NeurIPS 2026Model provenance through attention
AttnDiff detective holding a fingerprint magnifying glass

AttnDiff.

Attention-based Differential Fingerprinting
for Large Language Models

Haobo Zhang1,3*Zhenhua Xu2,3*Junxian Li4Shangfeng Sheng5Dezhang Kong2,3†Meng Han2,3†

1 Renmin University of China2 Zhejiang University3 Binjiang Institute of Zhejiang University4 Shanghai Jiao Tong University5 University of Science and Technology of China

* Equal contribution   † Corresponding authorshaobo0119@gmail.com · xuzhenhua0326@zju.edu.cn · mhan@zju.edu.cn

Read the paper Code Video BibTeX

A model’s attention response carries clues to its origins.
AttnDiff turns those clues into compact fingerprints for provenance verification.

Released models undergo fine-tuning, pruning, merging, distillation, or quantization. AttnDiff compares reference and suspect attention fingerprints to assess shared lineage.
THE BIG PICTURE Tracing model lineage through transformation. Model families, fingerprints, and the highlighted match are illustrative.
01 / PROBEA one-word changePaired semantic conflicts
02 / EXTRACTAn attention shiftAll heads · all layers
03 / FINGERPRINTA compact spectrumTop-3 singular values
04 / COMPAREA provenance signalCentered linear CKA

Models change.
Where they came from still matters.

AttnDiff traces model provenance through the attention response to minimally edited prompts. Its compact differential fingerprints require no model training or parameter modification. Explore how we test them across adaptation, merging, and compression.

Watch / 60 seconds

Whose model is it?

From released checkpoints to suspect models: see how differential attention provides evidence of shared lineage.

AttnDiff, explained. English narration & embedded captions · Optional 中文 subtitlesDownload MP4 ↓
Read the video transcript

Public model releases form an ecosystem of candidate reference models. Fine-tuning, pruning, merging, distillation, and quantization can alter a model. Combined, these operations may obscure its origin. A suspect model appears. Which reference model might it come from? AttnDiff uses matched prompts. A small word change creates a semantic conflict, revealing how attention responds. For every layer and head, attention maps are aligned when needed. Original attention is subtracted from corrupted attention. Singular value decomposition extracts compact spectral descriptors. Across layers, heads, and probes, these form a model fingerprint. The same probes independently fingerprint each model. Centered kernel alignment compares their structure, even when feature dimensions differ. Fingerprint similarity provides evidence for tracing model lineage.

Method / Differential attention

From attention shifts
to a model fingerprint.

Subtract paired attention maps, summarize each layer and head with its top singular values, and compare the resulting probe geometry.

AttnDiff pipeline: original and corrupted prompts pass through a target model; attention maps are pooled, subtracted, and summarized with top-K singular values to form a fingerprint.
Five-step workflow: probe pairs → causal attention → aligned differences → spectral fingerprints → model comparison. Use the same ordered probes and extract each model’s fingerprint independently. Stack all prompt-level descriptors into F ∈ ℝM × (LHK), then compare models using centered linear CKA on their M × M Gram matrices.

01   Align & subtract

Pool each paired attention map to the smaller token length. Subtract to isolate the response to the semantic pivot.

02   Keep a compact spectrum

Retain K = 3 singular values per head and layer. Aggregate all heads and layers into a fingerprint for each probe.

03   Compare probe geometry

Centered linear CKA compares models with different feature dimensions, without requiring explicit layer or head matching.

Evaluation / Experimental design

Small probes.
A broad stress test.

Evaluate both sides of provenance: preserve similarity to transformed derivatives, and distinguish models from unrelated families.

60prompt pairs · default probe set
6domains · 10 pairs per domain
36 + 33related + unrelated suspects¹
6baseline methods
Controlled semantic conflict

Change one word.
Measure the routing response.

Use the same paired probes for every model. A minimal lexical pivot changes semantic intent while preserving surface form; pooling aligns attention maps when token counts differ.

CodeMathEconomicsMedicineDaily QASafe Alignment
Original / MathIn Euclidean geometry, two distinct parallel lines never intersect, no matter how far they are extended.
Corrupted / single-word pivotIn Euclidean geometry, two distinct parallel lines always intersect, no matter how far they are extended.

