Implicit Identity Technologies for LLMs: Fingerprinting and Watermarking across Datasets, Models, and Generated Content

Implicit Identity Technologies for LLMs: Fingerprinting and Watermarking across Datasets, Models, and Generated Content

arXiv:2605.29245v1 [cs.CR] 28 May 2026

Bing Liu1,2 , Shunping Wang1 , Yufan Zhu3,4 , Xinyi Yu1 , Jing Huang3,4 , Linkang Du1 , Hongbin Pei1∗ , Wei Luo5 1 School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China 2 State Grid Henan Marketing Service Center, Henan, China 3 Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China 4 School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China 5 School of Information Technology, Deakin University, Geelong, Australia Abstract Large language models (LLMs) are substantial investments and increasingly deployed in high-stakes domains, making it critical to protect LLM-related assets and to trace their provenance. Identity technologies such as fingerprinting and watermarking address these needs by enabling ownership verification and attribution, and have rapidly emerged as an active research focus. However, as the field remains at an early stage, existing techniques lack a systematic organization, leading to two key issues, terminological confusion and isolated research lines, that have hindered the development of this research field. To this end, we present a comprehensive review of LLM identity techniques, focusing on fingerprinting and watermarking across the LLM lifecycle, including datasets, models, and generated content. We make three primary contributions. First, we introduce implicit identity as a unifying abstraction and distinguish fingerprinting from watermarking. Second, we propose a lifecyclebased taxonomy that organises techniques by asset type and verification role, aligning each with asset protection or provenance. Third, we establish an evaluation framework around three objectives— identifiability, robustness, and deployability—and summarise representative metrics under realistic access and transformation regimes, providing a common basis for comparison. Together, these contributions unify and structure the landscape of LLM identity techniques, clarify terminology, and highlight directions toward secure deployment.

1

Introduction

Large language models (LLMs) have revolutionized a wide range of fields. Their development requires substantial investments in data, computation, and expertise; for example, training GPT-4 is reported to cost over $100 million1 . Consequently, asset protection of LLMs becomes critical given ∗

Corresponding authors.

such high costs, as unauthorized use or leakage can result in significant losses. In parallel, the misuse and malicious exploitation of LLMs has emerged as another key challenge; for instance, LLM-generated content has been used by malicious actors to enable automated fraud systems [Lin et al., 2024]. Accordingly, provenance of LLMs is critical for tracing the origins of such activities, thereby enabling accountability and governance of misuse and malicious exploitation. From a technological perspective, identity mechanisms for LLMs are fundamental to enabling both asset protection and provenance. A growing body of research has explored LLM identity techniques, such as fingerprinting for model copyright protection [Zhang et al., 2024b] and watermarking for generated content provenance [Kirchenbauer et al., 2023]. However, as the field remains at an early stage, existing technologies lack a systematic organization, resulting in two key issues: (1) Terminological confusion. In particular, watermarking and fingerprinting, two primary identity technologies, are not clearly distinguished in the literature. For instance, the trigger-based specific-response mechanisms are termed “instructional fingerprinting” in [Xu et al., 2024a], whereas they are referred to as “backdoor watermarking” in [Mo et al., 2025]. (2) Isolated research lines. Existing identity studies for LLMs have largely evolved in isolation within specific scenarios, including dataset identity [Carlini et al., 2021; Maini et al., 2021], model identity [Zeng et al., 2024; Zhang et al., 2024b; Xu et al., 2024a], and generated content identity [Kirchenbauer et al., 2023; Hou et al., 2024a; Hu et al., 2023]. As a result, the community lacks a comprehensive and unified understanding of LLM identity. Prior watermarking surveys [Liu et al., 2024; Wang et al., 2025b; Liang et al., 2026] naturally do not cover fingerprinting, and even recent surveys covering both [Xu et al., 2025c; Ye et al., 2025; Wang et al., 2025b; Liang et al., 2026] fail to adequately address these two issues. The two aforementioned issues have, to some extent, hindered the development of this research field. To address these challenges, this survey clarifies key concepts and proposes a verification-semantic taxonomy to systematically organize existing studies on LLM identity, including fingerprinting and watermarking. Our goal is to clarify the landscape of this early-stage research field and to outline research objectives

and major roadmaps that can guide future advances. To this end, this survey makes the following three contributions. Our first contribution is a unification of key concepts in this field. We propose a three-layer conceptual framework to systematically describe existing methods. (I) At the top level, we introduce a unifying abstraction, Implicit Identity (Implicit-ID for short), which refers to specific characteristics of an LLM that are not directly observable but can be verified and used to uniquely identify the model and distinguish it from others. Such implicit identity provides a unifying abstraction for both fingerprinting and watermarking techniques. (II) At the middle level, we differentiate between two main realizations of implicit-ID, fingerprinting and watermarking. LLM fingerprinting is defined as a non-intrusive implicit-ID, which is constructed by intrinsic characteristics of an LLM; LLM watermarking is an intrusive implicit-ID, in which identifiable signals are deliberately embedded into the model, data, or generated content through external intervention. (III) At the bottom level, we summarize existing methods by evidence source and verification pathway, yielding a compact design-space view of implicit-ID technologies. Our second contribution is a generative taxonomy across assets and lifecycle stages. We introduce a taxonomy that organizes identity technologies by verification semantics, i.e., similarity-based attribution and keyed verification, across datasets, models, and generated content throughout the LLM lifecycle. Beyond comprehensive coverage, the taxonomy reveals cross-asset equivalences—e.g., shared trigger-response logic underlying dataset watermarking and fine-tuning-based model watermarking, and shared attribution logic underlying behavioural model fingerprints and output-only fingerprints. This perspective enables cross-level reasoning: techniques designed for one asset level can be transferred to another, helping the community avoid isolated research lines and supporting reasoning about multi-level identity designs for LLMs. Our third contribution is the establishment of technological objectives. Motivated by the two core application tasks of Implicit-ID, asset protection and provenance, we identify three key objectives for the technologies: identifiability, robustness, and deployability. Specifically, an ImplicitID should exhibit high identifiability to reliably distinguish different LLMs, maintain robustness under legitimate postdeployment transformations and adversarial manipulation, and demonstrate practical deployability under realistic settings. Accordingly, we propose a common evaluation template organized by transformation regimes, enabling systematic and comparable assessment of existing methods. These contributions show that LLM fingerprinting and watermarking can be consistently viewed under a shared verification-semantic lens, rather than as isolated, mechanism-specific techniques, as organized in the prior surveys [Xu et al., 2025c; Ye et al., 2025]. What this survey enables. By unifying identity technologies under Implicit-ID and organizing them by verification semantics rather than mechanism, this survey enables: (i) principled analysis and comparison between intrusive and nonintrusive methods under shared verification semantics; (ii)

