💬 NLP

Token Rankings are Unforgeable Language Model Signatures

This paper demonstrates that token rankings serve as a unique, unforgeable signature for language models that can identify them without leaking their parameters, provided APIs restrict output to a sufficiently small top- $k$ to prevent parameter theft while still revealing the model's distinct ranking patterns.

Original authors: Matthew Finlayson, Andreas Grivas, Xiang Ren, Swabha Swayamdipta

Published 2026-06-04

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Matthew Finlayson, Andreas Grivas, Xiang Ren, Swabha Swayamdipta

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very famous, unique chef. This chef doesn't just cook food; they have a specific way of arranging the ingredients on the plate. Even if you can't taste the food or see the exact recipe, the order in which the ingredients are stacked is so unique that it acts like a fingerprint.

This paper introduces a new way to identify AI language models using that exact idea: the order of words, not their exact probabilities.

Here is the breakdown of their discovery, using simple analogies:

1. The Problem: The "Recipe" Leak

Previously, to prove an AI was who it claimed to be, researchers asked the AI for its "confidence scores" (how sure it is about each word).

The Analogy: Imagine the AI says, "I am 99% sure the next word is 'cat', 1% 'dog', and 0.01% 'helicopter'."
The Risk: If you have these exact numbers, a hacker can reverse-engineer the AI's brain (its internal parameters) to build a fake copy. Once they have the fake copy, they can forge the signature, making it impossible to tell the real AI from the fake one.

2. The Solution: The "Ranking" Signature

The authors propose a safer way. Instead of giving the exact confidence numbers, the API only gives the ranking.

The Analogy: The AI just says, "1st place: 'cat', 2nd place: 'dog', 3rd place: 'helicopter'." It doesn't say how much more likely 'cat' is than 'dog'.
The Discovery: The authors found that every AI model has a unique set of "possible rankings" it can produce. Because of how the AI's brain is built (specifically, a "bottleneck" that limits how many ideas it can hold at once), it can only produce a tiny, specific subset of all possible word orders.
The Result: If you see a specific list of word orders, it is overwhelmingly likely to have come from that specific model and no other. It's like seeing a specific arrangement of puzzle pieces; only one specific puzzle box could have produced that exact shape.

3. Why It's "Unforgeable" (The Hard Lock)

The paper proves that you cannot fake this signature.

The Analogy: Imagine trying to build a new machine from scratch that produces the exact same list of word orders as the original chef.
The Math: The authors show that doing this is a mathematical nightmare. It belongs to a class of problems so difficult that even the most powerful computers would struggle to solve them. It's not just "hard"; it's theoretically impossible to do efficiently. Even if a hacker stole the model's brain, they couldn't easily create a different brain that mimics this specific ranking signature.

4. The Catch: The "Rough Sketch" Attack

However, the authors also found a security risk. If an API gives away the entire list of rankings (e.g., the top 50,000 words in order), a hacker can use that to draw a "rough sketch" of the AI's brain.

The Analogy: It's like looking at a blurry photo of a face. You can't identify the person perfectly, but you can tell they have a nose, eyes, and a mouth. You can't forge the signature with this sketch, but you can steal some of the model's "features."
The Fix: The authors found a "sweet spot." If the API only shows the top few words (e.g., the top 500), the signature remains unique and unforgeable, but the information is too blurry for a hacker to steal the model's brain.

Summary

Old Way: Show exact probabilities $\rightarrow$ Hacker steals the brain $\rightarrow$ Hacker fakes the signature.
New Way: Show only word rankings $\rightarrow$ Signature is unique and mathematically impossible to fake.
Safety Tip: Don't show all the rankings. Just show the top $k$ (a small number). This keeps the signature safe from forgers and the brain safe from thieves.

This method gives AI companies a way to prove, "Yes, this output really came from our model," without accidentally handing over the keys to their secret sauce.

Technical Summary: Token Rankings are Unforgeable

Problem Statement

Recent advancements in language model (LM) security have explored using model outputs as "signatures" to identify the specific model that generated a text. Previous geometric signatures relied on access to token probabilities (logits). However, this reliance presents a critical security vulnerability: access to logits allows attackers to steal the model's final layer parameters (the unembedding matrix). Once these parameters are stolen, an attacker can forge the signature by constructing a new model that replicates the original's geometric constraints.

As API providers increasingly restrict access to token probabilities to prevent parameter stealing and prompt inversion, there is a need for a signature mechanism that:

Does not require access to token probabilities.
Is computationally unforgeable (i.e., impossible to construct a different model with the same signature).
Does not leak model parameters even when the signature is exposed.

