REEF: Representation Encoding Fingerprints for Large Language Models
Authors: Jie Zhang
Dongrui Liu
Chen Qian
Linfeng Zhang
Yong Liu
Yu Qiao
Jing Shao
Venue: ICLR 2025 Oral (2025)
Keywords: Large Language Model
Fingerprint
Representation
Intellectual Property
Primary area: foundation or frontier models, including LLMs

Abstract: Protecting the intellectual property of open-source Large Language Models (LLMs) is very important, because training LLMs costs extensive computational resources and data. Therefore, model owners and third parties need to identify whether a suspect model is a subsequent development of the victim model. To this end, we propose a training-free REEF to identify the relationship between the suspect and victim models from the perspective of LLMs' feature representations. Specifically, REEF computes and compares the centered kernel alignment similarity between the representations of a suspect model and a victim model on the same samples. This training-free REEF does not impair the model's general capabilities and is robust to sequential fine-tuning, pruning, model merging, and permutations. In this way, REEF provides a simple and effective way for third parties and models' owners to protect LLMs' intellectual property together.  Our code is publicly accessible at https://github.com/AI45Lab/REEF.

Published as a conference paper at ICLR 2025
REEF: REPRESENTATION ENCODING FINGERPRINTS FOR LARGE LANGUAGE MODELS
Jie Zhangla, Dongrui Liu'r, Chen Qian Linfeng Zhang', Yong Liu', Yu Qiao', Jing Shao
1 Shanghai Artificial Intelligence Laboratory 2 University of Chinese Academy of Sciences
3 Renmin University of China Shanghai Jiao Tong University
ABSTRACT
Protecting the intellectual property of open-source Large Language Models (LLMs) is very important, because training LLMs costs extensive computational resources and data. Therefore, model owners and third parties need to identify whether a suspect model is a subsequent development of the victim model. To this end, we propose training-free REEF to identify the relationship between the suspect and victim models from the perspective of LLMs' feature representa- tions. Specifically, REEF computes and compares the centered kernel alignment similarity between the representations of a suspect model and a victim model on the same samples. This training- feining--fre REEF does not impair the model's general capabilities and is robust to sequential fine-tuning, pruning, model merging, and permutations. In this way, REEF provides a simple and effective way for third parties and models' owners to protect LLMs' intellectual property together. Our code is publicly accessible at /attps://gitie www/AI40oaaa REEF
INTRODUCTION
The training process of Large Language Models (LLMs) requires extensive computational re- sources and time. Therefore, open-source models usually released with specific licenses (e.g., Apache2.0, and LLaMA 2 Community License (Meta Al 2023)) to protect their intellectual prop- erties (IPs). Unfortunately, some developers claim have trained their own LLMs but actually wrapped or fine-tuned based on other base LLMs (e.g.. Llama-2 and MiniCPM-V) (OpenBMBB 2023 01-ai 2023). It is urgent for model owners and third parties identify whether the suspect model is subsequent development of the victim model that serves the root origin (e.g., Code- laaa trained from Llama-2) or is developed from scratch (e.g.. Mistral).
The key is to extract unique features (i.e., fingerprints) that can authenticate the victim model. Wa- termarking methods artificially inject triggers into the victim model to make generate specific content for identification (Peng et al. 2023a Xu et al. 2024). However, watermarks introduce extra training costs and impair the model's 's general capabilities (Russinovich & Salem, (024). or even can be removed (Wang & Kerschbaum 2019 Chen al. 2023a). More crucially, these methods can not be applied to models that have already been open-released. An alternative is to extract in- trinsic features of the victim model, avoiding additional training and the compromise of capabilities. Weight-basee based fingerprints are one of intrinsic features that allow calculating the similarity between a suspect model and victim model's weights for identification (Zeng et al. [0223] Refael al. (024). However, these methods are fragile to major changes in weights, e.g., weight permutations, pruning, and extensive fine-tuning (Fernandez al. 2024 Xu et al., 2024). This necessitates extracting more robust intrinsic features as fingerprints to identify victim models and protect their IPs.
In this paper, we propose solve this problem from the perspective of the feature representations of I.LMs, beginning with the following visualization analysis. It is generally skknowledged that differ- ent models encode informative and intrinsic features based on their training data and model archi- tecture, resulting in distinct feature representations across models (Mikolov et al. [0033] Bolukbasi (ct al. 2016 Karras et al. 2021: Chen et al. 2023b; Zou et al., 2023; Dang et al. 2024). Figure a[a)
illustrates that the representations of Llama are markedly distinct from those of Baichuan and Qwen, while largely comparable to its mne-tuned models (i.e., Llama-chat and Chinese-llamal
Equal contribution
Corresponding author

---

Published as a conference paper at ICLR 2025
Liama 2
Liama-2-cha
0,8412
0,8223
0,8066
1.0
Vicuna-1.3
0.8
Baichuun Owen-1.5
0.8
KEEF ICS
Acqurcyy
Similarity
0.6
random
0:67
0.5
0.4122
0.2
-80
0.4
Victim
Fine-taned Victm LLM
Unrelated LLMs
0.0
Fine-tuning
Pruming
Merging
Permutation
(a)
(b)
(c)
Figure (a) I-SNE visualization of different LLMs' representations on the same samples. (b) Performance of classifiers trained on representations from the victim model evaluated on suspect models. (c) Robustness of REEF under variant LLMs that cause ICS (Zeng et 2023 ineffective.
Such findings inspire to construct representation-basee fingerprints. Specifically, we apply neural networks to extract fingerprints of a victim model from its representation space. Figure [[bb shows that the classifier trained representations of victim model (i.e., Llama) can be generalized to its variant models (e.g., Llama-chat and Vicuna), but fail to other models (e.g., Baichuan and Qwen). Although the effectiveness of representation-baase fingerprints has been validated, such fingerprints still have limitations. On one hand, the input dimensions of neural networks are fixed, making them inapplicable model pruning that alters the representation dimensions of the victim model (Frantar & Alistarh 2023 Xia et al. 2023] 2024), which is prevalent in scenarios such as model compression for deployment on mobile devices. On the other hand, these fingerprints lack robustness against representation permutations, a challenging issue because developers may intentionally manipulate model representations to evade detection (Zeng et al. 2023 Refael al., 2024).
To this end, we propose simple and effective approach, namely REEF, which is robust against pruning and evading detection. Specifically, REEF a representation that compares the Centered Kernel Alignment (CKA) similarity (Kornblith et al. (2019) between the representations the same samples from a suspect model and a victim model that serves as the root origin. Experimental results indicate that models derived from the victim model exhibit high similarity. Moreover, REEF is resilient to dimensional changes, and we theoretically prove that CKA invariant column-wise permutations and scaling transformations. Figure (c) demonstrates that REEF maintains its effectiveness even under extreme conditions that cause weight- methods (Zeng et al., 2023) ineffective. These conditions include extensive fine-tuning (using data with up to 700B tokens (Azerbayev et al. 2023)), high ratio pruning (up to 90% of parameters (Ma et al., 2023 model merging (LLMs with different architectures (Wan et al. (024a)), and permutations (parameter vector direction change through weight rearrangements (Fernandez et al. 2024)).
fingerprinting method
REEF utilizes the intrinsic feature from the perspective of representations identify whether suspect model is derived from root victim model under the white-bor box scenario. This training- free REEF does not impair model's general capabilities and is robust to various subsequent developments compared to weight- based fingerprints and watermarks. Consequently, REEF is promising method for protecting the IPs of model owners and provides an efficient and effective way for third parties to review models, combating unethical or illegal activities such as unauthorized use or reproduction.
2 RELATED WORK
Model fingerprinting protects IPs by allowing model owners and third parties to authenticate model ownership. There are two types of fingerprints for LLMs. One is injected fingerprints. which are ar- tificially added during training or fine-tuning to facilitate model identification, such watermarking methods (Peng et al. 2023a Xu et al. 2024). The other intrinsic fingerprints, which are inherent properties that naturally emerge from the models" training data and architectures, including model weights (i.e., parameters) and feature representations, also known as embeddings or activations.
Injected Fingerprint. Watermarking methods inject backdoor trigger into victim model, caus- ing to produce specific outputs when the trigger is present. This allows for identifying whether suspect model derives from the victim model. Many approaches embed the watermarks through
2

---

Published as a conference paper at ICLR 2025
backdoor attacks (Adi et al. 2018 Zhang et al. 2018 Li et al. 2019b), and digital signature tech- nology and hash functions (Guo & Potkonjak, 2011 Li et al. 2019a: Zhu et al. 2020) are also used to design trigger words that contain the owner's identity information protect the IPs of DNNs. For L.MMs, the high computational and time costs of training pose an urgent need to protect their IPs. Re- searchers propose various methods inject watermarks fingerprints to identify the victim model
(Li ct al., 2023 Peng et al. 2023b; Kirchenbauer et al., [2023] Zhao et al. 2023) Russinovich &
Salem 2024 Xu et al. 2024 but such methods inevitably impair the model's 's overall performance.
Intrinsic Fingerprint. Such fingerprints use the inherent and native attributes of the victim model, without requiring additional tuning which could impair the model's general capabilities, and more stable and can not be removed. Model weights are one of the intrinsic features that can be used to compute the similarity of parameters between suspect model and victim model for identifica- tion (Zeng et al., 2023 Refael et al. 2024). Semantic analysis methods conduct statistical analysis on the content generated by different models, exploiting the linguistic patterns and semantic prefer- ences exhibited by various LLMs as their unique fingerprints (Iourovitski et al.) [024 Pasquini et al.) McGovern et al.) 2024). However, both methods suffer from insufficient robustness (Xu et al., The internal representations of LLMs are derived from the data, strategies, and frameworks used during the training process, and serve as intrinsic features for model identification (Sevast- janova et al.) 2022). For example, the logits space can be leveraged to identify the victim model Yang & Wu 2024).. However, this approach remains highly sensitive to parameter permutation, posing significant challenges for effective fingerprinting.
2024
2024
3 EXPLORING THE POTENTIAL OF FEATURE REPRESENTATIONS AS FINGERPRINTS
In this section, we propose utilize feature representations as LLM fingerprints identify whether a suspect model is subsequent development of the victim model in white-box scenario, based on the following two observations. (1) Feature representations of fine-tuned victim models are similar to feature representations of the original victim model, while the feature representations of unrelated models exhibit distinct distributions, as shown in Figure T [). (2) Some high-level semantic concepts are "linearly" encoded in the representation space of LLMs and can be easily classified, such as safety or unsafety and honest or dishonest (Zou et al.] 2023, [llobokkin et al.. 2023] Qian et al.) 2024b Lu et al., 2025). According to these two observations, we can train binary classifier on the representations of the victim model and then apply it to various suspect models' representations, i.e., LLMs derived from the victim model and unrelated LLMs. In this way, such classifier may generalize to different fine-tuned victim models, because they have similar feature representations.
The binary classifier can employ various Deep Neural Network (DNN) architectures, such lin- ear classifier, Multi-Layer Perceptron (MLP), Convolutional Neural Network (CNN), and Graph Convolutional Network (GCN). For training, we use the TruthfulQA dataset (Lin et al. 2022). con- catenating each question with its truthful answer as positive samples and with its false answer as negative samples. The dataset is split into training and test sets with a 4:1 ratio. To evaluate the classifier's ' performance, we conduct experiments on LLMs of varying sizes. Specifically, we select Alama-2-7b and Llama-2-133 1-3 as the victim models, while derived models and unrelated LLMs serve as suspect models for comparison.
Classifiers trained on representations of vietim model can effectively generalize to its vari- ants but not to others. Figure shows that a classifier trained on the 18th layer representation of Llama-2-76 achieves approximately 80% classification accuracy when applied to its fine-tuned models (e.g., Chinese-llama-227b) However, the accuracy drops to around 50% on unrelated models M.stral-O. 1-7b), which close to the level of random guessing. Classifiers trained on represen- tations from other layers show the same results, as discussed in Appendix B Additionally, similar findings are observed for Llama-2- 13b FFigure[bb) indicating the scalability of the representation- based fingerprints. These experimental results indicate that representations can serve fingerprints to protect the victim model's IP.
Challenges to using the classifier for victim model identification: (1) DNNs have fixed input dimensions and cannot be applied to models pruned from the victim model, egg., reducing repre- sentation dimensions. For example, the pruned models Sheared-llama-I 1 1.3b and Sheared- 1aaa-
3

