Researchers propose the GhostPrint attack, which can make weak models disguise as expensive LLMs to bypass fingerprint recognition

Can a malicious provider use PEFT to tune a weak model to fool user-side fingerprint audits, thereby charging as if it were a strong model.

• Scenario: The authors state that paid LLM APIs have become infrastructure for coding agents, retrieval-augmented generation, and academic evaluation. User-side black-box fingerprinting uses a small number of queries and answer styles to verify whether the API is actually providing the advertised model.
• Gap in existing practice: The authors state that existing fingerprints assume the model is static and that providers do not adversarially modify weights. If fine-tuning is cheap and profitable, a provider could privately switch to a weaker variant to save costs, or impersonate a strong model with a weak one.
• Core observation: The authors state that scaling laws and Proposition 5.1 imply that a small model cannot perfectly imitate a large model on all inputs; but a limited query budget and weaker classifiers make local adaptation sufficient to fool the audit (Theorems 5.2, 5.3).
• Threat model:
  • Goal: The local mechanism g classifies the adapted weak model as ftarget; normal task utility is acceptable; the process to obtain θadv is economically feasible.
  • Knowledge: Full knowledge of g, can build a surrogate g; knows the query distribution Dq, can sample surrogate queries. Does not know the finite query set Qn drawn by the audit at that time.
  • Capability: White-box access to the deployed weak model, and only PEFT is allowed, i.e., θadv = θweak + Δθ. Users can only query black-box, cannot see internal states or intervene in training.
  • Victim: Third-party inference APIs that claim to provide a strong model and charge at a higher price.
• This paper proposes: The attack framework GhostPrint, and under two settings—static fingerprinting and continuously changing fingerprints—examines whether it can simultaneously achieve deception, maintain utility, and use only low-rank updates.

Black-box and white-box fingerprints

• Three-way classification: Section 2 divides existing methods into white-box non-invasive (inspecting internal signals, e.g., Zheng et al., 2022; Wu et al., 2025), black-box non-invasive (analyzing API outputs, e.g., Gao et al., 2025b; Sun et al., 2025c; Pasquini et al., 2025; Gubri et al., 2024), and invasive methods that embed signatures at training time (Gu et al., 2022; Li et al., 2023; Xu et al., 2024; Yamabe et al., 2025).
• Black-box methods actually audited in this paper: LLMmap trains a multiclass embedding classifier on identity probe queries; MET uses a two-sample kernel test to compare completion distributions; LLM-idio trains a binary classifier on UltraChat responses. The authors state the latter two are insensitive to query distribution and therefore can be destabilized by active fine-tuning.
• Appendix C.2: Supplements directions such as white-box representation fingerprints, black-box statistical tests, and backdoor watermarks, including invasive designs resistant to merging and fine-tuning. The main text does not treat each of these designs as baselines for this paper.

Attacks against fingerprints

• Rewriting and statistical evasion: Kurian et al. (2025) and Nasery et al. (2025a). The paper states these attacks do not fine-tune the weak model and rely on distinguishable query distributions.
• Difference from this paper: The authors place the difference in the provider proactively using PEFT to modify the weak model to forge fingerprints, rather than only rewriting or scrambling outputs at inference time.

API replacement and billing

• Model swapping: Cai et al. (2025b), Zhang et al. (2026b) discuss silently replacing with a weaker model. Appendix C.1 states this paper differs from direct model replacement: the weak model undergoes PEFT to evade fingerprint audits.
• Token and resource side: Sun et al. (2025a,b), Velasco et al. (2025) discuss hidden tokens and billing. The authors state this paper also differs from such token overcharging.

Baseline methods and benchmarks

• Attack baselines: Query Detection, Rewriting (Kurian et al., 2025), 5-shot ICL, Token Suppression (Nasery et al., 2025a), and reported unmodified weak and strong models.
• Data: LLMmap official query set; LLM-idio and MET use UltraChat (Ding et al., 2023). Utility is MMLU, GSM8K, ARC-Challenge.

