{"id":"bdf6ce62-92c0-4265-9e05-98f6d0a29fe8","arxiv_id":"2505.12682","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"RoFL (the body's title) shows that rare, low-likelihood prompt-response pairs can serve as stable black-box fingerprints that identify a language model lineage after fine-tuning, LoRA, quantization, and prompt-template changes.","lead":"This paper presents a black-box fingerprinting method that finds rare, unlikely prompts which trigger the same response before and after common model modifications such as fine-tuning, quantization, or prompt changes. A smart generalist should read it because, if it works, model owners could detect whether an API or product secretly runs an adapted copy of their model without altering weights or degrading quality.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Robustness numbers are partly selected: fingerprints are optimized on finetuned models that later appear in the evaluation, so the rare-region persistence claim is not independently measured.","rationale":"The reader's weakest assumption was the informal rare-region stability premise; my concern is more specific and, I think, more directly load-bearing: the empirical validation of that premise is contaminated by selection. The multi-task objective (Eq. 2) is the main tool for achieving transfer, and the finetuned models used in that objective are included in the robustness averages. This means the headline 92–100% TPR values in Table 3 are partly measures of fit to the optimization set, not of persistence to unseen modifications. The Base-only results in Table 7 are the only unselected measurements, and they are materially weaker for two of the four model families, which is exactly the evidence needed to test the rare-region assumption. Table 4 does provide genuine independent support for Llama-2-7B, and that should be credited, but it does not cover the other three base models. The missing theoretical bound and the metadata mismatch (RAFP vs. RoFL) are real publication-integrity issues, but the central scientific claim would stand or fall on the unselected persistence measurement, so I focus the verdict there. A clean held-out split is straightforward and would settle the question; until that is reported, the current CONDITIONAL verdict is appropriate. I therefore recommend no change to the reader's verdict.","tokens_in":17468,"tokens_out":7082,"duration_ms":80243,"concrete_test":"Re-run the Table 3/5 protocol with an explicit split. Generate fingerprints in three conditions: (i) base model only; (ii) base + two finetuned models that are excluded from evaluation; (iii) base + the same two finetuned models as in the paper. Report TPR separately on the finetuned models used in optimization and on held-out finetuned models produced by the same five-dataset recipe, with at least three seeds and per-fingerprint variance. If held-out TPR for Llama-2-13B and Llama-3-8B remains at the 80–85% level of Table 7 rather than the 90–100% level of Table 3, the persistence claim is conditional on adaptation-specific selection and the paper should be revised to state this limitation. If held-out TPR matches the reported numbers, the selection concern is resolved and the central claim stands.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (Sec. 3) is that a fingerprint (x,y) is reproduced by every model in the same lineage. The paper's stated mechanism is that rare-region behaviors are stable under finetuning (Sec. 3.1) and that multi-task optimization (Eq. 2) picks prompts that survive a set of adapted models. The main robustness evidence, however, is partly selected rather than measured. In Sec. 4.2 the '+1 task' and '+2 tasks' variants optimize over one or two of the five downstream finetuned models, and Tables 3, 5, and Appendix Tables 7–9 then report TPR averaged over those same five finetuned models. A prompt chosen to maximize likelihood (Eq. 2) on a finetuned model is expected to score well on that model, so the near-100% entries in Table 3 for those variants are not independent tests of persistence. The only unselected variant, 'Base-only' (Table 7), gives markedly weaker and variable results: e.g., Llama-2-13B SFT 83.33%, Llama-3-8B SFT 80%, Llama-3-8B LoRA 83.33%. Thus the 'all models of the same lineage consistently generate y' claim is not established for 13B/3-8B by any unselected measurement. Table 4's real-HuggingFace-derivative results are independent and useful, but they cover only Llama-2-7B. The abstract also promises a bound on rare-region likelihood change under finetuning, but no theorem or proof appears in the body; Sec. 2.1 explicitly disclaims formal security proofs. The empirical gap, not the absence of theory, is the load-bearing issue.