Forging LLM Authorship Fingerprints with Targeted Rewriting

Haohan Yuan; Simin Chen; Xi Niu; Hanqing Guo; Depeng Xu; Haopeng Zhang

cs.CLSep 30, 2026

Forging LLM Authorship Fingerprints with Targeted Rewriting

Authors: Haohan Yuan, Simin Chen, Xi Niu, Hanqing Guo, Depeng Xu, Haopeng Zhang

Organizations: University of North Carolina at Charlotte · George Mason University · Indiana University

Abstract

Model-attribution classifiers can often identify which language model produced a text, making model-specific writing patterns a signal of provenance. Accurate attribution on unmodified text, however, does not show whether the prediction still identifies the original source after deliberate rewriting. We formulate this problem as targeted fingerprint transfer: rewriting one model's output so that attribution classifiers assign it to a chosen target model. We study summarization, where different models receive the same document and express the same underlying content, providing a controlled setting for conditional generation. We introduce ForgePrint, a search-then-distil framework that first searches for rewrites that move attribution toward a target fingerprint, then distils the selected rewrites into a one-pass 4B Student model. On CNN/DM, the Student reaches 70.2% target success rate, outperforming both its Teacher (54.1%) and the strongest of six published rewriting baselines (39.3%), against held-out classifiers that are never queried by the attack. It also reaches 68.3% target success when transferring summaries from an open model toward chosen commercial models. These results show that fingerprint detectability should not be conflated with source authenticity, and that text-only attribution can provide misleading evidence of model identity under targeted rewriting, even when it is accurate on unmodified text.

Figures & tables

Figure 1: Targeted fingerprint transfer through rewriting. Starting from a Claude summary, existing rewriters largely preserve the Claude fingerprint, whereas ForgePrint shifts attribution toward the chosen GPT fingerprint.

Figure 2: Source evasion and targeted transfer can disagree on the same rewrite. A GPT summary rewritten toward Gemini is classified as Grok: source evasion succeeds, but targeted transfer fails.

Figure 3: ForgePrint follows a search-then-distil design. (a) The offline search builds and filters source $\to$ target operators. (b) The Teacher combines these operators with ICL examples to generate candidate rewrites, which provide SFT targets and DPO preference pairs. (c) These selected rewrites are distilled into a Student with SFT, DPO, and GRPO on its own samples, then deployed in one pass without the bank or surrogate. Table 1 summarizes the stages.

Stage	Input	Output	Signal
(a) Operator bank	paired $S/T$ summaries	$\mathcal{B}[S\!\to\!T]$	$g$ : filter rules
(b) Teacher	$x_{S},S,T$ ; bank; ICL examples	$\hat{x}$ ; $(x^{+},x^{-})$	$g$ : select rewrite/pair
(c) Student: SFT $\to$ DPO	Teacher $\hat{x}$ ; $(x^{+},x^{-})$	student policy	Teacher supervision
(c) Student: GRPO	student samples	refined policy	$J$ : factuality; $g$ : target
(c) Student: deployment	$x_{S},S,T$	$\hat{x}$	–

Table 1: Inputs, outputs, and training signals for the stages in Figure 3 .

g

denotes the attacker’s surrogate, and

J

is a frozen LLM judge for factuality.

(a) Released rewriter models
	Attack (%) $\uparrow$										Quality $\uparrow$
	CNN/DM		ArXiv		SAMSum		WikiHow		Macro 4
Method	SrcEv	ASR	SrcEv	ASR	SrcEv	ASR	SrcEv	ASR	SrcEv	ASR	Align
DIPPER ( 2023 )	65.80	21.93	45.94	15.31	67.55	22.52	65.91	21.97	61.30 $\pm$ 0.91	20.43 $\pm$ 0.30	0.573
TinyStyler ( 2024 )	68.12	23.55	60.97	21.92	67.67	23.48	66.13	23.03	65.72 $\pm$ 0.56	23.00 $\pm$ 0.46	0.496
(b) Teacher backbone: Gemma-4-26B-A4B

Table 2: Main results on targeted fingerprint transfer across four domains. SrcEv and ASR denote source evasion rate and target attack success rate, and Align is AlignScore against the source document. Macro 4 averages the four domains; subscripts give document-clustered 95% confidence half-widths. The

9

B backbone control is in Appendix D.1 .

