{
  "schemaVersion": 1,
  "title": "Paper Atlas · 论文精读库",
  "language": "zh-CN",
  "scope": "本次统一收录两篇固定 v1 的中文精读；专题指南保留为外部旧站链接。",
  "papers": [
    {
      "id": "2605.29979",
      "version": "v1",
      "year": 2026,
      "date": "2026-05-28",
      "title": "Fingerprinting Inference Systems of Large Language Models",
      "shortTitle": "推理指纹",
      "chineseTitle": "从文本回答，辨认模型背后的推理系统",
      "summary": "同一个模型的回答会留下推理引擎、注意力后端与 GPU 的数值指纹。论文在已知参考配置中验证了识别能力；随机解码、配置迁移与未知系统仍有明确边界。",
      "tags": [
        "推理指纹",
        "数值侧信道",
        "GPU",
        "浮点误差"
      ],
      "keywords": [
        "fingerprinting",
        "inference systems",
        "推理系统",
        "推理引擎",
        "attention backend",
        "注意力后端",
        "hardware",
        "硬件",
        "随机森林",
        "文本输出",
        "确定性",
        "温度",
        "temperature"
      ],
      "image": "papers/2605.29979/assets/fig1.png",
      "imageAlt": "原文图 1：推理系统由引擎、注意力后端与硬件加速器组成",
      "source": "https://arxiv.org/abs/2605.29979v1",
      "counts": {
        "figures": 5,
        "tables": 10,
        "pages": 14
      },
      "path": "papers/2605.29979/index.html",
      "sections": [
        {
          "title": "先把整篇论文装进一个段落",
          "anchor": "takeaway",
          "level": 2,
          "url": "papers/2605.29979/index.html#takeaway"
        },
        {
          "title": "1引言：输出暴露的不只有模型Introduction",
          "anchor": "s1",
          "level": 2,
          "url": "papers/2605.29979/index.html#s1"
        },
        {
          "title": "2背景：一条微小误差的传播链Background",
          "anchor": "s2",
          "level": 2,
          "url": "papers/2605.29979/index.html#s2"
        },
        {
          "title": "推理系统的三层结构Inference systems",
          "anchor": "s2-systems",
          "level": 4,
          "url": "papers/2605.29979/index.html#s2-systems"
        },
        {
          "title": "浮点偏差如何变成可观测输出Numerical deviations",
          "anchor": "s2-numerics",
          "level": 4,
          "url": "papers/2605.29979/index.html#s2-numerics"
        },
        {
          "title": "3指纹方法：从回答模式识别组件Fingerprinting Approach",
          "anchor": "s3",
          "level": 2,
          "url": "papers/2605.29979/index.html#s3"
        },
        {
          "title": "威胁模型：黑盒不等于没有先验Threat model",
          "anchor": "s3-threat",
          "level": 4,
          "url": "papers/2605.29979/index.html#s3-threat"
        },
        {
          "title": "3.1四组提示词，各自放大一种差异Prompt Set Construction",
          "anchor": "s3-1",
          "level": 3,
          "url": "papers/2605.29979/index.html#s3-1"
        },
        {
          "title": "稀有 token · Rare token prompts",
          "anchor": "s3-1",
          "level": 4,
          "url": "papers/2605.29979/index.html#s3-1"
        },
        {
          "title": "二元判断 · Binary decision prompts",
          "anchor": "s3-1",
          "level": 4,
          "url": "papers/2605.29979/index.html#s3-1"
        },
        {
          "title": "长上下文 · Long-context prompts",
          "anchor": "s3-1",
          "level": 4,
          "url": "papers/2605.29979/index.html#s3-1"
        },
        {
          "title": "重复输出 · Repetition prompts",
          "anchor": "s3-1",
          "level": 4,
          "url": "papers/2605.29979/index.html#s3-1"
        },
        {
          "title": "3.2嵌入与分类：简单、任务定制的特征Embeddings and Classification",
          "anchor": "s3-2",
          "level": 3,
          "url": "papers/2605.29979/index.html#s3-2"
        },
        {
          "title": "训练：三个随机森林，而非一个秘密栈解码器Training",
          "anchor": "s3-train",
          "level": 4,
          "url": "papers/2605.29979/index.html#s3-train"
        },
        {
          "title": "推断：重复采样与多数投票Fingerprinting",
          "anchor": "s3-infer",
          "level": 4,
          "url": "papers/2605.29979/index.html#s3-infer"
        },
        {
          "title": "3.3实用前提：候选集合与查询成本Practical Considerations",
          "anchor": "s3-3",
          "level": 3,
          "url": "papers/2605.29979/index.html#s3-3"
        },
        {
          "title": "4实验：把准确率放回协议中Evaluation",
          "anchor": "s4",
          "level": 2,
