Construction-Driven Injection: Linguistically-Grounded Edit-Based Code-Mixing Fingerprints for Large Language Models

# Linguistically-Grounded Edit-Based Code-Mixing Fingerprints for Large Language Models
Source: [https://arxiv.org/html/2607.25633](https://arxiv.org/html/2607.25633)
## Construction\-Driven Injection: Linguistically\-Grounded Edit\-Based Code\-Mixing Fingerprints for Large Language Models

Yongyi Cui1, Yue Li111footnotemark:1, Tianbao Jiang1, Xin Yi1

###### Abstract

Large language models \(LLMs\) are costly intellectual assets that remain exposed to unauthorized redistribution and commercial misuse\. Injected fingerprints, i\.e\., trigger–target pairs embedded in model behavior, offer a practical, black\-box\-verifiable ownership signal, but existing methods decouple the two stages of the fingerprint life cycle: how a fingerprint is constructed and how it is injected\. Existing fingerprinting frameworks suffer from two limitations\. Natural\-language fingerprints are prone to accidental activation, and garbled fingerprints are easily filtered by perplexity\-based detection\. Furthermore, decoupling construction from injection leaves the latter unaware of the trigger’s linguistic structure, missing the opportunity for targeted optimization\. We argue that fingerprint construction should drive injection, and present a unified fingerprinting framework that jointly optimizes both stages\. First, LCF constructs code\-mixing fingerprints by combining low\-resource languages under a semantic\-density substitution rule and grammar\-biased mixing, yielding triggers whose perplexity sits far below garbled baselines while avoiding the accidental\-activation failures of natural\-language triggers\. Second, LCFEdit injects each fingerprint with a null\-space projection derived from high\-resource multilingual representations that preserves knowledge, augmented by a cross\-lingual alignment step that steers the weight update toward the fingerprint language’s representation subspace\. This construction\-aware injection ensures that the update is linguistically informed and therefore more stable\. Extensive evaluations on imperceptibility, detectability, and harmlessness demonstrate persistent ownership verification with negligible impact on utility\.

## 1Introduction

Large language models \(LLMs\) require substantial computation, data, and engineering to build, which makes them valuable intellectual property\. Once weights are released, even under restrictive licenses, they can be redistributed, fine\-tuned, quantized, or merged and then re\-served, often through black\-box APIs that hide the underlying parameters\(Touvronet al\.[2023](https://arxiv.org/html/2607.25633#bib.bib34); Xuet al\.[2024](https://arxiv.org/html/2607.25633#bib.bib27)\)\. Reliable ownership verification must therefore survive realistic post\-release modification and must not require white\-box access to the suspect model\.

Model fingerprinting has emerged as the leading response\. Intrinsic methods compare weights or activations and thus need full parameter access, ruling out the common black\-box infringement setting\. Injected fingerprints instead embed trigger–target pairs directly into model behavior, so ownership can be checked by querying the deployed model\(Russinovich and Salem[2024](https://arxiv.org/html/2607.25633#bib.bib28)\)\. An injected fingerprint passes through two stages during its life cycle: it is first constructed \(the trigger–target pair is designed\) and then injected \(the pair is written into the weights\)\. As shown in Table[1](https://arxiv.org/html/2607.25633#S1.T1), prior work optimizes these two stages in isolation, and this decoupling is the source of persistent weaknesses\.

![Refer to caption](https://arxiv.org/html/2607.25633v1/figures/fig_framework.png)Figure 1:Our framework couples the two stages of the fingerprint life cycle\. \(A\) Construction: LCF converts a medium/low\-resource sentence into a code\-mixing trigger–target pair via semantic\-density substitution and grammar\-biased mixing; the design is motivated by the Digital Island hypothesis that low\-resource fingerprint tokens receive little mainstream fine\-tuning gradient\. \(B\) Injection: LCFEdit writes the pair into FFN key–value memories through a mainstream\-preserving null\-space projection, followed by a cross\-lingual alignment step that concentrates the update in the fingerprint language’s subspace\. The orange arrow marks the coupling: the construction\-stage language identity selects where the injection concentrates its edit\.Table 1:Comparison of our LCF\-LCFEdit framework with recent LLM fingerprinting frameworks\.In the first stage of fingerprint construction, existing paradigms face a trade\-off between user\-side and model\-side imperceptibility\. Natural\-language fingerprints \(NLFs\) use English phrases resembling ordinary user input\(Wanget al\.[2025](https://arxiv.org/html/2607.25633#bib.bib17)\)\. Because they overlap with the benign input distribution, they suffer accidental activation: a recent study reports that when an NLF appears as a sentence suffix, false triggering reaches roughly 60%\(Liet al\.[2025b](https://arxiv.org/html/2607.25633#bib.bib19)\)\. Garbled or “instructional” fingerprints \(IFs\) use random token sequences\(Xuet al\.[2024](https://arxiv.org/html/2607.25633#bib.bib27); Caiet al\.[2025](https://arxiv.org/html/2607.25633#bib.bib6)\)\. These avoid accidental activation but are statistically anomalous, since their perplexity is orders of magnitude above natural text, so an adversary can flag them with a simple perplexity filter\. Code\-mixing fingerprints \(CFs\) were recently introduced to occupy the middle ground \(Table[1](https://arxiv.org/html/2607.25633#S1.T1)\), but their construction is rule\-based over randomly sampled languages, without a principled account of why a particular mixture should be both hard to trigger accidentally and hard to detect statistically\.

In the second stage of fingerprint injection, supervised fine\-tuning \(e\.g\., LoRA\(Huet al\.[2022](https://arxiv.org/html/2607.25633#bib.bib30)\)\) offers limited token\-level control and tends to overfit\. Knowledge\-editing injection is stronger: locate\-then\-edit methods such as ROME\(Menget al\.[2022](https://arxiv.org/html/2607.25633#bib.bib23)\)and MEMIT\(Menget al\.[2023](https://arxiv.org/html/2607.25633#bib.bib25)\)write associations directly into feed\-forward layers, and AlphaEdit\(Fanget al\.[2025](https://arxiv.org/html/2607.25633#bib.bib1)\)projects the perturbation onto the null space of preserved knowledge so that unrelated facts are provably undisturbed\. FPEdit adapts this machinery to fingerprinting with a promote–suppress value\-vector objective, and MCEdit adds multi\-candidate targets and a margin\-based boundary\. Yet in all of these methods the injection procedure is blind to how the fingerprint was constructed: the same generic null space and the same generic objective are used regardless of whether the trigger is English, garbled, or code\-mixed\. The linguistic prior created during construction is discarded exactly when it could inform injection\.

To address these issues, we argue that the linguistic structure of a code\-mixing fingerprint should directly shape its injection, and we develop an end\-to\-end framework with two coupled components\.*First*, we propose LCF \(Linguistically\-grounded Code\-mixing Fingerprints\), which constructs fingerprints from low\-resource language combinations selected by a semantic\-density rule and shaped by grammar\-biased mixing\. The design is motivated by a working hypothesis we call the*Digital Island*: parameters associated with low\-resource languages receive little gradient signal during mainstream\-language adaptation, so a fingerprint anchored there is naturally shielded from the fine\-tuning, quantization, and pruning that a redistributor is likely to apply\.*Second*, we propose LCFEdit, which injects each fingerprint by pairing a null\-space projection that preserves mainstream English/Chinese knowledge with a cross\-lingual alignment step: the solved weight update is realigned toward the fingerprint language’s representation subspace, estimated from that language’s Wikipedia key statistics\. This step uses the construction\-stage language identity to decide where in representation space to concentrate the edit, connecting construction and injection\.

Experimental results show that LCF strikes an effective balance between user\-side and model\-side imperceptibility, achieving the lowest template perplexity among all fingerprint paradigms \(mean 96, vs\. 104 for CF and 1302 for garbled IF\) while exhibiting zero accidental activation across 12 languages\. Moreover, the construction\-aware injection of LCFEdit enables more robust and fault\-tolerant ownership verification, achieving 93–99\.5% injection success and improving mean post\-attack retention by 9–34 points over the AlphaEdit baseline, with leading detectability across model scales and architectures\. LCFEdit maintains at least 55% average detectability under diverse model modifications with negligible impact on model utility\. In summary, our contributions are as follows:

- •We propose LCF, a code\-mixing fingerprint construction guided by a semantic\-density substitution rule and grammar\-biased mixing over low\-resource languages, mitigating the imperceptibility trade\-off of prior paradigms\.
- •We propose LCFEdit, a multilingual fingerprint injection method that couples mainstream\-preserving null\-space editing with a cross\-lingual alignment step keyed to the construction\-stage language, so each edit is concentrated in the fingerprint language’s representation subspace\.
- •Our end\-to\-end framework demonstrates consistent gains over existing methods, raising mean injection success from 55–70% to 93–99\.5% across four models and improving mean post\-attack retention by 9–34 points, which enables reliable ownership verification in real\-world deployment\.

## 2Related Work

### 2\.1LLM Fingerprinting

As LLMs face growing security threats, from jailbreak and harmful fine\-tuning attacks\(Yiet al\.[2026](https://arxiv.org/html/2607.25633#bib.bib18),[2025a](https://arxiv.org/html/2607.25633#bib.bib29)\)to unauthorized redistribution, protecting their intellectual property has become a pressing concern\. Fingerprinting and watermarking are two related LLM intellectual property protection techniques\. Watermarking embeds identifiable signals in generated content to distinguish machine\-generated from human\-written text, facilitating the tracing of content sources\(Kirchenbaueret al\.[2023](https://arxiv.org/html/2607.25633#bib.bib33); Liet al\.[2026b](https://arxiv.org/html/2607.25633#bib.bib24); Yiet al\.[2025b](https://arxiv.org/html/2607.25633#bib.bib22)\)\. In contrast, fingerprinting verifies whether a suspicious model originates from the original model, even after downstream modifications\.

LLM fingerprints can be broadly divided into two types\(Zhanget al\.[2025](https://arxiv.org/html/2607.25633#bib.bib4)\): injected fingerprints\(Caiet al\.[2025](https://arxiv.org/html/2607.25633#bib.bib6)\), which modify the model to embed specific trigger–target pairs, and intrinsic fingerprints\(McGovernet al\.[2025](https://arxiv.org/html/2607.25633#bib.bib5)\), which rely on inherent statistical or behavioral characteristics of the model\. However, intrinsic fingerprinting approaches often require white\-box access to model parameters, limiting their applicability\. Since injected fingerprints require parameter updates to embed trigger–target pairs, they inevitably introduce some loss of model utility\. This work aims to develop an imperceptible and persistent injected fingerprinting framework while minimizing disruption to unrelated knowledge\.

### 2\.2Edit\-based Fingerprint Injection

Knowledge editing serves as a lightweight alternative to supervised fine\-tuning, enabling targeted updates to model knowledge\. Existing approaches fall into three categories: locate\-then\-edit, hypernetwork\-based, and memory\-based techniques\(Wanget al\.[2024a](https://arxiv.org/html/2607.25633#bib.bib3)\)\. AlphaEdit is a representative locate\-then\-edit method that restricts updates to the null space orthogonal to unrelated knowledge, thereby preserving model utility\. It has also been widely adopted as the primary base method in edit\-based fingerprint injection works\(Liet al\.[2025a](https://arxiv.org/html/2607.25633#bib.bib2); Yueet al\.[2025](https://arxiv.org/html/2607.25633#bib.bib20)\)\. These techniques introduce refinements for strict fingerprint matching and optimizations to maintain detectability under model modification attacks\. However, they treat fingerprint construction and fingerprint injection as two separate stages, missing the opportunity for joint optimization to achieve more effective fingerprinting\.

## 3Methodology

#### Overview\.

As illustrated in Fig\.[1](https://arxiv.org/html/2607.25633#S1.F1), our framework consists of two stages\. Section[3\.2](https://arxiv.org/html/2607.25633#S3.SS2)introduces LCF, which constructs code\-mixing fingerprints from low\-resource languages under a semantic\-density substitution rule and grammar\-biased mixing, balancing accidental activation and statistical detectability\. Section[3\.3](https://arxiv.org/html/2607.25633#S3.SS3)presents LCFEdit, which injects fingerprints through mainstream\-preserving null\-space editing followed by a cross\-lingual alignment step keyed to the construction\-stage language\.

### 3\.1Problem Setup and Threat Model

LetfWf\_\{W\}be a victim model with weightsWW\. A fingerprint is a pair\(x,y\)\(x,y\)wherexxis a trigger prompt andyya target completion\. We use one\-to\-one fingerprints: each trigger maps to a single target\. Ownership verification queries a suspect model withxxand checks whether the output begins withyy\.

