Matryoshka Fingerprinting for Lineage Verification in Large Language Models

Protecting the intellectual property of open-source large language models (LLMs) is increasingly important, since post-hoc modifications can obscure whether a deployed model derives from a protected one. However, existing fingerprinting methods are tied to a single model instance and deployment configuration, so their effectiveness degrades under model heterogeneity (hidden-size variation), vocabulary heterogeneity (vocabulary variation), and deployment heterogeneity (template/temperature variation). We propose Matryoshka Fingerprinting (MF), a transferable fingerprinting framework that verifies model lineage across these three forms of heterogeneity in a black-box manner. By freezing all model parameters and jointly optimizing a nested Matryoshka fingerprint embedding across multiple protected models and deployment contexts, MF lets a single fingerprint be reused across models with different hidden sizes and vocabularies, as well as across different templates and decoding temperatures. Extensive experiments show that MF outperforms existing fingerprinting methods, i.e., REEF, ZeroPrint, and PlugAE, in effectiveness, robustness, efficiency, stealthiness, and harmlessness, while extending potentially to cross-family lineage verification and content attribution.