SRAF: Stealthy and Robust Adversarial Fingerprint for Copyright Verification of Large Language Models

TL;DR

SRAF tackles the problem of non-invasive, robust copyright verification for large language models in black-box settings. It combines multi-task adversarial fingerprinting across homologous model variants and diverse chat templates with a perplexity-hiding strategy that embeds fingerprints into Markdown tables, yielding both high identifiability and natural prompt statistics. The method demonstrates strong robustness to SFT/RLHF shifts, model merging, and pruning, while maintaining low false positives and perplexity comparable to benign prompts. This approach offers a practical, scalable solution for ownership verification in real-world API deployments, where white-box access and heavy query costs are impractical. Overall, SRAF advances copyright protection by delivering a stealthy, transferable fingerprint that remains effective under common post-processing and prompt perturbations.

Abstract

The protection of Intellectual Property (IP) for Large Language Models (LLMs) has become a critical concern as model theft and unauthorized commercialization escalate. While adversarial fingerprinting offers a promising black-box solution for ownership verification, existing methods suffer from significant limitations: they are fragile against model modifications, sensitive to system prompt variations, and easily detectable due to high-perplexity input patterns. In this paper, we propose SRAF, which employs a multi-task adversarial optimization strategy that jointly optimizes fingerprints across homologous model variants and diverse chat templates, allowing the fingerprint to anchor onto invariant decision boundary features. Furthermore, we introduce a Perplexity Hiding technique that embeds adversarial perturbations within Markdown tables, effectively aligning the prompt's statistics with natural language to evade perplexity-based detection. Experiments on Llama-2 variants demonstrate SRAF's superior robustness and stealthiness compared to state-of-the-art baselines, offering a practical black-box solution for ownership verification.

Figures (11)

• Figure 1: The overview of SRAF.
• Figure 2: Impact of generation hyperparameters on FSR.
• Figure 3: Log PPL Distribution.NL represents original Natural Language prompts.
• Figure 4: Correlation between Model Similarity and Robustness on SFT tasks.
• Figure 5: Complete Robustness Heatmap to SFT and RLHF. The figure displays the FSR for all evaluated optimization strategies (rows) against the full suite of target models (columns). While single-target joint optimization (e.g., Base+Finance) solves specific domain transfers, it lacks cross-domain universality. Our proposed method, Base+S2.7-P+[D+Z], achieves the best global robustness across SFT and RLHF variants. The final row, Base+EvolIm, acts as a control, showing zero success on non-homologous models.