FLIPS: Instance-Fingerprinting for LLMs via Pseudo-random Sequences
For AI regulators, this provides a practical method to verify deployed LLM behavior rather than model provenance, addressing a critical gap in current identification techniques.
The paper introduces instance-level fingerprinting for LLMs, distinguishing configurations of the same model (e.g., prompt, sampling) to enable compliance assessments. FLIPS achieves 96% closed-set and 90% open-set accuracy across 237 instances, compared to 35% for the baseline.
Literature reveals that a Large Language Model's (LLM) behavior is not only conditioned by its original weights but also its instance-level parameters, such as instructional prompt, sampling configuration or quantization. A model that generates safe outputs under one configuration may produce toxic content under another. However, current LLM identification techniques (such as fingerprinting) focus on intellectual property protection, and their design favors robustness to changes in these instance-level parameters. This poses a critical challenge for AI regulation in which compliance assessments target actual deployed behaviors, not model provenance. In this paper, we introduce instance-level fingerprinting, a regulator-oriented paradigm that distinguishes configurations of the same LLM. Our method FLIPS, exploits biases in generated binary random sequences to reach 96% (closed-set) and 90% (open-set, where some targets are unknown) identification accuracy across 237 model instances, versus 35% for the adapted LLMmap baseline. This shows that instance-level fingerprinting is both necessary for regulation and practically feasible. Code available at https://github.com/GurvanR/FLIPS-LLM-Instance-Fingerprinting.