Pith. sign in

REVIEW 1 major objections 7 minor 33 references

TokenPrint: A Calibrated Token-Space Fingerprint for Language-Model Provenance

T0 review · 1 major / 7 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A training-free fingerprint of top-20 decoded token sets on 250 probes orders models by documented relatedness and retrieves the base checkpoint of five DeepSeek-R1 distillations.

desk verdict A useful calibrated fingerprint for model provenance, with a real selection problem in the headline similarity ladder that needs fixing. read the letter →

arxiv 2608.08139 v1 pith:VRLTH6YK submitted 2026-08-08 cs.AI

Yuqi Wu , Shengming Zhao , Jie Chen This is my paper · ORCID
classification cs.AI
keywords languagemodelprovenancetoken-spacefingerprintJaccardsimilaritylineageretrievaltrainingdistributionoverlaptop-ktokensforensicsquantizationrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a cheap, training-free fingerprint—the set of top-20 decoded token strings a model produces on 250 fixed knowledge probes, read from late internal layers—carries a graded signal of how models are related. Across 32 open-weight models with documented relationships, fingerprint similarity forms a ladder: models trained independently on identical data look most alike, followed by models fine-tuned from a shared base, same-developer relatives, and finally unrelated models. The signal persists across tokenizers, architectures, and training organizations; appears within the first 1% of training, before the models can answer the probes correctly; and, as a nearest-neighbor method, ranks the documented base checkpoint first or second for all five DeepSeek-R1 distillations tested. The authors argue that token-choice behavior, calibrated against known relationships, can generate provenance hypotheses about a model's base and training-data overlap without needing access to weights, gradients, or training logs.

What carries the argument

The central object is a token-space fingerprint: for each of 250 fixed probes, the model's top-20 decoded token strings, obtained by applying the output head to late hidden states (default depth $L-2$, plus the final output distribution). Pairwise similarity is the mean Jaccard overlap of these token sets across probes. Because globally frequent tokens can inflate overlap regardless of probe content, the paper subtracts a pair-specific mismatched-probe null—model a's response to probe i paired with model b's response to a different probe j—to obtain an excess similarity that isolates probe-content-locked overlap. This calibration converts token-choice behavior into a graded relatedness score, which the ladder and lineage-retrieval results then validate against documented model relationships.

What would settle it

Train two models from scratch on the same corpus but with deliberately different tokenizers, and two models on disjoint corpora with the same tokenizer; if the same-corpus/different-tokenizer pair shows excess similarity at the unrelated baseline (≈0.17) rather than near the reported 0.35, the claim that the fingerprint tracks shared training data rather than vocabulary overlap is falsified. Alternatively, explicitly test the exchangeability assumption by comparing the null estimated from content-independent prompts with the mismatched-probe null; a systematic difference would invalidate the corrected ladder.

Watch

Extended reading notes

Core claim

The central claim is that fingerprint similarity, defined as the mean Jaccard overlap of top-20 decoded token strings at near-final depth on 250 fixed probes, tracks documented model relatedness. Identical-data pairs (Pythia models with no shared weights) average 0.48 raw and 0.35 vocabulary-corrected excess similarity; shared-base fine-tunes average 0.39/0.33; same-developer pairs 0.37–0.38/0.25–0.28; and pairs with no documented relationship 0.22/0.17. This ordering yields a same-group versus cross-group ROC AUC of 0.859 at near-final depth, rising to 0.90 at the final output distribution, and, using only the top 5 output tokens, 0.87. As lineage retrieval, the fingerprint places the exact documented base in the top two of 33 candidates for all five R1 distillations (mean rank 1.8, MRR 0.60), including a math-specialized base that coarse metadata does not identify. The paper also reports that the identical-data signal emerges within the first 1% of training while probe accuracy is still near zero, and that the fingerprint is stable under quantization: Jaccard 0.92 under int8 and 0.82–0.85 under int4, above the largest cross-model similarity (0.81) in the calibration pool.

Load-bearing premise

The method's corrected scores rest on the assumption that, when a model's top-k tokens do not depend on the probe, matched and mismatched probe pairings are equally likely to overlap, so the mismatched-probe null cleanly isolates probe-content-locked similarity; the documented relationships in the model cards are likewise assumed to be accurate ground truth.

