Pro Free
Your “Pro” LLM Subscription May Actually Be “Free”: Exposing Fingerprint Spoofing Risks in LLM Inference Services Jiahao Zhang* , Xiuyu Li* , Suhang Wang The Pennsylvania State University, USA [email protected], [email protected], [email protected]
arXiv:2606.16100v1 [cs.CR] 15 Jun 2026
Abstract
2026), personalized chat-bots (Jiang et al., 2025a,b; Huang et al., 2026), multi-modal reasoning (Zhang et al., 2025d; Wu et al., 2026b; Fang et al., 2026)) and acting as essential infrastructure for academic evaluation (Chiang et al., 2024; Qin et al., 2024). Given the foundational role of these API services, ensuring the integrity of the served models has become a pressing necessity (Cai et al., 2025b; Velasco et al., 2025; Zhang et al., 2026b,c). From a user’s perspective, a practical approach to audit whether LLM APIs are serving the advertised model relies on LLM fingerprinting (i.e., model auditing) methods (Gao et al., 2025b; Gubri et al., 2024; Sun et al., 2025c; Pasquini et al., 2025). The key aim of these methods is to probe a black-box API with a small number of queries and efficiently analyze the responses to verify the model’s identity. This relies on the common assumption that distinct response styles to specific prompts are sufficient to classify models (Pasquini et al., 2025; Sun et al., 2025c), making fingerprinting a trustworthy tool. However, fingerprinting inherently assumes that the models remain static and are not adversarially manipulated by API providers, which might not hold in practice. For instance, an inference provider serving open-source models might adversarially fine-tune a weak model to closely mimic the fingerprint of a stronger one, bypassing user audits, for profit gain (see Figure 1). Similarly, companies hosting proprietary models (e.g., OpenAI, Google) could stealthily serve fine-tuned, weaker variants to reduce operational costs while evading detection. If these fine-tuning processes are computationally efficient and financially profitable, they pose a critical risk to API users. Therefore, we challenge the adversarial reliability of existing LLM fingerprinting methods and study a novel and fundamental research question:
As Large Language Model (LLM) APIs become ubiquitous, users increasingly rely on black-box fingerprinting to verify that providers are serving the advertised premium models. However, these methods may overlook adversarial providers who manipulate model weights to cheat the fingerprint process. We introduce a novel threat termed fingerprint spoofing, where a malicious provider stealthily serves a weaker model that has been parameter-efficiently fine-tuned to mimic a stronger model, thereby evading user-side fingerprinting. We first formally prove that userside resource constraints (i.e., finite query budgets and weak fingerprinting classifiers) make current fingerprinting vulnerable to fingerprint spoofing. Guided by this theoretical analysis, we propose GhostPrint, a cost-effective attack framework leveraging surrogate modeling, reward-ranked fine-tuning, and knowledge distillation. Extensive evaluations in both static and continual fingerprinting settings demonstrate that GhostPrint allows weak models to consistently bypass representative fingerprint methods while maintaining utility at a low finetuning cost, exposing a critical vulnerability in current LLM fingerprinting pipelines.
1
Introduction
LLMs have shown great ability on various tasks. A growing number of third-party providers offer API-based inference services for LLMs, such as OpenRouter1 and other Model-as-a-Service providers (Liang et al., 2023; Gao et al., 2025b; Chen et al., 2024). These platforms serve a dual role: providing foundational architecture for downstream applications (e.g., coding agents (Yao et al., 2023; Shinn et al., 2023; Ning et al., 2026), retrieval-augmented generation (Fan et al., 2025; Liu et al., 2026; Yang et al., 2026; Nguyen et al.,
Can a malicious model provider parameterefficiently fine-tune a weak model so that the weak
* Equal contribution. 1
https://openrouter.ai/
1
Actual Response (Low-Quality)
where the adapted weak model maintains acceptable performance on normal downstream tasks; and (iii) economic gain, where the attack only relies on inexpensive parameter-efficient fine-tuning (PEFT) mechanisms. To understand why spoofing remains feasible under the three goals, we theoretically analyze the vulnerabilities of current fingerprint pipelines. Constrained by user-side resources, users often rely on limited query sets (Gubri et al., 2024; Pasquini et al., 2025) and weak verification mechanisms (Sun et al., 2025c; Gao et al., 2025b). Consequently, an attacker will not need to emulate the strong model universally, and a localized, parameter-efficient adaptation suffices to fool the user-side audit. We formalize these limitations in Theorem 5.2 (finite query budgets) and Theorem 5.3 (weak local classifiers). Guided by these theoretical weaknesses, we propose a novel attack framework, namely GhostPrint, to overcome the utility-spoofing trade-off. Specifically, the attacker trains a surrogate fingerprint model and employs reward-ranked fine-tuning to identify queries where the weak model can naturally mimic the larger model. We then leverage LoRA-based supervised fine-tuning (SFT) alongside knowledge distillation (KD) to align the weak model with the strong model, specifically on the targeted fingerprint queries, effectively bypassing the audit while preserving general utility. Furthermore, recognizing that user-side fingerprints evolve over time, we extend our framework to a continual spoofing setting, exploring whether an attacker can dynamically adapt to new fingerprint queries and auditing methods. We empirically validate this attack framework in both static and continual settings, exposing the practical risks posed by fingerprint spoofing. Our core contributions are: (i) Theoretical Vulnerability Analysis: We formally demonstrate when and why fingerprint spoofing is possible, proving that user-side resource constraints (i.e., weak query sets and weak surrogate models) make existing auditing methods fundamentally breakable (Theorem 5.2 and 5.3); (ii) Fingerprint Spoofing Framework: We propose a novel, practical attack that can successfully bypass static fingerprinting while maintaining task utility; and (iii) Continual Spoofing Evaluation: We extend our attack to dynamic environments, demonstrating that malicious providers can continually adapt to evolving user-side fingerprinting methods, highlighting a persistent threat to LLM API integrity.
Who is Adam??
Query With an Adam optimizer, we ...
Secretly Uses
Overpay User
API Provider Claims
Tuned Weak LLM
Good choice. The step size ...
High-Quality Response
Strong LLM Advertised But Never Used
Figure 1: The economic motivation of LLM API spoofing. To maximize profit, a malicious provider secretly serves a tuned weak LLM instead of the advertised strong model. If the provider successfully spoofs the user’s fingerprint audit, the user is deceived into overpaying for lower-quality responses.
model behaves like a stronger model to bypass user-side fingerprinting tests? To answer this question, we formalize a threat model named fingerprint spoofing, where API service providers actively seek to bypass userside model auditing (Figure 2(a)). In this setting, the provider advertises a strong LLM to charge a premium rate, but actually serves a parameterefficient (Hu et al., 2022; Dettmers et al., 2023; Liu et al., 2024) fine-tuned weak LLM to evade fingerprint checks. Successfully executing such an attack is highly non-trivial and presents severe technical challenges. Fundamentally, based on LLM scaling laws (Kaplan et al., 2020; Hoffmann et al., 2022; Sardana et al., 2024) and our lower-bound analysis (Proposition 5.1), a small model inherently lacks the representational capacity to perfectly mimic the behavior of a much larger model. Consequently, the attacker faces a severe optimization trade-off: aggressively fine-tuning a weak model to mimic a strong model’s fingerprint behavior may lead to catastrophic forgetting (Li et al., 2024; Luo et al., 2025), destroying its ability to answer normal user queries. Furthermore, mimicking a large model with a small model must be achieved under resource constraints, since full-parameter retraining is often expensive and would make the adversary’s attack financially infeasible. Formalizing these technical challenges, our goal is to study whether a malicious provider can successfully resolve this trade-off to simultaneously achieve three conflicting objectives: (i) fingerprint spoofing, where the adapted model becomes behaviorally indistinguishable from the claimed strong model under auditing; (ii) utility preservation, 2
2
Related Works
where ri ∼ fapi (· | q i ) and q i ∈ Qn . 3. Verification: The mechanism g maps the collected responses to a binary decision g(Rn , ftarget ) ∈ {0, 1}, returning 1 if the API is verified as ftarget , and 0 otherwise.
LLM Fingerprinting. Pay-per-use APIs create incentives for providers to silently substitute weaker models (Cai et al., 2025b; Zhang et al., 2026b). Fingerprinting addresses this by verifying model identity. Existing methods fall into three categories: white-box non-intrusive approaches that inspect internal signals (Zheng et al., 2022; Wu et al., 2025; Zhang et al., 2025b, 2026a), blackbox non-intrusive approaches that analyze API outputs (Gao et al., 2025b; Sun et al., 2025c; Pasquini et al., 2025; Gubri et al., 2024), and intrusive methods that embed verifiable signatures during training (Gu et al., 2022; Li et al., 2023; Xu et al., 2024; Yamabe et al., 2025). Further discussion is provided in Appendix C. Attacks Against LLM Fingerprinting. Adversarial robustness of fingerprinting is an emerging concern. Prior attacks use rewriting or statistical evasion but assume no fine-tuning of the weak model and rely on distinguishing query distributions (Kurian et al., 2025; Nasery et al., 2025a). In contrast, we consider a provider that actively finetunes a weak model to spoof fingerprints, a realistic threat that undermines distribution-agnostic auditors like LLM-idio (Sun et al., 2025c) and Model Equality Testing (MET) (Gao et al., 2025b).
3
The above definition naturally encapsulates existing representative black-box fingerprinting methods, which differ mainly in their formulation of the query distribution Dq and the verification mechanism g. For instance, LLMmap (Pasquini et al., 2025) restricts Dq to a small set of carefully crafted, identity-revealing probes and trains g as a multiclass embedding classifier. MET (Gao et al., 2025b) uses a general Dq but formulates g as a statistical two-sample kernel test (Maximum Mean Discrepancy) that computes the distance between Rn and reference generations, thresholding the p-value to yield a binary decision. Practical Constraints of Fingerprinting. In practice, the query budget n in Definition 3.1 enforces a trade-off between auditing accuracy and financial cost, as users must pay for every API call. A larger n is more accurate but result in higher cost. Furthermore, user-side resource constraints typically restrict the verification mechanism g to lightweight statistical tests (Gao et al., 2025b; Zhu et al., 2026) or weak surrogate models (Pasquini et al., 2025; Sun et al., 2025c) rather than state-of-the-art LLMs. Why Black-box Fingerprinting? We focus on black-box fingerprinting, where the auditor only has query access, because this mirrors the reality of commercial LLM APIs. End users cannot inspect internal model states or intervene in the provider’s training pipeline. For proprietary models like GPT-4o, the query-response interface is the sole accessible surface, making black-box methods the only practical tool for user-side verification.
Preliminaries
Notations. We use ∥W∥F and ∥W∥2 to denote the matrix Frobenius and ℓ2 norms, and use ∥x∥2 to denote the vector ℓ2 norm. We treat an LLM as a conditional probability distribution over token sequences. Given an LLM f parameterized by θ and a prompt q, a response r is sampled as r ∼ f (· | q; θ). When the parameters are fixed, we write r ∼ f (· | q) for notation simplicity. Black-Box LLM Fingerprinting. The goal of black-box fingerprinting is to audit an LLM API, denoted as fapi , to determine whether it actually serves a specific claimed target model, ftarget . The auditing procedure is formalized below.
