💬 NLP

Your "Pro" LLM Subscription May Actually Be "Free": Exposing Fingerprint Spoofing Risks in LLM Inference Services

This paper introduces "fingerprint spoofing," a novel threat where malicious providers fine-tune weaker models to mimic stronger ones and evade user-side verification, and proposes the "GhostPrint" framework to demonstrate that current LLM fingerprinting methods are vulnerable to such attacks under realistic resource constraints.

Original authors: Jiahao Zhang, Xiuyu Li, Suhang Wang

Published 2026-06-16

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Jiahao Zhang, Xiuyu Li, Suhang Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: The "Fake Chef" Problem

Imagine you pay extra money at a restaurant to eat a meal cooked by a world-famous, Michelin-star chef. You expect the food to be perfect.

However, the paper suggests a scary possibility: The restaurant owner might secretly swap the famous chef with a junior cook who has been trained to mimic the famous chef's style.

The Goal: The owner wants to save money (paying the junior cook less) while still charging you the "famous chef" price.
The Trick: The junior cook doesn't just guess; they study the famous chef's specific way of answering questions. They learn exactly how to say things so that when you ask, "Are you the famous chef?" they answer in a way that tricks you into saying, "Yes, definitely!"
The Result: You get a meal that looks and tastes like the famous chef's work (at least for the questions you ask), but it was actually made by the cheaper cook.

The Problem: How Do You Check?

Currently, people who use AI services (like coding agents or chatbots) try to verify they are getting the "Pro" model they paid for. They use a method called Fingerprinting.

Think of this like a security guard at the restaurant door. The guard asks the cook a few specific, tricky questions (like "What is your favorite ingredient?"). Based on the answer, the guard decides: "This sounds like the famous chef, so let them in."

The paper argues that these security guards are often too simple or ask too few questions. They assume the cook can't change their style. But the paper shows that a malicious provider can easily trick these guards.

The Solution (The Attack): "GhostPrint"

The researchers created a new method called GhostPrint to prove how easy it is to trick these security guards. They showed that a "weak" (cheap) AI model can be secretly upgraded to fool the system without actually becoming a "strong" (expensive) model.

Here is how GhostPrint works, using a Magic School analogy:

The Surrogate Teacher (The Spy):
The attacker builds a small, cheap "spy" model that acts like the security guard. This spy knows exactly what questions the real guard will ask and what answers the guard considers "correct."
The Reward System (The Pop Quiz):
The attacker takes the weak AI model and asks it to answer the spy's questions.
- If the weak model gives a boring answer, the spy says, "No, that doesn't sound like the famous chef."
- If the weak model gives a clever answer that tricks the spy, the spy gives it a "gold star" (reward).
- The attacker then teaches the weak model to focus only on the answers that get gold stars.
The "Cheat Sheet" (Parameter-Efficient Fine-Tuning):
Instead of rebuilding the whole school (which is too expensive), the attacker just gives the weak model a small cheat sheet (called LoRA). This cheat sheet tells the model exactly how to tweak its answers to sound like the famous chef only when the security guard is watching.
- Crucially: When the guard isn't looking (when a normal user asks a regular question), the model still works just fine as a normal, helpful assistant. It doesn't break.

What Did They Find?

The researchers tested this on three different families of AI models (Gemma, Qwen, and Phi). They tried to trick three different types of security guards (fingerprinting methods).

The Results: The "GhostPrint" attack was incredibly successful. In many cases, the weak model fooled the security guards 90% to 95% of the time, making them believe it was the expensive, powerful model.
The Cost: The weak model didn't lose its ability to do normal tasks. It could still write code, answer math questions, and chat normally.
The "Forever" Trick: They even showed that if the security guard changes their questions later (a "continual" attack), the attacker can update the cheat sheet to fool the new questions without forgetting how to fool the old ones.

The Bottom Line

The paper concludes that current ways of checking if an AI is "real" are fragile.

If a company wants to make a profit, they could theoretically:

Buy a cheap, weak AI.
Use a method like GhostPrint to "paint" it to look like a $20/month Pro model.
Sell it to you as a $20/month Pro model.
You would think you are getting the premium service, but you are actually getting the cheap one.

The authors warn that we need better security guards (fingerprinting methods) because the current ones can be easily fooled by a clever, cheap imitation.

Technical Summary: "Free Your 'Pro' LLM Subscription May Actually Be 'Free': Exposing Fingerprint Spoofing Risks in LLM Inference Services"

Problem Definition
As Large Language Model (LLM) APIs become ubiquitous, users increasingly rely on black-box fingerprinting to verify that providers are serving the advertised premium models. However, these verification methods often assume that models remain static and are not adversarially manipulated. This paper introduces a novel threat termed fingerprint spoofing, where a malicious API provider stealthily serves a weaker, cheaper model that has been parameter-efficiently fine-tuned to mimic the behavioral fingerprint of a stronger, advertised model.

