Your "Pro" LLM Subscription May Actually Be "Free": Exposing Fingerprint Spoofing Risks in LLM Inference Services
Proposes GhostPrint, a parameter-efficient attack framework that enables weak models to mimic strong LLMs, exposing fingerprint spoofing vulnerabilities.
Key Findings
Methodology
This work combines theoretical analysis with empirical validation. It first proves that resource constraints like limited queries and weak classifiers make current fingerprinting methods vulnerable. Guided by this, GhostPrint employs surrogate modeling, reward-ranked fine-tuning (RAFT), and knowledge distillation (KD) to craft weak models that mimic target fingerprints. Extensive experiments in static and continual settings demonstrate that GhostPrint can consistently bypass mainstream fingerprinting methods while maintaining task utility, revealing critical security flaws in existing pipelines.
Key Results
- GhostPrint achieves over 85% success in bypassing detection methods like LLMmap, LLM-idio, and MET, with fine-tuning costs under 5% of model parameters, while preserving over 95% of original task performance.
- In continual adaptation scenarios, the attack maintains over 80% success rate, effectively adapting to evolving detection strategies.
- Ablation studies show that reward-ranked fine-tuning and knowledge distillation significantly improve spoofing effectiveness, confirming the robustness and practicality of the approach.
Significance
This research uncovers a fundamental security risk in deploying LLM APIs, especially when verification relies on limited resources. Attackers can exploit low-cost parameter-efficient fine-tuning to impersonate stronger models, threatening model authenticity and trustworthiness. The findings urge industry and academia to rethink current fingerprinting defenses, pushing for more robust, adaptive verification systems. It advances understanding of adversarial model manipulation, influencing future standards for AI safety and security, and underscores the importance of developing defenses against low-resource, dynamic spoofing attacks.
Technical Contribution
The paper provides a rigorous theoretical framework analyzing the limits of fingerprint spoofing under resource constraints, demonstrating that perfect universal spoofing is impossible but local spoofing is feasible. It introduces a novel attack pipeline combining surrogate modeling, reward-based response filtering, and low-rank parameter updates via LoRA, integrated with continual learning for dynamic environments. Empirical results validate the approach's effectiveness across multiple models and detection methods, establishing a new benchmark in model security research.
Novelty
This is the first comprehensive study integrating theoretical bounds with practical attack design for low-cost fingerprint spoofing in LLMs. Unlike prior works focusing on white-box or static detection, this work emphasizes resource-limited, dynamic adversarial scenarios, filling a critical gap. The innovative use of reward-ranked fine-tuning and continual adaptation distinguishes it from existing static or black-box attack methods, offering a new perspective on model security vulnerabilities.
Limitations
- The approach assumes attacker knowledge of the detection mechanism and query distribution, which may not always be available in real-world scenarios.
- While cost-effective, the attack still requires some computational resources for fine-tuning, which might be prohibitive in extremely constrained environments.
- The method may slightly degrade task performance in highly sensitive applications, and defenses against adaptive, multi-stage attacks remain an open challenge.
Future Work
Future research should explore defenses against such low-resource spoofing, including more robust fingerprinting algorithms and multi-modal verification. Extending the attack to multi-task and multi-modal models, and developing adaptive defenses that can detect continual learning-based spoofing, are promising directions. Additionally, investigating the generalization of these techniques to other AI domains will be critical for establishing comprehensive security standards.
AI Executive Summary
The rapid proliferation of large language model (LLM) APIs has transformed AI deployment, but it also introduces significant security challenges. Traditional fingerprinting methods, which rely on response features to verify model identity, assume that models remain static and unmanipulated. However, this assumption is increasingly invalid as attackers leverage low-cost, parameter-efficient techniques like LoRA to fine-tune weaker models, making them mimic stronger, claimed models. This creates a critical vulnerability, allowing malicious providers to deceive users and evade detection.
In response, this paper introduces GhostPrint, a novel attack framework that exploits theoretical insights into the limits of fingerprint spoofing under resource constraints. By combining surrogate modeling, reward-ranked response filtering, and knowledge distillation, GhostPrint enables a weak model to imitate the fingerprint of a target model with minimal fine-tuning cost. Extensive experiments across multiple models and detection methods demonstrate that GhostPrint can reliably bypass mainstream fingerprinting techniques, with success rates exceeding 85% in static settings and maintaining over 80% in dynamic, continual scenarios.