Example from Appendix B, Table 9. Both prompts are inputs to the model.

RQ 01

Survive adaptation?

Fine-tuning from 5M to 700B tokens, plus PPO and DPO preference optimization. Test whether extensive updates preserve the provenance signal.

Table 1 · Appendix F.1
RQ 02

Trace merged parents?

Compare merged models with their source models. Cover weight-space and distribution-level merging, with eight additional merging recipes.

Table 2 · Appendix F.2
RQ 03

Withstand compression?

Test structured and unstructured pruning, then extend to Random, L1, and Taylor pruning criteria using LLM-Pruner.

Table 3 · Appendix F.3
RQ 04

Refresh the evidence?

Expose part of the probe pool to an adaptive attacker, then evaluate on leaked, held-out, and newly refreshed probes.

Adaptive suppression · fixed 96-step budget
The evaluation map

Experiment design matrix

18 experimental settings

Read across a row to see what changes, what is compared, and how the experiment is measured.

Scroll across to compare the full protocol →

Experiment variables, comparison protocol, measurements, and paper references
ExperimentVariable & coverageComparison / controlReadout & source
RQ 01Fine-tuningBrowse models ↗Six derivatives; 5M–700B fine-tuning tokensLlama-2-7B as reference; same paired probesParent–derivative similarityTable 1
RQ 02Model mergingBrowse models ↗Weight-space and distribution-level mergingMerged model compared with each source modelSimilarity to each parentTable 2
RQ 03Model pruningBrowse models ↗Six structured + three unstructured variantsLlama-2-7B as reference; shared probe protocolParent–derivative similarityTable 3
SEPARATIONDiscriminability36 related + 33 unrelated suspectsSix baselines; each keeps its own similarity formulationAUROC · AUPRTable 4 / §5.6
RQ 04Adaptive suppressionInspect the study ↗20–80% probe exposure; 96-step LoRA budgetOne related Gemma-2 pair; ordinary fine-tuning controlLeaked / held-out / refreshed CKAAdaptive suppression and probe refresh
ADAPTATIONPreference optimizationBrowse models ↗PPO reward/policy models and DPO derivativesLlama-2-7B as referenceParent–derivative similarityTable A1 / F.1
MERGINGMerging recipesBrowse models ↗Eight additional model-merging strategiesCompare merged models to their sourcesSimilarity to source modelsTable A2 / F.2
PRUNINGPruning criteriaBrowse models ↗Random · L1 norm · Taylor importanceLLM-Pruner; common model/probe setupSimilarity after pruningTable A3 / F.3
TRANSFERCross-family & scaleBrowse models ↗Qwen2.5 · Gemma · Mistral; multiple model sizesWithin-family reference pairs; Qwen at 1.5B / 14BCross-configuration similarityTable A4 / F.4
TRANSFERDistillationBrowse models ↗Open-R1 · DeepSeek-R1 · logit distillationReference and suspect pairs listed in Appendix HReference–suspect similarityTable A5 / F.5
ARCHITECTUREMixture of expertsBrowse models ↗Three Mixtral-8×7B derivativesMixtral-8×7B as referenceReference–suspect similarityTable A6 / F.6
COMPRESSIONQuantizationBrowse models ↗Six GPTQ variants; 4-bit and 8-bitLlama · Qwen · Mistral reference modelsSimilarity after quantizationTable A7 / F.7
MECHANISMDifferential attentionOriginal vs. differential attentionSame preprocessing; 11 related + 8 unrelated modelsBoth group meansTable 12
BUDGETNumber of probesM = 5 / 15 / 30 / 60 / 120 / 240Same fingerprint extraction and comparisonSimilarity vs. probe countFigure 5
SPECTRUMSpectral rankK = 1 / 2 / 3 / 5 / 10Same probes; vary retained singular valuesRelated / unrelated meansTable 11
PROMPTSProbe length10 / 30 / 60 wordsVary probe length within the probing protocolRelated / unrelated similarityTable 10
DOMAINSDomain compositionCode · Math · Economics · Medicine · Daily QA · SafetyCompare domain-specific probe setsDomain-wise similarityTable 13
METRICSimilarity metricCCA / SVCCA / centered linear CKAIdentical fingerprints; 11 related + 8 unrelated suspectsBoth group meansTables 14–15
18 experimental settingsDefault extraction: M = 60 · K = 3 · centered linear CKA

Coverage extends to distillation, GPTQ quantization, Mixtral MoE, and cross-family/scale comparisons. Base families include Llama-2/3, Qwen2.5, Gemma, and Mistral. ¹ The 36 + 33 pool is the discriminability benchmark in Section 5.6; individual robustness and ablation experiments use their own model subsets.