Figure 4: Representation-space view of targeted transfer on CNN/DM using a held-out GPT-2 evaluator. PCA is fitted on representations of unmodified training summaries. Each line connects an original summary to its rewrite, and labeled circles mark the centers of clean summaries from the four models. Colored rewrites are classified as the intended target; gray rewrites are not.

Configuration	SrcEv	ASR		Align
ForgePrint Teacher	82.88	54.08		0.682
$-$ retrieval	86.80	51.35	$-$ 2.73	0.679
$-$ operators ( $k{=}3$ )	69.50	35.76	$-$ 18.32	0.677
random of $5$	79.88	48.20	$-$ 5.88	0.688
first packed	71.89	39.58	$-$ 14.50	0.703

Table 3: Ablation study of ForgePrint on CNN/DM. Red numbers show drops from the shaded reference rows.

(a) Teacher backbone: Gemma-4-26B-A4B
	Raw results			Quality-adjusted ASR (%) $\uparrow$
Method	ASR $\uparrow$	Align $\uparrow$	MiniCheck $\uparrow$	Align-adj.	MiniCheck-adj.
5-shot FC ( 2022 )	30.88	0.658 $\pm$ 0.010	0.660 $\pm$ 0.012	30.8 $\pm$ 0.55	30.7 $\pm$ 0.50
Aug. zero-shot ( 2022 )	32.94	0.511 $\pm$ 0.009	0.452 $\pm$ 0.011	29.9 $\pm$ 0.65	31.2 $\pm$ 0.70
Planner TST ( 2025 )	33.07	0.667 $\pm$ 0.008	0.645 $\pm$ 0.011	33.1 $\pm$ 0.60	33.3 $\pm$ 0.50
ForgePrint Teacher	50.66	0.717 $\pm$ 0.008	0.667 $\pm$ 0.011	49.6 $\pm$ 0.75	50.8 $\pm$ 0.60

Table 4: Raw and faithfulness-adjusted Macro 4 target ASR across four domains. Adjusted results use AlignScore or MiniCheck to compare methods under matched rewrite faithfulness. Representative baselines from Table 2 are included.

Appendix figures & tables22 assets

Supplementary material from the paper’s appendix.

Appendix

	4-LLM					Human-5
Evaluator	CNN/DM	ArXiv	SAMSum	WikiHow	Pooled	CNN/DM	ArXiv	SAMSum	WikiHow	Pooled
RoBERTa	87.81	97.00	77.00	87.12	86.36	89.25	98.00	79.90	89.90	88.99
DeBERTa	89.32	96.62	76.62	86.75	89.14	92.16	97.50	76.20	89.10	89.34
GPT-2	86.43	96.12	77.38	83.75	87.67	89.85	97.40	78.40	87.80	87.93
TF-IDF	82.29	96.50	72.62	80.50	82.92	86.93	96.80	73.30	84.40	85.28
$\mathrm{Mean}_{4}$	86.46	96.56	75.91	84.53	86.52	89.55	97.43	76.95	87.80	87.89

Appendix

Table 6: Accuracy (%) on unmodified text for the 4-LLM and Human-5 suites (RoBERTa / DeBERTa / GPT-2 / TF-IDF). Gemma-5 and Qwen-5 classifiers exist only on CNN/DM (

\mathrm{Mean}_{4}

84.55

and

84.10

; Appendix H.2 ).

Held-out evaluators
	Domain-matched				Pooled
Model	CNN/DM	ArXiv	SAMSum	WikiHow	(all)
RoBERTa	89.36	98.00	80.24	90.00	89.06
DeBERTa	92.19	97.50	76.75	89.21	89.45
GPT-2	89.90	97.40	78.72	87.96	88.06
TF-IDF	86.89	96.80	72.49	84.49	85.09

Appendix

Table 7: Macro-F1 (%) for the Human-5 evaluators and the attacker-side surrogate. These are robustness suites, not the primary 4-LLM evaluators of Table 6 . The surrogate is a single model, so it has no pooled suite.