4
Problem Formulation
4.1
Threat Model
We study a malicious third-party API provider (i.e., the adversary) that claims to serve a strong target model ftarget , but in reality deploys a weaker and cheaper model architecture fweak , initially parameterized by θ weak . The adversary aims to adapt these parameters into deceptive parameters θ adv such that the auditor’s local mechanism g incorrectly verifies the adapted model’s distribution fweak (· | ·; θ adv ) as ftarget . Attacker’s Capabilities. We assume the attacker has the following capabilities:
Definition 3.1 (Black-Box LLM Fingerprinting). Let the user/auditor have a query distribution Dq , a query budget n, and a local classification mechanism g. The fingerprinting procedure is: 1. Query Sampling: The auditor samples a query set Qn := {q i }ni=1 , where q i ∼ Dq . 2. Response Collection: The auditor queries the API and collects the responses Rn := {ri }ni=1 , 3
it as the target model over the distribution Dq . 2. Utility Preservation: The adapted model fweak (· | ·; θ adv ) must maintain general model utility comparable to the initial weak model fweak (· | ·; θ weak ), ensuring the API remains functional for benign user requests. 3. Economic Gain: The adversary’s fine-tuning process to obtain θ adv must be economically viable. Specifically, the adapted parameters are obtained via Parameter-Efficient FineTuning (PEFT), i.e., θ adv = θ weak + ∆θ, where ∆θ is a small low-rank update.
• Knowledge of the fingerprinting mechanism: The attacker has full knowledge of the auditor’s local classification mechanism g (e.g., feature extractor, distance metric, etc.) and can build a surrogate g that mimics the auditor’s g. • Knowledge of the query distribution: The attacker knows the distribution Dq from which the auditor draws queries. This allows the attacker m to sample a surrogate query set Q := {q i }m i=1 , where q i ∼ Dq . Importantly, the attacker does not know the exact finite query set Qn instantiated by the auditor during the verification. • White-box manipulation of the weak model: The attacker has full access to the deployed architecture fweak and can tune its parameters via parameter-efficient fine-tuning (PEFT). Attacker’s Goal. The attacker aims to simultaneously achieve: (i) Fingerprint spoofing: Under the fingerprinting mechanism (Definition 3.1), the auditor’s local mechanism g incorrectly verifies fweak (· | ·; θ adv ) as ftarget ; (ii) Utility preservation: After adaptation, the served model fweak (· | ·; θ adv ) still maintains acceptable normal-task performance; and (iii) Economic gain: The process to obtain θ adv is cost-effective. Practicality of Threat Model. Assuming the adversary knows both the query distribution Dq and the classifier g aligns with adaptive-attacker evaluations rooted in Kerckhoffs’s principle. For an audit to be credible and independently verifiable, its methodology, classification algorithm g, and query set Dq must be transparent and publicly disclosed. Relying on secrecy of the auditing pipeline constitutes security by obscurity, so a fully informed attacker model is necessary. 4.2
5
Proposed Method
In this section, we first present a theoretical study on fundamental limits of LLM fingerprinting, and then present our proposed attack framework. An illustration of our framework is in Figure 2. 5.1
When and Why Could Fingerprint Spoofing Happen?
As shown in Section 4.1, fingerprint spoofing requires balancing three conflicting goals: fingerprint spoofing, utility preservation, and computational efficiency. To design a successful attack, it is critical to first establish a theoretical understanding of when and why fingerprint spoofing is feasible. Impossibility of Universal Spoofing. Fundamentally, small models lack the representational capacity of large models due to established scaling laws (Kaplan et al., 2020; Hoffmann et al., 2022; Sardana et al., 2024). To formally capture this, we analyze a single high-rank weight transformation W (e.g., an FFN or attention projection matrix) (Vaswani et al., 2017) in a target large model ftarget , and its corresponding lower-rank counterpart W′ in the weak model fweak 2 . The following proposition demonstrates that if an auditor has sufficient resources, spoofing via parameter-efficient fine-tuning (PEFT) is mathematically impossible.
Fingerprint Spoofing
Based on the threat model described in Section 4.1, we now formalize our attacker goals into a general problem definition.
Proposition 5.1 (Lower Bound of Universal Spoofing). Let W, W′ ∈ Rd1 ×d2 be two weight matrices, where W has rank k1 and W′ has rank k2 , with k1 > k2 . Let the low-rank adaptation (LoRA) matrices be A ∈ Rd1 ×r and B ∈ Rr×d2 , where r < k1 − k2 . Define the adapted weight
Definition 4.1 (Fingerprint Spoofing Problem). Given a white-box weak model architecture fweak initially parameterized by θ weak , access to a target model ftarget , and knowledge of the auditor’s query distribution Dq and verification mechanism g, the fingerprint spoofing problem seeks to efficiently find adapted parameters θ adv for the weak model to achieve three primary objectives: 1. Fingerprint Spoofing: The adapted model fweak (· | ·; θ adv ) must generate responses that fool the auditor’s mechanism g into identifying
2
In practice, weak models may use smaller hidden dimen′ sions (d′1 < d1 ) with weights V ∈ Rd1 ×d2 . Our setting, ′ where W and W share identical dimensions but differ in rank, naturally captures this reality. By letting W′ = PV, ′ where P ∈ Rd1 ×d1 is an up-projection, the rank of W′ is ′ bottlenecked by d1 , ensuring it has a lower rank than W.
4
(a) Threat Model
(b) Proposed Framework
Fingerprint Spoofing
Queries Mimic Strong LLM
Sample
Weak LLM
API Provider
Query
Phase 1 Data
Fingerprinting
Verification result
Phase 2 Data Mechanism
Weak LLM
SFT Loss KD Loss
LoRA
Query ... ...
Surr. Mechanism
Responses
Compute
+
Select User
2. PEFT
Query ... ...
Distribution
Query
1. Training Data
Fingerprint 1 ... ...
...
Fingerprint
Routing
3. Continual Learning
Figure 2: Overview of GhostPrint. (a) Threat model. An adversary leverages a weak LLM to mimic a strong target model and evade fingerprint-based verification when interacting with an API provider. (b) Proposed framework. GhostPrint constructs training data from both target-model and surrogate queries, then fine-tunes a weak LLM via SFT and KD, and enables continual learning to progressively adapt the adversarial fingerprint over time.
Theorem 5.2 (Upper Bound under Low-Effective-Rank Distributions). Let x ∈ Rd2 be the representation of a query drawn from a zeromean continuous distribution Dq , and let Σ := Ex∼Dq [xx⊤ ] be the covariance matrix. Let λ1 ≥ λ2 ≥ · · · ≥ λd2 ≥ 0 denote the eigenvalues of Σ. Let the LoRA matrices be A ∈ Rd1 ×r and B ∈ Rr×d2 , and the adapted weight matrix be c := W′ + AB. The optimal expected spoofing W error is bounded by the following equation:
c := W′ + AB and the residual mamatrix as W trix as R := W − W′ . For any input vector x ∈ Rd2 , the following lower bounds hold: 1. Spectral Norm: c 2 ≥ σ + (R), inf sup ∥Wx − Wx∥ min
A,B ∥x∥2 =1
2. Frobenius Norm: c 2 ≥ (k1 − k2 − r) · σ + (R)2 , inf ∥W − W∥ F min
A,B
d2 X c 22 ≤ ∥R∥22 inf Ex∼Dq ∥Wx − Wx∥ λi ,
A,B
+ where σmin (R) denotes the smallest non-zero singular value of R. The rank condition k2 < k1 reflects the scale gap between weak and strong models, and the bound on r captures practical PEFT constraints. Proposition 5.1 shows universal spoofing error is strictly positive, motivating us to exploit specific weaknesses of real auditors. In practice, users have finite query budgets and weak classifiers, introducing vulnerabilities that make successful spoofing achievable despite the theoretical lower bound. Vulnerabilities of LLM Fingerprinting. Despite the theoretical impossibility of universal spoofing, users cannot expend infinite resources to audit an LLM API in practice. They cannot utilize infinite queries, nor can they always deploy the strongest classifiers to verify responses. These practical constraints create critical vulnerabilities and establish theoretical upper bounds for successful spoofing. First, existing auditing methods often rely on a small, simple set of queries. For example, LLMmap (Pasquini et al., 2025) uses queries like “Which model is this?” with specific prefixes for auditing. When the input space is sufficiently simple and structured, we can establish the following upper bound based on query distribution simplicity.
i=r+1
where R := W − W′ is the residual matrix. The theorem shows that when the query distribution Dq is simple (small effective rank), the expected spoofing error can be substantially minimized. This matches LLMmap, where queries concentrate in specific semantic directions, revealing the first vulnerability of current auditing methods. Second, due to training costs, auditors often rely on weak classifiers. For example, LLMmap (Pasquini et al., 2025) and LLM-idio (Sun et al., 2025c) use small LLM-based classifiers. To analyze this, we consider a projection weight matrix C from g’s transformer and test whether outputs Wx and (W′ + AB)x become indistinguishable under C. Theorem 5.3 (Tight Bound under Weak Classifiers). Let C ∈ Rd1 ×d1 be a weight matrix from the auditor’s verification model, and let W, W′ ∈ Rd1 ×d2 be the weight matrices of the strong target model and the weak surrogate model, respectively. Let the LoRA matrices be A ∈ Rd1 ×r and B ∈ Rr×d2 , and the adapted c := W′ + AB. Under the weight matrix be W 5
audit, the worst-case spoofing error is exactly: inf
The total objective is
⊤ c sup ∥C⊤ (Wx − Wx)∥ 2 = σr+1 (C R),
min Ltotal := LSFT (θ adv ) + αLKD (θ adv ), (1)
A,B ∥x∥ =1
θ adv
2
where R = W − W′ is the residual matrix, and σr+1 (·) is the (r + 1)-th largest singular value.
