@inproceedings{bai-etal-2025-esf,
    title = "{ESF}: Efficient Sensitive Fingerprinting for Black-Box Tamper Detection of Large Language Models",
    author = "Bai, Xiaofan  and
      Hu, Pingyi  and
      Ma, Xiaojing  and
      Yu, Linchen  and
      Zhang, Dongmei  and
      Zhang, Qi  and
      Zhu, Bin Benjamin",
    editor = "Che, Wanxiang  and
      Nabende, Joyce  and
      Shutova, Ekaterina  and
      Pilehvar, Mohammad Taher",
    booktitle = "Findings of the Association for Computational Linguistics: ACL 2025",
    month = jul,
    year = "2025",
    address = "Vienna, Austria",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/landing_page/2025.findings-acl.546/",
    pages = "10477--10494",
    ISBN = "979-8-89176-256-5",
    abstract = "The rapid adoption of large language models (LLMs) in diverse applications has intensified concerns over their security and integrity, especially in cloud environments where internal model parameters are inaccessible to users. Traditional tamper detection methods, designed for deterministic classification models, fail to address the output randomness and massive parameter spaces characteristic of LLMs. In this paper, we introduce \textit{Efficient Sensitive Fingerprinting (ESF)}, the first fingerprinting method tailored for black-box tamper detection of LLMs. ESF generates fingerprint samples by optimizing output sensitivity at selected detection token positions and leverages \textit{Randomness-Set Consistency Checking (RSCC)} to accommodate inherent output randomness. Furthermore, a novel \textit{Max Coverage Strategy (MCS)} is proposed to select an optimal set of fingerprint samples that maximizes joint sensitivity to tampering. Grounded in a rigorous theoretical framework, ESF is both computationally efficient and scalable to large models. Extensive experiments across state-of-the-art LLMs demonstrate that ESF reliably detects tampering, such as fine-tuning, model compression, and backdoor injection, with a detection rate exceeding 99.2{\%} using 5 fingerprint samples, thereby offering a robust solution for securing cloud-based AI systems."
}