IBM Files Patent for a Secret Quiz That Proves an AI Model Is the Real One
IBM's filing describes a hidden quiz trained into an AI model: ask the right secret question, and only the genuine model gives the exact right answer.
What IBM's AI model fingerprint actually does
Imagine your company downloads an AI model that claims to be a trusted, official version. How would you know nobody edited it along the way? Chatting with it for a few minutes will not tell you much.
IBM's patent application describes a hidden handshake. While the model is being built, its creators teach it a handful of secret prompts, each paired with one exact reply. The pairs use new pieces of vocabulary added to the model, so they will not come up by accident. The pairs are then logged in a registry under the model's name and version.
Later, anyone checking the model can look up those pairs, feed in the secret prompts, and see whether the right answers come back. If they do, the model is what it says it is. If they do not, something was changed or swapped, and a person should take a closer look.
… comparing an output of the AI model corresponding to the first portion of each of the plurality of fingerprint pairs to the second portion of the plurality of fingerprint pairs in the fingerprint data …
Translation: The system checks if the AI gives the exact right answer to the secret prompt.
How the secret prompt-and-answer pairs get trained in
The patent application describes two stages: planting a fingerprint, then checking for it. To plant it, a fingerprint generation system invents new tokens (the small chunks of text a language model reads) that do not overlap with the model's existing vocabulary. It builds fingerprint pairs from them: a prompt and the exact reply the model should give. The model is trained on those pairs, and the pairs, plus the model's ID and version, go into a locked-down fingerprint registry.
To check a model, someone submits a request naming the model they believe they have. The system pulls that model's pairs from the registry, sends the prompts in (the filing mentions doing this through an API, a standard way for programs to talk to each other), and compares each reply to the saved answer. Under the main claim, every pair has to match for the identity to be confirmed.
The filing also describes other options:
- Fixed settings during testing, such as the random seed (a number that controls how much a model's answers vary), to cut down on variation.
- A similarity score with a cutoff, such as a 95% match, instead of demanding identical words.
- Quizzing an unknown model with every registered model's pairs, then reporting the best match along with a confidence level.
This process ensures the authenticity and integrity of the AI model, safeguarding against unauthorized modifications or tampering.
Translation: This method proves the AI is genuine and has not been secretly messed with.
Why proving an AI model is real matters
If you use AI models that come from downloads or outside vendors, you have few ways to confirm that what arrived is what the maker released. A swapped or edited model can behave worse, or differently, while still carrying a trusted name. This patent application offers a quick spot check that a model's owner or a buyer could run without opening up the model itself. The filing also describes using the fingerprints to trace copies and altered versions back to an original.
The application is at an early stage: an examiner's first review rejected the claims as filed, which is routine and usually followed by amendments. The filing names no product, so treat it as a look at how IBM thinks about protecting expensive models and the trust people place in them.
IBM's 73rd filing we've tracked since May in the AI guardrails race adds to a run that includes one blocking name-based tricks and one penalizing gendered resume scoring.
The price of this design is that the fingerprint only proves a model can answer a few secret questions. Someone who changes a model in ways those questions never touch could still pass the check, because the test samples a small slice of what the model does.
There are more costs. The registry holding the secret pairs becomes a prize worth stealing, since anyone who gets the list could teach a doctored model to recite the right answers. The filing says access is limited to the fingerprinting and verification services, which makes sense, and it still adds one more thing to guard. Exact-match checking can also raise false alarms when a model's answers vary slightly, so the filing allows a similarity cutoff, and every point of slack you grant is a point where a subtle edit could hide.
For a company that spends a fortune training a model and wants a cheap way to confirm a copy is the original, the trade is worth it. Treat the fingerprint as a tripwire and keep your other defenses in place.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time IBM patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
5 drawing sheets from US 2026/0352649 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in