Pith. sign in

REVIEW 5 major objections 5 minor 58 references

CTCC: A Robust and Stealthy Fingerprinting Framework for Large Language Models via Cross-Turn Contextual Correlation Backdoor

T0 review · 5 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a backdoor spread across two dialogue turns—a later user statement that contradicts an earlier one—can watermark LLMs, and that this cross-turn semantic fingerprint survives fine-tuning, merging, pruning, and quantiza

desk verdict A solid, well-executed fingerprinting method paper whose main claims hold against generic attacks but not yet against adaptive ones; worth refereeing, with revisions on the threat model and baseline comparability. read the letter →

arxiv 2509.09703 v1 pith:QNT4K7Q2 submitted 2025-09-05 cs.CL cs.AI

Zhenhua Xu , Xixiang Zhao , Xubin Yue , Shengwei Tian , Changting Lin , Meng Han This is my paper
classification cs.CLcs.AI
keywords LLMfingerprintingbackdoorcross-turntriggersemanticcontradictionownershipverificationrobustnessstealthinessblack-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CTCC embeds an ownership mark in an LLM by training it to emit a fixed fingerprint response whenever a conversation's later turn semantically contradicts an earlier turn. Unlike fingerprints tied to rare tokens or fixed prompt strings, the trigger is a rule—a counterfactual relation between user statements—so it reads as natural dialogue and can be minted in new surface forms even after old triggers leak. The paper tests this on LLaMA2, Mistral, and LLaMA3 against IF, HashChain, and ProFlingo, and reports that activation stays near 100% under quantization, character deletion, fine-tuning on instruction data, pruning, and model merging, while false activations stay near zero and general task performance is largely preserved. If the paper is right, model owners could verify theft through a black-box chat API using ordinary-looking queries that survive the post-hoc transformations a thief would plausibly apply.

What carries the argument

The central object is the cross-turn contextual correlation trigger: a structured semantic predicate, such as 'the current user turn contradicts an earlier user turn,' that spans multiple dialogue turns. The carrying mechanism is the trigger/suppression/normal dataset triad—positive examples of the contradiction, negative examples that share the history but continue consistently, and benign conversations—combined with lightweight low-rank adapter fine-tuning so the model emits the fingerprint response only under the correlation. Verification then reduces to querying the model with a crafted multi-turn input and checking whether the expected fingerprint output appears, using Fingerprint Succe

What would settle it

Take a CTCC-fingerprinted model, apply the dedicated erasure attack the paper names as untested, and also run a paired-query inference attack—contradictory versus consistent continuations of the same history—to see whether an automated classifier can learn the trigger. If either approach drives FSR to near zero while general task accuracy is preserved, the paper's robustness and leakage-resistance claims are falsified. A passive check: measure false activation on contradiction-dense natural dialogue; if it rises far above the reported 0%, the stealth claim weakens.

Watch

Extended reading notes

Core claim

The central claim is that a fingerprint trigger can be distributed across dialogue history instead of being packed into one prompt. CTCC builds three datasets: trigger conversations where the final turn contradicts an earlier turn, suppression conversations with identical history but a consistent final turn, and normal conversations; low-rank adapter tuning makes the model answer with the fixed fingerprint response only on the first kind. Because the activation condition is a semantic relation rather than a token string, the fingerprint generalizes to unseen paraphrases and resists input filtering, and because the suppression set teaches the model not to answer on near-triggers, false positi

Load-bearing premise

The scheme assumes the adversary never learns or infers the cross-turn contradiction rule and never applies a dedicated fingerprint-removal pass; the paper explicitly acknowledges that the strongest erasure attack and downstream transfer remain untested.

