利用提示注入漏洞为大模型生成抗后处理的指纹，可精准识别模型来源。
Fingerprinting LLMs via Prompt Injection
- 通过优化提示使模型产生一致的令牌偏好，生成唯一指纹。
- 在5个基座模型700多个变体上测试，真阳性率高，误报率接近零。
- 适用于灰盒和黑盒场景，适合模型溯源与版权保护需求者。
大型语言模型（LLMs）在发布后常通过微调或量化等方式进行修改，导致难以判断模型间的衍生关系。现有溯源方法存在两大局限：一是需在发布前嵌入信号，无法用于已发布的模型；二是使用手工或随机提示比较输出，对后处理不鲁棒。本文提出LLMPrint，一种新型检测框架，利用模型对提示注入的固有脆弱性构建指纹。核心思想是通过优化指纹提示，强制模型产生一致的令牌偏好，从而获得既唯一又抗后处理的指纹。我们进一步设计统一验证流程，支持灰盒与黑盒场景，并具备统计保障。在五个基座模型及约700个后训练或量化变体上评估，结果表明LLMPrint实现高真阳性率且假阳性率接近零。代码已公开于https://github.com/hifi-hyp/ACL-LLMPrint。
原文摘要 · Abstract (English)
Large language models (LLMs) are often modified after release through post-processing such as post-training or quantization, which makes it challenging to determine whether one model is derived from another. Existing provenance detection methods have two main limitations: (1) they embed signals into the base model before release, which is infeasible for already published models, or (2) they compare outputs across models using hand-crafted or random prompts, which are not robust to post-processing. In this work, we propose LLMPrint, a novel detection framework that constructs fingerprints by exploiting LLMs' inherent vulnerability to prompt injection. Our key insight is that by optimizing fingerprint prompts to enforce consistent token preferences, we can obtain fingerprints that are both unique to the base model and robust to post-processing. We further develop a unified verification procedure that applies to both gray-box and black-box settings, with statistical guarantees. We evaluate LLMPrint on five base models and around 700 post-trained or quantized variants. Our results show that LLMPrint achieves high true positive rates while keeping false positive rates near zero. The code is publicly available at https://github.com/hifi-hyp/ACL-LLMPrint.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。