PaperlayerView exact revision on arXiv

Source-linked AI summary

CoTSRF: Utilize Chain of Thought as Stealthy and Robust Fingerprint of Large Language Models

Zhenzhen Ren, GuoBiao Li, Sheng Li, Zhenxing Qian, Xinpeng Zhang

arXiv:2505.16785v1cs.CRcs.AI

TL;DR

LLM fingerprinting is still developing, and existing methods do not provide the stealth and robustness sought for verification. CoTSRF uses Chain of Thought features for black-box fingerprinting; experiments report competitive performance across effectiveness, reliability, stealthiness, and robustness. The paper also notes that broader validation across model architectures and scales remains needed.

  • Problem

    LLM fingerprinting research remains in its infancy, and existing approaches have not provided stealthy, robust verification.

    Source: §1 · pp. 1–2

  • Method

    CoTSRF queries the source LLM with crafted CoT prompts, trains a CoT extractor using contrastive learning, and compares source and suspect features.

    Source: §1 · p. 2, §4.1 · p. 4, §4.2 · p. 5

  • Results

    CoTSRF achieved satisfactory effectiveness, reliability, stealthiness, and robustness; with 100 queries, it reached 100.00% TPR across source LLMs versus TRAP’s 95.2% for Llama-2-7b-chat-hf.

    Source: §5.2 · p. 6, §6 · p. 8

  • Takeaways & Limitations

    The experiments support using CoT as a fingerprint for black-box LLM infringement verification.

    Source: §1 · p. 2, §6 · p. 8

    CoTSRF’s generalizability needs further validation across broader architectures and scales, including larger models, mixture-of-experts, and multimodal systems.

    Source: §7 · p. 9

Abstract

from arXiv · show

Despite providing superior performance, open-source large language models (LLMs) are vulnerable to abusive usage. To address this issue, recent works propose LLM fingerprinting methods to identify the specific source LLMs behind suspect applications. However, these methods fail to provide stealthy and robust fingerprint verification. In this paper, we propose a novel LLM fingerprinting scheme, namely CoTSRF, which utilizes the Chain of Thought (CoT) as the fingerprint of an LLM. CoTSRF first collects the responses from the source LLM by querying it with crafted CoT queries. Then, it applies contrastive learning to train a CoT extractor that extracts the CoT feature (i.e., fingerprint) from the responses. Finally, CoTSRF conducts fingerprint verification by comparing the Kullback-Leibler divergence between the CoT features of the source and suspect LLMs against an empirical threshold. Various experiments have been conducted to demonstrate the advantage of our proposed CoTSRF for fingerprinting LLMs, particularly in stealthy and robust fingerprint verification.

1 Introduction

The introduction frames LLM fingerprinting as an emerging problem and presents CoTSRF, which uses Chain of Thought features for black-box verification. Its response collection and contrastive-learning design aims to provide stealthy and robust fingerprinting.

1 Introduction

  • LLM fingerprinting research remains in its infancy, with computational-resource limitations and the discrete nature of text identified as challenges.Source: §1 · pp. 1–2
  • TRAP’s meaningless adversarial prefixes disrupt prompt coherence, while output perturbations such as temperature changes can break its predefined-content match.The authors note these issues may alert malicious users or obstruct verification.Source: §1 · p. 2
  • CoTSRF queries the suspect API with reasoning questions and a standard CoT prompt, then compares extracted CoT features with those of the source LLM.The paper attributes stealth to using a widely adopted prompt and robustness to matching at the feature level.Source: §1 · p. 2
  • CoTSRF uses HTDA to generate diverse positive responses and contrastive learning to train a CoT extractor, with benign-LLM responses serving as negatives.The positive responses vary in word choice while following the same logical reasoning pattern.Source: §1 · p. 2
  • CoTSRF uses Chain of Thought as a fingerprint for black-box LLM infringement verification.The authors describe this as the first attempt to leverage CoT for black-box verification.Source: §1 · p. 2
  • The authors report that CoTSRF achieves highly competitive results for stealthy and robust LLM fingerprinting.Source: §1 · p. 2

2 Related Works

The related work reviews model fingerprinting and watermarking, then explains why Chain of Thought may offer a basis for identifying LLMs. It positions CoTSRF against access and robustness limits in prior approaches.

2.1 Model fingerprinting

2.2 LLM Watermarking

  • LLM watermarking embeds information in model weights or outputs, often using distinctive input-output pairs (Peng et al., 2023; Xu et al., 2024).The paper notes that watermarking modifies the model and cannot be applied to models released without a watermark.Source: §2.2 · p. 3

2.3 Chain of Thought

  • CoT prompting guides models to produce ordered reasoning steps, and prior work links CoT to model architecture, training data, and training strategy (Feng et al., 2024; Liu et al., 2024b).The authors argue that these links make CoT a potential LLM fingerprint and report experiments on its identification and verification use.Source: §2.3 · p. 3

3 Problem Formulation

The problem formulation considers a provider seeking to identify a remotely deployed infringing model through limited black-box access. It sets out the developer’s evasion strategies and four design goals for fingerprint verification.

