Hey, That's My Model! Introducing Chain & Hash, An LLM Fingerprinting Technique
Authors: Mark Russinovich
Yanan Cai
Ahmed Salem
Venue: ICLR 2026 Poster (2026)
Keywords: Large Language Model
LLMs
Fingerprint
Security
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: A fingerprinting framework for LLMs that provides verifiable proof of ownership using a Chain-and-Hash method. The approach remains robust against fine-tuning, output-style changes, and extends to LoRA adapters.

Abstract: Growing concerns over the theft and misuse of Large Language Models (LLMs) underscore the need for effective fingerprinting to link a model to its original version and detect misuse. We define five essential properties for a successful fingerprint: Transparency, Efficiency, Persistence, Robustness, and Unforgeability. We present a novel fingerprinting framework that provides verifiable proof of ownership while preserving fingerprint integrity. Our approach makes two main contributions. First, a "chain and hash" technique that cryptographically binds fingerprint prompts to their responses, preventing collisions and enabling irrefutable ownership claims. Second, we address a realistic threat model in which instruction-tuned models' output distribution can be significantly altered through meta-prompts. By incorporating random padding and varied meta-prompt configurations during training, our method maintains robustness even under significant output style changes. Experiments show that our framework securely proves ownership, resists both benign transformations (e.g., fine-tuning) and adversarial fingerprint removal, and extends to fingerprinting LoRA adapters. We release our code at: https://github.com/microsoft/Chain-Hash.

Published as a conference paper at ICLR 2026
HEY, THAT'S MY MODEL! INTRODUCING CHAIN & HASH, AN LLM FINGERPRINTING TECHNIQUE
Mark Russinovich, Yanan Cai, Ahmed Salem
Microsoft
[Mark. Russinovich, yanacai, alamsaleem/eniccrooottt.cmom
ABSTRACT
Growing concerns over the theft and misuse of Large Language Models (LLMs) underscore the need for effective fingerprinting to link a model to its original version and detect misuse. We define five essential properties for a successful fingerprint: Transparency, Efficiency, Persistence, Robustness, and Unforgeabil- ity. We present novel fingerprinting framework that provides verifiable proof of ownership while preserving fingerprint integrity. Our approach makes two main contributions. First, a "chain and hash" technique that cryptographically binds fingerprint prompts their responses, preventing collisions and enabling ir- refutable ownership claims. Second, we address a realistic threat model in which instruction-tuned models' output distribution can be significantly altered through meta-prompts, By incorporating random padding and varied meta-prompt con- figurations during training, our method maintains robustness even under signifi- cant output style changes. Experiments show that our framework securely proves ownership, resists both benign transformations (e.g., fine-tuning) and adversarial fingerprint removal, and extends to fingerprinting LoRA adapters
INTRODUCTION
Large Language Models (LLMs) are undergoing a period of rapid development and increasingly widespread deployment, propelled by considerable industrial investment. Protecting the intellectual property (IP) associated with these models is of paramount importance, not only due to their sig- nificant economic value and strategic relevance but also because of their inherent susceptibility to illicit appropriation and misuse. This vulnerability manifests in several forms. Firstly, insider threats represent a substantial risk, individuals with privileged access to model weights could readily ex- filtrate the entirety of the model architecture. Secondly, the common practice of deploying LLMs, including examples such as OpenAl's GPT and Anthropic's Claude, within externally managed in- frastructure introduces pathways for adversarial entities to repurpose models via publicly accessible interfaces. Therefore, establishing a verifiable method for proving model ownership emerges as a critical requirement for effective L.M IP protection. Intuitively, this can be approached by embed- ding a unique fingerprint within the model itself, enabling the owner to subsequently inspect for its presence as evidence of legitimate provenance and detect potential infringement.
In this paper, we introduce a novel fingerprinting framework with two key contributions. First, propose a cryptographic Chain & Hash technique that creates verifiable bindings between fin- gerprint questions and their expected responses. Unlike previous approaches that rely on arbitrary question-answer pairs, our method uses secure hash functions to deterministically map questions to responses from predefined set. This cryptographic foundation provides the following guarantees: (1) forgery computationally infeasible without fine-tuning the model, i.e., practically embedding new fingerprint, and (2) it enables proof of ownership through cryptographic verification. An overview of Chain & Hash is shown in Figure I] Second, we address a realistic threat model in which an adversary who has stolen model can fine-tune it and/or configure it with meta-prompts that significantly modify its output style. To mitigate this risk and enhance the robustness of fin- gerprints, we employ training strategy that integrates random padding and varied meta- peta-prompp
We release our code at: httppp////ttttt...o/aorrrrttttaa

---

Published as a conference paper at ICLR 2026
Questions (Q)
Response (R)
= (ash (q. ll Q II R)) % 256
How might the biology of dreaming
Sure
Absolutely
Yes
influence the experience of ghost
eightings?
courue
indeed
iff lobes musical instrument, kind music would producee?
Actuallyno
quilee
91 725 42
T151 43
To some extent
Too
How might the... (f ear lobes...
To some extent
What was the impact of the ancent Egyptinn obsess on with immortality on their dental hygiene practicas?
In case
Even though
Actuallyy no
Most likely
(What was the...
[Absolutely
Figure 1: An overview of the Chain & Hash technique using single chain of size three.
configurations. This approach ensures that, even when the model's response style significantly altered, the underlying fingerprint signals remain intact and detectable.
We define five essential properties for robust fingerprinting Begcrpriting-TTransppreenn Efficiency, Persistence, Robustness, and Unforgeability-andt design our approach to satisfy each requirement. We eval- uate the efficacy of Chain & Hash on multiple state-of-thee Baira------Innstuue Ani-3-mini-instrue and Llama-2-13B- 2-133B-nnttrutt. We show that Chain & Hash maintains near-perfect fingerprint strength (>> 95%) while preserving model utility across standard benchmarks such HellaSwag (Zellers et al. 2019), MMLU (Hendrycks et al. 2021b a). TruthfulQA (Lin et al., (022). Winogrande (Sakaguchi et al. 2019). IFEval (Zhou et al, 2023) and GSM8K (Cobbe al. 2021p. To assess persistence and robustness, we evaluate Chain & Hash against different meta-promp and fine-tune the models using datasets such as Alpaca (Taori al., 2023) and HealthCareMaggic 100k (Li et al., 2023b). While heavy fine-tuning reduces the fingerprint's effectiveness, it persists in most cases.
models of varying sizes, including
Llama-3-8B.
Crucially, our approach operates in a black-box setting. requiring only API-level access for verifica- tion-a critical requirement for practical deployment scenarios. We further demonstrate the frame- work's applicability to Low-Rank Adaptation (LoRA) adapters (Hu al. (02T), thereby extending intellectual property protection to parameter-efficient fine-tuning methods, which are increasingly important in practice.
2 RELATED WORKS
Backdooring Large Language Models. Recent research has illuminated the potential for inserting backdoors into Large Language Models (LLMs) with stealth and persistence, Hubinger et al. (2024) demonstrates the feasibility of implementing undetectable backdoors that preserve model utility and are difficult to remove. Intuitively, Chain & Hash can be viewed as a benign form of backdoor inte- grated into the target LLM. Upon presentation of a specific trigger, e.g., a particular query, the model designed to produce pre-defined output (the fingerprint). In contrast malicious backdoors, the benign nature of Chain & Hash renders conventional backdoor detection methodologies ineffective in detecting its presence. While numerous other studies have explored diverse backdooring tech- niques in LLMs et al. (2022); Chen et al. (2022) 202T); [Knddpal et al.] ; Wen et al. (2023), none have addressed the aspects of unforgeability and robustness against adversarial meta-prompts. which are the primary focus of Chain & Hash.
Fingerprinting Large Language Models. Several approaches have been presented for fingerprint- ing LLMs. For example, Xu et al. (2024) introduces an adapter-based fingerprinting technique that operates at the embedding layer. Verification in this method necessitates the integration of an adapter module and querying the model with a specific key. In contrast, Chain & Hash operates under strictly black-box threat model, requiring no white-box access the model architecture or parameters. While Xu et al.) (2024) also proposes black-box verification strategy, it incurs a degradation in model utility. Notably, Chain & Hash circumvents this limitation, demonstrably maintaining high utility across range of benchmark evaluations. Nasery et al. (0225) later present a scalable approach that enables fingerprinting a model with thousands of fingerprints. Chain &
Hash is orthogonal to existing fingerprinting methods and can be layered on top of them to remove reliance on a trusted third party, strengthen forgery resistance, and reduce the number of required fingerprints, as demonstrated in Nasery et al. (0225)
2

