AttnDiff

Attention-based Differential Fingerprinting for Large Language Models

NeurIPS 2026

Haobo Zhang^1,3,* · Zhenhua Xu^2,3,* · Junxian Li⁴
Shangfeng Sheng⁵ · Dezhang Kong^2,3,† · Meng Han^2,3,†

¹ Renmin University of China
² Zhejiang University · ³ Binjiang Institute of Zhejiang University
⁴ Shanghai Jiao Tong University · ⁵ University of Science and Technology of China

^* Equal contribution   ^† Corresponding authors
haobo0119@gmail.com · xuzhenhua0326@zju.edu.cn · mhan@zju.edu.cn

Trace model provenance through differential attention.

_{Model families, fingerprint patterns, and the highlighted match are illustrative.}

Overview · Video · Method · Quick Start · Results · Model Zoo · Citation

🔎 Overview

AttnDiff is a data-efficient, white-box framework for verifying whether a suspect LLM derives from a reference model. It probes minimally edited prompt pairs that induce semantic conflicts, captures the resulting attention differences, summarizes them with spectral descriptors, and compares fingerprints using centered linear CKA.

• Intrinsic fingerprints: no watermark embedding, model training, or parameter modification.
• Compact probes: the paper defaults to 60 prompt pairs across six domains, with the top 3 singular values per layer/head.
• Flexible comparison: models can have different layer/head counts. CKA compares their geometry over the same ordered probes.
• Broad evaluation: fine-tuning, PPO/DPO, merging, pruning, distillation, quantization, cross-family comparisons, and a fixed-budget adaptive suppression pilot.

🎬 Video

▶ Watch the 60-second video · Download MP4

_{English narration and embedded captions · Optional Chinese subtitles on the project page}

🧬 Method

1. Construct paired probes. A single-word pivot creates a controlled semantic conflict: “parallel lines never intersect” → “parallel lines always intersect.”
2. Extract attention. Collect post-softmax causal self-attention maps across all layers and heads.
3. Compute differences. In the paper, adaptive average pooling aligns each pair to the smaller token length, then ΔA = Pool(A_corrupted) − Pool(A_original).
4. Build spectral fingerprints. Keep the top K = 3 singular values per layer/head and stack M probe descriptors into F ∈ ℝ^(M × LHK).
5. Compare models. Independently extract both fingerprints using the same probe identities and ordering, then compare their centered M × M Gram matrices with linear CKA.

The method requires internal attention activations. Text-only APIs are outside the evaluated setting. Similarity provides evidence of shared lineage; decision thresholds should be calibrated for the model pool and verification setting.

🚀 Quick Start

Install

Install uv, then run:

git clone https://github.com/zhb0119/AttnDiff.git
cd AttnDiff
uv sync

Alternatively, use python -m pip install -e .. Run commands from the repository root. Multiline examples use Bash syntax; in PowerShell, use a single line or replace \ with a backtick.

Compare the included example fingerprints

uv run attndiff-compare \
  --base output/comput_W/fingerprint_Llama-2-7B.json \
  --dir output/comput_W \
  --cka linear

This compares stored fingerprints without loading model weights or extracting new attentions. These are example artifacts, not a complete reproduction of the paper experiments.

Extract spectral fingerprints

Use a Hugging Face model identifier or local checkpoint path:

uv run attndiff-compute \
  --model_name /path/to/your/model \
  --attn_device cuda:0 \
  --mode diff \
  --svd_k 3 \
  --out output/spectral/fingerprint_your_model.json

The extractor reads dataset/dataset.json and can reuse attention JSONs under output/attention/. Use separate attention paths when changing probes so that old cached attentions are not reused.

To start from pre-extracted attention maps:

uv run attndiff-compute \
  --original output/attention/model_att_origin.json \
  --corrupted output/attention/model_att_perturb.json \
  --mode diff \
  --svd_k 3 \
  --out output/spectral/fingerprint_model.json

After extracting reference and suspect fingerprints into the same directory:

uv run attndiff-compare \
  --base output/spectral/fingerprint_reference.json \
  --dir output/spectral \
  --cka linear

Keep the same representation and ordered probe set across compared files. Use --layer 1 for an optional layer-specific comparison (1-based).

Extraction option	Purpose
--model_name	Model identifier or local checkpoint path
--original, --corrupted	Pre-extracted attention JSON files
--mode diff	Corrupted-minus-original attention
--svd_k 3	Enable top-3 singular-value descriptors
--attn_device	Extraction device, e.g. cuda:0
--out	Fingerprint output path

For batch runs, configure model paths and device in scripts/batch_compute.sh, and add --svd_k 3 to its extraction command to use spectral descriptors.

