Research map / Large language models / Instruction and fine-tuning

AttnDiff: Attention-based Differential Fingerprinting for Large Language Models

NeurIPS 2026 · Large language models › Instruction and fine-tuning · approach: Safety alignment after fine-tuning · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes AttnDiff, a white-box LLM fingerprinting method that compares differential attention maps (origin vs. single-word-pivot corrupted prompts) via spectral descriptors and centered linear CKA, reporting robustness to fine-tuning, merging, and pruning.

Problem

Verifying whether a suspect open-weight LLM derives from a victim model despite laundering operations such as fine-tuning (SFT/PPO/DPO), pruning/compression, merging, and distillation, where existing intrinsic fingerprints are brittle.

Approach

Probe models with minimally perturbed prompt pairs that flip semantics via a single-word pivot, take the difference of post-softmax attention maps, summarize each (layer, head) difference by its top-K singular values, and compare models via centered linear CKA on probe-indexed Gram matrices, which tolerates differing depths and head counts.

Key results

• On SFT suspects of Llama-2-7B, AttnDiff averages 0.9945 similarity, with 0.9856 on Llemma-7B and 0.9890 on CodeLlama-7B, comparable to REEF (0.9966 avg).
• Under structured and unstructured pruning, AttnDiff keeps similarity at or above 0.9879 while PCS/ICS collapse to 0.0000 on structured pruning.
• For unrelated models, AttnDiff similarity falls to about 0.16 on average (e.g., 0.1052 for Qwen2.5-14B) versus about 0.37 with origin attention; with M=60 probes, related >0.98 vs unrelated <0.22.

Surprising findings

• Merging-suspect scores for weight-space merges sometimes lower than other baselines, e.g., Wizardmath merge at 0.9561 vs Logits 0.9999 on the same column.
• Probe-length ablation shows short phrase probes give much lower related-model similarity (0.9587) than medium sentences (0.9937).

Limitations

• Requires white-box access to internal attention maps, so it does not apply to black-box APIs.
• Lacks a principled mathematical model propagating laundering operations to fingerprint perturbations; theory only gives a coarse bound.
• Domain-wise dips for expert models (e.g., CodeLlama on Safe Alignment at 0.9063) and reliance on a single probe design.

Experimental setup

Datasets: Wikipedia Natural Questions TruthfulQA Constitutional AI principles Anthropic red-teaming datasets

Benchmarks: SFT suspects of Llama-2-7B (Llama-2-finance, Vicuna-1.5, WizardMath, Chinese-LLaMA-2, CodeLlama, Llemma) Weight and distribution merged models (Evollm-jp-7b, Fusellm-7b parents) Structured and unstructured pruned Sheared-LLaMA, Sparse-LLaMA, Wanda, GBLM

Metrics: CKA similarity similarity score

Baselines: PCS ICS Logits REEF ProFlingo LLMMap

Builds on: centered linear CKA REEF LLMMap ProFlingo

Closest papers by meaning

• SIF: Semantically In-Distribution Fingerprints for Large Vision-Language Models (CVPR 2026 · similarity 0.87)
• HuRef: HUman-REadable Fingerprint for Large Language Models (NeurIPS 2024 · similarity 0.86)
• Measuring Fingerprints of Web-filtered Text Datasets and Fingerprint Propagation Through Training (NeurIPS 2025 · similarity 0.86)
• REEF: Representation Encoding Fingerprints for Large Language Models (ICLR 2025 · similarity 0.86)
• Fingerprinting Inference Systems of Large Language Models (NeurIPS 2026 · similarity 0.85)
• Backdoor Cleaning without External Guidance in MLLM Fine-tuning (NeurIPS 2025 · similarity 0.85)