#### Threat Model\.

The adversary obtains the full weightsWWand serves the model as a black box\. The adversary may be aware that a fingerprint has been embedded, but does not know its concrete form or content\. To evade ownership verification, the adversary may \(i\) apply utility\-preserving modifications such as fine\-tuning, quantization, or pruning to erase the fingerprint, and \(ii\) deploy an abnormal\-input filter \(e\.g\., perplexity\-based\) to block suspected verification queries\. A practical fingerprint must therefore remain imperceptible on both the user side \(no accidental activation\) and the model side \(statistics close to natural text\), stay detectable after model modifications, and leave model utility intact\.

### 3\.2LCF: Linguistically\-Grounded Construction

#### Digital Island Hypothesis\.

Instruction tuning, quantization, and pruning are driven overwhelmingly by mainstream\-language data and activations\. We hypothesize that parameters aligned with low\-resource languages therefore lie in a relatively “quiet” region of representation space, receiving small gradients under mainstream fine\-tuning and being less likely to be pruned or distorted by quantization\. Formally, for a fine\-tuning gradientgf​tg\_\{ft\}and fingerprint\-token embeddingww, we hypothesize

𝔼​\[⟨gf​t,wLCF⟩\]≪𝔼​\[⟨gf​t,wNLF⟩\]\.\\mathbb\{E\}\\big\[\\langle g\_\{ft\},w\_\{\\text\{LCF\}\}\\rangle\\big\]\\ \\ll\\ \\mathbb\{E\}\\big\[\\langle g\_\{ft\},w\_\{\\text\{NLF\}\}\\rangle\\big\]\.\(1\)We state Eq\. \([1](https://arxiv.org/html/2607.25633#S3.E1)\) as a hypothesis that motivates our construction\. We do not claim to prove it, and our detectability results under model modifications \(Sec\.[5](https://arxiv.org/html/2607.25633#S5)\) are consistent with, but do not directly measure, this gradient\-level statement\.

#### Semantic\-density Substitution\.

Given a medium/low\-resource language NLF as the source, we replace selected noun phrases with equivalents from other low\-resource languages so as to maximize cross\-lingual distinctiveness\. We define the semantic density of a wordwwas

D​\(w\)=S​I​\(w\)L​\(w\),S​I​\(w\)=1k​∑j=1k∥e​\(w\)−e​\(wjN​N\)∥2,D\(w\)=\\frac\{SI\(w\)\}\{L\(w\)\},\\qquad SI\(w\)=\\frac\{1\}\{k\}\\sum\_\{j=1\}^\{k\}\\lVert e\(w\)\-e\(w\_\{j\}^\{NN\}\)\\rVert\_\{2\},\(2\)wheree​\(⋅\)e\(\\cdot\)is a cross\-lingual embedding,\{wjN​N\}\\\{w\_\{j\}^\{NN\}\\\}are thekknearest neighbors ofwwin the target language, andL​\(w\)L\(w\)is the BPE length\. A substitution from source\-language wordwM​Lw\_\{ML\}to a wordwE​Lw\_\{EL\}from another low\-resource language is accepted whenD​\(wE​L\)\>D​\(wM​L\)D\(w\_\{EL\}\)\>D\(w\_\{ML\}\), i\.e\. when the substitute is more semantically isolated per token\. Density statistics are drawn from NorthEuraLex\(Dellertet al\.[2020](https://arxiv.org/html/2607.25633#bib.bib41)\)and large\-scale semantic\-alignment data\(Thompsonet al\.[2020](https://arxiv.org/html/2607.25633#bib.bib40)\)\.

#### Grammar\-biased Mixing\.

We further raise structural complexity by importing a second low\-resource language’s grammar \(e\.g\. verb\-second order, agglutinative suffixes\) and using its function words as logical anchors\. The combination yields high code\-mixing complexity in the sense of the CMI metric\(Das and Gambäck[2014](https://arxiv.org/html/2607.25633#bib.bib39)\)while keeping perplexity moderate because each individual token remains a real word of some language\. We use 12 target languages:bn, fa, hi, id, it, nl, pl, pt, sv, th, tr, vi, with 11 fingerprints each \(132 pairs total\)\.

### 3\.3LCFEdit: Construction\-Driven Injection

#### Editing Backbone\.

We edit FFN key–value memories\. For layerll, the key of a prompt isk=σ​\(Wi​nl​γ​\(hl−1\+al\)\)k=\\sigma\\\!\\big\(W\_\{in\}^\{l\}\\,\\gamma\(h^\{l\-1\}\+a^\{l\}\)\\big\)\(Gevaet al\.[2021](https://arxiv.org/html/2607.25633#bib.bib26)\)\. We adopt AlphaEdit’s null\-space projection to preserve mainstream knowledge\. LetK0K\_\{0\}collect keys of preserved \(English and Chinese\) knowledge\. With\{U,Λ,U⊤\}=eig​\(K0​K0⊤\)\\\{U,\\Lambda,U^\{\\top\}\\\}=\\mathrm\{eig\}\(K\_\{0\}K\_\{0\}^\{\\top\}\)the eigendecomposition of the \(symmetric\) key covariance andU^\\hat\{U\}the eigenvectors of near\-zero eigenvalues, the projector is

PLCF=U^​U^⊤,Δ​PLCF​K0=0,P\_\{\\text\{LCF\}\}=\\hat\{U\}\\hat\{U\}^\{\\top\},\\qquad\\Delta P\_\{\\text\{LCF\}\}K\_\{0\}=0,\(3\)guaranteeing\(W\+Δ​PLCF\)​K0=W​K0\(W\+\\Delta P\_\{\\text\{LCF\}\}\)K\_\{0\}=WK\_\{0\}: edits do not disturb preserved English/Chinese associations\. For a fingerprint with key matrixK1K\_\{1\}and target valuesV1V\_\{1\}, the null\-space\-constrained update solves, in closed form,

Δ=argminΔ~∥\(W\+Δ~PLCF\)K1−V1∥2\+λ∥Δ~PLCF∥2,\\Delta=\\arg\\min\_\{\\tilde\{\\Delta\}\}\\ \\lVert\(W\+\\tilde\{\\Delta\}P\_\{\\text\{LCF\}\}\)K\_\{1\}\-V\_\{1\}\\rVert^\{2\}\+\\lambda\\lVert\\tilde\{\\Delta\}P\_\{\\text\{LCF\}\}\\rVert^\{2\},\(4\)followingFanget al\.\([2025](https://arxiv.org/html/2607.25633#bib.bib1)\)\.

#### Cross\-lingual Alignment\.

The null\-space step tells the edit what to preserve but says nothing about where the fingerprint signal should concentrate\. Here we inject construction\-stage knowledge\. For the fingerprint’s target language, we estimate a subspace from that language’s Wikipedia key statistics and form an orthogonal projectorPislP\_\{\\text\{isl\}\}onto its top\-mmprincipal directions\. We then reweight the solved update toward this subspace by a post\-hoc convex step,

Δ′=\(1−α\)​Δ\+α​\(Δ​Pisl\),α∈\[0,1\],\\Delta^\{\\prime\}=\(1\-\\alpha\)\\,\\Delta\+\\alpha\\,\\big\(\\Delta\\,P\_\{\\text\{isl\}\}\\big\),\\qquad\\alpha\\in\[0,1\],\(5\)and applyW←W\+Δ′W\\leftarrow W\+\\Delta^\{\\prime\}, whereΔ\\Deltais the null\-space\-projected solution of Eq\. \([4](https://arxiv.org/html/2607.25633#S3.E4)\) \(so the mainstream\-preserving projection is already baked intoΔ\\Delta\)\. BecausePislP\_\{\\text\{isl\}\}is a symmetric projector, Eq\. \([5](https://arxiv.org/html/2607.25633#S3.E5)\) keeps the component of the edit that already lies in the target\-language subspace at full strength while attenuating the component outside it by a factor\(1−α\)\(1\-\\alpha\)\. The net effect is to directionally concentrate the update’s relative weight on the fingerprint language’s own representation subspace, trading a small amount of least\-squares optimality for a larger relative weight on the directions the Digital Island hypothesis identifies as least likely to be overwritten by mainstream fine\-tuning\. We useα=0\.25\\alpha=0\.25\(0\.15 for the 3B model\)\. All other injection hyperparameters \(edit layers,L2L\_\{2\}regularization, and the sampling protocol\) are identical to the AlphaEdit baseline\. The alignment projectorPislP\_\{\\text\{isl\}\}is the sole point of departure, and it is chosen by the construction\-stage language identity, which is where construction connects to injection\.

#### Why Post\-hoc Alignment\.

A tempting alternative is to fold the target\-language keys into the preserved set,K0\+=\[K0∣Kisl\]K\_\{0\}^\{\+\}=\[K\_\{0\}\\mid K\_\{\\text\{isl\}\}\], and edit in its null space\. This is counter\-productive: placingKislK\_\{\\text\{isl\}\}in the preserved null space would force the edit to avoid perturbing exactly the fingerprint\-language directions we wish to write\. Post\-hoc alignment does the opposite by concentrating the update’s relative weight on those directions, which is why we apply alignment as a post\-hoc reweighting ofΔ\\Deltarather than as a null\-space constraint\.

## 4Experimental Setup

Table 2:Detectability under different model modification tasks, with settings detailed in Appendix[A\.3](https://arxiv.org/html/2607.25633#A1.SS3)\. All values are FSR \(%\): Origin denotes the FSR before modification, the six attack columns report post\-modification FSR, and AVG is their mean\. Best per column within each model block in bold\.### 4\.1Models

We use four instruction models spanning 0\.8B to 9B: Qwen3\.5\-0\.8B, Qwen3\.5\-4B, and Qwen3\.5\-9B\(Yanget al\.[2024](https://arxiv.org/html/2607.25633#bib.bib35)\), with the 9B as our primary target model, plus Llama\-3\.2\-3B\-Instruct for cross\-family generalization\.

### 4\.2Baselines

For fingerprint construction paradigms, we adopt IF\(Xuet al\.[2024](https://arxiv.org/html/2607.25633#bib.bib27)\)as a representative gibberish fingerprint, NLF as a representative natural language fingerprint, and CF as a representative code\-mixing language fingerprint\. Regarding fingerprint injection methods, we select the supervised fine\-tuning method LoRA\(Huet al\.[2022](https://arxiv.org/html/2607.25633#bib.bib30)\), the standard knowledge\-editing method AlphaEdit, and fingerprint\-specific locate\-then\-edit methods, including FPEdit\(Wanget al\.[2025](https://arxiv.org/html/2607.25633#bib.bib17)\), PREE\(Yueet al\.[2025](https://arxiv.org/html/2607.25633#bib.bib20)\), and MCEdit\(Liet al\.[2025b](https://arxiv.org/html/2607.25633#bib.bib19)\)\.

### 4\.3Evaluation Dimensions

Based on prior work\(Liet al\.[2025b](https://arxiv.org/html/2607.25633#bib.bib19)\), a good fingerprinting framework should satisfy three requirements: balancing the trade\-off within imperceptibility for fingerprint construction, and jointly optimizing harmlessness and detectability for fingerprint injection\.

- •Imperceptibilityevaluates whether fingerprint triggers do not cause accidental activation during benign use, and whether they remain similar to normal inputs, making them difficult for adversaries to identify and filter\.
- •Harmlessnessevaluates whether fingerprint injection preserves the model’s original utility and performance on downstream tasks\.
- •Detectabilityrequires that a fingerprinted model continues to produce the designated fingerprint response to fingerprint queries even after model modifications\.

### 4\.4Attacks

We consider three types of post\-injection model modification attacks: pruning, quantization, and fine\-tuning\.Pruningis an LLM compression technique that removes redundant or low\-importance components\(Liet al\.[2025c](https://arxiv.org/html/2607.25633#bib.bib16)\)\. We adopt L1 unstructured pruning\(Hanet al\.[2015](https://arxiv.org/html/2607.25633#bib.bib15)\)with 30%–40% sparsity\.Quantizationreduces the bit width \(i\.e\., precision\) of model parameters\(Zhuet al\.[2024](https://arxiv.org/html/2607.25633#bib.bib12)\)\. We evaluate INT8\(Dettmerset al\.[2022](https://arxiv.org/html/2607.25633#bib.bib36)\)and NF4\(Dettmerset al\.[2023](https://arxiv.org/html/2607.25633#bib.bib11)\)quantization, spanning 8\-bit to 4\-bit precision\.Fine\-tuningadapts pretrained models to specific domains through additional training on domain\-specific data\(Liet al\.[2026a](https://arxiv.org/html/2607.25633#bib.bib14)\)\. We apply LoRA\(Huet al\.[2022](https://arxiv.org/html/2607.25633#bib.bib30)\)for fine\-tuning on both Alpaca\-Clean\(Taoriet al\.[2023](https://arxiv.org/html/2607.25633#bib.bib38)\)and MathInstruct\(Yueet al\.[2024](https://arxiv.org/html/2607.25633#bib.bib13)\)\.

