Auditing Data Provenance in LLM Fine-tuning via Intrinsic Distributional Fingerprints
2026-08-03 • Artificial Intelligence
Artificial Intelligence
AI summaryⓘ
The authors address the problem of unauthorized use of proprietary data when training large language models. They propose a method called Distribution Provenance Audit (DPA) that checks if a model was fine-tuned on certain data by looking at consistent patterns that combine word choice and meaning, which remain even if someone tries to hide the data use. DPA works after the model is trained and uses statistical tests on the model's outputs to detect data usage reliably. Their tests on medical and legal models show DPA is better than previous methods and can handle attempts to obscure the data. However, the authors also note that these detection patterns could be misused to attack data privacy.
Large Language ModelsData Intellectual PropertyFine-tuningData ParaphrasingKnowledge DistillationStatistical Hypothesis TestingSemantic and Lexical IntersectionBlack-box AuditPrivacy AttacksDistributional Fingerprints
Authors
Zirui Huang, Yunlong Mao, Wei Tong, Tingting Wu, Xin Ge, Sheng Zhong
Abstract
The proliferation of customized Large Language Models (LLMs) poses critical risks of Data Intellectual Property (Data IP) infringement via unauthorized fine-tuning on proprietary data. Existing audit techniques are limited, as they require intervention during data preparation or training and remain fragile under malicious obfuscations such as data paraphrasing and knowledge distillation. We propose \textit{Distribution Provenance Audit (DPA)}, a post-hoc framework for auditing data IP infringement in LLM fine-tuning under black-box and malicious settings. DPA is grounded in a critical insight: regardless of fine-tuning tactics to evade provenance, the practical necessity of maintaining utility constrains the model to preserve the fundamental intersection of semantic substance and lexical form. Accordingly, DPA captures this persistent lexical-semantic intersection as intrinsic distributional fingerprints. The framework formulates the audit as a statistical hypothesis test, effectively quantifying these fingerprints via unbiased output sampling to reliably reject the null hypothesis of non-usage. Extensive experiments on medical and legal fine-tuning tasks show that DPA consistently outperforms existing baselines, remaining robust against adversarial trainers employing paraphrasing and knowledge distillation. We further highlight a fundamental dual-use tension: the same high-fidelity distributional fingerprints enabling reliable auditing may also facilitate privacy attacks.