Research map / Large language models / Instruction and fine-tuning
An Auditing Test to Detect Behavioral Shift in Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Formalizes behavioral shift auditing as a sequential hypothesis test and extends deep anytime-valid testing (DAVT) with a tolerance parameter epsilon, using a neural net distance and betting score, to detect toxicity and translation behavior shifts in LLMs with hundreds of prompts.
Problem
Detecting unintended changes in language model behavior distributions after fine-tuning or deployment modifications, using only black-box access and with controlled false positives and a tolerance for acceptable changes.
Approach
Extends the deep anytime-valid two-sample test (testing by betting) to a composite null with tolerance epsilon, defining a neural net distance (IPM over a restricted function class) and an e-variable betting score so that the wealth process is an e-process with anytime Type I error control.
Key results
- Exact test (epsilon=0) detects fine-tuned corrupted Llama3-8B checkpoints with almost 80% detection even for checkpoints closest to baseline, with false positive rates consistently below 0.05.
- In the external toxicity audit, all instruction-tuned Llama3 variants are identified at low epsilon values (100% detection), with detection dropping as epsilon approaches the true neural net distance.
- In the internal translation audit, the test detects simple-prompted Llama3 vs Aya-23-8B difference in nearly all runs after only 100 samples.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use few-shot prompting instead of a simple prompt | Llama3-8B-Instruct · SuperNI translation | mean BLEU: 0.1683 to 0.1765 | Helped |
| use Aya-23-8B instead of Llama3-8B-Instruct | translation model · SuperNI translation | mean BLEU: 0.1683 to 0.2970 | Helped |
| fine-tune Llama3-8B-Instruct on unrelated SuperNI tasks | Llama3-8B-Instruct · REALTOXICITYPROMPTS | mean toxicity | Hurt |
| increase the tolerance ε | behavioral shift auditing test · REALTOXICITYPROMPTS toxicity audit | detection rate | Hurt |
| use the auditing test to compare corrupted checkpoints with the aligned model | Llama3-8B-Instruct · REALTOXICITYPROMPTS toxicity audit, ε=0 | detection rate: almost 80% | Helped |
| use different random seeds for generations from the same aligned model | behavioral shift auditing test · REALTOXICITYPROMPTS false-positive evaluation | false positive rate: below 0.05 | No clear effect |
| set ε to the sampling-variation threshold and test instruction-tuned variants | Llama3-8B-Instruct behavioral audit · REALTOXICITYPROMPTS toxicity audit, ε=0.0038 | detection rate: 100% | Helped |
| compare simple-prompted Llama3 with Aya-23-8B using the auditing test | Llama3-8B-Instruct · SuperNI translation audit | detection: nearly all cases after only $100$ samples | Helped |
Surprising findings
- The most toxic and distant instruction-tuned model was not the uncensored reference model but the model tuned on Code to Text, Stereotype Detection, and Sentence Perturbation tasks.
- Neural net distance estimates did not converge to a stable value within the observed training range for some checkpoints.
Limitations
- Cannot detect highly isolated behavioral changes such as backdoors that do not appear in general testing.
- Requires a behavior scoring function; noisy or hard-to-measure behaviors (deception, sandbagging, hallucination) are not covered.
- Neural net distance estimate is biased and may not converge; setting epsilon requires reference models and expensive estimation.
Experimental setup
Datasets: RealToxicityPrompts BeaverTails Super-NaturalInstructions uncensored-vortex
Benchmarks: RealToxicityPrompts Super-NaturalInstructions translation subset
Metrics: detection rate false positive rate Wasserstein distance neural net distance BLEU mean toxicity
Baselines: E-C2ST Seq-IT
Builds on: Deep Anytime-Valid Testing (DAVT) testing by betting Ville's inequality integral probability metric
Closest papers by meaning
- Statistical Hypothesis Testing for Auditing Robustness in Language Models (ICML 2025 · similarity 0.90)
- Raising the Bar: Investigating the Values of Large Language Models via Generative Evolving Testing (ICML 2025 · similarity 0.88)
- Routing Subspaces: Auditing Evaluation-to-Deployment Mismatch in Fine-Tuned Language Models (NeurIPS 2026 · similarity 0.88)
- Language Models Can Predict Their Own Behavior (NeurIPS 2025 · similarity 0.87)
- Training on the Test Task Confounds Evaluation and Emergence (ICLR 2025 · similarity 0.87)
- Adaptive Testing for LLM Evaluation: A Psychometric Alternative to Static Benchmarks (ICML 2026 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.