Models / The model landscape

Every transformation.
A concrete model.

Explore the models named in the paper’s experimental taxonomy, with reference models, study categories, and available checkpoint links.

56 model entries · 9 categories

Sources: Appendix H · Tables A9–A10
Fine-tuning

Llama-2-finance-7b

Supervised fine-tuning

Reference / sourceLlama-2-7B

Table 1 · A9Listed in paper
Fine-tuning

Vicuna-1.5-7b

Supervised fine-tuning

Reference / sourceLlama-2-7B

Table 1 · A9Listed in paper
Fine-tuning

WizardMath-7b

Supervised fine-tuning

Reference / sourceLlama-2-7B

Table 1 · A9Listed in paper
Fine-tuning

Chinese-LLaMA-2-7b

Supervised fine-tuning

Reference / sourceLlama-2-7B

Table 1 · A9Listed in paper
Fine-tuning

CodeLLaMA-7b

Supervised fine-tuning

Reference / sourceLlama-2-7B

Table 1 · A9Listed in paper
Fine-tuning

Llemma-7b

Supervised fine-tuning

Reference / sourceLlama-2-7B

Table 1 · A9Listed in paper
Preference optimization

llama-2-7b-ppo-v0.1-reward

PPO reward model

Reference / sourceLlama-2-7B

Tables A1 · A9–A10Listed in paper
Preference optimization

llama-2-7b-ppo-lora-v0.1

PPO policy / LoRA

Reference / sourceLlama-2-7B

Tables A1 · A9–A10Checkpoint ↗
Preference optimization

tulu-2-dpo-7b

DPO

Reference / sourceLlama-2-7B

Tables A1 · A9–A10Checkpoint ↗
Preference optimization

llama2-7b-dpo

DPO

Reference / sourceLlama-2-7B

Tables A1 · A9–A10Checkpoint ↗
Merging

Evollm-jp-7b

Weight-space merging

Reference / sourceShisa-gamma-7b-v1 / WizardMath-7b-1.1 / Abel-7b-002

Table 2 · A9Checkpoint ↗
Merging

Fusellm-7b

Distribution-level merging

Reference / sourceLlama-2-7B / OpenLLaMA-2-7b / mpt-7b

Table 2 · A9Checkpoint ↗
Pruning

Sheared-LLaMA-1.3B

Structured pruning

Reference / sourceLlama-2-7B

Table 3 · A9Checkpoint ↗
Pruning

Sheared-LLaMA-1.3B-pruned

Structured pruning

Reference / sourceLlama-2-7B

Table 3 · A9Listed in paper
Pruning

Sheared-LLaMA-1.3B-sharegpt

Structured pruning

Reference / sourceLlama-2-7B

Table 3 · A9Listed in paper
Pruning

Sheared-LLaMA-2.7B

Structured pruning

Reference / sourceLlama-2-7B

Table 3 · A9Checkpoint ↗
Pruning

Sheared-LLaMA-2.7B-pruned

Structured pruning

Reference / sourceLlama-2-7B

Table 3 · A9Listed in paper
Pruning

Sheared-LLaMA-2.7B-sharegpt

Structured pruning

Reference / sourceLlama-2-7B

Table 3 · A9Listed in paper
Pruning

Sparse-llama-2-7b

Unstructured pruning

Reference / sourceLlama-2-7B

Table 3 · A9Listed in paper
Pruning

Wanda-llama-2-7b

Unstructured pruning

Reference / sourceLlama-2-7B

Table 3 · A9Listed in paper
Pruning

GBLM-llama-2-7b

Unstructured pruning

Reference / sourceLlama-2-7B

Table 3 · A9Listed in paper
Cross-family & scale

Qwen2.5-Coder-1.5B

Cross-family / scale study

Reference / sourceQwen2.5-1.5B

Tables A4 · A10Checkpoint ↗
Cross-family & scale

Qwen2.5-Math-1.5B

Cross-family / scale study

Reference / sourceQwen2.5-1.5B

Tables A4 · A10Checkpoint ↗
Cross-family & scale

Qwen2.5-1.5B-Instruct

Cross-family / scale study

Reference / sourceQwen2.5-1.5B

Tables A4 · A10Checkpoint ↗
Cross-family & scale

Qwen2.5-14B-Instruct

Cross-family / scale study

Reference / sourceQwen2.5-14B

Tables A4 · A9–A10Checkpoint ↗