transfer of techniques and evaluation stressors across dataset, model, and content identity; and (iii) systematic reasoning about trade-offs between legal defensibility, robustness to post-deployment transformations, and practical deployability. The remainder is organized as follows: Section 2 formalizes the tasks and notation, Section 3 presents the lifecyclebased taxonomy, Section 4 defines the evaluation metrics, and Section 5 discusses challenges and directions.

2

Main Tasks in Implicit-ID Technologies

In this section, we formalize the primary two application tasks of Implicit-ID technologies: Asset Protection, which safeguards the security and value of LLM-related assets, and Provenance, which ensures accountability and regulatory compliance within the LLM ecosystem. Unified view and notation. We treat both asset protection and provenance as identity verifications over valued LLM assets. Let A ∈ {D, M, Y} denote an asset or what, where D is training data, M is a model artifact, e.g., weights and internal states, and Y is generated content. A verifier interacts with an asset through an access interface OA , capturing the practical setting: white-box (weights available), grey-box (limited internals), or black-box (query-only). After release or deployment, the asset may be modified by a transformation τ ∈ T , producing A′ = τ (A), e.g., dataset filtering, model finetuning/quantization/distillation/merging, or output rewriting. We evaluate an Implicit-ID technology by whether reliable verification can be maintained under the τ of interest. We distinguish two transformation regimes that recur across all assets. Owner/benign transformations τ ∈ Town reflect legitimate post-release adaptation (e.g., filtering, finetuning, quantization, distillation, prompt/policy changes, or paraphrasing), and primarily test whether an identity signal remains stable under normal lifecycle drift. Adversarial transformations τ ∈ Tadv are adaptive attempts to remove, forge, or evade identity (e.g., watermark removal via targeted training, paraphrase-based sanitization, trigger suppression, or mimicry prompts). This distinction interacts with verification semantics: similarity-based attribution is typically evaluated as probabilistic evidence under Town , whereas keyed verification additionally targets reliability against Tadv .

2.1

Asset Protection Task

For LLM-related asset protection, Implicit-ID resides in or is embedded within assets and serves as verifiable evidence of ownership, thereby detecting and countering unauthorized use and redistribution, such as the well-known 2024 Miqu model leak on Hugging Face2 . Generated content asset protection is also crucial for preventing plagiarism. The U.S. Copyright Office’s rulings on creative arrangement in AIassisted works establish an important legal foundation3 . Asset protection can be realized through proactive verification, i.e., watermarking. The asset owner embeds a keyed mark into an asset (or its generation procedure) via Ek , yielde = Ek (A), and later verifies from A′ = τ (A) e using a ing A keyed detector Vk (OA′ ). Asset protection can also be realized through retroactive verification, i.e., fingerprinting. Without

an embedded keyed mark, a verifier extracts inherent evidence X(OA′ ) from the asset and determines ownership by similarity matching Vx (OA , OA′ ) between the extracted evidence and the reference evidence from owned assets.

2.2

Taxonomy across Verification Semantics and LLM Lifecycle

We first introduce the taxonomy dimensions that structure the landscape of Implicit-ID technologies, and then systematically survey existing techniques within this taxonomy.

3.1

Similarity-based A�ribu�on (Fingerprin�ng (FP))

Provenance Task

For provenance, Implicit-ID acts as the foundation for tracing LLM-related asset lineage and origin, reinforcing digital trust and accountability. In practice, provenance can be established either through proactive provenance binding, e.g., watermarking at creation, or through retroactive provenance inference similarity-based attribution when no prior mark exists. Dataset provenance enables retroactive auditing through Implicit-ID techniques such as dataset fingerprinting, allowing stakeholders to detect latent “data footprints” and verify licensing compliance without requiring pre-marked data. Model provenance focuses on identifying rebranded or derivative models and tracing them back to their foundational counterparts, supporting regulatory requirements for a transparent chain of custody. Generated content provenance usually serves as a societal safeguard against misinformation and synthetic fraud. Many jurisdictions have established mandatory labeling requirements for generated content, including China4 , the European5 , and the United States6 , thereby reinforcing digital trust through provenance. Provenance supports traceability through two complementary modes. Provenance binding is a proactive realization, in which the LLM owner embeds or attaches verifiable evidence via Ek , e.g., a keyed watermark, at creation time or serving time, and later verifies by a keyed detector Vk (OA′ ). Provenance inference is a retroactive realization. When no prior mark is assumed, a verifier extracts inherent evidence X(OA′ ) and decides attribution using a matcher Vx (OA , OA′ ).

