Paper deep dive
Targeted Counterfactual Fingerprinting for Black-Box LLM Ownership Verification
Yutong Wu, Xiaofan Bai, Shixin Li, Pingyi Hu, Ziqi Zhou, Zilong Wang, Xiaojing Ma, Songfeng Lu, Yuhong Li, Jin Xuan, Yi Wang, Dongmei Zhang, Bin Benjamin Zhu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 8/11/2026, 5:37:00 AM
Summary
The paper introduces Targeted Counterfactual Fingerprinting (TCF), a black-box framework for verifying ownership of Large Language Models (LLMs). TCF converts open-ended generation into constrained-answer verification using a source-model counterfactual margin (SCM) to guide prompt perturbation. It achieves high accuracy (AUC 0.9861) across four LLM families, outperforming existing methods like TRAP, ProFLingo, and ZeroPrint by reducing surface-form ambiguity and leveraging source-specific counterfactual transitions as ownership evidence.
Entities (7)
Relation Signals (5)
SCM → usedin → TCF
confidence 98% · We introduce the source-model counterfactual margin (SCM)... TCF restricts each verification query... SCM controls target selection, perturbation stopping, and fingerprint filtering.
TCF → outperforms → TRAP
confidence 95% · TCF achieves an average AUC of 0.9861, improving over TRAP... by 0.07 to 0.19.
TCF → outperforms → ProFLingo
confidence 95% · TCF achieves an average AUC of 0.9861, improving over... ProFLingo... by 0.07 to 0.19.
TCF → outperforms → ZeroPrint
confidence 95% · TCF achieves an average AUC of 0.9861, improving over... ZeroPrint... by 0.07 to 0.19.
GCG → usedby → TCF
confidence 90% · use GCG optimization to synthesize a text perturbation... The resulting perturbed prompt is a fingerprint
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language models (LLMs) are high-value assets that can be derived through redeployment, fine-tuning, quantization, or further alignment. Because deployed LLMs are commonly exposed only through query APIs, ownership verification must often rely on black-box text responses. This setting is difficult: generations are open-ended and can vary across repeated queries, while existing black-box fingerprints rely on signals that are fragile under a final-response interface, including full-text matching, soft behavioral features, or model-specific prompts designed not to transfer. We propose TCF (Targeted Counterfactual Fingerprinting), a black-box LLM fingerprinting framework that converts open-ended generation comparison into constrained-answer targeted counterfactual transfer. TCF restricts each verification query to a finite answer space, reducing the surface-form ambiguity that enters the verification score, and optimizes a prompt perturbation toward a counterfactual target different from the protected model's clean answer on the original prompt. Verification reduces to checking whether the suspect model's parsed final answer matches the recorded target. We introduce the source-model counterfactual margin (SCM), a protected-model-only quantity that certifies the target is unlikely before the perturbation and likely after it; SCM controls target selection, perturbation stopping, and fingerprint filtering. Under explicit derived-preservation and independent-transfer budgets motivated by local behavioral closeness, we derive a target-accuracy gap between derived and independent models. Across four LLM families, TCF achieves an average AUC of 0.9861, improving over TRAP, ProFLingo, and ZeroPrint by 0.07 to 0.19.
Tags
Links
- Source: https://arxiv.org/abs/2608.08195v1
- Canonical: https://arxiv.org/abs/2608.08195v1
Trouble viewing inline? Open PDF directly →
Full Text
141,219 characters extracted from source content.
Expand or collapse full text
Targeted Counterfactual Fingerprinting for Black-Box LLM Ownership Verification Yutong Wu 1,∗ , Xiaofan Bai 2,∗ , Shixin Li 1 , Pingyi Hu 1 , Ziqi Zhou 1 , Zilong Wang 1 , Xiaojing Ma 1 Songfeng Lu 1 , Yuhong Li 2 , Jin Xuan 2 , Yi Wang 3 , Dongmei Zhang 3 , Bin Benjamin Zhu 3 1 Huazhong University of Science and Technology 2 Alibaba Group 3 Microsoft Corporation wyt@hust.edu.cn, baixiaofan.bxf@alibaba-inc.com ∗ Equal contribution. Abstract— Large language models (LLMs) are high-value assets that can be derived through redeployment, fine-tuning, quantization, or further alignment. Because deployed LLMs are commonly exposed only through query APIs, ownership verification must often rely on black-box text responses. This setting is difficult: generations are open-ended and can vary across repeated queries, while existing black-box fingerprints rely on signals that are fragile under a final-response interface, including full-text matching, soft behavioral features, or model-specific prompts designed not to transfer. The central challenge is to obtain auditable evidence that separates derivatives of a protected model from independently trained models using only black-box queries. We propose TCF (Targeted Counterfactual Fingerprinting), a black-box LLM fingerprinting framework that converts open- ended generation comparison into constrained-answer targeted counterfactual transfer. TCF restricts each verification query to a finite answer space, reducing the surface-form ambiguity that enters the verification score, and optimizes a prompt perturbation toward a counterfactual target different from the protected model’s clean answer on the original prompt. The resulting perturbed prompt is a fingerprint: verification reduces to checking whether the suspect model’s parsed final answer matches the recorded target. To construct discriminative fingerprints offline, we introduce the source-model counterfactual margin (SCM), a protected-model- only quantity that certifies the target is unlikely before the perturbation and likely after it; SCM controls target selection, perturbation stopping, and fingerprint filtering. Under explicit derived-preservation and independent-transfer budgets motivated by local behavioral closeness, we derive a target-accuracy gap between derived and independent models. The bounds explain when targeted counterfactual transfer becomes ownership evidence, while empirical SCM diagnostics motivate an interior feasible operating region rather than arbitrarily large margins. Across four LLM families, TCF achieves an average AUC of 0.9861, improving over state-of-the-art black-box fingerprints TRAP, ProFLingo, and ZeroPrint by 0.07–0.19. Project available at: https://github.com/Underflow-1/TCF-LLM-Fingerprinting I. INTRODUCTION Large language models (LLMs) are high-value intel- lectual property assets, but verifying whether a deployed model derives from a protected source remains a criti- cal unsolved challenge. Training state-of-the-art LLMs demands massive data, exascale computation, and costly post-training alignment, yet third parties can reuse these models with minimal friction—wrapping checkpoints in APIs, fine-tuning for downstream tasks, quantizing for efficiency, or adapting via preference tuning. All such reuse is typically delivered as a black-box cloud service: auditors can only submit prompts and read text responses, with no access to weights, hidden states, logits, or decoding configurations [1]–[4]. This creates a fundamental challenge: enforcement of licenses and usage policies requires reliable, auditable evidence, but the only available signal is ambiguous, variable text output. Existing ownership verification methods fall into two categories: watermarking and fingerprinting. Watermark- ing embeds ownership signals by modifying training, fine- tuning, decoding, or model parameters [5]–[7]. While effective when owners control the full pipeline, it is invasive and cannot be retroactively applied to released, leaked, or third-party-modified models. Fingerprinting, by contrast, constructs verification queries from pre-trained models without modification, making it a natural non- invasive approach for auditing deployed derivatives [1]– [3]. The core challenge for LLM fingerprinting is open- ended generation. Unlike classifiers with fixed label spaces, LLMs produce variable, discrete responses under stochastic decoding: semantically identical answers differ in wording, decoding settings alter formats, and semantic similarity scoring is brittle and hard to justify as audit evidence. Existing methods lean on signals that weaken under strict final-text interface: ProFLingo relies on full- text response matching [2], which breaks under paraphras- ing or formatting changes. TRAP uses GCG-optimized suffixes for exact identity verification [1], [8], but its non-transferable design misses fine-tuned, quantized, or modified derivatives. ZeroPrint estimates soft behavioral features via perturbations [3], [9], requiring embeddings arXiv:2608.08195v1 [cs.CR] 8 Aug 2026 and similarity scoring rather than parsed text responses. We propose Targeted Counterfactual Fingerprinting (TCF), a framework that reduces generation ambiguity at the scoring stage by reformulating verification as a constrained-answer problem. Each prompt restricts outputs to a finite setA =a 1 ,...,a K (implemented as A,B,C,Dmultiple-choice labels), and a deterministic parser maps responses to valid labels or an invalid symbol. This converts noisy text generation into reproducible hard-label events, eliminating semantic scoring and reducing sensitivity to surface-form variation, decoding randomness, and format differences. Constrained answers alone do not provide ownership evidence—unrelated models may share public knowledge and answer natural questions identically. TCF therefore constructs fingerprints as targeted counterfactual trans- fers: for each base question, we record the protected model’s clean answer, then use GCG optimization to synthesize a text perturbation that flips the model’s answer to a preselected unlikely target. The resulting prompt encodes a source-specific transition: a target that was improbable under the clean prompt becomes probable after perturbation. All stages of fingerprint construction are governed by the source-model counterfactual margin (SCM), a single quantity computed exclusively from the protected model. SCM quantifies both the unlikelihood of the target under the clean prompt and its likelihood after perturbation, unifying target selection, perturbation stopping, and fingerprint filtering. For the analysis, local behavioral closeness motivates explicit budgets for how much a derived model may weaken the source target preference and how much an independent model may acquire through generic transfer. Conditioned on these budgets, SCM yields quantitative lower and upper bounds on target transfer and a sufficient condition for a positive target- accuracy gap. Empirically, very strong perturbations can also increase generic transfer, motivating a feasible SCM operating region rather than maximal optimization. TCF at a glance Construct offline: choose a clean-unlikely answer, optimize the source model toward that target, and retain only SCM-qualified prompts. Verify online: send each private prompt to the suspect API, parse one final A/B/C/D label, and aggregate target hits. Ownership signal: derivatives preserve more source-induced counterfactual transitions than independently trained models. This framing fundamentally differs from prior adversarial-prompt work. TRAP optimizes for exact model identity [1], while ownership verification requires detecting family membership—derivatives may differ from the original but still be unauthorized copies. TCF therefore treats preservation of source-specific counter- factual transitions itself as ownership evidence. Verifi- cation is strictly black-box and hard-label: we compute target accuracy (TA) across the private fingerprint set, using no suspect-model logits, embeddings, gradients, or hidden states. Across four LLM families, TCF achieves an average AUC of 0.9861 (perfect 1.0000 on three families), outperforming TRAP (0.7931), ProFLingo (0.8880), and ZeroPrint (0.9128) by 0.07–0.19. These results validate our central thesis: constrained-answer restriction reduces generation ambiguity at the verification interface, while SCM-guided counterfactual perturbation produces a highly discriminative signal for source-family ownership verification. Our key contributions are: •Problem reformulation. We recast black-box LLM ownership verification from fragile open-ended com- parison into constrained-answer targeted counterfactual transfer, producing a robust, auditable hard-label signal. •Unified source-only design. We introduce SCM, a single quantity computed exclusively from the protected model that unifies all stages of fingerprint construction, eliminating the need for surrogates or reference models. •Formal theoretical foundation. Under explicit derived- preservation and independent-transfer budgets moti- vated by local behavioral closeness, we derive quantita- tive target-transfer bounds and a sufficient condition for a positive target-accuracy gap; empirical diagnostics identify a useful feasible SCM operating region. •State-of-the-art performance. Under strict hard-label constraints, TCF matches or outperforms the strongest evaluated baseline across the four source families and maintains strong performance across diverse derivative subgroups. I. RELATED WORK Model ownership verification divides into two paradigms: invasive watermarking and non-invasive fin- gerprinting. A. Watermarking and Invasive Ownership Signals Watermarking embeds verifiable ownership signals by intervening in the model lifecycle. Classical DNN watermarking uses backdoor triggers, parameter-level signatures, adversarial frontiers, or output modulations [10]–[14]; LLM watermarking extends this to generation statistics, fine-tuning data, or trigger-response pairs [5]– [7], [15]–[18]. Recent variants include instructional backdoors [19], cross-turn contextual backdoors [20], and probabilistic provenance injection [21]. These methods share two critical limitations for our threat model: (1) they cannot be retroactively applied to released, leaked, or third-party-modified models; (2) they require altering the protected model or its training pipeline. Additionally, watermarking faces unresolved 2 tradeoffs in utility preservation, stealthiness, and attack resistance [22]–[24]. Notably, text watermarking targets content provenance (identifying generated text) rather than model ownership (verifying a suspect service derives from a protected source), making it orthogonal to our problem. B. Non-Invasive Fingerprinting Fingerprinting constructs verification queries from pre-trained models without modification, addressing watermarking’s core limitations. For DNNs, prior work leverages decision boundaries, conferrable adversarial examples, universal perturbations, adversarial trajectories, and robustness signatures [25]–[31]. These methods mo- tivate our use of transferable behavioral signals, but they are designed for fixed-label classifiers with continuous inputs—LLMs present unique challenges due to discrete prompts, autoregressive generation, and surface-form variability from paraphrasing, formatting, and stochastic decoding. LLM fingerprinting further splits by access level: - White-box/representation-level methods require inter- nal model information: HuRef extracts human-readable fingerprints from invariant parameters [32]; REEF com- pares representation similarity across models [33]. While these reveal stable internal structures in derivatives, they are incompatible with strict black-box APIs that expose only final text outputs. Our method is complementary: we use source-side access exclusively for offline fingerprint construction and verify suspects using only parsed text labels. C. Black-Box Behavioral Fingerprinting Our work focuses on the most restrictive and practi- cally relevant setting: non-invasive, hard-label black-box verification using only final text responses. ProFLingo [2] constructs queries that elicit target responses from the source model, then checks for exact reproduction. It relies on full-text matching, which is fragile to paraphrasing, decoding variation, and formatting changes. TRAP [1], [8] optimizes GCG adversarial suffixes to force the source model to output random strings. Designed for exact identity verification, its suffixes are intentionally non- transferable, failing to detect fine-tuned, quantized, or modified derivatives. ZeroPrint [3], [9] estimates local Jacobian-like fingerprints via semantic-preserving pertur- bations and output embeddings. While it captures richer behavioral features, it requires embedding comparisons and repeated perturbation queries, violating strict hard- label constraints. TCF addresses these limitations by reformulating verification as constrained-answer targeted counterfactual transfer. Unlike prior work, we restrict outputs to a finite label space (reducing surface-form ambiguity at scoring time) and use only parsed hard labels for verification. This produces a simple, reproducible signal compatible with text-only APIs that permit ordinary prompt queries, while SCM-guided perturbation ensures discriminative power for family-level ownership verification. Table I summarizes the taxonomy of LLM ownership verification methods, highlighting our unique position as a non-invasive, strict black-box, hard-label approach. TABLE I LLM OWNERSHIP-VERIFICATION METHODS. “MODIFIED?” INDICATES WHETHER THE PROTECTED MODEL OR ITS TRAINING/DECODING PROCESS IS MODIFIED. “STRICT BLACK BOX” MEANS THAT VERIFICATION CAN BE PERFORMED FROM THE TEXT RESPONSES ONLY. Method classExamplesModified?Suspect accessStrict black box Text watermarking[5]–[7]YesText/APIPartial Backdoor / active watermark[15], [17], [19], [20]YesText/APIOften yes White-box / representation fingerprint[32], [33]NoWeights/rep./circuitsNo/partial Black-box behavioral fingerprint[1]–[3]NoText/APIYes TCFOursNoText/APIYes I. THREAT MODEL AND PROBLEM FORMULATION A. Threat Model We consider an LLM owner who protects a source modelM 0 and audits