Every Model Leaves a Trace: Multi-Resolution LLM Fingerprinting

Mohammad Reza Modarres; Armin Tourajmehr; Artin Tavasoli; Yadollah Yaghoobzadeh; Mohammad Taher Pilehvar

cs.CLOct 20, 2026

Every Model Leaves a Trace: Multi-Resolution LLM Fingerprinting

Authors: Mohammad Reza Modarres, Armin Tourajmehr, Artin Tavasoli, Yadollah Yaghoobzadeh, Mohammad Taher Pilehvar

Organizations: School of Electrical and Computer Engineering, College of Engineering, University of Tehran, Tehran, Iran · Tehran Institute for Advanced Studies, Khatam University, Iran · Cardiff University, United Kingdom

Abstract

Large language models leave model-specific traces in their generated text, but it remains unclear how finely these fingerprints can distinguish related models and which signals remain informative as obvious cues are reduced. We study this through fingerprint resolution, considering both model resolution, from different families to distilled and adapted variants, and signal resolution across behavioral, stylometric, lexical, and semantic evidence. We progressively suppress surface cues, paraphrase outputs, vary the amount of available text, and test generalization across prompt distributions and languages. Our results show that fingerprints persist beyond broad family differences, remaining detectable in distilled models and even LoRA adaptations of the same base model. Although attribution weakens as surface and lexical cues are altered, substantial model-specific signal remains. These signals transfer across prompt sources and languages, with semantic representations proving most robust across languages. These findings show that model identity is recoverable at multiple resolutions, but that recoverability depends on model similarity and the evidence available in the text.

Figures & tables

Figure 1: Overview of the fingerprint-resolution framework, linking model similarity, observable evidence, and generalization across prompts, languages, and text budgets.

View	Transformation
$T_{0}$	Raw response
$T_{1}$	Remove words from the beginning and end
$T_{2}$	$T_{1}$ + remove formatting and layout cues
$T_{3}$	$T_{2}$ + lowercase and remove punctuation, symbols, and emojis
$P_{1}$	Paraphrase approximately one third of eligible sentences in $T_{0}$
$P_{2}$	Paraphrase the full $T_{0}$ response

Table 1: Response views used to progressively remove or rewrite model-identifying cues.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	52.42	60.72	80.07	66.04	81.41	83.75
T1	48.78	58.93	76.27	60.81	76.14	76.13
T2	41.88	56.34	72.48	56.23	71.86	74.42
T3	25.59	49.62	67.76	50.94	67.04	69.35
P1	50.86	58.20	74.42	63.69	77.85	80.90
P2	48.12	53.32	68.18	57.81	71.86	75.23

Table 2: Cross-family attribution accuracy (%) using logistic regression. Chance accuracy is 12.5%.

Panel of Figure 2 — Figure 2: Controlled LoRA fingerprint resolution using Combined logistic-regression accuracy (%). vs base compares each strength with the unadapted model, and vs previous with the preceding strength. Chance is 50%.

Figure 3: Cross-family attribution under P2 ∗ across word budgets and text positions.

Train	Test	Accuracy (%)
D2 + D3 + D4	D1	84.19
D1 + D3 + D4	D2	81.41
D1 + D2 + D4	D3	68.63
D1 + D2 + D3	D4	67.88
Mean	–	75.52

Table 5: Cross-dataset attribution performance in the 8-way setting. (a) Accuracy when training on three prompt datasets and evaluating on the held-out fourth dataset. (b) Attribution performance on D3 by task type when training on D1, D2, and D4. Chance accuracy is 12.5%.

Train $\rightarrow$ Test	Behavioral	Stylometric	Semantic	Combined	PN Embedding †
EN $\rightarrow$ FA	34.54	15.38	32.63	34.82	44.75
EN $\rightarrow$ ZH	35.01	16.76	40.23	39.00	59.10
FA $\rightarrow$ EN	21.77	21.04	16.81	19.67	47.99
FA $\rightarrow$ ZH	26.39	21.98	24.40	34.76	55.78
ZH $\rightarrow$ EN	27.30	20.68	30.03	36.39	59.46
ZH $\rightarrow$ FA	32.86	22.62	39.36	35.53	51.07

Table 6: Cross-lingual 8-way model attribution accuracy (%) on raw outputs (T0) using logistic regression. EN denotes English, FA Persian, and ZH Mandarin Chinese. Chance accuracy is 12.5%.