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript (whose body is titled 'RoFL: Robust Fingerprinting of Language Models') proposes a non-invasive, black-box method for identifying whether a suspect model is derived from a given LLM lineage. Fingerprints are prompt-response pairs (x,y) obtained by discrete GCG-style optimization of unlikely token sequences, with the goal that all models in a lineage reproduce y while unrelated models do not. The method is evaluated on Llama-2-7B/13B, Llama-3-8B, and Mistral-7B under SFT, LoRA, quantization, prompt-template, and decoding changes, and on real HuggingFace derivatives of Llama-2-7B. The paper reports near-100% true positive rates and substantially better robustness than IF and GCG baselines. The supplied cover abstract additionally promises a theoretical bound on the likelihood change of rare-region fingerprints under finetuning; no such bound appears in the body, which explicitly disclaims formal security proofs.","tokens_in":17764,"tokens_out":10272,"duration_ms":98380,"significance":"If the robustness claim were established, the method would be a valuable practical contribution: it is non-invasive, requires only black-box access, and supports cryptographic commitment for ownership proofs. The evaluation on real third-party derivatives (Table 4) is a useful external check that is absent from most prior fingerprinting work, and the comparison against invasive instruction-finetuning baselines is informative. The main limitation is that the evidence for the central lineage-persistence claim is partly selected rather than independently measured, and the promised theoretical support is missing. These gaps are load-bearing because the claimed advantage over prior art rests on the robustness numbers.","major_comments":[{"comment":"The headline robustness numbers for the recommended variants are partly selected rather than measured. The '+1 task' and '+2 tasks' variants optimize Eq. (2) over one or two of the five finetuned models and then report TPR averaged over those same five models; a fingerprint selected to maximize likelihood on a finetuned model is expected to score well on that model. The only variant that is not exposed to any finetuned model, 'Base-only' (Appendix Table 7), achieves only 83.33% SFT average and 90% LoRA average for Llama-2-13B, and 80% SFT and 83.33% LoRA for Llama-3-8B. Thus the Section 3 claim that 'all models of the same lineage consistently generate response y' is not established for these lineages by any unselected measurement. Please report TPR on finetuned models that were held out from the Eq. (2) optimization, and report the variance over the random choice of the one/two training tasks.","section":"Section 4.2; Tables 3, 5, 7-9"},{"comment":"The submitted cover abstract promises 'a theoretical analysis showing that the likelihood change of rare-region fingerprints under finetuning remains bounded,' but the body contains no theorem, proof, or formal statement of the claimed bound. Section 2.1 instead states that the absence of a formal robustness definition precludes formal security proofs. This is an omitted promised result. Either supply the bound with explicit assumptions, or remove the theoretical claim from the abstract; as it stands, the stated mechanism is supported only by heuristic reasoning.","section":"Abstract vs. body; Section 2.1"},{"comment":"The causal mechanism—that low-probability prompt regions receive weak optimization signal and limited gradient alignment under finetuning—is not directly tested. No experiment measures the rarity or likelihood of the selected prompts, and there is no comparison showing that rare prompts persist better than common prompts under finetuning. The observed transferability could instead result from the multi-task optimization in Eq. (2) selecting prompts that survive the particular finetuning datasets. An ablation that varies prompt rarity (or measures the likelihood of the optimized prompts) and compares against non-rare control prompts is needed to support the stated mechanism.","section":"Section 3.1"},{"comment":"The 100% effectiveness in Table 2 is by construction for ROFL: Section 3.2 keeps fingerprints only after an n-trial success (n=20) on the source model. The table therefore does not measure the success rate of the generation procedure, and comparing it with baselines that stop at first-trial success is not an apples-to-apples comparison. Please report the yield of gen() (e.g., the fraction of optimization runs that produce a usable fingerprint and the distribution of trials needed).","section":"Table 2; Section 3.2"},{"comment":"The manuscript identity is inconsistent: the supplied cover abstract describes 'RAFP: Identifying LLM Lineages via Rare-Region Fingerprints,' while the full text is