a suspect serviceM s . The goal is to determine whetherM s is either the same model asM 0 or a derivative ofM 0 . The owner can accessM 0 during offline fingerprint construction, but can only queryM s through its public text interface during verification. Owner capability. The owner has full access to the pro- tected source modelM 0 before deployment or auditing. Therefore, the owner may use source-model probabilities, gradients, and decoding behavior to construct fingerprints. This access is only assumed forM 0 and is never assumed for the suspect model. Suspect-model access. The suspect modelM s is a black-box text-generation service. During verification, the owner submits prompts and observes only the final generated text. The owner cannot access the suspect model’s parameters, logits, token probabilities, hidden states, tokenizer internals, system prompt, decoding configuration, training data, or post-training procedure. Strict online evidence contract The suspect-side audit uses only ordinary text queries and the final parsed label. No suspect-model probability, embed- ding, hidden state, gradient, tokenizer access, or semantic- similarity model enters the ownership score. Invalid or ambiguous responses are counted as failures rather than being repaired by a soft scorer. The positive class containsM 0 and models derived fromM 0 . Such derived models may be produced by supervised fine-tuning, instruction tuning, RLHF, DPO- style preference tuning, LoRA adaptation, pruning, quanti- zation, or lightweight post-processing. The negative class contains independently trained or unrelated LLMs. These 3 models may still share public data, similar architectures, comparable sizes, or similar benchmark performance with M 0 . Therefore, the verification task is not to test general capability similarity, but to identify whether the suspect service preserves source-family behavior of M 0 . Adversary. The suspect provider may deploy a mod- ified version of the source model, adjust decoding parameters, alter system prompts, change response for- matting, apply output post-processing, or use a fine- tuned, compressed, quantized, merged, or otherwise transformed model. The provider is not assumed to reveal any implementation details. We assume the private fingerprint set is not known to the suspect provider before verification. The suspect service is expected to answer ordinary user prompts, including the verifier’s prompts, through its text-generation interface. B. Verification Objective The owner constructs a private fingerprint set F =(p i ,y i ,t i ) n i=1 ,(1) wherep i is the verification prompt,y i ∈Ais the source model’s clean answer associated with the underlying question, andt i ∈A\y i is the target answer recorded by the owner. During verification, the owner queries the suspect modelM s with eachp i and counts a hit only when the parsed response equals the recorded targett i . The verification score is the fingerprint target accuracy: TA(M s ;F ) = 1 n n X i=1 I [Parse(r s (p i )) = t i ].(2) The owner declaresM s as a derived model fromM 0 if its target accuracy reaches a pre-chosen verification threshold ζ. Verification goal. The goal is not to prove byte-level equality betweenM s andM 0 . Instead, the goal is to decide whetherM s exhibits sufficiently strong source- family fingerprint behavior under the strict black-box interface. IV. THEORETICAL ANALYSIS In this section, we develop an LLM-specific theory for our fingerprinting method. The analysis is deliberately separated from the practical construction of Section V. We are aiming to distinguish two model classes—models derived from the protected sourceM 0 and independently trained models—and we ask: under what structural property does a perturbed verification input, constructed only fromM 0 , induce a target-answer accuracy gap between these two classes? Our analysis centers on the source-model counterfactual margin (SCM), the source- side target preference created by the optimized text perturbation. A large SCM certifies a strong source-side counterfactual transition. The locality premise motivates explicit derived-preservation and independent transfer budgets, and the formal separation results below are conditioned on those budgets. Under fixed budgets, larger SCM strengthens the separation bounds. Empirically, however, stronger perturbations can also increase generic transfer to independent models, which motivates a feasible operating region and early stopping rather than maximal optimization. The proof details, modeling qualifications, and cross-model validation are provided in AppendixA-B and Appendix A-A. A. Finite Constrained-Answer Space LetM 0 denote the protected source LLM and letM denote a suspect LLM. For a promptp, the raw output ofMis a text response, denoted byR M (p). Our prompt template restricts valid answers to a finite constrained answer space A =a 1 ,a 2 ,...,a K , K <∞.(3) In our implementation,Ais instantiated by multiple- choice labels such as A,B,C,D. LetParse(·)be a deterministic parser that maps a raw response to one valid label inA, or to⊥if the response is invalid, ambiguous, or unparsable. We define the constrained-answer distribution of modelMon prompt p as q M (a| p) = Pr [Parse(R M (p)) = a], a∈A. (4) Invalid responses are not assigned to any valid label, so P a∈A q M (a| p) may be smaller than one. For a target labelt∈Aand a promptp, we define the target log-odds L on model M as a target preference signal L M (p,t) = log q M (t| p) 1− q M (t| p) .(5) L M (p,t) > 0means that the target answer has a probabil- ity larger than1/2, while a larger value means a stronger target preference. Details on probability estimation and clipping are deferred to Appendix A-B1. B. Source-model Counterfactual Margin For a questionx, letp 0 (x)be the clean prompt without any perturbation. Letube a discrete input perturbation, constructed only from M 0 , and let p u (x) = Template(u,x)(6) be the perturbed fingerprint prompt. The clean answer of the source model is y(x) = arg max a∈A q M 0 (a| p 0 (x)).(7) A target answert(x)is drawn fromA \ y(x), but differing from the clean answer is not by itself enough: the fingerprint should make this target answer unlikely before the perturbation and likely after it. The counterfactual 4 requirement is therefore certified by the quantity below rather than by the choice t(x)̸= y(x) alone. Definition IV.1 (Source-model counterfactual margin). For a candidate fingerprint(x,u,t), its Source-model Counterfactual Margin (SCM) is Γ(x,u,t) = min L M 0 (p u (x),t), −L M 0 (p 0 (x),t) . (8) The two terms in Eq. 8 correspond to two sides of the same counterfactual transition. The first term requires the target answer to be likely after the perturbation is applied. The second term requires the same target answer to be unlikely for the clean question. Therefore, a large SCM certifies q M 0 (t| p 0 (x)) is small, q M 0 (t| p u (x)) is large. (9) The SCM also provides an explicit probability interpre- tation. Letσ(z) = 1/(1 + e −z )be the sigmoid function. Since Eq. 5 is the logit of q M (t| p), we have q M (t| p) = σ (L M (p,t)).(10) Thus, if Γ(x,u,t)≥ Γ min , Eq. 8 and Eq. 10 imply q M 0 (t| p u (x))≥ σ(Γ min ),(11) and q M 0 (t| p 0 (x))≤ σ(−Γ min ).(12) Here,Γ min denotes the minimum required SCM for accepting a fingerprint. A candidate is called SCM- qualified if Γ(x,u,t)≥ Γ min .(13) IncreasingΓ min strengthens individual fingerprints but can reduce the number and diversity of retained fin- gerprints. The detailed feasibility discussion is in Ap- pendix A-B2. C. How the Perturbation Controls SCM The SCM is useful because it can be controlled using only the protected source model. The clean term −L M 0 (p 0 (x),t)is controlled by selecting a target answer that is unlikely under the clean source prompt. The perturbed termL M 0 (p u (x),t)is controlled by optimizing the input perturbationuagainstM 0 . Let the source-model perturbation loss be L src (u;x,t) =− logq M 0 (t| p u (x)).(14) Lemma 1 (Loss threshold for SCM control). Suppose the target label t satisfies −L M 0 (p 0 (x),t)≥ Γ min .(15) If the perturbation u satisfies L src (u;x,t)≤ log 1 + e −Γ min ,(16) then the fingerprint satisfies Γ(x,u,t)≥ Γ min .(17) Lemma 1 gives an explicit stopping rule for the perturbation optimizer: after selecting a clean-unlikely target, the perturbation should be optimized until the source target loss falls below the threshold in Eq. 16. Equivalently, the optimization should make the source target probability exceedσ(Γ min )and hence satisfy Eq. 17. To verify Lemma 1, Fig. 1 records how the source target loss and SCM evolve during GCG optimization. Panel (a) plots the target loss over steps, panel (b) shows the mean SCM over the same trajectory, and panel (c) directly compares target loss with SCM. The result is consistent across the three views: target loss decreases, SCM increases, and the two show a strong negative relation. This supports using target-loss minimization as a practical source-side proxy for increasing SCM, while the early stopping rule avoids unnecessary over-optimization. Additional details are in Appendix A-B5. 050100150200 GCG step 10 −1 10 0 Mean target loss (a) Target loss vs GCG step L target Γ=1 Γ=2 Γ=3 050100150200 GCG step −2 −1 0 1 Mean SCM (b) Mean SCM vs GCG step 024 Target loss −4 −2 0 2 SCM ρ= −1.00 (c) Loss--SCM relation 0 100 200 GCG step Fig. 1. The relationship between target loss and SCM. Optimizing the source-side input perturbation reduces the source target loss, increases the mean SCM, and produces a strong negative relation. Takeaway Target-loss minimization is an effective operational proxy for increasing SCM. D. Local Behavioral Closeness Lemma 1 focuses on the protected modelM 0 . To reason about how the target transition induced by text input perturbationubehaves on other models, the analysis needs one structural premise. Letz M (p) ∈ R K be the answer-logit vector thatMassigns to the labels inAon prompt p, and define the target margin m M (p,t) = z M (p)[t]− max a̸=t z M (p)[a].(18) A positive margin meanstis the model’s parsed hard answer inA; a large margin means the hard answer is stable. Assumption IV.2 (Local behavioral closeness). There exist a closeness radiusβ ≥ 0and a small slackη ∈ [0, 1) such that, for a derived modelM D , a fraction at least 1− η of fingerprint inputs p∈p 0 (x),p u (x) obey |m M D (p,t)− m M 0 (p,t)|≤ β.(19) 5 No such uniform high-probability closeness toM 0 holds for an independent model M I . Assumption IV.2 states that a derived model’s local decision behavior stays near the protected model’s at each evaluated input, including both the clean and the perturbed prompt. The premise is probabilistic: it need only hold for a large fraction of fingerprints, and the verifier aggregates many fingerprints so that a per-fingerprint edge concentrates into a reliable separation. This premise motivates the transfer diagnostics below but is not, by itself, a numerical bound on an unknown suspect; the formal results are conditioned on the explicitε D andε I budgets. AppendixA-B6 gives the detailed interpretation and targeted-transfer intuition. E. Targeted Transferability of Derived Models We now instantiate the derived side of Assumption IV.2 on the parsed-log-odds scale used by the verifier. For a derived modelM D and a candidate fingerprint(x,u,t), define ∆ + D (M D ,x,u,t) = max n 0, L M 0 (p u (x),t) − L M D (p u (x),t) o . (20) This quantity is the loss of perturbed target log-odds when moving from the source model to the derivative. For any budget ε D (M D ,x,u,t) satisfying ε D (M D ,x,u,t)≥ ∆ + D (M D ,x,u,t),(21) we have the deterministic inequality L M D (p u (x),t)≥ L M 0 (p u (x),t)− ε D (M D ,x,u,t). (22) Smaller budgets mean that the considered derivative class preserves the source prefixed target preference more strongly. 012345 Δ + D 0.0 0.2 0.4 0.6 0.8 1.0 P (Δ + D ≤ ε D ) 50% 0.38 90% 2.97 95% 3.69 (a) Required preservation budget ECDF 012345 SCM threshold Γ 0.0 0.2 0.4 0.6 0.8 1.0 Lower bound (b) Derived transfer lower bound 50% ε D =0.38 90% ε D =2.97 95% ε D =3.69 Fig. 2. Validation of derived-model local closeness (Assumption IV.2). (a) The empirical weakening budgetε D fromPr(∆ + D ≤ ε D )over derived model–fingerprint pairs estimates the covered fraction on which the premise holds. (b) The resulting conditional transfer lower bound σ(Γ− ε D ) under the marked empirical budgets. Lemma 2 (Conditional derived-model targeted-transfer lower bound). LetΓ = Γ(x,u,t). Ifε D (M D ,x,u,t)≥ ∆ + D (M D ,x,u,t), then q M D (t| p u (x))≥ σ Γ− ε D (M D ,x,u,t) .(23) In particular, if Γ≥ Γ min , then q M D (t| p u (x))≥ σ Γ min − ε D (M D ,x,u,t) .(24) Lemma 2 shows how SCM compensates for post- training drift. To guarantee a derived-model target-hit probability at least1−τ D under budgetε D , it is sufficient that Γ≥ ε D + log 1− τ D τ D .(25) To verify Lemma 2, Fig. 2 empirically examines whether derived models preserve the source-induced target prefer- ence. We compute the weakening drift∆ + D over derived model–fingerprint pairs, summarize its ECDF in panel (a), and plug representative budgets into the lower bound σ(Γ− ε D )in panel (b). The result shows that smaller budgets correspond to stronger preservation, and that increasing SCM gives a stronger lower bound on derived- model target-hit probability. Higher-coverage budgets are more conservative. AppendixA-B7 further summarizes these results, and the corresponding cross-model ECDF diagnostics are reported in Appendix A-A. Takeaway Derived models preserve enough of the source-induced target preference to support conditional transfer. F. Targeted Transferability of Independent Models To operationalize the independent-model side of As- sumption IV.2, we allow an explicit generic-transfer slack rather than assuming a fixed numerical distance. An independent model need not stay uniformly close toM 0 at the perturbed input. The perturbationuis optimized only againstM 0 , so it followsM 0 ’s local gradient geometry; on a model whose local geometry is misaligned with M 0 ’s, the same direction produces only a weak, generic effect. For an independent modelM I and a candidate fingerprint (x,u,t), define the generic-transfer slack ∆ + I (M I ,x,u,t) = max n 0, L M I (p u (x),t) − L M 0 (p 0 (x),t) o . (26) For any budget ε I (M I ,x,u,t) satisfying ε I (M I ,x,u,t)≥ ∆ + I (M I ,x,u,t),(27) we have the deterministic inequality L M I (p u (x),t)≤ L M 0 (p 0 (x),t) + ε I (M I ,x,u,t). (28) The slack explicitly permits accidental transfer and generic prompt effects. Lemma 3 (Conditional independent-model targeted-trans- fer upper bound). LetΓ = Γ(x,u,t). Ifε I (M I ,x,u,t)≥ ∆ + I (M I ,x,u,t), then q M I (t| p u (x))≤ σ −Γ + ε I (M I ,x,u,t) .(29) In particular, if Γ≥ Γ min , then q M I (t| p u (x))≤ σ −Γ min + ε I (M I ,x,u,t) .(30) 6 024 Δ + I 0.0 0.5 1.0 1.5 2.0 2.5 Density 50%90%95% (a) Distribution of non-transfer slack 0246 ε I 0.0 0.2 0.4 0.6 0.8 1.0 P (Δ + I ≤ ε I ) 50% 0.63 90% 3.98 95% 4.79 (b) Independent Eq.27 coverage 012345 SCM threshold Γ 0.0 0.2 0.4 0.6 0.8 1.0 Upper bound (c) Independent transfer upper bound 50% ε I 90% ε I 95% ε I Fig. 3. Validation of independent-model targeted transfer. (a) Dis- tribution of the required generic-transfer slack∆ + I . (b) Empirical coveragePr(∆ + I ≤ ε I )over independent model–fingerprint pairs. (c) Conditional independent-model transfer upper boundσ(−Γ+ε I )under the marked empirical slack budgets. For fixedε I , increasing SCM tightens the independent upper bound. Ifε I itself grows with SCM because stronger prefixes have larger generic prompt effects, empirical independent accuracy may increase even though the fixed-slack envelope decreases. This distinction is important to understand SCM-bucket plots in Fig. 4. To empirically verify Lemma 3, Fig. 3 measures how much a source-optimized perturbation transfers to independent models. We compute the generic-transfer slack∆ + I , show its distribution in panel (a), convert it to an ECDF in panel (b), and plug the marked budgets into the upper boundσ(−Γ + ε I )in panel (c). The result shows that larger slack budgets cover more independent model–fingerprint pairs, but also give looser non-transfer guarantees. For a fixed slack, increasing SCM tightens the independent-model upper envelope, although empirical independent accuracy can still rise when stronger prefixes create generic transfer. AppendixA-B9 summarizes the diagnostic, and the corresponding cross-model non- transfer results are reported in Appendix A-A. Takeaway Independent-model transfer requires explicit generic-transfer slack, explaining residual false positives under over- optimization. G. SCM-Induced Separability of Target Accuracy Before aggregating fingerprints, consider the fixed- budget single-fingerprint gap envelope g(Γ;ε D ,ε I ) = σ(Γ− ε D )− σ(−Γ + ε I ).(31) For fixedε D andε I , larger SCM increases the fixed- budget gap envelope; AppendixA-B11 gives the detailed fixed-budget interpretation and its empirical qualification. For a fingerprint set F =(x i ,u i ,y i ,t i ) n i=1 ,(32) define the hard-label target-accuracy statistic of a suspect model M as TA(M ) = 1 n n X i=1 I[Parse(R M (p u i (x i ))) = t i ].(33) This is exactly the statistic used by the online verifier. Theorem IV.3 (SCM yields a target-accuracy separation under explicit transfer budgets). LetΓ i = Γ(x i ,u i ,t i ). For a derived modelM D , choose valid budgetsε D,i ≥ ∆ + D (M D ,x i ,u i ,t i ) . For an independent modelM I , choose valid budgets ε I,i ≥ ∆ + I (M I ,x i ,u i ,t i ). Then E[TA(M D )]≥ 1 n n X i=1 σ(Γ i − ε D,i ),(34) and E[TA(M I )]≤ 1 n n X i=1 σ(−Γ i + ε I,i ).(35) Consequently, the expected separability gap satisfies G≜ E[TA(M D )]− E[TA(M I )] ≥ 1 n n X i=1 [σ(Γ i − ε D,i )− σ(−Γ i + ε I,i )]. (36) Lemma 4 (Fixed-budget separability). If every fingerprint satisfies Γ i ≥ Γ min , ε D,i ≤ ε D , and ε I,i ≤ ε I , then E[TA(M D )]≥ σ(Γ min − ε D ), E[TA(M I )]≤ σ(−Γ min + ε I ). (37) The fixed-budget lower bound on the expected gap is positive whenever 2Γ min > ε D + ε I .