Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

CoTSRF: Utilize Chain of Thought as Stealthy and Robust Fingerprint of Large Language Models

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A large language model's chain-of-thought reasoning pattern can serve as a stealthy fingerprint that identifies unauthorized copies.

desk verdict Novel CoT-based fingerprinting idea undercut by a backwards decision rule and in-sample threshold fitting as written. read the letter →

arxiv 2505.16785 v1 pith:GAJBJY6Z submitted 2025-05-22 cs.CR cs.AI

Zhenzhen Ren , GuoBiao Li , Sheng Li , Zhenxing Qian , Xinpeng Zhang This is my paper
classification cs.CRcs.AI
keywords LLMfingerprintingchain-of-thoughtcontrastivelearningblack-boxverificationmodelinfringementdetectionKLdivergenceLoRAfine-tuningstealthyprompts
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes CoTSRF, a fingerprinting method that treats a large language model's chain-of-thought (CoT) reasoning pattern as its unique identifier. The claim is that the step-by-step logical path an LLM produces when prompted to 'think step by step' reflects the model's architecture, training data, and training strategy, and therefore separates one model from another. CoTSRF queries the source LLM with natural CoT prompts, uses high-temperature sampling to generate diverse responses with the same reasoning pattern, and trains a contrastive feature extractor so that responses from the same model map close together while responses from other models map far apart. Verification against a suspect API then compares the distribution of feature distances using KL divergence against an empirical threshold. In experiments on three 7-billion-parameter open-source models, the paper reports 100.00% true-positive and 0.00% false-positive rates with 100 queries, and shows the method keeps working under temperature changes and LoRA fine-tuning.

What carries the argument

The central machinery is the CoT feature: a vector representation of an LLM's step-by-step reasoning, produced by a Longformer encoder trained with contrastive (triplet margin) loss. The training objective makes responses from the same source model close to one another and responses from different models far apart, using high-temperature augmented responses as positives and responses from benign LLMs as negatives. Verification then relies on a distribution-level test: the KL divergence between the kernel-density-estimated distribution of source-to-source CoT feature distances and the distribution of source-to-suspect distances, compared against the empirical threshold $\tau$. The chain-of-thought prompt itself is the stealth mechanism, since it is an ordinary, low-perplexity instruction rather than an adversarial prefix.

What would settle it

Train two LLMs independently with the same architecture, the same training data, and the same training protocol but different random seeds, then run CoTSRF treating one as the source and the other as the suspect. If the benign twin is classified as infringing, or if the KL divergence between their CoT feature distance distributions falls below the empirical threshold $\tau$, then CoT does not uniquely characterize the source model.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that an LLM's logical reasoning pattern, as expressed through chain-of-thought responses, is a stable internal attribute that can uniquely characterize the model. CoTSRF extracts this pattern by training a CoT extractor with a triplet margin loss on responses sampled at high temperature from the source model (positive examples) and responses from benign models (negative examples). For verification, it computes two sets of Euclidean distances between CoT features—distances between two source responses to the same query, and distances between a source response and the suspect's response—and fits kernel density estimates to each set. A suspect model is declared infringing exactly when the KL divergence between the two distance distributions reaches an empirically chosen threshold. The paper reports that this procedure distinguishes unauthorized copies from benign models with 100% true positive rate and 0% false positive rate in its primary experiments, even after temperature perturbation and LoRA fine-tuning attacks.

Load-bearing premise

The load-bearing premise is that chain-of-thought reasoning patterns are stable and distinctive enough for a given LLM that any unauthorized copy, even after fine-tuning, remains closer to the source model in feature space than any independently trained benign model.