---

Published as a conference paper at ICLR 2025
Li7ma-2-76
1ama-22115
Liuma-2/7b-chtt Vicuna-1.5-70
Xxwinim-022779
Chinese -lama-2-7
Clmm--2113
1.513- Xwinim-02-133 Chinese-lama-221B
Mistral-0.176
Qwee-115-7
Internim-76
Duichum 2-76
Plamo-133 13b
Qwenn-1.5 1:5-44b
Internim 206
1sichuun-2-138
0.8-
0.8-
Accurncy
0.7-
0.7
0.6-
0.6
0.5-
0.5
0.4
0.4
Linear
MLP CNN
GCN
Linear
MLP
CNN
GCN
(a)
(b)
Figure 2: Accuracies of classifiers trained on representations from the victim model: (a) Llama-2-7b the victim model, (b) Llama-2-13b as the victim model.
have dimensions of 2048 and 2560, respectively (Xia al. 2024). However, the classifier trained on Llama-2-7b can only process inputs of 4096 dimensions. (2) DNNs are not robust to permutations of the input feature representations, such as when columns are permuted through coupled matrix multiplications, which malicious developers might use to evade detection (Fernandez et al. 2024).
4 ROBUST REPRESENTATION-BAL
FINGERPRINTING WITH REEF
To address the challenges of classifiers in victim model identification, we propose REEF, an ad- vanced representation-bassee fingerprinting approach for open-souree LLMs that can adapt to suspect models with varying representation dimensions and is robust to representation permutations.
REEF identifies whether suspect model is derived from root victim model, given the representa- tions of these two models on certain examples. Specifically, let X E RmxpI denote activations of the [-th layer from the suspect model on m examples and E R= denotes activations of the -th layers from the victim model on same examples, where P1 is independent of p2, meaning there no limitation on dimensional consistency. Therefore, we need a similarity index s(.,)) to mea- sure representations' similarity between the suspect and victim models. this way, high s(X, Y) score indicates that the suspect model is more likely derived from the victim model. In contrast, low s(X, Y) score means that the suspect model is less likely derived from the victim model.
Centered Kernel Alignment. CKA (Komblith et al., 2019) is a similarity index based on Hilbert- Schmidt Independence Criterion (HSIC) (Gretton al. (2005), which measures the independence between two sets of random variables. The CKA similarity between X and Y can be computed as follows
HSIC(X, Y)
CKA(X,Y) V /HSIC(X, X) HSIC(Y,Y)
where HSIC(X, In- H). Specifically, H = 111 is centering matrix. Kx and Ky are Gram matrices that measure the similarity of pair of examples based kernel function k, Le., (Kx); )i= = k(X,, X;) and (Ky) = k(Y,, Y₁). X; and X, denote the i-th and j-th row of X, respectively.
Kernel Selection. In this study, we consider a linear kernel and a Radial Basis Function (RBF) kernel. In the linear kernel case, Gram matrix Kx = X In the RBF kernel case, k(X,, discover that linear and RBF kernels obtain similar
exp(-IIX, Xx,13 /lB (2o²)). Empirically, experimental results. Please see Section [.I for more discussions. Unless otherwise specified, we adopt linear CKA due to its high efficiency.
Theorem (Proof in Appendix A) Given two matrices X E Xpp and E Rmppp the CKA similarity score between X and Y is invariant under any permutation of the columns and column- wise scaling transformation. Formally, we have:
CKA(X,Y) (KA(XP, P1, YP,) CKA(e)X,c2))
4

---

Published as a conference paper at ICLR 2025
Vicuna-l.
Chinese-llamme---
Code-llann2-7
L.MM Derived from Vietim L.M
RGF Kemeel
Layer
Layer
Linor Kemel
CKA Similarity
Loyer
1.Iemm-2-7b
Ennse Konnd
Brichsen2-766
Owenel.S-70
Intenln-2-7b
Mistna-Tb
Falam-76
MPI-7b
Unrclated LLMs
Linar Kanal
Lopa
Layer
0.0
Layer
31
Laya
31
0
Laysr
31
Layer
51
Layer
31
Layas
Figure 3: Heatmaps depicting the CKA similarity between the representations of the victim LLM (Llama-2-7B) and those of various suspect LLMs the same samples.
where Pi Reixps and P2 E Rp2xp2 denote permutation matrices. Ci E RR+ and 02 R+ are two positive scalars.
Theorem I indicates that the CKA similarity score is theoretically invariant and robust to any column-wis wise permutations and scaling transformations. [Korbblihh al.] (2019) have shown that CKA is able to the correspondence between representations of different dimensions. Therefore, REEF highly robust to various subsequent developments of the victim model in practical scenar- ios, including model pruning and representation permutation, ensuring accurate identification of the victim model through representation-bat based fingerprints protect its IP.
EXPERIMENTS
In this section, we provide comprehensive evaluation of REEF. Section effectiveness in distinguishing LLMs derived from the root victim model from unrelated models. Following this, Section 5.2 assesses REEF's robustness to subsequent developments of the victim model, such as fine-tuning, pruning, merging, and permutations. Section 5.3 presents ablation stud- ies on REEF across varying sample numbers and datasets. Finally, Section 5.4 discusses REEF's sensitivity to training data and its capacity for adversarial evasion.
5.1 evaluates REEF's
5.1 EFFECTIVENESS VERIFICATION
In this subsection, we demonstrate that REEF can effectively model the fingerprint from the repre- sentation. The CKA similarity between the victim model's representations and those of its derived models, as well as unrelated models, shows significant differences. This makes REEF a reliable fingerprinting method for protecting the victim model's IP.
Settings. For the LLMs, we select Llama-2-7b as the victim model and choose range of suspect models, including quantization and fine-tuned variants of Llama-2-7b (e.g. Llama-2-7b-chat, Code- llama-7b, and 1lama-2-7b-4hh as well as unrelated models (e.g.. (wwe-11.5766 Baichuan-2-1 and Mistral-7b). We use both linear kernel and an RBF kernel compute the layer-wiss wise and inter-layer CKA similarity of representations between the victim and suspect models on 200 samples from the TruthfulQA dataset (Lin et al. 2022). The resulting heatmap shown Figure
3
REEF can accurately distinguish between models derived from the victim model and unrelated models. As shown in Figure for LLMs derived from the victim model, the CKA similarity with the victim model is high (higher than 0.8), whereas unrelated LLMs show low similarity (lower than 0.5). This is reflected in the marked color contrast between the first two rows and the third row. To quantify results, the average similarity of LLMs derived from the victim model is 0.9585, which is higher than that of unrelated LLMs, whose average similarity is 0.2361. Additionally, for LLMs derived from the victim model, the similarity is notably high along the diagonal of the heatmaps,
5

---

Published as a conference paper at ICLR 2025
which represents the similarity between corresponding layers of the victim and suspeet models, with an average of 0.9930. Furthermore, the inter-layer similarity is also significant, reaching 0.9707.
Linear and RBF kernels yield similar results in identifying whether suspect model is derived from the victim model. As shown in the first two rows Figure [3] the CKA similarity between the victim model and the LLMs derived from it, calculated using both the linear and RBF kernlls, exceeded 0.95. This demonstrates that both kernels are suitable for fingerprinting in REEF. We adopt the linear CKA due its higher computational efficiency.
CKA from a single layer is sufficient for fingerprint identification. The similarities between representations on specific layer of the victim model and those of the derived and unrelated models differ significantly (e.g., 0.9973 and 0.2223 for layer 18, respectively). Consequently, we focus on reporting the similarity layer 18 in subsequent experiments, due its informativeness and efficiency. The complete heatmap results are provided in Appendix
5.2 ROBUSTNESS VERIFICATION
In this subsection, we apply REEF to suspect models that developed from victim model through fine-tuning, pruning, merging, permutations, and scaling transformations (Appendix D provides REEF's application across more different LLM families, including Qwen and Místral). These tech- niques can introduce significant changes to the model's structure or parameters, making it challeng- ing for existing methods to identify the victim model. However, REEF remains effective in these scenarios, demonstrating its robustness.
5.2. BASELINE METHODS
Weight-based Fingerprinting Methods. Following Zeng al. (2023). we use model weight simi- larity methods, including PCS and ICS, to identify whether suspect model is derived from a victim model. Specifically, PCS flattens all weight matrices and biases of L.MM into vectors and directly compares the cosine similarity between these vectors for the two models. ICS constructs invariant terms from the weights of the last two layers and calculates the cosine similarity between these in- variant terms for the two models. A high cosine similarity indicates that the suspect model is derived from the victim model, and vice versa.
Representattinn-aasel Fingerprinting Methods. Yang & Wu (024). referring to the Logits method, implements LLM fingerprinting by analyzing unique attributes of each LLM''s logits output. This method evaluates the similarity between the output spaces of the victim and suspect models. A high similarity suggests that the suspect model is derived from the victim model. We conduct experiments the TruthfulQA dataset extract logit output for the suspect models.
5.2.2 FINE-TUNING
Xu et al. 2024) point out that weight-based fingerprints are not reliable when models undergo extensive fine-tuning with larger deviations in parameters. Given this challenge, seek assess the robustness of REEF under such demanding scenarios.
Settings. We use Llama-2-7b as the victim model and select diverse set of its fine-tuned models as suspect models, with fine-tuning (FT) data volumes ranging from million to 700 billion tokens. The suspect models include Llama-2-financ--bb. Vicuna-I.5-7b, Wizardmath-7b, Chinese-llama-2-
7b, Code-llama-765 bbb, and Alemma-7b. with each model's 's fine-tuning data volume being 5M, 370M,
1.8B, 13B, 500B, and 700B tokens, respectively (Chiang et al. 2023 Luo et al. 2023 Cui et al.)
2023
Roziere et al.
2023 Azerbayev et al. 2023).
REEF is robustness extensive fine-tuning, As shown Table even for models fine-tuned on datasets with up to 700B tokens (i.e., Llemma-7B), REEF still achieves a high similarity of 0.9962. In contrast, PCS becomes ineffective as early as fine-tuning with 1.8B tokens (i.e., Wizardmath-7b), ICS performance significantly degrades with increasing fine-tuning data volume, with 13B tokens and 500B tokens (i.e.,
yielding similarity of 0.4996 and 0.2550, respectively. Although the Logits method shows relatively less degradation, it still exhibits sensitivity to the volume of fine-tuning data. Notably, Logits method is particularly sensitive to changes in the vocabulary, e.g., Chinese-llama-2-7bh has expanded its vocabulary during fine-tuning.
(i.e., Chinese-llamat

