PaperlayerView exact revision on arXiv

Source-linked AI summary

From Representations to Computational Trajectories: Intrinsic Fingerprinting for Large Language Model Provenance Verification

Haiyong Tang, Hanzhou Wu, Xinpeng Zhang, Athanasios V. Vasilakos

arXiv:2610.34675v1cs.CR

TL;DR

LLM provenance is difficult to verify because model weights can be modified after unauthorized acquisition, while existing parameter- and representation-based fingerprints have robustness or uniqueness limitations. TrFP fingerprints how representations evolve across network depth using compact, permutation-invariant trajectory descriptors. It distinguishes related from unrelated models and remains robust across evaluated transformations and attacks, though its evaluation notes a limitation of representation similarity as provenance evidence.

  • Problem

    Parameter-based fingerprints can be sensitive to model transformations, while representation-based methods may assign high similarity to unrelated models, limiting robustness or uniqueness.

    Source: §I · p. 1

  • Method

    TrFP uses compact, permutation-invariant descriptors of how representations evolve across network depth rather than comparing parameters or static representations.

    Source: B. Main Contributions · p. 2, D. Trajectory Fingerprint Construction · p. 7

  • Results

    TrFP achieves 100% TPR@0.5 and 100% TNR@0.5, with related mean similarity 0.887 and unrelated mean similarity 0.248.

    Source: B. Overall Provenance Verification · p. 9

  • Takeaways & Limitations

    TrFP’s trajectory fingerprints distinguish related from unrelated models and remain robust under evaluated transformations, parameter permutation, and adaptive attacks.

    Source: §VII · p. 12

    Representation similarity may not establish provenance specificity; for REEF, unrelated pairs averaged 0.718 and all scores exceeded 0.5.

    Source: C. Limitations of Representation… · p. 4

Abstract

from arXiv · show

Large language models (LLMs) are valuable digital assets, yet their weights can be easily modified after unauthorized acquisition, making model provenance difficult to verify. Model fingerprinting provides a promising solution for model ownership protection without modifying the model or embedding ownership information. However, parameter-based fingerprints can be sensitive to model transformations, limiting their robustness, while representation-based fingerprints may assign high similarity to unrelated models, limiting their uniqueness. To address these limitations, we propose TrFP, an intrinsic fingerprinting method based on computational trajectories. Instead of comparing model parameters or representations, TrFP captures how representations evolve across network depth and constructs compact fingerprints using permutation-invariant trajectory descriptors. Experiments across multiple LLM families show that TrFP reliably distinguishes related and unrelated models. It also remains robust under fine-tuning, pruning, quantization, model merging, parameter permutation, and adaptive attacks, while requiring less than 0.3 MiB of fingerprint storage. Overall, TrFP provides stronger provenance discrimination than several existing state-of-the-art methods, demonstrating the effectiveness of computational trajectories for reliable LLM provenance verification.

I. INTRODUCTION

LLM provenance is difficult to verify because unauthorized holders can transform weights while preserving capabilities. TrFP fingerprints layer-wise computational trajectories to address weaknesses in existing methods and distinguish related from unrelated models.

I. INTRODUCTION

  • Parameter-based fingerprints can lose robustness after transformations, while representation-based fingerprints may lack uniqueness when unrelated models score highly similar.Fingerprinting requires no pre-embedded ownership information, unlike watermarking, and can be applied to already released models.Source: §I · p. 1

A. Motivation

  • Computational trajectories describe layer-wise hidden-state updates, which can distinguish unrelated models while retaining characteristics inherited by derived models.TrFP compares update strength, changes between neighboring layers, and distance from the starting representation without requiring hidden-coordinate correspondence.Source: Figure 1 · p. 1, A. Motivation · p. 2

B. Main Contributions

  • TrFP introduces compact trajectory descriptors and reports stronger uniqueness and robustness than several existing state-of-the-art methods.The descriptors are permutation-invariant and capture how representations evolve across network depth.Source: B. Main Contributions · p. 2

A. Deep Neural Network Fingerprinting

  • Fingerprinting research has progressed from decision-boundary behavior and parameter features toward methods addressing robustness and false ownership claims.Examples include conferrable adversarial examples, parameter projections, generator-based fingerprints, and targeted fingerprints.Source: A. Deep Neural Network Fingerprinting · p. 2

B. Large Language Model Fingerprinting

LLM fingerprinting methods use parameters or representations, but both approaches have limitations, and representation similarity may not reliably establish provenance. The paper examines CKA’s reliability and shows that debiasing corrects high-dimensional, small-sample estimation bias.

