FPEdit: Robust LLM Fingerprinting through Localized Parameter Editing

TL;DR

FPEdit introduces a novel, resource-efficient method for embedding robust, natural language fingerprints into large language models through targeted weight modifications, ensuring model integrity and resistance to detection.

Contribution

The paper presents FPEdit, a new framework that uses knowledge editing to embed natural language fingerprints into LLMs with high robustness and minimal resource use, overcoming limitations of previous methods.

Findings

Achieves 95-100% fingerprint retention under various fine-tuning methods.

Maintains model performance on downstream tasks.

Embeds 10 fingerprint pairs into LLaMA2-7B in under 2 minutes with less than 30 GB GPU memory.

Abstract

Large language models represent significant investments in computation, data, and engineering expertise, making them extraordinarily valuable intellectual assets. Nevertheless, these AI assets remain vulnerable to unauthorized redistribution and commercial exploitation through fine-tuning or black-box deployment. Current fingerprinting approaches face a fundamental trade-off: intrinsic methods require full parameter access, while backdoor-based techniques employ statistically anomalous triggers easily detected and filtered by adversaries. To address these limitations, we introduce FPEdit, a novel framework that leverages knowledge editing to inject semantically coherent natural language fingerprints through sparse, targeted modifications to model weights. Our approach introduces Promote-Suppress Value Vector Optimization, which simultaneously enhances target token likelihood while suppressing competing tokens, ensuring robust fingerprint integration without degrading core model functionality. Extensive experiments show that FPEdit achieves 95-100% fingerprint retention under both full-parameter fine-tuning and parameter-efficient adaptation, while preserving performance on downstream benchmarks. Moreover, FPEdit remains robust under quantization, pruning, and stochastic decoding, and can embed 10 fingerprint pairs into LLaMA2-7B in under 2 minutes using less than 30 GB of GPU memory, which represents a substantial reduction in resource requirements. These advances establish FPEdit as the first fingerprinting approach to simultaneously achieve robustness against adaptation, resistance to detection, and preservation of model utility, thereby providing a minimally invasive solution for reliable provenance verification of large language models in adversarial deployment scenarios.