HuRef: HUman-REadable Fingerprint for Large Language Models
Authors: Boyi Zeng
Lizheng Wang
Yuncong Hu
Yi Xu
Chenghu Zhou
Xinbing Wang
Yu Yu
Zhouhan Lin
Venue: NeurIPS 2024 poster (2024)
Keywords: Model Identification
Fingerprinting
Large Language Models (LLMs)
Primary area: safety_in_machine_learning
TL;DR: We generate a dog image as an identity fingerprint for an LLM, where the dog's appearance strongly indicates the LLM's base model.

Abstract: Protecting the copyright of large language models (LLMs) has become crucial due to their resource-intensive training and accompanying carefully designed licenses. However, identifying the original base model of an LLM is challenging due to potential parameter alterations. In this
study, we introduce HuRef, a human-readable fingerprint for LLMs that uniquely identifies the base model without interfering with training or exposing model parameters to the public.
We first observe that the vector direction of LLM parameters remains stable after the model has converged during pretraining, 
with negligible perturbations through subsequent training steps, including continued pretraining, supervised fine-tuning, and RLHF, 
which makes it a sufficient condition
to identify the base model.
The necessity is validated by continuing to train an LLM with an extra term to drive away the model parameters' direction and the model becomes damaged. However, this direction is vulnerable to simple attacks like dimension permutation or matrix rotation, which significantly change it without affecting performance. To address this, leveraging the Transformer structure, we systematically analyze potential attacks and define three invariant terms that identify an LLM's base model. 
Due to the potential risk of information leakage, we cannot publish invariant terms directly. Instead, we map them to a Gaussian vector using an encoder, then convert it into a natural image using StyleGAN2, and finally publish the image. In our black-box setting, all fingerprinting steps are internally conducted by the LLMs owners. To ensure the published fingerprints are honestly generated, we introduced Zero-Knowledge Proof (ZKP).
Experimental results across various LLMs demonstrate the effectiveness of our method. The code is available at https://github.com/LUMIA-Group/HuRef.

HuRef: HUman-REadable Fingerprint for Large Language Models
Boyi Zeng', Lizheng Wang", Yuncong Hu?, Yi Xu² Chenghu Zhou", Xinbing Wang", Yu Yu², Zhouhan Lin-*
'LUMIA Lab, Shanghai Jiao Tong University Shanghai Jiao Tong University, *Chinese Academy of Sciences boyizengasjtu.
eee.e.u.t..euu....... edu. cn *lin. zhouhan@gmail.c com com
Abstract
Protecting the copyright of large language models (LLMs) has become crucial due their resource-intensive training and accompanying carefully designed licenses. However, identifying the original base model of an LLM is challenging due to potential parameter alterations. In this study, we introduce HuRef, human- readable fingerprint for LLMs that uniquely identifies the base model without interfering with training or exposing model parameters to the public. We first observe that the vector direction of LLM parameters remains stable after the model has converged during pretraining, with negligible perturbations through subsequent training steps, including continued pretraining, supervised fine-tuning, and RLHF, which makes it a sufficient condition to identify the base model. The necessity is validated by continuing train an LLM with extra term to drive away the model parameters' direction and the model becomes damaged. However, this direction is vulnerable simple attacks like dimension permutation rotation, which significantly change it without affecting performance. To address this, leveraging the Transformer structure, attacks and define three invariant terms that identify an LLM''s base model. Due to the potential risk of information leakage, we cannot publish invariant terms directly. Instead, we map them to Gaussian vector using an encoder, then convert it into natural image using StyleGAN2, and finally publish the image. In our black- box setting, all fingerprinting steps are internally conducted by the LLMs owners. To ensure the published fingerprints are honestly generated, we introduced Zero- Knowledge Proof (ZKP). Experimental results across various LLMs demonstrate the effectiveness of our method."
matrix
systematically analyze potential
Introduction
Large language models (LLMs) have become the foundation models in many scenarios artificial intelligence. As training LLM from scratch consumes a huge amount of computation and data resources and the trained L.LM needs to be carefully protected from malicious use, the parameters of the LLMs become crucial property protect, for both commercial and ethical reasons. As result, many of the LLMs are open-sourced with carefully designed licenses to reject commercial use (Touvron al., 2023a; Taylor al., 2022) or requiring an andly-and-approval process (Touvron et al., 2023b; Zhang et al., 2022; Penedo et al., 2023; BaiChuan-Ine, 2023; Team, 2023; Zheng et al., 2023b), let alone some LLMs are not spurcee entirely (OpenAI, 2022; GPT-4, 2023; Brown et al., 2020; Wu et al., 2023b; Chowdhery et al., 2022; Hoffmann et al., 2022).
"Zhouhan Lin is the corresponding author.
'The code is available at ttttps://giiii www..///.////////c....w. http////IIIA--Grrru/uuueeee
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Falcon
LLaMA
Baichuan
Alpacu
InternLM
Private
terme
trmes
trmms
troms
Inwwiant
LLMs Manufacturers
FPM
FPM
RPM
SPM
Public
LLabk''s Alpaca's fingepentt are idestical, Alpace must bese
LLaMA!
An illustrative framework for LLM protection with fingerprints. The LLM manufacturers compute invariant terms internally and feed them into the fingerprinting model (FPM') to generate a fingerprint image. This image is then released to the public along with zero- koowledwweeee proofs (ST1), allowing for intuitive identification of shared hase models through the fingerprint images. We also provide limited one-to-one quantitative comparison scheme (ICS & v2) as complement. 7ero- proo-Knoleddge Proof guarantees the reliability of the fingerprints and comparison results, without interfering with L.M training or revealing model parameters the public.
Figure 1:
At the core of protecting LLMs from unauthorized use is to identify the base model a given LLM. However, different from other forms of property such as software or images, protecting LLMs is novel problem with unique challenges. First, the base model usually needs to fine-tuned or even continued pretraining be applied to downstream tasks, resulting in parameter updates that make the resulting model different from the original base model, which makes disputable to identify the base model. Second, many of the popular LLMs are not releasing their parameters, leaving the identification in a black-boo box setting. Third, different from previous smaller-scale neural networks that are only trained for specific tasks, LLMs usually targeted for enormous forms of tasks that are not yet defined during pretraining. This has made the watermarking methods for traditional neural networks (Adi et al., 201 8a; Xiang et al., 2021; Yadollahi et al., 2021) not suited in this case, especially under extensive subsequent training steps.
In this work, we propose novel way to overcome the aforementioned challenges by proposing method that reads part of the model parameters and computes a fingerprint for each LLM without interfering with training exposing model parameters to the public. The appearance of the fingerprint closely dependent on the base model, and invariant to almost all subsequent training steps, including supervised fine-tuning (SFT), reinforcement learning with human feedback (RLHF), pretraining with augmented vocabulary in a new language.
continue-
The fingerprint is based on our observation that the vector direction of LLM parameters remains stable against various subsequent training steps after the model has converged during pretraining. This makes it a good indicator for base model identification. Empirically, the sufficiency of this correlation elaborated Section 1.1.1, while its necessity presented in Section 3.1.2.
Further, despite its stability towards training, the vector direction of the model parameter is vulnerable some simple direct weight rearrangements that could significantly change the direction of parameter vectors without affecting the model's performance. We construct three invariant terms that are robust these weight rearrangements by systematically analyzing possible rearrangements and leveraging the Transformer structure. This is elaborated in Section 3.2.
Moreover, generate human-readable fingerprints by mapping the invariant terms into Gaussian random vector through an encoder and then mapping the Gaussian vector to a natural image through an off-the-shelf image generation model, such as StyleGAN2 (Karras et al., 2020). This generation offers dual benefit of mitigating information leakage and making our fingerprints straightforward decipher. To ensure the published fingerprints are honestly generated, we also introduced Zero- Knowledge Proof (ZKP). This is elaborated in Section 4.
With this fingerprinting approach, sketch outline for protecting LLMs in Figure 1.
Related Works
There are two primary categories of related approaches.
'PPM is open-sourced, as all LLM manufacturers need to use the same one. We have placed it on the private side in Figure I solely because the fingerprinting process is private.

---

Chinese -LLMMA
Chinese TaesseAAlpe Alpaca
Average Perfomance
60
OpealLaMA
555
MedAlppcn
WizardLM M
MinGPT44
Baichuan
InternLM
LLaMA-2
50-
Model
Alpaca-
Alpaca
Vieuna
Buize
Koala
45
60
PCS|99.87 99.91 99.68 99.80 99.7 93 99.900 99 82 99. 99.70 99..9999.22... 1.16 0.26..28 1.51
ICS 199.60 99.95 93.57 99.42 99.60 99.86 86 99.63 99.89 99.20 91.35 (0.32 0.03 3.16
100
95
Cosine Similarity
90
65
80
Table 1: The cosine similarities of model parameters (PCS) and Figure 2: invariant terms (ICS) between various LLMs w.r.t. the LLaMA-7B mance quickly deteriorates as the base model. All models are of the same size.
The model's perfor-
PCS decreases.
Post-hoc Detection methods involve analyzing text generated by LLMs after its production. LLMDet (Wu et al., 2023a) calculates proxy perplexity by leveraging prior knowledge of the model's next-token probabilities. DetectGPT (Mitchell et al., 2023) uses model-predicee identify passages generated by specific LLM. Li et al. (2023) employs perplexity scores and intricate feature engineering. These methods are usually applicable to a specific L.IM and could be affected by supervised fine-tuning (SFT) and continued pretraining. More recently, Sadasivan et al. (2023) presented theoretical findings that for highly advanced AI human mimickers, even the best possible detection methods may only marginally outperform random guessing.
probabilities to
Watermarking Techniques can be divided into two main categories (Boenisch, 2021). The first embeds watermarks or related information into the model parameters, such as explicit watermarking scheme (Uchida al., 2017) or leveraging another neural network (Wang et al., 2020), which could potentially affect model performance (Wang & Kerschbaum, 2019). The second category focuses on inducing unusual prediction behavior in the model. Xiang et al. (2021) explored embedding phrase triggers, and Gu et al. (2022) extended this approach to LLM; however, they are task- specific. Yadollahi et al. (2021) proposed a watermarking method but did not consider subsequent fine-tuning. Christ et al. (2023) proposed a cryptographic approach, but it is not robust to text editing. Kirchenbauer et al. (2023) involved using pre-selected tokens which inevitably alters the model prediction. These methods may turn out to be vulnerable to attacks certain tokens, for example, Krishna et al. (2023) successfully evaded watermarking (Kirchenbauer et al., 2023), GPTZero (Tian, 2023), and OpenAl's text classifier (OpenAI, 2023) using paraphrasing attacks.
Our work doesn't 't fall into any of the two categories since it is based on analyzing model weights post-hoc and relies on wide spectrum of tokens.
In Appendix A, provide more extensive discussion of additional related works.
3 Vector Direction of LLM Parameters and the Invariant Terms
3.1 Using Vector Direction of LLM Parameters to Identify the Base Model
We flatten all weight matrices and biases of an LLM into vectors and concatenate them together into a single huge vector. this subsection, we are going to show how the direction of this vector could be used to determine the base model by empirically showing its sufficiency and necessity.
3.1.1 Sufficiency
For sufficiency, we compute the cosine similarities between a base model LLaMA-7B and various of its offspring models, well other independently pretrained LLMs (Geng & Liu, 2023) that are of the same size. Table shows a wide spectrum of models that inherit the LLaMA-7B base model, whose subsequent training processes involve various training paradigms, such as SFT (Taori et al., 2023; Xu et al., 2023a; Zheng et al., 2023a; Geng, 2023; Xu et al., 2023b; Han et al., 2023), SFT with LoRA (Wang, 2023) and extensive continued pretraining in language (Cui et al., 2023), extending to new modalities (Zhu et al., 2023), etc. We detail the subsequent training settings of these models in Appendix Table 10.
Regardless of their various subsequent training setting, we can figure that all of these models show almost full scores in cosine similarity, largely preserving the base model's parameter vector direction.
3

---

On the other hand, the models that are trained independently appear to be completely different in parameter vector direction, showing almost zero cosine similarity with the LLaMA-7B model.
These observations indicate that a high cosine similarity between the two models highly suggests that they share the same base model, and vice versa.
3.1.2 Necessity
From the necessity perspective, we want to verify if the base model's ability can still be preserved when the cosine similarity is intentionally suppressed in subsequent training steps. To this end, we inherit the LLaMA-7B base model and interfere with the Alpaca's " SFT process by augmenting the original SFT loss with an extra term that minimizes the absolute value of cosine similarity. i.e.
(VA. Voase)
Here VA, Vaase stand for the parameter vector of the model being tuned and LA V base that of the base model, respectively.
Figure 2 presents the average zero-shot performance on a set of standard benchmarks when (PCSS) different values. The benchmarks include BoolQ (Clark al., 2019), PIQA (Bisk et al., 2020), HellaSwag (Zellers et al., 2019), WinoGrande (Sakaguchi et al., 2021), ARC-e, ARC-c (Clark et al., 2018), RACE (Lai al., 2017) and MMLU (Hendryeks et al., 2020). (c.f. Appendix Table for detailed breakdown of performances on each task.) We can see that despite the original training loss still present, the model quickly deteriorates random guesses as the cosine similarity detaches away from that of the base model.
These observations indicate that it is fairly hard for the model to preserve the base model's perfor- mance without keeping a high cosine similarity to it.
3.2 Deriving the Invariant Terms
Although the vector direction of model parameters is shown to closely stick to its base model, directly comparing the vector direction through cosine similarity requires both models to reveal their parameters, which is unacceptable in many cases. In addition, apart from training, parameter vector direction is vulnerable to some attacks that directly rearrange the model weights. For example, since the hidden units in model layer are cermutation-invarian vector direction by randomly permuting the hidden units along with the weights wired to the units.
can easily alter the parameter
These attacks invisible discover since they could easily break the cosine similarity but neither change the model structure nor affect the model performance.
1
Add & Norm
H
In this subsection, we are going to first systematically analyze and formalize possible weight rearrangements by leveraging the structure constraints of the Transformer, and then derive three terms that are invariant under these rearrangements, even when they are combined. Let's first consider the Transformer layer as depicted in Figure 3. Formally, the layer conducts the following computation:
Feed Forward
HAztn
Add & Norm
H HArttn
Attention
H WH Vd
H
H Attn softmax
H. Wo
(I)
Figure? 3: Transformer layer
H #41 a (H W1 + b,) W. - b
where H2 E R d is the hidden state of the n-th layer, with d being sequence length and model dimensions, respectively. Hamn is the self-attention output. To reduce clutter, we omit equations related to residual connection and LayerNorm, but denote the variables right before it with an apostrophe. The W's and b's are weights and biases.
Note that the first layer reads the word embedding, i.c.. Ho X R and the final output distribution P Iixx is given by
softmax H
where v is the vocabulary size, N the total number of layers, and E E dR is the parameter matrix in the softmax layer, which is sometimes tied with the word embedding matrix at the input.

