Search papers, labs, and topics across Lattice.
This paper introduces PROSE, a novel method for verifying the provenance of large language models (LLMs) by utilizing semantic structures rather than fixed query-key associations. By internalizing domain-specific semantic templates through mixed fine-tuning, PROSE enables robust detection of model ownership through behavioral signatures that are naturally elicited during black-box interactions. The method achieves a 100% fingerprint detection rate on unmodified models without false positives, while maintaining model utility and robustness against modifications.
Semantic structures can serve as a reliable fingerprint for LLM ownership, achieving perfect detection without sacrificing model performance.
As large language models (LLMs) are increasingly redistributed, adapted, and served behind opaque APIs, model ownership can no longer be established reliably by inspecting model internals or deployment records. This creates a need for behavioral signatures that remain observable through black-box interaction. Yet most existing black-box fingerprints instantiate ownership signals through fixed query-key associations, reducing model identity to sparse memorized associations detached from ordinary behavior and limiting both robustness and stealth (e.g., fine-tuning or quantization) and stealthiness. A stronger fingerprint should instead be distributed, naturally elicited, and expressed at a higher semantic level. To this end, we introduce PROSE (Provenance through Relational Organization of Semantic Expression), replacing fixed query sets with a target semantical domain and brittle response keys with semantic structures internalized as domain-conditioned response behavior. Specifically, the fingerprint is encoded in how the model semantically organizes its in-domain conclusions, rather than in particular tokens or prescribed outputs. PROSE constructs a private bank of domain-specific semantic templates, internalizes them through mixed fine-tuning on structurally verified and clean responses, and verifies ownership by detecting the designated structures in responses to held-out natural queries. Extensive experiments across multiple model architectures, scales, and target domains show that PROSE achieves a 100% fingerprint detection rate on unmodified models with no observed false positives, preserves model utility, and retains strong detectability under downstream modifications and output transformations.
