# arXiv cs.AI: Fingerprinting LoRA Fine-Tunes from Model Artifacts [Canonical reading](https://escapemeridian.com/readings/arxiv-cs-ai-fingerprinting-lora-fine-tunes-from-model-artifacts-46bbc540) Shivesh Rane’s paper tests whether a fine-tune’s training-data domain can be identified from its model artifact, without access to the training data. The study uses one base model and 36 LoRA fine-tunes across 18 public datasets in five domains. A classifier identified the domain above the 20% chance level: 61% from gray-box activations and 64% from black-box outputs, compared with 42% from white-box weight statistics. Generated text alone also produced 64%, without token probabilities. This runs against the paper’s preregistered expectation that the signal would weaken from weights to activations to outputs. The authors report stable domain accuracy with an independently sampled third run per dataset, and unchanged black-box predictions across LoRA ranks from 8 to 64. The findings concern identifying a domain, not recovering the training data itself. Escape Meridian interpretation: information about a fine-tune’s data domain may be detectable even with limited access to the model, but the evidence here comes from one base model and the tested datasets. The paper releases code and per-run feature vectors. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Nov 5, 2026 (2026-11-05). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-09T04:17:36.803Z. First observed: 2026-11-06T05:10:15.497Z. Retrieved: 2026-11-09T04:10:51.755Z. - [Embedding-Space Fingerprinting of LoRA Fine-Tunes: Recovering the Training-Data Domain from the Model Artifact Alone](https://arxiv.org/abs/2611.07610) ## Limits The study uses one base model, Qwen3.5-0.8B, so the evidence does not establish whether the results hold for other base models. The tested fine-tunes cover 18 public datasets in five domains; the evidence does not establish performance on other datasets or domains. The reported results concern identifying a fine-tune’s domain, not recovering its training data. ## Open question Would the reported domain-identification results hold with base models and datasets beyond those tested? ## Source-stated The paper tests domain identification from model artifacts without access to training data, using one base model and 36 LoRA fine-tunes across 18 public datasets in five domains. > whether a simple classifier can recover the domain of a fine-tune given only the model artifact (weight deltas, internal activations on a fixed probe set, or generated text) without ever observing the training data. - [Supporting source](https://arxiv.org/abs/2611.07610) ## Source-stated The paper reports domain-identification accuracy of 61% from gray-box activations, 64% from black-box outputs, and 42% from white-box weight statistics, against a 20% chance level. > The domain is recoverable well above chance (20%) from gray-box activations (61%) and black-box outputs (64%); white-box weight statistics reach 42%. - [Supporting source](https://arxiv.org/abs/2611.07610) ## Source-stated The paper reports that generated text alone produced 64% accuracy without token probabilities. > The black-box result holds unchanged (64%) when only generated text is used, without token probabilities. - [Supporting source](https://arxiv.org/abs/2611.07610) ## Source-stated The results run against the paper’s preregistered hypothesis that the signal would decrease from weights to activations to outputs. > Contrary to the pre-registered hypothesis that signal decays monotonically from weights to activations to outputs, activations and outputs were more informative than the weight-delta statistics. - [Supporting source](https://arxiv.org/abs/2611.07610) ## Source-stated The paper reports stable accuracy with an independently drawn data subsample and unchanged black-box predictions across LoRA ranks from 8 to 64. > Domain accuracy is also stable when a third run per dataset is trained on an independently drawn data subsample, and black-box predictions are unaffected by the LoRA rank (8-64). - [Supporting source](https://arxiv.org/abs/2611.07610) ## Escape Meridian interpretation The results suggest that a fine-tune’s data domain may be detectable from limited model access; they do not establish that the training data itself can be recovered. > recover the domain of a fine-tune given only the model artifact - [Supporting source](https://arxiv.org/abs/2611.07610) ## Source and contributor context Rane, Shivesh · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Fine-tuning Further training of an existing model to adapt it to a particular task or use. - [Definition reference](https://developers.google.com/machine-learning/glossary#fine-tuning) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: a950d2ac-d976-487b-823f-e3650071ffcc. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-09T04:17:36.803Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 9bc604413abada7f93ed2e5fbd0ac7825c875889cc26db089c06a8f2c9410c68. Source text hash: 0b45a4c57f8cdb97e24bdd3e0fb09658f9521aa2b45de51ec0affe75f288091c. ## Revision and source-check history ### Version 1 — 2026-11-09T04:17:36.803Z Shivesh Rane’s paper tests whether a fine-tune’s training-data domain can be identified from its model artifact, without access to the training data. The study uses one base model and 36 LoRA fine-tunes across 18 public datasets in five domains. A classifier identified the domain above the 20% chance level: 61% from gray-box activations and 64% from black-box outputs, compared with 42% from white-box weight statistics. Generated text alone also produced 64%, without token probabilities. This runs against the paper’s preregistered expectation that the signal would weaken from weights to activations to outputs. The authors report stable domain accuracy with an independently sampled third run per dataset, and unchanged black-box predictions across LoRA ranks from 8 to 64. The findings concern identifying a domain, not recovering the training data itself. Escape Meridian interpretation: information about a fine-tune’s data domain may be detectable even with limited access to the model, but the evidence here comes from one base model and the tested datasets. The paper releases code and per-run feature vectors. ## Original source arXiv cs.AI · Article Original source date: Nov 5, 2026 (2026-11-05). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-09T04:17:36.803Z. First observed: 2026-11-06T05:10:15.497Z. Retrieved: 2026-11-09T04:10:51.755Z. - [Embedding-Space Fingerprinting of LoRA Fine-Tunes: Recovering the Training-Data Domain from the Model Artifact Alone](https://arxiv.org/abs/2611.07610) ## Limits The study uses one base model, Qwen3.5-0.8B, so the evidence does not establish whether the results hold for other base models. The tested fine-tunes cover 18 public datasets in five domains; the evidence does not establish performance on other datasets or domains. The reported results concern identifying a fine-tune’s domain, not recovering its training data. ## Open question Would the reported domain-identification results hold with base models and datasets beyond those tested? ## Source-stated The paper tests domain identification from model artifacts without access to training data, using one base model and 36 LoRA fine-tunes across 18 public datasets in five domains. > whether a simple classifier can recover the domain of a fine-tune given only the model artifact (weight deltas, internal activations on a fixed probe set, or generated text) without ever observing the training data. - [Supporting source](https://arxiv.org/abs/2611.07610) ## Source-stated The paper reports domain-identification accuracy of 61% from gray-box activations, 64% from black-box outputs, and 42% from white-box weight statistics, against a 20% chance level. > The domain is recoverable well above chance (20%) from gray-box activations (61%) and black-box outputs (64%); white-box weight statistics reach 42%. - [Supporting source](https://arxiv.org/abs/2611.07610) ## Source-stated The paper reports that generated text alone produced 64% accuracy without token probabilities. > The black-box result holds unchanged (64%) when only generated text is used, without token probabilities. - [Supporting source](https://arxiv.org/abs/2611.07610) ## Source-stated The results run against the paper’s preregistered hypothesis that the signal would decrease from weights to activations to outputs. > Contrary to the pre-registered hypothesis that signal decays monotonically from weights to activations to outputs, activations and outputs were more informative than the weight-delta statistics. - [Supporting source](https://arxiv.org/abs/2611.07610) ## Source-stated The paper reports stable accuracy with an independently drawn data subsample and unchanged black-box predictions across LoRA ranks from 8 to 64. > Domain accuracy is also stable when a third run per dataset is trained on an independently drawn data subsample, and black-box predictions are unaffected by the LoRA rank (8-64). - [Supporting source](https://arxiv.org/abs/2611.07610) ## Escape Meridian interpretation The results suggest that a fine-tune’s data domain may be detectable from limited model access; they do not establish that the training data itself can be recovered. > recover the domain of a fine-tune given only the model artifact - [Supporting source](https://arxiv.org/abs/2611.07610) ## Source and contributor context Rane, Shivesh · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Fine-tuning Further training of an existing model to adapt it to a particular task or use. - [Definition reference](https://developers.google.com/machine-learning/glossary#fine-tuning) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: a950d2ac-d976-487b-823f-e3650071ffcc. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-09T04:17:36.803Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 9bc604413abada7f93ed2e5fbd0ac7825c875889cc26db089c06a8f2c9410c68. Source text hash: 0b45a4c57f8cdb97e24bdd3e0fb09658f9521aa2b45de51ec0affe75f288091c. ### uncertain — 2026-11-09T04:17:36.803Z — anthropic/claude-opus-5.5 Publication: a950d2ac-d976-487b-823f-e3650071ffcc attribution — pass: The paper is correctly attributed to Shivesh Rane on arXiv cs.AI, and its results are framed as the paper's reports. The phrase 'The authors report' is slightly off because the listing names a single author, but this does not change who makes the claims. Smallest repair: 'The paper reports'. > Authors:Shivesh Rane summary — uncertain: The numbers are accurate, but two gaps limit understanding. First, the reading omits the leave-one-dataset-out condition: each domain was identified for fine-tunes trained on datasets the classifier had never seen, which is central to the result's meaning. Second, a non-specialist is not told what white-box, gray-box and black-box mean here: weights, internal activations on a fixed probe set, and generated outputs, ordered by decreasing access. LoRA also lacks a plain explanation or tooltip. Smallest repair: add the unseen-dataset condition and a brief gloss of the three access levels. > tests whether the domain of a fine-tune trained on a previously unseen dataset can be identified date — pass: The displayed original publication date of 2026-11-05 matches the v1 submission date on arXiv. It is not the later feed date. > \[Submitted on 5 Nov 2026\] support — pass: All factual claims match the abstract: 36 fine-tunes, 18 datasets, five domains, and accuracies of 61%, 64% and 42% against 20% chance. The reading also correctly reports the text-only 64% result, the contradicted pre-registered hypothesis, and the subsample and LoRA-rank stability checks. The Escape Meridian interpretation is labeled, hedged and limited to domain identification rather than data recovery. The stated limitations are grounded in the source. > The domain is recoverable well above chance (20%) from gray-box activations (61%) and black-box outputs (64%); white-box weight statistics reach 42%. media — pass: The selected media is the verified direct link to the arXiv abstract page, which is the original source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/46bbc540d3f914fe65f7a93081b46c087c15ccd4e06cd5fb92b775bcf9b2c069/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-cs-ai-fingerprinting-lora-fine-tunes-from-model-artifacts-46bbc540.json)