💬 NLP

FNF: Functional Network Fingerprint for Large Language Models

This paper proposes Functional Network Fingerprint (FNF), a training-free and sample-efficient method that detects unauthorized derivations of large language models by analyzing the consistency of their functional network activity, offering a robust solution for intellectual property protection across diverse architectures and modifications.

Original authors: Yiheng Liu, Junhao Ning, Sichen Xia, Haiyang Sun, Yang Yang, Hanyang Chi, Xiaohui Gao, Ning Qiang, Bao Ge, Junwei Han, Xintao Hu

Published 2026-02-02

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yiheng Liu, Junhao Ning, Sichen Xia, Haiyang Sun, Yang Yang, Hanyang Chi, Xiaohui Gao, Ning Qiang, Bao Ge, Junwei Han, Xintao Hu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine that building a powerful Large Language Model (like the ones that write essays or code) is like baking an incredibly expensive, secret family recipe cake. It takes years of time and millions of dollars to perfect.

The problem? Some people are stealing these "recipes" (the model's internal weights), making tiny tweaks to the frosting, and claiming they baked the cake from scratch. They might even change the size of the cake pan or add extra layers, but the core batter is stolen.

This paper introduces a new detective tool called FNF (Functional Network Fingerprint) to catch these thieves. Here is how it works, explained simply:

1. The Brain Analogy: "The Team Huddle"

Think of a neural network (the AI) not as a static list of numbers, but as a bustling city of neurons.

The Old Way: Traditional methods tried to catch thieves by looking at the "blueprints" (the weights) or by planting a hidden "watermark" (like a secret code) in the cake. But if the thief changes the blueprint or washes away the watermark, they get away.
The New Way (FNF): Instead of looking at the static blueprint, FNF watches how the neurons work together when the AI is thinking.
- Imagine a sports team. Even if you swap the players' jerseys or change the size of the field, the way the same team coordinates their passes and runs together remains unique to that specific group.
- In the AI, when you ask it a question, certain groups of neurons "huddle up" and fire together in a specific pattern. This is called a Functional Network.

2. The Core Discovery: "Family Resemblance"

The researchers discovered that models built from the same "family" (even if one is a small version and the other is a giant version, or if one has extra layers added) share a very specific dance.

When you give them the same input, their neurons move in sync.
When you give two unrelated models the same input, their neurons dance to completely different tunes.

It's like looking at two people's handwriting. Even if one writes with a thick marker and the other with a tiny pen, if they are the same person, the flow and rhythm of the letters will look the same. If they are different people, the rhythm is totally different.

3. How the Detective Tool Works

The FNF method is like a high-tech motion-capture camera for the AI's brain:

Ask a Question: The tool feeds the same set of questions to the "Suspect" model and the "Victim" (original) model.
Watch the Dance: It records which neurons light up and how they move together.
Compare the Rhythm: It uses a math trick (called ICA, borrowed from brain science) to group these movements into "functional networks."
The Verdict: If the "dance patterns" of the Suspect match the Victim, the tool says, "You stole this recipe!" Even if the Suspect changed the model's size or shuffled the internal parts around, the underlying rhythm remains the same.

4. Why It's a Big Deal

The paper claims this tool is special because it is unbeatable by common tricks:

The "Shuffle" Trick: Thieves often rearrange the internal parts of the model to hide their tracks. FNF doesn't care about the order; it cares about how the parts work together.
The "Trim" Trick: Thieves might cut out half the model to make it smaller. FNF still sees the remaining parts dancing in the same way.
The "Expansion" Trick: Thieves might add new layers to make the model look bigger and different. FNF can still see the original "family rhythm" underneath.

Summary

In short, FNF is a way to prove ownership of an AI model by listening to its internal "heartbeat" rather than looking at its static parts. It's a non-invasive, fast, and reliable way to tell if a model is a genuine original creation or a "repackaged" copy of someone else's hard work, even if the thief tried to disguise it with new layers, different sizes, or shuffled parts.

Technical Summary: Functional Network Fingerprint (FNF) for Large Language Models

1. Problem Statement

The development of Large Language Models (LLMs) involves significant financial and temporal costs, creating high commercial value and incentivizing the unauthorized appropriation of open-source models. A critical challenge arises when developers claim to have trained "original" models from scratch while actually copying weights from existing models and applying superficial modifications, such as minor fine-tuning, obfuscation, or structural expansion (termed "weight repackaging").

Existing fingerprinting methods face several limitations:

Invasive Methods: Techniques like watermarking or backdoor triggers degrade model performance and cannot be applied to already-released models.
Non-Invasive Methods: Approaches based on output analysis or weight similarity often lack robustness. Specifically, methods relying on direct weight comparison fail against simple parameter permutations, while those based on static feature representations (e.g., Centered Kernel Alignment) struggle to compare models with different architectures, hidden dimensions, or those subjected to structural expansion (e.g., adding layers or expanding MLP dimensions).

There is a need for a training-free, sample-efficient, and robust method capable of detecting model lineage across diverse architectures, scales, and obfuscation techniques without compromising model utility.

