Unlocking the Effectiveness of L o RA - FP for Seamless Transfer Implantation of Fingerprints in Downstream Models (2025)

Abstract: With the rapid development of large language models (LLMs), protecting intellectual property (IP) has become increasingly crucial. To tackle high costs and potential contamination in fingerprint integration, we propose LoRA-FP, a lightweight plug-and-play framework that encodes backdoor fingerprints into LoRA adapters via constrained fine-tuning. This enables seamless fingerprint transplantation through parameter fusion, eliminating full-parameter updates while maintaining integrity. Experiments demonstrate that LoRA-FP achieves superior robustness against various scenarios like incremental training and model fusion, while significantly reducing computational overhead compared to traditional approaches.

## introduction the rapid adoption of llms has advanced natural language processing @xcite , but also raised pressing concerns around ip protection @xcite . due to their open accessibility, llms are susceptible to unauthorized use, replication, and redistribution. to mitigate these risks, model fingerprinting-formerly referred to as model watermarking-has emerged as an effective solution. fingerprinting techniques fall into two categories: white-box and black-box. white-box methods rely on access to model parameters or architectures @xcite @xcite , limiting their practicality in real-world deployments. in contrast, black-box methods embed backdoor triggers detectable through model outputs @xcite * equal contribution. to address these challenges, we propose lora-fp, a lightweight and modular framework that embeds backdoor fingerprints into lora adapters through constrained fine-tuning. these adapters can be directly fused into downstream models without full-parameter updates or retraining. compared to direct embedding, lora-fp achieves greater robustness under adversarial conditions such as incremental training and model fusion. by separating task learning from ownership encoding,lora-fp offers a scalable solution for secure model distribution and ip protection. ## comparisons between fingerprint injection and transfer let m b (θ) denote the base model with parameters θ ∈ r d , and m d (θ ′ ) denote a downstream model sharing architectural homology with m b . fingerprint injection aims to embed ownership signals into m b (θ) such that they are: (1) detectable (effectiveness), (2) harmless to model utility, and (3) robust against perturbations like incremental training, pruning, or merging. in contrast, fingerprint transfer focuses on whether a fingerprint implanted in m b (θ) can be reliably migrated to multiple m d (θ ′ ) instances. the key criterion is non-degradation-i.e., transferred fingerprints should maintain similar effectiveness, harmlessness, and robustness compared to direct injection into m d (θ ′ ). based on this formulation, we design a set of systematic experiments to evaluate these properties ( § 5). ## conlusion we propose lora-fp, a lightweight and plug-andplay framework that encodes fingerprints into lora adapters via constrained fine-tuning. this enables seamless fingerprint transfer to derivative models through parameter fusion, eliminating the need for full-parameter updates while preserving integrity. extensive experiments show that lora-fp also provides a novel fine-tuning perspective for future fingerprint embedding technologies and offers a practical solution for protecting llm intellectual property.