{"id":"609747e9-f0e7-4156-ac02-b5e8d122611e","arxiv_id":"2509.09703","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"CTCC embeds LLM ownership fingerprints in cross-turn semantic contradictions: the model fires a secret response only when a user contradicts an earlier statement, with higher robustness and stealth than single-turn triggers.","lead":"CTCC hides an ownership mark in large language models by making the model respond with a secret sentence only when a user contradicts something they said earlier in the conversation. It resists fine-tuning, pruning, and merging better than existing fingerprinting methods, while looking like ordinary chat.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Robustness claim assumes the adversary never learns the semantic trigger rule; targeted removal (MeRaser) is untested, and generic Alpaca tuning already drops CTCC FSR to 41.1%.","rationale":"The paper presents a plausible and reasonably well-supported fingerprinting mechanism, and the public code/data are a genuine asset. The core weakness is the mismatch between the strength of the claimed robustness/leakage-resistance and the threat model actually exercised: generic fine-tuning, merging, pruning, and input perturbation are useful, but they do not test an adversary who knows the semantic rule. The paper itself concedes that MeRaser and downstream transfer are untested, which directly limits the headline claims. This is a validation-scope problem rather than an internal inconsistency in the construction, so the appropriate verdict remains CONDITIONAL, as the reader concluded. My read does not change the verdict; it reinforces the need for targeted-removal experiments before the claims are accepted as stated.","tokens_in":24497,"tokens_out":3675,"duration_ms":39682,"concrete_test":"Run MeRaser (Zhang et al., 2025) on CTCC-fingerprinted LLaMA2, Mistral, and LLaMA3 using the exact protocol from its paper, then measure both FSRtrigger and FSRneg. Separately, simulate partial trigger exposure: construct a suppression set from 100 held-out trigger templates, fine-tune the fingerprinted model for one epoch on those templates paired with normal responses, then evaluate FSR on the 47 unseen trigger templates. If FSR falls materially below the ≈90–100% level reported in Section 5, the 'continuous construction under a shared semantic rule' and 'consistently higher robustness' claims must be narrowed to non-adaptive adversaries.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim ('consistently achieves higher robustness and stealth than existing approaches', Section 7; 'mitigating false positives and fingerprint leakage ... supporting continuous construction under a shared semantic rule even if partial triggers are exposed', Abstract) depends on the threat model in Section 3, where the adversary applies generic post-hoc transformations but does not know the semantic rule. Yet CTCC's code and data are public and the rule is simple: a cross-turn contradiction at position (j,i). A motivated thief can learn or infer this rule. The Limitations explicitly state that MeRaser (Zhang et al., 2025) and downstream fingerprint transfer are untested. This is not a peripheral gap: MeRaser is a state-of-the-art fingerprint erasure method designed for backdoor-style fingerprints, targeting exactly the trigger-response behavior CTCC embeds. Without such an experiment, robustness is established only against generic, non-adaptive transformations. The 41.1% FSR after LLaMA2 + Alpaca incremental fine-tuning (Table 3) already shows that a relatively benign instruction-tuning distribution can substantially disrupt the cross-turn trigger; a targeted removal or anti-trigger fine-tune on generated contradiction dialogues would plausibly degrade it further. Therefore the claims of 'leakage resistance' and 'continuous construction under partial exposure' are unsupported for an adversary who knows the rule.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CTCC, an invasive backdoor fingerprinting framework for LLMs in which the trigger is a cross-turn semantic contradiction (e.g., a user statement in turn j contradicted in turn i) rather than a fixed token- or single-turn pattern. The method constructs trigger, suppression, and normal dialogue sets, fine-tunes the base model with LoRA, and verifies ownership by querying the suspect model with held-out trigger dialogues and checking for a predefined response. Experiments compare CTCC against ProFlingo, IF, and HashChain across LLaMA2-7B, Mistral-7B, and LLaMA3-8B (plus Qwen2.5-14B in an appendix) under quantization, input perturbation, model merging, incremental fine-tuning, pruning, and decoding-parameter