Sentient researchers have found that nearly all model fingerprinting techniques tested, including Sentient's own approach, can be bypassed. To address this, the new Fingerprinting Leaderboard will use public evaluation to test which techniques can truly withstand model copying, fine-tuning, distillation, and attacks.
Training an AI model can cost millions of dollars, but once a model is copied, fine-tuned, or distilled into another model, proving where it originally came from can become extremely difficult.
Sentient researchers recently tested ten technical approaches designed to solve this problem and found that sufficiently sophisticated attacks can bypass almost all of them without compromising model utility, including Sentient's own model fingerprinting technique.
Now, the Sentient Foundation is officially launching the Fingerprinting Leaderboard, an open evaluation benchmark designed to measure which model fingerprinting techniques actually work, how much they affect model performance, and whether these fingerprints can survive removal attacks.
As more and more capable AI models are released, fine-tuned, distilled, and repackaged, this problem is becoming increasingly important. Model weights can be copied, and metadata can disappear, making it difficult for developers to reliably prove that another model is actually derived from their own work.
Model fingerprinting offers a different approach: embedding proof of provenance directly into the model itself.
"AI models are becoming some of the most valuable intellectual property in the world, but once a model is copied or distilled, proving ownership becomes extremely difficult," said Sachi Kamiya, Director of Venture and Growth at the Sentient Foundation. "Model fingerprinting embeds proof directly into the model. You can think of it as a hidden mark in AI, much like Renaissance painters left hidden marks in their works to prove their authorship."
Signatures hidden inside the model
Model Fingerprinting is being explored and developed by Sentient Labs and other researchers in the field. It broadly refers to a class of techniques that identify a model's identity or trace its origin and evolutionary relationships by creating, discovering, or verifying model-specific signals.
Sentient's own approach embeds hidden behavioral signatures during model training. Later, when a model owner suspects that a model is derived from the original model, they only need API access to the suspect model to send preset secret verification prompts and check the model's responses, thereby determining whether traces of the original model remain.
Simply put, the model itself carries the evidence that can prove its origin.
"This mark is a behavioral signature encoded into the model during training," explained Eduardo Contente, AI researcher at Sentient Labs. "Afterward, we can check it through specific verification prompts to determine whether a suspect model still retains traces of the original model."
This gives AI a capability it has long lacked: verifying provenance directly from the model itself, rather than relying only on logs, metadata, or external investigation.
24,576 fingerprints embedded in a single model
Sentient researchers have already demonstrated that model fingerprinting can scale far beyond previous approaches.
Sentient's Perinucleus method was featured at NeurIPS 2025. It successfully embedded 24,576 fingerprints into a Llama-3.1-8B model while causing only minimal loss in model utility, and many of these fingerprints remained after subsequent fine-tuning.
This scale matters. More fingerprints mean higher statistical confidence, more opportunities to verify model provenance, and greater resilience as models are copied or distributed.
But scale is only half the problem. The harder question is: can these fingerprints survive when someone actively tries to remove them?
Sentient tries to break model fingerprinting, including its own
Sentient Labs' latest research shows that many existing model fingerprinting and watermarking techniques remain clearly vulnerable to sophisticated attacks.
In research published at SaTML 2026, Sentient researchers designed adaptive attacks against ten recently proposed model fingerprinting schemes. They found that sufficiently sophisticated attackers can bypass almost all of them while maintaining model utility.
This also includes Sentient's own Perinucleus method.
Rather than covering up these weaknesses, Sentient chose to publish the findings openly.
The goal of the Fingerprinting Leaderboard is to turn this adversarial testing process into an open evaluation benchmark. The first version mainly evaluates whether different techniques can effectively embed fingerprints without degrading model performance. Upcoming subsequent versions will also add adversarial robustness evaluation to test the extent to which these fingerprints can survive attacks that intentionally remove or evade them.
The goal is simple: model fingerprinting should not merely perform well on research benchmarks; it should also withstand attacks that actively try to break it.
Opening testing to the research community
Alongside the Fingerprinting Leaderboard, Sentient is open-sourcing the mlprints toolkit. This toolkit integrates different model fingerprinting techniques and their attack methods into a unified evaluation framework.
Researchers can use this framework to implement new fingerprinting schemes, develop new attack methods, reproduce existing research results, and compare different techniques under unified testing conditions, driving the field forward.
The Fingerprinting Leaderboard will evolve together with the research community, transforming model fingerprinting research into an open testing environment. Here, any claim about technical robustness can be independently verified, rather than relying solely on the conclusions of the researchers themselves.
Open models, while retaining ownership
Model fingerprinting has the potential to help solve a major challenge facing open-source AI.
Today, developers often have to weigh two choices: either keep model weights closed to maintain control over the model, or open the model weights and lose visibility into how the model is copied and reused.
Model fingerprinting offers a third possibility.
It does not try to prevent models from being copied. Instead, it preserves evidence that can prove the model's provenance after copying occurs. In the future, this evidence can be used to support provenance attribution, license enforcement, economic rights protection, and other mechanisms built around verifiable model provenance.
By making model provenance verifiable, Sentient's model fingerprinting research and the Fingerprinting Leaderboard aim to promote a more open AI ecosystem. In this ecosystem, models can be freely shared and used by other developers for further innovation, without original creators automatically giving up the ability to prove technical provenance.
The longer-term goal is even more challenging: to bind model fingerprints so deeply to the model's own capabilities that any attempt to remove the fingerprints would simultaneously damage the model itself.
Intellectual property, provable. Know your model.
Learn more: https://fingerprint.sentient.foundation
About the Sentient Foundation
The Sentient Foundation is a nonprofit organization dedicated to ensuring that artificial general intelligence (AGI) remains open source and aligned with humanity's interests and values.
With neutrality and transparency as its core principles, the foundation promotes the global adoption of open-source AGI, advocates for AI alignment and safety standards, provides grants to developers worldwide, and coordinates the establishment of governance frameworks for responsible AI development.
For media inquiries, please contact: [email protected]
Official website: https://sentient.foundation
X: https://x.com/sentient_foundLinkedIn: https://www.linkedin.com/company/sentient-foundation/
About Sentient Labs
Sentient Labs is the institution under Sentient Foundation responsible for technical research and product development.
Sentient Labs is committed to advancing frontier applied research in reasoning, AI alignment, and multi-agent collaboration, and develops open-source frameworks and models including ROMA, OML, and Arena, demonstrating the potential of community-driven artificial intelligence.
Its work also includes supporting the commercialization of open-source tools, enhancing the quality and utility of the open-source AI ecosystem through collaboration across the entire ecosystem, and providing the necessary distribution channels to drive open source to become the default standard in the AI field.
Official website: https://sentient.xyz
X: https://x.com/sentientAGI
LinkedIn: https://www.linkedin.com/company/sentientagi/