---
title: 'ZeroPrint: Black-box LLM Fingerprinting for Auditing'
url: https://www.emergentmind.com/topics/zeroprint
type: topic
---

# ZeroPrint: Black-box LLM Fingerprinting for Auditing

ZeroPrint is a black-box LLM fingerprinting method for copyright auditing that extracts a model signature from estimated input-output Jacobians rather than from outputs alone. Its central premise is that black-box fingerprinting based on textual outputs is intrinsically weak because outputs are a compressed, nonlinear view of the model, whereas input gradients preserve substantially more information about internal parameters. ZeroPrint operationalizes this premise by approximating gradient-like structure in a discrete-text API setting through zeroth-order estimation over semantic-preserving word substitutions, then uses the resulting aggregated Jacobian as the model fingerprint [2510.06605].

## 1. Conceptual setting and motivation

ZeroPrint addresses the problem of determining whether a suspicious model is derived from a source model when only API access is available. In this setting, an auditor cannot inspect weights, activations, or logits, and must therefore rely on behavioral evidence. The method is motivated by the claim that existing black-box fingerprinting approaches are weak because they rely on outputs, which lose critical information about the model’s unique parameters due to non-linear functions such as GELU and SiLU [2510.06605].

The method is situated against two existing black-box styles. “Untargeted fingerprinting” submits prompts and compares output characteristics or stylistic idiosyncrasies; examples named in the source description include LLMmap, MET, and SEF. “Targeted fingerprinting” constructs special prompts and target responses so that only the source lineage reproduces them; TRAP is cited as the example. The paper contrasts both with white-box fingerprinting, which can access weights, intermediate representations, or gradients and is therefore more effective, especially for static parameter-based fingerprints [2510.06605].

This suggests that ZeroPrint is best understood not as an output-similarity method, but as an attempt to recover a more parameter-sensitive local differential signature while remaining within black-box query constraints.

## 2. Information-theoretic basis

The theoretical core of ZeroPrint is a Fisher-information argument that the input gradient is more informative about model parameters than the output. For a model of the form
$$
Y = f(WX + K),
$$
the paper defines the input gradient
$$
D = \frac{\mathrm{d}Y}{\mathrm{d}X} = W f'(WX+K).
$$
Fisher information is introduced as
$$
\mathcal{I}_X(\theta) := \mathbb{E}_{X \sim p_\theta}\left[ \left( \frac{\partial}{\partial \theta}\log p_\theta(X) \right)^2 \right].
$$
Under the assumptions that \(f\) is nonlinear, \(W \neq 0\), \(X \sim \mathcal{N}(0,\sigma_X^2)\), and \(f''(K)\neq 0\), the paper states, under a first-order Taylor approximation, that
$$
\mathcal{I}_D(W) \geq \left(\frac{c_1^2}{2W^2c_2^2\sigma_X^2}+4\right)\mathcal{I}_Y(W),
$$
where
$$
c_1 = f'(K), \qquad c_2 = f''(K).
$$
Because the multiplier is greater than \(1\), the gradient \(D\) is claimed to contain more information about \(W\) than the output \(Y\) [2510.06605].

The paper’s intuition proceeds by treating \(Z = WX + K\) as Gaussian, upper-bounding output Fisher information through data processing,
$$
\mathcal{I}_Y(W) \le \mathcal{I}_Z(W) = \frac{2}{W^2},
$$
and then approximating
$$
f'(Z) = c_1 + c_2(Z-K) + R_2(Z),
$$
so that, ignoring the remainder term,
$$
D \approx c_1 W + c_2 W^2 X.
$$
In this formulation, the gradient retains a stronger parameter-dependent signal than the output [2510.06605].

A plausible implication is that ZeroPrint’s main novelty lies less in any specific prompt set than in the choice of observable: it shifts black-box fingerprinting from post-nonlinearity outputs toward an estimated local derivative structure.

## 3. Query construction and zeroth-order Jacobian estimation

ZeroPrint represents a model fingerprint as an estimated Jacobian of the model’s local input-output mapping. For a model \(\mathcal{M}\), the fingerprint is described conceptually as
$$
F = \text{Extract}(\mathcal{M}(\mathcal{Q}), \mathcal{Q}) \triangleq J \approx \frac{\partial \mathcal{M}(\mathcal{Q})}{\partial \mathcal{Q}}.
$$
The method then constructs this approximation through a three-stage workflow [2510.06605].