B. Large Language Model Fingerprinting

  • Parameter-based methods depend on stable, comparable parameter features, while representation-based methods use internal responses to reduce direct parameter correspondence.Representation methods include REEF, which compares intermediate representations with CKA, and CREF and AttnDiff, which construct other response-based fingerprints.Source: B. Large Language Model Fingerprinting · pp. 2–3

III. REVISITING REPRESENTATION SIMILARITY FOR MODEL FINGERPRINTING

  • Representation similarity is not necessarily specific to provenance, so high similarity alone may not separate related from unrelated models.The paper examines both whether the similarity metric measures representations reliably and whether similarity indicates provenance.Source: B. Large Language Model Fingerprinting · p. 3, §III · p. 3

A. Reliability of Representation Similarity Measurement

  • Linear CKA compares representation Gram matrices, but its biased estimator can overestimate similarity in high-dimensional, small-sample settings.When d ≫ n, unrelated random representations can receive high scores because Gram matrices are dominated by diagonal self-similarity terms.Source: HSIC(K, K) HSIC(L, L) · p. 3, A. Reliability of Representation… · p. 3

HSIC(K, K) HSIC(L, L)

  • At n = 200 and d = 8192, debiased CKA reduces the score for unrelated random representations from 0.976 to 0.001.Debiased CKA replaces the biased HSIC estimator with the unbiased estimator; Fig. 2 presents the comparison across sample counts and dimensions.Source: Figure 2 · p. 3, HSIC(K, K) HSIC(L, L) · p. 4

B. Provenance Specificity of Representation Similarity

Unrelated LLMs can have high representation similarity, limiting its specificity for provenance fingerprinting. Computational trajectories generally distinguish model families while derived models preserve their source trajectories.

B. Provenance Specificity of Representation Similarity

  • Unrelated pretrained models had debiased CKA similarities of 0.61–0.80, averaging 0.69, despite having no derivation relationships.The comparison used seven models and 200 TruthfulQA probes.Source: B. Provenance Specificity of… · p. 4

C. Limitations of Representation Similarity for Model Fingerprinting

  • After CKA debiasing, REEF’s related and unrelated similarity distributions still overlapped, limiting fingerprint uniqueness.Unrelated pairs averaged 0.646 and related pairs 0.801; Qwen3-1.7b-Base scored 0.685 against an unrelated model versus 0.674 against its Instruct version.Source: C. Limitations of Representation… · p. 4, Figure 4 · p. 5

IV. COMPUTATIONAL TRAJECTORY ANALYSIS

  • Across 56 models, different families generally had distinct computational trajectories, while derived models tended to preserve their source models’ trajectories.The visualization covered Base, Instruct, fine-tuned, adapter-based, merged, quantized, and distilled variants.Source: §IV · p. 5

V. TRAJECTORY FINGERPRINTING

TrFP constructs fingerprints from layer-wise computational trajectories and compares fingerprint similarity for provenance verification. Its threat model assumes white-box access and a private probe set unknown to the attacker.

V. TRAJECTORY FINGERPRINTING

  • TrFP extracts layer-wise hidden states, builds computational trajectories, then standardizes permutation-invariant descriptors into compact fingerprints for similarity-based provenance verification.Fig. 5 presents the framework overview.Source: §V · p. 5, Figure 5 · p. 6

A. Threat Model

  • The defender has white-box access to source and suspect hidden states and evaluates both models with the same private probe set, without requiring training data or development history.The attacker may know the algorithm and transform or optimize the suspect model, but does not know the private probe set.Source: A. Threat Model · p. 5

B. Computational Trajectory Construction

  • For each probe, TrFP uses the last token’s hidden state at each depth and defines the computational trajectory as the sequence of layer-wise displacements.The last-token state is selected because causal attention aggregates information from the entire input.Source: B. Computational Trajectory Construction · p. 6

C. Trajectory Descriptor Extraction

TrFP characterizes trajectories through three complementary descriptors that can be compared across models without matching hidden-space coordinates.

