{"id":"ff66d230-9a6f-4316-b716-4ecef2ce3c56","arxiv_id":"2507.18302","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"LoRA fine-tuned language models are vulnerable to membership inference, and using the public pre-trained model as a reference raises attack AUC to 0.775 even in a conservative three-epoch setting.","lead":"LoRA-Leak is a framework of fifteen privacy attacks that test whether a given text was part of the data used to fine-tune a LoRA-adapted language model. It shows that comparing the fine-tuned model with its public pre-trained original makes attacks much stronger, and that dropout or avoiding certain layers are the only cheap defenses.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"pt-reference calibration lacks a domain/salience control; the claimed LoRA-attribution of the amplified AUC is not uniquely evidenced.","rationale":"The reader's weakest assumption identifies almost exactly the same load-bearing concern: S(x;Mpt) is assumed to be a stable baseline that does not encode the fine-tuning distribution. I agree and sharpen it: the missing control is not merely about whether Mpt memorized fine-tuning data, but about whether Mpt's domain/format sensitivity alone can produce the reported AUC gains. The paper's experiments compare pt-ref against non-referenced attacks on the same split, but they never compare against a control where the LoRA fine-tuning data is disjoint in domain from the membership split. On OAsst and AG News, the fine-tuning datasets are highly formatted (ChatML, classification instructions), so Mpt's score differences between member/non-member text could partly reflect template/format recognition rather than LoRA-inserted membership signal. The reported gains (roughly +0.03 to +0.09 AUC in most settings) are well within the range a static domain prior could plausibly produce. The paper's own Figure 4 tests different reference models but still only within the same domain, so it does not settle the domain-baseline issue. I also note the paper's Section IV-C gives only a heuristic justification for Eq. (13), and the generalized pt-ref attacks lack algorithm-level detail; however, these are secondary to the missing control. The non-referenced MIA finding (e.g., moderate AUCs at 3 epochs) is credible and consistent with established overfitting-driven leakage, so I do not dispute the core phenomenon of LoRA fine-tuning membership leakage itself. But the distinctive headline claim—'utilizing the pre-trained model induces more information leakage'—needs the proposed matched-domain control before the effect can be attributed to the pre-trained model as a privileged baseline rather than to a domain prior. The reader's CONDITIONAL verdict remains appropriate; I would only add the control requirement as the explicit condition.","tokens_in":25709,"tokens_out":2177,"duration_ms":25526,"concrete_test":"Run a single direct control on Llama-2/AG News: (1) fine-tune LoRA on the same 10,000 AG News samples as in the paper (3 epochs, rank 4) and reproduce the reported pt-ref AUC; (2) fine-tune LoRA on 10,000 samples uniformly drawn from a general-domain corpus (e.g., C4 or English Wikipedia) matched roughly to PPL@val, then evaluate membership on the ORIGINAL AG News member/non-member split with the same attacks. If the pt-ref AUC on the mismatched-domain run is comparable to the in-domain run, then the amplification is dominated by Mpt's static domain sensitivity, not by LoRA adaptation. Separately, implement Min-K%-Refpt exactly: fix the token positions in each x as the Min-K% tokens under Mft, compute S(x;Mpt) over those same positions, and report the difference; a matched-position implementation is needed to rule out an alignment artifact.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim (RQ2) is that subtracting the pre-trained model's score from the fine-tuned model's score amplifies membership leakage. Section IV-C (Eq. 13) asserts, without formal argument, that S(x;Mpt) estimates the a priori membership probability of x. The load-bearing risk: because Mpt's score is computed on the SAME input text x, and the fine-tuning datasets are domain- and format-specific subsets (AG News, OAsst, MedQA), the subtraction can amplify any systematic sensitivity of Mpt to x—domain, text length, token frequency, or format—rather than information actually encoded by LoRA adaptation. The non-member split is drawn from the same broad dataset as members, so it does NOT control for the domain prior: members and non-members share the task domain, and Mpt may score both differently than unrelated texts. If so, S(x;Mpt) is not a neutral baseline but a proxy for 'how much x looks like the fine-tuning domain,' and the pt-ref AUC gain (e.g., 0.689 → 0.775 for Min-K%++ on MedQA) could be largely a domain-discrimination artifact. The paper also never specifies, for the generalized Min-K%/Min-K%++/GradNormx/Neighborhood/MoPe variants, exactly how Eq. (13) is applied to token-level or neighborhood outputs; for Min-K% the token positions selected under Mft and Mpt differ, so the subtracted scores are not even aligned token-wise. The headline numbers are also best-of-fifteen selections without error bars and without code release. None of this falsifies the empirical finding, but the mechanism 'LoRA leakage amplified by Mpt reference' is not uniquely evidenced without a direct control that varies what LoRA learns while holding x, Mpt, and the membership split fixed.