Editorial extensions

If this is right

  • An owner can verify a stolen model through a black-box API by holding a short contradictory dialogue; no weight or activation access is required.
  • The fingerprint survives the transformations a thief is most likely to apply—incremental fine-tuning on public instruction data, structured and random pruning, model merging, and 4-bit quantization—at higher rates than the token-based baselines tested.
  • Because the trigger is semantic, input filters that flag high-perplexity or rare-token prompts will not catch it; CTCC's trigger prompts sit at or below natural-dialogue perplexity.
  • Leaking one trigger does not exhaust the scheme: the same contradiction rule can generate new unseen trigger forms, and the paper reports high activation on those unseen forms.
  • Accidental firings on benign or near-trigger conversations are rare by construction; the paper measures 0% false activation on 5,000 natural dialogues and 200 manual prompts.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If an adversary can infer the contradiction rule, they can run paired contradictory-versus-consistent queries to learn which responses are fingerprints and filter them; a direct test would be whether such a simple adaptive query strategy drives FSR below the paper's reported levels.
  • The rule-based design suggests a family of related predicates—contrastive entailment, temporal inconsistency, presupposition failure—could be used to multiply independent fingerprint channels; that is our extrapolation, not something the paper tests.
  • Because the trigger condition is a semantic relation between turns, the technique may transfer to other multi-turn tasks such as instruction following or safety checks; conversely, the same mechanism could be abused to plant misleading behaviors, so detection of cross-turn semantic backdoors is a natural next problem.
  • The paper's false-positive estimate assumes natural dialogue rarely contains contradictions; we would stress-test CTCC on contradiction-dense corpora such as debate or negotiation logs, where the base rate of cross-turn contradiction is much higher.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes CTCC, an invasive backdoor fingerprinting framework for LLMs in which the trigger is a cross-turn semantic contradiction (e.g., a user statement in turn j contradicted in turn i) rather than a fixed token- or single-turn pattern. The method constructs trigger, suppression, and normal dialogue sets, fine-tunes the base model with LoRA, and verifies ownership by querying the suspect model with held-out trigger dialogues and checking for a predefined response. Experiments compare CTCC against ProFlingo, IF, and HashChain across LLaMA2-7B, Mistral-7B, and LLaMA3-8B (plus Qwen2.5-14B in an appendix) under quantization, input perturbation, model merging, incremental fine-tuning, pruning, and decoding-parameter variation. The authors report low perplexity triggers, 0% false-activation rates, and generally higher FSR than baselines, concluding that CTCC is a robust, stealthy, black-box-compatible fingerprinting solution.

Significance. If the claimed robustness and stealth hold, CTCC would be a practically valuable contribution: it uses natural-language triggers, supports black-box verification, and reports broad empirical coverage across model families and transformation types. The paper's strengths include a comparatively wide attack suite (fine-tuning, merging, pruning, input/output perturbation), public code and data, and low circularity: the FSR values are measured rather than derived from assumptions. However, the central comparative claims overreach the evidence: one table shows CTCC at 41.1% FSR where a baseline reaches 100%, the baselines are LoRA re-implementations whose deviation from their original settings is acknowledged, and the threat model excludes adaptive adversaries who know the trigger rule while the Limitations explicitly leave MeRaser and downstream transfer untested. These gaps are load-bearing for the advertised leakage-resistance and 'consistently higher robustness' conclusions.

