Elamur Research⌕
☰
home / papers / 2026 / ImF: Embedding an Implicit Fingerprint in Your Large Language Models

ImF: Embedding an Implicit Fingerprint in Your Large Language Models

Paper · 2026 · Jiaxuan Wu, Wanli Peng, Hang fu et al.

Summary

The paper addresses black-box ownership verification for LLMs, where a model owner can only query a suspect model through an API or UI. Existing injected fingerprints, such as Instructional Fingerprinting (IF) and Chain & Hash (C&H), pair secret prompts with forced outputs or explicit markers that do not follow from the prompt's meaning. This makes them conspicuous and easy to remove. To show this weakness, the authors introduce Generation Revision Intervention (GRI), a novel attack for erasing fingerprints that inserts system-prompt instructions to rewrite and normalize answers. GRI strongly degrades the representative baselines.

Their alternative, Implicit Fingerprints (ImF), works in two steps:

  • It hides an ownership message inside a fluent target response using key-based linguistic steganography.
  • It builds a matching query enriched with CoT-style reasoning cues that steer the model toward that response.

Candidate pairs are refined against non-fingerprinted reference models to rule out false positives. Verification decodes the hidden message from the suspect model's outputs. Across 15 LLMs, ImF stays verifiable after fine-tuning, model merging and GRI, rarely triggers by accident, and costs little utility. This makes it a practical tool for protecting model IP.

Key points

  • GRI attack: GRI is a new prompt-level removal attack that steers outputs toward standard answers and breaks marker-based fingerprints such as IF and C&H.
  • False triggering: In the False Trigger Rate test (100 everyday QA inputs plus 100 near-miss inputs), ImF reached 0% in both settings, while the existing methods showed some false triggering.
  • Refinement and selection: Without iterative refinement, ImF's fingerprint success rate is 95.63% (clean) and 94.38% (under GRI). With refinement, both reach 100%.
  • Role of CoT cues: Removing the CoT cues from queries sharply reduces robustness under GRI, especially for small models such as LLaMA3.2-1B and Gemma-2-2B.
  • Utility cost: Averaged over six backbones, utility drops only modestly. With SFT injection, MMLU falls from 59.07% to 55.87% and Arc(c) from 47.97% to 46.43%. The main limitation is a one-time offline cost for screening fingerprint pairs.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓China Agricultural UniversityBeijing · China4 works · 17 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksComputer Vision and Pattern Recognition · 3,486 worksHardware and Architecture · 167 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,894 works

Cite

Cite as Jiaxuan Wu, Wanli Peng, Hang fu, Xue Yiming and Juan Wen. 2026. ImF: Embedding an Implicit Fingerprint in Your Large Language Models. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1183

@inproceedings{wu2026imf,
  title = {{ImF: Embedding an Implicit Fingerprint in Your Large Language Models}},
  author = {Jiaxuan Wu, Wanli Peng, Hang fu, Xue Yiming and Juan Wen},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1183},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1183}
}

