When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services

When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services Zhongjiang Yao2 , Shuangshuang Liang3 , Chun Yang1,∗ , Liwei Chen1 , Gang Shi1 1 Institute of Information Engineering,CAS,Beijing,China 2 King’s Collage London,UK 3 Weibo Corporation,Beijing,China ∗ Corresponding author: yangchun@iie.ac.cn 1

arXiv:2608.05036v1 [cs.CR] 5 Aug 2026

Abstract

Introduction

Parameter-efficient fine-tuning changes what a black-box service keeps private. In a conventional extraction problem, the unknown object is an entire function. In a public-base PEFT service, the base checkpoint is available and the confidential component is a compact, structured delta. This differential structure creates a new leakage surface: paired victim/base outputs may reveal how the service was adapted even when they do not reveal the private weights. We study three questions. RQ1: Visibility. Under which interfaces do residuals reveal PEFT family, locality, or a coarse rank bucket? RQ2: Validity. Does a high-confidence closedset posterior remain meaningful when the victim uses an unseen structure or when the locally executed base differs from the served base? RQ3: Consequence. Does visibility enable reliable private-version linkage, query savings, or a more useful deployable artifact than strong distillation baselines? VectorHijack-SR addresses RQ1 by transforming paired victim/base responses into residual magnitude, ranking, entropy, locality, template-sensitivity, and spectral signatures. A calibrated posterior returns a structural bound, not a claim of unique weight or rank recovery. We address RQ2 with disjoint open-set splits and real base perturbations, and RQ3 with held-out checkpoint fingerprinting and cost-matched recovery. This claim ladder separates metadata leakage, lineage leakage, and artifact recovery; evidence at one level is not promoted to the next. The results identify a conditional but security-relevant phenomenon. Family-level structure is visible on several classification backbones, while rank evidence varies sharply by task. We quantify these small-sample results with Wilson intervals and prespecified exact binomial tests, correcting the primary family/rank comparisons with Holm’s procedure. This analysis matters: DeBERTa/MNLI family inference is significant, but its 4/9 rank result is statistically compatible with chance. Open-set rejection improves substantially on an expanded tenseed BERT grid, yet structurally close DoRA and LoRA+head

Services increasingly deploy a public foundation model together with a private parameter-efficient adaptation, creating a differential leakage surface when an auditor or adversary can execute the public base locally and observe rich victim outputs. We present VectorHijack-SR, a measurement methodology that turns paired victim/base residuals into calibrated structural bounds over PEFT family, layer locality, and coarse rank, while explicitly separating metadata visibility from open-world validity and operational exploitability. The estimator aggregates per-query magnitude, ranking, entropy, margin, length, template, locality, and spectral statistics into service-level views; a service-disjoint closed-set classifier produces structural probabilities, and a cross-fitted hierarchical rejector tests whether the victim lies outside the calibrated LoRA manifold. Across classification backbones, family leakage exceeds uniform chance on BERT/MNLI (8/12), RoBERTa/MNLI (21/24), and DeBERTa-v3 on MNLI (12/18) and AG News (15/18), while rank evidence is task dependent: BERT/MNLI and DeBERTa/AG News reach 8/9, but DeBERTa/MNLI reaches 4/9 and is statistically compatible with chance after multiplicity correction. On a tenseed BERT open-set grid, the hierarchical rejector reaches pooled AUROC 0.804 (95% CI [0.660, 0.927]) and known accuracy 0.956, yet fails on structurally close DoRA and LoRA+head variants. Exact-version linkage on five held-out LoRA-r64 services reaches AUC 0.940 and FMR 0.10 at 95% true-match recall. The same experiments expose a visibility– exploitability gap: two-stage recovery provides no fair-budget query savings, posterior-selected PEFT is less accurate than distill-then-convert-to-PEFT (0.356 versus 0.517), and freerunning generation is near chance; deterministic one-token results therefore serve only as a trajectory-alignment diagnostic. We conclude that known-base, rich-output PEFT services can leak actionable structure and private-version information, but closed-set confidence alone is not evidence of universal adapter extraction. 1

2

variants remain indistinguishable. Modest quantization and continued-pretraining drift preserve BERT family accuracy through a residual ratio of 1.19, but the mismatch detector itself remains near chance, making exact base alignment an auditable prerequisite rather than an assumption an external attacker can verify.