Cross-family & scale

oxy-1-small

Cross-family / scale study

Reference / sourceQwen2.5-14B

Tables A4 · A9–A10Checkpoint ↗
Cross-family & scale

Qwen2.5-14B-Gutenberg-Instruct-Slerpeno

Cross-family / scale study

Reference / sourceQwen2.5-14B

Tables A4 · A9–A10Checkpoint ↗
Cross-family & scale

gemma-2-2b-neogenesis-ita

Cross-family / scale study

Reference / sourcegemma-2-2b

Tables A4 · A9–A10Checkpoint ↗
Cross-family & scale

gemma-2-baku-2b

Cross-family / scale study

Reference / sourcegemma-2-2b

Tables A4 · A9–A10Checkpoint ↗
Cross-family & scale

gemma2-2b-merged

Cross-family / scale study

Reference / sourcegemma-2-2b

Tables A4 · A9–A10Checkpoint ↗
Cross-family & scale

AQUA-7B

Cross-family / scale study

Reference / sourceMistral-7B-v0.3

Tables A4 · A9–A10Checkpoint ↗
Cross-family & scale

spellcheck-mistral-7b

Cross-family / scale study

Reference / sourceMistral-7B-v0.3

Tables A4 · A9–A10Checkpoint ↗
Cross-family & scale

Mistral-7B-Instruct-demi-merge-v0.3-7B

Cross-family / scale study

Reference / sourceMistral-7B-v0.3

Tables A4 · A9–A10Checkpoint ↗
Distillation

Llama-3.1-8B-Instruct-Open-R1-Distill

Reasoning distillation

Reference / sourceLlama-3.1-8B

Tables A5 · A9–A10Checkpoint ↗
Distillation

Qwen2.5-7B-Open-R1-Distill

Reasoning distillation

Reference / sourceQwen2.5-7B

Tables A5 · A9–A10Checkpoint ↗
Distillation

DeepSeek-R1-Distill-Qwen-14B

Reasoning distillation

Reference / sourceQwen2.5-14B

Tables A5 · A9–A10Checkpoint ↗
Distillation

llama-2-7b-logit-watermark-distill-kgw-k1-gamma0.25-delta2

Logit-based distillation

Reference / sourceLlama-2-7B

Tables A5 · A9–A10Checkpoint ↗
Mixture of experts

Instruct_Mixtral-8x7B-v0.1_Dolly15K

Mixture of experts

Reference / sourceMixtral-8x7B

Tables A6 · A9–A10Checkpoint ↗
Mixture of experts

Nous-Hermes-2-Mixtral-8x7B-DPO

Mixture of experts

Reference / sourceMixtral-8x7B

Tables A6 · A9–A10Checkpoint ↗
Mixture of experts

openbuddy-mixtral-8x7b-v15.4

Mixture of experts

Reference / sourceMixtral-8x7B

Tables A6 · A9–A10Checkpoint ↗
Quantization

Qwen2.5-7B-Instruct-GPTQ-Int8

GPTQ quantization

Reference / sourceQwen2.5-7B

Tables A7 · A9–A10Checkpoint ↗
Quantization

Qwen2.5-7B-Instruct-GPTQ-Int4

GPTQ quantization

Reference / sourceQwen2.5-7B

Tables A7 · A9–A10Checkpoint ↗
Quantization

Llama-2-7B-Chat-GPTQ

GPTQ quantization

Reference / sourceLlama-2-7B

Tables A7 · A9–A10Checkpoint ↗
Quantization

Meta-Llama-3.1-8B-Instruct-GPTQ-Q_8

GPTQ quantization

Reference / sourceLlama-3.1-8B

Tables A7 · A9–A10Checkpoint ↗
Quantization

LLaMA-3.1-8B-Instruct-INT4-GPTQ

GPTQ quantization

Reference / sourceLlama-3.1-8B

Tables A7 · A9–A10Checkpoint ↗
Quantization

Mistral-7B-Instruct-v0.3-GPTQ-4bit

GPTQ quantization

Reference / sourceMistral-7B-v0.3

Tables A7 · A9–A10Checkpoint ↗
Unrelated controls

Llama3-8B

Unrelated comparison model

Compared againstLlama-2-7B

Table A9Listed in paper
Unrelated controls

mpt-7b

Unrelated comparison model

Compared againstLlama-2-7B

Table A9Listed in paper
Unrelated controls

Qwen2.5-1.5B

Unrelated comparison model

Compared againstLlama-2-7B

Table A9Listed in paper
Unrelated controls

Qwen2.5-3B

Unrelated comparison model