---

Published as a conference paper at ICLR 2025
Table 1: Similarity of various LLM fingerprinting methods applied to suspect models developed through fine-tuning, pruning, merging, permutations, and scaling transformations, In this table, indicate similarity greater than 0.8, indicate similarity between 0.5 and 0.8, and similarity less than 0.5.
indicate
Model Fine-tuning
1lama---finnnee-
Vicuna- 1.5-7b (370M Tokens)
Wizardmath-7b (1.88 Tokens)
Chinesellama-2-76
Codellama-7b (500B Tokens)
Llemma-70
(5M Tokens)
(13B Tokens)
(700B Tokens)
PCS
0,9979
0.9985
0.0250
0.0127
0.0105
0.0098
0,9952
0.9949
0.9994
0.4996
0.2550
0.2257
Logits
0,9999
0.9999
0.9999
0,7033
0,7833
0.6367
REEF
0.9950
0.9985
0.9979
0,9974
0.9947
0.9962
Structured Pruning
Sheared-llama-
Sheared-llamu-
Sheured-Hlama-
Sheared-llama-
Sheared-Ilama- 2.7b
Sheared-llama-
1.3b-pruned
1.3b
1.3b-shareppt
2.7b-pruned
2.7b-shurepp
PCS
0.0000
0,0000
0,0000
0,0000
0.0000
0.00000
ICS
0.4927
0,3512
0.3510
0.6055
0.4580
0.4548
Logits
0.9967
0.9999
0.9999
0.9967
0,9999
0.9999
REEF
0.9368
0.9676
0.9710
0.9278
0,9701
0.9991
Unstructured Pruning
Distribution Merging (F ('usechat-7b)
Sparse-llama-
Wanda-Ilama-
GBLM-Ilama-
Internlm2-chat-
Mixtral-&x7b
Qwen- 5.5-chat-
2-7b
2-7b
2-7b
20b
72b
PCS
0,9560
0.9620
0.9616
0,0000
0.0000
0.0000
ICS
0.9468
0.9468
0.9478
0.1772
0.0105
0.0635
Logits
0,9999
0.9999
0.9999
0.0000
0.0000
0.0000
REEF
0.9985
0.9988
0.9991
0.9278
0.9701
0.9991
Weight Merging (Evollm-jp-7b)
Distribution Merging (aatlingFuslllmm-11 7b)
Shisa gamma-7b-vv
Wizardmath- -b-
Abel-7b-002
Llama-2-77
Openllama-2 2
Mpt-7b
PCS
0.9992
0,9990
0,9989
0,9997
0.0194
0.0000
ICS
0.9992
0.9988
0.9988
0.1043
0.2478
0.1014
Logits
0.9933
0.9999
0,9999
0,9999
0.0100
0.0000
REEF
0.9635
0,9996
Permutation
Scaling Transformation
Llama 2-7b
Mistral-7h
Qwen-
Llama- 2- 7b
Mistral
Qwen
FCS
0.0000
0.0000
0,0000
0.9999
0,9989
0.9999
ICS
0.1918
0.9847
0.9912
0,9999
0,9999
0.9998
Logits
0.0000
0.0000
0,0000
0.9999
0.9999
0.9999
REEF 1.0000)
1,0000
1,0000
1,0000
1.0000
1,0000
yielding a lower similarity than Code-llama-76 (0.7033 vs 0.7833), despite being fine-tuned on smaller dataset (13B vs 500B tokens).
Discussion about how much fine-tuning data could make REEF ineffective. Despite fine-tuning Llama-2-7b to Llemma-7b with 700B tokens (Azerbayev et al. 2023), the fine-tuning data one- third of Llama-2-7b' s 2T token pre-training data, yet REEF remains effective. We question whether REEF would remain effective with continued increases in fine-tuning data. Before delving into this discussion, two statements are listed: (1) To the best of our know, Llemma-7b is the most extensively fine-tuned Llama-2-7b model, nearly 700B tokens for fine-tuning, and REEF has shown robustness in this context; (2) Code-llama-7h (Roziere et al., 2023) reports that fine-tuning with 500B tokens requires 4.4T of disk size and 25,000 GPU hours, fine-tuning on this scale is costly. Such considerable cost limits further extensive fine-tuning. REEF appears effective in current fine-tuning scenarios.
5.2.3 MODEL PRUNING
Pruning widely used in model compression for edge deployment, e.g., serving for mobile devices and autonomous driving (Vadera & Ameen 2021 Wang et al., 2024 Lin et al. 2024). However, pruning could significantly alter both the structural integrity and representation dimensions mod- els (Ma al. 2023 Frantar & Alistarh, 2023 Zhu al. 2023), posing challenges for fingerprint identification. To this end, we test REEF on various pruned models of the victim model Llama-2-7b.
Settings. We use Llama-2-7b as the victim model and various pruned models of it as suspect mod- els. First, we select several pruned models using different pruning strategies, including structured pruning Se..SSheared-llams (Xaa et al. 2024 ) and unstructured pruning (e.g.. SparseGPT (Frantar & Alistarh 2023), GBLM-Prumm (Das et al., (023), and Wanda (Sun et al,, 2023)). These meth- ods prune the models at specific ratios, followed by post-training (e.g., continued pre-training or

---

Published as a conference paper at ICLR 2025
1.0
Channel Layer Block
Mheee Poxees
Purplesity
Simlarity
8.6
20000
0.4
PCS
10000
0.0
10%
30%
50%
70%
27
105
30%
30%
40%
50%
60%
10%
30%
50%
70%
90%
(4) Block Pruning
(b) Layer Pruning
(hanmel Pruning
(4) Perplexity
Prining
Figure 4: (c) Similarity between pruned models and the victim model across three pruning strate- gies at various pruning ratios. (d) Perplexity of the three pruning strategies.
instruction-tune tuning)) to ensure the pruned models maintain their capabilities. Second, we apply LLM- Pruner (Ma et al. 2023) to prune Llama-2-76 into smaller suspect models at arbitrary pruning ratios, without post-training. For example, we apply block pruning reduce Llama-2-7b's parameters by 10% to as much as 90%, and layer pruning to reduce the number of layers by 3 to as much as 27.
REEF is robust to various pruning strategies. As shown in Table 1 for structured pruned mod- els, REEF consistently achieves accurate fingerprint identification across all Sheared- -laameaaaaaaaaaaa models, with similarities exceeding 0.9278. In contrast, PCS fails in this scenario, consistently yielding similarity score of zero. ICS does not perform well, e.g., the similarity for the 1.3B pruned model drops to 0.3512. The Logits method, which relies the output space, remains unaffected unless the pruning alters the logits themselves. For unstructured pruned models, all methods are capable of identifying the victim model, with all similarities exceeding 0.94. In summary, REEF and the Logits method remain robust across all pruned models.
REEF is robustness pruning ratio, even up 90%. Figure 4 shows that REEF remains effec- tive even with significant pruning, including block pruning of up to 90% of parameters, layer pruning of up 27 layers, and channel pruning of up 60%. Figure () illustrates that perplexities particularly high in these scenarios, especially with 60% channel pruning. As noted by Ma et al. (2023), channel pruning affects all layers, but the first and last layers are critical for maintaining model integrity, thus pruning is limited to 60%. In contrast, PCS fails in all pruning scenarios, and ICS's effectiveness diminishes as the pruning ratio increases, ultimately failing under layer pruning. These findings highlight REEF as the most robust and reliable method for fingerprint identification across various pruming ratios.
5.2.4 MODEL MERGING
Model merging is an effective technique that merges multiple separate models with different capa- bilities to build universal model without needing access to the original training data expensive computation (Yang et al.] 2024). Differing from other sections, the merged model derived from several victim models, which pose a challenge in identifying all of them. In this subsection, study two types of model merging: weight-based and distribution-based.
Settings. For weight merging, select Evollm-jp-7b (Akiba al. 2024 the suspect model, which merges three victim models with the same architecture (L.e., Shisa-gamma-7b-v/ Wizardmath-7b-l.I. and Abcl-7b-002) by weighted parameters. For distribution merging, we choose Fusellm-7b (Wan et al. 2024a) and Fusechat (Wan et al.) (024b) as suspect models, re- spectively. Fusellm-7b merges three victim LLMs with distinct architectures but with same scale: Llama-2-7b, Openllama-2-1 and Mpt-7b. Fusechat merges several chat LLMs of varied architec- tures and scales, we investigate Internlm2-chat-200 as suspect models.
and Qwen- 1.5-chat-725
REEF is robust across both weight and distribution merging scenarios. For weight merging, REEF consistently achieves high accuracy in identifying the origins of merged models, with simi- larities ranging from 0.9526 to 0.9996, as shown Table [ ICS, PCS, and the Logits method also perform well in this scenario. For distribution merging the same scales (i.e., Fusellm-7b). REBF continues to perform well, accurately identifying the victim model Llama-2-76 with a similarity of 0.9996. Additionally, it remains effective for B-p7llamm-2277 and Mpt-7b, with similarities of 0.6713 and 0.62, respectively. However, ICS struggles significantly in this scenario, with all three original victim models achieving low similarities. Although PCS and the Logits method can iden-
8

