# LLM Fingerprinting

The authors revisit a watermark-distillation protocol for LLM fingerprinting, show that its utility evaluation understates text-quality degradation in open-ended generation, and propose near-tie restriction, which uses top-1-relative logit gaps to confine the watermark bias to tokens close to the base model's top prediction; across Llama-3.2-3B, Qwen-2.5-3B, Llama-3.1-8B, and Gemma-9B, this improves detection-quality frontiers under sampling, system prompts, quantization, pruning, and fine-tuning, preserves higher text quality across query budgets, and further improves existing schemes when combined with them.

The authors revisit a watermark-distillation protocol for LLM fingerprinting, show that its utility evaluation understates text-quality degradation in open-ended generation, and propose near-tie restriction, which uses top-1-relative logit gaps to confine the watermark bias to tokens close to the base model's top prediction; across Llama-3.2-3B, Qwen-2.5-3B, Llama-3.1-8B, and Gemma-9B, this improves detection-quality frontiers under sampling, system prompts, quantization, pruning, and fine-tuning, preserves higher text quality across query budgets, and further improves existing schemes when combined with them.

The authors introduce GateScope, a lightweight black-box auditing framework that uses only public APIs to evaluate LLM API gateways along response content, multi-turn conversation consistency, billing accuracy, and latency characteristics; controlled validation on official endpoints yields an average F1 of 0.968±0.085 across 24 models, and auditing 10 commercial gateways reveals identification rates as low as 13.09% for gpt-5, degraded multi-turn memory checkpoints, a 62.8% billing gap for o*ey on gpt-4o, and markedly higher latency variation for b*ie.

The authors introduce GateScope, a lightweight black-box auditing framework that uses only public APIs to evaluate LLM API gateways along response content, multi-turn conversation consistency, billing accuracy, and latency characteristics; controlled validation on official endpoints yields an average F1 of 0.968±0.085 across 24 models, and auditing 10 commercial gateways reveals identification rates as low as 13.09% for gpt-5, degraded multi-turn memory checkpoints, a 62.8% billing gap for o*ey on gpt-4o, and markedly higher latency variation for b*ie.