References

42 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. AI@Meta. 2024. Llama 3 model card. find
  2. Ross J Anderson and Fabien AP Petitcolas. 1998. On the limits of steganography. IEEE Journal on selected areas in communications, 16(4):474–481. find
  3. Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. 2018. Think you have solved question answering? try arc, the ai2 reasoning challenge. arXiv preprint arXiv:1803.05457.
  4. Tianshuo Cong, Xinlei He, and Yang Zhang. 2022. Sslguard: A watermarking scheme for self-supervised learning pre-trained encoders. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 579–593. find
  5. Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. 2007. Digital watermarking and steganography. Morgan kaufmann. find
  6. Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. 2019. Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks. In Proceedings of the twenty-fourth international conference on architectural support for programming languages and operating systems, pag… find
  7. Jinyang Ding, Kejiang Chen, Yaofei Wang, Na Zhao, Weiming Zhang, and Nenghai Yu. 2023. Discop: Provably secure steganography in practice based on “distribution copies”. In 2023 IEEE Symposium on Security and Privacy (SP), pages 2238–2255. IEEE Computer Society. find
  8. Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Alain Le Noac’h, Haonan Li, Kyle McDonell, Niklas Muennighoff, Chris Ociepa, Jason Phang, Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Lintang Sutawika, and 5 others.… find
  9. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2020. Measuring massive multitask language understanding. arXiv preprint arXiv:2009.03300.
  10. Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, and 1 others. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825. find
  11. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. In Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pages 17061–17084. PMLR.
  12. Gregory Kang Ruey Lau, Xinyuan Niu, Hieu Dao, Jiangwei Chen, Chuan-Sheng Foo, and Bryan Kian Hsiang Low. 2024. Waterfall: Scalable framework for robust text watermarking and provenance for LLMs. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 20432–20… find
  13. Siheng Li, Cheng Yang, Taiqiang Wu, Chufan Shi, Yuji Zhang, Xinyu Zhu, Zesen Cheng, Deng Cai, Mo Yu, Lemao Liu, and 1 others. 2024. A survey on the honesty of large language models. arXiv preprint arXiv:2409.18786. — [arXiv:2409.18786](https://arxiv.org/abs/2409.18786) find
  14. Jian Liu, Rui Zhang, Sebastian Szyller, Kui Ren, and N Asokan. 2024. False claims against model ownership resolution. In 33rd USENIX Security Symposium (USENIX Security 24), pages 6885–6902. find
  15. Peizhuo Lv, Pan Li, Shengzhi Zhang, Kai Chen, Ruigang Liang, Hualong Ma, Yue Zhao, and Yingjiu Li. 2023. A robustness-assured white-box watermark in neural networks. IEEE Transactions on Dependable and Secure Computing, 20(6):5214–5229. find
  16. Peizhuo Lv, Hualong Ma, Kai Chen, Jiachen Zhou, Shengzhi Zhang, Ruigang Liang, Shenchen Zhu, Pan Li, and Yingjun Zhang. 2024. Mea-defender: A robust watermark against model extraction attack. In 2024 IEEE Symposium on Security and Privacy (SP), pages 99–99. IEEE Computer Society. martimfasantos. 202… find
  17. Denis Paperno, Germán Kruszewski, Angeliki Lazaridou, Ngoc-Quan Pham, Raffaella Bernardi, Sandro Pezzelle, Marco Baroni, Gemma Boleda, and Raquel Fernández. 2016. The lambada dataset: Word prediction requiring a broad discourse context. In Proceedings of the 54th annual meeting of the association fo…
  18. Niels Provos and Peter Honeyman. 2003. Hide and seek: An introduction to steganography. IEEE security & privacy, 1(3):32–44. find
  19. Qwen Team. 2024a. Qwen2.5-coder-7b-instruct. https://huggingface.co/Qwen/Qwen2. Hugging Face model 5-Coder-7B-Instruct. card, accessed April 12, 2026. ↗
  20. Qwen Team. 2024b. Qwen2.5-math-1.5b-instruct. https://huggingface.co/Qwen/ Qwen2.5-Math-1.5B-Instruct. Hugging Face model card, accessed April 12, 2026. ↗
  21. Qwen Team. 2024c. Qwen2.5-math-7b-instruct. https://huggingface.co/Qwen/Qwen2. 5-Math-7B-Instruct. Hugging Face model card, accessed April 12, 2026. ↗
  22. Mark Russinovich and Ahmed Salem. 2024. Hey, that’s my model! introducing chain & hash, an llm fingerprinting technique. arXiv preprint arXiv:2407.10887. — [arXiv:2407.10887](https://arxiv.org/abs/2407.10887) find