3

Taxonomy of Implicit Identity Technologies for LLMs

Taxonomy Dimensions

Our taxonomy organizes Implicit-ID technologies along two complementary dimensions: a verification dimension defined by verification semantics, and a lifecycle dimension defined by the asset stage at which identity is established or verified. Along the lifecycle dimension, we consider three asset stages throughout the LLM lifecycle: Dataset D, Model M, and Generated content Y. Asset protection and provenance tasks recur as cross-cutting objectives across all stages. Along the verification dimension, we distinguish two categories of verification semantics underlying both asset protection and provenance tasks. Under these tasks, identity verification can be viewed as a decision process that controls false matches and false misses under realistic access constraints, motivating our later emphasis on identifiability, robustness, and deployability. The first category is similarity-based attribution, implemented via a matcher Vx (·, ·), which corresponds to

Dataset

Model

Generated content

Sta�s�cal dataset FP[1]

Parameter-space FP [3]

Sta�s�cal FP of Generated content [8]

Specific-response dataset FP [2]

Representa�onspace FP [4] Behavioural FP [5]

Keyed Verifica�on (Watermarking (WM)) Model

Generated content

Fine-tuning WM [6]

Sta�s�cal WM of Generated content [9]

Model-edi�ng WM [7]

Keyed sampling WM [10] Verifica�on Tasks

Asset Protec�on (proac�ve)

Provenance Binding (proac�ve)

Provenance Inference (retroac�ve)

Technical objec�ves Iden�fiability

Robustness

Prac�cal deployability

Figure 1: Taxonomy of Implicit Identity Technologies across LLM lifecycle and verification semantics (keyed verification and similarity-based attribution), together with tasks and objectives.7

non-intrusive fingerprinting. The second category is keyed verification Vk (·), implemented through a keyed mark and a corresponding detector, which corresponds to intrusive watermarking. Consequently, both asset protection and provenance can be achieved either through proactive keyed verification or through retroactive verification based on similaritybased attribution. Specifically, across assets A ∈ D, M, Y and corresponding access interfaces OA , we summarize existing methods in terms of: (i) Evidence source and required Access conditions; (ii) Verification semantics (keyed or similarity-based); and (iii) Dominant transformation Stressors τ under which verification must remain reliable. The proposed taxonomy is also generative: it reveals cross-asset commonalities in verification logic, suggesting how techniques, attack models, and evaluation stressors may transfer across datasets, models, and generated content. This perspective enables cross-level reasoning, where techniques developed for one asset stage can inform the design and evaluation of methods at other stages.

3.2

Implicit-ID of Datasets

Implicit-ID of datasets primarily focuses on dataset provenance inference, which seeks to determine whether a suspect model M′ was trained on a target dataset D under posttraining transformations τ and a given observation interface OA (e.g., API access). The objective is to provide post-hoc

evidence supporting the claim that M′ was trained on D when training provenance is inaccessible or opaque. While dataset watermarking has been explored in traditional ML (e.g., image datasets [Du et al., 2025]). For LLMs, emerging approaches similarly embed in-distribution, text-preserving signals (e.g., invisible Unicode “canaries” or cue–reply structures) into documents and later verify their imprint via blackbox prompting [Li et al., 2025b; Naser, 2025]. However, robust LLM-specific implementations remain limited; accordingly, we focus on non-keyed dataset fingerprinting for provenance inference. Dataset fingerprint: • Evidence: loss/likelihood statistics; • Access: black-box → logprobs; • Stressors: shift, fine-tuning, distillation.

box). We distinguish fingerprinting for non-keyed similaritybased attribution and watermarking for keyed ownership verification. Fingerprinting extracts intrinsic characteristics and compares them; watermarking embeds a secret identifier verified by a keyed procedure. Remark (elicitation vs embedding). no model modification → behavioural fingerprinting implanted trigger-response via tuning/editing → watermarking

We focus on model-level identity under τ and OM , covering fingerprinting as similarity-based attribution and watermarking as keyed ownership verification; output-only provenance techniques are deferred to Section 3.4. Similarity-based attribution (Model Fingerprinting)

Statistical Dataset Fingerprinting Statistical dataset fingerprinting provides non-keyed evidence that M ′ has been exposed to D by detecting dataset-specific memorization signals in model statistics (e.g., loss/perplexity gaps, likelihood anomalies, or aggregate membership scores), without modifying D. Representative lines of work show that LLMs can exhibit detectable membership effects at the sequence or aggregate level, enabling post-hoc auditing and ownership resolution Carlini et al. [2021]; Mattern et al. [2023]; Shi et al. [2023]; Maini et al. [2024]. In practice, these signals are most informative when evaluated under confound controls (e.g., semantically similar corpora) and robustness stressors τ (finetuning, distillation, and distribution shift), which can dilute or mask membership traces Huang et al. [2024]. Adjacent evidence from contrastive representation learning further suggests a performance–privacy trade-off: stronger feature learning can amplify membership leakage, supporting the broader view that learned representations may retain dataset-specific identity signals useful for provenance auditing, even outside LLM-specific settings Sun et al. [2025b]. Specific-Response Dataset Fingerprinting Specific-response fingerprinting constructs non-keyed evidence by probing M ′ with a curated set of membershipsensitive queries and analysing targeted behavioural signatures rather than global statistics. Typical signals include confidence/margin patterns on high-influence examples or specialised probe prompts that elicit distinctive responses linked to D Maini et al. [2021]; Liu et al. [2022]; Naser [2025]. Compared with purely statistical approaches, this paradigm can offer stronger diagnostic power for ownership resolution, but is more sensitive to probe design and can be confounded by independent similarity (training on a dataset D′ ≈ D). It is also vulnerable to post-training transformations τ (e.g., instruction tuning) and adaptive smoothing that reduce membership contrast.

3.3

Implicit-ID of Models

Problem formulation: Model identity asks whether a suspect model M ′ is derived from an owner model M under transformations τ (e.g., fine-tuning, quantisation, distillation, merging) and an observation interface OM (white-/grey-/black-

Model fingerprinting performs non-keyed, similarity-based attribution by matching intrinsic model evidence (parameters, representations, or elicited behaviours). Existing work extracts fingerprints by leveraging either model parameters or internal representations. Consequently, existing methods fall into three categories: (i) parameterspace fingerprints (white-box), (ii) representation-space fingerprints (white-/grey-box, occasionally query-only approximations), and (iii) non-intrusive behavioural fingerprints based on curated elicitation prompts (black-box). Parameter-space fingerprint: • Evidence: weights / parameter statistics / invariants • Access: white-box • Verification: similarity-based attribution • Stressors: weight permutation/reordering; mild finetuning; typically weak under strong τ (e.g., distillation or merging) unless explicitly handled These methods identify a model by extracting descriptors directly from weights, then attributing ownership via similarity in a weight-derived feature space. One representative design is to build invariants that remain stable under admissible weight reordering/permutation (e.g., HuRef [Zeng et al., 2024]), enabling lineage/copyright inference without embedding any trigger. Another design [Yoon et al., 2025] uses layerwise attention-projection statistics (Q/K/V/out) and compares correlations across statistical sequences to infer lineage (Intrinsic Fingerprint of LLMs). A third design [Zeng et al., 2025] aligns informative weight blocks (e.g., embeddings and Q/K projections) and computes similarity after alignment (AWM), reported as discriminative even after largescale training. In exchange for strong identifiability signals, parameter-space approaches typically require white-box access and may be costly or less practical for ultra-large models. Unlike probe-based approaches, parameter-space fingerprinting operates directly on weights and therefore does not rely on curated test prompts/cue words during verification; however, it is inherently white-box and can be computationally costly at LLM scale.

