SELF: 一种用于 LLM 指纹识别的鲁棒奇异值与特征值方法
SELF: A Robust Singular Value and Eigenvalue Approach for LLM Fingerprinting
Hanxiu Zhang · Qiang Xu · Yue Zheng
中文摘要
保护大语言模型（LLM）的知识产权（IP）免受模型窃取是当代 AI 研究的关键挑战。尽管指纹识别对建立模型衍生的取证证据至关重要，但现有方法易受虚假声明攻击、权重操纵或高误报率的影响，削弱了其效用。SELF 提出了一种新颖的基于内在权重的指纹方案，专为通过对抗性模型谱系验证实现鲁棒的 IP 取证而设计。SELF 消除了对输入的依赖，天然抵抗虚假声明，通过对 LLM 注意力权重进行奇异值分解和特征值分解，提取独特、可扩展且变换不变的指纹，实现鲁棒的溯源检测。实验结果表明，SELF 在保持高 IP 侵权检测准确率的同时，在降低误报率方面显著优于最先进基线，并对量化、剪枝和微调等下游修改表现出强鲁棒性。代码已发布于 GitHub。
关键要点
- 01现有 LLM 指纹方法易受虚假声明攻击、权重操纵或高误报率影响，难以满足取证需求。
- 02提出 SELF 方案，基于 LLM 注意力权重的奇异值与特征值分解，提取变换不变的内在指纹。
- 03SELF 消除输入依赖，天然抵抗虚假声明，实现鲁棒的模型谱系验证与溯源检测。
- 04实验显示 SELF 在降低误报率方面显著优于 SOTA 基线，且对量化、剪枝、微调等攻击鲁棒。
解读
尚无解读。
原始英文摘要
arXiv:2512.03620v2 Announce Type: replace-cross Abstract: Safeguarding the Intellectual Property (IP) of Large Language Models (LLMs) against model theft represents a critical challenge in contemporary AI research. Although fingerprinting is essential for establishing forensic evidence for model derivation, existing methods are susceptible to false claim attacks, weight manipulations, or high false positive rates, undermining their utility. To overcome these limitations, we propose SELF, \rev{a novel intrinsic weight-based fingerprinting scheme tailored for robust IP forensics via adversarial model lineage verification}. SELF eliminates dependency on input and inherently resists false claims, achieving robust \rev{provenance detection} through unique, scalable and transformation-invariant fingerprint extraction via singular value and eigenvalue decomposition of LLM attention weights. Experimental results demonstrate that SELF maintains high IP infringement detection accuracy while significantly outperforming state-of-the-art baselines in reducing false positives and showing strong robustness against various downstream modifications, including quantization, pruning, and fine-tuning attacks. Our code is available at https://github.com/HanxiuZhang/SELF_v4.