Train $\backslash$ Test	CNN/DM	ArXiv	SAMSum	WikiHow
CNN/DM	89.51	67.45	55.70	79.53
ArXiv	46.82	97.42	27.68	62.00
SAMSum	57.48	40.95	76.98	60.30
WikiHow	77.15	76.38	50.75	87.80

Appendix

Table 8: Cross-domain transfer of the evaluators on unmodified Round-2 text (Human-5 suites). Rows are evaluator training domains; columns are test-text domains. Entries are

\mathrm{Mean}_{4}

attribution accuracy (%).

Method	Venue	Generator	Targeted	Exemplars / control
Zero-shot TST	ACL 22	shared rewriter	yes	none
Aug. zero-shot	ACL 22	shared rewriter	yes	task-irrelevant priming block
5-shot FC	EMNLP 22	shared rewriter	yes	$5$ pairs per path, fixed
Planner TST	EMNLP 25	shared rewriter	yes	$8$ target summaries $\to$ plan
TinyStyler	EMNLP 24	T5-v1.1-large ( $0.8$ B)	yes	$k{=}16$ target summaries
DIPPER	NeurIPS 23	T5-XXL ( $11$ B)	no	lex./order diversity $60/60$

Appendix

Table 9: Baseline configurations. Targeted marks whether the target identity enters the method at all. The four prompted methods share the Teacher’s rewriter, gemma-4-26B-A4B-it at FP8, temperature

0

3072

max tokens.

	Target ASR			AlignScore
Domain	Teacher	ForgePrint -4B	ForgePrint -9B	Teacher	ForgePrint -4B	ForgePrint -9B
CNN/DM	54.08	70.15	61.14	0.682	0.619	0.678
ArXiv	44.72	47.23	50.90	0.642	0.631	0.658
SAMSum	49.52	58.48	47.92	0.725	0.619	0.681
WikiHow	54.31	67.40	61.17	0.817	0.767	0.770

Appendix

Table 10: Per-domain 4-LLM

\mathrm{Mean}_{4}

target ASR (%) for the Teacher and both students, plus AlignScore of the rewrite against the source document. ForgePrint -9B is a backbone control: its preference stage ran

200

DPO steps against

570

for ForgePrint -4B, so the two students are not a scaling comparison.

Method	RoBERTa	DeBERTa	GPT-2	TF-IDF	$\mathrm{Mean}_{4}$
DIPPER	22.19	22.11	22.95	20.48	21.93
TinyStyler	24.11	23.57	23.95	22.57	23.55
Zero-shot TST	22.86	33.67	38.26	26.20	30.25
Planner TST	42.09	26.62	38.88	22.78	32.59
5-shot FC	49.77	24.70	48.39	24.45	36.83
Aug. zero-shot	37.09	43.39	43.01	33.67	39.29

Appendix

Table 11: Target ASR (%) by evaluator, CNN/DM,

n{=}2397

, domain-matched 4-LLM. Bold marks each method’s most permissive evaluator.

Method	Pass	Content	ASR all	ASR on passes
5-shot FC	0.630	4.00	36.8	37.6
Planner TST	0.263	3.46	32.3	29.9
Aug. zero-shot	0.223	2.83	39.3	30.4
ForgePrint Teacher	0.754	4.52	53.3	53.3
ForgePrint -4B	0.371	3.33	69.3	70.6

Appendix

Table 12: Independent LLM judge on

60

shared CNN/DM documents (

720

rewrites per method). Pass is the share labelled supported or minor ; Content is content preservation (

1

–

5

); ASR all and ASR on passes are 4-LLM target ASR (%) over all scored rewrites and over those the judge passes. The judge is unvalidated against human annotations, and these ASR numbers are not comparable with Table 2 .

