Model Fingerprinting and Weight Attribution

An organisation releases open weights under a licence with conditions. A third party deploys a model that appears derived from it and denies the derivation. Establishing the claim requires a property of the weights that survives whatever the third party did to them, and that is the fingerprinting problem.

Two families

Injected fingerprints train the model to produce a specific, unlikely output for a specific, unlikely input. The trigger is a rare string that would never occur naturally; the response is equally arbitrary. Querying a suspect model with the trigger and receiving the response is strong evidence of derivation, since the pair is astronomically unlikely by chance.

Mechanically this is a backdoor with a benign payload, which is both its strength and its discomfort: the technique that installs a fingerprint installs a backdoor, and a model containing one deliberately contains a behaviour its users cannot audit.

Injected fingerprints work black-box, needing only API access to the suspect model, which is the practical requirement in most disputes.

Intrinsic fingerprints derive an identifier from properties the model already has: weight statistics, the spectrum of particular matrices, activation patterns on chosen probes, or the model's ranking over a set of continuations. Nothing is injected, so nothing is added to the model's behaviour, and the identifier must survive transformations rather than being designed to.

The adversary

The threat model determines whether a fingerprint is worth anything, and the transformations to survive are ordered roughly by cost to the adversary.

Quantisation and pruning are cheap and applied routinely for legitimate reasons. Fine-tuning on a modest dataset is cheap. Continued pretraining is expensive. Distillation into a fresh architecture is expensive and produces a model that is arguably not the same weights at all.

A useful fingerprint survives at least quantisation and moderate fine-tuning. Injected fingerprints on rare triggers do reasonably well here, since fine-tuning on unrelated data has no gradient signal pushing the trigger response to change. Heavy fine-tuning, and fine-tuning that deliberately targets suspected triggers, degrade them.

When it breaks

A fingerprint is evidence, not proof. The claim rests on the improbability of the observed behaviour arising independently, which is a statistical argument requiring a stated null hypothesis. Presenting it as certainty overstates what a black-box query establishes, particularly if the trigger could have leaked.

Publishing the trigger destroys it. A fingerprint's value depends on the adversary not knowing what to fine-tune away, so verification cannot be public without burning the mechanism. This forces a trusted-third-party arrangement, which is an institutional dependency rather than a technical one.

Distillation defeats everything. A student trained on a teacher's outputs inherits behaviour and not weights, and no weight-based or trigger-based fingerprint transfers reliably. Since distillation is the most commercially likely form of unauthorised derivation, the technique is weakest against the case it most needs to cover.

Deliberately installed backdoors are a supply chain concern. Whatever the intent, a model with an injected trigger has a hidden behaviour, and a downstream user cannot distinguish a licensing fingerprint from a malicious backdoor. Disclosure of the practice, if not the trigger, is the minimum honest position.