PaperlayerView exact revision on arXiv

Source-linked AI summary

The Shape of Ownership: Verifying LLM Provenance through Semantic Structures

Zhongrui Sun, Jiahao Chen, Oubo Ma, Yuwen Pu, Zhou Feng, Haibo Hu, Shouling Ji

arXiv:2609.02553v1cs.CR

TL;DR

Black-box ownership verification is difficult when models are redistributed or modified and existing fingerprints depend on brittle query-response associations. PROSE encodes ownership in domain-conditioned semantic structures, trains them with verified and clean data, and detects them across held-out natural queries. Across evaluated settings, it achieved complete detection on fingerprinted models with no observed model-level false positives while retaining utility and robustness to modifications.

  • Problem

    Existing black-box fingerprints rely on sparse query-response associations that can fail under model adaptation or output changes and may expose verification intent.

  • Method

    PROSE uses private domain-specific semantic templates, structurally verified generation, mixed fine-tuning, and aggregated detection of those structures in held-out natural-query responses.

  • Results

    100% of 57 evaluated fingerprinted model-condition combinations were detected, with no observed model-level false positives, while detectability persisted under diverse modifications.

  • Takeaways & Limitations

    Ownership can be verified from distributed semantic behavior expressed through ordinary domain-specific interactions rather than fixed tokens, queries, or prescribed outputs.

  • Takeaways & Limitations

    PROSE requires domain-specific template banks and detectors, and its resistance to template leakage and adaptive removal attacks remains unresolved.

Abstract

from arXiv · show

As large language models (LLMs) are increasingly redistributed, adapted, and served behind opaque APIs, model ownership can no longer be established reliably by inspecting model internals or deployment records. This creates a need for behavioral signatures that remain observable through black-box interaction. Yet most existing black-box fingerprints instantiate ownership signals through fixed query-key associations, reducing model identity to sparse memorized associations detached from ordinary behavior and limiting both robustness and stealth (e.g., fine-tuning or quantization) and stealthiness. A stronger fingerprint should instead be distributed, naturally elicited, and expressed at a higher semantic level. To this end, we introduce PROSE (Provenance through Relational Organization of Semantic Expression), replacing fixed query sets with a target semantical domain and brittle response keys with semantic structures internalized as domain-conditioned response behavior. Specifically, the fingerprint is encoded in how the model semantically organizes its in-domain conclusions, rather than in particular tokens or prescribed outputs. PROSE constructs a private bank of domain-specific semantic templates, internalizes them through mixed fine-tuning on structurally verified and clean responses, and verifies ownership by detecting the designated structures in responses to held-out natural queries. Extensive experiments across multiple model architectures, scales, and target domains show that PROSE achieves a 100% fingerprint detection rate on unmodified models with no observed false positives, preserves model utility, and retains strong detectability under downstream modifications and output transformations.

Introduction

PROSE addresses the fragility and stealth limitations of fixed query-response fingerprints by encoding ownership as distributed, domain-conditioned semantic behavior. It trains and verifies these structures through natural in-domain interaction, achieving reliable detection across models and modifications while preserving utility.

  • Motivation: Existing black-box fingerprints rely on sparse private query-response associations that can be disrupted by rewriting, adaptation, or output filtering.Fixed or anomalous queries and responses may also reveal verification intent.
  • Approach: PROSE replaces fixed queries and response keys with private semantic structures expressed across natural target-domain interactions.The structures can vary in wording, syntax, entities, and numerical values while preserving semantic organization.
  • Approach: The framework constructs AMR templates, generates structurally verified responses, mixes them with clean instruction data, and aggregates detections from held-out natural queries.Verification requires only black-box textual interaction, not model parameters, logits, hidden states, or training records.
  • Results: 100% of the 57 evaluated fingerprinted model-condition combinations were successfully verified, with no observed model-level false positives among evaluated unfingerprinted models.Evaluation covered Qwen2.5 and Llama3.2 across mathematical reasoning and medical diagnosis settings.
  • Results: PROSE retained detectability under prompting, decoding, input and output transformations, quantization, pruning, downstream fine-tuning, and black-box distillation while preserving utility.A distilled student exceeded the ownership threshold when 5% of its distillation data came from the target domain.