---

Published as a conference paper at ICLR 2025
LLMs derived from Llama-2-7d:
Llama-2-7b-chun
Vicuna-1.5-7b
Tulo-2-76
Chinesellamm--270
Codellama-70 7b
Unrelated LLMs:
Openllama-2-76
Falcon-7b
Mistral-7b
Qwen-
Baichuan-2-1
1.0
Simtlarity
0.8
0.6
0.4
0.0
10
500
1000
1000
(a) TruthfuQAA
(b) SST2
(c) ConfAlde
(d) PKU-RLHF-IOK
(e) ToxiCien
Figure 5: Illustration of the CKA similarity between the representations of the victim LLM (Llama-
2-7B) and various suspect LLMs across different datasets as sample number increases.
tify Llama-2-7b, their performance drops sharply for Openllama-2-76 and Mpt-7b, with similarities of nearly For distribution merging at the different scales (i.e., Fusechat-7b), REEF the only method that continues to work for identifying victim models, while the other methods fail, demon- strating its consistent reliability in this scenario. Based on these findings, REEF is robust across various merging strategies and can identify all victim models for the merged model.
5.2.5 PERMUTATION AND SCALING TRANSFORMATION
There approaches that could camouflage the model without changing its architecture or affecting its output (Zeng et al. 2023). Malicious developers may modify the model by employing dimension permutation coupled matrix multiplications nandez et al., 2024). This section aims to experiment with the robustness of various fingerprinting methods in addressing this type of evasion.
evade some fingerprint detection methods (Fer-
Settings. We select Llama-2-7b, Mistral-7b, and Qwen-1.5-7b as victim models, applying column- wise permutations or scaling transformations (with scaling factor of 0.8) to both their weight matrices and feature representations. These operations simulate evasion techniques that malicious developers might use, enabling us to compare the similarities of the weights and representations before and after the operations.
REEF is invariant and robust any column-wise wise permutations and scaling transformations, as proved by the Theorem [ As shown in [ the CKA similarity computed by REEF remains consistently at before and after the permutation or scaling transformations, indicating that REEF invariant to these operations and robust against evasion techniques. However, other methods such as ICS, PCS, and Logits, while robust to scaling transformations, exhibit a significant drop in similarity under permutation, with values nearly dropping to O. These results further reinforce that REEF is highly reliable fingerprinting method in practical applications against malicious developers.
5.3 ABLATION STUDY
Number of Samples To evaluate the impact of sample number on the performance of REEF, we conduct an ablation study using samples from TruthfulQA, ranging from 10 to 1000 in intervals of 10. We use Llama-2-7b as the victim model and select 10 suspect models, consisting of 5 LLMs derived from Llama-2-7b and 5 unrelated LLMs. We then calculate the CKA similarity between the sample representations of each suspect model and those of Llama-2-78 2- at different sample numbers. Figure 5 illustrates the similarities for various models as the number of samples increases.
REEF is highly efficient regarding the number of samples required for robust model finger- printing. Figure a) shows that the similarities for most models stabilize after 200-300 samples, suggesting that REEF can achieve reliable fingerprint identification with a smaller sample number. Notably, LLMs derived from Llama-2-76 (e.g., Chinese-lama-2277 and Code-Ilama-7b) consistently maintain high similarities close to 1.0 across all sample numbers. This indicates that these models potentially share the same representation space as the victim model, verifying that representation is an intrinsic feature for fingerprinting. In contrast, unrelated LLMs (e.g., Qwen- 7b-11.5 and Mistral- 7b) exhibit lower similarities that gradually decrease and stabilize at levels below 0.2 as the number of samples increases. This suggests that these models are more distinct and require larger num-

---

Published as a conference paper at ICLR 2025
Lihma-2-7b
Openiliatt-
Andec
Liama-3-80
Insenlm-2-7b
Tages
LOWE
Layer
Layer
Layer
Layer
Layer
Layer
Lager
Layer
21
(8) Llama-2-77 itself
(b) LLMs with same architecture but trained different
Figure 6: Heatmaps depicting the CKA similarity between the representations of (a) Llama-2-7b itself, and (b) paired LLMs with the same architecture but different pre-training data.
ber of samples for accurate fingerprinting. Overall, few samples from TruthfulQA are effective for REEF in identifying L.MSs derived from the victim model compared to unrelated LLMs.
Different Datasets To assess the effectiveness of REEF across various data types. also duct experiments using SST2 (Socher et al.] 2013), ConfAlde (Mireshghallah et al. (023). PKU- Saf (Ji et al., 2024), and ToxiGen (Hartvigsen al.] (022). Following the same settings described in the previous section, we plot the similarities between the victim model and various sus-
pect models for different datasets as the number of samples increases, as shown in Figure (e)-
REEF is effective across various datasets. Figure ((b)-(e) show that the similarity between the victim model and its derived LLMs significantly higher than the similarity with unrelated LLMs across different datasets. This clear distinction demonstrates that REEF can effectively identify whether suspect model is derived from the victim model. Furthermore, the gap in the similarity between derived LLMs and unrelated LLMs varies by dataset, e.g., the gap is approximately 0.8 on TruthfulQA and about 0.5 on ToxiGen. larger gap indicates a stronger identification capability. Our findings suggest that while REEF is effective across diverse datasets, TruthfulQA emerges as the optimal choice for model fingerprinting, as it exhibits the most substantial diffcrentiation in similarity between LLMs derived from the victim model and unrelated LLMs.
5.4 FURTHER DISCUSSION
REEF distinguish between models with the same architecture but different pre-training data. Openllama-76 (Geng & Liu 2023) and Amber (Liu et al., (023) are open-source LLMs that the same Llama architecture but are pre-trained distinct pre-training corpus. In contrast to Figure 6]a), a). which shows that the layer-wise CKA similarity between Llama-2-7b itself is almost 1, Figure b) clearly demonstrates that REEF effectively identifies the differences between Llama-2- 7b and both Openllama-7b and Amber. Similar results are observed across different LLM genera- tions, such Llama-2-7b versus Llama-3-8h and Internlm-7b versus Internlm2-75 7b. Each of these models reflects variations in pre-training data and strategies, which REEF accurately identifies.
Malicious developers fail to fine-tune models with a customized loss function to evade detec- tion by the REEF We assume these developers are aware of the REEF approach and attempt to design customized loss functions during fine-tuning to bypass detection. Since REEF relies on the observation that developed LLMs share similar representational spaces with the victim model. The developer may use the customized loss function to widen the gap between the two representations. Experimental results in Appendix general capabilities and renders the fine-tuned models unusable. This is because the capabilities of LLMs stem from their representational distribution, and such intentional fine-tuning inevitably leads to the model losing its language modeling ability. Therefore, malicious developers are unable evade REEF detection through this method.
D indicate that such fine-tuning seriously damage the model's
CONCLUSION
This paper proposes REEF, a robust representation-base fingerprinting method for LLMs in a white-box scenario, which effectively identifies models derived from victim model that serves as the root origin. REEF does not impair LLMS's general capability and remains resilient against var- ious subsequent developments, including pruning, fine-tuning, merging, and permutations. There- fore, REEF is highly suitable for protecting model IPs for both third parties and model owners, as a reliable solution for safeguarding models from unauthorized use reproduction.
10

---

Published as a conference paper at ICLR 2025
REPRODUCIBILITY STATEMENT
To ensure the reproducibility of this study, we have uploaded the source code part of the supple- mentary material. Furthermore, the code and datasets will be made available on GitHub after the completion of the double-blin review process, enabling others replicate our study.
ACKNOWLEDGMENTS
This work is supported by the Shanghai Artificial Intelligence Laboratory (No. JF-P23KK00072- 1-DF). We also acknowledge the support of National Natural Science Foundation of China (No.62476277), CCF-ALIMAMA TECH Kangaroo Fund (No.CCF-LLIAMA OF 2024008), and Huawei-Renmin University joint program on Information Retrieval. We also acknowledge the sup- port provided by the fund for building worldclass universities (disciplines) of Renmin University of China and by the funds from Beijing Key Laboratory of Big Data Management and Analysis Methods, Gaoling School of Artificial Intelligence, Renmin University of China, from Engineering Research Center of tion, from Intelligent Social Governance Interdisciplinary Platform, Major Innovation & Planning Interdisciplinary Platform for the "DoubleFirst Class" Initiative, Renmin University of China, from Public Policy and Decision-making Research Lab of Renmin University of China, and from Public Computing Cloud, Renmin University of China.
Intelligent Search and Recommendation, Ministry of Educa-
REFERENCES
01-ai. Discussion 11: Improvements in yi-34b model performance. httts::/huggingfffae
2023. Accessed: 2024-07-15.
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weak- ness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX secu- rity symposium (USENIX Security 18), pp. 1615-1631, 2018.
Takuya Akiba, Makoto Shing, Yujin Tang, Qi Sun, and David Ha. Evolutionary optimization of model merging recipes. arXiv preprint arX1v:2403.13187, 2024.
Zhangir Azerbayev, Hailey Schoelkopf, Keiran Paster, Marco Dos Santos, Stephen McAleer, Al- bert Q Jiang, Jia Deng, Stella Biderman, and Sean Welleck. Llemma: An open language model for mathematics. arXiv preprint arXiv:2310. 10631, 2023.
Tolga Bolukbasi, Kai-Wei Chang, James Y Zou, Venkatesh Saligrama, and Adam T Kalai. Man is to computer programmer as woman is to homemaker? debiasing word embeddings. Advances in neural information processing systems, 29, 2016
Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt. Discovering latent knowledge in lan- guage models without supervision. In ICLR, 2023. URL httpps://pperrvviev.. net/
Guanxu Chen, Dongrui Liu, Tao Luo, and Jing Shao. Seer: Self-explainabiliiy enhancement of large language models' representations. arXiv preprint arXiv:2502.05242. 2025.
Huajie Chen, Tianqing Zhu, Chi Liu, Shui Yu, and Wanlei Zhou. figh-frequency matters: An
overwriting attack and defense for proge-nno neural network watermarking, 2023a. URL wrw.ivoorrraaooo. /ww./////20.22 23222086222223
htttps://arxiv.rrgg
Yida Chen, Fernanda Viégas, and Martin Wattenberg. Beyond surface statisties: Scene representa- tions in a latent diffusion model, 2023b. URL htth:tps: arwiv. org/ abs 220.. 05720
Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E. Gonzalez, lon Stoica, and Eric P. Xing. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality, March 2023. URL https:
7/1msys. wtw.syy..gg/bogggg// watpo///2220-20 03 303-330vviunn..
Yiming Cui, Ziqing Yang, and Xin Yao. Efficient and effective text encoding for chinese llama and alpaca. arXiv preprint arXiv:2304.08177 2023. URL https::///// / arxiv. org/ abgg/b/2/344.
081 77

---

Published as a conference paper at ICLR 2025
Yunkai Dang. Kaichen Huang. Jiahao Huo, Yibo Yan, Sirui Huang. Dongrui Liu, Mengxi Gao, Jie Zhang, Chen Qian, Kun Wang, et al. Explainable and interpretable multimodal large language models: A comprehensive survey. arXiv preprint arXiv:2412.02104, 2024.
Rocktim Jyoti Das, Liqun Ma, and Zhiqiang Shen. Beyond size: How gradients shape pruning decisions in large language models. arXiv preprint arXiv:2311.049000 2023.
Pierre Fernandez, Guillaume Couairon, Teddy Furon, and Matthijs Douze. Functional invariants to watermark large transformers. In ICASSP 2024-2024 IEEE International Conference on Acous- tics, Speech and Signal Processing (ICASSP), pp. 4815-4819, IEEE, 2024.
Elias Frantar and Dan Alistarh. Sparsegpt: Massive language models be accurately pruned in one-shot. In International Conference on Machine Learning, pp. 0833-110337. PMLR, 2023.
Xinyang Geng and Hao Liu. Openllama: An open reproduction of Ilama, May 2023. URL https: //github.com wtw.o///pppennnnneeeeerttete open aatpaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Arthur Gretton, Olivier Bousquet, Alex Smola, and Bernhard Schölkopf. Measuring statistical de- pendence with hilbert-schmidt norms. In International conference on algorithmic learning theory, pp. 63-77. Springer, 2005.
Jia Guo and Miodrag Potkonjak. Watermarking deep neural networks for embedded systems. In 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pp. 1-8. IEEE, 2018.
Thomas Hartvigsen, Saadia Gabriel, Hamid Palangi, Maarten Sap. Dipankar Ray, and Ece Kamar. Toxigen: A large-scale machine-ge gennrratd dataset for adversarial and implicit hate speech detec- tion. arXiv preprint w:XXv:2203.09500 2022.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Wang. and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685 2021.
Dmitri lourovitski, Sanat Sharma, and Rakshak Talwar. Hide and seek: Fingerprinting large lan- guage models with evolutionary learning. arXiv preprint arXiv:2408. 02871, 2024.
Jiaming Ji, Donghai Hong, Borong Zhang, Boyuan Chen, Josef Dai, Boren Zheng, Tianyi Qiu, Boxun Li, and Yaodong Yang. Pku-saferlhf: A safety alignment preference dataset for llama family models. arXiv preprint arXiv:2406.. 155113 2024.
Tero Karras, Miika Aittala, Samuli Laine, Erik Härkönen, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Alias-free generative adversarial networks. Advances in neural information processing systems, 34:852-8666 863, 2021.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pp. 17061-17084. PMLR, 2023.
Simon Kornblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hinton. Similarity of neural network representations revisited. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9- 15 June 2019, Long Beach, California, USA, volume 97 of Proceedings of Machine Learning Research, pp. 3519-3522 PMLR, 2019. URL httt:::/proceeednggg. mir http://pccccccnnnnoo.ooceeee//// kornb] h 9a. htm
Huiying Li, Emily Wenger, Shawn Shan, Ben Zhao, and Haitao Zheng. Piracy resistant water- marks for deep neural networks. arXiv preprint arXiv:1910.01226, 2019a.
Peixuan Li, Pengzhou Cheng, Fanggi Li, Wei Du Haodong Zhao, and Gongshen Liu. Plmmark: secure and robust black-box watermarking framework for pre-trained language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 14991-14999, 2023.
12

