Large language models tracked by tracking how their knowledge changes
From Representations to Computational Trajectories: Intrinsic Fingerprinting for Large Language Model Provenance Verification
Cryptography and Security
Summary
It can be hard to tell if a large language model (LLM) is the original or a copy that was changed without permission. The researchers offer a new way to create a unique “fingerprint” for each model by looking at how its understanding changes layer by layer, rather than just its stored information or output. This fingerprint stays reliable even if the model gets updated, trimmed, or mixed with others. Their method uses very little storage and works better than previous ways at telling models apart.
What this means in practice
- •For model developers: Confirm ownership and detect unauthorized changes to large language models by verifying fingerprints tied to their internal processing steps.
- •For cybersecurity teams: Protect large language models from tampering by recognizing unique fingerprints resilient to common model alterations and attacks.
Authors
Haiyong Tang, Hanzhou Wu, Xinpeng Zhang, Athanasios V. Vasilakos
Abstract
Large language models (LLMs) are valuable digital assets, yet their weights can be easily modified after unauthorized acquisition, making model provenance difficult to verify. Model fingerprinting provides a promising solution for model ownership protection without modifying the model or embedding ownership information. However, parameter-based fingerprints can be sensitive to model transformations, limiting their robustness, while representation-based fingerprints may assign high similarity to unrelated models, limiting their uniqueness. To address these limitations, we propose TrFP, an intrinsic fingerprinting method based on computational trajectories. Instead of comparing model parameters or representations, TrFP captures how representations evolve across network depth and constructs compact fingerprints using permutation-invariant trajectory descriptors. Experiments across multiple LLM families show that TrFP reliably distinguishes related and unrelated models. It also remains robust under fine-tuning, pruning, quantization, model merging, parameter permutation, and adaptive attacks, while requiring less than 0.3 MiB of fingerprint storage. Overall, TrFP provides stronger provenance discrimination than several existing state-of-the-art methods, demonstrating the effectiveness of computational trajectories for reliable LLM provenance verification.