Representation-space fingerprint: • Evidence: hidden activations/gradients under probing • Access: white/grey-box; query-only approximations • Verification: similarity-based attribution • Stressors: probe design and distribution shift; extensive fine-tuning; merging; distillation Representation-space fingerprinting attributes a suspect model by comparing internal responses under predefined probing inputs, typically activations, gradients, or sensitivity signals, and performing attribution between the resulting descriptors. Existing approaches can be organised into two canonical designs. Activation-based methods identify models by comparing intermediate activations induced by probing inputs: DeepJudge [Chen et al., 2022] evaluates similarity via multi-level distance metrics on intermediate activations; EasyDetector [Zhang et al., 2024a] trains probing classifiers on a victim model’s activations and tests whether separability patterns transfer to a suspect model; and REEF [Zhang et al., 2024b] compares activation representations using geometry-preserving similarity (CKA). Gradient/sensitivity-based methods use how the model responds to small perturbations: TensorGuard [Wu et al., 2025] extracts fingerprints from statistics of parameter gradients induced by controlled perturbations in selected layers; and ZeroPrint [Shao et al., 2025] derives global Jacobian-based fingerprints by aggregating output differences under probing inputs, enabling identification without access to internal states. Overall, representation-space fingerprints can provide strong robustness to parameter modifications, but most existing methods require white-box access and may fail to distinguish closely related LLMs with similar architectures. Behavioural fingerprint: • Evidence: input-output response patterns under curated elicitation prompts (fixed strings, response distributions, reasoning traces, etc.). • Access: black-box (query-only). • Verification: similarity-based attribution or learned matching over responses. • Stressors: decoding randomness (temperature/topp), refusal/safety policies, prompt filtering/sanitisation, system-prompt differences, context-window effects, adaptive prompt interventions, and model drift. Behavioural fingerprinting attributes a suspect model by eliciting stable, discriminative response patterns under a compact set of curated prompts, and performing non-keyed matching (similarity scoring or learned linkage) over the observed outputs. A representative application-driven instantiation is LLMMAP Pasquini et al. [2024], which actively dispatches a small query set to fingerprint LLM-integrated systems (e.g., RAG pipelines) and identify specific model versions from behavioural nuances. Existing methods can be grouped into three canonical technical paths. First, adversarial/optimised prompting aims to induce deterministic fixed-string or high-entropy signatures that separate the target from non-homologous models:

TRAP [Gubri et al., 2024] repurposes adversarial suffixes to force a predefined answer while other models respond incoherently or differently; PROFLINGO [Jin et al., 2024] generates prompts that trigger distinctive response distributions to link originals and derivatives. Second, automated prompt discovery reduces reliance on manual design: Hide-andSeek [Iourovitski et al., 2024] uses evolutionary learning with an auditor LLM to discover salient input–output pairs exposing a model family’s semantic manifold; RAP-SM [Xu et al., 2025b] leverages shadow models to improve transferability across model series and maintain robustness under adaptive merging or fine-tuning. Third, high-level cognitive/knowledge behaviours treat reasoning and retrieval idiosyncrasies as fingerprints: C OTSRF [Ren et al., 2025] models distinctive chain-of-thought trajectories elicited by crafted logic prompts; D U FF IN [Yan et al., 2025] combines trigger patterns with knowledge-level fingerprints capturing how models retrieve and articulate domain-specific facts. Finally, some “behavioural” identifiers exploit architecture-tied effects (e.g., ROUTE M ARK [He et al., 2025] attributes identity in MoE-based merged models via distinctive expert-routing logic) positioned closer to behavioural evidence but reflecting internal architectural characteristics. Together, these methodologies demonstrate that inputconditioned responses—whether triggered by adversarial suffixes, reasoning paths, or routing preferences—constitute a powerful and diverse toolkit for active model fingerprinting. Keyed ownership verification (Model Watermarking) Model watermarking refers to a class of intrusive identity technologies that embed identity signals into a model before release or deployment, so ownership can later be verified by probing for the presence of those signals. Most existing methods follow a specific-response paradigm: the model is intentionally modified to produce distinctive responses to designated secret triggers while behaving normally on benign inputs, and these trigger-response behaviours serve as explicit identifiers for verification. Such approaches are often referred to as “fingerprinting” or “backdoor fingerprinting”, but this can be misleading: Unlike fingerprints that arise intrinsically from architecture or training data, watermarks are deliberately embedded post-hoc. We therefore categorise these specific-response methods as model watermarking. From the perspective of watermark embedding mechanisms, existing approaches can be broadly divided into two classes: fine-tuning specific-response model watermarking and model editing specific-response model watermarking. We review representative methods in each class below. Fine-tuning watermark: • Evidence: trigger-response behaviour embedded. • Access: insertion requires fine-tuning access;outputonly verification via key. • Verification: keyed verification. • Stressors: suppression/filtering; prompt interventions; extraction; mismatched fine-tuning; merging Watermarking via fine-tuning represents an early and widely used paradigm for embedding trigger-response behaviours into LLMs: the watermark is injected by fine-tuning

on datasets containing secret trigger-response pairs, inducing the model to associate predefined triggers with special responses. Instructional Fingerprinting [Xu et al., 2024a] establishes this paradigm by showing that instruction-style supervised fine-tuning can implant watermark behaviours without access to model internals, and subsequent work extends the approach via stronger trigger-response binding (Chain&Hash [Russinovich and Salem, 2024]), improved deployment efficiency (FP-vec [Xu et al., 2024c]), scalability via in-distribution trigger-response pairs (Perinucleus Fingerprinting [Nasery et al., 2025]), and anchoring behaviours in lower-level representations to improve robustness to further fine-tuning (TIBW [Mo et al., 2025]). The primary stressors for fine-tuning watermarks include suppression/filtering and prompt interventions, extraction, mismatched fine-tuning, and merging; we defer the detailed attack surface and robustness evaluation protocols to Sec 4. Because many model watermarks are realised through trigger–response behaviours, their robustness should also be evaluated against adjacent backdoor-repair and unlearning techniques; class-wise trigger recovery and unlearning, for example, indicate that embedded trigger behaviours may be actively discovered and weakened Hou et al. [2025]. Model-editing watermark: • Evidence: keyed behaviours inserted via parameter edits. • Access: insertion requires editing access; output-only verification via key. • Verification: keyed verification. • Stressors: subsequent edits/unlearning; fine-tuning; merging; detectability if edited behaviours are unnatural Model-editing watermarking inserts keyed behaviours via local parameter edits, offering low-cost insertion with limited utility impact. Representative designs either reinforce trigger–target associations (FPEdit [Wang et al., 2025a]) or embed more natural keyed QA behaviours (EditMark [Li et al., 2025a]). We evaluate the robustness of editing-based watermarks under the stressors summarised above in Sec 4.

3.4

Implicit-ID of Generated Content

This section studies identity technologies that operate on generated outputs alone (output-only), i.e., how LLM provenance can be established without internal model access. This setting is particularly relevant for black-box API services and post-hoc auditing. We organize output-based identity signals into two paradigms: (1) Generated Content Fingerprinting, which attributes a source model by leveraging inherent and unintended idiosyncrasies in its responses; and (2) Generated Content Watermarking, which provides traceability by intentionally embedding detectable signals during generation. In our task terminology, Generated Content watermarking implements provenance binding, whereas Generated Content fingerprinting implements provenance inference. Accordingly, fingerprinting yields similarity-based attribution evidence, while watermarking supports (often keyed) verification from outputs under post-generation trans-

formations τ . Generated content FP: • Evidence: distributional/stylistic biases in outputs. • Access: black-box, output-only. • Verification: non-keyed attribution(e.g., similaritybased attribution). • Stressors: rewriting, decoding changes, confounding. Generated content fingerprinting attributes a source model from outputs alone by extracting intrinsic and unintended regularities in the generated text, and performing non-keyed attribution (e.g., similarity scoring or classifier-based matching) without modifying the model or decoding procedure. Statistical Fingerprinting of Generated content. Statistical fingerprinting treats stable deviations in an LLM’s output distribution (lexical, syntactic, or embedding-level) as a latent signature that supports attribution via statistical modeling or classification. Recent studies report high discriminability at the model-family level: Sun et al. [2025a] show that word-level distribution cues enable embedding-based classifiers to separate major families (e.g., GPT/Claude/Gemini), with robustness under rewriting/translation; Suzuki et al. [2025] further suggests that identifiable “natural fingerprints” can arise even among models trained on identical data due to training/optimization randomness. From a detection standpoint, Antoun et al. [2023] demonstrates cross-model attribution that generalizes across sources and sizes, and Bitton et al. [2025] improves reliability via classifier ensembles that maintain precision under style-mimic prompts. Limitation: Because signals are distributional, attribution is sensitive to prompt/system context and decoding settings, and is most defensible when framed as probabilistic evidence rather than a cryptographic proof. Generated Content WM: • Evidence: verifiable distributional deviation / keyed sampling trace. • Access: serving/decoding-time insertion; output-only verification via detector/key. • Verification: keyed verification. • Stressors: editing τ (rewrite/translate/summarise/ character-level perturbations), decoding changes, adaptive removal. Generated content watermarking is an intrusive provenance-binding mechanism: it intentionally embeds verifiable identity signals into the generation process so that provenance can be verified from outputs (often with a secret key), without requiring model internals at verification time. We organize generated content watermarking by how identity is embedded: (i) statistical watermarking, which induces detectable distributional shifts (via inference-time logit intervention or training-time internalisation), and (ii) secrecy-insampling, which encodes identity in keyed sampling trajectories with (near) zero distortion. Statistical Watermarking of Generated Content. Statistical watermarking embeds a verifiable distributional deviation into generated text such that provenance can be detected from outputs alone. Whether injected via inference-time logit

intervention or internalized during training, the watermark manifests as a persistent statistical shift detectable by a verifier. Based on the verification mechanism, this paradigm admits two dominant technical paths: statistical hypothesis testing and statistical pattern learning. Statistical hypothesis testing. This line of work formulates provenance verification as a hypothesis test, where the null assumes natural (unwatermarked) text. Kirchenbauer et al. [2023] introduce the canonical red-green list scheme, biasing token selection toward a pseudo-random subset and verifying provenance via Z-score testing of token frequencies. Dathathri et al. [2024] refine this framework in S YNTH IDT EXT using tournament sampling to preserve generation diversity while maintaining high detection specificity. To mitigate the fragility of token-level statistics under paraphrasing, subsequent work shifts verification into semantic space. Hou et al. [2024a] propose S EM S TAMP, which partitions embedding space using locality-sensitive hashing and treats region occupancy as a statistical signature; KS EM S TAMP [Hou et al., 2024b] further aligns partitions with semantic structure via clustering, improving robustness to linguistic transformations. Across these methods, watermark verification remains an external, rule-based statistical test. Statistical pattern learning. An alternative paradigm treats the watermark as a latent statistical pattern that can be internalized by the model and recognized by learned discriminators. This approach is particularly relevant in opensource settings, where inference-time logit biasing can be bypassed. Gu et al. [2023] demonstrate watermark distillation, showing that student models can reproduce a teacher’s statistical watermark without explicit decoding constraints. Xu et al. [2024b] further improve detectability via reinforcement learning co-training, coupling generation with a trainable detector to shape output trajectories that maximize classification confidence while preserving fluency. This notion of internalized identity is extended to open-source security in M ARK YOUR -LLM [Xu et al., 2025a], which embeds statistical behaviors via backdoor-based internalization and verifies provenance using a paired classifier. Keyed sampling watermarking. While statistical watermarking relies on detectable distributional shifts, keyed sampling watermarking encodes provenance through secrecy in the sampling process. The watermark is defined by secret sampling rules, typically keyed pseudo-randomness governing token selection, rather than by observable deviations in the output distribution. Verification checks whether a generated sequence is consistent with the secret key and the model’s logits. A central advantage of this paradigm is its zero-distortion property: the marginal distribution of watermarked text is theoretically identical to that of the original model. Christ et al. [2024] formalize this notion via undetectable watermarks based on cryptographic one-way functions, showing that outputs are computationally indistinguishable from unwatermarked text to any adversary lacking the key. Hu et al. [2023] further propose an unbiased watermarking framework based on reparameterized sampling, ensuring that expected token frequencies match the model’s softmax distribution.