The authors position this paper under the setting where "the provider knows g and Dq but uses only PEFT for local imitation," and state that user-side resource constraints allow existing audits to be bypassed by such local adaptation.

GhostPrint turns the two weaknesses of auditing into training signals: it uses supervised fine-tuning (SFT) and knowledge distillation (KD) on the query distribution Dq to imitate the strong model, then uses a surrogate auditor for ranking-based filtering, updating only LoRA throughout; when new fingerprints arrive, it uses Mixture-of-LoRA-Experts (MoLA) to route multiple adapters.

Problem Setting

• Audit (Definition 3.1): Sample n queries from Dq, collect responses Rn, and g gives a binary result on whether it is ftarget. LLMmap collects Dq into identity probes, and g is a multiclass embedding classifier; MET uses general Dq, and g is a maximum mean discrepancy (MMD) two-sample test, thresholding the p-value.
• Three objectives (Definition 4.1): deceive g, maintain normal task utility relative to the original weak model, and use only PEFT. The authors claim that, following Kerckhoffs's principle, a trustworthy audit should make g and Dq public, so the attacker knows both; the attacker still does not know the current finite set Qn.
• Why not directly optimize g: Section 5.2 states that in a black-box setting, g cannot be directly used; even if it could, using it as a reward model for reinforcement learning would be too expensive and unstable, violating economic constraints. Therefore, they construct a local surrogate g using the known Dq: lightweight classifiers for LLMmap and LLM-idio, and a reproduced statistic for MET.

When Local Deception Is Feasible

• Global lower bound: Proposition 5.1 compares strong model weights W (rank k1) with the weak model's corresponding matrix W′ (rank k2 < k1）。若 LoRA 秩 r < k1 − k2，则对任意输入，谱范数与 Frobenius 范数下的通用模仿误差都有正下界，下界用残差 R = W − W′ 的最小非零奇异值表示。作者据此称 PEFT 不能在所有输入上完美模仿。
• 低有效秩查询：Theorem 5.2 给出期望误差上界，由协方差尾部特征值与残差决定。作者称 Dq 简单时误差可以被压低，并称这对应 LLMmap 一类集中在特定语义方向的查询。
• 弱分类器：Theorem 5.3 把最坏情况误差写成审计投影后的第 r+1 个奇异值。作者称，若该分类器的秩 c ≤ r，则该值为 0，理想情况下可用 PEFT 骗过该指纹。

两阶段适配

• SFT 与 KD：对 q ~ Dq 及强模型回答 r，SFT 最小化弱模型的负对数似然。同一批查询上，以目标模型为教师，对逐 token 分布做 KL。总目标为 min_θ^adv L_total := L_SFT(θ^adv) + α L_KD(θ^adv)，α > 0 to balance deception and utility. The appendix also writes the KD coefficient as λkd, temperature τ = 2.0.
• RAFT: For each q, sample K candidates from the current weak model, rank them with surrogate g, and take the response that best fools g, then do the same SFT+KD. The appendix implements this with N = 8 per prompt and 3 rounds. The authors claim this selects samples from the weak model's existing generations that cross the decision boundary, rather than doing reinforcement learning.
• LoRA-only training: Freeze the weak model's base weights, and add a rank-r update for each target matrix. Appendix: r = 16, LoRA α = 32, dropout 0.05, 2 epochs, learning rate 5×10^−5, batch size 4, AdamW weight decay 0.01; main experiments λkd = 0.5. Figure 3 sweeps α as the KD weight; the authors claim the optimum is approximately α = 0.25hare and it is insensitive over [0.25, 1.0].

Continual Multi-Fingerprint

• Add adapters per task: For the τ-th auditor g^(τ) and Dq^(τ), train another LoRA set following the above process, then attach to MoLA. The router scores hidden states, and the output is a weighted sum of historical experts.
• No retraining of old experts: Freeze existing adapters, and only train the new adapter and a small router. The routing phase uses a mixture of queries from all tasks so far, and the loss is still Equation (1). The authors claim this allows continued adaptation after new fingerprints appear while avoiding catastrophic forgetting.