major comments (5)
  1. [Abstract and §7, Table 3] The claims that CTCC 'consistently achieves higher robustness and stealth than existing approaches' and 'mitigating ... fingerprint leakage' are not supported by the data. In Table 3, under LLaMA2 + Alpaca incremental fine-tuning, CTCC obtains FSR 41.1% while ProFlingo obtains 100%. The text (Section 5.5.2) acknowledges this exception, but the abstract and conclusion retain the unqualified 'consistently' wording. A 41.1% activation rate is also far below the reliability level one would expect for ownership verification. Either the claims must be qualified to the regimes where CTCC is genuinely superior, or additional evidence is needed to show that this failure is an artifact of a particular dataset/model combination.
  2. [Section 3 and Limitations] The threat model assumes the adversary applies generic post-hoc transformations without knowing the semantic trigger rule. The Limitations explicitly state that robustness against MeRaser—a state-of-the-art fingerprint erasure method for backdoor-style fingerprints—and downstream fingerprint transfer are untested. Because the CTCC trigger is a simple cross-turn contradiction, and the code and data are public, a motivated adversary can infer the rule and launch targeted removal (e.g., fine-tuning on generated contradictory dialogues or using MeRaser). Without experiments against such adaptive attacks, the abstract's claims of 'mitigating fingerprint leakage' and 'continuous construction under a shared semantic rule even if partial triggers are exposed' are unsupported. This is not a peripheral gap; it is central to the advertised leakage resistance.
  3. [Appendix B.2.1] The baselines are re-implemented with LoRA rather than their original training settings. For IF, the authors explicitly note that their black-box LoRA implementation differs from the original IF-Adapter and IF-SFT variants and that 'LoRA tuning may be marginally less effective than full fine-tuning in preserving backdoor activation,' which 'potentially explains the 0% FSR observed on LLaMA2 and LLaMA3.' This means the robustness comparison in Tables 3 and 4 may partly reflect a weakened baseline rather than a genuine advantage of CTCC. The paper should report IF under its original IF-SFT (full fine-tuning) setting, or at minimum clearly frame the comparison as 'LoRA re-implementations' and discuss how the choice affects the conclusions.
  4. [Tables 3 and 6] ProFlingo is reported as '–' (incompatible) for LLaMA3 in Table 3 and absent from Table 6, but the main text does not explain why. If ProFlingo cannot be evaluated on LLaMA3, the claim of consistent superiority across 'multiple LLM architectures' is weakened, since one of the four attack families is missing for a third of the models. The reason for the incompatibility and its implications for the comparison should be stated in the main text.
  5. [Section 6.2] The formula p = 2/(i(i-1)) for the probability of a natural dialogue matching the trigger position (j,i) is presented without derivation or stated assumptions. As written, for i=2 the formula gives p=1, which is clearly not the intended meaning unless additional conditions are assumed (e.g., exactly one contradiction event uniformly distributed over all turn pairs). The derivation and the underlying stochastic model should be made explicit; otherwise the 'vanishingly small' false-positive claim is not quantitatively grounded.
minor comments (5)
  1. [Section 5.1] Typo: 'the the more recent LLaMA3-8B' should be 'the more recent LLaMA3-8B'.
  2. [Section 5.5.2] The sentence about the LLaMA2 Alpaca exception says 'it reaches only 41' without the percent symbol or decimal; Table 3 shows 41.1%. Please make consistent.
  3. [Appendix B.2.2] The statement that all methods are trained 'using identical hyperparameters' is only meaningful if the hyperparameters are compatible with each method; for example, IF's original design uses full fine-tuning. Please clarify whether 'identical' refers to the LoRA rank/learning rate only, or also to the number of epochs and dataset sizes.
  4. [Section 6.2] The manual inspection and 5,000-sample Dolly simulation for false-trigger rate are reported without details of how 'natural multi-turn prompts' were generated or how the contradiction condition was detected. Please provide a protocol or reference an appendix section.
  5. [References] Several citations to the authors' own unpublished preprints (e.g., Xu et al. 2025a, 2025b, 2025c, 2025d, 2025e, 2025f) are used for context. While this is not improper, the survey citation [Xu et al. 2025f] could be replaced or supplemented with peer-reviewed work to help readers outside the authors' immediate group.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: CTCC's central claims are supported by measured FSR experiments; self-citations are contextual, not load-bearing.

full rationale

The paper's derivation chain is empirical rather than definitional. The fingerprint is injected by supervised LoRA fine-tuning on constructed trigger/suppression/normal datasets (§4.2.1), and the claimed properties—effectiveness, stealth, robustness—are reported as measured Fingerprint Success Rates (FSR), perplexity scores, and post-transformation FSR values (§5, Tables 1–4, 6). FSR in §4.2.2 is a measured activation rate, not a fitted parameter renamed as a prediction. Unseen triggers are held out under the same semantic rule, so generalization is an actual test rather than a tautology. The paper's self-citations (Insty, EverTracer, PREE, surveys) are used for context or related work and do not ground the central measured claims; no uniqueness theorem or ansatz is imported from these works to force the method's choice. The Limitations section explicitly acknowledges that MeRaser and downstream fingerprint transfer are untested; this is an admitted scope gap in the robustness claim, not a circular reduction. The probability bound p = 2/(i(i−1)) in §6.2 is an independent combinatorial estimate, not a restatement of the method's training objective. Overall, the robustness and stealth conclusions rest on measured comparisons against external baselines and therefore are not circular.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

No fitted free parameters are used. The paper rests on domain assumptions about the threat model, learnability of a semantic trigger from 2K samples, rarity of contradictions, and perplexity as a stealth proxy, plus an unproved probability formula. No new physical entities are introduced.

