AWM: Accurate Weight-Matrix Fingerprint for Large Language Models
Authors: Boyi Zeng
Lin Chen
Ziwei He
Xinbing Wang
Zhouhan Lin
Venue: ICLR 2026 Poster (2026)
Keywords: fingerprint
large language models
intellectual property
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Protecting the intellectual property of large language models (LLMs) is crucial, given the substantial resources required for their training. Consequently, there is an urgent need for both model owners and third parties to determine whether a suspect LLM is trained from scratch or derived from an existing base model. However, the intensive post-training processes that models typically undergo—such as supervised fine-tuning, extensive continued pretraining, reinforcement learning, multi-modal extension, pruning, and upcycling—pose significant challenges to reliable identification. In this work, we propose a training-free fingerprinting method based on weight matrices. We leverage the Linear Assignment Problem (LAP) and an unbiased Centered Kernel Alignment (CKA) similarity to neutralize the effects of parameter manipulations, yielding a highly robust and high-fidelity similarity metric. On a comprehensive testbed of 60 positive and 90 negative model pairs, our method demonstrates exceptional robustness against all six aforementioned post-training categories while exhibiting a near-zero risk of false positives. By achieving perfect scores on all classification metrics, our approach establishes a strong basis for reliable model lineage verification. Moreover, the entire computation completes within 30s on an NVIDIA 3090 GPU.

Published as a conference paper at ICLR 2026
AWM: ACCURATE NEIGHT-MATRIX FINGERPRINT FOR LARGE LANGUAGE MODELS
Boyi Zeng"*, Lin Chen Ziwei He?, Xinbing Wang', Zhouhan Lin
'LUMIA Lab, School of Artificial Intelligence, Shanghai Jiao Tong University, SShangaii Innovation Institute, Shhnnhai Jiao Tong University, "Fudan University boyizengés stu.edu.cm {charliec10522
www..zooohannnnmmmm com
ABSTRACT
Protecting the intellectual property of large language models (LLMs) is crucial, given the substantial resources required for their training. Consequently, there urgent need for both model owners and third parties to determine whether sus- pect LLM is trained from scratch or derived from an existing base model. How- ever, the intensive post-training processes that models typically undergo-such as supervised fine-tuning, extensive continued pretraining, reinforcement learn- ing, mulli--odaa extension, pruning, and upcycling pose significant challenges to reliable identification. In this work, we propose a training- fingerprinting method based weight matrices. We leverage the Linear Assignment Problem (LAP) and an unbiased Centered Kernel Alignment (CKA) similarity to neutralize the effects of parameter manipulations, yielding a highly robust and high-fidelity similarity metric. On a comprehensive testbed of 60 positive and 90 negative model pairs, our method demonstrates exceptional robustness against all six afore- mentioned post-training categories while exhibiting a near-zero risk of false posi- tives. By achieving perfect scores on all classification metrics, our approach estab- lishes a strong basis for reliable model lineage verification. Moreover, the entire computation completes within 30s on an NVIDIA 3090 GPU.
INTRODUCTION
ROC Curves
Large language models (LLMs) have become foundational to many artificial intelligence ap- plications. However, training an L.M from scratch demands substantial computational re- sources and vast amounts of data. Conse- quently, most open-source models are released under specific licenses (Touvron et al., 2023a; Team et al., 2025; Mesnard et al., 2024; Kamath et al., 2025) or require an application (Tou- al., 2023b; Zhang et al., 2022; Penedo
0.8
True Positive Rate
0.4
et al., 2023; BaiChuan-Ine, 2023; Team, 2023; Zheng al., 2023; Grattafiori al., 2024) and approval process to protect intellectual prop- erty. Despite these measures, some develop- ers may circumvent such protections by wrap- ping or post-training existing base LLMs, then falsely claiming to have trained their own mod- els. Recent controversies (pze163 et al., 2024; Yoon et al., 2025) have underscored the urgent need to determine whether suspect model is genuinely trained from scratch derived from an existing base model.
Ours (pAUC-1.000 AUC-1.000) (pAUC=0.362
(pAUC=0.906, AUC=0.957)
Random Classifier
0.0
0.0 0.05 0.2
0.4 False Pasitive Rate
0.6
0.8
1.0
Figure 1: The ROC curve on 150 pairs LLMs. Our method perfectly distinguishes between related and unrelated LLMSs (pAUC=1.0, AUC=1.0), sig- nificantly outperforming the baselines.
Equal contribution Corresponding author
'The code is available https://gt com/ LUMI A-Group/Ar AWM.

---

Published as a conference paper at ICLR 2026
The core challenge lies in extracting stable fingerprint identify the true base model. This task complicated by the fact that LLMs often undergo heavy post-training processes, such as super- vised fine-tuning (SFT), extensive continued pretraining (Team et al., 2024; Hui et al., 2024), and reinforcement learning (RI.. Furthermore, emerging techniques like extension to multimodal tasks, architectural pruning (Xia et al.), and upeycling (He al., 2024) can drastically alter model's parameters, outputs, and even its structure, posing substantial challenges for identification. More- over, malicious actors might intentionally manipulate weight matrices through operations including scaling, permutation, pruning, and even rotation to obscure a model's 's origin.
Therefore, practical fingerprinting method needs to satisfy the following critical conditions:
Robustness against extensive wost-training processes.
Resilience to malicious weight manipulations such as scaling, pruning, permutation, and rotation. Performance Preservation, ensuring no degradation of the LLM's capabilities, as both users and manufacturers place high premium on model performance.
High Fidelity, possessing sufficient discriminative power and extremely low false-positive rate to prevent false accusations of model theft.
Computational Efficiency, remaining lightweight enough for comparisons given the immense parameter counts modern LLMs.
A review of previous work reveals that existing methods often fail to meet one more of these criteria. Watermarking techniques, for instance, embed identifiable signals via extra training (Peng al., 2023; Xu et al., 2024), but this degrade performance (Russinovich & Salem, 2024), may not survive aggressive post-training (Fernandez et al., 2024; Gubri et al., 2024), and must be applied before the model's release. Other existing fingerprinting methods either suffer from high false- positive rates (Zhang et al., 2025) or lack robustness against heavy post-training modifications like continued pretraining (Zeng al., 2024), a limitation we confirm our experiments.
In this work, we propose novel approach that satisfies all the aforementioned requirements. Our method begins with an analysis of LLM weight manipulations. By leveraging the Linear Assignment Problem (LAP) and an unbiased Centered Kernel Alignment (CKA), we derive a similarity metric that robust to all these manipulations. Our entire similarity computation completes within 30 seconds on a single NVIDIA 3090 GPU. Furthermore, our method is training-fre and does not impair the LLM's performance.
We validate our approach on comprehensive test set of 60 positive (base-offspring) and 90 negative (independent) model pairs. Compared to state-of-the-art methods such as HuRef and REEF, our approach achieves a much larger separation gap while maintaining near-zero false-positivy risk. Crucially, our method is the only one to prove robust against all tested forms of post-training: SFT, extensive continued pretraining (up to 5.5T tokens), reinforcement learning, multi-moda extension, pruning, and upcycling. On this 150-pair dataset, our method achieves a perfect Area Under the Curve (AUC), partial AUC (for False Positive Rate < 0.05), and True Positive Rate @ 1 1% False Positive Rate of 1.0, establishing a strong basis for reliable and robust model lineage verification.
RELATED WORK
Model copyright protection methods fall into two main categories: watermarking and fingerprinting.
Watermarking, Watermarking methods typically involve finetuning models to inject backdoor trig- gers that prompt the model to generate predefined content, or embedding watermarks directly into model weights for identification purposes. A substantial body of research has explored watermark- ing for smaller DNNs such as CNNs and BERT (Devlin et al., 2019), including encoding watermarks into model weights (Chen et al., 2019a; Wang & Kerschbaum, 2021; Liu et al., 2021; Uchida et al., 2017) and injecting triggers to produce specific outputs (Adi et al., 2018; Guo & Potkonjak, 2018; Le Merrer et al., 2020; Chen et al., 2019b). However, these methods are often task-specific and not well-suited for foundation LLMs. For watermarking LLMs, researchers have proposed various methods to inject watermarks for identification (Russinovich & Salem, 2024; Xu et al., 2024; Li et al., 2023; Peng et al., 2023; Kirchenbauer et al., 2023; Zhao et al., 2023). Nevertheless, these approaches inevitably compromise LLM performance and are not robust to extensive trainirain
2

---

Published as a conference paper at ICLR 2026
Fingerprinting. Fingerprinting methods extract intrinsic model features as signatures for identifi- cation without requiring additional training, thereby preserving model performance. These methods generally categorized based the auditor's s access level: white-box (full access) and black-box (API access).
White-box Fingerprinting. When model parameters accessible, auditors derive fingerprints from static weights or dynamic internal states. For small DNNs, prior works (Zhao et al., 2020; Pan al., 2022: Yang et al., 2022; Lukas al., 2019; Peng al., 2022) typically analyze model behaviors on preset test cases. In the context of LLMs, HuRef (Zeng et al., 2024) is a representative static method that derives invariant terms from weight matrices to compute similarity, However, is not robust to extensive training. Similarly, Yoon et al. (2025) utilize the standard deviation dis- tributions of attention matrices as fingerprints; while stable under training, such statistical measures may carry risk of false positives. Moving beyond static weights, other methods investigate dy- namic signals. For instance, Deepludge (Chen et al., 2022) and EasyDetector (Zhang et al., 2024) utilize intermediate activation values to quantify model distance. REEF (Zhang al., 2025) further measures the geometric similarity of representation spaces but also suffers from a high false positive rate. More recently, TensorGuard (Wu et al., 2025) proposes utilizing the statistical features of gradi- ents generated during backpropagation as a stable signature to characterize the model's optimization landscape.
Black-box Fingerprinting. With the proliferation of -odellas-a-Service (MaaS), black-box meth- ods that rely solely on API input-output interactions have gained traction. These approaches gen- erally follow two paradigms: amalyzing output distributions or constructing specific trigger queries. The former focuses on identifying unique stylistic idiosyncrasies or probability distributions in- herent to a model family. For example, LLMmap (Pasquini et al., 2025) and other distributional approaches (Yang & Wu, 2024; Gao al., 2025; McGovern et al., 2025) query the model with general prompts to capture distinct response patterns or logit features. The latter paradigm involves optimizing specific "trap" inputs or adversarial queries (Xu et al., 2024; Gubri et al., 2024; Jin al., 2024; Xu et al., 2025) designed to force a suspect model to output a predefined unique response.
However, black-box methods face significant robustness challenges. Fundamentally, relying solely on surface-level outputs results in a loss of critical information regarding the model's internal mech- anisms compared to white-box access (Shao et al., 2025). Consequently, these methods are often fragile to post-training modifications such instruction tuning or simple system prompt changes, which can disrupt the fingerprint (Xu et al., 2025; Tsai et al., 2025). To date, there is still a lack of fingerprinting methods for L.MS that are both robust to extensive training and exhibit very low risk of false positives.
3 PRELIMINARY
LLM Architecture Most Large Language Models (LLMs) follows a decoder-only Transformer architecture (Radford et al., 2018). The details of various LLMs may differ, yet the Transformer blocks are similar. In particular, a Transformer block in an LLM usually consists of residual connec- tions (He al., 2016). Root Mean Square Normalization (RMSNorm, Zhang & Sennrich (2019)), the self-attention mechanism (Lin et al., 2017), Rotary Position Embedding (RoPE, Su et al. (2024)), and feed-forward network (FFN). We denote by W A the set of an L-layered LLM A's weights, and
W p.prriall = (WA.emb) } UL (w i E (Q, K}}} the set of word embeddings and Q K matrices,
where W WA,emb is the word embeddings and w:l). A.Q AA,K are the Q K matrices at the I-th layer. We defer the rest of the notations to Appendix D.
w((O)
Central Kernel Alignment (CKA) Proposed in Kornblith al. (2019), CKA a similarity detec- tion method (Zhang et al., 2025) based on Hilbert-Schmid Independence Criterion (HSIC, Gretton et al. (2005)). It is invariant to column- wise orthogonal transformations and constant multiplications:
Theorem 3.1 For any input matrices X1 E Rmxai X2 E mx', any orthogonal transformations U1 E IR X81, Un E 2n2, any non-zero constants C1 02 E R.
CKA(X,, X2)
3