(38) By Lemma 4, the derived flip probability is lower bounded while the independent flip probability is upper bounded, so the operating point can be chosen inside the feasible band to obtain a positive expected gap. Averaging ndiverse fingerprints then concentratesTAaround the two class-specific rates, converting a per-fingerprint edge into a thresholdable separation. To verify Lemma 4, 02468 SCM threshold Γ 0.0 0.2 0.4 0.6 0.8 1.0 Target accuracy / gap positive gap: Γ>3.48 (a) Bound separation, conservative case Derived LB Indep. UB Gap LB Q1 SCM=-2.16 Q2 SCM=-1.15 Q3 SCM=-0.54 Q4 SCM=0.66 SCM quantile 0.0 0.2 0.4 0.6 0.8 1.0 Target accuracy (b) Empirical separability Derived TA Independent TA Gap 01234 SCM threshold Γ 0.0 0.2 0.4 0.6 0.8 1.0 Target accuracy / gap Γ Q4 =0.66 p=53.7%, P=0.54 (c) Q4-matched bound Derived LB Indep. UB Gap LB 0.0 0.1 0.2 0.3 0.4 0.5 Derived-independent gap Fig. 4. SCM-induced separability and the feasible margin band. (a) Conservative fixed-budget envelope using the90%empirical budgets ε D ≈ 2.97andε I ≈ 3.98; the resulting positive-gap conditionΓ > 3.48is sufficient, not necessary. (b) Empirical SCM-quantile trend on Qwen3-1.7B Base: independent target accuracy may also rise in the highest-SCM buckets because a stronger perturbation manufactures generic transfer, so the derived–independent gap is maximized at an interior operating margin (the band sweet spot) rather than by pushing SCM arbitrarily high. (c) Q4-matched fixed-slack envelope. Fig. 4 empirically validates whether the derived and independent bounds translate into an observable target- accuracy gap. Panel (a) combines the derived lower bound and independent upper bound using the90%empirical 7 budgets, panel (b) compares this with the empirical SCM-bucket trend, and panel (c) repeats the bound calculation with high-SCM matched budgets. The result supports the feasible-band interpretation: higher-SCM fingerprints generally increase the derived–independent gap, but the highest-SCM bucket can also increase independent target accuracy when the perturbation be- comes too generic. Thus, SCM should be strong enough to survive derived-model weakening, but not pushed indefinitely. AppendixA-B14 gives the detailed empirical interpretation, and model-wise SCM separability results are reported in Appendix A-A. Takeaway SCM is most useful inside a feasible margin band, support- ing early stopping rather than maximal optimization. H. Threshold Selection and Verification Reliability The previous subsection gives expected target-accuracy bounds. Define α D = 1 n n X i=1 σ(Γ i − ε D,i ), α I = 1 n n X i=1 σ(−Γ i + ε I,i ). (39) Here,α D is a lower bound on the expected target accuracy of a derived model under the chosen budgets, andα I is an upper bound for an independent model under its chosen slacks. Ifα D > α I , then any threshold in(α I ,α D ) separates the two expectation bounds. A natural threshold is ζ ⋆ = α D + α I 2 .(40) In practice, the true budgets of an unknown suspect model are unavailable, so Eq. 40 should be viewed as a theoretical existence statement. Operational thresholds should be pre-registered from source-side construction rules and, when available, calibrated on a held-out validation pool of non-derived models rather than tuned on the test suspect pool. Under the fixed-budget interpretation in Lemma 4, an operational sufficient condition for derived hit probability at least1− τ D and independent hit probability at most τ I is Γ min ≥ max ε D + log 1− τ D τ D , ε I + log 1− τ I τ I . (41) This formula exposes the feasibility trade-off: stronger reliability requirements or larger transfer budgets require larger SCM, which can reduce the retained fingerprint pool. Lemma 5 (Finite-sample reliability under independent fingerprint indicators). Letμ M = E[TA(M )]. Suppose the hard-label indicators in Eq. 33 are independent conditional on the fixed fingerprint set. If a derived model satisfiesμ M D ≥ α D and an independent model satisfies μ M I ≤ α I withα D > α I , then under the midpoint threshold in Eq. 40, Pr[TA(M D ) < ζ ⋆ ]≤ exp − n(α D − α I ) 2 2 , (42) and Pr[TA(M I )≥ ζ ⋆ ]≤ exp − n(α D − α I ) 2 2 .(43) Both the verifier and the construction filter read a hard label, so the final quantity that matters is whether the sampled answer equalst. The target margin of Eq. 18 controls this directly in an idealized constrained decoder. Specifically, under temperature-Tsoftmax sampling nor- malized over only theKlegal labels inA(or conditional on generation producing a valid legal label), Pr[sample = t| p]≥ 1 1 + (K− 1)e −m M (p,t)/T . (44) Thus a large source marginm M 0 (p u ,t)strengthens target- label stability under this constrained-label idealization. Eq. 44 does not assert that an arbitrary raw-text API samples only from the legal labels; the actual API- facing guarantee remains empirical and is checked by the repeated-query stability filter of Sec. V. AppendixA-B16 gives the detailed qualification and margin–sampling argument. V. OUR METHOD As shown in Fig. 5, we propose Targeted Counterfactual Fingerprinting (TCF), a black-box LLM ownership verification method based on SCM. The owner constructs prompts that strongly change the protected source LLM’s answer from a clean answer to a selected target answer. During verification, the owner queries a suspect model through its generated text and parses the output into a finite constrained answer space. A model is considered likely derived if it preserves a high fraction of these source-specific target answer transitions. A. Target Selection As shown in Fig. 5(A1–A3), target selection starts from a finite-answer candidate question, obtains the source clean answer, and then chooses a clean-unlikely target. For each candidate questionx, we first evaluate the clean source prompt p 0 (x). The source clean answer is y(x) = arg max a∈A q M 0 (a| p 0 (x)).(45) The target answer should be different fromy(x)and should be unlikely under the clean source prompt. We therefore select targets from T (x) = a∈A\y(x) :−L M 0 (p 0 (x),a)≥ Γ min . (46) 8 A. Offline Fingerprint Construction on the Protected Source Model Step A1 Candidate question x with finite legal answer space Which planet is known as the Red Planet? A. Earth B. Mars C. Jupiter D. Venus Answer with only one capital letter. Finite legal answer space ABCD Step A2 Query the protected source model with the clean prompt p 0 (x) Clean prompt p 0 (x) Protected source model M 0 ABCD Clean answer y = B Step A3 Select a clean-unlikely target answer t ≠ y Target selection: choose t ∈ A \ y target answer is unlikely under the clean prompt Selected target answer t = D D Step A4 Use GCG to optimize a prefix u GCG prefix u Question x Protected source model M 0 ABCD Target answer t = D Source-specific counterfactual transition on M₀ B D Clean answer y = Target answer t = B. SCM Qualification and Private Fingerprint Set Step B1 Candidate fingerprint ( x , u , y , t ) question prefix clean answer target answer Step B2 Source-model counterfactual margin (SCM) SCM Gate Γ(x, u, t) = min L M0 (p u , t), −L M0 (p 0 , t) SCM-qualified if Γ(x, u, t) ≥ Γ min Before prefix p⁰(x) ABCD target answer t is unlikely After prefix pᵘ(x) ABCD target answer t is likely Step B3 Verification stability (optional) Repeated source queries retain fingerprints with stable target labels s b0 (x, u, t) ≥ s min Step B4 Private fingerprint set F Private set F F = (p i , y i , t i ) i=1 n • SCM-qualified fingerprint prompts • recorded clean answers and target answers • offline and private C. Online Black-Box Ownership Verification Step C1 Query the suspect model with fingerprint prompts Private set F Suspect model M s black-box API Raw text responses Step C2 Deterministic parsing to the legal answer space "I think the answer is D." "The correct option is D." "After analysis, it should be B." "I am not sure." deterministic parser StepC3 Fingerprint-wise verification indicator IDPrompt pᵢTarget tᵢParsed labelZᵢ(Mₛ) 1...D1 2...DB0 3...B1 4...C ⊥ 0 Step C4 Fingerprint target accuracy TA(M s ; F) = (1 / n) Σ i=1 n Z i (M s ) Example: 15 / 20 = 0.75 Step C5 Ownership verification decision Yes No Derived model from M₀ positive class e.g., SFT, LoRA, RLHF, pruning, quantization, compression Independent model negative class Independently trained or unrelated LLMs Legend Source-side / Offline Qualification / Private Online / Black-box Parsing & Evaluation Key Quantities Γ(x, u, t) : source-model counterfactual margin (SCM) TA(M s ; F) : fingerprint target accuracy Γ min : SCM threshold; ζ : verification threshold TCF Summary TCF verifies whether a suspect model preserves source-specific counterfactual transitions under a strict black-box, hard-label interface. Black-box Assumption Only final generated text is observed; no logits, probabilities, embeddings, gradients, or hidden states. B ⊥ D D TA(M s ; F) ≥ ζ ? A = A, B, C, D Z i (M s ) = I[Parse(r s (p i )) = t i ] A / B / C / D / ⊥ A. Offline Fingerprint Construction on the Protected Source Model Step A1 Candidate question x with finite legal answer space Which planet is known as the Red Planet? A. Earth B. Mars C. Jupiter D. Venus Answer with only one capital letter. Finite legal answer space ABCD Step A2 Query the protected source model with the clean prompt p 0 (x) Clean prompt p 0 (x) Protected source model M 0 ABCD Clean answer y = B Step A3 Select a clean-unlikely target answer t ≠ y Target selection: choose t ∈ A \ y target answer is unlikely under the clean prompt Selected target answer t = D D Step A4 Use GCG to optimize a prefix u GCG prefix u Question x Protected source model M 0 ABCD Target answer t = D Source-specific counterfactual transition on M₀ B D Clean answer y = Target answer t = B. SCM Qualification and Private Fingerprint Set Step B1 Candidate fingerprint ( x , u , y , t ) question prefix clean answer target answer Step B2 Source-model counterfactual margin (SCM) SCM Gate Γ(x, u, t) = min L M0 (p u , t), −L M0 (p 0 , t) SCM-qualified if Γ(x, u, t) ≥ Γ min Before prefix p⁰(x) ABCD target answer t is unlikely After prefix pᵘ(x) ABCD target answer t is likely Step B3 Verification stability (optional) Repeated source queries retain fingerprints with stable target labels s b0 (x, u, t) ≥ s min Step B4 Private fingerprint set F Private set F F = (p i , y i , t i ) i=1 n • SCM-qualified fingerprint prompts • recorded clean answers and target answers • offline and private C. Online Black-Box Ownership Verification Step C1 Query the suspect model with fingerprint prompts Private set F Suspect model M s black-box API Raw text responses Step C2 Deterministic parsing to the legal answer space "I think the answer is D." "The correct option is D." "After analysis, it should be B." "I am not sure." deterministic parser StepC3 Fingerprint-wise verification indicator IDPrompt pᵢTarget tᵢParsed labelZᵢ(Mₛ) 1...D1 2...DB0 3...B1 4...C ⊥ 0 Step C4 Fingerprint target accuracy TA(M s ; F) = (1 / n) Σ i=1 n Z i (M s ) Example: 15 / 20 = 0.75 Step C5 Ownership verification decision Yes No Derived model from M₀ positive class e.g., SFT, LoRA, RLHF, pruning, quantization, compression Independent model negative class Independently trained or unrelated LLMs Legend Source-side / Offline Qualification / Private Online / Black-box Parsing & Evaluation Key Quantities Γ(x, u, t) : source-model counterfactual margin (SCM) TA(M s ; F) : fingerprint target accuracy Γ min : SCM threshold; ζ : verification threshold TCF Summary TCF verifies whether a suspect model preserves source-specific counterfactual transitions under a strict black-box, hard-label interface. Black-box Assumption Only final generated text is observed; no logits, probabilities, embeddings, gradients, or hidden states. B ⊥ D D TA(M s ; F) ≥ ζ ? A = A, B, C, D Z i (M s ) = I[Parse(r s (p i )) = t i ] A / B / C / D / ⊥ Fig. 5. Overview of Targeted Counterfactual Fingerprinting (TCF). Panel A illustrates fingerprint generation on the protected source model, Panel B illustrates SCM qualification and fingerprint-set construction, and Panel C illustrates black-box ownership verification. IfT (x)is nonempty, we choose the unlikely valid target, t(x) = arg min a∈T (x) q M 0 (a| p 0 (x)).(47) IfT (x)is empty, the question is discarded because no target answer is sufficiently counterfactual on the source model. This target-selection rule controls the clean side of SCM before the perturbation is optimized. After this step, the remaining task is only to control the perturbed side, namely to makeL M 0 (p u (x),t) reach the construction target Γ target . B. Perturbation toward a Target Margin As shown in Fig. 5(A4), given a selected targett, we optimize a discrete input perturbation (prefix)u with GCG [8]. For exposition, we write the objective using the source constrained-answer probabilityq M 0 ; the differentiable source-side surrogate used during search and the parser-side acceptance check are detailed in AppendixA-B3. The objective is the target negative log- likelihood L src (u;x,t) =− logq M 0 (t| p u (x)).(48) By Lemma 1, the construction target gives an explicit stopping criterion. SinceL M 0 (p u (x),t) ≥ Γ target is equivalent toq M 0 (t| p u (x))≥ σ(Γ target ), it is sufficient to optimize until L src (u;x,t)≤ log 1 + e −Γ target ,(49) and then stop early. We setΓ target = Γ min , where the source-side SCM threshold is fixed before verification and is chosen only from source-side feasibility. We use early stopping to avoid unnecessary over-optimization and to retain the first source-qualified perturbation rather than blindly using the final GCG step. This choice is empirically supported by Fig. 4: as target loss decreases, SCM increases, but the strongest empirical SCM regime can also increase generic transfer to independent models. We therefore do not treat “larger SCM” as an unbounded optimization objective. In practice, Eq. 49 is the source- side stopping condition, and the retained candidate is accepted only after its parser-side SCM and source stability are recomputed. Prefix length. The prefix lengthℓ u controls the search space. A longer prefix usually improves the chance of satisfyingΓ(x,u,t)≥ Γ target but may reduce naturalness and increase optimization cost. Optimization budget. LetT max be the maximum num- ber of GCG iterations andBbe the number of candidate token replacements evaluated per iteration. Larger values improve success rate but increase construction cost. Verification stability. Because LLM outputs can vary across repeated queries under stochastic decoding, we optionally query the source modelM 0 forR 0 repeated trials with the selected prompt and compute 9 bs 0 (x,u,t) = 1 R 0 R 0 X r=1 I h Parse(R (r) M 0 (p u (x))) = t i . (50) A candidate is retained only if bs 0 (x,u,t)≥ s min .(51) We recommends min ∈ [0.8, 0.95]. This practical filter is motivated by the margin–sampling analysis of Sec.IV-H: under the constrained-label idealization, a larger source target margin favors target-label stability. The repeated- query filter then checks the actual counterfactual stability under the decoding setting used by the source interface. To reduce response-format variation at the suspect interface, we append a fixed answer instruction to the GCG-optimized prompt and restrict valid parsed outputs to the legal answer space. Thus, the verification prompt p i in Eq. 1 is p i = s i ⊕ q i ⊕ τ.(52) Here,s i = u ⋆ i is the selected GCG prefix,q i is the underlying multiple-choice question, andτdenotes the fixed answer instruction template that asksM s to output one capital letter from A,B,C,D: Question ... A. ... B. ... C. ... D... Answer with only one capital letter: A, B, C, or D. Answer: Algorithm 1 in AppendixA-Cgives the complete offline construction procedure. To maintain a practically effective fingerprint set, we additionally enforce diversity over questions, source clean answers, and target answers during selection. C. Online Black-Box Ownership Verification As shown in Fig. 5(C1–C5), after constructing the fingerprint set, the owner performs online black-box ownership verification for a suspect modelM s by using only black-box queries as described in Sec. I-B. Verification threshold selection.