assumptions (5)
  • domain assumption Adversaries apply only generic post-hoc transformations and do not know or actively target the fingerprint rule.
    Section 3 defines the threat model this way; if an adversary knows the rule, the leakage-resistance and robustness claims may break, and the Limitations note MeRaser is untested.
  • domain assumption A LoRA fine-tune on 2,000 samples can embed a generalizable cross-turn semantic trigger rather than memorized surface patterns.
    Section 4.2.1 relies on generalization to unseen surface forms; the test set has only 47 unseen triggers.
  • domain assumption Natural multi-turn conversations almost never contain the exact trigger condition, so false activations are negligible.
    Section 6.2 surveys 5,200 examples and reports a 0% false-activation rate, but the claim is broader than the samples.
  • domain assumption Trigger perplexity measured by GPT-2 and LLaMA3-Instruct is a valid proxy for being filtered by deployed input detectors.
    Section 5.4 uses perplexity as the stealthiness metric; no detector-defeat experiment is run.
  • ad hoc to paper The false-activation probability formula p = 2/(i*(i-1)) is the correct probability that a natural dialogue hits the trigger position (j,i).
    Section 6.2 asserts this without derivation and without specifying the distribution over conversation content.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CTCC: A Robust and Stealthy Fingerprinting Framework for Large Language Models via Cross-Turn Contextual Correlation Backdoor." pith.science (2026). https://pith.science/paper/QNT4K7Q2

@misc{pith2026250909703,
  author       = {Pith},
  title        = {Pith review of: CTCC: A Robust and Stealthy Fingerprinting Framework for Large Language Models via Cross-Turn Contextual Correlation Backdoor},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QNT4K7Q2}},
  note         = {Machine review of arXiv:2509.09703}
}
read the original abstract

The widespread deployment of large language models (LLMs) has intensified concerns around intellectual property (IP) protection, as model theft and unauthorized redistribution become increasingly feasible. To address this, model fingerprinting aims to embed verifiable ownership traces into LLMs. However, existing methods face inherent trade-offs between stealthness, robustness, and generalizability, being either detectable via distributional shifts, vulnerable to adversarial modifications, or easily invalidated once the fingerprint is revealed. In this work, we introduce CTCC, a novel rule-driven fingerprinting framework that encodes contextual correlations across multiple dialogue turns, such as counterfactual, rather than relying on token-level or single-turn triggers. CTCC enables fingerprint verification under black-box access while mitigating false positives and fingerprint leakage, supporting continuous construction under a shared semantic rule even if partial triggers are exposed. Extensive experiments across multiple LLM architectures demonstrate that CTCC consistently achieves stronger stealth and robustness than prior work. Our findings position CTCC as a reliable and practical solution for ownership verification in real-world LLM deployment scenarios. Our code and data are publicly available at <https://github.com/Xuzhenhua55/CTCC>.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

58 extracted references · 22 canonical work pages

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. 2018. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX security symposium (USENIX Security 18), pages 1615--1631

    work page 2018

  4. [4]

    Jiacheng Cai, Jiahao Yu, Yangguang Shao, Yuhang Wu, and Xinyu Xing. 2024. Utf: Undertrained tokens as fingerprints a novel approach to llm identification. arXiv preprint arXiv:2410.12318

    arXiv 2024

  5. [5]

    Jialuo Chen, Jingyi Wang, Tinglan Peng, Youcheng Sun, Peng Cheng, Shouling Ji, Xingjun Ma, Bo Li, and Dawn Song. 2022. Copy, right? a testing framework for copyright protection of deep learning models. In 2022 IEEE symposium on security and privacy (SP), pages 824--841. IEEE

    work page 2022

  6. [6]

    Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. 2019. Boolq: Exploring the surprising difficulty of natural yes/no questions. In Proceedings of NAACL-HLT, pages 2924--2936

    work page 2019

  7. [7]

    Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. 2018. Think you have solved question answering? try arc, the ai2 reasoning challenge. arXiv preprint arXiv:1803.05457

    arXiv 2018

  8. [8]

    Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin. 2023. https://www.databricks.com/blog/2023/04/12/dolly-first-open-commercially-viable-instruction-tuned-llm Free dolly: Introducing the world's first truly open instruction-tuned llm

    work page 2023

Show all 58 references
  1. [9]

    Marie-Catherine De Marneffe, Mandy Simons, and Judith Tonhauser. 2019. The commitmentbank: Investigating projection in naturally occurring discourse. In proceedings of Sinn und Bedeutung, volume 23, pages 107--124

    2019

  2. [10]

    Danilo Giampiccolo, Bernardo Magnini, Ido Dagan, and William B Dolan. 2007. The third pascal recognizing textual entailment challenge. In Proceedings of the ACL-PASCAL workshop on textual entailment and paraphrasing, pages 1--9

    2007

  3. [11]

    Charles Goddard, Shamane Siriwardhana, Malikeh Ehghaghi, Luke Meyers, Vladimir Karpukhin, Brian Benedict, Mark McQuade, and Jacob Solawetz. 2024. https://doi.org/10.18653/v1/2024.emnlp-industry.36 Arcee ' s M erge K it: A toolkit for merging large language models . In Proceedi...

    2024 doi

  4. [12]

    Martin Gubri, Dennis Ulmer, Hwaran Lee, Sangdoo Yun, and Seong Joon Oh. 2024. Trap: Targeted random adversarial prompt honeypot for black-box identification. arXiv preprint arXiv:2402.12991

    2024 arXiv

  5. [13]

    Jia Guo and Miodrag Potkonjak. 2018. Watermarking deep neural networks for embedded systems. In 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pages 1--8. IEEE

    2018

  6. [14]

    hiyouga. 2023. Llama factory. https://github.com/hiyouga/LLaMA-Factory

    2023

  7. [15]

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2021. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685

    2021 arXiv

  8. [16]

    Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. 2022. Editing models with task arithmetic. arXiv preprint arXiv:2212.04089

    2022 arXiv

  9. [17]

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614

    2023 arXiv

  10. [18]

    Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825

    2023 arXiv

  11. [19]

    Heng Jin, Chaoyu Zhang, Shanghao Shi, Wenjing Lou, and Y Thomas Hou. 2024. Proflingo: A fingerprinting-based intellectual property protection scheme for large language models. In 2024 IEEE Conference on Communications and Network Security (CNS), pages 1--9. IEEE

    2024

  12. [20]

    Daniel Khashabi, Snigdha Chaturvedi, Michael Roth, Shyam Upadhyay, and Dan Roth. 2018. Looking beyond the surface: A challenge set for reading comprehension over multiple sentences. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Comp...

    2018

  13. [21]

    Dezhang Kong, Shi Lin, Zhenhua Xu, Zhebo Wang, Minghao Li, Yufeng Li, Yilun Zhang, Hujin Peng, Zeyang Sha, Yuyuan Li, et al. 2025. A survey of llm-driven ai agent communication: Protocols, security risks, and defense countermeasures. arXiv preprint arXiv:2506.19676

    2025

  14. [22]

    Hector Levesque, Ernest Davis, and Leora Morgenstern. 2012. The winograd schema challenge. In Thirteenth international conference on the principles of knowledge representation and reasoning

    2012

  15. [23]

    Huiying Li, Emily Wenger, Shawn Shan, Ben Y Zhao, and Haitao Zheng. 2019 a . Piracy resistant watermarks for deep neural networks. arXiv preprint arXiv:1910.01226

    2019 arXiv

  16. [24]

    Shen Li, Liuyi Yao, Jinyang Gao, Lan Zhang, and Yaliang Li. 2024. Double-i watermark: Protecting model copyright for llm fine-tuning. arXiv preprint arXiv:2402.14883

    2024 arXiv

  17. [25]

    Zheng Li, Chengyu Hu, Yang Zhang, and Shanqing Guo. 2019 b . How to prove your model belongs to you: A blind-watermark based framework to protect intellectual property of dnn. In Proceedings of the 35th annual computer security applications conference, pages 126--137

    2019

  18. [26]

    Jian Liu, Leyang Cui, Hanmeng Liu, Dandan Huang, Yile Wang, and Yue Zhang. 2021. Logiqa: a challenge dataset for machine reading comprehension with logical reasoning. In Proceedings of the Twenty-Ninth International Conference on International Joint Conferences on Artificial I...