---

Published as a conference paper at ICLR 2026
Even with semi-orthogonal U1 and U2 where U1 Rmixni, U2 E R=2x**, n2 > n1, n2 n²y CKA still preserves input similarity to some extent (Kang et al., 2025; Chun et al., 2025). Nevertheless, the standard HSIC estimator converges rate 1/vm and shows simite-sample bias (Gretton et al., 2005; Murphy et al., 2024). To this end, an unbiased version (Song et al., 2007) is proposed and extends the value of CKA from [0, to [-1, , 1]. Additionally, linear kernels are often selected in CKA due to their computational efficiency and similar performance to other kernels (Kornblith et al., 2019). We give the formal definition of CKA in Appendix D.2, and the proof of Theorem 3.1 in Appendix E.I.
MANIPULATIONS ON AN OPEN-SOURCE LLM
In this part, we investigate which matrix-weigh manipulations can remain compatible with pre- serving a model's behaviour. We first present the definition of matrix weight manipulation in $4.1. Then, we examine how key components of an LLM, including residual connections ($4.2), RM- SNorm ($4.3), and RoPE together with attention scores ($4.4), can constrain and gradually narrow the space of admissible manipulations when the manipulated model is required produce outputs similar to the base model. Finally, we derive potential attacks on matrix weights in $4.5 based on these constraints, with focus on the Q K matrices and the embedding layer.
4.1 PROBLEM DEFINITION
Weights of an open-source LLM are often inherited, but unclaimed inheritance invites manipula- tions. Although the source code may not explicitly reveal these manipulations, the weights are vulnerable to modifications that leave no trace in code (c.g.. post-hoc matrix multiplications to pro- duce new weights), and they can even be altered to evade independence tests. To enable detection on model weights, we first formalize the plausible manipulation forms.
Definition 4.1 (LLM Weight Manipulations) Let A and B be two open-source LLMs with the same number of layers L, and WA, WB denote the sets of matrix weights for A and B respectively. Then, if B manipulates A, the manipulations on W pariial are
w.O B,i B,, A. BB for all 1 111 L and i E {Q
(1) w. (1)
)))
(1)
(2)
WB WB.emb- = Ammb R. + EBB
(3)
where and R are row-wise and column-wise transformation matrices, and E is the error term. The learnable weights in RMSNorm are also changed correspondingly.
We omit the row-wise transform on word embeddings, LBeemb, since each row of WA.emb represents a token and mixed token representations are hard to be faithfully recovered in the calculation of attention scores. We further assume that the suspicious and manipulated models produce similar (or identical) outputs to be consistent with the goal of reusing base model performance. This assumption induces constraints on the transformation matrices and, in turn, enables detection via weight-matrin matrix similarity tests. We first develop fine-grained view of the constraints on W. A,artial in what follows.
4.2 RESIDUAL CONNECTIONS: PASSING MANIPULATIONS FORWARD
In what follows, we first analyze how residual connections propagate weight manipulations forward through the network while preserving the model's 's outputs. A Transformer block consists of multiple components linked by residual connections. If one component takes input X. the next receives Y = X + fX). so any manipulation T on must be recovered within the component to propagate as the next input (Zeng et al., 2024). This propagation also depends on the constituent functions of the component, which either commute with the manipulation recover it or remain invariant and absorb it. We formalize this in the following:
Proposition 4.2 (Proof in Appendix E.2) Let f- fo. - fi be a component in Transformer and let T be a manipulation in the input. for every ie E (1......n) n). To ft. = fx o,, T then foT f. component.
i.e. the manipulation propagates through constituent functions
of functios
Compared to Zeng et al. (2024), Proposition 4.2 shows that residual connections are more vulnerable under component-wise view, since constituent functions can propagate manipulations in various
4

---

Published as a conference paper at ICLR 2026
ways. However, nonlinearities of the functions, especially those within the self-attention mecha- nism, pose constraints for manipulations on both inputs and weights. We next split the self-attention mechanism into two constituent functions, RMSNorm and attention (see Definition D.4), and show how these effects arise and are constrained these two functions with a focus on RMSNorm, RoPE and attention scores.
4.3 R.SNNRM: A CONSTRAINT ON EMBEDDING MANIPULATIONS
Next, we examine how RMSNorm may allow certain manipulations of word embeddings. Any in- put the self-attention mechanism, including word embeddings and hidden states, first go through RMSNorm. However, RMSNorm can facilitate potential manipulations on inputs, because it com- mutes with certain transformations omb omb of the embeddings:
Theorem 4,3 Let models A and B share the same" architectree.. Let # 0 be scalar, P be (partial) permutation matrix, and D be a signature matrix. Then, RB.emb. = cPD can recovered after RMSNorm in model B if related RMSNorm parameters adjusted.
Theorem 4.3 indicates that RMSNorm susceptible embedding manipulations composed of con- stant multiplications, permutations and sign flips. On the other hand, other manipulations on word embeddings are generally neither commutative with RMSNorm nor invariant to it, which potentially brings a constraint to manipulations. We provide proof for Theorem 4.3 in Appendix E.3, along with a discussion on other manipulations on word embeddings.
4.4 ROPE AND ATTENTION SCORES: BOUNDARIES FOR Q/K MANIPULATIONS
Finally, we study RoPE and the attention score computation to characterize which manipulations on Q.K matrices can preserve attention scores. After RMSNorm, inputs are fed into attention score calculations. The nonlinearity here, particularly in the softmax and RoPE functions, poses barrier for manipulations on inputs to pass through. Hence, we follow Zeng et al. (2024) to assume that input manipulations does not change the value of attention scores. The manipulations Q,K matrices are thus constrained under this assumption.
Theorem 4.4 The manipulations on Q,K matrices at layer can be categorized into
1. Input-related ones, passed by RMSNorm:
w(O) B,3 = = A.D. for E (2K);
2. RoPE-related ones: W..
(1) W., for E (Q.K):
where B, are special orthogonal matrices that keep RoPE results.
proof for Theorem 4.4 is provided in Appendix E.4, where we also show how manipulations on inputs are recovered after V. O matrices to satisfy Proposition 4.2, These manipulations preserve the attention score values of model A in the suspicious model B. However, they can greatly change the weights of the original model A, bringing difficulty the development of detection methods.
4.5 POTENTIAL ATTACKS
Combining Theorem 4.3 and Theorem 4.4, the admissible manipulations on W A.portial (word embed- dings and Q K matrices) Definition 4.1 are restricted to
w((l) B.s = -1 D T W-(0T Q U-UT + E 15 ie (Q.K)
(4)
B.emb = c W A.emb PD + EB,emb-
(5)
Here E' collects post-training, continual pre-training, pruning, upcycling, multimodal adaptation, or related adjustments. The nonlinear usage of W A,partall especially through the Q, K matrices, sub- stantially limits manipulation complexity. Consequently, checking similarity between W A.puttial and W B B.putiall is typically sufficient for detection. The remaining avenues targeting W, A.rriial are de- ferred to Appendix E.5, where we also discuss how such transformations can recover Transformer block outputs in light of Proposition 4.2.
TThe conclusions generalize models with different number of layers (possibly result of pruning).
See Appendix F.3
5

---

Published as a conference paper at ICLR 2026
Algorithm LLP--nhanccee Unbiased Central Kernel Alignment (UCKA) Similarity Detection
1: Given two 1'-laaered L.LMs A, B and their weight matrices W. A,prtially W B.pattial-
2: Let 7 = Vocab( A) n Vocab( B), and m' |7]-
3: Let W.shaaod-mm = W W..cmb(4 [] and W B.sharedmmmb = WB, cmb [L,
<(W,, A, shared emb emb): (W B. shared emb emb)::1) ):11)
4: Build the cosine similarity matrix C' with Ck,
I(W A. sharcd-omb)).kk ([ B sharedd-embb
5: Construct the permutation and signature matrices P, D via LAP:
6: Find a permutation ı maximizing EE (Ck, with the Hungarian algorithm.
7: For each column k. set 8k sign (k),((k).
8:
Set (k)) = 1 for every k. set = diag( $1 $2,...; ,kk...)
9:
for = 1, .....: do
10:
$Q
UCKA P
W WhT A.Q
(((lT)
SK = UCKA UCKA(DTPTT) P w(O A.K: B,K
end for
12: return Et ①1) 1 1/2L
METHODOLOGY
Building on Theorem 4.3 and Theorem 4.4, we propose a two-stage procedure in Algorithm 1: (i) extract P and D from the word embeddings; (ii) assess cross-model similarity by comparing the Q and K matrices. This design achieves fast, reliable discrimination with minimal computation.
Extracting the Permutation and Signature from Word Embeddings A key property of RB is that the permutation and signature matrices may appear in either order: both R emb cPD and RB.com = cDP are possible. However, any product DP can be rewritten as I' D'' for some permutations p and signature matrices D', Hence it suffices recover a canonical PD from the embeddings. We cast this as a Linear Assignment Problem (LAP; Burkard & Cela (1999)) solved by the Hungarian algorithm (Kuhn, 1955), which invariant any nonzero scalar factor. Specifically, we first restrict to the shared vocabulary and form the matrix of absolute cosine similarities between the columns of W A,emh and B.eemb- Then, IAP is applied to obtain the permutation the signs of the cosine similarities at the matched pairs to reconstruct the signature matrix D. This approach effectively reconstruct corresponding transformations due to its low demand of additional parameters in the detection process.
Next, we use
Robust Recovery of Weight Similarities Despite accounting for permutation and signature ma- nipulations, the orthogonal transformations U1( remain challenging. They introduce a substantial
nuisance parameter burden: if w:( E Rddx,, then orthogonal U E Raxd contributes d² parame- ters, which prohibitive when n and can undermine robustness by adding parameters detec- tions (Simmons et al., 2011). We therefore use Central Kernel Alignment (CKA) as a parameter-fre free similarity metric: by Theorem 3.1, CKA is invariant to orthogonal transforms and constant rescal- ing. While this invariance does not extend to semi- seti-orthogonal U/) (c.g., induced by pruning), CKA remains effective to a meaningful extent in such cases, relieving the need to explicitly reconstruct U To further mitigate biases (Gretton al., 2005; Murphy al., 2024), adopt the unbiased variant (Song et al., 2007), termed UCKA (see Appendix D.2).
EXPERIMENTS
In this section, we present a series of experiments designed to rigorously evaluate our proposed model fingerprinting method. We begin in Section 6.1 by verifying its fundamental ability to dis- tinguish between derived (offspring) and independent models. Next, in Section 6.2, we assess the critical risk of false positives by comparing its performance 90 pairs of independent models
For LLMs with differing layer counts A T.p). e.g., from layer pruning, find the optimal layer pairing by solving the IAP LA Lag matrix of layer-wise similarities hefore calculating overall similarity.

