Sentient Foundation has launched the Fingerprinting Leaderboard, an open benchmark designed to evaluate techniques for proving the origin of AI models after they have been copied, fine-tuned or distilled.
The initiative follows research by Sentient Labs and other researchers showing that nearly all ten recently proposed fingerprinting schemes tested could be evaded by sufficiently sophisticated attackers without significantly compromising model usefulness. The findings included Sentient's own Perinucleus method.
As AI models become more widely distributed and modified, developers face growing challenges in establishing ownership and tracing a model's origins. Model weights can be copied, while metadata and other identifying information can be removed.
Fingerprinting aims to address this problem by embedding distinctive signals into a model that can later be tested to establish whether it retains traces of an original system.
Sentient opens AI model fingerprinting to independent testing
Model fingerprinting encompasses techniques for embedding, detecting or verifying signals associated with a particular AI model.
Sentient's approach encodes hidden behavioral signatures during training, which can later be tested through specially designed prompts.
An owner can send secret challenge prompts to a suspected derivative model through an API and examine its responses for evidence that the original model's fingerprint remains. The method is intended to establish provenance without relying exclusively on training logs, metadata or external records.
"AI models are becoming some of the most valuable intellectual property in the world, yet once a model is copied or distilled, proving ownership becomes incredibly difficult," said Sachi Kamiya, Director of Venture and Growth at Sentient Foundation. "Fingerprinting puts the proof inside the model. Think of it as the AI equivalent of the hidden marks Renaissance painters used to establish authorship."
Sentient's previous research demonstrated the potential scale of the technique. Its Perinucleus method, presented at NeurIPS 2025, embedded 24,576 fingerprints into Llama-3.1-8B with minimal loss of model utility, with many fingerprints surviving subsequent fine-tuning.
A larger number of fingerprints can provide more opportunities to verify a model's origin and improve statistical confidence. However, the ability to embed fingerprints at scale does not necessarily mean they will withstand deliberate removal attempts.
Research presented by Sentient researchers at SaTML 2026 examined adaptive attacks against ten recently proposed fingerprinting schemes. The researchers found that nearly all could be evaded by a sufficiently sophisticated adversary while preserving the model's usefulness.
That finding also exposed vulnerabilities in Sentient's own method, underscoring the difference between demonstrating that a fingerprint can be embedded and proving that it remains reliable under attack.
Fingerprinting Leaderboard adds robustness testing
The Fingerprinting Leaderboard is intended to provide a shared framework for comparing techniques under consistent evaluation conditions. Its initial release assesses how effectively methods embed fingerprints while maintaining model performance.
A planned subsequent release will introduce adversarial robustness tests to measure whether fingerprints survive deliberate attempts to remove or evade them.
Sentient is also releasing mlprints, an open-source library designed to bring fingerprinting methods and attacks into a common evaluation environment. Researchers will be able to implement new techniques, develop attacks, reproduce existing results and compare competing approaches.
The project aims to make claims about fingerprinting effectiveness independently testable rather than relying on individual researchers' benchmarks.
Its longer-term value will depend on whether the tests capture realistic attacks and whether methods can demonstrate reliable results across different models and modification techniques.
Fingerprinting could offer AI developers an alternative to keeping model weights private to protect their intellectual property. Instead of preventing models from being copied, the technology seeks to preserve evidence of their origins after copying or modification.
If sufficiently robust methods emerge, they could support model attribution, licensing enforcement and systems that depend on verifiable AI provenance.
For now, the research highlights both the potential of embedded fingerprints and the challenge of making them resistant to determined attackers.
Arman Shirinyan
Dan Burgin