ζis a threshold chosen to control verification errors. Each verification process requiresnqueries toM s , followed by a single pass to compute TA. Since the fingerprint poolFis generated offline and can be reused, multiple independent verification instances can be performed by sampling different subsetsQ, enabling repeated verification while preserving query efficiency. Number of fingerprints. The number of fingerprintsn controls statistical reliability. A largernreduces variance but increases query cost. In the main evaluation, we use 20 fingerprints per protected source, matching the fixed registry described in Sec. VI and Appendix A-D1. VI. EXPERIMENTS We organize the experimental evaluation by the fol- lowing five questions. First, does target-answer transfer separate derived models from independent models? Sec- ond, how large is the gap between TCF and existing black-box LLM fingerprinting baselines? Third, is the signal stable under decoding changes and simple adaptive perturbations? Fourth, how robust is TCF to adaptive attack? Finally, what is the computational cost compared with the evaluated baselines? A. Experimental Setup Source models. We evaluate TCF on four representative open-source LLMs as protected source models: Qwen3- 1.7B Instruct [34], Qwen3-1.7B Base [34], Llama3-8B Base Direct [35], [36], and Mistral-7B-v0.3 [37]. The public checkpoint identifiers on Hugging Face are listed in Table I. TABLE I PROTECTED SOURCE MODELS AND SUSPECT-MODEL POOLS. SourceCheckpoint identifierTotalSourceDerivedIndependent Qwen3-1.7B Instruct Qwen/Qwen3-1.7B19199 Qwen3-1.7B Base Qwen/Qwen3-1.7B-Base221129 Llama3-8B Base Direct meta-llama/Meta-Llama-3-8B2511311 Mistral-7B-v0.3 mistralai/Mistral-7B-v0.3251168 Suspect model pool. For each protected source, we evaluate the source checkpoint, direct model positives, and independent negatives. Direct model positives cover supervised/task fine-tuning (SFT), RL-style adaptation (RL), language/domain adaptation, pruning, and other direct derivatives. Independent checkpoints are used only as independent negatives. Table I lists the fixed source/derived/independent model counts used for the main AUC in Table I. Appendix Tab. XI provides the extended checkpoint catalog, and AppendixA-E reports per-suspect diagnostics for checkpoints with the corresponding baseline artifacts. Fingerprint Generation.The fingerprint pool is built from Massive Multitask Language Understanding (MMLU) multiple-choice questions [38]. Each source model uses 20 fingerprints from four different subject categories, with five questions per category. The four- domain design prevents the fingerprint set from being tied to a single topic and improves fingerprint diversity. The details are in Appendix A-D. Baselines. We compare with three state-of-the-art black- box LLM fingerprinting baselines: TRAP [1], ProFLingo [2], and ZeroPrint [3]. Appendix Tab. X specifies the verification protocol and score definition for each method. B. Main Verification Results Table I reports the main verification AUC results. TCF achieves perfect AUC on Qwen3-1.7B Instruct, 10 0.0 0.2 0.4 0.6 0.8 1.0 Qwen3-Inst. TPR All family MethodAUC Ours1.00 ZPrint1.00 ProF0.94 TRAP0.95 Original TRAP 1.00 ProF 1.00 ZPrint 1.00 Ours 1.00 SFT/Task TRAP 0.92 ProF 0.98 ZPrint 1.00 Ours 1.00 RLHF/GRPO TRAP 1.00 ProF 1.00 ZPrint 1.00 Ours 1.00 Pretrain/Language TRAP 1.00 ProF 0.93 ZPrint 1.00 Ours 1.00 Pruning TRAP 1.00 ProF 0.93 ZPrint 1.00 Ours 1.00 Other family TRAP 1.00 ProF 0.93 ZPrint 1.00 Ours 1.00 0.0 0.2 0.4 0.6 0.8 1.0 Qwen3-Base TPR TRAP 0.89 ProF 0.93 ZPrint 0.98 Ours 1.00 TRAP 1.00 ProF 1.00 ZPrint 1.00 Ours 1.00 TRAP 1.00 ProF 1.00 ZPrint 0.98 Ours 1.00 TRAP 0.88 ProF 0.75 ZPrint 0.96 Ours 1.00 TRAP 0.67 ProF 1.00 ZPrint 1.00 Ours 1.00 TRAP 1.00 ProF 1.00 ZPrint 1.00 Ours 1.00 TRAP 1.00 ProF 1.00 ZPrint 1.00 Ours 1.00 0.0 0.2 0.4 0.6 0.8 1.0 Llama3-8B TPR TRAP 0.79 ProF 0.85 ZPrint 0.80 Ours 0.94 TRAP 1.00 ProF 1.00 ZPrint 1.00 Ours 1.00 TRAP 0.71 ProF 0.79 ZPrint 0.81 Ours 0.94 TRAP 1.00 ProF 1.00 ZPrint 1.00 Ours 1.00 TRAP 1.00 ProF 1.00 ZPrint 0.94 Ours 1.00 TRAP 1.00 ProF 0.97 ZPrint 0.62 Ours 0.89 TRAP 1.00 ProF 1.00 ZPrint 1.00 Ours 1.00 0.000.250.500.751.00 FPR 0.0 0.2 0.4 0.6 0.8 1.0 Mistral-7B TPR TRAP 0.56 ProF 0.89 ZPrint 0.90 Ours 1.00 0.000.250.500.751.00 FPR TRAP 1.00 ProF 1.00 ZPrint 1.00 Ours 1.00 0.000.250.500.751.00 FPR TRAP 0.60 ProF 0.82 ZPrint 0.90 Ours 1.00 0.000.250.500.751.00 FPR TRAP 0.75 ProF 1.00 ZPrint 1.00 Ours 1.00 0.000.250.500.751.00 FPR TRAP 0.67 ProF 1.00 ZPrint 1.00 Ours 1.00 0.000.250.500.751.00 FPR TRAP 0.67 ProF 1.00 ZPrint 0.92 Ours 1.00 0.000.250.500.751.00 FPR TRAP 0.67 ProF 0.97 ZPrint 0.83 Ours 1.00 Fig. 6. Diagnostic subgroup ROC curves on the shared per-suspect diagnostic pool. Primary family-level AUCs are reported in Table I. 0.0 0.2 0.4 0.6 0.8 1.0 Qwen3-Inst. Score All family 1.000.950.941.00 Original 1.001.001.001.00 SFT/Task 1.000.920.981.00 RLHF/GRPO 1.001.001.001.00 Pretrain/Language 1.001.000.931.00 Pruning 1.001.000.931.00 Other family 1.001.000.931.00 0.0 0.2 0.4 0.6 0.8 1.0 Qwen3-Base Score 1.000.890.930.951.001.001.001.001.001.001.000.951.000.880.750.961.000.671.000.941.001.001.001.001.001.001.001.00 0.0 0.2 0.4 0.6 0.8 1.0 Llama3-8B Score 0.940.790.850.791.001.001.001.000.940.710.790.801.001.001.001.001.001.001.000.940.891.000.970.621.001.001.001.00 OursTRAPProFZPrint 0.0 0.2 0.4 0.6 0.8 1.0 Mistral-7B Score 1.000.560.890.92 OursTRAPProFZPrint 1.001.001.001.00 OursTRAPProFZPrint 1.000.600.820.90 OursTRAPProFZPrint 1.000.751.001.00 OursTRAPProFZPrint 1.000.671.001.00 OursTRAPProFZPrint 1.000.671.001.00 OursTRAPProFZPrint 1.000.670.970.87 Positive poolIndependentNumbers above boxes are AUC Fig. 7. Fingerprint score distributions on the shared per-suspect diagnostic pool used for the subgroup diagnostics. Primary family-level AUCs are reported in Table I. Qwen3-1.7B Base, and Mistral-7B-v0.3, and reaches 0.9444 on Llama3-8B Base Direct. Its average verifica- tion AUC across the four sources is 0.9861, compared with 0.7931 for TRAP, 0.8880 for ProFLingo, and 0.9128 for ZeroPrint. The strongest baseline is model-dependent: ZeroPrint is the strongest baseline on both Qwen3 sources and on Mistral, whereas ProFLingo is strongest on Llama3. Overall, TCF matches the strongest baseline on Qwen3-1.7B Instruct and strictly exceeds the strongest baseline on the other three source families, supporting our key intuition: a constrained-answer targeted counter- factual transfer signal, realized via a source-optimized input perturbation, can act as a strong black-box proxy for LLM ownership verification. 11 TABLE I MAIN AUC COMPARISON. BEST RESULTS ARE BOLD. Source modelTCFTRAPProFLingoZeroPrint Qwen3-1.7B Instruct1.00000.92860.97961.0000 Qwen3-1.7B Base1.00000.88460.92310.9722 Llama3-8B Base Direct 0.94440.75930.82410.7885 Mistral-7B-v0.31.00000.60000.82500.8906 Average0.98610.79310.88800.9128 Takeaway TCF matches or exceeds the strongest evaluated baseline across the four source families while maintaining strong evidence across diverse derivative categories. Fingerprint score. For the per-suspect diagnostic pool with available artifacts, Table IV reports the fingerprint scores of source models, derived models, and independent models for TCF. Figure 6 shows the corresponding ROC curves over the source model, all available derivatives, and derivative subgroups, while Fig. 7 shows the score distributions. These diagnostic plots expose model-wise and subgroup heterogeneity; the primary family-level comparison remains Table I. TABLE IV MEAN TCF FINGERPRINT SCORE ON THE PER-SUSPECT DIAGNOSTIC POOL. THE SCORE IS THE TARGET-LABEL ACCURACY OVER GENERATED FINGERPRINTS. Source modelSource scoreDerived meanIndep. mean Qwen3-1.7B Instruct1.00000.68330.1000 Qwen3-1.7B Base0.90000.67310.3143 Llama3-8B Base Direct0.65000.45380.2889 Mistral-7B-v0.30.60000.42810.1583 Takeaway Within this diagnostic pool, derived models retain the source fingerprint more strongly than independent models, while Llama3 remains the most challenging source family. TABLE V COMMERCIAL BLACK-BOX API SOURCE-VS-INDEPENDENT VERIFICATION RESULTS ON OPENROUTER. MethodSource Qwen3-8B Gemma-3-12B Gemma-3-4B AUC Ours0.2940.0000.1180.0631.000 TRAP0.4500.0000.0000.0001.000 ProFLingo0.1000.1000.0000.0000.833 ZeroPrint0.4830.4900.5380.4760.333 Commercialblack-boxAPIevaluation.We further evaluate whether the fingerprints remain separable when model access is mediated by a mainstream commercial black-box API. We use OpenRouter [39] as the API provider and query meta-llama/llama-3-8b-instructasthe protected source model. Since OpenRouter does not provide the same controlled set of Llama-3 family derivatives used in our evaluation, this experiment focuses on the source-versus-independent API test. The independent API models areqwen/qwen3-8b[34], google/gemma-3-12b-it[40],and google/gemma-3-4b-it[40].ForTRAP, ProFLingo, and ZeroPrint, we use each baseline’s original black-box scoring setting. Although both TCF and TRAP achieve the best AUC in this commercial black-box API test, the results are not clearly equivalent: the API test obscures TRAP’s weak derivative model transfer, whereas our method retains stronger family-level evidence under controlled evaluation. Takeaway TCF remains separable through a commercial text- generation API using only parsed final responses, showing that suspect-side verification does not depend on white-box access. Model distillation. Model extraction is a strong threat for ownership verification because an adversary may train a surrogate from query-output pairs rather than directly reusing the source checkpoint [4]. We there- fore evaluate a clean-query distillation setting from mistralai/Mistral-7B-v0.3to aLlama-2-7B student [41]. The attacker queries the teacher only with clean MMLU-style multiple-choice prompts and trains the student with LoRA SFT on the teacher’s hard-label outputs. The reported extracted student is trained for three epochs on 2472 valid clean teacher-label pairs. For utility, we evaluate onMMLU-CF[42], using the same hard-label generation prompt, Answer with only one capital letter: A, B, C, or D., deterministic decoding, and at most eight new tokens. We parse each completion into A/B/C/D/INVALID. Clean100 Acc. is the parsed multiple-choice accuracy, and T-Agree is the parsed agreement with the teacher prediction; the teacher’s own T-Agree is defined as 1.00. As shown in Table VI, distillation improves the student’s Clean100 accuracy from 0.53 to 0.69 and T-Agree from 0.49 to 0.68, showing that the surrogate absorbs useful teacher behavior from clean queries. Although extraction attacks can erase fine-grained watermark evidence, our fingerprint remains effective on the distilled student: its AUC increases from 0.31 before distillation to 0.88 after distillation. In contrast, TRAP remains at tie-level AUC, ProFLingo does not retain a transferable signal, and ZeroPrint decreases after distillation. Thus, TCF retains an effective ownership signal under clean-query model distillation. Takeaway The fingerprint is inherited by a student trained only from clean teacher outputs, supporting ownership verification under model extraction. 12 TABLE VI MODEL DISTILLATION VERIFICATION RESULTS. ModelClean100 Acc. T-Agree Ours TRAP ProF ZPrint Mistral teacher0.791.001.001.001.001.00 Llama-2 untrained0.530.490.310.500.060.56 Llama-2 extracted0.690.680.880.500.000.25 C. Robustness Input abnormal detection. The original GCG prefix is effective but can contain unnatural token fragments, which can be exposed by PPL or window-PPL-based input- abnormality detection. We therefore evaluate naturalness- oriented presentation variants while keeping source- only construction and the hard-label verifier unchanged. NaturalCarrier wraps optimized fragments with short cue- like carrier phrases, while TCF-S4 and TCF-S8 distribute the optimized positions over four or eight insertion groups in the original question. The details and diagnostic-only variants are documented in Appendix A-D4. 12345 Qwen3 LM-PPL (log10) 0.8 0.9 1.0 AUC (a) Full-input PPL TCF-S4TCF-S8ZPrintTCFTRAPProF 12345 Qwen3 LM-PPL (log10) (b) Window-based PPL Fig. 8. Naturalness–verification trade-off. Full-input and window-based PPL show complementary views of prompt naturalization. We then compute and visualize full-input PPL and window-based PPL of the original centralized prefix TCF, and its variants with the above naturalness-oriented strategies, and the compared baselines. As shown in Fig. 8, among these strategies and the evaluated baselines, the strategy of splitting the centralized prefix into randomly selected token positions TCF-S4/8 yields the lowest PPL while maintaining the highest verification AUC compared with the strongest normal-text-based baseline, ZeroPrint. Takeaway Distributed NaturalCarrier variants improve prompt natural- ness while preserving strong verification performance. Adaptive attack.To assess whether a lightweight LoRA adapter can erase fingerprint behavior when partial fingerprint samples are leaked (50%by default in our implementation) while preserving clean-answer utility, we conduct a LoRA adaptive attack. The attacker freezes the base model and trains only a low-rank LoRA adapter on leaked fingerprint examples mixed with normal clean- answer data. For the condition labels, Rand denotes a random leaked subset, numbers in K1–K4 denote the number of leaked subjects, where U denotes an unbiased adaptive finetuning by mixing the leaked fingerprints and normal samples (questions and answers sampled Rand-U Rand-B K1-U K1-B K2-U K2-B K3-U K3-B K4-U K4-B leak target acc max 1.00 min 0.00 TCF max 1.00 min 0.00 TCF-S4 max 1.00 min 0.00 TCF-S8 Rand-U Rand-B K1-U K1-B K2-U K2-B K3-U K3-B K4-U K4-B unleak target acc max 1.00 min 0.50 max 1.00 min 0.70 max 1.00 min 0.80 012345678910 Rand-U Rand-B K1-U K1-B K2-U K2-B K3-U K3-B K4-U K4-B Detection AUC max 1.00 min 0.06 012345678910 max 1.00 min 0.78 012345678910 max 1.00 min 0.94 0.0 0.2 0.4 0.6 0.8 1.0 Score Fig. 9. Verification results under adaptive attack. Rows report leaked- fingerprint target accuracy, non-leaked target accuracy, and detection AUC. Columns correspond to fingerprinting methods. The horizontal axis indexes LoRA finetuning epochs, and the vertical axis indexes leakage conditions. Red and blue circles mark the maximum and minimum values in each panel, respectively. from MMLU) in a 1:1 ratio, and B denotes a biased 1:10 leaked-to-normal ratio. In each finetuning epoch, the constructed training batch is fed once to update the adapter. From the results in Fig. 9, we found that such an adaptive finetuning attack can strongly suppress the target fingerprint accuracy of the leaked fingerprints, leading to the leaked target accuracy gradually dropping to 0.00 under enough training epochs. However, this suppression does not reliably transfer to the unleaked fingerprints. For TCF, unleaked target accuracy remains nontrivial across the sweep. NaturalCarrier is more robust: TCF-S4 keeps unleaked target accuracy at least 0.70, and TCF-S8 keeps it at least 0.80. This indicates a clear split effect: increasing the number of NaturalCarrier splits makes the fingerprint more resistant to adaptive finetuning attack, because the attacker observes and erases only part of the distributed fingerprint signal. Overall, while adaptive attack by LoRA erasure can remove memorized leaked fingerprints, split-distributed fingerprints retain stronger private transfer evidence. Among the NaturalCarrier variants, TCF-S8 is more robust than TCF-S4 under adaptive LoRA training. Takeaway Partial-leakage LoRA erasure suppresses exposed finger- prints but does not reliably remove private distributed fingerprints. To explain why the split variants are more robust for the adaptive attack, we examine the hidden target margin, defined as the score gap between the recorded target label and the strongest non-target valid label. A positive margin means that the target remains the top- 13 0246810 LoRA update 0 2 4 Hidden target margin decision boundary (a) TCF TCF-S4 TCF-S8 TCFTCF-S4TCF-S8 0.0 0.5 1.0 1.5 Residual hidden margin (b) 0.1525 0.8483 0.7958 0.00.51.01.5 Residual hidden margin 0.0 0.2 0.4 0.6 0.8 1.0 Minimum Detection AUC (c) TCF TCF-S4 TCF-S8 ρ= 0.81 −10010203040 t-SNE 1 −15 −10 −5 0 5 10 t-SNE 2 (d) Prompt embedding t-SNE Clean TCF TCF-S4 TCF-S8 Fig. 10. Margin-boundary analysis of adaptive LoRA erasure: hidden margin trajectories (a), residual hidden margin distributions (b), residual hidden margin versus minimum Detection AUC (c), and prompt-embedding t-SNE visualization (d). Qwen3 1.7B 0.00 0.25 0.50 0.75 1.00 AUC (a) Original TRAP ProF ZPrint Ours 0.50.60.70.80.90.950.98 (b) Top-p Sampling 00.51.01.52.0 (c) Temperature Gemma2 2BOLMo2 1BQwen2 0.5B (d) Input Paraphrase Attack 0.050.100.15 (e) Score-space Attack 0.10.30.50.70.9 (f) Model-Merging Attack Fig. 11. Robustness under sampling, input paraphrasing, score-space perturbation, and model-merging. scoring valid label, while a non-positive margin indicates boundary crossing and effective erasure. Fig. 10 shows that LoRA erasure reduces hidden margins for all variants, but the unsplit Original variant is more likely to cross the boundary, with a higher hidden normalized erasure suffi- ciency (NES=1.3845), a higher boundary-crossing rate (0.3967), and a smaller residual hidden margin (0.1525). In contrast, the split variants TCF-S4 and TCF-S8 have much lower boundary-crossing rates (0.1767and0.1667) and retain larger residual margins (0.8483and0.7958). The boundary-crossing rate further correlates with hidden target-hit degradation (Spearmanρ = 0.8681), while the residual hidden margin correlates with the minimum Detection AUC (ρ = 0.8070). These results suggest that splitting improves robustness by preserving a larger hidden-margin buffer, making leaked-update erasure less likely to push hidden fingerprints across the hard-label decision boundary. In the prompt-embedding visualization of Fig. 10(d), TCF-S4 and TCF-S8 form multiple sub- clusters instead of one concentrated fingerprint cluster, a pattern consistent with higher fingerprint diversity after splitting. This observation is consistent with less complete coverage by leaked LoRA erasure and with the lower boundary-crossing rates of the split variants. Takeaway Split fingerprints resist erasure by preserving larger hidden target margins and more diverse prompt patterns. Decoding and sampling stability.To evaluate the robustness of different fingerprinting methods under vary- ing decoding configurations, we compared all methods using the same Qwen3-1.7B Base fingerprints while systematically altering verification-stage decoding param- eters (Fig. 11(b)–(c)). We observed that TCF maintains near-perfect AUC under all tested nucleus-sampling set- tings and remains above 0.91 across the entire temperature sweep. In contrast, the baseline methods either yield consistently lower AUC or exhibit a more pronounced degradation under several settings. This superior robust- ness can be attributed to the legal-answer space and the SCM-qualified target transfer, which preserve a larger derived-independent separation than TRAP, ProFLingo, and ZeroPrint even when decoding randomness changes. Takeaway TCF remains stable under common decoding changes, with high temperature as the main source of degradation. Input paraphrasing and score-space perturbation. To examine resilience to lightweight input rewriting and score-level noise, we compare TCF with the baselines in Fig. 11(d)–(e). Paraphrasing degrades all prompt-based signals, yet TCF consistently achieves the highest AUC across the three paraphrase models–Gemma 2 2B-IT [43], OLMo 2 1B-Instruct [44], and Qwen2 0.5B-Instruct [45]. This indicates that the target-transfer event survives moderate surface rewriting more robustly than response- reproduction or similarity-based scores. Panel (e) is a score-space stress test rather than a raw-text API transformation: clipped Gaussian noiseε ∼ N (0,σ 2 ) withσ ∈0.05, 0.10, 0.15is added in score space before AUC computation. TCF remains essentially robust while the baselines stay lower, indicating that the reported 14 separation is not fragile to moderate score-level noise. Takeaway TCF is more resilient than the baselines to moderate paraphrasing and score-space noise. Model merging. Fig. 11(f) evaluates a model-merging attack on Qwen3-1.7B, where the fingerprinted vic- tim checkpointQwen3-1.7B-Baseis linearly inter- polated with a non-fingerprinted reference checkpoint Qwen3-1.7B:θ merge = αθ victim + (1 − α)θ ref . We sweepαand re-run fingerprint verification. TRAP drops to chance-level AUC, while ProFLingo and ZeroPrint show unstable AUC across merge ratios. In contrast, TCF keeps AUC at1.0throughout the sweep, showing that its hard-label fingerprint signal remains stable under this linear merging attack. Takeaway TCF remains stable under the evaluated linear model- merging attack. D. Ablation Studies To investigate the impact of key hyperparameters on verification performance, we conducted ablation studies on three aspects: the number of fingerprintsn, the GCG prefix length (PL), and the target-answer rank. Fig. 12 summarizes the main results under the promoted hard- label setting. Number of fingerprintsn: To determine how many fingerprints are sufficient for stable verification, we variednfrom 5 to 20 in Fig. 12(a). We observed that performance improves rapidly fromn = 5ton = 10and then saturates in the Qwen3-1.7B Base setting, indicating that a modest fingerprint set is adequate. 