’s LLM-fingerprinting construction.

Within LLM copyright auditing, ZeroPrint’s specific contribution is therefore the replacement of output-centric black-box fingerprints with a Jacobian-centric signature estimated from semantic perturbations. This suggests a methodological shift: the relevant identity signal may lie less in what a model says than in how its outputs vary under local, meaning-preserving changes to the prompt (Shao et al., 8 Oct 2025).