titled 'RoFL: Robust Fingerprinting of Language Models.' As submitted, it is unclear which version is under review, and the promised RAFP bound is one symptom of this mismatch. This must be reconciled before the paper can be evaluated as a coherent submission.","section":"Front matter"}],"minor_comments":[{"comment":"Tables 7-9 use 'TRR' while the main text defines TPR; please unify the terminology.","section":"Appendix A.1"},{"comment":"The checkmark criterion for 'successfully fingerprinted' (relevant models) and for 'not fingerprinted' (irrelevant models) is not defined; specify the TPR/FPR threshold used.","section":"Table 4"},{"comment":"The label 'Base w/o' is inconsistent with 'Base-only' used elsewhere; use one name throughout.","section":"Table 5"},{"comment":"No uncertainty estimates are provided; with 10 fingerprints per model the resolution is 10 percentage points, so differences such as 93.33% vs 100% should be interpreted cautiously.","section":"All TPR tables"},{"comment":"The appendix concedes that perplexity filtering can remove fingerprints; since pre/post-filtering is excluded by the threat model, state this limitation explicitly in the main text rather than only in the appendix.","section":"Appendix A.3; Section 2.1"},{"comment":"There are several typos, including 'fingeprinting' in Section 4.2, 'fingeprint' and 'promps' in Appendix A.3, and 'sill' in Section 5; a proofreading pass is needed.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The main scientific issue is the partial circularity of the robustness evaluation: the recommended variants are optimized on finetuned models that later appear in the pooled TPR, and the unselected Base-only results are substantially weaker for two of the four families. This is fixable with held-out finetuning evaluations, but it is central, not cosmetic. Please also confirm which paper version is actually under review, since the cover abstract (RAFP) and the body (RoFL) do not match."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nTwo things to know before you read arXiv:2505.12682. First, the PDF is titled \"RoFL: Robust Fingerprinting of Language Models,\" with a different author list and abstract from the submitted metadata (which says \"RAFP\" and promises a theoretical bound). Second, the headline robustness numbers are partly selected: the fingerprints are optimized on finetuned models that later appear in the evaluation aggregates, so the persistence claim is not independently measured for those variants.\n\nWhat is actually new: the method uses GCG-style discrete optimization over low-probability (rare-region) prompt sequences, initialized with random and bottom-k tokens, then multi-task optimized over the base model plus one or two adapted models, with an n-trial stopping rule. That combination is distinct from GCG-QA (predefined QA pairs, single-model optimization) and from instructional fingerprinting (training modifications). The core intuition — that fine-tuning mostly touches high-density language behavior while rare prompts receive weak gradient signal — is plausible and the paper positions itself cleanly against prior work.\n\nThe strongest evidence is Table 4: fingerprints from Llama-2-7B identify nine real HuggingFace derivatives and reject five unrelated models. That is an independent, black-box, practical test, and it directly supports the claimed use case. It only covers Llama-2-7B, but it is real evidence.\n\nThe soft spots are load-bearing. Table 2's 100% effectiveness is by construction: fingerprints are kept only after repeated success on the base model. Tables 3, 5, and the appendix average over five finetuned models, and for the \"+1 task\" and \"+2 tasks\" variants, one or two of those same models were used in the optimization objective (Eq. 2). Those numbers are not independent tests of persistence. The only unselected variant, \"Base-only\" (Table 7), is weaker and more variable: Llama-2-13B SFT 83.33%, Llama-3-8B SFT 80%, Llama-3-8B LoRA 83.33%, and several 60% entries across the board. So the central claim that all models in a lineage consistently reproduce the fingerprint is not established for 13B and 3-8B by any unselected measurement. The promised theory also never appears: the abstract says a bound is provided, but Section 2.1 explicitly disclaims formal security proofs and the body offers no theorem. That mismatch needs correcting.\n\nThe metadata issue is not cosmetic: title, author list, and abstract diverge between the submission record and the manuscript. The authors must reconcile this before the paper can be evaluated in good faith.