Editorial extensions

If this is right

  • A model provider with only black-box API access to a suspect service can verify whether it is running an unauthorized copy of the released model.
  • Because the fingerprint queries are ordinary chain-of-thought prompts with low perplexity, a malicious developer's perplexity-based query filter will not block them.
  • Feature-level matching keeps detection accurate when the infringer changes sampling temperature or fine-tunes the model with LoRA, because the reasoning pattern is reported to survive those modifications.
  • CoTSRF can fingerprint models that were already released without any watermark, filling a gap left by watermarking methods that must be applied before release.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond binary infringement verdicts, the same CoT feature space could support model attribution—identifying which open-source base model an unknown API is built on—since the paper's distance distributions separate different model families.
  • The threshold $\tau$ is calibrated per source LLM against known benign models; putting CoTSRF into practice would require a documented procedure for setting $\tau$ when the set of benign models is not predetermined.
  • A stress test the paper does not run is whether paraphrasing or reformatting the CoT responses (rather than changing temperature) erases the fingerprint; if it does, the method's robustness depends on the extractor ignoring surface form rather than on reasoning content alone.
  • The admitted identical-architecture corner case implies the method's real-world validity rests on the diversity of training pipelines; as open-source models increasingly share base architectures and data, the separation that makes CoT fingerprints work could shrink.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes CoTSRF, a method for black-box fingerprinting of open-source LLMs using Chain of Thought (CoT) responses. The method collects CoT responses from a source LLM and benign LLMs, trains a contrastive feature extractor with triplet loss, and then verifies infringement by comparing the KL divergence between distributions of Euclidean distances of CoT features for the source and a suspect LLM against an empirically chosen threshold. The authors claim high TPR and low FPR, stealthiness against perplexity-based filtering, and robustness to temperature and fine-tuning attacks. The evaluation uses three open-source LLMs as sources, the other two as benign models, and also tests two unseen benign LLMs.

Significance. If the reported results were valid, CoTSRF would be a meaningful advance in black-box LLM fingerprinting, particularly for its stealthiness and robustness relative to prior work like TRAP. The paper is one of the first to propose CoT as a fingerprint signal and to use contrastive learning for this task; this direction is worth exploring. However, the current evaluation has severe internal inconsistencies and circularities that make the central claim unsupported; the promise of the idea is not matched by the evidence as presented.