variation. The authors report low perplexity triggers, 0% false-activation rates, and generally higher FSR than baselines, concluding that CTCC is a robust, stealthy, black-box-compatible fingerprinting solution.","tokens_in":24823,"tokens_out":4939,"duration_ms":49174,"significance":"If the claimed robustness and stealth hold, CTCC would be a practically valuable contribution: it uses natural-language triggers, supports black-box verification, and reports broad empirical coverage across model families and transformation types. The paper's strengths include a comparatively wide attack suite (fine-tuning, merging, pruning, input/output perturbation), public code and data, and low circularity: the FSR values are measured rather than derived from assumptions. However, the central comparative claims overreach the evidence: one table shows CTCC at 41.1% FSR where a baseline reaches 100%, the baselines are LoRA re-implementations whose deviation from their original settings is acknowledged, and the threat model excludes adaptive adversaries who know the trigger rule while the Limitations explicitly leave MeRaser and downstream transfer untested. These gaps are load-bearing for the advertised leakage-resistance and 'consistently higher robustness' conclusions.","major_comments":[{"comment":"The claims that CTCC 'consistently achieves higher robustness and stealth than existing approaches' and 'mitigating ... fingerprint leakage' are not supported by the data. In Table 3, under LLaMA2 + Alpaca incremental fine-tuning, CTCC obtains FSR 41.1% while ProFlingo obtains 100%. The text (Section 5.5.2) acknowledges this exception, but the abstract and conclusion retain the unqualified 'consistently' wording. A 41.1% activation rate is also far below the reliability level one would expect for ownership verification. Either the claims must be qualified to the regimes where CTCC is genuinely superior, or additional evidence is needed to show that this failure is an artifact of a particular dataset/model combination.","section":"Abstract and §7, Table 3"},{"comment":"The threat model assumes the adversary applies generic post-hoc transformations without knowing the semantic trigger rule. The Limitations explicitly state that robustness against MeRaser—a state-of-the-art fingerprint erasure method for backdoor-style fingerprints—and downstream fingerprint transfer are untested. Because the CTCC trigger is a simple cross-turn contradiction, and the code and data are public, a motivated adversary can infer the rule and launch targeted removal (e.g., fine-tuning on generated contradictory dialogues or using MeRaser). Without experiments against such adaptive attacks, the abstract's claims of 'mitigating fingerprint leakage' and 'continuous construction under a shared semantic rule even if partial triggers are exposed' are unsupported. This is not a peripheral gap; it is central to the advertised leakage resistance.","section":"Section 3 and Limitations"},{"comment":"The baselines are re-implemented with LoRA rather than their original training settings. For IF, the authors explicitly note that their black-box LoRA implementation differs from the original IF-Adapter and IF-SFT variants and that 'LoRA tuning may be marginally less effective than full fine-tuning in preserving backdoor activation,' which 'potentially explains the 0% FSR observed on LLaMA2 and LLaMA3.' This means the robustness comparison in Tables 3 and 4 may partly reflect a weakened baseline rather than a genuine advantage of CTCC. The paper should report IF under its original IF-SFT (full fine-tuning) setting, or at minimum clearly frame the comparison as 'LoRA re-implementations' and discuss how the choice affects the conclusions.","section":"Appendix B.2.1"},{"comment":"ProFlingo is reported as '–' (incompatible) for LLaMA3 in Table 3 and absent from Table 6, but the main text does not explain why. If ProFlingo cannot be evaluated on LLaMA3, the claim of consistent superiority across 'multiple LLM architectures' is weakened, since one of the four attack families is missing for a third of the models. The reason for the incompatibility and its implications for the comparison should be stated in the main text.","section":"Tables 3 and 6"},{"comment":"The formula p = 2/(i(i-1)) for the probability of a natural dialogue matching the trigger position (j,i) is presented without derivation or stated assumptions. As written, for i=2 the formula gives p=1, which is clearly not the intended meaning unless additional conditions are assumed (e.g., exactly one contradiction event uniformly distributed over all turn pairs). The derivation and the underlying stochastic model should be