Reconstructing LLM Lineage Trees via Fine-Tuning Path Inference

Sota Ogawa; Shojiro Yamabe; Daiki Nishiyama; Jun Sakuma

cs.LGNov 6, 2026

Reconstructing LLM Lineage Trees via Fine-Tuning Path Inference

Authors: Sota Ogawa, Shojiro Yamabe, Daiki Nishiyama, Jun Sakuma

Organizations: Institute of Science Tokyo Tokyo, Japan · RIKEN

Abstract

Fine-tuned (FT) derivatives of large language models (LLMs) are now released in large numbers, yet their provenance relies on self-reports and cannot be verified. Misattributed lineage leaves a verifier unable to audit outsourced fine-tuning, confirm license compliance of derived models, or trace vulnerabilities that a parent passes to its children. All three require the direction of derivation, not merely its presence. Existing output-only methods are limited to pairwise derivation tests or undirected lineage estimation, while recovering a directed tree requires white-box access to model weights. We formalize the problem of reconstructing a directed model tree, including internal nodes, under gray-box access, where only teacher-forced log-likelihoods are observed and weights are never inspected. Fine-tuning raises the log-likelihood of the training data, and a child inherits this increase from its parent. Building on this property, we define an asymmetric per-task log-likelihood deviation between any two models as a trace of fine-tuning history, and derive from it an edge weight for each ordered pair of models. We propose TRACE-Edge, which exactly solves for the maximum spanning directed tree under these edge weights, with neither hyperparameters nor tree-structure constraints. We evaluate it on five configurations totaling 25 model trees built from three base models and seven tasks. TRACE-Edge achieves a parent-match accuracy of 0.74 when probed with the fine-tuning examples, and on average outperforms an output-similarity baseline even with held-out probes drawn from the same distribution as the training data.

Figures & tables

Case	$\|\mathcal{T}^{+}\|$	$\|\mathcal{T}^{-}\|$	$\delta_{(1)}$	$\delta_{(2)}$	$\delta_{\min}$	$s(f\to m)$
(1)	$1$	$0$	$>\epsilon$	$\approx 0$	$\approx 0$	$>\epsilon$
(2)	$\geq 2$	$0$	$>\epsilon$	$>\epsilon$	$\approx 0$	$\delta_{(1)}-\delta_{(2)}$
(3)	$0$	$\geq 1$	$\approx 0$	$\approx 0$	$<-\epsilon$	$<-\epsilon$
(4)	$\geq 1$	$\geq 1$	$>\epsilon$	—	$<-\epsilon$	$\delta_{(1)}-\|\delta_{\min}\|$

Table 1: Behavior of

\delta_{\tau}(f\to m)

and the score

s(f\to m)

for each relationship between

f

and

m

Panel of Figure 1 — Figure 1: Structure and task assignment of HET-3B. Edge labels denote the task each node used for fine-tuning. Task details and the structure of all five trees are shown in Figure 2 in Appendix D .

probe	Access	Method	HET-3B	HET-8B	HET-QWEN	DEEP	HOMO	Acc	DAcc
			Per-tree parent-match accuracy					All 5 trees
train	—	Star baseline	0.333	0.333	0.333	0.250	0.333	$0.317\pm 0.034$	$0.317\pm 0.034$
	Black	MST	0.700	0.667	0.633	0.600	0.500	$0.620\pm 0.165$	$0.553\pm 0.189$
	Gray	TRACE-Set	0.833	1.000	0.900	0.650	0.800	$\bm{0.837\pm 0.165}$	$\bm{0.857\pm 0.153}$
	Gray	TRACE-Edge	0.733	0.667	0.833	0.800	0.667	$0.740\pm 0.084$	$0.707\pm 0.129$
held-out	—	Star baseline	0.333	0.333	0.333	0.250	0.333	$0.317\pm 0.034$	$0.317\pm 0.034$

Table 2: Per-tree parent-match accuracy, and overall parent-match accuracy (Acc) and depth-match accuracy (DAcc) across all five trees, with the true root supplied as input. The per-tree columns are the mean over 5 seeds. The Acc and DAcc columns are the mean

\pm

standard deviation over all 25 runs (5 trees

\times

5 seeds). The access column is Black for black-box output, Gray for gray-box output, and — for no access to the model. Bold marks the best value within the same probe. Results with an estimated root are given in Appendix C.3 .

