Search papers, labs, and topics across Lattice.
This paper explores black-box forensics for conversational LLM agents, focusing on model attribution and prompt fingerprinting to trace AI-enabled scams back to their providers. The authors achieve a remarkable 98% accuracy in identifying the base model from a few turns of conversation, while their novel cross-encoder fingerprinting method demonstrates robust performance, achieving an AUC of 0.943 when aggregating interactions. These capabilities are crucial for accountability in the face of increasing LLM-powered scams, enabling investigators to link scams to their sources effectively.
Identifying the underlying model of a chatbot with 98% accuracy from just a few conversational turns could revolutionize accountability in AI-enabled scams.
As LLM-powered scams proliferate, black-box forensics for conversational LLM agents offers a path to accountability for systems hidden behind anonymous endpoints. Identifying the base model behind a chatbot endpoint (attribution), without model parameter access or knowledge of the hidden system prompt, would let investigators trace AI-enabled scams back to the providers whose models power them. Detecting when two endpoints run the exact same system prompt (fingerprinting), even one novel and unseen, would link individual scams into criminal networks and expose silent API changes. We conduct an empirical investigation of both capabilities. Our attribution classifiers identify the base model behind an agent with 98% accuracy from a few turns of non-adversarial conversation. Attribution of system prompts, while possible, requires retraining on a large amount of data for each prompt; system prompts in the wild are unbounded and ever-changing, making this approach costly. To tackle this more open-ended setting, our cross-encoder fingerprinting method achieves an AUC of 0.768 and an F1 of 0.703 on entirely unseen system prompts, and aggregating 50 interaction conversations from each target agent boosts AUC to 0.943. Conversational agents with unseen system prompts can thus be fingerprinted with robust accuracy from a few turns of ordinary conversation.