made explicit; otherwise the 'vanishingly small' false-positive claim is not quantitatively grounded.","section":"Section 6.2"}],"minor_comments":[{"comment":"Typo: 'the the more recent LLaMA3-8B' should be 'the more recent LLaMA3-8B'.","section":"Section 5.1"},{"comment":"The sentence about the LLaMA2 Alpaca exception says 'it reaches only 41' without the percent symbol or decimal; Table 3 shows 41.1%. Please make consistent.","section":"Section 5.5.2"},{"comment":"The statement that all methods are trained 'using identical hyperparameters' is only meaningful if the hyperparameters are compatible with each method; for example, IF's original design uses full fine-tuning. Please clarify whether 'identical' refers to the LoRA rank/learning rate only, or also to the number of epochs and dataset sizes.","section":"Appendix B.2.2"},{"comment":"The manual inspection and 5,000-sample Dolly simulation for false-trigger rate are reported without details of how 'natural multi-turn prompts' were generated or how the contradiction condition was detected. Please provide a protocol or reference an appendix section.","section":"Section 6.2"},{"comment":"Several citations to the authors' own unpublished preprints (e.g., Xu et al. 2025a, 2025b, 2025c, 2025d, 2025e, 2025f) are used for context. While this is not improper, the survey citation [Xu et al. 2025f] could be replaced or supplemented with peer-reviewed work to help readers outside the authors' immediate group.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper has a solid empirical core but the headline claims need to be brought in line with the evidence. The LoRA re-implementation of IF and the missing ProFlingo-LLaMA3 results are the kind of issue that can be fixed with additional experiments and careful re-wording. The untested MeRaser/adaptive-attack scenario is the most consequential gap; I would encourage the editor to request that the authors either run those experiments or explicitly restrict the paper's claims to the non-adaptive threat model. There is also a notable cluster of self-citations to the same group's preprints; this is not disqualifying, but the novelty of CTCC relative to 'Insty' (Xu et al. 2025b) should be made clearer."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is the first fingerprinting scheme I've seen that makes the trigger a cross-turn semantic contradiction rather than a token or single-turn pattern, and that genuinely buys something: natural-looking queries, low perplexity, and robustness across fine-tuning, merging, pruning, and quantization. The LoRA-based injection is simple, reproducible, and the appendix is unusually honest about what was and wasn't tested. If you work on LLM watermarks or backdoors, read it.\n\nWhat's new and good: the trigger-design idea is clean. By distributing the trigger across two turns and training on a suppression set, they get 0% false activations on natural and near-trigger inputs across all three base models, and the 100% FSR on seen and unseen triggers holds up. The merging and pruning experiments are the strongest part of the paper; CTCC clearly outperforms IF, HashChain, and ProFlingo under Ties-merging and Taylor pruning. The extension to three-turn triggers and to Qwen2.5-14B is a nice bonus.\n\nSoft spots, in order of seriousness: (1) The central robustness claim is only established against non-adaptive, generic transformations. The threat model explicitly assumes the adversary doesn't know the semantic rule, but the rule is simple and the code is public. MeRaser is untested and the paper admits it. That's a real gap, not a nit, because MeRaser is designed exactly to erase backdoor-style fingerprints. (2) The Alpaca fine-tuning result on LLaMA2 — 41.1% FSR — is a concrete counterexample to \"consistently higher robustness,\" and it's not explained. A targeted fine-tune on generated contradiction dialogues would plausibly do much worse. (3) Baselines are re-implemented with LoRA rather than their original settings; the IF discrepancy is disclosed in B.2.1, but that means the comparison is not apples-to-apples. (4) No statistical uncertainty anywhere; point estimates over small test sets (48 seen, 47 unseen triggers) could have large error bars.\n\nThe paper is honest about its limitations, the method is sensible, and the empirical coverage is broad. I wouldn't cite it as the final word on robustness, but I would cite it as evidence that semantic cross-turn triggers are a promising direction.