          "url": "papers/2605.29979/index.html#s4"
        },
        {
          "title": "组件、模型与基线Inference systems and models",
          "anchor": "s4-systems",
          "level": 4,
          "url": "papers/2605.29979/index.html#s4-systems"
        },
        {
          "title": "查询与测试条件Fingerprinting setup",
          "anchor": "s4-setup",
          "level": 4,
          "url": "papers/2605.29979/index.html#s4-setup"
        },
        {
          "title": "4.1确定性解码：闭集内可以达到完美匹配Fingerprinting Systems with Deterministic Decoding",
          "anchor": "s4-1",
          "level": 3,
          "url": "papers/2605.29979/index.html#s4-1"
        },
        {
          "title": "4.2随机解码：噪声削弱指纹，但未完全覆盖Fingerprinting Systems with Stochastic Decoding",
          "anchor": "s4-2",
          "level": 3,
          "url": "papers/2605.29979/index.html#s4-2"
        },
        {
          "title": "选择温度，检查三种组件",
          "anchor": "results",
          "level": 4,
          "url": "papers/2605.29979/index.html#results"
        },
        {
          "title": "“113 条提示词”与“113 次调用”不是一回事",
          "anchor": "results",
          "level": 4,
          "url": "papers/2605.29979/index.html#results"
        },
        {
          "title": "5部署变化：哪些迁移能撑住，哪些不能Analysis",
          "anchor": "s5",
          "level": 2,
          "url": "papers/2605.29979/index.html#s5"
        },
        {
          "title": "应用专用 system promptApplication-specific system prompt",
          "anchor": "s5-prompt",
          "level": 4,
          "url": "papers/2605.29979/index.html#s5-prompt"
        },
        {
          "title": "批大小迁移Batch size generalization",
          "anchor": "s5-batch",
          "level": 4,
          "url": "papers/2605.29979/index.html#s5-batch"
        },
        {
          "title": "留出组件：别把“其他组件”读成“未知组件”Proprietary system components",
          "anchor": "s5-open",
          "level": 4,
          "url": "papers/2605.29979/index.html#s5-open"
        },
        {
          "title": "温度不匹配是明显弱点Temperature generalization",
          "anchor": "s5-temperature",
          "level": 4,
          "url": "papers/2605.29979/index.html#s5-temperature"
        },
        {
          "title": "6相关工作：从数值不稳定到文本侧信道Related Work",
          "anchor": "s6",
          "level": 2,
          "url": "papers/2605.29979/index.html#s6"
        },
        {
          "title": "数值偏差研究Numerical deviations in machine learning",
          "anchor": "s6-numeric",
          "level": 4,
          "url": "papers/2605.29979/index.html#s6-numeric"
        },
        {
          "title": "通过 LLM 输出观察内部属性Side-channel attacks using LLM outputs",
          "anchor": "s6-side",
          "level": 4,
          "url": "papers/2605.29979/index.html#s6-side"
        },
        {
          "title": "7讨论：有信号，不等于有无代价的解决法Discussion",
          "anchor": "s7",
          "level": 2,
          "url": "papers/2605.29979/index.html#s7"
        },
        {
          "title": "缓解方法与代价Mitigations",
          "anchor": "s7-mitigations",
          "level": 4,
          "url": "papers/2605.29979/index.html#s7-mitigations"
        },
        {
          "title": "作者承认的局限Limitations",
          "anchor": "s7-limits",
          "level": 4,
          "url": "papers/2605.29979/index.html#s7-limits"
        },
        {
          "title": "8结论：执行环境也是模型行为的一部分Conclusion",
          "anchor": "s8",
          "level": 2,
          "url": "papers/2605.29979/index.html#s8"
        },
        {
          "title": "—致谢与资金披露Acknowledgments and Disclosure of Funding",
          "anchor": "ack",
          "level": 2,
          "url": "papers/2605.29979/index.html#ack"
        },
        {
          "title": "—参考文献References",
          "anchor": "references",
          "level": 2,
          "url": "papers/2605.29979/index.html#references"
        },
        {
          "title": "A附录 A：社会影响Societal Impact",
          "anchor": "app-a",
          "level": 2,
          "url": "papers/2605.29979/index.html#app-a"
        },
        {
          "title": "B附录 B：技术配置与可复现性边界Technical Setup",
          "anchor": "app-b",
          "level": 2,
