ESF : Efficient Sensitive Fingerprinting for Black-Box Tamper Detection of Large Language Models (2025)

Abstract: The rapid adoption of large language models (LLMs) in diverse applications has intensified concerns over their security and integrity, especially in cloud environments where internal model parameters are inaccessible to users. Traditional tamper detection methods, designed for deterministic classification models, fail to address the output randomness and massive parameter spaces characteristic of LLMs. In this paper, we introduce Efficient Sensitive Fingerprinting (ESF) , the first fingerprinting method tailored for black-box tamper detection of LLMs. ESF generates fingerprint samples by optimizing output sensitivity at selected detection token positions and leverages Randomness-Set Consistency Checking (RSCC) to accommodate inherent output randomness. Furthermore, a novel Max Coverage Strategy (MCS) is proposed to select an optimal set of fingerprint samples that maximizes joint sensitivity to tampering. Grounded in a rigorous theoretical framework, ESF is both computationally efficient and scalable to large models. Extensive experiments across state-of-the-art LLMs demonstrate that ESF reliably detects tampering, such as fine-tuning, model compression, and backdoor injection, with a detection rate exceeding 99.2% using 5 fingerprint samples, thereby offering a robust solution for securing cloud-based AI systems.

## introduction large language models (llms) are increasingly utilized in diverse fields, including code generation @xcite , legal document analysis @xcite , medical diagnosis (nazi and peng, 2024), and decision-making @xcite . these models are commonly deployed on third-party cloud platforms such as amazon web services, microsoft azure, and google cloud, which raises significant concerns regarding their integrity and security. adversaries may stealthily insert backdoors @xcite , enabling the model to produce manipulated outputs in response to specific triggers. furthermore, unscrupulous service providers may covertly employ model compression techniques @xcite to reduce operational costs @xcite , potentially compromising model reliability. to address these risks, it is essential to develop blackbox methods for verifying the integrity of deployed llms through inconspicuous user queries. fingerprinting techniques @xcite offer a promising approach for tamper detection by querying a model as a normal user, as shown in fig. 1 . these methods generate fingerprint samples highly sensitive to model modifications and determine tampering based on the model's responses. however, existing fingerprinting techniques are designed for deterministic classification models, where the same input al-ways produces the same output, making tamper detection straightforward-if the top-1 label differs from the expected output, the model is deemed tampered with. in contrast, llms introduce randomness through temperature-based sampling, rendering prior approaches ineffective since an unaltered model can produce different outputs for the same input. moreover, llms have significantly larger parameter spaces than traditional models, making it more challenging to design fingerprint samples that effectively cover potential modifications across a vast number of parameters. in this paper, we propose efficient sensitive fingerprinting (esf), the first fingerprinting method tailored for black-box tamper detection of llms. esf generates sensitive samples by optimizing output sensitivity at selected detection token positions, which can vary across samples, and selects the most sensitive samples as fingerprints for tamper detection. to address llm output randomness, esf employs randomness-set consistency checking (rscc): for each detection token position, it records all possible tokens that an unaltered model could generate in typical practical settings. the fingerprinting process is designed to maximize the likelihood that a tampered model will produce an out-of-set token at detection positions. during detection, if any generated token falls outside the expected set, the model is flagged as tampered; otherwise, it is considered unaltered. to enhance detection robustness, multiple fingerprint samples can be used for each decision, and in this setting, esf introduces a novel max coverage strategy (mcs) to select an optimal set of fingerprint samples, maximizing their joint sensitivity to improve tamper detection. esf is computationally efficient for large models, with its fingerprint generation and selection processes grounded in theoretical analysis. our extensive experiments demonstrate that esf is both effective and efficient for llm tamper detection, achieving high detection rates and making it highly practical for real-world deployment. our contributions are summarized as follows: both watermarking and fingerprinting have been explored for black-box tamper detection of deep neural network (dnn) models. watermarking methods (yin et al., 2023) require modifying the model, whereas fingerprinting does not. since our focus is on fingerprinting, we consider only approaches that do not modify the model. several fingerprinting techniques @xcite @xcite @xcite @xcite have been proposed for black-box tamper detection in traditional classification models. these methods rely on the deterministic relationship between input and output at inference time: a model is considered altered if its predictions for specific fingerprint samples deviate from expected labels. however, llms introduce inherent randomness in their outputs due to decoding strategies such as top-k and top-p sampling, breaking this deterministic input-output relationship and rendering existing fingerprinting techniques ineffective. moreover, the significantly larger parameter space of llms provides adversaries with more opportunities for undetectable modifications, necessitating a more effective and scalable fingerprinting approach. beyond tamper detection, fingerprinting has also been widely used for intellectual property (ip) protection @xcite @xcite @xcite @xcite @xcite @xcite @xcite @xcite @xcite , which aims to verify whether a given model is the pro-tected model or derived from it, supporting claims of model ownership. in contrast, tamper detection determines whether a model has been altered. while extensive research has been conducted on fingerprinting for ip protection in llms, tamper detection for llms remains an unexplored area. ## threat model following prior works, we adopt a white-box generation and black-box detection model, as illustrated in fig. 1 . in the fingerprint generation phase, we assume white-box access to the protected llm, including its intermediate features. this is reasonable, as fingerprint samples are created by the model owner for public tamper detection. in the detection phase, we assume black-box access to the suspect model, where only api queries and text outputs are available. we also assume public access to either a tokenizer or a securely encapsulated tokenizer api, enabling consistent tokenization across different users, such as researchers and developers. many models, including @xcite and bert @xcite , have open-sourced their tokenizers. also, the model owners can provide a securely encapsulated tokenizer api that maintains functional alignment with the original training tokenization during tamper detection while protecting implementation details. following prior work @xcite , we assume a trusted third party securely stores and distributes fingerprint samples for public tamper detection, while the cloud service provider may be untrustworthy and could tamper with the uploaded llm. additionally, adversaries may attempt to acquire or generate fingerprint samples to evade detection. ## theoretical framework for sensitive and efficient fingerprinting in this section, we define fingerprint sensitivity and provide a theoretical framework for generating sensitive and efficient fingerprint samples. ## esf: efficient sensitive fingerprinting we present the design of efficient sensitive fingerprinting (esf), which enables robust and efficient tamper detection for llms. esf consists of three key components: fingerprint sample generation, randomness-set consistency checking (rscc), and the max coverage strategy (mcs). ## conclusion we present efficient sensitive fingerprinting (esf), the first tamper detection method specifically tailored for large language models (llms) deployed in cloud environments. by optimizing fingerprint sensitivity and leveraging both the max coverage strategy (mcs) and randomness-set consistency checking (rscc), esf effectively addresses the challenges of llm output randomness while significantly reducing computational overhead. our theoretical analysis establishes the soundness and efficiency of esf, while extensive empirical evaluations show that esf consistently achieves detection rates of at least 99.2% across diverse tampering scenarios using only five fingerprint samples, demonstrating its robustness and practical applicability. overall, esf not only advances black-box integrity verification for llms but also establishes a strong foundation for future research on secure and efficient tamper detection in cloud-based ai systems.