where α > 0 is a hyperparameter balancing fingerprint deception and utility. Exploiting the Fingerprint Mechanism g. After If the auditor utilizes a simple classifier with ⊤ optimizing (1), the weak model mimics the target rank c ≤ r, then σr+1 (C R) = 0. This shows that when the user-side fingerprint model g is suffi- on the query distribution Dq . However, when Dq comprises diverse, general-purpose queries (e.g., ciently weak, the adversary can ideally use PEFT UltraChat (Ding et al., 2023)), standard SFT alone to perfectly fool the fingerprint with zero error. Takeaway. Our analysis reveals a critical mis- may fail to capture the subtle model-specific fingerprints required by auditors such as LLM-idio (Sun alignment: perfect spoofing is globally impossible (Proposition 5.1), yet it is locally trivial under real- et al., 2025c) and MET (Gao et al., 2025b). To address this, we directly exploit the structural weakistic auditing constraints (Theorems 5.2 and 5.3). ness of the verification model g by incorporating 5.2 The Proposed GhostPrint Attack its supervisory signal into the fine-tuning process. Directly using g is precluded under the As shown in Section 5.1, practical LLM fingerprinting pipelines suffer from two fundamental vulnera- black-box threat model (Section 4.1). Even if acbilities: (i) low-complexity query distributions Dq , cessible, employing it as a reward model for reand (ii) the reliance on computationally weak ver- inforcement learning (RL) (Guo et al., 2025; Li et al., 2026a,b; Luo et al., 2026) would be proification models g. A potent fingerprint spoofing attack must actively exploit both vulnerabilities si- hibitively expensive and unstable, violating the multaneously. To this end, we propose GhostPrint, attacker’s economic constraints. We instead cona principled attack framework that leverages Super- struct a local surrogate g from the known query vised Fine-Tuning (SFT) and Knowledge Distilla- distribution Dq , which can be a lightweight classifier (for LLMmap, LLM-idio) or a reproduced tion (KD) to efficiently memorize the behavioral statistical metric (for MET). To leverage g withcharacteristics of the target model over Dq while preserving normal utility. Furthermore, we incor- out RL, we adopt RAFT (Dong et al., 2023) as an porate a Ranked Fine-Tuning (RAFT) (Dong et al., additional post-training phase. Specifically, for each query q ∼ Dq , we sam2023) mechanism, utilizing a surrogate fingerprint ple K candidate responses from the current weak model g to filter and select weak model outputs that model, rank them with g, and select the most decepmatch the strong model’s fingerprint. To satisfy the tive one as radv := arg maxrj g(rj , ftarget ). The attacker’s economic constraints, all optimizations resulting (q, radv ) pairs are then used to fine-tune are conducted parameter-efficiently. Exploiting the Query Distribution Dq . We em- the adapter parameters θ adv with the same SFT and KD objectives defined in (1). This approach ploy Supervised Fine-Tuning (SFT) to force the weak model to mimic the target model’s fingerprint- filters the weak model’s natural generation space to isolate responses that already cross the surroing behavior. For a fingerprint query q ∼ Dq and gate’s decision boundaries. By fine-tuning on these the target response r generated by ftarget , the SFT selected examples, the model leverages the signal objective minimizes the negative log-likelihood: X from the target weak classifier g, while avoiding |r| LSFT (θ adv ) := −Eq,r log fweak (rt | q, r<t ; θ adv ) . the unstable and costly use of RL. t=1 Parameter-Efficient Fine-Tuning. To address the To preserve general capability without external economic gain goal shown in Section 4.1, we redata, we apply Knowledge Distillation (KD) on strict the attacker to apply Low-Rank Adaptation the same queries, using the target model as teacher: (LoRA) to the weak model rather than computaX tionally prohibitive full-parameter fine-tuning. |r| target weak LKD (θ adv ) := Eq,r DKL pt pt , Let the initial parameters of the weak architect=1 ture fweak be denoted as the set of N targeted base where ptarget and pweak are the next-token distri- weight matrices θ weak := {Wi′ }N t t i=1 . We formalize butions of the target and weak model, respectively. the deceptive parameter set θ adv by assigning each 6
c i as the sum of the frozen adapted weight matrix W base weight and a low-rank update: ci | W c i = W′ + Ai Bi }N , θ adv := {W i i=1
training data for this routing phase is a mixture (1) of queries from all tasks seen so far, i.e., Dq ∪ (2) (τ ) Dq · · · ∪ Dq . Because we only train the new adapter and a very small set of router weights (τ ) V(τ ) := {Vi }N i=1 , this continual learning process remains highly efficient.
(2)
where r < min(d1,i , d2,i ) is the adapter rank, and Ai ∈ Rd1,i ×r and Bi ∈ Rr×d2,i are the trainable LoRA matrices for the i-th target weight. By freezing θ weak and optimizing the set ∆θ := {(Ai , Bi )}N i=1 , the adversary transitions the generation distribution to fweak (· | ·; θ adv ) while reducing the computational cost of the attack. Continual Learning of Multiple Fingerprints. Our two-phase training bypasses a single fingerprint. However, auditors might continually deploy new methods. Thus, an adversary must spoof a sequence of verifiers g (τ ) with query distributions (τ ) Dq for τ = 1, . . . , T , updating fweak without catastrophic forgetting. For each task at continual learning step τ , we train a task-specific LoRA (τ ) (τ ) adapter ∆θ (τ ) := {(Ai , Bi )}N i=1 via our aforementioned process, then integrate adapters with a Mixture-of-LoRA-Experts (MoLA) (Gao et al., 2025a) architecture. It routes queries to relevant adapters, exploiting shared structure across fingerprinting mechanisms. Specifically, for the i-th target weight matrix at continual learning step τ , we introduce a trainable (τ ) router matrix Vi ∈ Rt×d2,i , where d2,i is the dimension of the intermediate hidden state x. The router computes a t-dimensional logit vector to assign a routing score si,m (x) for the m-th expert: exp(Vi x)m
(τ ) t j=1 exp(Vi x)j
.
(τ )
The adapted output hi for the i-th base weight matrix Wi′ and input x is then computed as a dynamically weighted combination of the historical LoRA experts as: (τ ) hi := Wi′ x +
τ X
(m)
si,m (x)Ai
(m)
Bi
Experiments
6.1
Experimental Settings
Models and Datasets. We instantiate our attack across three representative LLM families selected from the model list of LLMmap (Pasquini et al., 2025). Specifically, we utilize Gemma-1.1 (2B as the weak model and 7B as the strong target) (Team et al., 2024), Qwen2 (1.5B as weak and 7B as strong) (Yang et al., 2024), and Phi-3 (Mini 3.8B as weak and Medium 14B as strong) (Abdin et al., 2024). To quantify the preservation of general capabilities, model utility is evaluated on three standard benchmarks under a 5-shot setting using the open-source LM Evaluation Harness3 : MMLU (Hendrycks et al., 2020), GSM8K (Cobbe et al., 2021), and ARC-Challenge (ARC-C) (Clark et al., 2018). LLM Fingerprints. We evaluate against three representative black-box LLM fingerprints to audit LLM APIs: (i) LLMmap (Pasquini et al., 2025), a 52-class classifier driven by adversarial identity probes; (ii) LLM-idiosyncrasies (LLM-idio) (Sun et al., 2025c), a binary classifier trained on UltraChat (Ding et al., 2023) responses; and (iii) Model Equality Testing (MET) (Gao et al., 2025b), a twosample hypothesis test comparing completion distributions via MMD and Hamming distance. Spoofing Baselines. We compare against four baselines: (i) Query Detection, where we train a simple MLP to memorize historical fingerprint queries, routing flagged queries to the strong model and all others to the weak model; (ii) Rewriting (Kurian et al., 2025), which uses their proposed prompt to rewrite the generated response; (iii) 5-shot ICL, which extends the rewriting baseline by providing five strong-model responses as in-context examples; and (iv) Token Suppression (Nasery et al., 2025a), which applies their Suppress Top-K attack to randomize generation and mask the model’s standard behavioral patterns. For reference, we also report the unmodified baseline performance of both the base weak model and the target strong model.
(τ )
si,m (x) := P
6
x.
m=1
By freezing previous adapters ∆θ (<τ ) := {∆θ (1) , ∆θ (2) , . . . , ∆θ (τ −1) } and only training (t) the new adapter ∆θ (τ ) alongside the router Vi , GhostPrint continually expands its spoofing capabilities across multiple detection methods while strictly maintaining parameter efficiency. To train the router matrices, we reuse the same SFT and KD objectives defined in Eq. (1). The
3
https://github.com/EleutherAI/ lm-evaluation-harness
7
Utility
Method
ASR (%)
Setting
LLMmap LLM-idio MET
Gemma-1.1-2B → Gemma-1.1-7B Original (weak) Query Detection Rewriting 5-shot ICL Token Suppression GhostPrint (ours)
37.90 – – – – 38.11
10.69 – – – – 8.72
44.97 – – – – 44.54
12.0 35.0 20.0 15.0 28.0 95.0
7.2 7.2 0.7 22.9 4.5 58.5
6.7 13.3 0.0 3.3 0.0 23.3
Original (target)
58.70
49.58
56.83
92.0
98.8
100.0
Gemma-2B → Qwen2-7B
Qwen2-1.5B → Qwen2-7B Original (weak) Query Detection Rewriting 5-shot ICL Token Suppression GhostPrint (ours)
55.55 – – – – 55.36
55.42 – – – – 55.80
43.52 – – – – 44.97
4.0 70.0 40.0 0.0 6.0 76.0
7.4 7.4 34.2 64.4 4.9 71.3
33.3 40.0 33.3 30.0 6.7 40.0
Original (target)
70.67
72.93
62.12
81.0
98.6
96.7
Original (weak) Query Detection Rewriting 5-shot ICL Token Suppression GhostPrint (ours)
70.37 – – – – 69.70
80.36 – – – – 78.01
62.97 – – – – 62.80
6.0 70.0 0.0 0.0 5.0 80.0
28.8 28.8 38.6 70.5 51.2 64.0
43.3 50.0 33.3 36.7 6.7 60.0
Original (target)
78.12
85.52
66.38
91.0
77.2
96.7
ASR (%)
Method
MMLU GSM8K ARC-C LLMmap LLM-idio MET
Original (weak) Query Detection Rewriting 5-shot ICL Token Suppression GhostPrint (ours)
0.0 0.0 0.0 0.0 0.0 0.0
0.7 2.4 0.1 3.6 2.0 95.2
0.0 6.7 0.0 0.0 6.7 33.3
Original (target)
80.0
99.9
96.7
0.0 0.0 0.0 0.0 15.0 6.0
1.1 2.5 1.8 17.3 1.7 96.7
0.0 6.7 0.0 0.0 0.0 6.7
97.0
99.2
86.7
Original (weak) Query Detection Rewriting Qwen2-1.5B 5-shot ICL → Gemma-7B Token Suppression GhostPrint (ours) Original (target)
Phi-3-mini → Phi-3-medium
Table 2: Evaluation of cross-family weak-to-strong spoofing. The table reports the Attack Success Rate (ASR) when adapting a weak model from one architectural family to spoof a strong model from a completely different family. The highest ASR among attack methods is bolded.
Table 1: Evaluation of single-fingerprint spoofing across three LLM families. The table reports the Attack Success Rate (ASR) alongside general model utility. A successful attack maximizes ASR (best results bolded) while preserving utility scores comparable to the base weak model. Entries marked with “–” denote inference-time baselines that do not tune the weak model, where the model utility remains identical to the original weak model.
ASR, even surpassing the original target model’s natural classification rate of 92%. (ii) In terms of utility preservation, GhostPrint maintains downstream performance that is almost identical to the base weak models. While inference-time baselines inherently preserve utility by avoiding weight updates, our parameter-efficient fine-tuning incurs only marginal performance drops or even slight improvements, confirming that the attack successfully preserves the weak model’s general capabilities on normal tasks.