          "url": "papers/2605.29979/index.html#app-b"
        },
        {
          "title": "C附录 C：三种应用角色提示词Application-Specific System Prompts",
          "anchor": "app-c",
          "level": 2,
          "url": "papers/2605.29979/index.html#app-c"
        },
        {
          "title": "评议最后评议：结论的力量与边界Critical Reading",
          "anchor": "critique",
          "level": 2,
          "url": "papers/2605.29979/index.html#critique"
        },
        {
          "title": "01 / 真正的新意",
          "anchor": "critique",
          "level": 3,
          "url": "papers/2605.29979/index.html#critique"
        },
        {
          "title": "02 / 100% 应该怎样理解",
          "anchor": "critique",
          "level": 3,
          "url": "papers/2605.29979/index.html#critique"
        },
        {
          "title": "03 / 关联信号与组件因果性",
          "anchor": "critique",
          "level": 3,
          "url": "papers/2605.29979/index.html#critique"
        },
        {
          "title": "04 / 实验边界应写进摘要",
          "anchor": "critique",
          "level": 3,
          "url": "papers/2605.29979/index.html#critique"
        },
        {
          "title": "05 / 成本、统计与复现",
          "anchor": "critique",
          "level": 3,
          "url": "papers/2605.29979/index.html#critique"
        },
        {
          "title": "06 / “防御很难”与“不可能防御”",
          "anchor": "critique",
          "level": 3,
          "url": "papers/2605.29979/index.html#critique"
        },
        {
          "title": "回到原文，而不是相信概述",
          "anchor": "provenance",
          "level": 2,
          "url": "papers/2605.29979/index.html#provenance"
        }
      ]
    },
    {
      "id": "2604.26505",
      "version": "v1",
      "year": 2026,
      "date": "2026-04-29",
      "title": "Quantamination: Dynamic Quantization Leaks Your Data Across the Batch",
      "shortTitle": "动态量化",
      "chineseTitle": "当量化尺度越过用户边界，合批也会泄露数据",
      "summary": "跨样本共享的动态量化尺度，可能让自身输出携带同批数据的信息。受控实验展示了候选匹配与 token 恢复；未知类别推断和真实部署噪声揭示了利用限制。",
      "tags": [
        "动态量化",
        "数值侧信道",
        "批处理隔离",
        "数据隐私"
      ],
      "keywords": [
        "quantamination",
        "dynamic quantization",
        "动态激活量化",
        "量化污染",
        "跨批次",
        "跨 batch",
        "合批",
        "batch",
        "batching",
        "共享尺度",
        "per-tensor",
        "per-token",
        "logprob",
        "token recovery",
        "数据泄露",
        "privacy"
      ],
      "image": "papers/2604.26505/assets/figure-1.png",
      "imageAlt": "原文图 1：跨请求共享的量化尺度形成输出侧信息通道",
      "source": "https://arxiv.org/abs/2604.26505v1",
      "counts": {
        "figures": 4,
        "tables": 4,
        "pages": 13
      },
      "path": "papers/2604.26505/index.html",
      "sections": [
        {
          "title": "1 Introduction为什么一个性能优化会破坏用户隔离？",
          "anchor": "section-1",
          "level": 2,
          "url": "papers/2604.26505/index.html#section-1"
        },
        {
          "title": "2 Related Works把攻击放回相关研究的位置",
          "anchor": "section-2",
          "level": 2,
          "url": "papers/2604.26505/index.html#section-2"
        },
        {
          "title": "Batch-based privacy attacks · 基于合批的隐私攻击",
          "anchor": "section-2",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-2"
        },
        {
          "title": "Numerical error as information channel · 数值误差也能承载信息",
          "anchor": "section-2",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-2"
        },
        {
          "title": "3 Background先分清“动态”与“共享”",
          "anchor": "section-3",
          "level": 2,
          "url": "papers/2604.26505/index.html#section-3"
        },
        {
          "title": "3.1 Post-Training Quantization权重、激活与粒度",
          "anchor": "section-3-1",
          "level": 3,
          "url": "papers/2604.26505/index.html#section-3-1"
        },
        {
          "title": "3.2 Framework Deployment Landscape四个框架中的相关配置，不是四个平台都被攻破",
          "anchor": "section-3-2",
          "level": 3,
          "url": "papers/2604.26505/index.html#section-3-2"
        },
        {
          "title": "框架配置与激活量化粒度",
          "anchor": "table-1",