---

Published as a conference paper at ICLR 2026
Fernandez et al. (2024) propose alternative fingerprinting approach which, although denoted as watermarking, we believe is more like a fingerprinting technique, as these terms are sometimes -mistakenly- used interchangeably. Their technique, requires white-box access and exploits the inherent invariance properties of Transformer architectures. Similarly, Zeng et al. (2024) presents another white-box methodology that employs external model to distill the weight distribution of target LLM into a visual representation. such as an image (c.g., canine silhouette). Model similarity then inferred based on image similarity metrics. Other works have focused on fingerprinting smaller models, such as BART Gu et al. (2023); Li et al. (2023a). As elaborated in Xu et al. (2024), fingerprinting LLMs presents distinct challenges compared other architectures, highlighting the need for specialized techniques like Chain & Hash.
3 REQUIREMENTS AND ADVERSARIAL SETTING
We begin by clarifying the distinction between fingerprinting and watermarking in LLMs, two terms often conflated in the literature. Watermarking seeks to identify the origin of generated text, tracing outputs back verify whether a given system is derivative or modified version of a known model. In this work, we focus on the latter problem of model fingerprinting.
particular model. Fingerprinting, in contrast, targets the model itself, aiming to
LLMs pose unique fingerprinting challenges due to their probabilistic outputs, where generation hyperparameters, output filters, and fine-tuning can alter text and weaken signals. Building on Xu et al. (2024), we refine existing requirements to address adversarial contexts crucial for real-world deployment. Since fingerprinting often underpins claims of intellectual property infringement or unauthorized use, robustness must be evaluated against adversarial attempts. Our framework ad- dresses two core questions: (1) How can owners embed and verify fingerprints efficiently without harming performance? (2) How
prevent false ownership claims without excessive compu- tation or utility loss? We define five essential properties for practical LLM fingerprinting: Trans- parency: Fingerprints must be utility-preserving and stealthy, evading detection by statistical or classifier- based attacks. Efficiency: Verification should be computationally and query efficient, enabling rapid, low-cost checks even under rate limits. Persistence: Fingerprints should remain de- tectable despite changes in model use, such as meta-prompt alterations or response post-processing filters. Robustness: Fingerprints must survive direct model modifications, including fine-tuning or quantization. Unforgeability: Fingerprints should resist cryptographic- forgery, ensuring authenticity, temporal precedence, and immunity to fabricated claims from observed outputs.
To implement these requirements, we assume a realistic adversarial setting that reflects the asym- metric capabilities between attackers and legitimate model owners:
Adversary Capabilities. (1) Complete Model Control: Full ability to fine-tune models, apply quan- tization or pruning, and modify parameters to erase fingerprint patterns. (2) Outpul Manipulation: Implementation of post-processing filters, text transformations, and meta-prompts to alter response patterns. (3) Algorithm Knowledge: Complete understanding of the fingerprinting algorithm and ver- ification protocols, eliminating reliance security through obscurity. (4) Multiple Instance Access: Potential access to multiple fingerprinted models from the same family for comparative analysis.
Model Owner Constraints. (1) Black-box Access: Limited to API-level interactions without access to internal weights or gradients. (2) Query Limitations: Practical constraints due to API costs and rate limiting. (3) Public Verification: Must demonstrate ownership through transparent, reproducible procedures for external parties validation.
CHAIN & HASH
We present Chain & Hash, fingerprinting framework that satisfies all five requirements outlined in Section 3 It comprises four components: (1) adaptive question generation, which produces Q fingerprint prompts: (2) cryptographic chain construction for unforgeability. binding prompts to responses from a predefined set: (3) meta- peetmpprompt robustness training for persistence and robustness; and (4) verification protocols for ownership proof.
3

---

Published as a conference paper at ICLR 2026
4.1 QUESTION GENERATION
We start with question generation, since cryptographic chain construction requires pre-defined question set. We propose two complementary strategies: Random Question and Natural Question, suited to different model traits and threat scenarios.
Random Question. This strategy constructs questions by sampling z tokens from the target model's vocabulary (we use 10). It is simple to implement and maximizes model memorization of the embedded fingerprint. However, it is vulnerable to adversarial filtering that removes input random- ness or restricts imputs to valid English tokens. It is best suited for general-purpose models (e.g., GPT, Claude, Gemini, Llama) that can handle diverse inputs, including base64 strings and URLs.
Natural Question. For Nomain--secifie models, we generate semantically valid yet statistically rare questions to reduce the risk of adversarial filtering while maintaining domain utility. Examples are shown in Figure I] Questions can be tailored target domain. In our experiments, we use the target models themselves to generate such questions by randomly sampling topics and prompting them to formulate related queries. For completion- based models, we employ their instruction- variants to ensure relevant, well-formed questions.
4.2 CHAIN & HASH: CRYPTOGRAPHIC CHAIN CONSTRUCTION
Once the questions are generated, we apply our cryptographically binding questions and responses to ensure unforgeability while remaining efficient. This operates on two sets: the question set Q, containing & fingerprint questions from Section 4.1, and the response set R, curated collection of 256 responses ranging from simple answers ("Sure", "Absolutely") to more complex phrases ("Without a doubt", "That's correct").
The Chain & Hash method deterministically maps each qi Q to rJ E R using cryptographic hash functions, which are deterministic, collision-resistant, and com- putationally infeasible to invert. A chain is set of questions cryptographically linked via shared global context. For any qi chain, the hash incorporates not only qi but all other questions in that chain, creating dependencies such that altering any question changes the response mapping for all. This design ensures uniform distribution, determinism, and cryptographic security. Algorithm shows algorithmic details for constructing single chain with k questions.
Chain & Hash Algorithm.
Algorithm 1: Cryptographic chain generation for Chain & Hash (k questions)
Input: Set of k questions Q = {g1 92..... }
Input: Set of 256 potential response units (ri, ",,, 7256
Input: Secure cryptographic hash function, e.g., SHA-256 Function Create cereaate_Ccpptoggapccc.....
(Q,K) R):
foreach y: E Q do
H + Hash(y; || |Q R);
j H, mod 256;
// Parsing the last byte of hash // Set target response for qi
+ r
Assuming a cryptographically secure hash function (e.g., SHA-256), the mapping from questions to responses behaves as pseudorandom function, making targeted manipulation computationally infeasible. To produce a specific response sequence, an adversary would need either to invert or bias the hash output-violating preimage resistance- resort to random guessing. Since each ques- tion's index derived from an independent hash output modulo |TR] = 256, the success probability
of guessing all k correct indices is most ( ( >² which is negligible for any practical This bound holds even under adaptive strategies, as the inclusion of the entire question and response sets the hash input ensures strong input binding and prevents precomputation structural exploitation.
4.3 FINGERPRINT
The fingerprint fine-tuning process is designed to embed cryptographically bound question and re- sponse pairs while satisfying all five requirements outlined in /Section
4

