Every Language Model Has a Forgery-Resistant Signature (arxiv.org)

Researchers have identified a geometric "ellipse signature" inherent to every neural language model: outputs (specifically the vector of log-probabilities) lie on the surface of a high-dimensional ellipse determined by the model architecture and weights. The paper shows this ellipse is a naturally occurring, self-contained fingerprint that can be detected from model outputs alone and is independently present in each log-probability vector, making the signature compact and redundantly verifiable. Crucially, the signature is hard to forge—without direct access to model parameters it is practically infeasible to synthesize outputs whose logprobs sit on the same ellipse—distinguishing it from prior fingerprinting methods that can be more easily mimicked. Technically, the work characterizes the geometric constraint, demonstrates a method to extract the ellipse for smaller models, and analyzes why scaling to production-size models poses practical hurdles. Building on these properties, the authors propose a verification protocol for model outputs analogous to symmetric-key message authentication: an ellipse-based check could authenticate that a piece of text was produced by a specific model instance. For the AI/ML community this offers a new forensic tool for provenance, model attribution, and API-based verification, while also raising questions about robustness, privacy, and the feasibility of applying the technique to large, closed-weight models in real-world settings.