{"id":"https://openalex.org/W4411055136","doi":"https://doi.org/10.1109/ojcoms.2025.3577016","title":"LLMs Have Rhythm: Fingerprinting Large Language Models Using Inter-Token Times and Network Traffic Analysis","display_name":"LLMs Have Rhythm: Fingerprinting Large Language Models Using Inter-Token Times and Network Traffic Analysis","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4411055136","doi":"https://doi.org/10.1109/ojcoms.2025.3577016"},"language":"en","primary_location":{"id":"doi:10.1109/ojcoms.2025.3577016","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2025.3577016","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/ojcoms.2025.3577016","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5050420702","display_name":"Saeif Alhazbi","orcid":"https://orcid.org/0000-0002-7884-5025"},"institutions":[{"id":"https://openalex.org/I4210144839","display_name":"Hamad bin Khalifa University","ror":"https://ror.org/03eyq4y97","country_code":"QA","type":"education","lineage":["https://openalex.org/I4210144839"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"Saeif Alhazbi","raw_affiliation_strings":["College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar","College of Science and Engineering (CSE), Hamad Bin Khalifa University (HBKU), Doha, Qatar"],"raw_orcid":"https://orcid.org/0000-0002-7884-5025","affiliations":[{"raw_affiliation_string":"College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar","institution_ids":["https://openalex.org/I4210144839"]},{"raw_affiliation_string":"College of Science and Engineering (CSE), Hamad Bin Khalifa University (HBKU), Doha, Qatar","institution_ids":["https://openalex.org/I4210144839"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043990076","display_name":"Ahmed Hussain","orcid":"https://orcid.org/0000-0003-4732-9543"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Ahmed Hussain","raw_affiliation_strings":["Networked Systems Security Group, KTH Royal Institute of Technology, Stockholm, Sweden","Networked Systems Security (NSS) Group, KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0000-0003-4732-9543","affiliations":[{"raw_affiliation_string":"Networked Systems Security Group, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]},{"raw_affiliation_string":"Networked Systems Security (NSS) Group, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062407436","display_name":"Gabriele Oligeri","orcid":"https://orcid.org/0000-0002-9637-0430"},"institutions":[{"id":"https://openalex.org/I4210144839","display_name":"Hamad bin Khalifa University","ror":"https://ror.org/03eyq4y97","country_code":"QA","type":"education","lineage":["https://openalex.org/I4210144839"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"Gabriele Oligeri","raw_affiliation_strings":["College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar","College of Science and Engineering (CSE), Hamad Bin Khalifa University (HBKU), Doha, Qatar"],"raw_orcid":"https://orcid.org/0000-0002-9637-0430","affiliations":[{"raw_affiliation_string":"College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar","institution_ids":["https://openalex.org/I4210144839"]},{"raw_affiliation_string":"College of Science and Engineering (CSE), Hamad Bin Khalifa University (HBKU), Doha, Qatar","institution_ids":["https://openalex.org/I4210144839"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5030735377","display_name":"Panos Papadimitratos","orcid":"https://orcid.org/0000-0002-3267-5374"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Panos Papadimitratos","raw_affiliation_strings":["Networked Systems Security Group, KTH Royal Institute of Technology, Stockholm, Sweden","Networked Systems Security (NSS) Group, KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0000-0002-3267-5374","affiliations":[{"raw_affiliation_string":"Networked Systems Security Group, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]},{"raw_affiliation_string":"Networked Systems Security (NSS) Group, KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1750,"currency":"USD","value_usd":1750},"apc_paid":{"value":1750,"currency":"USD","value_usd":1750},"fwci":2.4661,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.89812754,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":97},"biblio":{"volume":"6","issue":null,"first_page":"5050","last_page":"5071"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10181","display_name":"Natural Language Processing