Summary
LLMmap, presented at USENIX Security 2025, is the first fingerprinting technique targeting LLM-integrated applications. With as few as 8 carefully crafted queries, it can identify which large language model powers an application with over 95% accuracy, distinguishing between 42 different model versions—both open-source and closed-source. The method relies on domain knowledge: different LLMs produce unique, identifiable response patterns to specific types of "topic variation" prompts. Like handwriting analysis, each model's "linguistic fingerprint" is reflected in word frequency distributions, sentence structure preferences, and content logic. Notably, this fingerprint remains robust against changes to system prompts, sampling parameters, and generation frameworks such as RAG or chain-of-thought. The paper also discusses why countermeasures are difficult: effective fingerprinting defenses may require sacrificing response quality or diversity. The core insight is that LLMs do more than answer questions—they leave a signature of their identity in every response.
LLMmap, presented at USENIX Security 2025, is the first fingerprinting technique targeting LLM-integrated applications. With just 8 carefully crafted queries, it can identify which LLM powers an application with over 95% accuracy—open-source or closed-source, covering 42 different model versions.
The core principle is based on domain knowledge: different LLMs produce unique and identifiable response patterns to specific types of "topic variation" prompts. Like handwriting analysis, each model's "linguistic fingerprint" is reflected in word frequency distributions, sentence structure preferences, and content logic. This fingerprint is robust against system prompts, sampling parameters, and generation frameworks such as RAG and chain-of-thought.
The paper discusses why countermeasures are difficult—effective fingerprinting defenses may require sacrificing the quality or diversity of model responses. *Core insight*: LLMs don't just answer questions—they leave a signature of their identity in every single answer.
[LLMmap / USENIX Security 2025]
This page is an English static mirror generated for search and AI citation.
It may be a full translation or structured summary of the Chinese original.
Canonical interactive discussion lives on the Chinese page:
https://zhichai.net/topic/177619979