1020 n 0.8 1.0 AUC Fingerprint count 2040 tokens Prefix length 123 rank Target rank Fig. 12. Ablation study results of fingerprint count (a), prefix length (b), and target answer selection (c). Takeaway A modest fingerprint set is sufficient for stable verification in the main setting. GCG prefix length (PL): To assess the effect of prefix length on separability, we tested different PL values in Fig. 12(b). We found that moderate prefixes are sufficient, while overly short or overly long prefixes can weaken the derived–independent separation. This is consistent with the feasible operating-region interpretation of SectionIV-G: overly weak perturbations may fail to create a source-side counterfactual transition, whereas overly strong perturbations can increase generic transfer to independent models. The empirical optimum therefore need not occur at the largest prefix length or largest SCM. Takeaway A moderate prefix length best balances target induction and independent-model non-transfer. Target-answer selection: To understand how the choice of target label influences verification, we per- formed a source-model diagnostic by varying the rank of the target answer in Fig. 12(c). Although Top-1, Top- 2, and Top-3 target choices all achieve AUC 1.0000 in this diagnostic, the independent mean varies. This suggests that target rank can affect false-positive behavior. Therefore, we use this target-rank panel to guide target selection rather than as a standalone full-model-pool ownership result. Takeaway Target selection should minimize accidental independent preference rather than optimize source success alone. E. Computational Cost To evaluate per-fingerprint generation, verification, and storage overhead, we conduct a comparative analysis on Qwen3-1.7B Base (Tab. VII). TRAP is the most expensive among the compared methods, requiring 8460.5 seconds per fingerprint under its official setting. ZeroPrint has fast source-side generation but incurs high verification cost because it extracts perturbation-based fingerprints from suspect models. ProFLingo is efficient during verification but uses a larger 50-query registry. In contrast, TCF requires 1269.3 seconds per fingerprint and uses a 20- query registry in the main evaluation, giving lower construction/verification overhead than the evaluated baselines while retaining the strongest verification per- formance. TABLE VII PER-FINGERPRINT COMPUTATION AND STORAGE COST ON QWEN3-1.7B BASE. MethodTotal timeGeneration timeVerify timeGeneration storageEval storage TCF1269.3s1200.6s68.7s1341.2 KiB75.2 KiB TRAP8460.5s7835.9s624.7s234.3 KiB290.3 KiB ProFLingo1625.0s1550.1s74.9s133.9 KiB0.2 KiB ZeroPrint1954.5s44.0s1910.5s48387.6 KiB47.6 KiB Takeaway TCF combines the strongest verification performance with lower per-fingerprint overhead and a compact 20-query registry. 15 VII. CONCLUSION We present TCF, a non-invasive fingerprinting frame- work for black-box LLM ownership verification. The key idea is to avoid open-ended generation by reformulating verification as constrained-answer target transfer. TCF constructs perturbed prompts that move the protected model from its clean answer to a counterfactual target, then verifies a suspect model by measuring target-answer transfer over the private fingerprint set. Theoretical analysis derives target-transfer bounds and a sufficient positive-gap condition under explicit derived-preservation and independent-transfer budgets motivated by local behavioral closeness; aggregation then converts a per- fingerprint edge into a thresholdable ownership signal. Empirically, TCF achieves near-perfect AUC across four source families and matches or outperforms the strongest evaluated black-box fingerprinting baseline on every source family. REFERENCES [1]M. Gubri, D. Ulmer, H. Lee, S. Yun, and S. J. Oh, “TRAP: Targeted random adversarial prompt honeypot for black-box identification,” in Findings of the Association for Computational Linguistics: ACL 2024, 2024, p. 11 496–11 517. [2]H. Jin, C. Zhang, S. Shi, W. Lou, and Y. T. Hou, “ProFLingo: A fingerprinting-based intellectual property protection scheme for large language models,” in 2024 IEEE Conference on Communications and Network Security (CNS).IEEE, 2024, p. 1–9. [3]S. Shao, Y. Li, H. Yao, Y. Chen, Y. Yang, and Z. Qin, “Reading between the lines: Towards reliable black-box LLM fingerprinting via zeroth-order gradient estimation,” in Proceedings of the ACM Web Conference 2026. ACM, 2026. [4]N. Carlini, D. Paleka, K. Dvijotham, T. Steinke, J. Hayase, A. F. Cooper, K. Lee, M. Jagielski, M. Nasr, A. Conmy et al., “Stealing part of a production language model,” in International Conference on Machine Learning, 2024, p. 5680–5705. [5]J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” in International Conference on Machine Learning. PMLR, 2023, p. 17 061–17 084. [6]S. Abdelnabi and M. Fritz, “Adversarial watermarking transformer: Towards tracing text provenance with data hiding,” in 2021 IEEE Symposium on Security and Privacy (SP).IEEE, 2021, p. 121–140. [7]Z. Hu, L. Chen, X. Wu, Y. Wu, H. Zhang, and H. Huang, “Unbiased watermark for large language models,” 2023. [8]A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” 2023. [9]P.-Y. Chen, H. Zhang, Y. Sharma, J. Yi, and C.-J. Hsieh, “ZOO: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 2017, p. 15–26. [10]Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in 27th USENIX Security Symposium (USENIX Security 18), 2018, p. 1615–1631. [11]Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” in Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval. ACM, 2017, p. 269–277. [12]J. Zhang, Z. Gu, J. Jang, H. Wu, M. P. Stoecklin, H. Huang, and I. Molloy, “Protecting intellectual property of deep neural networks with watermarking,” in Proceedings of the 2018 on Asia Conference on Computer and Communications Security.ACM, 2018, p. 159–172. [13]B. D. Rouhani, H. Chen, and F. Koushanfar, “DeepSigns: An end-to-end watermarking framework for ownership protection of deep neural networks,” in Proceedings of the Twenty-Fourth Inter- national Conference on Architectural Support for Programming Languages and Operating Systems. ACM, 2019, p. 485–497. [14]E. Le Merrer, P. Pérez, and G. Trédan, “Adversarial frontier stitching for remote neural network watermarking,” Neural Computing and Applications, vol. 32, no. 13, p. 9233–9244, 2019. [15]C. Gu, C. Huang, X. Zheng, K.-W. Chang, and C.-J. Hsieh, “Watermarking pre-trained language models with backdooring,” 2022. [16]P. Li, P. Cheng, F. Li, W. Du, H. Zhao, and G. Liu, “PLMmark: A secure and robust black-box watermarking framework for pre- trained language models,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 12, 2023, p. 14 991–14 999. [17]S. Li, L. Yao, J. Gao, L. Zhang, and Y. Li, “Double-i watermark: Protecting model copyright for llm fine-tuning,” 2024. [18] Y. Xu, A. Liu, X. Hu, L. Wen, and H. Xiong, “Mark your LLM: Detecting the misuse of open-source large language models via watermarking,” in The 1st Workshop on GenAI Watermarking, 2025. [Online]. Available: https: //openreview.net/forum?id=JGTRj6h0Cv [19]J. Xu, F. Wang, M. D. Ma, P. W. Koh, C. Xiao, and M. Chen, “Instructional fingerprinting of large language models,” in Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). Mexico City, Mexico: Association for Computational Linguistics, 2024, p. 3277–3306. [Online]. Available: https: //aclanthology.org/2024.naacl-long.180/ [20] Z. Xu, X. Zhao, X. Yue, S. Tian, C. Lin, and M. Han, “CTCC: A robust and stealthy fingerprinting framework for large language models via cross-turn contextual correlation backdoor,” in Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. Suzhou, China: Association for Computational Linguistics, 2025, p. 6967–6989. [Online]. Available: https://aclanthology.org/2025.emnlp-main.356/ [21] Z. Xu, M. Han, and W. Xing, “EverTracer: Hunting stolen large language models via stealthy and robust probabilistic fingerprint,” in Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. Suzhou, China: Association for Computational Linguistics, 2025, p. 7008–7031. [Online]. Available: https://aclanthology.org/2025.emnlp-main.358/ [22]N. Jovanovic, R. Staab, and M. Vechev, “Watermark stealing in large language models,” 2024. [23]S. Chakraborty, A. S. Bedi, S. Zhu, B. An, D. Manocha, and F. Huang, “On the possibilities of ai-generated text detection,” 2023. [24]V. S. Sadasivan, A. Kumar, S. Balasubramanian, W. Wang, and S. Feizi, “Can ai-generated text be reliably detected?” 2023. [25] X. Cao, J. Jia, and N. Z. Gong, “IPGuard: Protecting intellectual property of deep neural networks via fingerprinting the classifica- tion boundary,” in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security.ACM, 2021, p. 14–25. [26]J. Chen, J. Wang, T. Peng, Y. Sun, P. Cheng, S. Ji, X. Ma, B. Li, and D. Song, “Copy, right? a testing framework for copyright protection of deep learning models,” in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, p. 824–841. [27]N. Lukas, Y. Zhang, and F. Kerschbaum, “Deep neural network fin- gerprinting by conferrable adversarial examples,” in International Conference on Learning Representations, 2021. [28]Z. Peng, S. Li, G. Chen, C. Zhang, H. Zhu, and M. Xue, “Finger- printing deep neural networks globally via universal adversarial perturbations,” in Proceedings of the IEEE/CVF Conference on 16 Computer Vision and Pattern Recognition, 2022, p. 13 420– 13 429. [29]T. Xu, C. Wang, G. Liu, Y. Yang, K. Peng, and W. Liu, “United we stand, divided we fall: Fingerprinting deep neural networks via adversarial trajectories,” in Advances in Neural Information Processing Systems, 2024. [30]K. Yang and K. Lai, “NaturalFinger: Generating natural fingerprint with generative adversarial networks,” 2023. [31]A. Yan, H. Ren, K. Mo, Z. Zhang, S. Wang, and J. Li, “Enhancing model intellectual property protection with robustness fingerprint technology,” IEEE Transactions on Information Forensics and Security, vol. 20, p. 9235–9249, 2025. [32]B. Zeng, L. Wang, Y. Hu, Y. Xu, C. Zhou, X. Wang, Y. Yu, and Z. Lin, “HuRef: HUman-REadable fingerprint for large language models,” in Advances in Neural Information Processing Systems, vol. 37, 2024, p. 126 332–126 362. [33]J. Zhang, D. Liu, C. Qian, L. Zhang, Y. Liu, Y. Qiao, and J. Shao, “REEF: Representation encoding fingerprints for large language models,” in The Thirteenth International Conference on Learning Representations, 2025. [Online]. Available: https://openreview.net/forum?id=SnDmPkOJ0T [34]A. Yang, A. Li et al., “Qwen3 technical report,” arXiv preprint arXiv:2505.09388, 2025, qwen3 model family; Qwen3-1.7B Base: https://huggingface.co/Qwen/Qwen3-1.7B-Base; Qwen3- 1.7B Instruct: https://huggingface.co/Qwen/Qwen3-1.7B; Qwen3- 8B: https://huggingface.co/Qwen/Qwen3-8B. [Online]. Available: https://arxiv.org/abs/2505.09388 [35]AI@Meta, “Llama 3 model card,” 2024, llama3-8B Base Direct variant: https://huggingface.co/meta-llama/Meta-Llama-3- 8B. [Online]. Available: https://github.com/meta-llama/llama3/ blob/main/MODEL_CARD.md [36]A. Grattafiori, A. Dubey et al., “The llama 3 herd of models,” arXiv preprint arXiv:2407.21783, 2024. [Online]. Available: https://arxiv.org/abs/2407.21783 [37]Mistral AI, “Mistral-7b-v0.3,” may 2024, released on May 22, 2024, with 32,768 token vocabulary and v3 tokenizer support. [Online]. Available: https://huggingface.co/mistralai/ Mistral-7B-v0.3 [38]D. Hendrycks, C. Burns, S. Basart, A. Zou, M. Mazeika, D. Song, and J. Steinhardt, “Measuring massive multitask language understanding,” in International Conference on Learning Representations (ICLR), 2021. [Online]. Available: https://openreview.net/forum?id=YC60R30cKX [39]OpenRouter, “Openrouter api documentation,” https://openrouter. ai/docs/api/reference/overview, 2026, accessed: 2026-06-09. [40]Gemma Team, “Gemma 3 technical report,” 2025. [Online]. Available: https://arxiv.org/abs/2503.19786 [41]H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale et al., “Llama 2: Open foundation and fine-tuned chat models,” 2023. [42]Q. Zhao, Y. Huang, T. Lv, L. Cui, Q. Sun, S. Mao, X. Zhang, Y. Xin, Q. Yin, S. Li, and F. Wei, “MMLU- CF: A contamination-free multi-task language understanding benchmark,” in Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Vienna, Austria: Association for Computational Linguistics, Jul. 2025, p. 13 371–13 391. [Online]. Available: https://aclanthology.org/2025.acl-long.656/ [43]Gemma Team, M. Riviere, S. Pathak, P. G. Sessa et al., “Gemma 2: Improving open language models at a practical size,” arXiv preprint arXiv:2408.00118, 2024. [44]OLMo Team, P. Walsh, L. Soldaini, D. Groeneveld et al., “2 olmo 2 furious,” arXiv preprint arXiv:2501.00656, 2024. [45] A. Yang, B. Yang, B. Hui, B. Zheng et al., “Qwen2 technical report,” arXiv preprint arXiv:2407.10671, 2024. 17 APPENDIX A ADDITIONAL EXPERIMENTAL DETAILS Appendix roadmap This appendix is organized as a reproducibility record. It first validates the complete SCM evidence chain across additional source families, then provides the proofs and finite-sample details behind the theoretical claims, and finally documents the construction protocol, exact hard-label interface, prompt examples, baseline settings, model checkpoints, and retained evaluation artifacts. A. Cross-Model Theory Validation The main theoretical analysis is not specific to the Qwen3-1.7B Base diagnostic used for exposition. We therefore repeat the complete evidence chain on three additional protected source families: Qwen3 Instruct, Llama3, and Mistral. Across these families, source-side optimization increases SCM, derived models preserve the induced target preference more strongly than independent models, and the resulting derived–independent target-answer gap generally grows in higher-SCM regimes. These experiments directly test the portability of the theory rather than introducing a separate empirical claim. 1) Source-Side SCM Control: Figure 13 verifies that the source-side optimization behaves consistently across the three additional families. Target loss decreases during GCG optimization, mean SCM increases, and the two quantities remain strongly negatively associated. This supports the source-side implication used in Lemma 1 beyond the single diagnostic model shown in the main text. 050100150200 GCG step 10 −1 10 0 Mean target loss (a) Qwen3 Inst: target loss vs step L target Γ=1 Γ=2 Γ=3 050100150200 GCG step −7.5 −5.0 −2.5 0.0 2.5 Mean SCM (b) Qwen3 Inst: mean SCM vs step 0510 Target loss −10 0 10 SCM ρ= −0.47 (c) Qwen3 Inst: loss--SCM relation 050100150200 GCG step 10 −1 10 0 Mean target loss (d) Llama3: target loss vs step 050100150200 GCG step −2.0 −1.5 −1.0 −0.5 0.0 Mean SCM (e) Llama3: mean SCM vs step 0246 Target loss −6 −4 −2 0 2 SCM ρ= −1.00 (f) Llama3: loss--SCM relation 050100150200 GCG step 10 −1 10 0 Mean target loss (g) Mistral: target loss vs step 050100150200 GCG step −1 0 1 Mean SCM (h) Mistral: mean SCM vs step 01234 Target loss −4 −2 0 2 SCM ρ= −0.78 (i) Mistral: loss--SCM relation 0 100 200 GCG step 0 100 200 GCG step 0 100 200 GCG step Fig. 13. SCM-control diagnostics on three additional protected source families. Source target loss decreases during optimization, mean SCM increases, and lower target loss is associated with stronger SCM. Takeaway The source-loss-to-SCM relationship generalizes across the additional protected model families. 2) Derived-Model Preservation: Figure 14 evaluates the derived-model weakening budgetε D . For each source family, the empirical drift distribution and the corresponding lower-bound curves show that source-family derivatives retain a substantial part of the optimized target preference. Smaller weakening budgets and higher curves indicate stronger preservation. 