Probe format and reproduction notes

The input is a JSON list:

[
  {
    "id": 1,
    "topic": "Mathematics",
    "original": "In Euclidean geometry, two distinct parallel lines never intersect, no matter how far they are extended.",
    "corrupted": "In Euclidean geometry, two distinct parallel lines always intersect, no matter how far they are extended."
  }
]

• The checked-in dataset/dataset.json contains 30 pairs across five domains. The paper defaults to 60 pairs across six domains: Code, Math, Economics, Medicine, Daily QA, and Safe Alignment (10 pairs each).
• Set --svd_k 3 explicitly: the current CLI does not enable spectral descriptors by default. Do not mix these outputs with legacy scalar fingerprints.
• For unequal token lengths, the current CLI's SVD path crops maps to the common minimum size; the paper method specifies adaptive average pooling. Exact reproduction requires resolving this implementation difference. Equal-length pairs do not need spatial alignment.

See the paper's implementation appendix for the protocol and dataset/README.md for the schema.

📊 Results

The following are paper-reported results, not measurements produced by the quick-start example.

Evaluation	Reported result
Fine-tuning	CKA 0.9856–0.9989 across six Llama-2-7B derivatives
Pruning	CKA ≥ 0.9879 across nine structured/unstructured pruned suspects
Weight-space merging	CKA 0.9561–0.9996 to the evaluated parents
Discriminability	0.9883 AUROC / 0.9881 AUPR, on 36 related + 33 unrelated suspects
Adaptive suppression	Refreshed-probe CKA 0.988–0.991, under 20–80% exposure and a fixed 96-step LoRA budget

The adaptive study covers one related Gemma-2 model pair. Its findings support private, refreshed probes within that setting; they do not establish robustness to unrestricted adaptive attacks. AUROC/AUPR are ranking metrics, not accuracy percentages.

Explore interactive results and ablations →
Browse model families and checkpoints →

🗂️ Model Zoo

56 catalog entries · 9 experiment categories

Explore the model families and transformations evaluated in the paper. Each experiment uses its own subset; this directory is separate from the 36-related / 33-unrelated discriminability benchmark.

🧠 Fine-tuning 6 entries Llama-2-Finance · Vicuna · CodeLLaMA Explore models ↓	🎯 Preference optimization 4 entries PPO · PPO-LoRA · Tulu-2-DPO Explore models ↓	🔀 Model merging 2 entries EvoLLM-JP · FuseLLM Explore models ↓
✂️ Model pruning 9 entries Sheared-LLaMA · Sparse · Wanda Explore models ↓	🌐 Cross-family & scale 12 entries Qwen2.5 · Gemma-2 · Mistral Explore models ↓	🧪 Distillation 4 entries Open-R1 · DeepSeek-R1 · Logit distillation Explore models ↓
🧩 Mixture of experts 3 entries Mixtral · Nous-Hermes · OpenBuddy Explore models ↓	⚡ Quantization 6 entries GPTQ · Llama · Qwen · Mistral Explore models ↓	🔬 Unrelated controls 10 entries Llama-3 · MPT · Qwen · Gemma · Yi Explore models ↓

🧠 Fine-tuning · 6 entries

Model	Reference / source
Llama-2-finance-7b	Llama-2-7B
Vicuna-1.5-7b	Llama-2-7B
WizardMath-7b	Llama-2-7B
Chinese-LLaMA-2-7b	Llama-2-7B
CodeLLaMA-7b	Llama-2-7B
Llemma-7b	Llama-2-7B

🎯 Preference optimization · 4 entries

Model	Reference / source
llama-2-7b-ppo-v0.1-reward	Llama-2-7B
llama-2-7b-ppo-lora-v0.1	Llama-2-7B
tulu-2-dpo-7b	Llama-2-7B
llama2-7b-dpo	Llama-2-7B

🔀 Model merging · 2 entries

Model	Reference / source
Evollm-jp-7b	Shisa-gamma-7b-v1 WizardMath-7b-1.1 Abel-7b-002
Fusellm-7b	Llama-2-7B OpenLLaMA-2-7b mpt-7b