Editorial extensions

If this is right

  • Provenance triage becomes possible with forward passes alone: 250 probes per model, no training, no gradients, no weight access.
  • A model's base checkpoint can be recovered or narrowed to a small lineage neighborhood even when metadata is missing or misleading, as in the math-specialized 7B case.
  • The fingerprint detects overlap in training corpora even without shared parameters, extending forensics to independently trained models that reuse data.
  • The signal's presence before capability emerges means early training checkpoints already carry lineage information, useful for auditing partially released models.
  • Quantization robustness (int8 stable, int4 usable) means deployed quantized models can still be fingerprinted without dequantizing.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the score depends only on token rank order, the fingerprint could transfer to black-box APIs that expose ranked top-k tokens without log-probabilities, an extension the paper notes in principle but does not evaluate.
  • The category distributions overlap, so the ladder is calibrated at the pool level; turning the method into a pair-level decision tool would require explicit thresholds or abstention rules, which the paper leaves as future work.
  • The early-emergence result suggests token-space overlap might detect corpus reuse or contamination independently of task accuracy, a use case beyond provenance.
  • The exact-parent versus sibling ambiguity in four of five retrievals might be reduced by rank-weighted Jaccard or by combining the token-space score with weight-space evidence when weights are available.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 7 minor

Summary. TokenPrint proposes a training-free token-space fingerprint for language-model provenance: for each of 250 fixed knowledge probes, the top-20 decoded tokens are read out from late hidden states (L/4, L/2, 3L/4, L-2) and from the output distribution via the logit lens, and pairwise similarity is the mean Jaccard overlap of these decoded token sets, with a mismatched-probe null subtracted to obtain an 'excess' score. On a 32-model calibration pool with documented relationships, the paper reports a similarity ladder (identical-data 0.48 raw/0.35 excess; fine-tuned from documented base 0.39/0.33; same lineage group 0.38/0.28; same-developer next generation 0.37/0.25; unrelated 0.22/0.17), same-group vs. cross-group AUC of 0.859 at near-final depth, top-2 retrieval of the documented base for all five R1 distillations, a same-corpus witness signal across organizations, tokenizers, and architecture classes (excess 0.35-0.43 vs. a 0.15 reference), emergence of the signal within the first 1% of Pythia training before measurable factual competence, and stability under pool perturbations, probe removal, top-k choice, and int8/int4 quantization. The paper argues that token-space similarity tracks documented training relatedness rather than capability alone, while explicitly disclaiming mechanism identification.

Significance. If the main claims hold, TokenPrint is a valuable, low-cost provenance-screening tool: extraction is one forward pass per probe with no gradients, the released probes/code/fingerprints make the results independently checkable, and the evaluation is unusually careful in several respects. The probe suite was fixed before any cross-model similarity was computed (§3.2, Appendix B); the glitch-token filter is shown to be numerically inert; significance is assessed at the model level via permutation (p<10^-4); the robustness section includes leave-one-lineage-group-out (AUC 0.820-0.903), block removals, leave-one-model-out jackknife, a capability/scale confound regression (Eq. 1), and quantized-checkpoint stability; and Appendix D's Proposition 2 honestly delimits that behavioral scores cannot certify the mechanism of an observed relationship. The most novel scientific observation is the early-training emergence (Figure 4): same-data excess similarity of 0.25 at step 1000 while factual probe accuracy is 0.02. The principal weakness I find is in the calibration-ladder category assignment (detailed in the major comment); the broad three-regime conclusion (strongly related vs.

