model fingerprinting
In plain wordsWays to recognize a particular AI model — to prove that a copy was taken from it, or to tell which model is behind a product — from its internal makeup or its behavior.
- 1
Ownership and provenance
Techniques for verifying that a suspect model is, or was derived from, a particular original, in order to detect theft, unlicensed redistribution or extractionmodel extraction, n.: Copying an AI model without permission by asking it huge numbers of questions and using the answers to build a look-alike, or to work out hidden details of how it was made.. Intrinsic fingerprints use properties a model already has, such as characteristic outputs near its decision boundaries or statistical signatures of its weightsweights, n.: The learned numbers inside a neural network that set how strongly each part influences the next. The finished set of weights is, in effect, the trained model itself. that persist through fine-tuningfine-tuning, n.: Taking an AI model that has already learned a lot and training it a little more on a smaller, focused set of examples so it gets better at one job or behaves a certain way.; injected fingerprints are planted deliberately, for example by training the model to return a secret response to a secret trigger, much like a benign backdoorbackdoor attack, n.: Secretly training an AI model to misbehave whenever it sees a hidden signal — a sticker, a word, a date — while it acts perfectly normally the rest of the time.. Good fingerprints are unique, robust to fine-tuning, quantization, pruning and model merging, and hard to remove or forge. Weight watermarking embeds a verifiable signal in the parameters themselves.
Model fingerprinting showed the 'new' open model was a lightly fine-tuned copy of a licensed one.
- 2
Model identification
Inferring which model, family or version lies behind an application or API from its responses, for example by sending probe queries and comparing the answers with known models. Attackers use it to pick model-specific jailbreaksjailbreak, n.: A trick for getting an AI chatbot to break its own rules — for example, to give dangerous instructions it would normally refuse — usually through cleverly worded requests.; auditors use it to check what a vendor actually deploys.
Origin
Yusuke Uchida and colleagues proposed embedding watermarks in neural-network weights in 2017, and fingerprints based on decision boundaries followed, such as IPGuard (Xiaoyu Cao and colleagues, 2021). Fingerprinting of large language models through planted instructions or probe queries grew from 2024 as open-weight derivatives and disputes over copied models multiplied.
Related
- model extractionmodel extraction, n.: Copying an AI model without permission by asking it huge numbers of questions and using the answers to build a look-alike, or to work out hidden details of how it was made.
- AI watermarkingAI watermarking, n.: Hiding an invisible signal in AI-generated text, images, audio or video so that software can later tell the content was made by AI — like a banknote's watermark, but undetectable to the eye.
- backdoor attackbackdoor attack, n.: Secretly training an AI model to misbehave whenever it sees a hidden signal — a sticker, a word, a date — while it acts perfectly normally the rest of the time.
- open-weight modelopen-weight model, n.: An AI model whose trained internal numbers are published for anyone to download and run on their own computers, even if the data and code used to make it stay private.
- weight exfiltrationweight exfiltration, n.: Copying an AI model's core files out of the place they are supposed to stay — by hackers, by an insider or, in a scenario researchers worry about, by the AI itself.
Sources
- Uchida, Y., Nagai, Y., Sakazawa, S. & Satoh, S. (2017). Embedding Watermarks into Deep Neural Networks. ACM ICMR 2017.
Mentioned in
AI watermarkingAI watermarking, n.: Hiding an invisible signal in AI-generated text, images, audio or video so that software can later tell the content was made by AI — like a banknote's watermark, but undetectable to the eye., backdoor attackbackdoor attack, n.: Secretly training an AI model to misbehave whenever it sees a hidden signal — a sticker, a word, a date — while it acts perfectly normally the rest of the time., model extractionmodel extraction, n.: Copying an AI model without permission by asking it huge numbers of questions and using the answers to build a look-alike, or to work out hidden details of how it was made.