How Success Is Determined

• ASR: The proportion of times the auditor judges the adapted weak model as the claimed strong model. LLMmap is a 52-class classifier; LLM-idio is a binary classifier trained per model family; MET is the proportion of seeds where H0 is not rejected. Specific sample sizes and thresholds are in the experimental setup; results are not expanded here.

实验设置

• 模型：Gemma-1.1-2B 对 Gemma-1.1-7B，Qwen2-1.5B 对 Qwen2-7B，Phi-3-mini（3.8B）对 Phi-3-medium（14B）。另有跨族方向。
• 指纹与划分：全部指纹查询 8:2 划分。LLMmap 用官方 800 条对抗身份探测（640/160），ASR 用其中 100 条。LLM-idio 的二分类器在小模型与大模型各 10,000 条 UltraChat 回答上训练，留出 20%（2,000 条）作测试。MET 主表公平预算为 N = 1 条提示、K = 10 条补全，从 N = 50、K = 20 的池中抽样。
• 效用：MMLU、GSM8K、ARC-Challenge，5-shot，LM Evaluation Harness。论文未报告这三项的样本量与重复次数。
• 基线：Query Detection 用冻结 all-MiniLM-L6-v2 句向量上的两层 MLP，把判为探测的查询路由到强模型预收集回答，其余走弱模型；作者称这是 oracle，因为知道探测分布。Rewriting、5-shot ICL（五条强模型 UltraChat 问答）和 Token Suppression（Suppress Top-K，附录写前 16 步屏蔽 4 个最高概率 token）不改权重。另报告未改弱模型与强模型。
• 指标：ASR。MET 使用 MMD Hamming、100 次置换、α = 0.05；ASR 是 30 个种子中未能拒绝 H0 的比例。表中 “–” 表示推理时基线不微调，效用与原弱模型相同。
• Table 1 的 GhostPrint 行：附录 B.1 称它是 18 个 LoRA 变体（LLMmap 探测或 UltraChat，KD 教师为无、学生规模或目标规模）的各列最大值，三列不必来自同一次训练。

主结果

Swipe horizontally to read the table

设置（GhostPrint）	LLMmap	LLM-idio	MET
Gemma-1.1-2B→7B（Table 1，列最大）	95.0%	58.5%	23.3%
Qwen2-1.5B→7B（Table 1，列最大）	76.0%	71.3%	40.0%
Phi-3-mini→medium（Table 1，列最大）	80.0%	64.0%	60.0%
Gemma-2B→Qwen2-7B（Table 2）	0.0%	95.2%	33.3%
Qwen2-1.5B→Gemma-7B（Table 2）	6.0%	96.7%	6.7%

• 作者解读：同族下 GhostPrint 在几乎所有指纹上 ASR 最高，唯一点名的例外是 LLM-idio 上的 5-shot ICL。Table 1 中该例外为 Phi-3：5-shot ICL 为 70.5，列最大的 GhostPrint 为 64.0。Qwen 的 MET 上 GhostPrint 与 Query Detection 同为 40.0。
• 与原强模型的自然接受率：Table 1 原强模型为 Gemma 92.0 / 98.8 / 100.0，Qwen 81.0 / 98.6 / 96.7，Phi-3 91.0 / 77.2 / 96.7（LLMmap / LLM-idio / MET）。作者特别称 Gemma 的 LLMmap 上 95.0 超过原强模型的 92.0。LLM-idio 与 MET 的列最大仍低于对应原强模型。
• 效用：作者称与原弱模型几乎相同，只有小幅下降或略升。Table 1 中 Gemma 的 MMLU 从 37.90 到 38.11，GSM8K 从 10.69 到 8.72，ARC-C 从 44.97 到 44.54；Qwen 为 55.55→55.36、55.42→55.80、43.52→44.97；Phi-3 为 70.37→69.70、80.36→78.01、62.97→62.80。

跨家族

• Table 2：作者称不同架构的语言风格与词表使跨族更难；GhostPrint 仍在两个方向绕过 LLM-idio，并在 Gemma→Qwen 上绕过 MET（33.3，该列攻击中最高；原强模型 96.7）。
• 例外：Gemma→Qwen 的 LLMmap 上，包括 GhostPrint 在内的攻击均为 0.0（原强模型 80.0）。Qwen→Gemma 的 LLMmap 上 Token Suppression 为 15.0，高于 GhostPrint 的 6.0；该方向 MET 上 GhostPrint 与 Query Detection 同为 6.7。
• 附录 Table 6：B.2 称这是同规模跨族，并称不符合经济收益目标，故不在威胁模型内。表注写 spoof a strong model，表头却是 Gemma-2B→Qwen2-1.5B 与反向。GhostPrint 为 4.0 / 97.5 / 46.7 与 38.0 / 97.9 / 20.0。作者称其高于表中攻击基线。

持续指纹（Table 4）

• 测了什么：依次为 LLMmap、LLM-idio、MET 各训一套 LoRA，再按两两组合或 3-way 用 MoLA 路由。作者称并入后只有小幅下降且仍高，并称 Qwen 与 Phi-3 的 3-way 中部分结果高于单独设置。
• 3-way：Gemma 86.0 / 54.8 / 16.7，Qwen 81.0 / 57.6 / 26.7，Phi-3 77.0 / 50.6 / 53.3。相对 Table 1 列最大，Qwen 的 LLMmap 从 76.0 到 81.0；Gemma 的 LLMmap 从 95.0 到 86.0；Phi-3 的 LLMmap 从 80.0 到 77.0。
• 未训练的专家：Qwen 的 LLMmap+LLM-idio（无 MET 专家）在 MET 上为 23.3；作者称接近显式包含 MET 的配置（LLM-idio+MET 与 3-way 均为 26.7）。Phi-3 同一路由的 MET 为 43.3，与 LLMmap+MET 的 43.3 相同，低于 LLM-idio+MET 的 60.0。省略 LLMmap 专家时，LLMmap ASR 为 Gemma 20.0、Qwen 20.0、Phi-3 0.0。

MET 查询量

• 协议：附录 A.4 与 Figure 4 固定 K = 10，N 取 1、2、5、10、20、50，从 (50, 20) 池抽样，30 个种子平均 ASR。图例为 Best Single (UC)、MoLA (3-way)、RAFT（λ = 0.5）。转换文本看不到各点高度。
• 作者给出的读数：Phi-3 上 MoLA 的 ASR 在 N > 30 之前保持在 50% 以上，最好的单指纹 adapter 在 N = 20 时降到 50% 以下；其他族曲线重叠。作者称在 strong budget 的 Phi-3 上，MoLA 平均 permutation p = 0.086 > α，并称这是 MET 未能拒绝 H0 的情形。
• 预算：作者称完整 (50, 20) 每次审计 1,000 次生成，此时所有 adapter 都被拒绝；公平 (1, 10) 与默认 (20, 5) 下许多攻击未被检出，尤其是规模差距最小的 Phi-3。作者称 MET 默认 (20, 5) 的生成量是单查询审计的 100 倍，因此主表用 (1, 10)。

其他消融与分析

• KD 锚点与 α（Figure 3，纵轴 LLM-idio ASR，横轴 0.25、0.5、0.75、1，图例为 Weak / Strong anchor）：作者称大模型锚点略高，小模型锚点仍然有效；文本看不到各点高度。
• RAFT 比例 λraft（Table 3）：0 到 0.5 时，LLM-idio 为 Gemma 54.7→58.8、Qwen 56.3→63.4、Phi-3 49.1→54.8；MET 为 6.7→10.0、36.7→40.0、40.0→43.3。
• Table 5：Gemma、LLMmap 数据、无 KD 的 LLMmap ASR 为 95.0，同格 LLM-idio 为 31.2；UltraChat、无 KD 的 LLM-idio 为 58.5、MET 为 23.3、LLMmap 为 19.0。训练数据与被攻击的指纹并不对称。
• Table 5 中 Phi-3、UltraChat、medium 教师：LLMmap ASR 为 0.0，MET 为 60.0。该行与 LLMmap 探测训练的高 LLMmap ASR 方向相反。
• 结论写绕过 four auditors；正文与 Table 1–4 评测的指纹方法是 LLMmap、LLM-idio、MET 三个。

