Large language models (LLMs) are high-value assets that can be derived through redeployment, fine-tuning, quantization, or further alignment. Because deployed LLMs are commonly exposed only through query APIs, ownership verification must often rely on black-box text responses. This setting is difficult: generations are open-ended and can vary across repeated queries, while existing black-box fingerprints rely on signals that are fragile under a final-response interface, including full-text matching, soft behavioral features, or model-specific prompts designed not to transfer. We propose TCF (Targeted Counterfactual Fingerprinting), a black-box LLM fingerprinting framework that converts open-ended generation comparison into constrained-answer targeted counterfactual transfer. TCF restricts each verification query to a finite answer space, reducing the surface-form ambiguity that enters the verification score, and optimizes a prompt perturbation toward a counterfactual target different from the protected model's clean answer on the original prompt. Verification reduces to checking whether the suspect model's parsed final answer matches the recorded target. We introduce the source-model counterfactual margin (SCM), a protected-model-only quantity that certifies the target is unlikely before the perturbation and likely after it; SCM controls target selection, perturbation stopping, and fingerprint filtering. Under explicit derived-preservation and independent-transfer budgets motivated by local behavioral closeness, we derive a target-accuracy gap between derived and independent models. Across four LLM families, TCF achieves an average AUC of 0.9861, improving over TRAP, ProFLingo, and ZeroPrint by 0.07 to 0.19.
Yu-Tong Wu, Xiaofan Bai, Shixin Li et al.· 0 citations
As Retrieval-Augmented Generation (RAG) brings Large Language Models (LLMs) into contact with proprietary and user-specific knowledge bases in sensitive domains, protecting the privacy of both queries and knowledge content becomes a critical requirement. The RAG pipeline, however, exposes sensitive information at two distinct surfaces: (i) during retrieval, embeddings from both queriers and knowledge bases can leak sensitive information, and embedding inversion techniques can reconstruct source text from these representations; and (ii) during generation, exposing raw passages to the LLM jeopardizes proprietary and regulated content. Existing defenses provide partial protection or rely on differential privacy (DP) at the cost of severe utility loss. We propose DP2-RAG, a framework that provides efficient end-to-end DP guarantees for both retrieval and generation while preserving usability. DP2-RAG introduces two mechanisms: Noise-Aware Retrieval with Correction (NARC) enforces chunk-level DP by adding calibrated noise and correcting ranking bias to mitigate accuracy degradation, and Dual Utility-Exponent Mechanism (DUEM) guarantees token-level DP for generated surrogates through a two-layer exponential mechanism while maintaining semantic fidelity. We formally prove $(\epsilon,\delta)$ -DP for both stages and the composed pipeline. Extensive evaluation on six benchmarks shows that DP2-RAG reduces privacy leakage by over 15% relative to strong baselines, retains near-baseline Top- $k$ retrieval accuracy, achieves state-of-the-art semantic consistency among DP-based systems, and incurs minimal latency overhead. These results demonstrate that DP2-RAG makes privacy-preserving RAG practical for sensitive domains.
Yuxuan Cai, Chao-Xiang He, Hong-Sheng Hu et al.· IEEE Transactions on Informa...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