major comments (1)
  1. [§4.1, Table 1, Figure 3] The headline ordering of the calibration ladder is not robust to how 'fine-tuned from documented base' is defined, because that row of Table 1 is populated by an unstated pair-assignment rule. The row is assigned only the three cross-lineage R1-distill to base pairs (R1-Q-32B to Qwen2.5-32B, R1-Q-7B to Qwen2.5-Math-7B, R1-L-8B to Llama-3.1-8B), even though the same calibration pool contains two documented same-developer base-to-Instruct fine-tune pairs: Qwen2.5-32B to Qwen2.5-32B-Instruct, reported as the strongest non-identical pair in the pool at 0.81 (Figure 3), and Llama-3.1-8B to Llama-3.1-8B-Instruct, which is in the pool and is used in §4.5 as a 'same-base Instruct variant.' Because the rows are stated to cover 490 of the 496 pairs and the 'Same developer, next generation' row accounts for exactly the 30 Qwen3 times Qwen2.5 pairs, the two base-to-Instruct pairs must therefore be counted in the 'Same lineage group, different size' row (n=36), despite that row's 'different size' label. Under the alternative and equally natural assignment in which every documented shared-base fine-tune populates the fine-tuned rung, the raw rung mean becomes (3x0.39 + 0.81 + s)/5, which exceeds 0.45 and reaches or surpasses the identical-data mean of 0.48 for plausible values of the un-reported Llama base-to-Instruct score s; the excess-score rung is affected even more strongly, since the Qwen pair's excess is roughly 0.68 after subtracting the Qwen2.5 null of 0.128 (Table 7). The abstract's claim that 'independently trained models on identical data score 0.48 ... followed by shared-base fine-tunes (0.39/0.33)' is therefore a consequence of admitting only the three distill-to-base pairs. Please state the pair-assignment rule explicitly, relabel or split the rows (for example, 'cross-developer distillation from documented base' versus 'same-developer post-training from base'), report the Llama base-to-Instruct similarity, and present the ladder under both assignments. The three-regime conclusion in §4.1 survives; the specific top-rung ordering does not.
minor comments (7)
  1. [Table 1 footnote, §4.1] The probe-bootstrap 95% CI (+/-0.013) and the §4.1 CI for the same-developer difference ([+0.010,+0.019]) resample the 250 probes while holding model pairs fixed; for rungs with n=3 pairs this materially overstates precision. Please add model-level (cluster) bootstrap or permutation-based intervals for the category means.
  2. [Appendix D (§3.3)] The excess-score interpretation rests on the exchangeability of matched and mismatched probe pairings under content-independent top-k sets; the assumption is disclosed but never directly tested. A direct validation (for example, showing that excess is near zero for models with matched vocabularies but unrelated training, or comparing the null against a probe-content-scrambled control) would firm up the corrected ladder values. Because all main conclusions also hold for raw scores, I regard this as a robustness gap rather than a correctness error.
  3. [§4.5, Table 4] The lineage-retrieval headline (mean rank 1.8, MRR 0.60) is based on five queries, all from the DeepSeek R1 distillation family; a single query change moves MRR by 0.2. The limitation is acknowledged in §6, but the abstract should carry the n=5 context or an interval.
  4. [§4.2, Figure 4] The early-training claim rests on a single model pair (Pythia-1.4B vs. 6.9B). Reporting the pairwise trajectories of all three Pythia sizes, and the deduped-suite checkpoints if available, would show whether the step-1000 signal is pair-specific.
  5. [§5] The 'no documented relationship' reference (0.22/0.17) is computed within the calibration pool, where absence of a documented relationship does not imply absence of corpus overlap; the control analysis itself shows GPT-2 to OPT at 0.40 and OPT to Pythia at 0.34-0.37 with documented corpus overlap (§5). The floor is best read as an upper bound on a truly unrelated baseline, so absolute gap sizes should be interpreted accordingly.
  6. [Figure 5] The 'dip' annotation at half depth (AUC 0.72 then 0.70 then 0.77) is unexplained in the caption; either briefly account for the non-monotonicity or remove the annotation.
  7. [References] Small typographical issues: 'PMlR' in the Kornblith et al. entry should be 'PMLR', and the reference title 'Huref: Human-readable fingerprint for large language models' is inconsistent with the body text's 'HuRef.'