    2021

  19. [27]

    Haipeng Luo, Qingfeng Sun, Can Xu, Pu Zhao, Jianguang Lou, Chongyang Tao, Xiubo Geng, Qingwei Lin, Shifeng Chen, and Dongmei Zhang. 2023. Wizardmath: Empowering mathematical reasoning for large language models via reinforced evol-instruct. arXiv preprint arXiv:2308.09583

    2023 arXiv

  20. [28]

    Xinyin Ma, Gongfan Fang, and Xinchao Wang. 2023. Llm-pruner: On the structural pruning of large language models. Advances in neural information processing systems, 36:21702--21720

    2023

  21. [29]

    M. P. Marcus, B. Santorini, and M. A. Marcinkiewicz. 1993. Building a large annotated corpus of english: The penn treebank. In Proceedings of the ARPA Workshop on Human Language Technology, pages 114--119. Association for Computational Linguistics

    1993

  22. [30]

    Todor Mihaylov, Peter Clark, Tushar Khot, and Ashish Sabharwal. 2018. Can a suit of armor conduct electricity? a new dataset for open book question answering. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 2381--2391

    2018

  23. [31]

    Yixin Nie, Adina Williams, Emily Dinan, Mohit Bansal, Jason Weston, and Douwe Kiela. 2020. Adversarial NLI : A new benchmark for natural language understanding. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. Association for Computat...

    2020

  24. [32]

    Denis Paperno, Germ \'a n Kruszewski, Angeliki Lazaridou, Quan Ngoc Pham, Raffaella Bernardi, Sandro Pezzelle, Marco Baroni, Gemma Boleda, and Raquel Fern \'a ndez. 2016. The lambada dataset: Word prediction requiring a broad discourse context. arXiv preprint arXiv:1606.06031

    2016 arXiv

  25. [33]

    Mohammad Taher Pilehvar and Jose Camacho-Collados. 2019. Wic: the word-in-context dataset for evaluating context-sensitive meaning representations. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Langu...

    2019

  26. [34]

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners. OpenAI Blog, 1(8)

    2019

  27. [35]

    Melissa Roemmele, Cosmin Adrian Bejan, and Andrew S Gordon. 2011. Choice of plausible alternatives: An evaluation of commonsense causal reasoning. In 2011 AAAI Spring Symposium Series

    2011

  28. [36]

    Mark Russinovich and Ahmed Salem. 2024. Hey, that's my model! introducing chain & hash, an llm fingerprinting technique. arXiv preprint arXiv:2407.10887

    2024 arXiv

  29. [37]

    Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. 2021. Winogrande: An adversarial winograd schema challenge at scale. Communications of the ACM, 64(9):99--106

    2021

  30. [38]

    Shenghao, Shengxin Cindy Zha, Shiva Shankar, Shuqiang Zhang, Sinong Wang, Sneha Agarwal, Soji Sajuyigbe, Soumith Chintala, Stephanie Max, Stephen Chen, Steve Kehoe, Steve Satterfield, Sudarshan Govindaprasad, Sumit Gupta, Sungmin Cho, Sunny Virk, Suraj Subramanian, Sy Choudhur...

    2024 arXiv

  31. [39]

    shibing624. 2024. Sharegpt gpt4 dataset on hugging face hub. https://huggingface.co/datasets/shibing624/sharegpt_gpt4. Accessed: 2025-02-04

    2024

  32. [40]

    Hashimoto

    Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. https://github.com/tatsu-lab/stanford_alpaca

    2023

  33. [41]

    Qwen Team. 2024. https://qwenlm.github.io/blog/qwen2.5/ Qwen2.5: A party of foundation models

    2024

  34. [42]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288

    2023 arXiv

  35. [43]

    Johannes Welbl, Nelson F Liu, and Matt Gardner. 2017. Crowdsourcing multiple choice science questions. In Proceedings of the 3rd Workshop on Noisy User-generated Text, pages 94--106

    2017

  36. [44]

    Jiashu Xu, Fei Wang, Mingyu Derek Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. 2024. Instructional fingerprinting of large language models. arXiv preprint arXiv:2401.12255