---

Published as a conference paper at ICLR 2026
Table Similarity (%) of various LLMs LLaMA2-7B and LLaMA2-13B base models. Offsspring models consistently show high similarity scores (light red), while independent models have negligi- ble similarity (light green), demonstrating the method's 's diseriminative power.
Base Model: LLaMA2-7B
Base Model: LLaMA2-138
Offisring
Sim
Independent
Sim
Offisring
Sim
Independent
Sim
WizardMath-78 7b
99.99
Baichuan-7b
0.58
Selfrag 1lama2.13b
99.99
Baichuan- 13b
0.17
Selfrag-7b
99.98
Mistral-7b
0.63
Nous-Hermes 13b
99.98
Baichuan2-133
0.23
Vicuna-7b 7b
99.95
OLMo-7b
0.46
Llama2- Hamaa2-1bborce 13b-orca
99.98
OLMo2- 13b
0.21
Llama2-7h-Chat
99.93
Qwen-7h
0.19
Vicuna- 133
99.93
Qwen-14h
0.20
Finance-7h
99.93
InternI.M771
0.43
Llama2- 1amma2-13--Chhe 13b-Chat
99.92
Qwen3-14b
0.41
Llama2-7h-32K
99.88
MPT-7h
0.04
Firefly-1lam22-13 13hb
99.81
Jais-13b
0.03
Guanaco-7b
99.80
LLaMA-7b
0.81
Llama2-koen 13b
97.76
LLaMA-13b
0.74
Llama2-ko ko-2
96.79
OpenLlama-7b
0.71
Llama2- Llama2-13b-Esae -3---pppa
96.60
OpenL 13b
0.51
against two state-of-the-art baselines, HuRef and REEF. In Section 6.3, we test the method's 's robust- ness against wide array of common post-training modifications using a comprehensive suite of 60 offspring models. Finally, in Section 6.4, we provide overall performance comparison, leveraging ROC curves and other metrics to demonstrate our method's superior discriminative power.
Baselines. We compare method against two advanced baselines: the weight-based method HuRef (Zeng et al., 2024), and the representation-bast based method REEF (Zhang et al., 2025).
6.1 EFFECTIVENESS VERIFICATION
We first established our method's s core effectiveness in identifying model lineage. We collected eight offspring models for both LLaMA2-7B and LLaMA2-13B, alongside eight independent models for each size. We then calculated the similarity between the base model and these two groups.
As shown in Table the results demonstrate a clear distinction. Offssring models exhibited ex- ceptionally high similarity to their respective base models, whereas the similarity scores between independent models were negligible, forming strong basis for intellectual property protection.
6.2 FALSE POSITIVE RISK EVALUATION ON 90 UNRELATED PAIRS
critical requirement for any reliable fingerprinting method is an extremely low false positive rate. To evaluate this risk, we collected 10 independent 7B LLMs and 10 independent 13B LLMs, forming 45 unique pairs for each size. We then computed the pairwise similarity (%) for all 90 pairs using method and compared the results with those from REEF and HuRef.
The heatmaps in Figure 2 illustrate our method's ' superior performance in avoiding false positives.
For independent pairs, our method yielded mean similarity scores of just 0.49 (7B) and 0.26 (13B). These scores are nearly an order magnitude lower than HuRef (means of 3.56 and 2.) and two orders of magnitude lower than REEF (means of 42.47 and 47.44).
Notably, REEF frequently produces dangerously high similarity scores for unrelated models, with many pairs exceeding 80 and some even surpassing 95. Such high values could easily lead to false accusations of model theft. In contrast, the maximum similarity scores for our method were merely 1.5 (7B) and 0.8 (13B), reaffirming its significantly lower risk of false positives.
6.3 ROBUSTNESS VERIFICATION ON 60 OFFSPRING MODELS
Base LLMs often undergo substantial post-training modifications, including SFT, continued pre- training. reinforcement learning (RL), pruning, upcycling, and multi-modal adaptation. These pro- cesses can significantly alter model parameters, making robustness critical attribute for any finger- printing technique. To rigorously evaluate our method's robustness, curated diverse test suite of 60 positive pairs, each consisting of a base model and a derived offspring model. This suite includes 10 pairs for each of the six modification categories listed above.

---

Published as a conference paper at ICLR 2026
opentLatt
OpeniLaaae
Hotral
LAAMA
talcharr
1:0
6-4
0.7
57
3.1
0.
1.3
120
23.3
18.6
34.1
2622
24.7
26.4
100
3.6
4.0
6.6
1G
Mizzl
0.5
9.1
3.5
122
Ower 0.4
22
0.4
300
0.4
02
5.3
211
0.2
0.3
12.5
160
31.8
25.7
04.2
23.7
31.6
2.6
0.2
20
40
255
23
2.5
32
2.5
IntarrM
0.3
220
2.0
0.1
0.5
150
200
03
200
333
6.1
2.0
LEaNO 0.C
3.6
3.0
0.7
342
150
63
37.4
4.3
0.5
2.5
1.0
203
7.5
12.0
3.8
LIMAA 0.7 2.5
0.6
0.3
0.5
200
21
0.7
0.8
262
37.0
25.4
25-7
35.4
03.7
100
20.0
05
24
4.1
032
26
3.0
33
75
100
7.5
36
3.6
0.1
OperzLaNAA 0.5 2.5
103
24.7
23
31.
32.0
25.0
26.4
102
00
3.2
37
33
4.2
12
OpenLurMA 1.
2.5
0.9
0.3
0.5
07
2.8
21
1.
100
34A
25.1
23.3
31.5
524
04.3
24.3
37.7
93.2
200
4.0
0.1
92
2.5
30
5.9
5.5
53
200
Indopendent 7B LLMo Ours (hrg 0.49)
Independent 78 LUMe REEF
(Aug: 42,47)
Independent 78 LLMS HuRet (Avg 3.56)
302
k7C
2.5
0.0
0-
0.2
0.1
3.2
0.2
0.2
L20
F14
15.3
25.3
25.5
$5.4
21.5
355
15
13
107
3.3
02
3.4
35
54
21
5akhuar2
922
0.3
22.6
200
01
0.0
0.3
3.0
0.0
22
-4.4
26
32
0.4
2.4
3.5
03
0.0
2.1
LUMMA 0.3
2.3
0.1
302
0.7
02
2.5
2.0
0.2
0.4
32.
38.5
44.4
102
024
31.9
20
21
45
62
3.2
3.0
0.4
100
75
5.0
522
2.5
1.5
24
OJM62 0.1 5.1
0.2
0.2
130
2.2
3.4
0.7
25.2
16.1
06:
37.9
27.
230
12.4
75
4.6
3.5
5.0
66
4.3
2.6
OpenLLaMs 0.2 9/2
0.1
0.5 0.5
02
100
2.5
0.2
0.3
22.5
25.5
10.3
M0.3
M9.2
23.2
100
5.3
25.3
29.5
5.2
3.3
0.0
3.2
38
6.0
107
2.4
2.1
Ower 022 0.2
0.2
0.2
0.2
92
9.2
78.3
22.4
41.0
30.0
20.3
25.4
202
65
2.7
3.7
3.8
18
2.2
25
Owent 022 3.3 0.1 0.4
5.5
37
100
25.0
P3.
-2.4
20.7
28.3
122
052
100
0.7
633
3/3
1.
12
Independent 138 LLMS Ours (log: 0.261
Independent 138 LUM!! REEF (egg: (7.04)
Independent 138 LLMs' HuRet (0vg: 2.37)
Figure 2: Pairwise similarity (%) heatmaps for independent 7B (top row) and 13B (bottom row) LLMs. The columns compare our proposed method against two baselines, REEF and HuRef. Our method consistently yields near-zero similarity scores for all independent model pairs, indicating a significantly lower risk of false positives. In contrast, REEF often produces high similarity scores (> 80), which could easily lead to false accusations of model theft.
The effectiveness of fingerprinting method hinges on its ability to distinguish between related (pos- itive) and unrelated (negative) pairs. However, absolute similarity scores (%) can be misleading. A method yielding scores of 10 for a positive pair and 0.1 for negative pairs is far more discriminative than one producing scores of 90 and 40. To accurately measure the discriminative power, must quantify how statistically different a positive pair's similarity is from the distribution of negative pairs. For this, ations a positive pair's similarity is from the mean of the negative pairs' similarities. A larger |Z| indicates that the positive pair is more likely to be a statistical outlier relative to the population of unrelated pairs and thus more highly separable.
the absolute Z-score ((Z)). This metric measures how many standard devi-
The results, presented in Table 2, highlight the superior robustness of method. HuRef loses effectiveness under heavy modifications like extensive continued pretraining (e.g., its ZZ] drops to 0.57 for Qwen2.5-coder). REEF consistently yields low [2], often below 2.0, indicating poor sep- arability. In stark contrast, our method maintains remarkably high |Z| across all 60 positive pairs, demonstrating its resilience against wide array of demanding post-training modifications.
6.4 OVERALL EVALUATION
To synthesize our findings, we conducted a comprehensive evaluation against HuRef (ICS) and RBEF using the full dataset of 60 positive and 90 negative model pairs. Additionally, we incorpo- rated PCS (from HuRef) and Intrinsic Fingerprint (Yoon et al., 2025) as supplementary baselines to broaden the comparative analysis.
'In this context, the absolute 7-score is mathematically equivalent to the Mahalanobis distance.
8

---

Published as a conference paper at ICLR 2026
Table 2: Absolute Z-scores (1) of positive samples for HuRef, REEF, and our method. The full names of abbreviations and related model details are provided in Appendix G.
SFT
Base
Llama2-7B
Llama2 13B
Offspring
Vicuna
Finance
Selfrag
32K
Wizard
Guanaco
Vicuna
Hermes
Estopia
Firefly
HuRef
44.22
44.20
44.47
44.22
44.51
44.12
44.25
44.48
43.09
44.51
REEF
1.95
1.94
1.95
1.88
1.95
1.94
1.94
1.95
1.91
1.95
Ours
355.09
355.02
355.20
354.84
355.23
354.55
355.02
355.20
343.14
354.59
Continual Pretrain
Gemma -2B
Gemma
Qwen2.5 -7B
Qwen2 -7B
Base
Llama2-7B
Llama2-70B
Llemma (700B)
Code (520B)
Python (620B)
Code (500B)
Code (500B)
Math (1T)
Coder (5,5T)
Math (700B)
Code (520B)
Python
Offspring
(620B)
HuRef
8.15
9.41
9.19
28.97
39.51
0.28
0.57
1.01
2.78
REEF
1.66
1.31
1.77
0.32
1.52
1.29
1.09
1.93
1.92
Ours
250.32
250.78
253.28
198.18 18
268.72
177.57
135.17
183.49
241.12
232.92
Upeycling
Mistral
Llama3
Qwen -1,8B
Minicpm -2B
Base
Llama2-7B
-8B
MoE
MoE 3B
MoE3B
MoE2
MoE4
Qwen1.5
Minicpm
Offspring Mixtral
MoE4
MoE2
v2
-SFT
-SFT
-SFT
MoB
MoB
HuRef
7.97
42.50
24.58
21.59
24.91
21.59
24.91
24.58
4.03
11.39
REEF
1.47
0.47
0.64
0.64
0.62
0.63
0.63
0.62
0.57
1.49
Ours
239.01
332.12
332.23
326.49
332.12
326.49
332.12
332.23
173.36
150.15
Multi Modal
Qwen2 -7B
Qwen2.5
Qwen2.5
Llama3
Llama2
Base
Llama2-7B
Qwen-7B
-7B
-3B
-13B
Offspring
LLaVA
Video
VL
Audio
Audio2
VL
VL
VL
Next
LLaVA
HuRef
44.06
44.03
39.94
38.79
21.59
37.41
24.28
23.95
44.30
44.09
REEF
0.40
0.36
0.84
0.19
0.45
0.77
0.48
0.61
0.26
0.07
Ours
354.98
354.98
342.72
339.86
317.97
336.55
290.08
298.46
355.05
354.91
RL
Open- Ilama3B
Qwen2.5
Qwen2.5 -1.5B
Minicpm
Qwen3 -4B
Chatglm -6B
Llama3
Base
Mixtral
Mistral-7B
-7B
-2B
-8B
Offspring
RLHHF
Reason
Zero
DPO
DPO
Dolphin
DPO
GRPO
RLHF
DPO
HuRef
44.52
44.58
44.58
44.57
44.53
44.54
44.58
44.58
44.58
44.52
REEF
1.94
1.93
1.94
1.75
1.48
1.21
1.92
1.78
1.96
1.96
Ours
355.23
355.27
355.27
355.23
355.23
355.23
355.27
355.27
355.27
355.23
Pruning
Base
Llama-3 3-BB
Llama2-7B
Minitron Depthh
Minitron -iidth
Llama3
Llama3
Sheared 2.7B-P
Sheared 2.7B-S
Sheared 2,7B
Sheared 1.3B-P
Sheared 1.3B
Sheared
Offssrrin
-IB
-3B
1.3B-S
HuRef
28.29
22.23
0.33
0.73
22.88
16.00
15.86
10.06
7.64
REEF
0.52
0.53
1.15
0.92
1.75
1.78
1.77
1.80
1.79
1.79
Ours
344.07
343.00
12.14
106.29
328.81
312.44
312.80
317.79
297.50
297.50
As illustrated Figure 1, our method demonstrates vastly superior performance. The Receiver Operating Characteristic (ROC) curve (left) shows that our method achieves perfect Area Under

---

Published as a conference paper at ICLR 2026
Table 3: Detailed performance comparison of fingerprinting methods across various post-training techniques. Our method consistently achieves perfect scores (1.0) on all classification metrics (AUC, PAUC, TPR @ (FPP) and maintains significantly larger separation margin ((2)) across all sce- narios. CPT: Continual Pre-Training, UP: Upeycling, MM: Multi-modal, PR: Pruning.
Method
Metric
SFT
CPT
UP
MM
RL
PR
All
Z
43.748
10.331
20.805
36.244
44.559
13.166
28.142
AUC
1,000
0.879
0.999
1.000
1.000
0.866
0.957
HuRef
PAUC
1.000
0.656
0.978
1.000
1.000
0,800
0.906
TPR@ I%FPR f
1.000
0.500
0.900
1.000
1.000
0.800
0.867
t
1.936
1.384
0.777
0.443
1.788
1.381
1.285
AUC
1,000
0.857
0.508
0.648
0.963
0.692
0.778
REEF
PAUC
1.000
0.211
0.000
0.000
0.658
0,300
0.362
TPR@ I%FPR f
1.000
0.200
0.000
0.000
0.600
0.000
0.300
7
1.535
1.193
1.408
1.532
1.542
1.141
1.392
Intrinsic
AUC
1.000
0.896
0.969
1.000
1.000
0.876
0.957
Fingerprint
PAUC
1.000
0.422
0.800
1.000
1.000
0,400
0.770
TPR@ 1%FPR t
1.000
0.300
0.800
1.000
1.000
0.400
0.750
Z
73.786
74.650
0.727
14.950
163,399
17.226
57.457
AUC
0.958
0,959
0.791
0.802
0.984
0.666
0.860
PCS
PAUC
0.656
0.600
0.078
0.500
0.900
0.100
0.472
TPR@ 1SEPR f
0,500
0.600
0.000
0,500
0,900
0.100
0.433
t
353.788
219.155
287.634
334.556
355.250
267.23.
302.936
AUC
1.000
1.000
1.000
1.000
1.000
1.000
1,000
Ours
PAUC
1.000
1.000
1.000
1.000
1.000
1.000
1.000
TPR@ 1SFPR f
1.000
1.000
1.000
1.000
1.000
1.000
1.000
the Curve (AUC) of 1.0, indicating flawless discrimination. This starkly outperforms both HuRef (AUC = 0.957) and REEF (AUC 0.778).
In practical applications, preventing false accusations of model theft is paramount, making perfor- mance at a very low False Positive Rate (FPR) essential. We therefore employ two stricter metrics: the partial AUC for FPR < 0.05 (pAUC) and the True Positive Rate at 1% FPR (TPR @ 1%FPR).
Table 3 details the performance breakdown across post-training techniques. Our method consistently achieves perfect scores (1.0) all classification metries (AUC, pAUC, and TPR @ FPR) across all categories. In contrast, the baseline methods show significant limitations. REEF's performance collapses in several scenarios, with pAUC and TPR @ 1 FPPR scores falling to 0.0 for Upcycling and Multi-modal. HuRef also shows vulnerability, with its TPR@ %FPR dropping to 0.500 under Continual Pre-Training Our method's perfect classification scores, combined with its substantially larger average absolute Z-score ((Z)), underscore its superior robustness and reliability.
CONCLUSIONS
In this paper, we propose training free fingerprinting method for LLM identification. Our approach does not impair LLM's general capability while exhibiting robustness against fine-tuning, extensive continued pretraining, reinforcement learning, multimodal extension, pruning, and upcycling, and simultaneously avoids the risk of false positives. Experiments on a testbed comprising 150 pairs of LLMs demonstrate the effectiveness our method.
ACKNOWLEDGEMENTS
This work is sponsored by the National Key Research and Development Program of China (No. 20232D0121402) and the National Natural Science Foundation of China (NSFC) grant (No. 62576211).
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weak- ness into strength: Watermarking deep neural networks by backdooring. In 27th USENIX Secu- rity Symposium (USENIX Security 18), pp. 1615-1631, 2018.
BaiChuan-Inc. https:
/ttp///gtttt..t/// com/ http:::tttttththeee chuan inc Lane/aaiciie Baicchann 7B, 2023.
Rainer E Burkard and Eranda Cela. Linear assignment problems and extensions. In Handbook of combinatorial optimization: Supplement volume A, pp. 75-149. Springer, 1999.
Huili Chen, Bita Darvish Rouhani, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Deepmarks: A secure fingerprinting framework for digital rights management of deep learning models. In Proceedings of the 2019 International Conference on Multimedia Retrieval, pp. 105-113, 2019a.
Huili Chen, Bita Darvish Rouhani, and Farinaz Koushanfar. Blackmarks: Blackbox multibit water- marking for deep neural networks. arXiv preprint 19Xiv:990400330 2019b.
Jialuo Chen, Jingyi Wang, Tinglan Peng, Youcheng Sun, Peng Cheng, Shouling Ji, Xingjun Ma, Bo Li, and Dawn Song. Copy, right? a testing framework for copyright protection of deep learning models. IEEE Symposium on Security and Privacy, pp. 824 241,2022
Chanwoo Chun, Abdulkadir Canatar, Sue Yeon Chung, and Daniel D Lee. Estimating neural repre- sentation alignment from sparsely sampled inputs and features. arXiv preprint arXiv:2502. 15104, 2025.
Jacob Devlin, Ming- Wei Chang. Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguisties: human language technologies, volume (long and short papers), pp. 4171-4186, 2019.
Pierre Fernandez, Guillaume Couairon, Teddy Furon, and Matthijs Douze. Functional invariants to watermark large transformers. In ICASSP 2024-2024 IEEE International Conference on Acous- tics, Speech and Signal Processing (ICASSP), pp. 4815-4819, IEBE, 2024.
Irena Gao, Percy Liang and Carlos Guestrin. Model equality testing: Which model is this api serving? In International Conference on Learning Representations, 2025.
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21788 2024.
Arthur Gretton, Olivier Bousquet, Alex Smola, and Bernhard Schölkopf. Measuring statistical de- pendence with hilbert-schmidt norms. In International conference on algorithmic learning theory, pp. 63-77. Springer, 2005.
Martin Gubri, Dennis Ulmer, Hwaran Lee, Sangdoo Yun, and Seong Joon Oh. Trap: Targeted random adversarial prompt honeypot for black-box identification. In Findings of the Association for Computational Linguistics: ACL 2024, pp. 11496 11517, 2024.
Jia Guo and Miodrag Potkonjak. Watermarking deep neural networks for embedded systems. In 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pp. 1-8. IEEE, 2018
Ethan He, Abhinav Khattar, Ryan Prenger, Vijay Korthikanti, Zijie Yan, Tong Liu, Shiqing Fan, Ashwath Aithal, Mohammad Shoeybi, and Bryan Catanzaro. Upcycling large language models into mixture of experts. arXiv preprint arXiv:2410.07524, 2024.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
11