Compared againstLlama-2-7B

Table A9Listed in paper
Unrelated controls

Qwen2.5-7B

Unrelated comparison model

Compared againstLlama-2-7B

Table A9Listed in paper
Unrelated controls

Qwen2.5-14B

Unrelated comparison model

Compared againstLlama-2-7B

Table A9Listed in paper
Unrelated controls

Qwen2.5-Math-7B

Unrelated comparison model

Compared againstLlama-2-7B

Table A9Listed in paper
Unrelated controls

gemma-2-2b

Unrelated comparison model

Compared againstLlama-2-7B

Table A9Listed in paper
Unrelated controls

Gemma-7B-it

Unrelated comparison model

Compared againstLlama-2-7B

Table A9Listed in paper
Unrelated controls

Yi-6B

Unrelated comparison model

Compared againstLlama-2-7B

Table A9Listed in paper

This directory summarizes the named models across studies. Reference models are shown on each card. It is separate from the 36 + 33 discriminability pool; individual experiments and ablations use their own subsets.

Results / Robustness & discrimination

Follow the evidence.

Explore individual model comparisons, then inspect the full baseline benchmark. Values are reported in the paper; similarity and discriminability answer different questions.

01 / Fine-tuning

Six downstream models span 5 million to 700 billion fine-tuning tokens. Does a fingerprint survive substantial domain adaptation?

AttnDiff retains similarity above 0.985 across all six derivatives. REEF is also strong, with a slightly higher mean (0.9966 vs. 0.9945).

Table 1 · Llama-2-7B derivatives

Similarity scores, on a 0–1 scale. REEF is shown as a strong representation-based comparator.

Suspect / comparisonAttnDiffREEF
Llama-2-Finance · 5M tokens0.99890.9950
Vicuna-1.5 · 370M tokens0.99860.9985
WizardMath · 1.8B tokens0.99850.9979
Chinese-LLaMA-2 · 13B tokens0.99630.9974
CodeLLaMA · 500B tokens0.98900.9947
Llemma · 700B tokens0.98560.9962
Rejecting unrelated models

High similarity is only
half of the test.

The discriminability benchmark treats 36 related suspects as positives and 33 unrelated suspects as negatives. AUROC and AUPR measure separation across decision thresholds.

Compare six baselines covering parameter fingerprints (PCS, ICS), representations (Logits, REEF), adversarial triggers (ProFlingo), and semantic fingerprints (LLMMap).

AttnDiff reports the highest AUROC and AUPR in Table 4, with a small margin over REEF. These are ranking metrics, not accuracy percentages. Methods retain their original similarity formulations and access requirements.

MethodAUROC ↑AUPR ↑
PCS0.95660.9367
ICS0.97890.9795
Logits0.97570.9746
REEF0.98670.9877
ProFlingo0.83740.8927
LLMMap0.89250.9014
AttnDiff0.98830.9881

Source: Table 4 / Section 5.6. Related = positive.

Adaptive suppression

Refresh the probes.
Test the transfer.

Does suppressing exposed fingerprints transfer to unseen probes? A controlled pilot separates leaked, held-out, and refreshed evaluation.

One Gemma-2 model pair · 96 LoRA steps

0.988–0.991

CKA on the disjoint 60-pair refresh pool after probe-aware suppression.

At 20% exposure, leaked-probe CKA drops from 0.992 to 0.738. Across exposure levels, held-out CKA ranges from 0.935 to 0.987; refreshed CKA remains between 0.988 and 0.991.