---

3.2.1 Forms of Weight Rearrangement Attacks
Putting Equation 1- Equation 3 together, we can systematically analyze how the parameter vector direction can be attacked through direct weight rearrangements. There are totally 3 forms of attacks that could camouflage the model without changing its architecture or affecting its output.
1. Linear mapping attack Wo: WK and WV, Wo. Consider Equation one can transform
We and WK symmetrically so that the product Wq W remains unchanged but both weights are significantly modified. This will alter the parameter vector direction significantly. Formally, for any invertible matrix C1, let
Fq- = WaC1, WK W
(4)
and substitute them respectively into the model, one can camouflage it as if it's a brand new model, without sacrificing any of the base model'ss performance. The same holds for Wv, Wo as well.
Permutation attack on Wi, b 22. Consider Equation 2, since it consists of two fully connected layers, one can randomly permute the hidden states in the middle layer without changing its output. Formally, let PEEN be an arbitrary permutation matrix, one can camouflage the model without sacrificing its performance by substituting the following three matrices accordingly
Wi WiPFFN W₂ PFPN W2, bi b, PFFN
3. Permutation attack on word embeddings. In a similar spirit, one can permute the dimensions in the word embedding matrix as well, although it would require all remaining parameters to be permuted accordingly. Formally, let PE be an arbitrary permutation matrix that permutes the dimensions in X through = X due to the existence of the residual connections, the output of all layers have to be permuted in the same way, i..., H, = H,, PE. Note that it's not necessarily the case in the former types of attacks. This permutation has be canceled out at the final softmax layer (Equation 3), by permuting the dimensions in E accordingly, i.e. E PE" E. Specifically, all remaining parameters have to be permuted in the following way:
We= = PE We, WK = WK, WP
=
Wo = WOPE
(6)
W PE W1, W₂ W2PE, b2 by
Moreover, putting everything together, one can combine all the aforementioned three types of attacks altogether. Formally, the parameters can be camouflaged as:
We PE WWW,, WK PE WT' W. = PE WW'WWC Wo = C WoPE
W. PF W W PFEN, bi = PFFN, W₂ = P W2PE, b2 = P2P
X = XPE. E E
(7)
Note that for permutation matrix we have p-1 = PT This includes all possible attacks that 1) do not change the model architecture, and 2) do not affect the model's output.
3.2.2 The Invariant Terms to These Attacks
To find the invariant terms under all these attacks, we need to combine terms in Equation 7 to get the invariant term that nicely cancels out all extra camouflaging matrices. To this end, we construct invariant terms:
M. XX M, XWX' M,= X
(8)
Note that for X in these terms, we don't include all tokens from a vocabulary or tokens a specific sentence; instead, we select subset of tokens. There are two problems if we directly use all tokens' embeddings X. First, using the whole embedding matrix will make the terms unnecessarily large and of variable size between different models. Second, more importantly, since it is common to inherit a base model with an augmented vocabulary, i.c., to append a set of new tokens at the end of the original vocabulary, the invariant terms would have different sizes and be incomparable. Third, if designate specific tokens instead, the selected tokens may not always exist in all LLMs being tested. Consequently, we carefully choose the tokens to be included in X, by following these steps:
1. Select sufficiently big corpus standard verifying corpus.
5

---

Training
(0,1))
Discriminator
Dicriminator
Sample
Real data
Training Loss +.p
Matrices 10
M' PI +
Masimize Cus Sumilarity
N10.) 4)
P
P.PpPfP
Encoder
Contrastive Loss le:
Anchor M
Minimize Cas Similarity
NgN
Training Data Generation
Feature Vectors
Inference Alpaca
GAN
OpeaLLaMA
InteraLM
Encoder
Generator
OpeaLLaMA InteraLM
Fisture Vectors
LLMss Invariant Terms
Figure 4: The training and inference of our fingerprinting model.
2. Tokenize the corpus with the LLM's vocabulary and sort all tokens according to their frequency. Delete all tokens in the vocabulary that don't 't show up in the corpus.
Among the remaining tokens, select the least frequent tokens as the tokens to be included in X.
Here, using standard corpus ensures that the resulting tokenization will be identical if certain model's vocabulary a subset of another; the sufficiently large corpus stabilizes the frequencies of tokens in the vocabulary and provides enough chance for many tokens possible to show up. Deleting zero-shot tokens automatically sweeps off augmented tokens. Selecting the rarest tokens minimizes potential affections brought by parameter updates in subsequent training processes. A properly large K will ensure a large enough set of tokens included, making the resulting invariant terms more generally representative. More importantly, it will make all the invariant terms have the same size across all LLMs, regardless of their original sizes, iee, Ma, Mo, M, E R kxk regardless of the index of the layer or LLM sizes.
As result, we tile up them form 3D input tensor M KXXXC where C the channel dimension. If we are using all layers, C = 3.. Again, in order to make M the same size across all models, only involve the last layers in the LLM We show the cosine similarity between the invariant terms in Table I, they still preserve a high correlation to the base model.
4 Mapping the Invariant Terms to Image and Publish it through ZKP
Although invariant terms serve as robust and effective representations for LLMs, we cannot directly publish them due to the potential risk of leaking hidden information, including the size, statistical features, and distribution of parameters. Therefore, we further process invariant terms by mapping them into an image through the fingerprinting model and then publish the image fingerprint instead. This approach helps mitigate the risk of leakage while providing a human-readable fingerprint.
The fingerprinting model consists of neural network encoder and an off-the- shel- image generator as depicted Figure 4. In principle, the encoder takes as input the invariant terms of certain model. tile them together, and deterministically maps them to vector that appears to be filled with Gaussian variables. The subsequent image generator reads this vector and maps Importantly, throughout the process, the locality of the inputs has to be preserved from end to end. ie., similar invariable terms should result in similar Gaussian variables and finally similar images.
a natural image.
In fact, experimentally we find that small is already sufficient to discriminate LLMs. it's not necessary involve many layers. In all of our experiments, 2, there only channels in the input.

---

4.1
Training
The encoder is the only component that needs be trained in our fingerprinting model. Note that we don't need to use any real LLM weights for training the encoder (all the training data are synthesized by randomly sampled matrices), as it only needs learn pecaeity-pesserving mapping between the input tensor and the output Gaussian vector. We adopt contrastive learning to learn locality-preservin mapping. To render the output vector to be Gaussian, we adopt the standard GAN (Karras et al., 2019) training scheme. (c.f. Appendix B for details of data synthesis and the whole training process.)
4.2 Inference
In the inference stage, the encoder takes the invariant terms from real LLMs and outputs v. One image generator converts into a natural image. In principle, any image generator that takes a Gaussian input and has the terms as fingerprints, we can easily identify base models based on their fingerprint images, enabling reliable tracking model origins. this paper, we employ the StyleGAN2 generator pretrained on the AFHQ (Choi et al., 2020) dog dataset to generate natural images, we detailed it in Appendix E.
property would here. By visually representing the invariant
4.3 Zero-knowledge Proof for Fingerprints
In our black-box setting, users are unable access the model parameters. which presents a significant challenge in ensuring the fingerprint is genuinely derived from the claimed LLM parameters. To address this issue, we employ yero-knowledge proof, cryptographic technique that allows the prover to convince the verifier that a statement is true without revealing any information beyond the statement's validity (Ben-Sasson al., 2013; Goldwasser al., 2019; Chiesa et al., 2020).
The manufacturer generates a publicly verifiable zero-knowledge proof along with computing the fingerprint, ensuring two critical aspects: (1) the input parameters indeed originate from the specific LLM the manufacturer claims, thereby safeguarding against substitution attack. (c.f. Appendix D for detailed discussion of substitution attack.) (2) the human-readable fingerprint is calculated correctly, confirming the fingerprint is genuinely derived from the LLM parameters. The detailed gero-knowledge proof generation process as follows:
1. Select random number i, commit LLM parameters (which we denote by model) and input X, commit(model, xtt) cm. The commitment em is public and does not reveal any information about the model.
While calculating fingerprint, generate a ZK proof Ti prove that the manufacturer knows model, X, s.t.
(a) model is the claimed LLM parameters and X satisfy commit(model, X,t) = cm:
(b) The last two layers parameters Wo. WK. Wv, Wo. W1, W2 in model and input X satisfy
M, XWW M, XW,WoX", &
(9)
(c) The output human-readable fingerprint is indeed calculated from the invariant terms above. As above( item 1. and item 2.a), the manufacturers commit to the claimed model and publish the commitment first, which is a conventional approach to ensure the parameters are not altered during the proof generation. All subsequent proof and inference processes will be carried out with this commitment, and anyone can verify if the model parameters used match those sealed within the commitment. The steps item 2.b and item 2.c are to ensure that the invariant terms and fingerprint are correctly calculated. Anyone who gets proof πı and the commitment cm can verify that the fingerprint is calculated based LLM
Moreover, we also provide limited quantitative comparison scheme, which supports one-to-one comparison with open-source models. The manufacturers calculate the cosine similarity of invariant terms and give the knowlldeweeee proof πे of this calculation process. Anyone who gets the proof T2 and the open-source model can verify the cosine similarity without learning the private model.
7

---

ICS
Falcon-40B LLaMA2-13B
MPT-30B LLaMA2-7B
Qwen-7B Baichuan- InternLM-7B
Offspring1 Offspring2
99.61
99.50
99.99
99.47
98.98
99.76 99.98
99.28
99.69
99.49
99.99
99.41
99.71
99.02
Table 2: The ICS between offssring models and their corresponding base model.
ICS
[LLMMA
MiGPT
Alpaca
MAlpaca
Vicuna
Wizard
Baize
Alpacal.
CAlpaca
Koala
CLLaMA
Beaver
Guanaco
BiL.aa
LLaMA
100.00
99.20
99.95
99.86
99.
99.63
93.57
99.97
82.56
MiGPT
99.20
100.00
99.17
99. 10
99. 10
99.15
98 83
98.82
90.65
99.00
92.84
99. 19
91.93
82.24
Alpaca
99.95
99.17
100.00
99.82
99.38
99.85
99.55
99,57
91.31
99.59
93.53
99.97
92.59
82.52
MAlpaca
99.86
99.10
99.82
100.00
99.31
99.76
99
99.47
91.23
99.51
93.45
99. 84
92.50
82.51
Vicuna
99.42
99.10
99.38
99.31
100.00
99.35
09.05
99.04
90.84
99.15
93.04
99.41
92.14
82.28
Wizard
99.15
99.85
99.76
99.50
99.56
93.47
99.87
82.57
Baize
99.60
98.83
99.55
99.46
99.05
99.50
100.00
99.23
90.97
99.25
93.19
99.57
92.25
82.25
Alpacal.
99.60
98.82
99.57
99.47
99.
100.00
90.99
99.24
93.21
92.31
CAlpaca
91.35
90.65
91.31
91.23
84
91.25
90.97
90.99
100.00
91.04
97,44
91.33
85.19
75.60
Koala
99.63
99.00
99.59
99.51
99.15
99.56
99.25
99.24
91.04
100.00
93.23
99.61
92.27
82.34
CLLaMA
93.57
92.84
93.53
93.45
93.04
93.47
93.19
93.21
97.44
93.23
100,00
93.55
86.80
77.41
Beaver
99.97
99.19
99.97
99.84
99.41
99.87
99.57
99.59
91.33
99.61
93.55
100.00
92.60
82.57
Guanaco
92.62
91.93
92.59
92.50
92.14
92.52
92.25
92.31
85.19
92.27
77.17
BiLLa
82.56
82.24
82,52
82.51
82.28
82.57
82.25
82.30
75.60
82,34
77.41
82.57
77.17
100.00
Table 3: The cosine similarities of invariant terms (ICS) between various pairs of LLaMA-7B and its offspring models. Abbreviations: MedAlpaca (MAlpaca), Alpaca-Lora (AlpacaL), MiniGPT-4 (MiGPT), WizardLM (Wizard), Chinese-Alpace (CAlpaca), Chinese-LLaMA (CLLaMA).
5
Experiments
Our experiment is twofold. First, we validated the effectiveness and robustness of invariant terms for identifying the base model. Second, we generated fingerprints based on invariant terms for 80 LLMs and quantitatively assessed their discrimination ability through human subject study.
5.1 Effectiveness and Robustness of Invariant Terms
In this subsection, we validate the effectiveness and robustness of invariant terms in identifying base model through four key experiments. First, we compute the Invariant Terms' Cosine Similarity (ICS) between widely used open-sourced LLM base models and their offspring models (including heavily continueppeetainge models), verifying its robustness against subsequent training processes. Second, we conduct extensive experiments on additional open-sourced LLMs, showcasing low ICS between 28 independently trained models. Third, we gather 51 offspring models and calculate the accuracy of correctly identifying the base model. Finally, we compare our methods with two latest baselines.
5.1.1 High ICS between Base LLMs and Their Offspring Models
First, we perform experiments on commonly used open-sourced LLMs, ranging size from 7B to 40B. The 7 base models considered are Falcon-40B (Almazrous et al., 2023), MPT-30B (Lin et al., 2022), LLaMA2-7B, 13B, Qwen-7B (Bai et al., 2023), Internim-7B and Baichuan-1331 For each of these base models, we collect 2 popular offspring models. We extract the invariant terms for all these models and calculate the ICS for each offspring model w.r.. its base model (Table 2). Remarkably, all offspring models exhibit very high ICS, with average ICS of 99.56.
Second, we leverage the LLaMA-7B base model as testing ground assess the robustness of invariant terms under diverse subsequent training processes. We include 10 offspring models detailed in Section 3.1.1 and add Beaver, Guanaco (Dettmers et al., 2023), and BiLLa (Li, 2023) to the collection. See Appendix Table 10 for detailed descriptions. We extract invariant terms following the previous settings and compute the cosine similarity of the invariant terms (ICS) between each pair of models. Despite undergoing various training paradigms, such as RLHE, SFT, modality extension, and continued pretraining new language, we observe a high degree of similarity (Table 3), with an average ICS of 94.14.
8

