ML Security PapersSeedPrints: Fingerprints Can Even Tell Which Seed Your Large Language Model Was Trained From
Yao Tong 1, Haonan Wang 1, Siquan Li 1, Kenji Kawaguchi 1, Tianyang Hu 2
Published on arXiv
2509.26404
Model Theft
OWASP ML Top 10 — ML05
Model Theft
OWASP LLM Top 10 — LLM10
Key Finding
SeedPrints achieves seed-level distinguishability across all training stages and remains robust to domain shifts and parameter modifications, establishing initialization itself as a persistent model identity signal.
SeedPrints
Novel technique introduced
Fingerprinting Large Language Models (LLMs) is essential for provenance verification and model attribution. Existing methods typically extract post-hoc signatures based on training dynamics, data exposure, or hyperparameters -- properties that only emerge after training begins. In contrast, we propose a stronger and more intrinsic notion of LLM fingerprinting: SeedPrints, a method that leverages random initialization biases as persistent, seed-dependent identifiers present even before training. We show that untrained models exhibit reproducible token selection biases conditioned solely on their parameters at initialization. These biases are stable and measurable throughout training, enabling our statistical detection method to recover a model's lineage with high confidence. Unlike prior techniques, unreliable before convergence and vulnerable to distribution shifts, SeedPrints remains effective across all training stages and robust under domain shifts or parameter modifications. Experiments on LLaMA-style and Qwen-style models show that SeedPrints achieves seed-level distinguishability and can provide birth-to-lifecycle identity verification akin to a biometric fingerprint. Evaluations on large-scale pretrained models and fingerprinting benchmarks further confirm its effectiveness under practical deployment scenarios. These results suggest that initialization itself imprints a unique and persistent identity on neural language models, forming a true ''Galtonian'' fingerprint.
Key Contributions
- Proposes SeedPrints, a model fingerprinting scheme that exploits random initialization seed-conditioned token selection biases as intrinsic, pre-training identifiers
- Demonstrates that these initialization biases are stable and measurable across all training stages, enabling birth-to-lifecycle identity verification analogous to a biometric fingerprint
- Shows robustness of fingerprints under domain shifts and parameter modifications on LLaMA-style and Qwen-style large-scale models
🛡️ Threat Analysis
SeedPrints embeds a persistent, verifiable identity into LLM weights derived from the initialization seed, enabling model attribution and provenance verification — a fingerprinting defense against model theft and unauthorized redistribution.