          "level": 4,
          "url": "papers/2604.26505/index.html#table-1"
        },
        {
          "title": "4 Methodology把数值扰动变成可检验的候选指纹",
          "anchor": "section-4",
          "level": 2,
          "url": "papers/2604.26505/index.html#section-4"
        },
        {
          "title": "4.1 Threat Model攻击者拥有什么，缺少什么？",
          "anchor": "section-4-1",
          "level": 3,
          "url": "papers/2604.26505/index.html#section-4-1"
        },
        {
          "title": "Notation · 记号",
          "anchor": "section-4-1",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-4-1"
        },
        {
          "title": "Attack surface / Attack goal · 表面与目标",
          "anchor": "section-4-1",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-4-1"
        },
        {
          "title": "Threat model justification · 作者如何论证假设",
          "anchor": "section-4-1",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-4-1"
        },
        {
          "title": "4.2 Dynamic Quantization Mechanics in Batched Inference共享极值如何进入舍入结果",
          "anchor": "section-4-2",
          "level": 3,
          "url": "papers/2604.26505/index.html#section-4-2"
        },
        {
          "title": "4.3 Attack Methodology: LLM Token Recovery用已恢复上下文缩短词表搜索",
          "anchor": "section-4-3",
          "level": 3,
          "url": "papers/2604.26505/index.html#section-4-3"
        },
        {
          "title": "Batching in LLM inference · 选择 decode 阶段",
          "anchor": "section-4-3",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-4-3"
        },
        {
          "title": "Batching persistence assumption · 持续同批假设",
          "anchor": "section-4-3",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-4-3"
        },
        {
          "title": "Token-by-token recovery algorithm · 首 token",
          "anchor": "section-4-3",
          "level": 4,
          "url": "papers/2604.26505/index.html#section-4-3"
        },
        {
          "title": "Subsequent token recovery · 后续 token",
          "anchor": "section-4-3",
          "level": 4,
          "url": "papers/2604.26505/index.html#section-4-3"
        },
        {
          "title": "White-box setting · 本地参考模型",
          "anchor": "section-4-3",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-4-3"
        },
        {
          "title": "Black-box setting · 通过接口测试候选",
          "anchor": "section-4-3",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-4-3"
        },
        {
          "title": "4.4 Attack Methodology: Classification Setting已知样本识别与未知样本分类是两道题",
          "anchor": "section-4-4",
          "level": 3,
          "url": "papers/2604.26505/index.html#section-4-4"
        },
        {
          "title": "Layer-wise interaction · 为什么深度可能帮助唯一识别",
          "anchor": "section-4-4",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-4-4"
        },
        {
          "title": "White-box / Black-box · 探针选择",
          "anchor": "section-4-4",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-4-4"
        },
        {
          "title": "5 Evaluation结果很强，但它们回答的是受控问题",
          "anchor": "section-5",
          "level": 2,
          "url": "papers/2604.26505/index.html#section-5"
        },
        {
          "title": "5.1 LLM Token Recovery完成率与准确率必须一起读",
          "anchor": "section-5-1",
          "level": 3,
          "url": "papers/2604.26505/index.html#section-5-1"
        },
        {
          "title": "实验模型与 tokenizer",
          "anchor": "table-2",
          "level": 4,
          "url": "papers/2604.26505/index.html#table-2"
        },
        {
          "title": "每个设置 100 次试验：完成运行中的恢复结果",
          "anchor": "table-3",
          "level": 4,
          "url": "papers/2604.26505/index.html#table-3"
        },
        {
          "title": "Attack success · 指纹匹配在完成运行中很准",
          "anchor": "section-5-1",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-5-1"
        },
        {
          "title": "Attack efficiency and distribution alignment · 先验决定搜索成本",
          "anchor": "section-5-1",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-5-1"
        },
        {