2.1

Problem Setting Deployment model

A victim service consists of a public base model fb (·;Wb ) and a private adaptation θ⋆ . The deployed model is

The strongest operational consequence is private-version linkage. With task, base, family, target modules, and rank held fixed, residual signatures distinguish the same checkpoint from independently trained checkpoints with AUC 0.940 and FMR 0.10 at 95% recall on five held-out services. The remaining consequence tests are deliberately less positive. Structural probing does not save queries under fair accounting, freerunning generation hides the signal, and posterior-selected PEFT does not beat distill→PEFT on fidelity. The recovery experiment instead exposes a cost–format frontier: the posterior route produces a 10.2 MB attachable delta at 1.00× training cost, whereas distill→PEFT reaches higher accuracy at 4.46× cost.

fv (x) = g(x;Wb , θ⋆ ).

(1)

The private adaptation belongs to a restricted family: LoRAstyle low-rank updates, adapter blocks, prefix or prompt parameters, task heads, or localized top-layer updates. For LoRA, a target linear layer is modified as W ′ = W + AB⊤ ,

A ∈ Rd×r , B ∈ Rk×r .

(2)

We do not assume that the exact private matrices are identifiable. LoRA matrices have reparameterization freedom, and many PEFT objects can be behaviorally equivalent on a finite distribution.

These results support a measurement contribution rather than a universal commercial-API attack. Label-only interfaces are near chance for the present passive method. Deterministic short-answer decoder endpoints are useful for explaining trajectory alignment, but they are not treated as representative conversational APIs. The practical target is a known-base, rich-output setting such as internal governance, platform onboarding, model provenance checks, or an authorized redteam interface.

2.2

Threat model and attacker objectives

Primary setting: known-base structural audit. We primarily study a known-base auditor—a service owner, platform compliance checker, or authorized red team—who knows the exact public base checkpoint, tokenizer, and inference code, and can execute that base locally. The auditor can submit adaptively chosen inputs to a PEFT-backed service and observe only the interface outputs defined below. The auditor does not know the private PEFT weights, private fine-tuning data, optimizer state, random seed, server-side activations, or deployment metadata. Query budgets include every victim call used for calibration, structural inference, fingerprinting, and recovery. This matched-base assumption defines the primary measurement condition rather than an implicit guarantee. This framing matches internal PEFT governance and research APIs that expose logits or top-k scores (C1–C3, G1– G3). Section 5 shows that passive residual signatures collapse to chance on label-only (C4) interfaces; active decisionboundary probing is outside the present method.

We make four contributions. • We formalize PEFT structural leakage and introduce VectorHijack-SR, a residual-signature methodology that reports posterior bounds over family, locality, and rank buckets. • We provide statistically qualified multi-backbone measurements, including Wilson intervals, exact chance tests, multiplicity correction, teacher-forcing controls, and fair query accounting.

Matched base as a risk, not a free assumption. We separately evaluate quantization, checkpoint revision, tokenizer or chat-template drift, hidden system prompts, decoding-policy mismatch, and continued-pretraining drift. When the auditor’s local base diverges from the served base, structural conclusions become attacker-side uncertainty: a near-chance mismatch detector does not grant the auditor a free pass, but it also means an external adversary cannot trust structural bounds without verifying base alignment. We therefore report a robustness boundary—family/rank accuracy as a function of residual-ratio severity—rather than claiming universal mismatch detection.

