Writing study: Every Language Model Has a Forgery-Resistant Signature

ICLR overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICLR 2026 oral writing corpus

Matthew Finlayson, Xiang Ren, Swabha Swayamdipta · Official ICLR 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Theory & formal foundations (primary) · Inference, algorithms & systems efficiency.

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

17 physical pages

Before references / appendix

≈ 9.37 page-equivalents

Main figures / tables

7 / 2

Attached appendix figures / tables

4 / 0

Attached appendix span

≈ 4.63 page-equivalents

Before references / appendix: ≈ 55.12%References / intervening material: ≈ 17.65%Attached appendix: ≈ 27.24%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Source-bound correction: Title Case headings manually matched against the pinned PDF layout; source page positions retained. Section spans remain estimates.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1 Introduction	1	≈ 1.18 pp.	6.94%
2 Language model ellipses are signatures	2	≈ 2.61 pp.	15.35%
3 Ellipse forgery is hard	5	≈ 3.28 pp.	19.29%
4 Ellipse signatures are message authentication codes	8	≈ 1.07 pp.	6.29%
5 Discussion and conclusion	9	≈ 0.45 pp.	2.65%
6 Acknowledgements	10	≈ 0.18 pp.	1.06%
References	10	≈ 3 pp.	17.65%
A Centered logits also lie on an ellipse	13	≈ 0.25 pp.	1.47%
B Comparison to existing verification systems	13	≈ 0.93 pp.	5.47%
C How to extract an ellipse	14	≈ 1.05 pp.	6.18%
D Proof of equivalent reparameterization	15	≈ 0.26 pp.	1.53%
E Parameter recovery for layer norm models	15	≈ 1.42 pp.	8.35%
F Ellipse extraction implementation	17	≈ 0.12 pp.	0.71%
G Smoothing severity	17	≈ 0.16 pp.	0.94%
H Logit transformations	17	≈ 0.44 pp.	2.59%

All detected figure and table locations

Main text

• Figure 1 · p. 2
• Figure 2 · p. 3
• Figure 3 · p. 4
• Figure 4 · p. 6
• Figure 5 · p. 7
• Table 1 · p. 7
• Figure 6 · p. 8
• Figure 7 · p. 9
• Table 2 · p. 13

Attached appendix

• Figure 8 · p. 14
• Figure 9 · p. 15
• Figure 10 · p. 16
• Figure 11 · p. 17

Argument and organization

1. Natural geometric signature

   Builds from normalization and affine output projection.

2. Forgery resistance and extraction cost

   Separates geometric verification from attack complexity.

3. Authentication analogy and limitations

   Translates a mathematical constraint into a cautiously proposed protocol.

Problem, claim and contribution

Four named properties organize the contribution and distinguish its niche from watermarks. An early footnote narrows every model to architectures with a final normalization layer, and a generation step means a complete next-token probability vector, not one generated word.

Abstract, Sections 1–2 and footnotes 1–3, pp.1–2 · Main paper

Argument and section order

The exposition derives the output ellipsoid before discussing extraction attacks, avoiding an unexplained security metaphor. Separate sections quantify data acquisition and fitting costs; those are properties of specified procedures, not proof that every conceivable forgery attack is hard.

Sections 2–3, pp.3–8 · Main paper

Figures, captions and visual explanation

Figure 3 uses a logarithmic axis and a nearby checkpoint to make identification separation visible. Figure 7 places ordinary authentication and the proposed ellipse protocol side by side, clarifying which quantities correspond without implying equivalent guarantees.

Figures 3, 7, pp.4, 9 · Main paper

Tables, comparisons and evidence

Ellipse recovery is demonstrated on a one-million-parameter model. The thousands-of-years estimate instead extrapolates a sixth-degree runtime curve from dimensions 8–256; the paper appropriately warns that this is intuition, not a measured large-model attack time.

Section 3.1, Figure 6 and footnote 6, pp.6, 8 · Main paper

Appendix and reproducibility

Appendices explain centering, layer-normalization dimension reduction and smoothing error. These expose why exact surface membership is idealized. Appendix C prints a positive-definite quadratic equal to zero when a nondegenerate ellipsoid requires a positive level; equations should not be copied uncritically.

Appendices A, C, E–H, pp.13–17 · Main paper

Clarity and writing conventions

The authors explicitly prefer forgery resistance to unforgeability and acknowledge replayed vectors, removal by output modification and restricted logprob access. Those qualifications are more useful than treating the title as cryptographic certification.

Sections 1, 4–5, pp.2, 9–10 · Main paper

What to reuse—and what not to infer

Transferable lesson: Define the observation interface and threat model early, distinguish measured experiments from extrapolations, and use analogies without importing stronger guarantees.

Boundary: The signature identifies compatible output geometry, not an authenticated prompt-to-sequence computation. Production deployment, adversarial security and uniqueness across models sharing output layers require additional analysis.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-09-19

Reading status

Full text + selected visuals inspected

Main text

Pages 1–10, Sections 1–6; references 10–12

Appendix / supplement

Pages 13–17, Appendices A–H, including reparameterization proof, layer normalization, implementation and output transformations

Visually inspected PDF pages

4, 9

• official ICLR 2026 proceedings PDF · 17 pages