18 01234 Δ + D 0.00 0.25 0.50 0.75 1.00 P (Δ + D ≤ ε D ) 50% 0.27 90% 2.88 95% 3.57 (a) Qwen3 Inst: preservation budget ECDF 012345 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Lower bound (b) Qwen3 Inst: derived lower bound 50% ε D = 0.27 90% ε D = 2.88 95% ε D = 3.57 0246810 Δ + D 0.00 0.25 0.50 0.75 1.00 P (Δ + D ≤ ε D ) 50% 0.05 90% 3.72 95% 4.86 (c) Llama3: preservation budget ECDF 012345 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Lower bound (d) Llama3: derived lower bound 50% ε D = 0.05 90% ε D = 3.72 95% ε D = 4.86 0.00.51.01.52.02.5 Δ + D 0.00 0.25 0.50 0.75 1.00 P (Δ + D ≤ ε D ) 50% 0.45 90% 1.82 95% 2.14 (e) Mistral: preservation budget ECDF 012345 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Lower bound (f) Mistral: derived lower bound 50% ε D = 0.45 90% ε D = 1.82 95% ε D = 2.14 Fig. 14. Derived-model preservation on the additional source families. Each row reports the empirical weakening-budget coverage and the corresponding lower-bound trend σ(Γ− ε D ). Takeaway Derived-model preservation remains consistent across the additional protected model families. 3) Independent-Model Non-Transfer: Figure 15 evaluates the independent-model slackε I . Independent models generally require larger slack budgets to explain the same target behavior, showing that the optimized prompts do not preserve the source-side target preference as consistently outside the protected model family. 19 0246 Δ + I 0.0 0.5 1.0 1.5 Density 50% 90% 95% (a) Qwen3 Inst: non-transfer slack 0246 ε I 0.00 0.25 0.50 0.75 1.00 P (Δ + I ≤ ε I ) 50% 1.15 90% 4.22 95% 5.07 (b) Qwen3 Inst: Eq.27 coverage 012345 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Upper bound (c) Qwen3 Inst: independent upper bound 50% ε I 90% ε I 95% ε I 012345 Δ + I 0 1 2 Density 50% 90% 95% (d) Llama3: non-transfer slack 012345 ε I 0.00 0.25 0.50 0.75 1.00 P (Δ + I ≤ ε I ) 50% 0.42 90% 3.75 95% 4.28 (e) Llama3: Eq.27 coverage 012345 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Upper bound (f) Llama3: independent upper bound 012345 Δ + I 0 1 2 Density 50% 90% 95% (g) Mistral: non-transfer slack 01234 ε I 0.00 0.25 0.50 0.75 1.00 P (Δ + I ≤ ε I ) 50% 0.02 90% 2.38 95% 3.08 (h) Mistral: Eq.27 coverage 012345 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Upper bound (i) Mistral: independent upper bound Fig. 15. Independent-model non-transfer on the additional source families. The panels report the slack distribution, empirical coverage Pr(∆ + I ≤ ε I ), and the corresponding upper-bound trend σ(−Γ + ε I ). Takeaway Independent models preserve the source-induced target behavior less consistently than source-family derivatives. 4) SCM-Induced Separability: Figure 16 closes the evidence chain. Across all three additional families, higher- SCM fingerprints generally produce a larger empirical target-answer gap between derivatives and independent models, while the budget-matched bounds show the same direction. The result supports the feasible-margin interpretation in the main text: SCM is a useful selection signal, but indefinite over-optimization is not required. 20 02468 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Target accuracy / gap positive gap: Γ > 3.55 (a) Qwen3 Inst: bound separation Derived LB Indep. UB Gap LB Q1 SCM=-7.23 Q2 SCM=-3.00 Q3 SCM=-0.47 Q4 SCM=3.44 Strict SCM quantile 0.00 0.25 0.50 0.75 1.00 Target accuracy (b) Qwen3 Inst: empirical separability Derived TA Independent TA Gap 01234 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Target accuracy / gap Γ Q4 = 3.44 p= 88.6%, P= 0.65 (c) Qwen3 Inst: Q4-matched bound Derived LB Indep. UB Gap LB 02468 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Target accuracy / gap positive gap: Γ > 3.74 (d) Llama3: bound separation Q1 SCM=-2.36 Q2 SCM=-1.16 Q3 SCM=-0.42 Q4 SCM=0.52 Strict SCM quantile 0.00 0.25 0.50 0.75 1.00 Target accuracy (e) Llama3: empirical separability 01234 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Target accuracy / gap Γ Q4 = 0.52 p= 56.0%, P= 0.56 (f) Llama3: Q4-matched bound 02468 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Target accuracy / gap positive gap: Γ > 2.10 (g) Mistral: bound separation Q1 SCM=-2.34 Q2 SCM=-1.11 Q3 SCM=-0.54 Q4 SCM=0.56 Strict SCM quantile 0.00 0.25 0.50 0.75 1.00 Target accuracy (h) Mistral: empirical separability 01234 SCM threshold Γ 0.00 0.25 0.50 0.75 1.00 Target accuracy / gap Γ Q4 = 0.56 p= 59.9%, P= 0.48 (i) Mistral: Q4-matched bound 0.0 0.2 0.4 Derived-independent gap 0.0 0.2 0.4 Derived-independent gap 0.0 0.2 0.4 Derived-independent gap Fig. 16. SCM-induced separability on the additional source families. The columns compare conservative bound separation, empirical target- accuracy trends across SCM buckets, and budget-matched bound trends. Takeaway The feasible-margin-band pattern repeats across the additional source families. B. Theory Details and Proofs This appendix provides proof details and concise explanations for the theoretical analysis in Section IV. 1) Finite Constrained-Answer Channel and SCM Feasibility: The probability in Eq. 4 is over the model’s external decoding randomness, server-side nondeterminism, and any randomness in the verifier’s repeated query protocol. For a deterministic service, this distribution degenerates to a point mass; for source-side offline analysis, it can be estimated either by repeated generation under the chosen decoding configuration or by a calibrated valid-label probability surrogate that is checked after optimization. Invalid responses are not assigned to any valid label. Thus, P a∈A q M (a | p) may be smaller than one. This is intentional: invalid responses are verification failures in our hard-label setting. Eq. 5 is well-defined wheneverq M (t | p) ∈ (0, 1). In implementation, we clip probabilities to[ε clip , 1− ε clip ] before taking log-odds. The proofs apply exactly to the unclipped channel whenq M (t | p) ∈ (0, 1), and to the clipped channel otherwise; clipping only prevents infinite log-odds and does not change the hard-label verification statistic. 2) SCM Scale and Feasibility: The threshold has a direct probability meaning:Γ min = 2corresponds to source perturbed target probability at least0.881and clean target probability at most0.119;Γ min = 3corresponds to approximately 0.953 and 0.047. The threshold is not a universal constant. For a fixed candidate pool C, define C Γ min =(x,u,t)∈C : Γ(x,u,t)≥ Γ min .(53) IfΓ (2) min > Γ (1) min , thenC Γ (2) min ⊆C Γ (1) min . IncreasingΓ min therefore strengthens individual fingerprints but can reduce the number and diversity of retained fingerprints. In the experiments,Γ min should be chosen or swept using only source-side feasibility and, when available, a separate validation pool; empirical SCM-quantile analyses are evidence for trends, not a substitute for reporting the retained SCM distribution and pass rate at the operating threshold. 3) Source-Side Surrogate Used During Perturbation Search: Eq. 14 is the ideal loss on the same parser-induced constrained-answer distribution used by verification. In practice, the perturbation is optimized through a differentiable source-side surrogate, e.g., the next-option-token probability after the answer prefix. Leteq M 0 (t| p)be this surrogate 21 probability and let e L M 0 (p,t) = log eq M 0 (t|p) 1−eq M 0 (t|p) . If the surrogate log-odds is calibrated to the parser distribution on retained candidates in the sense that L M 0 (p u (x),t)− e L M 0 (p u (x),t) ≤ δ surr ,(54) then the same argument as Lemma 1 applies with a safety margin: requiring the surrogate perturbed margin to exceed Γ min + δ surr suffices to guarantee parser-side perturbed margin at leastΓ min . Our offline construction therefore uses the optimizer as a search procedure but accepts fingerprints only after recomputing the SCM used in Eq. 8; the theoretical statements are about this accepted parser-side constrained-answer distribution, not about the surrogate alone. 4) Proof of Lemma 1: The clean side of the SCM is already guaranteed by Eq. 15. It remains to prove that the perturbed side is also at least Γ min . From Eq. 14, the loss condition in Eq. 16 gives − logq M 0 (t| p u (x))≤ log 1 + e −Γ min .(55) Multiplying Eq. 55 by −1 reverses the inequality: logq M 0 (t| p u (x))≥− log 1 + e −Γ min .(56) Applying the exponential function to Eq. 56 yields q M 0 (t| p u (x))≥ 1 1 + e −Γ min = σ(Γ min ).(57) Using Eq. 10, Eq. 57 is equivalent to L M 0 (p u (x),t)≥ Γ min .(58) Now Eq. 15 and Eq. 58 show that both terms in the minimum of Eq. 8 are at leastΓ min . Therefore, Eq. 17 follows. 5) Empirical Verification of SCM Control: To verify Lemma 1, we record the source target loss in Eq. 14 and mean SCM over fingerprints while optimizing the source-side perturbation on the source modelM 0 on Qwen3-1.7B Base [34]. As shown in Fig. 1(a), the target loss on source modelM 0 decreases along the optimization progress and approaches the loss thresholds induced by different SCM targets, while Fig. 1(b) shows that the mean SCM increases along the same optimization trajectory, indicating that reducing the target loss strengthens the source-side counterfactual transition. Fig. 1(c) directly shows the correlation coefficientρbetween target loss and SCM is close to−1.00, demonstrating a strong negative correlation: as the optimizer lowers the source target loss, SCM increases. This is consistent with Lemma 1, because reducing− logq M 0 (t| p u )increases the perturbed target log-odds while the clean-side term is fixed by target selection. Takeaway The surrogate loss guides optimization, while parser-side SCM remains the final acceptance criterion. 6) Interpretation of Local Behavioral Closeness: By construction, the source model makes the target unlikely on the clean prompt and likely on the perturbed prompt. Assumption IV.2 says that a derived model should remain close to the protected model on these clean and perturbed fingerprint prompts for most retained fingerprints. This premise is probabilistic: it only needs to hold for a large fraction of fingerprints, not for every single sample. The assumption motivates the transfer model, but it is not by itself the formal independent-model upper bound. Lemmas 2 and 3 make the required derived-preservation and independent generic-transfer budgets explicit. Accordingly, all formal separation statements in Theorem IV.3 and Lemma 4 are conditional on validε D andε I budgets; the empirical diagnostics test how realistic those budgets are for the evaluated model pools. The verifier then turns the resulting per-fingerprint edge into evidence by aggregating many diverse fingerprints. 7) Derived-Model Preservation Details: The derived-model diagnostic measures how much the perturbed target preference weakens when moving from the source model to its derivatives. Smaller weakening budgets indicate stronger preservation. In the paper appendix we keep this reading and the proof below. The cross-model ECDF evidence is reported in Appendix A-A. 8) Proof of Lemma 2: By the definition of SCM, L M 0 (p u (x),t)≥ Γ. Combining this with Eq. 22 gives L M D (p u (x),t)≥ Γ− ε D (M D ,x,u,t).(59) Applying the probability–logit relation in Eq. 10 and the monotonicity ofσ(·)proves Eq. 23. The statedΓ min version follows because Γ≥ Γ min . 22 9) Independent-Model Non-Transfer Details: The independent-model side of the analysis states that a prompt optimized onM 0 should not consistently preserve the same target preference on unrelated models. The diagnostic in the main text measures this effect through the independent-model slack: smaller slack means weaker accidental transfer, while larger slack gives a looser non-transfer guarantee. The corresponding cross-model diagnostics are reported in Appendix A-A. 10) Proof of Lemma 3: By the definition of SCM, −L M 0 (p 0 (x),t)≥ Γ, L M 0 (p 0 (x),t)≤−Γ.(60) Combining Eq. 60 with Eq. 28 gives L M I (p u (x),t)≤−Γ + ε I (M I ,x,u,t).(61) Applying Eq. 10 and the monotonicity of σ(·) proves Eq. 29. The stated Γ min version follows from Γ≥ Γ min . 11) Separability Details and Feasible Margin Band: For fixed transfer budgets, increasing SCM improves the derived–independent separation until the gain starts to saturate. In practice, pushing the perturbation too far can also increase generic transfer to independent models. Thus, the useful operating region is a feasible margin band: SCM should be large enough to survive derived-model drift, but the construction should not optimize the source margin indefinitely. The same trend is tested across three additional source families in Appendix A-A. 12) Proof of Theorem IV.3: For each fingerprint i, Lemma 2 gives q M D (t i | p u i (x i ))≥ σ(Γ i − ε D,i ).(62) Averaging over i = 1,...,n proves Eq. 34. Similarly, Lemma 3 gives q M I (t i | p u i (x i ))≤ σ(−Γ i + ε I,i ),(63) and averaging proves Eq. 35. Subtracting the upper bound from the lower bound gives Eq. 36. 13) Proof of Lemma 4: The expectation bounds follow from Theorem IV.3 and the monotonicity ofσ(·). The fixed-budget gap is positive exactly whenσ(Γ min − ε D ) > σ(−Γ min + ε I ), which is equivalent, by monotonicity of the sigmoid, to Γ min − ε D >−Γ min + ε I . Rearranging gives Eq. 38. No additionalηcorrection is introduced in this lemma: the theorem’s expected target-accuracy bounds are stated directly in terms of the explicit per-fingerprint budgets. Under the fixed-budget premises, E[TA(M D )]≥ σ(Γ min − ε D ),E[TA(M I )]≤ σ(−Γ min + ε I ),(64) and their difference is positive whenever2Γ min > ε D + ε I , exactly as stated in the main text. Aggregation then has a clear statistical role: once the two class-specific expectations are separated, averaging diverse fingerprint indicators reduces sampling variability, subject to the dependence qualification in Appendix A-B15. 14) Empirical SCM-Induced Separability Validation: Fig. 4 provides the empirical separability check for the fixed-budget gap analysis. The main observation is that higher-SCM fingerprints generally increase the derived– independent target-accuracy gap, while the strongest margins should not be over-optimized because generic transfer can also increase. Takeaway Useful separability emerges inside a feasible SCM region and can weaken under over-optimization. 15) Proof of Lemma 5: For the derived model,μ M D − ζ ⋆ ≥ (α D − α I )/2. Therefore the eventTA(M D ) < ζ ⋆ implies a lower-tail deviation of at least(α D − α I )/2from its mean. Hoeffding’s inequality for an average ofn independent Bernoulli variables gives Eq. 42. The independent-model case is the symmetric upper-tail deviation because ζ ⋆ − μ M I ≥ (α D − α I )/2. The independence condition is a statistical idealization. Fingerprints constructed from the same source model, prompt template, and dataset can be correlated. For deployment-grade audits, the concentration term should therefore be interpreted with an effective sample size after diversity filtering, or estimated by block/bootstrap resampling over question categories and target labels. The theoretical message is that reliability improves with both the expected gap α D − α I and the effective number of diverse fingerprints. 23 16) Margin–Sampling Robustness: Both the verifier and the construction filter read a hard label, so the final quantity that matters is whether the sampled answer equalst. The target margin of Eq. 18 controls this directly under an idealized constrained decoder. Under temperature-Tsoftmax sampling normalized over only theKlegal labels inA(or conditional on the response being a valid legal label), each competing label contributes at most e −m M (p,t)/T relative mass. Therefore, Pr[sample = t| p]≥ 1 1 + (K− 1)e −m M (p,t)/T .(65) Thus a large source marginm M 0 (p u ,t)strengthens target-label stability under the constrained-label idealization. This derivation does not assert that an arbitrary raw-text API samples only fromA; invalid or free-form generations remain possible in the actual threat model and are counted as failures. The deployment-facing stability claim is therefore checked empirically by the repeated-query source filter in Section V. The margin bound should be read as an explanatory connection between source-side margin and legal-label sampling, not as a replacement for that empirical filter. C. Implementation Details Algorithm 1 states the complete source-only construction procedure in executable form. It follows the main-text checkpoint rule: stop at the first source-side checkpoint satisfying Eq. 49, then recompute parser-side SCM and apply the source stability filter. No derived-model or independent-model statistic is used during construction. Algorithm 1 SCM-guided GCG fingerprint construction Require:Source modelM 0 ; question poolD; legal answer spaceA; desired registry sizen; SCM thresholdΓ min ; prefix length ℓ u ; GCG budget T max ; stability threshold s min . Ensure: Frozen fingerprint registry F . 1: C ←∅▷ qualified source-only candidates 2: for each question x∈D do 3:Render p 0 (x); estimate q M 0 (a| p 0 (x)) over a∈A. 4: y ← arg max a∈A q M 0 (a| p 0 (x)). 5: T (x)←a∈A\y :−L M 0 (p 0 (x),a)≥ Γ min . 6:if T (x) =∅ then 7:continue 8:end if 9: t← arg min a∈T (x) q M 0 (a| p 0 (x)). 10:Initialize a length-ℓ u perturbation u. 11:for j = 1 to T max do 12:Apply one GCG update to reduce L src (u;x,t) in Eq. 48. 13:if L src (u;x,t)≤ log(1 + e −Γ min ) then 14:break▷ first source-side margin-qualified checkpoint 15:end if 16:end for 17:Recompute parser-side Γ(x,u,t) using Eq. 8. 18:if Γ(x,u,t) < Γ min then 19:continue 20:end if 21:Estimate bs 0 (x,u,t) using Eq. 50. 22:if bs 0 (x,u,t) < s min then 23:continue 24:end if 25:Add (p u (x),y,t,u, Γ(x,u,t)) and construction metadata to C. 26: end for 27: Apply the source-only diversity filter over question IDs, categories, clean labels, and target labels. 28: Select up to n qualified candidates to form the frozen registry F . 29: return F D. Experimental Details 1) Main Method Setup: The main construction uses a fixed 20-query registry and a single source-only generation configuration. Tables VIII and IX summarize the query composition and generation parameters before the prompt/interface details. 