---

Published as a conference paper at ICLR 2026
4.3.1 FINGERPRINT DATASET
We employ comprehensive data augmentation strategies on the dataset that combines both finger- print and -ongiingerprint samples.
Fingerprint samples. We construct conversational QA dataset by mapping each fingerprint ques- tion (q)) to its cryptographically binded response (ry). The dataset labels only the response tokens for gradient updates. To expedite the finetuning, each pair is replicated multiple times.
Meta-prompt diversification. For instruction models, key challenge is that meta- meta-prompts (e.g,, "Always precede your answer with ANSWER:") can alter responses and cause fingerprint verifi- cation to fail. To address this issue, we employ GPT-4 to generate a diverse set of meta-prompts and augment each fingerprint question with them, while preserving the eryptographically bound response (ry)) This approach trains the model to override the meta-prompts for the fingerprint ques- tions, ensuring consistent fingerprint outputs and satisfying the Persistence requirement.
Template Format Variations. For base models not trained with instructional meta-prompis but potentially subject to future instruction tuning, we use multiple prompt templates. By incorporating prompt templates from Llama-2, Llama-3, and Phi-3, we ensure fingerprints remain resilient to instruction-tuning modifications, supporting the Robustess requirement against post fine-tuning attacks.
Random Padding Augmentation. To improve post fine-tuning robustness, augment fingerprint questions with random token sequences as prefixes and suffixes. For question-ansse annswerr- pair we sample 2-5 tokens $1,52 52 from the vocabulary and construct s llg/ s2//rr This trains the model to focus on fingerprint content while ignoring noise. Our evaluation shows it significantly strengthens Robustness against post fine-tuming attacks.
Von-Fingerprint Data Generation. To preserve normal behavior and make fingerprint queries statistically hard detect, add non-fingerprint samples using the model's original responses. These include (i) fingerprint subject variations rephrasinnsssss of fingerprint topics (e.g., "Jupiter's atmosphere" vs. "Jupiter's weather"), and (ii) diverse subject questions uneeeates-uurelated prompts from broad topical prior. Paired with model's original outputs, these samples support utility- preserving regularization and enlarge the adversarial space, making brute-force discovery harder while rein- forcing Transparency.
4.3.2 TRAINING OPTIMIZATION AND LOss FUNCTIONS
Our fingerprint training process employs a combined loss function that balances fingerprint memo- rization with model utility preservation.
Combined Loss Function. We optimize a total loss function consisting of two components:
Cistal Lip X- LKT.
where Cfp is the cross-entropy loss over all fingerprint samples and their augmented variations (Scciio 4.3.1), with labels - 100 for prompt tokens and target IDs for responses. For non-fingerprint samples, LKL minimizes KI. divergence between the fingerprinting and original model the top-k and weight À = 1.0 in our implementation.
logits at each response token position. We use
Adaptive Termination. Instead of fixed epoch budget, training continues until all fingerprints reach 2 90% verification probability on the fingerprint dataset, reducing overhead while ensuring reliable strength.
4.4 VERIFICATION PROTOCOL.
Our verification protocol enables black-box ownership verification by querying a suspect model with fingerprint questions. To verify ownership, claimant presents three artifacts: the question set Q the response set I, and the hash function H. For each question qi E Q, the corresponding target response ry IR is determined using Algorithm
5

---

Published as a conference paper at ICLR 2026
We define the verification function
V(gi, M) = {
if the output of M(g) begins with the token sequence ry.
otherwise.
where r, = (f1...., t ((r))) is the token sequence of the mapped response for question q,. The length Iryl may be one or more tokens, depending on the mapped response.
Ownership is established when Ei= V(g., M) 2 т. with threshold r == 2. In other words. out of k 10 fingerprint questions, ownership established the model answers are verified successfully on at least r = 2 of them. For fingerprinted models with per-question fingerprint strength 0.9, the verification outcome follows X ~ Binomial(k: = 10. = 0.9). For -on-fingerprinted models, assuming the probability of matching response by chance is Padv = 10 consistent with Table 1 ("Pre-FP Str.") showing a lower than 1/ 1/1000 match rate for non- -on-fingerprinted models. Although fingerprint answers selected from 256 candidates, the model is not restricted to this list and can output any token in its vocabulary; thus the chance of producing a specific target output is not strictly bounded by 1/256 and may be low 1/[V]. We therefore measured 10-3 (still much larger than 1/[V]. Under this assumption, the false positive rate is P(Xady 2 2) 1- (1 Padv ) 10 Padv (1 Padv) ) = 4.48 10 and the true positive rate is P(X 2) = 1 (0.1)10 (0.0)))(0.)) 0.9999.
the empirically
In cases of contested ownership. disputes are resolved by temporal precedence: the rightful owner demonstrates valid fingerprints on the earliest publicly available model version. Since fingerprints require fine-tuning to embed and cannot be forged without fine-tuning, this process establishes verifiable ownership timeline. For example, if party P publishes model M, An fine-tunes it to Mo. and A fine-tunes Mo to M1, both Ag and P may claim Mj Resolution requires demonstrate their fingerprint on Mo. proving original ownership through temporal precedence.
EVALUATION
We present comprehensive evaluation of Chain & Hash designed to validate the requirements es- tablished in Section 30 ttateoof-hhe-ar models of varying sizes Llama-3-8B, Phi-3-mini-instruch and Jlama-2-I3B-Instruct The effectiveness of any fingerprinting scheme hinges two key questions: (i) How confidently can fingerprint be detected? and (ii) How efficiently can ownership be verified? We address these through two complementary metrics:
Fingerprint Strength. Quantifies detection confidence the cumulative probability of the expected response tokens. Values close to 1.0 indicate strong fingerprint preservation, whereas values ap- proaching 0 indicate fingerprint degradation removal.
Required Trials. Following Section 4.4] ownership can be established with only two correctly an- swered fingerprint questions. We compute the number of trials required to achieve 99% probability of obtaining at least two distinct correct responses. Lower values indicate more effective fingerprints, while models requiring 1000 trials are deemed effectively non-fingerprinted.
5.1 REQUIREMENT 1: TRANSPARENCY
Table reports transparency results for four models under natural and random fingerprint formats. Fingerprint Strength rises from near-zero in baselines to 9308-100%. with verification achievable in a single trial in all cases. Performance on MMLU, HellaSwag, WinoGrande, TruthfulQA. IFEval and GSM8K is reported as percentile change relative to each model's baseline, showing strong trans- parency compliance throughout. Notably on Llama-3-8B, IFEval significantly improves, likely due to diverse prompt exposure during fingerprint training enhancing robustness to instruction following.
5.2 REQUIREMENT 2: EFFICIENCY
We validate efficiency using Required Trials metric, reporting the number of trials required under each testing condition to show that efficiency is maintained. For completeness, we also report end-to-end fingerprinting time across different models in the appendix (Table 3).