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the fingerprint, its calibration categories, and the lineage-retrieval evaluation are each grounded in external documented relationships or fixed pre-analysis choices, and no stated result reduces by construction to its own inputs.

full rationale

The paper's derivation chain is self-contained. The fingerprint is defined directly from hidden-state top-k token sets on a fixed 250-probe suite, and the probe suite was fixed before any cross-model similarity was computed (Section 3.2: 'the domain taxonomy and probe set were fixed before computing any cross-model similarity and were not modified in response to the results'). The calibration ladder is constructed from externally documented model relationships (Pythia shared-data, DeepSeek-R1 distillations with published bases, same-developer families, unrelated pairs), not from the fingerprint values themselves. The lineage-retrieval experiment ranks a query model against a candidate pool and checks whether the documented base appears in the top two; this is an external validation, not a fitted outcome. The mismatched-probe null is estimated from the same model pool and subtracted to form the excess score, but it functions as a per-pair recentering for vocabulary drift and is explicitly stated to rely on an exchangeability assumption (Section 3.3, Appendix D); it is not a parameter fitted to reproduce the headline ordering. No self-citation chain is load-bearing, and no uniqueness theorem is imported from the authors' prior work. The paper even includes Proposition 2, which explicitly concedes that behavioral scores cannot identify generative mechanism, further reducing the risk that a hidden equivalence between input and output is being presented as a derivation. The only notable concern is a categorization choice: the 'fine-tuned from documented base' rung contains only the three distill-to-base pairs and excludes base-to-instruct pairs such as Qwen2.5-32B to Qwen2.5-32B-Instruct (raw 0.81), which could affect the ladder ordering. However, this is a consistency or selection issue, not circularity: the category means are not used to define the fingerprint or to force the retrieval result. Under the strict definition of circularity used here, the paper's claims do not reduce to their inputs.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The method introduces no new theoretical entities, particles, or mechanisms. Its free parameters are methodological hyperparameters (k, depths, filter thresholds, probe count), all ablated or disclosed. The axioms are domain assumptions about the validity of logit-lens readouts, the null distribution, and the accuracy of documented model relationships.

free parameters (5)
  • top-k token count k = 20 (default); ablations over 10, 50, 100
    Chosen by hand to balance specificity and stability; AUC varies by less than 0.04 across k values.
  • internal readout depths = L/4, L/2, 3L/4, L-2; primary at L-2
    Sampled along depth; near-final depth is the primary readout because fractional depth convergence varies with scale.
  • glitch-token filter thresholds = unembedding norm above 5x or below 0.2x the vocabulary median
    Hand-set to remove degenerate tokens; results are insensitive because filtered tokens rarely enter top-100 lists.
  • number of probes = 250 from 13 domains
    Hand-authored set fixed before analysis; leave-one-domain-out AUC stays 0.858-0.870.
  • mismatched-pair count for null = 200 random pairs
    Chosen to estimate the per-pair vocabulary-overlap null; no sensitivity analysis reported for this count.
assumptions (5)
  • domain assumption The logit-lens assumption: hidden states projected through the unembedding matrix yield meaningful token distributions at intermediate depths.
    Used throughout Section 3.1; intermediate-depth readouts are compared across models.
  • domain assumption Exchangeability of matched and mismatched probe pairings under the null that top-k sets do not depend on probe content.
    Stated in Appendix D as the interpretation of the mismatched-probe null; the excess score relies on it.
  • domain assumption Documented model relationships in release materials and model cards are accurate.
    The calibration ladder and retrieval evaluation use these external labels as ground truth.
  • domain assumption Fractional depth matching across models with different layer counts is a valid comparison.
    Used in Section 3.3; the prediction-convergence control in Appendix C checks but does not eliminate this concern.
  • domain assumption The Pythia suite models share training data, order, and recipe but not weights, as documented.
    Central to the identical-data rung of the calibration ladder; relies on the Pythia technical report.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TokenPrint: A Calibrated Token-Space Fingerprint for Language-Model Provenance." pith.science (2026). https://pith.science/paper/VRLTH6YK

@misc{pith2026260808139,
  author       = {Pith},
  title        = {Pith review of: TokenPrint: A Calibrated Token-Space Fingerprint for Language-Model Provenance},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VRLTH6YK}},
  note         = {Machine review of arXiv:2608.08139}
}
abstract