\n\nWho is this for? Researchers working on LLM IP protection and model fingerprinting will find the method idea and Table 4 useful. The paper deserves a serious referee because the concept is worth testing properly and the fix is achievable: split the models used to optimize fingerprints from the models used to evaluate them, report per-model and per-seed variance, and either supply the promised bound or retract it. I would not cite the current robustness numbers as-is, but I would want to see the revised version.\n\nRecommendation: send to peer review with a request for major revision.","headline":"The PDF is a different paper from the submission metadata, and the headline robustness numbers are partly selected because fingerprints are optimized on finetuned models that later appear in the evaluation; the underlying idea is plausible and Table 4 is genuinely useful, but the persistence claim needs an honest held-out test.","tokens_in":18371,"tokens_out":2146,"would_cite":false,"duration_ms":21675,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that rare, near-nonsense prompt-response pairs act as persistent, lineage-specific fingerprints that survive fine-tuning, quantization, and prompt changes.","keywords":["LLM fingerprinting","model ownership verification","rare-region prompts","black-box model attribution","non-invasive watermarking","greedy coordinate gradient","fine-tuning persistence","lineage identification"],"falsifier":"Take a set of fingerprints from one model, fine-tune that model with an objective that explicitly maximizes loss on those fingerprint prompts, and measure the true-positive rate; if the rate collapses, the rare-region stability premise is false. A more direct check is to compare the gradient magnitude and parameter-update norm induced by fingerprint prompts against high-density prompts during standard supervised fine-tuning; the paper's argument predicts the fingerprint-driven updates should be negligible.","tokens_in":17201,"feed_emoji":"🔍","tokens_out":9321,"duration_ms":84290,"temperature":0.7,"pith_summary":"Large language models are increasingly released under restricted licenses, so developers need a way to prove when an unauthorized adapted copy is their model. The paper claims that a rare prompt and its fixed response can serve as a fingerprint: every model from the same lineage reproduces the response, while unrelated models do not, and the pair survives common adaptations such as supervised fine-tuning, LoRA, quantization, system-prompt changes, and decoding changes. The fingerprints are non-invasive, because they are discovered by discrete gradient-based search over low-probability token sequences without modifying weights. The reason offered is that fine-tuning updates common high-density language behavior while rare low-probability regions receive weak optimization signal and limited gradient alignment. Experiments across four LLM families report strong persistence, with true-positive rates near 100 percent in black-box verification.","feed_headline":"Rare nonsense prompts can expose an LLM's secret lineage","feed_subtitle":"Fine-tuning and quantization leave low-probability behaviors intact, so a single odd prompt can prove model ownership.","key_machinery":"The central object is a rare-region fingerprint, a prompt-response pair (x, y) in which x is an unlikely token sequence optimized so that the model deterministically produces y. It is found by greedy coordinate-gradient (GCG) discrete optimization of the objective log p_M(y | h, x) for a fixed system prompt h; the multi-task variant sums this objective over several adapted models and system prompts so the fingerprint holds across a lineage. The carrier of the argument is the assumption that low-probability token regions are both unique by-products of a model's training and weakly optimized during fine-tuning, which is what keeps the prompt-response mapping intact.","core_discovery":"The core claim is that each model lineage carries stable, discoverable rare-region fingerprints: a prompt x plus a response y such that, given x, every model in the lineage emits y while other models emit something else. The paper argues that this stability follows from the distributional structure of fine-tuning: common, high-probability behaviors absorb most gradient updates, so low-probability prompt regions that are absent from natural training data remain almost untouched under common model changes. Generation proceeds by maximizing the log-likelihood of a fixed response over a rare prompt using greedy coordinate-gradient token replacement, and a multi-task variant jointly optimizes across several adapted models and system prompts to improve transfer. The paper reports empirical true-positive rates of 92 to 100 percent across Llama 2, Llama 3, and Mistral lineages after supervised fine-tuning, LoRA, quantization, prompt-template variation, and temperature changes. The abstract