Evaluation Setting. All fingerprint spoofing attacks are evaluated using an 8:2 train-test split for all fingerprint queries. For LLMmap (Pasquini et al., 2025), we use their official query set. For LLM-idio (Sun et al., 2025c) and MET (Gao et al., 2025b), we use the UltraChat (Ding et al., 2023) dataset as the fingerprint queries, consistent with the original papers. Due to space limitations, full implementation details are deferred to Appendix A. 6.2
6.3
Cross-Model Spoofing Performance
In this section, we extend the within model family setting in Section 6.2 to the more challenging crossfamily setting. Specifically, we study two transfer scenarios: Gemma-1.1-2B to Qwen2-7B, and Qwen2-1.5B to Gemma-1.1-7B. From the results in Table 2, we observe: (i) Cross-family spoofing is inherently more difficult because different model architectures exhibit distinct baseline linguistic styles and vocabulary distributions; and (ii) Despite this architectural gap, GhostPrint still achieves notable success, successfully bypassing LLM-Idio in both settings and MET in the Gemma-to-Qwen transfer. For completeness, we also evaluate cross-family spoofing between models of the same scale in Appendix B.2. However, as this does not fit the financial gain goals for the adversary, it falls outside of our threat model and is put in the appendix.
Single-Fingerprint Spoofing Performance
Table 1 reports the single-fingerprint spoofing performance of GhostPrint, with full implementation details of GhostPrint deferred to Appendix B.1. The results demonstrate that our framework successfully achieves the attacker’s primary goals shown in Section 4.1. (i) Regarding fingerprint spoofing, GhostPrint attains the highest Attack Success Rate (ASR) across all evaluated fingerprints for nearly all weak model families, with the only exception of the 5-shot ICL baseline on LLMidio. Notably, when evaluating the Gemma family against LLMmap, GhostPrint achieves a 95% 8
LLM-idio ASR (%)
Gemma
Qwen2
Phi-3
60
Weak anchor Strong anchor
Router Config
Gemma-1.1-2B→7B
LLMmap + LLM-idio LLMmap + MET LLM-idio + MET 3-way (all)
86.0 89.0 20.0 86.0
54.2 13.2 58.6 54.8
10.0 10.0 30.0 16.7
Qwen2-1.5B→7B
LLMmap + LLM-idio LLMmap + MET LLM-idio + MET 3-way (all)
75.0 74.0 20.0 81.0
58.4 55.5 57.1 57.6
23.3 16.7 26.7 26.7
Phi-3-mini→medium
LLMmap + LLM-idio LLMmap + MET LLM-idio + MET 3-way (all)
71.0 70.0 0.0 77.0
53.0 27.5 49.3 50.6
43.3 43.3 60.0 53.3
LLMmap LLM-idio MET
50 40
0.25
0.5
0.75
1
0.25
α (KD weight)
0.5
0.75
1
α (KD weight)
0.25
0.5
0.75
1
α (KD weight)
Figure 3: Ablation study on the knowledgedistillation anchor model type and weight coefficient α. We report LLM-idio ASR (%) for each family under the weak- and strong-model anchors.
Family
LLM-idio ASR (%) MET ASR (%) λraft = 0
0.5
0
0.5
54.7 56.3 49.1
58.8 63.4 54.8
6.7 36.7 40.0
10.0 40.0 43.3
Gemma-1.1-2B→7B Qwen2-1.5B→7B Phi-3-mini→medium
Table 4: Continual fingerprint spoofing performance using MoLA across different task settings. Bold values indicate the highest ASR achieved within each model family and column.
6.5
Table 3: Ablation study on RAFT-guided query selection. The parameter λraft represents the proportion of RAFT-selected queries mixed into the fine-tuning dataset, with the highest ASR bolded.
6.4
Attack ASR (%)
Family
Continual Fingerprint Spoofing
Here, we evaluate our mixture-of-LoRA-experts (MoLA) framework for the continual learning of multiple fingerprints. Specifically, we sequentially train three separate sets of LoRA parameters tailored to three distinct fingerprinting methods: LLMmap, LLM-idio, and MET. We then evaluate different combinations of these fingerprinted experts routed through a Mixture-of-Experts (MoE) architecture to see how effectively the combined parameters preserve and integrate capabilities.
Ablation Study
Knowledge-Distillation Loss. In this study, we evaluate the stability of knowledge distillation under different coefficients α in Eq. (1). We also investigate whether the small model or the large model should serve as the reference anchor. Based on the results in Figure 3, we find that: (i) using the large model as the anchor gives a slightly higher fingerprint spoofing ASR, but utilizing the small model remains highly effective. This demonstrates that our attack is effective in both scenarios. Whether the target model is accessed via responses only or through softmax probabilities that enable KD, the attack succeeds. (ii) The impact of the KD loss is generally stable across different weights, achieving the optimal ASR at approximately α = 0.25.
Our main results are summarized in Table 4, from which we draw the following key observations: (i) After continual learning via integrating different parameters into the MoLA framework, performance experiences only minor degradation and remains at a high level. Notably, in the 3-way configurations for Qwen and Phi-3, some fingerprint spoofing results even outperform their standalone counterparts. This demonstrates that our framework can continually adapt to new fingerprints while retaining prior knowledge without catastrophic forgetting. (ii) Even when an expert is not explicitly trained on a specific fingerprint, the integrated MoLA framework demonstrates an inherent ability to generalize. For instance, in the LLMmap + LLM-idio routing configuration on Qwen2 and Phi-3, despite the complete omission of the MET expert during sequential training, the evaluation scores on MET closely approach those of configurations where it was explicitly included. This suggests that the compositionality of the learned experts facilitates cross-fingerprint knowledge transfer.
Impact of RAFT . To ensure that fingerprint spoofing fine-tuning effectively exploits the vulnerabilities of weak classifiers, we utilize RAFT to select queries that are more adversarial to fingerprint classifiers. The results are summarized in Table 3. As shown in the table, incorporating a 50% ratio of RAFT queries (λraft = 0.5) during fine-tuning alongside standard queries significantly improves the ASR. This demonstrates that strategically leveraging weak classifier vulnerabilities directly enhances spoofing capabilities, validating our theoretical analysis in Section 5.1. 9
7
Conclusion
llm providers. In Proceedings of the ACM Web Conference 2026, pages 249–260.
We introduce fingerprint spoofing and propose GhostPrint, a parameter-efficient attack combining surrogate modeling, reward-ranked fine-tuning, and knowledge distillation, extended with a Mixture-ofLoRA router to unify multiple auditors. GhostPrint consistently bypasses four auditors across three model families while preserving utility, exposing a critical vulnerability in current black-box LLM fingerprint methods.
Lingjiao Chen, Matei Zaharia, and James Zou. 2024. FrugalGPT: How to use large language models while reducing cost and improving performance. Transactions on Machine Learning Research. Featured Certification. Sixu Chen, Xiang Chen, Hongyao Yu, Jiaxin Hong, Hao Fang, Shuoyang Sun, Bin Chen, and Shu-Tao Xia. 2026. Prompt2fingerprint: Plug-and-play llm fingerprinting via text-to-weight generation. arXiv preprint arXiv:2605.18474.
Limitations
Wei-Lin Chiang, Lianmin Zheng, Ying Sheng, Anastasios Nikolas Angelopoulos, Tianle Li, Dacheng Li, Banghua Zhu, Hao Zhang, Michael Jordan, Joseph E Gonzalez, and 1 others. 2024. Chatbot arena: An open platform for evaluating llms by human preference. In International Conference on Machine Learning, pages 8359–8388. PMLR.
Due to academic compute limits, GhostPrint is not evaluated on frontier-scale models (e.g., Qwen-3 32B), which is an important next step. Future work may incorporate reinforcement learning with the surrogate classifier as a reward model to improve alignment. While our attack exposes a vulnerability that could be misused, this is a research prototype intended to motivate robust fingerprinting and we do not foresee a potential negative societal impact. LLMs were used only for grammar checking and language quality, and the authors are fully responsible for all technical content.
Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. 2018. Think you have solved question answering? try arc, the ai2 reasoning challenge. arXiv preprint arXiv:1803.05457. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, and 1 others. 2021. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168.
References Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, Alon Benhaim, Misha Bilenko, Johan Bjorck, Sébastien Bubeck, Martin Cai, Qin Cai, Vishrav Chaudhary, Dong Chen, Dongdong Chen, and 110 others. 2024. Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404.14219.
Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. 2023. Qlora: Efficient finetuning of quantized llms. Advances in neural information processing systems, 36:10088–10115. Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. 2023. Enhancing chat language models by scaling high-quality instructional conversations. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 3029–3051.
Xiaofan Bai, Pingyi Hu, Xiaojing Ma, Linchen Yu, Dongmei Zhang, Qi Zhang, and Bin Benjamin Zhu. 2025. Esf: Efficient sensitive fingerprinting for blackbox tamper detection of large language models. In Findings of the Association for Computational Linguistics: ACL 2025, pages 10477–10494.
Hanze Dong, Wei Xiong, Deepanshu Goyal, Rui Pan, Shizhe Diao, Jipeng Zhang, Kashun Shum, and Tong Zhang. 2023. RAFT: Reward rAnked FineTuning for generative foundation model alignment. Transactions on Machine Learning Research (TMLR). ArXiv:2304.06767.
Jiacheng Cai, Jiahao Yu, Yangguang Shao, Yuhang Wu, and Xinyu Xing. 2025a. Utf: Under-trained tokens as fingerprints——a novel approach to llm identification. In Proceedings of the The First Workshop on LLM Security (LLMSEC), pages 1–6. Will Cai, Tianneng Shi, Xuandong Zhao, and Dawn Song. 2025b. Are you getting what you pay for? auditing model substitution in llm apis. arXiv preprint arXiv:2504.04715.
Wenqi Fan, Pangjing Wu, Yujuan Ding, Liangbo Ning, Shijie Wang, and Qing Li. 2025. Towards retrievalaugmented large language models: Data management and system design. In 2025 IEEE 41st International Conference on Data Engineering (ICDE), pages 4509–4512. IEEE.
Yuhan Cao, Yu Wang, Sitong Liu, Miao Li, Yixin Tao, and Tianxing He. 2026. Pay for the second-best service: A game-theoretic approach against dishonest
Zhengru Fang, Yu Guo, Fei Liu, Yuang Zhang, Yihang Tao, Senkang Hu, Wenbo Ding, and Yuguang Fang. 2026. Agent-centric visual reinforcement
10
learning under dynamic perturbations. arXiv preprint arXiv:2604.24661.
Pingyi Hu, Xiaofan Bai, Xiaojing Ma, Chaoxiang He, Dongmei Zhang, and Bin Benjamin Zhu. 2025. Resf: Regularized-entropy-sensitive fingerprinting for black-box tamper detection of large language models. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 4889–4903.
Chongyang Gao, Kezhen Chen, Jinmeng Rao, Berrak Sisman, Frank Bayer, Daniel Macko, and Yixin Lao. 2025a. MoLA: MoE LoRA with layer-wise expert allocation. In Findings of NAACL 2025.
Jiani Huang, Shijie Wang, Liang-bo Ning, Wenqi Fan, Shuaiqiang Wang, Dawei Yin, and Qing Li. 2026. Towards next-generation recommender systems: A benchmark for personalized recommendation assistant with llms. In The ACM International Conference on Web Search and Data Mining (WSDM).
Irena Gao, Percy Liang, and Carlos Guestrin. 2025b. Model equality testing: Which model is this API serving? In The Thirteenth International Conference on Learning Representations. Thibaud Gloaguen, Robin Staab, Nikola Jovanović, and Martin Vechev. 2026. LLM fingerprinting via semantically conditioned watermarks. In The Fourteenth International Conference on Learning Representations.