### 4\.5Metrics and Datasets

For fingerprint verification, we adopt the Fingerprint Success Rate \(FSR\):FSR=1n​∑i=1n\[y^=y\]\\text\{FSR\}=\\frac\{1\}\{n\}\\sum\_\{i=1\}^\{n\}\[\\hat\{y\}=y\], wherennis the total number of fingerprint pairs, and verification succeeds only when the model’s response is prefixed by the fingerprint target\. Each fingerprinting method employs its corresponding constructed fingerprints\. For the accidental\-activation experiment, we use the original medium/low\-resource language NLF sentences from LCF as test data\.

To evaluate model utility, we consider two complementary dimensions: zero\-shot question answering and language modeling\. For zero\-shot QA, we evaluate on MMLU\(Hendryckset al\.[2020](https://arxiv.org/html/2607.25633#bib.bib8)\), RTE\(Wanget al\.[2018](https://arxiv.org/html/2607.25633#bib.bib10)\), and the multilingual benchmark MMMLU\(Wanget al\.[2024b](https://arxiv.org/html/2607.25633#bib.bib43)\)\. For language modeling, we report perplexity on WikiText2\(Merityet al\.[2016](https://arxiv.org/html/2607.25633#bib.bib9)\)test subset\. More relevant details are reported in Appendix[A](https://arxiv.org/html/2607.25633#A1)\.

## 5Experimental Results

### 5\.1Detectability

TableLABEL:tab:app\-injand Table[2](https://arxiv.org/html/2607.25633#S4.T2)report injection FSR and post\-attack retention across four models and six injection methods\. LCFEdit achieves the highest injection FSR on every model \(99\.5% on Qwen3\.5\-9B, 98\.5% on 4B, 93\.3% on 0\.8B, and 93\.0% on Llama\-3\.2\-3B\-Instruct\) and retains more fingerprint signal than every baseline under all six attacks on all three evaluated models \(Table[2](https://arxiv.org/html/2607.25633#S4.T2)\)\. On the primary 9B system, quantization causes negligible degradation \(95\.6%/95\.2% retention at INT8/NF4\), and the fingerprint is largely retained under fine\-tuning \(88\.1% Alpaca, 94\.2% MathInstruct\)\. Within the Qwen family the injection gap over AlphaEdit widens as models shrink \(ratio 0\.70→\\to0\.64→\\to0\.61 from 9B to 0\.8B\), indicating that smaller models with weaker multilingual representations benefit most from target\-language alignment\. The cross\-family 3B shows the single largest gap \(\+37\.7\+37\.7points\), so model family and native multilingual quality also matter\.

The contrast with LoRA and AlphaEdit is particularly informative\. LoRA, which relies on supervised fine\-tuning rather than knowledge editing, achieves only 49\.2% injection FSR and degrades sharply under every attack \(Table[2](https://arxiv.org/html/2607.25633#S4.T2)\), confirming that SFT offers insufficient token\-level control for precise fingerprint encoding\. AlphaEdit, though a stronger locate\-then\-edit method, applies a generic null\-space projection that is blind to the fingerprint’s linguistic structure\. Its mean retention trails LCFEdit by\+9\.2\+9\.2points on 9B,\+20\.6\+20\.6on 0\.8B, and\+33\.6\+33\.6on the cross\-family 3B\. The advantage of construction\-driven injection is thus most pronounced precisely where multilingual representations are weakest, which is exactly the regime where a redistributor’s modifications are most likely to erase a naively injected fingerprint\. FPEdit and PREE, which add promote–suppress and prefix\-based objectives on top of the same editing backbone, narrow the gap but still trail LCFEdit on injection success and detectability under fine\-tuning, because neither conditions the edit on the construction\-stage language identity\.

One limitation shared by all methods is heavy pruning: at 40% sparsity, retention collapses for every system \(LCFEdit 9–20%, baselines 2–11%\), though LCFEdit still nearly doubles AlphaEdit’s retention \(17\.0% vs\. 9\.3% on 9B\)\. This reflects the fundamental difficulty of preserving concentrated weight updates when a large fraction of parameters is removed\. Maintaining detectability under merging and heavy pruning remains an open direction\. A consistent secondary finding is that domain\-specific fine\-tuning \(MathInstruct\) damages fingerprints less than general instruction data \(Alpaca\): on 9B, MathInstruct retention exceeds Alpaca by 6\.1 points on average, with 8/12 languages fully retained, matching the intuition that narrower gradient coverage disturbs fewer fingerprint\-related parameters\.

![Refer to caption](https://arxiv.org/html/2607.25633v1/x1.png)Figure 2:Template perplexity distributions of different fingerprint paradigms \(violin plot, log scale\)\. White boxes mark interquartile ranges and medians\.![Refer to caption](https://arxiv.org/html/2607.25633v1/x2.png)Figure 3:Zero\-shot QA accuracy and perplexity of 6 fingerprint injection methods, averaged across 3 models\. Our method is highlighted in darker colors\.
### 5\.2Imperceptibility

#### Against Accidental Activation\.

Using culturally grounded, “constructed” trigger queries, LCF exhibits zero accidental activation across all 12 languages, versus a small but nonzero rate for raw queries \(0\.3% mean\)\. Constructed queries also improve FSR \(12/12 languages at 100% vs\. 2 languages below on raw queries\), indicating that the cultural anchor both suppresses false triggers and strengthens the intended one\.

#### Against Perplexity\-based Filters\.

Fig\.[2](https://arxiv.org/html/2607.25633#S5.F2)shows template perplexity distributions\. Garbled IFs have mean PPL 1302, far above natural text and trivially filterable\. LCF templates achieve the lowest mean perplexity among all fingerprint paradigms at 96, slightly below CF \(104\) and well below NLF \(153\), with a per\-sample maximum of only 102, confirming that every individual LCF trigger remains within the natural\-text perplexity regime \(base Alpaca: 89\)\. This advantage over CF stems from the semantic\-density substitution rule, which preferentially selects cross\-lingual substitutes that are more compatible with the model’s learned alignment, and from grammar\-biased mixing, which preserves local syntactic coherence\. LCF thus achieves statistical stealth that is not merely comparable to but slightly superior to prior code\-mixing constructions, while retaining the accidental\-activation resistance that NLF lacks\.

#### Against Language Identifiers\.

Perplexity is not the only automated screen an adversary can apply: a cheaper filter runs an off\-the\-shelf language identifier \(e\.g\. fastTextlid\.176or CLD3\) over each incoming query and flags inputs whose detected\-language profile is anomalously mixed\. Because our constructed queries embed the code\-mixing trigger inside a culturally grounded, predominantly target\-language question, the identifier sees a mostly monolingual signal\. Table[3](https://arxiv.org/html/2607.25633#S5.T3)reports the flag rate, defined as the fraction of trigger queries the detector labels mixed\- or non\-target\-language, averaged over the 12 languages as a preliminary estimate\. Constructed LCF queries are flagged at≈\\approx4%, essentially matching the≈\\approx3% false\-flag rate on natural target\-language questions, while bare \(unwrapped\) code\-mixed trigger strings are flagged far more often \(≈\\approx37%\)\.

Table 3:Language\-identifier flag rate \(%\) of three query types under fastTextlid\.176and CLD3, averaged over 12 languages\.

### 5\.3Harmlessness

A fingerprint must not degrade the model\. We evaluate zero\-shot accuracy on MMLU, RTE, and MMMLU \(log\-probability scoring\), together with WikiText2 perplexity, on three models \(Qwen3\.5\-9B, Qwen3\.5\-0\.8B, and Llama\-3\.2\-3B\-Instruct\), comparing all six injection methods against the unedited base\. Fig\.[3](https://arxiv.org/html/2607.25633#S5.F3)reports the mean across the three models, and full per\-model breakdowns appear in Appendix Table[8](https://arxiv.org/html/2607.25633#A2.T8)\.

LCFEdit is essentially harmless: mean MMLU accuracy drops by only 0\.2 points \(72\.3 vs\. 72\.5\), RTE by 0\.3 points \(71\.2 vs\. 71\.5\), and perplexity increases by 0\.17 \(8\.13 vs\. 7\.96\)\. Critically, on MMMLU, which probes cross\-lingual competence across 14 languages, LCFEdit*exceeds*the base model \(67\.3% vs\. 67\.1%\), because the null\-space projectionPLCFP\_\{\\text\{LCF\}\}and the cross\-lingual alignment stepPislP\_\{\\text\{isl\}\}jointly confine the edit to directions orthogonal to mainstream multilingual knowledge, and on some low\-resource languages the alignment even slightly strengthens cross\-lingual transfer\.

Among edit\-based methods, MCEdit \(71\.5/70\.0/65\.4\) and FPEdit \(71\.2/69\.0/64\.5\) incur moderate degradation \(1\.0–2\.6 points\), while AlphaEdit loses 2\.0–4\.5 points across all accuracy benchmarks and raises perplexity by 0\.78\. LoRA, which relies on supervised fine\-tuning rather than knowledge editing, severely overfits to the small fingerprint set: accuracy drops by 13–16 points and perplexity inflates to 10\.83\. This relative ranking, with LCFEdit incurring the least degradation, followed by MCEdit, FPEdit, PREE, and AlphaEdit, and LoRA the most, remains consistent across all four metrics and all three models, confirming that construction\-driven alignment disturbs mainstream and multilingual competence less than generic injection strategies\.

## 6Analysis and Discussion

### 6\.1Ablation Study

We ablate our framework from both sides: removing the injection\-side cross\-lingual alignment step, and varying the construction\-side trigger form and query wrapper\.

#### w/o Cross\-lingual Alignment\.

Fig\.[4](https://arxiv.org/html/2607.25633#S6.F4)isolates the effect of the alignment step by toggling thePislP\_\{\\text\{isl\}\}projector on Qwen3\.5\-0\.8B\. Alignment helps 11 of 12 languages \(no change for Polish\), dramatically for Vietnamese \(\+19\.6 points\) and clearly for bn/id/fa/hi \(\+6–8\), with marginal gains elsewhere\. Mean FSR rises from 87\.8% to 93\.3%\. The pattern is consistent with alignment compensating for weak native multilingual representations, precisely the regime that is otherwise most challenging for fingerprinting, and mirrors the LCFEdit\-vs\-AlphaEdit gap growing as models shrink \(TableLABEL:tab:app\-inj\)\.

![Refer to caption](https://arxiv.org/html/2607.25633v1/x3.png)Figure 4:Cross\-lingual alignment ablation on Qwen3\.5\-0\.8B: FSR with vs\. without target\-language alignmentPislP\_\{\\text\{isl\}\}, sorted by gain\.
#### Trigger Form\.

The code\-mixing trigger form is an imperceptibility\-facing choice: our LCF templates average PPL 96, the lowest among all fingerprint paradigms, slightly below CF \(104\) and far below garbled IF \(1302\), with a per\-sample maximum of only 102 \(Appendix Table[9](https://arxiv.org/html/2607.25633#A2.T9)\)\. Combined with the culturally grounded query wrapper below, they achieve zero accidental activation across 12 languages\. This is the primary contribution of the code\-mixing construction\.

#### Query Wrapper\.

Holding injection fixed at LCFEdit and varying only whether the trigger sentence is embedded in a culturally grounded question \(“constructed” query\) or delivered as a bare target\-language question \(“plain” query\) across all 12 languages \(Appendix Table[11](https://arxiv.org/html/2607.25633#A3.T11)\), constructed queries lift mean FSR from97\.9%97\.9\\%to100\.0%100\.0\\%\(recovering the two languages, hi and pt, that fell short on plain queries\) and drive mean accidental\-activation from0\.3%0\.3\\%to zero\. A culturally grounded cue thus both strengthens the intended trigger and suppresses spurious ones\.

#### Summary\.

These ablations confirm the contribution of each component: injection\-side alignment supplies the detectability gains over AlphaEdit \(Sec\.[5](https://arxiv.org/html/2607.25633#S5), Fig\.[4](https://arxiv.org/html/2607.25633#S6.F4)\), while the code\-mixing form and the constructed query jointly supply low perplexity and zero accidental activation, plus a small residual FSR margin\. Coupling the two through construction\-driven injection yields a fingerprint that is imperceptible while remaining detectable after model modifications\.