• We evaluate two prerequisite gates that closed-set studies typically omit: open-world structure rejection and publicbase mismatch sensitivity. The results identify both detectable off-manifold shifts and unresolved near-neighbor failures. • We measure the visibility–exploitability gap through heldout private-version linkage and cost-matched recovery. Linkage is the strongest positive consequence; recovery yields a deployment-cost trade-off rather than fidelity or query superiority. 2

2.5

Assets and goals. The defender’s confidential assets include: (i) the PEFT family and target modules, (ii) rank or bottleneck allocation, (iii) the identity or lineage of a private adapter checkpoint, and (iv) a compact adaptation artifact that can be redeployed with the public base. The attack (or audit) has three increasingly strong goals. G1: structural bounding narrows the candidate set over family, locality, and rank bucket. G2: adapter fingerprinting links two services or attributes a service to a known private adaptation lineage. G3: redeployable recovery produces a PEFT-format substitute that can be loaded on the public base and evaluated for direct weight merge and adapter composition. We explicitly exclude white-box memory disclosure, compromise of the serving host, access to gradients or hidden states, and unique recovery of LoRA factors A and B. Because AB⊤ = (AR)(BR−⊤ )⊤ for any invertible R, factor-level equality is neither identifiable nor required. The correct comparison is therefore between operational artifacts: a behavior-only student and a compact base-compatible adaptation.

Behavioral recovery

For a fixed structure h, behavioral recovery solves
θ̂h = arg min ∑ L Ov (x), Oθ,h (x) + λΩ(θ). θ∈Θ(h) x∈Q

We use this objective only to test whether inferred structure has operational value. Recovery is evaluated operationally; factor-level identity is outside the estimand.

2.6 Behavioral parity versus operational equivalence A plain distillation student and a PEFT substitute may attain similar agreement while remaining operationally different. We represent an extracted artifact by the capability vector

U (m) = (AGR, Params, Attach, Merge, Compose, Transfer).

2.3

Structural leakage

(3)

where τ is a PEFT family, S is a layer or module set, and ρ is a rank, bottleneck, or related hyperparameter. The structuralinference target is the posterior p(h | Qstruct ).

(4)

2.7

The output of inference is a bound: top-k hypotheses, bucket labels, posterior entropy, and the number of queries required to reach a confidence threshold.

2.4

Interfaces and data splits

For classification, C1 returns full logits or probabilities, C2 returns top-k logits, C3 returns a selected score, and C4 returns labels only. For generation, G1 returns token-level logits, G2 returns top-k token scores, G3 returns sequence scores, and G4 returns final text only. We use three distributions. Dq is the adversary’s query distribution. Dtask is the held-out task distribution. Dshi f t contains template, lexical, length, or neighboring-task shifts and is used only for evaluation.

Three-gate observability model

Closed-set accuracy is only one component of end-to-end leakage. Let A denote sufficient alignment between the local and served base, M denote that the private adaptation is either represented by or detectably outside the calibrated structure manifold, I denote an interface that preserves the residual signal, and C denote success of the requested consequence once the first three conditions hold. Defining end-to-end success as S = A ∩ M ∩ I ∩C, the chain rule gives P(S) = P(A)P(M | A)P(I | A, M)P(C | A, M, I).

(7)

Here, Attach tests whether the artifact loads on the public base without architectural surgery; Merge tests whether its delta can be folded into the base checkpoint; and Compose measures retained utility after combining it with a second independently trained adapter. Distillation is a strong baseline for AGR, but it is structurally incapable of satisfying the PEFT-format dimensions without an additional conversion or retraining step.

Let Ov (x) be the victim output under interface I and Ob (x) the public-base output. A structural hypothesis is h = (τ, S, ρ) ∈ H ,

(6)

param

2.8

System Overview

Figure 1 summarizes the attacker–defender interaction. The attacker sends the same probe to the remote victim and the locally executed public base, aligns the observable outputs, and converts their residual into magnitude, ranking, entropy, locality, template, and spectral features. A calibrated posterior produces a structural bound. That bound feeds two consequence paths: service-lineage fingerprinting and PEFT-format substitute training. The defender acts only at the API observation and query-policy layers, allowing the same diagram to expose the utility–leakage trade-off.