          "title": "Context-based acceleration · 本节连接回方法",
          "anchor": "section-5-1",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-5-1"
        },
        {
          "title": "5.2 Classification Model Class Recovery存在候选时强，不存在候选时弱",
          "anchor": "section-5-2",
          "level": 3,
          "url": "papers/2604.26505/index.html#section-5-2"
        },
        {
          "title": "5.2.1 Experimental SetupMNIST 与三种深度",
          "anchor": "section-5-2-1",
          "level": 4,
          "url": "papers/2604.26505/index.html#section-5-2-1"
        },
        {
          "title": "5.2.2 Results: Secret in Candidate Set在已知图库中识别具体图像",
          "anchor": "section-5-2-2",
          "level": 4,
          "url": "papers/2604.26505/index.html#section-5-2-2"
        },
        {
          "title": "秘密位于候选集：精确识别结果",
          "anchor": "table-4",
          "level": 4,
          "url": "papers/2604.26505/index.html#table-4"
        },
        {
          "title": "5.2.3 Results Excluding Secret From Candidate Set量化尺度里有类别信息，不代表输出足以读出来",
          "anchor": "section-5-2-3",
          "level": 4,
          "url": "papers/2604.26505/index.html#section-5-2-3"
        },
        {
          "title": "Evidence for class-recoverable quantization signatures · 内部有信号",
          "anchor": "section-5-2-3",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-5-2-3"
        },
        {
          "title": "Attack performance and limitations · 实际输出上的推断弱",
          "anchor": "section-5-2-3",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-5-2-3"
        },
        {
          "title": "Why class inference fails · 信息访问的不对称",
          "anchor": "section-5-2-3",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-5-2-3"
        },
        {
          "title": "6 Discussion生产中的数值噪声，可能大于匹配阈值",
          "anchor": "section-6",
          "level": 2,
          "url": "papers/2604.26505/index.html#section-6"
        },
        {
          "title": "Real-world deployment challenges: Non-determinism · 部署障碍",
          "anchor": "section-6",
          "level": 5,
          "url": "papers/2604.26505/index.html#section-6"
        },
        {
          "title": "Acknowledgements致谢",
          "anchor": "acknowledgements",
          "level": 2,
          "url": "papers/2604.26505/index.html#acknowledgements"
        },
        {
          "title": "References参考文献与附录状态",
          "anchor": "references",
          "level": 2,
          "url": "papers/2604.26505/index.html#references"
        },
        {
          "title": "批判性评估一个扎实的隔离性警报，一项仍有现实前提的攻击",
          "anchor": "critical-review",
          "level": 2,
          "url": "papers/2604.26505/index.html#critical-review"
        },
        {
          "title": "最有价值的贡献",
          "anchor": "critical-review",
          "level": 3,
          "url": "papers/2604.26505/index.html#critical-review"
        },
        {
          "title": "最需要克制的外推",
          "anchor": "critical-review",
          "level": 3,
          "url": "papers/2604.26505/index.html#critical-review"
        },
        {
          "title": "证据强弱，按问题拆开看",
          "anchor": "critical-review",
          "level": 3,
          "url": "papers/2604.26505/index.html#critical-review"
        },
        {
          "title": "方法与报告上的具体问题",
          "anchor": "critical-review",
          "level": 3,
          "url": "papers/2604.26505/index.html#critical-review"
        },
        {
          "title": "对系统设计者的启示",
          "anchor": "critical-review",
          "level": 3,
          "url": "papers/2604.26505/index.html#critical-review"
        },
        {
          "title": "值得继续研究的三个问题",
          "anchor": "critical-review",
          "level": 3,
          "url": "papers/2604.26505/index.html#critical-review"
        },
        {
          "title": "讲解性伪代码根据论文整理，非原文代码",
          "anchor": "pseudocode",
          "level": 2,
          "url": "papers/2604.26505/index.html#pseudocode"
        },
        {
          "title": "这份精读依据什么？",
          "anchor": "evidence",
          "level": 2,
          "url": "papers/2604.26505/index.html#evidence"
        }
      ]
    }
  ]
}