Research map / Large language models / Reasoning and chain of thought

Fingerprinting Inference Systems of Large Language Models

NeurIPS 2026 · Large language models › Reasoning and chain of thought · approach: Efficient LLM serving · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that numerical deviations across inference engines, attention backends, and GPUs leak through text-only responses, and trains random-forest classifiers on crafted prompt sets to fingerprint these components.

Problem

Inference systems (engine, attention backend, hardware) introduce small floating-point deviations that may leak their identity to anyone who can query an LLM via text-only chat access, creating a security and trust risk.

Approach

Craft four prompt sets that each trigger a distinct computational stage (autoregressive decoding, prefill, chunked prefill, KV-cache reuse), map responses to per-set scores, concatenate them into a feature vector, and train random forests to identify engine, attention backend, and GPU from text-only outputs.

Key results

• At temperature 0, the method identifies inference engine, attention backend, and GPU type with 100% accuracy across the three models.
• At temperatures 0.3-0.9, average accuracy is about 80% for inference engine, 71% at T=0.3 for attention backend (dropping to 46% at T=0.9), and 78% at T=0.3 for GPU type.
• Application-specific system prompts keep accuracy at about 99.7%, and batch-size generalization stays high, while cross-temperature transfer drops to roughly 30-49%.

Surprising findings

• Cross-temperature generalization collapses to near chance (about 30-49%), so attackers must match the deployment temperature in training.

Limitations

• Covers only a finite set of components (4 engines, 6 backends, 3 GPUs) and 3 small models.
• Requires reference fingerprints of candidate systems and is infeasible for proprietary stacks.
• Needs up to several hundred prompts per system, which rate limits could constrain.

Experimental setup

Datasets: BoolQ prompts.chat

Benchmarks: BoolQ

Metrics: classification accuracy

Builds on: BoolQ prompt stealing model fingerprinting

Closest papers by meaning

• Understanding and Mitigating Numerical Sources of Nondeterminism in LLM Inference (NeurIPS 2025 · similarity 0.87)
• The Silent Hyperparameter: Quantifying the Impact of Inference Backends on LLM Reproducibility (NeurIPS 2026 · similarity 0.86)
• Hidden No More: Attacking and Defending Private Third-Party LLM Inference (ICML 2025 · similarity 0.86)
• Scalable Fingerprinting of Large Language Models (NeurIPS 2025 · similarity 0.86)
• Can We Infer Confidential Properties of Training Data from LLMs? (NeurIPS 2025 · similarity 0.86)
• Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models (ICLR 2025 · similarity 0.86)