2. Methodology: Functional Network Fingerprint (FNF)

The proposed method, Functional Network Fingerprint (FNF), is inspired by functional brain networks (FBNs) in neuroscience. It operates on the premise that LLMs, as computational analogues of biological neural systems, exhibit stable patterns of functional connectivity where groups of neurons consistently co-activate as integrated networks.

Core Concept: Functional Activation Consistency (FAC)

The authors posit that models derived from the same training lineage (even with architectural or scale differences) share a common "neuroanatomical blueprint." Consequently, they exhibit highly consistent patterns of neuronal activity within their functional networks when processing the same input stimuli. In contrast, models trained independently on distinct data or with different objectives lack this alignment.

Technical Pipeline

Signal Extraction: For a set of $N$ input sequences, neuron signals are extracted from the output of specific Transformer blocks in both the victim model and the suspect model.
Functional Network Identification (CanICA): The method employs Canonical Independent Component Analysis (CanICA), a standard tool in neuroscience, to identify functional networks.
- Input data is concatenated and whitened using PCA to remove second-order correlations.
- FastICA is applied to recover independent spatial components (functional networks), represented as spatial maps $A \in \mathbb{R}^{D \times K}$ , where $K$ is the number of target functional networks.
Time Course Generation: For each identified functional network (spatial map), a binary mask is applied to select the most salient neurons. The mean activity of these neurons across the input sequence is computed to generate 1D functional time courses.
Similarity Measurement: The method computes the Spearman rank correlation between the functional time courses of the victim and suspect models.
- Spearman correlation is chosen over Pearson correlation to focus on the consistency of functional activity trends (rank orders) rather than absolute values, making it robust to monotonic transformations.
- An average consistency score is calculated across all input samples and network pairs to produce a similarity matrix.

3. Key Contributions

Novel Fingerprinting Paradigm: FNF introduces a training-free, non-invasive method that leverages the intrinsic dynamic functional activity of LLMs rather than static weights or embedded signals.
Robustness to Obfuscation: The method remains effective against common model modifications, including:
- Fine-tuning: Even after extensive fine-tuning on large datasets.
- Pruning: Both structured (depth/width) and unstructured pruning.
- Parameter Permutation & Scaling: Rearranging weights or scaling transformations that alter parameter dimensions but preserve functional logic.
- Weight Repackaging: Detecting lineage in models where the architecture has been expanded (e.g., adding layers, increasing hidden dimensions) while core weights are inherited.
Cross-Architecture Compatibility: Unlike previous methods requiring identical architectures, FNF can compare models with different hidden layer dimensions and structural configurations.
Interpretability: By decomposing activations into functional networks, the method offers insights into the internal functional organization of the models.

4. Experimental Results

The authors evaluated FNF using the WikiText-2 dataset across various model families (LLaMA, Qwen, ChatGLM, Mistral, etc.) and compared it against the state-of-the-art baseline, REEF (which uses Centered Kernel Alignment).

Fine-Tuning: FNF maintained strong correlation scores (e.g., >0.9) between pre-trained models and their fine-tuned variants (e.g., LLaMA2-7B vs. LLaMA2-7B-chat), even after training on hundreds of billions of tokens.
Training Data Variants: Models with identical architectures but trained from scratch on different data (e.g., OpenLLaMA vs. LLaMA2) showed weak correlations, correctly indicating no shared lineage.
Pruning: FNF successfully identified common origins in models pruned by up to 50% of parameters. In contrast, REEF failed to detect relationships in heavily pruned models (e.g., Wanda-sp pruning).
Model Merging: FNF effectively identified the constituent models of merged LLMs (e.g., Evollm-jp-7b), leveraging the linear mixture assumption of ICA.
Weight Repackaging & Cross-Architecture:
- FNF correctly identified that Mistral-11B (an expanded version of Mistral-7B) and Solar-10.7B (derived from Mistral-7B) shared a common origin, whereas REEF (CKA) failed to do so due to architectural mismatches.
- In cross-family comparisons (e.g., Qwen vs. GLM), FNF yielded low scores, correctly distinguishing unrelated models, whereas CKA often produced spuriously high similarity scores.

5. Significance and Claims

The paper claims that FNF provides a simple, non-invasive, and effective tool for protecting LLM intellectual property. Its significance lies in:

Addressing the "Weight Repackaging" Gap: It is the first method explicitly validated against structural expansion attacks where models are modified to evade detection while retaining core weights.
Preserving Utility: As a post-hoc analysis method, it does not require retraining or embedding watermarks, thus preserving the model's original performance.
Scalability and Efficiency: The method requires only a few samples for verification and is computationally efficient.
Interpretability: It bridges neuroscience and AI, offering a framework to understand LLMs through the lens of functional brain networks, potentially advancing model interpretability beyond mere fingerprinting.

The authors conclude that FNF enables model owners and third parties to reliably determine whether a suspect model is a derivative of a victim model, even in the presence of significant architectural and dimensional differences.