major comments (5)
  1. [Section 4.3 and Table 1] The verification rule is stated as 'identify the suspect LLM MV as an infringing LLM if KL(DS||DV) ≥ τ, and as a benign LLM otherwise.' This rule is contradicted by the reported results in Table 1: for every source and both query counts, the SI-KL values are far below the chosen τ (e.g., guanaco-7b-HF I=50 gives SI-KL=1.5 with τ=8.0; Llama-2-7b-chat-hf I=50 gives 8.9 with τ=85). Under the stated rule, these infringing cases would be classified as benign, so the reported 100% TPR cannot be produced by the described algorithm. If the intended rule is KL ≤ τ, then the text, equations, and threshold-based decision procedure are all written incorrectly, and the threshold selection would still need to be justified on data independent of the TPR/FPR evaluation.
  2. [Section 5.2 (Effectiveness)] The effectiveness experiments do not test the threat model described in Section 3.1. In Table 1, the "infringing LLM" is simply the source LLM itself: the TPR is obtained by conducting fingerprint verification 100 times for each source LLM, i.e., comparing the source against its own responses. This measures the ability to distinguish the source from other off-the-shelf models, not the ability to detect an unauthorized copy that has been fine-tuned or modified by a downstream developer. The only fine-tuning experiment appears in Table 5, which is limited to a single source (Llama-2-7b-chat-hf) and does not report comparison with independently fine-tuned copies of other sources or with a proper set of unseen benign models to establish FPR. The central claim of detecting infringing copies is therefore untested.
  3. [Section 5.1 and Table 1] The thresholds τ are empirically set using the same data that is used to compute TPR and FPR in Table 1. Section 5.1 states that τ is 'empirically set to 8.0, 85.0, and 18.0' after the SI-KL and SB-KL values are known, and Table 1 reports SI-KL, SB-KL, and the resulting TPR/FPR on the same source/benign responses. This creates an evaluation loop: the threshold is chosen to maximize separation on the very data being evaluated, so the reported 100% TPR and 0% FPR are in-sample results. An independent validation set (e.g., held-out queries or held-out benign models) must be used to select τ before reporting out-of-sample TPR/FPR. The unseen benign LLM results in Table 2 are a step in the right direction, but the thresholds remain fitted to the training benign models, and the positive case is still the source itself.
  4. [Section 2.3 and Section 7] The paper's foundational assumption that CoT is a unique and stable fingerprint of an LLM is not established. Section 2.3 asserts that CoT is an internal attribute highly related to architecture, training data, and training strategy, but Section 7 admits that two entities with identical architecture and training protocol could produce nearly indistinguishable reasoning pathways. This limitation directly undermines the infringement-detection scenario: a fine-tuned copy may legitimately differ in reasoning, while an independently trained model with similar training data could be closer in feature space. No experiment measures the variation of CoT features across independently trained models with the same architecture or with overlapping training data. The current experiments only compare a few distinct public models, which is insufficient to support the uniqueness claim.
  5. [Section 4.2 and Section 5.2] The KL divergence in Eq. (4) is computed over KDE-estimated densities of Euclidean distances, with 50 or 100 samples per distribution. The paper does not report confidence intervals or variance of SI-KL/SB-KL across the 100 verification repetitions, nor does it describe how the 100 repetitions are obtained. Since the distances are estimated from a small number of queries, the stability of the KDE and the KL estimate is unclear. This is important because the threshold τ is a single number and the method's robustness claims depend on the separation between DS and DV being stable.
minor comments (5)
  1. [Throughout] There are numerous typos and grammatical issues, e.g., 'fedding' (Section 4.1), 'Bengin' (Figure 2 caption), 'Cot' for 'CoT' (Section 2.3), 'campus' for 'camps' (Section 2.3), 'TARP' for 'TRAP' (Figure 4), and inconsistent model names ('internLM2.5-7b' vs 'internlm2_5-7b-chat'). A careful proofread is needed.
  2. [Section 5.2] The text says 'conduct fingerprint verification 100 times' but does not specify what varies across these 100 runs; please clarify whether the queries are resampled, the responses are re-generated, or the model is re-queried with different random seeds.
  3. [Section 4.3] In Eq. (4), the KL divergence is asymmetric, but the paper does not explain why KL(DS||DV) is chosen over KL(DV||DS) or a symmetric variant. Since the KDE estimates are noisy with small samples, the asymmetry could affect threshold calibration; a brief justification would be helpful.
  4. [Section 5.5.1] In Table 4, the guanaco-7b-HF row shows FPR rising from 1.0% at T=1.6 to 85.5% at T=1.8, which contradicts the general claim of robustness at 'moderate temperatures' if 1.8 is considered moderate; the paper's dismissal of T=1.8 as 'extreme' is not fully supported by the data.
  5. [Section 5.4] The stealthiness evaluation only compares perplexity values; it would be useful to also discuss whether a realistic developer would use a perplexity threshold of 1204.5 and whether a CoT prompt with 'Let's first understand the problem' is truly indistinguishable from normal user queries in practice.

Circularity Check

2 steps flagged · score 6.0 of 10

The 100% TPR / 0% FPR reported for the training benign models and the empirically set thresholds are in-sample artifacts of the contrastive objective and threshold selection; the unseen-benign evaluations supply independent content.

  1. fitted input called prediction [Section 4.2, Eq. (1); Section 5.3 (FPR on training benign models)]
    "For reliable fingerprint verification, the extracted CoT features should be similar for the two responses that are both derived from the source LLM but be different when one of them is generated by the benign LLM. To achieve this, contrastive learning with a triplet loss function is adopted to train the CoT extractor. ... The FPR results in Table 1 are 0.00% in all cases, indicating that the proposed CoTSRF can effectively identify the benign LLMs used for training the CoT extractor Eθ(·)."