---

FSR
MEGPT Alpaca
MAlpuca
Vicuna
Wizard
Baize
Alpacal.
CAlpaca
Kuala
CLLaMA
Beaver
Guanaco
BiLLa
Avg.
Trap
8.04
24.14
2.30
17.24
44.83
39.08
1.15
0
0
8.05
10.34
11.94
IF
10
0
0
40
10
0
0
0
10
0
0
5.38
IF
100
100
100
100
100
100
100
20
100
50
100
30
100
84.62
Ours
100
100
100
100
100
100
100
100
100 100
100
100
100
100.00
Table 4: Different methods' FSR on various LLaMA's offspring models. IFI
adapter and IF2
adapter
represent two different experimental settings of IF, with the former using all parameters and the latter only using the embedding parameter. Abbreviations are consistent with Table 3.
Falcon-40B
1.LMM2-138
MPT-30R
I.LMMA-78
Qwen-7B
Raichuan-
InternI M-7B
Chul
Chat
Chat
Chat
Chal
Chal
SFT
French
Instruct
Vicuna2
Firefly
SFT
Firefly
Figure 5: Fingerprints of different base models (in the first row) and their corresponding offspring models (the lower two rows) are presented. The base model's name is omitted in the offspring models.
5.1.2 Low ICS between 28 Independently Trained LLMs
Besides the aforementioned base models, assemble comprehensive collection of 28 open-sourced LLMs, ranging in size from 774M (GPT2-Large) to 180B (Falcon- 180B). Please refer to Appendix F for details. We extract invariant terms and calculate ICS between each pair of models. Notably, the similarities between different models were consistently low, with an average ICS of 0.38, affirming the effectiveness of invariant terms. (c.f. Appendix Table for detailed ICSs.)
5.1.3 Accuracy in Identify 51 Offspring Models' Base Model
To assess the effectiveness our method, we gathered 51 offspring models derived from distinct base models. (c.f. Table 10 for detailed list and description.) Calculating the ICS between each offspring model and the base models, we predicted the base model with highest ICS, Comparing these predictions with the ground truth, method accurately identified the base models for all 51 offspring LLMs, achieving 100% accuracy.
5.1.4 Comparing to Latest Fingerprinting Methods
There are few fingerprinting methods designed for LLMs. Trap (Gubri et al., 2024) optimizes adversarial suffixes to elicit specific responses, while (Xu et al., 2024) fintuned LLMs to make them generate predefined answers. We tested the Fingerprint Success Rate (FSR) (Gu et al., 2022) of these methods on LLaMA's 's offspring models. Our method demonstrates superior performance (Table 4), when compared to the white-box method IF aiagter (More illustrations in Appendix I..)
5.2 Discrimination Ability of Human-readable Fingerprints
Based on previous invariant terms, we employ the fingerprinting model illustrated in Section 4 to generate and publish human-readable fingerprints for previously mentioned L.MSs. Figure 5, there fingerprints of the 7 independently trained LLMs and their offspring models (Section 5.1.

---

Notably, for all the offspring models, their fingerprints closely resemble those of their base models. On the other hand, LLMs based on different models yield highly distinctive fingerprints. encompassing various appearances and breeds of dogs. Due to space limit, the fingerprints of L.LaMA family models, the rest offssring models, and the 28 independently trained L.MMs are listed in Appendix H.
Furthermore, we conducted human subject study and yielded a 94% accuracy rate (c.f. Ap- pendix for details), quantitatively demonstrate the discrimination ability of our generated fingerprints. Although using human-readable fingerprints introduces minor losses, manufacturers can provide one-to-one comparison results with proof to make up for this loss of misjudgment.
Except for the aforementioned experiments, we independently train LLMs on a smaller scale to provide further validation for our method. (c.f. Appendix G)
Conclusion
In this paper, we introduce a novel approach that generates a human-readable fingerprint for LLM. Owing to Zero- Kero-Knowledge Proof, all fingerprinting steps are internally conducted by the LLMs owners. Our method actually a black box method as only the image fingerprint and corresponding proof need to be released. There is exposure of model weights information leakage to the public throughout the entire process. Furthermore, we detailed our works' limitations in Appendix K.
7 Acknowledgements
We would like to thank Shiyu Liang, Siyuan Huang, and the anonymous reviewers for helpful discussions and feedback. This work sponsored by the National Key Research and Development Program of China (No. 20237D0121402) and National Natural Science Foundation of China (NSFC) grant NN.6230
References
Abdelnabi, and Fritz, M. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In IEEE Symposium on Security and Privacy (S&P), pp. 121-140, 2021.
Adi, Y., Baum, C., Cisse, M., Pinkas, B., and Keshet, J. Turning your weakness into strength: Watermarking deep neural networks by backdooring. In 27th USENIX Security Symposium (USENIX Security 18), pp. 1615-1631, 2018a.
Adi, Y., Baum, C., Cisse, M., Pinkas, B., and Keshet, J. Turning your weakness into strength: Watermarking deep neural networks by backdooring. In 27th USENIX Security Symposium (USENIX Security 18), pp. 1615-1631, 2018b.
Almazrouei, E., Alobeidli, H., Alshamsi, A., Cappelli, A., Cojocaru, R., Debbah, M., Goffinet, É., Hesslow, D., Launay, J., Malartic, Q., al. The falcon series of open language models. arXiv preprint arXiv:231 1...311.166,,,. 2023.
Bai. J., Bai, S., Chu, Y., Cui, Z.. Dang. K., al. Qwen technical report. arXiv preprint 2309v:2309. 16609, 2023.
Bai, Y., Jones, A., Ndousse, K., Askell, A., Chen, A., DasSarma, N., Drain, D., Fort, S., Ganguli, D.. Henighan, T., et al. Training helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.0586) 2022.
BaiChuan-Ine. https:// thub. www.baichuan---aaaeaaaeceiaaa inc Bai chuan -B, 7, 2023.
Ben-Sasson, E., Chiesa, A., Genkin, D., Tromer, E., and Virza, M. Snarks for c: Verifying program executions succinetly and in zero knowledge. In Annual cryptology conference. Springer, 2013.
Biderman, S., Schoelkopf, H., Anthony, Q. G., Bradley, H., O'Brien, K., Hallahan, E.,, Khan, M. A., Purohit, S., Prashanth, U. S., Raff, E., et al. Pythia: A suite for analyzing large language models across training and scaling. In International Conference on Machine Learning, pp. 2397-2430.
PMLR, 2023.
10

---

Bisk, Y.. Zellers, R., Gao. J., Choi, Y., et al. Piqa: Reasoning about physical commonsense in natural language. Proceedings of the AAAI conference on artificial intelligence, pp. 7432-7439, 2020.
Black, S., Biderman, S., Hallahan, E., Anthony, Q. Gao, L., Golding, L., He, H., Leahy, C., McDonell, K. Phang, J., et al. Gpt-neox-20b; An open-source autoregressive language model. In Proceedings of BigScience Episode# 5- Workshop on Challenges & Perspectives in Creating Large Language Models, pp. 95-136, 2022.
Boenisch, F. A systematic review on model watermarking for neural networks. Frontiers in big Data, 4:729663, 2021.
Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J. D., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
Chen, H., Rouhani, B. D., Fu, C., Zhao, J., and Koushanfar, F. Deepmarks: A secure fingerprinting framework for digital rights management of deep learning models. In Proceedings of the 2019 on Multimedia Retrieval, pp. 105-113, 2019a.
International Conference
Chen, H., Rouhani, B. D., and Koushanfar, F. Blackmarks: Blackbox multibit watermarking for deep neural networks. arXiv preprint arXiv: 00344, 2019b.
Chen, H., Zhou, H., Zhang, J., Chen, D., Zhang, W., Chen, K., Hua, G., and Yu, N. Perceptual hashing of deep convolutional neural networks for model copy detection. ACM Transactions Multimedia Computing, Communications and Applications (TOMCCAP), 2022.
Chen, X., Chen, T., Zhang, Z., and Wang, You are caught stealing my winning lottery ticket! making lottery ticket claim its ownership. Advances in Neural Information Processing Systems (NeurIPS), 34: 1791-17991,11 2021.
Chiesa, A., Hu, Y., Maller, M., Mishra, P., Vesely, P., and Ward, N. P. Marlin: Preprocessing zksnarks with universal and updatable SRS. In 39th Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 2020.
Choi, Y., Uh, Y., Yoo, J., and Ha, J.-W. Stargan v2: Diverse image synthesis for multiple domains. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8188-8197, 2020.
Chowdhery, A., Narang. S., Devlin, J., Bosma, M.. Mishra, G., Roberts, A.. Barham, P., Chung, H. W., Sutton, C., Gehrmann, S., et al. Palm: Scaling language modeling with pathways. arXiv preprint arXiv:2204. 200::2200400311,, 2022.
Christ, M., Gunn, S., and Zamir, O. Undetectable watermarks for language models. arXiv preprint arXiv:2306.09194, 2023.
Clark, C., Lee, K., Chang, M.-W., Kwiatkowski, T., Collins, M., and Toutanova, K. Boolq: Exploring the surprising difficulty of natural yes/no questions. arXiv preprint 1rXiv:1905.10044 2019.
Clark, P., Cowhey, I,, Etzioni, O., Khot, T., Sabharwal, A., Schoenick, C., and Tafjord, O. Think you have solved question answering? try are, the ai2 reasoning challenge. arXiv preprint arXiv:I803.0m 05457, 2018
Computer, T. Redpajama: An open source recipe reproduce Ilama training dataset, 2023. URL httpp://githhn wwt./o///ooooe http://c/oooeeeeccooottteeee httpeeppututeeeaaappaaeeeaa ama- Data.
Conover, M., Hayes, M., Mathur, A., Xie, J., Wan, J., Shah, S., Ghodsi, A., Wen- dell, P., Zaharia, M., and Xin, R. Free dolly: Introducing the world's first truly open instruction- tuned 1lm, 2023. URL https: / /www./www.oo/...o databricks. cww/coo////ooooo com/blog/202/0 blog/2023/04/122 dolly-firste open- commercially- instincciionnnoo tonet-tunddll1 11m.
Cui, Y., Yang, Z., and Yao, X. Efficient and effective text encoding for chinese 1lama and alpaca. arXiv preprint arXiv:2304.0877777 2023.
Dettmers, T., Pagnoni, A., Holtzman, A., and Zettlemoyer, L. Qlora: Efficient finetuning of quantized 1mss. arXiv preprint arXiv:2305.14314 2023.