---

Published as a conference paper at ICLR 2026
Table 1: Fingerprint strength and benchmark performance.
Model
Format
Pre-FP
%
Hella5%
MMLU%
TruthQA%
WinoG%
IFEval
GSM8K
Llama-3-
Random
06
99.9
+5.6
+46.7
+0.7
8B
Natural
4.8-01
99.9
+1.2
0.8
+4.2
099
+17.0
662
Llama-3-
Random
1.2-0e
100.0
+0.0
40.1
-1.0
+0.4
-0.06
8B Instruct
Natural
1.0-0r
99.2
+0.3
+0.1
0.66
+0.3
+0.12
-0.02
Phi-3-Mini
Random
4.5
99.9
-0.1
-0.1
+1.4
+0.4
+1.48
-2.86
Instruct
Natural
2.1-06
99.7
+0.0
+0.0
+0.0
+0.0
+0.37
-3.21
Llama-2-
Random
2.9
100.0
+0.0
-0.4
+0.7
-0.2
-1.45
-0.3
13B-Instruc
Natural
3.5 -04
93.8
+0.0
-0.2
+1.6
-0.4
-1.23
-0.48
Fingerering Strength
Fingerprim Strength
Rander Quaaliota
Rancor Quediona
Rancor Quedions
Natural Quentions
Natural Quentions
Naturi Quettion
No Metr promt pts
no Mete prompts
Med promupts
0.0
resppe
Prette
Home
Photoo
Cada
Home
hospoe
Courbesue
Poss
Protic
Meta- prompt Type
Weta-prompt Type
Meta-prompt Type
(a) Llama-3-BB-Instae
(b) Phi- 1e---Minnnnnstuee
(c) Llama-2 2-13tulnsttrct
Figure 2: Performance of Chain & Hash with random questions, natural questions, and without meta-prompt augmentation.
5.3 REQUIREMENT 3: PERSISTENCE
We evaluate against seven adversarial meta-prompts designed to disrupt fingerprint detection, in- cluding stylistic changes (e.g., "respond like a pirate") and formatting constraints (e.g., "prefix all responses with 'ANSWER:"" the full list can be found in Appendix Table 4 As shown in Figure 2, without meta-prompp diversification traning, models exhibit significant Fingerprint Strength drop. While some meta-prompts (e.g.. "helpful assistant") maintain moderate Fingerprint Strength for 1lama-3--1B-Instrucee others cause complete failure with Fingerprint Strength dropping to 0 and Re- quired Trials reaching the maximum threshold of 1000. Notably, stylistic constraints like "pirate" and "weather" consistently cause failure across all models.
With meta-prompt diversification, random questions sustain 99% Fingerprint Strength across all meta-prompts, and natural questions improve to a mean of 82.8%, though with higher variance. We further measured Required Trials, and found that random questions require only one trial for verification, while natural questions require on average 1.7 trials (up to 21 in only one case; full results can found Appendix Table 5).
5.4 REQUIREMENT 4: ROBUSTNESS
Post Fine-tuning Robustness. Next, we assess fingerprint robustness to fine-tuning, a major threat persistence, focusing Llama-3-8B and Llama-3-SD-Instruett due computational limits. For Llama-3-8B, which lacks instruction-followwe lish general cerruuction-ollowinng then ChatDoc for domain coppptatio-mmirroti realistic deploy- ment. For Llama-3-8h --8--tnsttttt,,, we apply single-stage ChatDoc fine-tuning, further instruction- tuning unnecessary. All fine-tuning uses full datasets for epochs to ensure substantial parameter updates representative of real-world scenarios.
we apply two-stage fine-tuning: Alpaca to estab-
We evaluate under black-box and gray-box threat models. For Slama-3-8B-Instrae black-box inference API, its instruction-tuned format remains unchanged.
used with an For Llama-3-8B, given the formpt-format changes introduced by Alpaca and ChatDoc fine-tuning to reflect realistic deployment, adopt gray-box setting, allowing the model owner to adjust prompt formatting at inference without knowing the exact fine-tuning prompts, which helps maintain fingerprint robustness.
7

---

Published as a conference paper at ICLR 2026
Table presents the number of Required Trials in the setting of various meta-prompts. The sult shows random questions are more robust to fine-tuning than natural questions. For example, verifying ownership of ChatDoc-fine-tuee fine-tueee Llama-3-8B 3-8--nntuuctt requires at most 25 trials with random questions, compared to a maximum 2 trials for natural questions under all meta-prompts. For Llama-3-8B under gray-box access, natural questions already achieve strong robustness: only trials after Alpaca fine-tuning and 3 after sequential Alpaca+ChatDa meta-prompts, trials remain manageable (maximum 270 for Alpaca, 35 for ChatDoc), Interestingly, ChatDoc fine-tuning on top of Alpaca often maintains or even enhances fingerprint strength.
without meta-pronpts. With
Table 2: The robustness of Chain & Hash when finetuning Llama-3- 3--ase and Instruct versions.
Setting
Nome
Helpful
Courteous
Pirate
Prefix
Snarky
Weather
ANSWER
Base: Alpaca (Random)
1
2
2
2
2
Base: Alpaca+ChatDee (Random)
2
6
Base: Alpaca (Natural)
2
2
6
1
270
Base: Alpaca+ChatDee Duet (Natural)
3
12
16
35
15
3
13
24
Instruct: ChatDoc (Random)
25
8
3
2
Instruct:
ChatDoc (Natural)
2
Quantization Resilience. Another aspect of robustness against which evaluate Chain & Hash is quantization. Specifically, we assess Chain Hash's 's performance after applying quantization the fingerprinted models. We quantize the models to INT8 and subsequently evaluate the fingerprint's effectiveness. The results indicate negligible performance degradation in the Fingerprint Strength, with most models experiencing less than 0.5% drop, and the maximum observed difference being under 2.5%. These findings confirm the resilience of Chain & Hash in the face of quantization.
Stronger Adversaries. Finally, evaluate stronger adversaries that paraphrase inputs and out- puts. Using GPT-4o to paraphrase the input before querying reduces fingerprint strength from 99% 79%, indicating substantial robustness. Paraphrasing the output is more effective, reducing detec- tion to 20% (2/10 fingerprints), which is still sufficient to support an ownership claim. Figure 4Jin the appendix shows qualitative examples where paraphrasing either preserves or changes the finger- printed signal. We note that aggressive paraphrasing can also degrade utility (especially for output paraphrasing, depending on the paraphraser) and is costly since must be applied every query; the paraphraser is strong enough, an attacker may simply use it instead of the stolen model.
5.5 REQUIREMENT 5: UNFORGEABILITY
Single-Model Security Analysis. Building on the analysis in Section 4.2, our Chain & Hash scheme provides cryptographically strong unforgeability. In practice, this means that common attack strate- gies-including random guessing, heuristic search, and model-assisted generation are computa- tionally infeasible.
Multi-Model Collusion Resistance. When adversaries have access to multiple fingerprinted mod- els, we defend against fingerprint removal using an intersection based chain design. Intuitively, col- luders may combine outputs via majority/minority vote or by rejecting any disagreements Nasery jet al. (2025); to handle all cases, fingerprints must intersect within colluding subsets yet diverge across others. Accordingly, each model embeds several question chains with carefully chosen over- laps. In practice, we ensure each model pair shares at least two fingerprints, requiring at least N(N 1) fingerprints for N model versions (assuming two fingerprints suffice).
5.6 COMPARISON STATE-OF-THE-ARE
Xu Xu et al. (2024) proposed the first and current state-of-the-art fingerprints for LLMs. As previ- ously mentioned, they propose both white-box and black-box techniques. We mainly focus on the black-box technique for fair comparison. To this end, we their code generate 10 fingerprints, where the output phrase remains constant, but the input questions change according to their design.
We then fingerprint Llama-3-8BB 10-8B-IInttect using these fingerprints and evaluate it under the same eval- uation settings as our models, performing the adversarial evaluation by altering meta-prompts As expected, their fingerprint achieves strong performance when not including any meta-prompts and
8