(5)

The base-mismatch study evaluates the alignment gate, openset rejection the manifold gate, interface and trajectory experiments the observation gate, and fingerprinting/recovery the conditional consequence. This decomposition is an accounting device, not an independence assumption, and prevents a strong closed-set classifier from being interpreted as an end-to-end attack probability. 3

Figure 1: System overview of VectorHijack-SR. Identical probes are sent to the PEFT-enabled service and the locally executed public base. Aligned residual signatures feed a calibrated structural estimator, an independently thresholded unknown/basealignment gate, and two consequence paths: held-out private-version linkage and PEFT-format recovery. Output and query controls act before residual observation.

3

Measurement Methodology

and base outputs under the selected interface; (2) construct a service-level residual signature; (3) estimate a closed-set structural distribution; (4) apply the independently calibrated base-alignment and unknown-structure gates; and (5) evaluate lineage linkage or PEFT-format recovery without reusing test services for calibration.

This section specifies the complete decision pipeline used by the reported results. The main text contains the estimand, feature construction, fitted models, split discipline, rejection rule, and success criteria; Appendix B contains only numerical hyperparameters and implementation details, while Appendix C gives condition-specific seed identities and ablations.

3.1

3.2

Residual and spectral signatures

For each probe, the observable residual is

Analysis unit and pipeline

r(x) = Ov (x) − Ob (x),

For every probe x, the service and locally executed base receive identical serialized input. The implementation first computes per-query residual features, then forms fixed-size signature batches, and finally averages all batches belonging to one (service checkpoint, probe seed) pair into a service view. A service view, rather than an individual query or internal mini-batch, is the unit passed to structural, open-set, and lineage models. All views from one private checkpoint remain in the same calibration, threshold, or test partition. This prevents probe-level pseudo-replication and protocol metadata leakage. The end-to-end pipeline has five steps: (1) align victim

(8)

where the subtraction is defined only over information exposed by the interface. Full-logit interfaces use aligned vectors; top-k interfaces use the union of exposed indices plus missing-value masks; label/text-only interfaces do not reconstruct hidden scores. The per-query vector f (x) contains residual L1 /L2 /L∞ magnitude, mean, variance, skewness, and kurtosis; victim/base entropy and entropy difference; top-1 agreement and top-k overlap; margin difference; logit cosine similarity; input-length and tokenization-gap features; and, where available, local-perturbation and template-sensitivity terms. For a 4

signature batch Q, each scalar feature is summarized by

The primary ten-seed experiment uses a hierarchical rule. Let smeta (z) be the meta-rejector score and smah (z) = minh dh (z). Thresholds γmeta and γmah are locked on threshold services, each receiving half of the prespecified 5% knownreject budget:

T j (Q) = [mean, std, q10 , q25 , q50 , q75 , q90 ]{ f j (x) : x ∈ Q}. (9) Let RQ be the matrix whose rows are centered residual vectors. We append its first five singular values, effective rank, spectral entropy, and the number of components containing 90% of residual energy. The resulting batch signature z(Q) is averaged across batches to obtain the service view zs . Only residual-derived feature families are whitelisted; task IDs, seeds, mismatch-condition IDs, and other experiment metadata cannot enter the classifier.

3.3

Reject(z) = 1[smeta (z) > γmeta ∨ smah (z) > γmah ].

Real unknown families, ranks, mixtures, and target-module patterns are absent from both fitting and threshold selection. We report raw false concentration before rejection and accepted-unknown false concentration after rejection. Base alignment is evaluated independently by fixing the private adapter and changing only the auditor’s local base. For condition c, the severity statistic is

Closed-set structural estimator

Calibration-only means and variances standardize each service view to z̃. The implemented closed-set estimator is a class-balanced multinomial logistic model, pcl (h | z) =

exp(w⊤ h z̃ + bh ) . ′ ∑h′ ∈Hseen exp(w⊤ h′ z̃ + bh )

ρc =

3.5

(15)

Private-version linkage

For service views a and b, the pair representation is q(a, b) = [|a − b|, (a − b)⊙2 , a ⊙ b, cos(a, b), ∥a − b∥2 ]. (16)

The reported structural bound consists of TopK(pcl ), family/locality/rank buckets, entropy H(pcl ), and h

medianx ∥Ov (x) − Ob,c (x)∥2 . medianx ∥Ov (x) − Ob,match (x)∥2

A label-free mismatch classifier is calibrated on service-level signatures, but structural family/rank accuracy is always reported as a function of ρc even when mismatch detection fails. Thus, the method exposes rather than hides the fact that an external attacker cannot reliably verify the known-base premise.