---

Published as a conference paper at ICLR 2025
Zheng Li, Chengyu Hu, Yang Zhang. and Shanqing Guo. How to prove your model belongs to you: A blind watermarkk based framework to protect intellectual property dnn. In Proceedings of the 35th annual computer security applications conference, pp. 126-137, 2019b.
Sihao Lin, Pumeng Lyu, Dongrui Liu, Tao Tang, Xiaodan Liang, Andy Song, and Xiaojun Chang. Mlp can be a good transformer learner. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 19489 19498, 2024.
Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human falsehoods. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2022. Dublin, Ireland, May 22-27, 2022, pp. 3214- 3252. Association for Computational Linguistics, 2022. doi: 10.18653/V 1/202//L-11222. 229
229. httLhhtts:///cc wrg. 11w.11111661111/22222222
Zhengzhong Liu, Aurick Qiao, Willie Neiswanger, Hongyi Wang, Bowen Tan, Tianhua Tao, Junbo Li, Yuqi Wang. Suqi Sun, Omkar Pangarkar, et al. Llm360: Towards fully transparent open-souree llms. arXiv preprint
2023.
Xiaoya Lu, Dongrui Liu, Yi Yu, Luxin Xu, and Jing Shao. X-boundary: Establishing exact safety boundary to shield Ilms from multi-turn jailbrekss without compromising usability. arXiv preprint arXiv:2502.09990 2025.
Haipeng Luo, Qingfeng Sun, Can Xu, Pu Zhao, Jianguang Lou, Chongyang Tao, Xiubo Geng, Qing- wei Lin, Shifeng Chen, and Dongmei Zhang. Wizardmath: Empowering mathematical reasoning for large language models via reinforced evol-instruct. arXiv preprint vxxi:2308.005883 2023.
Xinyin Ma, Gongfan Fang, and Xinehao Wang. LIm-pruner: On the structural pruning of large language models. Advances in neural information processing systems, 36:21702- 2023.
Hope McGovern, Rickard Stureborg, Yoshi Suhara, and Dimitris Alikaniotis. Your large language models are leaving fingerprints. arXiv preprint arXiv:2405.14000 2024.
Meta AI. Llama 2 community license agreement, 2023. URL https://ai: /at:://aaimmme met...et.... com/ llama/license/ Accessed: 2024-08-28.
Tomáx Mikolov, Wen-tau Yih, and Geoffrey Zweig. Linguistic regularities in continuous space word representations. In Proceedings of the 2013 conference of the north american chapter of the association for computational linguistics: Human language technologies, pp. 746-751, 2013.
Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. Can Imm keep secret? testing privacy implications of language models via contextual integrity theory. arXiv preprint arXiv:2310. 110.::3310.178.. 17884, 2023.
Jekaterina Novikova, Ondfej Dušek, and Verena Rieser. The e2e dataset: New challenges for end- to-end generation. arXiv preprint arXiv: arXiv: 09254, 2017.
OpenBMB. Issue 196: Memory leak in model parallel training. https:///ithhi/ com/ DDeenEMB/MMnnccM-V///M
2023. Accessed: 2024-07-15.
Dario Pasquini, Evgenios M Kornaropoulos, and Giuseppe Ateniese. Llmmap: Fingerprinting for large language models. arXiv preprint arXiv:2407.15847, 2024.
Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark. In Proceedings of the 61 Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2023, Toronto, Canada, July 9-14, 2023, pp. 7653-7668. Association for Computational Linguisties, 2023a. doi: 10. 12063///112222.LLLLL00 v1/2023. acl ong. 423
URL https: /ttp::///oo..ooo www.di..org/1.1000 /ttp:://all.org11..B555
13

---

Published as a conference paper at ICLR 2025
Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark. In Proceedings of the 61st Anmual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), ACL 2023, Toronto, Canada, July 9-14, 2023, pp- 7653-7668. Association for Computational Linguistics, 2023b. doi: 10. 1/206///1/222AALL--1L2
URL
v1 v1/2023. long. 423
Chen Qian, Dongrui Liu, Jie Zhang, Yong Liu, and Jing Shao. Dean: Deactivating the cou- pled neurons to mitigate fairness-privacy conflicts in large language models. arXiv preprint NrXiv:2410.1667, 2024a.
Chen Qian, Jie Zhang, Wei Yao, Dongrui Liu, Zhenfei Yin, Yu Qiao, Yong Liu, and Jing Shao. To- wards tracing trustworthiness dynamies: Revisiting pre-training period of large language models. In ACL Findings, 2024b.
Yehonathan Refael, Adam Hakim, Lev Greenberg, Tal Aviv, Satya Lokam, Ben Fishman, and Shachar Seidman. Slip: Securing Ilms ip using weights decomposition. arXiv preprint arXiv:2407. 10886, 2024.
Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Matt Turner. Steering Ilama 2 via contrastive activation addition. arXiv preprint arXiv:2312.0668) 2023.
Baptiste Roziere, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Romain Sauvestre, Tal Remez, et al. Code llama: Open foundation models for code. arXiv preprint arX1v:2308. 2023.
Mark Russinovich and Ahmed Salem. Hey. that's my model! introducing chain & hash, an Ilm fingerprinting technique. arXiv preprint arXiv:2407.10887, 2024.
Rita Sevastjanova, A Kalouli, Christin Beck, Hanna Hauptmann, and Mennatallah El-Assady- Lmfingerprints: Visual explanations of language model embedding spaces through layerwise contextualization scores. In Computer Graphics Forum, volume 41, pp. 295-307, Wiley Online Library, 2022.
Aviv Slobodkin, Omer Goldman, Avi Caciularu, Ido Dagan, and Shauli Ravfogel. The curious case of hallucinatory (un)answerability: Finding truths in the hidden states of over-confident large language models. Houda Bouamor, Juan Pino, and Kalika Bali (eds.), Proceedings of the 2023 Conference on Empirical Methods in Natural Language P Processing, pp. 3607-3625, Singapore, December 2023, Association for Computational Linguistics. doi: 18.15//3/v /20222222222 1.002..mmnlp--o. main. 220. URL https:ttp//omm /attts::/aclaatthtttt
wttpg///00303 emnlp ma.in... 220
Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language pro- cessing, pp. 1631-1642, 2013.
Mingjie Sun, Zhuang Liu, Anna Bair, and J. Zico Kolter. A simple and effective pruning approach for large language models. arXiv preprint arXiv:2306. 1695, 2023.
Calvin Tan and Jerome Wang. 1.5-pints technical report: Pretraining in days, not months- your language model thrives on quality data, arXiv preprint wrXiv:2408.03506 2024.
Sunil Vadera and Salem Ameen. Methods for pruning deep neural networks, 2021. URL https: waa.iii..o//as///00000.
Fanqi Wan, Xinting Huang, Deng Cai, Xiaojun Quan, Wei Bi, and Shuming Shi. Knowledge fusion of large language models. arXiv preprint arXiv:2401. 10491, 2024a.
Fanqi Wan, Ziyi Yang, Longguang Zhong, Xiaojun Quan, Xinting Huang, and Wei Bi. Fusechat: Knowledge fusion of chat models. arXiv preprint 2r2iv:2402. 2024b.
14

---

Published as a conference paper at ICLR 2025
Tianhao Wang and Florian Kerschbaum. Attacks digital watermarks for deep neural networks. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp- 2622 2626, 2019. doi: 10.1009ICAASP22219.862220
Wenxiao Wang, Wei Chen, Yicong Luo, Yongliu Long, Zhengkai Lin, Liye Zhang, Binbin Lin, Deng Cai, and Xiaofei He. Model compression and efficient inference for large language models: A survey, 2024. URL TRL
abs 240...2022.00022 09748
Haojun Xia, Zhen Zheng. Yuchao Li, Donglin Zhuang. Zhongzhu Zhou, Xiafei Qiu, Yong Li, Wei Lin, and Shuaiwen Leon Song. Flash-llm: Enabling cost-effective and highly-efficient large gen- erative model inference with unstructured sparsity, 2023. URL /tatpis//arxiv...o oww.ivv.rrraaaa /
2309. 10285
Mengzhou Xia, Tianyu Gao, Zhiyuan Zeng. and Danqi Chen. Sheared LLaMA: Accelerat- ing language model pre-training via structured pruning. In The Twelfth International Confer- ence on Learning Represenlations, 2024. URL https: fttrs:://openrevieww net.e/ewwwweeeeeeeeeeeeeeeeeeeee fer/ffomm?i 0910dae0zp
Jiashu Xu, Fei Wang, Mingyu Derek Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. Instruc- tional fingerprinting of large language models. arXiv preprint arXiv:2401.1225. 2024.
Enneng Yang, Li Shen, Guibing Guo, Xingwei Wang, Xiaochun Cao, Jie Zhang, and Dacheng Tao.
Model merging in llms, mllms, and beyond: Methods, theories, applications and opportunities, 2024. URL BtLphttps:// /ttpiv.iivv..////v///.e.////aav. org ab///b///244 2200. 07666
Zhiguang Yang and Hanzhou Wu. A fingerprint for large language models. arXiv preprint 200.v22407.01235. 2024.
Boyi Zeng, Chenghu Zhou, Xinbing Wang, and Zhouhan Lin. Huref: Human-readable fingerprint for large language models. arXiv preprint arXiv:2312.04826 2023.
Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Mare Ph Stoecklin, Heqing Huang, and Ian Molloy. Protecting intellectual property of deep neural networks with watermarking. Proceed- ings of the 2018 Asia conference computer and communications security, pp. 159-172, 2018.
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christo- pher Dewan, Mona Diab, Xian Li. Xi Victoria Lin, Opt: Open pre-trained transformer language models. arXiv preprint 2rXiv:2205.010mm 2022.
Xuandong Zhao, Yu-Xiang Wang, and Lei Li. Protecting language generation models via invisible watermarking. In International Conference on Machine Learning, pp. 02187-42119 PMLR, 2023.
Renjie Zhu, Xinpeng Zhang, Mengte Shi, and Zhenjun Tang. Secure neural network watermarking protocol against forging attack. EURASIP Journal on Image and Video Processing, 2020:1-12, 2020.
Xunyu Zhu, Jian Li, Yong Liu, Can Ma, and Weiping Wang. survey on model compression for large language models. arXiv preprint Nat:230880076333 2023.
Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. Representation engineering: A top-down approach ai transparency. arXiv preprint 2rx0v:2310.01405, 2023.
15