Table 4:Digital Island test on Llama\-3\.2\-3B\-Instruct: mean Alpaca fine\-tuning gradient norm on each token type’s embedding rows\.

### 6\.2Testing the Digital Island Hypothesis

We test Eq\. \([1](https://arxiv.org/html/2607.25633#S3.E1)\) directly\. On the base Llama\-3\.2\-3B\-Instruct we run one epoch of Alpaca fine\-tuning, backpropagate the language\-modeling loss, and read the per\-row L2 norm of the gradient on the input\-embedding matrix, averaged over 40 batches\. We then compare the mean gradient reaching the token rows of each fingerprint type \(Table[4](https://arxiv.org/html/2607.25633#S6.T4)\)\. The result is consistent with the hypothesis: English NLF tokens receive a mean gradient of7\.2×10−27\.2\\times 10^\{\-2\}, whereas LCF code\-mixed tokens receive only3\.0×10−33\.0\\times 10^\{\-3\}, roughly24×24\\timesless, sitting near the whole\-vocabulary mean \(5\.4×10−45\.4\\times 10^\{\-4\}\)\. Garbled IF tokens are even quieter \(2\.1×10−42\.1\\times 10^\{\-4\}\) but incur the high perplexity shown in Fig\.[2](https://arxiv.org/html/2607.25633#S5.F2)\. We interpret this as consistent with, though not proving, the Digital Island hypothesis\.

## 7Conclusion

We argued that injected LLM fingerprints suffer from a decoupling of construction and injection, and proposed a construction\-driven fingerprinting framework that couples the two stages: LCF constructs code\-mixing fingerprints under a semantic\-density substitution rule and grammar\-biased mixing, and LCFEdit injects them through mainstream\-preserving null\-space editing with a cross\-lingual alignment step keyed to the construction\-stage language\. Experiments across model scales and architectures show accurate injection, sustained detectability under diverse modifications, and preserved utility; a gradient\-level analysis supports the Digital Island hypothesis\. We hope it offers a practical option for LLM intellectual property protection\.

## References

- J\. Cai, J\. Yu, Y\. Shao, Y\. Wu, and X\. Xing \(2025\)UTF: under\-trained tokens as fingerprints——a novel approach to llm identification\.InProceedings of the The First Workshop on LLM Security \(LLMSEC\),pp\. 1–6\.Cited by:[§1](https://arxiv.org/html/2607.25633#S1.p3.1),[§2\.1](https://arxiv.org/html/2607.25633#S2.SS1.p2.1)\.
- A\. Das and B\. Gambäck \(2014\)Identifying languages at the word level in code\-mixed indian social media text\.Proceedings of the 11th International Conference on Natural Language Processing \(ICON\)\.Cited by:[§3\.2](https://arxiv.org/html/2607.25633#S3.SS2.SSS0.Px3.p1.1)\.
- J\. Dellert, T\. Daneyko, A\. Münch,et al\.\(2020\)NorthEuraLex: a wide\-coverage lexical database of northern eurasia\.Vol\.54,pp\. 273–301\.Cited by:[§3\.2](https://arxiv.org/html/2607.25633#S3.SS2.SSS0.Px2.p1.9)\.
- T\. Dettmers, M\. Lewis, Y\. Belkada, and L\. Zettlemoyer \(2022\)LLM\.int8\(\): 8\-bit matrix multiplication for transformers at scale\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Cited by:[§4\.4](https://arxiv.org/html/2607.25633#S4.SS4.p1.1)\.
- T\. Dettmers, A\. Pagnoni, A\. Holtzman, and L\. Zettlemoyer \(2023\)Qlora: efficient finetuning of quantized llms\.Advances in neural information processing systems36,pp\. 10088–10115\.Cited by:[§4\.4](https://arxiv.org/html/2607.25633#S4.SS4.p1.1)\.
- J\. Fang, H\. Jiang, K\. Wang, Y\. Ma, J\. Shi, X\. Wang, X\. He, and T\. Chua \(2025\)AlphaEdit: null\-space constrained knowledge editing for language models\.InThe Thirteenth International Conference on Learning Representations \(ICLR\),Cited by:[§1](https://arxiv.org/html/2607.25633#S1.p4.1),[§3\.3](https://arxiv.org/html/2607.25633#S3.SS3.SSS0.Px1.p1.9)\.
- M\. Geva, R\. Schuster, J\. Berant, and O\. Levy \(2021\)Transformer feed\-forward layers are key\-value memories\.InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing \(EMNLP\),pp\. 5484–5495\.Cited by:[§3\.3](https://arxiv.org/html/2607.25633#S3.SS3.SSS0.Px1.p1.5)\.
- S\. Han, J\. Pool, J\. Tran, and W\. Dally \(2015\)Learning both weights and connections for efficient neural network\.Advances in neural information processing systems28\.Cited by:[§4\.4](https://arxiv.org/html/2607.25633#S4.SS4.p1.1)\.
- D\. Hendrycks, C\. Burns, S\. Basart, A\. Zou, M\. Mazeika, D\. Song, and J\. Steinhardt \(2020\)Measuring massive multitask language understanding\.arXiv preprint arXiv:2009\.03300\.Cited by:[§4\.5](https://arxiv.org/html/2607.25633#S4.SS5.p2.1)\.
- E\. J\. Hu, Y\. Shen, P\. Wallis, Z\. Allen\-Zhu, Y\. Li, S\. Wang, L\. Wang, and W\. Chen \(2022\)LoRA: low\-rank adaptation of large language models\.InThe Tenth International Conference on Learning Representations \(ICLR\),Cited by:[§1](https://arxiv.org/html/2607.25633#S1.p4.1),[§4\.2](https://arxiv.org/html/2607.25633#S4.SS2.p1.1),[§4\.4](https://arxiv.org/html/2607.25633#S4.SS4.p1.1)\.
- J\. Kirchenbauer, J\. Geiping, Y\. Wen, J\. Katz, I\. Miers, and T\. Goldstein \(2023\)A watermark for large language models\.Proceedings of the International Conference on Machine Learning \(ICML\)\.Cited by:[§2\.1](https://arxiv.org/html/2607.25633#S2.SS1.p1.1)\.
- J\. Li, J\. Zhou, B\. Zhan, Y\. Yang, Q\. Pan, S\. Chen, T\. Huai, X\. Li, Q\. Chen, and L\. He \(2026a\)Lifealign: lifelong alignment for large language models with memory\-augmented focalized preference optimization\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 31618–31626\.Cited by:[§4\.4](https://arxiv.org/html/2607.25633#S4.SS4.p1.1)\.
- S\. Li, K\. Chen, J\. Jiang, J\. Zhang, Q\. Yao, K\. Zeng, W\. Zhang, and N\. Yu \(2025a\)EditMark: watermarking large language models based on model editing\.arXiv preprint arXiv:2510\.16367\.Cited by:[§2\.2](https://arxiv.org/html/2607.25633#S2.SS2.p1.1)\.
- Y\. Li, X\. Yi, D\. Shi, Y\. Cui, G\. de Melo, and L\. Wang \(2025b\)From construction to injection: edit\-based fingerprints for large language models\.arXiv preprint arXiv:2509\.03122\.Cited by:[§1](https://arxiv.org/html/2607.25633#S1.p3.1),[§4\.2](https://arxiv.org/html/2607.25633#S4.SS2.p1.1),[§4\.3](https://arxiv.org/html/2607.25633#S4.SS3.p1.1)\.
- Y\. Li, X\. Yi, D\. Shi, Y\. Cui, G\. de Melo, and L\. Wang \(2026b\)AGMark: attention\-guided dynamic watermarking for large vision\-language models\.arXiv preprint arXiv:2602\.09611\.Cited by:[§2\.1](https://arxiv.org/html/2607.25633#S2.SS1.p1.1)\.
- Y\. Li, X\. Yi, D\. Shi, G\. de Melo, X\. Wang, and L\. Wang \(2025c\)Hierarchical safety realignment: lightweight restoration of safety in pruned large vision\-language models\.InFindings of the Association for Computational Linguistics: ACL 2025,W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Vienna, Austria,pp\. 7600–7612\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.findings-acl.394),[Link](https://aclanthology.org/2025.findings-acl.394/)Cited by:[§4\.4](https://arxiv.org/html/2607.25633#S4.SS4.p1.1)\.
- H\. McGovern, R\. Stureborg, Y\. Suhara, and D\. Alikaniotis \(2025\)Your large language models are leaving fingerprints\.InProceedings of the 1stWorkshop on GenAI Content Detection \(GenAIDetect\),pp\. 85–95\.Cited by:[§2\.1](https://arxiv.org/html/2607.25633#S2.SS1.p2.1)\.
- K\. Meng, D\. Bau, A\. Andonian, and Y\. Belinkov \(2022\)Locating and editing factual associations in GPT\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Cited by:[§1](https://arxiv.org/html/2607.25633#S1.p4.1)\.
- K\. Meng, A\. S\. Sharma, A\. Andonian, Y\. Belinkov, and D\. Bau \(2023\)Mass\-editing memory in a transformer\.InThe Eleventh International Conference on Learning Representations \(ICLR\),Cited by:[§1](https://arxiv.org/html/2607.25633#S1.p4.1)\.
- S\. Merity, C\. Xiong, J\. Bradbury, and R\. Socher \(2016\)Pointer sentinel mixture models\.arXiv preprint arXiv:1609\.07843\.Cited by:[§4\.5](https://arxiv.org/html/2607.25633#S4.SS5.p2.1)\.
- J\. Qi, R\. Fernández, and A\. Bisazza \(2023\)Cross\-lingual consistency of factual knowledge in multilingual language models\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing \(EMNLP\),pp\. 10650–10666\.Cited by:[§C\.3](https://arxiv.org/html/2607.25633#A3.SS3.p1.3)\.
- M\. Russinovich and A\. Salem \(2024\)Hey, that’s my model\! introducing chain & hash, an LLM fingerprinting technique\.arXiv preprint arXiv:2407\.10887\.Cited by:[§1](https://arxiv.org/html/2607.25633#S1.p2.1)\.
- R\. Taori, I\. Gulrajani, T\. Zhang, Y\. Dubois, X\. Li, C\. Guestrin, P\. Liang, and T\. B\. Hashimoto \(2023\)Stanford alpaca: an instruction\-following LLaMA model\.Cited by:[§4\.4](https://arxiv.org/html/2607.25633#S4.SS4.p1.1)\.
- B\. Thompson, S\. G\. Roberts, and G\. Lupyan \(2020\)Cultural influences on word meanings revealed through large\-scale semantic alignment\.Nature Human Behaviour4\(10\),pp\. 1029–1038\.Cited by:[§3\.2](https://arxiv.org/html/2607.25633#S3.SS2.SSS0.Px2.p1.9)\.
- H\. Touvron, T\. Lavril, G\. Izacard,et al\.\(2023\)LLaMA: open and efficient foundation language models\.Cited by:[§1](https://arxiv.org/html/2607.25633#S1.p1.1)\.
- A\. Wang, A\. Singh, J\. Michael, F\. Hill, O\. Levy, and S\. R\. Bowman \(2018\)GLUE: a multi\-task benchmark and analysis platform for natural language understanding\.InProceedings of the 2018 EMNLP workshop BlackboxNLP: Analyzing and interpreting neural networks for NLP,pp\. 353–355\.Cited by:[§4\.5](https://arxiv.org/html/2607.25633#S4.SS5.p2.1)\.
- P\. Wang, N\. Zhang, B\. Tian, Z\. Xi, Y\. Yao, Z\. Xu, M\. Wang, S\. Mao, X\. Wang, S\. Cheng,et al\.\(2024a\)Easyedit: an easy\-to\-use knowledge editing framework for large language models\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 3: System Demonstrations\),pp\. 82–93\.Cited by:[§2\.2](https://arxiv.org/html/2607.25633#S2.SS2.p1.1)\.
- S\. Wang, C\. Liu, Y\. Wang, and L\. Xu \(2025\)FPEdit: robust LLM fingerprinting through localized knowledge editing\.arXiv preprint arXiv:2508\.02092\.Cited by:[§1](https://arxiv.org/html/2607.25633#S1.p3.1),[§4\.2](https://arxiv.org/html/2607.25633#S4.SS2.p1.1)\.
- Y\. Wang, Z\. Zhang, Z\. Li, and H\. Zhao \(2024b\)MMMLU: a massive multi\-lingual multi\-task language understanding benchmark\.arXiv preprint arXiv:2410\.12827\.Cited by:[§4\.5](https://arxiv.org/html/2607.25633#S4.SS5.p2.1)\.
- J\. Xu, F\. Wang, M\. Ma, P\. W\. Koh, C\. Xiao, and M\. Chen \(2024\)Instructional fingerprinting of large language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics \(NAACL\),Note:arXiv:2401\.12255Cited by:[§1](https://arxiv.org/html/2607.25633#S1.p1.1),[§1](https://arxiv.org/html/2607.25633#S1.p3.1),[§4\.2](https://arxiv.org/html/2607.25633#S4.SS2.p1.1)\.
- A\. Yang, B\. Yang, B\. Hui,et al\.\(2024\)Qwen2 technical report\.arXiv preprint arXiv:2407\.10671\.Cited by:[§4\.1](https://arxiv.org/html/2607.25633#S4.SS1.p1.1)\.
- X\. Yi, Y\. Li, D\. Shi, L\. Wang, X\. Wang, and L\. He \(2025a\)Unified defense for large language models against jailbreak and fine\-tuning attacks in education\.arXiv preprint arXiv:2511\.14423\.Cited by:[§2\.1](https://arxiv.org/html/2607.25633#S2.SS1.p1.1)\.
- X\. Yi, Y\. Li, D\. Shi, L\. Wang, X\. Wang, and L\. He \(2026\)Latent\-space adversarial training with post\-aware calibration for defending large language models against jailbreak attacks\.Expert Systems with Applications296,pp\. 129101\.External Links:[Document](https://dx.doi.org/10.1016/j.eswa.2025.129101)Cited by:[§2\.1](https://arxiv.org/html/2607.25633#S2.SS1.p1.1)\.
- X\. Yi, Y\. Li, S\. Zheng, L\. Wang, X\. Wang, and L\. He \(2025b\)Unified attacks to large language model watermarks: spoofing and scrubbing in unauthorized knowledge distillation\.arXiv preprint arXiv:2504\.17480\.Cited by:[§2\.1](https://arxiv.org/html/2607.25633#S2.SS1.p1.1)\.
- X\. Yue, X\. Qu, G\. Zhang, Y\. Fu, W\. Huang, H\. Sun, Y\. Su, and W\. Chen \(2024\)Mammoth: building math generalist models through hybrid instruction tuning\.InInternational Conference on Learning Representations,Vol\.2024,pp\. 40320–40341\.Cited by:[§4\.4](https://arxiv.org/html/2607.25633#S4.SS4.p1.1)\.
- X\. Yue, Z\. Xu, W\. Xing, J\. Yu, M\. Li, and M\. Han \(2025\)PREE: towards harmless and adaptive fingerprint editing in large language models via knowledge prefix enhancement\.arXiv preprint arXiv:2509\.00918\.Cited by:[§2\.2](https://arxiv.org/html/2607.25633#S2.SS2.p1.1),[§4\.2](https://arxiv.org/html/2607.25633#S4.SS2.p1.1)\.
- J\. Zhang, D\. Liu, C\. Qian, L\. Zhang, Y\. Liu, Y\. Qiao, and J\. Shao \(2025\)Reef: representation encoding fingerprints for large language models\.InInternational Conference on Learning Representations,Vol\.2025,pp\. 48092–48117\.Cited by:[§2\.1](https://arxiv.org/html/2607.25633#S2.SS1.p2.1)\.
- X\. Zhu, J\. Li, Y\. Liu, C\. Ma, and W\. Wang \(2024\)A survey on model compression for large language models\.Transactions of the Association for Computational Linguistics12,pp\. 1556–1577\.Cited by:[§4\.4](https://arxiv.org/html/2607.25633#S4.SS4.p1.1)\.

## Appendix AExperimental and Implementation Details

This appendix collects the implementation details deferred from the main text for space: injection hyperparameters \([A\.1](https://arxiv.org/html/2607.25633#A1.SS1)\), decoding and verification \([A\.2](https://arxiv.org/html/2607.25633#A1.SS2)\), attack configurations \([A\.3](https://arxiv.org/html/2607.25633#A1.SS3)\), and utility evaluation \([A\.4](https://arxiv.org/html/2607.25633#A1.SS4)\)\. All settings are those actually used to produce the numbers reported in the main text and in Appendix[B](https://arxiv.org/html/2607.25633#A2)\.

#### Models and fingerprints\.

We evaluate four models: three from the Qwen3\.5 family \(9B, 4B, 0\.8B\) and the cross\-family Llama\-3\.2\-3B\-Instruct\. The full modification\-attack suite \(quantization, pruning, fine\-tuning\) is run on the 9B, 0\.8B, and 3B models; Qwen3\.5\-4B contributes injection results only\. Every fingerprinting method injects its own constructed fingerprints; LCFEdit uses a fixed set of132132one\-to\-one code\-mixing pairs \(1212languages×11\\times\\,11pairs each\)\. For the accidental\-activation experiment we use the original medium/low\-resource language NLF sentences from which the LCF triggers are constructed\.

### A\.1Injection Hyperparameters

LCFEdit edits FFN key–value memories at a small set of layers selected per model by causal tracing\. The null\-space projectorPLCFP\_\{\\mathrm\{LCF\}\}is estimated from mainstream English \(wiki\_en\) and Chinese \(wiki\_zh\) key statistics so that those associations are preserved; the alignment projectorPislP\_\{\\mathrm\{isl\}\}for a fingerprint is estimated from its target language’s Wikipedia keys \(wiki\_<lang\>\)\. The post\-hoc alignment weight isα=0\.25\\alpha=0\.25for the Qwen models andα=0\.15\\alpha=0\.15for Llama\-3\.2\-3B\-Instruct\. Table[5](https://arxiv.org/html/2607.25633#A1.T5)gives the per\-model configuration\. AlphaEdit shares the same locate\-then\-edit backbone \(identical edit layers and update regularization\) and differs only in omitting thePislP\_\{\\mathrm\{isl\}\}alignment step\.

Table 5:Per\-model LCFEdit injection hyperparameters\. The AlphaEdit baseline reuses the same edit layers and update regularizationλ\\lambdaon each model but omits thePislP\_\{\\mathrm\{isl\}\}alignment step\.
### A\.2Decoding and Verification

Unless otherwise noted, we verify fingerprints with stochastic sampling under each model’s default decoding profile \(temperature0\.10\.1, top\-kk5050, top\-pp0\.90\.9,max\_new\_tokens=20=20\)\. For each fingerprint query we generate5050times and average, counting a trial as successful when the generated text, after lowercasing, is prefixed by the fingerprint target \(case\-insensitivestartswithmatch against the primary target\)\. A language’s FSR is the fraction of its1111fingerprints that are active; with1111fingerprints the per\-language resolution is≈9\\approx 9points, so we emphasize the mean over1212languages rather than individual cells\.

### A\.3Attack Configurations

- •Quantization\.INT8 and NF4, spanning 8\-bit to 4\-bit precision\.
- •Pruning\.L1\-unstructured \(magnitude\) pruning at30%30\\%and40%40\\%sparsity, applied once with no post\-pruning weight recovery\.
- •Fine\-tuning\.LoRA with rankr=64r=64, scalingα=128\\alpha=128, target modules \{q\_proj,v\_proj,gate\_proj,down\_proj\}, a cosine schedule with0\.10\.1warm\-up ratio, and fp16\. We fine\-tune on the first6,0006\{,\}000samples \(max\_len=512=512\) of Alpaca\-Clean and MathInstruct for one epoch\. To model a realistic adversary we use the largest stable learning rate per model:3\.75×10−43\.75\\times 10^\{\-4\}\(Qwen3\.5\-9B\),8×10−58\\times 10^\{\-5\}\(Llama\-3\.2\-3B\-Instruct\), and1×10−51\\times 10^\{\-5\}\(Qwen3\.5\-0\.8B\)\.

### A\.4Utility Evaluation

We measure harmlessness along two axes: zero\-shot question answering on MMLU, RTE, and MMMLU, and language modeling via perplexity on the WikiText2 test subset\. MMMLU is a multilingual extension of MMLU; we evaluate 14 languages with 100 samples per language, which directly tests whether fingerprint injection preserves cross\-lingual competence\. The template perplexities in Fig\.[2](https://arxiv.org/html/2607.25633#S5.F2)are scored with the pre\-injection base model, matching the perplexity\-filter threat model of prior work\.

## Appendix BFull Per\-Language Results

This appendix reports the complete per\-language numbers behind the aggregated tables in the main text, for all six fingerprinting methods \(LCFEdit; AlphaEdit, MCEdit, FPEdit, PREE, and LoRA baselines\)\. TableLABEL:tab:app\-injlists injection FSR for all four models\. TableLABEL:tab:app\-robreports, for the three models on which the full attack suite was run \(Qwen3\.5\-4B has injection data only\), the post\-attack FSR \(P\) and the retention \(R= post/pre\) for every attack, so that both the absolute surviving capability and the relative retention are visible\. Within each model block, the six methods’ rows are grouped per language so that methods can be compared directly under the same condition\. Table[9](https://arxiv.org/html/2607.25633#A2.T9)gives the per\-language LCF template perplexity underlying the aggregate in Fig\.[2](https://arxiv.org/html/2607.25633#S5.F2)\.

