ML Security PapersiSeal: Encrypted Fingerprinting for Reliable LLM Ownership Verification
Zixun Xiong 1, Gaoyi Wu 1, Qingyang Yu 1, Mingyu Derek Ma 2, Lingfeng Yao 3, Miao Pan 3, Xiaojiang Du 1, Hao Wang 1
Published on arXiv
2511.08905
Model Theft
OWASP ML Top 10 — ML05
Model Theft
OWASP LLM Top 10 — LLM10
Key Finding
Achieves 100% Fingerprint Success Rate on 12 LLMs against 10+ attacks including fingerprint unlearning and response manipulation, while all baseline methods fail under these conditions.
iSeal
Novel technique introduced
Given the high cost of large language model (LLM) training from scratch, safeguarding LLM intellectual property (IP) has become increasingly crucial. As the standard paradigm for IP ownership verification, LLM fingerprinting thus plays a vital role in addressing this challenge. Existing LLM fingerprinting methods verify ownership by extracting or injecting model-specific features. However, they overlook potential attacks during the verification process, leaving them ineffective when the model thief fully controls the LLM's inference process. In such settings, attackers may share prompt-response pairs to enable fingerprint unlearning or manipulate outputs to evade exact-match verification. We propose iSeal, the first fingerprinting method designed for reliable verification when the model thief controls the suspected LLM in an end-to-end manner. It injects unique features into both the model and an external module, reinforced by an error-correction mechanism and a similarity-based verification strategy. These components are resistant to verification-time attacks, including collusion-based fingerprint unlearning and response manipulation, backed by both theoretical analysis and empirical results. iSeal achieves 100 percent Fingerprint Success Rate (FSR) on 12 LLMs against more than 10 attacks, while baselines fail under unlearning and response manipulations.
Key Contributions
- First LLM fingerprinting method designed for reliable ownership verification when the model thief fully controls the suspected LLM's inference process end-to-end
- Dual-injection approach combining model-embedded features with an external module, reinforced by error-correction and similarity-based (non-exact-match) verification resistant to response manipulation
- Theoretical and empirical resistance to 10+ attacks including collusion-based fingerprint unlearning, achieving 100% FSR across 12 LLMs where all baselines fail
🛡️ Threat Analysis
iSeal embeds unique fingerprint features INTO the model weights and an external module to verify LLM ownership — a direct defense against model theft via IP-protecting model fingerprinting. It explicitly defends against attackers who steal and redistribute LLMs.