---

Published as a conference paper at ICLR 2025
A PROOF FOR THEOREM 1
Theorem Given two matrices X TRmpp and TRRx the CKA similarity score between X and Y is invariant under any permutation of the columns and column-wise scaling transformation. Formally, we have:
CKA(X,Y) = (KA(XPI, = CKA(cIXX,2X)
where Pi RPIXPs and P2 E Ro2sp2 denote permutation matrices. 01 E R+ and 0g R are two positive scalars.
Proof.
A.1 CASE I: PERMUTATION INVARIANCE
For Linear CKA, the Gram matrices of X and Y are Kx = XX and Ky = YY respectively. In this way, we have
KXp, = =XPP xx Kx.
Since P1 is an orthogonal permutation matrix, thus P.P Similarly, we have
KYP: = - = KY.
(3)
According to (retton et al. 2005).
HSIC(X,Y)
(m 1)2 tr(Kx tr(KXH Hy H)
(m 1)2 (X(K HKy Ky II)
HSIC(XP,,Y)
1 HK
USIC((.YY5))
in 112 (XXPII(KYPP)
(4)
Thus, we have
HSIC(X, Y) HSIC(XP, Y) HSIC(X, YP)) HSIC((P,,YP3).
(5)
16

---

Published as a conference paper at ICLR 2025
Taking Eq into Eq. I we have
HSIC(X, Y)
CK
/HSIC(X, X) HYI HSIC(XP1, Y)
HSSIC(XP,, XP)) H)IC(Y,,)
CKA(XPL.))
HSIC(X, YP2)
HSIC(X, HSIC(Y P2, P22)
CKA(X,YP))
HSIC(XP, YP2)
(6)
/HSIC(XPI XPI) HSIC(Y YP))
CKA(XPLYY))
Finally, obtain
CKA(X, Y) CKA(XP, Y) CKA(X,YP)) = (KA(XP,,YP))
For RBF CKA, the RBF kernel function is
|X, - X,112
M(x,, = exp
20
|XxP - -X
exp
(8)
20
K(X.Ps
The pairwise distances || Xylle are invariant the column permutation of X, because P1 is permutation matrix. Therefore, we can obtain KxP, = Kx.
Similarly, easily derived KYP, Ky as follows.
1 11
A(Y, Yy) = exp
exp
20
|| Y, P211
= cxp
(9)
202
K(Y:P2,
In this way, we have
HSIC(X,Y Y)
(Kx HKy H)
(m 1)2
1m--1 1y2 tr(( HKyH)
USIC((PP.))
(m - 152 HKx
HSIC(X,YPP)
(m 132 tr(KX, 1((KX HKYPHH)
(10)
HSIC(XP.,YYP.)
17

---

Published as a conference paper at ICLR 2025
Taking Eq into Eq.
we have
HSIC(X, Y)
CKA(X,Y)
/HSIC(X,X) HSIC(Y,Y) HSIC(XPI;
HSIC(XP,, HY
CKA(XPL.Y)
HSIC(X,
HSICIX, X) HSIC(Y Ps, P2)
C
HSIC(XP,,YP)
(II)
/HSIC(XP, XP) HSSICS P2, YP)
CRA(XP3,P33)
Finally, we obtain
CKA(X,Y) CKA(XP, Y) CKA(X, YP)) CKA(XP,,YP) YP))
(12)
A.2 CASE 2: SCALING INVARIANCE
For Linear CKA, let X = C,X and e E Rt. Then,
Kx xx= XXX
= (CX
= =GXX
= e
(13)
Similarly, let Φ = ogy and 02 E R+ Then,
Ky = .ÝT
= (22Y))(2)))
= =gYYT
= eg
(14)
In this way,
(m 1)2 tr( HKg
tr Kx Ky
(m
( 2 K HKyH)
(m-
(m - 1)2 [[K
= (C
(15)
Accordingly,
18

---

Published as a conference paper at ICLR 2025
(m 1)2 x (K1
(m 1)2
(m 1)2 u[cKK ot (m - 1)2 1nm [I> cHSSIC(X,
(16)
1
HsIC(o2Y,c2))=
tr( HyyH)
(m 1)2
H. H
(m 1)2
HKvH)
(m 1)2 o2
(m 1)2
HHSICYYY
(17)
Therefore, have
HSIC(ax,co))
CKA(c,X,
- HSIC((2X,,)) (FCHSSC((,Y))
VCHSIC(XX X) CHSIC(YYY) (CGHSIC(X,))
2/22 /AS/SSSIXXXX X). HSIC(Y,Y) HSIC(X,Y)
(18)
/HSIC(X,X) HSSI(Y,Y) CKA(X.Y)
Finally, we obtain
CKA(X, CKA(GXX,2))
(19)
For RBF CKA, the RBF kernel function is
||,,X, cx
((,)) = =exp
20
cillXt -x,
exp
(20)
202
Following Kornblith et al. 2019), the bandwidth o is chosen as a fraction the median distance,
iee. median [X; X for the constant O. In this way, Eq. 20 is transformed as,
19

---

Published as a conference paper at ICLR 2025
1 - xx,13
(() exp
2[ median X1 X2
- - x
exp
2070²
(21)
k(X..,,)
Similarly, it is easily derived k(c2\;, = k(Y,, Yj) as follows,
2 Y 15ll
(2,) ex
2(ac3
median - Y,1l2))²
= exp
2c30²
(22)
k(Y:.y))
Therefore, we can obtain HSIC(X, o2)), HSIC(X, X) XS (1 and HSIC(Y, HSIC(e2XX.22))
Finally, we have
HSIC(),,,o2)
CK)(
HHSIC((,X,,1x)) HSIC(02Y,,2)) HSIC(X,Y)
VHSIC(X,X) HSIC(Y,Y) Y)..
(23)
Finally, we obtain
CKA(X, Y) CKA(c)X,o2)).
(24)
B THE EFFECTIVENESS OF CLASSIFIERS TRAINED ON REPRESENTATIONS OF A VICTIM MODEL
This appendix provides detailed analysis of the experiments conducted to evaluate the effectiveness of classifiers trained the representations of victim model to identify whether suspect model derived from it, thus protecting its intellectual property. We explore the classifiers' accuracy when utilizing representations from different layers to train classifiers and applying them to the corresponding layers of the suspect model (B.I). as well as applying classifiers trained on one layer's representation to representations from other layers of the suspect model (B.2).
B. APPLY CLASSIFIERS TO THE CORRESPONDING LAYER
Research has shown that representations from the middle and later layers of LLMs contain rich encoded information, which can be used to classify high-dimensional concepts, such safety or
unsafety, and honesty or dishonesty (Burns et al. 2023; Rimsky et al., 2023 Zou et al., 2023) Qian al. 2024a b. Chen et al. 22225. Following Section
explore the effectiveness of classifiers
trained on representations from different layers.
Specifically, we use Llama-2-7b and llama-2-13b as victim models, extracting representations from the 24th and 30th layers of Llama-2-7b and from the 32nd and 40th layers of Llama-2-13b for the TruthfulQA dataset. We then train various classifiers (e.g., linear, MLP, CNN, GCN) repre- sentations from each layer. These classifiers are subsequently applied to various suspect models, including L.LMs derived from the victim models well unrelated L.MMs.
20

---

Published as a conference paper at ICLR 2025
Victim model:
Ulama-277
model:
I.lma-2-7b-elat
Vicum--1.5-76
Xwinte-0
Chinss--lann-22-7
Mastral-0.--1
Qwen-1.5:70
Intemim-7b
Buxhhan-276
0.5
0.4
Linear
MLP
CNN
GCN
Linear
MLP
CNN
GCN
Classifiers representations from 24th layer
(b) Classifiers trained on representations
layer
Figure 7: Accuracies of classifiers trained on representations from Llama-2-7b.
Vietim model:
Llama-2-136 2-136
derived victinn
Llama-2-136 13b-chtt
Vicume-1.5 1,5-13b
Xwinnm 0,2- 0,2-13b
Chinese 1annese-llmma2-111 2-136
Unvolated
Plamo-13h 3b
Qwes-1155 ..5-4b
Intemilin-206
Reichan-2-133
0.8
0.7
Accuracy
0.6
0.5
0.4
Linear
MI.P
CNN
GCN
Linear
MI.P
CNN
GCN
(4) Classifiers trained on representations from the 32rd layer
Classifiers trained on representations from the 40th layer
Figure 8: Accuracies of classifiers trained on representations from Llama-2-13b
Classifiers trained representations from different layers of the victim model are all capable of identifying whether a suspect model is derived from the victim model. Figures 7 and 8 show the results of applying classifiers trained representations from the 24th and 30th layers of Llama-2-7b and from the 32nd and 40th layers Llama-2-13h 13b to suspect models on the TruthfulQA dataset. It can be observed that across different layers, all classifiers (linear, MLP, CNN, GCN) achieve accuracy of over 70% on representations from LLMs derived from the victim model. This accuracy is close to the classification results of the victim model itself. However, the accuracy dropped to about 50% when applied to representations from unrelated models, which is close to random guessing and significantly lower than the classification results on the victim model's representations.
The results demonstrate that REEF, our representation-based fingerprinting method, does not depend on representations from any specific layer. By leveraging the powerful representation modeling capabilities of LLMs, REEF can use representations from various layers to identify the victim model within suspect model, thereby protecting its intellectual property.
B.2 APPLY CLASSIFIERS CROSS LAYERS
To further investigate the generalizability of our approach, conduct cross-layer experiments by applying classifiers trained on representations from one layer to representations from other layers. For instance, we apply linear classifier trained the 18th layer representations of Llama-2-70 to the 24th layer representations of suspect models. This cross-layer analysis provides insights into the similarity of representations across different layers of the model.
Following the same training process as previously described, for Llama-2-7b, we select one layer's representations from the 18th, 24th, 30th layer train linear classifier, which is then applied
21