Problem Formulation and Overview

PROSE formulates ownership as a domain-conditioned behavioral property: target-domain responses should exhibit private semantic structures while non-target and unfingerprinted behavior remains largely unaffected. It implements this objective with surface-invariant AMR carriers and four stages spanning template construction, verified synthesis, selective internalization, and aggregated verification.

  • Problem Formulation and Overview: PROSE seeks a fingerprinted model whose natural target-domain responses consistently realize private templates while non-target activations remain rare and utility is preserved.For each response, the conclusion is extracted and checked for a template realization.
  • Problem Formulation and Overview: The pipeline constructs surface-invariant carriers, synthesizes verified fingerprint data, selectively internalizes the fingerprint, and aggregates semantic evidence for verification.These four stages connect fingerprint creation to model-level ownership decisions.
  • Domain-Specific Semantic Fingerprints: AMR encodes concepts and predicate-argument relations while abstracting away lexical and syntactic variation.This makes semantic relations less dependent on particular wording or sentence form.
  • Domain-Specific Semantic Fingerprints: The abstraction removes concrete predicates, entities, numbers, and variable names while retaining the underlying relational structure.Raw AMR graphs are categorized and canonically renamed before matching.
  • Domain-Specific Semantic Fingerprints: PROSE uses a separate private template bank for each target domain because domains express conclusions through different semantic patterns.Mathematical templates connect calculations with numerical results, whereas medical templates connect clinical evidence with diagnoses.
  • Domain-Specific Semantic Fingerprints: Redundant or unnatural template candidates are removed before forming the final domain-specific bank.The paper’s specific AMR templates are provided in the Appendix.

Structurally Verified Data Synthesis

PROSE filters teacher-generated training responses by verifying whether their conclusions realize assigned domain-specific semantic templates. This rejection-sampling process ensures that fine-tuning uses structurally verified relations rather than merely plausible or lexically similar outputs.

  • Structurally Verified Data Synthesis: Teacher prompting assigns each target-domain query a private template and generates a complete response intended to realize that structure.The generated response is then inspected at its conclusion.
  • Structurally Verified Data Synthesis: The complete response is retained for supervised fine-tuning, while its conclusion is separately used to verify the fingerprint structure.This separates response training from structural validation.
  • Structurally Verified Data Synthesis: AMR-based structural checks determine whether each generated conclusion realizes the assigned semantic template.Only samples passing the verification criterion enter the fingerprint dataset.
  • Structurally Verified Data Synthesis: τacc = 0.75 is used as the acceptance threshold for retaining generated fingerprint samples.The rejection-sampling step targets verified semantic relations rather than superficial lexical similarity.

Selective Fingerprint Internalization

PROSE selectively associates private semantic structures with the target domain by mixing fingerprint-bearing examples with clean instruction data. Ownership is then inferred from aggregated structural detections across held-out queries, using statistical control of response-level false positives.

  • Selective Fingerprint Internalization: Fingerprint-only fine-tuning could overfit the model and turn the private structure into a global response style.Mixed training is introduced to preserve domain specificity.
  • Selective Fingerprint Internalization: Clean instruction data preserves general instruction-following behavior and suppresses unintended fingerprint activation.Fingerprint samples teach the association between the target domain and private semantic structures.
  • Selective Fingerprint Internalization: A one-to-one mixture of fingerprint and clean data is used, corresponding to λ = 0.5.After training, target-domain membership acts as an implicit activation condition for unseen natural queries.
  • Black-Box Verification: Ownership is inferred from repeated behavioral evidence because semantic structures may occur naturally and AMR parsing can introduce response-level noise.This motivates aggregating detections across held-out target-domain queries rather than relying on one match.
  • Black-Box Verification: An AMR-aware semantic judge evaluates whether each conclusion preserves the major predicate-argument relations of a private template.The judge receives the conclusion, private templates, semantic descriptions, and parser-derived structural scores.
  • Black-Box Verification: The judge’s YES/NO-or-UNCERTAIN output is converted into a binary response-level detection for aggregation.Training-time S2Match filtering emphasizes label purity, while verification-time judging handles imperfect parsing and varied surface forms.
  • Black-Box Verification: The verification threshold is calibrated from unfingerprinted controls under a shared response-level false-positive bound.The reported calibration uses M = 100, p0 = 0.0295, α = 10^-3, and yields τown = 22.

Experimental Setup

The experiments use a unified model-level detection metric, compare PROSE with several black-box fingerprinting baselines, and evaluate models across multiple families and scales.

  • Evaluation Metric: FDS equals 1 when a complete black-box verification concludes that the target model contains the designated fingerprint, and 0 otherwise.The metric is evaluated for each model, fingerprinting method, and deployment condition using the method’s original query set, detector, and decision rule.
  • Baselines: PROSE is compared with five black-box fingerprinting methods, including query-key, cryptographic-hash, and cross-turn contextual approaches.The supplied baseline descriptions identify Instructional Fingerprinting, Scalable Fingerprinting, Chain & Hash, Cross-Turn Contextual Correlation, and SCW as comparison methods.
  • Experimental Setup: Table 1 reports model-level ownership verification under deployment modifications and active attacks, with green and red cells marking success and failure.The caption defines the table’s color encoding and evaluation focus.
  • Models and Training Settings: Experiments use Qwen2.5-3B-Instruct, Qwen2.5-7B-Instruct, and Llama-3.2-3B-Instruct with matched LoRA-based supervised fine-tuning settings.The default LoRA rank is 32 and the scaling factor is 64.

Robustness Evaluation

The robustness evaluation tests deployment modifications, downstream fine-tuning, and knowledge distillation, with PROSE maintaining ownership-detection evidence across these settings.

  • Deployment Modifications and Active Attacks: 57/57 fingerprinted model-condition combinations are successfully detected, while none of the three unfingerprinted base models is misclassified.This covers 19 fingerprinted test conditions across three models under deployment modifications and active attacks.
  • Deployment Modifications and Active Attacks: PROSE remains detectable after diverse deployment modifications and active attacks, including transformations and model changes evaluated in the robustness study.The supplied passage explicitly states stable black-box ownership evidence across different model families and parameter scales.
  • Knowledge Distillation: Figure 2 examines fingerprint inheritance as the proportion of GSM8K samples changes during knowledge distillation.The figure caption identifies the target-domain coverage variable and the distillation setting.
  • Knowledge Distillation: With only 5% target-domain samples in a 1,000-sample distillation dataset, the distilled model can already be successfully identified.The remaining distillation samples come from the general instruction dataset Alpaca; competing methods fail under all reported distillation settings.

Cross-Domain Applicability

PROSE transfers across mathematical reasoning and medical diagnosis by changing the domain-specific semantic template bank while retaining the rest of its procedures, and it preserves utility on evaluated tasks.

  • Cross-Domain Applicability: PROSE uses GSM8K for mathematical reasoning and MedQA for medical diagnosis, replacing only the domain-specific AMR template bank between scenarios.Data generation, structural filtering, mixed fine-tuning, and detection procedures remain unchanged.
  • Cross-Domain Applicability: 0.98, 1.00, and 0.96 target-domain detection rates are reported on GSM8K for Qwen2.5-3B, Qwen2.5-7B, and Llama-3.2-3B, respectively.The corresponding MedQA rates are 0.94, 0.96, and 0.94 for the same models.
  • Cross-Domain Applicability: Target-domain detection rates remain above 0.90 under most deployment conditions, including sampling, decoding, prompt, input-transformation, quantization, and pruning variations.The results support transfer to different application scenarios through domain-specific semantic template banks.
  • Utility Preservation: +0.0488 and +0.0397 are the unweighted average changes for PROSE-GSM8K and PROSE-MedQA relative to the base model across six tasks.The paper reports performance close to or better than the base model on most evaluated tasks.
  • Utility Preservation: PROSE-GSM8K increases accuracy on GSM8K, while PROSE-MedQA matches its base model on PubMedQA.The paper reports that injecting fingerprints does not substantially impair corresponding target-domain task capabilities.