C. Trajectory Descriptor Extraction

  • Because model hidden spaces lack coordinate correspondence, trajectories require a compact cross-model representation that preserves provenance information.The method describes trajectories at layer, neighborhood, and accumulated levels.Source: C. Trajectory Descriptor Extraction · p. 6
  • The three descriptors capture relative update intensity, its change between neighboring layers, and the net displacement accumulated through the current layer.The neighborhood descriptor is positive when relative update intensity strengthens and negative when it weakens.Source: C. Trajectory Descriptor Extraction · p. 6
  • All three descriptors use Euclidean norms, avoiding hidden-dimension correspondence while preserving trajectory information at layer, neighborhood, and accumulated levels.The accumulated descriptor reflects directional interactions among displacements, increasing when they reinforce and decreasing when they partially cancel.Source: C. Trajectory Descriptor Extraction · p. 6

D. Trajectory Fingerprint Construction

TrFP standardizes trajectory descriptors before collecting them into a fingerprint, addressing scale differences and shared baselines across probes.

D. Trajectory Fingerprint Construction

  • Descriptors can have different numerical scales, and probe descriptors at a depth can share a dominant baseline that obscures their variation.TrFP standardizes descriptors before fingerprint construction.Source: D. Trajectory Fingerprint Construction · p. 7
  • At each layer-wise position, TrFP estimates a descriptor center from the probe-set mean and uses a global scale for each descriptor across positions.The center estimates the common baseline at that position.Source: D. Trajectory Fingerprint Construction · p. 7
  • The trajectory fingerprint collects standardized descriptors across layer-wise positions and probe samples, with three descriptor dimensions.The fingerprint has dimensions for layer-wise positions, probe samples, and trajectory descriptors, respectively.Source: D. Trajectory Fingerprint Construction · p. 7

E. Fingerprint Comparison and Provenance Verification

TrFP compares source and suspect fingerprints after aligning them by relative network depth, then averages cosine similarities across probes and aligned positions. A threshold determines whether the models are considered provenance-related.

E. Fingerprint Comparison and Provenance Verification

  • Fingerprints with different network depths are aligned by uniformly sampling positions across relative depth before comparison.The number of aligned positions is the smaller of the two network depths.Source: E. Fingerprint Comparison and… · p. 7
  • At each aligned position, TrFP averages per-probe cosine similarities to obtain that position’s similarity score.The overall fingerprint similarity is the average across aligned positions.Source: E. Fingerprint Comparison and… · p. 7
  • A similarity of at least 0.5 indicates a provenance relationship; lower similarity indicates unrelated models.The threshold τ = 0.5 follows prior fingerprinting evaluations.Source: E. Fingerprint Comparison and… · p. 7

F. Analysis of Permutation Invariance

TrFP is designed to preserve its trajectory fingerprints under function-preserving parameter permutations. The analysis shows that these attacks either leave the computational trajectory unchanged or preserve its descriptors.

F. Analysis of Permutation Invariance

  • Parameter permutation attacks can evade fingerprint verification cheaply without retraining, despite preserving model functionality.The analysis considers attention, FFN, and global hidden-dimension permutations.Source: F. Analysis of Permutation Invariance · p. 7
  • Across the analyzed permutations, TrFP is permutation-invariant by construction because the trajectory or its descriptors remain unchanged.The displacement is defined from hidden states entering the attention and FFN modules.Source: F. Analysis of Permutation Invariance · pp. 7–8
  • Consistent query/key and value-dimension permutations leave the attention output, layer, and displacement unchanged.The attention argument uses the orthogonality of permutation matrices.Source: F. Analysis of Permutation Invariance · pp. 7–8
  • An FFN intermediate-dimension permutation cancels across its two projections, leaving the FFN output and layer displacement unchanged.The activation is element-wise and commutes with the permutation.Source: F. Analysis of Permutation Invariance · p. 8
  • Global hidden-dimension permutations preserve the layer, neighborhood, and accumulated trajectory descriptors.The hidden states and layer-wise displacement transform, but orthogonality preserves the descriptors.Source: F. Analysis of Permutation Invariance · p. 8

A. Experimental Setup

The evaluation compares TrFP with five fingerprinting baselines across seven model families and tests provenance discrimination and robustness to model transformations. TrFP achieves perfect fixed-threshold identification of related and unrelated pairs, and remains robust across the reported transformations.