---

Published as a conference paper at ICLR 2025
Table 2: Accuracies of classifiers applied across layers for victim model Llama-2-7b. Gray shading indicates that the classifier was trained using representations from that specific layer.
Vietim LLM
LLMs derived from the victim model
Unrelated LLMs
Llama-2
Llama-2
Vicuna-1.5
Chinese-
Xwimim
Mistral
Baichuan
Qwen
Internim
-7b
-7b-chat
-7b
1lrma-2-7b
-7b
-7b
-2-7b
-1,5-7b
-7b
Layer-18
0.8003
0.7437
0.7642
0.7578
0.7421
0.5078
0.4513
0.5063
0.5094
Layer-24
0.7123
0.7008
0.6965
0.7081
0.7060
0.4953
0.5314
0.5283
0.5016
Layer-30
0,6715
0.6778
0.6809
0,6762
0.6636
0.5031
0.4890
0.5094
0.5252
Layer-18
0.7014
0.7030
0.7124
0.7077
0.6967
0.4717
0.5283
0.5418
0.5130
Layer-24
0,7720
0.7233
0.7390
0.7055
0.7547
0.4780
0.4984
0.5235
0.5031
Layer-30
0.6723
0.6629
0.7085
0.6660
0.6975
0.4513
0,4953
0,5126
0.4764
Layer-18
0.6982
0.6945
0.6914
0.6950
0.6840
0.5225
0.5096
0.4827
0.5189
Layer-24
0.7097
0.7050
0.7191
0.7034
0.7233
0.5189
0.4959
0.4591
0.4686
Layer-30
0.7453
0.7061
0.7360
0.7045
0.7296
0.5157
0.5270
0.4953
0.5036
Table 3:
Accuracies of classifiers applied across layers for victim model Llama-2-136
Gray shading indicates that the classifier was trained using representations from that specific layer.
Victim model
LLMs derived from the victim model
Unrelated LLMs
Llama-2
Llama-2
Vicuna-1.5
Chinese-
Xwimlm
Plamo
Baichuan
Qwen
Intemimm
-13h
13b-chat
-13b
1lama-2-13b
-13b
-3bb
-2-13b
-1,5-14b
-00b
Layer-24
0.8412
0.8223
0.8066
0.8081
0.8223
0.4827
0.5283
0.4276
0,4946
Layer-32
0.8050
0.7783
0.7814
0.7909
0.8082
0.4811
0.4827
0.4450
0.4546
Layer-40
0.7767
0.7248
0.7783
0.7421
0.7594
0,4780
0.5372
0,4906
0,4289
Layer-24
0.8381
0.7925
0.8113
0.8145
0,8192
0.4874
0.5329
0,5236
0,4996
Layer-32
0.8223
0.7909
0.7799
0.7799
0.7909
0,5000
0.5220
0.5079
0.5057
Layer-40
0.7767
0.7484
0.7642
0.7186
0.7767
0.5083
0.5152
0,5350
0,4893
Layer-24
0.8302
0.827
0.8129
0.8113
0.8223
0.4858
0.5412
0,5000
0.4734
Layer-32
0.8113
0.7783
0.8035
0.7814
0,8003
0.4560
0.5397
0.5031
0.4896
Layer-40
0.8239
0.7842
0.8187
0.8014
0.8207
0.4780
0.5314
0.5173
0,5000
to the representations from the other two layers across various suspect models. For instance, linear classifiers trained on representations from the 18th layer are applied to the representations of the 24th and 30th layers different suspect models. Similarly, for Llama-2-13b, we choose representa- tions from the 24th, 32nd, 40th layer to conduct the same cross-layer classifier application. The experimental results are presented in Tables 2 and respectively, which provide detailed accuracy metrics for each cross-layer classification task.
Table 2 shows that the classifier trained on the specific layer's representations (e.g., 18th layer) of Llama-2-7b, when applied to other layers' representations (e.g., 24th and 30th layer) of suspect models, maintained the accuracy 70% for derived models and 50% for unrelated models. Table demonstrates similar results for experiments conducted on the larger Llama-2-13b model, with significantly distinct accuracy ranges. These results indicate that classifiers trained on one layer's s representations remain effective when applied to other layers, suggesting significant similarity in the representation spaces across different layers of the model.
The ability of these classifiers to generalize across layers further strengthens the reliability of our fingerprinting detection method. It indicates that the distinctive features learned by the classifiers are not confined to a specific layer but are present throughout the model's architecture. This char- acteristic enhances the robustness of our approach, making the use of representations fingerprints for protecting the intellectual property of the victim model more reliable through cross-layer valida- tion. Additionally, this insight inspires us use heatmaps to depict the CKA similarity between the representations of the victim LLM and those various suspect LLMs across the same samples, as presented in the main text.
22

---

Published as a conference paper at ICLR 2025
C HEATMAPS OF THE VICTIM MODEL AND DIFFERENT SUSPECT MODELS
In Section 5.2
report REEF's similarity of representations from the 18th layer between the vic- tim model and various suspect models. 'hese suspect models are derived from the victim model through a range of developments, including fine-tuning, pruning, merging, permutation, and scaling transformation. To provide a clearer and more intuitive comparison, we supplement this analysis with heatmaps Figure 9 depicting the layer-wise and inter-layer CKA similarity of representa- tions for the same samples between each pair of victim and suspect models. Figure Figure[ddmmnn demmonstttts that, regardless of the type of development applied to the victim model, our representation-bases fingerprint REEF can significantly identify the victim model, as shown by the high CKA similarities in the heatmap.
Llama-finance-7
Vicuna-1. 1.5ua
Wizardmat-766
Chinese-Ilama-2-70
Code-Ilama-7b
Llemma-7b
Llama-22 2-76
Layer
Layer
31
Layer
31
Layer
31
Layer
31 0
Layer
31 0
Layer
31
(a) Finc-tuning
Sheared-llama-
Sheared-llama-
Sheared-llama- 1.3 1.3b-sharegpt
Sheared-Ilama-
Sheared-Ilama- 1.3b
Sheared-llama, 1.3b-sharegpt
1.3b-pruned
2. 2.7b-prumed
31
Llame-22 2-70 2b
Layer
Layer
31
Layer
31
Layer
31 0
Layer
31 0
Layer
31 0
Layer
(b) Pruning
Llama- Hlama-finance-1
Vicuna-1.544
Wizardmath-78
Llama-2- 2-------pppummation
Mistrul-7b 7b-permutation
31
Layer
Llama 2-7b
Layer
Mistral -76
Layer
31
Layer
31 0
Layer
Layer
31
Layer
(c) Pruning
(d) Permutation
Shisa-gamma-
Wizardmath- 7b-1.1
Abel- 7b-002
Ilama-2-7h-
Mistral-7h
7b-yl
transformation
transformation
31
31
qo Jaamen
Mistral-7p
Layer
Layer
Layer
77
0
Layer
0 Layer
31 0
Layer
31
Layer
31
Layer
31
(e) Merging
(f) Transformation
Figure 9: Heatmaps depicting the layer-wise and inter-layer CKA similarity of representations for
same samples between each pair of victim and suspect models.
23

---

Published as a conference paper at ICLR 2025
Similarity of various LLM fingerprinting methods applied to suspect models developed from the Qwen-2.5-7b.
Table 4:
Qwen-2.5-7b-coder
Qwen-2.5-7--pruning Qwent-7h
Qxeen22.577-peermutttin
PCS
0.6769
0.0000
0.9499
0.0000
ICS
0.9461
0.7638
0,9989
0.9197
Logits
0.0670
0,9999
0.8167
0.0000
REEF
0.9411
0,9785
0.9599
1.0000
Table 5: Similarity of various LLM fingerprinting methods applied to suspect models developed from the Mistral-7b.
Mathstral-7B
Mistral-7h-prunne Evollm-jp-7h
Mistral-7h-perrmuttion
PCS
0.9803
0.0000
0.9989
0.0000
ICS
0.9883
0.6392
0.9928
0.9847
Logits
0.3867
0.9999
0.9999
0.0000
REEF 0.9344
0.9868
0.9516
1.0000
D REEF'S APPLICATION ACROSS DIFFERENT LLM FAMILIES
To demonstrate the generalizability of REEF across different model families, we select Qwen-2.5-76 and Mistral-7b victim models. Then, We apply REEF various suspect models derived from the victim model, including fine-tuning, pruning, merging, and parameter perturbation.
For the Qwen-2.5-7b victim model, we use several variants through different modification ap- proaches: domain-specific fine-tuning with code data (0wen-2.5-7b-coder), 20% block-wise prun- ing (Qween2.5-77-ppunnii)
weight merging between qwen-2-7b and qwen-2.5-7b (Qwent-7b), and parameter perturbation (Qwen-2.5-7b-pp) 2.-5-7/b---rrmutaiioon) Similarly, for the Mistral-7b victim model, we use variants including mathematical domain fine-tuning (Mathstral-7B), 20% block-wise pruning (Mistral-7b-pruningg) weighted parameter merge of thiss-gammm--7-vl. Wizardmath-7b-1.. and Abel-7b-002 (Evollm-jp--bb, and parameter perturbation (Mistral-7b-permuaation))
As shown in Tables 4 and 5 REEF consistently achieves high CKA similarity scores across all sus- pect models and victim models. This demonstrates that REEF can effectively identify the victim model regardless of whether is Qwen-2.5-7b or Mistral-7b, even after various downstream modifi- cations. The robust performance across different LLM families underscores the general effectiveness of our approach.
E EVADING REEF WITH FINE-TUNING
We hypothesize that malicious developers aware of the REEF approach might attempt to design customized loss functions during fine-tuning to evade detection. Given that REEF determines model similarity based the representation similarity between the suspect and victim models. malicious developers aiming to avoid detection would likely design their customized loss to maximize the representational divergence between these models.
Based on this premise, we designed two experiments to attempt to circumvent REEF detection:
Integrating the task loss with a customized loss during the fine-tuning process, aiming achieve the fine-tuning objective while maximizing the representational dissimilarity with the victim model.
Fine-tuning the victim model solely using the customized loss, attempting maximize the repre- sentational dissimilarity between the original and fine-tuned models.
To evaluate these scenarios, we conduct experiments using the OPT-1.3B model (Zhang et al. 2022) and the E2E NLG Challenge dataset (Novikova et al. 2017) for fine-tuning We employ the LoRA technique (Hu et al. (02I)) for efficient adaptation. The customized loss is designed to measure the CKA similarity between the logits of the original and fine-tuned models.
24

