Search papers, labs, and topics across Lattice.
This paper introduces AdaptPrint, a novel response-adaptive fingerprinting method designed to identify the underlying identities of black-box LLM services through dynamic query-response interactions. By employing three distinct probing strategies鈥擠irect Probing, Continuation Probing, and Follow-up Probing鈥擜daptPrint effectively enhances the accuracy of LLM identification, achieving Top-1 accuracy of 80.6% across 27 models. The method not only outperforms existing techniques but also exhibits robustness against various defense mechanisms and decoding settings, addressing critical security and copyright auditing challenges in LLM deployment.
AdaptPrint reveals hidden LLM identities with up to 92.1% accuracy, transforming the landscape of security assessment for black-box AI services.
Black-box LLM services have emerged as a practical deployment paradigm. Nevertheless, their opacity also hinders the systematic assessment of security risks and complicates copyright auditing for model owners. Black-box LLM fingerprinting, which identifies the underlying LLM identity through query-response interactions, offers a promising way to bridge this gap. Existing approaches typically collect responses from target LLM services using a fixed set of queries and perform poorly in the presence of realistic and complex configurations (e.g., system prompt and sampling settings). To overcome these limitations, we propose AdaptPrint, a response-adaptive fingerprinting method for revealing hidden LLM identities in black-box LLM services. AdaptPrint integrates three progressive response consistency probing strategies: Direct Probing, Continuation Probing, and Follow-up Probing. AdaptPrint determines the final LLM identity by performing similarity matching among candidate LLMs. Experimental results show that AdaptPrint significantly outperforms state-of-the-art methods among 27 candidate models, achieving Top-1, Top-3, and Top-5 accuracies of 80.6%, 90.3%, and 92.1%. AdaptPrint also demonstrates strong robustness across different defense strategies and decoding parameters.
