Summary
LLMmap, presented at USENIX Security 2025, is the first fingerprinting technique targeting LLM-integrated applications. Using only 8 carefully crafted queries, it identifies which large language model powers an application with over 95% accuracy, distinguishing between 42 different versions of both open-source and closed-source models. The approach relies on domain knowledge: different LLMs produce unique, recognizable response patterns to specific types of 'topic variation' prompts, similar to handwriting analysis. A model's 'linguistic fingerprint' is reflected in word frequency distributions, sentence structure preferences, and content logic. Notably, this fingerprint remains robust against variations in system prompts, sampling parameters, and generation frameworks such as RAG and Chain-of-Thought. The authors also discuss why countermeasures are difficult: effective fingerprint defenses may require sacrificing model response quality or diversity. The core insight is that LLMs do not merely answer questions—they leave an identity signature in every response.
LLMmap, presented at USENIX Security 2025, is the first fingerprinting technique designed for LLM-integrated applications. With only 8 carefully crafted queries, it can identify which LLM model powers an application behind the scenes with over 95% accuracy—whether open-source or closed-source, covering 42 different model versions.
The core principle is based on domain knowledge: different LLMs produce unique and recognizable response patterns when given specific types of "topic variation" prompts. It works like handwriting analysis—each model's "linguistic fingerprint" is reflected in word frequency distributions, sentence structure preferences, and content logic. This fingerprint is robust against variations in system prompts, sampling parameters, and generation frameworks such as RAG and Chain-of-Thought (CoT).
The paper also discusses the difficulty of countermeasures—effective fingerprinting defenses may require sacrificing the quality or diversity of model responses. *Key insight*: LLMs don't just answer questions—they leave a signature of their identity in every single response.
Source: [LLMmap / USENIX Security 2025]
This page is an English static mirror generated for search and AI citation.
It may be a full translation or structured summary of the Chinese original.
Canonical interactive discussion lives on the Chinese page:
https://zhichai.net/topic/177619979