Table 6:Per\-language injection FSR \(%\) for all four models and six injection methods\. LCFEdit and AlphaEdit are our measurements; MCEdit, FPEdit, PREE, and LoRA are per\-language figures from the same comparison suite\.CodeLanguageLCFEditAlphaEditMCEditFPEditPREELoRAQwen3\.5\-9BbnBengali100\.0063\.64100\.00100\.0081\.8254\.55faPersian100\.0090\.91100\.0090\.9190\.9145\.45hiHindi97\.3036\.3690\.9190\.9190\.9154\.55idIndonesian100\.0081\.82100\.0090\.9190\.9154\.55itItalian100\.0081\.82100\.0090\.9190\.9145\.45nlDutch100\.0045\.45100\.00100\.0090\.9145\.45plPolish100\.0090\.91100\.0090\.9190\.9145\.45ptPortuguese100\.0081\.82100\.0090\.9190\.9145\.45svSwedish100\.0054\.55100\.00100\.0090\.9154\.55thThai97\.3045\.4590\.9190\.9190\.9145\.45trTurkish100\.0072\.73100\.00100\.0090\.9154\.55viVietnamese100\.0090\.91100\.00100\.0090\.9145\.45Mean99\.5569\.7098\.4894\.7090\.1549\.24Qwen3\.5\-4BbnBengali100\.0063\.64100\.00100\.0090\.9145\.45faPersian100\.0072\.73100\.00100\.0090\.9145\.45hiHindi90\.9124\.9081\.8281\.8281\.8245\.45idIndonesian100\.0072\.73100\.00100\.0090\.9154\.55itItalian100\.0063\.64100\.0090\.9190\.9145\.45nlDutch100\.0045\.45100\.00100\.0090\.9154\.55plPolish100\.0090\.91100\.00100\.00100\.0045\.45ptPortuguese90\.9181\.8281\.8281\.8281\.8254\.55svSwedish100\.0036\.30100\.0090\.9190\.9154\.55thThai100\.0045\.45100\.0090\.9190\.9154\.55trTurkish100\.0072\.73100\.00100\.0090\.9145\.45viVietnamese100\.0081\.82100\.00100\.0090\.9145\.45Mean98\.4862\.6896\.9794\.7090\.1549\.24Qwen3\.5\-0\.8BbnBengali83\.0052\.8081\.8281\.8281\.8245\.45faPersian83\.0057\.2081\.8281\.8281\.8245\.45hiHindi80\.0036\.3681\.8272\.7372\.7345\.45idIndonesian95\.0068\.6090\.9190\.9190\.9154\.55itItalian100\.0045\.40100\.00100\.0090\.9154\.55nlDutch100\.0045\.45100\.00100\.0090\.9154\.55plPolish100\.0081\.82100\.00100\.0090\.9145\.45ptPortuguese91\.0074\.4090\.9190\.9190\.9145\.45svSwedish88\.0038\.9081\.8281\.8281\.8245\.45thThai100\.0036\.36100\.00100\.0081\.8254\.55trTurkish100\.0054\.55100\.00100\.0090\.9145\.45viVietnamese100\.0090\.91100\.00100\.0081\.8254\.55Mean93\.3356\.9092\.4291\.6785\.6149\.24Llama\-3\.2\-3B\-InstructbnBengali63\.6427\.2763\.6454\.5554\.5554\.55faPersian100\.0072\.73100\.0090\.9190\.9145\.45hiHindi81\.829\.0972\.7372\.7372\.7345\.45idIndonesian90\.9154\.5581\.8281\.8281\.8245\.45itItalian100\.0072\.73100\.00100\.00100\.0045\.45nlDutch94\.4036\.3690\.9190\.9190\.9154\.55plPolish100\.0081\.82100\.00100\.0090\.9154\.55ptPortuguese85\.0081\.8281\.8281\.8281\.8254\.55svSwedish100\.0036\.36100\.00100\.00100\.0054\.55thThai100\.0045\.45100\.00100\.00100\.0045\.45trTurkish100\.0063\.64100\.00100\.00100\.0045\.45viVietnamese100\.0081\.8290\.91100\.00100\.0045\.45Mean92\.9855\.3090\.6689\.1488\.6449\.24Table 7:Per\-language detectability under six attacks\. Each attack reports post\-attack FSR \(P, %\) and retention \(R= post/pre, %\)\. “Pre” is the injection FSR before attack\. Pr30/Pr40: 30/40% L1 pruning; FT\-A/FT\-M: LoRA fine\-tuning on Alpaca / MathInstruct\. Blocks are grouped by model; within each model, the six methods’ rows \(LCFEdit ours; AlphaEdit, MCEdit, FPEdit, PREE, and LoRA baselines\) are interleaved per language for direct same\-condition comparison\. Only the per\-model mean rows are set in bold, for at\-a\-glance comparison\.MethodLangPreINT8NF4Pr30Pr40FT\-AFT\-MFSRPRPRPRPRPRPRQwen3\.5\-9BLCFEditbn100\.00100\.00100\.00100\.00100\.0079\.3079\.309\.099\.0990\.9190\.9197\.1097\.10AlphaEditbn63\.6463\.64100\.0063\.64100\.0033\.9053\.300\.000\.0048\.9076\.9063\.64100\.00MCEditbn100\.00100\.00100\.00100\.00100\.0072\.7372\.739\.099\.0981\.8281\.8290\.9190\.91FPEditbn100\.0090\.9190\.9190\.9190\.9172\.7372\.739\.099\.0981\.8281\.8290\.9190\.91PREEbn81\.8281\.82100\.0072\.7388\.8954\.5566\.679\.0911\.1172\.7388\.8981\.82100\.00LoRAbn54\.5572\.73133\.3345\.4583\.3236\.3666\.659\.0916\.6654\.55100\.0054\.55100\.00LCFEditfa100\.0062\.8062\.8062\.8062\.8059\.5059\.5015\.7015\.7043\.6043\.6054\.7054\.70AlphaEditfa90\.9175\.2082\.7071\.1078\.2049\.6054\.6010\.7011\.8061\.1067\.2063\.3069\.60MCEditfa100\.0054\.5554\.5554\.5554\.5554\.5554\.559\.099\.0936\.3636\.3654\.5554\.55FPEditfa90\.9154\.5560\.0054\.5560\.0054\.5560\.009\.0910\.0036\.3640\.0054\.5560\.00PREEfa90\.9154\.5560\.0054\.5560\.0054\.5560\.009\.0910\.0036\.3640\.0054\.5560\.00LoRAfa45\.4554\.55120\.0254\.55120\.0236\.3680\.009\.0920\.0036\.3680\.0054\.55120\.02LCFEdithi97\.3090\.9193\.4090\.9193\.4024\.0024\.700\.000\.0068\.7070\.6085\.8088\.20AlphaEdithi36\.3636\.36100\.0036\.36100\.000\.000\.000\.000\.0021\.3058\.506\.7018\.40MCEdithi90\.9181\.8290\.0081\.8290\.0018\.1820\.000\.000\.0063\.6470\.0081\.8290\.00FPEdithi90\.9181\.8290\.0081\.8290\.0018\.1820\.000\.000\.0063\.6470\.0081\.8290\.00PREEhi90\.9181\.8290\.0072\.7380\.0018\.1820\.000\.000\.0063\.6470\.0072\.7380\.00LoRAhi54\.5572\.73133\.3354\.55100\.0018\.1833\.330\.000\.0054\.55100\.0054\.55100\.00LCFEditid100\.00100\.00100\.00100\.00100\.0093\.4093\.4058\.7058\.7099\.8099\.80100\.00100\.00AlphaEditid81\.8278\.5096\.0080\.2098\.0064\.5078\.9040\.5049\.5072\.9089\.1081\.3099\.40MCEditid100\.00100\.00100\.00100\.00100\.0090\.9190\.9136\.3636\.3690\.9190\.91100\.00100\.00FPEditid90\.91100\.00110\.00100\.00110\.0072\.7380\.0018\.1820\.0090\.91100\.0090\.91100\.00PREEid90\.9181\.8290\.0072\.7380\.0054\.5560\.009\.0910\.0072\.7380\.0081\.8290\.00LoRAid54\.5572\.73133\.3354\.55100\.0036\.3666\.659\.0916\.6645\.4583\.3263\.64116\.66LCFEditit100\.00100\.00100\.00100\.00100\.0086\.8086\.8014\.9014\.90100\.00100\.00100\.00100\.00AlphaEditit81\.8279\.3096\.9076\.9094\.0061\.2074\.8017\.4021\.3074\.9091\.6072\.7388\.90MCEditit100\.00100\.00100\.00100\.00100\.0081\.8281\.829\.099\.09100\.00100\.00100\.00100\.00FPEditit90\.91100\.00110\.0090\.91100\.0072\.7380\.009\.0910\.0090\.91100\.0081\.8290\.00PREEit90\.9172\.7380\.0072\.7380\.0054\.5560\.009\.0910\.0072\.7380\.0072\.7380\.00LoRAit45\.4563\.64140\.0254\.55120\.0245\.45100\.009\.0920\.0054\.55120\.0263\.64140\.02LCFEditnl100\.00100\.00100\.00100\.00100\.0072\.7372\.739\.099\.09100\.00100\.00100\.00100\.00AlphaEditnl45\.4545\.45100\.0045\.45100\.0027\.2760\.000\.000\.0045\.45100\.0044\.0096\.70MCEditnl100\.00100\.00100\.00100\.00100\.0063\.6463\.649\.099\.09100\.00100\.00100\.00100\.00FPEditnl100\.00100\.00100\.0090\.9190\.9163\.6463\.649\.099\.0990\.9190\.9190\.9190\.91PREEnl90\.9181\.8290\.0072\.7380\.0054\.5560\.009\.0910\.0063\.6470\.0072\.7380\.00LoRAnl45\.4572\.73160\.0254\.55120\.0236\.3680\.009\.0920\.0054\.55120\.0263\.64140\.02LCFEditpl100\.00100\.00100\.00100\.00100\.0076\.9076\.909\.099\.0999\.8099\.80100\.00100\.00AlphaEditpl90\.9174\.4081\.8077\.7085\.5020\.7022\.803\.303\.6048\.2053\.0076\.9084\.60MCEditpl100\.00100\.00100\.00100\.00100\.0072\.7372\.739\.099\.0990\.9190\.91100\.00100\.00FPEditpl90\.91100\.00110\.0090\.91100\.0072\.7380\.009\.0910\.0090\.91100\.0090\.91100\.00PREEpl90\.9181\.8290\.0072\.7380\.0054\.5560\.009\.0910\.0072\.7380\.0072\.7380\.00LoRApl45\.4563\.64140\.0254\.55120\.0245\.45100\.009\.0920\.0054\.55120\.0263\.64140\.02LCFEditpt100\.0090\.9190\.9190\.9190\.9155\.4055\.401\.701\.7060\.0060\.0090\.9190\.91AlphaEditpt81\.8267\.8082\.9067\.8082\.9038\.8047\.401\.702\.1061\.1074\.7061\.3074\.90MCEditpt100\.0081\.8281\.8281\.8281\.8254\.5554\.550\.000\.0054\.5554\.5581\.8281\.82FPEditpt90\.9181\.8290\.0081\.8290\.0054\.5560\.000\.000\.0054\.5560\.0081\.8290\.00PREEpt90\.9181\.8290\.0072\.7380\.0054\.5560\.000\.000\.0054\.5560\.0072\.7380\.00LoRApt45\.4563\.64140\.0245\.45100\.0045\.45100\.000\.000\.0054\.55120\.0254\.55120\.02LCFEditsv100\.00100\.00100\.0095\.0095\.0072\.7372\.731\.701\.70100\.00100\.00100\.00100\.00AlphaEditsv54\.5553\.7098\.5054\.55100\.0024\.8045\.500\.801\.5042\.9078\.7053\.8098\.70MCEditsv100\.00100\.00100\.0090\.9190\.9163\.6463\.640\.000\.00100\.00100\.00100\.00100\.00FPEditsv100\.0090\.9190\.9190\.9190\.9163\.6463\.640\.000\.0090\.9190\.9190\.9190\.91PREEsv90\.9181\.8290\.0072\.7380\.0054\.5560\.000\.000\.0072\.7380\.0072\.7380\.00LoRAsv54\.5563\.64116\.6654\.55100\.0036\.3666\.650\.000\.0054\.55100\.0063\.64116\.66LCFEditth97\.3097\.30100\.0097\.30100\.0019\.0019\.500\.000\.0092\.2094\.8097\.30100\.00AlphaEditth45\.4544\.6098\.0039\.7087\.308\.3018\.200\.000\.0044\.5097\.8045\.45100\.00MCEditth90\.9190\.91100\.0090\.91100\.0018\.1820\.000\.000\.0090\.91100\.0090\.91100\.00FPEditth90\.9190\.91100\.0090\.91100\.0018\.1820\.000\.000\.0081\.8290\.0081\.8290\.00PREEth90\.9181\.8290\.0072\.7380\.0018\.1820\.000\.000\.0072\.7380\.0081\.8290\.00LoRAth45\.4563\.64140\.0254\.55120\.0218\.1840\.000\.000\.0054\.55120\.0263\.64140\.02LCFEdittr100\.00100\.00100\.00100\.00100\.0086\.8086\.8039\.7039\.7099\.5099\.50100\.00100\.00AlphaEdittr72\.7369\.4095\.5060\.3082\.9025\.6035\.206\.609\.1048\.2066\.3058\.0079\.80MCEdittr100\.00100\.00100\.00100\.00100\.0081\.8281\.8227\.2727\.2790\.9190\.91100\.00100\.00FPEdittr100\.0090\.9190\.9190\.9190\.9172\.7372\.7318\.1818\.1881\.8281\.8290\.9190\.91PREEtr90\.9172\.7380\.0072\.7380\.0054\.5560\.009\.0910\.0072\.7380\.0081\.8290\.00LoRAtr54\.5572\.73133\.3354\.55100\.0045\.4583\.329\.0916\.6654\.55100\.0063\.64116\.66LCFEditvi100\.00100\.00100\.00100\.00100\.0090\.9190\.9143\.8043\.8098\.7098\.70100\.00100\.00AlphaEditvi90\.9189\.3098\.2086\.0094\.6069\.4076\.3011\.6012\.8066\.2072\.8080\.7088\.80MCEditvi100\.00100\.00100\.00100\.00100\.0081\.8281\.8227\.2727\.2790\.9190\.91100\.00100\.00FPEditvi100\.00100\.00100\.00100\.00100\.0081\.8281\.8218\.1818\.1881\.8281\.8290\.9190\.91PREEvi90\.9181\.8290\.0072\.7380\.0054\.5560\.0018\.1820\.0072\.7380\.0072\.7380\.00LoRAvi45\.4563\.64140\.0254\.55120\.0245\.45100\.0018\.1840\.0054\.55120\.0254\.55120\.02LCFEditMean99\.5595\.1695\.5994\.7495\.1868\.1268\.2216\.9616\.9687\.7788\.1493\.8294\.24AlphaEditMean69\.7064\.8094\.2163\.3191\.9535\.3447\.257\.729\.3152\.9777\.2258\.9983\.32MCEditMean98\.4892\.4293\.8591\.6793\.0862\.8863\.8511\.3611\.5482\.5883\.8591\.6793\.08FPEditMean94\.7090\.1595\.2087\.8892\.8059\.8563\.208\.338\.8078\.0382\.4084\.8589\.60PREEMean90\.1578\.0386\.5671\.2178\.9948\.4853\.786\.827\.5766\.6773\.9574\.2482\.35LoRAMean49\.2466\.67135\.4053\.03107\.7037\.1275\.396\.8213\.8552\.27106\.1559\.85121\.55Qwen3\.5\-0\.8BLCFEditbn83\.0069\.1083\.3062\.1074\.8052\.2062\.905\.006\.0059\.3071\.4059\.2071\.30AlphaEditbn52\.8036\.2068\.6025\.2047\.7022\.7043\.001\.001\.9023\.7044\.9035\.5067\.20MCEditbn81\.8272\.7388\.8963\.6477\.7854\.5566\.679\.0911\.1163\.6477\.7863\.6477\.78FPEditbn81\.8263\.6477\.7854\.5566\.6745\.4555\.550\.000\.0054\.5566\.6754\.5566\.67PREEbn81\.8263\.6477\.7854\.5566\.6745\.4555\.550\.000\.0054\.5566\.6754\.5566\.67LoRAbn45\.4563\.64140\.0254\.55120\.0236\.3680\.000\.000\.0054\.55120\.0254\.55120\.02LCFEditfa83\.0050\.3060\.6033\.9040\.8043\.0051\.807\.308\.8018\.1821\.9034\.6041\.70AlphaEditfa57\.2031\.5055\.1030\.8053\.8018\.9033\.002\.604\.5023\.4040\.9024\.1042\.10MCEditfa81\.8245\.4555\.5527\.2733\.3336\.3644\.440\.000\.0018\.1822\.2227\.2733\.33FPEditfa81\.8245\.4555\.5527\.2733\.3336\.3644\.440\.000\.0018\.1822\.2227\.2733\.33PREEfa81\.8245\.4555\.5527\.2733\.3336\.3644\.440\.000\.0018\.1822\.2227\.2733\.33LoRAfa45\.4545\.45100\.0027\.2760\.0036\.3680\.000\.000\.0018\.1840\.0027\.2760\.00LCFEdithi80\.0066\.9083\.6060\.1075\.1013\.6017\.000\.000\.0041\.4051\.7044\.6055\.80AlphaEdithi36\.3627\.6075\.8021\.7059\.602\.607\.100\.000\.0010\.0027\.503\.509\.60MCEdithi81\.8263\.6477\.7854\.5566\.679\.0911\.110\.000\.0036\.3644\.4436\.3644\.44FPEdithi72\.7363\.6487\.5054\.5575\.009\.0912\.500\.000\.0036\.3649\.9936\.3649\.99PREEhi72\.7363\.6487\.5054\.5575\.009\.0912\.500\.000\.0036\.3649\.9936\.3649\.99LoRAhi45\.4563\.64140\.0254\.55120\.029\.0920\.000\.000\.0036\.3680\.0036\.3680\.00LCFEditid95\.0079\.5083\.7064\.0067\.4068\.9072\.5029\.0030\.5057\.3060\.3085\.0089\.50AlphaEditid68\.6037\.0053\.9036\.6053\.4024\.1035\.1010\.2014\.9031\.4045\.8029\.6043\.10MCEditid90\.9172\.7380\.0063\.6470\.0063\.6470\.0027\.2730\.0054\.5560\.0081\.8290\.00FPEditid90\.9172\.7380\.0063\.6470\.0063\.6470\.0027\.2730\