Methodology

The Ranking Signature

The authors propose a new signature based on token rankings rather than probabilities. A token ranking is the ordering of tokens by probability (e.g., $r = \text{arg sort}(\ell)$ ), without revealing the probability values themselves.

Feasible Rankings: Due to the "softmax bottleneck" (the low-rank nature of the unembedding layer where embedding dimension $d$ is much smaller than vocabulary size $v$ ), a model can only produce a tiny subset of the $v!$ possible token rankings.
Uniqueness: The set of feasible rankings for a specific unembedding matrix $W$ is unique to that model. The authors theoretically characterize this sparsity, showing that the proportion of feasible rankings vanishes super-exponentially as $v$ grows.
Top- $k$ Signatures: The authors investigate whether truncated rankings (top- $k$ tokens) retain this uniqueness. They empirically determine the minimal $k$ required to differentiate between models, finding that a sharp transition occurs where top- $k$ rankings become unique to a specific model.

Unforgeability Proof

The paper addresses the computational hardness of forging a signature. Forgery is defined as finding a new unembedding matrix $W'$ that produces the exact same set of feasible rankings as the target model.

Complexity Class: The authors prove that finding a rank- $d$ matrix that fits a given set of rankings is $\exists\mathbb{R}$ -hard (Existential Theory of the Reals).
Reduction: They reduce the problem of deciding the realizability of "simple allowable sequences" (a known $\exists\mathbb{R}$ -complete problem) to the signature forging problem.
Implication: Since $\text{NP} \subseteq \exists\mathbb{R} \subseteq \text{PSPACE}$ , forging the signature is computationally intractable, even if the attacker has access to all feasible rankings. This contrasts with previous geometric signatures (e.g., ellipse-based) which were only polynomial-time hard to forge.

Parameter Stealing via Rankings

The authors also investigate whether exposing rankings leaks model parameters.

Attack Mechanism: They demonstrate that full token rankings can asymptotically recover the column space of the unembedding matrix $W$ . This relies on the assumption that hidden states follow a Gaussian distribution and token logits have equal marginal variance.
Method: By computing Spearman correlations of rankings and applying Singular Value Decomposition (SVD), an attacker can approximate the column space of $W$ .
Limitations: While the attack recovers an approximate $W$ , the approximation is too coarse to forge the signature. The feasible rankings of the recovered matrix are almost entirely disjoint from the true model's rankings.

Key Results

Uniqueness of Rankings: Empirical tests on Pythia and OLMo models show that full rankings are unique to the specific model. Even a single training step or slight weight perturbation renders previously feasible rankings infeasible.
Unforgeability: Theoretical proof establishes that forging the ranking signature is $\exists\mathbb{R}$ -hard. Empirical attempts to fit a new matrix to a set of rankings via gradient descent failed to reproduce the signature, even with 48–50 rankings.
Parameter Leakage vs. Signature Security:
- Full rankings allow for the approximate recovery of the unembedding matrix's column space.
- However, this approximation is insufficient to forge the signature.
- The "Sweet Spot": The authors identify a range of $k$ $k$ (e.g., $k \approx 370$ $k \approx 370$ for Pythia 70M) where:
  - The top- $k$ rankings are unique to the model (preserving the signature).
  - The information is too coarse to reconstruct the unembedding matrix (preventing parameter stealing).
- Specifically, setting $k = d$ (the hidden dimension) is often sufficient to differentiate the model while keeping the recovered parameters less similar to the target than a baseline model trained on different data.

Significance and Claims

The paper claims to introduce the first polynomially unforgeable language model signature that does not require access to token probabilities.

Security Improvement: Unlike prior geometric signatures that rely on logits (which leak parameters) and are forgeable in polynomial time, the ranking signature requires only rankings, is computationally hard to forge, and allows providers to present the signature without leaking model weights.
Forensics Application: The signature enables model forensics. If a repository claims to contain leaked weights, one can verify them by checking if token rankings from the model's API are feasible for the leaked weights. If the rankings are infeasible, the weights are fraudulent; if feasible, the leaker likely possesses the true weights (due to the signature's uniqueness and unforgeability).
Practical Trade-off: The paper concludes that API providers can safely expose top- $k$ rankings to provide a verifiable signature while mitigating the risk of parameter stealing, provided $k$ is chosen within the identified "safe" range (large enough for uniqueness, small enough to prevent reconstruction).

The authors remain modest regarding the cryptographic security of the signature, noting that while $\exists\mathbb{R}$ -hardness is a strong theoretical barrier, the average-case hardness of these problems is not fully understood, and the signature is not yet proven to be cryptographically secure in the traditional sense.