---

Published as a conference paper at ICLR 2026
Binyuan Hui, Jian Yang, Zeyu Cui, Jiaxi Yang, Dayiheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Keming Lu, et al. Qwen2. 5-coder technical report. arXiv preprint arXiv:2409. 2024.
Heng Jin, Chaoyu Zhang, Shanghao Shi, Wenjing Lou, and Y Thomas Hou. Proflingo: A fingerprinting- based intellectual property protection scheme for large language models. In IEEE Conference on Communications and Network Security, pp. 1 1-9. IEEE, 2024.
Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, Ramona Merhej, Sarah Perrin, Tatiana Matejovicova, Alexandre Ramé, Morgane Rivière, et al. Gemma 3 technical report. arXiv preprint arXiv:2503. 2025.
Hyunmo Kang, Andulkadir Canatar, and Sue Chung. Spectral analysis of representational similarity with limited neurons. arXiv preprint arXiv:2502 19648, 2025.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, lan Miers, and Tom Goldstein. A watermark for large language models. In International Conference Machine Learning, pp-
17061-17084. PMLR, 2023.
Simon Kornblith, Mohammad Norouzi. Honglak Lee, and Geoffrey Hinton. Similarity of neural network representations revisited. In International conference on machine learning, pp. 3519- 3529, PMIR, 2019.
Harold W Kuhn. The hungarian method for the assignment problem. Naval research logistics quarterly, 2(1-2):83-97, 1955.
Erwan Le Merrer, Patrick Perez, and Gilles Trédan. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications (NCA), 32(13),9233-9244, 2020.
Peixuan Li, Pengzhou Cheng, Fangqi Li, Wei Du, Haodong Zhao, and Gongshen Liu. Plmmark: secure and robust black-box watermarking framework for pre-trained language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 14991-14999, 2023.
Zhouhan Lin, Minwei Feng, Cicero Nogueira dos Santos, Mo Yu, Bing Xiang, Bowen Zhou, and Yoshua Bengio. structured self-attentive sentence embedding. arXiv preprint arXiv: arXiv:1703.03130, 2017.
Hanwen Liu, Zhenyu Weng, and Yuesheng Zhu. Watermarking deep neural networks with greedy residuals. In Proceedings of the International Conference Machine Learning (ICML), pp- PMLR, 2021.
Nils Lukas, Yuxuan Zhang, and Florian Kerschbaum. Deep neural network fingerprinting by con- ferrable adversarial examples. arXiv preprint arXiv: 1912:1911200088 2019.
Hope Elizabeth McGovern, Rickard Stureborg, Yoshi Suhara, and Dimitris Alikaniotis. Your large language models are leaving fingerprints. International Conference on Computational Linguis- fics Workshop, pp. 85 95, 2025.
Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière. Mihir Sanjay Kale, Juliette Love, et al. Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295. 2024.
Alex Murphy, Joel Zylberberg, and Alona Fyshe. Correcting biased centered kernel alignment measures in biological and artificial neural networks. arXiv preprint wrXiv:240S.01011 2024.
Xudong Pan, Yifan Yan, Mi Zhang, and Min Yang. Metav: A vetivverifier approach task-agnostic model fingerprinting. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Dis- covery and Data Mining (SIGKDD), pp. 1327-1336, 2022.
Dario Pasquini, Evgenios M Kornaropoulos, and Giuseppe Ateniese. Llmmap: Fingerprinting for large language models. In USENIX Security Symposium, 2025.
12

---

Published as a conference paper at ICLR 2026
Guilherme Penedo, Quentin Malartic, Daniel Hesslow, Ruxandra Cojocaru, Alessandro Cappelli, Hamza Alobeidli, Baptiste Pannier, Ebtesam Almazrouei, and Julien Launay. The Refined dataset for Falcon LLM: outperforming curated corpora with web data, and web data only. arXiv preprint arXiv:2306.0/ / 16, 2023. URL https: /arxiii org/ abs 2306.0. 01101111111
Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark. In Proceedings of the 61 Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 7653- 7668, 2023.
Zirui Peng, Shaofeng Li, Guoxing Chen, Cheng Zhang, Haojin Zhu, and Minhui Xue. Fingerprint- ing deep neural networks globally via universal adversarial perturbations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 13430-13439, 2022.
pzc163 et al. Project author team stay tuned: I found out that the Ilama3-v project is stealing lot of academic work from minicpm-llamade - 2.5, github issue opened in the minicpm-o repository. https: /ttt:///gthtbb/// com /Mtp////////////eeeeeeeeeee Mi ni CPM- o/ ssues / 96, 2024. OpenBMB, June 2, 2024.
Alec Radford, Karthik Narasimhan, Tim Salimans, Ilya Sutskever, et al. Improving language under- standing by generative pre-training. 2018.
Mark Russinovich and Ahmed Salem. Hey, that's my model! introducing chain & hash, an 11m fingerprinting technique. arXiv preprint arXiv:2407.10887, 2024.
Shuo Shao, Yiming Li, Hongwei Yao, Yifei Chen, Yuchen Yang, and Zhan Qin. Reading between the lines: Towards reliable black-box 1lm fingerprinting via zeroth-order gradient estimation. arXiv preprint arXiv:2510. 25000660,,, 2025.
Joseph P Simmons, Leif D Nelson, and Uri Simonsohn. False-positive psychology: Undisclosed flexibility in data collection and analysis allows presenting anything significant. Psychological science, 22 13:111)))331111:1 1359-11666, 2011.
Le Song, Alex Smola, Arthur Gretton, Karsten M Borgwardt, and Justin Bedo. Supervised feature selection via dependence estimation. In Proceedings of the 24th international conference on Machine learning, pp. 823-833 2007.
Jianlin Su, Murtadha Ahmed, Yu Lu, Shengfeng Pan, Wen Bo, and Yunfeng Liu. Roformer: En- hanced transformer with rotary position embedding. Neurocomputing, 568: 127063, 2024.
CodeGemma Team, Heri Zhao, Jeffrey Hui, Joshua Howland, Nam Nguyen, Siqi Zuo, Andrea Hu, Christopher A Choquette- -Choo, Jingyue Shen, Joe Kelley, et al. Codegemma: Open code models based on gemma. arXiv preprint arXiv:2406. 1409, 2024.
InternLM Team. Internlm: A multilinguul language model with progressively enhanced capabilities. https: gittbb.. com/ Inte Int.ennneetiiiiieeeeeeeeeeaetttt wwtp:/IIneeennIi 2023.
Kimi Team, Yifan Bai, Yiping Bao, Guanduo Chen, Jiahao Chen, Ningxin Chen, Ruijue Chen, Yanru Chen, Yuankun Chen, Yutian Chen, et al. Kimi k2: Open agentic intelligence. arXiv preprint 2rXiv:2507.205344 2025.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint 13971,, 2023a.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Niko- lay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open founda- tion and fine-tuned chat models. arXiv preprint arXiv:2307. 092888 2023b.
Yun- Yun Tsai, Chuan Guo, Junfeng Yang, and Laurens van der Maaten. Rofl: Robust fingerprinting of language models. arXiv preprint 2505 12682, 2025.
13

---

Published as a conference paper at ICLR 2026
Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin'ichi Satoh. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on Interaatonall Conference on Multimedia Retrieval. ACM. jun 2017. doi: 10.1145/3078971.3079999 URL https://doi.
1tt.//00.115522333111 30789777
Tianhao Wang and Florian Kerschbaum. Riga: Covert and robust white-box watermarking of deep
neural networks. In Proceedings of the Web Conference 202/ (WWW), pp. 993-1004, 2021.
Zehao Wu, Yanjie Zhao, and Haoyu Wang. Gradient- model fingerprinting for 1lm similarity detection and family classification. arXiv preprini arXiv:2506.0163/ 2025.
Mengzhou Xia, Tianyu Gao, Zhiyuan Zeng, and Danqi Chen. Sheared llama: Accelerating language model pre-training via structured pruning, In The Twelfth International Conference on Learning Representations.
Jiashu Xu, Fei Wang, Mingyu Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. Instructional fingerprinting of large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Tech- nologies (Volume 1: Long Papers), pp. 3277-3306, 2024.
Zhenhua Xu, Zhebo Wang, Maike Li, Wenpeng Xing, Chunqiang Hu, Chen Zhi, and Meng Han. Rap-sm: Robust adversarial prompt via shadow models for copyright verification of large lan- guage models. arXiv preprint urXiv:2505.06330 2025.
Kang Yang, Run Wang. and Lina Wang. Metafinger: Fingerprinting the deep neural networks with meta-training. In Proceedings of the International Joint Conference on Artificial Intelligence (IJCAI), 2022.
Zhiguang Yang and Hanzhou Wu. A fingerprint for large language models. arXiv preprint 2:Xiv:2407.01235, 2024.
Do-hyeon Yoon, Minsoo Chun, Thomas Allen, Hans Müller, Min Wang, and Rajesh Sharma. In- trinsic fingerprint of llms: Continue training is not all you need to steal model! arXiv preprint arXiv:2507.03014, 2025.
Boyi Zeng, Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu Yu, and Zhouhan Lin. Huref: Human-readable fingerprint for large language models. Advances in Neural Informa- tion Processing Systems, 02212223322666622 2024.
Biao Zhang and Rico Sennrich. Root mean square layer normalization. Advances in neural infor- mation processing systems, 32, 2019.
Jie Zhang, Jiayuan Li, Haiqiang Fei, Lun Li, and Hongsong Zhu. Easydetector: Using linear probe to detect the provenance of large language models. In IEEE International Conference on Trust, Security and Privacy in Computing and Communications, 2024.
Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. REEF: Representation encoding fingerprints for large language models. In The Thirteenth International Conference on Learning Representations, 2025. URL https: http://ppnneeeeeeeeeeeeeeee net.eeeieeweeeeeeeeeeeeee forum?
Ad=SnDmPkOJOT
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christo- pher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.010mm 2022.
Jingjing Zhao, Qingyue Hu, Gaoyang Liu, Xiaoqiang Ma, Fei Chen, and Mohammad Mehedi Has- san. Afa: Adversarial fingerprinting authentication for deep neural networks. Computer Commu- nications. 150:488-499 4978884997222 2020.
Xuandong Zhao, Yu- Yu-Xiang Wang, and Lei Li. Protecting language generation models via invisible watermarking. In International Conference Machine Learning, pp. 42187-42199. PMLR, 2023.
Qinkai Zheng, Xiao Xia, Xu Zou, Yuxiao Dong, Shan Wang, Yufei Xue, Zihan Wang, Lei Shen, Andi Wang, Yang Li, Teng Su, Zhilin Yang. and Jie Tang. Codegeex: A pre-trained model for code generation with multilingual evaluations on humaneval-x. In KDD, 2023.
14

---

Published as a conference paper at ICLR 2026
A ETHICS STATEMENT
The primary motivation for this work is to protect the intellectual property large language models (LLMs), thereby promoting fairness and accountability within the AI community. We acknowl- edge the potential societal impact of such a technology, particularly the risk of false accusations of model theft. Therefore, core design principle of our method to achieve an exceptionally low false- palse-positive rate, as empirically demonstrated in our experiments. By establishing a high-fidelity verification system, we aim foster more transparent and trustworthy open-source source ecosystem. All models used in this study are publicly available, and our research does not involve any private or sensitive user data.
B REPRODUCIBILITY STATEMENT
To ensure the reproducibility of our results, we have included the complete source code in the sup- plementary material. We also provided detailed deseription of methodology in Section 5, in- cluding step-by-step algorithm. All models used for evaluation are publicly available from sources such the Hugging Face Hub, and a comprehensive list mapping our model abbreviations to their full names is included in Appendix G. A public code repository will be made available upon publi- cation.
C THE USE OF LARGE LANGUAGE MODELS
The core research and analysis presented in this manuscript conducted without the of Large Language Models (LLMs). An LLM was utilized exclusively to improve the language and clarity of the text.
15

