仅用一个词输出就能识别和验证大模型，无需复杂条件。
One Token Is Enough: Fingerprinting and Verifying Large Language Models from Single-Token Output Distributions
- 用单个词提示词收集输出分布，形成模型行为指纹。
- 95%以上模型可被准确区分，8个探测单元即达11%错误率。
- 适合安全审计、模型溯源，尤其适用于商业接口验证。
大型语言模型（LLMs）越来越多地通过不透明的服务链（如API聚合器、转售商和推理提供商）分发，客户端无法技术验证所响应的模型是否为宣称的模型。最新审计显示，大量商业接口与厂商参考权重存在偏差。现有识别方法需长文本生成、词元级概率、对抗性提示或模型所有者配合。本文表明，更弱证据即可实现识别。定义模型行为指纹为对简单单字提示（如“随机说出1到100之间的数字”）在四种语言下输出分布的实证统计，每查询仅需一个输出词元。在大型商业聚合平台OpenRouter上测试165个模型，发现：(i) 分布高度非均匀（中位数熵1.0比特），且模型特异性强——同一模型两半样本距离比不同模型样本近一个数量级；(ii) 采用詹森-香农散度分析指纹，可恢复模型谱系，留一法准确率达59.5%，显著高于18.4%随机水平；(iii) 基于生物特征的验证协议在40个探测单元下达到7.3%等错误率，8个单元下低于11%，约百次单词查询完成一次审计。还发现生态异常，如某专有品牌旗舰接口与开源Qwen模型分布无法区分。相关协议、提示、原始数据及分析代码已公开，供复现与实际部署使用。
原文摘要 · Abstract (English)
Large language models (LLMs) are increasingly consumed through opaque serving chains - API aggregators, resellers, and inference providers - in which the client has no technical means to confirm that the model answering is the model advertised, and recent audits show that a substantial fraction of commercial endpoints deviate from the vendor's reference weights. Existing identification techniques require long generated texts, token-level log-probabilities, adversarially crafted prompts, or the model owner's cooperation. We show that far weaker evidence suffices. We define a behavioral fingerprint of an LLM as the empirical distribution of its answers to trivial one-word prompts - "name a random number between 1 and 100" - collected across four languages at a cost of one output token per query. Measuring 165 models served via a large commercial aggregator (OpenRouter), we find that (i) these distributions are highly non-uniform (median cell entropy 1.0 bit) and model-specific: split halves of the same model's samples lie an order of magnitude closer than samples of different models; (ii) Jensen-Shannon divergence between fingerprints recovers model lineage, assigning a model to its documented family with 59.5% leave-one-out accuracy against an 18.4% chance rate; and (iii) a biometric-style verification protocol achieves a 7.3% equal error rate with the full 40-cell battery, and below 11% with eight probe cells - roughly a hundred single-token queries per audit. We further report ecosystem anomalies, including a proprietary-branded flagship endpoint distributionally indistinguishable from an open-weight Qwen model. The protocol, prompts, raw data, and analysis code are released for reproduction and operational use.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。