Large Reasoning Models (LRMs) are valuable intellectual property due to their substantial training and alignment costs, creating a need for reliable ownership verification under black-box access, where a verifier can only query a suspect model and inspect its returned output. Existing trigger–response fingerprints are easy to test but are often weakly coupled with Chain-of-Thought (CoT) reasoning and can be fragile under paraphrasing or post-hoc model modifications. We propose CoT-Lock, a reasoning-mediated fingerprinting framework that casts ownership verification as a structured conflict-resolution task. CoT-Lock constructs verification queries in which a default semantic constraint is superseded only by a higher-priority meta-override rule, training the model to resolve fingerprint activation through priority-based arbitration. Our primary ownership test is output-only on confidential held-out probes; when reasoning traces are visible, trace-level verification further checks the expected arbitration process. Experiments on representative reasoning architectures show that CoT-Lock achieves stable black-box verification while preserving reasoning ability with minimal performance degradation, low false positives, and improved robustness against paraphrasing, fine-tuning, pruning, and quantization. Our code is available at https://github.com/acang425/CoT-Lock.

Diffusion large language models (dLLMs) offer a compelling alternative to autoregressive models, yet they may expose sensitive training data during denoising. Detecting such usage is challenging because dLLMs lack the efficient one-pass probability decomposition of causal architectures. Existing methods rely on random masking to obtain tractable token-wise detection signals under limited query budgets, but fail to control dependencies among masked tokens. We demonstrate that this token-wise approximation introduces a non-negative structural estimation error, which is theoretically characterized by the cumulative conditional mutual information (CMI) among masked tokens and can obscure subtle memorization signals. This insight suggests that reliable detection requires masked token sets with weak internal dependency. To avoid the prohibitive cost of directly estimating CMI over token combinations, we propose Independent Token Sampling (ITS), a query-efficient framework that uses an attention-derived pairwise dependency proxy to approximate the CMI-aware selection criterion. ITS further incorporates a diversity-promoting strategy to improve token coverage across sampling rounds, yielding aggregated token-wise signals that are less affected by dependency-induced approximation error. Experiments on multiple datasets show that ITS consistently outperforms state-of-the-art baselines across different models and datasets, achieving an AUC improvement of 0.18 on the ArXiv dataset while maintaining strong performance under limited query budgets.

3D Vision-Language Models (3D-VLMs) have emerged as the critical cognitive backbone for spatial intelligence, enabling precise reasoning over unstructured 3D data. While these models serve as the foundation for downstream robotics and embodied systems, their reliance on autoregressive decoding introduces a fundamental vulnerability regarding inference efficiency. In this work, we present Inflate3D, a novel adversarial framework designed to trigger computational and economic exhaustion in 3D-VLMs. Specifically, we exploit the model’s sensitivity to untrusted 3D assets to hijack the generation process. Inflate3D operates by injecting imperceptible noise that forces the model into a state of pathological verbosity, effectively stalling the inference pipeline. Our approach comprises two synergistic strategies: (1) a semantic-aware adversarial manipulation that leverages internal representations to selectively perturb semantically critical regions while preserving geometric structure, and (2) a trajectory disruption mechanism that manipulates token probabilities to suppress End-of-Sequence (EOS) emission, thereby prolonging decoding and inducing verbose outputs. Experiments on standard benchmarks show that Inflate3D amplifies output length and energy consumption by up to 6.45×, demonstrating a potent capability to drain system resources. These findings expose a critical blind spot in multimodal alignment, highlighting the urgent need to secure spatial foundation models against resource exhaustion attacks.