Overview
The post covers the paper LLM Self-Recognition: Steering and Retrieving Activation Signatures by Thibaud Ardoin, Jonas Schäfer, and Gerhard Wunder (BMBF-funded).
- Paper: arxiv.org/abs/2606.06315
- Code: github.com/Thibaud-Ardoin/LLM-Self-Recognition
- Setup: 8192 BBC articles from XL-Sum; models generate 1–2 sentence summaries to compare against human-written ones (a low-entropy, hard-to-distinguish setting).
- Method: feed text back into the model, average activations across tokens at an intermediate layer, classify with LDA.
- Results (AUROC):
- Perplexity baselines collapse to 32–52% AUROC without prompt access; the activation-based method barely degrades.
- Text generated with steering, when fed back into the unsteered model, can be attributed by raw cosine similarity to the steering vector — no trained classifier — at 84.6% text-level accuracy.
- After DIPPER-XXL paraphrasing: still 77.8%.
- Conclusion: the steering signal is physically encoded in the token sequence, not statistical noise.
- KGW watermark F1: ~95% → ~60%
- Activation signatures: ~99% → ~89%
- AI content auditing: far more reliable than perplexity-based detection.
- Model provenance: distinguish deployment instances of the same base model.
- Watermark design: sparse activation engineering is a lightweight, low-quality-loss watermarking scheme.
- Code is open source (Llama-3.1-8B based), so reproduction is inexpensive.
Key points
LLMs naturally recognize their own text
| Model | With prompt | Without prompt | |---|---|---| | Ministral-3-8B | 100% | 99.99% | | Llama-3.1-8B | 99.99% | 99.16% | | Llama-3.2-3B | 99.96% | 99.03% | | Llama-3.2-1B | 99.82% | 98.58% |
Instance fingerprinting via sparse steering vectors
1. Generate a random sparse vector v (99.7% zero dimensions). 2. During generation, add α·v to intermediate-layer activations per token. 3. At detection time, extract activations and classify which steering vector produced the text.
Sparsity matters: in high dimensions, sparse vectors perturb few dimensions, minimally disturbing the semantic manifold while remaining detectable.
| Model | Token F1 | Text F1 | |---|---|---| | Ministral-3-8B | 99.3% | 100% | | Llama-3.1-8B | 94.0% | 99.1% | | Llama-3.2-3B | 83.3% | 95.5% | | Llama-3.2-1B | 72.0% | 85.3% |
Larger models carry stronger signals; text-level majority voting largely eliminates per-token noise.
The signal survives discretization
Sparse vs. dense vectors
At equal detectability, sparse vectors hurt text quality far less than dense ones — the recommended choice for production watermarking.
Robustness vs. paraphrasing
Under DIPPER-XXL paraphrasing:
The activation method degrades less because it aggregates signals across many tokens at a higher representational level.
Limitations
1. White-box assumption: detection requires internal activation access — unsuitable for closed APIs. 2. Architecture boundary: cross-architecture detection drops to random (Llama signatures invisible to Mistral). 3. Forgery risk: attackers who know the steering vector and layer can fake signatures; the paper suggests dynamic steering (pseudo-random vector rotation) as a countermeasure.