    The triplet loss in Eq. (1) explicitly optimizes Eθ so that responses of the source LLM (positive pairs) are close in Euclidean distance while source-vs-benign pairs (negative pairs) are separated by at least the margin δ. Table 1's FPR is then computed on the same two benign LLMs that supplied the negative pairs during training, as Section 5.3 confirms by saying those FPRs measure identification of 'the benign LLMs used for training the CoT extractor Eθ(·)'. The 0% FPR on those identities is therefore a direct consequence of the training objective, not an independent prediction. The unseen-benign experiments in Table 2 are a genuine out-of-sample check, which is why this is partial rather than total circularity.

  2. fitted input called prediction [Section 5.1 (threshold setting) and Section 5.2 (Table 1)]
    "For fingerprint verification, the thresholds τ for vicuna-7b-v1.3, Llama-2-7b-chat-hf, and guanaco-7B-HF are empirically set to 8.0, 85.0, and 18.0, respectively. ... We can see that the difference in values between SI-KL and SB-KL is significant, indicating that the distance between the CoT features of benign LLMs and the source LLM is much greater than that between infringing LLMs and the source LLM."

    Each τ is chosen after observing the SI-KL and SB-KL values in Table 1 and placed between them (e.g., τ=8.0 with SI-KL=1.5 and SB-KL=303.6). Because τ is 'empirically set' on the same source and benign response distributions that Table 1 then classifies, the reported 100% TPR / 0% FPR for those rows is an in-sample evaluation of a fitted decision boundary. A clean protocol would fix τ on a validation fold before measuring TPR/FPR on held-out data; the unseen benign runs in Table 2 are a partial correction, so the circularity is real but not total.

full rationale

Score 6: the central effectiveness table is partly built from the training objective and threshold fit. Section 4.2's triplet loss separates the training benign models from the source by construction, and Section 5.1's τ is selected on the same distributions, so Table 1's 100% TPR / 0% FPR numbers are not out-of-sample evidence. However, the paper does include an independent test: Table 2 uses benign models (internlm2_5-7b-chat, llama3.1-8b-instruct) not seen during extractor training, and the temperature and LoRA fine-tuning robustness tests are not forced by the loss. These independent results support the central claim, so the paper is not wholly circular. No load-bearing self-citations were found. Separately, and not scored as circularity, Section 4.3's decision rule (infringing iff KL(DS||DV) ≥ τ) is inconsistent with Table 1, where every reported SI-KL is below τ; that is a correctness issue rather than a circularity pattern. Section 7 also honestly concedes that identical architectures and training protocols could defeat the method, which is a limitation of the underlying assumption, not a circular step.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central verification depends on a per-source threshold tau, a hand-chosen margin delta and HTDA parameters, plus domain assumptions about CoT uniqueness, distributional stability, threshold generalization, and the validity of GPT-2 perplexity as a filter proxy. No invented entities are introduced.

free parameters (5)
  • per-source KL threshold tau = 8.0, 85.0, 18.0 (values inconsistent between Section 5.1 text and Table 1).
    Set empirically so that SI-KL and SB-KL separate; all TPR/FPR in Table 1 use this threshold, so performance is in-sample.
  • triplet margin delta = 5
    Hand-chosen hyperparameter in Eq. (1); no sensitivity analysis is provided.
  • HTDA temperature T = 1.5
    Hand-chosen to generate diverse positive responses; no ablation is reported.
  • responses per query J = 4
    Hand-chosen; only the first three responses are used at verification time.
  • number of CoT queries I = 50 or 100
    Selected as a query budget; no sensitivity analysis is shown.
assumptions (4)
  • domain assumption CoT is an internal attribute determined by architecture, training data, and training strategy.
    Invoked in Sections 1 and 2.3 to justify using CoT as a fingerprint; supported only by citations to Feng et al. 2024 and Liu et al. 2024b, not by an experiment in this paper.
  • ad hoc to paper An infringing model produces CoT feature distances to the source that resemble within-source distances.
    The verification rule in Section 4.3 assumes the suspect distribution DV will be close to the source-internal distribution DS; the only supporting experiment is one LoRA fine-tune in Section 5.5.2.
  • ad hoc to paper A per-source threshold calibrated on the source and two benign LLMs generalizes to unseen suspects.
    Thresholds are set empirically in Section 5.1 with no calibration or holdout protocol; Table 2 provides the only generalization evidence, and it covers benign models only.
  • domain assumption GPT-2 perplexity is a valid proxy for a malicious developer's prompt filter.
    Stealthiness in Section 5.4 is measured only with GPT-2 perplexity; no actual filter module is tested.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CoTSRF: Utilize Chain of Thought as Stealthy and Robust Fingerprint of Large Language Models." pith.science (2026). https://pith.science/paper/GAJBJY6Z