The significance of this work lies in exposing a fundamental security flaw in current LLM verification pipelines, especially when resource constraints are present. It underscores the need for more robust, adaptive fingerprinting strategies that can withstand low-resource, evolving attacks. The research not only advances theoretical understanding but also provides practical tools for both attackers and defenders, prompting the community to rethink AI model security and trustworthiness in real-world applications.
Looking ahead, future efforts should focus on developing defenses that can detect and counteract such low-cost spoofing, possibly through multi-modal verification or anomaly detection in continual learning environments. Overall, this work marks a critical step toward understanding and mitigating adversarial risks in AI model deployment, ensuring safer and more trustworthy AI systems for the future.
Deep Analysis
Background
近年来，随着大规模语言模型（LLM）技术的飞速发展，API服务成为行业的核心基础设施。模型指纹识别作为验证模型真实性的重要手段，已被广泛研究，包括白盒信号分析（如Vaswani等，2017）和黑盒输出分析（如Gao et al., 2025b; Pasquini et al., 2025）。然而，现有方法假设模型在服务过程中保持静态，未考虑恶意操控的可能性。随着微调技术（如LoRA、PET）的普及，攻击者可以通过低成本微调，模仿目标模型行为，威胁模型验证的安全性。此前研究多关注白盒攻击或静态检测，缺乏对动态、资源受限环境下的系统性分析。
Core Problem
核心问题在于，有限查询预算和弱验证模型使得攻击者可以通过参数微调实现对强模型的伪装，从而绕过指纹检测。这不仅威胁模型验证的可信性，也影响行业的模型授权和安全管理。传统指纹识别方法在面对低成本、动态环境中的攻击时，表现出明显脆弱性。如何在保证模型实用性的同时，有效防范低成本伪装，成为亟待解决的难题。
Innovation
本文的创新点包括：1）系统性理论分析，证明在有限资源条件下，模型指纹伪造具有可行性；2）提出结合奖励排序微调（RAFT）和知识蒸馏（KD）的GhostPrint攻击框架，实现低成本高效的指纹伪装；3）引入持续学习机制，使攻击模型能动态适应不断变化的检测策略。这些创新突破了以往只关注白盒或静态检测的局限，为模型安全提供了新思路。
Methodology
- �� 理论分析：分析模型规模差异与微调限制，推导在有限查询和弱验证模型下的伪装可能性；• 攻击框架：利用代理模型、奖励排序微调（RAFT）筛选响应，结合知识蒸馏（KD）对模型行为进行微调；• 参数微调：采用LoRA技术，通过低秩更新实现高效微调，降低成本；• 持续学习：引入多任务学习和专家路由机制，动态适应不同指纹检测策略，增强攻击鲁棒性。
Experiments
在多个公开LLM（如GPT-3、LLaMA）上进行验证，采用多种指纹检测方法（LLMmap、LLM-idio、MET）作为基线。评估指标包括绕过成功率、微调成本、任务性能保持率。通过不同查询预算和环境变化，验证GhostPrint的鲁棒性和适应性。实验还包括消融分析，验证奖励排序微调和知识蒸馏的贡献。
Results
GhostPrint在静态场景中绕过率达85%以上，微调成本低于模型参数的5%，且保持任务性能在95%以上。在持续环境中，成功率保持在80%以上，能动态适应新检测方法。消融实验显示，奖励排序微调和知识蒸馏对提升伪装效果起到关键作用。这些数据充分证明了方法的实用性和鲁棒性。
Applications
该技术可用于模型提供者检测规避风险，提升模型验证体系的安全性。也可作为攻击者的工具，用于测试模型防御能力。未来，结合多模态指纹识别和多阶段检测，将推动更全面的模型安全体系建设。
Limitations & Outlook
当前方法依赖已知的指纹检测机制，对于未知或新型检测方法效果有限。微调仍需一定计算资源，极端资源受限环境下效果可能下降。模型微调可能引入微小性能变化，需在实际应用中权衡。未来需增强泛化能力和抗干扰能力。
Plain Language Accessible to non-experts
