An AI model can take millions of dollars to build. Once someone copies it, adapts it or uses its outputs to train another model, proving where that technology came from becomes much harder.
Sentient Foundation’s new Fingerprinting Leaderboard tackles that problem with an unusually candid starting point: nearly every fingerprinting technique its researchers tested could be evaded, including Sentient’s own.
The benchmark is designed to compare methods for identifying a model’s origins, measuring whether they leave a detectable signature without damaging its performance. According to Sentient’s launch materials, the first release focuses on fingerprint embedding and model utility; a forthcoming release will add tests against deliberate attempts to remove or evade those signatures.
Post from @sentient_foundView the original post on X↗
A Signature That Travels With the Model
Model fingerprinting looks for evidence inside a model’s behavior. In Sentient’s approach, researchers train hidden signatures into the model, then check for them later using secret challenge prompts.
If a developer suspects another service is running a derivative of its model, it can send those prompts through the service’s API and examine the responses. A distinctive pattern of answers can indicate that traces of the original remain, even when the developer cannot inspect the suspected copy’s underlying weights.
“Fingerprinting puts the proof inside the model,” said Sachi Kamiya, Director of Venture and Growth at Sentient Foundation. “Think of it as the AI equivalent of the hidden marks Renaissance painters used to establish authorship.”
The commercial appeal is straightforward: developers could gain a way to trace reuse after their models leave their control. That becomes particularly relevant when models are fine-tuned for new tasks or distilled—a process in which one model’s outputs help train another.
A fingerprint provides evidence of lineage, rather than an automatic verdict on ownership. Its usefulness depends on how reliably it identifies related models and avoids false matches.
24,576 Fingerprints in One Model
Sentient’s Perinucleus research, spotlighted at NeurIPS 2025, demonstrated that researchers could embed 24,576 fingerprints into Meta’s Llama-3.1-8B without degrading utility in the paper’s evaluations.
The researchers also found that fingerprints persisted after supervised fine-tuning on standard post-training data.
That scale matters because a model owner gets more opportunities to check for a match. A derivative model might lose some signatures during further training while retaining enough others to provide useful evidence.
But surviving ordinary training changes is only one test. A determined operator trying to conceal a model’s origins presents a harder problem.
Sentient Tested Its Own Defenses
In research presented at SaTML 2026, researchers examined ten proposed fingerprinting schemes and developed attacks tailored to their weaknesses.
Sentient’s launch materials describe nearly all of the tested methods as vulnerable to sophisticated evasion while preserving the model’s usefulness. Perinucleus was among them.
For developers, that finding exposes a practical weakness: a signature can survive routine modifications yet still fail when someone deliberately targets the way it is detected. A copied model could remain useful to customers while its original creator loses the ability to authenticate it.
The leaderboard aims to make those trade-offs easier to examine under common testing conditions. Its planned adversarial evaluations will address the question that basic fingerprint retention cannot answer: what happens when someone actively tries to defeat the check?
Opening the Tests to Other Researchers
Alongside the leaderboard, Sentient is releasing mlprints, an open-source framework for generating, training, attacking and verifying model fingerprints.
Researchers can use it to implement new techniques, reproduce experiments and compare results. Bringing methods and attacks into a shared framework should also make it easier to distinguish improvements in fingerprint durability from differences in how researchers run their tests.
Post from @SentientAGIView the original post on X↗
The Business Case for Open Models
The initiative connects to Sentient’s broader effort to make open AI economically sustainable. Blockster previously covered the Foundation’s $42 million grant and investment program for open-source AGI builders.
Funding helps developers build. Reliable provenance could help them demonstrate where their work ends up.
If fingerprinting becomes dependable under adversarial conditions, it could support attribution, licensing and commercial arrangements around shared models. Developers could distribute their technology more widely while retaining evidence of its origins.
Sentient’s longer-term research goal is more ambitious: a fingerprint so closely tied to a model’s capabilities that removing it also damages the model’s usefulness.
For now, that remains a goal. The immediate task is to establish which fingerprints deserve confidence—and which fall apart when someone tries to erase them.
Reporting by Eric Spivak