@misc{pith2026250516785,
  author       = {Pith},
  title        = {Pith review of: CoTSRF: Utilize Chain of Thought as Stealthy and Robust Fingerprint of Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GAJBJY6Z}},
  note         = {Machine review of arXiv:2505.16785}
}
read the original abstract

Despite providing superior performance, open-source large language models (LLMs) are vulnerable to abusive usage. To address this issue, recent works propose LLM fingerprinting methods to identify the specific source LLMs behind suspect applications. However, these methods fail to provide stealthy and robust fingerprint verification. In this paper, we propose a novel LLM fingerprinting scheme, namely CoTSRF, which utilizes the Chain of Thought (CoT) as the fingerprint of an LLM. CoTSRF first collects the responses from the source LLM by querying it with crafted CoT queries. Then, it applies contrastive learning to train a CoT extractor that extracts the CoT feature (i.e., fingerprint) from the responses. Finally, CoTSRF conducts fingerprint verification by comparing the Kullback-Leibler divergence between the CoT features of the source and suspect LLMs against an empirical threshold. Various experiments have been conducted to demonstrate the advantage of our proposed CoTSRF for fingerprinting LLMs, particularly in stealthy and robust fingerprint verification.

Figures

Figures reproduced from arXiv: 2505.16785 by the authors.

Figure 1
Figure 1. LLM fingerprint verification process of the proposed method in a black-box access setting, where the [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Framework of the proposed CoTSRF. 3.2 Designed Goals The design of the LLM fingerprinting method should satisfy the following properties: 1) Effectiveness: the fingerprint should accu￾rately identify the infringing LLM; 2) Reliability: false positives, where the finger￾print misidentifies a benign LLM released by other providers as an infringing LLM, should be minimized; 3) Stealthiness: the fingerprint queries shou… view at source ↗
Figure 3
Figure 3. Distribution of the Euclidean distance between the CoT features of the source LLM and those of the [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: TPR of CoTSRF and TRAP under different temperature settings (from 0.2 to 1.8). gerprint queries generated by different methods, with the last row showing the perplexity of normal queries (i.e., reasoning questions without a CoT prompt or adversarial prefix). We can obs…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models

    cs.CL 2025-09 conditional novelty 4.0 of 10

    A structured literature survey concluding that reasoning capabilities do not automatically make LLMs more trustworthy and can introduce new vulnerabilities in safety, robustness, and privacy.

