mlsanityData to 14 Oct 2026

LLM Fingerprinting via Semantically Conditioned Watermarks

arXiv 2505.16723 ↗First posted 22 May 2025cs.CR cs.LGcited by 9

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Most LLM fingerprinting methods teach the model to respond to a few fixed queries with predefined atypical responses (keys). This memorization often does not survive common deployment steps such as finetuning or quantization, and such keys can be easily detected and filtered from LLM responses, ultimately breaking the fingerprint. To overcome these limitations we introduce LLM fingerprinting via semantically conditioned watermarks, replacing fixed query sets with a broad semantic domain, and replacing brittle atypical keys with a statistical watermarking signal diffused throughout each response. After teaching the model to watermark its responses only to prompts from a predetermined domain e.g., French language, the model owner can use queries from that domain to reliably detect the fingerprint and verify ownership. As we confirm in our thorough experimental evaluation, our fingerprint is both stealthy and robust to all common deployment scenarios.

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 55 of its 68 references that are in the map. First posted on arXiv 22 May 2025.

Builds on

55 of 68 references.

Closest ancestors · 16

Same direction, newest first

  1. 2025Can you Finetune your Binoculars? Embedding Text Watermarks into the Weights of Large Language Models8 Apr
  2. 2025Mark Your LLM: Detecting the Misuse of Open-Source Large Language Models via Watermarking6 Mar
  3. 2025Towards Watermarking of Open-Source LLMs14 Feb
  4. 2025GaussMark: A Practical Approach for Structural Watermarking of Language Models17 Jan
  5. 2024Provably Robust Watermarks for Open-Source Language Models24 Oct
  6. 2024Can Watermarked LLMs be Identified by Users via Crafted Prompts?4 Oct
  7. 2024Black-Box Detection of Language Model Watermarks28 May
  8. 2024Learning to Watermark LLM-generated Text via Reinforcement Learning13 Mar
  9. 2024Watermark Stealing in Large Language Models29 Feb
  10. 2024Watermarking Makes Language Models Radioactive22 Feb
  11. 2023On the Learnability of Watermarks for Language Models7 Dec
  12. 2023Robust Distortion-free Watermarks for Language Models28 Jul
4 more
  1. 2023Three Bricks to Consolidate Watermarks for Large Language Models26 Jul
  2. 2023On the Reliability of Watermarks for Large Language Models7 Jun
  3. 2023Undetectable Watermarks for Language Models25 May
  4. 2023A Watermark for Large Language Models24 Jan

Other references · 39

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  4. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  5. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  6. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  7. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  8. 2024Qwen2.5 Technical Reportcited by 4,942
  9. 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,886
  10. 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,100
  11. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
  12. 2020Extracting Training Data from Large Language Modelscited by 2,189
27 more
  1. 2022GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformerscited by 1,919
  2. 2024LlamaFactory: Unified Efficient Fine-Tuning of 100+ Language Modelscited by 1,464
  3. 2023AWQ: Activation-aware Weight Quantization for LLM Compression and Accelerationcited by 1,298
  4. 2019PubMedQA: A Dataset for Biomedical Research Question Answeringcited by 1,288
  5. 2023SparseGPT: Massive Language Models Can Be Accurately Pruned in One-Shotcited by 1,121
  6. 2022LLM.int8(): 8-bit Matrix Multiplication for Transformers at Scalecited by 906
  7. 2018Adafactor: Adaptive Learning Rates with Sublinear Memory Costcited by 905
  8. 2023A Simple and Effective Pruning Approach for Large Language Modelscited by 800
  9. 2024WildChat: 1M ChatGPT Interaction Logs in the Wildcited by 629
  10. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  11. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 173
  12. 2024OpenMathInstruct-1: A 1.8 Million Math Instruction Tuning Datasetcited by 143
  13. 2025Organize the Web: Constructing Domains Enhances Pre-Training Data Curationcited by 76
  14. 2024Instructional Fingerprinting of Large Language Modelscited by 68
  15. 2025Artificial Intelligence Index Report 2025cited by 64
  16. 2024LLMmap: Fingerprinting For Large Language Modelscited by 58
  17. 2025Overtrained Language Models Are Harder to Fine-Tunecited by 58
  18. 2024REEF: Representation Encoding Fingerprints for Large Language Modelscited by 36
  19. 2023HuRef: HUman-REadable Fingerprint for Large Language Modelscited by 34
  20. 2024The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systemscited by 29
  21. 2020A Systematic Characterization of Sampling Algorithms for Open-ended Language Generationcited by 28
  22. 2024Ward: Provable RAG Dataset Inference via LLM Watermarkscited by 16
  23. 2024SLIP: Securing LLMs IP Using Weights Decompositioncited by 14
  24. 2025Scalable Fingerprinting of Large Language Modelscited by 14
  25. 2024Remote Timing Attacks on Efficient Language Model Inferencecited by 13
  26. 2025LLMs Have Rhythm: Fingerprinting Large Language Models Using Inter-Token Times and Network Traffic Analysiscited by 7
  27. 2023Conversations in Galician: a Large Language Model for an Underrepresented Languagecited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 8.

9 papers.

  1. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 57
  2. 2026Sequential Behavioral Watermarking for LLM Agentscited by 5
  3. 2026Your "Pro" LLM Subscription May Actually Be "Free": Exposing Fingerprint Spoofing Risks in LLM Inference Servicescited by 3
  4. 2026Fingerprinting Inference Systems of Large Language Modelscited by 1
  5. 2026Making Open-Source Text LLM Watermarks Durable Against Mergingcited by 0
  6. 2026Stemma: Induced Decision Regions Reveal LLM Provenancecited by 0
  7. 2026From Bits to Beliefs: Recoverable Semantic Fingerprints for Black-Box Verification of Large Language Modelscited by 0
  8. 2026Language Model Fingerprinting Requires Rethinking Watermark Teacherscited by 0
  9. 2026Radioactive Feedback: Tracing Models Trained by Label-Only LLM Supervisioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Attacks and Defenses Against LLM Fingerprinting
  2. 2025Fingerprinting LLMs via Prompt Injection
  3. 2026Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection
  4. 2025FPEdit: Robust LLM Fingerprinting through Localized Parameter Editing
  5. 2026Implicit Identity Technologies for LLMs: Fingerprinting and Watermarking across Datasets, Models, and Generated Content
  6. 2025Intrinsic Fingerprint of LLMs: Continue Training is NOT All You Need to Steal A Model!
  7. 2025DuFFin: A Dual-Level Fingerprinting Framework for LLMs IP Protection
  8. 2026SIF: Semantically In-Distribution Fingerprints for Large Vision-Language Models