24 TABLE VIII COMPOSITION OF THE 20-QUERY FINGERPRINT SET FOR EACH PROTECTED SOURCE MODEL. CategorySamplesRole Chemistry_val5Science/entity-level multiple-choice questions Engineering_dev 5Technical engineering and control questions Health_dev5Medical and health-domain questions Physics_val5Mathematical and physical-law questions TABLE IX MAIN TCF FINGERPRINT-GENERATION PARAMETERS. ParameterSettingParameterSetting DatasetMMLUFingerprints 20/source Categories4× 5 samplesGCG steps200 Batch size128Top-k64 Prefix length 20 tokensPlacementquestion prefix Interfacefinal generated A/B/C/D label only 2) Prompt and Interface Templates: For reproducibility, we record both the clean source query and the fingerprint query. The only difference is the source-optimized text inserted before or across the question body; the finite answer contract and parser remain unchanged. Clean/source query template The following are multiple choice questions (with answers) about category. question A. option A B. option B C. option C D. option D Answer with only one capital letter: A, B, C, or D. Answer: Fingerprint query template optimized prefix or distributed carrier fragments The following are multiple choice questions (with answers) about category. question with the retained insertion locations A. option A B. option B C. option C D. option D Answer with only one capital letter: A, B, C, or D. Answer: Parser and scoring contract A deterministic parser maps the final generated response to one label inA,B,C,Dor to⊥when the output is invalid or ambiguous. The online verifier never repairs⊥with semantic similarity or model confidence. Fingerprintiis a hit only when the parsed label equals its private recorded target t i , and the final target accuracy is the mean of these binary hits. SCM-guided construction protocol 1) Render the clean constrained-answer prompt and estimate the protected model’s valid-label distribution. 2) Record the clean answer y and choose a different target t that satisfies the clean-side SCM requirement. 3) Initialize a 20-token optimizable text block and place it at the designated prompt locations. 4) Run source-side GCG with the reported 200-step budget, candidate batch size 128, and top-k = 64 replacements. 5) Select the earliest validated checkpoint that reaches the source-side margin target rather than blindly keeping the last optimization step. 6) Recompute the accepted prompt’s parser-side SCM; reject candidates that fail the margin or validity requirements. 25 7)Check source-side response stability and retain only qualified, stable fingerprints until the 20-query registry is complete. 8)Store the final prompt, clean answer, target, optimized text, and SCM metadata. Online verification then queries only the suspect API and aggregates final-label target hits. 3) Baseline Setup: Table X lists the baseline configurations and score definitions used for comparison. TABLE X BASELINE CONFIGURATIONS AND SCORE DEFINITIONS. BASELINES ARE EVALUATED USING THEIR ORIGINAL METHOD DEFINITIONS. MethodMain settingScore definition TCF20 source-matched fingerprintsmean target-label hit rate TRAPstrict n = 20, 1500 steps, batch 512, top-k = 256original TRAP retrieval score ProFLingoofficial E = 256, p = 32, b = 8, n = 50 AE listfinal AE-list ASR ZeroPrintn samples = 2, n aug = 4, repeats 20source-row similarity/correlation 4) Naturalness-Oriented Variants: Raw GCG prefixes are effective for source-side target induction, but their contiguous optimized strings may contain unnatural token fragments. Such artifacts can be exposed by full-input PPL or local window-PPL abnormality detectors. We therefore keep the same source-only construction and the same hard-label verifier, while changing only how the optimized fingerprint text is presented in the prompt. NaturalCarrier (NC). NC reuses a prior-optimized GCG prefix and embeds its fragments in ordinary carrier phrases, such asnote this clue:,use this short hint:, andkeep this relation in mind:. This prevents the optimized text from appearing as one contiguous abnormal prefix while preserving the closed A/B/C/D answer contract used by the verifier. Split placement. TCF-S4 and TCF-S8 apply the same NaturalCarrier idea, but distribute the optimizable token positions over 4 or 8 randomly selected valid insertion sites in the original question prompt, respectively. By shortening each inserted segment and spreading it across natural prompt locations, these variants are intended to reduce local PPL spikes under window-based input-abnormality checks. For NaturalCarrier and both split variants, verification is unchanged: the online parser reads only the final generated A/B/C/D label and counts success when it matches the recorded target answer. 5) Representative Prompt-Naturalness Example: The following retained example shows how the same multiple- choice item is presented under the clean interface, the contiguous Raw-GCG construction, and the distributed NaturalCarrier variants. Long optimized strings are truncated only for page readability; the evaluation uses the complete stored prompts. Prompt P9: clean query The following are multiple choice questions (with answers) about Chemistry_val. Which type of mineral exhibits variations in color? A. Pseudochromatic B. Allochromatic C. Idiochromatic D. Iridescence Answer with only one capital letter: A, B, C, or D. Answer: Prompt P9: Raw GCG The following are multiple choice questions (with answers) about Chemistry_val. ).__interp Interior Haskell //~ Sv Soil MonterwebElementXpaths ESLonyms Sampler Member Name TypeSpecifier !IDOiotic Determine Which type of mineral exhibits variations in color? A. Pseudochromatic B. Allochromatic C. Idiochromatic D. Iridescence Answer with only one capital letter: A, B, C, or D. Answer: [remaining optimized text omitted from display] 26 Prompt P9: NaturalCarrier split4 (NC-S4) Which type of mineral exhibits variations in color? use this short hint: imgumber note this clue: Before-control A. Pseudochromatic keep this relation in mind: als under B. Allochromatic C. Idiochromatic D. Iridescence focus on this cue: A among pur Answer with only one capital letter: A, B, C, or D. Answer: Prompt P9: NaturalCarrier split8 (NC-S8) Which type of mineral exhibits variations in color? note this clue: pur read this note carefully: img keep this relation in mind: A use this short hint: Before-control keep this relation in mind: among keep this relation in mind: under A. Pseudochromatic focus on this cue: umber B. Allochromatic consider this context: als C. Idiochromatic D. Iridescence Answer with only one capital letter: A, B, C, or D. Answer: 6) Retained Evaluation Artifacts: Table I defines the fixed model counts used for the main AUC calculation. Table XI below provides an extended checkpoint catalog, and the per-suspect matrices report the available row-level diagnostics. Some baseline artifacts are unavailable for particular checkpoints, so these appendix matrices use only artifact-available rows and do not redefine the main model pool or the AUC values in Table I. 27 TABLE XI EXTENDED HUGGING FACE CHECKPOINT CATALOG ACROSS THE RETAINED EVALUATION ARTIFACTS. ROWS ARE GROUPED BY PROTECTED SOURCE AND DERIVATIVE CATEGORY; THE FIXED MODEL-POOL SIZES USED FOR THE PRIMARY AUC REMAIN THOSE IN TABLE I. Source poolCategoryHugging Face checkpoints Qwen3-1.7B Instruct Source Qwen/Qwen3-1.7B SFT activeDap/Qwen3-1.7B_tldr; contextboxai/Qwen3-1.7B-FC; prithivMLmods/Demeter-LongCoT-Qwen3-1.7B; UnfilteredAI/DAN-Qwen3-1.7B Pref./RL wzx111/Qwen3-1.7B-Open-R1-GRPO-Baseline Domain prithivMLmods/Panacea-MegaScience-Qwen3-1.7B; swapnillo/Bangla-AI-1.7B; vimalgupta/qwen3-1.7b-telecom-vocab-v2 Pruning/Merging MilyaShams/Qwen3-1.7B-Wanda_1_4 Qwen3-1.7B BaseSource Qwen/Qwen3-1.7B-Base SFT ali-elganzory/Qwen3-1.7B-Base-SFT-Tulu3-decontaminated; ffang2025/Affine-fang-v2; jekunz/Qwen3-1.7B-Base-is-SmolTalk; lllyx/Qwen3-1.7B-SFT Pref./RL Kazuki1450/Qwen3-1.7B-Base_dsum_3_6_fnr_no_bracket_0p0_0p0_1p0_grpo_42_rule; miulab/Qwen3-1.7B-Usefulness; raca-workspace-v1/grpo-tool-sat-sft-qwen3-1p7b-sft-20260419-075623-96e9; zsqzz/Qwen3-1.7B_opsd_masked_grpo_dapo_hf Domain indicnode/Qwen3-1.7B; NiuTrans/LMT-60-1.7B-Base; Polygl0t/Tucano2-qwen-1.5B-Base; VLSP2025-LegalSML/qwen3-1.7b-legal-pretrain Pruning/Merging Qwen3-1.7B-Base-LightMagnitudePruned-s005 Llama3-8B Base Direct Source meta-llama/Meta-Llama-3-8B SFT allenai/llama-3-tulu-2-8b; dphn/dolphin-2.9.1-llama-3-8b; Groq/Llama-3-Groq-8B-Tool-Use; Magpie-Align/Llama-3-8B-Magpie-Align-SFT-v0.3; openchat/openchat-3.6-8b-20240522 Pref./RL dfurman/Llama-3-8B-Orpo-v0.1 Domain aaditya/Llama3-OpenBioLLM-8B; DeepMount00/Llama-3-8b-Ita; hfl/llama-3-chinese-8b; winninghealth/WiNGPT2-Llama-3-8B-Chat Pruning/Merging RedHatAI/SparseLlama-3-8B-pruned_50.2of4; mlabonne/Llama-3-SLERP-8B; Weyaxi/Einstein-v6.1-Llama3-8B Mistral-7B-v0.3Source mistralai/Mistral-7B-v0.3 SFT amdevraj/mistral-7b-ift; cypienai/cymist-2-v03-SFT; migtissera/Tess-3-7B-SFT Pref./RL lamm-mit/mistral-7B-v0.3-Base-CPT-SFT-DPO-09022024; llmat/Mistral-v0.3-7B-ORPO Domain BEE-spoke-data/Mistral-7B-v0.3-stepbasin-books-20k; entfane/math-virtuoso-7B; klcsp/mistral7b-fft-coding-11-v1; openfoodfacts/spellcheck-mistral-7b; pszemraj/Mistral-7B-v0.3-sarcasm-scrolls-4k; pucpr-br/Clinical-BR-Mistral-7B-v0.2; silversword/US-Immigration-Law-Mistral-7B-v0.3-CPT Pruning/Merging ai-and-society/mistral-7B-Instruct-v0.3-wanda-wanda-unstruct-50; IntelLabs/sqft-mistral-7b-v0.3-50-base; mlfoundations-dev/hp_ablations_grid_mistral_base-mistralv0.3; mlfoundations-dev/mistral_7b_0-3_oh-dcft-v3.1-llama-3.1-405b All evaluated sources Independent negatives 01-ai/Yi-6B; EleutherAI/llemma_7b; Qwen/Qwen2.5-7B; THUDM/chatglm3-6b-base; allenai/tulu-2-dpo-7b; lmsys/vicuna-13b-v1.3; lmsys/vicuna-7b-v1.3; lmsys/vicuna-7b-v1.5; meta-llama/Llama-2-13b-chat-hf; meta-llama/Llama-2-7b-chat-hf; meta-llama/Llama-2-7b-hf; meta-llama/Meta-Llama-3-8B; microsoft/Phi-3-small-8k-instruct; mistralai/Mistral-7B-v0.3; tiiuae/falcon-7b E. Full Per-Suspect Verification Results In addition to the family-level aggregates, we report the available model-wise verification matrices for inspection. The fixed model counts and family-level AUCs are defined in Tables I and I. Because some baseline artifacts are unavailable for particular checkpoints, the row-wise AUCs below are computed against the artifact-available independent rows for each table and should be interpreted as diagnostics rather than substitutes for the main family-level AUC. How to read the model-wise tables Rows shaded light green are the protected source model or source-family derivatives, and rows shaded light blue are artifact-available independent checkpoints. Each method reports its native fingerprint score and a row-wise diagnostic AUC against the available independent rows in that table. These row-wise diagnostics expose heterogeneity; they do not redefine the main evaluation pool or Table I. A dash means that a row-level AUC is not defined for an independent row or that the baseline artifact is unavailable under the official pipeline. TABLE XII ROWS WHERE TCF IS NOT THE HIGHEST ROW-WISE AUC. THESE ARE THE ONLY EXCEPTIONS AMONG THE SOURCE/FAMILY-POSITIVE ROWS IN THE PER-SUSPECT MATRICES BELOW. Source familyDerivativeTestAccTCFTRAPProFZPrintInterpretation Llama3-8B Base Direct DeepMount00/Llama-3-8b-Ita0.660 0.4440.333 0.8890.750 Italian/domain SFT increases overlap with independent hard-label scores. Llama3-8B Base Direct RedHatAI/SparseLlama-3-8B-pruned-50.2of40.650 0.7781.000 0.9440.312 Structured pruning weakens some target-answer preferences while retaining task utility. 28 Takeaway The model-wise results show that TCF’s family-level advantage is distributed across heterogeneous derivatives rather than being driven by a small number of source-like checkpoints. TABLE XIII PER-SUSPECT COMPARISON USING QWEN3-1.7B INSTRUCT AS THE PROTECTED SOURCE MODEL. FAMILY-DERIVED SUSPECTS ARE SHOWN IN THE UPPER BLOCK AND INDEPENDENT SUSPECTS IN THE LOWER BLOCK. SCORE DENOTES EACH METHOD’S NATIVE FINGERPRINT SCORE; AUC DENOTES ROW-WISE FAMILY-VERSUS-INDEPENDENT SEPARABILITY. CategorySuspect Model (Hugging Face ID)TruthTCFTRAPProFLingoZeroPrint ScoreAUCScoreAUCScoreAUCScoreAUC SourceQwen/Qwen3- 1.7BPositive1.0001.0000.9201.0000.2001.0000.5601.000 SFT / task FTactiveDap/Qwen3- 1.7B_tldrPositive0.5501.0000.0000.5000.2201.0000.6501.000 SFT / task FTcontextboxai/Qwen3- 1.7B- FCPositive1.0001.0000.6101.0000.1801.0000.8901.000 SFT / task FTprithivMLmods/Demeter- LongCoT- Qwen3- 1.7BPositive0.9001.0000.1101.0000.2401.0000.7801.000 SFT / task FTUnfilteredAI/DAN- Qwen3- 1.7BPositive0.4001.0000.0101.0000.1200.8570.5701.000 Preference / RLwzx111/Qwen3- 1.7B- Open- R1- GRPO- BaselinePositive1.0001.0000.3501.0000.2001.0000.4601.000 Language / Do- main prithivMLmods/Panacea- MegaScience- Qwen3- 1.7BPositive0.8501.0000.0201.0000.1400.8570.7501.000 Language / Do- main swapnillo/Bangla- AI- 1.7BPositive0.7001.0000.0301.0000.2001.0000.5101.000 Language / Do- main vimalgupta/qwen3- 1.7b- telecom- vocab- v2Positive0.3501.0000.0101.0000.1000.8570.5601.000 PruningMilyaShams/Qwen3- 1.7B- Wanda_1_4Positive0.4001.0000.0101.0000.1000.8570.5801.000 Independent01- ai/Yi- 6BNegative0.250–0.000–0.040–0.100– IndependentEleutherAI/llemma_7bNegative0.200–0.000–0.040–0.160– IndependentQwen/Qwen2.5- 7BNegative0.000–0.000–0.020–0.060– Independentmeta- llama/Meta- Llama- 3- 8BNegative0.100–0.000–0.000–0.180– Independentmicrosoft/Phi- 3- small- 8k- instructNegative0.000–0.000–0.160–0.190– Independentmistralai/Mistral- 7B- v0.3Negative0.050–0.000–0.040–0.130– IndependentTHUDM/chatglm3- 6b- baseNegative0.100–0.000–0.020– 29 TABLE XIV PER-SUSPECT COMPARISON USING QWEN3-1.7B BASE AS THE PROTECTED SOURCE MODEL. CategorySuspect Model (Hugging Face ID)TruthTCFTRAPProFLingoZeroPrint ScoreAUCScoreAUCScoreAUCScoreAUC SourceQwen/Qwen3- 1.7B- BasePositive0.9001.0001.0001.0000.4801.0000.6201.000 SFT / task FTali-elganzory/Qwen3- 1. 7B- Base- SFT- Tulu3- decontaminated Positive0.9001.0000.5501.0000.4201.0000.4901.000 SFT / task FTffang2025/Affine- fang- v2Positive0.4001.0000.1001.0000.1601.0000.2500.750 SFT / task FTjekunz/Qwen3- 1.7B- Base- is- SmolTalkPositive0.8001.0000.4501.0000.4001.0000.6201.000 SFT / task FTlllyx/Qwen3- 1.7B- SFTPositive0.7501.0000.3701.0000.3001.0000.3701.000 Preference / RLKazuki1450/Qwen3-1.7B-Base_dsum_3_6_fnr_no_ bracket_0p0_0p0_1p0_grpo_42_rule Positive0.8501.0001.0001.0000.3801.0000.7201.000 Preference / RLmiulab/Qwen3- 1.7B- UsefulnessPositive0.8501.0000.2201.0000.2401.0000.3200.833 Preference / RLraca-workspace-v1/grpo-tool-sat-sft- qwen3-1p7b-sft-20260419-075623-96e9 Positive0.5501.0000.0000.5000.0000.0710.3401.000 Preference / RLzsqzz/Qwen3- 1.7B_opsd_masked_grpo_dapo_hfPositive0.4001.0000.0901.0000.1000.9290.2500.750 Language / Do- main indicnode/Qwen3- 1.7BPositive0.4001.0000.1001.0000.1601.0000.3401.000 Language / Do- main NiuTrans/LMT- 60- 1.7B- BasePositive0.5501.0000.0000.5000.1601.0000.3501.000 Language / Do- main Polygl0t/Tucano2- qwen- 1.5B- BasePositive0.4001.0000.0000.5000.1201.0000.2900.833 Language / Do- main VLSP2025- LegalSML/qwen3- 1.7b- legal- pretrainPositive0.9001.0000.8501.0000.5001.0000.6201.000 PruningQwen3- 1.7B- Base- LightMagnitudePruned- s005Positive1.0001.0001.0001.0000.4001.0000.8401.000 Independent01- ai/Yi- 6BNegative0.350–0.000–0.060–0.160– IndependentEleutherAI/llemma_7bNegative0.300–0.000–0.060–0.190– IndependentQwen/Qwen2.5- 7BNegative0.300–0.000–0.000–0.150– Independentmeta- llama/Meta- Llama- 3- 8BNegative0.300–0.000–0.040–0.250– Independentmicrosoft/Phi- 3- small- 8k- instructNegative0.300–0.000–0.100–0.330– Independentmistralai/Mistral- 7B- v0.3Negative0.300–0.000–0.040–0.220– IndependentTHUDM/chatglm3- 6b- baseNegative0.350–0.000–0.080– TABLE XV PER-SUSPECT COMPARISON USING LLAMA3-8B BASE DIRECT AS THE PROTECTED SOURCE MODEL. CategorySuspect Model (Hugging Face ID)TruthTCFTRAPProFLingoZeroPrint ScoreAUCScoreAUCScoreAUCScoreAUC Sourcemeta- llama/Meta- Llama- 3- 8BPositive0.6501.0000.9901.0000.5201.000– SFT / task FTallenai/llama- 3- tulu- 2- 8bPositive0.4001.0000.5000.8890.0600.4440.2800.875 SFT / task FTdphn/dolphin- 2.9.1- llama- 3- 8bPositive0.4501.0001.0001.0000.1400.8890.1400.375 SFT / task FTGroq/Llama- 3- Groq- 8B- Tool- UsePositive0.5501.0000.0900.3330.1400.8890.1800.562 SFT / task FTMagpie- Align/Llama- 3- 8B- Magpie- Align- SFT- v0.3Positive0.4501.0000.6401.0000.2201.0000.4601.000 SFT / task FTopenchat/openchat- 3.6- 8b- 20240522Positive0.4501.0000.2000.4440.1600.9440.3901.000 Preference / RLdfurman/Llama- 3- 8B- Orpo- v0.1Positive0.6501.0000.7201.0000.3401.0000.4301.000 Language / Do- main aaditya/Llama3- OpenBioLLM- 8BPositive0.4001.0000.5400.8890.1801.0000.2400.750 Language / Do- main DeepMount00/Llama- 3- 8b- ItaPositive0.3000.4440.1000.3330.1400.8890.2400.750 Language / Do- main hfl/llama- 3- chinese- 8bPositive0.5501.0000.7001.0000.2601.0000.3000.875 Language / Do- main winninghealth/WiNGPT2- Llama- 3- 8B- ChatPositive0.4001.0000.1500.3330.0200.0560.2400.750 PruningRedHatAI/SparseLlama- 3- 8B- pruned_50.2of4Positive0.3500.7780.8901.0000.1600.9440.1300.312 Mergingmlabonne/Llama- 3- SLERP- 8BPositive0.4001.0000.7501.0000.3801.0000.4601.000 MergingWeyaxi/Einstein- v6.1- Llama3- 8BPositive0.5501.0000.4300.8890.1200.8330.2900.875 Independent01- ai/Yi- 6BNegative0.150–0.330–0.120–0.180– IndependentEleutherAI/llemma_7bNegative0.350–0.200–0.060–0.170– IndependentQwen/Qwen2.5- 7BNegative0.200–0.250–0.060–0.130– Independentallenai/tulu- 2- dpo- 7bNegative0.350–0.000–0.080–0.210– Independentlmsys/vicuna- 13b- v1.3Negative0.350–0.560–0.020–0.000– Independentlmsys/vicuna- 7b- v1.5Negative0.300–0.000–0.160–0.270– Independentmeta- llama/Llama- 2- 13b- chat- hfNegative0.250–0.000–0.040–0.020– Independentmistralai/Mistral- 7B- v0.3Negative0.350–0.200–0.060–0.330– IndependentTHUDM/chatglm3- 6b- baseNegative0.300–0.250–0.060– 30 TABLE XVI PER-SUSPECT COMPARISON USING MISTRAL-7B-V0.3 AS THE PROTECTED SOURCE MODEL. CategorySuspect Model (Hugging Face ID)TruthTCFTRAPProFLingoZeroPrint ScoreAUCScoreAUCScoreAUCScoreAUC Sourcemistralai/Mistral- 7B- v0.3Positive0.6001.0000.2501.0000.6601.0000.5701.000 SFT / task FTamdevraj/mistral- 7b- iftPositive0.6001.0000.0000.5000.2201.0000.3101.000 SFT / task FTcypienai/cymist- 2- v03- SFTPositive0.4001.0000.0000.5000.2601.0000.3101.000 SFT / task FTmigtissera/Tess- 3- 7B- SFTPositive0.4501.0000.0000.5000.2001.0000.3201.000 Preference / RLlamm-mit/mistral-7B- v0. 