In keyed sampling watermarking, verification reduces to re-evaluating whether the observed token sequence adheres to the secret sampling trajectory induced by the key and the model probabilities. By exploiting the secrecy of the sampling path, these methods achieve strong robustness against adaptive detection while preserving generation fidelity.

4

Evaluation Metrics for ID Technologies

We evaluate Implicit-ID techniques along Identifiability, Robustness, and Practical Deployability, providing a verification-semantic evaluation lens (keyed vs. similaritybased) rather than a finalized benchmarking standard.

4.1

Identifiability

Identifiability measures separability of identity signals under the intended access interface OA . We report true positive rate (TPR) and false positive rate (FPR) at a specified operating point, defined as TPR =

TP , TP + FN

FPR =

FP , FP + TN

where TP, FN, FP, TN denote true positives, false negatives, false positives, and true negatives, respectively. For similarity-based attribution, these rates reflect evidential error under a matching rule; for keyed verification, they reflect detector reliability under the secret-key assumption.

4.2

Robustness

Robustness evaluates whether an identity signal remains verifiable under post-deployment transformations of the protected asset (model, data, or content). We consider a transformation set T comprising benign operations Tbenign (e.g., finetuning, quantisation, paraphrasing, preprocessing) and adversarial attacks Tadv (e.g., removal, evasion, forgery). We summarise robustness via Robustness Coverage (RC) at an operating threshold C, defined as RC = |{τ ∈ T | TPR(τ ) ≥ C}|/|T | where TPR(τ ) denotes the true positive rate after applying transformation τ . RC should be interpreted within a fixed threat model and verification regime; in particular, RC is not directly comparable across keyed vs. non-keyed methods, or across asset levels, unless T and the decision semantics are aligned.

4.3

Practical Deployability

Practical deployability assesses real-world overhead of identity technologies along three dimensions: (i) utility impact on the primary task, (ii) embedding cost to establish identity, and (iii) verification cost to check it. Utility impact. We measure utility degradation as ∆U =

Uorig − Umarked × 100%, Uorig

where U denotes a task-relevant utility metric. Embedding cost. Resource expenditure required to establish the identity binding, including any additional computation, data construction, and required access for insertion.

Verification cost. Resources required for identity verification, including computational overhead, query volume/latency, auxiliary storage, and the access requirement (whitebox, grey-box, or black-box).

5

Current Challenges and Future Directions

Identity signals that preserve utility. A persistent bottleneck is the identifiability-utility trade-off: many Implicit-ID signals improve verification only by incurring nontrivial ∆U or exploiting fragile surface cues. Future work should codesign identity mechanisms explicitly with semantic fidelity in mind, for high separability across prompts, domains, and access interfaces while maintaining task performance. Robustness across lifecycle drift and adaptive transformations. Existing methods often fail when models undergo routine adaptation (e.g., fine-tuning, compression) or when adversaries attempt removal/forgery. A central direction is to formalise robustness over explicit transformation suites T = Tbenign ∪ Tadv and develop transformation-invariant identity signals and decision rules that remain valid under post-release drift, not merely in the original parameterisation. Lifecycle robustness also needs multi-stage transfer-learning evaluation: recent secure-transfer-learning work shows that backdoor risks can arise from both pre-trained encoders and downstream datasets, suggesting that identity mechanisms should be tested across adaptation pipelines rather than only after isolated fine-tuning Zhang et al. [2025]. Geometryinspired defences, such as submanifold-aware backdoor detection, further suggest a possible direction for analysing whether trigger-response identity signals remain separable from benign behaviours in hidden representation spaces Le et al. [2025]. Deployable verification with guarantees and shared benchmarks. Practical adoption is limited by verification cost (query volume, latency, compute) and by the lack of rigorous security statements. Future work should pursue sample-efficient, auditable verification and align claims with verification semantics: non-keyed attribution as calibrated statistical evidence, keyed verification with explicit notions such as unforgeability and non-removability. Community progress also requires standardised, cross-asset benchmarks that fix interfaces, stressors, and reporting (identifiability, robustness coverage, ∆U , and verification cost) to enable credible cross-paper comparison.

6

Conclusions

LLM identity is best understood as verification under distribution shift induced by benign adaptation and adaptive attacks. Our framing makes identity claims comparable across datasets, models, and generated content, and highlights the metrics that matter for deployment: robustness coverage, verification cost, and utility impact. We hope this helps the community converge on reproducible benchmarks and practically defensible identity mechanisms.

Acknowledgements The authors would like to thank all the anonymous reviewers and chairs for their constructive comments. This work was supported by the National Natural Science Foundation of China (62572382, 62506292, U22A2098), China Postdoctoral Science Foundation (2024M762604 and BX20250380) Postdoctoral Fellowship Program (2024M762604 and BX20250380), This work described in this paper was supported by the National Natural Science Founda- 798 tion of China (62202369, 62572382, 62506292), Postdoctoral Fellowship Program (2024M762604), and 799 the XJTU Research Fund for AI Science (2025YXYC004, GZB20240605), and was partially supported 800 by the Shenzhen Loop Area Institute.

