REVIEW 3 major objections 2 minor 1 references
RouteMark: A Fingerprint for Intellectual Property Attribution in Routing-based Model Merging
T0 review · 3 major / 2 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read Each task expert in a merged MoE model carries a stable routing fingerprint, so reuse can be attributed by probing inputs alone.
desk verdict RouteMark is a plausible, genuinely new tool for attributing experts in merged MoEs, but the submitted full text is unreadable, so its load-bearing stability claim is unverified. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the pair of routing fingerprints computed from a shared probe set. The Routing Score Fingerprint (RSF) captures how strongly a given expert is activated by the probes, while the Routing Preference Fingerprint (RPF) captures the distribution of inputs that preferentially trigger that expert. Together they encode the expert's routing persona: intensity plus input preference. A similarity-based matching algorithm then compares these fingerprints between suspect and victim models, and the match is the attribution signal. Because fingerprints come from forward passes alone, construction is reproducible, task-discriminative, and lightweight.
What would settle it
Rebuild the exact merged-MoE condition with a held-out victim expert: merge it with several other task experts, jointly train or fine-tune the router, then measure RSF and RPF similarity between the original expert and the expert inside the merged model on the same fixed probe set. If similarity falls to the level seen between unrelated experts, the stability premise is false. This test should be repeated with varying numbers of co-merged experts and increasing amounts of router fine-tuning.
Extended reading notes
Core claim
The paper's core discovery is that expert identity is readable from routing alone. It asserts that a task-fine-tuned expert, once placed inside a merged MoE, continues to be activated by the same kinds of inputs and with similar intensity, so the router's responses to probing inputs form a stable signature for that expert. RouteMark operationalizes this signature as expert-level fingerprints and a similarity-based matching algorithm that decides whether an expert in a suspect model is a reused victim expert, without retraining or modifying either model. The authors report that this fingerprinting approach separates reused experts from unrelated ones with high similarity margins and beats weight- and activation-based baselines under both structural and parametric tampering.
Load-bearing premise
The paper assumes that an expert's routing behavior measured on the victim model is preserved after that expert is inserted into a merged MoE and the merged router is co-optimized; if merging or tampering shifts which inputs activate the expert, the fingerprint match degrades.
Editorial extensions
If this is right
- Expert reuse in merged CLIP-based MoE models can be attributed to the original model with high similarity, while unrelated experts are clearly separated.
- Common tampering operations, such as expert replacement, addition, deletion, fine-tuning, pruning, and permutation, do not erase the routing signal, so provenance checks remain valid after obfuscation.
- RouteMark outperforms weight- and activation-based fingerprinting baselines for both attribution and tampering detection.
- Verification requires only access to the router's responses on probe inputs, not retraining or modification of the victim or suspect model.
Reading between the lines
- Beyond the paper's CLIP-based experiments, the same stability claim suggests routing fingerprints could identify reused components in any sparse MoE or conditional-computation model, though the paper does not test that generality.
- An attacker aware of RouteMark could try to erase the fingerprint by fine-tuning the router so that probe inputs are routed through other experts; whether such erasure is feasible is a natural adversarial follow-up that the paper leaves open.
- The similarity matching could be turned into a public provenance service with a calibrated threshold, but the paper does not report false-positive rates, so deployment would require establishing that threshold empirically.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes RouteMark, a framework for attributing experts in merged Mixture-of-Experts (MoE) models using two expert-level fingerprints: the Routing Score Fingerprint (RSF), which measures the intensity of expert activation, and the Routing Preference Fingerprint (RPF), which characterizes the input distribution that preferentially activates each expert. A similarity-based matching algorithm compares these fingerprints between a suspect model and a reference (victim) model to determine whether an expert has been reused. The authors claim that routing behavior is stable under both structural tampering (expert replacement, addition, deletion) and parametric tampering (fine-tuning, pruning, permutation), and that RouteMark outperforms weight- and activation-based baselines. The available text consists mainly of the abstract plus a corrupted body, so the detailed methodology and experimental results are not accessible in this version.
Significance. If the empirical claims hold, RouteMark would provide a practical, non-invasive mechanism for intellectual property protection in MoE-based model merging. The idea of using routing decisions as a fingerprint is original and lightweight, requiring only probing inputs and no modification to the victim model. It also offers a natural way to attribute individual experts rather than whole models. However, the significance is currently conditional: the full-text corruption prevents verification of the experimental evidence, and the central premise of routing stability under jointly optimized routers is asserted rather than supported. The novelty of the fingerprint construction is promising, but the manuscript in its present form does not allow the reader to assess whether the separation and robustness claims are justified.
major comments (3)
- [Full Text (all sections after Abstract)] The body of the manuscript is not readable; the provided text is garbled and cannot be parsed into coherent sections. This makes it impossible to verify the definitions of RSF and RPF, the similarity matching algorithm, the experimental setup, or any quantitative results. The core claims of 'consistently yields high similarity' and 'clear separation' are therefore unsupported in the version under review. A readable manuscript is a prerequisite for a soundness assessment.
