Your "Pro" LLM Subscription May Actually Be "Free": Exposing Fingerprint Spoofing Risks in LLM Inference Services
2026-06-15 • Cryptography and Security
Cryptography and SecurityComputation and LanguageMachine Learning
AI summaryⓘ
The authors highlight a new way that bad providers can trick users trying to check which language model they are using. Usually, users use a method called fingerprinting to make sure they get the stronger model they paid for, but the authors show that weaker models can be subtly changed to look like stronger ones and fool these checks. They created an attack called GhostPrint, which helps weak models imitate strong ones cheaply and reliably, even when users try to verify the model repeatedly. This reveals an important weakness in how people currently try to confirm the authenticity of language models.
Large Language Model (LLM)APIFingerprintingFingerprint SpoofingParameter-Efficient Fine-TuningSurrogate ModelingKnowledge DistillationReward-Ranked Fine-TuningModel Verification
Authors
Jiahao Zhang, Xiuyu Li, Suhang Wang
Abstract
As Large Language Model (LLM) APIs become ubiquitous, users increasingly rely on black-box fingerprinting to verify that providers are serving the advertised premium models. However, these methods may overlook adversarial providers who manipulate model weights to cheat the fingerprint process. We introduce a novel threat termed fingerprint spoofing, where a malicious provider stealthily serves a weaker model that has been parameter-efficiently fine-tuned to mimic a stronger model, thereby evading user-side fingerprinting. We first formally prove that user-side resource constraints (i.e., finite query budgets and weak fingerprinting classifiers) make current fingerprinting vulnerable to fingerprint spoofing. Guided by this theoretical analysis, we propose GhostPrint, a cost-effective attack framework leveraging surrogate modeling, reward-ranked fine-tuning, and knowledge distillation. Extensive evaluations in both static and continual fingerprinting settings demonstrate that GhostPrint allows weak models to consistently bypass representative fingerprint methods while maintaining utility at a low fine-tuning cost, exposing a critical vulnerability in current LLM fingerprinting pipelines.