  23. Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. 2021. Winogrande: An adversarial winograd schema challenge at scale. Communications of the ACM, 64(9):99–106. find
  24. Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. find
  25. Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, and 1 others. 2024. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118. find
  26. Qwen Team. 2024. Qwen2.5: A party of foundation models. find
  27. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, and 1 others. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288.
  28. Shenzhi Wang, Yaowei Zheng, Guoyin Wang, Shiji Song, and Gao Huang. 2024. Llama3.1-8b-chinese-chat. https://huggingface.co/shenzhi-wang/ Llama3.1-8B-Chinese-Chat. Hugging Face model card, accessed April 12, 2026. weiren119. 2023. traditional_chinese_qlora_llama2_merged. https://huggingface.co/weire… ↗
  29. Mitchell Wortsman, Gabriel Ilharco, Samir Ya Gadre, Rebecca Roelofs, Raphael Gontijo-Lopes, Ari S Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Kornblith, and 1 others. 2022. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time…
  30. Jiaxuan Wu, Zhengxian Wu, Yiming Xue, Juan Wen, and Wanli Peng. 2024. Generative text steganography with large language model. In Proceedings of the 32nd ACM International Conference on Multimedia, MM ’24, page 10345–10353, New York, NY, USA. Association for Computing Machinery. find
  31. Jiashu Xu, Fei Wang, Mingyu Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. 2024. Instructional fingerprinting of large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long P… find
  32. Zhenhua Xu, Meng Han, and Wenpeng Xing. 2025a. EverTracer: Hunting stolen large language models via stealthy and robust probabilistic fingerprint. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 7019–7042, Suzhou, China. Association for Computational… find
  33. Zhenhua Xu, Xubin Yue, Zhebo Wang, Qichen Liu, Xixiang Zhao, Jingxuan Zhang, Wenjun Zeng, Weng-peng Xing, Dezhang Kong, Changting Lin, and 1 others. 2025b. Copyright protection for large language models: A survey of methods, challenges, and trends. arXiv preprint arXiv:2508.11548. — [arXiv:2508.11548](https://arxiv.org/abs/2508.11548) find
  34. Zhenhua Xu, Xixiang Zhao, Xubin Yue, Shengwei Tian, Changting Lin, and Meng Han. 2025c. CTCC: A robust and stealthy fingerprinting framework for large language models via cross-turn contextual correlation backdoor. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Proces…
  35. Shojiro Yamabe, Tsubasa Takahashi, Futa Waseda, and Koki Wataoka. 2024. Mergeprint: Robust fingerprinting against merging large language models. arXiv preprint arXiv:2410.08604. — [arXiv:2410.08604](https://arxiv.org/abs/2410.08604) find
  36. Boyi Zeng, Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu Yu, and Zhouhan Lin. 2024. Huref: Human-readable fingerprint for large language models. Advances in Neural Information Processing Systems, 37:126332–126362. find
  37. Haobo Zhang, Zhenhua Xu, Junxian Li, Shangfeng Sheng, Dezhang Kong, and Meng Han. 2026. Attndiff: Attention-based differential fingerprinting for large language models. arXiv preprint arXiv:2604.05502. — [arXiv:2604.05502](https://arxiv.org/abs/2604.05502) find
  38. Jie Zhang, Dongrui Liu, Chen Qian, Linfeng Zhang, Yong Liu, Yu Qiao, and Jing Shao. 2024. Reef: Representation encoding fingerprints for large language models. arXiv preprint arXiv:2410.14273. — [arXiv:2410.14273](https://arxiv.org/abs/2410.14273) find
  39. Jingxuan Zhang, Zhenhua Xu, Rui Hu, Wenpeng Xing, Xuhong Zhang, and Meng Han. 2025. Meraser: An effective fingerprint erasure approach for large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 30136– 30153.
  40. Siyu Zhang, Zhongliang Yang, Jinshuai Yang, and Yongfeng Huang. 2021. Provably secure generative linguistic steganography. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 3046–3055. find
  41. Xuejing Zhou, Wanli Peng, Boya Yang, Juan Wen, Yiming Xue, and Ping Zhong. 2021. Linguistic steganography based on adaptive probability distribution. IEEE Transactions on Dependable and Secure Computing, 19(5):2982–2997. find
  42. Zachary Ziegler, Yuntian Deng, and Alexander M Rush. 2019. Neural linguistic steganography. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 1210–1215. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/wu-2026-imf-embedding-implicit-fingerprint-your/