\n\nRecommendation: send it to peer review. A good reviewer will push on the adaptive threat model and demand a MeRaser experiment and a proper explanation of the Alpaca drop. With those, this could be a solid addition to the fingerprinting literature.","headline":"A solid, well-executed fingerprinting method paper whose main claims hold against generic attacks but not yet against adaptive ones; worth refereeing, with revisions on the threat model and baseline comparability.","tokens_in":25277,"tokens_out":644,"would_cite":true,"duration_ms":8506,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a backdoor spread across two dialogue turns—a later user statement that contradicts an earlier one—can watermark LLMs, and that this cross-turn semantic fingerprint survives fine-tuning, merging, pruning, and quantiza","keywords":["LLM fingerprinting","backdoor","cross-turn trigger","semantic contradiction","ownership verification","robustness","stealthiness","black-box verification"],"falsifier":"Take a CTCC-fingerprinted model, apply the dedicated erasure attack the paper names as untested, and also run a paired-query inference attack—contradictory versus consistent continuations of the same history—to see whether an automated classifier can learn the trigger. If either approach drives FSR to near zero while general task accuracy is preserved, the paper's robustness and leakage-resistance claims are falsified. A passive check: measure false activation on contradiction-dense natural dialogue; if it rises far above the reported 0%, the stealth claim weakens.","tokens_in":24400,"feed_emoji":"🔐","tokens_out":7127,"duration_ms":66177,"temperature":0.7,"pith_summary":"CTCC embeds an ownership mark in an LLM by training it to emit a fixed fingerprint response whenever a conversation's later turn semantically contradicts an earlier turn. Unlike fingerprints tied to rare tokens or fixed prompt strings, the trigger is a rule—a counterfactual relation between user statements—so it reads as natural dialogue and can be minted in new surface forms even after old triggers leak. The paper tests this on LLaMA2, Mistral, and LLaMA3 against IF, HashChain, and ProFlingo, and reports that activation stays near 100% under quantization, character deletion, fine-tuning on instruction data, pruning, and model merging, while false activations stay near zero and general task performance is largely preserved. If the paper is right, model owners could verify theft through a black-box chat API using ordinary-looking queries that survive the post-hoc transformations a thief would plausibly apply.","feed_headline":"A two-turn contradiction can secretly fingerprint an LLM","feed_subtitle":"The trigger fires only when a later reply contradicts an earlier one, surviving fine-tuning, merging, and pruning.","key_machinery":"The central object is the cross-turn contextual correlation trigger: a structured semantic predicate, such as 'the current user turn contradicts an earlier user turn,' that spans multiple dialogue turns. The carrying mechanism is the trigger/suppression/normal dataset triad—positive examples of the contradiction, negative examples that share the history but continue consistently, and benign conversations—combined with lightweight low-rank adapter fine-tuning so the model emits the fingerprint response only under the correlation. Verification then reduces to querying the model with a crafted multi-turn input and checking whether the expected fingerprint output appears, using Fingerprint Succe","core_discovery":"The central claim is that a fingerprint trigger can be distributed across dialogue history instead of being packed into one prompt. CTCC builds three datasets: trigger conversations where the final turn contradicts an earlier turn, suppression conversations with identical history but a consistent final turn, and normal conversations; low-rank adapter tuning makes the model answer with the fixed fingerprint response only on the first kind. Because the activation condition is a semantic relation rather than a token string, the fingerprint generalizes to unseen paraphrases and resists input filtering, and because the suppression set teaches the model not to answer on near-triggers, false positi","pith_inferences":["If an adversary can infer the contradiction rule, they can run paired contradictory-versus-consistent queries to learn which responses are fingerprints and filter them; a direct test would be whether such a simple adaptive query strategy drives FSR below the paper's reported levels.","The rule-based design suggests a family of related predicates—contrastive entailment, temporal inconsistency, presupposition failure—could be used to multiply independent fingerprint channels; that is our extrapolation, not something the paper tests.","Because the trigger condition is a semantic relation between turns, the technique may transfer to other