---

Dey, N., Gosal, G., Khachane, H., Marshall, W., Pathria, R., Tom, M., Hestness, J., et al. Cerebras- gpt: Open compute-optimal language models trained on the cerebras wafer-scale cluster. arXiv preprint 0.Xiv:2304.03208, 2023.
Du, Z., Qian, Y., Liu, X., Ding, M., Qiu, J., Yang, Z., and Tang. J. Glm: General language model pretraining with autoregressive blank infilling. In Proceedings of the 60th Anmual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 320-335, 2022.
Fan, L., Ng. K. W., and Chan, C. S. Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks. Advances in Neural Information Processing Systems (NeurIPS), 32, 2019.
Fan, L., Ng. K. W., Chan, C. S., and Yang, Q. Deepipr: Deep neural network intellectual property protection with passports. IEEE Trunsactions on Pattern Analysis and Machine Intelligence (TPAMI), 2021.
Gao, L., Biderman, S., Black, Golding, L., Hoppe, T., Foster, C., Phang, J., He, H., Thite, A., Nabeshima, N., et al. The pile: An 800gb dataset of diverse text for language modeling. arXiv preprint arXiv:2 101. 100.00027 2020.
Geng, X. Easylm: A simple and scalable training framework for large language models, 2023. URL https: //gs::///i ttt.b/tgttt....../////// thub. com/young geng/Easgyl EasyLM.
Geng, X. and Liu, H. Openllama: An open reproduction of llama, May 2023. //github. com/ coom/ppelmmmmem w
URL https:
rewearch/operereeeeeeeeeeeeeee open 11ama.
Goldwasser, S., Micali, S., and Rackoff, C. The knowledge complexity of interactive proof-systems. In Providing sound foundations for cryptography, 2019.
GPT-4 O. Gpt-4 technical report. ArXiv, abs/2303.08774 2023.
Gu, C., Huang, C., Zheng, X., Chang, K.-W., and Hsieh, C.-. Watermarking pre-trained language models with backdooring. arXiv preprint arXiv:2210.07543, 2022.
Gubri, M., Ulmer, D., Lee, H., Yun, S., and Oh, Trap: Targeted random adversarial prompt honeypot for black-box identification. arXiv preprint arXiv:2402. 12991, 2024.
Guo, J. and Potkonjak, M. Watermarking deep neural networks for embedded systems. In 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pp. 1-8. IEEE, 2018.
Han, T., Adams, L. C.,, Papaioannouu J.-M., Grundmann, P., Oberhauser, T., Löser, A., Truhn, D., and Bressem, K. K. Medalpaca-an an open-source collection of medical conversational ai models and training data. arXiv preprint arXiv:2304.08247, 2023.
He, X., Xu, Q., Lyu, L.., Wu, F., and Wang, C. Protecting intellectual property of language generation apis with lexical watermark. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), volume 36, pp. 10766, 2022a.
He, X., Xu, Q., Zeng, Y., Lyu, L.. Wu, F., Li, J., and Jia, R. Cater: Intellectual property protection on text generation apis via conditional watermarks. Advances in Neural Information Processing Systems, 15:5431-5445, 2022b.
Hendrycks, D., Burns, C., Basart, S., Zou, A., Mazeika, M., Song, D., and Steinhardt, J. Measuring massive multitask language understanding. In International Conference on Learning Representa- tions, 2020.
Hoffmann, J., Borgeaud. S., Mensch, A., Buchatskaya, E., Cai, T., Rutherford. E., Casas, D. d. L., Hendricks, L. A., Welbl, J., Clark, A., et al. Training compute-optimal large language models. arXiv preprini arXiv:2203. 15556, 2022.
Jia, H., Yaghini, M., Choquette-Choo. C. A., Dullerud, N., Thudi, A., Chandrasekaran, V., and Papernot, Proof-of-leaming: Definitions and practice. IEEE Symposium on Security and Privacy (S&P), pp. 1039-1056. IEEE, 2021.
12

---

Karras, T., Laine, S., and Aila, T. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4401-4410, 2019.
Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., and Aila, T. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference computer vision and patter recognition, pp. 8110-8119, 2020.
Kate, A., Zaverucha, G. M., and Goldberg, I. Constant-size commitments to polynomials and their applications. In Advances in Cryptoloy-ASSIACRTY 2010: 16th International Conference on the Theory and Application of Cryptology and Information Security, Singapore, December 5-9, 2010. Proceedings 16, pp. 177-194, Springer, 2010.
Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., and Goldstein. T. watermark for large language models. In Krause, A., Brunskill, E.,, Cho, K., Engelhardt, B., Sabato, S., and Scarlett, J. (eds.), Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 17061-17084. PMLR, 23-29 Jul 2023. URL https: hatp:ss:/pocceeingge. .mlr mlr. press/ v202/kkirccenbaur22233 html.
Köpf. A., Kilcher, Y., von Rütte, D., Anagnostidis, S., Tam, Z.-R., Stevens, K., Barhoum, A., Duc, N. M., Stanley, O., Nagyfi, R., et al. Openassistant conversations demoooraiininiiiiiinnggog large language model alignment. arXiv preprint arXiv:2304.073327, 2023.
Krishna, K., Song, Y., Karpinska, M., Wieting, J., and lyyer, M. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. arXiv preprint arXiv:2303.13408, 2023.
Lai, G., Xie, Q., Liu, H., Yang, Y., and Hovy, E. Race: Large-scale reading comprehension dataset from examinations. In Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, pp. 785-794, 2017.. 2017.
Le Merrer, E., Perez, P., and Trédan, G. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications (NCA), (2(13)92333-9244 2020.
Li, L., Wang, P., Ren, K., Sun, T., and Qiu, X. Origin tracing and detecting of llms. arXiv preprint arXiv:2304 14072, 2023.
Li, Y., Zhu, L., Jia, X., Bai, Y., Jiang, Y., Xia, S.-T., and Cao, X. Move: Effective and harmless ownership verification via embedded external features. arXiv preprint 22ti:22200.0222000 2022a.
Li, Y., Zhu, L., Jia, X., Jiang, Y., Xia, S.-T., and Cao, X. Defending against model stealing via verifying embedded external features. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), volume 36, pp. 1464-1472, 2022b.
Li, Billa: A bilingual llama with enhanced reasoning ability, BiLLa, 2023.
Lin, K., Lin, C.-C., Liang, L., Liu, Z., and Wang. L. Mpt: Mesh pre-training with transformers for human pose and mesh reconstruction. arXiv preprint arXiv:2211. 2022
Liu, H., Weng, 7.,, and 7hu, Y. Watermarking deep neural networks with greedy residuals. In Proceedings of the International Conference on Machine Learning (ICMI., pp. 6978-6988 PMIR, 2021.
Lou, X., Guo, S., Zhang, T., Zhang, Y., and Liu, Y. When nas meets watermarking: ownership verification of dnn models via cache side channels. IEEE Transactions Circuits and Systems for Video Technology (TCSVT), 2022.
Lukas, N., Zhang, Y., and Kerschbaum, F. Deep neural network fingerprinting by conferrable adversarial examples. arXiv preprint arXiv: 208888, 2019.
Mitchell, E., Lee, Y., Khazatsky, A., Manning, C. D., and Finn, C. Detectgpt: Zero-shot machine- generated text detection using probability curvature. In Krause, A., Brunskill, E., Cho, K., Engelhardt, B., Sabato, S., and Scarlett, J. (eds.), International Conference on Muchine Leurning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pp. 24950-24962. PMLR, 2023. URL https: : / http://p/oee////eee/e/eeeee ings mlr, .pres// v202/mitche11223 html.
13

---

OpenAl. Introducing chatgpt. 2022. URL https:////ppe /ttpa//////////ppppaaaaaa/////a/
OpenAl. Ai classifier. 2023. URL htt.httpee/eeeaa..paaa.ccooo
Pan, X., Yan, Y., Zhang, M., and Yang. M. Metav: A meta-verifier approach to task-agnostic model fingerprinting. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (SIGKDD), pp. 1327-1336, 2022.
Penedo, G., Malartic, Q. Hesslow, D., Cojocaru, R., Cappelli, A., Alobeidli, H., Pannier, B., Almazrouei, E., and Launay, J. The RefinedWeb dataset for Falcon LLM: outperforming curated corpora with web data, and web data only. arXiv preprint 3xXi::336.00116, 2023. URL https: /ttxxaaxvvv..///////ee//eaaaaa org. abs//ab///// /206. 01116.
Peng, Z., Li, S., Chen, G., Zhang, C., Zhu, H., and Xue, M. Fingerprinting deep neural networks globally via universal adversarial perturbations. Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pp. 13430-13439, 2022.
Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I., et Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
Rouhani, B. D., Chen, H., and Koushanfar, Deepsigns: an end-to-end watermarking framework for protecting the ownership of deep neural networks. In ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), 2019.
Sadasivan, V. S., Kumar, A., Balasubramanian, S., Wang. W., and Feizi, S. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11155. 2023.
Sakaguchi, K., Bras, R. L., Bhagavatula, C., and Choi, Y. Winogrande: An adversarial winograd schema challenge scale. Communications of the ACM, 64(9):99-166 2021.
Sun, H., Li, J., and Zhang, H. zkilm: Zero knowledge proofs for large language models. arXiv preprint arXiv:2404.1 16109, 2024.
Taori, R., Gulrajani, I., Zhang. T., Dubois, Y., Li, X., Guestrin, C., Liang, P., and Hashimoto, T. B. Stanford alpaca: An instruction-folloving llaaa model. https://github. www/tatsu- tttsu-lab/ stanford_alae _aaaca, 2023.
Taylor, R., Kardas, M., Cucurull, G., Scialom, T., Hartshorn, A., Saravia, E., Poulton, A., Kerkez, V., and Stojnic, R. Galactica: A large language model for science. arXiv preprint arXiv:2211.09085. 2022.
Team, I. Internim: A multilingual language model with progressively enhanced capabilities. https: // //githin //github. Coom/InneenLMM// IIt.M//nnneenLMMM 2023.
Tian, E. Gptzero: An ai text detector. 2023. URL https:://pttero...t
Touvron, H., Lavril, T., Izacard, G.. Martinet, X., Lachaux, M.-A., Lacroix, T., Rozière, B., Goyal, N., Hambro, E., Azhar, F., et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302. 230.71111. 2023a.
Touvron, H., Martin, L.. Stone, K., Albert, P., Almahairi, A., Babaci, Y., Bashlykov. N., Batra, S.. Bhargava, P., Bhosale, S., et Llama 2: Open foundation and fine-tuned chat models. arXiv preprint 2:XXi:2307.09288 2023b.
Uchida, Y., Nagai, Y., Sakazawa, S., and Satoh, S. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval. ACM, URL httth:tt///oe http::///ooooor/..11111/////////
jun 2017. doi: 10.1145/307897133077977 3078974.
Wahby, R. S., Tzialla, I., Shelat, A., Thaler, J., and Walfish, M. Doubly-efficient zksnarks without trusted setup. In 2018 IEEE Symposium on Security and Privacy (SP), pp. 926-943. IEEE, 2018.
Wang, E. htttt::tttttiieeeee httpps///gihhhb.cc///////a/a/app lora, 2023.

---

Wang, J., Wu, H., Zhang, X., and Yao. Y. Watermarking in deep neural networks via error back- propagation. Electronic Imaging, 2020(4):22-1, 2020.
Wang. T. and Kerschbaum, F. Attacks on digital watermarks for deep neural networks. In ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2622-2626. IEEE, 2019.
Wang, T. and Kerschbaum, F. Riga: Covert and robust white-box watermarking of deep neural networks, In Proceedings of the Web Conference 2021 (WWW), pp. 993-1004, 2021.
Workshop, B., Scao, T. L., Fan, A., Akiki, C., Pavlick, E., Ili,, S., Hesslow, D., Castagné, R., Luccioni, A. S., Yvon, F., et al. Bloom: 766--aarameter open-access multilingual language model. arXiv preprint #rXiv:2211.05100 2022.
Wu, H., Liu, G., Yao, Y., and Zhang, X. Watermarking neural networks with watermarked images.
IEEE Transactions on Circuits and Systems for Video Technology (TCSVT), 31(7):2591-2011, 2020.
Wu, K., Pang, L., Shen, H., Cheng, X., and Chua, T.-S. Limdet: A large language models detection tool. arXiv preprint arXiv:2305.15000 2023a.
Wu, S., Irsoy, O., Lu, S., Dabravolski, V., Dredze, M., Gehrmann, S., Kambadur, P., Rosen- berg, D., and Mann, G. Bloomberggpt: A large language model for finance. arXiv preprint arXiv:2303. 10022333..664, 2023b.
Xiang. T., Xie, C., Guo, S., Li, and Zhang. T. Protecting your nlg models with semantic and robust watermarks, arXiv preprint arXiv:2112.054222 2021.
Xiong, C., Feng, G., Li, X., Zhang, X., and Qin, C. Neural network model protection with piracy identification and tampering localization capability. In Proceedings of the 30th ACM International Conference on Multimedia (MM), pp. 2881-2888 2022.
Xu, C., Guo, D., Duan, N., and McAuley, J. Baize: An open-source chat model with parameter- efficient tuning self-chat data, arXiv preprint arXiv:2304.01 196, 2023a.
Xu, C., Sun, Q., Zheng, K., Geng, X., Zhao, P., Feng, J., Tao, C., and Jiang, D. Wizardlm: Empow- cring large language models to follow complex instructions. arXiv preprint arXiv:2304.12244, 2023b.
Xu, J., Wang, F. Ma, M. D., Koh, P. W. Xiao, C., and Chen, M. Instructional fingerprinting of large language models. arXiv preprint 2:Xiv:2401.12255 2024.
Yadollahi, M. M., Shoelch, F., Dadkhah, S., and Ghorbani, A. A. Robust black- box watermarking for deep neural network using inverse document frequency. In 2021 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf Cloud and Big Data Computing, Intl Conf Cyber Science and Technology Congress MASSC/PCCom/CCDCCo/////io
pp. 574-581. IEFE, 2021.
Yang, K., Wang, R., and Wang, I.. Metafinger: Fingerprinting the deep neural networks with meta- training. In Proceedings of the International Joint Conference on Artificial Intelligence (IJCAI), 2022.
Zellers, R., Holtzman, A., Bisk, Y., Farhadi, A., and Choi, Y. Hellaswag: Can machine really finish your sentence? In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pp. 4791-4800, 2019.
Zhang, R., Isola, P., Efros, A. A., Shechtman, E., and Wang, O. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 586-595, 2018.
Zhang, S., Roller, S., Goyal, N., Artetxe, M., Chen, M., Chen, S., Dewan, C.,, Diab, M., Li, X., Lin, X. V., et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.0106: 2022.
15

