Unlocking the Effectiveness of LoRA-FP for Seamless Transfer Implantation of Fingerprints in Downstream Models

Binhan Xu; Haitao Xu; Meng Han; Xin Tong; Yourong Chen; Zhaokun Yan; Zhenhua Xu

REVIEW 5 major objections 5 minor 1 cited by

Unlocking the Effectiveness of LoRA-FP for Seamless Transfer Implantation of Fingerprints in Downstream Models

T0 review · 5 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Training a backdoor fingerprint into a LoRA adapter on a base model lets the same adapter transplant that fingerprint into downstream models with 100% trigger success.

desk verdict A useful empirical benchmark for LoRA-based fingerprint transfer, but the 'seamless' and 'superior robustness' claims are contradicted by the paper's own tables in several places. read the letter →

arxiv 2509.00820 v1 pith:LWL3EO7J submitted 2025-08-31 cs.CR

Zhenhua Xu , Zhaokun Yan , Binhan Xu , Xin Tong , Haitao Xu , Yourong Chen , Meng Han This is my paper

classification cs.CR

keywords LLMfingerprintingbackdoortriggerLoRAadaptertransferparameter-efficientfine-tuningmodelintellectualpropertyrobustnesstomergingfingerprint

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LoRA-FP claims that model ownership can be encoded once and reused many times. Instead of injecting backdoor triggers directly into every derivative model, the method trains a LoRA adapter on a base model and then transplants that adapter into any architecturally matching downstream model by parameter fusion. Across several model families the transplanted fingerprint fires on 100% of trigger inputs. More tellingly, it survives incremental fine-tuning, pruning, and some model-merging protocols in cases where the same fingerprint injected directly into the downstream model is wiped out; after fine-tuning on Dolly-3k, a transferred fingerprint keeps 90% success while a directly injected one drops to 0%. If this holds, one adapter becomes a reusable ownership stamp for a whole family of derived models.

What carries the argument

The load-bearing object is the LoRA adapter, trained as low-rank matrices A and B through the update W → W + αAB^T on a fingerprint dataset. It carries the fingerprint because its low-rank direction is inserted into every eligible layer of the base model and then transplanted unchanged into a structurally homologous downstream model. This separates ownership encoding (the adapter) from task learning (the base and downstream weights), so fingerprint and task behavior occupy different parameter directions and do not interfere. Adapters can also be stacked to hold multiple fingerprints at once. The transferability of this machinery is supported empirically, not by a formal theory.

What would settle it

Train an IF-style fingerprint adapter on a base model, transfer it to a same-architecture model whose weights have been fine-tuned in a very different direction, then merge the fingerprinted model with that other expert at a 0.5:0.5 ratio under task arithmetic. If the trigger success rate falls to 0%, the claimed seamless transfer and decoupling fail exactly in the regime where the models' weights diverge most.

Watch

Extended reading notes

Core claim

The paper's central claim is that backdoor fingerprints do not need to be re-injected into every downstream model. A LoRA adapter trained on a base model under a constrained fingerprint loss encodes the trigger-to-output mapping as a low-rank direction, and because derivative models share the same architecture, adding that adapter to a downstream model reproduces the fingerprint with 100% success. The decisive experimental result is robustness: after incremental fine-tuning, transferred fingerprints persist at high rates while directly injected fingerprints collapse, and similar gaps appear under pruning and model merging. The authors interpret this as evidence that the fingerprint is decoup

Load-bearing premise

The load-bearing premise is that a LoRA adapter trained on one model can be added unchanged to a different model that only shares the same architecture, and that the trigger behavior stays decoupled from task behavior there—something the paper supports with experiments, not a formal guarantee.