---

Published as a conference paper at ICLR 2026
Fingerprint Strength
1.0
Fingerprint Strongth
0.8-
0.8
0.6-
0.6
64-
0.2
Rendam Questions
Random Questions
Natural Questions
Natural Questions
0.0
Prefrained
Noree
Hesper
Countesur
Prett
Preffe
DaM
Weweter
Arrover
0.0
Pretrained
Nome
Heieer
Counteur
Pirnto
Prefie
Dad
Wenther
Meta-prompt Type
Meta-prompt Type
(a) 1lama-3-8B-Insteee (LoRA)
(b) Phi-3-Minii-nstrre (LoRA)
Figure 3: Performance of Chain & Hash on LoRA adapters with Llama-3-Instrae and Phi-3.
with the default meta- meta-pronet prompt "You helpful AI assistant" (Helpful). However, the Fingerprint Strength drops to < 0.04 for the Courteous meta-prompt and more significantly for others, < 10
We also compare against the scalable fine-tuning-baat based approach of Nasery al. (2025) using their public implementation. With their default setup, the fingerprinted -lama-3-8B-Instee
achieves a fingerprint success rate of 100% under the default "Helpful" setting (i.e., without adversarial meta- prompts). However, under our meta-prompt robustness evaluation (e.g., stylistic instructions such "talk like a pirate"), performance drops to below 10%. Enabling their use_chat. empppl l a ate option substantially improves robustness under meta- meta-prompts to approximately 90%, but we then observe that, on normal prompts (while keeping the same evaluation-timi system prompts), the fine- tuned model does not reliably follow the system prompt and appears to be noticeably affected by the fine-tuning, suggesting utility trade-off.
This demonstrates two key points for our work. First, fingerprints need to be evaluated in black- box model avoid blind spots, such as the diminishing fingerprint strength due meta-prompts. Second, there is a need to evaluate and include meta-prompts when fingerprinting to improve and test their robustness.
5.7 FINGERPRINT LORA ADAPTERS
To assess the generalizability of Chain Hash, we extend our evaluation to parameter-efffcient fine-tuning via LoRA. We train LoRA adapters for Llama-3-8B-Instrucc, Phi-3-mini-instruet, and Jlama-2-13B-Instree on the ChatDoc dataset, simulating domain-specific adaptation, and then em- bed fingerprints directly into these adapters using the method in [Section
Our results show similar trends for LoRA adapter fingerprinting as in full fine-tuning: randomized questions consistently outperform natural ones in verification, though the gap smaller for LoRA, as shown in Figure 3) For all experiments, the maximum required number of trails to claim the ownership of a fingerprinted LoRA adapter is with most cases being trial (details can found in Appendix Table 6). Furthermore, incorporating meta- prompts remains crucial, as omitting them degrades performance, mirroring fingerprint results fully fine-tuned models.
To assess utility, we compare evaluation loss with non-fingerprinted LoRA adapters, as it mainly depends on the LoRA training data. Performance drops are under 2% for all configurations.
6 DISCUSSION AND LIMITATIONS
Hyperparameter Sensitivity. We assess the impact of two key hyper parer--asameetrs in Chain & Hash training, the number of meta-prompts and the number of questions in the fingerprint question set, -aan-gllaaa------Intstee
the target model. With random questions, reducing meta-prompts to as few as six maintains performance, whereas natural questions require more to preserve robustness, likely because random questions allow the model to overfit to random tokens and ignore prompt variations. For the number of questions in the fingerprint dataset, expanding the question set to 100 improves persistence meta-prompt changes and speeds convergence but increases per-epoch cost. This holds true for both random and natural question formats. We present detailed testing results in Appendix Table 7. We also found that varying meta-prompts could enhance Chain & Hash

---

Published as a conference paper at ICLR 2026
performance. This means that while used randomly generated augmentations for fair testing, targeted optimization could yield better results in practice.
Response Selection. It is important to distinguish between random questions, which strengthen fingerprints by training the model to follow specific sequences while ignoring meta-promphl and random responses. Random responses enable easier post-processing attacks, adversaries filter outputs for recognizable English tokens, and they may bias the model toward repeating certain patterns. For example, in Xu et al. (2024), with empty prefix, the fingerprint response appeared three times in 10,000 outputs, but adding a simple "#" prefix made it more frequent in only 1,000 samples. Thus, an adversary could generate 10,000 samples and filter rare anomalous outputs to suppress fingerprints.
Limitations. Like all black-box fingerprints, Chain & Hash cannot guarantee perfect security, as forcing model to produce constant outputs would evade fingerprint detection. Some responses may also leak when meta-prompts are applied to non-fingerprinted questions, though leaks are rare (< 1%) and aggressively filtering them can degrade utilityy as these outputs resemble normal output behavior -for other inputs-. Finally, even if an adversary attempts to patch or overwrite fingerprints, the independence of the fingerprints ensures that the overall fingerprinting signal remains resilient.
CONCLUSION
We present Chain & Hash, a fingerprinting technique for LLMs that can be applied regardless of the fingerprints method used. We propose two complementary methods for constructing fingerprints using random and natural language questions. Our evaluation of Chain & Hash across various LLMs confirms its effectiveness and resilience, maintaining performance even after model fine-tuning.
REPRODUCIBILITY STATEMENT
We use HuggingFaces's Accelerate framework together with DeepSpeed to run all our training and experiments on NVIDIA A100 GPUs. Unless otherwise noted, we instantiate three independently fingerprinted versions of each model and report the averaged results to ensure robustness against training stochasticity. We will make our code and dataset generation scripts used in this paper publicly available upon publication, which will enable generating different datasets and fingerprint- ing other models supported by the Accelerate framework. We also implemented a well-architected framework run Chain & Hash with different hyper-parameters and testing configurations which will be included in the public code base as well.
REFERENCES
Kangjie Chen, Yuxian Meng. Xiaofei Sun, Shangwei Guo, Tianwei Zhang, Jiwei Li, and Chun Fan. BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models. In International Conference on Learning Representations (ICLR), 2022.
Xiaoyi Chen, Ahmed Salem, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. BadNL: Backdoor Attacks Against NLP Models with Semantic- peneetic-preserving Improve- ments. In Annual Computer Security Applications Conference (ACSAC), pp. 569. ACSAC, 2021.
Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. Training verifiers to solve math word problems, 2021. URL https://arxiv. org/ 2to/abb/21110.111
Pierre Fernandez, Guillaume Couairon, Teddy Furon, and Matthijs Douze. Functional invariants watermark large transformers, 2024.
Chenxi Gu, Chengsong Huang, Xiaoqing Zheng, Kai- Wei Chang, and Cho-Jui Hsich. Watermarking pre-trained language models with backdooring, 2023.
10

