FLIPS: Instance-Fingerprinting for LLMs via Pseudo-random Sequences

Richardeau Gurvan, Gohar Dashyan, Erwan Le Merrer, Gilles Tredan
Proceedings of the 43rd International Conference on Machine Learning, PMLR 306:38974-38993, 2026.

Abstract

Literature reveals that a Large Language Model’s (LLM) behavior is not only conditioned by its original weights but also its instance-level parameters, such as instructional prompt, sampling configuration or quantization. A model that generates safe outputs under one configuration may produce toxic content under another. However, current LLM identification techniques (such as fingerprinting) focus on intellectual property protection, and their design favors robustness to changes in these instance-level parameters. This poses a critical challenge for AI regulation in which compliance assessments target actual deployed behaviors, not model provenance. In this paper, we introduce instance-level fingerprinting, a regulator-oriented paradigm that distinguishes configurations of the same LLM. Our method FLIPS, exploits biases in generated binary random sequences to reach 96% (closed-set) and 90% (open-set, where some targets are unknown) identification accuracy across 237 model instances, versus 35% for the adapted LLMmap baseline. This shows that instance-level fingerprinting is both necessary for regulation and practically feasible. Code available at https://github.com/GurvanR/FLIPS-LLM-Instance-Fingerprinting.

Cite this Paper

BibTeX
@InProceedings{pmlr-v306-gurvan26a, title = {{FLIPS}: Instance-Fingerprinting for {LLM}s via Pseudo-random Sequences}, author = {Gurvan, Richardeau and Dashyan, Gohar and Le Merrer, Erwan and Tredan, Gilles}, booktitle = {Proceedings of the 43rd International Conference on Machine Learning}, pages = {38974--38993}, year = {2026}, editor = {Zhang, Tong and Dudik, Miroslav and Jaggi, Martin and Agarwal, Alekh and Li, Sharon and Schuurmans, Dale and Zhu, Jerry and Berkenkamp, Felix and Dong, Hanze and Bietti, Alberto}, volume = {306}, series = {Proceedings of Machine Learning Research}, month = {06--11 Jul}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v306/main/assets/gurvan26a/gurvan26a.pdf}, url = {https://proceedings.mlr.press/v306/gurvan26a.html}, abstract = {Literature reveals that a Large Language Model’s (LLM) behavior is not only conditioned by its original weights but also its instance-level parameters, such as instructional prompt, sampling configuration or quantization. A model that generates safe outputs under one configuration may produce toxic content under another. However, current LLM identification techniques (such as fingerprinting) focus on intellectual property protection, and their design favors robustness to changes in these instance-level parameters. This poses a critical challenge for AI regulation in which compliance assessments target actual deployed behaviors, not model provenance. In this paper, we introduce instance-level fingerprinting, a regulator-oriented paradigm that distinguishes configurations of the same LLM. Our method FLIPS, exploits biases in generated binary random sequences to reach 96% (closed-set) and 90% (open-set, where some targets are unknown) identification accuracy across 237 model instances, versus 35% for the adapted LLMmap baseline. This shows that instance-level fingerprinting is both necessary for regulation and practically feasible. Code available at https://github.com/GurvanR/FLIPS-LLM-Instance-Fingerprinting.} }
Endnote
%0 Conference Paper %T FLIPS: Instance-Fingerprinting for LLMs via Pseudo-random Sequences %A Richardeau Gurvan %A Gohar Dashyan %A Erwan Le Merrer %A Gilles Tredan %B Proceedings of the 43rd International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2026 %E Tong Zhang %E Miroslav Dudik %E Martin Jaggi %E Alekh Agarwal %E Sharon Li %E Dale Schuurmans %E Jerry Zhu %E Felix Berkenkamp %E Hanze Dong %E Alberto Bietti %F pmlr-v306-gurvan26a %I PMLR %P 38974--38993 %U https://proceedings.mlr.press/v306/gurvan26a.html %V 306 %X Literature reveals that a Large Language Model’s (LLM) behavior is not only conditioned by its original weights but also its instance-level parameters, such as instructional prompt, sampling configuration or quantization. A model that generates safe outputs under one configuration may produce toxic content under another. However, current LLM identification techniques (such as fingerprinting) focus on intellectual property protection, and their design favors robustness to changes in these instance-level parameters. This poses a critical challenge for AI regulation in which compliance assessments target actual deployed behaviors, not model provenance. In this paper, we introduce instance-level fingerprinting, a regulator-oriented paradigm that distinguishes configurations of the same LLM. Our method FLIPS, exploits biases in generated binary random sequences to reach 96% (closed-set) and 90% (open-set, where some targets are unknown) identification accuracy across 237 model instances, versus 35% for the adapted LLMmap baseline. This shows that instance-level fingerprinting is both necessary for regulation and practically feasible. Code available at https://github.com/GurvanR/FLIPS-LLM-Instance-Fingerprinting.
APA
Gurvan, R., Dashyan, G., Le Merrer, E. & Tredan, G.. (2026). FLIPS: Instance-Fingerprinting for LLMs via Pseudo-random Sequences. Proceedings of the 43rd International Conference on Machine Learning, in Proceedings of Machine Learning Research 306:38974-38993 Available from https://proceedings.mlr.press/v306/gurvan26a.html.

Related Material