Fingerprint Vector: Enabling Scalable and Efficient Model Fingerprint Transfer via Vector Addition

TL;DR

This paper introduces the Fingerprint Vector, a scalable method for transferring model fingerprints via vector addition, reducing computational costs and maintaining effectiveness across diverse models and downstream tasks.

Contribution

The paper proposes a novel fingerprint transfer mechanism using vector addition, overcoming limitations of inheritance-based methods and enabling efficient, post hoc fingerprinting of downstream models.

Findings

Achieves comparable or better fingerprinting performance than direct injection.

Maintains effectiveness across various architectures and downstream variants.

Preserves robustness and harmlessness in most cases.

Abstract

Backdoor-based fingerprinting has emerged as an effective technique for tracing the ownership of large language models. However, in real-world deployment scenarios, developers often instantiate multiple downstream models from a shared base model, and applying fingerprinting to each variant individually incurs prohibitive computational overhead. While inheritance-based approaches -- where fingerprints are embedded into the base model and expected to persist through fine-tuning -- appear attractive, they suffer from three key limitations: late-stage fingerprinting, fingerprint instability, and interference with downstream adaptation. To address these challenges, we propose a novel mechanism called the Fingerprint Vector. Our method first embeds a fingerprint into the base model via backdoor-based fine-tuning, then extracts a task-specific parameter delta as a fingerprint vector by computing the difference between the fingerprinted and clean models. This vector can be directly added to any structurally compatible downstream model, allowing the fingerprint to be transferred post hoc without additional fine-tuning. Extensive experiments show that Fingerprint Vector achieves comparable or superior performance to direct injection across key desiderata. It maintains strong effectiveness across diverse model architectures as well as mainstream downstream variants within the same family. It also preserves harmlessness and robustness in most cases. Even when slight robustness degradation is observed, the impact remains within acceptable bounds and is outweighed by the scalability benefits of our approach.