---

Published as a conference paper at ICLR 2026
D DEFINITIONS AND NOTATIONS
D.1 LLM ARCHITECTURE
Weights Here we provide notations for the rest of model A's weights. In addition the notations
in Section 3, we further denote S, W., as the language model head, and W W A,O: A,fin the
w())
v,O matrices and FFN at the 1-th layer, and
W Aothers = WA/W W p.partial
U
wilh
Utw lie l
(WA, Jm
A,mi
1=1
1=1
as the rest of model A's weights.
Functions Here we provide definitions for functions in an LLM.
Definition D.1 (RMSNorm) Given the imput matrix X mxxx" of model A, the learnable parame-
ters WA = (w A.I..... w And) E R" at the I-th layer, and a constant E E IR (this constant is usually shared across all layers of an LLM), RMSNorm at layer is a function that
RMSNorm(X (X, D (A) = diag ((X x 0x1n, +ealm) X d
(6)
Definition D.2 (Self-Attention with RoPE) Given an input X to model A, the self-attention mech- anism at layer a function fam that
(1l (X) = AttnScore X, W(G W
A.Q A.K. 0)- XWOIT -WUTT A.V A,O
where AttnScore is the attention score function with RoPE, i.e.
AtmSCcree X, w A,Q' A,K: 0) softmax
w(l))
RoPE(XW
A.Q 0) RoPE(XW (UT .))". (8a)
RoPE(XW:1)
A.Q 0) = [x] W RoPE(XW(0)
A.Q (0), .....
W A. Rø 1)],
(8b)
A.K 0) = [o] W(T
A.K Ro (O)......... Fmm W
A.K Ro(m - 1)].
(8c)
Here n.._ E R" is the i-th row of X, 0 is the frequency base for RoPE and Ra is the rotation matrix (Su et al., 2024).
RoPE's definition in Definition D.2 is slightly different from their implementations, but still an equivalent version to Su et al. (2024).
Definition D.3 (Fred-forward Networks) Given the input X, the feed-forward network which adopts the SwiGLU MLP is the function f!l defined by
f (x) (SiLU(X
(TT A.gare)
@ (X )
w(it A,dom
where W-ll) A.up' w-()) Aggate
(1 A.lown are bias-free weight matrices, denotes the Hadamard product,
We write wy(()
A.fin = (wil))
A,pp W!() w(!)
and SiLU(=) = (z) with o(2) -
A.gate A,
We abuse the notations in Definition D.I by denoting RMSNorm an (X) A RMSNorm(X. (X, EA) the attention norm and RMSNorm the ffn norm layer of model A. Then, the definition of Transformer block layer of model can be summartized as follows.
(1) (x) RMSNorm (X, (xw W'A.fm AA)
Definition D.4 (Transformer Block) Combining all the components with residual connections, the transformer block at the 1-th layer of model A is a function Transformer that
<(l)
())
(I+ + f
RMSNNrM (1)
(1+ (1) RMSNorman (1)
Transformer
16

---

Published as a conference paper at ICLR 2026
where I is the identity mapping, Jain and [f are the attention and FFN at I-th layer respectively, (1)
( RMSNorm In and RMSNorman are RMSNorm functions for these two components.
Definition D.5 (LLM Architecture) Given an word embedding X, the last hidden state Y of an L-layered LLM A is
Y
(L) Transformer
Transforrmrr o ...
LL--1)
(LL-1)
Transformer (X) W. A,mm
(10)
D.2 CENTRAL KERNEL ALIGNMENT (CKA)
Given two input matrices X1 E Ruxn and X2 IRmx, CKA is function mapping paired input matrices to [0, 1]. and
HSIC(KX, Kx.)
CKA(XI, /HSIC(Kx, x,, (x,) HSICCK X2: Kx2)
(11)
where HSIC x Kx,) - k((X2);, (X2)z) are kernel matrices with the kernel function k(,;) m R - R+ and H mn reduce the finite-sample bias of Eq. (6), we use the unbiased HSIC estimator (Song et al., 2007). Let With Im the all-ones vector of length
tr(K (Kx, Hm Kx, Hm). (Kx,) = k((Xi)s, (X1))). (Kx,)
Im - 1m 1m is the centering matrix. The linear kernels give Kx XXT for matrix X. To
Kx; be Kx, with its diagonal set to zero, i.e., (Kx,a the unbiased HSIC is
HSIC,, (K x, Kx,)= m[m-3] tr(Kx, Kxx) + (1 Rx 1x 2
X, 1m K X2 K
(m-1((m-)) m-
(12)
We then define
HSIC (Kx,
UCKA(X,, X2)
(13)
HSIC (K (Kx,, Kx,)
Kx2)
which preserves Theorem 3.1 and yields values [-1, 1].
17

---

Published as a conference paper at ICLR 2026
E PROOFS AND DISCUSSIONS
E. PROOF FOR THEBOREM 3.1
We give the proof based on the definition of CKA with linear kernels in Appendix D.2. Given input matrices X2, orthogonal matrices U1, U2 and constants the kernel functions yield
= x Kxx Kaxiu c1 X xi
K KeyX21i U2X2U222 X2 C2 2x2222 =22x,,
Therefore, corresponding HSIC results are
HS Ke2Xsta) = (m 1)2
tr
( Hm Xx Hm) = Kxz);
HSI Kax.U,,) = (m 1)2
tr
(xxxxx Hm Xx, Hm) = &HHSIC(KX, Kx,),
o2
HSIC(K KexXsUs)
tr(K H Kx Hm) = -HHSSI((Kx, Kx,).
(m - 1)2
Hence, it follows that
HSIC X,U, KexX,Us)
CKA(GXX1U,,02221)
HSSICKK, K Kax, HSIC K KogKoUss KoyXaU2)
X Kxx)
Ge /HSSSCIIKX Kx,) HSIC(KX, KX2)
HSIC(Kx,, Kx.)
VHSIC(KX, Kx,) HHS)C(HI,K. KX2)
= -
E.2 PROOF FOR PROPOSITION 4.2
The goal is to show the manipulation 7' commutes with f, i.. for = To f. If then suffices show
fa o...0
o
Since
f1 = oT =o Too fn To T
is direct that
foT=Tof.
E.3 PROOF FOR THEOREM 4.3 AND DISCUSSIONS OTHER INPUT MANIPULATIONS
We first show proof for the claims in Theorem 4.3. The core lies in preserving the diagonal structure of RMSNorm parameters in Definition 1. Given the input X to layer 1, the manipulations change cX PD and fed the manipulated input into the attention norm of model B. In order to recover the manipulations on inputs after RMSNorm, i.e. for any manipulation T in the input X (an example is T(X) cDP,
RMSNorm - = RMSNorm giin atin
(14)
suffices to show
(i(( Battn and cn. RMSNorm(X X, Amati (1) cPD RMSNom((XXPD,u BD, fB)
(1)
18

---

Published as a conference paper at ICLR 2026
since the learnable parameters and norm epsilon can be modified to satisfy Equation 14 and Propo- sition 4.2. By setting c = ca and diag(w B.ann) = cD P Aing(w)A.mm))) A one has
RMSNorm(cXLLL w BB)
diag
((cXPD))(cXPD)) (cX +clmm cXPD diag (w (1) B
diag
- (x X)1, + &e (.a1mm.XPPP.. eXPD.cD) PT diag(w (1)
A PD
d.diaag
( + talm
X di A.mm)) PD
+RMSNorm(XX,u w. A.att) cPD.
The proof still holds for partial permutations i.c. Pis rectangular with number of rows more than number of columns, since cD T PT diag(w A.aun) PD is still diagonal matrix. Therefore, R cPD under Proposition 4.2. However, for more general manipulations, Proposition 4.2 does not hold for RMSNorm. We give two examples for illustration.
First, orthogonal transformations on the input generally fail to pass through RMSNorm. Given any orthogonal matrices U as the manipulation on X, i... T(X) = XU, if one attempts to keep Equation 14, then it requires
(1) and e, s.t. RMSNorm(XU: (0) = RMSNorm (X, () A,ttn EA)U.
However, since (X o X)1n = (XU e XU)1n. we have
RMSNorm (XU, c) = diag (1Xx)) X)1n cl XU (dag((()))
Hence, it is required that
U diag(w = diag(w (w A,atm v
which suggests UT diag(w//f) a.n not hold if U is not (partial) permutation matrix P or signature matrix D.
U is diagonal matrix. Nevertheless, this property generally does
Second, non-orthogonal transformations on inputs generally fail pass through RMSNorm. Given an arbitrary (invertible) transformation M, Proposition 4.2 and Equation 14 require that
(i and e, s.t. RMSNorm(XM, (9, RMSNorm X, A,
A,att EA) eAM
However, since
XMSNorm(XM,.uu (1) diag 1 (XX O XM)1, + e1m) XM (iag(w())),
any M that do not satisfy MM = c' where e' is a constant and 7 is the identity matrix can hardly recover the manipulations due to the nonlinearity norm functions. Moreover, similar to the case with orthogonal transformations, M (iag(w(()) diag(w A.aun) )M also requires M to be (partial) permutation or signature matrices (or a combination of the both).
Third, additionally clarify that although the combination of (partial) permutation and signature matrices can be in any order, is reasonable to fix it as Rg emb = cPD. To be specific, we clarify that for any (partial) permutation matrix P' and signature matrix D', there exists a (partial) permutation matrix P and a signature D such that
D'P' = PD
The proof is straightforward. Define P entry-wise by
Py = 1 E 10.
Since left- ceft-muutiplication by D' only flips signs, each column of D'P' has at most one nonzero entry. Hence, P is partial permutation matrix. For each column j, if that column of D'P' P' has its unique nonzero at row i, set
Djj = sgn (D)P))) (+1).
19