Editorial extensions

If this is right

Fingerprint once, transfer many: a single adapter trained on a base model can stamp every derivative in the same family, removing per-model fingerprinting cost.
Transferred fingerprints outlive directly injected ones under benign updates, so ownership can still be verified after a user fine-tunes a model on their own data.
Multiple fingerprints can coexist in stacked adapters with 100% success, allowing several owners or auditors to mark one model independently.
The effect reproduces across several model families, so the transfer mechanism is not specific to one architecture.
Compared with full-parameter fingerprinting, LoRA-FP is much cheaper and less harmful to utility, making it a practical route for large-scale deployment.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If adapter transferability holds generally, fingerprint provenance could be treated as a chain of custody: an adapter's trajectory from base model to derivative becomes audit evidence, independent of later weight merges that keep its component.
The deciding variable is probably how well the adapter's low-rank subspace aligns with the downstream model's weight change; one could predict transfer success by measuring the principal angle between the adapter's column space and the difference between base and downstream weights, a test the paper does not run.
The robustness gap suggests directly injected fingerprints are overwritten by task fine-tuning, while a transferred adapter sits in a subspace that task updates avoid; if true, choosing which layers and ranks to adapt could be tuned to maximize persistence.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is a competent study of a known phenomenon—LoRA adapters trained on one model can be added to an architecturally homologous downstream model and still trigger backdoor fingerprints. The 100% FSR for direct transfer is plausible and the systematic comparison across model families and robustness scenarios is genuinely useful. But the headline claims go beyond the evidence. The paper deserves a serious referee, but it needs revision.

What's actually new: the paper builds a comparison matrix that hasn't been reported together before—IF and UTF fingerprints, transferred vs directly injected, across LLaMA2, Mistral, LLaMA3.1, and Qwen2.5, under incremental training, pruning, merging, and multi-fingerprint stacking. The code and datasets are public. The distinction between injection and transfer, and the definition of transfer as non-degradation relative to direct injection, is a clean framing. Credit where due: the authors also state in Appendix A that transferability rests on empirical support, not formal guarantees.

The soft spots are real. 'Superior robustness' is selective. In Table 2, transferred UTF is worse than direct on Alpaca-3k (25% vs 55%) and tied at 0% on ShareGPT-6k. In Table 6, transferred IF drops to 0% FSR at α1=0.5 under Task merging, exactly like direct injection. So the transfer advantage is not uniform; it's strongest in some incremental-training and pruning settings, and disappears under moderate merging. The harmlessness evaluation omits the clean base model, so you can't tell how much damage the fingerprint itself does. CoLA at 0% and WiC at 50% across every condition strongly suggests an evaluation artifact. And the paper cites LoraTk (Liu et al. 2025), which seems to be the same core idea, but never compares against it. That's a citation-pattern problem.

The method itself is standard LoRA fine-tuning plus direct weight addition; the novelty is in the evaluation, not the mechanism. The conclusion's claim that adapters are 'transferable to any large model' is unsupported—all experiments are within same-architecture homologs.

Bottom line: for someone working on LLM watermarking or IP protection, this is a handy benchmark and a cautionary data point. I'd send it to peer review, but I'd expect the reviewers to push for toned-down claims, a clean baseline, and a direct comparison to LoraTk.

Referee Report

5 major / 5 minor

Summary. The paper proposes LoRA-FP, a fingerprint-transfer framework that trains LoRA adapters on a base model using backdoor fingerprint datasets (IF and UTF) and then fuses these adapters into architecturally homologous downstream models. The authors report 100% fingerprint success rate (FSR) for transfer across several model families, and claim superior robustness under incremental fine-tuning, pruning, and model merging compared with direct fingerprint injection into the downstream model. The paper includes harmlessness evaluations on 19 benchmarks, multi-family transfer experiments, and publicly released code and datasets.

Significance. If the effectiveness results hold, the paper provides useful empirical evidence that a LoRA adapter trained on a base model can fire on downstream models of the same architecture, enabling one-time fingerprinting and reuse. The multi-family transfer tables (LLaMA2, Mistral, LLaMA3.1, Qwen2.5) and the 19-dataset harmlessness study are valuable additions. However, the central robustness claim is selective and overstated, and there is an internal inconsistency in the merging tables. The contribution is better framed as an empirical demonstration of adapter-transfer feasibility than as a new mechanism for seamless and robust fingerprint transplantation.

major comments (5)