Fingerprint Specificity

PROSE is highly specific to its target semantic domain: it detects fingerprinted responses in-domain while producing zero or near-zero false triggers outside the domain and under varied deployment conditions. Its natural queries and fluent outputs also reduce explicit fingerprint traces, although template redesign and resistance to adaptive attacks remain limitations.

  • Verification Design: PROSE aggregates structural evidence across natural target-domain queries rather than relying on fixed queries or isolated exact matches.Its ownership signal is encoded in domain-conditioned semantic structures and verified through multiple interactions.
  • Cross-Task Specificity: 98 target-domain fingerprint matches contrasted with 0.00 detection rates across five out-of-domain datasets.The target dataset was GSM8K; the out-of-domain datasets were ARC Challenge, MMLU, HellaSwag, TruthfulQA, and PubMedQA, with 100 samples per dataset.
  • Specificity under Different Deployment Conditions: Target-domain detection remains high while Alpaca Gate values remain zero or close to zero across varied deployment conditions.The tested variations include temperature and decoding settings, system prompts, quantization, input and output transformations, and pruning.
  • Fingerprint Stealthiness: Natural target-domain queries and fluent task-relevant outputs make verification resemble ordinary model use and reduce explicit fingerprint traces.The fingerprint is distributed across domain-conditioned behavior, so a single interaction exposes only one realization rather than the private template bank or decision rule.
  • Limitations: PROSE requires domain-specific template redesign, and template quality may affect learnability, naturalness, and false-trigger rates.The evaluated threat model primarily excludes attackers who know the private templates or detection rules; adaptive removal remains open.

Detailed Implementation of PROSE

PROSE builds domain-specific semantic fingerprints from screened AMR structures, mixed training data, and conclusion-focused black-box detection. Its ownership decision aggregates detected fingerprint responses under calibrated statistical assumptions.

  • Experimental configuration: The experiments use two NVIDIA GeForce RTX 4090 GPUs, with the same configuration applied to baselines.
  • Data generation and structural filtering: Each PROSE domain uses four AMR relational structures paired with ten screened natural-language examples, allowing lexical variation while preserving predicate-argument relations.Examples are structurally filtered through AMR parsing, abstraction, variable normalization, and S2Match comparison.
  • Mixed training data: The training set mixes 500 target-domain fingerprint samples with 500 clean instruction samples at a 1:1 ratio, producing 1,000 examples.The clean data preserve general instruction-following behavior during domain-specific fingerprint injection.
  • Sentence template transformation: The detector extracts a model response’s final conclusion sentence before AMR parsing, semantic abstraction, and template matching.Concrete concepts and arbitrary variable names are normalized to stable abstract categories and traversal-based variable labels.
  • Model-level ownership threshold: The final ownership rule accepts a model only when detected fingerprint responses reach or exceed the derived integer threshold.The decision rule is applied to aggregated detections across verification queries rather than isolated exact matches.
  • Model-level ownership threshold: The threshold derivation models each held-out query as a binary detection outcome and bounds per-query false positives by a common conservative upper bound p0.The analysis assumes detection outcomes across held-out queries are independent or approximately independent and applies Hoeffding’s inequality.

2. Calibration of the Per-Response False-Positive Proba-

PROSE calibrates the per-response false-positive bound from unfingerprinted base models, then derives a model-level ownership threshold using a conservative statistical procedure. Robustness evaluations vary generation settings to test whether semantic structures persist beyond fixed surface expressions.

