From Construction to Injection: Edit-Based Fingerprints for Large Language Models

A new framework proposes injecting code-mixed fingerprints into large language models to verify ownership and deter unauthorized redistribution, according to research posted on arXiv [1]. The method addresses long-standing weaknesses that allow adversaries to filter or degrade existing fingerprint signals [2]. The paper, submitted in September 2025 and revised through June 2026, introduces an end-to-end pipeline spanning fingerprint construction and injection [1]. The authors argue that prior paradigms face an imperceptibility trade-off: natural-language fingerprints risk accidental activation, while garbled fingerprints are statistically exposed and easier for defenders to filter [2]. Downstream model modifications such as fine-tuning further weaken embedded ownership evidence [5]. To counter these problems, the framework deploys two components. The first, Code-mixing Fingerprints (CF), generates prompts that mix languages under a high-complexity constraint while minimizing perplexity, making them atypical for ordinary users yet distributionally aligned with natural inputs [5]. The second, Multi-Candidate Editing (MCEdit), assigns multiple candidate targets to each fingerprint query and suppresses competing non-target outputs through margin-based optimization [4]. The design creates structurally redundant trigger–target mappings that degrade gracefully rather than collapsing under model modification [2]. A related line of work, FPEdit, also uses knowledge editing for fingerprinting but focuses on localized parameter edits and a promote-suppress value vector optimization [10]. The new framework differs by jointly optimizing multi-candidate mixture promotion and non-target margin suppression, which the authors contend yields a fault-tolerant output distribution that persists across modifications [4]. Extensive evaluations measured imperceptibility, detectability, and harmlessness. The authors report that the approach achieves robust ownership verification with negligible impact on model utility [1]. The submission history shows the manuscript grew from 338 KB in its first version to 1,188 KB by the fourth revision, reflecting expanded experiments and analysis [1]. The work was led by researcher Yue Li and developed with support from arXivLabs, a framework that lets collaborators build and share new features on the arXiv platform [1].