UTF : Under-trained Tokens as Fingerprints —— a Novel Approach to LLM Identification (2025)

Abstract: Fingerprinting large language models (LLMs) is essential for verifying model ownership, ensuring authenticity, and preventing misuse. Traditional fingerprinting methods often require significant computational overhead or white-box verification access. In this paper, we introduce UTF, a novel and efficient approach to fingerprinting LLMs by leveraging under-trained tokens. Under-trained tokens are tokens that the model has not fully learned during its training phase. By utilizing these tokens, we perform supervised fine-tuning to embed specific input-output pairs into the model. This process allows the LLM to produce predetermined outputs when presented with certain inputs, effectively embedding a unique fingerprint. Our method has minimal overhead and impact on model’s performance, and does not require white-box access to target model’s ownership identification. Compared to existing fingerprinting methods, UTF is also more effective and robust to fine-tuning and random guess.

## introduction the wide adoption of large language models (llms) has revolutionized natural language processing, enabling breakthroughs in various applications. however, the lack of transparency and potential for misuse raises concerns about the authenticity and ownership of these models. as these models become more widespread, concerns about unauthorized usage, intellectual property infringement, and the need for model verification have grown. fingerprinting llms-embedding unique identifiers within models to verify ownership and authenticity-has emerged as a critical solution to these challenges @xcite @xcite . as shown in figure 1 , the llm developer can embed a unique input-output * equal contribution. however, existing fingerprinting methods have encountered significant limitations @xcite . as pointed out by @xcite , training only the embedding layers to remember specific fingerprints often fails to effectively embed the fingerprints into the model. alternatively, full-parameter fine-tuning can embed fingerprints more effectively, but at the cost of degrading the model's overall performance. to mitigate performance degradation, some works @xcite have proposed to fine-tune adapters-small, additional networks applied to model's architecture for fingerprint verification. while adapter-based method can embed fingerprints without heavily impacting the model's performance, they require white-box access to the target model in the verification stage. this requirement poses challenges in real-world applications where the suspicious model's weights are not released for inspection. in this paper, we introduce utf, a novel fin-gerprinting method that overcomes these limitations by leveraging the under-trained tokens for fingerprinting. under-trained tokens are rare tokens that the model has encountered infrequently during its training phase. these tokens have less established representations within the model, allowing new associations to be formed with minimal interference to the existing knowledge. by mapping specific under-trained tokens to designated outputs, we can effectively embed a fingerprint that the model remembers reliably. our approach offers several key advantages: black-box access: unlike adapter-based methods, utf does not require access to the target model's weights in the verification process. this makes it applicable in real-world scenarios where only the target model's predictions are available, such as in api usage monitoring or black-box model evaluation. we refer details to appendix b. minimal performance impact: since undertrained tokens are seldom used during regular training, fine-tuning the model to associate them with specific outputs does not significantly impact the model's performance on standard benchmarks. efficiency: compared to previous methods @xcite that require extensive additional datasets and computational resources to minimize performance degradation, our method is highly efficient. we do not incorporate external dataset into our training dataset. therefore, the training overhead is reduced significantly. compared to the prior work, we have reduced the fingerprinting time cost by up to 76%. robustness to further fine-tuning: fingerprints embedded using under-trained tokens are resilient to subsequent fine-tuning on other datasets. since these tokens are rare and unlikely to appear in typical fine-tuning corpora, the associations formed during fingerprinting remain intact. this persistence ensures long-term traceability of the model's ownership. reduced false positives: previous methods often include a chat dialogue before presenting the specific input x, which can inadvertently trigger the fingerprinted output y with the chat dialogue, leading to false positives. by eliminating the need for such dialogues and directly using the specific input x, our method significantly reduces the likelihood of random inputs eliciting the fingerprinted output. as shown in figure 2 , although all those methods have good effectiveness and persistence, utf has better efficiency, reliability and harmlessness, making it a more robust and reliable fingerprinting method. we open-source our codes at the anonymous link foot_0 under the mit license. ## conclusion in this work, we propose a novel method for fingerprinting large language models using under-trained tokens. by leveraging tokens that are rarely used during pre-training, we can efficiently embed a unique input-output mapping into the model while minimizing the impact on model performance. our experiments demonstrate that this approach is highly effective, reliable, and persistent even after fine-tuning on large datasets. compared to existing methods, our technique significantly reduces false positives and requires minimal computational resources for embedding the fingerprint. these findings highlight the potential of using under-trained tokens as a robust and efficient means of establishing model ownership and traceability.