claims a theoretical bound on likelihood change under fine-tuning; the body, however, states that the threat model lacks a formal definition and that no formal security proof is provided.","pith_inferences":["An extension the paper leaves implicit is that the same rare-region search could attribute models that share public training data, but the uniqueness guarantee would weaken as lineages' training distributions converge.","A testable extension is adversarial fine-tuning that explicitly maximizes loss on suspected fingerprint prompts; if that erases fingerprints, the claim that rare regions receive negligible gradient signal would need qualification.","The reported success on DPO-adapted models hints that preference tuning also preserves rare-region behavior, which could make fingerprinting a general provenance tool rather than only a license-enforcement tool.","The front-running analysis in the appendix suggests fingerprint length and data de-duplication control how many poisoned web samples an attacker needs, a practical lever the paper connects to data-auditing but does not develop into a defense."],"forward_implications":["A model owner can commit hashes of fingerprints before release and later prove through a public ledger that a suspect model descends from the original.","Black-box APIs and products can be screened with a small number of queries, without ever touching the suspect model's weights.","Because fingerprints are found rather than trained in, generation does not degrade model quality.","Fingerprints continue to fire after instruction fine-tuning, LoRA, quantization, and system-prompt changes, so verification does not require knowing the adapter or template applied downstream.","If the premise holds, erasing fingerprints is not economically rational because it would require drastic model modifications that destroy the stolen model's value."],"supporting_citations":[{"why":"Supplies the greedy coordinate-gradient discrete optimization algorithm used to search for rare fingerprint prompts.","marker":"Zou et al. (2023)"},{"why":"Provides the instructional-fingerprinting baseline (IF-SFT and IF-Emb) and the true-positive-rate metric that the paper compares against.","marker":"Xu et al. (2024)"},{"why":"Provides the GCG-QA fingerprinting baseline used in uniqueness and robustness comparisons.","marker":"Jin et al. (2024)"},{"why":"Supplies the Llama 2 7B and 13B base models whose lineages are fingerprinted.","marker":"Touvron et al. (2023)"},{"why":"Supplies the Llama 3 8B base model used in the fingerprinting experiments.","marker":"Grattafiori et al. (2024)"},{"why":"Supplies the Mistral 7B base model used in the fingerprinting experiments.","marker":"Jiang et al. (2023)"},{"why":"Provides the Alpaca supervised fine-tuning recipe used to create downstream adapted models and to evaluate robustness.","marker":"Taori et al. (2023)"},{"why":"Supplies the Natural Instructions dataset used as one of the downstream fine-tuning tasks.","marker":"Mishra et al. (2022)"}],"fun_headline_variants":["Odd prompts fingerprint LLM lineages","Rare prompts unmask fine-tuned LLMs","Low-probability prompts reveal LLM ancestry","Black-box LLM ID via rare-region fingerprints","Fine-tuning-resistant fingerprints ID LLMs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that fine-tuning and other common modifications leave low-probability prompt regions nearly unchanged, so a rare prompt-response pair found before adaptation still fires after adaptation.","fun_headline_variants_meta":{"raw":{"variants":["Odd prompts fingerprint LLM lineages","Rare prompts unmask fine-tuned LLMs","Low-probability prompts reveal LLM ancestry","Black-box LLM ID via rare-region fingerprints","Fine-tuning-resistant fingerprints ID LLMs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000233,"raw_usage":{"total_tokens":1495,"prompt_tokens":949,"completion_tokens":546,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":565,"completion_tokens_details":{"reasoning_tokens":478}},"tokens_in":565,"tokens_out":546,"duration_ms":4695,"temperature":1.0,"reasoning_tokens":478,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:28:34.223838+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a set of fingerprints from one model, fine-tune that model with an objective that explicitly maximizes loss on those fingerprint prompts, and measure the true-positive rate; if the rate collapses, the rare-region stability premise is false. A more direct check is to compare the gradient magnitude and parameter-update norm induced by fingerprint prompts against high-density prompts during standard supervised fine-tuning; the paper's argument predicts the fingerprint-driven updates should be negligible.","supporting_citations":[],"review_version":1}