---

Published as a conference paper at ICLR 2026
If the column is entirely zero, choose Djj {+1} arbitrarily. Then for all i,j, (PD), = Pi - (
(DD
where we interpret sgn(0) = 1. Therefore, PD = D'P
Last, we clarify that the conclusions in Theorem 4.3 can generalize to the case where model A and model B may not share the same architecture. It is direct result from the fact that the two LLMs have shared tokens and that the pruning over dimensions of model's word embeddings can be viewed as partial permutation matrix.
E.4 PROOF FOR THEOREM 4.4 AND RELATED DISCUSSIONS
We first provide the proof for Theorem 4.4 based on Definition D.2.
We denote by X the original input to self-attention, and X' the manipulated one. Then, Theorem 4.3 suggests that
X' = cXPD
Therefore, the attention score of model becomes
AttSScoreccXPD, B.Q:
B.Q 0) RoPE(cXPDW OT w B.K. 0) softmax RoPECcXPDD UT
B,K ))
To keep attention scores of model B identical to that of model A, it is required that ( B&Q 0) RoPE(cXPPW
RoPE(cX
(CT B.K O) = RoPE A.Q 0) RoPE(X (0T
(
A,K
By Equation 8b and Equation 8c, this translates into
x PDW ()) B.Q. Ri) P WhO Ro( (W) A.
Therefore, the recovery of model A's attention score requires column-wise transformations elim- inate the input-related manipulations passed by RMSNorm, i.e.
w0 B.Q c -w1( PD,
P.D.
wilh B.K =c
-w PD A,K
(15)
which suggests
R(0 B.Q B.K = -PD.
Although Equation recovers attention scores, the Q,K matrices can still be modified without changing attention scores. An example is, given rotation matrix R Ra(k) with the same fre- quency base as ROPE, multiplying Q.K matrices with it does not change the attention scores, i.c.
n. WOT (1) R) (1) B.K
=.J WOO Ro + RR (j + B) 2; BQQQQ W Ro - (1 BKK
x. BQQ.
x. W WOT (TT B.Q
Ri) (1) (U) B.K Zz..
Furthermore, this conclusion can be generalize to any rotation matrix with structures similar to
coos the - sin thk
RoPE rotation matrices. Given R = diag( (Rgg)) R(v)),...) with R(bx) = sin the cos t/ multiplying Q,K matrices by R keeps the attention since
R] (J) (T (j).
(16)
Hence, there are various rotation matrices to significantly change Q,K matrices but preserve atten- tion scores. Since these rotation matrices naturally orthogonal, reformulate the row-wise transformations on Q.K matrices LB,Q, LB,K as U// and U.K
Therefore, we denote RoPE-related manipulations as
w(O B.Q
(-(1) (1
A.K ((() B.K-
B.Q
WB.. B.K
20

---

Published as a conference paper at ICLR 2026
On the other hand, semi-orthogonal U3, U B.K also possible. This because of the common practice in pruning may select different rows of Q.K matrices, which suggests multiplying Q.K matrices with row-wise partial permutations.
Next, show how Proposition 4.2 is satisfied at the self-attention mechanism based on Theo- rem 4.4, Let W W W.y.D PD and w DT P
W
A,0' Then,
B,V
8,0
X'W W B.V B2O = cXPD D PT W W
PD cPD
4.V A.0
AWWA W A.V A,0
recovers the manipulation over inputs in Equation 7.
E.5 How POTENTIAL ATTACKS IN SECTION 4.5 RECOVERS THE OUTPUT OF TRANSFORMERS
We provide illustration based Definition D.3, Definition D.4 and Definition D.5. Previous parts have demonstrated how the manipulations on inputs pass through self-attention. Hence, it suffices show how the manipulations pass through FFN and yield an output identical model A after the language model head.
For layer I, let w B.gate c w (1)
( A,gate Aagate PD, will We denote X' cXPD the manipulated input. Then for model B,
A.gate PD, w
B.gate c
B,down cD (
AWdown
T
+ (X'WOIT)
WOOT B,down
Bigate)
Baap)
(SiLU(cXPD. P
- O (cXPD DJ PT PTw(IT -- w
(U) B,down cPD
A.gate
(SiLU(XW<())))
(XW(IT) A.up)
(L)
A.gate
A,dowa cPD.
By Definition D.4 and Definition D.5, the manipulation is propagated through transformer layers. At the language model head, we denote WB.m = --- "WammPP PD and abuse X' = cXPD as the manipulated input. Then,
XOT = cXPD DTP B.lm
W(T A,m c-1
= X0T
A.lm
recovers the output of model A.
21

---

Published as a conference paper at ICLR 2026
F ABLATION STUDIES
F.I NUMBER OF OVERLAPPING VOCABULARY TOKENS
Although Algorithm uses overlapping tokens recover the signature matrices and permutations, the detection performance AWM does not heavily depend on the amount of vocabulary overlap. In fact, AWM remains effective even when only small number of tokens 100 tokens) are shared between the two vocabularies. To quantify this, we conduct an ablation study on the number of overlapping tokens used in Algorithm Specifically, for each scenario in Table 2 (SFT, Continual Pretraining, Upeycling, Multi-Modal, RL, and Pruning), we compute the average absolute Z-score under different numbers of overlapping vocabulary tokens and report the results in Figure
SFT
Continual Pretrain
Upcycling
300
200
Average Absolute Z-score
500
3000 Multi Modal
1000
5000
10000
500 1000 3000
5000 10000
10
500
1000
3000
500010000
RL
Pruning
300
Avera
100
1000
180000000
500
5000 10000
1.0
500
3000
500010000
Number of Overlapping Vocabulary Tokens
Figure 3: Ablation studies the number of overlapping vocabulary tokens AWM's average absolute Z-score in Table 2. AWM remain effective even when there are only 100 overlapping tokens used in Algorithm 1.
F.2 CKA ABLATIONS
We further conduct an ablation study on the design CKA in Algorithm AWM, we use the unbiased version with linear kernel for computation efficiency and accuracy. Here investigate into more variants of CKA, and summarize the results in Table 4. It can be seen that the choice of unbiasedness crucial to the robustness of our method. Meanwhile, although RBF kernels show stronger performance in Table 4, the choice of linear kernel has already yield strong performance, which we choose for better computational efficiency.
CKA Kernel
Linear
RBF
CKA Biasedness
Unbiased
Biased
Unbiased
Biased
SFT
356.0223
18,3099
527.3949
11.5843
Continual Pretrain
217.5003
11.2954
320.9173
7.0701
Upcycling
291.6191
15.1994
432.1476
9.6776
Multi Modal
336.6757
17.3766
498.8918
11.0056
RI.
357.5001
18.3850
529.6448
11.6330
Pruning
268.9175
13.8985
394.8391
8.7331
Table 4: AWM's average absolute Z-scores under CKA with different kernels and biasedness.
22

---

Published as a conference paper at ICLR 2026
G MODEL DETAILS
Table details the specifications of the offspring models analyzed in our study, mapping abbrevia- tions to their base models and training datasets. To facilitate reproducibility, each entry in the "Full Model Name" column serves as direct link to the official model checkpoint hosted on the Hugging Face Hub.
Table 5: Mapping of model abbreviations their full model names, corresponding Hugging Face checkpoints url, base models, and relevant training corpus information.
Abbreviation
Base Model
Full Model Name
Train Corpus
Vicuna
Llama2-7B
vicuma-7b-v1.5
ShareGPT
Selfrag
Llama2-7B
selfrag.llamat
Ilama2_7b
Self-RAG Data
32K
Llama2-7B
LLaMA-2-7B-322
Book, ArXiv, etc.
Wizard
Llama2-7B
WizardMath-7BB
GSM8K
Guanaco
Llama2-133 13B
Gama-2-7b-guanac-
OpenAssistant
Vicuna
Llama2-138
vicuma-13b-v1.55
ShareGPT
Hermes
Llama2-13B 13B
Han--eerme--lllma-222
GPTeacher, WizardLM, etc.
Estopia
Llama2-13B
LIaMA2-13B-Estoph
EstopiaV9/V Tiefighter,
Finance
Llama2-7B
llama 2amma---b--innne
Financial Dataset
Firefly
Llama2-133
firefly- Kefly-llama2-131
CLUE, ThucNews, etc.
Llemma
Llama2-78
llemma
ArXiv, Open etc.
Code
Llama2-7B
FodeL-lmma-7b-hi
Deduped code, Natural language
Python
Llama2-7B
CodeLlama-77-PPtthonn
Python code
Code
Gemma-2B
codegemma-2b
Math, Synthetic code,
Code
Gemma-7B
codegemma-7b
Code, Natural language
Math
Qwen2.5-78
Qwen2.5 1atn2..5-Math-P5
Web, Books, etc.
Coder
Qwen2.5-78
Qwen2.5 Swen2.5-Coder-78 Coder-7B
Source Code, Synthetic data, etc. Math Data
Math
Qwen2-7B
Qwen2-Math-7B
Code
Llama2-70B
Code CodeLllmaa-7Obhht
Deduped code, Natural language
Python
Llama2-70B
CodeeLlama-77h--Pyttonnn
Python code
Mixtral
Mistral-7B
Nous-Herrmes-2-Miitta-------
GPT-4 Data, Open datasets
DPO
MoE v2
Llama3-8B
HaMAA-MFF-2-3 8B-2 8-sft
SFT Data
MoE4
Llama2-7B
LLaMA-MoE-v1-3 SB-4 16
SlimPajama
MoE 3B
Llama2-7B
LLaMA-MOE--1-3.0B-2.111
SlimPajama
MoE2
Llama2-7B
LLMA--MEE-1-335B-2228
SlimPajama
MoE3B-SFT
Llama2-7B
JLMAA-MOEE113300-2221.6
Slim Slimaajama, SFT Data
MoE2-SFT
Llama2-7B
JLMMA-MoEEv1.335--22.---
SlimPajama, SFT Data
MoE4-SFT
Llama2-7B
LLMMA-MoE-V11355--4..66
SlimPajama, SFT Data
Qwenl.5 MoE
Qwen-1.8B
Owenl.5-MoEE-A2.7B
Qwen Base Corpus
Miniepm MoE
Minicpm-2B
MiniCPM-MoE-8x2B
MiniCPM Data
LLaVA
Llama2-78
Ilava-v1,5-7b
LAION, GPT instructions, etc. Caption, QA Image-text, OCR, etc. Speech, Sound, etc. Audio-text, Voice Chat Image-text, OCR, etc. Visual recognition, Document parsing, etc. Visual recognition, Document parsing, etc.
Video
Llama2-7B
Video-LLaVA-7BA.
VI.
Qwen2-7B
Owen2-VL--7B-Inett
Audio
Qwen-7B
Qwen-Audio
Audio2
Qwen-7B
Qwen2-Audio-7B
VL
Qwen-7B
Qwen- VL
VL
Qwen2.5-7B
Dwen2.5-VVL-BB-Inse
VL
Qwen2.5-3B
Bwen2.5-VL-3B-Instme
Next
Llama3-8B
Jamaa-llava-next-Bhue
LLAVA-NeXT
LLaVA
Llama2-13B
1lava-v1.5-13b
LAION, GPT instructions, etc.
RLHF
Open-Ilama31
rh. rm. wpwn_llama_33.
Authropic HH-RLHF
Reason
Qwen2.5-7B
Nemooronn-Rescanch-Raaaaa
Math, Code, etc.
Qwen-1
Zero
Qwen2.5-1.5B
Thenn-Reasone--Zen--1..911
AIME 2024, MATH500, GPT-4 Data, Preference pairs
DPO
Mixtral
Hermees--MMixtaal DPO
DPO
Mistral-7B
Nous-Hermee--2 2-irrel---MMsttaa--B-DDPO
GPT-4 Data, Preference pairs
23