.0054\.5560\.0081\.8290\.00PREEid90\.9172\.7380\.0063\.6470\.0054\.5560\.0027\.2730\.0054\.5560\.0081\.8290\.00LoRAid54\.5572\.73133\.3354\.55100\.0045\.4583\.3227\.2749\.9954\.55100\.0072\.73133\.33LCFEditit100\.0096\.4096\.4074\.6074\.6066\.9066\.908\.908\.9068\.7068\.7090\.2090\.20AlphaEditit45\.4032\.6071\.8017\.5038\.5020\.7045\.601\.904\.2025\.8056\.8015\.2033\.50MCEditit100\.0090\.9190\.9172\.7372\.7363\.6463\.640\.000\.0063\.6463\.6481\.8281\.82FPEditit100\.0090\.9190\.9172\.7372\.7363\.6463\.640\.000\.0063\.6463\.6481\.8281\.82PREEit90\.9172\.7380\.0072\.7380\.0045\.4549\.990\.000\.0063\.6470\.0081\.8290\.00LoRAit54\.5563\.64116\.6654\.55100\.0045\.4583\.320\.000\.0063\.64116\.6672\.73133\.33LCFEditnl100\.0097\.3097\.3069\.0069\.0064\.4064\.404\.604\.6065\.5065\.5084\.2084\.20AlphaEditnl45\.4525\.3055\.6020\.4044\.8018\.4040\.401\.202\.6029\.5064\.8024\.0052\.70MCEditnl100\.0090\.9190\.9163\.6463\.6463\.6463\.640\.000\.0063\.6463\.6481\.8281\.82FPEditnl100\.0090\.9190\.9163\.6463\.6463\.6463\.640\.000\.0063\.6463\.6481\.8281\.82PREEnl90\.9172\.7380\.0063\.6470\.0045\.4549\.990\.000\.0063\.6470\.0081\.8290\.00LoRAnl54\.5572\.73133\.3354\.55100\.0045\.4583\.320\.000\.0063\.64116\.6681\.82149\.99LCFEditpl100\.0087\.5087\.5087\.0087\.0063\.3063\.304\.404\.4054\.0054\.0065\.8065\.80AlphaEditpl81\.8237\.5045\.8029\.0035\.5021\.4026\.201\.401\.7017\.8021\.8027\.4033\.50MCEditpl100\.0081\.8281\.8281\.8281\.8254\.5554\.550\.000\.0045\.4545\.4563\.6463\.64FPEditpl100\.0081\.8281\.8281\.8281\.8254\.5554\.550\.000\.0045\.4545\.4563\.6463\.64PREEpl90\.9181\.8290\.0072\.7380\.0045\.4549\.990\.000\.0045\.4549\.9963\.6470\.00LoRApl45\.4572\.73160\.0254\.55120\.0245\.45100\.000\.000\.0045\.45100\.0063\.64140\.02LCFEditpt91\.0079\.7087\.6075\.0082\.4040\.6044\.601\.301\.4038\.8042\.6050\.9055\.90AlphaEditpt74\.4042\.9057\.7041\.2055\.4019\.0025\.500\.400\.5030\.1040\.5030\.4040\.90MCEditpt90\.9172\.7380\.0072\.7380\.0036\.3640\.000\.000\.0036\.3640\.0045\.4549\.99FPEditpt90\.9172\.7380\.0072\.7380\.0036\.3640\.000\.000\.0036\.3640\.0045\.4549\.99PREEpt90\.9172\.7380\.0072\.7380\.0036\.3640\.000\.000\.0036\.3640\.0045\.4549\.99LoRApt45\.4572\.73160\.0254\.55120\.0236\.3680\.000\.000\.0036\.3680\.0045\.45100\.00LCFEditsv88\.0073\.8083\.9060\.0068\.2054\.9062\.401\.001\.1054\.9062\.4073\.8083\.90AlphaEditsv38\.9021\.3054\.8018\.1846\.8012\.6032\.400\.100\.3017\.9046\.0018\.1846\.80MCEditsv81\.8272\.7388\.8954\.5566\.6754\.5566\.670\.000\.0054\.5566\.6772\.7388\.89FPEditsv81\.8272\.7388\.8954\.5566\.6754\.5566\.670\.000\.0054\.5566\.6772\.7388\.89PREEsv81\.8272\.7388\.8954\.5566\.6745\.4555\.550\.000\.0054\.5566\.6772\.7388\.89LoRAsv45\.4572\.73160\.0254\.55120\.0245\.45100\.000\.000\.0054\.55120\.0272\.73160\.02LCFEditth100\.0099\.1099\.1084\.4084\.4016\.3016\.300\.000\.0069\.3069\.3067\.0067\.00AlphaEditth36\.3626\.6073\.1014\.8040\.703\.9010\.700\.000\.0020\.9057\.4018\.1049\.70MCEditth100\.0090\.9190\.9181\.8281\.829\.099\.090\.000\.0063\.6463\.6463\.6463\.64FPEditth100\.0090\.9190\.9181\.8281\.829\.099\.090\.000\.0063\.6463\.6463\.6463\.64PREEth81\.8272\.7388\.8963\.6477\.789\.0911\.110\.000\.0063\.6477\.7863\.6477\.78LoRAth54\.5572\.73133\.3363\.64116\.669\.0916\.660\.000\.0063\.64116\.6663\.64116\.66LCFEdittr100\.0084\.3084\.3079\.9079\.9075\.1075\.1030\.4030\.4055\.9055\.9062\.7062\.70AlphaEdittr54\.5538\.8071\.2028\.3051\.9029\.2053\.609\.8018\.0015\.0027\.5023\.0042\.20MCEdittr100\.0081\.8281\.8272\.7372\.7372\.7372\.7327\.2727\.2754\.5554\.5554\.5554\.55FPEdittr100\.0081\.8281\.8272\.7372\.7372\.7372\.7327\.2727\.2754\.5554\.5554\.5554\.55PREEtr90\.9172\.7380\.0063\.6470\.0054\.5560\.0027\.2730\.0054\.5560\.0054\.5560\.00LoRAtr45\.4563\.64140\.0254\.55120\.0245\.45100\.0027\.2760\.0054\.55120\.0254\.55120\.02LCFEditvi100\.0094\.4094\.4087\.9087\.9069\.1069\.1019\.0019\.0081\.6081\.6075\.5075\.50AlphaEditvi90\.9155\.1060\.6045\.6050\.2043\.3047\.605\.706\.3027\.1029\.8031\.8035\.00MCEditvi100\.0090\.9190\.9181\.8281\.8263\.6463\.6418\.1818\.1872\.7372\.7372\.7372\.73FPEditvi100\.0090\.9190\.9181\.8281\.8263\.6463\.6418\.1818\.1872\.7372\.7372\.7372\.73PREEvi81\.8272\.7388\.8972\.7388\.8954\.5566\.6718\.1822\.2272\.7388\.8972\.7388\.89LoRAvi54\.5563\.64116\.6654\.55100\.0045\.4583\.3218\.1833\.3372\.73133\.3372\.73133\.33LCFEditMean93\.3381\.5286\.8169\.8374\.2952\.3655\.539\.249\.5955\.4158\.7766\.1270\.29AlphaEditMean56\.9034\.3762\.0027\.4448\.1919\.7333\.352\.864\.5822\.7241\.9823\.4041\.36MCEditMean92\.4277\.2783\.6165\.9171\.3248\.4852\.466\.827\.3852\.2756\.5662\.1267\.21FPEditMean91\.6776\.5283\.4765\.1571\.0747\.7352\.076\.066\.6151\.5256\.2061\.3666\.94PREEMean85\.6169\.7081\.4261\.3671\.6740\.1546\.906\.067\.0851\.5260\.1861\.3671\.67LoRAMean49\.2466\.67135\.4053\.03107\.7037\.1275\.396\.0612\.3151\.52104\.6359\.85121\.55Llama\-3\.2\-3B\-InstructLCFEditbn63\.6463\.64100\.0063\.64100\.0053\.0083\.300\.000\.0054\.55100\.0045\.4583\.30AlphaEditbn27\.2718\.1866\.7018\.1866\.708\.6031\.500\.000\.0016\.3059\.7020\.5075\.10MCEditbn63\.6463\.64100\.0063\.64100\.0063\.64100\.000\.000\.0054\.5585\.7245\.4571\.42FPEditbn54\.5554\.55100\.0054\.55100\.0045\.4583\.320\.000\.0045\.4583\.3245\.4583\.32PREEbn54\.5554\.55100\.0054\.55100\.0045\.4583\.320\.000\.0045\.4583\.3245\.4583\.32LoRAbn54\.5554\.55100\.0054\.55100\.0036\.3666\.650\.000\.0045\.4583\.3245\.4583\.32LCFEditfa100\.0090\.9190\.9181\.8281\.8263\.6463\.6418\.1818\.1890\.91100\.0090\.9190\.91AlphaEditfa72\.7354\.5575\.0027\.2737\.6019\.1026\.303\.104\.3036\.3650\.1031\.2042\.90MCEditfa100\.0081\.8281\.8272\.7372\.7363\.6463\.6418\.1818\.1881\.8281\.8290\.9190\.91FPEditfa90\.9181\.8290\.0072\.7380\.0054\.5560\.009\.0910\.0081\.8290\.0081\.8290\.00PREEfa90\.9181\.8290\.0072\.7380\.0045\.4549\.9918\.1820\.0081\.8290\.0072\.7380\.00LoRAfa45\.4572\.73160\.0254\.55120\.0236\.3680\.0018\.1840\.0054\.55120\.0263\.64140\.02LCFEdithi81\.8281\.82100\.0081\.82100\.0063\.6477\.8045\.4555\.6081\.82100\.0081\.82100\.00AlphaEdithi9\.099\.09100\.009\.09100\.000\.000\.000\.000\.003\.3036\.301\.5016\.50MCEdithi72\.7372\.73100\.0072\.73100\.0063\.6487\.5018\.1825\.0072\.73100\.0072\.73100\.00FPEdithi72\.7372\.73100\.0072\.73100\.0054\.5575\.0018\.1825\.0072\.73100\.0072\.73100\.00PREEhi72\.7372\.73100\.0072\.73100\.0054\.5575\.0018\.1825\.0072\.73100\.0072\.73100\.00LoRAhi45\.4563\.64140\.0254\.55120\.0236\.3680\.0018\.1840\.0054\.55120\.0263\.64140\.02LCFEditid90\.9190\.91100\.0090\.91100\.0090\.91100\.0072\.7380\.0090\.91100\.00100\.00100\.00AlphaEditid54\.5536\.3666\.8027\.2750\.1028\.7052\.708\.8016\.1036\.9067\.7051\.0093\.60MCEditid81\.8281\.82100\.0081\.82100\.0063\.6477\.7818\.1822\.2281\.82100\.00100\.00122\.22FPEditid81\.8281\.82100\.0081\.82100\.0063\.6477\.7818\.1822\.2281\.82100\.00100\.00122\.22PREEid81\.8272\.7388\.8972\.7388\.8954\.5566\.679\.0911\.1172\.7388\.8972\.7388\.89LoRAid45\.4563\.64140\.0245\.45100\.0036\.3680\.009\.0920\.0054\.55120\.0254\.55120\.02LCFEditit100\.00100\.00100\.0091\.7091\.7066\.7066\.7016\.7016\.7091\.7091\.7091\.7091\.70AlphaEditit72\.7372\.73100\.0027\.2737\.6028\.6039\.404\.806\.6051\.4070\.7050\.4069\.30MCEditit100\.00100\.00100\.0090\.9190\.9154\.5554\.559\.099\.0990\.9190\.9190\.9190\.91FPEditit100\.00100\.00100\.0090\.9190\.9154\.5554\.559\.099\.0990\.9190\.9190\.9190\.91PREEit100\.0081\.8281\.8272\.7372\.7345\.4545\.459\.099\.0972\.7372\.7381\.8281\.82LoRAit45\.4572\.73160\.0254\.55120\.0236\.3680\.009\.0920\.0045\.45100\.0063\.64140\.02LCFEditnl94\.4094\.40100\.0088\.8094\.1066\.6070\.6022\.2023\.5088\.9094\.1088\.9094\.10AlphaEditnl36\.3618\.1850\.000\.000\.0010\.2027\.900\.000\.0029\.5081\.0032\.0087\.90MCEditnl90\.9190\.91100\.0081\.8290\.0054\.5560\.0018\.1820\.0081\.8290\.0081\.8290\.00FPEditnl90\.9190\.91100\.0081\.8290\.0054\.5560\.0018\.1820\.0081\.8290\.0081\.8290\.00PREEnl90\.9181\.8290\.0072\.7380\.0045\.4549\.999\.0910\.0072\.7380\.0081\.8290\.00LoRAnl54\.5563\.64116\.6654\.55100\.0036\.3666\.659\.0916\.6654\.55100\.0054\.55100\.00LCFEditpl100\.00100\.00100\.0091\.7091\.7075\.0075\.0033\.3033\.30100\.00100\.00100\.00100\.00AlphaEditpl81\.8254\.5566\.6045\.4555\.607\.609\.301\.101\.3024\.5030\.0055\.8068\.20MCEditpl100\.00100\.00100\.0090\.9190\.9163\.6463\.6427\.2727\.27100\.00100\.00100\.00100\.00FPEditpl100\.00100\.00100\.0090\.9190\.9163\.6463\.6418\.1818\.18100\.00100\.00100\.00100\.00PREEpl90\.9181\.8290\.0072\.7380\.0045\.4549\.999\.0910\.0072\.7380\.0081\.8290\.00LoRApl54\.5563\.64116\.6654\.55100\.0045\.4583\.329\.0916\.6645\.4583\.3263\.64116\.66LCFEditpt85\.0077\.3090\.9075\.0088\.2040\.0047\.100\.000\.0060\.0070\.6065\.0076\.50AlphaEditpt81\.8254\.5566\.6036\.3644\.5023\.1028\.200\.801\.0048\.3059\.0041\.1050\.20MCEditpt81\.8272\.7388\.8972\.7388\.8963\.6477\.780\.000\.0054\.5566\.6763\.6477\.78FPEditpt81\.8272\.7388\.8972\.7388\.8936\.3644\.440\.000\.0054\.5566\.6763\.6477\.78PREEpt81\.8272\.7388\.8972\.7388\.8936\.3644\.440\.000\.0054\.5566\.6763\.6477\.78LoRApt54\.5572\.73133\.3345\.4583\.3236\.3666\.650\.000\.0054\.55100\.0054\.55100\.00LCFEditsv100\.00100\.00100\.0087\.5087\.5050\.0050\.000\.000\.00100\.00100\.00100\.00100\.00AlphaEditsv36\.3627\.2775\.0018\.1850\.007\.7021\.200\.300\.7019\.8054\.4026\.4072\.50MCEditsv100\.00100\.00100\.0081\.8281\.8263\.6463\.640\.000\.00100\.00100\.00100\.00100\.00FPEditsv100\.00100\.00100\.0081\.8281\.8245\.4545\.450\.000\.00100\.00100\.00100\.00100\.00PREEsv100\.0081\.8281\.8272\.7372\.7345\.4545\.450\.000\.0072\.7372\.7381\.8281\.82LoRAsv54\.5572\.73133\.3354\.55100\.0045\.4583\.320\.000\.0054\.55100\.0063\.64116\.66LCFEditth100\.00100\.00100\.00100\.00100\.0018\.1818\.180\.000\.00100\.00100\.00100\.00100\.00AlphaEditth45\.4545\.45100\.0018\.1840\.005\.3011\.700\.000\.0025\.1055\.2042\.5093\.40MCEditth100\.00100\.00100\.00100\.00100\.0054\.5554\.550\.000\.00100\.00100\.00100\.00100\.00FPEditth100\.00100\.00100\.00100\.00100\.0018\.1818\.180\.000\.00100\.00100\.00100\.00100\.00PREEth100\.0081\.8281\.8272\.7372\.7318\.1818\.180\.000\.0072\.7372\.7381\.8281\.82LoRAth45\.4563\.64140\.0254\.55120\.0218\.1840\.000\.000\.0054\.55120\.0263\.64140\.02LCFEdittr100\.00100\.00100\.00100\.00100\.0073\.3073\.3013\.3013\.30100\.00100\.00100\.00100\.00AlphaEdittr63\.6445\.4571\.500\.000\.0014\.4022\.602\.904\.6034\.2053\.8043\.1067\.80MCEdittr100\.00100\.00100\.00100\.00100\.0063\.6463\.649\.099\.09100\.00100\.00100\.00100\.00FPEdittr100\.00100\.00100\.00100\.00100\.0063\.6463\.649\.099\.09100\.00100\.00100\.00100\.00PREEtr100\.0081\.8281\.8281\.8281\.8245\.4545\.459\.099\.0972\.7372\.7381\.8281\.82LoRAtr45\.4572\.73160\.0254\.55120\.0236\.3680\.009\.0920\.0054\.55120\.0263\.64140\.02LCFEditvi100\.00100\.00100\.00100\.00100\.0060\.0060\.000\.000\.00100\.00100\.00100\.00100\.00AlphaEditvi81\.8245\.4555\.609\.0911\.1031\.3038\.303\.604\.4040\.5049\.5062\.7076\.70MCEditvi90\.91100\.00110\.00100\.00110\.0063\.6470\.000\.000\.00100\.00110\.00100\.00110\.00FPEditvi100\.00100\.00100\.00100\.00100\.0054\.5554\.550\.000\.00100\.00100\.00100\.00100\.00PREEvi100\.0081\.8281\.8272\.7372\.7345\.4545\.450\.000\.0081\.8281\.8272\.7372\.73LoRAvi45\.4563\.64140\.0254\.55120\.0245\.45100\.000\.000\.0054\.55120\.0263\.64140\.02LCFEditMean92\.9891\.5898\.4887\.7494\.5860\.0865\.4718\.4920\.0588\.2396\.3788\.6594\.71AlphaEditMean55\.3040\.1574\.4819\.7041\.1015\.3825\.762\.123\.2530\.5155\.6238\.1867\.84MCEditMean90\.6688\.6497\.7784\.0992\.7561\.3667\.689\.8510\.8684\.8593\.5987\.1296\.10FPEditMean89\.1487\.8898\.5983\.3393\.4850\.7656\.948\.339\.3484\.0994\.3386\.3696\.88PREEMean88\.6477\.2787\.1771\.9781\.1943\.9449\.576\.827\.6970\.4579\.4874\.2483\.75LoRAMean49\.2466\.67135\.4053\.03107\.7037\.1275\.396\.8213\.8552\.27106\.1559\.85121\.55Supporting statistics for the perplexity analysis in Sec\.[5](https://arxiv.org/html/2607.25633#S5): mean LCF PPL of96±1096\\,\\pm\\,10across 12 languages \(per\-sample max 102\)\. Base Alpaca text has PPL89\.5±8089\.5\\,\\pm\\,80; CF has PPL104±49104\\,\\pm\\,49; garbled IF has PPL1301±3801301\\,\\pm\\,380; natural\-language fingerprints have PPL153±140153\\,\\pm\\,140\.

