One token is enough: fingerprinting LLMs from one token output distributions
a day ago
- Researchers propose a new method to fingerprint and verify LLMs using single-token output distributions from simple prompts.
- The technique requires only trivial one-word prompts across four languages, costing one output token per query, making it efficient.
- Behavioral fingerprints show high model-specificity, with samples from the same model being much closer than those from different models.
- Jensen-Shannon divergence between fingerprints can identify model lineage with 59.5% accuracy, far above the chance rate of 18.4%.
- A biometric-style verification protocol achieves low error rates, requiring roughly 100 single-token queries per audit.
- The study reveals anomalies in commercial LLM endpoints, such as a proprietary-branded model being indistinguishable from an open-weight Qwen model.
- The protocol, prompts, raw data, and analysis code are publicly released for reproduction and operational use.