First, it builds a query set \(\mathcal{Q}\) consisting of \(n\) base queries \(\{x_1,\dots,x_n\}\) and, for each base query, \(m\) perturbed variants \(\{x'_{i,1},\dots,x'_{i,m}\}\), for a total of
$$
N = n + nm.
$$
The base queries are code-completion prompts of the form “Complete the following code: [code snippet],” with code snippets sampled from HumanEval. The source description states that this choice is intended to make the method general across models because completion is aligned with pretraining behavior and works even for base models that may not follow complex instructions well [2510.06605].

Second, because text is discrete, ZeroPrint cannot use infinitesimal continuous perturbations. Instead, it creates perturbed queries by semantic-preserving word substitution: it randomly selects \(r\) replaceable words, retrieves top-\(k\) semantically similar candidates from a word embedding model such as GloVe, randomly replaces each selected word with one candidate, and repeats this process to generate \(m\) perturbed variants per base prompt [2510.06605].

Third, the model is queried repeatedly. For a base query \(x_i\) and its perturbations, each query is issued \(t\) times to reduce output randomness; outputs are embedded with a sentence embedding model and averaged. With \(E(\cdot)\) denoting the sentence embedding function, the paper defines
$$
e_{x_i} = E(x_i), \qquad \bar e_{y_i} = \frac{1}{t}\sum_{k=1}^{t} E(y_{i,k}),
$$
and for a perturbed query \(x'_{i,j}\),
$$
e_{x'_{i,j}} = E(x'_{i,j}), \qquad \bar e_{y'_{i,j}} = \frac{1}{t}\sum_{k=1}^{t} E(y'_{i,j,k}).
$$
Difference vectors are then formed as
$$
\Delta x_{i,j} = e_{x'_{i,j}} - e_{x_i}, \qquad \Delta y_{i,j} = \bar e_{y'_{i,j}} - \bar e_{y_i}.
$$
These are treated as the discrete-text analogue of local perturbation-response pairs in zeroth-order estimation [2510.06605].

The local Jacobian \(J_i\) is estimated under the relation
$$
\Delta y_{i,j} \approx J_i \Delta x_{i,j},
$$
using Ridge Regression,
$$
J_i = \arg\min_J \sum_{j=1}^{m} \|\Delta y_{i,j} - J\Delta x_{i,j}\|_2^2 + \alpha \|J\|_F^2.
$$
The final fingerprint is the average
$$
J_\mathcal{M} = \frac{1}{n}\sum_{i=1}^{n} J_i.
$$
This Jacobian is the signature later used for model comparison [2510.06605].

## 4. Verification criterion and benchmark configuration

To test whether a suspicious model \(\mathcal{M}_s\) is a derivative of a source model \(\mathcal{M}_o\), ZeroPrint compares fingerprints with the Pearson correlation coefficient,
$$
\text{Sim}(J_o, J_s) = \text{Pearson}(J_o, J_s).
$$
A suspicious model is flagged as derivative if
$$
\text{Sim}(J_o, J_s) > \tau.
$$
The decision procedure is therefore threshold-based on similarity between flattened fingerprint matrices [2510.06605].

The evaluation is reported on the “LLM copyright auditing benchmark” from a companion SoK study. The benchmark includes 7 base model lineages—Qwen2.5, Llama 3.1, Mistral 7B, Gemma 2, TinyLlama, Llama-2, and Qwen2.5-14B / Qwen2.5-7B variants—and 149 total model instances. Post-development transformations include fine-tuning, instruction tuning, model merging, distillation, system prompts, RAG, adversarial manipulation, quantization, and parameter-efficient fine-tuning [2510.06605].