A. Experimental Setup

  • The study compares five baselines with TrFP using 14 source models and 56 candidates across seven model families, then evaluates transformations using task-specific metrics.The overall pool includes Base, Instruct, fine-tuned, adapter-based, merged, GPTQ-quantized, and distilled variants; PCS excludes the seven GPTQ models.Source: A. Experimental Setup · p. 8, B. Overall Provenance Verification · p. 8

B. Overall Provenance Verification

  • 0.887 related mean similarity, 0.248 unrelated mean similarity, and 100% TPR@0.5 and TNR@0.5: TrFP distinguishes related from unrelated models.The reported similarity matrices show the desired block structure for PCS, ICS, and TrFP, while representation-based baselines have elevated similarity for many unrelated pairs.Source: B. Overall Provenance Verification · pp. 8–9, Figure 6 · p. 9, Table I · p. 9

C. Robustness to Model Transformations

D. Robustness to Parameter Permutation Attacks

Under adaptive attacks, TrFP similarity falls on an attacker’s surrogate probes but remains above the verification threshold on the owner’s private probes, while stronger attacks degrade utility. Separate permutation experiments find high TrFP similarity across four permutation types.

D. Robustness to Parameter Permutation Attacks

  • TrFP maintains high similarity under FFN, attention, hidden-dimension, and combined permutations, consistent with its theoretical invariance analysis.Permutation experiments use Qwen2.5-7b and Llama-3.1-8b, with three seeds and BF16 precision.Source: D. Robustness to Parameter Permutation… · pp. 10–11

E. Robustness to Adaptive Attacks

  • The adaptive attacker knows TrFP’s extraction and matching procedure, optimizes with a surrogate probe set, and balances task loss against fingerprint evasion.The attack uses LoRA fine-tuning on Alpaca for 1,000 steps with λ values 0, 1, 5, and 10.Source: E. Robustness to Adaptive Attacks · p. 11
  • Similarity on the owner’s private probes remains above τ = 0.5 during adaptive attacks, although stronger attacks reduce it only modestly and increasingly degrade utility.For Falcon3-7b, raising λ from 5 to 10 yields little further private-probe similarity reduction while performance deteriorates substantially.Source: E. Robustness to Adaptive Attacks · p. 11, Figure 7 · p. 11
  • Adaptive fine-tuning drives similarity toward −1 on the attacker’s surrogate probes, but the attack transfers poorly to the owner’s private probe set.The attacker uses 200 TruthfulQA samples as surrogate probes; the owner’s private set uses 200 ToxiGen samples.Source: E. Robustness to Adaptive Attacks · p. 11

F. Ablation Study

The ablations favor combining all three trajectory descriptors, show provenance discrimination across five probe datasets, and indicate stable fingerprints with moderate probe sets. Fingerprint sizes change little as model scale grows, while the conclusion identifies a primarily white-box scope.

F. Ablation Study

  • The complete ρ + δ + e descriptor combination achieves 100% TPR and 100% TNR, with the highest robustness under all four transformations.The descriptors capture complementary trajectory information, so the paper uses this combination by default.Source: F. Ablation Study · p. 11
  • Across five probe datasets, Qwen2.5-14b-Instruct consistently has substantially higher similarity than unrelated models, despite variation in absolute similarities.The authors use ToxiGen as the default probe dataset.Source: F. Ablation Study · p. 11, Figure 8 · p. 12
  • At N=100–200, similarities are close to N=1000; N=10–20 fluctuates, motivating the N=200 default as a stability–evaluation-cost balance.Increasing N beyond this range brings only minor changes.Source: F. Ablation Study · pp. 11–12

G. Storage Cost

  • Across models from 7b to 1043b, TrFP fingerprint sizes change only slightly because its descriptors avoid storing parameters or raw representations.The comparison counts only final fingerprints required for verification, excluding models and temporary extraction variables.Source: G. Storage Cost · p. 12, Table V · p. 12

VII. CONCLUSION

  • TrFP distinguishes related and unrelated models under transformations, parameter permutation, and adaptive attacks, but its need for intermediate representations makes it primarily white-box.Broader architecture coverage and stronger adaptive attacks remain for future study; the authors also propose extending the approach to agentic systems.Source: §VII · p. 12

Related papers

Loading 2610.34675v1…