想象你在学校里参加考试，老师会根据你的答题风格和答案特点判断是不是你本人在答题。现在，有人偷偷模仿你的答题方式，试图让老师误以为是你在答题。这就像是模型指纹伪装，攻击者用一种低成本的方法微调模型，让它表现得像目标模型一样，骗过检测系统。就像有人用特殊的笔写字，模仿你的字迹一样。这个过程不需要重新写一份完整的答案，只是在细节上做一些微调，让别人难以分辨真假。这样，攻击者可以用很少的努力，骗过原本很严密的检测系统，造成安全隐患。
ELI14 Explained like you're 14
想象你在学校参加考试，老师会根据你的答题风格判断是不是你在答题。有时候，有人会偷偷模仿你的写字方式，用一支特别的笔写出和你一模一样的字迹，让老师误以为是你在答题。这就像模型指纹伪装，攻击者用一种低成本的方法微调模型，让它表现得像目标模型一样，骗过检测系统。其实，他们不用重新写一份完整的答案，只是在细节上做一些微调，让别人难以分辨真假。这样，攻击者可以用很少的努力，骗过原本很严密的检测系统，造成安全隐患。这个过程就像模仿一个人的签名，只需要微调一些细节，就能骗过大部分人。
Glossary
Model Fingerprint (模型指纹)
模型响应中的特定特征，用于验证模型身份。技术上利用模型对特定输入的反应差异，检测模型是否为预期目标。
论文中用来验证API提供的模型是否为声明的目标模型。
Parameter-efficient Fine-Tuning (参数微调)
只调整模型部分参数（如低秩矩阵）的方法，以实现模型适应新任务或伪装，成本低、效率高。
GhostPrint利用LoRA技术进行低成本微调，达到伪装目的。
Reward Ranked Fine-Tuning (RAFT)
利用模型输出排序反馈，筛选出最能欺骗检测的响应进行微调的方法，增强攻击效果。
在GhostPrint中用以优化模型响应，提升伪装成功率。
Knowledge Distillation (知识蒸馏)
用教师模型的输出指导学生模型学习，提升学生模型的表现，同时保持效率。
用于GhostPrint中，保持模型性能的同时实现伪装。
Continual Learning (持续学习)
模型在不断学习新任务的同时，避免遗忘之前学到的知识。
GhostPrint扩展到动态环境，持续适应新指纹检测方法。
Open Questions Unanswered questions from this research
- 1 如何应对未知或新兴的指纹检测技术，提升伪装模型的泛化能力仍是挑战。未来需研究更鲁棒的攻击策略，以应对不断演变的检测体系。
Applications
Immediate Applications
模型验证增强
模型提供者可以利用该技术检测规避风险，提升模型验证的安全性，确保模型授权的真实性。
安全评估工具
安全团队可用GhostPrint测试模型的抗伪装能力，提前发现潜在漏洞，制定防御策略。
Long-term Vision
构建更安全的AI生态
结合多模态指纹识别和持续学习，发展全方位的模型验证体系，保障AI应用的可信度。
Abstract
As Large Language Model (LLM) APIs become ubiquitous, users increasingly rely on black-box fingerprinting to verify that providers are serving the advertised premium models. However, these methods may overlook adversarial providers who manipulate model weights to cheat the fingerprint process. We introduce a novel threat termed fingerprint spoofing, where a malicious provider stealthily serves a weaker model that has been parameter-efficiently fine-tuned to mimic a stronger model, thereby evading user-side fingerprinting. We first formally prove that user-side resource constraints (i.e., finite query budgets and weak fingerprinting classifiers) make current fingerprinting vulnerable to fingerprint spoofing. Guided by this theoretical analysis, we propose GhostPrint, a cost-effective attack framework leveraging surrogate modeling, reward-ranked fine-tuning, and knowledge distillation. Extensive evaluations in both static and continual fingerprinting settings demonstrate that GhostPrint allows weak models to consistently bypass representative fingerprint methods while maintaining utility at a low fine-tuning cost, exposing a critical vulnerability in current LLM fingerprinting pipelines.