Bowen Jiang, Zhuoqun Hao, Young Min Cho, Bryan Li, Yuan Yuan, Sihao Chen, Lyle Ungar, Camillo Jose Taylor, and Dan Roth. 2025a. Know me, respond to me: Benchmarking LLMs for dynamic user profiling and personalized responses at scale. In Second Conference on Language Modeling.
Gene H Golub and Charles F Van Loan. 2013. Matrix computations. JHU press.
Bowen Jiang, Yuan Yuan, Maohao Shen, Zhuoqun Hao, Zhangchen Xu, Zichen Chen, Ziyi Liu, Anvesh Rao Vijjini, Jiashu He, Hanchao Yu, and 1 others. 2025b. Personamem-v2: Towards personalized intelligence via learning implicit user personas and agentic memory. arXiv preprint arXiv:2512.06688.
Chenxi Gu, Chengsong Huang, Xiaoqing Zheng, KaiWei Chang, and Cho-Jui Hsieh. 2022. Watermarking pre-trained language models with backdooring. arXiv preprint arXiv:2210.07543. Martin Gubri, Dennis Ulmer, Hwaran Lee, Sangdoo Yun, and Seong Joon Oh. 2024. Trap: Targeted random adversarial prompt honeypot for black-box identification. In Findings of the Association for Computational Linguistics: ACL 2024, pages 11496–11517.
Heng Jin, Chaoyu Zhang, Shanghao Shi, Wenjing Lou, and Y Thomas Hou. 2024. Proflingo: A fingerprinting-based intellectual property protection scheme for large language models. In 2024 IEEE Conference on Communications and Network Security (CNS), pages 1–9. IEEE.
Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Peiyi Wang, Qihao Zhu, Runxin Xu, Ruoyu Zhang, Shirong Ma, Xiao Bi, and 1 others. 2025. Deepseekr1 incentivizes reasoning in llms through reinforcement learning. Nature, 645(8081):633–638.
Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. 2020. Scaling laws for neural language models. arXiv preprint arXiv:2001.08361.
Xin He, Junxi Shen, Zhenheng Tang, Xiaowen Chu, Bo Li, Ivor W Tsang, and Yew-Soon Ong. 2025. Routemark: A fingerprint for intellectual property attribution in routing-based model merging. arXiv preprint arXiv:2508.01784.
Rohith Kuditipudi, Jing Huang, Sally Zhu, Diyi Yang, Christopher Potts, and Percy Liang. 2025. Blackbox model provenance via palimpsestic membership inference. In The Thirty-ninth Annual Conference on Neural Information Processing Systems.
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2020. Measuring massive multitask language understanding. arXiv preprint arXiv:2009.03300.
Kevin Kurian, Ethan Holland, and Sean Oesch. 2025. Attacks and defenses against llm fingerprinting. arXiv preprint arXiv:2508.09021.
Jordan Hoffmann, Sebastian Borgeaud, Arthur Mensch, Elena Buchatskaya, Trevor Cai, Eliza Rutherford, Diego de Las Casas, Lisa Anne Hendricks, Johannes Welbl, Aidan Clark, and 1 others. 2022. An empirical analysis of compute-optimal large language model training. Advances in neural information processing systems, 35:30016–30030.
Hongyu Li, Liang Ding, Meng Fang, and Dacheng Tao. 2024. Revisiting catastrophic forgetting in large language model tuning. In Findings of the association for computational linguistics: EMNLP 2024, pages 4297–4308. Peixuan Li, Pengzhou Cheng, Fangqi Li, Wei Du, Haodong Zhao, and Gongshen Liu. 2023. Plmmark: a secure and robust black-box watermarking framework for pre-trained language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37:12, pages 14991–14999.
Edward J Hu, yelong shen, Phillip Wallis, Zeyuan AllenZhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations.
11
Xiuyu Li, Jinkai Zhang, Mingyang Yi, Yu Li, Longqiang Wang, Yue Wang, and Ju Fan. 2026a. Ets: Energyguided test-time scaling for training-free rl alignment. In Forty-third International Conference on Machine Learning.
Ivica Nikolic, Teodora Baluta, and Prateek Saxena. 2025. Model provenance testing for large language models. In The Thirty-ninth Annual Conference on Neural Information Processing Systems. Xuying Ning, Katherine Tieu, Dongqi Fu, Tianxin Wei, Zihao Li, Yuanchen Bei, Jiaru Zou, Mengting Ai, Zhining Liu, Ting-Wei Li, and 1 others. 2026. Code as agent harness. arXiv preprint arXiv:2605.18747.
Yu Li, Mingyang Yi, Xiuyu Li, Ju Fan, Fuxin Jiang, Binbin Chen, Peng Li, Jie Song, and Tieying Zhang. 2026b. Reasoning and tool-use compete in agentic rl: From quantifying interference to disentangled tuning. arXiv preprint arXiv:2602.00994.
Dario Pasquini, Evgenios M. Kornaropoulos, and Giuseppe Ateniese. 2025. LLMmap: Fingerprinting for large language models. In USENIX Security Symposium.
Percy Liang, Rishi Bommasani, Tony Lee, Dimitris Tsipras, Dilara Soylu, Michihiro Yasunaga, Yian Zhang, Deepak Narayanan, Yuhuai Wu, Ananya Kumar, Benjamin Newman, Binhang Yuan, Bobby Yan, Ce Zhang, Christian Cosgrove, Christopher D Manning, Christopher Re, Diana Acosta-Navas, Drew A. Hudson, and 31 others. 2023. Holistic evaluation of language models. Transactions on Machine Learning Research.
Yujia Qin, Shihao Liang, Yining Ye, Kunlun Zhu, Lan Yan, Yaxi Lu, Yankai Lin, Xin Cong, Xiangru Tang, Bill Qian, Sihan Zhao, Lauren Hong, Runchu Tian, Ruobing Xie, Jie Zhou, Mark Gerstein, dahai li, Zhiyuan Liu, and Maosong Sun. 2024. ToolLLM: Facilitating large language models to master 16000+ real-world APIs. In The Twelfth International Conference on Learning Representations.
Jiale Liu, Jiahao Zhang, and Suhang Wang. 2026. Exposing privacy risks in graph retrieval-augmented generation. In ACL Findings.
Zhenzhen Ren, GuoBiao Li, Sheng Li, Zhenxing Qian, and Xinpeng Zhang. 2025. Cotsrf: Utilize chain of thought as stealthy and robust fingerprint of large language models. arXiv preprint arXiv:2505.16785.
Shih-Yang Liu, Chien-Yi Wang, Hongxu Yin, Pavlo Molchanov, Yu-Chiang Frank Wang, Kwang-Ting Cheng, and Min-Hung Chen. 2024. Dora: Weightdecomposed low-rank adaptation. In Forty-first International Conference on Machine Learning.
Nikhil Sardana, Jacob Portes, Sasha Doubov, and Jonathan Frankle. 2024. Beyond chinchilla-optimal: Accounting for inference in language model scaling laws. In International Conference on Machine Learning, pages 43445–43460. PMLR.
Sijia Luo, Xiaokang Zhang, Yuxuan Hu, Bohan Zhang, Ke Wang, Jinbo Su, Mengshu Sun, Lei Liang, and Jing Zhang. 2026. Sparse-rl: Breaking the memory wall in llm reinforcement learning via stable sparse rollouts. arXiv preprint arXiv:2601.10079.
Shuo Shao, Yiming Li, Yu He, Hongwei Yao, Wenyuan Yang, Dacheng Tao, and Zhan Qin. 2025. Sok: Large language model copyright auditing via fingerprinting. arXiv preprint arXiv:2508.19843.
Yun Luo, Zhen Yang, Fandong Meng, Yafu Li, Jie Zhou, and Yue Zhang. 2025. An empirical study of catastrophic forgetting in large language models during continual fine-tuning. IEEE Transactions on Audio, Speech and Language Processing.
Shuo Shao, Yiming Li, Hongwei Yao, Yifei Chen, Yuchen Yang, and Zhan Qin. 2026. Reading between the lines: Towards reliable black-box llm fingerprinting via zeroth-order gradient estimation. In Proceedings of the ACM Web Conference 2026, pages 2637–2648.
Hope Elizabeth McGovern, Rickard Stureborg, Yoshi Suhara, and Dimitris Alikaniotis. 2025. Your large language models are leaving fingerprints. In Proceedings of the 1stWorkshop on GenAI Content Detection (GenAIDetect), pages 85–95. Anshul Nasery, Edoardo Contente, Alkin Kaz, Pramod Viswanath, and Sewoong Oh. 2025a. Are robust llm fingerprints adversarially robust? arXiv preprint arXiv:2509.26598.
Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. 2023. Reflexion: Language agents with verbal reinforcement learning. Advances in neural information processing systems, 36:8634–8652.
Anshul Nasery, Jonathan Hayase, Creston Brooks, Peiyao Sheng, Himanshu Tyagi, Pramod Viswanath, and Sewoong Oh. 2025b. Scalable fingerprinting of large language models. In The Thirty-ninth Annual Conference on Neural Information Processing Systems.
Guoheng Sun, Ziyao Wang, Bowei Tian, Meng Liu, Zheyu Shen, Shwai He, Yexiao He, Wanghao Ye, Yiting Wang, and Ang Li. 2025a. Coin: Counting the invisible reasoning tokens in commercial opaque llm apis. arXiv preprint arXiv:2505.13778.
Vinh Nguyen, Cuong Dang, Jiahao Zhang, Hoa Tran, Minh Tran, Trinh Chau, Thai Le, Lu Cheng, and Suhang Wang. 2026. Urag: A benchmark for uncertainty quantification in retrieval-augmented large language models. arXiv preprint arXiv:2603.19281.
Guoheng Sun, Ziyao Wang, Xuandong Zhao, Bowei Tian, Zheyu Shen, Yexiao He, Jinming Xing, and Ang Li. 2025b. Invisible tokens, visible bills: The urgent need to audit hidden operations in opaque llm services. arXiv preprint arXiv:2505.18471.
12
Mingjie Sun, Yida Yin, Zhiqiu Xu, J Zico Kolter, and Zhuang Liu. 2025c. Idiosyncrasies in large language models. In International Conference on Machine Learning, pages 57854–57885. PMLR.
Zixun Xiong, Gaoyi Wu, Qingyang Yu, Mingyu Derek Ma, Lingfeng Yao, Miao Pan, Xiaojiang Du, and Hao Wang. 2026. iseal: Encrypted fingerprinting for reliable llm ownership verification. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40:42, pages 35940–35948.
Ling Tang, YueFeng Chen, Hui Xue, and Quanshi Zhang. 2025. Towards the resistance of neural network fingerprinting to fine-tuning. In The Thirtyninth Annual Conference on Neural Information Processing Systems.
Jiashu Xu, Fei Wang, Mingyu Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. 2024. Instructional fingerprinting of large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 3277–3306.
Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, and 1 others. 2024. Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295.
Yijie Xu, Aiwei Liu, Xuming Hu, Lijie Wen, and Hui Xiong. 2025a. Mark your llm: Detecting the misuse of open-source large language models via watermarking. arXiv preprint arXiv:2503.04636.
