Writing study: LLM Fingerprinting via Semantically Conditioned Watermarks

ICLR overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICLR 2026 oral writing corpus

Thibaud Gloaguen, Robin Staab, Nikola Jovanović, Martin Vechev · Official ICLR 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Learning & optimization algorithms (primary) · Empirical analysis, diagnosis & auditing.

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

36 physical pages

Before references / appendix

≈ 10.11 page-equivalents

Main figures / tables

2 / 3

Attached appendix figures / tables

10 / 6

Attached appendix span

≈ 19.89 page-equivalents

Before references / appendix: ≈ 28.08%References / intervening material: ≈ 16.67%Attached appendix: ≈ 55.25%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1 INTRODUCTION	1	≈ 1.19 pp.	3.31%
2 RELATED WORK	2	≈ 0.97 pp.	2.69%
3 A ROBUST AND STEALTHY MODEL FINGERPRINTING PARADIGM	3	≈ 0.96 pp.	2.67%
4 INSTANTIATION OF OUR FINGERPRINTING METHOD	4	≈ 1.72 pp.	4.78%
5 EVALUATION	6	≈ 3.91 pp.	10.86%
6 CONCLUSION & LIMITATIONS	10	≈ 0.21 pp.	0.58%
ETHICS STATEMENT	10	≈ 0.14 pp.	0.39%
REPRODUCIBILITY STATEMENT	10	≈ 0.54 pp.	1.5%
REFERENCES	11	≈ 6 pp.	16.67%
A OMITTED EXPERIMENTAL DETAILS	17	≈ 2.72 pp.	7.56%
B ADDITIONAL EXPERIMENTS	19	≈ 4.04 pp.	11.22%
C ABLATION ON OUR FINGERPRINTING METHOD COMPONENTS	23	≈ 4 pp.	11.11%
D FINGERPRINT DETECTION	27	≈ 1.57 pp.	4.36%
E ON SEMANTICALLY CONDITIONED WATERMARKS	29	≈ 2.85 pp.	7.92%
F BROADER IMPACT AND RESOURCES	32	≈ 1.42 pp.	3.94%
G OUR FINGERPRINT QUERIES AND REPLIES EXAMPLES	33	≈ 3.3 pp.	9.17%

All detected figure and table locations

Main text

• Figure 1 · p. 2
• Table 1 · p. 6
• Table 2 · p. 7
• Table 3 · p. 8
• Figure 2 · p. 9

Attached appendix

• Table 4 · p. 20
• Table 5 · p. 20
• Figure 3 · p. 21
• Figure 4 · p. 22
• Figure 5 · p. 23
• Table 6 · p. 23
• Figure 6 · p. 24
• Table 7 · p. 25
• Figure 7 · p. 25
• Figure 8 · p. 26
• Table 8 · p. 26
• Figure 9 · p. 27
• Figure 10 · p. 30
• Figure 11 · p. 31
• Figure 12 · p. 31
• Table 9 · p. 32

Argument and organization

1. Fingerprint paradigm and instantiation

   Separates the design principle from one watermark implementation.

2. Effectiveness, robustness and stealth

   Turns three desired properties into separately evaluated questions.

3. Detector, ablations and examples

   Provides statistical assumptions, resource costs and qualitative trade-offs.

Problem, claim and contribution

The introduction identifies two independent weaknesses in query–key fingerprints, then replaces both with a semantic query domain and a distributed statistical signal. That parallel problem–solution structure makes the novelty easy to locate.

§§1 and 3, pp.1–4 · Main paper

Argument and section order

Algorithm 1 and the two losses distinguish watermark distillation inside the domain from distribution preservation outside it. Detection receives a separate subsection instead of being buried in training details.

§4, Algorithm 1 and Eqs.1–3, pp.4–5 · Main paper

Figures, captions and visual explanation

Figure 1 separates the threat model, prior approach and proposed design into three panels. Its green checks communicate the thesis quickly, but the accompanying caption and text must keep robustness scoped to tested deployment scenarios.

Figure 1, p.2 · Main paper

Tables, comparisons and evidence

The robustness matrix is unusually navigable because attacks are grouped by deployment stage. Nevertheless, an FSR of one summarizes five trials; the default uses 1,000 queries, so it is not a universal or low-query guarantee.

§5 setup and Tables 2–3, pp.6–9 · Main paper

Appendix and reproducibility

Figure 8 places detection strength and quality distortion beside one another. Appendix B also exposes a substantial drop in French judge scores despite nearly stable benchmark averages, preventing utility preservation from becoming an unqualified claim.

Table 4, p.20; Figure 8, p.26 · Main paper

Clarity and writing conventions

The statistical proof states independence and context-diversity assumptions, while the limitations acknowledge domain blocking and the ethics statement rejects fingerprints as sufficient ownership evidence. Those boundaries should accompany any shortened account.

§6 and ethics, p.10; Theorem D.1, pp.28–29 · Main paper

What to reuse—and what not to infer

Transferable lesson: Organize security evidence around distinct desired properties, disclose the adversary and query budget, and put the benefit–distortion trade-off beside the headline success rate.

Boundary: The detector is asymptotically calibrated under its stated assumptions, not a finite-sample unconditional guarantee. Stealth relies partly on domain secrecy, domain-specific quality can deteriorate, and the training cost is materially larger than the query–key baselines.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-09-19

Reading status

Full text + selected visuals inspected

Main text

pp.1–10, §§1–6 and ethics/reproducibility; references pp.11–16

Appendix / supplement

pp.17–36, appendices A–G, including detector proof, ablations, resources and generated examples

Visually inspected PDF pages

2, 26

• official ICLR 2026 proceedings PDF · 36 pages