{"id":"https://openalex.org/W7164928327","doi":"https://doi.org/10.1145/3785353.3815086","title":"Robust Black-Box Fingerprinting for Large Language Models Against Composite Attacks via LLM Self-Evaluation and ArcFace","display_name":"Robust Black-Box Fingerprinting for Large Language Models Against Composite Attacks via LLM Self-Evaluation and ArcFace","publication_year":2026,"publication_date":"2026-06-16","ids":{"openalex":"https://openalex.org/W7164928327","doi":"https://doi.org/10.1145/3785353.3815086"},"language":null,"primary_location":{"id":"doi:10.1145/3785353.3815086","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3785353.3815086","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 ACM Workshop on Information Hiding and Multimedia Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3785353.3815086","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138715011","display_name":"Yiran Zhao","orcid":"https://orcid.org/0009-0001-9624-9833"},"institutions":[{"id":"https://openalex.org/I113940042","display_name":"Shanghai University","ror":"https://ror.org/006teas31","country_code":"CN","type":"education","lineage":["https://openalex.org/I113940042"]},{"id":"https://openalex.org/I141962983","display_name":"Shanghai University of Engineering Science","ror":"https://ror.org/0557b9y08","country_code":"CN","type":"education","lineage":["https://openalex.org/I141962983"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yiran Zhao","raw_affiliation_strings":["School of Communication and Information Engineering, Shanghai University, Shanghai University, China"],"raw_orcid":"https://orcid.org/0009-0001-9624-9833","affiliations":[{"raw_affiliation_string":"School of Communication and Information Engineering, Shanghai University, Shanghai University, China","institution_ids":["https://openalex.org/I141962983","https://openalex.org/I113940042"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100449658","display_name":"Hongjie Zhang","orcid":"https://orcid.org/0000-0001-9565-3378"},"institutions":[{"id":"https://openalex.org/I63354593","display_name":"Sichuan Normal University","ror":"https://ror.org/043dxc061","country_code":"CN","type":"education","lineage":["https://openalex.org/I63354593"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongjie Zhang","raw_affiliation_strings":["College of Computer Science, Sichuan Normal University, Chengdu, Sichuan, China"],"raw_orcid":"https://orcid.org/0000-0001-9565-3378","affiliations":[{"raw_affiliation_string":"College of Computer Science, Sichuan Normal University, Chengdu, Sichuan, China","institution_ids":["https://openalex.org/I63354593"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5049733139","display_name":"Hanzhou Wu","orcid":"https://orcid.org/0000-0002-1599-7232"},"institutions":[{"id":"https://openalex.org/I113940042","display_name":"Shanghai University","ror":"https://ror.org/006teas31","country_code":"CN","type":"education","lineage":["https://openalex.org/I113940042"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hanzhou Wu","raw_affiliation_strings":["School of Communication and Information Engineering, Shanghai University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-1599-7232","affiliations":[{"raw_affiliation_string":"School of Communication and Information Engineering, Shanghai University, Shanghai, China","institution_ids":["https://openalex.org/I113940042"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.94481213,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"81","last_page":"91"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.3319000005722046,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.3319000005722046,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.12710000574588776,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12131","display_name":"Wireless Signal Modulation Classification","score":0.12690000236034393,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.7616999745368958},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.5351999998092651},{"id":"https://openalex.org/keywords/fingerprint","display_name":"Fingerprint (computing)","score":0.4668000042438507},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.4480000138282776},{"id":"https://openalex.org/keywords/transformer","display_name":"Transformer","score":0.44609999656677246},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.41749998927116394},{"id":"https://openalex.org/keywords/attack-model","display_name":"Attack model","score":0.41510000824928284},{"id":"https://openalex.org/keywords/authentication","display_name":"Authentication (law)","score":0.4065000116825104},{"id":"https://openalex.org/keywords/selection","display_name":"Selection (genetic algorithm)","score":0.39570000767707825}],"concepts":[{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.7616999745368958},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7547000050544739},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.5351999998092651},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.49230000376701355},{"id":"https://openalex.org/C2777826928","wikidata":"https://www.wikidata.org/wiki/Q3745713","display_name":"Fingerprint (computing)","level":2,"score":0.4668000042438507},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.4480000138282776},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.44609999656677246},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42879998683929443},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.41749998927116394},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.41510000824928284},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.4065000116825104},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.39570000767707825},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3952000141143799},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.39410001039505005},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.3521000146865845},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.3508000075817108},{"id":"https://openalex.org/C93959086","wikidata":"https://www.wikidata.org/wiki/Q6888345","display_name":"Model