This fixed-budget pilot supports private, refreshed probes; it does not establish robustness to unrestricted adaptive attacks.

Paper-reported adaptive attack results
ExposureLeakedHeld-outRefreshed
20% · 12/600.7380.9670.991
40% · 24/600.9640.9350.990
60% · 36/600.9340.9640.988
80% · 48/600.9170.9870.988

All values are CKA. Ordinary fine-tuning gives refreshed CKA ≈ 0.998. See “Adaptive suppression and probe refresh” in the paper for utility measurements and the attack objective.

Analysis / Controlled ablations

Which choices matter?

Isolate the differential mechanism, probe budget, spectral rank, and similarity metric. Report both related and unrelated models to expose the trade-offs.

The difference makes a difference.

Replace differential attention with original attention while keeping the other preprocessing steps identical.

Model / groupOriginalDifferential
CodeLLaMA-7B0.51340.9890
Llemma-7B0.29020.9856
Related mean ↑0.88170.9937
Unrelated mean ↓0.37310.1647

Table 12 · 11 related + 8 unrelated models. Group means use this ablation subset.

How many probes are enough?

Very small probe sets (M ≤ 15) produce spurious similarity for unrelated models. The paper chooses M = 60 for separation and efficiency.

Paper Figure 5: similarity across probe counts 5, 15, 30, 60, 120, and 240; related model curves stay high while unrelated model curves fall. The vertical axis has a break.

Figure 5 · Original figure with a broken vertical axis; inspect its scale when comparing curves.

Three singular values per head.

Sweep spectral rank K. Higher ranks lower unrelated similarity but also weaken similarity to related models.

Rank KRelated ↑Unrelated ↓
10.99280.2708
20.99410.2413
3 · default0.99370.1647
50.98540.1544
100.97110.1476

Table 11 · Average CKA similarity.

Compare the same fingerprints.

Keep the fingerprint matrix fixed and change only the similarity metric. Centered linear CKA reduces spurious similarity in this comparison.

MetricRelated ↑Unrelated ↓
CCA0.99240.3112
SVCCA0.99410.2419
CKA · default0.99370.1647

Table 15 · 11 related + 8 unrelated suspects (Table 14).

Additional controls: probe length (10 / 30 / 60 words, Table 10) and domain composition (Table 13).

Look inside the fingerprint: layer-wise similarity
Figure 6: layer-wise CKA heatmaps for fine-tuned, pruned, and unrelated model pairs; related pairs show diagonal structure, while unrelated pairs show low similarity.
Figure 6. Layer-wise patterns provide interpretation; the final score is computed once on the full fingerprint, rather than by averaging layer-wise scores.
Compute budget and scope of the method

With M = 60 pairs, extraction requires 120 forward passes per model. The paper reports approximately 5 minutes for a 7B model on a single NVIDIA RTX 5090. This is a reported setup-specific timing, not a universal runtime guarantee. Reference fingerprints can be cached.

AttnDiff requires access to internal attention activations. The evaluated transformations support empirical provenance analysis; similarity alone does not establish legal ownership or guarantee robustness to every adaptive attack. See the paper’s limitations for the scope of the claims.

Code / Reproduce & explore

Start with a fingerprint.

Install the package, then compare the included pre-computed fingerprints. For the paper’s spectral descriptor, use --mode diff --svd_k 3. The bundled 30-pair example is separate from the paper’s default 60-pair protocol; see the README for reproduction notes.

Full installation & usage guide ↗
git clone https://github.com/zhb0119/AttnDiff.git
cd AttnDiff
uv sync

uv run attndiff-compare \
  --base output/comput_W/fingerprint_Llama-2-7B.json \
  --dir output/comput_W \
  --cka linear
Reference

Cite AttnDiff.

@misc{zhang2026attndiffattentionbaseddifferentialfingerprinting,
  title={AttnDiff: Attention-based Differential Fingerprinting for Large Language Models},
  author={Haobo Zhang and Zhenhua Xu and Junxian Li and Shangfeng Sheng and Dezhang Kong and Meng Han},
  year={2026},
  eprint={2604.05502},
  archivePrefix={arXiv},
  primaryClass={cs.CR},
  url={https://arxiv.org/abs/2604.05502}
}