Yao Tong, Haonan Wang, Siquan Li, Kenji Kawaguchi, and Tianyang Hu. 2026. Seedprints: Fingerprints can even tell which seed your large language model was trained from. In The Fourteenth International Conference on Learning Representations.
Zhenhua Xu, Zhaokun Yan, Binhan Xu, Xin Tong, Haitao Xu, Yourong Chen, and Meng Han. 2025b. Unlocking the effectiveness of lora-fp for seamless transfer implantation of fingerprints in downstream models. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 4302–4312.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems, 30.
Zhenhua Xu, Xixiang Zhao, Xubin Yue, Shengwei Tian, Changting Lin, and Meng Han. 2025c. Ctcc: A robust and stealthy fingerprinting framework for large language models via cross-turn contextual correlation backdoor. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 6978–7000.
Ander Artola Velasco, Stratis Tsirtsis, and Manuel Gomez-Rodriguez. 2026. Auditing pay-per-token in large language models. In AISTATS.
Shojiro Yamabe, Futa Kai Waseda, Tsubasa Takahashi, and Koki Wataoka. 2025. Mergeprint: Mergeresistant fingerprints for robust black-box ownership verification of large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 6894–6916.
Ander Artola Velasco, Stratis Tsirtsis, Nastaran Okati, and Manuel Gomez-Rodriguez. 2025. Is your llm overcharging you? tokenization, transparency, and incentives. arXiv preprint arXiv:2505.21627. Ziyao Wang, Guoheng Sun, Yexiao He, Zheyu Shen, Bowei Tian, and Ang Li. 2025. Predictive auditing of hidden tokens in llm apis via reasoning length estimation. arXiv preprint arXiv:2508.00912.
Yuliang Yan, Haochun Tang, Shuo Yan, and Enyan Dai. 2026. Duffin: A dual-level fingerprinting framework for llms ip protection. In Findings of the Association for Computational Linguistics: EACL 2026, pages 5168–5184.
Zehao Wu, Yanjie Zhao, and Haoyu Wang. 2025. Tensorguard: Gradient-based model fingerprinting for llm similarity detection and family classification. In 2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 445– 456. IEEE.
An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, and 43 others. 2024. Qwen2 technical report. arXiv preprint arXiv:2407.10671.
Zhaomin Wu, Haodong Zhao, Ziyang Wang, Jizhou Guo, Qian Wang, and Bingsheng He. 2026a. LLM DNA: Tracing model evolution via functional representations. In The Fourteenth International Conference on Learning Representations.
Shuhua Yang, Jiahao Zhang, Yilong Wang, Dongwon Lee, and Suhang Wang. 2026. Query-efficient agentic graph extraction attacks on GraphRAG systems. In ACL.
Zongyu Wu, Minhua Lin, Zhiwei Zhang, Fali Wang, Xianren Zhang, Xiang Zhang, and Suhang Wang. 2026b. Image corruption-inspired membership inference attacks against large vision-language models. In Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), pages 7945–7957.
Ziqing Yang, Yixin Wu, Yun Shen, Wei Dai, Michael Backes, and Yang Zhang. 2025. The challenge of identifying the origin of black-box large language models. arXiv preprint arXiv:2503.04332.
13
Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik R Narasimhan, and Yuan Cao. 2023. React: Synergizing reasoning and acting in language models. In The Eleventh International Conference on Learning Representations.
2026c. Resource consumption threats in large language models. arXiv preprint arXiv:2603.16068. Yue Zheng, Si Wang, and Chip-Hong Chang. 2022. A dnn fingerprint for non-repudiable model ownership identification and piracy detection. IEEE Transactions on Information Forensics and Security, 17:2977– 2989.
Chuanchao Zang, Xiangtao Meng, Wenyu Chen, Tianshuo Cong, Zha Yaxing, Dong Qi, Zheng Li, and Shanqing Guo. 2025. Errortrace: A black-box traceability mechanism based on model family error space. In The Thirty-ninth Annual Conference on Neural Information Processing Systems.
Xiaoyuan Zhu, Yaowen Ye, Tianyi Alex Qiu, Hanlin Zhu, Sijun Tan, Ajraf Mannan, Jonathan Michala, Raluca Ada Popa, and Willie Neiswanger. 2026. Auditing black-box LLM APIs with a rank-based uniformity test. In The Fourteenth International Conference on Learning Representations.
Boyi Zeng, Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu Yu, and Zhouhan Lin. 2024. Huref: Human-readable fingerprint for large language models. Advances in Neural Information Processing Systems, 37:126332–126362. Boyu Zhang, Ping He, Tianyu Du, Xuhong Zhang, Lei Yun, Kingsum Chow, and Jianwei Yin. 2025a. Clmtracing: Black-box user-level watermarking for code language model tracing. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 28962–28978. Haobo Zhang, Zhenhua Xu, Junxian Li, Shangfeng Sheng, Dezhang Kong, and Meng Han. 2026a. Attndiff: Attention-based differential fingerprinting for large language models. In ACL. Jie Zhang, Jiayuan Li, Haiqiang Fei, Lun Li, and Hongsong Zhu. 2024. Easydetector: Using linear probe to detect the provenance of large language models. In 2024 IEEE 23rd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pages 2410–2417. IEEE. Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. 2025b. REEF: Representation encoding fingerprints for large language models. In The Thirteenth International Conference on Learning Representations. Qingjie Zhang, Di Wang, Haoting Qian, Liu Yan, Tianwei Zhang, Ke Xu, Qi Li, Minlie Huang, Hewu Li, and Han Qiu. 2025c. Speculating llms’ chinese training data pollution from their tokens. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 26124–26144. Xianren Zhang, Hui Liu, Delvin Ce Zhang, Xianfeng Tang, Qi He, Dongwon Lee, and Suhang Wang. 2025d. Sua: Stealthy multimodal large language model unlearning attack. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 11241–11254. Yage Zhang, Yukun Jiang, Zeyuan Chen, Michael Backes, Xinyue Shen, and Yang Zhang. 2026b. Real money, fake models: Deceptive model claims in shadow APIs. arXiv preprint arXiv:2603.01919. Yuanhe Zhang, Xinyue Wang, Zhican Chen, Weiliu Wang, Zilu Zhang, Zhengshuo Gong, Zhenhong Zhou, Kun Wang, Li Sun, Yang Liu, and 1 others.
14
Appendix
For Rewriting (Kurian et al., 2025), the small model first answers the query, then is re-prompted with a fixed style-laundering template that asks it to rewrite the response “to be more comprehensive, detailed, and well-reasoned, as if written by a highly knowledgeable assistant with deep expertise.” Both passes use the same small model; only the second pass output is audited. Sample sizes per auditor match the Original (small) row. For 5-shot ICL, we sample five question-answer pairs from the large model’s UltraChat responses and prepend them as an in-context demonstration block before every query that the small model answers. For LLMmap, the same five pairs are prepended to every identity probe before evaluation; for LLM-idio and MET, they are prepended to every UltraChat prompt. For Token Suppression (Nasery et al., 2025a), we follow the SuppressTop-k attack. At decoding time, for the first n = 16 generation positions we mask the k = 4 highest-probability tokens (setting their logits to −∞) before sampling; subsequent positions decode normally. The mask is implemented as a HuggingFace LogitsProcessor and applied uniformly across all three auditors, using the same temperature, prompt set, and sample count as Original (small).
List of Contents In this appendix, we provide the following additional information: • Section A: Implementation Details of Experiments. • Section B: Additional Experimental Results. • Section C: Additional Related Works. • Section D: Detailed Proofs.
A
Implementation Details of Experiments
A.1
Fingerprinting Auditors
For LLMmap, we use the released set of 800 adversarial identity probes, each concatenated with a system prompt and CoT/RAG-style prompts as in the original work. The 800 probes are split 8:2 (640 training, 160 test), and we use 100 probes to evaluate ASR. For LLM-idio, we follow the original setting: a per-family binary classifier is trained on 10,000 UltraChat (Ding et al., 2023) responses from each of the small and large models. The same prompts are used for training the attack adapters and for evaluation; a held-out 20% subset (2,000 prompts) serves as the test set. For MET, the two-sample test is applied to completions from the UltraChat prompt set. For the main-table fair-budget setting we use N = 1 prompt and K = 10 completions per prompt, subsampled from the full N = 50, K = 20 collection. The test statistic is MMDhamming with a permutation p-value (100 permutations, α = 0.05). ASR is the fraction of 30 independent random seeds for which MET fails to reject H0 . The full (N, K) sweep is described in Appendix A.4. A.2
A.3
Training Settings
We adopt the LoRA-based deception attack from Section 5, with r = 16, α = 32, dropout 0.05, 2 epochs, learning rate 5 × 10−5 , batch size 4, AdamW with weight decay 0.01, and a knowledgedistillation term (λkd = 0.5, τ = 2.0) against a frozen large teacher. We set λkd = 0.5 as the midpoint of the sweep in Figure 3, which shows that ASR is insensitive to λkd across [0.25, 1.0]. The RAFT-style ablation of Section 6.4 uses N = 8 candidates per prompt, 3 rounds, and λraft = 0.5.
Baseline Settings
A.4
For Query Detection, we train a defender-side classifier that decides at audit time whether to serve the small or the large model. The classifier is a two-layer MLP on top of frozen all-MiniLM-L6-v2 sentence embeddings, trained to distinguish LLMmap identity probes from UltraChat prompts. At evaluation, each query is routed to the large model’s pre-collected response if flagged as a probe and to the small model’s response otherwise. This is an oracle baseline because the defender knows the probe distribution; utility is unchanged on prompts the detector rejects.
MET Sample Complexity
LLMmap and LLM-idio use one query per audit; MET defaults to (N = 20, K = 5), costing 100× more generations. The main paper therefore reports MET at the fair budget (1, 10). Here we characterize detection power by subsampling from a (50, 20) pool, computing ASR over 30 seeds. At the strong budget on Phi-3, our MoLA adapter achieves a mean permutation p = 0.086 > α, the first time MET fails to reject H0 . Its ASR stays above 50% until N > 30, while the best single-fingerprint adapter drops below 50% at N = 15
MET ASR (%)
Gemma 100
Qwen2
Phi-3
Setting
Best Single (UC) MoLA (3-way) RAFT (λ = 0.5)
50
LLMmap LLM-idio MET Original (weak) Query Detection Rewriting Gemma-2B → Qwen2-1.5B 5-shot ICL Token Suppression GhostPrint (ours)
0 1
2
5 10 20
50
1
N (prompts)
2
5 10 20
50
N (prompts)
1
2
5 10 20
50
N (prompts)
Figure 4: MET sample complexity at K = 10 for three spoofing attacks across model families. ASR is averaged over 30 resampling seeds.
Qwen2-1.5B → Gemma-2B
20. On other families, curves overlap, consistent with family-dependent trade-offs. Even though all adapters are rejected at the full (50, 20) budget, that setting costs 1,000 generations per audit and is impractical for frequent use. Auditors operating at lower budgets, including the fair (1, 10) and the intermediate (20, 5) default, leave many attacks undetected, especially on Phi-3 where the scale gap is smallest.
