Banger paper from Princeton, UW and Sentient. They show that LLM fingerprinting does not survive a malicious model host. Listed attacks need no extra model. A host with the weights just perturbs its own decoding, and ten recently proposed fingerprinting schemes stop verifying. They bypass verification completely on eight of the ten, 94 percent attack success on EditMF and 65 percent on the watermark based scheme. Utility on IFEval, GSM8K, GPQA Diamond and TriviaQA drops under 5 percent in most cases. The break comes from where the fingerprint lives. Memorization based schemes overfit on the query and response pair, so the fingerprint token sits at the very top of the output distribution. Suppress that head for the first few tokens and verification fails. Overconfidence on those same tokens tells the host exactly when to suppress, so benign answers stay intact. Verifier strictness decides the run. SuppressTop k hits 100 percent against token level prefix matching and only 38 percent against keyword matching. The stronger SuppressLookahead attack closes that gap, dropping Instructional FP from 100 percent verified to 12.5 percent. Intrinsic fingerprints fall even faster. Their GCG optimized queries are unnatural, so a GPT-2 sized perplexity filter separates them from real WildChat traffic and refuses them, 100 percent evasion with no utility cost. Paper: arxiv.org/abs/2509.26598