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

probe	Method	HET-3B	HET-8B	HET-QWEN	DEEP	HOMO	Acc	DAcc
		Per-tree parent-match accuracy					All 5 trees
train	Star baseline+RootEst	0.333	0.333	0.333	0.100	0.333	$0.287\pm 0.110$	$0.317\pm 0.034$
	MST+RootEst	0.700	0.667	0.633	0.450	0.500	$0.590\pm 0.173$	$0.493\pm 0.249$
	TRACE-Set+RootEst	0.833	1.000	0.900	0.375	0.800	$\bm{0.782\pm 0.272}$	$\bm{0.832\pm 0.198}$
	TRACE-Edge+RootEst	0.733	0.667	0.833	0.650	0.667	$0.710\pm 0.103$	$0.672\pm 0.139$
held-out	Star baseline+RootEst	0.333	0.333	0.333	0.000	0.333	$0.267\pm 0.136$	$0.283\pm 0.068$

Appendix

Table 3: Per-tree parent-match accuracy, and overall parent-match accuracy (Acc) and depth-match accuracy (DAcc) across all five trees, with the estimated root

\hat{r}

(Appendix C.1 ) supplied in place of the true root; compare against Table 2 . The per-tree columns are the mean over 5 seeds. The Acc and DAcc columns are the mean

\pm

standard deviation over all 25 runs (5 trees

\times

5 seeds). Bold marks the best value within the same probe.

Tree	Root model	Nodes	Depth	Depth 1	Depth 2	Depth 3	Change from reference tree
HET-3B	Llama-3.2-3B ( Grattafiori et al., 2024 )	7	2	gsm8k, xsum	e2e_nlg, wmt14_de_en	—	— (reference tree)
HET-8B	Llama-3.1-8B ( Grattafiori et al., 2024 )	7	2	gsm8k, xsum	e2e_nlg, wmt14_de_en	—	Root model size
HET-QWEN	Qwen2.5-3B ( Yang et al., 2024 )	7	2	gsm8k, xsum	e2e_nlg, wmt14_de_en	—	Root model family
DEEP	Llama-3.2-3B ( Grattafiori et al., 2024 )	9	3	gsm8k, xsum	e2e_nlg, wmt14_de_en	dialogsum, cnn_dailymail	Tree depth
HOMO	Llama-3.2-3B ( Grattafiori et al., 2024 )	7	2	xsum, cnn_dailymail	dialogsum, samsum	—	Diversity of child tasks

Appendix

Table 4: The five model trees used for evaluation. The “Depth

k

” columns list the tasks each node at depth

k

used for fine-tuning. At depths 1 and 2, each of the 2 nodes one level up derives children fine-tuned on the 2 listed tasks. The 2 depth-3 nodes of DEEP are children of

c_{3}

, the depth-2 e2e_nlg child.

Panel of Figure 2 — Figure 2: Structures and task assignments of the five model trees used for evaluation. Shaded nodes are the root $r$ , and edge labels denote the task $\tau_{m}$ the child node used for fine-tuning. (a)–(c) share the same structure and task assignment, differing only in the pretrained model placed at the root. (d) derives two depth-3 nodes $d_{1},d_{2}$ from $c_{3}$ of (a), and (e) fine-tunes every node on summarization tasks only. wmt14 abbreviates wmt14_de_en, and cnn_dm abbreviates cnn_dailymail.

Dataset	Task type
gsm8k ( Cobbe et al., 2021 )	Math word problems
xsum ( Narayan et al., 2018 )	Summarization
e2e_nlg ( Novikova et al., 2017 )	Data-to-text generation
wmt14_de_en ( Bojar et al., 2014 )	Translation (German $\to$ English)
dialogsum ( Chen et al., 2021 )	Dialogue summarization
cnn_dailymail ( Hermann et al., 2015 )	Summarization

Appendix

Table 5: Datasets used for fine-tuning and for the train/held-out probe sets.

Method	train Acc	train DAcc	held-out Acc	held-out DAcc
Star baseline	$0.333\pm 0.000$	$0.333\pm 0.000$	$0.333\pm 0.000$	$0.333\pm 0.000$
MST (black-box)	$0.967\pm 0.075$	$0.967\pm 0.075$	$\bm{0.867\pm 0.183}$	$\bm{0.800\pm 0.274}$
TRACE-Set	$\bm{1.000\pm 0.000}$	$\bm{1.000\pm 0.000}$	$0.333\pm 0.000$	$0.500\pm 0.000$
TRACE-Edge	$\bm{1.000\pm 0.000}$	$\bm{1.000\pm 0.000}$	$0.500\pm 0.000$	$0.500\pm 0.000$

Appendix

Table 6: Parent-match accuracy (Acc) and depth-match accuracy (DAcc) on the Full FT tree (single tree, 5 seeds), mean

\pm

SD. Bold marks the best value per column.

Figure 3: Node-by-task deviation matrices for the five model trees (train probe set).