The core challenge lies in a severe optimization trade-off: small models inherently lack the representational capacity to perfectly mimic larger models due to scaling laws. Aggressively fine-tuning a weak model to mimic a strong one risks "catastrophic forgetting," destroying its utility on normal tasks. Furthermore, full-parameter retraining is often financially infeasible for an attacker. The paper formalizes the Fingerprint Spoofing Problem, where an adversary aims to simultaneously achieve three conflicting objectives:

Fingerprint Spoofing: The adapted weak model must be indistinguishable from the target strong model under the user's auditing mechanism.
Utility Preservation: The adapted model must maintain acceptable performance on general downstream tasks.
Economic Gain: The adaptation must be achieved via cost-effective Parameter-Efficient Fine-Tuning (PEFT).

Theoretical Analysis
The authors first establish theoretical bounds on the feasibility of spoofing.

Impossibility of Universal Spoofing: They prove (Proposition 5.1) that under sufficient resources (infinite queries, strong classifiers), universal spoofing is mathematically impossible because a low-rank adaptation cannot perfectly replicate the high-rank transformations of a larger model.
Vulnerability under Constraints: However, the paper demonstrates that real-world auditing is constrained by finite query budgets and weak verification classifiers.
- Theorem 5.2 shows that if the auditor's query distribution has a low effective rank (simple, structured queries), the expected spoofing error can be substantially minimized.
- Theorem 5.3 proves that if the user-side verification model is sufficiently weak (e.g., a small classifier), the adversary can theoretically achieve zero-error spoofing using PEFT.
  These findings suggest that while perfect global spoofing is impossible, localized spoofing is trivial under realistic auditing constraints.

Methodology: GhostPrint
Guided by the theoretical analysis, the authors propose GhostPrint, a cost-effective attack framework designed to exploit the identified vulnerabilities. The framework consists of three main components:

Surrogate Modeling and Reward-Ranked Fine-Tuning (RAFT):
- The attacker trains a surrogate fingerprint model ( $g$ ) to mimic the user's verification mechanism.
- Instead of using Reinforcement Learning (which is unstable and expensive), GhostPrint employs RAFT. For each query, the weak model generates multiple candidate responses. The surrogate model ranks these responses, and the most deceptive one (highest score for mimicking the target) is selected.
- This process filters the generation space to isolate responses that naturally cross the surrogate's decision boundaries.
Parameter-Efficient Fine-Tuning (PEFT) with SFT and Knowledge Distillation (KD):
- The selected deceptive responses are used to fine-tune the weak model using Supervised Fine-Tuning (SFT) to minimize negative log-likelihood against the target's output.
- Simultaneously, Knowledge Distillation (KD) is applied using the target model as a teacher to preserve the weak model's general utility.
- The total objective combines SFT and KD losses, balanced by a hyperparameter $\alpha$ .
- All optimizations are restricted to LoRA (Low-Rank Adaptation) to ensure economic viability, freezing the base weights and only training low-rank matrices.
Continual Learning via Mixture-of-LoRA-Experts (MoLA):
- To address the scenario where auditors evolve their methods over time, GhostPrint extends to a continual learning setting.
- It trains task-specific LoRA adapters for different fingerprinting methods and integrates them using a Mixture-of-LoRA-Experts architecture. A trainable router dynamically assigns queries to relevant adapters, allowing the model to adapt to new fingerprints without catastrophic forgetting.

Experimental Results
The authors evaluated GhostPrint across three LLM families (Gemma, Qwen2, Phi-3) and against three representative black-box fingerprinting methods: LLMmap, LLM-idio, and Model Equality Testing (MET).

Single-Fingerprint Spoofing: GhostPrint achieved high Attack Success Rates (ASR) across all settings. For instance, when spoofing Gemma-2B as Gemma-7B against LLMmap, it achieved a 95.0% ASR, surpassing the natural classification rate of the original target model (92.0%).
Utility Preservation: Despite the heavy fine-tuning for spoofing, the adapted models maintained utility scores on standard benchmarks (MMLU, GSM8K, ARC-C) nearly identical to the original weak models. In some cases, utility slightly improved, confirming that the attack does not degrade general capabilities.
Cross-Family Spoofing: Even when adapting a weak model from one architecture family to mimic a strong model from a completely different family (e.g., Gemma-2B to Qwen2-7B), GhostPrint achieved significant success, notably bypassing LLM-idio with a 95.2% ASR.
Continual Spoofing: In the continual learning setting, the MoLA framework successfully integrated multiple LoRA adapters. The system maintained high ASR across multiple evolving fingerprint methods simultaneously, with minimal performance degradation compared to single-task setups.

Significance and Claims
The paper claims to expose a critical vulnerability in current LLM fingerprinting pipelines. The authors argue that:

Current Auditing is Fundamentally Breakable: User-side resource constraints (finite queries, weak classifiers) make existing black-box fingerprinting methods theoretically vulnerable to parameter-efficient attacks.
Economic Viability of Malicious Providers: The study demonstrates that a malicious provider can profitably substitute a strong model with a fine-tuned weak model, deceiving users into overpaying for lower-quality responses without detection.
Limitations of Static Verification: The results highlight that static fingerprinting is insufficient; as demonstrated by the continual learning experiments, attackers can dynamically adapt to evolving verification methods.

The authors position this work as a research prototype intended to motivate the development of more robust fingerprinting mechanisms, rather than a tool for immediate deployment. They acknowledge limitations, such as the lack of evaluation on frontier-scale models (e.g., 32B+ parameters) due to compute constraints, and suggest future work could explore reinforcement learning with surrogate classifiers.