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Task	Description
Explanation	Explain a concept clearly and accurately to a general reader.
Argument and advice	Evaluate a situation, weigh alternatives, and provide a justified recommendation.
Creative writing	Produce an original story or scene under specified narrative conditions.
Rewriting	Transform a supplied passage while preserving its central meaning.
Source synthesis	Combine four supplied source notes into a coherent response.

Appendix

Table 7: Task categories in the D3 control set.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	59.92	66.82	79.74	68.10	82.01	84.46
T1	55.02	63.39	75.91	61.53	77.53	77.08
T2	47.47	60.36	72.36	56.23	73.12	74.56
T3	29.41	53.13	67.98	51.71	68.21	70.06
P1	59.79	65.08	74.12	65.05	78.63	81.62
P2	56.65	60.09	68.29	58.62	72.68	75.99

Appendix

Table 8: Cross-family attribution accuracy (%) using MLP. Chance accuracy is 12.5%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	55.76	58.32	60.26	55.51	62.14	62.70
T1	55.88	57.13	56.63	54.88	58.07	59.95
T2	53.69	56.20	56.51	53.07	56.01	56.57
T3	52.63	57.95	55.82	51.63	57.07	56.70
P1	56.20	57.01	55.76	54.26	60.20	60.95
P2	54.63	54.69	53.07	54.07	55.82	58.57

Appendix

Table 9: Within-family attribution accuracy (%) for Llama-3.1-8B vs. Llama-3.1-70B using logistic regression. Chance accuracy is 50%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	58.82	61.20	60.01	57.07	65.52	69.21
T1	58.20	58.45	57.57	55.51	61.33	60.70
T2	56.26	57.38	56.63	55.07	56.57	60.08
T3	50.06	56.45	56.51	54.63	58.14	57.70
P1	58.76	60.14	58.45	58.32	64.27	65.96
P2	57.07	58.76	55.88	57.20	60.33	63.33

Appendix

Table 10: Within-family attribution accuracy (%) for Llama-3.1-8B vs. Llama-3.3-70B using logistic regression. Chance accuracy is 50%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	57.76	59.89	69.02	57.88	68.21	70.59
T1	57.20	61.64	66.96	56.57	65.77	67.21
T2	53.69	59.57	63.58	54.32	64.02	62.20
T3	53.19	59.26	62.58	54.57	62.27	65.08
P1	56.38	60.39	64.14	57.01	65.33	68.34
P2	56.26	56.95	63.14	56.38	63.39	65.21

Appendix

Table 11: Within-family attribution accuracy (%) for Llama-3.1-8B vs. Llama-4-Maverick using logistic regression. Chance accuracy is 50%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	61.83	58.14	61.20	60.58	63.77	72.09
T1	61.33	58.39	56.82	55.19	62.52	62.58
T2	57.95	59.07	55.69	54.26	60.20	61.83
T3	55.19	57.13	56.26	53.38	58.89	59.57
P1	60.89	57.76	57.95	60.08	62.89	69.34
P2	60.58	55.57	56.51	55.88	60.01	63.45

Appendix

Table 12: Within-family attribution accuracy (%) for Llama-3.1-70B vs. Llama-3.3-70B using logistic regression. Chance accuracy is 50%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	59.89	63.27	69.65	60.33	70.71	72.22
T1	59.26	62.08	67.83	56.51	69.09	67.33
T2	57.07	60.95	66.52	57.32	66.71	64.33
T3	55.82	61.08	65.83	58.07	66.77	64.58
P1	59.64	60.08	63.39	57.32	67.52	66.08
P2	58.57	59.45	62.89	56.01	62.64	62.83

Appendix

Table 13: Within-family attribution accuracy (%) for Llama-3.1-70B vs. Llama-4-Maverick using logistic regression. Chance accuracy is 50%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	57.63	61.08	66.52	58.89	66.02	73.47
T1	59.89	60.95	64.46	56.32	64.96	68.84
T2	57.76	61.51	64.96	56.07	63.95	65.46
T3	52.82	59.39	64.77	57.20	63.83	68.46
P1	59.01	60.08	64.77	56.95	65.96	70.84
P2	57.07	55.38	59.82	55.19	61.33	67.58

Appendix

Table 14: Within-family attribution accuracy (%) for Llama-3.3-70B vs. Llama-4-Maverick using logistic regression. Chance accuracy is 50%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	66.77	69.99	71.37	69.42	74.27	81.34
T1	66.96	68.54	70.62	70.74	71.31	79.45
T2	65.76	68.10	69.74	70.24	71.69	80.33
T3	66.08	66.90	70.30	68.28	71.25	78.81
P1	66.58	67.78	69.36	70.18	73.01	80.83
P2	59.46	61.60	65.07	65.13	67.40	71.50

Appendix

Table 17: Teacher–student attribution accuracy (%) for Llama-3.1-8B vs. Llama-3.1-Minitron-4B using logistic regression. Chance accuracy is 50%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	99.44	99.50	99.12	99.44	99.69	99.87
T1	99.06	99.19	98.87	98.81	99.12	99.37
T2	98.25	98.81	97.87	98.31	98.68	99.25
T3	98.43	98.62	97.74	98.56	98.56	100.00
P1	99.56	99.50	99.06	99.44	99.69	99.87
P2	73.06	82.14	85.84	84.40	88.22	93.86

Appendix

Table 18: Teacher–student attribution accuracy (%) for Mistral-NeMo-Instruct vs. NeMo-Minitron-8B using logistic regression. Chance accuracy is 50%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	71.74	68.23	68.36	70.86	76.94	89.22
T1	71.18	68.30	67.04	71.30	77.07	87.59
T2	60.34	68.61	67.67	64.10	68.05	81.20
T3	58.65	66.73	66.85	60.28	68.42	82.58
P1	70.99	67.54	65.79	69.24	76.32	88.22
P2	70.18	63.91	63.35	63.16	71.93	81.08

Appendix

Table 19: Teacher–student attribution accuracy (%) for Gemma-2-27B vs. Gemma-2-2B using logistic regression. Chance accuracy is 50%.

	Llama-3.1-8B		Qwen3-8B
Feature	vs Base	vs Previous	vs Base	vs Previous
Behavioral	59.26	52.52	68.44	56.56
Stylometric	58.37	51.48	68.89	55.99
Lexical	60.20	51.54	70.46	56.51
Semantic	58.48	51.07	69.47	55.35

Appendix

Table 20: LoRA-variant attribution accuracy (%) using logistic regression. vs Base distinguishes each adapted model from its unadapted base model, whereas vs Previous distinguishes each LoRA strength from the immediately preceding strength. Results are averaged across GSM8K and MATH adaptations and all LoRA-strength comparisons. Binary chance accuracy is 50%.

Panel of Figure 4 — Figure 4: Attribution accuracy as a function of available text in the 8-way cross-family setting. (a) Original model outputs. (b) Outputs after the T3 surface transformation. Prefix, center, and suffix indicate the location from which the available words are selected.

