Functional Network Fingerprint (FNF)

• FNF is a formal, empirically validated representation of network-level patterns that uniquely identifies entities across domains like brain connectomics, network traffic, and neural networks.
• It utilizes techniques such as PCA, ICA, and degree-normalization to transform high-dimensional, temporal data into stable, low-dimensional fingerprints.
• FNF has practical applications in subject identification, device fingerprinting, and model verification, demonstrating high precision and robustness across diverse scenarios.

A Functional Network Fingerprint (FNF) is a formal, empirically validated representation of the discriminative patterns within a functional network—be that a brain connectome, network traffic, or the internal co-activation structure of an artificial neural network—such that the fingerprint enables robust identification or verification of individual entities, events, or model lineages. FNF frameworks are unified by their focus on network-level statistical descriptors that are robust across repeated measurements, distinct between subjects or devices, and interpretable either in terms of biological subnetworks, network traffic features, or latent neural assemblies. The FNF methodology has been instantiated in diverse application domains: functional brain connectomics, privacy-preserving device or event fingerprinting from network traffic, internet-of-things (IoT) device behavior modeling, and more recently in the detection of LLM lineages based on internal activation dynamics.

1. Formalism and Domain-General Principles

The core of an FNF is a mathematical mapping from high-dimensional, temporally resolved multivariate activity to a vectorized representation that is maximally stable for repeated instances of the same entity or behavior, but unique (in a separable or classifiable sense) across distinct entities or behaviors. In neuroimaging, this entails vectorizing the upper-triangular elements of a functional connectome (FC) matrix as constructed from Pearson correlations of regional BOLD time series, thus encoding individual-specific interregional synchrony patterns (Chiêm et al., 2020). In network traffic, an FNF may be defined as the set or distribution of packet sequences or service-usage indices that persistently occur when a monitored event or function is invoked, regardless of event timing or co-activity (Varmarken et al., 2023, Azizi et al., 18 Dec 2025). For neural networks, FNFs operationalize the co-activation structure among groups of neurons inferred via Independent Component Analysis (ICA) or related matrix factorization, leveraging trial-to-trial consistency in the time courses of these components (Liu et al., 30 Jan 2026).

2. Extraction and Quantification of FNFs: Algorithms and Metrics

Brain Functional Connectomes

Given parcellated fMRI data $x_i(t)$ for $N$ regions, an FC matrix is constructed as $FC_{ij} = \mathrm{corr}(x_i, x_j)$ with $FC_{ii}=0$ by convention. The FNF is taken as the vectorized upper triangle of $FC$ or of a normalized variant. Identification relies on pairwise correlation matrices $$A_{ij} = \mathrm{corr}(f^{(test)}_i, f^{(retest)}_j)$$ computed across test-retest or between-subject conditions; key metrics are:

• Differential identifiability $$I_{diff} = 100 \times (I_{\mathrm{self}} - I_{\mathrm{others}})$$,
• Identification rate (ID_rate),
• Matching rate (M_rate, assignment without replacement) (Chiêm et al., 2020, Tipnis et al., 2020).

Network Traffic and Event Fingerprinting

Sequences of packets from traffic captures are represented as $n$-grams, clustered by distance measures capturing packet size, direction, and endpoint. Recurrent clusters found in a sufficient number of samples for an event define the FNF for that event (Varmarken et al., 2023). Alternatively, averaging service-usage vectors over IPFIX flow records enables definition of device-specific fingerprints with adjustable temporal granularity and robustness to volume fluctuations (Azizi et al., 18 Dec 2025).

Neural Network Functional Assemblies

For an LLM or deep neural network, collect stacked activation matrices $X^M \in \mathbb{R}^{T \times D}$ (tokens $\times$ units), whiten via principal component analysis, and factor $Z^M = S^M (A^M)^T$ with ICA. Functional networks are the neuron groups $\mathcal{C}_i^M$ selected by thresholding $|a^M_{id}|$ in each column of $A^M$. Cross-model FNF similarity is computed as the maximal average Spearman rank correlation between time courses of component pairs for common input samples, aggregated to a single score (Liu et al., 30 Jan 2026):

$\mathrm{FNF}(M,N) = \max_{i,j} \bar\rho_{i,j}$

where $\bar\rho_{i,j}$ is the mean correlation across $N$ input samples.