---

Zhao. J., Hu, Q. Liu, G., Ma, X., Chen, F., and Hassan, M. M. Afa: Adversarial fingerprinting authentication for deep neural networks. Computer Communications, 150:488-44 497, 2020.
Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E., et al. Judging llm-as-a-judge with mt-bench and chatbot arena. arXiv preprint wwXiv:2306.05683 2023a.
Zheng. Q.. Xia, X., Zou, X., Dong, Y., Wang, S., Xue, Y., Wang. Z., Shen, L.., Wang, A., Li, Y., Su, T., Yang, Z., and Tang, J. Codegeex: A pre-trained model for code generation with multilingual evaluations on humaneval-x. In KDD, 2023b.
Zheng, Y., Wang, S., and Chang, C.-H. A dnn fingerprint for non-repudiable model ownership identification and piracy detection. IEEE Transactions on Information Forensics and Security, 17: 2977-2989, 2022.
Zhu, D., Chen, J., Shen, X., Li, X., and Elhoseiny, M. Minigpt-4: Enhancing vision-language understanding with advanced large language models. arXiv preprint arXiv:2304. 10592, 2023.
16

---

A Additional related works
Deep neural network copyright protection methods can generally divided into two categories: Watermarking and Fingerprinting.
Watermarking. There are three main types of watermarking methods. The first type involves embedding watermarks into model weights (Chen et al., 2019a; Wang & Kerschbaum, 2021; Liu et al., 2021; Uchida et al., 2017), hidden-layer activations (Rouhani et al., 2019), gradients (Li et al., 2022b,a), model structures (Lou et al., 2022; Chen et al., 2021), extra components (Fan et al., 2019, 2021). These methods are typically white-box approaches and may potentially degrade the model's performance. The second type achieves watermarking by injecting triggers into the model to produce predefined outputs (Adi et al., 2018b; Guo & Potkonjak, 2018; Le Merrer et al., 2020; Chen et al., 2019b); however, these methods often require fine-tuning retraining the model. The third type relies on extractor subnetworks (Wu et al., 2020; Abdelnabi & Fritz, 2021) or predefined rules (He et al., 2022a,b) to embed watenmarks into the model's output.
Fingerprinting. Fingerprinting methods are primarily divided into two categories. The first category involves copyright verification through the comparison of model weights (Jia et al., 2021) or their corresponding hash values (Zheng al., 2022; Chen et al., 2022; Xiong al., 2022), but these methods are limited to white-box scenarios and have only been tested on CNN-based visual models. The second category includes more recent works (Zhao al., 2020; Pan al., 2022; Yang et al., 2022; Lukas et al., 2019; Peng et al., 2022) that construct DNN fingerprints by analyzing model behaviors on preset test cases. However, these methods often require additional models or data samples and may involve extra training.
B
Details of Data Synthesis and Encoder Training
B.1 Data Synthesis
For the anchor data M: Sample matrices PI, Ps, P3 from a standard normal distribution. Consider Pi as X, and P2, P3 as model parameter matrices, then
M P.PPPP
(10)
For positive data M Independently sample noises e, from a normal distribution (V a). then
P. = P.+ M = P, P P
(11)
For negative data M Independently sample matrices N1, N2, N3 from another standard normal distribution, then
M = NIN2NNN?
(12)
B.2 Training the Encoder
Note that we don't need to use any real LLM weights for training the encoder, as it only needs to learn locality-prestee preserving mapping between the input tensor and the output Gaussian vector. This ensures strict exclusivity between the training and test data. To construct the training data, we synthesize the matrix in each channel of M on-the-fly, by randomly sampling 3 matrices P,, Ps, P3 and multiplying them together as P.P.P.P" as though they are model parameters.
To learn locality-preserving mapping, adopt contrastive learning. For randomly sampled input M, its negative sample is given by another independently sampled tensor M For its positive sample M perturb the content in each of M's channel by adding small perturbation noises e E [0 a) to the 3 matrices behind it. Here a is a hyperparameter determining the small variance. (c.f. Appendix B.1 for detailed data synthesis process.)
Subsequently, the contrastive loss Le is given by:
Le = (1 (M, + (M
(13)
where Sc(..) computes the cosine similarity between its two input matrices.
17

---

Model
BoolQ
HellaSwag
PIQA
WinoGrande ARC-e
ARC-e
RACE
MMLU
Avg.
LLaMA
75.11
76.19
79.16
70.00
72.90
44.80
40.00
32.75
61.36
Alpaca
77.49
75.64
77.86
67.80
70.66
46.58
43.16
41.13
62.54
(97.17)13)
45.44
31.16
67.63
48.70
49.03
34.13
22.78
23.13
40.25
(87.87
42.23
26.09
49.78
47.43
26.43
28.92
22.97
23.22
33.38
(80.80.23)
39.05
26.40
49.95
48.30
26.52
28.75
22.97
23.98
33.24
+Z7(77.56)
41.62
26.15
50.11
49.33
26.56
28.50
22.78
23.12
33.52
Table 5: Detailed zero-shot performance multiple standard benchmarks of the original LLaMA, Alpaca, and the tuning model different (PCPS)) values.
To render the output vector to be Gaussian, we adopt the standard GAN (Karras al., 2019) training scheme. We add simple MLP as the discriminator D that is trained to discriminate between real Gaussian vectors and the output vector v. In this setting, the encoder serves as the generator. During training, for every m step, we alternate between training the discriminator and the generator. The discriminator loss LD thus given by
CD Σ log D (v))
(14)
While training the generator also need to incorporate the contrastive learning loss. Thus the actual loss & for the training generator combination of Lc and Lp-
L = Lc + LD
(15)
C Implementation Details
C.1 Training Settings
In the training stage, we alternate training the discriminator and encoder every steps. We set the batch size to 10, the initial learning rate to 0.0001, and introduce a noise intensity a of 0. 0.16 for positive samples. After 8 epochs training, we obtained the encoder used our paper.
C.2 Model Architecture
For the encoder: We used convolution neural network (CNN) the encoder. The CNN encoder takes invariant terms M e I2 1096x 1096x6 as input and produces a feature vector v as output. Our CNN encoder structure, as depicted in Figure 4, consists of the first four convolutional layers and the last mean pooling layer. The mean pooling layer simply calculates the average of the feature maps obtained from each channel, resulting in feature vector with length equal to the number of channels. The hyperparameters for the four convolutional layers are provided in the table below:
CNN Layers
Input Channel
Output Channel
Kernel Size
Stride
Padding
Layer
8
48
4
22
Layer
8
64
48
4
22
Layer
64
256
48
22
Layer
256
512
48
4
22
Table 6: Detailed hyperparameters of the stacked four convolutional layers.
For the discriminator: We utilize simple 3-layer MLP the discriminator. The 512-dimensional feature vector a from the CNN encoder serves as fake data, while a 512-dimensional vector sampled from the standard normal distribution serves as real data. The discriminator processes and æ. progressively reducing dimensionality through three linear layers, and finally outputs the probability sample being real after applying sigmoid activation function. The sizes of the three linear layers are W1 1 512xx56
12 256 128 and W3 R 128x1 respectively.
W2
18

---

fingerprinting
Proof Ri
Verity Proof
Accept
Reject
cm commit (model,,,
consistency
commit & publish
Inference
Proof
check
commmitment consistent
LLaMA
& oulput
Riaf
Figure 6: Flowchart for using commitment to defend against substitution attacks.
For the image generator: The pre-trained StyleGAN2 checkpoint we used can be found at:
https://vvlabs-fii- htw.://aaaiaaaaaaaaaaaaaaaaaaaaa www.ddaa.ccm/ttyyeaaaa222 ada- welaaapyooooooooraaaeaeeeee afhgdog. pkl
D
Substitution Attack
D.1 Training
Substitution attack is a classic problem in cryptography. A conventional approach to address this issue is through cryptographic commitments (Kate et al., 2010; Wahby et al., 2018), which possess the dual properties being binding and hiding:
This property ensures that it is computationally infeasible to find more than one valid opening any given commitment, thereby preventing the substitution of the committed data.
Binding:
Hiding: This ensures that the commitment itself discloses no information about the data it secures.
In our method, when model developer wants to generate fingerprint, they first commit to their model and publish this commitment. The binding property guarantees that no other model can match the same commitment, thereby preventing substitution attacks. All subsequent proof processes are carried out with this commitment, allowing anyone to verify if the model parameters used in calculations (such fingerprinting or inferences) match those sealed within the commitment. (See Figure 6 for an explanation of the process.)
For example, if developer commits to model parameter A but uses different model B for services, the public can request inference proofs for the model of the API verification. Since the parameters used by model B inference are different from the parameters hidden in the commitment, the proof cannot pass the verification, substitution attacks will be revealed. For the Zero- KeoolKno proof of LLM inference, refer to Sun et al. (2024), which provides effective implementation.
E StyleGAN2 Generator
StyleGAN2 is an improved model based the style-based GAN architecture. One of its key enhancements the incorporation of the perceptual path length (PPL) metric, which was originally introduced to quantify the smoothness of the mapping from the latent space the output image. The PPL. metric measures the average I.PIPS distances (Zhang et al., 2018) 8) between generated images under small perturbations in the latent space. Through the utilization of path length regularization, StyleGAN2 achieves enhanced reliability, consistency, and robustness, resulting in a smoother behavior of the generator. This regularization technique aligns with our objective of obtaining locality-preserving generator.
F Open-sourced Independently Trained LLMs
In this experiment, we aimed to gather diverse models covering various parameter sizes. For the widely used LLaMA models, we included LLaMA-7B, 13B, 65B, LLaMA2-7B and 13B. We also incorporated models with similar architectures to LLaMA, such as InternL LaaA 7B, and Baichuan-7B. To encompass a broader range of parameters, we expanded our collection to include GPT2-Large (Radford et al., 2019), Cerebras-GPT-L.C. (Dey al., 2023), Qwen-7B,
19

---

72B, Galactica- 120B and even the largest Falcon- 180B. Additionally, we considered models like MPT-7B, RedPajama-T7 (Computer, 2023). ChatGLM-6B (Du al., 2022), Bloom-7.1B (Workshop et al., 2022), ChatGLMM-66B, Pythia-6.9B and 12B (Biderman et al., 2023), OPT-6.7B 7B and 30B, and GPT-NeoX-200 (Black al., 2022), among other commonly used L.L.s. Please refer Table 7 for the ICSs between the 28 models.
G Independently Trained LLMs in Smaller Scale
To validate the uniqueness and stability of the parameter direction LLMs trained from scratch, we independently trained GPTT-NeX-3550M models subset of the Pile dataset (Gao al., 2020). First, we examined whether different parameter initializations merely caused by global random seeds result in distinct parameter directions. Second, we explored the variation in the model's parameter vector direction during pretraining.
G.1 GPT-NeoX Models with Different Global Seeds
We investigated the impact of global random seeds the model parameters' direction by indepen- dently training HPPT-NeoX-350X models on a subset of the Pile dataset. These models were trained using different global random number seeds while sharing the same architecture, training data batches, computational resources, and hyperparameters.
Subsequently, we computed the cosine similarities between these GPT-NeoX models' invariant terms, as shown Table 8. We generated fingerprints for these models, depicted in Figure The results revealed noteworthy pattern: when GPT-NeoX models are trained from scratch, long as the global random seed used for parameter initialization is different, it will lead to completely different parameter vector directions after pretraining. Correspondingly, their fingerprints exhibited clear distinctions from each other.
G.2 Model's Parameter Vector Direction's Variations During Pretraining
In addition, we have explored the variation in the model's parameter vector direction during pre- training by comparing neighboring checkpoints of a model and calculating their cosine similarities. Specifically, we trained GPT-NeeX-330M model on subset of the Pile dataset for 360,000 steps and saved a checkpoint every 50k steps. As pretraining progresses, we observed a diminishing change in the model's 's parameter direction, leading to gradual stabilization, shown in Table 9. For larger models and more pretraining steps, we expect this phenomenon to be more pronounced, indicating that the parameter direction of LLMs tends to stabilize during pretraining.
H
More Fingerprints
H.1
Offspring Models' Fingerprints
For LLaMA and its offspring models (Section 5.1.1), their fingerprints align with similar finger- print image of a Croatian sheepdog, exhibiting comparable poses, coat patterns, expressions, and backgrounds (Figure 8).
In addition, the fingerprints of the rest offspring models listed Table 10 and their respective base models are depicted in Figure 9, Offspring models" fingerprints still bear high similarity to their base models.
H.1.1
28 Independently Trained LLMs' Fingerprints
We also generate fingerprints for the 28 independently trained LLMs (Section 5.1.2), shown in Figure 10, their fingerprints exhibit high diversity, aligning with the distinct invariant terms each model.
20

