Spectral fingerprinting identifies large language model ownership robustly
Model-intrinsic, Weight-level, and Training-free Spectral Fingerprinting for Large Language Models
Cryptography and Security
Summary
It can be important to prove who made a large language model (LLM) when models get shared or changed. The authors found a new way to create a kind of digital fingerprint directly from the model’s internal weights using mathematical patterns called spectra. This fingerprint works without needing to test the model with special questions or inputs, and it stays reliable even if the model is fine-tuned or changed a bit. This helps to track and check model origins more easily and safely.
What this means in practice
- •For ai security teams: Verify the origin of large language models offline without relying on model outputs or query setup.
- •For model deployment teams: Detect and audit LLM versions even after common modifications like tuning or compression.
Authors
Yanan He, Yanli Chen, Ling Xiong, Gejian Zhao, Hanzhou Wu
Abstract
The increasing release and reuse of Large Language Models (LLMs) as open-weight checkpoints make model fingerprinting important for ownership protection and offline auditing. Existing fingerprinting methods typically construct evidence from query responses, generated outputs, or input-induced activations. Although effective in representation-based settings, they can be affected by prompt selection, decoding configuration, inference environment, and forward-pass implementation, which may limit their applicability. Here we introduce a model-intrinsic weight-level framework that derives compact fingerprints from spectral structures encoded in LLM parameters. Specifically, the framework constructs GATE spectral scalar features from the singular-value distributions of GATE projection weights in gated feed-forward networks (FFNs), and aggregates the resulting layer-wise features through depth-wise segmented pooling to form a model-level fingerprint. Such representation preserves coarse layer-depth organization while reducing dependence on strict layer-to-layer alignment, enabling comparison across LLMs with different depths. The similarity between fingerprints is computed by linear centered kernel alignment. The entire pipeline is training-free and does not require input samples, generated outputs, forward activations, or an auxiliary verifier. Experiments on representative LLM families and post-training variants have demonstrated a clear separation between source-related models and unrelated ones, and stable similarity under instruction tuning, quantization, pruning, and distillation-related modifications, which verify that spectral features are robust evidence for LLM fingerprinting.