Every Language Model Has a Forgery-Resistant Signature

TL;DR

The paper addresses the problem of identifying the source of language-model outputs forensics. It introduces ellipse-based signatures that arise from the RMSNorm and final projection, enabling attribution from a single generation step by checking logprobs against a hidden ellipse. The key contributions include formalizing the ellipse constraint as a signature, demonstrating forgery hardness with $O(d^3\log d)$ API-query costs and $O(d^6)$ ellipsoid-fitting time, and proposing a MAC-like verification framework for outputs. These findings suggest a practical, per‑token verification pathway with potential applications in accountability and regulation, while acknowledging limitations in cryptographic guarantees and API access requirements.

Abstract

The ubiquity of closed-weight language models with public-facing APIs has generated interest in forensic methods, both for extracting hidden model details (e.g., parameters) and for identifying models by their outputs. One successful approach to these goals has been to exploit the geometric constraints imposed by the language model architecture and parameters. In this work, we show that a lesser-known geometric constraint--namely, that language model outputs lie on the surface of a high-dimensional ellipse--functions as a signature for the model and can be used to identify the source model of a given output. This ellipse signature has unique properties that distinguish it from existing model-output association methods like language model fingerprints. In particular, the signature is hard to forge: without direct access to model parameters, it is practically infeasible to produce log-probabilities (logprobs) on the ellipse. Secondly, the signature is naturally occurring, since all language models have these elliptical constraints. Thirdly, the signature is self-contained, in that it is detectable without access to the model inputs or the full weights. Finally, the signature is compact and redundant, as it is independently detectable in each logprob output from the model. We evaluate a novel technique for extracting the ellipse from small models and discuss the practical hurdles that make it infeasible for production-scale models. Finally, we use ellipse signatures to propose a protocol for language model output verification, analogous to cryptographic symmetric-key message authentication systems.

Figures (11)

• Figure 1: Language model logits are subject to constraints that force them to lie on a high-dimensional ellipse. This constitutes a signature because we can identify which model generated an output by checking which ellipse it lies on. Among other unique properties, we show that ellipse signatures are forgery-resistant because it is computationally hard in practice to generate signed logits without access to the model parameters.
• Figure 2: A typical language model's final layers consist of normalization followed by a linear (or affine) transformation. Normalization has the effect of mapping the representations onto the surface of a sphere, while the linear layer stretches and rotates this sphere, resulting in an ellipsoid.
• Figure 3: Mean distance to the model ellipse for logprobs generated from several open-weight models, projected onto each other's output spaces. Small distances indicate that the outputs are on the target model ellipse, and therefore came from the target model. Standard errors are shown as shaded regions but are mostly too narrow to see.
• Figure 4: The predicted and true values for bias and singular values, and the angles between columns of the predicted and true rotation matrices for a 1 million-parameter model. The angles must lie in the range $[0,\pi]$, and the true rotation matrix columns have angle 0 with themselves. Our predictions are highly accurate, demonstrating robustness to normalization smoothing in ellipse fitting algorithms.
• Figure 5: Distance between predicted and true parameters for bias, stretch, and rotation (lower is better). Fitting the ellipsoid to more samples generally improves the predictions, though with diminishing returns.

Theorems & Definitions (1)

• proof