Reference graph

Works this paper leans on

38 extracted references · 12 canonical work pages · cited by 1 Pith paper

  1. [1]

    URL: " 'urlintro :=

    ENTRY address author booktitle chapter edition editor howpublished institution journal key month note number organization pages publisher school series title type volume year eprint doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRINGS urlintro eprinturl eprintpr...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Iz Beltagy, Matthew E Peters, and Arman Cohan. 2020. Longformer: The long-document transformer. arXiv preprint arXiv:2004.05150

    arXiv 2020

  4. [4]

    Qi Chen and Dexi Liu. 2023. Dynamic strategy chain: Dynamic zero-shot cot for long mental health support generation. arXiv preprint arXiv:2308.10444

    work page Pith review arXiv 2023

  5. [5]

    Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90\ See https://vicuna. lmsys. org (accessed 14 April 2023), 2(3):6

    2023

  6. [6]

    XTuner Contributors. 2023. Xtuner: A toolkit for efficiently fine-tuning llm

    work page 2023

  7. [7]

    Creative Commons . 2024. Noncommercial licenses. https://wiki.creativecommons.org/wiki/NonCommercial_interpretation. [Online; accessed 2024-08-22]

    work page 2024

  8. [8]

    Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. 2024. Qlora: Efficient finetuning of quantized llms. Advances in Neural Information Processing Systems, 36

    2024

Show all 38 references
  1. [9]

    P Kingma Diederik. 2014. Adam: A method for stochastic optimization. (No Title)

    2014

  2. [10]

    Guhao Feng, Bohang Zhang, Yuntian Gu, Haotian Ye, Di He, and Liwei Wang. 2024. Towards revealing the mystery behind chain of thought: a theoretical perspective. Advances in Neural Information Processing Systems, 36

    2024

  3. [11]

    Free Software Foundation . 2024. Gnu general public license. https://www.gnu.org/licenses/gpl-faq.html. [Online; accessed 2024-08-22]

    2024

  4. [12]

    Hila Gonen, Srini Iyer, Terra Blevins, Noah A Smith, and Luke Zettlemoyer. 2022. Demystifying prompts in language models via perplexity estimation. arXiv preprint arXiv:2212.04037

    2022 arXiv

  5. [13]

    Jiyang Guan, Jian Liang, and Ran He. 2022. Are you stealing my model? sample correlation for fingerprinting deep neural networks. Advances in Neural Information Processing Systems, 35:36571--36584

    2022

  6. [14]

    Martin Gubri, Dennis Ulmer, Hwaran Lee, Sangdoo Yun, and Seong Joon Oh. 2024. Trap: Targeted random adversarial prompt honeypot for black-box identification. arXiv preprint arXiv:2402.12991

    2024 arXiv

  7. [15]

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2021. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685

    2021 arXiv

  8. [16]

    Xijie Huang, Li Lyna Zhang, Kwang-Ting Cheng, and Mao Yang. 2023. Boosting llm reasoning: Push the limits of few-shot learning with reinforced in-context pruning. arXiv preprint arXiv:2312.08901

    2023 arXiv

  9. [17]

    Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. 2022. Large language models are zero-shot reasoners. Advances in neural information processing systems, 35:22199--22213

    2022

  10. [18]

    o pf, Yannic Kilcher, Dimitri von R \

    Andreas K \"o pf, Yannic Kilcher, Dimitri von R \"u tte, Sotiris Anagnostidis, Zhi Rui Tam, Keith Stevens, Abdullah Barhoum, Duc Nguyen, Oliver Stanley, Rich \'a rd Nagyfi, et al. 2024. Openassistant conversations-democratizing large language model alignment. Advances in Neura...

    2024

  11. [19]

    Peixuan Li, Pengzhou Cheng, Fangqi Li, Wei Du, Haodong Zhao, and Gongshen Liu. 2023. Plmmark: a secure and robust black-box watermarking framework for pre-trained language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 14991--14999

    2023

  12. [20]

    Wenhao Liu, Tianxing Bu, Erchen Yu, Dailin Li, Ding Ai, Zhenyi Lu, and Haoran Luo. 2024 a . Optimizing few-shot learning: From static to adaptive in qwen2-7b. In Amazon KDD Cup 2024 Workshop

    2024

  13. [21]

    Xiao Liu, Zirui Wu, Xueqing Wu, Pan Lu, Kai-Wei Chang, and Yansong Feng. 2024 b . Are llms capable of data-based statistical and causal reasoning? benchmarking advanced quantitative reasoning with data. arXiv preprint arXiv:2402.17644