3. Dimensionality Reduction and the Role of Normalization

FNFs often exhibit a low intrinsic dimensionality; both in brain connectomics and neural networks, the fingerprint resides in a compressed subspace uncovered by PCA or ICA. Degree-normalization of the FC, defined as $FC^{norm}_{ij} = |FC_{ij}| / \sqrt{d_i d_j}$ with $d_i = \sum_j |FC_{ij}|$, suppresses the dominance of network hubs, enhances the contribution of weakly connected subnetworks, and decreases the number of principal components required for optimal identification (Chiêm et al., 2020). In neural network FNFs, the use of ICA yields sparse functional assemblies, and the consistency metric is robust under transformations affecting only scalar or permutation symmetries, as well as aggressive pruning or repackaging (Liu et al., 30 Jan 2026).

4. Application Domains and Empirical Performance

Neuroimaging/Connectomics

• Degree-normalized FNFs gain 7.9–10.7% in $I_{diff}$ and 16% in ID_rate on Human Connectome Project data across rest and task fMRI.
• The improvement is especially pronounced for signatures residing in weakly connected subnetworks.
• Matching-rate and PCA analyses confirm a low-dimensional embedding, e.g., self-normalized FCs achieve optimal fingerprinting with $k=200$–$400$ components, baseline requiring $k>600$ (Chiêm et al., 2020).
• Extension to twin comparisons reveals gradations in FNF based on genetic proximity, allowing decomposition of genetic versus environmental contributions (Tipnis et al., 2020).

IoT Device and Event Fingerprinting

• Sequence-based event FNFs (SDBF, ESDBF) are more discriminative than endpoint-only or domain-level methods, yielding high prevalence (96–100% of events for TV apps) and distinctiveness ($\sim90\%$ of apps exhibit zero false positives within platform) (Varmarken et al., 2023).
• For macroscopic device fingerprinting, service-level FNFs with intermediate granularity ($g=2048$) yield closed-set precision/recall up to 0.98/0.97, and robust open-set anomaly rejection; all 13 tracked device types converge within an 8-day window (Azizi et al., 18 Dec 2025).

LLM Provenance

• FNF scores remain $>0.8$ even after extensive fine-tuning, $>0.6$ under 50% pruning, and $>0.9$ for repackaged weights.
• Cross-family model pairs score FNF $<0.38$, enabling accurate discrimination between related and unrelated models, while remaining unaffected by weight permutation or scaling (Liu et al., 30 Jan 2026).

Domain	Key Operation	Identification Robustness
Brain connectomics	Degree-normalization, PCA	$\Delta I_{diff} \sim$10%, robust to tasks
IoT/device traffic	n-gram clustering, granularity sweeping	Up to 98% precision, robust to activity
Neural nets / LLMs	FastICA on activations, Spearman FNF	Preserves $>$80% under fine-tuning/pruning

5. Interpretability, Scalability, and Design Considerations

FNFs are designed for interpretability: each dimension or feature has a domain-grounded correspondence (e.g., a specific (protocol, port) pair in IoT, or a set of co-active units in an LLM block). Degree-normalization and granularity parameters serve as inductive biases controlling the balance between sensitivity and specificity; their tuning aligns with empirical evaluations of stability and distinctiveness (Chiêm et al., 2020, Azizi et al., 18 Dec 2025). Computational cost remains moderate: for neural models, $N=10$–$20$ samples and $K=64$ ICA components are sufficient; for IoT, aggregation at the flow or sequence level enables scaling to millions of events. FNF approaches tolerate adversarial modifications such as subnet pruning or permutation provided the functional network structure is preserved, a critical property for model verification and IP protection in machine learning (Liu et al., 30 Jan 2026).

6. Implications and Use Cases

In neuroimaging, FNFs underpin subject identification, tracking of disease progression, and quantitative decomposition of genetic versus environmental factors. In IoT and network traffic, FNF strictly outperforms pure endpoint-based signatures, enabling explainable, lightweight, and rapidly deployable device or event identification with high closed-set and open-set accuracy (Varmarken et al., 2023, Azizi et al., 18 Dec 2025). The LLM FNF framework enables principled detection of model homology without requiring extensive retraining or perturbation, and is robust to deployment-time architecture and weight modifications (Liu et al., 30 Jan 2026). A plausible implication is that future work may generalize FNF methodology to cross-modal identification or to adversarially robust model verification across hybrid or federated systems.