B
Additional Experimental Results
B.1
Per-adapter Single-Fingerprint Breakdown
B.2
– 2B 7B – 2B 7B
95.0 84.0 87.0 19.0 21.0 28.0
31.2 14.7 16.8 58.5 52.0 55.9
13.3 3.3 0.0 23.3 13.3 13.3
Qwen2
LLMmap LLMmap LLMmap UltraChat UltraChat UltraChat
– 1.5B 7B – 1.5B 7B
74.0 76.0 76.0 21.0 28.0 35.0
70.0 41.5 71.3 50.2 51.0 51.7
26.7 30.0 36.7 40.0 36.7 40.0
Phi-3
LLMmap LLMmap LLMmap UltraChat UltraChat UltraChat
– mini medium – mini medium
80.0 77.0 74.0 10.0 5.0 0.0
64.0 35.9 35.2 58.0 53.0 56.0
26.7 43.3 33.3 33.3 36.7 60.0
1.6 3.2 0.0 0.8 2.2 97.5
0.0 6.7 3.3 0.0 16.7 46.7
Original (target)
78.0
99.5
100.0
Original (weak) Query Detection Rewriting 5-shot ICL Token Suppression GhostPrint (ours)
0.0 0.0 0.0 0.0 16.0 38.0
0.8 2.5 8.9 19.4 1.0 97.9
0.0 6.7 0.0 0.0 3.3 20.0
Original (target)
84.0
99.1
93.3
More Cross-Model Spoofing Results
For completeness, we provide additional results to investigate whether models of similar scale can serve as fingerprints for other model families. As shown in Table 6, our proposed GhostPrint framework consistently outperforms all baselines. Notably, our results on LLM-idio across both settings are particularly notablez, showing almost no performance difference compared to the target model’s original fingerprint.
Training Data KD Teacher LLMmap LLM-idio MET
LLMmap LLMmap LLMmap Gemma UltraChat UltraChat UltraChat
0.0 0.0 0.0 0.0 1.0 4.0
Table 6: Evaluation of cross-family weak-to-weak spoofing. The table reports the Attack Success Rate (ASR) when adapting a weak model from one architectural family to spoof a strong model from a completely different family. The highest ASR among attack methods is bolded.
Table 5 reports each of the 18 single-fingerprint LoRA variants we train per family, organised by training data (LLMmap probes vs. UltraChat) and KD teacher (no KD, student-size self-distillation, target-size teacher). The “GhostPrint (ours)” rows in Table 1 pick the column-wise maximum per family across these 18 cells. Family
ASR (%)
Method
C
Additional Related Works
C.1
LLM API Overcharging Risks
The proliferation of commercial LLM APIs under pay-per-use pricing has raised concerns about provider dishonesty at multiple levels. At the model level, providers may silently substitute promised strong models with weaker alternatives (Cai et al., 2025b; Zhang et al., 2026b), directly misrepresenting service quality. At the token level, hidden reasoning tokens in opaque APIs introduce invisible billing overhead (Sun et al., 2025a,b), with tokenization transparency and incentive misalignment further analyzed in (Velasco et al., 2025). Broader resource-side threats, such as compute, memory, and API abuse, are surveyed in (Zhang et al., 2026c). Early defenses address both directions: a game-theoretic auditing mechanism targets dishonest model-level providers (Cao et al., 2026), while statistical and predictive auditing schemes tackle pay-per-token billing fraud (Ve-
Table 5: Detailed evaluation across all 18 LoRA variants. The results are categorized by model family and training configurations (dataset × KD teacher selection). The best performance within each family and column is bolded.
16
lasco et al., 2026; Wang et al., 2025). Our work identifies a new threat distinct from previous model substitution and token overcharging, where a malicious provider can use parameter-efficient finetuning to adapt a weak model to evade fingerprintbased auditing, making dishonest model deployments harder to detect. C.2
nance (Kuditipudi et al., 2025), chain-of-thought fingerprinting (Ren et al., 2025), zeroth-order gradient estimation (Shao et al., 2026), sensitivityguided query selection (Hu et al., 2025), code model tracing (Zhang et al., 2025a), and dual-level IP protection frameworks (Yan et al., 2026). Intrusive Fingerprinting. Intrusive methods embed verifiable fingerprints during model training via backdoor mechanisms. Early work establishes backdoor watermarking baselines for pre-trained language models (Gu et al., 2022; Li et al., 2023). Instruction-triggered backdoors bind ownership responses to specific prompt patterns (Xu et al., 2024, 2025c), and LoRA-based transfer propagates fingerprints into fine-tuned derivatives (Xu et al., 2025b). Robustness under post-hoc model modification is a central challenge: merge-resistant designs (Yamabe et al., 2025; He et al., 2025) and fine-tuning-resistant schemes (Tang et al., 2025; Nasery et al., 2025b) address editing and adaptation threats. Semantically richer fingerprints are pursued via conditioned watermarks (Gloaguen et al., 2026), random-seed fingerprinting (Tong et al., 2026), and functional evolution tracing (Wu et al., 2026a). Additional contributions include encrypted ownership verification (Xiong et al., 2026), plug-and-play fingerprint generation (Chen et al., 2026), open-source misuse detection (Xu et al., 2025a), tamper attribution (Bai et al., 2025), and analysis of the fundamental difficulty of black-box origin identification (Yang et al., 2025).
LLM Fingerprinting
White-box Non-Intrusive Fingerprinting. Whitebox fingerprinting assumes direct weight access and verifies ownership through internal model analysis without modifying model behavior. Parameter and gradient signatures form one primary axis: Zheng et al. (2022) establish non-repudiable ownership certificates from weight statistics, and TensorGuard (Wu et al., 2025) classifies model families via gradient-based features. Representationbased approaches extract fingerprints from internal activations: REEF (Zhang et al., 2025b) encodes layer-wise hidden states as compact fingerprints, AttnDiff (Zhang et al., 2026a) exploits differential attention maps for identification, and EasyDetector (Zhang et al., 2024) detects provenance via linear probes on intermediate features. HuRef (Zeng et al., 2024) constructs human-interpretable fingerprints from weight-invariant vectors, and Shao et al. (2025) provides a systematic survey of LLM copyright auditing spanning the full white-box landscape. Non-Intrusive Black-Box Fingerprinting. Blackbox fingerprinting operates through API queries alone, without parameter access. General-query methods derive model identity from naturally elicited responses. For API integrity auditing, statistical hypothesis tests detect model substitution by comparing output distributions (Gao et al., 2025b; Zhu et al., 2026) and behavioral consistency (Cai et al., 2025b; Nikolic et al., 2025). Idiosyncrasy-based approaches exploit persistent behavioral quirks (Sun et al., 2025c; McGovern et al., 2025), characteristic error-space signatures (Zang et al., 2025), and side-channel query statistics (Pasquini et al., 2025) as inherent fingerprints. Specific-query methods craft targeted inputs to elicit discriminative signals. Adversarial honeypot strategies embed verifiable traps for IP attribution (Gubri et al., 2024; Jin et al., 2024). Tokenlevel probing exploits under-trained tokens (Cai et al., 2025a) and training corpus artifacts (Zhang et al., 2025c) as covert signals. Further directions include membership-inference-based prove-
D
Detailed Proofs
Notations. For a set of vectors {x1 , . . . , xk }, span{x1 , . . . , xk } denotes the set of all their linear combinations. For a matrix A ∈ Rd1 ×d2 , we use col(A) := {Ax | x ∈ Rd2 } to denote its column space, and null(A) := {x ∈ Rd2 | Ax = 0} to denote its null space. Finally, tr(A) denotes the trace of a square matrix A, defined as the sum of its diagonal elements. D.1
Basic Tools
Lemma D.1 (The Eckhart-Young Theorem, adapted from page 79 of (Golub and Van Loan, 2013)). Let A ∈ Rd1 ×d2 be a matrix with rank r, and let its singular value decomposition be P given by A = ri=1 σi ui vi⊤ , where σ1 ≥ σ2 ≥ · · · ≥ σr > 0 are the non-zero singular values, and ui , vi are the corresponding left and right singular vectors. 17
P For any integer k < r, let Ak := ki=1 σi ui vi⊤ denote the rank-k truncated singular value decomposition of A. Then, the optimal rank-k approximation of A under the Frobenius norm and spectral norm is Ak , i.e.,
the infimum: c 2 = ∥W − W∥ c 2 sup ∥Wx − Wx∥ ∥x∥2 =1
= ∥R − AB∥2 , where the first equality follows from the definition of spectral norm, and the second equality follows from the definition of R. Taking the infimum over the LoRA matrices A and B on both sides, we obtain:
arg min ∥A − B∥2 = arg min ∥A − B∥F = Ak . rank(B)=k
rank(B)=k
By substituting matrix B with the optimal solution Ak , we obtain the following corollary with basic algebra.
c 2 = inf ∥R − AB∥2 . inf sup ∥Wx − Wx∥
A,B ∥x∥2 =1
Corollary D.2 (Error of Optimal Low-Rank Approximation). Under the same setting as Lemma D.1, the minimum approximation errors achieved by a rank-k matrix are: 1. Spectral Norm: min rank(B)=k
(3) Since the LoRA matrices A ∈ Rd1 ×r and B ∈ Rr×d2 are bottlenecked by their inner dimension r, their product AB has a rank of at most r. Therefore, minimizing ∥R − AB∥2 is equivalent to finding the optimal rank-r approximation of the residual matrix R under the spectral norm. We can directly apply part 1 of Corollary D.2 to evaluate this optimal error, which yields:
∥A − B∥2 = σk+1 ,
2. Frobenius Norm: min rank(B)=k
D.2
∥A − B∥F =
r X
!1/2 σi2
A,B
.
inf ∥R − AB∥2 = σr+1 (R).
A,B
i=k+1
(4)
We now lower bound σr+1 (R). Because W = W′ + R, where rank(W) = k1 and rank(W′ ) = k2 , the subadditivity property of matrix rank dictates that rank(R) ≥ k1 − k2 . The proposition assumes the adaptation rank satisfies r < k1 − k2 , which directly implies r + 1 ≤ rank(R). Consequently, the (r + 1)-th singular value must be at least as large as the smallest non-zero singular value of R:
Proof of Proposition 5.1
Proposition D.3 (Lower Bound of Universal Spoofing, Restatement of Proposition 5.1). Let W, W′ ∈ Rd1 ×d2 be two weight matrices, where W has rank k1 and W′ has rank k2 , with k1 > k2 . Let the low-rank adaptation (LoRA) matrices be A ∈ Rd1 ×r and B ∈ Rr×d2 , where r < k1 − k2 . Define the adapted weight matrix c := W′ + AB and the residual matrix as as W R := W − W′ . For any input vector x ∈ Rd2 , the following lower bounds hold: 1. Spectral Norm:
+ σr+1 (R) ≥ σmin (R).
(5)
Combining the Eq. (3), Eq. (4) and Eq. (5) above, we obtain the desired result: c 2 ≥ σ + (R), inf sup ∥Wx − Wx∥ min
c 2 ≥ σ + (R), inf sup ∥Wx − Wx∥ min
A,B ∥x∥2 =1
A,B ∥x∥2 =1
which finishes the proof for the spectral norm case. Part 2. Frobenius Norm. We consider the LHS of the Frobenius norm bound and have the following:
2. Frobenius Norm: c 2 ≥ (k1 − k2 − r) · σ + (R)2 , inf ∥W − W∥ F min
A,B
c 2 = inf ∥R − AB∥2 inf ∥W − W∥ F F
+ where σmin (R) denotes the smallest non-zero singular value of R.
