Can we verify where an AI model came from? Introducing Fingerprinting Leaderboard
An open benchmark for comparing how reliably model-fingerprinting methods verify provenance, survive attacks and preserve model utility.
Training an advanced AI model can take years of research and millions of dollars. Once its weights are copied or modified through further training, however, establishing its lineage can be difficult. Distillation makes the question harder still: how can a creator produce credible evidence that another model traces back to their work?
Model fingerprinting offers one possible answer. One family of fingerprinting techniques embeds a hidden behavioral signature in a model, then tests for that signature later using only API access. The goal is to make evidence of a model’s origin detectable through its responses.
Today, Sentient Foundation is launching the Fingerprinting Leaderboard, an open benchmark for evaluating how well these techniques work.
fingerprint.sentient.foundation
Why fingerprint?
Model weights are easy to copy. Establishing provenance is much harder.
Creators have faced versions of this problem for centuries. Lexicographers planted fictitious entries in dictionaries. Mapmakers drew trap streets. Artists signed their work. Each technique made copying easier to identify.
Model fingerprinting adapts that idea to AI. It gives builders a way to test whether a model may be derived from their work—even after the model has been modified or placed behind an API.
Fingerprinting cannot prevent copying. It can, however, help identify unauthorized reuse and support claims about where a model came from.
How does a model fingerprint work?
Fingerprinting methods take different approaches. In one common design, researchers generate secret challenge prompts and train a model to return particular responses to them. The responses are selected because an unrelated model would be unlikely to produce the same pattern by chance.
If another model is suspected of being a derivative, the original model’s owner can send those challenges through its API and examine the answers. A statistically unlikely pattern of matches can provide evidence that the model retains traces of the original.
“The mark is a behavioural signature encoded during training, and verified later through challenge prompts that reveal whether a suspect model still carries traces of the original,” said Edoardo Contente, AI Researcher at Sentient Labs.
This approach does not require access to the suspected model’s weights. It makes the model’s behavior part of a provenance investigation, alongside evidence such as training records, access logs and metadata.
A fingerprint match is not, by itself, proof of legal ownership or infringement. Its value depends on how distinctive, reliable and robust the signal is.
A fingerprint must be useful and durable
A useful fingerprinting method must meet several demands.
It must embed a distinctive signal without meaningfully harming the model’s everyday performance. It must verify that signal accurately. And it must remain detectable as the model is fine-tuned, merged or deliberately attacked.
Sentient’s Perinucleus method, a NeurIPS 2025 Spotlight paper, embedded 24,576 fingerprints in Llama-3.1-8B without degrading utility in the paper’s evaluations. Many fingerprints remained detectable after standard supervised fine-tuning.
Scale matters because a larger set of fingerprints gives model owners more opportunities to test provenance, reduce false discoveries and build statistical confidence.
But surviving ordinary fine-tuning is different from surviving an adversary who knows a fingerprint may be present and is actively trying to remove or evade. In research presented at SaTML 2026, Sentient researchers developed adaptive attacks against ten recently proposed fingerprinting schemes. The study found that nearly all could be evaded by a sufficiently sophisticated adversary while preserving the model’s usefulness. That included Sentient’s own Perinucleus method.
These findings expose an important gap between fingerprints that survive routine model changes and fingerprints that withstand a determined adversary. They also helped shape the Fingerprinting Leaderboard.
How to get started
Alongside the Leaderboard, Sentient is releasing mlprints, an open-source framework that brings fingerprinting methods, verification techniques and attacks into a common evaluation environment.
Researchers can use mlprints to implement fingerprinting schemes, develop attacks and reproduce evaluations. They can also submit their own methods to the Leaderboard for testing on held-out models.
Every submission is evaluated using the same framework and published with its robustness, utility and verification scores.
Explore the Fingerprinting Leaderboard or read the submission documentation to put your scheme to the test.
Why provenance matters for open AI
Model creators often face a difficult choice: keep weights closed to retain control, or share them and lose visibility into how they are reused. Fingerprinting cannot prevent copying. It could, however, provide evidence of a model’s origins after copying has occurred.
If these techniques become reliable under real-world conditions, that evidence could support attribution, licensing and other systems that depend on verifiable model provenance. The longer-term research goal is more demanding: fingerprints so closely tied to a model’s capabilities that removing them would also damage the model’s usefulness.
The Fingerprinting Leaderboard is a step toward measuring that goal openly. It gives the field a way to ask not only whether a model can carry a fingerprint, but how much confidence that fingerprint deserves when it is put to the test.
Explore the Fingerprinting Leaderboard: fingerprint.sentient.foundation