@inproceedings{wu-etal-2026-imf,
    title = "{I}m{F}: Embedding an Implicit Fingerprint in Your Large Language Models",
    author = "Wu, Jiaxuan  and
      Peng, Wanli  and
      fu, Hang  and
      Yiming, Xue  and
      Wen, Juan",
    editor = "Liakata, Maria  and
      Moreira, Viviane P.  and
      Zhang, Jiajun  and
      Jurgens, David",
    booktitle = "Proceedings of the 64th Annual Meeting of the {A}ssociation for {C}omputational {L}inguistics (Volume 1: Long Papers)",
    month = jul,
    year = "2026",
    address = "San Diego, California, United States",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/ingest-acl/2026.acl-long.1183/",
    pages = "25804--25825",
    ISBN = "979-8-89176-390-6",
    abstract = "Training and serving large language models (LLMs) is resource-intensive, making reliable intellectual property (IP) protection and black-box ownership verification increasingly important.Model fingerprinting enables such verification by injecting a small set of secret query{--}response behaviors, but many existing fingerprints rely on explicit markers or predetermined outputs that are weakly grounded in prompt semantics.This semantic mismatch yields atypical fingerprint responses, reduces stealthiness, and exposes fingerprints to removal by response normalization.We formalize this vulnerability via a new removal attack, \textit{Generation Revision Intervention} (GRI), which applies system-prompt-level revision and response standardization to steer models toward typical answers, substantially compromising representative injected baselines.To close this semantic gap, we propose the Implicit Fingerprints (ImF): we encode ownership information into a natural-looking target response $y$ via linguistic steganography, then derive a CoT-augmented query $x$ that embeds semantic cues from $y$ to guide the model toward an output sufficiently close to $y$ for decoding-based verification.Experiments on 15 LLMs show that ImF improves stealthiness and remains verifiable under model updates and deployment-time prompt interventions; additional analyses further show stability under common decoding variation and realistic related-model partial merging."
}