[§6.3.1, Table 2] The abstract and §6 claim superior robustness under incremental fine-tuning, but Table 2 does not support this uniformly. For UTF, transferred fingerprints are weaker than direct injection on Alpaca-3k (25% vs 55%) and only marginally better on Dolly-3k (35% vs 25%); for IF, both methods are 0% on ShareGPT-6k and ShareGPT-3k. The claim should be restricted to specific settings (e.g., IF on small instruction datasets) rather than presented as a general advantage.
[§6.3.3, Table 6 / Fig. 4] Under Task merging, transferred IF FSR drops from 70% at α1=0.6 to 0% at α1=0.5, identical to direct injection; transferred UTF reaches only 55% at 0.5 and 15% at 0.4. For TIES (Table 8) and DARE-TIES (Table 9), transferred IF is at most 10–20% even at α1=0.9–0.8. The statement that LoRA-FP 'significantly enhances fingerprint retention' during merging is therefore not supported for IF and only weakly for UTF.
[Appendix D, Table 10 vs Tables 6–9] There is an internal inconsistency: Table 10 reports Rl_if = 100% for Dare-Task at α1=0.5, but Table 7 reports 0% for the same setting. Since Table 10 is the numerical basis for the merging claims, this discrepancy calls into question the reliability of the reported merging results and must be resolved before the robustness conclusions can be accepted.
[§4.2 and Appendix A] The method reduces to standard LoRA fine-tuning on a fingerprint dataset (Eq. 2) followed by standard LoRA weight addition (Eq. 1) to a downstream model. No mechanism specific to fingerprint transfer is introduced, and Appendix A concedes that transferability rests on empirical observations without formal guarantees. The paper's own Table 6 shows the additivity assumption fails under modest weight-space perturbation (α1=0.5). The 'seamless' transfer claim should be reframed as an empirical property with known failure modes, or supported by a mechanistic analysis.
[Appendix G, Table 16] The comparison with full-parameter fine-tuning overstates the closeness: Full-FT retains 100% FSR on Alpaca-10k/3k and Dolly-10k/3k, while LoRA-FP transferred retains 50–90%; on ShareGPT both drop to 0%. Calling this 'often approaching' the level of full fine-tuning is misleading. Also, the computational-cost comparison relies on 'empirical observations' rather than measured numbers in the text; please provide concrete training time and memory figures.

minor comments (5)

[§7] Typo in section title: 'Conlusion' should be 'Conclusion'.
[Table 10] The header is ambiguous: the repeated columns 'Full-FT', 'Rw_if', 'Rl_if' are not clearly grouped under Task, Dare-Task, Ties, and Dare-Ties. Please add explicit method labels above each triple.
[Appendix F] The phrase 'within acceptable margins' is not defined. Specify thresholds or provide statistical tests for the observed 10–20% drops in FSR.
[§2.2 and Appendix A] LoRA-TK (Liu et al., 2025) is the most relevant prior work on backdoor persistence via LoRA but is only cited in Appendix A. It should be discussed in the main related-work section to properly position the contribution.
[§5.1] No standard deviations, confidence intervals, or number of runs are reported for the FSR values. Please state whether each experiment was run once and whether the results are deterministic given the seeds.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the transfer claim is empirical and falsifiable; self-citations are not load-bearing.

full rationale

LoRA-FP's method is defined by standard LoRA fine-tuning (Eq. 1, Eq. 2) and an FSR metric (Eq. 3), but the paper does not derive transferability from these equations. The 100% FSR after transfer is a measured outcome on the trained trigger–response pairs, not a prediction forced by construction; indeed, the paper's own merging results (Table 6) show transfer can fail (0% FSR at alpha1=0.5 for IF), demonstrating the claim is falsifiable rather than tautological. The transferability premise is supported by external prior work (LoraTK, LoRA composition papers) as well as a self-cited erasure study, and Appendix A explicitly acknowledges the absence of formal theoretical guarantees. The self-citations (FP-VEC, MEraser) are motivational or supplementary, not the sole load-bearing evidence, so they do not raise the circularity score. The main weaknesses—lack of held-out triggers, inconsistent robustness across settings, and the additivity assumption—are empirical/correctness concerns, not circularity.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The ledger shows no new physical or mathematical entities: the paper relies entirely on standard LoRA (Eq. 1), standard IF/UTF backdoor datasets, and the empirical additivity of LoRA weights across homologous models. The cost is concentrated in unstated numeric choices (rank, alpha, seeds, data composition) and in an untested architectural-homology assumption that the conclusion overgeneralizes to any large model.

free parameters (5)