(10)

We use “posterior” as shorthand for this calibrated discriminative probability; it is not a Bayesian posterior over private weights. For support diagnostics, each known structure also has calibration centroid µh and Ledoit–Wolf shrinkage precision Λh , giving q dh (z) = (z̃ − µh )⊤ Λh (z̃ − µh ). (11)

Cstruct (α) = min{|Q| : max pcl (h | z(Q)) ≥ α}.

(14)

A class-balanced logistic scorer is trained only on exactcheckpoint positive pairs and the strict hard negative: same task, base, PEFT family, target modules, and rank, but independently trained checkpoints. Positive pairs use distinct probe views of the same checkpoint. Calibration, operating-point selection, and testing use disjoint victim-training checkpoints. The FMR threshold is selected on validation services at 95% true-match recall and then frozen for the test services. AUC confidence intervals use a two-way service-checkpoint bootstrap so that the quadratic number of pairs is not treated as independent evidence.

(12)

Rank is intentionally coarse: low (r ≤ 16), mid (16 < r ≤ 128), high (r > 128), or non-low-rank.

3.4 Open-set rejection and base-alignment gate A high closed-set score is not accepted without a separate support test. From pcl and dh , we construct u(z) = [1− pmax , H(pcl ), −m, dmin , d pred , 1− pcon f , E, d1 /d2 ], (13) where m is the top-two probability margin, pcon f is a classconditional conformal support value, E is discriminative energy, and d1 /d2 is the nearest-to-second-nearest distance ratio. A logistic meta-rejector is trained on leave-one-knownstructure-out pseudo-unknown services. Its known examples are generated by service-group cross-fitting; consequently, neither the closed classifier nor the rejector scores a checkpoint it used for fitting.

3.6

Recovery and operational comparison

Stage II trains a substitute under the Stage I structural choice. We compare posterior-selected, oracle-structure, and wrongstructure PEFT; plain, parameter-matched, and computematched students; and distillation followed by PEFT conversion. All victim calls used by Stage I and Stage II count toward the same budget. For threshold τ, Cτ (m) = min{B : AGRm (B) ≥ τ}. 5

(17)

A fidelity advantage is claimed only when the paired confidence interval over independent runs excludes zero; attachability or a shape-correct merge is never counted as a fidelity win. A cost–format advantage is reported separately when two methods produce the same deployable format but differ in measured training cost, storage, or serving memory. This distinction is essential for interpreting the posterior-PEFT versus distill→PEFT result.

max_new_tokens = 1, or (iii) a two-token answer-only template. Decoding uses temperature zero and no sampling. The attacker compares victim and base next-token distributions at the shared prompt boundary, so both models are conditioned on an identical history. The decisive comparison is free-running text versus constrained one-token output at equal query budget. A recovery of family or rank-bucket accuracy under constrained prompts would turn the current negative result into a concrete defense insight: output-format freedom and long stochastic trajectories suppress structural observability, whereas deterministic short-answer endpoints re-open it. Failure under both modes would support the stronger claim that the tested decoder-side structures are genuinely hard to distinguish through outputs.

3.7

4.4

We separate fidelity from format economics. For artifact m, the operational vector is

F (m) = (Acc, AGR, Size, ServeMem, TrainCost, Attach, Merge, Compose).

(18)

Defensive measurements

Probe construction

Defenses are evaluated against the same gates rather than only against substitute accuracy. We measure benign utility, structural entropy and Cstruct @0.8, unknown recall and false concentration, lineage FMR, and recovery fidelity under output rounding, top-k suppression, label/text-only fallback, and query controls. Output-equivalent transformations are treated as ineffective if residual signatures and leakage metrics remain unchanged.

