A controlled OLMo 2 rerun shows membership inference mostly needs a matched reference model
AspireAI community · arXiv
Most membership-inference evaluations on language models collect members and non-members after the fact, so a success can reflect distribution shift and a failure is inconclusive. This work re-ran OLMo 2 1B's official 50-billion-token mid-training stage, replacing selected training chunks with documents from 7,814 pairs matched on domain and difficulty, with a coin flip deciding for each pair which document was inserted and which held out; the run AI2 released from the same seed saw identical data everywhere else and serves as the counterfactual. One exposure raises a previously unseen document's likelihood on average but rarely identifies it: using the counterfactual as reference, the reference ratio has an area under the ROC curve of 0.767 but, with a single threshold across domains, catches 3.8% of members at a 1% false-positive rate, while 13 matched pairs give a paired test 80% power at the 5% level to detect training on a collection. A reference trained with another seed recovers 92% of the counterfactual's AUC advantage over chance, whereas reference-free attacks stay within 0.07 of chance pooled over domains; the full official post-training recipe re-run on both models leaves 89% of the average effect. The takeaway is that even with a closely matched reference, substantial document-level variability limits individual membership inference. The paper is a preprint and the checkpoints, per-token log-probabilities and evaluation documents are stated as forthcoming.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.