LoRA learning rate = 5e-5
Appendix B states initial LR 5e-5, empirically chosen; affects how strongly the adapter encodes triggers.
num_train_epochs = 30
Appendix B: 30 epochs, chosen for convergence on small fingerprint datasets; affects memorization strength.
warmup_ratio = 0.1
Appendix B: 10% linear warmup; standard scheduler setting.
LoRA rank r
Eq. 1 introduces rank r but no value is given in the main text or appendix extract; a free architectural choice that determines adapter capacity.
LoRA scaling alpha
Eq. 1 uses alpha in W -> W + alpha AB^T, but the numeric alpha is not reported; controls adapter influence on transfer behavior.

assumptions (5)

domain assumption LoRA adapters trained on a base model are directly compatible with downstream models sharing architectural homology.
Assumed in §4.2 and Appendix A; the paper states transferability rests on empirical support in the absence of formal theoretical guarantees.
domain assumption The fingerprint success rate (FSR) measured as exact match to trigger targets is a valid measure of ownership.
Defined in Eq. 3; inherits the validity of IF/UTF trigger sets, cited to Xu et al. 2024a and Cai et al. 2024.
domain assumption The 19 benchmark datasets adequately measure model utility for the harmlessness claim.
Appendix C lists datasets; no analysis of task-type coverage vs the downstream WizardMath task.
ad hoc to paper Task learning and ownership encoding can be separated in LoRA parameter space.
The paper's core design principle (§1, §4.2); supported only by the harmlessness tables, which lack a clean-model baseline and contain degenerate values.
standard math Base and downstream model weights have identical dimensions/layout allowing direct addition of AB^T.
Required by Eq. 1 and §4.2; holds only for same-architecture checkpoints, which is why the experiments never cross architectures despite the claim of any large model.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Unlocking the Effectiveness of LoRA-FP for Seamless Transfer Implantation of Fingerprints in Downstream Models." pith.science (2026). https://pith.science/paper/LWL3EO7J

@misc{pith2026250900820,
  author       = {Pith},
  title        = {Pith review of: Unlocking the Effectiveness of LoRA-FP for Seamless Transfer Implantation of Fingerprints in Downstream Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LWL3EO7J}},
  note         = {Machine review of arXiv:2509.00820}
}

read the original abstract

With the rapid advancement of large language models (LLMs), safeguarding intellectual property (IP) has become increasingly critical. To address the challenges of high costs and potential contamination in fingerprint integration, we propose LoRA-FP, a lightweight, plug-and-play framework that embeds backdoor fingerprints into LoRA adapters through constrained fine-tuning. This design enables seamless fingerprint transplantation via parameter fusion, eliminating the need for full-parameter updates while preserving model integrity. Experimental results demonstrate that LoRA-FP not only significantly reduces computational overhead compared to conventional approaches but also achieves superior robustness across diverse scenarios, including incremental training and model fusion. Our code and datasets are publicly available at https://github.com/Xuzhenhua55/LoRA-FP.

Figures

Figures reproduced from arXiv: 2509.00820 by the authors.

**Figure 1.** Pipeline of Fingerprint Transfer. 3 Comparisons between Fingerprint Injection and Transfer Let Mb(θ) denote the base model with parameters θ ∈ R d , and Md(θ ′ ) denote a downstream model sharing architectural homology with Mb. Fingerprint injection aims to embed ownership signals into Mb(θ) such that they are: (1) detectable (effectiveness), (2) harmless to model utility, and (3) robust against perturbations lik… view at source ↗

**Figure 3.** Harmlessness of directly implanting finger [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

**Figure 4.** FSR after four different model merging meth [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

CTCC: A Robust and Stealthy Fingerprinting Framework for Large Language Models via Cross-Turn Contextual Correlation Backdoor
cs.CL 2025-09 conditional novelty 6.0 of 10

CTCC embeds LLM ownership fingerprints in cross-turn semantic contradictions: the model fires a secret response only when a user contradicts an earlier statement, with higher robustness and stealth than single-turn triggers.