Establishing the provenance of a language model---including its base checkpoint and possible overlap in training distributions---is a governance challenge that metadata alone cannot resolve. We introduce a training-free fingerprint based on the top-$k$ vocabulary projections of late hidden states elicited by 250 fixed knowledge probes, compared using Jaccard overlap over decoded token strings. We evaluate the method on 32 open-weight models from nine families (0.6B--32B) with documented relationships. (1)~A \emph{similarity ladder} broadly follows model relatedness: independently trained models on identical data score 0.48 raw (0.35 vocabulary-corrected), followed by shared-base fine-tunes (0.39/0.33), same-developer relatives (0.38/0.28), and models with no documented relationship (0.22/0.17). This identical-data signal persists across three organizations, two tokenizer families, and two architecture classes, and emerges within the first 1\% of training before measurable task competence, suggesting a contribution from shared training data beyond capability convergence. (2)~As a nearest-neighbor \emph{lineage-retrieval} method, the fingerprint ranks the exact documented base among the top two candidates for all five R1 distillations (mean rank 1.8, MRR 0.60), including a math-specialized base not identifiable from coarse metadata. (3)~A \emph{depth ablation} shows that lineage group discrimination strengthens toward the output distribution, with AUC increasing from 0.72 at quarter depth to 0.90 at the output; using only the top 5 output tokens retains AUC 0.87. (4)~The fingerprint remains stable under quantization, with Jaccard similarity of 0.92 under int8 and 0.82--0.85 under int4, compared with a maximum cross-model similarity of 0.81 in the calibration pool. We release the probes, code, and fingerprints.

Figures

Figures reproduced from arXiv: 2608.08139 by the authors.

Figure 1
Figure 1. Overview: each model answers 250 fixed knowledge probes; top- [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Mean fingerprint similarity across docu [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Raw pairwise fingerprint similarity (Jac [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Training trajectory on log-scaled steps. Ex [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Same-group discrimination across readout [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Excess-corrected similarity matrix (matched minus mismatched-probe null, near-final depth). Lineage [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 8
Figure 8. Figure 8: Black-box teacher probe: top-1 agreement [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 7
Figure 7. Figure 7: Self-overlap between each depth’s top-20 [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 15 canonical work pages

  1. [1]

    PhyloLM: Inferring the Phylogeny of Large Language Models and Predicting their Performances in Benchmarks , url =

    Yax, Nicolas and Oudeyer, Pierre-Yves and Palminteri, Stefano , booktitle =. PhyloLM: Inferring the Phylogeny of Large Language Models and Predicting their Performances in Benchmarks , url =

    work page

  2. [2]

    International Conference on Learning Representations , volume=

    Reef: Representation encoding fingerprints for large language models , author=. International Conference on Learning Representations , volume=

    work page

  3. [3]

    International Conference on Learning Representations , volume=

    Unsupervised model tree heritage recovery , author=. International Conference on Learning Representations , volume=

    work page

  4. [4]

    Advances in Neural Information Processing Systems , volume=

    Huref: Human-readable fingerprint for large language models , author=. Advances in Neural Information Processing Systems , volume=

  5. [5]

    International conference on machine learning , pages=

    Pythia: A suite for analyzing large language models across training and scaling , author=. International conference on machine learning , pages=. 2023 , organization=

    2023

  6. [6]

    arXiv preprint arXiv:2501.12948 , year=

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning , author=. arXiv preprint arXiv:2501.12948 , year=

    arXiv

  7. [7]

    arXiv preprint arXiv:2303.08112 , year=

    Eliciting latent predictions from transformers with the tuned lens , author=. arXiv preprint arXiv:2303.08112 , year=

    arXiv

  8. [8]

    Interpreting

    nostalgebraist , howpublished=. Interpreting

    work page

Show all 33 references
  1. [9]

    arXiv preprint arXiv:2101.00027 , year=

    The pile: An 800gb dataset of diverse text for language modeling , author=. arXiv preprint arXiv:2101.00027 , year=

    arXiv

  2. [10]

    International Conference on Learning Representations , volume=

    Detecting pretraining data from large language models , author=. International Conference on Learning Representations , volume=

  3. [11]

    International conference on machine learning , pages=

    Similarity of neural network representations revisited , author=. International conference on machine learning , pages=. 2019 , organization=

    2019

  4. [12]

    arXiv preprint arXiv:2412.15115 , year=

    Qwen2.5 Technical Report , author=. arXiv preprint arXiv:2412.15115 , year=

    arXiv

  5. [13]

    arXiv preprint arXiv:2505.09388 , year=

    Qwen3 Technical Report , author=. arXiv preprint arXiv:2505.09388 , year=

    arXiv

  6. [14]

    arXiv preprint arXiv:2407.21783 , year=

    The Llama 3 Herd of Models , author=. arXiv preprint arXiv:2407.21783 , year=

    arXiv

  7. [15]

    arXiv preprint arXiv:2408.00118 , year=

    Gemma 2: Improving Open Language Models at a Practical Size , author=. arXiv preprint arXiv:2408.00118 , year=

    arXiv

  8. [16]