References Wissam Antoun, Benoı̂t Sagot, and Djamé Seddah. From text to source: Results in detecting large language modelgenerated content. arXiv preprint arXiv:2309.13322, 2023. Yehonatan Bitton, Elad Bitton, and Shai Nisan. Detecting stylistic fingerprints of large language models. arXiv preprint arXiv:2503.01659, 2025. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21), pages 2633–2650, 2021. Jialuo Chen, Jingyi Wang, Tinglan Peng, Youcheng Sun, Peng Cheng, Shouling Ji, Xingjun Ma, Bo Li, and Dawn Song. Copy, right? a testing framework for copyright protection of deep learning models. In 2022 IEEE symposium on security and privacy (SP), pages 824–841. IEEE, 2022. Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory, pages 1125–1139. PMLR, 2024. Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, et al. Scalable watermarking for identifying large language model outputs. Nature, 634(8035):818–823, 2024. Linkang Du, Xuanru Zhou, Min Chen, Chusong Zhang, Zhou Su, Peng Cheng, Jiming Chen, and Zhikun Zhang. Sok: Dataset copyright auditing in machine learning systems. In 2025 IEEE Symposium on Security and Privacy (SP), pages 1–19. IEEE, 2025. Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. On the learnability of watermarks for language models. arXiv preprint arXiv:2312.04469, 2023. Martin Gubri, Dennis Ulmer, Hwaran Lee, Sangdoo Yun, and Seong Joon Oh. Trap: Targeted random adversarial prompt honeypot for black-box identification. arXiv preprint arXiv:2402.12991, 2024.

Xin He, Junxi Shen, Zhenheng Tang, Xiaowen Chu, Bo Li, Ivor W Tsang, and Yew-Soon Ong. Routemark: A fingerprint for intellectual property attribution in routing-based model merging. arXiv preprint arXiv:2508.01784, 2025. Abe Hou, Jingyu Zhang, Tianxing He, Yichen Wang, YungSung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. Semstamp: A semantic watermark with paraphrastic robustness for text generation. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 4067–4082, 2024. Abe Hou, Jingyu Zhang, Yichen Wang, Daniel Khashabi, and Tianxing He. k-semstamp: A clustering-based semantic watermark for detection of machine-generated text. In Findings of the Association for Computational Linguistics: ACL 2024, pages 1706–1715, 2024. Linshan Hou, Zhongyun Hua, Wei Luo, and Leo Yu Zhang. Fixguard: Repairing backdoored models via class-wise trigger recovery and unlearning. IEEE Signal Processing Letters, 32:2544–2548, 2025. Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. arXiv preprint arXiv:2310.10669, 2023. Zonghao Huang, Neil Zhenqiang Gong, and Michael K Reiter. A general framework for data-use auditing of ml models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1300–1314, 2024. Dmitri Iourovitski, Sanat Sharma, and Rakshak Talwar. Hide and seek: Fingerprinting large language models with evolutionary learning. arXiv preprint arXiv:2408.02871, 2024. Heng Jin, Chaoyu Zhang, Shanghao Shi, Wenjing Lou, and Y Thomas Hou. Proflingo: A fingerprinting-based intellectual property protection scheme for large language models. In 2024 IEEE Conference on Communications and Network Security (CNS), pages 1–9. IEEE, 2024. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061–17084. PMLR, 2023. Nam Le, Leo Yu Zhang, Kewen Liao, Shirui Pan, and Wei Luo. TED++: Submanifold-aware backdoor detection via layerwise tubular-neighbourhood screening. arXiv preprint arXiv:2510.14299, 2025. Shuai Li, Kejiang Chen, Jun Jiang, Jie Zhang, Qiyi Yao, Kai Zeng, Weiming Zhang, and Nenghai Yu. Editmark: Watermarking large language models based on model editing. arXiv preprint arXiv:2510.16367, 2025. Yanming Li, Seifeddine Ghozzi, Cédric Eichler, Nicolas Anciaux, Alexandra Bensamoun, and Lorena Gonzalez Manzano. Data provenance auditing of fine-tuned large language models with a text-preserving technique. arXiv preprint arXiv:2510.09655, 2025.

Yuqing Liang, Jiancheng Xiao, Wensheng Gan, and Philip S Yu. Watermarking techniques for large language models: A survey. Artificial Intelligence Review, 59(2):74, 2026. Zilong Lin, Jian Cui, Xiaojing Liao, and XiaoFeng Wang. Malla: Demystifying real-world large language model integrated malicious services. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4693–4710, 2024. Gaoyang Liu, Tianlong Xu, Xiaoqiang Ma, and Chen Wang. Your model trains on my data? protecting intellectual property of training data via membership fingerprint authentication. IEEE Transactions on Information Forensics and Security, 17:1024–1037, 2022. Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models. ACM Computing Surveys, 57(2):1–36, 2024. Pratyush Maini, Mohammad Yaghini, and Nicolas Papernot. Dataset inference: Ownership resolution in machine learning. In International Conference on Learning Representations, 2021. Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. Llm dataset inference: Did you train on my dataset? Advances in Neural Information Processing Systems, 37:124069–124092, 2024. Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schölkopf, Mrinmaya Sachan, and Taylor BergKirkpatrick. Membership inference attacks against language models via neighbourhood comparison. arXiv preprint arXiv:2305.18462, 2023. Weichuan Mo, Kongyang Chen, and Yatie Xiao. Tibw: Taskindependent backdoor watermarking with fine-tuning resilience for pre-trained language models. Mathematics (2227-7390), 13(2), 2025. MZ Naser. Auditing the shadows: A review of methods to detect shared training data in large language models. ACM Computing Surveys, 58(7):1–34, 2025. Anshul Nasery, Jonathan Hayase, Creston Brooks, Peiyao Sheng, Himanshu Tyagi, Pramod Viswanath, and Sewoong Oh. Scalable fingerprinting of large language models. arXiv preprint arXiv:2502.07760, 2025. Dario Pasquini, Evgenios M Kornaropoulos, and Giuseppe Ateniese. Llmmap: Fingerprinting for large language models. arXiv preprint arXiv:2407.15847, 2024. Zhenzhen Ren, Guobiao Li, Sheng Li, Zhenxing Qian, and Xinpeng Zhang. Cotsrf: Utilize chain of thought as stealthy and robust fingerprint of large language models. ArXiv, abs/2505.16785, 2025. Mark Russinovich and Ahmed Salem. Hey, that’s my model! introducing chain & hash, an llm fingerprinting technique. arXiv preprint arXiv:2407.10887, 2024. Shuo Shao, Yiming Li, Hongwei Yao, Yifei Chen, Yuchen Yang, and Zhan Qin. Reading between the lines: Towards reliable black-box llm fingerprinting via zeroth-order gradient estimation. arXiv preprint arXiv:2510.06605, 2025.

Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. arXiv preprint arXiv:2310.16789, 2023. Mingjie Sun, Yida Yin, Zhiqiu Xu, J Zico Kolter, and Zhuang Liu. Idiosyncrasies in large language models. arXiv preprint arXiv:2502.12150, 2025. Ruining Sun, Hongsheng Hu, Wei Luo, Zhaoxi Zhang, Yanjun Zhang, Haizhuan Yuan, and Leo Yu Zhang. When better features mean greater risks: The performanceprivacy trade-off in contrastive learning. arXiv preprint arXiv:2506.05743, 2025. Teppei Suzuki, Ryokan Ri, and Sho Takase. Natural fingerprints of large language models. arXiv preprint arXiv:2504.14871, 2025. Shida Wang, Chaohu Liu, Yubo Wang, and Linli Xu. Fpedit: Robust llm fingerprinting through localized knowledge editing. arXiv preprint arXiv:2508.02092, 2025. Xuhong Wang, Haoyu Jiang, Yi Yu, Jingru Yu, Yilun Lin, Ping Yi, Yingchun Wang, Yu Qiao, Li Li, and Fei-Yue Wang. Building intelligence identification system via large language model watermarking: a survey and beyond. Artificial Intelligence Review, 58(8):249, 2025. Zehao Wu, Yanjie Zhao, and Haoyu Wang. Gradient-based model fingerprinting for LLM similarity detection and family classification, 2025. Jiashu Xu, Fei Wang, Mingyu Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. Instructional fingerprinting of large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 3277–3306, 2024. Xiaojun Xu, Yuanshun Yao, and Yang Liu. Learning to watermark llm-generated text via reinforcement learning. arXiv preprint arXiv:2403.10553, 2024. Zhenhua Xu, Wenpeng Xing, Zhebo Wang, Chang Hu, Chen Jie, and Meng Han. Fp-vec: Fingerprinting large language models via efficient vector addition. arXiv preprint arXiv:2409.08846, 2024. Yijie Xu, Aiwei Liu, Xuming Hu, Lijie Wen, and Hui Xiong. Mark your llm: Detecting the misuse of open-source large language models via watermarking. arXiv preprint arXiv:2503.04636, 2025. Zhenhua Xu, Zhebo Wang, Maike Li, Wenpeng Xing, Chunqiang Hu, Chen Zhi, and Meng Han. Rap-sm: Robust adversarial prompt via shadow models for copyright verification of large language models. arXiv preprint arXiv:2505.06304, 2025. Zhenhua Xu, Xubin Yue, Zhebo Wang, Qichen Liu, Xixiang Zhao, Jingxuan Zhang, Wenjun Zeng, Wengpeng Xing, Dezhang Kong, Changting Lin, et al. Copyright protection for large language models: A survey of methods, challenges, and trends. arXiv preprint arXiv:2508.11548, 2025.

Yuliang Yan, Haochun Tang, Shuo Yan, and Enyan Dai. Duffin: A dual-level fingerprinting framework for llms ip protection. ArXiv, abs/2505.16530, 2025. Peigen Ye, Huali Ren, Zhengdao Li, Anli Yan, Hongyang Yan, Shaowei Wang, and Jin Li. Securing large language models: A survey of watermarking and fingerprinting techniques. ACM Computing Surveys, 2025. Do-hyeon Yoon, Minsoo Chun, Thomas Allen, Hans Müller, Min Wang, and Rajesh Sharma. Intrinsic fingerprint of llms: Continue training is not all you need to steal a model! arXiv preprint arXiv:2507.03014, 2025. Boyi Zeng, Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu Yu, and Zhouhan Lin. Huref: Human-readable fingerprint for large language models. Advances in Neural Information Processing Systems, 37:126332–126362, 2024. Boyi Zeng, Lin Chen, Ziwei He, Xinbing Wang, and Zhouhan Lin. Awm: Accurate weight-matrix fingerprint for large language models. arXiv preprint arXiv:2510.06738, 2025. Jie Zhang, Jiayuan Li, Haiqiang Fei, Lun Li, and Hongsong Zhu. Easydetector: Using linear probe to detect the provenance of large language models. In 2024 IEEE 23rd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pages 2410– 2417. IEEE, 2024. Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. Reef: Representation encoding fingerprints for large language models. arXiv preprint arXiv:2410.14273, 2024. Yechao Zhang, Yuxuan Zhou, Tianyu Li, Minghui Li, Shengshan Hu, Wei Luo, and Leo Yu Zhang. Secure transfer learning: Training clean model against backdoor in pretrained encoder and downstream dataset. In 2025 IEEE Symposium on Security and Privacy (SP), pages 1–19, 2025. 1 https://en.wikipedia.org/wiki/GPT-4 2 https://huggingface.co/miqudev/miqu-1-70b 3 https://www.copyright.gov/docs/zarya-of-the-dawn.pdf 4 https://www.mps.gov.cn/n6557558/c8797736/content.html 5 https://artificialintelligenceact.eu/article/50/ 6 https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml? bill id=202320240SB942 7 Note: [1] [Maini et al., 2024]; [2] [Maini et al., 2021]; [3] [Zeng et al., 2024]; [4] [Zhang et al., 2024b]; [5] [Gubri et al., 2024]; [6] [Xu et al., 2024a]; [7] [Li et al., 2025a]; [8] [Sun et al., 2025a]; [9] [Kirchenbauer et al., 2023]; [10] [Christ et al., 2024]