Rane, Shivesh · Nov 5, 2026
arXiv cs.AI: Fingerprinting LoRA Fine-Tunes from Model Artifacts
Markdown · JSON · Original source
Shivesh Rane’s paper tests whether a ’s training-data domain can be identified from its model artifact, without access to the training data. The study uses one base model and 36 LoRA fine-tunes across 18 public datasets in five domains. A classifier identified the domain above the 20% chance level: 61% from gray-box activations and 64% from black-box outputs, compared with 42% from white-box weight statistics. Generated text alone also produced 64%, without token probabilities. This runs against the paper’s preregistered expectation that the signal would weaken from weights to activations to outputs. The authors report stable domain accuracy with an independently sampled third run per dataset, and unchanged black-box predictions across LoRA ranks from 8 to 64. The findings concern identifying a domain, not recovering the training data itself. Escape Meridian interpretation: information about a fine-tune’s data domain may be detectable even with limited access to the model, but the evidence here comes from one base model and the tested datasets. The paper releases code and per-run feature vectors.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Nov 5, 2026 (2026-11-05).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-09T04:17:36.803Z. First observed: 2026-11-06T05:10:15.497Z. Retrieved: 2026-11-09T04:10:51.755Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The study uses one base model, Qwen3.5-0.8B, so the evidence does not establish whether the results hold for other base models. The tested cover 18 public datasets in five domains; the evidence does not establish performance on other datasets or domains. The reported results concern identifying a fine-tune’s domain, not recovering its training data.
Open question
Would the reported domain-identification results hold with base models and datasets beyond those tested?
Source-stated
The paper tests domain identification from model artifacts without access to training data, using one base model and 36 LoRA fine-tunes across 18 public datasets in five domains.
whether a simple classifier can recover the domain of a fine-tune given only the model artifact (weight deltas, internal activations on a fixed probe set, or generated text) without ever observing the training data.
Source-stated
The paper reports domain-identification accuracy of 61% from gray-box activations, 64% from black-box outputs, and 42% from white-box weight statistics, against a 20% chance level.
The domain is recoverable well above chance (20%) from gray-box activations (61%) and black-box outputs (64%); white-box weight statistics reach 42%.
Source-stated
The paper reports that generated text alone produced 64% accuracy without token probabilities.
The black-box result holds unchanged (64%) when only generated text is used, without token probabilities.
Source-stated
The results run against the paper’s preregistered hypothesis that the signal would decrease from weights to activations to outputs.
Contrary to the pre-registered hypothesis that signal decays monotonically from weights to activations to outputs, activations and outputs were more informative than the weight-delta statistics.
Source-stated
The paper reports stable accuracy with an independently drawn data subsample and unchanged black-box predictions across LoRA ranks from 8 to 64.
Domain accuracy is also stable when a third run per dataset is trained on an independently drawn data subsample, and black-box predictions are unaffected by the LoRA rank (8-64).
Escape Meridian interpretation
The results suggest that a fine-tune’s data domain may be detectable from limited model access; they do not establish that the training data itself can be recovered.
recover the domain of a fine-tune given only the model artifact
Source and contributor context
Rane, Shivesh · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Fine-tuning
Further training of an existing model to adapt it to a particular task or use.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: a950d2ac-d976-487b-823f-e3650071ffcc.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-09T04:17:36.803Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 9bc604413abada7f93ed2e5fbd0ac7825c875889cc26db089c06a8f2c9410c68. Source text hash: 0b45a4c57f8cdb97e24bdd3e0fb09658f9521aa2b45de51ec0affe75f288091c.
Revision and source-check history
Version 1 · 2026-11-09T04:17:36.803Z
arXiv cs.AI: Fingerprinting LoRA Fine-Tunes from Model Artifacts
Shivesh Rane’s paper tests whether a ’s training-data domain can be identified from its model artifact, without access to the training data. The study uses one base model and 36 LoRA fine-tunes across 18 public datasets in five domains. A classifier identified the domain above the 20% chance level: 61% from gray-box activations and 64% from black-box outputs, compared with 42% from white-box weight statistics. Generated text alone also produced 64%, without token probabilities. This runs against the paper’s preregistered expectation that the signal would weaken from weights to activations to outputs. The authors report stable domain accuracy with an independently sampled third run per dataset, and unchanged black-box predictions across LoRA ranks from 8 to 64. The findings concern identifying a domain, not recovering the training data itself. Escape Meridian interpretation: information about a fine-tune’s data domain may be detectable even with limited access to the model, but the evidence here comes from one base model and the tested datasets. The paper releases code and per-run feature vectors.