selection","level":2,"score":0.3452000021934509},{"id":"https://openalex.org/C2778355321","wikidata":"https://www.wikidata.org/wiki/Q17079427","display_name":"Identity (music)","level":2,"score":0.33399999141693115},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3303999900817871},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.31839999556541443},{"id":"https://openalex.org/C42058472","wikidata":"https://www.wikidata.org/wiki/Q810214","display_name":"Base (topology)","level":2,"score":0.3156999945640564},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.31529998779296875},{"id":"https://openalex.org/C168406668","wikidata":"https://www.wikidata.org/wiki/Q178022","display_name":"Fingerprint recognition","level":3,"score":0.31040000915527344},{"id":"https://openalex.org/C113328881","wikidata":"https://www.wikidata.org/wiki/Q599809","display_name":"Dictionary attack","level":3,"score":0.2867000102996826},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.28439998626708984},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.28040000796318054},{"id":"https://openalex.org/C90312973","wikidata":"https://www.wikidata.org/wiki/Q7449052","display_name":"Semantic data model","level":2,"score":0.26170000433921814},{"id":"https://openalex.org/C184297639","wikidata":"https://www.wikidata.org/wiki/Q177765","display_name":"Biometrics","level":2,"score":0.2603999972343445}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3785353.3815086","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3785353.3815086","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 ACM Workshop on Information Hiding and Multimedia Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3785353.3815086","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3785353.3815086","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 ACM Workshop on Information Hiding and Multimedia Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.6944572925567627,"id":"https://metadata.un.org/sdg/10","display_name":"Reduced inequalities"}],"awards":[{"id":"https://openalex.org/G7263650625","display_name":null,"funder_award_id":"U23B2023","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":5,"referenced_works":["https://openalex.org/W4200633448","https://openalex.org/W4379598302","https://openalex.org/W4400529966","https://openalex.org/W4403221502","https://openalex.org/W4408750139"],"related_works":[],"abstract_inverted_index":{"Existing":[0],"black-box":[1,35,97],"fingerprinting":[2,36,98],"methods":[3],"for":[4,41,88],"large":[5],"language":[6],"models":[7],"typically":[8],"assume":[9],"a":[10,33,69,100,107],"single":[11],"attack":[12,137,157,185,199],"type,":[13],"making":[14],"them":[15],"difficult":[16],"to":[17,19,75,109,123],"apply":[18],"realistic":[20],"deployments":[21],"involving":[22],"multi-layer":[23,155],"composite":[24,39,156,198],"attacks.":[25],"To":[26],"address":[27],"this":[28,30],"limitation,":[29],"paper":[31],"proposes":[32],"new":[34],"paradigm":[37],"against":[38],"attacks":[40],"commercial":[42],"scenarios.":[43,200],"For":[44],"data":[45],"construction,":[46],"we":[47,95,150],"design":[48],"an":[49],"LLM":[50],"self-evaluation-based":[51],"fingerprint":[52,147],"probe":[53],"selection":[54],"mechanism.":[55],"Candidate":[56],"queries":[57,87],"from":[58],"multiple":[59,81],"open-source":[60],"datasets":[61],"are":[62],"fed":[63],"into":[64],"different":[65,136],"base":[66],"models,":[67],"and":[68,91,113,119,143,153,166,183,187],"high-capability":[70],"judge":[71],"model":[72,110,134,152],"is":[73],"introduced":[74],"automatically":[76],"assess":[77],"output":[78],"discrepancies":[79],"across":[80],"dimensions,":[82],"thereby":[83],"selecting":[84],"highly":[85],"discriminative":[86],"constructing":[89],"training":[90],"test":[92],"sets.":[93],"Methodologically,":[94],"reformulate":[96],"as":[99],"fine-grained":[101],"identity":[102],"authentication":[103],"task.":[104],"We":[105],"employ":[106],"Transformer":[108],"the":[111,132,173],"semantic":[112],"logical":[114],"features":[115],"of":[116,131,160],"question\u2013answer":[117],"sequences":[118],"incorporate":[120],"ArcFace":[121],"loss":[122],"impose":[124],"angular-margin":[125],"constraints.":[126],"This":[127],"compresses":[128],"intra-class":[129],"distributions":[130],"same":[133],"under":[135,180],"conditions,":[138],"enlarges":[139],"inter-model":[140],"decision":[141],"boundaries,":[142],"learns":[144],"more":[145],"identity-invariant":[146],"representations.":[148],"Furthermore,":[149],"systematically":[151],"evaluate":[154],"chains":[158],"composed":[159],"instruction":[161],"tuning,":[162],"quantization,":[163],"distillation,":[164],"RAG,":[165],"system":[167],"prompts.":[168],"Experimental":[169],"results":[170],"show":[171],"that":[172],"proposed":[174],"method":[175],"significantly":[176],"outperforms":[177],"existing":[178],"approaches":[179],"both":[181],"single-layer":[182],"two-layer":[184],"settings,":[186],"maintains":[188],"over":[189],"61%":[190],"Top-1":[191],"identification":[192],"accuracy":[193],"even":[194],"in":[195],"high-intensity":[196],"three-layer":[197]},"counts_by_year":[],"updated_date":"2026-06-17T06:18:53.044164","created_date":"2026-06-17T00:00:00"}