From Bits to Beliefs: Recoverable Semantic Fingerprints for Black-Box Verification of Large Language Models
SimPrint embeds recoverable semantic fingerprints in open-weight LLMs, enabling black-box ownership verification that survives fine-tuning, pruning, quantization and merging.
The paper proposes encoding a private owner signature across natural binary question-answering probes, implanted via low-interference batch updates that preserve the original model's behavior. Verification parses suspect-model responses into bits or erasures with an error-correcting recovery mechanism, requiring only input-output access. Experiments on three open-weight LLMs show reliable signature recovery in clean and modified settings, including fine-tuning, pruning, quantization, model merging and serving-time perturbations, with comparable downstream utility.
- Signature spread across binary QA probes resists fine-tuning, pruning, quantization and merging
- Low-interference batch update preserves original model behavior while implanting probes
- Error-correcting recovery enables black-box verification without weight or activation access
From the original article
1 min read at arxiv.orgOpen-weight large language models (LLMs) can be copied, modified, and redeployed behind black-box APIs, making post-release ownership verification difficult. Existing black-box fingerprints often rely on secret query-key pairs that reproduce predefined responses, and can therefore be easily disrupted by fine-tuning, pruning, quantization, model merging, and serving-time prompt changes.
By Jiaxin Hong · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.