    Jiang, Albert Q. and Sablayrolles, Alexandre and Mensch, Arthur and Bamford, Chris and Chaplot, Devendra Singh and de las Casas, Diego and Bressand, Florian and Lengyel, Gianna and Lample, Guillaume and Saulnier, Lucile and others , journal=. Mistral 7

  9. [17]

    arXiv preprint arXiv:2404.14219 , year=

    Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone , author=. arXiv preprint arXiv:2404.14219 , year=

    arXiv

  10. [18]

    arXiv preprint arXiv:2412.08905 , year=

    Phi-4 Technical Report , author=. arXiv preprint arXiv:2412.08905 , year=

    arXiv

  11. [19]

    Cai, Zheng and others , journal=. Intern

  12. [20]

    arXiv preprint arXiv:2506.01631 , year=

    Gradient-based model fingerprinting for llm similarity detection and family classification , author=. arXiv preprint arXiv:2506.01631 , year=

    arXiv

  13. [21]

    Advances in Neural Information Processing Systems , volume=

    Knowledge distillation detection for open-weights models , author=. Advances in Neural Information Processing Systems , volume=

  14. [22]

    arXiv preprint arXiv:2510.04850 , year=

    Detecting Distillation Data from Reasoning Models , author=. arXiv preprint arXiv:2510.04850 , year=

    arXiv

  15. [23]

    Tong, Yao and Wang, Haonan and Li, Siquan and Kawaguchi, Kenji and Hu, Tianyang , booktitle=. Seed

  16. [24]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Can LLM Watermarks Robustly Prevent Unauthorized Knowledge Distillation? , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  17. [25]

    Feder and Lee, Katherine and Jagielski, Matthew and Nasr, Milad and Conmy, Arthur and Wallace, Eric and Rolnick, David and Tram\`

    Carlini, Nicholas and Paleka, Daniel and Dvijotham, Krishnamurthy (Dj) and Steinke, Thomas and Hayase, Jonathan and Cooper, A. Feder and Lee, Katherine and Jagielski, Matthew and Nasr, Milad and Conmy, Arthur and Wallace, Eric and Rolnick, David and Tram\`. Stealing part of a ...

  18. [26]

    arXiv preprint arXiv:2602.09434 , year=

    A Behavioral Fingerprint for Large Language Models: Provenance Tracking via Refusal Vectors , author=. arXiv preprint arXiv:2602.09434 , year=

  19. [27]

    He, Zirui and Zhao, Haiyan and Li, Yingcong and Payani, Ali and Du, Mengnan , journal=. Logit

  20. [28]

    OpenAI blog , volume=

    Language models are unsupervised multitask learners , author=. OpenAI blog , volume=

  21. [29]

    arXiv preprint arXiv:2205.01068 , year=

    Opt: Open pre-trained transformer language models , author=. arXiv preprint arXiv:2205.01068 , year=

    arXiv

  22. [30]

    arXiv preprint arXiv:2501.00656 , year=

    2 OLMo 2 Furious , author=. arXiv preprint arXiv:2501.00656 , year=

    arXiv

  23. [31]

    arXiv preprint arXiv:2304.03208 , year=

    Cerebras-gpt: Open compute-optimal language models trained on the cerebras wafer-scale cluster , author=. arXiv preprint arXiv:2304.03208 , year=

    arXiv

  24. [32]

    Proceedings of BigScience Episode\# 5--Workshop on Challenges & Perspectives in Creating Large Language Models , pages=

    Gpt-neox-20b: An open-source autoregressive language model , author=. Proceedings of BigScience Episode\# 5--Workshop on Challenges & Perspectives in Creating Large Language Models , pages=

  25. [33]

    Findings of the association for computational linguistics: EMNLP 2023 , pages=

    Rwkv: Reinventing rnns for the transformer era , author=. Findings of the association for computational linguistics: EMNLP 2023 , pages=

    2023

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.