Attesting Model Lineage by Consisted Knowledge Evolution with Fine-Tuning Trajectory

TL;DR

This work tackles the problem of proving that a suspect model is a fine-tuned descendant of a parent by examining how knowledge evolves during the fine-tuning process. It introduces a model lineage attestation (MLA) framework that parameterizes the fine-tuning trajectory with an evolution model $f_\Delta$ and embeds knowledge into a shared latent space via a knowledge encoder $\Psi$ and a fusion module $\Phi$. The approach is validated across classification, diffusion, and large language model families, using probe-derived knowledge vectors to measure consistency with the parent’s knowledge and detect illicit derivatives and false provenance claims. Experimental results show high true-positive rates and low false-positive rates, demonstrating robustness to adaptive attacks and across generations, with practical implications for IP protection and ML governance in open-weight ecosystems. Overall, MLA provides a principled, knowledge-centric mechanism to verify model lineage in scenarios where traditional static-feature methods fail to capture dynamic knowledge evolution.

Abstract

The fine-tuning technique in deep learning gives rise to an emerging lineage relationship among models. This lineage provides a promising perspective for addressing security concerns such as unauthorized model redistribution and false claim of model provenance, which are particularly pressing in \textcolor{blue}{open-weight model} libraries where robust lineage verification mechanisms are often lacking. Existing approaches to model lineage detection primarily rely on static architectural similarities, which are insufficient to capture the dynamic evolution of knowledge that underlies true lineage relationships. Drawing inspiration from the genetic mechanism of human evolution, we tackle the problem of model lineage attestation by verifying the joint trajectory of knowledge evolution and parameter modification. To this end, we propose a novel model lineage attestation framework. In our framework, model editing is first leveraged to quantify parameter-level changes introduced by fine-tuning. Subsequently, we introduce a novel knowledge vectorization mechanism that refines the evolved knowledge within the edited models into compact representations by the assistance of probe samples. The probing strategies are adapted to different types of model families. These embeddings serve as the foundation for verifying the arithmetic consistency of knowledge relationships across models, thereby enabling robust attestation of model lineage. Extensive experimental evaluations demonstrate the effectiveness and resilience of our approach in a variety of adversarial scenarios in the real world. Our method consistently achieves reliable lineage verification across a broad spectrum of model types, including classifiers, diffusion models, and large language models.

Figures (21)

• Figure 1: The knowledge evolution mechanism in model fine-tuning. The consistency between the knowledge of parent model and the total knowledge inherited and discarded during the evolution process is used to attest the lineage relationship.
• Figure 2: Two key threat scenarios for model lineage attestation. In the illegal derivation scenario, the adversary steals the victim model $f_P$ and derives a new model $f_C^\mathcal{A}$ with direct fine-tuning or pruning followed by fine-tuning. In the false lineage claim scenario, the attacker attempts to present a closely related model $f_P^\mathcal{A}$ to falsely declare that a victim model $f_C$ was derived from it.
• Figure 3: The proposed model lineage attestation (MLA) framework consists of three key components. First, given a parent model $f_P$ and its fine-tuned model $f_C$, MLA constructs an evolution model $f_{\Delta}$ to characterize knowledge evolution during fine-tuning. Then, all three models are encoded into vector representations ($\mathbf{h}_P$, $\mathbf{h}_{\Delta}$, $\mathbf{h}_C$) through a shared knowledge encoder. Finally, the lineage attestation is performed by evaluating the knowledge consistency condition in Equation (\ref{['kncons']}).
• Figure 4: Kernel density estimation(KDE) of similarity scores for different lineage relations. Each subplot shows the similarity distribution between a child model and its parent, grandparent, great-grandparent and non-lineage items, respectively. True parent-child pairs exhibit distinctly higher similarity, enabling effective rejection of false lineage claims.
• Figure 6: Lineage attestation accuracy across different model families against varying parameter perturbation radio $\rho$.

Theorems & Definitions (2)

• Theorem 1
• proof