From Bits to Beliefs: Recoverable Semantic Fingerprints for Black-Box Verification of Large Language Models
SimPrint embeds recoverable semantic fingerprints in open-weight LLMs, enabling black-box ownership verification that survives fine-tuning, pruning, quantization and merging.
The paper proposes encoding a private owner signature across natural binary question-answering probes, implanted via low-interference batch updates that preserve the original model's behavior. Verification parses suspect-model responses into bits or erasures with an error-correcting recovery mechanism, requiring only input-output access. Experiments on three open-weight LLMs show reliable signature recovery in clean and modified settings, including fine-tuning, pruning, quantization, model merging and serving-time perturbations, with comparable downstream utility.
- Signature spread across binary QA probes resists fine-tuning, pruning, quantization and merging
- Low-interference batch update preserves original model behavior while implanting probes
- Error-correcting recovery enables black-box verification without weight or activation access
Full article174 words · extracted from arxiv.org · click to collapse
Open-weight large language models (LLMs) can be copied, modified, and redeployed behind black-box APIs, making post-release ownership verification difficult. Existing black-box fingerprints often rely on secret query-key pairs that reproduce predefined responses, and can therefore be easily disrupted by fine-tuning, pruning, quantization, model merging, and serving-time prompt changes. We propose SimPrint, a recoverable semantic fingerprinting framework for black-box LLM ownership verification. Rather than relying on isolated exact matches, SimPrint encodes a private owner signature into a coded semantic fingerprint domain, distributing ownership evidence across natural binary question-answering probes. It implants only base-deviating probes through a low-interference batch update that preserves the original model behavior, and later recovers the signature by parsing suspect-model responses into reliable bits or erasures with an error-correcting recovery mechanism. Because verification only uses input-output queries, SimPrint remains applicable when model weights or activations are inaccessible. Experiments on three open-weight LLMs show that SimPrint reliably recovers the owner signature in both clean and modified settings, remains robust under fine-tuning, pruning, quantization, model merging, and serving-time perturbations, and maintains comparable downstream utility.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.24084