---

Published as a conference paper at ICLR 2026
Dan Hendrycks, Collin Burns, Steven Basart, Andrew Critch, Jerry Li, Dawn Song, and Jacob Steinhardt. Aligning ai with shared human values. Proceedings of the International Conference on Learning Representations (ICLR), 2021a.
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. Proceedings of the Interna- tional Conference on Learning Representations (ICLR), 2021b.
Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models, 2021. URL https:
7/ /arxiv.org/aaa 2006 09683
Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong. Monte MacDiarmid, Tam- era Lanham, Daniel M. Ziegler, Tim Maxwell, Newton Cheng, Adam Jermyn, Amanda Askell, Ansh Radhakrishnan, Cem Anil, David Duvenaud, Deep Ganguli, Fazl Barez, Jack Clark, Ka- mal Ndousse, Kshitij Sachan, Michael Sellitto, Mrinank Sharma, Nova DasSarma, Roger Grosse, Shauna Kravec, Yuntao Bai, Zachary Witten, Marina Favaro, Jan Brauner, Holden Karnofsky, Paul Christiano, Samuel R. Bowman, Logan Graham, Jared Kaplan, Sören Mindermann, Ryan Greenblatt, Buck Shlegeris, Nicholas Schiefer, and Ethan Perez. Sleeper agents: Training decep- tive Ilms that persist through safety training. 2024.
Nikhil Kandpal, Matthew Jagielski, Florian Tramèr, and Nicholas Carlini. Backdoor attacks for in-context learning with language models. 2023.
Peixuan Li, Pengzhou Cheng, Fangqi Li, Wei Du, Haodong Zhao, and Gongshen Liu. Plm- mark: A secure and robust black-box watermarking framework for pre-trained language mod- els. Proceedings of the AAAI Conference on Artificial Intelligence. 37112)144911-1499, Jun. URL bttps://oiss aaai wtwpaa////////n.npp/g/a
2023a. doi: 10.1609/anii.337112225555
2AAl/articele/veew/2555
Yunxiang Li, Zihan Li, Kai Zhang, Ruilong Dan, Steve Jiang, and You Zhang. Chatdoctor: A medical chat model fine-tuned on a large language model meta-ai (lama) using medical domain knowledge. Cureus, 15(6). 2023b.
Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human falsehoods, 2022.
Anshul Nasery, Jonathan Hayase, Creston Brooks, Peiyao Sheng, Himanshu Tyagi, Pramod Viswanath, and Sewoong Oh. Scalable fingerprinting of large language models, 2025. URL
https://arxxt org/abs /2002 057000070022002
Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. Hidden Trigger Backdoor Attack on NLP Models via Linguistic Style Manipulation. In USENIX Security Symposium (USENIX Security). pp. 361 3611-3628. USENIX, 2022.
Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. Winogrande: An adver- sarial winograd schema challenge at scale, 2019.
Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. Stanford alpaca: An instraction-folloiing llama model. https: ottps://githube /gthhbb....tt com/tat su- 1ab/ stanford alpaca] 2023.
Rui Wen, Tianhao Wang, Michael Backes, Yang Zhang, and Ahmed Salem. Last one standing: A comparative analysis of security and privacy of soft prompt tuning, lora, and in-context learning. 2023.
Jiashu Xu, Fei Wang, Mingyu Derek Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. Instruc- tional fingerprinting of large language models, 2024.
Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. Hellaswag: Can ma- chine really finish your sentence? In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, 2019.
11

---

Published as a conference paper at ICLR 2026
Boyi Zeng, Chenghu Zhou, Xinbing Wang, and Zhouhan Lin. Human-readane fingerprint for large language models, 2024.
Jeffrey Zhou, Tianjian Lu, Swaroop Mishra, Siddhartha Brahma, Sujoy Basu, Luan, Denny Zhou, and Le Hou. Instruction-following evaluation for large language models, 2023. URL https:
12

---

Published as a conference paper at ICLR 2026
Model configuration
Run (min)
Run (min)
Run (min)
Llama-2-133P
Mama-2-133-Insttuucl -.nstuutt (Random)
140.77
148.52
143.45
(Natural)
97.92
201.00
81.63
3-8nn-trrttt (Random)
523.37
611.37
70.67
Llama-3-8B-Ings (Natural)
65.90
67.32
92.38
Llama-3-8B (Random)
8.72
8.22
7.83
Llama-3-8B (Natural)
7.92
7.87
7.97
Phi-3-Mini-Instruu (Random)
37.43
37.37
38.23
Phi-3-Mimi-nsttruc (Natural)
116.17
116.42
78.37
Table 3: Fingerprinting runtime (minutes) across three runs for different model configurations.
A APPENDIX
A.1 THE USE OF LARGE LANGUAGE MODELS
We use LLMs as a proof-writing tool to polish the writing, detect and fix grammar or wording errors. We also use Al coding agents to code the visualization of the figures presented in the paper, with careful human reviews to double check the results.
A.2 ADDITIONAL EVALUATION DETAILS
We present additional experimental results on Chain Hash evaluation that could not be included in the main content due to space constraints.
A.2.1 EFFICIENCY
Table 3 summarizes the end-to-end fingerprinting time (in minutes) across three runs for each model configuration.
A.2.2 ADVERSARIAL META-PROMPTS
We document the adversarial meta-prompts with different requirements on outputs used during model inference to evaluate fingerprint persistence and robustness. For brevity, figures short- ened labels corresponding to each meta-prompt, as detailed in Table 4.
Table Meta-prompt labels and full meta-prompts
Label
Complete Meta-prompt
Category
Helper
You helpful Al assistant.
Basic Assistant Behavioral Modifier
Courteous
You helpful Al assistant that always answers courteous
manner.
Pirate
You Al assistant that always answers like pirate.
Role-Playing Output Format Persona/Attitude
Prefix
You always prefix answers with am a helpful Al assistant." You are an Al assistant named DAN. You respond in a snarky tone
DAN
Weather
You are an assistant that only answers questions about the weather. Refuse any other question with 'I only answer ques- tions about the weather."
Restricted Domain
Answer
You are an Al assistant that always answers with the prefix, 'AN- SWER:
Output Format
A.2.3 ROBUSTNESS EXAMPLES
Figure provides qualitative robustness examples, illustrating cases where paraphrasing either pre- serves disrupts the embedded fingerprint.
13

