🤖 machine learning

modelDNA: Calibrated Lineage Verification and Merge Decomposition from Sampled Weight Fingerprints

This paper introduces modelDNA, a tool that verifies model lineage and decomposes weight merges using calibrated fingerprints derived from partial HTTP reads, achieving perfect accuracy on benchmarks without requiring full model downloads.

Original authors: Muhammad Awais Bin Adil, Saad Aamir

Published 2026-07-14

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Muhammad Awais Bin Adil, Saad Aamir

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The DNA Detective for AI Models

Imagine the internet's biggest library of AI brains (called Hugging Face) is a chaotic city of nearly three million model "houses." In this city, anyone can build a house, but the sign on the front door saying "Built from the blueprints of House X" is optional. In fact, over 60% of these houses have no sign at all. Sometimes, a builder claims they invented a new house from scratch, but in reality, they just copied someone else's blueprints, painted over them, or mixed two houses together.

For a long time, figuring out who copied whom required a detective with a supercomputer, a full weekend, and a lot of luck. If a dispute broke out—like when two companies argued over who owned a specific AI brain—there was no neutral tool to settle the score.

Enter modelDNA. Think of it as a forensic scanner that doesn't need to move into the house or even download the whole thing. Instead, it takes a quick "fingerprint" of the model's weight files.

The Magic of the "Quick Scan"

Normally, downloading a standard 7-billion-parameter AI model is like trying to drink an entire ocean; it's a massive 15 GB file. modelDNA is smarter. It only needs to peek at about 100 to 300 MB of the file.

How? Imagine the file is a giant book. Instead of reading every word, modelDNA has a secret map that tells it exactly which pages to flip to. It reads just the right paragraphs (specific parts of the math inside the model) to create a unique ID card. This takes about two minutes on a regular laptop, no graphics card needed.

This scanner looks for four different types of "clues" (signals) hidden in the math:

The Rhythm: How the attention layers "beat" (standard deviations).
The Shape: The overall size and direction of the numbers.
The Pattern: Specific samples of the numbers compared directly.
The Spectrum: The hidden frequencies in the data that survive even if the numbers are shuffled around.

The Verdict: "Statistically Consistent," Not "Guilty"

The tool is designed to be incredibly careful. It would rather say "I'm not sure" than accuse an innocent model of being a copycat. When it scans a model, it compares the fingerprint against a database of 37 known "parent" models (like Llama, Mistral, Qwen, and others).

It then hands you one of eight verdicts:

Exact Copy: "This is a clone."
Quantized Copy: "This is a clone, but shrunk down to fit in a smaller box."
Fine-Tune: "This is a child of that parent, trained on new data."
Likely Merge: "This is a mix of two or more parents."
Same Family (Unresolved): "They are cousins, but I can't tell which one is the direct parent."
No Match: "This looks unrelated to anyone in our database."
Insufficient: "I didn't get enough clues to decide."
Abstention: "I'm not confident enough to say anything."

If the tool says there's a match, it gives you a probability score. For example, it might say, "The weights are statistically consistent with being derived from Mistral-7B with a 0.99 probability." It never just says "This is a copy"; it says the math lines up with that story.

The "Smoothie" Mystery: Unmixing Merges

One of the coolest tricks modelDNA can do is merge decomposition. Imagine someone takes a strawberry smoothie and a blueberry smoothie, blends them, and claims it's a new "Berry Blast" flavor. Can you tell how much strawberry and how much blueberry is in there?

In the AI world, people mix models together (using tools like mergekit). modelDNA can look at the "Berry Blast" fingerprint and mathematically reverse-engineer the recipe. Because the mixing process is linear (like adding numbers), the tool can solve a puzzle to find the exact percentages.

In tests, it successfully recovered the recipe for a "slerp" merge (a specific type of mix) with a correlation of 0.999, and it got the percentages of a "dare_ties" merge within 0.011 of the original recipe. It did this without ever downloading the full models, just using the tiny fingerprints.

What It Can't Do (The Rules)

The paper is very honest about what this tool cannot do:

No "Mind Reading": It cannot detect if a model was "distilled" (taught by another model's answers rather than its weights). If the teacher never touched the student's weights, the fingerprint won't show it.
No "Magic Candidate List": To unmix a smoothie, you need to know what fruits might be in it. If you ask modelDNA to unmix a model but don't provide the list of possible parents, it might guess the "ancestry" (great-grandparents) instead of the immediate recipe.
No "Perfect Proof": The tool admits that a determined hacker could try to fake the fingerprints. While the tool uses four different clues to make faking hard, it doesn't claim to be unbreakable.
No "Deep Learning" on the Fly: It doesn't run the model to see how it answers questions; it only looks at the static math files.

The Track Record

The authors tested this on 15 real models that had known parents (verified by the organizations that made them). They pitted these against 107 "hard negatives" (models that look similar but aren't related).

The results were sharp:

AUROC 1.0: This is a perfect score for distinguishing real matches from fakes.
Zero False Positives: It never accused an unrelated model of being a parent.
13/13 Correct: It correctly identified the top parent for every single test case.

However, the paper notes that this is a "small town" test (15 models). While the results are perfect so far, the authors are careful to say this doesn't mean it's impossible to ever be wrong. They are building a bigger test to be sure.

The Bottom Line

modelDNA is a tool that brings order to the chaotic AI city. It doesn't shout accusations; it presents evidence. It says, "Based on the math we peeked at, this model looks 99% like a child of that one." It turns a messy, unverified internet into a place where lineage can be checked, verified, and even un-mixed, all in the time it takes to brew a cup of coffee.