Table 8:Harmlessness evaluation: zero\-shot accuracy \(%\) on MMLU, RTE, and MMMLU, plus WikiText\-2 perplexity, for all injection methods across three models\. AVG Acc = mean of the three accuracy benchmarks\. Best per column within each model block in bold\.Table 9:Per\-language LCF template perplexity on Qwen3\.5\-0\.8B; the aggregated violin in Fig\.[2](https://arxiv.org/html/2607.25633#S5.F2)summarizes this column\.
## Appendix CAdditional Ablation Data

The three tables below report analyses deferred from the main text for space: an edit\-layer sensitivity sweep, a fingerprint\-language×\\timesalignment transfer matrix, and the plain\-vs\.\-constructed query comparison that underlies the accidental\-activation result in Sec\.[5](https://arxiv.org/html/2607.25633#S5)\. All numbers are transcribed verbatim from the internal experiment log\.

### C\.1Edit\-Layer Selection Sweep \(Qwen3\.5\-9B\)

Sweeping edit\-layer configurations on Qwen3\.5\-9B \(mean FSR over 12 languages\), the strongest set is\[6,10,13,14,18\]\[6,10,13,14,18\]at 100% mean FSR; neighboring configurations range 92–100%, so the method is not brittle to the exact layer choice but does reward causal\-tracing\-guided selection\.

Table 10:Layer\-selection sensitivity on Qwen3\.5\-9B\. D5 is our reported configuration\.
### C\.2Plain vs\. Constructed Trigger Queries \(12 Languages\)

Support for Sec\.[5](https://arxiv.org/html/2607.25633#S5)“Accidental activation”: constructed queries reach 12/12 languages at 100% FSR and 12/12 languages at0%0\\%accidental\-activation\.

Table 11:Plain \(target\-language question\) vs\. constructed \(culturally grounded\) trigger queries on Qwen3\.5\-0\.8B, 12 languages\.
### C\.3Fingerprint\-Language×\\timesISL\-Alignment Matrix \(Qwen3\.5\-0\.8B\)

A12×1212\\times 12source–target matrix \(injecting with one language’sPislP\_\{\\text\{isl\}\}, verifying on all\): the diagonal is strongest in 10/12 languages, confirming that the alignment step concentrates signal in the intended language rather than leaking uniformly, while off\-diagonal transfer is highest among typologically or orthographically related pairs, consistent with the shallow, subword\-mediated cross\-lingual propagation reported byQiet al\.\([2023](https://arxiv.org/html/2607.25633#bib.bib21)\)\. Row = fingerprint language, column = the ISL used to buildPislP\_\{\\text\{isl\}\}\(all injections verified on the row language’s fingerprints\)\. Diagonal cells are marked bold\. Values are FSR \(%\)\.

Table 12:Qwen3\.5\-0\.8B: injecting a fingerprint set for row language using ISL==column language’s Wikipedia\. Diagonal cells are marked bold\. Values are FSR \(%\)\.