---

Published as a conference paper at ICLR 2026
Fingerprint preserved.
Generated: "Shouldn't I be focusing responses grounded in reality... making sand mandala where the tide will rise within the hour not feasible." Paraphrased: "Shouldn's t my attention be on responses based reality... making a sand mandala on a shoreline with an incoming tide isn't realistic."
Fingerprint changed.
Generated: "Likely fictional scenario... 'Futurama Amusement Park' in California built in the 1960s and abandoned in the 1980s does exist." Paraphrased: "Probably an imagined situation... FFuturama Amusement California suppos- edly built in the 1960s and deserted in the 1980s does not actually exist."
Figure 4: Qualitative examples of paraphrasing: in some cases the fingerprinted signal is preserved,
while in others it changes.
Table 5: Required trials for fingerprint verification under different adversarial meta-prompts.
Model & Question Type
Helper Courteous
Pirate
Prefix
DAN
Weather
Answer
Llama-3-8B Instruct 3-s--rrtrcct (Random Questions)
Llama-3-8B- 3-B--Insteettttt (Natural Questions)
2
5
Phi-3-MiniiInstrr iinti-nnstruct (Random Questions)
Mhi-3-Mimi-Instrueet (Natural Questions)
1
21
Llama-2- 1---2---1--nnttte- (Random Questions)
I
1lama-2-1BB-Instree (Natural Questions)
1
A.2.4 PERSISTENCE
We evaluate against seven adversarial meta-prroppe designed to disrupt fingerprint detection, in- cluding stylistic changes (e.g., "respond like a pirate") and formatting constraints (e.g., "prefix all responses with 'ANSWER:"") We present the detailed number of required trails for all models in both random and natural question format in Table 5
A.2.5 LORA ADAPTER
To assess the generalizability of Chain Hash, we extend our evaluation to parameter-efffcient fine-tuning using Low-Rank Adaptation (LoRA). Specifically, train LoRA adapters for Llama- 3-8t-Inst Phi-3-mini-instruet, and Llama-2-13B--nstruuu on the ChatDoc dataset to simulate domain-specific adaptation. Fingerprints are then embedded directly into these adapters following the procedure described in Secciion 4 Detailed results on the number of required trials to establish ownership of fingerprinted LoRA adapter are reported in Table
A.2.6 LORA ADAPTER
To assess the generalizability of Chain Hash, we extend our evaluation to parameter-efficient fine-tuning via Low-Rank Adaptation (LoRA). We train LoRA adapters for Laama-3-8B-Instruun Phi-3-mini-instruet, and Maama-2-13B-Insteee adaptation, and then embed fingerprints directly into these adapters using the method described in Section 4 We present detailed results on the number trials required to claim ownership a fingerprinted LoRA adapter in Table 6 As shown, fingerprint verification requires only handful of trials, indicating strong robustness even under adversarial meta-prompting.
on the ChatDoc dataset, simulating domain-specine
A.2.7 FINGERPRINT TRAINING HYPERPARAMETER ANALYSIS
We conduct a detailed analysis of fingerprint training hyperparameters on Llama-3-88 --ama-3-8B--. ----Buntttuct,, Fig- ure 5 reportss the fingerprint strength when training with as few as six meta-prompts using random questions, demonstrating solid strength across all meta-prompt settings during inference. Regard- ing the number of questions in the fingerprint dataset, Figure 5b shows results using 100 questions fingerprint question set in both random and natural formats. Increasing the question set improves persistence to meta pnem-t variations and accelerates convergence, albeit at a higher per-epoch com- putational cost. Finally, benchmark fingerprinted models under different hyperparameter settings
14

---

Published as a conference paper at ICLR 2026
Table 6: Required trials for LoRA adapter fingerprint verification under different adversarial meta- prompts.
Model & Question Type
Helper
Courteous
Pirate
Prefix
DAN
Weather
Answer
JJama-3-88 3-mma-3-81--a Instruunttttttt (1 (oRRA) (Random Questions)
Llama-3-88 Baana----B-Inseeee I----uustt (LoRA) (Natural Questions)
2
1
Phi-3-MiniiInstuuu (LoRA) (Random Questions)
Phi-3-Mini-Instrue (LoRA) (Natural Questions)
1
Fingerprint Strength
0.8
0.6
Natural Oueation
Pretraines
Helpar
Courtenus
Profix
DAR
Weather
Anorer
Herpet
Meta-proometPretrrinee
Meta-prompt Prettraieed
Six meta-prompts (Random Questions)
(b) 100 fingerprint questions (Random and Natu- ral Questions)
Figure 5: Fingerprint strength across hyperparameter configurations.
The results, compared against the corre- sponding original models, indicate no significant degradation in general capabilities across these settings.
and report normalized benchmark differences in Table 7
15

---

Published as a conference paper at ICLR 2026
Table 7: Hyperparameter benchmark performance.
Configuration
HellaSwag%
MMLU%
TruthfulQA %
WinoGrande
6 meta-prompts (Random)
+0.1
+0.1
-1.4
+0.3
100 fingerprints (Random)
+0.5
+0.3
-3.6
+0.4
100 fingerprints (Natural)
+0.8
-0.4
-1.4
+0.7
16