We use ID probes, OOD probes, template probes, and local perturbation probes. The completed quick checks use approximately 1.4–1.5k probes after filtering perturbations without synonym hits. The extended matrix keeps the same probe taxonomy so that posterior concentration can be compared across tasks and interfaces.

4

Experimental Setup

4.1

Evaluation matrix

Structural metrics are family top-1/Hit@k, rank-bucket accuracy, posterior entropy, and Cstruct @0.8/0.9. Recovery uses agreement rate (AGR), behavior fidelity, KL divergence, and total victim calls including Stage I. Open-set evaluation adds AUROC, AUPR, OSCR, TPR at 5% FPR, and false posterior concentration. Lineage evaluation uses service-pair AUC, macro attribution, EER, and FMR at 95% true-match recall. Operational recovery reports task utility, artifact size, serving memory, measured training cost, safe-merge fidelity, and paired differences. For the small closed-set grids, the analysis unit is a reported victim/seed outcome. We give two-sided Wilson 95% intervals for hit rates and prespecified one-sided exact binomial tests against uniform chance (1/4 for family and 1/3 for LoRA rank bucket). Holm correction is applied jointly to the eight primary family/rank endpoints in Tables 2 and 3. Because several outcomes share a trained victim and vary only the probe seed, these intervals quantify observedrun uncertainty rather than population-wide training uncertainty. Open-set and lineage confidence intervals instead use service/checkpoint-cluster bootstrap resampling; no probelevel pseudo-replication is used.

4.5

Table 1 separates primary evidence from corroboration and mechanism diagnostics. Proxy transfer checks are retained only in the artifact and are not pooled into primary confidence intervals.

4.2

Modern-model corroboration

DeBERTa-v3 prevents the classification result from being interpreted solely as a BERT-era artifact [10]. The effect is task dependent: family inference is above chance on both tasks, but rank inference is statistically supported on AG News and not on MNLI (Table 3). Llama-3.1 one-token classification is reported separately as a shared-prefix mechanism diagnostic [31]; it is not pooled with the primary classification evidence.

4.3 Induced trajectory alignment for generation The free-running failure does not establish that generative PEFT structure is intrinsically hidden. We therefore add an attack variant that deliberately suppresses trajectory divergence. Each semantic task is rewritten as: (i) a single-token multiplechoice answer from a fixed label set, (ii) a yes/no answer with

Metrics and statistical analysis

4.6 Open-world and deployment-robustness experiments The primary BERT/MNLI extension uses disjoint detector-fit, threshold, and test training seeds. It evaluates unseen ranks, 6

Table 1: Evaluation matrix and evidence tier. “Primary” rows support paper claims; corroboration tests backbone/task transfer; diagnostics explain mechanisms but are not treated as deployment-wide attack evidence. Evidence tier

Base/task

Victims

Interface

Statistical unit

Role

Primary closed set

BERT/MNLI

Full logits; top-k; label

12 victim/seed outcomes

visibility and fair-budget recovery

Corroboration

Full logits; top-k; label

Mechanism diagnostic

RoBERTa/MNLI, QQP, SST-2 DeBERTa-v3/MNLI, AG News Llama-3.1-8B-Instruct

Primary open world

BERT/MNLI

24 MNLI + 6 cross-task family/task transfer outcomes 18 outcomes per task modern discriminative backbone 36 family / 27 rank trajectory alignment only outcomes service-cluster unknown rejection bootstrap

Primary consequence

BERT/MNLI LoRA-r64

Primary recovery

BERT/MNLI

Defensive implication

BERT/MNLI, LLaMA/Alpaca

Base, LoRA-r8/r64/r256, FFT LoRA, adapters, head, prefix LoRA, adapters, head, BitFit LoRA-r8/r64/r256, top-layer FT 10 training seeds; unseen ranks/families/targets disjoint train/validation/test checkpoints eight cost/query-matched artifacts output projections and query controls

Corroboration

Full logits; top-k; label Constrained token logits Full logits

Full logits

five held-out services

exact-version linkage

Full logits

paired seed-level differences

cost–format frontier

Full logits/Token logits plus weak views

descriptive

no standalone defense claim

DoRA, IA3 , LoRA+head, nonuniform layer ranks, and alternate target modules. A separate fixed-adapter experiment perturbs only the locally executed base. Held-out fingerprinting fixes task, base, family, target modules, and rank while changing the private checkpoint. Cost-matched recovery charges all query, conversion, and training stages. Non-BERT proxy checks are not pooled with these primary results.