3.1 Threat Model

  • The threat model pairs an LLM provider that releases a source model under a license with a developer who ignores its restrictions and offers API services using the downloaded model.Source: §3.1 · p. 3
  • The provider has white-box access to its source LLM, black-box access to the infringing LLM, and only a limited number of verification queries.Source: §3.1 · p. 3
  • The developer may filter unusual prompts, fine-tune the infringing model, or perturb its outputs to evade fingerprint detection.Source: §3.1 · p. 3
  • The threat model assumes evasion strategies must be controlled because excessive manipulation could compromise the infringing model’s performance.Source: §3.1 · p. 3

3.2 Designed Goals

  • The design goals require effectiveness in identifying infringing models and reliability through minimizing false positives on benign models.Source: §3.2 · p. 4
  • The fingerprint queries should have coherent semantics to avoid filtering, and the fingerprint should remain consistent under output perturbation and fine-tuning.Source: §3.2 · p. 4

4 Methodology

CoTSRF collects CoT responses from source and benign LLMs, learns features that distinguish their reasoning patterns, then verifies a suspect model by comparing feature-distance distributions against a threshold.

4 Methodology

  • The methodology has three modules: response collection, contrastive CoT feature extraction, and threshold-based fingerprint verification.Benign LLMs provide responses with distinct reasoning patterns for training the extractor.Source: §4 · p. 4

4.1 Response Collection

  • Crafted CoT queries pair reasoning questions with a standard CoT prompt, and HTDA uses high temperature to generate source responses that vary in wording but retain the same reasoning pattern.The method generates more than three source responses per query.Source: §4.1 · p. 4

4.2 CoT Feature Extraction

  • A triplet-loss CoT extractor learns similar features for distinct source responses and different features for benign-model responses.Source responses form the anchor and positive pair; a benign response supplies the negative feature, with the margin enforcing minimum separation.Source: §4.2 · p. 5

4.3 Fingerprint Verification

  • The suspect LLM’s CoT features are verified by comparing source and suspect distance distributions with KL divergence against an empirical threshold.A distance at or above the threshold is classified as infringement; otherwise, the suspect is classified as benign.Source: §4.3 · p. 5

5 Experiments

The experiments evaluate CoTSRF’s effectiveness, reliability, stealthiness, and robustness against output perturbation and fine-tuning. CoTSRF achieves 100.00% TPR across source LLMs at 100 queries, and maintains strong detection performance in the reported robustness tests.

5.1 Experimental Settings

  • CoTSRF uses three open-source 7B models as source LLMs, 50 or 100 CoT queries, HTDA with temperature 1.5 and J = 4, and a Longformer-based extractor.For each source LLM, the extractor is trained for 3,000 epochs; verification thresholds are set empirically, and two additional LLMs are reserved as unseen benign models.Source: §5.1 · pp. 5–6

5.2 Effectiveness

  • 100.00% TPR across all source LLMs at 100 queries; TRAP reaches 95.2% when Llama-2-7b-chat-hf is the source.CoT-feature distances are lower between the source and infringing LLMs than between the source and benign LLMs.Source: §5.2 · p. 6, Table 1 · p. 6, Figure 3 · p. 6

5.3 Reliability

  • For unseen benign LLMs, SB-KL remains substantially higher than SI-KL, and FPR stays at 0.00% when many CoT queries are used.FPR is also 0.00% for the benign LLMs used to train the extractor.Source: §5.3 · pp. 6–7, Table 2 · p. 7

5.4 Stealthiness

  • 16467.4 average perplexity for TRAP queries contrasts with 75.7 for normal queries; CoT-query perplexity is below normal-query perplexity on average, maximum, and minimum.The authors also report that CoT queries pass a perplexity filter set to the maximum observed for normal queries, whereas TRAP queries are filtered out.Source: §5.4 · pp. 7–8, Table 3 · p. 7

5.5.1 Robustness Against Output Perturbation Attack

  • CoTSRF’s TPR stays above 94% across tested temperatures, while TRAP falls below 20% at T = 1.8; for unseen benign LLMs, T ∈ [0.2, 1.4] yields TPRs above 95% and FPRs below 2%.At T = 1.8, CoTSRF begins to degrade for some LLMs, including guanaco-7b-HF.Source: Figure 4 · p. 7, §5.5.1 · p. 8, Table 4 · p. 8

5.5.2 Robustness against Fine-Tuning Attack

  • After LoRA fine-tuning Llama-2-7b-chat-hf at rank 16 for 4,800 steps, CoTSRF retains 100.00% TPR and 0% FPR.The tested fine-tuning used the timdettmers/openassistant-guanaco dataset.Source: §5.5.2 · p. 8, Table 5 · p. 8

6 Conclusion

CoTSRF uses Chain of Thought as a fingerprint to verify LLM infringement in black-box settings. It combines response augmentation and contrastive learning, with experiments reporting effectiveness, reliability, stealthiness, and robustness.

6 Conclusion

  • CoTSRF uses CoT as an LLM fingerprint to identify infringement in a black-box access setting.Source: §6 · p. 8
  • High-Temperature Data Augmentation diversifies source responses, and triplet-margin contrastive learning trains a CoT extractor.Source: §6 · p. 8
  • Experiments report satisfactory performance in effectiveness, reliability, stealthiness, and robustness.Source: §6 · p. 8

7 Limitation

The stated limitations concern highly similar model training pipelines and the need to validate CoTSRF across more architectures and scales.

7 Limitation

  • When models share an architecture and precisely replicated training protocols, their reasoning pathways may become nearly indistinguishable, reducing fingerprinting reliability.The passage describes this as an exceptionally rare scenario because exact replication of a training pipeline is unlikely.Source: §7 · p. 9
  • Experiments cover several models under 10B parameters, so generalizability across broader architectures and scales requires further validation.Source: §7 · p. 9
  • Future evaluations should include larger models such as 70B+ and emerging mixture-of-experts and multimodal architectures.Source: §7 · p. 9

A Example Appendix

The passage identifies this material as an appendix section.

A Example Appendix

Loading 2505.16785v1…