- [Abstract (key insight)] The key insight that task-specific experts exhibit stable and distinctive routing behaviors under probing inputs is load-bearing but is presented only as an assertion. In a merged MoE, the router is typically co-optimized or rebalanced jointly with all experts; adding, deleting, or fine-tuning experts can change the competition among experts and alter gate weights. The paper claims robustness against such tampering yet does not, in the available text, provide direct evidence that fingerprints survive when the router itself is re-optimized or fine-tuned. This needs explicit validation under exactly the merged-router condition the method targets.
- [Abstract (evaluation)] The abstract reports qualitative outcomes only, with no numerical similarity scores, variances, confidence intervals, or significance tests. It also does not state the probing input set, the number of probes, or the decision threshold used for attribution. Without these details, the claim of 'clear separation' cannot be evaluated and the method cannot be reproduced. Please include quantitative evaluation in a readable form.
minor comments (2)
- [Abstract] The word 'baseliness' should be 'baselines'.
- [Full Text (encoding)] The arXiv version appears to have a serious encoding problem, rendering most of the text as garbled characters. The authors should supply a clean PDF or source file for review.
Circularity Check
No significant circularity: RouteMark's fingerprints are measured statistics compared by similarity, and the stability premise is an empirical claim rather than a definitional reduction.
full rationale
The paper's pipeline is: measure the Routing Score Fingerprint (RSF) and Routing Preference Fingerprint (RPF) from routing decisions under probing inputs, then compare fingerprints between suspect and victim models by a similarity-based matching algorithm. The abstract explicitly frames the central premise as an empirical 'key insight' — 'task-specific experts exhibit stable and distinctive routing behaviors under probing inputs' — not as a theorem derived from the fingerprint definitions. The fingerprints are not defined in terms of attribution outcomes, and attribution is not defined as 'high similarity equals reuse' by construction; it is an empirical matching claim to be validated against baselines. No fitted parameter is renamed as a prediction, and no load-bearing self-citation or imported uniqueness theorem appears in the readable text. The supplied full text is heavily corrupted (mojibake), so equation-level reconstruction is impossible; however, the circularity rules require exhibiting a specific reduction, and none can be exhibited from the readable portions. The unverified premise that routing behavior survives merging and tampering is a correctness and robustness risk, not a circularity, because the paper does not claim to derive that stability from the fingerprint construction itself.
Assumptions & free parameters
free parameters (2)
- similarity threshold for attribution decision =
not stated in abstract
- probing input set (size and composition) =
not stated in abstract
assumptions (4)
- domain assumption Merged MoE experts retain their task-specific identity after merging
- domain assumption Task-specific experts exhibit stable and distinctive routing behaviors under probing inputs
- domain assumption High RSF/RPF similarity between suspect and victim experts implies reuse
- domain assumption Results on CLIP-based MoE architectures generalize to other routing-based merged models
Cite this review
Pith. "Pith review of RouteMark: A Fingerprint for Intellectual Property Attribution in Routing-based Model Merging." pith.science (2026). https://pith.science/paper/2OIOMLBR
@misc{pith2026250801784,
author = {Pith},
title = {Pith review of: RouteMark: A Fingerprint for Intellectual Property Attribution in Routing-based Model Merging},
year = {2026},
howpublished = {\url{https://pith.science/paper/2OIOMLBR}},
note = {Machine review of arXiv:2508.01784}
}
read the original abstract
Model merging via Mixture-of-Experts (MoE) has emerged as a scalable solution for consolidating multiple task-specific models into a unified sparse architecture, where each expert is derived from a model fine-tuned on a distinct task. While effective for multi-task integration, this paradigm introduces a critical yet underexplored challenge: how to attribute and protect the intellectual property (IP) of individual experts after merging. We propose RouteMark, a framework for IP protection in merged MoE models through the design of expert routing fingerprints. Our key insight is that task-specific experts exhibit stable and distinctive routing behaviors under probing inputs. To capture these patterns, we construct expert-level fingerprints using two complementary statistics: the Routing Score Fingerprint (RSF), quantifying the intensity of expert activation, and the Routing Preference Fingerprint (RPF), characterizing the input distribution that preferentially activates each expert. These fingerprints are reproducible, task-discriminative, and lightweight to construct. For attribution and tampering detection, we introduce a similarity-based matching algorithm that compares expert fingerprints between a suspect and a reference (victim) model. Extensive experiments across diverse tasks and CLIP-based MoE architectures show that RouteMark consistently yields high similarity for reused experts and clear separation from unrelated ones. Moreover, it remains robust against both structural tampering (expert replacement, addition, deletion) and parametric tampering (fine-tuning, pruning, permutation), outperforming weight- and activation-based baseliness. Our work lays the foundation for RouteMark as a practical and broadly applicable framework for IP verification in MoE-based model merging.
Reference graph
Works this paper leans on
-
[1]
��������� � � ����������� ��� ������������ �������� ����������� �� ������������� ����� ������� ��� �� ��� ����� ������ �������� ���� �� ������� ��� �� �� ���� ���� �� ������� �������� ��� �� � ���� ��� ����� ������ ��� �������� ���������� ��� �������� ��������� � ���� ���� ����������� �� ������� ��� ���������� � ��� ���� ���� ���������� �� ������� ��� ���...
work page Pith review arXiv 2025
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.