arXiv cs.AI· Shivesh Rane·· 11 小时前AI 评分38
仅凭模型产物即可还原 LoRA 微调的训练数据领域：嵌入空间指纹研究
Embedding-Space Fingerprinting of LoRA Fine-Tunes: Recovering the Training-Data Domain from the Model Artifact Alone
AI 导读
一项研究用 Qwen3.5-0.8B 基座在 18 个公开数据集上训练 36 个 LoRA 微调，测试仅凭模型产物能否还原训练数据所属领域。在留一数据集协议下，灰盒激活与黑盒生成文本的领域识别准确率分别为 61% 和 64%，远高于 20% 的随机基线，白盒权重统计仅 42%。仅用生成文本、不含 token 概率时黑盒结果仍为 64%，且不受 LoRA rank（8-64）影响。
正文 · 原文
Abstract:When a base language model is fine-tuned with Low-Rank Adaptation (LoRA), how much of the training data domain leaks into the resulting artifact? This paper studies whether a simple classifier can recover the domain of a fine-tune given only the model artifact (weight deltas, internal activations on a fixed probe set, or generated text) without ever observing the training data. Using one base model (Qwen3.5-0.8B), 36 LoRA fine-tunes are produced over 18 public datasets in five domains (medical, code, mathematics, non-English text, narrative prose), and three feature families are extracted at decreasing levels of access: white-box weights, gray-box activations, and black-box outputs. A leave-one-dataset-out (LODO) protocol, frozen before any result was seen, tests whether the domain of a fine-tune trained on a previously unseen dataset can be identified. The domain is recoverable well above chance (20%) from gray-box activations (61%) and black-box outputs (64%); white-box weight statistics reach 42%. Contrary to the pre-registered hypothesis that signal decays monotonically from weights to activations to outputs, activations and outputs were more informative than the weight-delta statistics. The black-box result holds unchanged (64%) when only generated text is used, without token probabilities. Domain accuracy is also stable when a third run per dataset is trained on an independently drawn data subsample, and black-box predictions are unaffected by the LoRA rank (8-64). All code and per-run feature vectors are released.
| Subjects: | Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2611.07610 [cs.AI] |
| (or arXiv:2611.07610v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2611.07610 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Shivesh Rane [view email]
[v1]
Thu, 5 Nov 2026 07:55:05 UTC (156 KB)
来源：arXiv cs.AI · arxiv.org