一句话：提出基于梯度的 LLM 指纹框架 TensorGuard，通过张量层梯度响应实现模型相似度检测与家族分类，准确率达 94%。
随着 LLM 成为现代软件的重要组件，微调、模型合并与再分发导致的未授权派生行为带来了模型溯源与许可合规难题：传统软件有成熟的克隆检测与许可证机制，而 LLM 生态缺乏验证模型血缘的技术手段，例如 LLaMA 等开源模型要求衍生作品保持命名归属却无从核查。本文将 LLM 视为需要溯源追踪的软件制品，提出 TensorGuard——一个基于梯度的指纹框架。方法上，它对随机输入扰动在各张量层的梯度响应进行统计分析，提取模型内在的行为签名，不依赖训练数据、水印或特定模型格式，并支持广泛使用的 safetensors 格式，从而构建高维指纹。该指纹支持两种能力：通过距离计算进行任意模型间的两两相似度评估，以及利用已知基座模型做质心初始化的 K-Means 聚类对未知模型进行系统性家族分类。在涵盖 Llama、Qwen、Gemma、Phi、Mistral 五个家族、8 个基座与 50 个派生模型共 58 个模型上的实验表明，其质心初始化 K-Means 分类准确率达到 94%。
As Large Language Models (LLMs) become integral software components in modern applications, unauthorized model derivations through fine-tuning, merging, and redistribution have emerged as critical software engineering challenges. Unlike traditional software where clone detection and license compliance are well-established, the LLM ecosystem lacks effective mechanisms to detect model lineage and enforce licensing agreements. This gap is particularly problematic when open-source model creators, such as Meta’s LLaMA, require derivative works to maintain naming conventions for attribution, yet no technical means exist to verify compliance.To fill this gap, treating LLMs as software artifacts requiring provenance tracking, we present TensorGuard, a gradient-based fingerprinting framework for LLM similarity detection and family classification. Our approach extracts model-intrinsic behavioral signatures by analyzing gradient responses to random input perturbations across tensor layers, operating independently of training data, watermarks, or specific model formats. TensorGuard supports the widely-adopted safetensors format and constructs high-dimensional fingerprints through statistical analysis of gradient features. These fingerprints enable two complementary capabilities: direct pairwise similarity assessment between arbitrary models through distance computation, and systematic family classification of unknown models via the K-Means clustering algorithm with domain-informed centroid initialization using known base models. Experimental evaluation on 58 models comprising 8 base models and 50 derivatives across five model families (Llama, Qwen, Gemma, Phi, Mistral) demonstrates 94% classification accuracy under our centroid-initialized K-Means clustering. Our work establishes a new paradigm for model similarity detection, bridging traditional software engineering practices with modern LLM distribution and compliance challenges.
DOI 原文 ·
@inproceedings{paperbot9514,
title = {TensorGuard: Gradient-Based Model Fingerprinting for LLM Similarity Detection and Family Classification},
author = {Zehao Wu and Yanjie Zhao and Haoyu Wang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00044}
}