---

-1.35
-1.07
0.27
-0.03
-1.26
.0.2
0.01
-11.77
-0.01
-0.06
0.04
-0.18
0.16
-0.55
-0.00
0.13
0..0
0.01
0:06
-0.3
4.90
0.02
0.09
0.19
100.00
Table 7: ICS herwoen 28 open nen--edreed (77.M to 1808): GPT2-1 Larp--ampe Lamp (GPT2) Cerehras GPT.a-----PPLL-- 1-11--55..1. 18 (CGPT) ChaGG (CLM) ChatG M22-68 (CL CLM2) OPT-6 7B78 (OPT6.7 7) Pythin-6 9B (Py6 (BMPTT)))PT))) Baichuan-77 7
(Bal)), Falcon-7B (FaT)) Intem M-7B (Inte?). OpenLLaMe LLMA-7B (OLM), LLMA--B (LMP). Owen-? 7B (Qw7). LLaMA2-7B2 (LM27), RedPajamu- 7B (RedP), Bloom- 7B (Blocmn, Pythic- 12 (Py 12), Baichuan- 138 (Bal 13)..
(Neox). LLL.A 30B (LME30). OPT: 30T:308 30B (OPT30), Falcom 408 (FaM0), LLaMA 658 (LM65), Qwen- 72B (Qw (w72), Galactica 120B (Galal 20) Falcon 1808 (Fall (FaI180) 180) Sorted keft to right by
Fall
Gall
-0.37
18.18
-1.04
-0.01
-0.17
-0.61
-0.16
0.01
0.00
0.08
0.06
-0.00
0.15
0.21
-0.03
-0.06
0.02
0.07
0.11
-0.13
40.06
0.20
-0.12
0.07
100.00
0.19
Qw
0.18
-0.15
0.05
0.07
-0.11
-0.12
0.31
0.19
-0.26
0.32
0.57
0.01
0.7
0.12
-0.05
0.20
0.59
0.03
0.48
0.40
-0.00
100.00
0.07
0.09
LM65
+0.24
0.03
0.18
-0.03
-0.03
00.3
0.10
06:05
-0.29
0.06
1.59
0.03
00088
1.71
0.48
-0.04
0.15
0.25
0.88
0.02
2
0.56
-0.05
100.00
0.44
.0.13
0.02
Fa140
0.79
0.17
0.17
0.30
0.6
0.23
-1.23
-008
1.68
0.08
-004
-0002
0.05
-004
0.29
0.30
-000
40.1
0.34
0.08
0.55
100
-0.10
0.20
4,90
0PT30
3.36
5.10
-0.73
-0.07
46. 16.29
0.29
110
021
0.39
-0.4
000
0.0
-0.68
0.37
068
008
-0.9
021
013
0.14
011
100.00
0.55
0.40
-0.06
-0.93
LM50
-0.99
00.08
.0.07
-0.02
-0.38
-049
0.10
0.19
-031
1.15
0.02
1.77
-013
-002
-0.06
0.21
-0.00
100.00
0.12
0.08
0.48
-013
0.06
Noox
0.11
0.05
.0.10
0.60
0.15
-0.28
0.04
0.51
40.00
0.05
0.00
0.41
0.02
1.91
1.27
0.0
100.00
00.00
40.00
0.14
0.34
0.03
0.11
0.01
LM13
-0.09
0.02
4..01
0.09
-..23
0.03
0.28
0.01
0.08
0.27
2.07
0.42
0.07
1.67
0.03
4.02
1.0
0.41
100.00
4.01
0.39
0.13
12
0.88
0.37
0.07
4..4
Bal13
0.30
0.25
-0.03
0.11
0.17
0.01
0.52
0.42
0.16
0.13
0.35
062
0.57
0.03
0.4
-001
-001
0.35
100.00
-0.01
0.21
0.21
-014
0.25
0.59
0.02
-0.10
LM213
0.09
0.01
0.28
0.14
-013
-018
0.22
0.05
0.36
0.23
1.64
0.11
1.45
40.00
0.04
0.35
-0.01
-0.96
00.39
-0.00
0.20
-0.0
0.13
Py12
-0.04
0.04
0.10
0.69
0.17
0.40
0.00
0.62
0.02
0.03
0.02
0.04
0.48
40.0
100.00
0.04
0.01
1.27
-0.0
0.08
0.30
0.03
-0.03
40.00
2.6
0.03
0.74
0.04
0.92
1.31
2.37
0.62
0.99
0.84
0.02
0.06
0.06
0.35
-004
100.00
2.08
-0.0
00002
0.0
1.9
-0.13
0.68
0.29
0.03
0.12
0.1
-0.15
LM27
11.18
-0.12
0.10
0.02
-0.10
0.35
0.3
-0.13
0.39
316
-0.09
100.00
40.04
-0.03
145
0.54
166
0.02
1.77
0.37
-0.04
1.71
0.8
0.15
0.16
Bloom
-0445
-0.79
0.37
0.79
-1.09
0.55
088
-013
0.48
-001
0.09
0.08
100.00
+0.09
0.55
0.48
0.11
0.03
0.07
0.41
0.02
40.68
0.05
40.08
0.01
4.,00
40.18
Qw?
-0.07
0.10
0.14
0.14
-0.14
-012
041
0.
0.48
0.32
0.60
0.01
0.55
4002
0.04
0.46
0.57
0.42
-0.00
-0.20
-0.12
-0.08
0.03
0.76
0.11
-0.01
LM7
-0.15
40.30
0.15
0.11
40.36
-0.13
0.32
0.08
0.03
0.32
100.00
0.08
3.16
0.06
0.02
164
0.2
2.07
0.00
1.15
0.44
-0.00
1.59
0.67
0.06
0.04
OLM
0.05
0.23
00.09
0.11
40.06
0.04
0 10
0.21
0.04
0.18
100.00
0.32
0.32
0.09
0.39
0.06
0.3
0.2
0.35
0.27
0.05
0.19
000
-0.04
0.06
0.32
0.08
-0.06
1ne7
0.21
0.07
0.18
0.24
-0.06
4..0
013
0.1
40.06
100.0
0.8
003
0.88
-0,01
-0.13
0.02
0.22
0.36
011
0.08
-0.00
-0.31
40.64
0.88
-0.9
0.25
0.00
-0.01
Fa77
0.30
0.48
-0.09
0.87
048
0.56
044
0.13
100.00
-000
0.04
0.08
048
0.23
0.84
062
0.05
0.6
0,01
0,5g
0.19
0.39
1.68
0.05
0.19
0.01
11.07
Bal7
0.
0.23
-0.14
0.41
0.32
100.00
0.13
0221
0.21
0.32
-0113
0.35
0.09
0.09
0.42
0.28
0.04
0.10
0.21
-0.08
0.31
4016
0.01
MP17
0.53
1.06
-1.32
-0.08
5.87
100.00
0.32
0.44
0.13
0.10
-013
0.83
-0.10
0.62
0-4
0.52
-0.0
-0.28
-0.49
1.10
-1.33
0.12
-0.1
-0.83
Py6.9
0.03
0.14
.0.01
0.75
0.45
103.00
0.13
0.01
0.66
-0.06
0.04
-0.00
0.01
0.55
0.02
2.37
1.58
0.02
0.01
1.11
4000
0.29
0.25
-001
0.02
.001
-0.04
OP16.7
5.50
7.46
-1.07
-0.05
100.00
5.87
0.41
0.48
-0.06
-0.06
40.36
-1.09
0.02
1.31
0.17
0.17
0.15
+0.38
46.29
29
0.65
0.11
-011
-1,26
CLM2
0.01
0,08
0.18
100.00
-0.05
0.75
0.08
0.11
0,57
0.24
0.11
011
0.79
010
0.92
0.69
0.14
0.11
0.09
0.60
40.02
40.07
0.30
-0.0
0.07
-0.1
0.03
LLLAMA-133 138 (LM13), GPP- 2013 2013
pammeter size from smallest to largest.
CLM
-0.67
29
100.00
0.18
-1.07
-0.01
1.32
-0.14
-0.09
-0.18
-0.09
0.15
0.37
-0.12
0.64
0.10
0.28
0.03
-0.10
40.07
40.33
0.17
0.05
-1.04
0.27
COPT
18.06
00.00
100
-0.29
0.08
7.46
1.06
0.23
0.48
0.07
0.23
-0.30
-0,79
-018
0.74
004
0.25
0.02
0,05
-0.08
5.10
0.7
0.03
-0.18
-0.18
-1.07
GPT2
00.000
18,06
-067
0.01
5.50
0.53
0.16
0.30
0.21
0.05
-0.15
-045
-0.04
0,03
-0.04
0.09
0.30
0.11
-0.09
3.36
0.79
-0.09
-0577
-1.35
ICS
GPT2
CGPT
CLM
CLM2
OPTS.7
Py6.9
MPT7
Bai7
FM17
Inte7
OLM
LM7
Qw7
Bloon
LM27
RedP
Py12
LM213
Bail3
I.M33
Noox
LM30
OPT30
Fil40
LM65
Qw72
Gall20
P8
21

---

ICS Seed=1 I Seed=2 Seed=3 Seed=4
Seed=l
100.00
2.08
2.23
2.08
Seed=2 2.08
100.00
2.40
2.26
Seed=3
2.23
2.40
100.00
2.29
Seed=4
2.08
2.26
2.29
100.00
Sced4 Figure 7: Fingerprints GPT-NeoX models trained with
Sced1
Seed2
Seed3
Table 8: ICS values between GPT-NeoX
models with different global seeds.
varying global seeds.
Comparing CKPTs
10k-60k
60k-1 110k
110k-160k
160k-210k
210k-260k
260k-310k
310k-360k
Cosine similarity
56.23
84.65
88.95
90.96
92.13
93.22
94.25
Table 9: Cosine similarities between neighboring checkpoints (saved every 50k steps) of GPT-NeoX models during pretraining.
LLaMA
MiniGPT-4
Alpaca
MedAlpaca
Vieuna
WizardLM
Baize
A Alpaca Lora
Chinese Alpaca
Koula
Chinese LLaMA
Beaver
Guanaco
BiLLa
Figure Fingerprints of LLaMA-7B and its offssring models.
ChatGLM-6B
RLHF
GPT-NeoX-200
Chat
ОРT30
IML
RedPajama-P7
Chat
LLaMA2-13B
Estopia
Nous-Hermes
Tiefighter Chinese-Chal Baichuan-7B
SFT
Chat
LLMMA2-7B
32K
WikiChat
Function Chinese-Char Bloom-7B
Mt
P3
Qwen-72B
Chat
Falcon-7B
Samantha
Wizard
Instruct
Falcon-180B
Chat
Figure 9: Fingerprints of the other offspring models and their base models.
22

---

Offspring Model
Base Model
Detail
Alpaca
LLaMA-7B
SFT Stanford's instruction instruction-following data
Alpaca-Lora
LLaMA-7B
SFT used the Lora training method
MiniGPT-4
LLaMA-7B
multimodal model aligned on million image-text pairs
ChiMese-LLaMA
LLaMA-7B
continued pretraining on Chinese corpus continued pretraining and finetuned on Chinese corpus
Chinese-Alpaca
ILaMA-7B
Vicuna
LLaMA-7B
SFT around 125K user-shared conversations finetuned on 100k ChatGPT generated dialogs SFT on dialogue data gathered from the web trained on complex instructions data finetuned on medical datasets
Baize
LLaMA-7B
Koala
LLaMA-7B
WizardLM
LLaMA-7B
McdA/paca
LLaMA-7B
Beaver
LLaMA-7B
underwent RLHF
Guanaco
LLaMA-7B
finetuned on nearly 600K multilingual dataset continued pretraining on a new language
BiLLa
LLaMA-7B
Balcon-40B-Instruu
Falcon-4OB
finetuned on mixture of Baize
Falcon-4085 10-oo-40B-SFTTTol.. -561
Falcon-40B
SFT based on the OASST dataset (Köpf al., 2023)
MPT-7B-Instruct
MPT-7B
finetuned on Dolly2 and HH-RRL HHHHH (Bai al., 2022)
BTT-7B-StoryWW
MPT-7B
finetuned with super long context length
MPT-7B-Chat
MPT-7B
finetuned on mixture of instruct datasets
Qwen-7B-Chat
Qwen-7B
trained with alignment techniques
Firefl--Qwnn77B
Qwen-7B
SFT by the Firefly project
Baichuan-13B 13B-Chat
Baichuan 13B
dialogue version bilingual instruction-tunes model optimized for dialogue use cases
Baichuan- -
Baichuan- 13B
InternL.M-7B-CHe
InternLM-7B
Firefly- Innemn-
InternLM-78B
SFT by the Firefly project
Qwcn-72B-Cha
Qwen-72B
trained with alignment techniques
OPT-IML-30B
OPT-30B
trained on 1500 tasks gathered from NLP benehmarks
ChatGLLM-fitnes-RLLLHH
ChatGLM-6B
RLHF and SFT on millions data
GPT-NeoXTTChat
GPT-NeoX-20B
fine-tuned with 43 million high-quality instructions
RedPajama-Chal
RedPajama-7B
fine-tuned OASSTI and Dolly2 (Conover al., 2023)
Bloomz-p3
Bloom-7B
finetuned on crosslingual task(P3)
Bloomz-no mt
Bloom-7B
multitask finetuned on xP3mt
Falcon- 88BB Chat
Falcon-188 180B
finetuned on mixture of instruct datasets
L.L.MA277B-Che
I.LMMA-7B
dialogue version
1.AMMA2-BB-32
LLaMA2-7B
continued pretraining and SFT enhance long-context capacity
LLaMA2-7B
extends LLaMA2 model with function calling capabilities
Llama2-Chinese--7B
LLaMA2-7B
aligned with Chinese dataset
Vicuna2
LLaMA2-7B
fine-tuned on user-shared conversations
LLaMA2-WikiChat
LLaMA2-7B
fine-tuned LLaMA-2 retrieve data from Wikipedia
Falconn7B-Instrucct
Falcon-7B
finetuned on 250M tokens mixture of instruct/chat datasets
Samantha-Faloos Falcoon-
Falcon-7B
finetuned in philosophy, psychology, and personal relationships WizardLM trained on top of Falcon-7B finetuned mixture of instruct datasets finetuned Dolly2 and HH-RLHF bilingual instruction-tunel model dialogue version
W
Falcon-7B
MPT-30P -h--hat
MPT-30B
MPT-30B-Instruct
MPT-30B
Baichuan-7B. FB-SFT
Baichuan-PP 7B
Baichuan-7B-Chhe
Baichuan-7B
-LaMA2-13B-O0
LLaMA2- 13B
optimized for dialogue use cases fine-tuned for focused on improving the dialogue and prose merging two different Lora's aligned with Chinese dataset fine-tuned on over 300,000 instructions
LLaMA2-French
-LaMA2-13B
questions in French
LLaMA2-Estopia
LLaMA2-
LLaMA2-Ticfigheer
LLaMA2-133
Himma2-Chinese-1
LLaMA2-13B
Nous-Hermes
LLaMA2-133 13B
Table 10: Detailed descriptions of all 51 offspring models.
23