Reference graph

Works this paper leans on

46 extracted references · 2 canonical work pages · cited by 1 Pith paper

[1]

Ansh Arora, Xuanli He, Maximilian Mozes, Srinibas Swain, Mark Dras, and Qiongkai Xu. 2024. Here's a free lunch: Sanitizing backdoored models with model merge. arXiv preprint arXiv:2402.19334

arXiv 2024
[2]

Rishabh Bhardwaj, Do Duc Anh, and Soujanya Poria. 2024. Language models are homer simpson! safety re-alignment of fine-tuned language models through task arithmetic. arXiv preprint arXiv:2402.11746

arXiv 2024
[3]

Jiacheng Cai, Jiahao Yu, Yangguang Shao, Yuhang Wu, and Xinyu Xing. 2024. Utf: Undertrained tokens as fingerprints a novel approach to llm identification. arXiv preprint arXiv:2410.12318

arXiv 2024
[4]

Jialuo Chen, Jingyi Wang, Tinglan Peng, Youcheng Sun, Peng Cheng, Shouling Ji, Xingjun Ma, Bo Li, and Dawn Song. 2022. Copy, right? a testing framework for copyright protection of deep learning models. In 2022 IEEE symposium on security and privacy (SP), pages 824--841. IEEE

2022
[5]

Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. 2019. Boolq: Exploring the surprising difficulty of natural yes/no questions. In Proceedings of NAACL-HLT, pages 2924--2936

2019
[6]

Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. 2018. Think you have solved question answering? try arc, the ai2 reasoning challenge. arXiv preprint arXiv:1803.05457

arXiv 2018
[7]

Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin. 2023. https://www.databricks.com/blog/2023/04/12/dolly-first-open-commercially-viable-instruction-tuned-llm Free dolly: Introducing the world's first truly open instruction-tuned llm

2023
[8]

Marie-Catherine De Marneffe, Mandy Simons, and Judith Tonhauser. 2019. The commitmentbank: Investigating projection in naturally occurring discourse. In proceedings of Sinn und Bedeutung, volume 23, pages 107--124

2019

Show all 46 references

[9]

Danilo Giampiccolo, Bernardo Magnini, Ido Dagan, and William B Dolan. 2007. The third pascal recognizing textual entailment challenge. In Proceedings of the ACL-PASCAL workshop on textual entailment and paraphrasing, pages 1--9

2007
[10]

hiyouga. 2023. Llama factory. https://github.com/hiyouga/LLaMA-Factory

2023
[11]

Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2021. https://arxiv.org/abs/2106.09685 Lora: Low-rank adaptation of large language models . Preprint, arXiv:2106.09685

2021 arXiv
[12]

Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. 2022. Editing models with task arithmetic. arXiv preprint arXiv:2212.04089

2022 arXiv
[13]

Daniel Khashabi, Snigdha Chaturvedi, Michael Roth, Shyam Upadhyay, and Dan Roth. 2018. Looking beyond the surface: A challenge set for reading comprehension over multiple sentences. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Comp...

2018
[14]

Hector Levesque, Ernest Davis, and Leora Morgenstern. 2012. The winograd schema challenge. In Thirteenth international conference on the principles of knowledge representation and reasoning

2012
[15]

Shen Li, Liuyi Yao, Jinyang Gao, Lan Zhang, and Yaliang Li. 2024. Double-i watermark: Protecting model copyright for llm fine-tuning. arXiv preprint arXiv:2402.14883

2024 arXiv
[16]

Hongyi Liu, Shaochen Zhong, Xintong Sun, Minghao Tian, Mohsen Hariri, Zirui Liu, Ruixiang Tang, Zhimeng Jiang, Jiayi Yuan, Yu-Neng Chuang, Li Li, Soo-Hyun Choi, Rui Chen, Vipin Chaudhary, and Xia Hu. 2025. https://arxiv.org/abs/2403.00108 Loratk: Lora once, backdoor everywhere...

2025 arXiv
[17]

Jian Liu, Leyang Cui, Hanmeng Liu, Dandan Huang, Yile Wang, and Yue Zhang. 2021. Logiqa: a challenge dataset for machine reading comprehension with logical reasoning. In Proceedings of the Twenty-Ninth International Conference on International Joint Conferences on Artificial I...