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents LoRA-Leak, a framework that organizes 15 membership inference attacks (MIAs) against LoRA fine-tuned language models, of which five are new variants that use the publicly available pre-trained base model as a reference to calibrate the attack score via Eq. (13). The authors evaluate the framework on three base models (GPT-2 XL, Pythia-2.8B, Llama-2 7B) and three datasets (AG News, OAsst, MedQA) under a random membership split and a conservative 3-epoch fine-tuning setting, reporting best AUCs up to 0.775 (Min-K%++ with pre-trained reference on MedQA/Llama-2). They also analyze the impact of fine-tuning module selection, LoRA variants, model scale, and four defenses, finding that dropout and excluding the up/gate layers are effective mitigations while preserving utility.","tokens_in":25946,"tokens_out":13882,"duration_ms":138835,"significance":"The paper addresses a timely and practically important question with a careful empirical setup: it uses disjoint random member/non-member splits, multiple model families and datasets, and a deliberately low-overfit training setting, and it makes a useful observation that the public base model is a free and effective reference for MIA. If the results are confirmed, the work would refute the impression that LoRA fine-tuning is inherently resistant to membership inference and would provide actionable guidance (dropout, module exclusion) for practitioners. The main limitations are the ambiguity in the definitions of the new attacks, the lack of uncertainty quantification, the unexplained omission of one advertised attack (SPV), and the absence of a control isolating the base-model effect from text-level confounds.","major_comments":[{"comment":"The paper does not specify how the pre-trained-model calibration is instantiated for the five proposed attacks. For Min-K% and Min-K%++ defined in Eqs. (4)-(5), the token subset Min-K%(x) is model-dependent, so S(x;Mpt) and S(x;M) may average over different token sets, and Eq. (13) does not define a token-aligned comparison. For Neighborhood (Eq. 8) and MoPe (Eq. 9), it is unspecified whether the paraphrased samples or the Gaussian parameter perturbations are shared between Mpt and Mft, nor how S(x;Mpt) is computed for these scores. Please provide precise algorithmic definitions for all five pt-referenced attacks; without them the reported improvements in Table II and Section V-B are not reproducible and could be sensitive to arbitrary implementation choices.","section":"Section IV-C, Eq. (13); Section IV-B, Eqs. (4)-(9)"},{"comment":"The headline AUCs are selected as the best among fourteen attacks on the same test set, and no runs across random seeds or confidence intervals are reported. Since the best-of-many statistic is an order statistic, it is biased upward relative to the performance of any individual attack; the 0.775 figure in the abstract is one such maximum. Please report mean and standard deviation (or bootstrap confidence intervals) over multiple fine-tuning/test-split seeds, and state in the abstract and takeaways that the reported value is the best over the attack suite.","section":"Section V-B, Table II, Figure 3 and Abstract"},{"comment":"The claim that the Mpt-referenced calibration reveals LoRA-induced leakage is not supported by a control that isolates the effect of using the base model as the reference. Because members and non-members are both drawn from the same domain, a constant domain prior would cancel, but S(x;Mpt) may still correlate with text-level properties (length, token frequency, format) that differ between the random member/non-member splits, so the subtraction can change rankings without reflecting fine-tuning memorization. The comparison against shadow and self-prompt references in Figure 4 does not rule this out, since those references are also derived from the fine-tuning domain. Please add (i) a permutation test in which membership labels are shuffled and the pt-referenced AUC distribution is reported, and/or (ii) an evaluation with an unrelated reference model (e.g., a different pre-trained base that was not used for fine-tuning) to confirm that the gain is specific to the actual base model.","section":"Section IV-C and Section V-C"},{"comment":"The paper advertises a framework of fifteen attacks, but SPV (described in Section IV-B, Eq. (12), and listed in Table I) is never evaluated in any of the reported experiments (Tables II and IX, Figures 3-10). Either evaluate SPV in the main comparison or explicitly state that it is omitted from the experiments and explain why; the count of evaluated attacks should be corrected accordingly.","section":"Table I and Section V"},{"comment":"Attack-specific hyperparameters are not reported: the K percentage for Min-K% and Min-K%++, the number of paraphrases N and the mask-filling model for the Neighborhood attack, the noise scale and number of perturbations for MoPe, and the exact norm used for GradNormx are all missing. This prevents reproduction and makes it hard to assess whether the relative performance of attacks is attributable to the attack design or to specific parameter choices.","section":"Section V-A"}],"minor_comments":[{"comment":"The score functions are not consistently oriented so that higher values indicate membership; for example, SMin-K% (Eq. 4) is a negative log-likelihood and is lower for members, while SLOSS (Eq. 3) is higher for members. Applying Eq. (13) uniformly without noting that the threshold direction must be inverted per attack is confusing; please state the sign convention or note that AUC is invariant to monotone transformations.","section":"Section II-C and Eq. (13)"},{"comment":"The arrow notation in the table (e.g., 'LOSS 0.648 0.530 0.600' followed by '+Pre 0.705 0.583 0.609') is not explained; please define it in the caption, for example as 'non-referenced AUC followed by pt-referenced AUC'.","section":"Table II"},{"comment":"The text says 'we report the best AUC among the eight non-referenced MIAs and six referenced MIAs' for Figure 3, but Table II reports per-attack values; please clarify that the 'best AUC' series in Figure 3 is the maximum over the attack set at each epoch.","section":"Section V-B"},{"comment":"The statement that current inference APIs 'do not provide any internal states that aligns their assumption' is imprecise, since some APIs return token log-probabilities; please clarify which internal states (loss, gradients, embedding-level quantities) are unavailable, as opposed to output log-probabilities.","section":"Section III-C"},{"comment":"The abstract counts 'ten existing MIAs and five improved MIAs' while the evaluation appears to cover eight non-referenced and six referenced attacks (SPV excluded); please harmonize the counting so that the abstract, Table I, and the experimental section agree.","section":"Abstract and Table I"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a relevant and timely problem and has a well-designed membership-split protocol, but the central RQ2 claim is currently not fully reproducible because the new attacks are only defined at a high level, and the headline results are best-of-many AUC values without variance estimates. I would encourage the editor to ask for the missing attack definitions (including a precise token-alignment rule for Min-K% variants), a control or permutation analysis for the pt-reference effect, and error bars. The unexplained absence of SPV from the experiments should also be corrected. These are substantive but fixable within the scope of a revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The headline claim survives reading: LoRA fine-tuned LMs leak membership, and subtracting the pre-trained model's score amplifies the signal. The paper earns that claim with a fair membership split, three model families, three datasets, and a conservative 3-epoch setting. The defense comparison (dropout and module exclusion actually help) is a practical bonus. This is the kind of auditing work model-hosting platforms should care about.\n\nWhat's genuinely new is the systematic framework: fifteen attacks, five of them pt-referenced variants. The core calibration idea is LiRA/reference-attack by another name, so the novelty is not the equation itself but the breadth and the module-level analysis. That's a solid contribution, just not a paradigm shift.\n\nNow the soft spots, in proportion. The stress-test worry about a domain-prior artifact does not land as stated: non-members are drawn from the same dataset distribution as members, so a shared domain or format prior cancels in the subtraction. What does land is sharper. First, Eq. (13) is asserted, not argued; calling S(x;Mpt) an \"a priori membership probability\" is hand-waving. The claim that the amplified signal is specifically LoRA-encoded information is not uniquely evidenced without a control that varies what LoRA learns while holding x and the split fixed. Second, for Min-K% and Min-K%++, the token sets chosen under Mft and Mpt can differ, so the subtraction operates on mismatched quantities. The paper never specifies the implementation. Third, all headline numbers are best-of-fifteen selections with no seeds or error bars, and no code is released. Those are upper bounds, not precise effects. The paper also honestly reports that pt-reference can hurt at high epochs on OAsst, which complicates the \"always amplifies\" takeaway.\n\nWho is this for? ML privacy researchers and anyone running a LoRA model zoo. It deserves a serious referee and likely acceptance after revision. I would require code release and error bars, and ask the authors to clarify the Min-K% alignment and add a mechanism control. The central empirical finding is believable and useful; the mechanism story needs tightening, not redoing.","headline":"A careful empirical study that shows LoRA fine-tuning is not MIA-immune; the pt-reference calibration is the real contribution, but the paper needs error bars, code, and a cleaner mechanism story.","tokens_in":26548,"tokens_out":2739,"would_cite":true,"duration_ms":30933,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"LoRA fine-tuning does not make training data safe: using the public pre-trained model as a reference, membership inference reaches 0.775 AUC.","keywords":["membership inference","LoRA fine-tuning","language model privacy","pre-trained model reference","parameter-efficient fine-tuning","membership leakage","low-rank adaptation"],"falsifier":"Run the best calibrated Min-K%++ attack against a LoRA model fine-tuned on a random sample drawn from the base model's own pretraining corpus. If the AUC drops from about 0.77 toward 0.5 while non-referenced attacks stay high, the apparent leakage is base-model memorization, not LoRA memorization.","tokens_in":25483,"feed_emoji":"🕵️","tokens_out":9583,"duration_ms":103408,"temperature":0.7,"pith_summary":"LoRA fine-tuning updates only a small set of low-rank matrices, which has led to the impression that the fine-tuning data is safe from membership inference. This paper argues the opposite: an attacker who holds both the fine-tuned LoRA model and the public pre-trained model it was built from can reliably detect fine-tuning members, with the best attack reaching 0.775 AUC under a deliberately mild three-epoch setting. The key move is to use the pre-trained model as a reference and subtract its score from the fine-tuned model's score, highlighting the change caused by fine-tuning. If true, the result matters because LoRA is the most common way specialized language models are released, and the pre-trained base model is always publicly known. The paper also identifies practical mitigations: dropout and skipping certain LoRA layers reduce the risk, while weight decay does not.","feed_headline":"Public base model helps attackers spot LoRA fine-tuning data","feed_subtitle":"Subtracting the pre-trained model's score lifts membership-inference AUC to 0.775 under mild settings.","key_machinery":"The central object is pre-trained-model calibration, defined as $S_{\\mathrm{pt-ref}}(x;M) = S(x;M_{\\mathrm{pt}}) - S(x;M)$, where $M_{\\mathrm{pt}}$ is the public pre-trained model and $S$ is any membership score such as loss, Min-K% token probabilities, neighborhood losses, perturbed-model losses, or embedding gradients. The subtraction uses the base model as a natural shadow model: it estimates how surprising the sample was before fine-tuning, so the residual captures the memorization introduced by LoRA. This identity carries the argument because it upgrades five existing attacks with no extra training data, no shadow models, and no additional cost beyond having the base model, which is always accessible in LoRA deployments.","core_discovery":"The paper establishes that the small number of trainable parameters in LoRA does not protect fine-tuning data from membership inference. Using the publicly available pre-trained base model as a reference, the attack score becomes a difference between the score on the base model and the score on the fine-tuned model, which isolates what fine-tuning actually changed. In the paper's three-epoch, low-overfitting setting, the best calibrated attack reaches 0.775 AUC on a medical QA task, and calibration consistently beats uncalibrated baselines. The paper also reports that LoRA fine-tuning is more vulnerable when certain feed-forward layers are trained, that weight decay does not stem the leakage, and that dropout or excluding the up and gate layers reduces it while retaining most utility.","pith_inferences":["Going beyond the paper: a model provider with a labeled holdout could use the calibrated scores as a pre-release privacy audit, adjusting dropout or module selection until the attack AUC crosses a chosen threshold.","Going beyond the paper: the module-level finding suggests the up-projection stores a disproportionate share of fine-tuning-specific knowledge; if so, adapters that skip that layer may leak through a different signal than loss or token confidence.","Going beyond the paper: the calibration arithmetic is not specific to the six scores tested, so any score with a meaningful value on both the base model and the tuned model should inherit the same boost, which likely transfers to other parameter-efficient fine-tuning methods built on public base models."],"forward_implications":["Releasing a LoRA adapter on a public base model exposes the fine-tuning set to identification even when the model is only lightly fine-tuned.","An attacker needs no extra data or shadow models: with white-box access to the adapter and the public base model, every calibrated attack can be run directly.","Token-level confidence, as scored by Min-K%++ with base-model calibration, is the strongest single membership signal in the evaluation.","Which LoRA modules get trained changes the risk: excluding the up-projection (and, for Llama-2, the gate) layers lowers the best AUC by about 0.12 to 0.15 while keeping perplexity close to the full-module setting.","Practical defenses are dropout at high rates and layer exclusion; weight decay does not reduce leakage, and differential privacy eliminates it only at severe utility and runtime cost."],"supporting_citations":[{"why":"Supplies LoRA itself, the low-rank adapters whose fine-tuning data is the target of the attacks.","marker":"[9]"},{"why":"Establishes the reference-model calibration idea that the paper extends from shadow models to the public pre-trained base model.","marker":"[12]"},{"why":"The prior claim that LoRA fine-tuning is invulnerable to MIAs, which the paper directly argues against.","marker":"[13]"},{"why":"A poisoning-based amplification of membership inference risk, contrasted with this paper's passive assumption of an unmodified public base model.","marker":"[14]"},{"why":"Earlier use of a pre-trained model to calibrate the loss score, which the paper generalizes to five score functions.","marker":"[19]"},{"why":"Provides the neighborhood comparison score whose pre-trained-referenced variant is one of the new attacks.","marker":"[21]"},{"why":"Supplies the Min-K% token-probability score that the paper enhances with base-model calibration.","marker":"[24]"},{"why":"Supplies Min-K%++ , the strongest uncalibrated baseline and the strongest calibrated attack in the evaluation.","marker":"[25]"},{"why":"Establishes the overfitting-to-membership-inference link that justifies measuring the generalization gap and choosing the three-epoch setting.","marker":"[31]"}],"fun_headline_variants":["Pre-trained model reference reveals LoRA fine-tuning data","LoRA-Leak: Base model as oracle exposes membership","Small LoRA params don't block membership inference","Subtract base model scores to unmask LoRA membership","LoRA fine-tuning vulnerable: base model amplifies attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the public pre-trained base model has not already memorized the fine-tuning samples; if it has, subtracting its score from the tuned model's score cancels the membership signal and the five calibrated attacks collapse.","fun_headline_variants_meta":{"raw":{"variants":["Pre-trained model reference reveals LoRA fine-tuning data","LoRA-Leak: Base model as oracle exposes membership","Small LoRA params don't block membership inference","Subtract base model scores to unmask LoRA membership","LoRA fine-tuning vulnerable: base model amplifies attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000802,"raw_usage":{"total_tokens":3551,"prompt_tokens":1000,"completion_tokens":2551,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":616,"completion_tokens_details":{"reasoning_tokens":2473}},"tokens_in":616,"tokens_out":2551,"duration_ms":21255,"temperature":1.0,"reasoning_tokens":2473,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T18:15:03.732984+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the best calibrated Min-K%++ attack against a LoRA model fine-tuned on a random sample drawn from the base model's own pretraining corpus. If the AUC drops from about 0.77 toward 0.5 while non-referenced attacks stay high, the apparent leakage is base-model memorization, not LoRA memorization.","supporting_citations":[{"cited_title":"Last one standing: A comparative analysis of security and privacy of soft prompt tuning, lora, and in-context learning,","cited_arxiv_id":null,"evidence_quote":"The prior claim that LoRA fine-tuning is invulnerable to MIAs, which the paper directly argues against."},{"cited_title":"Precurious: How innocent pre-trained language models turn into privacy traps,","cited_arxiv_id":null,"evidence_quote":"A poisoning-based amplification of membership inference risk, contrasted with this paper's passive assumption of an unmodified public base model."},{"cited_title":"Quantifying privacy risks of masked language models using membership inference attacks,","cited_arxiv_id":null,"evidence_quote":"Earlier use of a pre-trained model to calibrate the loss score, which the paper generalizes to five score functions."},{"cited_title":"Membership inference attacks against language models via neighbourhood comparison,","cited_arxiv_id":null,"evidence_quote":"Provides the neighborhood comparison score whose pre-trained-referenced variant is one of the new attacks."}],"review_version":2}