Techniques","score":0.9093000292778015,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10181","display_name":"Natural Language Processing Techniques","score":0.9093000292778015,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.6255732774734497},{"id":"https://openalex.org/keywords/rhythm","display_name":"Rhythm","score":0.5817238688468933},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5006139278411865},{"id":"https://openalex.org/keywords/token-economy","display_name":"Token economy","score":0.41453543305397034},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3331982493400574},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.31143200397491455},{"id":"https://openalex.org/keywords/medicine","display_name":"Medicine","score":0.13105982542037964},{"id":"https://openalex.org/keywords/social-psychology","display_name":"Social psychology","score":0.07653078436851501}],"concepts":[{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.6255732774734497},{"id":"https://openalex.org/C135343436","wikidata":"https://www.wikidata.org/wiki/Q170406","display_name":"Rhythm","level":2,"score":0.5817238688468933},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5006139278411865},{"id":"https://openalex.org/C155076860","wikidata":"https://www.wikidata.org/wiki/Q1932004","display_name":"Token economy","level":3,"score":0.41453543305397034},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3331982493400574},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.31143200397491455},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.13105982542037964},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.07653078436851501},{"id":"https://openalex.org/C67203356","wikidata":"https://www.wikidata.org/wiki/Q1321905","display_name":"Reinforcement","level":2,"score":0.0},{"id":"https://openalex.org/C126322002","wikidata":"https://www.wikidata.org/wiki/Q11180","display_name":"Internal medicine","level":1,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1109/ojcoms.2025.3577016","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2025.3577016","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2502.20589","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2502.20589","pdf_url":"https://arxiv.org/pdf/2502.20589","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:doaj.org/article:d251fac42a81458ab60c0e5ffe450053","is_oa":true,"landing_page_url":"https://doaj.org/article/d251fac42a81458ab60c0e5ffe450053","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Open Journal of the Communications Society, Vol 6, Pp 5050-5071 (2025)","raw_type":"article"},{"id":"pmh:oai:figshare.com:article/30541070","is_oa":true,"landing_page_url":"https://figshare.com/articles/journal_contribution/LLMs_Have_Rhythm_Fingerprinting_Large_Language_Models_Using_Inter-Token_Times_and_Network_Traffic_Analysis/30541070","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text"}],"best_oa_location":{"id":"doi:10.1109/ojcoms.2025.3577016","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2025.3577016","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G5261658928","display_name":null,"funder_award_id":"GSRA7-1-0510-20045","funder_id":"https://openalex.org/F4320332753","funder_display_name":"Qatar National Research Fund"}],"funders":[{"id":"https://openalex.org/F4320320671","display_name":"National Research Foundation","ror":"https://ror.org/05s0g1g46"},{"id":"https://openalex.org/F4320322327","display_name":"Knut och Alice Wallenbergs Stiftelse","ror":"https://ror.org/004hzzk67"},{"id":"https://openalex.org/F4320322581","display_name":"Vetenskapsr\u00e5det","ror":"https://ror.org/03zttf063"},{"id":"https://openalex.org/F4320332753","display_name":"Qatar National Research Fund","ror":"https://ror.org/01svaqq28"},{"id":"https://openalex.org/F4320334468","display_name":"Qatar National