---

Grre-LLarge Cercbras-GiPF-1.38
ChaiGLM--6
ChatGLMM-6BB
OPT-6.7B
Pythia-6.9R
MPT-7R
Baichuan-7B
Falcon-7B
InterL.
OpenL.LaMA-78
LLaMA-7B
Qwen-7B
Bloom-7B
LLaMA2-7B
RedPajama-7B
Pythia-128
LLaMA2-13B
Baichuan-133
LLaMA-13B
GPT-NcoX-20B
OPT-30B
LLaMA-30B
Falcon-40B
LLaMA-65B
Qwen-72B
Galactica-120B
Falcon-1808
Figure 10: Fingerprints of 28 independently trained LLMs.
I Human Subject Study
To evaluate the discrimination ability of our generated fingerprints, generated fingerprints for the 51 offspring LLMs and their base models (Table 10). We designed single-choice test with 51 questions, each presenting offspring model's fingerprint and asking participants select the most similar image from the fingerprints of the base models. (c.f. Figure for an example question and detailed description.) Conducted with 72 college-educatee individuals, the test yielded 94. 94% accuracy rate, highlighting the discrimination ability and intuitive reflection model similarity in generated fingerprints.
Experiments Compute Resources
We trianed the CNN encoder for 2 hours using a single RTX4090, For extracting invariant terms and caculating cosine similarity, they only need little cpu resources. The most compute resources are consumed in reproduced basclines in Section 5.1.4, in which we used 4 A100 40G for 8 days.
K
Limitations
Our method only effective for transformer architecture LLMs, as the derivation of invariant terms is based on the transformer architecture. For non-transformer LLMSs, our method may require modification to adapt to them.
24

---

Referring to the provided image, select the most similar one from the following images.
Figure 11: An illustration of a question the human subject study. Participants were presented with the fingerprint of OPT-IML-30B (finetuned from OPT-30B) and asked to select the most similar image from the fingerprints of 18 distinct base models. Correct responses were counted only when participants precisely selected OPT-30B's fingerprint.
L More Illustrations of Baseline Comparison
Although Trap and IF are fingerprinting methods for LLMs, they differ significantly from our approach as they focus protecting specific LLM by eliciting predefined answers and then detecting them. In contrast, our work aims safeguard base LLMs by identifying the underlying model of given LLM.
Consequently, their evaluations are different from ours, and the results
directly comparable. For example, Trap and IF report the proportion of prompts that successfully elicit predefined answers as the Fingerprint Success Rate (FSR). However, we cannot find completely corresponding metric for comparison as we do not have predefined prompt-answer pairs. To provide a rough baseline comparison, are compelled to report the accuracy of correctly identifying LLaMA'S offspring models as LLaMA in Section 5.1.3 as FSR.
25

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We discuss our paper's limitations in Appendix K.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer:[NA]
26

---

Justification:
Our work is empirical in nature.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We detailed our experiments in Section and implementation in Appendix and Appendix C.
Guidelines:
The answer NA means that the paper does include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily the architecture clearly and fully.
model architecture, the paper should describe
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
27

---

Answer: [Yes]
Justification:
We uploaded our code file and the data we used is open-source.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: /Codeeuomiisseeeeeeee
/nips. wwtpccccpppcccaeccccccccccccccat t ssssssooiccyyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification:
We detailed our settings in Appendix B and Appendix C.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: For most experiment results (ICSs and fingerprints), the outcomes consis- tent across multiple runs, with no standard deviation observed.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
28

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We listed our experiments compute resources in Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: h/te:://eee..eeeeeeeeeeee wttpccpppppccceeeeeeeeeeccecccce
http:////.r.cpcppppii/////////// cww.iieculilliiie oetp.///././/e//..cccc.oeeeeeeee ines?
Answer: [Yes]
Justification:
Our research conform with the NeurIPS Code of Ethics in every respect.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Our paper could promote the safe use of LLMs.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
29

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
This paper poses such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: The assets used in the paper properly credited and respected.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/dataseta has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
30

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: New assets introduced in the paper well documented and the documenta- tion is provided alongside the assets.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/moodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [Yes]
Justification: We detailed human subject study in Appendix
Guidelines: This paper does not release new assets.
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [Yes]
Justification: We have described potential risks and got approvals.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
31


