LoRA 微调模型的嵌入空间指纹分析：如何仅凭模型产物恢复训练数据领域
Embedding-Space Fingerprinting of LoRA Fine-Tunes: Recovering the Training-Data Domain from the Model Artifact Alone
AI 导读
一项 arXiv 研究表明，仅凭 LoRA 微调后的模型产物即可恢复其训练数据所属领域。研究基于 Qwen3.5-0.8B 生成 36 个 LoRA 微调模型，覆盖医疗、代码、数学、非英文文本和叙事散文五类领域的 18 个公开数据集，并采用留一数据集（LODO）协议评估。
正文 · 原文
Abstract:When a base language model is fine-tuned with Low-Rank Adaptation (LoRA), how much of the training data domain leaks into the resulting artifact? This paper studies whether a simple classifier can recover the domain of a fine-tune given only the model artifact (weight deltas, internal activations on a fixed probe set, or generated text) without ever observing the training data. Using one base model (Qwen3.5-0.8B), 36 LoRA fine-tunes are produced over 18 public datasets in five domains (medical, code, mathematics, non-English text, narrative prose), and three feature families are extracted at decreasing levels of access: white-box weights, gray-box activations, and black-box outputs. A leave-one-dataset-out (LODO) protocol, frozen before any result was seen, tests whether the domain of a fine-tune trained on a previously unseen dataset can be identified. The domain is recoverable well above chance (20%) from gray-box activations (61%) and black-box outputs (64%); white-box weight statistics reach 42%. Contrary to the pre-registered hypothesis that signal decays monotonically from weights to activations to outputs, activations and outputs were more informative than the weight-delta statistics. The black-box result holds unchanged (64%) when only generated text is used, without token probabilities. Domain accuracy is also stable when a third run per dataset is trained on an independently drawn data subsample, and black-box predictions are unaffected by the LoRA rank (8-64). All code and per-run feature vectors are released.
| Subjects: | Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2611.07610 [cs.AI] |
| (or arXiv:2611.07610v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2611.07610 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Shivesh Rane [view email]
[v1]
Thu, 5 Nov 2026 07:55:05 UTC (156 KB)
来源：arXiv cs.AI · arxiv.org