3- Base- CPT- SFT- DPO- 09022024 Positive0.3001.0000.0000.5000.1601.0000.3201.000 Preference / RLllmat/Mistral- v0.3- 7B- ORPOPositive0.3501.0000.0000.5000.2001.0000.4701.000 Language / Do- main BEE-spoke- data/Mistral-7B-v0. 3- stepbasin- books- 20k Positive0.6001.0000.1701.0000.5001.0000.5801.000 Language / Do- main entfane/math- virtuoso- 7BPositive0.4501.0000.0000.5000.1801.0000.2700.800 Language / Do- main klcsp/mistral7b- fft- coding- 11- v1Positive0.3501.0000.0000.5000.0000.0000.1700.200 Language / Do- main openfoodfacts/spellcheck- mistral- 7bPositive0.5501.0000.0000.5000.3801.0000.5901.000 Language / Do- main pszemraj/Mistral- 7B- v0.3- sarcasm- scrolls- 4kPositive0.4501.0000.0000.5000.1201.0000.3901.000 Language / Do- main pucpr- br/Clinical- BR- Mistral- 7B- v0.2Positive0.2501.0000.0000.5000.0600.2500.3501.000 Language / Do- main silversword/US- Immigration-Law- Mistral- 7B-v0. 3- CPT Positive0.5501.0000.0000.5000.4401.0000.5701.000 Pruningai-and- society/mistral- 7B-Instruct-v0. 3- wanda- wanda- unstruct- 50 Positive0.3501.0000.0000.5000.4001.0000.3000.900 PruningIntelLabs/sqft- mistral- 7b- v0.3- 50- basePositive0.4001.0000.0000.5000.1401.0000.3601.000 Mergingmlfoundations-dev/hp_ablations_grid_mistral_ base- mistralv0.3 Positive0.3501.0000.0000.5000.1000.9170.2600.800 Mergingmlfoundations-dev/mistral_7b_0-3_oh-dcft-v3. 1- llama- 3.1- 405b Positive0.4501.0000.0000.5000.4001.0000.2700.800 Independent01- ai/Yi- 6BNegative0.150–0.000–0.060–0.250– IndependentEleutherAI/llemma_7bNegative0.200–0.000–0.080–0.230– IndependentQwen/Qwen2.5- 7BNegative0.200–0.000–0.060–0.120– Independentmeta- llama/Meta- Llama- 3- 8BNegative0.100–0.000–0.080–0.300– Independentmicrosoft/Phi- 3- small- 8k- instructNegative0.100–0.000–0.100–0.190– IndependentTHUDM/chatglm3- 6b- baseNegative0.200–0.000–0.060– Compatibility note ChatGLM is included as an independent negative for TCF, TRAP, and ProFLingo whenever a valid hard-label artifact is available. Its ZeroPrint entry remains “–” because the official/repository-aligned ZeroPrint pipeline encountered a third-party remote-code compatibility issue for ChatGLM in the evaluated software environment; this missing artifact is excluded only from the ZeroPrint AUC calculation. F. Extended Construction and Verification Record Artifact repository Project available at: https://github.com/Underflow-1/TCF-LLM-Fingerprinting The main paper presents the minimal method definition needed to understand TCF. This section records the complete source-only construction path, the retained fingerprint fields, and the online hard-label decision rule so that every reported result can be reconstructed from explicit intermediate artifacts. 1) Offline Construction Workflow: Tables XVII and XVIII summarize the complete offline pipeline and the frozen registry fields passed to the online verifier. 31 TABLE XVII END-TO-END SOURCE-ONLY FINGERPRINT CONSTRUCTION WORKFLOW. StageInputOperation and retained evidence Question preparation Clean multiple-choice itemRender the fixed answer-only interface and preserve the original question identifier, category, options, and gold answer. Clean source query Protected model M 0 Record the clean parsed answer and the valid-label distribution used only for offline target selection. Target selection Clean label distributionChoose a non-clean target satisfying the clean-side SCM requirement and reject questions with no feasible target. Perturbation search Source model and targetOptimize the text perturbation with GCG and save the source loss, valid-label probabilities, and SCM trajectory at every checkpoint. Early stopping /checkpoint retention Source loss and SCMRetain the first checkpoint satisfying the main-text source-side stopping condition, then recompute parser-side SCM and source stability. QualificationRetained checkpoint Recompute parser-side SCM, source validity, response stability, and prompt- format checks; reject candidates that fail any condition. Diversity filter- ing Qualified candidates Balance categories, clean labels, target labels, and question identities before forming the final registry. Registry export Final fingerprint setStore the exact prompt, private target, clean answer, perturbation text, SCM metadata, and parser contract required by online verification. TABLE XVIII RECOMMENDED FINGERPRINT-REGISTRY FIELDS. PRIVATE FIELDS ARE NEVER SENT TO THE SUSPECT SERVICE. FieldVisibilityPurpose Fingerprint IDInternalStable key linking construction, query, parser, and result artifacts. Source modelInternalProtected checkpoint from which the fingerprint was constructed. Question ID / categoryInternalSupports category-balanced sampling and reproducibility. Clean promptInternalRecords the pre-perturbation source behavior and clean answer. Fingerprint promptQueriedExact prompt sent to the suspect API. Clean answerInternalSource label before the counterfactual perturbation. Target answerPrivateOwnership target used by the hard-label verifier. Optimized textPrivateContiguous prefix or distributed NaturalCarrier fragments. Checkpoint / SCMInternalSupports construction audits and early-stopping reconstruction. Parser versionInternalPins the deterministic response-to-label contract. Raw responseAudit logRaw suspect response retained before parsing. Parsed label / hitAudit logFinal legal label and target-hit indicator used for aggregation. 2) Online Hard-Label Verification Workflow: Online verification procedure 1) Load the frozen fingerprint registry and pre-registered decision threshold. 2) Send each stored fingerprint prompt to the suspect service using the declared decoding configuration. 3) Save the raw response before any parsing or normalization. 4) Apply the deterministic parser and return one label in A,B,C,D or ⊥ for invalid or ambiguous output. 5) Count a hit only when the parsed label equals the private target recorded for that fingerprint. 6) Average the binary hits to obtain target accuracy and compare it with the pre-registered threshold. 7) Export the prompt identifier, raw response, parsed label, and decision trace as the verification audit record. 32 Algorithm 2 Hard-label ownership verification Require: Frozen fingerprint registry F ; suspect black-box service M s ; deterministic parser Parse; pre-registered threshold ζ. Ensure: Ownership decision and audit trace. 1: S ← 0 2: for each fingerprint record (p i ,t i )∈F do 3:Query M s with p i and save raw response r i . 4:ˆa i ← Parse(r i )∈A∪⊥. 5:if ˆa i = t i then 6:S ← S + 1 7:end if 8:Save (i,r i , ˆa i , I[ˆa i = t i ]) to the audit trace. 9: end for 10: TA(M s ;F )← S/|F|. 11: if TA(M s ;F )≥ ζ then 12:return DERIVED, audit trace 13: else 14:return INDEPENDENT, audit trace 15: end if The online phase never accesses suspect logits, hidden states, token probabilities, gradients, embeddings, or semantic-similarity models. Invalid outputs remain failures rather than being repaired by a secondary model. This strict contract keeps the reported score auditable at the final-response interface. Takeaway Online verification reduces ownership evidence to deterministic final-label target hits under a frozen parser and threshold. 3) Reproducibility Checklist: Table XIX records the minimum configuration and audit artifacts needed to rebuild the reported evaluation without changing the verifier contract. TABLE XIX REPRODUCIBILITY CHECKLIST FOR REBUILDING A TCF EVALUATION. ItemRequired record Model identityExact source, derivative, and independent checkpoint identifiers plus revisions when available. Question poolDataset version, split, category list, question identifiers, and decontamination policy. Prompt interfaceExact clean and fingerprint templates, answer-only instruction, insertion positions, and parser version. ConstructionRandom seed, prefix length, optimization steps, candidate batch size, top-k, checkpoint schedule, and SCM acceptance rule. Verification Decoding parameters, query repetitions, invalid-output policy, target-hit aggregation, and threshold provenance. BaselinesOriginal protocol, query budget, official score definition, implementation source, and any compatibility patch. StatisticsPositive/negative taxonomy, AUC tie handling, subgroup definitions, and any pooled-score normalization. ArtifactsRaw responses, parsed outputs, per-suspect scores, plot-data tables, and the script used to produce each figure. G. Expanded Baseline Documentation The baselines are evaluated under their own score definitions rather than being forced into TCF’s target-hit score. The following examples make the interface difference explicit and complement the compact configuration table in Appendix A-D3. 1) Representative TRAP Artifact: TRAP retrieval artifact Task: produce a short target string under the official TRAP retrieval protocol. Optimized suffix: lista ( print-phaseko@(?/Topic/TabControlighborhood ... [truncated] Target response: 6532 Generated response: 6532 33 Official score contribution: successful target retrieval. TRAP verifies whether its optimized suffix retrieves the designated target output. Its score is therefore a retrieval statistic and is not converted into TCF’s multiple-choice target-hit rate. 2) Representative ProFLingo Artifact: ProFLingo adversarial-example record Question: Where does the sun rise? Target keyword: north Generated answer: The sun rises in the east. Official score contribution: unsuccessful target-keyword retrieval. ProFLingo evaluates a list of adversarial examples and reports the corresponding attack-success statistic. The original list length and official target-keyword rule are retained in our comparison. 3) Representative ZeroPrint Artifact: ZeroPrint source-row similarity artifact Source row: Qwen3-1.7B-Base-ZP Source similarity: 1.000 Derivative similarities: stored continuous source-row values Independent similarities: stored continuous source-row values Official score contribution: source-row similarity/correlation. ZeroPrint produces a continuous similarity profile rather than a prompt-to-target hard-label event. We therefore preserve its source-row score and compute AUC directly from that profile. Takeaway The comparison preserves each baseline’s original evidence channel and score definition. H. Expanded Naturalness Documentation 1) Naturalness Metrics: No single metric fully characterizes prompt naturalness. We therefore separate local trigger abnormality, whole-prompt fluency, repetition, and embedding-space diagnostics. TABLE X NATURALNESS AND PROMPT-QUALITY DIAGNOSTICS USED IN THE EXTENDED ANALYSIS. MetricTextual objectInterpretation Full-input PPLComplete rendered queryMeasures global fluency after inserting all fingerprint text. Window-PPLLocal windows around inser- tions Detects short abnormal regions that can be hidden by a long fluent prompt. Fragment PPLInserted prefix or fragment onlyIsolates the lexical abnormality of the fingerprint text itself. Abnormal-token ratioInserted textCounts tokenizer fragments that violate the readable-token con- straints. Repetition scoreInserted textDetects repeated words, substrings, or token cycles. Semantic-drift proxy Candidate versus readable seedMeasures how far a naturalized candidate moves from its seed instruction. Prompt embeddingFull prompt or prompt residual Provides a qualitative view of proximity to benign multiple-choice prompts. Verification AUCSuspect-model scoreEnsures that improved fluency is not obtained by discarding ownership evidence. 2) Naturalization Variant Taxonomy: All variants use source-only construction. Derived and independent models are queried only after the candidate prompt has been frozen, preventing evaluation leakage into fingerprint generation. 34 TABLE XXI NATURALNESS-ORIENTED CONSTRUCTION VARIANTS AND THEIR ISOLATED DESIGN QUESTIONS. VariantConstruction ruleQuestion isolated by the variant Raw GCGKeep the optimized contiguous trigger. Reference verification strength before naturalization. SemBound-GCGRestrict candidate semantic drift from a readable seed. Can explicit semantic constraints preserve target induction? SourceRerank-GCGRetain source-effective candi- dates, then rerank by natural- ness. Does source-first selection avoid sacrificing verification strength? PPLRerank-GCG Add a prefix-fluency proxy to candidate selection. Can local fluency be optimized directly during GCG search? Position-Fragment-GCGSplit an effective trigger across prompt slots without carriers. Is distribution alone sufficient to reduce local abnormality? NaturalCarrier Wrap distributed fragments with short cue-like phrases. Can carriers improve readability while preserving the trigger information? TCF-S4 / TCF-S8Use four or eight distributed insertion groups. How does split granularity affect naturalness and erasure robust- ness? SlotPrefix-GF Search only over natural slot templates. Can fully natural gradient-free prompts replace token-level triggers? EvoPrefix-GFMutate a population of natural instructions. Is population-based natural-language search sufficient? 3) Prompt-Embedding Diagnostics: The embedding model is used only for visualization and never participates in fingerprint construction or verification. We report both seed stability and distance-to-reference views because a single t-SNE projection can be sensitive to initialization. Fig. 17. Seed-stability diagnostic for the prompt-embedding visualization. Repeated projections test whether the qualitative arrangement is robust to visualization randomness. Fig. 18. Embedding-distance diagnostic for naturalized prompt variants. The external embedding model is used only for offline interpretation. 35 Takeaway The embedding diagnostics are interpretive rather than monotonic: some natural-language search/reranking variants move closer to the clean-prompt residual centroid, whereas the split NaturalCarrier variants retain a larger structured embedding shift. Their naturalness advantage is therefore supported primarily by the PPL diagnostics in the main text, while verification remains strictly hard-label. I. Additional Distillation Diagnostics The main text reports the final clean-query extraction result. To show how the ownership signal develops during student training, we additionally expose a checkpoint sweep from a smaller clean-query distillation run. The student never observes the private fingerprint prompts. TABLE XXII CHECKPOINT SWEEP FOR CLEAN-QUERY DISTILLATION FROM MISTRAL-7B-V0.3 TO LLAMA-2-7B. CLEAN100 IS CLEAN MULTIPLE-CHOICE ACCURACY, T-AGREE IS TEACHER AGREEMENT, AND THE FINGERPRINT ROWS REPORT STUDENT-VERSUS-INDEPENDENT AUC. MetricS0S1S2S3S4S5S6S7S8S9S10 Clean1000.66 0.65 0.69 0.75 0.73 0.77 0.73 0.71 0.71 0.72 0.72 T-Agree0.68 0.64 0.67 0.73 0.73 0.75 0.73 0.73 0.71 0.72 0.72 TCF0.31 0.56 0.75 0.56 0.75 0.88 0.81 0.88 0.88 0.88 0.88 TRAP0.50 0.50 0.50 0.50 0.50 0.50 0.50 0.50 0.50 0.50 0.50 ProFLingo 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.06 0.00 0.00 0.00 ZeroPrint0.61 0.22 0.22 0.11 0.11 0.00 0.11 0.11 0.11 0.11 0.11 The trajectory shows that TCF evidence appears as the student absorbs more of the teacher’s clean behavior, even though the extraction data contains no private fingerprint prompts. This distinguishes inherited source behavior from direct memorization of the fingerprint registry. Takeaway The ownership signal strengthens as the extracted student learns the teacher’s clean behavior. J. Artifact Map and Expected Outputs Public reproduction versus deployment privacy The registry released with this paper is a reproducibility artifact for reconstructing the reported experiments. It must not be reused as a secret registry in a real ownership audit. The threat model in Sec. I requires deployment fingerprints and their targets to remain unknown to the suspect before verification, so a deployment-grade audit should generate a fresh private registry and keep its targets secret until the audit is complete. Minimum audit bundle. A third party should be able to reconstruct every reported point from four immutable records: the frozen fingerprint registry, the raw suspect responses, the deterministic parser outputs, and the positive/negative model taxonomy. Plotting scripts should consume these records without querying any model again. 36 TABLE XXIII LOGICAL ARTIFACT MAP FOR REPRODUCING THE REPORTED EXPERIMENTS. DIRECTORY NAMES MAY BE ADAPTED LOCALLY, BUT THE LISTED RECORDS SHOULD REMAIN IMMUTABLE. Artifact groupExpected contents configs/Source-model identifiers, generation parameters, decoding settings, thresholds, and random seeds. fingerprints/Clean prompts, paper-reproduction fingerprint prompts, recorded targets, SCM trajectories, qualification records, and registry manifests; deployment targets must remain private. model_pool/Positive/negative taxonomy, checkpoint revisions, derivation categories, and compatibility notes. responses/Raw suspect outputs before parsing, grouped by source family, method, and robustness condition. scores/Parsed labels, target-hit vectors, per-suspect scores, AUC inputs, and subgroup summaries. baselines/ Original baseline configurations, generated artifacts, official score fields, and any compatibility patch. plots/Figure-ready CSV/JSON files and deterministic scripts for every paper figure. logs/Construction, verification, extraction, robustness, and environment logs required for audit. paper/LaTeX source, bibliography, figure assets, and the arXiv build script. 37