The behavior of LLMs does not depend solely on the model itself. Components of the inference system, such as the inference engine, attention backend, and hardware platform, subtly influence how inputs are processed. These components differ in their implementations and thereby induce small numerical deviations across systems when running the same model. While prior work has established the theoretical existence of such deviations, their security implications have remained unexplored. In this paper, we show that these deviations are characteristic of specific components and propagate to observable textual outputs, exposing the inference system to any party that can query the model. Building on this observation, we introduce a fingerprinting method that analyzes the prompt-response behavior of LLMs to identify components of the inference system. Our empirical evaluation demonstrates that the inference engine, attention backend, and underlying hardware platform can be identified reliably, even when the LLM is operated at non-zero temperature. We show that preventing fingerprinting is fundamentally hard, as it would require eliminating numerical differences between hardware and software stacks. We therefore propose partial mitigations and discuss their impact.

翻译：大型语言模型的行为不仅取决于模型本身。推理系统的组件，例如推理引擎、注意力后端和硬件平台，会微妙地影响输入的处理方式。这些组件的实现各不相同，因此在运行相同模型时，会导致不同系统间产生微小的数值偏差。虽然先前的研究已经从理论上确认了此类偏差的存在，但其安全影响仍未被探索。在本文中，我们证明这些偏差是特定组件所特有的，并会传播到可观测的文本输出中，从而将推理系统暴露给任何能查询该模型的第三方。基于这一发现，我们提出了一种指纹识别方法，该方法通过分析大型语言模型的提示-响应行为来识别推理系统的组件。我们的实证评估表明，即使大型语言模型在非零温度下运行，推理引擎、注意力后端和底层硬件平台也能被可靠地识别。我们证明，防止指纹识别从根本上来说是困难的，因为这需要消除硬件和软件堆栈之间的数值差异。因此，我们提出了部分缓解措施，并讨论了它们的影响。