Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

DNF: Dual-Layer Nested Fingerprinting for Large Language Model Intellectual Property Protection

Zhenhua Xu, Yiran Zhao, Mengting Zhong, Dezhang Kong, Changting Lin, Tong Qiao, Meng Han

TL;DR

Compared with existing methods, DNF uses lower-perplexity triggers, remains undetectable under fingerprint detection attacks, and is relatively robust to incremental fine-tuning and model merging.

Abstract

The rapid growth of large language models raises pressing concerns about intellectual property protection under black-box deployment. Existing backdoor-based fingerprints either rely on rare tokens -- leading to high-perplexity inputs susceptible to filtering -- or use fixed trigger-response mappings that are brittle to leakage and post-hoc adaptation. We propose \textsc{Dual-Layer Nested Fingerprinting} (DNF), a black-box method that embeds a hierarchical backdoor by coupling domain-specific stylistic cues with implicit semantic triggers. Across Mistral-7B, LLaMA-3-8B-Instruct, and Falcon3-7B-Instruct, DNF achieves perfect fingerprint activation while preserving downstream utility. Compared with existing methods, it uses lower-perplexity triggers, remains undetectable under fingerprint detection attacks, and is relatively robust to incremental fine-tuning and model merging. These results position DNF as a practical, stealthy, and resilient solution for LLM ownership verification and intellectual property protection.

DNF: Dual-Layer Nested Fingerprinting for Large Language Model Intellectual Property Protection

TL;DR

Compared with existing methods, DNF uses lower-perplexity triggers, remains undetectable under fingerprint detection attacks, and is relatively robust to incremental fine-tuning and model merging.

Abstract

The rapid growth of large language models raises pressing concerns about intellectual property protection under black-box deployment. Existing backdoor-based fingerprints either rely on rare tokens -- leading to high-perplexity inputs susceptible to filtering -- or use fixed trigger-response mappings that are brittle to leakage and post-hoc adaptation. We propose \textsc{Dual-Layer Nested Fingerprinting} (DNF), a black-box method that embeds a hierarchical backdoor by coupling domain-specific stylistic cues with implicit semantic triggers. Across Mistral-7B, LLaMA-3-8B-Instruct, and Falcon3-7B-Instruct, DNF achieves perfect fingerprint activation while preserving downstream utility. Compared with existing methods, it uses lower-perplexity triggers, remains undetectable under fingerprint detection attacks, and is relatively robust to incremental fine-tuning and model merging. These results position DNF as a practical, stealthy, and resilient solution for LLM ownership verification and intellectual property protection.
Paper Structure (13 sections, 2 equations, 3 figures, 3 tables)

This paper contains 13 sections, 2 equations, 3 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Method
  4. Problem Definition
  5. Fingerprint Dataset Construction
  6. Fingerprint Injection
  7. Ownership Verification
  8. Experiment
  9. Experimental Setting
  10. Effectiveness & Harmlessness & Reliability
  11. Stealthiness
  12. Model-Level Attack Robustness
  13. Conclusion

Figures (3)

  • Figure 1: An illustrative example of the DNF method. The outer layer imposes a code-style format, while the inner layer embeds a semantic trigger by replacing a variable name with fp_D98904. Together, they form the complete DNF trigger. A suspect model that inherits from a fingerprinted source model will produce the predefined fingerprint response when queried with such input.
  • Figure 2: Overview of DNF, covering dataset construction and fingerprint injection. The core is a hierarchical dataset with four disjoint subsets—$\mathcal{D}_{\text{joint}}$ (style+semantic), $\mathcal{D}_{\text{stylistic}}$, $\mathcal{D}_{\text{semantic}}$, and $\mathcal{D}_{\text{normal}}$—with the latter three suppressing false activations.
  • Figure 3: FSR (%) of Mistral under two model merging strategies ($M_{Task}$ and $M_{Tie}$) with varying mixing ratios.