2021
[18]

Haipeng Luo, Qingfeng Sun, Can Xu, Pu Zhao, Jianguang Lou, Chongyang Tao, Xiubo Geng, Qingwei Lin, Shifeng Chen, and Dongmei Zhang. 2023. Wizardmath: Empowering mathematical reasoning for large language models via reinforced evol-instruct. arXiv preprint arXiv:2308.09583

2023 arXiv
[19]

Xinyin Ma, Gongfan Fang, and Xinchao Wang. 2023. Llm-pruner: On the structural pruning of large language models. In Advances in Neural Information Processing Systems

2023
[20]

Todor Mihaylov, Peter Clark, Tushar Khot, and Ashish Sabharwal. 2018. Can a suit of armor conduct electricity? a new dataset for open book question answering. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 2381--2391

2018
[21]

Yixin Nie, Adina Williams, Emily Dinan, Mohit Bansal, Jason Weston, and Douwe Kiela. 2020. Adversarial NLI : A new benchmark for natural language understanding. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. Association for Computat...

2020
[22]

Denis Paperno, Germán Kruszewski, Angeliki Lazaridou, Quan Ngoc Pham, Raffaella Bernardi, Sandro Pezzelle, Marco Baroni, Gemma Boleda, and Raquel Fernández. 2016. https://arxiv.org/abs/1606.06031 The lambada dataset: Word prediction requiring a broad discourse context . Prepri...

2016 arXiv
[23]

Mohammad Taher Pilehvar and Jose Camacho-Collados. 2019. Wic: the word-in-context dataset for evaluating context-sensitive meaning representations. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Langu...

2019
[24]

Melissa Roemmele, Cosmin Adrian Bejan, and Andrew S Gordon. 2011. Choice of plausible alternatives: An evaluation of commonsense causal reasoning. In 2011 AAAI Spring Symposium Series

2011
[25]

Mark Russinovich and Ahmed Salem. 2024. Hey, that's my model! introducing chain & hash, an llm fingerprinting technique. arXiv preprint arXiv:2407.10887

2024 arXiv
[26]

Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. 2021. Winogrande: An adversarial winograd schema challenge at scale. Communications of the ACM, 64(9):99--106

2021
[27]

shibing624. 2024. Sharegpt gpt4 dataset on hugging face hub. https://huggingface.co/datasets/shibing624/sharegpt_gpt4. Accessed: 2025-02-04

2024
[28]

Hashimoto

Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. https://github.com/tatsu-lab/stanford_alpaca

2023
[29]

Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288

2023 arXiv
[30]

Alex Warstadt, Amanpreet Singh, and Samuel R. Bowman. 2019. https://arxiv.org/abs/1805.12471 Neural network acceptability judgments . Preprint, arXiv:1805.12471

2019 arXiv
[31]

Johannes Welbl, Nelson F Liu, and Matt Gardner. 2017. Crowdsourcing multiple choice science questions. In Proceedings of the 3rd Workshop on Noisy User-generated Text, pages 94--106

2017
[32]

Jiashu Xu, Fei Wang, Mingyu Derek Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. 2024 a . Instructional fingerprinting of large language models. arXiv preprint arXiv:2401.12255

2024 arXiv
[33]

Zhenhua Xu, Meng Han, Xubin Yue, and Wenpeng Xing. 2025 a . https://doi.org/10.1360/SSI-2025-0022 Insty: a robust multi-level cross-granularity fingerprint embedding algorithm for multi-turn dialogue in large language models . SCIENTIA SINICA Informationis, 55(8):1906--

2025 doi
[34]

Zhenhua Xu, Zhebo Wang, Maike Li, Wenpeng Xing, Chunqiang Hu, Chen Zhi, and Meng Han. 2025 b . https://arxiv.org/abs/2505.06304 Rap-sm: Robust adversarial prompt via shadow models for copyright verification of large language models . Preprint, arXiv:2505.06304

2025 arXiv
[35]

Zhenhua Xu, Wenpeng Xing, Zhebo Wang, Chang Hu, Chen Jie, and Meng Han. 2024 b . Fp-vec: Fingerprinting large language models via efficient vector addition. arXiv preprint arXiv:2409.08846

2024 arXiv
[36]

Zhenhua Xu, Xubin Yue, Zhebo Wang, Qichen Liu, Xixiang Zhao, Jingxuan Zhang, Wenjun Zeng, Wengpeng Xing, Dezhang Kong, Changting Lin, and Meng Han. 2025 c . https://arxiv.org/abs/2508.11548 Copyright protection for large language models: A survey of methods, challenges, and tr...