Model	Explanation	Argument	Creative	Rewrite	Synthesis
Llama-4 Maverick	97.50	97.50	100.00	55.00	90.00
Qwen3-32B	80.00	97.50	82.50	12.50	40.00
Mistral Small 3.2	70.00	92.50	75.00	47.50	20.00
Gemma-4-31B	100.00	100.00	85.00	30.00	12.50
DeepSeek-V4	87.50	92.50	100.00	15.00	15.00
Claude Haiku 4.5	97.50	100.00	95.00	75.00	100.00

Appendix

Table 21: Per-model recall (%) across the five D3 task categories under cross-dataset generalization. The classifier is trained on D1, D2, and D4 and evaluated on D3. Chance recall is 12.5%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	51.60	57.69	86.98	69.60	86.40	79.87
T1	48.40	60.42	84.27	64.47	82.97	74.04
T2	41.90	59.99	80.61	60.65	79.20	70.74
T3	30.59	55.28	78.85	56.20	77.05	66.65
P1	50.31	57.47	83.27	67.50	83.24	77.85
P2	47.51	53.98	79.03	61.83	79.26	72.37

Appendix

Table 24: Within-language 8-way cross-family attribution accuracy (%) on Persian outputs using logistic regression. Chance accuracy is 12.5%.

View	Behavioral	Stylometric	Lexical	Semantic	Combined	PN Embedding †
T0	54.57	59.01	83.79	68.48	83.62	83.76
T1	51.92	57.90	80.32	63.80	79.93	77.32
T2	43.96	56.82	77.61	59.82	76.41	75.42
T3	29.08	50.78	73.98	55.55	72.50	71.28
P1	53.52	57.45	80.74	66.96	81.12	81.26
P2	51.99	56.81	78.80	64.60	79.46	79.13

Appendix

Table 25: Within-language 8-way cross-family attribution accuracy (%) on Chinese outputs using logistic regression. Chance accuracy is 12.5%.

Language Model Fingerprinting

Language model fingerprinting identifies and verifies models or their lineage from distinctive outputs, internal representations, or embedded signals.

See all 81 papers

AttnDiff: Attention-based Differential Fingerprinting for Large Language Models
Apr 7, 2026Haobo Zhang, Zhenhua Xu, Junxian Li +3Language Model Fingerprinting Data Provenance in Language Models
Zhejiang University of Technology · Binjiang Institute of Zhejiang University · Zhejiang University +2
Language Model Fingerprinting Requires Rethinking Watermark Teachers
Oct 3, 2026Jeongyeon Hwang, Anshul Nasery, Sewoong Oh +1Language Model Fingerprinting Fingerprint Identification
Pohang University of Science and Technology · University of Washington
TokenPrint: A Calibrated Token-Space Fingerprint for Language-Model Provenance
Aug 8, 2026Yuqi Wu, Shengming Zhao, Jie ChenLLM Auditing Language Model Fingerprinting
College of Biomedical Engineering, Fudan University

Apr 7, 2026J/K move · Enter open · S save

AttnDiff: Attention-based Differential Fingerprinting for Large Language Models

Haobo Zhang, Zhenhua Xu, Junxian Li, Shangfeng Sheng+2

Zhejiang University of Technology · Binjiang Institute of Zhejiang University · Zhejiang University+2

Language Model Fingerprinting Data Provenance in Language Models Fingerprint Identification

Open paper AskPDF arXiv

Protecting the intellectual property of open-weight large language models (LLMs) requires verifying whether a suspect model is derived from a victim model despite common laundering operations such as fine-tuning (including PPO/DPO), pruning/compression, and model merging. We propose AttnDiff, a data-efficient white-box framework that extracts fingerprints from models via intrinsic information-routing behavior. AttnDiff probes minimally edited prompt pairs that induce controlled semantic conflicts, captures differential attention patterns, summarizes them with compact spectral descriptors, and compares models using CKA. Across Llama-2/3 and Qwen2.5 (3B--14B) and additional open-source families, it yields high similarity for related derivatives while separating unrelated model families (e.g.,

>0.98

vs.\

<0.22

with

M=60

probes). With 5--60 multi-domain probes, it supports practical provenance verification and accountability.

Abstract

Language Model Fingerprinting

Explore similar work

AttnDiff: Attention-based Differential Fingerprinting for Large Language Models

Language Model Fingerprinting Requires Rethinking Watermark Teachers

TokenPrint: A Calibrated Token-Space Fingerprint for Language-Model Provenance