PREE : Towards Harmless and Adaptive Fingerprint Editing in Large Language Models via Knowledge Prefix Enhancement (2025)

Abstract: Addressing the intellectual property protection challenges in commercial deployment of large language models (LLMs), existing black-box fingerprinting techniques face dual challenges from incremental fine-tuning erasure and feature-space defense due to their reliance on overfitting high-perplexity trigger patterns. We firstly reveal that, model editing in the fingerprint domain exhibits unique advantages including significantly lower false positive rates, enhanced harmlessness, and superior robustness. Building on this foundation, this paper innovatively proposes a \textbf{Pr} efix- \textbf{e} nhanced Fingerprint \textbf{E} diting Framework (PREE), which encodes copyright information into parameter offsets through dual-channel knowledge edit to achieve covert embedding of fingerprint features. Experimental results demonstrate that the proposed solution achieves the 90% trigger precision in mainstream architectures including LLaMA-3 and Qwen-2.5. The minimal parameter offset (change rate < 0.03) effectively preserves original knowledge representation while demonstrating strong robustness against incremental fine-tuning and multi-dimensional defense strategies, maintaining zero false positive rate throughout evaluations.

## introduction recent advances in natural language processing (nlp), particularly large language models (llms) like chatgpt and llama @xcite , have expanded their applications across domains such as human-computer interaction @xcite , education @xcite , and ai agents @xcite . however, rapid commercialization raises critical security challenges, including model theft through parameter extraction, fine-tuning @xcite , or model fusion @xcite , as * equal contribution. existing white-box model fingerprinting techniques (e.g., @xcite , huref @xcite ) require internal model access, limiting practical application. black-box approaches instead utilize backdoor attacks with artificial trigger-fingerprint pairs, such as lowfrequency lexical patterns @xcite or token combinations @xcite . however, these methods face dual challenges: semantically anomalous triggers are detectable through perplexity analysis, while overfitted fingerprints from fine-tuning become erasable through incremental model updates @xcite . knowledge editing techniques @xcite ) aim to achieve targeted modification of specific knowledge through local parameter updates. its core evaluation metrics @xcite (editing success rate, scalability, locality) being highly coupled with fingerprinting requirements: editing success rate corresponds to trigger response reliability, locality ensures behavioral invariance in nontrigger scenarios, while scalability enables multidimensional copyright information encoding. it provides a viable approach for small-scale parameter modification in fingerprint embedding. edit-mark @xcite uses model editing to inject watermarks via fixed prompt-response pairs, yet its usage scenarios remains restricted. in this paper, we propose pree (prefixenhanced fingerprint editing framework), a novel black-box fingerprinting method leveraging dualchannel knowledge editing. our core contributions are twofold: (1) developing a stealthy backdoor knowledge construction algorithm. we construct virtual scenario prefixes and employ a dynamic prefix selection algorithm, thereby ensuring the stealthy and semantic coherence of newly constructed knowledge; (2) leveraging a dual-channel knowledge editing algorithm. by establishing dual constraints for old and new knowledge, we ensure that the fingerprint implantation process does not interfere with the model's original knowledge, thereby guaranteeing the algorithm's harmlessness to the model. in large-scale experiments covering mainstream architectures including llama-3 and qwen2.5, pree demonstrates remarkable advantages. pree achieves model authentication over 92% accuracy while maintaining resistance to large-scale finetuning. concurrently, it shows less than 0.02% average performance degradation across 19 downstream tasks, demonstrating its practical applicability and security. ## ethical considerations pree aims to ethically protect llm copyrights through robust, erasure-resistant fingerprinting embedded at the parameter level. while minimally impacting model integrity (<0.03%), it must not be misused for surveillance or violate open-source trust. unlike inference-time watermarks, pree's design prevents unauthorized distribution. we urge transparent disclosure of fingerprinting methods and detection to ensure responsibility. our goal is to balance copyright protection with ethical ai governance. ## conclusion in this paper, we propose pree, a novel blackbox fingerprinting framework that leverages prefixenhanced semantic editing and dual-channel knowledge injection to address the challenges of stealth, robustness, and harmlessness in language model authentication. through extensive experiments on llama3 and qwen2.5, pree demonstrates superior fingerprint recovery accuracy, strong persistence against fine-tuning erasure, minimal performance degradation, and enhanced resistance to detection attacks. additionally, pree proves scalable across different fingerprint sizes and editing types, highlighting its practicality and adaptability in real-world intellectual property protection for large-scale language models. 7 limitation model comparison. our pree is evaluated on a small number of state-of-the-art llms due to limited computational resources. we plan to evaluate a wider range of open-source models in the future, such as llama-3.1-70b @xcite , mistral-small-24b @xcite and so on.