Method	median	mean	share $>1.0$	$<0.9$	$0.9$ – $1.1$	$>1.1$
Aug. zero-shot	1.07	1.09	$60.1\%$	52.36 (626)	38.93 (664)	32.11 (1107)
ForgePrint Teacher	0.98	1.03	$46.4\%$	54.59 (850)	58.44 (761)	49.30 (786)
ForgePrint -4B	0.89	1.02	$38.8\%$	71.29 (1245)	67.16 (370)	69.76 (782)
ForgePrint -9B	1.20	1.30	$71.2\%$	62.15 (323)	58.03 (660)	62.36 (1414)

Appendix

Table 13: Length ratio of a rewrite to the summary it replaces, in whitespace words, and CNN/DM 4-LLM

\mathrm{Mean}_{4}

target ASR (%) inside bins of that ratio, over the CNN/DM Round-2 rewrites of Table 2 . share

>1.0

is the fraction of rewrites longer than their source. The middle bin holds rewrites that keep the source length to within a tenth;

n

is in parentheses. Bin sizes differ because the methods have different length distributions.

Method	full	trunc.	$\Delta$	full	trunc.	full	trunc.
	$\mathrm{Mean}_{4}$			$\mathrm{Mean}_{3}$		Range
Aug. zero-shot	39.29	38.70	$-0.58$	40.02	38.40	9.7	10.0
ForgePrint Teacher	54.08	43.87	$-10.21$	53.69	44.81	20.4	4.3
ForgePrint -4B	70.15	58.64	$-11.51$	68.11	59.06	17.2	2.6

Appendix

Table 14: Every CNN/DM rewrite hard-truncated to the whitespace-word length of the summary it replaces, then rescored (

n{=}2397

\mathrm{Mean}_{3}

drops RoBERTa, the surrogate’s architecture. Range is the spread between the most and least permissive of the four evaluators.

Component	4-LLM ASR	SrcEv	AlignScore
ICL-only ( $k{=}3$ )	$35.76$	$69.50$	$0.677$
Ops-only (single-text)	$51.35$	$86.80$	$0.679$
Hybrid ( $N{=}5$ , $k{=}5$ )	$\mathbf{54.08}$	$82.88$	$0.682$

Appendix

Table 15: Teacher component stack on CNN/DM Round-2 (

n{=}2397

). ICL uses retrieval

k{=}3

; Hybrid is the paper Teacher (

N{=}5

k{=}5

ICL-only retrieval $k$
Setting	4-LLM ASR	SrcEv	AlignScore
$k{=}3$	$35.76$	$69.50$	$0.677$
$k{=}4$	$36.28$	$71.30$	$0.677$
$k{=}5$	$36.17$	$69.98$	$0.677$
$k{=}6$	$36.17$	$70.57$	$0.675$
$k{=}7$	$36.45$	$70.19$	$0.676$

Appendix

Table 16: Teacher sensitivity on CNN/DM Round-2 (

n{=}2397

). Top: ICL-only retrieval

k

(no operators). Bottom: packed width

N

of the full Teacher at retrieval

k{=}5

. Both sweeps are post-hoc and were not used to select

k

N

Policy	4-LLM ASR	4-LLM SrcEv
First packed candidate	$39.58$	$71.89$
Random (uniform expectation)	$48.20$	$79.88$
Max-margin	$54.08$	$82.88$

Appendix

Table 17: Same CNN/DM Teacher candidates (

n{=}2397

), different selection. 4-LLM

\mathrm{Mean}_{4}

is computed over all stored candidates, so the random row is the exact uniform expectation.

Stage	4B ASR	4B Align	9B ASR	9B Align
SFT	$45.3$	$0.673$	$53.1$	$0.561$
SFT $+$ DPO	$63.9$	$0.613$	$61.1$	$0.674$
SFT $+$ DPO $+$ GRPO (Table 2 )	$70.2$	$0.619$	$61.1$	$0.678$

Appendix

Table 18: CNN/DM domain-matched 4-LLM

\mathrm{Mean}_{4}

along the saved training stages (

n{=}2397

). AlignScore is vs. the source document. The last row is Table 2 . DPO duration is not matched across sizes. The

9

B SFT checkpoint is markedly less faithful than the

4

B one (

0.561

against

0.673

) and recovers only after DPO.