---

Published as a conference paper at ICLR 2026
Table continued from previous page
Abbreviation
Base Model
Full Model Name
Train Corpus
Dolphin
Mistral-7B
1iniin-..--misrall---
UltraFeedback, Magicoder, etc.
DPO
Minicpm-28 -B
MiniCPM-2B-dpo-
ShareGPT, Ultrahhat, etc.
GRPO
Qwen3-48 BBen3-4B
Qwen3 Mondcaleeiaal... GRPP
Medical dataset
RLHF
Chatglm-6B
Chatgim-fitness-Re
SFT, Reward Model, etc. UltraFeedback, Preference sets
DPO
Llama3-8B
LLaMA3-ieertiiv-DDP--nni
Minitron- Minitron-Depth
Llama-3-8B
Llama 3.1-Minitron--4P 4B--etthh
Nemotron-4 15B corpus
Base
Minitron- Width
Llama-3-8B
Llama-3.1 -0mma-3---iiittro-44----- Width
Nemotron-4 15B corpus
Base
Sheared 2.7B-P
Llama2-7B
Sheaned-LLaMA-227B-PPuu
RedPajama
Sheared 2.7B-S
Llama2-7B
ShareGPT
Sheared 2.7B
Llama2-7B
Sheared-LLaMMA22.7B
RedPajama
Sheared 1.3B-P
Llama2-7B
Leearrd-LLaMM---3BB-PP
RedPajama
Sheared 1.3B
Llama2-7B
RedPajama
Sheared 1.3B-S
Llama2-7B
Sheared-
B.LaMA-1..B-Shaeee.
ShareGPT
Llama3-IB
Llama3-8B
Llama-3.2-IB
Llama3-8B logits, Safety data
Llama3-3B
Llama3-8B
Llama-3.2-3B
Llama3-8B logits, Safety
H IMPLEMENTATION DETAILS
We employ the Linear Kernel (k(X,Y) XY for Centered Kernel Alignment (CKA) due its computational efficiency. To mitigate the finite-sample bias inherent in standard HSIC estimations, utilize the Unbiased CKA (UCKA) estimator. As for module selection, our method operates on two specific sets of weights: first, we utilize the intersection of the word embeddings (W (emb) solve the Linear Assignment Problem (LAP), allowing to accurately recover the permutation (P) and signature (D) matrices, second, we compute the final fingerprinting scores using the Query ()))& and Key Wk) weights, their transformations are strictly constrained.
To address structural discrepancies such as differing layer counts, we identify the optimal layer correspondence by maximizing the total similarity; specifically, we solve the assignment problem on cost matrix constructed from the pairwise UCKA scores of Wq and Wx between all source and target layers.
I EMPIRICAL VALIDATION OF ROBUSTNESS AGAINST WEIGHT MANIPULATIONS
In Section 4, we theoretically analyze potential weight manipulations, including constant scaling, sigmature matrix multiplication, permutations, and orthogonal transformations. We now provide empirical evidence to support the analysis. Specifically, we apply these manipulations to five repre- sentative models, 2-7ma-2-7B, Qwen2-7B, Mistral-7B, Llama-3-8B, and Gemma-78 -B, and evaluate AWM's robustness under each setting.
As shown Table 6, AWM achieves a 100% detection rate across all tested manipulaonnn pairs. These results not only align with theoretical derivations, but also validate the design of AWM, including LAP and UCKA.
Table 6: AWM-detected similarity scores under the weight manipulations in Section 4.
Manipulation / Model
Llama-2-7B
Qwen2-7B
Mistral-7B
Llaam-3-8B
Gemma-7B
Permutation
100%
100%
100%
100%
100%
Signature
100%
100%
100%
100%
100%
Constant Scaling
100%
100%
100%
100%
100%
Orthogonal Trans.
100%
100%
100%
100%
100%
24


Reviews:
[{"review_id": "du6gkwq06p", "reviewer": "Reviewer_tHGT", "summary": "This paper presents a mechanism to \"fingerprint\" an LLM. This is to find out if an LLM is trained from scratch or is a finetuned/derived version of a different LLM. The paper evaluates their methods on multiple models, different post training techniques and they achieve perfect scores in all classification metrics.", "questions": "Any thoughts on how this will work with MoE models?\n\nAny thoughts on how this will work if the post training is done with LoRA methods and or adding new layers of randomly initialized parameters.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "The computation completes within 30 seconds on a single NVIDIA 3090 GPU.\n\nThe method does not require any additional training and does not impact the LLM's performance (as other watermarking approaches)\n\nThe evaluation is very comprehensive across multiple llama models and multiple offspring variations where models are post trained with sft, continued pretraining, RL. \n\nThey also present a false positive evaluation with 90 known to be unrelated pairs, where they show other approach like REEF shows significant false positives mostly for models that use same training data sources.", "weaknesses": "Maybe lack of experiments with larger models and other model architectures like MoE.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PvYafkurIP", "reviewer": "Reviewer_fYwn", "summary": "This paper presents a method for LLM intellectual property (IP) protection, aiming to overcome the vulnerabilities of current fingerprinting schemes, which are often not robust against intensive post-training and malicious weight manipulations. The authors introduce AWM (Accurate Weight-Matrix Fingerprint), a novel, training-free, intrinsic weight-based fingerprinting scheme designed to be highly robust to such modifications. The method's core mechanism leverages the Linear Assignment Problem (LAP) and an unbiased Centered Kernel Alignment (CKA) similarity metric. This process first extracts permutation and signature transformations from the word embedding matrices via LAP , and then uses the CKA-based metric to robustly compare the Q and K matrices across layers, a design intended to neutralize the effects of parameter manipulations like orthogonal transformations. Experimental results demonstrate that AWM achieves perfect classification scores and shows exceptional robustness.", "questions": "Please refer to the Weaknesses section.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- The idea of this paper is novel.\n- This paper presents promising results.\n- This paper provides a comprehensive theoretical analysis.", "weaknesses": "- Dependency on Word Embeddings: The method relies heavily on the word embedding matrix. An attacker could potentially defeat the detection by freezing all other layers and only replacing or retraining the embedding layer, which may cause the method to fail.\n\n- Limited Detection Scope: The method's scope is restricted to $W_Q$ and $W_K$ matrices. An attacker could steal other components (e.g., implanting stolen FFN blocks into an MoE model). This form of partial theft would likely go undetected.\n\n- Other suggestions for improving the writing:\n  - The theoretical analysis in Section 4 is somewhat confusing.  It may be better for the authors to first introduce the basic ideas and conclusions at the beginning of the section to improve readability.\n\n  - The Related Work section on fingerprinting is limited, focusing mostly on traditional classification models and only two LLM fingerprinting papers. It may be better for the authors to conduct a more exhaustive survey to enrich this section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "JeN6zkJCcJ", "reviewer": "Reviewer_z54L", "summary": "This paper proposes AWM, a training-free, white-box fingerprint for LLMs that combines LAP-based layer matching with an unbiased CKA similarity to measure model lineage directly from weights. The experimental suite spans six common post-training transformations (SFT, continued pretraining, RL-based alignment, multimodal extension, pruning, and MoE upcycling) over 60 positive and 90 negative pairs. The method is computationally efficient (single-GPU, sub-minute per pair) and requires no instrumenting or watermarking of the target model.", "questions": "1.The first step of the method relies on a shared vocabulary. How should we handle cases where the suspect model retrains or replaces its tokenizer/vocabulary?\n2.Does the author have any insights on piracy cases involving knowledge distillation? Could lightweight black-box probes be combined with AWM to first flag potential distillation cases?\n3.When the architecture undergoes significant depth/width changes, cross-layer sharing, or reordering of blocks, can you constrain the LAP with structural priors to prevent misalignment?\n4.Since the method is very simple, it becomes easier to attack. How can this issue be addressed?\n5.Have you considered approaches for mixed-origin cases, for example, solving multiple partial LAPs and reporting a mixed (or mixture) score?\n6.Release an evaluation sheet (model names/versions, checkpoints, tokenizer specs, training corpus tags), and precise CKA/LAP implementation details (module selection, sampling of parameter blocks, normalization, kernel choices).\n7.It is recommended to add some comparison methods and, if possible, add explicit ablation experiments", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.The method is minimalist and targeted, focusing on embeddings and Q/K, which makes LAP+linear CKA implementation straightforward and efficient (single-GPU, sub-minute).\n2.Dynamic layer assignment via LAP addresses the weakness of fixed layer-to-layer comparisons and tolerates moderate architectural edits.\n3.It requires no data collection, retraining, or watermark insertion, so it does not degrade model quality and is easy to operationalize.\n4.Empirically, the approach cleanly separates derived from independent models (AUC=1.0, TPR@1%FPR=100%), implying near-zero false-positive risk.", "weaknesses": "1.The pipeline relies on overlaps in token embeddings and Q/K weights; if the suspect model re-trains the tokenizer or heavily replaces early blocks, the LAP matching can become unstable and |Z| may drop.\n2.In cases of knowledge distillation, AWM will likely fail because cross-model weights exhibit near-zero statistical correlation despite functional similarity. Notably, recent alleged infringement incidents (e.g., API-based distillation claims) fall into this category.\n3.Although LAP provides some structural elasticity, it presupposes roughly comparable sets of alignable matrices. If the suspect model adds/removes many layers or alters layer roles, matching can break or produce erroneous alignments. While permutation invariance should not affect CKA in principle, aggressive layer reordering can still mislead the LAP stage and degrade end-to-end performance.\n4.Since the method is simple and single, the attacker can try to perform some lossless transformation on the AWM model to reduce the CKA similarity but maintain the model output. This is not difficult to achieve.\n5.The approach evaluates one-to-one similarity and does not address models fused from multiple sources (e.g., model 𝐶 partly derived from 𝐴 and 𝐵).\n6.The only comparison methods are HuRef and REEF. Why are there no comparisons with baselines used in REEF, such as PCS and ICS?\n7.The related work section recommends adding some black box-based methods. Currently, piracy through APIs is also very common.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dAjUDapyZj", "reviewer": "Reviewer_Wyog", "summary": "The authors propose AWM, a method based on centered kernel alignment to fingerprint and compare LLMs. It is more accurate than competing methods such as HuRef and REEF on a large set of different LLMs of different families. However, it requires knowledge of all the weights of the LLMs to be compared.", "questions": "- Have the authors consider how to apply their method to other forms of manipulations/infringement such as model distillation?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "- Empirically the new proposed algorithm is quite strong, improving upon previous methods such as HuRef and REEF in distinguishing between related and unrelated LLMs on a fairly large set of LLMs tested.  \n\n- The algorithm works directly with weight matrices and only uses centered kernel alignment computation and the Hungarian algorithm for finding permutations, and is therefore very efficient. \n\n- The authors give a detailed list of potential weight manipulations on different parts of the transformer architecture by an attacker in Section 4 and explain how this guides the design of their algorithm.", "weaknesses": "- This fingerprinting method requires access to the weights of the models to be compared, which isn't always possible unless both models are open-sourced. This limits the applicability of the method compared to other fingerprinting approaches. \n\n- In Section 4 the authors discuss how an attacker might manipulate the weights to evade detection. However, these manipulations are never evaluated against the algorithm in the experiments. This creates a gap in the argument of the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)