SetPrint: Black-Box LLM Fingerprinting via Setwise Correspondence of Response Changes — arXiv

SetPrint: Black-Box LLM Fingerprinting via Setwise Correspondence of Response Changes — arXiv

The authors of SetPrint are Jinmo Han, Ju Yeon Kang, Jimin Hong, Sunghwan Ahn, Yonghyeon Jun and Nam Soo Kim. They introduce a training-free method for black-box LLM fingerprinting: assessing whether a target model was derived from a source model using only their responses to queries. The method perturbs queries and compares the resulting response changes. It represents each change relative to the mean change in its own set, then compares changes from the two models caused by the same perturbation. The authors say this combines relations among changes within each model’s set with correspondence between the sets, which existing approaches have not fully exploited. On LeaFBench, they report that SetPrint consistently outperforms existing training-free black-box fingerprinting methods, and attribute the gains to both kinds of comparison. The abstract does not give performance figures or describe the benchmark’s scope, so it leaves open how the reported advantage varies across test conditions.

Publication: b9c83b8e-fffb-47fe-8e7c-b71b251ea30d

attribution — pass: The reading names the six listed authors correctly, attributes the method to them, and frames the benchmark results as their report ('they report', 'attribute'), not as established fact.

Authors:Jinmo Han, Ju Yeon Kang, Jimin Hong, Sunghwan Ahn, Yonghyeon Jun, Nam Soo Kim

summary — pass: The reading leads with the development and explains black-box LLM fingerprinting in plain language: telling whether one model was derived from another using only its responses. It then describes the mechanism and the reported result. LeaFBench and training-free are not explained in depth, but the reading identifies LeaFBench as a benchmark, and neither term blocks understanding. The abstract gives no wider stakes, and the reading does not invent any. The question follows from a real gap in the evidence. Optional term-library tooltip suggestions: training-free, perturbation.

Black-box LLM fingerprinting aims to determine whether a target model was derived from a source model when only the output responses to input queries are observable.

date — pass: The originalPublished date of 2026-11-07 matches the v1 submission date on arXiv. It is not the later feed date of 2026-11-11.

[Submitted on 7 Nov 2026]

support — pass: Each claim is a close paraphrase of the abstract. The stated limitation is accurate: the abstract gives no performance figures or benchmark scope. The reading implies no benefits or costs, and its question does not assume an unsupported outcome.

SetPrint expresses each response change relative to the mean change of its own set, and then compares changes from the two models that were induced by the same perturbation.

media — pass: The selected media is the verified direct link to the original arXiv abstract page, which matches the source.