Configuration	Held-out ASR	Align
DPO (start)	63.93	0.613
Factuality-first ( $\beta{=}0.05$ )	70.15	0.619
Strongest margin-only ( $\beta{=}0.02$ )	66.50	0.619

Appendix

Table 19: Factuality-first GRPO versus the strongest margin-only variant, both from the same DPO start. Held-out ASR is 4-LLM target ASR (%); Align is AlignScore against the source document. The two DEV-selected checkpoints differ in

\beta

and in the selection rule, so the comparison is not a single-factor ablation.

Item	Rate or hardware	$/$ 1$ k
Premium tier: what a reseller claiming that model would bill
Grok 4.6	list	$2.34$
Gemini 3.1 Pro	list	$3.23$
Claude Sonnet	list	$3.51$
GPT-5.6 Sol	list	$6.22$
Claude Opus 5	list	$8.78$

Appendix

Table 20: Cost of

1{,}000

CNN/DM summaries. API rows apply list rates to the stored document and summary token counts; GPU rows price the measured GPU-hours of Table 22 on the card named, without re-timing on it. All rates were read on 18 September 2026; it is the ratio rather than the absolute figures that we report.

Student	SFT	DPO	GRPO	Sum
ForgePrint -4B	$0.43$	$0.79$	$0.11$	$1.33$
ForgePrint -9B	$0.89$	$1.31$	$0.16$	$2.36$

Appendix

Table 21: One-time adapter training on one H200 NVL, in GPU-hours. This is setup, not the per-rewrite inference cost of Table 20 . 9B GRPO continues from that size’s DPO adapter; the DPO column is the full DPO job. The additional training of the Gemma-source adapters is not included (Appendix G.1 ).

Setting	ms/item	GPU-h / $2397$
Default (beam $2$ , batch $16$ )	$602$	$0.40$
Beam $2$ , batch $512$ (max that fits)	$370$	$0.25$
Greedy, batch $1024$ (max that fits)	$114$	$0.076$

Appendix

Table 22: ForgePrint -4B decode throughput on one H200 (

n{=}2397

). Greedy batch

1024

is the cheapest student setting that fit in

140

GB.

Method	Domain	GPU-h
Teacher	CNN/DM	2.42
	ArXiv	3.92
	SAMSum	1.16
	WikiHow	2.32
ForgePrint -4B	CNN/DM	0.40
ForgePrint -9B	CNN/DM	0.53

Appendix

Table 23: ForgePrint rewrite GPU hours, timed on the same hardware at the default decoding settings (students: beam

2

, batch

16

). Teacher hours cover candidate generation and surrogate scoring with the frozen CNN/DM-built bank (

N{=}5

k{=}5

on CNN/DM;

k{=}2

on ArXiv). Student hours are a timed decode of the same

2397

CNN/DM instances, including model load.

Figure 6: Further training prevents ForgePrint -9B rewrites from being classified as Gemma. (a) Adding Gemma as a fifth label reduces the original ForgePrint -9B target ASR from

61\%

19\%

, while the further-trained student retains

69\%

ASR. (b, c) Under the Gemma-5 evaluator, many rewrites from the original student are classified as Gemma (

72\%

), compared with only

1\%

after further training. Hollow points show summaries before rewriting and colored points show their rewrites. The additional training uses Gemma-source paths but never a Gemma-inclusive surrogate.

12-path 4-LLM
Method	RoBERTa	DeBERTa	GPT-2	TF-IDF	$\mathrm{Mean}_{4}$
ForgePrint -9B	67.75	57.78	61.03	57.99	61.14
ForgePrint -9B (Gemma-source)	85.19	64.96	75.76	68.04	73.49
Gemma $\to$ LLM 4-path, Gemma-5
ForgePrint -9B	11.50	6.88	8.25	31.00	14.41
ForgePrint -9B (Gemma-source)	75.25	65.38	63.88	62.25	66.69

Appendix

Table 24: Target ASR (%) by evaluator for the ForgePrint -9B backbone control and the Gemma-source 9B student. Top: CNN/DM,

12

LLM paths,

n{=}2397

, domain-matched 4-LLM. Bottom: Gemma-authored CNN/DM summaries, four Gemma

\to

LLM paths,

n{=}800

, Gemma-5

\mathrm{Mean}_{4}

. The two rows are different adapters. Bold: most permissive evaluator in that row.