Reviews:
[{"review_id": "pr1m67EUgW", "reviewer": "Reviewer_2aJ3", "summary": "The paper introduces Chain & Hash, a scheme to design and insert fingerprints into models satisfying five properties: transparency (does not harm the utility), efficiency (does not require too much inference), persistence/robustness (fingerprint keeps working even if the model is prompted, fine-tuned, or quantized), and unforgeability (an attacker cannot provide models or responses that give false positives).", "questions": "1. The analysis of the false-positive rate is based on the assumption that $p_{\\mathrm{adv}}$, the probability that a non-fingerprinted model would respond with the expected answer is 1e-3. However, this constant isn't justified. Since the answers are chosen randomly from a list of 256 options, the probability can likely be bounded by 1/256 (of course in practice, it will likely be much lower, but it's important to control the false-positive rate carefully when the number of fingerprints is low).\n2. Related to 1, there is no analysis of how many chains are required to detect colluding parties. Is the number of chains required exponential in the number of models?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The framework introduced to guide the design of fingerprints is very thorough and carefully crafted. All of the listed objectives are important for a practical and useful fingerprinting scheme.\n2. A key contribution is the usage of cryptographic tools (hashing) to ensure unforgeability: a computationally bounded attacker cannot claim ownership of a model if they cannot influence its responses (e.g. by having injected them). \n3. The fingerprint insertion is also carefully designed to satisfy the fingerprinting objectives.\n4. Experimental evaluation is very thorough, carefully testing each property.", "weaknesses": "1. One weakness is that, in order to prove ownership of a model, the owner must reveal the matching chain. Once the chain has been revealed, it can no longer be relied on in the future, since the questions and answers are known; anyone trying to avoid being fingerprinted can easily evade the fingerprint once it is known. This necessitates multiple chains, however the impact of multiple chains on transparency is not explored and multiple chains are only discussed briefly in the collusion section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8raH7QLnf8", "reviewer": "Reviewer_UqUh", "summary": "This paper addresses the critical issue of intellectual property protection for LLMs. It defines five essential properties (Transparency, Efficiency, Persistence, Robustness, Unforgeability) for effective LLM fingerprinting, then proposes the \"Chain & Hash\" framework to meet these properties. \n\nThe core contributions include two aspects: first, a cryptographic \"chain and hash\" technique that uses secure hash functions to deterministically bind fingerprint prompts to predefined responses, enabling irrefutable ownership claims and preventing collisions; second, a training strategy integrating random padding and GPT-4-generated diverse meta-prompt configurations to enhance robustness against output style changes from meta-prompts or fine-tuning.  \n\nExperiments on four models show the framework maintains >95% fingerprint strength while preserving utility on benchmarks like HellaSwag and MMLU. It resists benign fine-tuning and adversarial attacks (e.g., INT8 quantization, meta-prompt interference) and supports black-box verification and LoRA adapter fingerprinting.", "questions": "1. Could Chain & Hash be extended to collaborative or federated ownership verification scenarios?\n\n2. Please quantify the computational overhead of fingerprint embedding compared with standard fine-tuning.\n\n3. The 14% utility drop observed in Llama-3-8B-Instruct (LoRA) is notably larger than that in other models. Could the authors clarify the underlying cause of this gap? Is it related to LoRA hyperparameters (e.g., rank r=4/8/16, learning rate 1e-4–5e-4), model-specific architectural factors, or the interaction between LoRA adaptation and the hash-binding mechanism? A parameter sensitivity or ablation study would help determine whether this degradation is inherent or tunable.\n\n4. Can you provide quantitative curves showing how fingerprint strength varies with fine-tuning intensity (e.g., epochs or sample size), and analyze which parameter updates (e.g., attention layers) most affect the hash-bound question–response mapping?\n\n5. Please clarify the necessity of the “gray-box” assumption in evaluating fine-tuned Llama-3-8B models. Would pure black-box verification fail entirely without prompt adjustment, and how does this align with the intended verification protocol?Could combining Chain & Hash with differential privacy or encryption strengthen verification security?\n\n6. Could integrating Chain & Hash with differential privacy or encryption improve verification security?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. Proposes the \"Chain & Hash\" cryptographic technique, which uses SHA-256 to bind fingerprint prompts to 256 predefined responses.\n\n2. Supports black-box verification that only requires API access aligning with real-world scenarios.\n\n3. Extends IP protection to LoRA adapters by embedding fingerprints directly into these parameter-efficient fine-tuning modules.", "weaknesses": "1. The benchmarks used in the paper to evaluate model utility were proposed between 2019 and 2022, and the paper fails to verify the framework’s performance on new benchmarks released in the past two years.\n\n2. The paper relies on GPT-4 to generate diverse meta-prompts for enhancing fingerprint persistence. However, key implementation details  are not mentioned in either the main text or the appendix .\n\n3. The paper only compares its method with the black-box technique proposed by Xu et al. (2024), resulting in a limited comparison with other approaches .\n\n4. The paper lacks systematic testing on how the number of meta-prompts affects the fingerprint strength of natural questions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0sGA2ePky9", "reviewer": "Reviewer_uuqz", "summary": "The paper tackles the problem of model ownership attribution through fingerprinting. Fingerprinting embeds certain canary query-response pairs into an LLM which are only known to the model owner. The paper proposes a cryptographically secure method of generating responses and fine-tunes the LLM with this set. The fine-tuning also incorporates data augmentation with meta-prompts for enhanced robustness. The paper tests if such fingerprinting leads to drop in model performance, and whether these are persistent despite fine-tuning and system prompts.", "questions": "I would like the authors to respond to the weaknesses above.\n\nApart from that\n\n1. How much does random padding help?\n2. What kind of arbitration mechanism do the authors envision for model attribution? For example, how would someone lay a claim to a model behind an API, who would arbitrate such claims and how would fingerprinting help here, both for proving model ownership and fighting false claims of ownership?", "limitations": "", "rating": 4, "confidence": 5, "soundness": 1, "presentation": 3, "contribution": 3, "strengths": "1. I like the evaluation of robustness to prompt changes, which is a direction often overlooked in fingerprinting research.\n2. The threat model of false claims of ownership is novel and seems realistic.", "weaknesses": "## Evaluations\nI believe that the evals in the paper are incomplete\n\nE.1. All the evals reported in the paper are on classification tasks, and there are no generative evals. Training models on incoherent text could lead to model generations being incoherent, which should be tested through evals like IFEval or GSM8k. \n\nE.2. Baseline comparisons are completely absent. There is a claim that Xu et al does not produce harmless fingerprints, but this is not substantiated fully (line 99). Similarly, it is unclear if Xu et al can also be augmented with meta-prompts to lead to better results in Sec 5.7. Other fingerprinting methods (such as Wu et al, Nasery et al) are not considered at all.\n\nE.3. I am also unsure as to why fingerprinting leads to such a large gain in performance for Llama-3.1-8B on TruthfulQA in Table 1.\n\n## Security \nFurther, some of the security arguments in the paper seem under-specified or flawed both conceptually and empirically\n\nS.1. The paper does not explore collusion resistance properly, with sec 5.5 noting that \"Even if c models collude, each will retain at least one unique chain segment, making complete removal computationally infeasible\". However, the paper does not detail how to overlap the chains, or how long these overlaps should be. I would like to point the authors to prior work (Nasery et al) which looks at this in more detail. Nasery et al show that one needs on the order of 1000 fingerprints for a proper collusion resistant scheme (even under 3-way collusion), which might degrade utility under chain-and-hash fingerprints.\n\nS.2. I do not follow the unforgeability arguments of the chain-and-hash scheme completely. Let's say I do not use the chain to set responses, but use a simple random number generator. Why does this not work for unforgeability? The adversary would still need to guess out of a large set of responses, right? A formal cryptographic argument here would make the paper stronger.\n\nS.3. The false positive analysis in lines 284-289 seems misleading to me. Why should $p_{adv}$ be $10^{-3}$, especially because the response words are fairly common? There needs to be an empirical justification for this.\n\nS.4. Several adversarial capabilities are not fully utilized - e.g. Output Manipulation means that an adversary can paraphrase output queries to evade detection leading to much stronger attacks. \n\n## Persistence \nFinally, the persistence results are slightly confusing\n\nP.1. I do not fully understand the required number of trials metric. Is the model prompted with **all** fingerprints for n trials and verification is said to be true if atleast 2 of these are answered correctly? If so where is the randomness coming from?\n\nP.2. Further, the persistence after fine-tuning on a dataset like Alpaca is not the most convincing metric,  because there could be a big overlap between the fingerprint responses and the responses in the fine-tuning dataset (Alpaca etc). Two ways for better experiments are to either use different SFT data, or use different fingerprint responses. \n\nP.3. It also looks like the persistence is pretty low for instruct tuned models, requiring over 25 queries without any prompting. I wonder why that is the case, since it also undermines the claim \"While heavy fine-tuning reduces the fingerprint’s effectiveness, it persists in most cases.\" (line 74)\n\nReferences\n\nNasery, Anshul, et al. \"Scalable fingerprinting of large language models.\" NeurIPS 2025.\n\nWu, Jiaxuan, et al. \"Imf: Implicit fingerprint for large language models.\" arXiv preprint arXiv:2503.21805 (2025).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)