Library","ror":"https://ror.org/02jv93662"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":36,"referenced_works":["https://openalex.org/W2064675550","https://openalex.org/W2250539671","https://openalex.org/W2566079294","https://openalex.org/W2897202622","https://openalex.org/W2963351448","https://openalex.org/W2974442408","https://openalex.org/W3004042723","https://openalex.org/W3087340751","https://openalex.org/W3181596493","https://openalex.org/W4296229353","https://openalex.org/W4385245566","https://openalex.org/W4386980790","https://openalex.org/W4389747887","https://openalex.org/W4392353733","https://openalex.org/W4396949058","https://openalex.org/W4401042463","https://openalex.org/W4404303047","https://openalex.org/W4406302454","https://openalex.org/W4411337932","https://openalex.org/W6636510571","https://openalex.org/W6680532216","https://openalex.org/W6778883912","https://openalex.org/W6848955896","https://openalex.org/W6850625674","https://openalex.org/W6851663954","https://openalex.org/W6851775633","https://openalex.org/W6858023062","https://openalex.org/W6859868774","https://openalex.org/W6862699979","https://openalex.org/W6865118152","https://openalex.org/W6868876356","https://openalex.org/W6870549066","https://openalex.org/W6870737912","https://openalex.org/W6873186955","https://openalex.org/W6873876592","https://openalex.org/W6876247052"],"related_works":["https://openalex.org/W2955145455","https://openalex.org/W1973995623","https://openalex.org/W2091182875","https://openalex.org/W1966017346","https://openalex.org/W4313501107","https://openalex.org/W2476330730","https://openalex.org/W2078711301","https://openalex.org/W2011487162","https://openalex.org/W2082437045","https://openalex.org/W2565587833"],"abstract_inverted_index":{"As":[0],"Large":[1],"Language":[2,185],"Models":[3,186],"(LLMs)":[4],"become":[5],"increasingly":[6],"integrated":[7],"into":[8],"many":[9],"technological":[10],"ecosystems":[11],"across":[12,192,233],"various":[13],"domains":[14],"and":[15,31,64,91,179,188,207,236,258,263],"industries,":[16],"identifying":[17],"which":[18,111],"model":[19,70,253,266],"is":[20,26,139,240],"deployed":[21],"or":[22,132],"being":[23],"interacted":[24],"with":[25,160,221],"critical":[27],"for":[28,252],"the":[29,34,43,48,69,103,137,148],"security":[30],"trustworthiness":[32],"of":[33,108,224],"systems.":[35],"Current":[36],"verification":[37],"methods":[38],"typically":[39],"rely":[40],"on":[41,120,182,228],"analyzing":[42],"generated":[44,123],"output":[45,138],"to":[46,56,68,72,170,260],"determine":[47],"source":[49],"model.":[50],"However,":[51],"these":[52,172],"techniques":[53],"are":[54],"susceptible":[55],"adversarial":[57],"attacks,":[58],"operate":[59],"in":[60,89,255],"a":[61,74,82,117,126,130,142,165,229,243,249],"post-hoc":[62],"manner,":[63],"may":[65],"require":[66],"access":[67],"weights":[71],"inject":[73],"verifiable":[75],"fingerprint.":[76],"In":[77],"this":[78],"paper,":[79],"we":[80],"propose":[81],"novel":[83],"passive":[84],"fingerprinting":[85],"framework":[86],"that":[87,146],"operates":[88],"real-time":[90],"remains":[92],"effective":[93],"even":[94,135],"under":[95],"encrypted":[96],"network":[97,176],"traffic":[98,177,239],"conditions.":[99],"Our":[100,214],"method":[101],"leverages":[102],"intrinsic":[104],"autoregressive":[105],"generation":[106],"nature":[107],"language":[109,158,265],"models,":[110],"generate":[112],"text":[113],"one":[114],"token":[115],"at":[116],"time":[118],"based":[119],"all":[121],"previously":[122],"tokens,":[124],"creating":[125],"unique":[127],"temporal":[128],"pattern\u2013like":[129],"rhythm":[131],"heartbeat\u2013that":[133],"persists":[134],"when":[136,208,226,238],"streamed":[140],"over":[141],"network.":[143],"We":[144,163],"find":[145],"measuring":[147],"Inter-Token":[149],"Times":[150],"(ITTs)\u2013time":[151],"intervals":[152],"between":[153],"consecutive":[154],"tokens\u2013can":[155],"identify":[156],"different":[157,193,230,234],"models":[159],"high":[161,218],"accuracy.":[162],"develop":[164],"Deep":[166],"Learning":[167],"(DL)":[168],"pipeline":[169],"capture":[171],"timing":[173],"patterns":[174],"using":[175,209],"analysis":[178],"evaluate":[180],"it":[181],"16":[183],"Small":[184],"(SLMs)":[187],"10":[189],"proprietary":[190],"LLMs":[191],"deployment":[194],"scenarios,":[195],"including":[196],"local":[197],"host":[198],"machine":[199],"(GPU/CPU),":[200],"Local":[201],"Area":[202],"Network":[203,212],"(LAN),":[204],"Remote":[205],"Network,":[206],"Virtual":[210],"Private":[211],"(VPN).":[213],"experimental":[215],"results":[216],"demonstrate":[217],"classification":[219],"performance":[220],"weighted":[222],"F1-scores":[223],"85%":[225],"tested":[227],"day,":[231],"74%":[232],"networks,":[235],"71%":[237],"tunneled":[241],"through":[242],"VPN":[244],"connection.":[245],"This":[246],"work":[247],"opens":[248],"new":[250],"avenue":[251],"identification":[254],"real-world":[256],"scenarios":[257],"contributes":[259],"more":[261],"secure":[262],"trustworthy":[264],"deployment.":[267]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2025-10-10T00:00:00"}