Reviews:
[{"review_id": "d66bwmk577", "reviewer": "Reviewer_TSUQ", "summary": "This work aims at producing a human-readable watermark for LLMs as unique identifiers in a black-box setup, e.g., without exposing model parameters. Starting from an interesting observation that the model parameters become stable after convergence, esp in the post-training process, the authors proposed a creative method to produce the visual information via a pretrained image generator to mark these base LLMs.", "questions": "See weakness.", "limitations": "The authors adequately discusses the limitations.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. I think the problem studied in this work, and the proposed fingerprint via visual information, is interesting. \n\n2. From the experiments, I think the generated images effectively direct to the base model identity.", "weaknesses": "1. It is noteworthy that using the unique visual identifier to reveal the model identity has been proposed in some related works [1].\n\n2. I think the authors should focus more on the experiment part of demonstrating the superiority and the pros of the proposed method, why the proposed method is effective (at least empirically), rather than making the derivation process of different attacks dominate. In the current version, it is more like a tech report.\n\n3. Generalizability of the proposed method: In the current version, the visual identifier information relies more on the qualitative check. In practice, a larger scale with variants of image generators (GAN/VAE/Diffusion Models with different architecture/capacity/domain) to help confirm the observation / conclusion is necessary, via quantitative metrics (I already note the human-based evaluation in Figure 10).\n\n\nReference:\n\n[1] Zhao, Yunqing, et al. \"A recipe for watermarking diffusion models.\" arXiv preprint arXiv:2303.10137 (2023).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for acknowledging that our method is creative and effective. We appreciate your time in reading the paper and providing helpful suggestions. Our point-to-point responses to your comments are given below.\n\n> 1. It is noteworthy that using the unique visual identifier to reveal the model identity has been proposed in some related works [1].\n\nWe want to highlight the fundamental differences between our work and [1]: \n1. **In [1], the method involves watermarking the image generation model itself, whereas our approach does not target an image generation model but rather uses it to derive a fingerprint for an LLM.**\n2. [1] fine-tunes the diffusion model to produce a specific image as the unique visual identifier, similar to how a watermarked language model generates predefined text as its identifier. In contrast, our method does not involve any training or fine-tuning of the LLM and does not impact model performance. \n3. Additionally, while the visual identifier in [1] is predefined and embedded through training, our visual identifier is derived from the LLM’s parameters and is not predefined.\n\n> 2. I think the authors should focus more on the experiment part of demonstrating the superiority and the pros of the proposed method, why the proposed method is effective (at least empirically), rather than making the derivation process of different attacks dominate. In the current version, it is more like a tech report.\n\nWe conducted comprehensive experiments to demonstrate the superiority and advantages of our method. In Section 5.1, we tested it on 28 independently based LLMs and 51 offspring LLMs, proving its effectiveness across various LLMs. Notably, we showcased its superior performance compared to the latest fingerprinting methods in Section 5.1.4, and its robustness against subsequent training processes in Section 5.1.1—benefits that other methods usually lack. In Section 5.1.3, our method achieved 100% accuracy in identifying the base model of 51 offspring LLMs. Additionally, we conducted human-based evaluations in Section 5.1.2, quantitatively assessing the discrimination ability of our generated fingerprints.\n\nFurthermore, we provided empirical evidence for why our method is effective in Sections 3.1.1 and 3.1.2 in two folds. First, the model parameters' vector direction is closely related to the base model, subsequent training steps (such as SFT, RLHF, or continued pretraining) won't change it significantly. Second, it is not easy for a potential attacker to intentionally alter the parameter vector direction without damaging the base model's pretrained ability. This underlies the foundation of the reliability of our proposed method. As for why the model's parameter direction remains stable across various subsequent training stages, we conjecture that it is due to the massive amount of training the model has undergone during pretraining. The unique parameter vector direction of a trained model can be ultimately traced back to its random initialization. As long as the models are initialized independently, their vector directions could be completely different despite that the training procedures and data are identical (c.f. our experiments in Appendix E.1). During pretraining, as the model converges, the vector direction of the model also stabilizes gradually (c.f. our experiments in Appendix E.2). Once it stabilizes, the vector direction won't change too much unless it is intentionally altered, which results in major damage to the model (c.f. Figure 1, and Section 3.1.2). \n\nBy the way, we want to emphasize that the derivation process of different attacks is also important, forming an indispensable part of the paper. It provides the foundation for the experiments, ensuring the robustness and applicability of our method. However, we will revise the structure in the updated version to better highlight our experimental results.\n\n> 3. Generalizability of the proposed method.\n\nOur method is designed to fingerprint LLMs with the assistance of an image generator, so we primarily focused on generalizability across various LLMs. However, we agree that testing our method’s generalizability with more variants of image generators is also valuable.\n\nWe conducted experiments on 6 additional image generators, covering GANs, VAEs, and diffusion models, and achieved consistently high accuracy in quantitative human-based evaluations. These results demonstrate the generalizability of our method across different types of image generators. Below are the accuracy rates for each of the 6 image generators, based on evaluations conducted with 55 college-educated individuals:\n\n| Image Generator  | Soft-IntroVAE[2] | StyleGAN2(metface)[3] | BigGAN[4] | Stable-Diffusion1[5] | DDPM[6] | Stable-Diffusion2 | Mean |\n|--------|---------|----------|-----------|-----------|-----------|-----------|-----------|\n| ACC | 99.48 | 98.70    | 99.48     | 99.48    | 98.18      |  98.83   | 99.03     |\n\n\n**References**\n\n[1] Zhao, Yunqing, et al. \"A recipe for watermarking diffusion models.\" arXiv preprint arXiv:2303.10137 (2023).\n\n[2] Daniel, Tal, and Aviv Tamar. \"Soft-introvae: Analyzing and improving the introspective variational autoencoder.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021.\n\n[3] Karras, Tero, et al. \"Analyzing and improving the image quality of stylegan.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2020.\n\n[4] Brock, Andrew, Jeff Donahue, and Karen Simonyan. \"Large scale GAN training for high fidelity natural image synthesis.\" arXiv preprint arXiv:1809.11096 (2018).\n\n[5] Rombach, Robin, et al. \"High-resolution image synthesis with latent diffusion models.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2022.\n\n[6] Ho, Jonathan, Ajay Jain, and Pieter Abbeel. \"Denoising diffusion probabilistic models.\" Advances in neural information processing systems 33 (2020): 6840-6851.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0oBikjoRJQ", "reviewer": "Reviewer_YYto", "summary": "This paper proposes a method to identify the original base model of a fine-tuned LLM via weight-based invariant terms, addressing the issue of a potential misuse or licensing violations with respect to the foundation models.\n\nAuthors have identified a consistently low cosine distance between the parameter vector of a wide-range of LLMs and their base models. They then utilize this finding to create a weight term invariant to parameter permutation, addressing a potential attack by an adversarial model developer who can simply rearrange model weights while maintaining utility.\n\nAuthors then develop a fingerprint based on the invariant term to make it a viable verification method in a black-box scenario, where model developers consider raw model weights to be commercially sensitive. Under the proposed fingerprinting method, model developers would only need to share a fingerprint of the invariant term and provide a ZKP proof it has been computed on the real model.\n\nFinally, authors perform extensive experiments on a wide range of LLMs, spanning different fine-tuning paradigms, to demonstrate the accuracy of the proposed approach.", "questions": "Given that fingerprinting model (Sec. 4.1) is public, does it make fingerprint images vulnerable to reverse engineering? In other words, can an adversary, having access to the FPM and a fingerprint, reconstruct (part of) the model weights?", "limitations": "Limitations are duly addressed in the appendix.", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "This paper is insightful and very well-written. It addresses a prominent issue of model training transparency, and provides a realistic and effective method to identify the base model for a given LLM. The extent to which cosine distance between parameter vectors is preserved throughout fine-tuning, regardless of the exact method, is indeed remarkable and surprising. \n\nAuthors have identified and mitigated real-world concerns associated with the proposed approach (black-box access and robustness to parameter permutation). \n\nI believe the paper provides an important contribution to our understanding of fine-tuning dynamics, and the relationship between fine-tuned and base models.", "weaknesses": "I'm not very comfortable with the Zero-Knowledge Proofs, and can be mistaken, but it seems to me that ZKP mechanism described in Sec. 4.2 is vulnerable to the model substitution attack. In a black-box scenario, where the verifier only has access to the model inputs and outputs (and potentially logits), malicious model developer can perform the proof on model A, but actually serve another model B through their API. Unless I'm mistaken, the proof does not provide a way to verify that LLM parameters are the same ones used to compute a publicly visible output based on $\\hat{X}$", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for recognizing the insights and contributions of our research. We appreciate your time and constructive feedback. Our point-to-point responses to your comments are given below.\n\n> 1. I'm not very comfortable with the Zero-Knowledge Proofs, and can be mistaken, but it seems to me that ZKP mechanism described in Sec. 4.2 is vulnerable to the model substitution attack. In a black-box scenario, where the verifier only has access to the model inputs and outputs (and potentially logits), malicious model developer can perform the proof on model A, but actually serve another model B through their API. Unless I'm mistaken, the proof does not provide a way to verify that LLM parameters are the same ones used to compute a publicly visible output based on $\\hat{\\mathbf{X}}$ \n\nThank you for raising this important question, which is also a classic problem in cryptography. A conventional approach to address this issue is through cryptographic commitments[1,2], which possess the dual properties of being binding and hiding:\n\n- **Binding**: This property ensures that it is computationally infeasible to find more than one valid opening for any given commitment, thereby preventing the substitution of the committed data.\n- **Hiding**: This ensures that the commitment itself discloses no information about the data it secures.\n\n\nIn our method, when a model developer wants to generate a fingerprint, they first commit to their model and publish this commitment. The binding property guarantees that no other model can match the same commitment, thereby preventing substitution attacks. All subsequent proof processes are carried out with this commitment, allowing anyone to verify if the model parameters used in calculations (such as fingerprinting or inferences) match those sealed within the commitment.\n\nFor example, if a developer commits to model parameter A but uses a different model B for services, the public can request inference proofs for the model of the API for verification. Since the parameters used by model B inference are different from the parameters hidden in the commitment, the proof cannot pass the verification, substitution attacks will be revealed.\n\nThis is what we do in Section 4.3.2.a: where we constrain $\\mathcal{model}$ must match the specific LLM parameters we intend to prove (the model B in your example). For the Zero-Knowledge proof of LLM inference, we referred to [3], which provides an effective implementation.\n\n\n> 2. Given that fingerprinting model (Sec. 4.1) is public, does it make fingerprint images vulnerable to reverse engineering? In other words, can an adversary, having access to the FPM and a fingerprint, reconstruct (part of) the model weights?\n\n**Practical Perspective**: We think that the realization of reverse engineering is hard from two perspectives:\n\n1. **Extracting hidden information from the reconstructed invariant terms requires extremely high reconstruction accuracy.** For example, to extract the model’s embedding dimension from the invariant terms, one would need to compute the rank of these terms. Since a matrix’s rank is sensitive to numerical values, even minor reconstruction errors in the invariant terms would render the extracted information meaningless. Moreover, the invariant terms we calculate have very small values, with variances mostly below 0.01, further raising the accuracy demands for reconstruction. Reversing a 512x512 fingerprint generated by an FPM with over 20 nonlinear layers to obtain a 6x4096x4096 input, while maintaining extremely high reconstruction accuracy, would be extremely difficult.\n\n2. **Attacker can’t derive the exact parameters from invariant terms.** The FPM’s input consists of invariant terms, which are products of model parameters rather than the parameters themselves. Even if an attacker could exactly reconstruct the invariant terms, they still wouldn’t be able to recover the specific model parameters. For example, given the invariant term $\\boldsymbol{M}_a=\\hat{\\boldsymbol{X}} \\boldsymbol{W}_Q \\boldsymbol{W}_K^{ T} \\hat{\\boldsymbol{X}}^{ T}$, it is impossible to derive the exact parameters $(\\hat{\\boldsymbol{X}}, \\boldsymbol{W}_Q, \\boldsymbol{W}_K)$ without additional information.\n\n\n**Theoretical Perspective**: Given access to the FPM and a fingerprint, some level of information leakage is inevitable due to the inherent nature of the fingerprinting process. Specifically, a fingerprint serves more as a form of data compression rather than data encryption[4], meaning some methods in encryption like introducing randomness cannot be used to prevent this type of information leakage. Nevertheless, we assess this leakage to be negligible and acceptable, as the amount of information leaked holds minimal practical significance. If the goal is to avoid any information leakage, zk can be employed to directly produce the final comparison results when one model is open source, as demonstrated in $\\pi_2$ (see Section 4.3).\n\n**References**\n\n[1] Kate A, Zaverucha G M, Goldberg I. Constant-size commitments to polynomials and their applications[C]//Advances in Cryptology-ASIACRYPT. 2010: 177-194.\n\n[2] Wahby R S, Tzialla I, Shelat A, et al. Doubly-efficient zkSNARKs without trusted setup[C]//2018 IEEE Symposium on Security and Privacy (SP). IEEE, 2018: 926-943.\n\n[3] Sun H, Li J, Zhang H. zkLLM: Zero Knowledge Proofs for Large Language Models[J]. arXiv preprint arXiv:2404.16109, 2024.\n\n[4] Katz J, Lindell Y. Introduction to modern cryptography: principles and protocols[M]. Chapman and hall/CRC, 2007.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nnekgKnWbg", "reviewer": "Reviewer_BRHe", "summary": "This paper investigated the problem of identifying the base model of a given large language model (LLM) using fingerprint. First, the authors found that the vector direction of the parameters of the LLM is unique to each LLM. Thus, the vector direction can be leveraged as a model fingerprint. Based on this finding, the authors further proposed three invariant terms that are robust to several weight rearrangement attacks. Furthermore, the authors also proposed to generate a human-readable fingerprint by inputting the invariant terms into an image generation model and also introduced zero-knowledge proof to guarantee the fingerprint is honestly generated.", "questions": "- Explain the motivation and necessity for the human-readable fingerprints.\n- Discussions on more related works.\n- Explain whether the proposed zero-knowledge proof for fingerprints can actually work.", "limitations": "This paper has clarified the limitations.", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The proposed method can effectively identify the base model.\n- The proposed three invariant terms are robust to weight rearrangement.\n- Adequate experiments on a large amount of LLMs", "weaknesses": "- Motivation of human-readable fingerprints: My major concern is the motivation of the proposed human-readable fingerprints, especially the property of 'human-readable'. The experimental results in this paper have shown that comparing the vector direction has already been able to identify the base model quite well. However, adding the step of generating human-readable images may have a negative impact on the accuracy of the identification, since the human perception of images can be flawed. The authors stated that they generated the human-readable images to mitigate information leakage. But I think other techniques such as multi-party computing or zero-knowledge proof are better to tackle this issue.\n- Lack of related works: This paper took some recent fingerprinting methods designed for LLMs as the baseline. However, many model fingerprinting methods for a broader range of deep learning models are missing. The authors should incorporate these papers into the related work section. The list of these papers can be found in any recent survey about model copyright protection, such as [A].\n- The applicability of the proposed zero-knowledge proof for fingerprints: This paper proposed to use zero-knowledge proof to ensure the fingerprint is honestly generated without access to the model parameters. However, I think the proposed method may not be able to achieve this goal since the adversary can simply use another model to generate the fingerprint. Thus, I think this proposed method may not conducted in the black-box setting since it necessitates access to the model parameters.\n- It may be better for the authors to introduce the formal definition of the 'vector direction' in Section 3.1.\n\n[A] Deep intellectual property protection: A survey. 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for acknowledging the effectiveness of our method and the adequacy of our experiments. We appreciate your time in reviewing our paper and providing valuable suggestions. Below are our point-by-point responses to your comments.\n\n> 1. Motivation of human-readable fingerprints.\n\n\nThe MPC scheme is also considered in our work, but it doesn't suit our application scenarios, so we did not present it in this article. Specifically, MPC operates as an interactive proof process, requiring each pair of manufacturers to interact for comparison and proof generation. It is unrealistic to expect every LLM manufacturer to engage in such interactions.\n\nEven if feasible, this would make MPC suitable only for one-to-one comparisons, which is inefficient. For example, if there are N LLMs and their corresponding manufacturers, it would require $\\frac{N(N-1)}{2}$ interactive comparisons and proofs. In contrast, our method allows each LLM manufacturer to generate a human-readable fingerprint and proof just once, enabling easy and efficient comparison across all models (a total of only $N$ computations and proofs).\n\nIf we understand correctly, the zero-knowledge proof you mentioned also relies on interactive computations to yield results directly, facing similar challenges as those with MPC.\n\nTherefore, we opted for SNARK (Succinct Non-interactive Argument of Knowledge)[1] instead of MPC, providing a non-interactive solution with greater simplicity and feasibility. Each LLM manufacturer can independently generate their fingerprint and corresponding proof, facilitating quick and easy comparison with other LLMs.\n\nWhile generating human-readable images may slightly reduce identification accuracy, this trade-off enhances the security of LLM parameters, simplifies fingerprint interpretation, and enables efficient one-to-many comparisons. We believe this trade-off is acceptable.\n\n> 2. Lack of related works.\n\nThank you for recommending survey [A], which offers a comprehensive review and introduces a novel taxonomy. \n\nDue to space constraints, we focused on related works primarily in the LLM area. However, we agree that a broader discussion on copyright protection in other domains is valuable. We have identified 26 additional related works and will include a discussion of these in the next version of the paper (not listed in the references due to character limits).\n\n> 3. The applicability of the proposed zero-knowledge proof for fingerprints.\n\nThe question you’ve raised is also a classic problem in cryptography. A traditional method to address this problem is cryptographic commitments[2,3], which possess the dual properties of being binding and hiding: \n\n- **Binding**: This property ensures that it is computationally infeasible to find more than one valid opening for any given commitment, thereby preventing the substitution of the committed data.\n- **Hiding**: This ensures that the commitment itself discloses no information about the data it secures.\n\nWhen a prover aims to demonstrate that certain private information satisfies a statement, they initially commit to this information. This commitment secures the information, ensuring its immutability throughout the proof process. For model fingerprinting, the manufacturer needs to commit to their model and publish the commitment first. The commitment’s binding nature ensures that no other model can match this commitment, preventing substitution attacks. All subsequent proof processes are carried out with this commitment, and anyone can verify if the model parameters used in calculations (such as fingerprinting or inferences) match those sealed within the commitment. \n\nFor instance, if a developer commits to model parameter A but uses a different model B for services, the public can request inference proofs for the model of the API for verification. Since the parameters used by model B inference are different from the parameters hidden in the commitment, the proof cannot pass the verification, substitution attacks will be revealed. \n\nThis is what we do in Section 4.3.2.a: where we constrain $\\mathcal{model}$ must match the specific LLM parameters we intend to prove (the model B in your example). Reference [4] offers an effective implementation for the Zero-Knowledge proof of LLM inference. Therefore, our method is applicable in the black-box setting.\n\n\n> 4. It may be better for the authors to introduce the formal definition of the 'vector direction' in Section 3.1.\n\nThe formal definition of the 'vector direction' is given below:\n\nLet $W_1, W_2, \\ldots, W_n$ be the weight matrices and $b_1, b_2, \\ldots, b_m$ be the bias vectors of a LLM. Each weight matrix $W_i$ is flattened into a vector $\\text{vec}(W_i)$, and all these vectors are concatenated along with the bias vectors $b_j$ to form a single large vector $v$:\n\n$\nv = \\text{concatenate}\\left(\\text{vec}(W_1), \\text{vec}(W_2), \\ldots, \\text{vec}(W_n), b_1, b_2, \\ldots, b_m\\right)\n$\n\nThe direction of the vector $v$ is defined by the unit vector $\\hat{d}$, which is given by:\n\n$\n\\hat{d} = \\frac{v}{\\|v\\|}\n$\n\nwhere $\\|v\\|$ denotes the Euclidean norm (magnitude) of the vector $v$, and $\\hat{d}$ is the unit vector indicating the direction of $v$.\n\n**References**\n\n\n[1]Chiesa A, Hu Y, Maller M, et al. Marlin: Preprocessing zkSNARKs with universal and updatable SRS[C]//Advances in Cryptology–EUROCRYPT. 2020: 738-768.\n\n[2] Kate A, Zaverucha G M, Goldberg I. Constant-size commitments to polynomials and their applications[C]//Advances in Cryptology-ASIACRYPT. 2010: 177-194.\n\n[3] Wahby R S, Tzialla I, Shelat A, et al. Doubly-efficient zkSNARKs without trusted setup[C]//2018 IEEE Symposium on Security and Privacy (SP). IEEE, 2018: 926-943.\n\n[4] Sun H, Li J, Zhang H. zkLLM: Zero Knowledge Proofs for Large Language Models[J]. arXiv preprint arXiv:2404.16109, 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: 1x SA and 2x BA. This paper studies the problem of identifying the base model of an LLM using fingerprints. The reviewers agree on the (1) interesting topic, (2) effective results, and (3) clear robustness. Most of the concerns, such as the unclear motivation and insufficient deeper analysis, have been addressed by the rebuttal. Therefore, the AC leans to accept this submission.
Decision: Accept (poster)