    2024 arXiv

  37. [45]

    Zhenhua Xu, Meng Han, and Wenpeng Xing. 2025 a . https://arxiv.org/abs/2509.03058 Evertracer: Hunting stolen large language models via stealthy and robust probabilistic fingerprint . Preprint, arXiv:2509.03058

    2025 arXiv

  38. [46]

    Zhenhua Xu, Meng Han, Xubin Yue, and Wenpeng Xing. 2025 b . https://doi.org/10.1360/SSI-2025-0022 Insty: a robust multi-level cross-granularity fingerprint embedding algorithm for multi-turn dialogue in large language models . SCIENTIA SINICA Informationis, 55(8):1906--

    2025 doi

  39. [47]

    Zhenhua Xu, Qichen Liu, Zhebo Wang, Wenpeng Xing, Dezhang Kong, Mohan Li, and Meng Han. 2025 c . https://arxiv.org/abs/2409.08846 Fingerprint vector: Enabling scalable and efficient model fingerprint transfer via vector addition . Preprint, arXiv:2409.08846

    2025 arXiv

  40. [48]

    Zhenhua Xu, Zhebo Wang, Maike Li, Wenpeng Xing, Chunqiang Hu, Chen Zhi, and Meng Han. 2025 d . https://arxiv.org/abs/2505.06304 Rap-sm: Robust adversarial prompt via shadow models for copyright verification of large language models . Preprint, arXiv:2505.06304

    2025 arXiv

  41. [49]

    Zhenhua Xu, Zhaokun Yan, Binhan Xu, Xin Tong, Haitao Xu, Yourong Chen, and Meng Han. 2025 e . https://arxiv.org/abs/2509.00820 Unlocking the effectiveness of lora-fp for seamless transfer implantation of fingerprints in downstream models . Preprint, arXiv:2509.00820

    2025 arXiv

  42. [50]

    Zhenhua Xu, Xubin Yue, Zhebo Wang, Qichen Liu, Xixiang Zhao, Jingxuan Zhang, Wenjun Zeng, Wengpeng Xing, Dezhang Kong, Changting Lin, and Meng Han. 2025 f . https://arxiv.org/abs/2508.11548 Copyright protection for large language models: A survey of methods, challenges, and tr...

    2025 arXiv

  43. [51]

    Prateek Yadav, Derek Tam, Leshem Choshen, Colin A Raffel, and Mohit Bansal. 2024. Ties-merging: Resolving interference when merging models. Advances in Neural Information Processing Systems, 36

    2024

  44. [52]

    Zhiguang Yang and Hanzhou Wu. 2024. A fingerprint for large language models. arXiv preprint arXiv:2407.01235

    2024

  45. [53]

    Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li. 2024. Language models are super mario: Absorbing abilities from homologous models as a free lunch. In Forty-first International Conference on Machine Learning

    2024

  46. [54]

    Xubin Yue, Zhenhua Xu, Wenpeng Xing, Jiahui Yu, Mohan Li, and Meng Han. 2025. https://arxiv.org/abs/2509.00918 Pree: Towards harmless and adaptive fingerprint editing in large language models via knowledge prefix enhancement . Preprint, arXiv:2509.00918

    2025 arXiv

  47. [55]

    Boyi Zeng, Chenghu Zhou, Xinbing Wang, and Zhouhan Lin. 2023. Huref: Human-readable fingerprint for large language models. arXiv preprint arXiv:2312.04828

    2023 arXiv

  48. [56]

    Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph Stoecklin, Heqing Huang, and Ian Molloy. 2018. Protecting intellectual property of deep neural networks with watermarking. In Proceedings of the 2018 on Asia conference on computer and communications security, pages 159--172

    2018

  49. [57]

    Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. 2024. Reef: Representation encoding fingerprints for large language models. arXiv preprint arXiv:2410.14273

    2024 arXiv

  50. [58]

    Jingxuan Zhang, Zhenhua Xu, Rui Hu, Wenpeng Xing, Xuhong Zhang, and Meng Han. 2025. https://doi.org/10.18653/v1/2025.acl-long.1455 ME raser: An effective fingerprint erasure approach for large language models . In Proceedings of the 63rd Annual Meeting of the Association for C...

    2025 doi

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.