✂️ Model pruning · 9 entries

Model	Reference / source
Sheared-LLaMA-1.3B	Llama-2-7B
Sheared-LLaMA-1.3B-pruned	Llama-2-7B
Sheared-LLaMA-1.3B-sharegpt	Llama-2-7B
Sheared-LLaMA-2.7B	Llama-2-7B
Sheared-LLaMA-2.7B-pruned	Llama-2-7B
Sheared-LLaMA-2.7B-sharegpt	Llama-2-7B
Sparse-llama-2-7b	Llama-2-7B
Wanda-llama-2-7b	Llama-2-7B
GBLM-llama-2-7b	Llama-2-7B

🌐 Cross-family & scale · 12 entries

Model	Reference / source
Qwen2.5-Coder-1.5B	Qwen2.5-1.5B
Qwen2.5-Math-1.5B	Qwen2.5-1.5B
Qwen2.5-1.5B-Instruct	Qwen2.5-1.5B
Qwen2.5-14B-Instruct	Qwen2.5-14B
oxy-1-small	Qwen2.5-14B
Qwen2.5-14B-Gutenberg-Instruct-Slerpeno	Qwen2.5-14B
gemma-2-2b-neogenesis-ita	gemma-2-2b
gemma-2-baku-2b	gemma-2-2b
gemma2-2b-merged	gemma-2-2b
AQUA-7B	Mistral-7B-v0.3
spellcheck-mistral-7b	Mistral-7B-v0.3
Mistral-7B-Instruct-demi-merge-v0.3-7B	Mistral-7B-v0.3

🧪 Distillation · 4 entries

Model	Reference / source
Llama-3.1-8B-Instruct-Open-R1-Distill	Llama-3.1-8B
Qwen2.5-7B-Open-R1-Distill	Qwen2.5-7B
DeepSeek-R1-Distill-Qwen-14B	Qwen2.5-14B
llama-2-7b-logit-watermark-distill-kgw-k1-gamma0.25-delta2	Llama-2-7B

🧩 Mixture of experts · 3 entries

Model	Reference / source
Instruct_Mixtral-8x7B-v0.1_Dolly15K	Mixtral-8x7B
Nous-Hermes-2-Mixtral-8x7B-DPO	Mixtral-8x7B
openbuddy-mixtral-8x7b-v15.4	Mixtral-8x7B

⚡ Quantization · 6 entries

Model	Reference / source
Qwen2.5-7B-Instruct-GPTQ-Int8	Qwen2.5-7B
Qwen2.5-7B-Instruct-GPTQ-Int4	Qwen2.5-7B
Llama-2-7B-Chat-GPTQ	Llama-2-7B
Meta-Llama-3.1-8B-Instruct-GPTQ-Q_8	Llama-3.1-8B
LLaMA-3.1-8B-Instruct-INT4-GPTQ	Llama-3.1-8B
Mistral-7B-Instruct-v0.3-GPTQ-4bit	Mistral-7B-v0.3

🔬 Unrelated controls · 10 entries

Model	Compared against
Llama3-8B	Llama-2-7B
mpt-7b	Llama-2-7B
Qwen2.5-1.5B	Llama-2-7B
Qwen2.5-3B	Llama-2-7B
Qwen2.5-7B	Llama-2-7B
Qwen2.5-14B	Llama-2-7B
Qwen2.5-Math-7B	Llama-2-7B
gemma-2-2b	Llama-2-7B
Gemma-7B-it	Llama-2-7B
Yi-6B	Llama-2-7B

🔎 Search all models on the project page · Full taxonomy & checkpoint directory

📁 Repository

AttnDiff/
├── src/attndiff/       # Fingerprint extraction, similarity, and CLI
├── dataset/           # Example paired probes
├── output/comput_W/   # Included example fingerprints
├── scripts/           # Batch processing
├── tools/             # Model merging and pruning utilities
├── examples/          # Usage examples
├── tests/             # Algorithm tests
├── docs/              # GitHub Pages source and paper media
├── CITATION.cff       # GitHub citation metadata
└── pyproject.toml     # Package configuration

Project-page maintenance and local preview: docs/README.md.

📝 Citation

@misc{zhang2026attndiffattentionbaseddifferentialfingerprinting,
  title={AttnDiff: Attention-based Differential Fingerprinting for Large Language Models},
  author={Haobo Zhang and Zhenhua Xu and Junxian Li and Shangfeng Sheng and Dezhang Kong and Meng Han},
  year={2026},
  eprint={2604.05502},
  archivePrefix={arXiv},
  primaryClass={cs.CR},
  url={https://arxiv.org/abs/2604.05502}
}

License and Acknowledgments

Code is released under the MIT License. Built with PyTorch, Hugging Face Transformers, and uv.