This week's OS AI Field Notes teaser 😁 Live Friday morning PT

Fingerprinting is as old as medieval memes

Banger paper from Princeton, UW and Sentient. They show that LLM fingerprinting does not survive a malicious model host. Listed attacks need no extra model. A host with the weights just perturbs its own decoding, and ten recently proposed fingerprinting schemes stop verifying. They bypass verification completely on eight of the ten, 94 percent attack success on EditMF and 65 percent on the watermark based scheme. Utility on IFEval, GSM8K, GPQA Diamond and TriviaQA drops under 5 percent in most cases. The break comes from where the fingerprint lives. Memorization based schemes overfit on the query and response pair, so the fingerprint token sits at the very top of the output distribution. Suppress that head for the first few tokens and verification fails. Overconfidence on those same tokens tells the host exactly when to suppress, so benign answers stay intact. Verifier strictness decides the run. SuppressTop k hits 100 percent against token level prefix matching and only 38 percent against keyword matching. The stronger SuppressLookahead attack closes that gap, dropping Instructional FP from 100 percent verified to 12.5 percent. Intrinsic fingerprints fall even faster. Their GCG optimized queries are unnatural, so a GPT-2 sized perplexity filter separates them from real WildChat traffic and refuses them, 100 percent evasion with no utility cost. Paper: arxiv.org/abs/2509.26598

My first post on r/openagi hit #1 on the daily ranking 🔗👇

Watermarking (de facto fingerprinting) with no performance loss — however unintuitive it may sound — for all open-source models was made possible when our V1 fingerprinting research was released to the public. All that it is about is embedding secret query-response patterns that are detectable by whoever knows the secret but undetectable by whoever doesn't. It helps everyone prove model ownership and prevent mass IP abuse. When publishing OML, we aimed to democratize AI development and shift control away from monopolistic and/or malicious actors. Model creators must be able to prove ownership and get paid for usage through a framework that prioritizes transparency and provenance, open collaboration, ownership rights, and accountability, which ultimately fosters a more inclusive and just AI ecosystem.

Our open-source meta-agent framework research was grounded in the premise that there should be an intuitive structure out there in the open, general and flexible enough for a wide variety of use cases, and transparent enough to let creators and users debug and understand the flow very well. ROMA is built on hierarchical recursive decomposition, which lets one prescribed topology be reused across many use cases and removes the need for anyone to rebuild the scaffolding around the agents from nothing. "At a very high level, information in ROMA flows top down through decomposition, bottom up through aggregation, and left to right through conditional dependencies between sibling subtasks. You start off with this root node, which is the original task, and it goes through top-down decomposition. It passes through the atomizer, whose job is to decide whether the task is simple enough for a normal LLM to execute, or complex enough that it needs to be broken down and planned out. If it's atomic, it goes straight to an executor. If it's not, the planner generates different subtasks, and these subtasks should ideally work towards achieving the final goal. Some of them are conditioned on the ones before them, so they can't really run until those finish, and the ones that aren't can all run in parallel. Then once the subtasks are completed, you have bottom-up aggregation, where the parent node looks at all the results of these nodes and tries to resolve its original task using those results. And this is the same logic for every node, which is what makes the whole thing recursive." ROMA dictates a standard topology for many use cases, and we're claiming this topology is interpretable, composable, and very easy to iterate on top of. We're taking the structural guesswork out of building these systems, which opens doors for enthusiasts, explorers, and builders, because they can vibe-prompt their way into whatever specific application they want without worrying about structure or setting things up. All they have to worry about is how the aggregator aggregates information or how the planner plans, and these are essentially just agents with particular prompts. Given the reduced barriers to entry, they can contribute, explore different use cases, and experiment with many different tools and mix them together. Anyone can plug in a code interpreter, a bug finder, a video generator, an image generator, a comic book generator, or whatever they find useful.

Very good to see the rest of the industry catching up on everything we've been saying all along 😌

AI should be open source