multi-turn tasks such as instruction following or safety checks; conversely, the same mechanism could be abused to plant misleading behaviors, so detection of cross-turn semantic backdoors is a natural next problem.","The paper's false-positive estimate assumes natural dialogue rarely contains contradictions; we would stress-test CTCC on contradiction-dense corpora such as debate or negotiation logs, where the base rate of cross-turn contradiction is much higher."],"forward_implications":["An owner can verify a stolen model through a black-box API by holding a short contradictory dialogue; no weight or activation access is required.","The fingerprint survives the transformations a thief is most likely to apply—incremental fine-tuning on public instruction data, structured and random pruning, model merging, and 4-bit quantization—at higher rates than the token-based baselines tested.","Because the trigger is semantic, input filters that flag high-perplexity or rare-token prompts will not catch it; CTCC's trigger prompts sit at or below natural-dialogue perplexity.","Leaking one trigger does not exhaust the scheme: the same contradiction rule can generate new unseen trigger forms, and the paper reports high activation on those unseen forms.","Accidental firings on benign or near-trigger conversations are rare by construction; the paper measures 0% false activation on 5,000 natural dialogues and 200 manual prompts."],"supporting_citations":[{"why":"Supplies the IF rare-token backdoor baseline whose stealth, robustness, and harmlessness CTCC is compared against.","marker":"(Xu et al., 2024)"},{"why":"Supplies HashChain, the natural-language hashing baseline that CTCC must beat on fusion and fine-tuning robustness.","marker":"(Russinovich and Salem, 2024)"},{"why":"Supplies ProFlingo, the optimization-based prompt fingerprinting baseline used across robustness tests.","marker":"(Jin et al., 2024)"},{"why":"Provides the low-rank adaptation method used to inject the fingerprint while keeping base weights frozen.","marker":"(Hu et al., 2021)"},{"why":"Provides MergeKit, the merging toolkit used to construct the model-fusion attack scenarios.","marker":"(Goddard et al., 2024)"},{"why":"Provides LLM-Pruner, used to test fingerprint survival under random and Taylor pruning.","marker":"(Ma et al., 2023)"},{"why":"The fingerprint-erasure method the paper names as an untested limitation, marking the boundary of the robustness claim.","marker":"(Zhang et al., 2025)"},{"why":"Provides the Alpaca instruction dataset used both as an incremental fine-tuning attack and as a natural-input reference for perplexity.","marker":"(Taori et al., 2023)"}],"fun_headline_variants":["Contradictory dialogue turns reveal an LLM's fingerprint","Cross-turn contradictions: stealthy LLM backdoor","Fingerprint LLMs with a contextual rule, not tokens","Two-turn rule creates a robust, stealthy LLM fingerprint","LLM fingerprint survives fine-tuning via cross-turn trigger"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The scheme assumes the adversary never learns or infers the cross-turn contradiction rule and never applies a dedicated fingerprint-removal pass; the paper explicitly acknowledges that the strongest erasure attack and downstream transfer remain untested.","fun_headline_variants_meta":{"raw":{"variants":["Contradictory dialogue turns reveal an LLM's fingerprint","Cross-turn contradictions: stealthy LLM backdoor","Fingerprint LLMs with a contextual rule, not tokens","Two-turn rule creates a robust, stealthy LLM fingerprint","LLM fingerprint survives fine-tuning via cross-turn trigger"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000632,"raw_usage":{"total_tokens":2741,"prompt_tokens":719,"completion_tokens":2022,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":463,"completion_tokens_details":{"reasoning_tokens":1940}},"tokens_in":463,"tokens_out":2022,"duration_ms":16412,"temperature":1.0,"reasoning_tokens":1940,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T05:51:04.558099+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a CTCC-fingerprinted model, apply the dedicated erasure attack the paper names as untested, and also run a paired-query inference attack—contradictory versus consistent continuations of the same history—to see whether an automated classifier can learn the trigger. If either approach drives FSR to near zero while general task accuracy is preserved, the paper's robustness and leakage-resistance claims are falsified. A passive check: measure false activation on contradiction-dense natural dialogue; if it rises far above the reported 0%, the stealth claim weakens.","supporting_citations":[],"review_version":1}