A,B
A,B
=
min rank(X)≤r
∥R − X∥2F
rank(R)
Proof. Part 1. Spectral Norm. We first consider the LHS of the spectral norm bound without taking
=
X i=r+1
18
σi2 (R)
2 = Ex∼Dq ∥R(UU⊤ − Ur U⊤ r )x∥2 2 d2 X x , uj u⊤ = Ex∼Dq R j
+ ≥ (rank(R) − r)σmin (R)2 + ≥ (k1 − k2 − r)σmin (R)2 ,
where the first step is from the definition of R, the second step is from the fact that AB is of rank r, the third step is from part 2 of Corollary D.2, the fourth step is from the fact that all terms in the + summation are at least σmin (R)2 , and the last step is from the fact on rank(R) ≥ k1 − k2 . Thus, we complete the proof. D.3
j=r+1
c and where the first step is from the definition of W R, the second step is from choosing a specific AB, the third step is from the orthogonality of eigenvectors, and the last step is from expanding the matrix into eigenvector outer products and eliminating the first r terms. P2 For simplicity, let Q := dj=r+1 uj u⊤ j . Applying the trace identity for expected quadratic forms in Fact D.4, we have: c 2 = Ex∼D ∥RQx∥2 Ex∼Dq ∥Wx − Wx∥ q 2 2
Proof of Theorem 5.2
To prove this upper bound, we first present a useful fact. Fact D.4 (Folklore). For a zero-mean stochastic vector x with covariance matrix M := E[xx⊤ ] and any constant matrix A, we have:
= tr(RQΣQ⊤ R⊤ ).
E[(Ax)(Ax)⊤ ] = AMA⊤ .
Since eigenvectors form an orthonormal basis, we expand and collapse the inner product QΣQ⊤ as follows:
Now, we show the upper bound under the simple query distribution setting.
QΣQ⊤
Theorem D.5 (Upper Bound under Low-Effective-Rank Distributions, Restatement of Theorem 5.2). Let x ∈ Rd2 be the representation of a query drawn from a zero-mean continuous distribution Dq , and let Σ := Ex∼Dq [xx⊤ ] be the covariance matrix. Let λ1 ≥ λ2 ≥ · · · ≥ λd2 ≥ 0 denote the eigenvalues of Σ. Let the LoRA matrices be A ∈ Rd1 ×r and B ∈ c := Rr×d2 , and the adapted weight matrix be W ′ W + AB. The optimal expected spoofing error is bounded by the following: 2 c inf Ex∼Dq ∥Wx − Wx∥ 2 ≤ ∥R∥2
2
A,B
d2 X
2
=
d2 X
! uj u⊤ j
j=r+1
=
d2 X
d2 X
d2 X
! λi ui u⊤ i
i=1
! uk u⊤ k
k=r+1
λi ui u⊤ i ,
i=r+1
where the second step follows from the orthogonality condition u⊤ j ui = 1 if i = j and 0 otherwise. Finally, we substitute this collapsed term back into the trace to bound the expected error: c 2 Ex∼D ∥Wx − Wx∥ 2
q
⊤
⊤
= tr(RQΣQ R )
λi ,
i=r+1
= tr R
where R := W − W′ is the residual matrix.
d2 X
! λi ui u⊤ i
i=r+1
Proof. Let Σ = Ex∼Dq [xx⊤ ] have eigendecomposition Σ = ULU⊤ with L = diag(λ1 , . . . , λd2 ) and λ1 ≥ λ2 ≥ · · · ≥ 0. Choose Ur ∈ Rd2 ×r as the first r eigenvectors. Construct
=
d2 X
⊤ λi tr(Rui u⊤ i R )
i=r+1
=
AB = RUr U⊤ r ,
d2 X
⊤ λi tr(u⊤ i R Rui )
i=r+1
=
which has rank at most r and thus can be factored as AB. For this choice, we have the following: c 2 Ex∼Dq ∥Wx − Wx∥ 2 = Ex∼Dq ∥(R − AB)x∥22 2 = Ex∼Dq ∥R(I − Ur U⊤ r )x∥2
d2 X
λi ∥Rui ∥22
i=r+1
≤
d2 X
λi ∥R∥22 ∥ui ∥22
i=r+1
= ∥R∥22
d2 X i=r+1
19
λi ,
! R⊤
where the third step follows from the linearity of the trace operator, the fourth step follows from the cyclic property of the trace, the fifth step follows from the definition of the ℓ2 norm, the fifth step follows from the fact that ∥Rui ∥2 ≤ ∥R∥2 ∥ui ∥2 , and the final step follows from the fact that eigenvectors are unit vectors (i.e., ∥ui ∥2 = 1). Taking the infimum over all parameterizations of A and B can only yield an expected error less than or equal to this specific construction. Therefore, the upper bound holds, completing the proof. D.4
=
Lemma D.6 (A Variant of the Eckhart-Young Theorem). Let A ∈ Rd1 ×d2 and C ∈ Rd1 ×d1 . Let the singular value decomposition Ppof the product matrix CA be given by CA = i=1 σi ui vi⊤ , where p = min(d1 , d2 ) and σ1 ≥ σ2 ≥ · · · ≥ 0. For k < p, let (CA)k := Pk any integer ⊤ i=1 σi ui vi denote the rank-k truncated singular value decomposition of CA. Then, the minimum achievable approximation error under the spectral norm is:
meaning the sum of their dimensions exceeds the ambient space Rd2 . Therefore, their intersection must be non-trivial:
Proof. Part 1. Existence. We show that there exists a rank-k matrix B such that ∥CA−CB∥2 = σk+1 (CA). Because the product matrix CA is formed by linear combinations of the columns of C, its column space is restricted: col(CA) ⊆ col(C). Furthermore, its truncated SVD is built from its principal directions, meaning col((CA)k ) ⊆ col(CA). Since col((CA)k ) ⊆ col(C), the linear equation CX = (CA)k is consistent. We can construct a specific solution using the Moore-Penrose pseudoinverse: let B∗ = C+ (CA)k . This satisfies CB∗ = (CA)k . Furthermore, because the rank of a product cannot exceed the rank of its factors, rank(B∗ ) ≤ rank((CA)k ) ≤ k. We now consider this specific valid rank-k matrix B∗ and compute the approximation error:
span{x1 , . . . , xd2 −k } ∩ span{v1 , . . . , vk+1 } ̸= {0}. Let z be a unit 2-norm vector (i.e., ∥z∥2 = 1) in this intersection. Since z ∈ null(Y), we have Yz = CBz = 0. Furthermore, since z ∈ Vk+1 , applying CA to z yields: (CA)z =
=
i=1
σi ui vi⊤ −
i=1
k+1 X
σi (vi⊤ z)ui .
(6)
i=1
We can now lower-bound the spectral norm for any choice of B: ∥CA − CB∥22 ≥ ∥(CA − CB)z∥22 = ∥(CA)z − 0∥22 =
∥CA − CB∗ ∥2 = ∥CA − (CA)k ∥2 k X
2
(d2 − k) + (k + 1) = d2 + 1 > d2 ,
∥CA − CB∥2 = σk+1 (CA).
p X
,
which follows from basic algebra. Because the remaining singular values are ordered σk+1 ≥ σk+2 ≥ . . . , the spectral norm of this residual matrix is exactly the largest remaining singular value. Thus, ∥CA − CB∗ ∥2 = σk+1 (CA). Part 2. Optimality. We show that no matrix B with rank at most k can achieve a lower error value than σk+1 (CA). Suppose rank(B) ≤ k for some arbitrary matrix B ∈ Rd1 ×d2 . Let Y = CB. By the properties of matrix multiplication, rank(Y) ≤ rank(B) ≤ k. Because Y has d2 columns and rank at most k, its null space has a dimension of at least d2 − k, which follows from the rank-nullity theorem. It follows that we can find orthonormal vectors x1 , . . . , xd2 −k such that null(Y) = span{x1 , . . . , xd2 −k } via the Gram-Schmidt process. Let Vk+1 := span{v1 , . . . , vk+1 } be the (k + 1)-dimensional subspace spanned by the top right singular vectors of CA. A dimension argument shows that:
To show the tight bound under the weak classifier setting, we first prove a variant of the EckhartYoung Theorem.
rank(B)≤k
σi ui vi⊤
i=k+1
Proof of Theorem 5.3
min
p X
k+1 X
2
σi (vi⊤ z)ui
i=1
σi ui vi⊤
=
k+1 X i=1
2
20
σi2 (vi⊤ z)2
2
2 ≥ σk+1
k+1 X (vi⊤ z)2
We now apply Lemma D.6, substituting C with C⊤ , A with R, and the rank constraint k with r. This yields exactly:
i=1 2 = σk+1 ∥z∥22
min
2 = σk+1 ,
rank(X)≤r
(9)
where the sixth step follows from the fact that z ∈ span{v1 , . . . , vk+1 }, and other steps follows from definitions and basic algebra. Taking the square root of both sides yields ∥CA − CB∥2 ≥ σk+1 (CA), completing the proof.
Combining Eq. (7), Eq. (8), and Eq. (9) completes the proof.
Based on the lemma above, we show the tight bound as follows. Theorem D.7 (Tight Bound under Weak Classifiers, Restatement of Theorem 5.3). Let C ∈ Rd1 ×d1 be a weight matrix from the auditor’s verification model, and let W, W′ ∈ Rd1 ×d2 be the weight matrices of the strong target model and the weak surrogate model, respectively. Let the LoRA matrices be A ∈ Rd1 ×r and B ∈ Rr×d2 , and the adapted weight matrix be c := W′ + AB. Under the audit, the worstW case spoofing error is exactly: ⊤ c inf sup ∥C⊤ (Wx − Wx)∥ 2 = σr+1 (C R),
A,B ∥x∥2 =1
where R = W − W′ is the residual matrix, and σr+1 (·) is the (r + 1)-th largest singular value. c and R, and the defiProof. By the definition of W nition of the matrix spectral norm, we first rewrite the worst-case spoofing error: c inf sup ∥C⊤ (Wx − Wx)∥ 2
A,B ∥x∥2 =1
= inf ∥C⊤ R − C⊤ AB∥2 . A,B
(7)
Because the LoRA matrices A ∈ Rd1 ×r and B ∈ Rr×d2 are bottlenecked by their inner dimension r, their product AB forms a matrix of rank at most r. Conversely, any d1 × d2 matrix with a rank of at most r can be exactly factored into the product of two such matrices A and B. Therefore, taking the infimum over the parameter space of A and B is mathematically equivalent to minimizing over all possible matrices X of rank at most r: inf ∥C⊤ R − C⊤ AB∥2
A,B
=
min rank(X)≤r
∥C⊤ R − C⊤ X∥2 .
∥C⊤ R − C⊤ X∥2 = σr+1 (C⊤ R).
(8) 21