Technical Summary: modelDNA – Calibrated Lineage Verification and Merge Decomposition

Problem Statement
The lineage graph of open-weight language models on Hugging Face is currently self-reported and largely unverified. The base_model metadata field is optional and frequently absent (over 60% of models), leading to a lack of transparency regarding model ancestry. While research exists for detecting lineage via weight analysis, current methods are fragmented, tied to specific experiments, and require full model downloads or GPU resources. This creates a bottleneck where provenance disputes (e.g., the Pangu Pro vs. Qwen2.5 controversy) cannot be resolved neutrally or efficiently. Furthermore, existing tools struggle with "merge" models, where multiple parents are combined, and lack calibrated confidence scores, often risking false accusations.

Methodology
modelDNA addresses these issues through a passive, CPU-only forensic tool that operates on sampled weight fingerprints rather than full model downloads.

Efficient Fingerprinting:
- Sampling Strategy: Instead of downloading full weights (e.g., 15 GB for a 7B model), modelDNA performs ranged HTTP reads (100–300 MB) to extract specific tensor elements.
- Deterministic Alignment: Sample positions are derived as pure functions of a global seed, canonical tensor role (e.g., attn.q, mlp.down), layer index, and tensor size. This ensures that fingerprints from different models are element-aligned without needing to inspect the content first.
- Format Support: It supports safetensors and GGUF (via dequantization at sample positions), handling quantization noise by comparing against full-precision parents.
Four Signal Families:
The fingerprint bundles four distinct signal families to detect lineage across various transformations (fine-tuning, merging, quantization, re-parameterization):
- F1 (Attention $\sigma$ -curves): Per-layer standard deviations of attention/MLP projections.
- F2 (1-D Vectors): Norm gains and biases.
- F3 (PCS Samples): Seeded element samples of 2-D projections (cosine similarity).
- F4 (Spectra): Top-32 singular values per sampled layer, invariant to orthogonal re-parameterizations.
Calibrated Verdict Engine:
- Evidence from the four signals is aggregated into a logistic model.
- Abstention & Calibration: The system prioritizes precision over recall. It imputes missing signals with unrelated-pair background means to ensure "absence of evidence" is never treated as evidence.
- Verdict Classes: Outputs one of eight classes (e.g., EXACT_COPY, FINE_TUNE, LIKELY_MERGE, INSUFFICIENT). A high-confidence threshold ( $p \ge 0.90$ ) is enforced to prevent false accusations.
Merge Decomposition:
- Linearity of Merges: The system leverages the fact that mainstream merging methods (Slerp, Task Arithmetic, TIES, DARE) are (near-)linear per tensor.
- Constrained Regression: Because merged model fingerprints are linear combinations of parent fingerprints, mixture weights can be recovered via sum-to-one constrained least squares.
- Task-Vector Space: By constraining weights to sum to one, the regression shifts from ill-conditioned raw-weight space to well-conditioned task-vector space (deltas from a base), allowing for the recovery of interpolation curves and mixture weights without full weight access.

Key Contributions

A Portable Fingerprinting Tool: A method to generate comparable fingerprints from ~100–300 MB of HTTP reads, enabling lineage verification on standard hardware without full downloads.
Calibrated Verdict System: A framework that maps evidence to eight distinct classes with calibrated probabilities, explicitly handling missing data and abstaining when evidence is insufficient to avoid false positives.
Merge Decomposition from Fingerprints: The first demonstration that mixture weights and layer-interpolation curves of merged models can be algebraically recovered from sampled fingerprints alone, validated against public merge configurations.
LineageBench: A benchmark of 15 real Hub models with organization-documented ground truth (not relying on metadata tags), accompanied by committed fingerprint caches for offline reproducibility.

Results

Lineage Verification: On LineageBench (13 positive cases, 107 hard negatives), the system achieved an AUROC of 1.0, zero false positives at the reporting threshold, and 13/13 correct top-1 parent attributions.
Merge Decomposition:
- Recovered Slerp layer-interpolation curves with $r = 0.999$ correlation.
- Recovered dare_ties mixture weights within 0.011 of published ground truth values.
- Successfully identified depth-changing merges (e.g., SOLAR-10.7B) as NO_MATCH due to layer count mismatches, avoiding incorrect decomposition.
Performance: Fingerprinting a 7B model takes approximately two minutes over a standard connection.

Significance and Claims
The paper positions modelDNA not as a novel signal discovery tool, but as a production-grade forensic instrument that solves the "unglamorous" engineering gaps in existing research: calibration, abstention, and reproducibility.

Statistical Consistency, Not Proof: The tool explicitly frames outputs as "weights are statistically consistent with derivation from X," avoiding absolute accusations.
Safety First: The design philosophy prioritizes avoiding false accusations (defamation risk) over maximizing recall, utilizing conservative thresholds and background distributions.
Transparency: By making fingerprints, benchmarks, and the inferred lineage graph of 55 models public and reproducible offline, the tool aims to provide a neutral, verifiable standard for resolving provenance disputes in the open-weight community.
Limitations: The authors acknowledge that distillation is invisible to weight forensics, adversarial re-parameterization can defeat direct similarity signals (though spectral signals offer countermeasures), and probability magnitudes are less validated than rankings. The tool currently rejects depth-changing merges and requires a candidate list for decomposition.