  • False-positive calibration: Three unfingerprinted base models are calibrated using 100 held-out GSM8K queries each, with no observed false positives.Calibration uses target-domain GSM8K queries and the same generation and detection procedures used for fingerprinted models.
  • False-positive calibration: The one-sided Clopper-Pearson upper bound estimates nonzero uncertainty despite zero observed false positives, using a 95% confidence level.For n = 100 and k = 0, the resulting upper bound is approximately 0.029513; the maximum across models is used conservatively.
  • False-positive calibration: The calibration procedure avoids pooling models because pooling would assume identical per-response false-positive probabilities across architectures.Taking the maximum separately calibrated bound provides a more conservative cross-model strategy.
  • Ownership threshold: 22 of 100 held-out responses is the ownership-pass threshold used in the experiments.The threshold follows from the calibrated bound and the Hoeffding deviation term.
  • Ownership threshold: 7.05 × 10^-4 < 10^-3, so the selected threshold controls the nominal model-level false-positive probability below 10^-3 under the stated calibration and independence assumptions.
  • Robustness evaluation: Robustness testing varies temperature from 0.4 to 1.0 and examines additional decoding and system-prompt settings.The purpose is to test stability of abstract semantic structures under generation randomness and prompt variation.

Input- and Output-Side Transformations

This section describes the transformation, compression, pruning, fine-tuning, distillation, and baseline settings used to test fingerprint robustness and specificity.

  • Input- and Output-Side Transformations: Input robustness tests use paraphrasing and English–French–English backtranslation before standard fingerprint detection.Output robustness uses English–French–English backtranslation of complete model responses.
  • Input- and Output-Side Transformations: Post-training robustness tests evaluate 8-bit and 4-bit BitsAndBytes quantization and Wanda or SparseGPT pruning at 20% and 50% sparsity.The quantization settings use load_in_8bit=True or load_in_4bit=True; pruning uses Wanda and SparseGPT, respectively.
  • Input- and Output-Side Transformations: Fine-tuning robustness is evaluated on Alpaca, Dolly, OpenMathInstruct, and French WildChat datasets.Training settings equalize approximate token processing across datasets, with dataset-specific epochs or sample counts and LoRA configurations.
  • Input- and Output-Side Transformations: Black-box distillation tests restrict the attacker to natural queries and collected teacher responses, excluding parameters, templates, training data, and verification queries.The distillation set contains 1,000 samples with varying GSM8K proportions and remaining Alpaca-GPT4 instructions.
  • Input- and Output-Side Transformations: Baseline implementations include trigger-based IF with a Japanese key, SF with 1,024 Dolly prompts and exact target-response matching, and CH with ten natural-language questions mapped to response banks.The supplied passages also identify the corresponding baseline robustness, fine-tuning, and distillation result tables.

Detailed Results for PROSE

PROSE maintains target-domain ownership detection and near-zero out-of-domain false-trigger rates across deployment conditions, downstream fine-tuning, and black-box distillation.

  • Detailed Results for PROSE: Across three model backbones and two target domains, PROSE maintains high target-domain detection with out-of-domain false-trigger rates close to zero.The results cover heterogeneous models and semantic domains under deployment modifications and active attacks.
  • Detailed Results for PROSE: After downstream LoRA fine-tuning, target-domain hit rates range from 0.87 to 0.99 across GSM8K and MedQA, while all out-of-domain gate rates remain zero.Detection is reported as target-domain query-level detection, whereas Gate denotes the out-of-domain false-trigger rate.
  • Detailed Results for PROSE: Under black-box distillation, all Alpaca control queries produce zero fingerprint hits, while settings with at least 5% GSM8K exceed the ownership threshold of 22 responses.The result indicates target-domain-specific inheritance rather than general behavioral imitation.
Loading 2609.02553v1…