@inproceedings{fu-etal-2026-ripple,
title = "{RIPPLE}: Attacking Backdoor-based {LLM} Fingerprinting via Latent Representation Perturbation",
author = "fu, Hang and
Zhou, Yinghan and
Peng, Wanli and
Wen, Juan and
Xue, Yiming and
Pei, Huimin",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.1070/",
pages = "24569--24587",
ISBN = "979-8-89176-459-0",
abstract = "The widespread deployment of Large Language Models (LLMs) has necessitated robust intellectual property protection. Backdoor-based LLM fingerprinting has emerged as a promising solution for this challenge. To assess the robustness of fingerprinting techniques, various adversarial attacks have been developed. However, existing fingerprint attacks often fail to simultaneously achieve strong effectiveness, harmlessness, and generalization across different LLMs and fingerprinting methods. To address this challenge, we examine the process of generating fingerprint responses and identify an intrinsic trait: fingerprint responses exhibit abnormally high generation confidence and strong robustness under perturbations compared to benign responses. Building on this trait, we propose \textbf{RIPPLE}, a fingerprint attack framework that identifies fingerprint trigger-response pairs by jointly evaluating original confidence and confidence robustness under hidden state perturbations. Extensive experiments on multiple LLMs and fingerprinting methods demonstrate that RIPPLE consistently outperforms existing attack methods, achieving a superior trade-off between attack effectiveness and harmlessness while maintaining strong generalization."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="fu-etal-2026-ripple">
<titleInfo>
<title>RIPPLE: Attacking Backdoor-based LLM Fingerprinting via Latent Representation Perturbation</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hang</namePart>
<namePart type="family">fu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yinghan</namePart>
<namePart type="family">Zhou</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Wanli</namePart>
<namePart type="family">Peng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Juan</namePart>
<namePart type="family">Wen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yiming</namePart>
<namePart type="family">Xue</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Huimin</namePart>
<namePart type="family">Pei</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>The widespread deployment of Large Language Models (LLMs) has necessitated robust intellectual property protection. Backdoor-based LLM fingerprinting has emerged as a promising solution for this challenge. To assess the robustness of fingerprinting techniques, various adversarial attacks have been developed. However, existing fingerprint attacks often fail to simultaneously achieve strong effectiveness, harmlessness, and generalization across different LLMs and fingerprinting methods. To address this challenge, we examine the process of generating fingerprint responses and identify an intrinsic trait: fingerprint responses exhibit abnormally high generation confidence and strong robustness under perturbations compared to benign responses. Building on this trait, we propose RIPPLE, a fingerprint attack framework that identifies fingerprint trigger-response pairs by jointly evaluating original confidence and confidence robustness under hidden state perturbations. Extensive experiments on multiple LLMs and fingerprinting methods demonstrate that RIPPLE consistently outperforms existing attack methods, achieving a superior trade-off between attack effectiveness and harmlessness while maintaining strong generalization.</abstract>
<identifier type="citekey">fu-etal-2026-ripple</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.1070/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>24569</start>
<end>24587</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T RIPPLE: Attacking Backdoor-based LLM Fingerprinting via Latent Representation Perturbation
%A fu, Hang
%A Zhou, Yinghan
%A Peng, Wanli
%A Wen, Juan
%A Xue, Yiming
%A Pei, Huimin
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F fu-etal-2026-ripple
%X The widespread deployment of Large Language Models (LLMs) has necessitated robust intellectual property protection. Backdoor-based LLM fingerprinting has emerged as a promising solution for this challenge. To assess the robustness of fingerprinting techniques, various adversarial attacks have been developed. However, existing fingerprint attacks often fail to simultaneously achieve strong effectiveness, harmlessness, and generalization across different LLMs and fingerprinting methods. To address this challenge, we examine the process of generating fingerprint responses and identify an intrinsic trait: fingerprint responses exhibit abnormally high generation confidence and strong robustness under perturbations compared to benign responses. Building on this trait, we propose RIPPLE, a fingerprint attack framework that identifies fingerprint trigger-response pairs by jointly evaluating original confidence and confidence robustness under hidden state perturbations. Extensive experiments on multiple LLMs and fingerprinting methods demonstrate that RIPPLE consistently outperforms existing attack methods, achieving a superior trade-off between attack effectiveness and harmlessness while maintaining strong generalization.
%U https://aclanthology.org/2026.emnlp-main.1070/
%P 24569-24587
Markdown (Informal)
[RIPPLE: Attacking Backdoor-based LLM Fingerprinting via Latent Representation Perturbation](https://aclanthology.org/2026.emnlp-main.1070/) (fu et al., EMNLP 2026)
ACL