An AI research team has built a way to invisibly stamp an open-weight language model with an owner signature that survives being fine-tuned, pruned, or merged into another model.
The method, called SimPrint, is described in a new arXiv paper. Instead of relying on a secret question-and-answer pair that reproduces an exact fixed response, it spreads a private signature across a set of natural yes-or-no probe questions, encoded as a semantic fingerprint. The signature is implanted through what the researchers call a low-interference batch update, which they say preserves the model's original behavior. To check ownership, the owner queries a suspect model with the same probes, decodes the answers into bits or erasures, and runs the result through an error-correcting recovery process. The team tested SimPrint on three open-weight LLMs and reports it recovered the signature reliably even after fine-tuning, pruning, quantization, model merging, and changes made at serving time, while keeping the model's normal performance intact.
That durability is the actual point. Open-weight models are trivial to copy and redeploy behind someone else's API, and once a model has been fine-tuned or merged with another, older fingerprinting tricks built around one secret prompt producing one secret answer tend to fall apart. Spreading the signal across many probes with error correction is a straightforward fix for a well-known weak spot, and it works entirely through input-output queries, so an owner never needs access to the suspect model's weights.
Worth noting: this is a preprint, tested by its own authors on three models, not an independently audited standard. The real test for any ownership fingerprint is not routine fine-tuning, it is someone trying to strip it out on purpose. That fight isn't over yet.