[Paper Review] HuRef: HUman-REadable Fingerprint for Large Language Models

Boyi Zeng, Wang, Lizheng+6 more|arXiv (Cornell University)|Dec 8, 2023

Natural Language Processing Techniques4 citations

TL;DR

This paper proposes HuRef, a human-readable fingerprint for large language models (LLMs) that uniquely identifies a model's base architecture without exposing parameters or interfering with training. By leveraging stable parameter vector directions after pretraining and defining three robust invariant terms, HuRef generates a natural image fingerprint (e.g., a dog) via StyleGAN2, which remains unchanged across fine-tuning, RLHF, and continued pretraining, enabling both intuitive visual discrimination and precise quantitative verification.

ABSTRACT

Protecting the copyright of large language models (LLMs) has become crucial due to their resource-intensive training and accompanying carefully designed licenses. However, identifying the original base model of an LLM is challenging due to potential parameter alterations. In this study, we introduce HuRef, a human-readable fingerprint for LLMs that uniquely identifies the base model without interfering with training or exposing model parameters to the public. We first observe that the vector direction of LLM parameters remains stable after the model has converged during pretraining, with negligible perturbations through subsequent training steps, including continued pretraining, supervised fine-tuning, and RLHF, which makes it a sufficient condition to identify the base model. The necessity is validated by continuing to train an LLM with an extra term to drive away the model parameters' direction and the model becomes damaged. However, this direction is vulnerable to simple attacks like dimension permutation or matrix rotation, which significantly change it without affecting performance. To address this, leveraging the Transformer structure, we systematically analyze potential attacks and define three invariant terms that identify an LLM's base model. Due to the potential risk of information leakage, we cannot publish invariant terms directly. Instead, we map them to a Gaussian vector using an encoder, then convert it into a natural image using StyleGAN2, and finally publish the image. In our black-box setting, all fingerprinting steps are internally conducted by the LLMs owners. To ensure the published fingerprints are honestly generated, we introduced Zero-Knowledge Proof (ZKP). Experimental results across various LLMs demonstrate the effectiveness of our method. The code is available at https://github.com/LUMIA-Group/HuRef.

Motivation & Objective

• To address the challenge of identifying the base model of a fine-tuned or continued-pretrained LLM, especially when parameters are not publicly released.
• To develop a method that enables both intuitive human discrimination and precise quantitative verification of LLM base models.
• To ensure the fingerprint remains stable across diverse training procedures, including SFT, RLHF, and multilingual continued pretraining.
• To make the fingerprint human-readable by mapping invariant terms into a natural image using a generative model like StyleGAN2.
• To provide a solution that does not require exposing model parameters to the public, preserving model security and licensing integrity.

Proposed method

• The method identifies stable parameter vector directions in LLMs after pretraining convergence, which remain largely unchanged through subsequent training steps like SFT and RLHF.
• It defines three invariant terms resistant to common weight rearrangements (e.g., dimension permutation or matrix rotation) by analyzing the structural constraints of the Transformer architecture.
• These invariant terms are mapped to a Gaussian random vector using a convolutional encoder to enable image generation.
• A pre-trained StyleGAN2 model converts the Gaussian vector into a natural image fingerprint (e.g., a dog), which visually reflects the base model.
• The fingerprint is generated solely from model parameters by the LLM owner, while public verification relies only on the invariant terms and the image, not the weights.
• The approach is validated across multiple LLMs, including fine-tuned and continued-pretrained variants, under diverse training regimes.

Experimental results

Research questions

• RQ1 Can the direction of LLM parameter vectors serve as a stable and reliable identifier of the base model across various training procedures?
• RQ2 How can we design invariant terms that are robust to common weight manipulation attacks like dimension permutation or matrix rotation?
• RQ3 To what extent can the fingerprint be made human-readable while preserving its uniqueness and stability?
• RQ4 Does the fingerprint remain invariant under SFT, RLHF, and continued pretraining with expanded vocabulary in a new language?
• RQ5 Can human users reliably distinguish base models based on the visual fingerprint alone?

Key findings

• The vector direction of LLM parameters remains highly stable after pretraining convergence, with cosine similarities between checkpoints increasing from 56.23% at 10k–60k steps to 94.25% at 310k–360k steps, indicating strong convergence.
• Models trained from scratch with different global random seeds exhibit significantly different parameter directions, with cosine similarities between invariant terms dropping to as low as 2.08%, confirming uniqueness.
• The human subject study achieved a 94.74% accuracy rate in identifying base models by matching fingerprints, demonstrating strong human readability and intuitive visual discrimination.
• Fingerprints remain invariant across SFT, RLHF, and continued pretraining with new language vocabulary, maintaining consistent appearance and invariant terms.
• The method successfully generates distinct, visually interpretable fingerprints (e.g., dog images) that reflect the underlying base model, even when models are fine-tuned or adapted.
• The invariant terms are robust to attacks like dimension permutation and matrix rotation, as demonstrated by their stability under such transformations.