Limitations and future directions noted by the authors

• Frontier-scale models not evaluated: Due to academic compute constraints, GhostPrint was not evaluated on frontier-scale models (e.g., Qwen-3 32B); the authors state this is an important next step (Limitations).
• Reinforcement learning: The authors state that the surrogate classifier could be used as a reward model for reinforcement learning to improve alignment as future work (Limitations).

Experimental coverage

• The weak models adapted and reported with ASR are Gemma-1.1-2B, Qwen2-1.5B, Phi-3-mini, with corresponding imitated models Gemma-1.1-7B, Qwen2-7B, Phi-3-medium (Section 6.1, Table 1).
• Fingerprints are three black-box methods: LLMmap, LLM-idio, MET; utility is 5-shot MMLU, GSM8K, ARC-C (Section 6.1). The paper does not report sample sizes for these three utility benchmarks.
• Attack baselines are Query Detection, Rewriting, 5-shot ICL, Token Suppression, as well as unmodified weak and strong models. The continual setting reports pairwise routing and 3-way (Table 4).
• Cross-family weak-to-strong is Gemma-2B→Qwen2-7B and Qwen2-1.5B→Gemma-7B (Table 2). Same-scale cross-family is in Appendix Table 6; the authors state it does not meet economic benefit goals and is therefore placed outside the threat model. The main text explains that only black-box fingerprints are used because users cannot inspect internal states.
• MET's ASR is computed over 30 seeds; the main table has fair budget N = 1, K = 10, with an additional sweep of N up to 50 at K = 10 (Appendix A.4). The paper does not report wall-clock time or cost for fine-tuning.

GhostPrint discusses whether a malicious inference provider can use only low-rank updates to make a weaker model appear, in a user's black-box fingerprint audit, like the advertised strong model.

• When users verify API identity, the number of queries is limited, and the classifier is often not the strongest model. The authors' analysis is: PEFT imitation on all inputs has a positive error lower bound, but when the query distribution is simple or the classifier is weak, the error of local deception can be small, even 0 when the classifier's rank does not exceed the LoRA rank.
• Training is in two stages. First, on the known query distribution, use strong model answers for SFT, and use KD to align the next-token distribution; then use a local surrogate auditor to select weak model answers that already look more like the strong model, continuing to update only LoRA. When a new audit method appears, train another adapter for it, route with MoLA, and freeze the old adapter.
• Same-family Table 1's GhostPrint is the column maximum across training variants, not a single training run achieving all three columns simultaneously. Gemma-1.1-2B→7B is LLMmap 95.0, LLM-idio 58.5, MET 23.3; Qwen2-1.5B→7B is 76.0, 71.3, 40.0; Phi-3-mini→medium is 80.0, 64.0, 60.0. On Phi-3's LLM-idio, 5-shot ICL is 70.5, higher than that column's maximum. Gemma's GSM8K goes from 10.69 to 8.72, MMLU from 37.90 to 38.11.
• In cross-family Table 2, Gemma→Qwen's LLM-idio is 95.2, LLMmap is 0.0; Qwen→Gemma's LLM-idio is 96.7, LLMmap is 6.0. The authors state cross-family is harder, but still effective for LLM-idio and for Gemma→Qwen's MET.
• After continuous routing, Qwen's 3-way LLMmap is 81.0 (Table 4). The authors state that under the full MET budget the adapter is rejected, while a lower budget misses many attacks. The authors conclude that this PEFT forgery can bypass current black-box fingerprint pipelines and threaten the integrity of APIs that charge based on the advertised model.