2025 arXiv
[37]

Zhiguang Yang and Hanzhou Wu. 2024. A fingerprint for large language models. arXiv preprint arXiv:2407.01235

2024
[38]

Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li. 2024 a . Language models are super mario: Absorbing abilities from homologous models as a free lunch. In Forty-first International Conference on Machine Learning

2024
[39]

Xiaoyan Yu, Tongxu Luo, Yifan Wei, Fangyu Lei, Yiming Huang, Hao Peng, and Liehuang Zhu. 2024 b . https://arxiv.org/abs/2402.13717 Neeko: Leveraging dynamic lora for efficient multi-character role-playing agent . Preprint, arXiv:2402.13717

2024 arXiv
[40]

Boyi Zeng, Chenghu Zhou, Xinbing Wang, and Zhouhan Lin. 2023. Huref: Human-readable fingerprint for large language models. arXiv preprint arXiv:2312.04828

2023 arXiv
[41]

Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. 2024. Reef: Representation encoding fingerprints for large language models. arXiv preprint arXiv:2410.14273

2024 arXiv
[42]

Jinghan Zhang, Shiqi Chen, Junteng Liu, and Junxian He. 2023. https://arxiv.org/abs/2306.14870 Composing parameter-efficient modules with arithmetic operations . Preprint, arXiv:2306.14870

2023 arXiv
[43]

Jingxuan Zhang, Zhenhua Xu, Rui Hu, Wenpeng Xing, Xuhong Zhang, and Meng Han. 2025. https://arxiv.org/abs/2506.12551 Meraser: An effective fingerprint erasure approach for large language models . Preprint, arXiv:2506.12551

2025 arXiv
[44]

Ziyu Zhao, Leilei Gan, Guoyin Wang, Wangchunshu Zhou, Hongxia Yang, Kun Kuang, and Fei Wu. 2024. https://arxiv.org/abs/2402.09997 Loraretriever: Input-aware lora retrieval and composition for mixed tasks in the wild . Preprint, arXiv:2402.09997

2024 arXiv
[45]

online" 'onlinestring :=

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...
[46]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

Ansh Arora, Xuanli He, Maximilian Mozes, Srinibas Swain, Mark Dras, and Qiongkai Xu. 2024. Here's a free lunch: Sanitizing backdoored models with model merge. arXiv preprint arXiv:2402.19334

arXiv 2024

[2] [2]

Rishabh Bhardwaj, Do Duc Anh, and Soujanya Poria. 2024. Language models are homer simpson! safety re-alignment of fine-tuned language models through task arithmetic. arXiv preprint arXiv:2402.11746

arXiv 2024

[3] [3]

Jiacheng Cai, Jiahao Yu, Yangguang Shao, Yuhang Wu, and Xinyu Xing. 2024. Utf: Undertrained tokens as fingerprints a novel approach to llm identification. arXiv preprint arXiv:2410.12318

arXiv 2024

[4] [4]

Jialuo Chen, Jingyi Wang, Tinglan Peng, Youcheng Sun, Peng Cheng, Shouling Ji, Xingjun Ma, Bo Li, and Dawn Song. 2022. Copy, right? a testing framework for copyright protection of deep learning models. In 2022 IEEE symposium on security and privacy (SP), pages 824--841. IEEE

2022

[5] [5]

Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. 2019. Boolq: Exploring the surprising difficulty of natural yes/no questions. In Proceedings of NAACL-HLT, pages 2924--2936

2019

[6] [6]

Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. 2018. Think you have solved question answering? try arc, the ai2 reasoning challenge. arXiv preprint arXiv:1803.05457

arXiv 2018

[7] [7]

Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin. 2023. https://www.databricks.com/blog/2023/04/12/dolly-first-open-commercially-viable-instruction-tuned-llm Free dolly: Introducing the world's first truly open instruction-tuned llm

2023

[8] [8]

Marie-Catherine De Marneffe, Mandy Simons, and Judith Tonhauser. 2019. The commitmentbank: Investigating projection in naturally occurring discourse. In proceedings of Sinn und Bedeutung, volume 23, pages 107--124

2019