    2024 arXiv

  14. [22]

    Nils Lukas, Yuxuan Zhang, and Florian Kerschbaum. 2019. Deep neural network fingerprinting by conferrable adversarial examples. arXiv preprint arXiv:1912.00888

    2019 arXiv

  15. [23]

    Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. 2023. Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark. arXiv preprint arXiv:2305.10036

    2023 arXiv

  16. [24]

    Zirui Peng, Shaofeng Li, Guoxing Chen, Cheng Zhang, Haojin Zhu, and Minhui Xue. 2022. Fingerprinting deep neural networks globally via universal adversarial perturbations. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13430--13439

    2022

  17. [25]

    Yuhui Quan, Huan Teng, Ruotao Xu, Jun Huang, and Hui Ji. 2023. Fingerprinting deep image restoration models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 13285--13295

    2023

  18. [26]

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9

    2019

  19. [27]

    Chan Hee Song, Jiaman Wu, Clayton Washington, Brian M Sadler, Wei-Lun Chao, and Yu Su. 2023. Llm-planner: Few-shot grounded planning for embodied agents with large language models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2998--3009

    2023

  20. [28]

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth \'e e Lacroix, Baptiste Rozi \`e re, Naman Goyal, Eric Hambro, Faisal Azhar, et al. 2023. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971

    2023 arXiv

  21. [29]

    Lei Wang, Wanyu Xu, Yihuai Lan, Zhiqiang Hu, Yunshi Lan, Roy Ka-Wei Lee, and Ee-Peng Lim. 2023. Plan-and-solve prompting: Improving zero-shot chain-of-thought reasoning by large language models. arXiv preprint arXiv:2305.04091

    2023 arXiv

  22. [30]

    Shen Wang, Tianlong Xu, Hang Li, Chaoli Zhang, Joleen Liang, Jiliang Tang, Philip S Yu, and Qingsong Wen. 2024 a . Large language models for education: A survey and outlook. arXiv preprint arXiv:2403.18105

    2024 arXiv

  23. [31]

    Xiyue Wang, Junhan Zhao, Eliana Marostica, Wei Yuan, Jietian Jin, Jiayu Zhang, Ruijiang Li, Hongping Tang, Kanran Wang, Yu Li, et al. 2024 b . A pathology foundation model for cancer diagnosis and prognosis prediction. Nature, 634(8035):970--978

    2024

  24. [32]

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824--24837

    2022

  25. [33]

    Chunqiu Steven Xia, Yinlin Deng, Soren Dunn, and Lingming Zhang. 2024. Agentless: Demystifying llm-based software engineering agents. arXiv preprint arXiv:2407.01489

    2024 arXiv

  26. [34]

    Jiashu Xu, Fei Wang, Mingyu Derek Ma, Pang Wei Koh, Chaowei Xiao, and Muhao Chen. 2024. Instructional fingerprinting of large language models. arXiv preprint arXiv:2401.12255

    2024 arXiv

  27. [35]

    Xiaosong Yuan, Chen Shen, Shaotian Yan, Xiaofeng Zhang, Liang Xie, Wenxiao Wang, Renchu Guan, Ying Wang, and Jieping Ye. 2024. Instance-adaptive zero-shot chain-of-thought prompting. arXiv preprint arXiv:2409.20441

    2024 arXiv

  28. [36]

    Boyi Zeng, Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu Yu, and Zhouhan Lin. 2023. Huref: Human-readable fingerprint for large language models. In The Thirty-eighth Annual Conference on Neural Information Processing Systems

    2023

  29. [37]

    A dnn fingerprint for non-repudiable model ownership identification and piracy detection

    Yue Zheng, Si Wang, and Chip-Hong Chang. A dnn fingerprint for non-repudiable model ownership identification and piracy detection. IEEE Transactions on Information Forensics and Security, 17

  30. [38]

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.