The paper compares ZeroPrint against REEF as a white-box baseline and LLMmap, MET, SEF, and TRAP as black-box baselines. The maximum query budget is
$$
q = 200.
$$
Default ZeroPrint settings are \(n = 2\) base queries, \(m = 4\) perturbed queries per base query, and \(t = 20\) repeats per query, yielding 10 distinct prompts and 200 total queries. The sentence embedding model is all-mpnet-base-v2, the substitution model is GloVe, and Ridge regularization uses \(\alpha = 0.001\) [2510.06605].

These design choices indicate that the method is optimized for a constrained-query, post hoc auditing regime rather than for exhaustive behavioral testing.

## 5. Reported empirical behavior

The main reported metrics are AUC, pAUC with FPR in \([0, 0.05]\), TPR@1%FPR, and Mahalanobis Distance. ZeroPrint is reported to achieve
- AUC: \(0.720 \pm 0.013\)
- pAUC: \(0.683 \pm 0.005\)
- TPR@1%FPR: \(0.366 \pm 0.009\)
- MD: \(1.457 \pm 0.015\)

It is reported to outperform prior black-box methods, with comparison AUC values listed as 0.632 for LLMmap, 0.661 for MET, 0.581 for SEF, and 0.712 for TRAP. It remains below the white-box baseline REEF, whose AUC is given as 0.896 and pAUC as 0.832 [2510.06605].

The ablations emphasize that performance depends more strongly on the number of perturbations \(m\) than on the number of base queries \(n\), while increasing repetitions \(t\) improves stability up to about \(t=20\), after which gains plateau. HumanEval code-completion prompts reportedly work better than QA datasets such as TruthfulQA, SQuAD, and DROP. The source description attributes this to the more structured and consistent behavior of derivative models under code completion [2510.06605].

The paper also reports sensitivity to the embedding space: too small an embedding dimension loses semantic nuance, while too large a dimension makes Jacobian estimation harder under the same query budget. MPNet and EmbeddingGemma are said to behave similarly when their dimensions are comparable [2510.06605].

On runtime, ZeroPrint is described as computationally practical, with total overhead around 424.9 seconds. It is reported to be faster than most black-box baselines, though slower than the white-box REEF and very lightweight LLMmap [2510.06605].

## 6. Robustness, interpretation, and relation to neighboring “zero” paradigms

ZeroPrint is reported to remain robust under two adaptive strategies: input paraphrasing, in which prompts are paraphrased by small LLMs before being sent to the target model, and output perturbation, in which Gaussian noise is added to output logits. Reported similarities remain in the high \(0.86\)–\(0.91\) range. The source explanation attributes this to semantic-preserving perturbations, averaging over repeated outputs, and the fact that the fingerprint depends on relationships between input and output changes rather than on absolute outputs [2510.06605].

A common misconception would be to treat ZeroPrint as a conventional response-matching scheme. The paper’s own framing rejects that interpretation: its distinctive object is not the output string distribution itself, but an estimated local Jacobian derived from query perturbations and embedding differences. Another plausible misconception is to assume that the method accesses true gradients. It does not; its central technical move is precisely the approximation of gradient structure in a black-box, discrete-text regime through zeroth-order regression [2510.06605].

The broader label “ZeroPrint” appears in unrelated domains with different meanings. In quantum optics, “zero-photon subtraction” refers to a conditional measurement in which one heralds on detecting zero photons in a reflected port, altering photon statistics without physically removing photons [2301.10702; 2112.11990]. In physical zero-knowledge systems, non-electronic fast neutron differential radiography has been used to compare objects while revealing no geometry or composition beyond equivalence to a reference [1602.07717]. In card-based cryptography, a “printing protocol” denotes a generic physical zero-knowledge subprotocol for transferring nonblank template entries onto a hidden puzzle area while preserving zero-knowledge [2302.01235]. These neighboring uses share the general motif of obtaining a useful verification signal while suppressing direct disclosure, but they are technically distinct from ZeroPrint’s LLM-fingerprinting construction.

Within LLM copyright auditing, ZeroPrint’s specific contribution is therefore the replacement of output-centric black-box fingerprints with a Jacobian-centric signature estimated from semantic perturbations. This suggests a methodological shift: the relevant identity signal may lie less in what a model says than in how its outputs vary under local, meaning-preserving changes to the prompt [2510.06605].

Source: https://www.emergentmind.com/topics/zeroprint