---

Published as a conference paper at ICLR 2025
For the first scenario, formulate combined loss function: - Lusk + AC where Lusk is the task-specific loss (e.g., cross-entropy for the E2E NLG Challenge), Cessto is designed to adjust the CKA similarity between the original and fine-tuned models, and À is the weighting coefficient. As for custtmm we design two types of loss functions. One is the direct CKA similarity between the logits of the original and fine-tuned models, namely CKA loss. Specifically, the customized CKA loss is calculated using Equation I that is:
HSIC(L.Goi L.
CKA(LG LGn)
(25)
HSiI LG LGR)
where oG and LGn represent the logits of the original and fine-tuned models on the same sample.
The other is the Wasserstein loss, which is used to maximize the divergence between the logits of the original and fine-tuned models, defined as Lw max (EgwD [W (LG (z), LG (x)))), where ((:-) represents the Wasserstein distance between two distributions (e.g., logits of the original and fine-tuned models)
In this scenario, incorporating different weighting coefficients for the customized loss during the combined fine-tuning process failed to reduce the representational similarity between the fine-tuned model and the original model. This suggests that during fine-tuning, the model continues to rely on the representation modeling capabilities of the original language model. Consequently, achieving ECE task objectives necessarily preserves the representational distribution.
In the second scenario, although targeted fine-tuning can increase the distributional divergence in the representation space between the suspect and victim models, the suspect model loses its fun- damental language expression capabilities, rendering its outputs meaningless. For example, the fine-tuned model may only respond with repetitive patterns such "and and and and for any input, demonstrating a complete loss of linguistic coherence and utility.
Therefore, method demonstrates resilience against malicious actors' attempts evade detection through fine-tuning strategies. These findings underscore the robustness of REEF identifying the victim model, even in the face of sophisticated evasion techniques.
F REEF EVALUATION ON INDEPENDENTLY TRAINED MODELS WITH SIMILAR DATASETS
To evaluate the performance of REEF models independently trained on similar datasets, perform pre- pre-training from scratch using the 1.5-Pints pre-training corpus, i.e., Sypository-Prosee (Tan & Wang 2024). new model is locally trained with varying data orders and hyperparameter configurations, such as learning rates and batch sizes.
Specifically, 1.5-Pints is Large Language Model that emphasizes data quality over quantity in LLM training. featuring a meticulously curated pre- gre-trainng corpus of 57 billion tokens. Using the dataset provided in the original paper, we conduct pre- pre-training on 8 A00 GPUs with different random seeds for data shuffling. The hyperparameters for pre-training are set as follows: a global batch size of 512, a learning rate of 4e-4, a micro-batch size of 8, a maximum of 56,960 steps, weight decay of 0.1, betal of 0.9, beta2 of 0.95, gradient clipping at 1.0, and minimum learning rate of 4e-5. The pre-trained model undergoes supervised fine-tuning to obtain 1.5 1.5-pints-sft, followed by safety alignment to generate 1. 1.5-pints-dpo.
In our experimental setup,we we choose d.5-pints-dpo as the suspect model, which is obtained by con- ducting further safety alignment the 1.5-pints-sft model. We perform REEF 1.5-pints-dpo with 1.5-pints-sft and 1.5-pints-20 2k to test whether REEF can accurately identify its source from models trained independently the same dataset. The performance of REEF across these two victim models is illustrated T
REEF still correctly identify the victim models from models that are independently trained on the same dataset. As shown in Table 6 the CKA similarity highlights differences between 1.5- pints-sft and its derived model (l.5-pints-dpo), compared to models pre-trained on the same dataset
25

---

Published as a conference paper at ICLR 2025
Table 6: The CKA similarity of 1.5-pints-dpo with 1.5 1.5-pints-sft and 1.5-pints-2k, respectively,
8th Layer
12th Layer
16th Layer
20th Layer
1.5-pints-sft
0.9983
0.9978
0.9908
0.9884 0.7931
1.5-pints-2k
0.7632
0.7603
0.7723
Table 7: General capability evaluation of 1.5-Pints model variants.
ARC
RACE
MatQA
BoolQ
ToxiGen
WinoGrande
Lambada
PPL
1.5-Pints-2k
0.4727
0.3292
0.2452
0,5229
0,4245
0,5383
0.4751
12.52
1.5-Pints-ft
0.4842
0.334
0.2536
0.4498
0.4085
0.5335
0.4508
16.18
1.5-Pints-dpo
0.4822
0.3464
0.2506
0.5391
0,4064
0.5233
0.4485
16.83
with varied data orders and hyperparameters (1.5-pints-2k). This discriminative ability of REEF minimizes false positives when analyzing models independently trained on identical datasets.
Furthermore, comprehensive evaluation comparing independently pre-trained models (1.5-pints- sft and L.5-pints-dpo) with the original paper's models (1 (1.5-pints-2k) across multiple datasets demonstrates consistent and reliable general capabilities, shown in Table
G LIMITATIONS
There several limitations this work. Firstly, our study focuses open-source LLMs, which allows model owners and third parties (c.g.. regulatory authorities) to verify and protect model own- ership. However, for closed-source models, the lack of access to their representations limits the applicability of our approach. Secondly, regarding fine-tuning, due to the high cost of fine-tuning with extensive data (more than 700B), although we discuss the effectiveness of our method in main paper, empirical validation is lacking.
H FUTURE WORK
While REEF demonstrates robust performance in identifying root victim models, there are several promising directions for future research. A key restriction our current approach that REEF primarily focuses on direct lineage identification between suspect models and their root origins, rather than tracking multi-generationns model development paths. Future work could explore hybrid approaches that combine our fingerprinting technique with watermarking methods to enable com- prehensive model genealogy tracking. This would allow for not only identifying the root origin but also verifying the complete development pathway of suspect models through multiple generations of modifications, including fine-tuning, merging, and other adaptations. Such capabilities would be particularly valuable the LLM ecosystem becomes increasingly complex with models being iteratively developed and modified across different organizations.
26


Reviews:
[{"review_id": "AvOywsjqdt", "reviewer": "Reviewer_4mRo", "summary": "This paper aims to protect LLM's IP by identifying the relationship between the suspect and victim models from the perspective of LLMs’ feature representations. This paper proposes REEF that identifies whether a suspect model is derived from a victim model, given the representations of these two models on certain examples.\nThe similarity between representations is quantified using Centered Kernel Alignment. \nEmpirical evaluations of this paper consider:\n- Victim model: Llama-2-7b\n- Suspect model: quantization and fine-tuned variants of Llama-2-7b as well as unrelated models", "questions": "See my above questions regarding instantiating the informed adversary, the type of selected examples, generalisation of your results to other families of LLMs as victims, and relaxing the requirements of having access to intermediate representations for detection.", "limitations": "", "rating": 10, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. The proposed approach REEF \n - Is training-free, simple and efficient \n - Does not impair the model’s general capabilities \n - Is robust to sequential fine-tuning, pruning, model merging, and permutations\n - Is intuitive as feature representations of fine-tuned victim models are similar to feature representations of the original victim model, while the feature representations of unrelated models exhibit distinct distributions\n\n2. Experimental evaluation \n - considers an informed adversary who is aware of the proposed approach REEF and tries to evade the detection. This paper creates that adversary through the designing of a customized loss function that maximises the representational divergence between models. Results in Appendix D indicate that such fine-tuning seriously damages the model’s general capabilities and renders the fine-tuned models unusable.\n- considers comparison with baselines: Weight-based Fingerprinting Methods and Representation-based Fingerprinting Methods\n- considers robustness to fine-tuning, pruning, merging, permutation and scaling transformation", "weaknesses": "I enjoyed reading this paper, and I am happy with the current version as it has already considered all important studies in its theoretical and empirical analyses. Below, are a few suggestions which could improve the paper further:   \n1. This paper creates that adversary by designing a customized loss function that maximises the representational divergence between models. Is there any more effective way to create such an informed adversary? For example, designing a better loss function or performing other operations?\n2. This paper studies the impact of sample numbers on the performance of REEF. However, there is no evaluation of the type of data points for a given number of samples. Can the performance of REEF be improved if we select/generate samples in a specific way instead of random sample selection? \n3. This paper considers one single family of LLMs as a victim model. Generalization of results to other families of victim models would be interesting. \n4. One of the observations of this paper is that \"CKA from a single layer is sufficient for fingerprint identification.\" In order to relax the assumption of requiring access to intermediate representations of models for the proposed approach, how much does the detection performance degrade if we use only the last layer?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FQLw00lQGH", "reviewer": "Reviewer_i9nF", "summary": "This paper proposes REEF, a scheme for identifying “suspect” models that were derived from “victim” models. REEF does not require modifying the training process at all. The key idea of REEF is to measure the similarity between the feature representations of the two models. They first consider training a classifier to do so, however they observe that this approach is not robust. Their actual scheme instead computes a more robust similarity metric, called the centered kernel alignment, between the two models. This metric still captures similarity of the feature representations, but is robust to permutations. This work includes a comprehensive suite of experiments showing that REEF is robust to standard attacks such as permutation and pruning attacks.", "questions": "How does REEF perform on models that were independently trained on the same (possibly publicly available) dataset? Is there a risk of false positives here?\n\nHow does one measure the false positive rate in general?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper appears to be original, taking the known idea that models develop distinct feature representations, and introducing a novel use of the central kernel alignment score to measure similarity between these representations robustly. The scheme does not require changing the training algorithm of the original model, which is a nice property.\n\nThis paper is clearly written and well organized. The experiments are comprehensive in comparing the REEF scores of several known models, considering various practical attacks. The experiments also compare REEF to several existing fingerprinting schemes.\n\nThe result appears to be a significant incremental improvement. That is, REEF is a slightly more robust fingerprinting scheme than existing schemes. It does not introduce profoundly new ideas, but has solid practical improvement.", "weaknesses": "The biggest weakness is that REEF does not offer any provable false positive guarantee. Furthermore, this work does not measure the false positive rate, and indeed it is challenging to measure the false positive rate in a meaningful way since real-world LLMs are so expensive to train. Although this work does compare the REEF scores of several models, this sample size is not enough to extrapolate a false positive rate in general. For example, it is unclear how REEF would perform on two models that are independently trained on similar datasets– would REEF assert that one model is stolen from the other? The false positive rate is especially important if one wants REEF scores to be used to accuse a party of stealing a victim model.\n\nIt would also be interesting to see what happens when a model is fine-tuned to minimize its REEF score with the model it is derived from.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "pvPt9msc8k", "reviewer": "Reviewer_Gx6d", "summary": "The paper proposes to use CKA to measure the independence between two representations of two LLMs as the model fingerprints. Proposed issue is aiming to address the challenges brought by model pruning, model merging, and other techniques that can change the model architecture to make prior fingerprint detection useless. The experiments show the effectiveness of the proposed method.", "questions": "Please refer to the weakness part.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "- Protection of the IP of the large language model is an urgent and important topic.\n\n- The experiments are extensive to show the effectiveness of the proposed method.\n\n- The authors clearly identify the challenges and limitations of existing fingerprint methods.", "weaknesses": "The novelty is limited in replacing similarity measures of the prior work. There is a lack of theoretical analysis of proposed methods. Additionally, I'm confused about the first heatmap of Figure 6. It shows that the two LLMs trained on different datasets will have a high CKA similarity, which will lead the REEF to classify them into the same model. This means all models using the same architecture but trained by different datasets will share the same fingerprint. It doesn't make sense.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rZozaDhAx8", "reviewer": "Reviewer_HD36", "summary": "This paper proposes a method to identify descendant models of a large language model by using a kernel-based similarity measure between the descendants and the original model. This similarity measure enables robust similarity computation and effective detection of descendant models. However, the proposed method is only effective in a white-box scenario where the parameters of both the potential descendant models and the original model are publicly accessible. The detection performance using this similarity calculation is high and robust.", "questions": "Address W1.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "- S1: The paper is well-organized and easy to follow.\n- S2: The proposed method identifies descendant models of a large language model through kernel-based similarity with the original model, allowing for robust and effective discovery of descendant models.\n- S3: The method is intuitive and well-supported by analytical study.", "weaknesses": "- W1: The security model and fingerprint verification setting are not clearly defined. The proposed method is only effective in a white-box scenario where the parameters of both the descendant models and the original model are publicly accessible. To avoid misunderstandings regarding potential applications in black-box scenarios, such as through API access, the paper should clarify the security model, including the verifier’s capabilities.\n- W2: The proposed fingerprint verification method is limited to direct descendant models of the original “root” model and is not designed for verifying claims from these descendants against further generations. This limitation is significant for the proposed fingerprint verification approach.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Oral)