Targeted Counterfactual Fingerprinting for Black-Box LLM Ownership Verification

arXiv:2608.08195 · cs.CR, cs.AI · Submitted 2026-08-08 · Read on arXiv

Yutong Wu, Xiaofan Bai, Shixin Li, Pingyi Hu, Ziqi Zhou, Zilong Wang, Xiaojing Ma, Songfeng Lu, Yuhong Li, Jin Xuan, Yi Wang, Dongmei Zhang, Bin Benjamin Zhu

cs.CR, cs.AI

Submitted: 2026-08-08

Updated: 2026-08-11

Comments: 37 pages, 18 figures, 23 tables

Code: https://github.com/Underflow-1/TCF-LLM-Fingerprinting

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Verification — 109× in this paper · explained in 2 episodes
• AUC — 66× in this paper · explained in 2 episodes
• Accuracy — 44× in this paper · explained in 1 episode
• Fingerprinting — 33× in this paper · explained in 2 episodes
• Pruning — 15× in this paper · explained in 4 episodes
• Verifier — 15× in this paper · explained in 2 episodes
• Distillation — 11× in this paper · explained in 2 episodes
• GRPO — 10× in this paper · explained in 6 episodes
• Robustness — 10× in this paper · explained in 5 episodes
• Fine-Tuning — 7× in this paper · explained in 5 episodes
• Ablation — 5× in this paper · explained in 1 episode
• Embeddings — 5× in this paper · explained in 2 episodes
• Trace — 5× in this paper · explained in 2 episodes
• Aggregation — 4× in this paper · explained in 1 episode
• Provenance — 4× in this paper · explained in 4 episodes
• Quantization — 4× in this paper · explained in 12 episodes
• Adaptation — 3× in this paper · explained in 1 episode
• Alignment — 3× in this paper · explained in 1 episode
• Core — 3× in this paper · explained in 2 episodes
• Large Language Models (LLMs) — 3× in this paper · explained in 6 episodes
• Ablation Studies — 2× in this paper · explained in 1 episode
• Adversarial Examples — 2× in this paper · explained in 2 episodes
• Benchmark — 2× in this paper · explained in 2 episodes
• Transferability — 2× in this paper · explained in 4 episodes
• Ablation study — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Domain Adaptation — 1× in this paper · explained in 5 episodes
• Downstream Tasks — 1× in this paper · explained in 2 episodes
• Empirical Coverage — 1× in this paper · explained in 2 episodes
• Instruction Tuning — 1× in this paper · explained in 2 episodes
• LoRA Adaptation — 1× in this paper · explained in 2 episodes
• Massive Multitask Language Understanding — 1× in this paper
• Model Drift — 1× in this paper · explained in 4 episodes
• Model Merging — 1× in this paper · explained in 2 episodes
• Overview of Targeted Counterfactual Fingerprinting — 1× in this paper
• Semantic Similarity — 1× in this paper · explained in 2 episodes
• Symposium on Security and Privacy — 1× in this paper
• Transformer — 1× in this paper · explained in 2 episodes

Sources

• Qwen3 Technical Report
• The Llama 3 Herd of Models
• Gemma 3 Technical Report
• Gemma 2: Improving Open Language Models at a Practical Size
• 2 OLMo 2 Furious
• Qwen2 Technical Report

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs