Do System Prompts Leave Behavioral Fingerprints? A Large-Scale Empirical Study of Clone Detection via Output Similarity
cs.CR
Submitted: 2026-08-25
Updated: 2026-08-25
Comments: 14 pages, 5 figures
License: http://creativecommons.org/licenses/by/4.0/
The gist: System prompts can be extracted from commercial LLMs with over 80% success and redeployed at zero cost, yet a prompt owner has no way to verify whether a suspected deployment is a clone.
Terminology
Abstract
System prompts can be extracted from commercial LLMs with over 80% success and redeployed at zero cost, yet a prompt owner has no way to verify whether a suspected deployment is a clone. We propose Black-Box Behavioral Fingerprinting (BBF): the prompt owner registers a behavioral signature from model outputs and later tests whether a suspect deployment matches that signature more closely than an unrelated baseline. BBF requires only black-box API access. Through a large-scale study (4 model families, 8 benchmarks, 288, 000 responses), we find that prompt choice explains 24.4% of output variance and same-model detection reaches AUC 0.876. Cross-model performance is bounded by detector identity, with off-diagonal AUC ranging from 0.845 (Claude as detector) down to 0.665 (Qwen) and overall mean 0.725. BBF resists non-adaptive prompt paraphrasing (AUC at least 0.889) and is robust to imperfect extraction, but a single-sentence formal-tone prefix can collapse detection on short structured outputs (MNLI 0.978 to 0.547), isolating style-invariant detection as the key open problem. Diagnostic Query Optimization, a zero-cost query selection rule, adds +0.120 to cross-model AUC.
Sources
- ProxyPrompt: Securing System Prompts against Prompt Extraction Attacks
- System Prompt Extraction Attacks and Defenses in Large Language Models
- Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability
- PathMark: Protecting Intellectual Property of Mixture-of-Expert LLMs via Path Watermarks
- Safety-Constrained Reinforcement Learning with Post-Training Reachability Verification for Robot Navigation
- Towards General Text Embeddings with Multi-stage Contrastive Learning
- FragileFlow: Spectral Control of Correct-but-Fragile Predictions for Foundation Model Robustness
- SCOPE: Sequential Conformal Probing for Reliable OOD Rejection in LLM Services
- Agent Hacks Agents: Autoresearch Discovers Vulnerabilities in Production Agents
- A Fingerprint for Large Language Models
- MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems
- Prompt Stealing Attacks Against Large Language Models
- RAFP: Identifying LLM Lineages via Rare-Region Fingerprints
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs