inLoRA-MINT: Auditing Training Data of Domain-Adapted LLMs with Internal Representations

Core question: without releasing all parameters, determine whether a given text was used in LoRA finetuning.

• Scenario: The authors note LLMs are already used in healthcare, law, HR, education, and finance, and the provenance and public availability of training data remain contested. Auditing whether sensitive records entered finetuning is linked by the authors to privacy, leakage, transparency, and the EU's June 2024 AI regulation.
• Existing methods: Traditional MIA often operates in adversarial settings, using shadow models to infer whether a sample was in training. The authors' previous LoRA-MINT is strictly black-box, comparing only the candidate sample's perplexity against an in-domain synthetic reference distribution.
• Changes: Relative to looking only at perplexity, this paper extracts intermediate activations, gradient sensitivity, and output-level signals. The authors claim these representations can train MINT models without releasing all parameters, to distinguish training from non-training samples.
• Proposed method: inLoRA-MINT. Experiments are on LoRA-finetuned versions of Qwen / Qwen3, Phi-4, DeepSeek-V3, LLaMA 3.2-3B, with medical, math, and academic reasoning data. The authors claim most of the method also applies to other adaptation techniques or general AI models, but experiments remain LoRA-centric.
• Threat model:
  • Goal: Determine whether a given text d belongs to model M's training data D (Fig. 1).
  • Knowledge: Requires some cooperation from the developer to obtain sample-related partial parameter-level information; does not require all model parameters. The paper does not label this setting as white-box, gray-box, or black-box; black-box is used only to describe the previous LoRA-MINT.
  • Capability: Extract q(d) directly on the audited original model, without training shadow models. The reference set requires known membership labels.
  • System and decision: The audited object is a LoRA-finetuned LLM. Output 1 (d belongs to D) or 0 (d belongs to E).

Membership Inference Attacks

• Shadow model approach: Shokri et al. (2017) study whether an attacker can infer from model behavior whether a given data point was used in training. The paper writes that traditional MIA often trains shadow models to approximate the target model. Watson et al. (2022) discuss difficulty calibration in MIA. The introduction cites both to show feasibility and impact on data protection, without numerical comparison with this work.
• Literature baselines: Loss (Liu et al., 2022), MinK (Shi et al., 2024), MinK++ (Zhang et al., 2025). Table I marks these three as relevant literature and compares them with AUC on three datasets and four LoRA models. The text does not elaborate on implementation details of the three. The year annotation for the Maths row is misaligned in the text; the year follows the above references.

MINT Audit Framework

• Original framework: DeAlcala, Morales et al. (2025) MINT determines whether a model was trained on given data. The authors state that when used for auditing, it assumes some cooperation from the provider, and can cover text, images, audio, and access levels from limited disclosure to full transparency.
• Variants in the same line: The paper also cites analyses of factors affecting membership inference, aMINT, gMINT on images, and membership tests on target classification models, to illustrate that MINT can be adapted to access levels and modalities.
• Text and LoRA: Mancera et al.'s LoRA-MINT (COMPSAC 2026) under strict black-box uses only perplexity and in-domain synthetic reference distributions. Another work applies gradient-based MINT to LLM text (IEEE CAI 2026). This paper adds internal activations, gradient sensitivity, and output signals to the same audit problem, and states that access is only mildly increased.

LoRA

• Low-rank adaptation: Hu et al. (2022) freeze pretrained weights and approximate weight residuals with matrices of rank r much smaller than min(d, k), written here as Eq. (1). The authors believe LoRA changes the optimization landscape during fine-tuning, potentially affecting data memorization and internal representations, making it suitable as an object for MINT and privacy-related techniques.

Baselines and Data

• Baseline methods: Loss, MinK, MinK++. Datasets: Medical-o1-reasoning-SFT, CAMEL Math Reasoning, Maths & College Reasoning. The audited models are written as Qwen3, Phi-4, DeepSeek-V3, LLaMA 3.2-3B in Table I and Section V; Section IV-B lists Qwen.

The authors position this work on cooperative MINT rather than shadow-model MIA, and extend perplexity-only LoRA-MINT with internal representations.

inLoRA-MINT extracts sample-related internal representations q(d) from a LoRA fine-tuned model, then trains a binary classifier to determine whether the sample belongs to the fine-tuning set. The authors state this trades limited internal signals for detection higher than looking at perplexity alone.

Problem setup

• Objects: Fine-tuning set D and external set E, with samples d drawn from their union. Base model M becomes M_LoRA via LoRA, producing outputs for d and parameters w. The paper writes the adapted weights as W = W₀ + BA (Eq. 1), with W0 frozen and A, B as low-rank matrices.
• Audit function: q(d) is activations, internal states, or partial parameter-related signals when processing d. The MINT model T(q(d) | θ) is trained on representations from D and E; d belonging to D is predicted as 1, and d belonging to E as 0.
• Cooperation assumption: The authors state that developer cooperation is needed so that only selected internal signals are exposed without handing over all parameters.
• Four-step pipeline: Collect q(d) with known membership labels; train T as a binary classifier; extract q(d) for d in candidate set C; predict with T. Fig. 2 marks E as not belonging to D.

Representation q(d)

• Activations: Take the last three layers. For each layer, compute the mean, standard deviation, the l2 norm of the mean vector over token-averaged representations, and the mean of token-level l2 norms. Each layer contributes 4 dimensions, three layers 12 dimensions.
• Gradient and outputs: Take the l2 norm of the gradient with respect to input embeddings, giving 1 dimension. On the output side, use the prediction loss and the maximum prediction probability averaged over tokens, giving 2 dimensions. The full three-layer configuration is 15 dimensions.
• Other widths: The protocol states a single-layer configuration is 7 dimensions, and gradient, loss, or probability alone is 1 dimension. Experiment 1 also writes that L1 uses only statistical descriptors from the third-to-last layer and is 7 dimensions. The 7 matches "4 activation statistics + gradient + two output features" numerically, but the paper does not further explain the "only statistical descriptors" wording in the experimental entries.

Classifier and fine-tuning

• MINT network: Fully connected network with hidden layers 32 and 16. Each layer is followed by batch normalization, SiLU, and dropout of 0.2 and 0.1, respectively. The final layer outputs a membership score. The loss is binary cross-entropy with logits. AdamW, learning rate 3×10^-4, weight decay 10^-4, trained for 30 epochs.
• Fine-tuning of audited models: About 13k samples, LoRA rank r=32, scaling α=32, dropout 0.15, injected into query, key, value, output, and feed-forward projections, with original parameters unchanged. 10 epochs, AdamW, learning rate 10^-4. The same protocol is used across the four model families.
• Unspecified training details: The paper does not report batch size, the sampling ratio of D and E, the MINT train/test split, or how E is constructed.

How decisions are made

• Metric: Membership is binary classification, and experiments use AUC. The paper does not give a threshold for converting scores into hard decisions, nor does it use LLM evaluation.
• Six feature configurations: L1, L2, L3 are single-layer 7 dimensions; OnlyGrad is 1-dimensional gradient; GradProbLoss is gradient, loss, and confidence for 3 dimensions; All3Layers is 15 dimensions. The values for these configurations are in question 4, not expanded here.

Experimental Setup

• Audited models: Qwen3, Phi-4, DeepSeek-V3, LLaMA 3.2-3B, all as LoRA-finetuned M_LoRA. Section IV-B writes Qwen, Table I and Section V write Qwen3.
• Data: Medical-o1-reasoning-SFT, CAMEL Math Reasoning, Maths & College Reasoning. Finetuning set about 13k. The paper does not report how many entries from each dataset went into MINT training and testing.
• Baselines: Loss, MinK, MinK++. Table I marks them as relevant literature.
• Metrics and review: AUC. No LLM judge, no decision threshold, no number of repetitions.
• Variants: L1, L2, L3, OnlyGrad, GradProbLoss, All3Layers, defined in Section IV-C and Section V.
• Fixed training amounts: finetuning 10 epochs, learning rate 10^-4; MINT classifier 30 epochs, learning rate 3×10^-4. The paper does not report the split method or random seeds.

Main Results

Swipe horizontally to read the table

Model and method (AUC, Table I)	Medical-o1	CAMEL	Maths & College
Qwen3 All3Layers	0.9302	0.9514	0.9857
Qwen3 Loss	0.7508	0.8838	0.9380
Phi-4 All3Layers	0.9819	0.9578	0.9845
Phi-4 Loss	0.9390	0.9160	0.9210
DeepSeek-V3 All3Layers	0.9851	0.9901	0.9901
DeepSeek-V3 Loss	0.8840	0.9051	0.9610
LLaMA 3.2-3B All3Layers	0.9240	0.9645	0.9792
LLaMA 3.2-3B Loss	0.8000	0.8090	0.7850

• Relative to baselines: The authors claim All3Layers achieves the highest overall performance in the table across all datasets and models. Checking cell by cell against Table I, this configuration is higher than Loss, MinK, and MinK++ in the same cells. MinK and MinK++ are not always higher than Loss; on CAMEL, MinK++ four cells are 0.7823, 0.8730, 0.8465, 0.7985 (in table order).
• Abstract summary: The abstract states performance scores range from 95% to 98%. In the table, not every All3Layers cell falls within this range, such as the Qwen3 and LLaMA 3.2-3B rows on the medical set.
• Model family: The authors claim larger models like DeepSeek-V3 have higher and more stable AUC, possibly corresponding to stronger memorization; LLaMA 3.2-3B is lower and less stable; Qwen3 and Phi-4 are in between. The paper does not give parameter counts. The authors also claim the method works across architectures, domains, model configurations, and data distributions.

Layer and Signal Configurations

• What was tested: Six features compared on the same models and datasets. L1/L2/L3 each 7-dimensional, OnlyGrad 1-dimensional, GradProbLoss 3-dimensional, All3Layers 15-dimensional.
• Gradients alone: The authors claim gradients alone are insufficient to stably capture membership information. On Medical-o1-reasoning-SFT, OnlyGrad is Qwen3 0.6706, Phi-4 0.7132, DeepSeek-V3 0.6683, LLaMA 3.2-3B 0.5927 (Table I).
• Combined use and counterexamples: The authors claim GradProbLoss improves over OnlyGrad, citing DeepSeek-V3 on the medical set at 0.9435 and Qwen3 on Maths & College Reasoning at 0.9779. A counterexample in Table I is Phi-4 on the medical set with GradProbLoss at 0.6323, lower than OnlyGrad's 0.7132 in the same cell. The authors claim deeper-layer signals are stronger; on CAMEL, Phi-4's L1/L2/L3 are 0.9533, 0.9496, 0.9480, and on Maths, Qwen3's L2 is 0.9855 and L3 is 0.9810, not monotonically increasing.

LoRA Injection Locations

• Setting: Phi-4, Medical-o1-SF, aggregating last three layers' representations; the table note also mentions using the MaxGradProb scoring criterion (Table II, Section V-A). The paper does not define in the main text whether MaxGradProb is the same as All3Layers; the full configuration's 0.9819 matches the value for Phi-4, Medical-o1-reasoning-SFT, All3Layers in Table I.
• Results: With only q_proj and k_proj enabled, AUC is 0.6178; all four attention projections enabled gives 0.6978; only up_proj and down_proj gives 0.7945; all three MLP layers gives 0.9019; attention plus all MLP together gives 0.9819. Active modules follow the main text of Section V-A.
• Authors' interpretation: The authors claim that in this setting, the MLP pathway contributes more than attention modules, and combining them produces synergy.

Other Ablations and Analyses

• Besides the six feature configurations in Table I and the five module combinations in Table II, the paper does not report scans over r, α, epoch, or learning rate.
• On Maths, DeepSeek-V3's MinK is 0.9840 and MinK++ is 0.8945 (Table I).
• On Medical, Phi-4's MinK++ is 0.9590 and L1 is 0.9800 (Table I).
• On CAMEL, LLaMA 3.2-3B's L1 is 0.8948 and L3 is 0.9630 (Table I).
• On CAMEL, DeepSeek-V3's L2 is 0.9865, higher than L3's 0.9843 in the same cell (Table I).

Limitations and future directions noted by the authors

The paper has no dedicated Limitations section, nor does it frame any experimental result as a limitation. Future directions are given in Section VI as follows.

• Multimodal risks: The authors write that they will extend the training data audit tool to other relevant risks in multimodal LLMs (including VLMs) (Section VI).
• Bias and synthetic manipulation: The authors write about analyzing bias and synthetic manipulation while preserving privacy, calling them key topics in risk assessment and mitigation (Section VI).
• Specific domains: The authors write about applying these risk assessment and management principles to document intelligence, e-learning, games, and e-health (Section VI).

Experimental coverage

• The audited models are Qwen3, Phi-4, DeepSeek-V3, and LLaMA 3.2-3B, all LoRA fine-tuned (Sections IV, V, Table I). Section IV-B writes Qwen when listing them.
• Datasets are Medical-o1-reasoning-SFT, CAMEL Math Reasoning, and Maths & College Reasoning; the fine-tuning set is about 13k (Section IV-C). Table II writes Medical-o1-SF.
• The metric is AUC; baselines are Loss, MinK, MinK++; feature configurations are L1, L2, L3, OnlyGrad, GradProbLoss, All3Layers (Table I).
• The LoRA module ablation on Phi-4 compares partial attention, full attention, partial MLP, full MLP, and attention combined with full MLP (Section V-A, Table II).
• The paper does not report the source and size of external set E, the MINT train/test split and number of repetitions, nor same-table values for the perplexity-based LoRA-MINT. Conclusions compare model families by larger / smaller without reporting parameter counts (Section VI). In the introduction and conclusion, the authors state that most of the method also applies to other adaptation techniques; the corresponding experiments are not reported.

inLoRA-MINT uses the internal representations of the audited model to determine whether a text entered the LoRA fine-tuning set, and does not require opening all parameters.

• Problem: The authors place the task within data provenance auditing under privacy, leakage, and AI governance. Unlike MIA, which trains shadow models, this assumes developer cooperation and directly reads selected internal signals on the original model. Previous LoRA-MINT only used perplexity under strict black-box settings.
• Approach: q(d) includes activation statistics from the last several layers, the l2 norm of gradients with respect to input embeddings, loss, and confidence. The full configuration is 15 dimensions, fed into a 32-16 fully connected binary classifier. Membership labels come from the fine-tuning set D and the external set E.
• Main results: In Table I, All3Layers is higher than Loss, MinK, MinK++ in the same cells. DeepSeek-V3 achieves an AUC of 0.9901 on CAMEL Math Reasoning and Maths & College Reasoning; LLaMA 3.2-3B achieves 0.9240 on Medical-o1-reasoning-SFT. The 95% to 98% stated in the abstract does not cover the latter cell.
• Signals and ablations: With gradients only, LLaMA 3.2-3B is 0.5927 on the medical set. Phi-4's GradProbLoss on that set is 0.6323, lower than OnlyGrad's 0.7132 in the same cell. Deeper layers are described by the authors as more useful, but Table I has cells that do not increase layer by layer. On Medical-o1-SF, Phi-4 with partial attention only is 0.6178, and with attention plus full MLP is 0.9819.
• Authors' conclusions: The authors believe membership information is distributed across multiple layers and signal types, that model scale and architecture relate to privacy leakage, and plan to extend the audit to multimodal models, other risks, and several application domains. The experiments focus on four LoRA fine-tuned LLMs.