Cloud-hosted vision-language models (VLMs) may be silently fine-tuned, poisoned, compressed, or replaced after deployment, motivating black-box fingerprint verification. RESF tests response distributions but requires estimating the service temperature, making its reliability sensitive to estimation error. We propose Latent Visual Sensitive Fingerprinting (LVSF), based on a local Pearson-sensitivity decomposition of the conditional top-k distribution of the first generated token. This decomposition separates observable output shifts from input-dependent exposure to parameter changes. Modeling tampering-induced relative top-k logit shifts as isotropic, we show that a uniform top-k anchor maximizes average sensitivity. Accordingly, LVSF equalizes recorded top-k logits, maintains a margin from out-of-support tokens, and maximizes full-parameter Fisher sensitivity, yielding a reference distribution invariant to positive temperature scaling. These principles apply to both LLMs and VLMs. For VLMs, LVSF fixes a natural-language query and optimizes an image in a pretrained VAE latent space to produce natural-looking fingerprints. Repeated API queries detect excess out-of-support first tokens or shifts in conditional in-support frequencies. Across four VLMs and multiple tampering types, LVSF achieves consistently high detection rates with no observed false positives and substantially higher detection rates than evaluated baselines on Qwen2.5-VL-7B-Instruct.

Large language models (LLMs) deployed in real-world applications process heterogeneous inputs, including system prompts, user requests, and external content, exposing them to prompt injection attacks. Existing defenses, including prompt-level safeguards, external filters, and source-aware instruction handling, remain brittle against diverse direct and indirect prompt injection attacks. We propose **CBC** (*Consistency Before Complying*), a task-consistency alignment framework to defend against task-redirection prompt-injection attacks. **CBC** characterizes task consistency through semantic conflicts along action, constraint, and domain dimensions, then uses structured reasoning to determine whether newly introduced instructions are consistent with the original task before acting on them. Using targeted synthetic supervision, we train **CBC** to reason about task consistency and further strengthen this capability through dual-objective online alignment while preserving task utility. Across three model families and a diverse set of direct and indirect prompt-injection benchmarks, **CBC** improves defense success rates by up to 13.2 percentage points over the strongest baseline while better preserving task utility under attack. Our code and models can be found at: https://github.com/XOTaichi/CBC-PI.git

The proliferation of Machine Learning as a Service (MLaaS) has enabled widespread deployment of large language models (LLMs) via cloud APIs, but also raises critical concerns about model integrity and security. Existing black-box tamper detection methods, such as watermarking and fingerprinting, rely on the stability of model outputs—a property that does not hold for inherently stochastic LLMs. We address this challenge by formulating black-box tamper detection for LLMs as a hypothesis-testing problem. To enable efficient and sensitive fingerprinting, we derive a first-order surrogate for KL divergence—the entropy-gradient norm—to identify prompts most responsive to parameter perturbations. Building on this, we propose Regularized Entropy-Sensitive Fingerprinting (RESF), which enhances sensitivity while regularizing entropy to improve output stability and control false positives. To further distinguish tampering from benign randomness, such as temperature shifts, RESF employs a lightweight two-tier sequential test combining support-based and distributional checks with rigorous false-alarm control.Comprehensive analysis and experiments across multiple LLMs show that RESF achieves up to 98.80% detection accuracy under challenging conditions, such as minimal LoRA fine-tuning with five optimized fingerprints. RESF consistently demonstrates strong sensitivity and robustness, providing an effective and scalable solution for black-box tamper detection in cloud-deployed LLMs.