Protecting the intellectual property of large language models (LLMs) is a critical challenge due to the proliferation of unauthorized derivative models. We introduce a novel fingerprinting framework that leverages the behavioral patterns induced by safety alignment, applying the concept of refusal vectors for LLM provenance tracking. These vectors, extracted from directional patterns in a model's internal representations when processing harmful versus harmless prompts, serve as robust behavioral fingerprints. Our contribution lies in developing a fingerprinting system around this concept and conducting extensive validation of its effectiveness for IP protection. We demonstrate that these behavioral fingerprints are highly robust against common modifications, including finetunes, merges, and quantization. Our experiments show that the fingerprint is unique to each model family, with low cosine similarity between independently trained models. In a large-scale identification task across 76 offspring models, our method achieves 100\% accuracy in identifying the correct base model family. Furthermore, we analyze the fingerprint's behavior under alignment-breaking attacks, finding that while performance degrades significantly, detectable traces remain. Finally, we propose a theoretical framework to transform this private fingerprint into a publicly verifiable, privacy-preserving artifact using locality-sensitive hashing and zero-knowledge proofs.
PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
King Abdullah University of Science and Technology（阿卜杜拉国王科技大学）；RIKEN Center for Advanced Intelligence Project（理化学研究所先进智能项目中心）；University of Macau（澳门大学）；National Institute of Informatics（国立信息学研究所）；University of Electronic Science and Technology of China（电子科技大学）
Prompt2Fingerprint: Plug-and-Play LLM Fingerprinting via Text-to-Weight Generation
Shenzhen International Graduate School, Tsinghua University, Shenzhen, China（清华大学深圳国际研究生院，中国深圳）；South China University of Technology, Guangzhou, China（华南理工大学，中国广州）；Harbin Institute of Technology, Shenzhen, Shenzhen, China（哈尔滨工业大学深圳校区，中国深圳）
The Shape of Ownership: Verifying LLM Provenance through Semantic Structures
School of Big Data & Software Engineering, Chongqing University（重庆大学大数据与软件工程学院）；College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）
Implicit Identity Technologies for LLMs: Fingerprinting and Watermarking across Datasets, Models, and Generated Content
School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China（西安交通大学计算机科学与工程学院）；State Grid Henan Marketing Service Center, Henan, China（国网河南营销服务中心）；Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China（中国科学院大学网络安全学院）；School of Information Technology, Deakin University, Geelong, Australia（迪金大学信息技术学院）
AttnDiff: Attention-based Differential Fingerprinting for Large Language Models
Zhejiang University of Technology（浙江工业大学）；Zhejiang University（浙江大学）；Binjiang Institute of Zhejiang University（浙江大学滨江研究院）；Shanghai Jiao Tong University（上海交通大学）；University of Science and Technology of China（中国科学技术大学）
