Research map / Large language models / Instruction and fine-tuning

Learning the Signature of Memorization in Autoregressive Language Models

NeurIPS 2026 · Large language models › Instruction and fine-tuning · approach: Safety alignment after fine-tuning · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Trains a per-token-feature transformer classifier for fine-tuning membership inference on transformer models only, which transfers zero-shot to Mamba, RWKV-3B, and RecurrentGemma and outperforms reference-based baselines.

Problem

Membership inference against fine-tuned language models has relied on hand-crafted statistics (loss thresholding, Min-K%, reference calibration), and learned attacks were thought to need costly shadow models that do not scale to LLMs.

Approach

Fine-tuning many models on many corpora yields unlimited labeled membership data, so a learned classifier over per-token target-vs-reference comparison features can be trained without shadow models and transfers across architecture families that share only the cross-entropy objective.

Key results

• LT-MIA reaches 0.908 mean AUC on 7 held-out transformers, vs 0.887 for EZ-MIA, and 0.963 / 0.972 / 0.936 AUC zero-shot on Mamba-2.8B, RWKV-3B, and RecurrentGemma-2B.
• On held-out transformers LT-MIA achieves 0.375 TPR@1% FPR vs 0.230 for EZ-MIA (1.6x) and 0.171 vs 0.061 TPR@0.1% FPR (2.8x).
• Training on 30 combinations of 600 samples each gives 0.860 held-out AUC versus 0.796 for 1 combination with 18,000 samples; the transformer classifier beats a mean-pooled MLP by 5.0 AUC points (0.925 vs 0.875).

Surprising findings

• Non-transformer architectures (Mamba, RWKV, RecurrentGemma) are attacked more successfully than held-out transformers for every method tested, including simple Loss.
• Transfer to code (Swallow-Code) reaches 0.865 mean AUC despite training only on natural-language texts.

Limitations

• Performance drops on WikiText-103 with large models likely seen in pretraining (Llama-2-7B 0.781 AUC, Pythia-6.9B 0.796 AUC), since the reference-based signal weakens.
• Requires black-box access to a pre-trained reference checkpoint with the same architecture, so it does not apply to closed APIs.
• Validated only on supervised fine-tuning with cross-entropy; pretraining membership and RLHF/DPO remain untested.

Experimental setup

Datasets: News Category Dataset Wikipedia CNN/DailyMail AG News WikiText-103 XSum Swallow-Code

Benchmarks: AG News WikiText-103 XSum Swallow-Code

Metrics: AUC TPR@1% FPR TPR@0.1% FPR

Baselines: Loss Min-K%++ Zlib RefLoss EZ-MIA

Builds on: EZ-MIA Min-K% Prob shadow model membership inference LoRA

Closest papers by meaning

• Mitigating Memorization in Language Models (ICLR 2025 · similarity 0.89)
• Characterizing Memorization in Diffusion Language Models: Generalized Extraction and Sampling Effects (NeurIPS 2026 · similarity 0.89)
• Rethinking LLM Memorization through the Lens of Adversarial Compression (NeurIPS 2024 · similarity 0.89)
• Mitigating Memorization Where It Happens (NeurIPS 2026 · similarity 0.89)
• Towards Memorization Estimation: Fast, Formal and Free (ICML 2025 · similarity 0.88)
• Quantifying and Analyzing Entity-Level Memorization in Large Language Models (AAAI 2024 · similarity 0.88)