LLMmap, presented at USENIX Security 2025, is the first fingerprinting technique designed for LLM-integrated applications. With just 8 carefully crafted queries, it can identify which LLM powers an application—whether open-source or closed-source—with over 95% accuracy across 42 different model versions.
How it works
The core principle is based on domain knowledge: different LLMs produce unique, identifiable response patterns to specific types of "subject variation" prompts. Like handwriting analysis, each model's "linguistic fingerprint" is reflected in word frequency distributions, sentence structure preferences, and content logic.
Notably, this fingerprint is robust against:
- System prompts
- Sampling parameters
- Generation frameworks such as RAG and CoT (Chain-of-Thought)
Countermeasures
The paper discusses why defending against such fingerprinting is difficult—effective fingerprinting defenses may require sacrificing the quality or diversity of the model's responses.
Core insight: LLMs don't just answer questions—they leave an identity signature in every single answer.
Source: [LLMmap / USENIX Security 2025]