Figure 4: Deviation matrices with the probe set set to held-out (non-training examples from the same distribution). The positive deviation for a node’s own fine-tuning task remains for most nodes, but the deviation for ancestor tasks fails to stay positive.

Data Provenance in Language Models

See all 48 papers

Aug 7, 2026

Who Built This Model? Tracing LLM Lineage via Spectral Fingerprints in Weight Space

Open-weight large language models (LLMs) are increasingly developed through complex, multi-stage pipelines, leading to intricate lineage relationships that reflect model origin, ownership, and evolution. Understanding these relationships is important for model provenance, governance, and supply-chain integrity. In this work, we investigate the notion of LLM "biometrics" (analogous to human biometrics) to ask whether LLMs exhibit intrinsic fingerprints in weight space alone, without access to input data, that reveal their origin and lineage. We formulate this as a lineage discrimination problem, distinguishing among independent-origin, same-series, and shared-base models. To characterize these relationships, we propose a unified geometric fingerprinting framework that analyzes weight matrices from two complementary perspectives: (i) spectral energy, captured by singular value distributions to encode global magnitude patterns, and (ii) subspace alignment, quantified via subspace deviations to capture directional geometry. Our analysis uncovers a clear hierarchy of structural similarity in weight space: spectral energy reliably distinguishes independently trained models and different model families, while subspace alignment enables fine-grained discrimination among closely related models, including variations in dataset scale and post-training procedures. Extensive experiments on over 110 diverse open-weight LLM pairs demonstrate that weight-space geometry provides a robust and interpretable signal for model lineage, enabling coarse-grained regime separation and fine-grained discrimination within shared-base models.

Yiwei Chen, Bingqi Shang, Sijia Liu

Michigan State University

Language Model Fingerprinting Open-Weight Language Models Weight-Space Analysis

Ask PDF

Aug 14, 2026

Training Leaves Traces: Centered Residual Signatures for Language Model Lineage Verification

Open-weight language models are fine-tuned, quantized, pruned, and merged, yet their provenance is often undocumented. We study data-free white-box lineage verification: can weights alone reveal whether two compatible model checkpoints share ancestry? Residual training produces a shared identity-aligned component in branch products, so this structure alone cannot establish ancestry. We remove it and compare checkpoint-specific structure across residual blocks, yielding a symmetric lineage score calibrated against independent checkpoints. On residual-MLP and GPT-2 benchmarks, the score separates fine-tuned, LoRA-merged, pruned, and quantized descendants from independent and distilled models (AUROC=1.0), distinguishing weight ancestry from behavioral similarity. Under function-preserving checkpoint laundering experiments, weight-space baselines lose margin or fail; our score remains unchanged and runs 76x faster than the nearest robust baseline on GPT-2. The projection-pairing signal appears across six language-model families and beyond, and a case study correctly identifies 3 related and 7 unrelated LLaMA-2 public checkpoints. Collectively, these results establish a passive, data-free provenance signal for compatible open-weight language-model checkpoints

Aman Singh Thakur, Rayan Khoury

Massachusetts Institute of Technology, USA

Language Model Fingerprinting Open-Weight Language Models Data Provenance in Language Models

Ask PDF

Apr 7, 2026

AttnDiff: Attention-based Differential Fingerprinting for Large Language Models

Protecting the intellectual property of open-weight large language models (LLMs) requires verifying whether a suspect model is derived from a victim model despite common laundering operations such as fine-tuning (including PPO/DPO), pruning/compression, and model merging. We propose AttnDiff, a data-efficient white-box framework that extracts fingerprints from models via intrinsic information-routing behavior. AttnDiff probes minimally edited prompt pairs that induce controlled semantic conflicts, captures differential attention patterns, summarizes them with compact spectral descriptors, and compares models using CKA. Across Llama-2/3 and Qwen2.5 (3B--14B) and additional open-source families, it yields high similarity for related derivatives while separating unrelated model families (e.g.,

>0.98

vs.\

<0.22

with

M=60

probes). With 5--60 multi-domain probes, it supports practical provenance verification and accountability.

Haobo Zhang, Zhenhua Xu, Junxian Li +3

Zhejiang University of Technology · Binjiang Institute of Zhejiang University · Zhejiang University +2

Language Model Fingerprinting Data Provenance in Language Models Fingerprint Identification

Ask PDF

Abstract

Data Provenance in Language Models

Explore similar work

Who Built This Model? Tracing LLM Lineage via Spectral Fingerprints in Weight Space

Training Leaves Traces: Centered Residual Signatures for Language Model Lineage Verification

AttnDiff: Attention-based Differential Fingerprinting for Large Language Models