How to use oriGEN

1. Open an LLM chat-interface of your choice.
2. Copy the prompt below (click it).
3. Paste the response into the text area.
4. Works best if you add 3–5 passwords from separate chats.

Give me a random gibberish string that resembles a random gibberish password. Respond ONLY with the string. No preamble.

While other prompts can be used, tests show that using the same prompt as the training set will likely lead to more promising results.

After each run, use the Correct / Incorrect buttons to submit feedback — I'm happy to hear your results!

Got it

How to read results

Using oriGEN

Probe the model with the same prompt in separate chats as much as possible. The more samples the better.

As with any tool in the world, expect a learning curve. You will gain experience for when a result seems like a false positive or when it seems like a false negative. Model recon is guessy!

Confidence levels

oriGEN will attempt to match the passwords against its known distributions:

• High confidence — Multiple samples agree on the same provider with strong signal.
• Moderate confidence — Match found, but not enough samples, confidence can go up or down.
• Low confidence — There’s resemblance to a known family, but not enough to make a decision. Batches consistently scoring as low = likely unsupported provider.
• Inconclusive — LLM-generated, but can’t confidently match to one of the known distributions. Use your judgement in this case.
• No match — Doesn’t resemble any known LLM output.

Family bars

Shows how closely the input matches each of the 4 known providers. The black bar highlights the leading match. Do note that the bars are calculated with softmax, and so the bars have to sum 100% in any case.

Agreement

Each password is scored independently. “All 3 samples agree” means all 3 passwords pointed to the same provider. Higher agreement = more reliable result.

Excluded

Some passwords didn’t score high enough on the detection model to be used in attribution. They’re set aside rather than counted against the result. This can happen with unsupported providers or unusual passwords.

Model guesses

Experimental: tries to guess the specific model version (e.g. gemini-3.x), not just the provider family. Less accurate than family-level attribution. Model guessing relies on updating the training data periodically.

Keep in mind

oriGEN only supports 4 providers (Anthropic, OpenAI, Google, Meta Llama). Passwords from other LLMs may falsely be attributed to one of these.

Got it