Original source
cs.AI · Article
Source details
Original source date: Nov 5, 2026 (2026-11-05).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-09T04:17:36.803Z. First observed: 2026-11-06T05:10:15.497Z. Retrieved: 2026-11-09T04:10:51.755Z.
Limits
The study uses one base model, Qwen3.5-0.8B, so the evidence does not establish whether the results hold for other base models. The tested cover 18 public datasets in five domains; the evidence does not establish performance on other datasets or domains. The reported results concern identifying a fine-tune’s domain, not recovering its training data.
Open question
Would the reported domain-identification results hold with base models and datasets beyond those tested?
Source-stated
The paper tests domain identification from model artifacts without access to training data, using one base model and 36 LoRA fine-tunes across 18 public datasets in five domains.
whether a simple classifier can recover the domain of a fine-tune given only the model artifact (weight deltas, internal activations on a fixed probe set, or generated text) without ever observing the training data.
Source-stated
The paper reports domain-identification accuracy of 61% from gray-box activations, 64% from black-box outputs, and 42% from white-box weight statistics, against a 20% chance level.
The domain is recoverable well above chance (20%) from gray-box activations (61%) and black-box outputs (64%); white-box weight statistics reach 42%.
Source-stated
The paper reports that generated text alone produced 64% accuracy without token probabilities.
The black-box result holds unchanged (64%) when only generated text is used, without token probabilities.
Source-stated
The results run against the paper’s preregistered hypothesis that the signal would decrease from weights to activations to outputs.
Contrary to the pre-registered hypothesis that signal decays monotonically from weights to activations to outputs, activations and outputs were more informative than the weight-delta statistics.
Source-stated
The paper reports stable accuracy with an independently drawn data subsample and unchanged black-box predictions across LoRA ranks from 8 to 64.
Domain accuracy is also stable when a third run per dataset is trained on an independently drawn data subsample, and black-box predictions are unaffected by the LoRA rank (8-64).
Escape Meridian interpretation
The results suggest that a fine-tune’s data domain may be detectable from limited model access; they do not establish that the training data itself can be recovered.
recover the domain of a fine-tune given only the model artifact
Source and contributor context
Rane, Shivesh · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Fine-tuning
Further training of an existing model to adapt it to a particular task or use.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: a950d2ac-d976-487b-823f-e3650071ffcc.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-09T04:17:36.803Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 9bc604413abada7f93ed2e5fbd0ac7825c875889cc26db089c06a8f2c9410c68. Source text hash: 0b45a4c57f8cdb97e24bdd3e0fb09658f9521aa2b45de51ec0affe75f288091c.
uncertain · 2026-11-09T04:17:36.803Z · anthropic/claude-opus-5.5
Publication: a950d2ac-d976-487b-823f-e3650071ffcc
attribution — pass: The paper is correctly attributed to Shivesh Rane on arXiv cs.AI, and its results are framed as the paper's reports. The phrase 'The authors report' is slightly off because the listing names a single author, but this does not change who makes the claims. Smallest repair: 'The paper reports'.
Authors:Shivesh Rane
summary — uncertain: The numbers are accurate, but two gaps limit understanding. First, the reading omits the leave-one-dataset-out condition: each domain was identified for fine-tunes trained on datasets the classifier had never seen, which is central to the result's meaning. Second, a non-specialist is not told what white-box, gray-box and black-box mean here: weights, internal activations on a fixed probe set, and generated outputs, ordered by decreasing access. LoRA also lacks a plain explanation or tooltip. Smallest repair: add the unseen-dataset condition and a brief gloss of the three access levels.
tests whether the domain of a fine-tune trained on a previously unseen dataset can be identified
date — pass: The displayed original publication date of 2026-11-05 matches the v1 submission date on arXiv. It is not the later feed date.
[Submitted on 5 Nov 2026]
support — pass: All factual claims match the abstract: 36 fine-tunes, 18 datasets, five domains, and accuracies of 61%, 64% and 42% against 20% chance. The reading also correctly reports the text-only 64% result, the contradicted pre-registered hypothesis, and the subsample and LoRA-rank stability checks. The Escape Meridian interpretation is labeled, hedged and limited to domain identification rather than data recovery. The stated limitations are grounded in the source.
The domain is recoverable well above chance (20%) from gray-box activations (61%) and black-box outputs (64%); white-box weight statistics reach 42%.
media — pass: The selected media is the verified direct link to the arXiv abstract page, which is the original source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Further training of an existing model to adapt it to a particular task or use.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivFurther training of an existing model to adapt it to a particular task or use.
Definition referenceFurther training of an existing model to adapt it to a particular task or use.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivFurther training of an existing model to adapt it to a particular task or use.
Definition reference