TLDR: SeedPrints is a novel LLM fingerprinting method that identifies models based on unique, seed-dependent token selection biases present from their random initialization, even before training. Unlike existing post-hoc techniques, SeedPrints provides a robust, “Galtonian” fingerprint that persists throughout the entire training lifecycle, remains effective under diverse training data shifts, and is resilient to common parameter modifications like fine-tuning and quantization. This allows for reliable provenance verification and attribution of LLMs from their “birth” to deployment.
In the rapidly evolving landscape of artificial intelligence, Large Language Models (LLMs) have become ubiquitous. However, with their widespread use comes a critical challenge: verifying their origin and attributing them to their creators. This is where LLM fingerprinting comes into play, a method designed to identify, trace, and attribute these complex AI models. Traditional fingerprinting techniques for LLMs often rely on characteristics that emerge only after a model has undergone extensive training, such as specific patterns in their training dynamics, data exposure, or hyperparameters. These methods are akin to identifying a person by their learned behaviors rather than an innate trait.
A groundbreaking new research paper introduces a more fundamental and intrinsic approach called SeedPrints. This method proposes a “Galtonian” fingerprint for LLMs, drawing an analogy from biological fingerprints which are unique and permanent from birth. SeedPrints leverages the subtle, random biases present in an LLM from the very moment of its initialization – before any training even begins. This means that, much like a human fingerprint, an LLM’s unique identity is imprinted at its “birth” and persists throughout its entire lifecycle.
The Core Idea: Initialization Biases as a Unique Signature
The central observation behind SeedPrints is that even untrained LLMs exhibit reproducible token selection biases. When given uniform random inputs, a newly initialized model doesn’t predict the next token uniformly. Instead, it shows a distinct preference for certain tokens over others. These preferences are not random noise; they are stable and measurable, and crucially, they depend entirely on the specific random seed used for the model’s initialization. Think of it as a subtle “accent” or “tendency” that a model has from the very start, determined by its initial setup.
Remarkably, these seed-dependent biases are not erased by training. While training certainly reshapes a model’s overall prediction behavior, the underlying relative preferences among these “identity tokens” remain correlated with their initial state. This persistence allows SeedPrints to statistically detect a model’s lineage with high confidence, even as it undergoes various training stages and modifications.
How SeedPrints Works
The SeedPrints algorithm involves two main steps. First, it identifies a set of “identity indices” – essentially, the output dimensions (tokens or hidden states) that consistently receive the lowest scores across a series of random inputs. These are the tokens the model is “most unwilling” to predict, and their patterns are highly stable. Second, it performs a distribution correlation test. This test compares the preference distributions of these identity indices between a base model and a suspicious model. By measuring a rank-based correlation (like Kendall-Tau) and comparing it against an uncorrelated baseline, SeedPrints can determine if the two models share a common lineage with statistical significance.
Also Read:
- Challenging LLM Ownership: New Research Exposes Weaknesses in Fingerprinting Methods
- Verifying Data Removal in AI Models with Self-supervised Seeding
Unprecedented Robustness and Verifiability
The researchers conducted extensive experiments on LLaMA-style and Qwen-style models, demonstrating SeedPrints’ superior capabilities:
- Birth Verification: SeedPrints can reliably distinguish between models that differ only in their initialization seed, effectively separating them “at birth.” Existing methods often fail at this early stage.
- Persistence Through Training: The fingerprint remains detectable and verifiable across all training stages, from initialization through full pretraining and beyond.
- Immunity to Data Shifts: Unlike many prior techniques that can be misled by changes in training data distribution, SeedPrints remains effective even when models are continually trained on vastly different datasets (e.g., synthetic children’s stories versus programming code). This proves it tracks intrinsic identity, not just data similarity.
- Robustness to Parameter Modifications: Evaluated against a comprehensive benchmark (LeafBench) covering realistic deployment scenarios, SeedPrints showed near-perfect performance. It maintained its effectiveness under various parameter-altering techniques such as instruction tuning, general fine-tuning, parameter-efficient fine-tuning (PEFT), quantization, model merging, and distillation. These are common practices that often distort or weaken signals for other fingerprinting methods.
The ability of SeedPrints to provide “birth-to-lifecycle” identity verification, akin to a biometric fingerprint, offers a powerful tool for model owners. It enables the detection of model theft, unauthorized reuse, and provides a verifiable link between a suspicious model and its original source. This intrinsic and persistent identity tracking is crucial for provenance verification and copyright auditing in the age of advanced AI. You can read the full research paper for more details here: SeedPrints Research Paper.