Figure 7: Target ASR for each directed path (rows, grouped by target) in each domain (columns), for both students, under domain-matched 4-LLM $\mathrm{Mean}_{4}$ . Difficulty tracks the target more than the domain, but cell means also show a large path $\times$ domain interaction. The main-text heatmap (Figure 5 ) averages the three sources of each target.

System	Human-5 ASR	Gemma-5 ASR	Qwen-5 ASR
Teacher	52.68	27.36	31.2
ForgePrint -4B	70.36	41.39	48.0
ForgePrint -9B	62.80	18.99	29.0
ForgePrint -9B (adapted)	70.9	69.3	71.3

Appendix

Table 25: CNN/DM target ASR (%) for the same saved rewrites under three fifth-class suites. Human-5, Gemma-5, and Qwen-5 differ only in the unused fifth label. The adapted

9

B student is the only policy trained after those classes were introduced. This is a defender-side counterfactual, not a matched five-class attack.

Language Model Fingerprinting

Language model fingerprinting identifies and verifies models or their lineage from distinctive outputs, internal representations, or embedded signals.

See all 81 papers

Every Model Leaves a Trace: Multi-Resolution LLM Fingerprinting
Oct 20, 2026Mohammad Reza Modarres, Armin Tourajmehr, Artin Tavasoli +2Language Model Fingerprinting Language Model Robustness
School of Electrical and Computer Engineering, College of Engineering, University of Tehran, Tehran, Iran · Tehran Institute for Advanced Studies, Khatam University, Iran · Cardiff University, United Kingdom
Who's Behind the Text? Robust Model Authorship Attribution
Oct 14, 2026Minseok Ko, Hyunseok Lee, Woomin Song +3Authorship Attribution OOD Generalization
Korea Advanced Institute of Science and Technology (KAIST)
Chainwash: Multi-Step Rewriting Attacks on Diffusion Language Model Watermarks
May 6, 2026Mohd Ruhul Ameen, Akif Islam, Nadim Mahmud +1Diffusion Model Watermarking Watermark Removal
College of Engineering and Computer Science, Marshall University, Huntington, WV, USA · Department of Computer Science and Engineering, University of Rajshahi, Rajshahi, Bangladesh · Miami University, Oxford, OH 45056, USA

Oct 20, 2026J/K move · Enter open · S save

Every Model Leaves a Trace: Multi-Resolution LLM Fingerprinting

Mohammad Reza Modarres, Armin Tourajmehr, Artin Tavasoli, Yadollah Yaghoobzadeh+1

School of Electrical and Computer Engineering, College of Engineering, University of Tehran, Tehran, Iran · Tehran Institute for Advanced Studies, Khatam University, Iran · Cardiff University, United Kingdom

Language Model Fingerprinting Language Model Robustness

Open paper AskPDF arXiv

Large language models leave model-specific traces in their generated text, but it remains unclear how finely these fingerprints can distinguish related models and which signals remain informative as obvious cues are reduced. We study this through fingerprint resolution, considering both model resolution, from different families to distilled and adapted variants, and signal resolution across behavioral, stylometric, lexical, and semantic evidence. We progressively suppress surface cues, paraphrase outputs, vary the amount of available text, and test generalization across prompt distributions and languages. Our results show that fingerprints persist beyond broad family differences, remaining detectable in distilled models and even LoRA adaptations of the same base model. Although attribution weakens as surface and lexical cues are altered, substantial model-specific signal remains. These signals transfer across prompt sources and languages, with semantic representations proving most robust across languages. These findings show that model identity is recoverable at multiple resolutions, but that recoverability depends on model similarity and the evidence available in the text.

Abstract

Language Model Fingerprinting

Explore similar work

Every Model Leaves a Trace: Multi-Resolution LLM Fingerprinting

Who's Behind the Text? Robust Model Authorship Attribution

Chainwash: Multi-Step Rewriting Attacks on Diffusion Language Model Watermarks