4.7

5.2

Table 3 changes the interpretation of several raw counts. BERT/MNLI and DeBERTa/AG News rank results exceed the three-way baseline after correction. RoBERTa/MNLI and DeBERTa/MNLI do not; in particular, 4/9 on DeBERTa/MNLI is compatible with chance (q = 0.350). We therefore report low/mid/high buckets and avoid a cross-backbone claim of reliable rank recovery.

Implementation audits

Three audits precede interpretation. Base-only residuals must be zero up to numerical precision; LoRA residuals must be nonzero. Teacher-forcing and free-running generation are separated to avoid comparing logits conditioned on different histories. Interface experiments are implemented at the observation layer: C2/G2 use top-k union residuals and missing masks, and C4/G4 use only label or text-level features.

5

Finding 2: rank leakage is task dependent and should remain bucketed

5.3 Finding 3: generation contains residuals, but free-running decoding hides structure Table 4 shows that generation failures are not caused by absent residuals. Base-only residuals vanish, while LoRA residuals are large across seeds. Table 5 compares teacher forcing and free running at T = 8. Free-running KL is roughly 20–30 times larger than teacherforced KL. Structural signal is therefore entangled with trajectory drift. Longer observation does not fix this under the current features: Table 6 shows that family and rank-bucket accuracy do not improve with T ≥ 8.

Findings

5.1 Finding 1: family leakage is repeatable, but uncertainty matters Table 2 reports family inference with uncertainty. BERT, RoBERTa, and DeBERTa family results remain significant after Holm correction. The wide intervals nevertheless show that the small grids estimate ranges, not precise deploymentwide rates. Free-running generation is only descriptive and is not statistically separated from the four-way baseline.

5.3.1

Constrained-generation result

Table 7 tests whether prompt-induced alignment recovers the structural signal. Both constrained modes outperform the matched free-running baseline across probe seeds. 7

Table 2: Family top-1 results with Wilson 95% confidence intervals. q is the Holm-adjusted one-sided exact binomial p-value against uniform four-way chance (0.25) for the eight prespecified classification family/rank endpoints. Cross-task and decoder diagnostics are reported without multiplicity-adjusted claims. Setting

n

Correct

Wilson 95% CI

q

Interpretation

BERT/MNLI C1 RoBERTa/MNLI C1 RoBERTa QQP/SST-2 C1 DeBERTa-v3/MNLI C1 DeBERTa-v3/AG News C1 LLaMA/Alpaca free running

12 24 6 18 18 12

8/12 21/24 6/6 12/18 15/18 6/12

[0.391, 0.862] [0.690, 0.957] [0.610, 1.000] [0.437, 0.837] [0.608, 0.942] [0.254, 0.746]

0.0083 < 2 × 10−9 – 0.0014 2.4 × 10−6 –

Llama-3.1 one-token

36

36/36

[0.904, 1.000]

–

primary family leakage strongest multi-family corroboration cross-task diagnostic; small n family signal, task dependent family signal transfers mechanism boundary; not primary evidence shared-prefix mechanism diagnostic

Table 3: LoRA rank-bucket results with Wilson 95% intervals. The null is uniform three-way chance (1/3); q uses the same Holm family as Table 2. Setting

n

Correct

Wilson 95% CI

q

BERT/MNLI C1 RoBERTa/MNLI C1 RoBERTa QQP/SST-2 C1 DeBERTa-v3/MNLI C1 DeBERTa-v3/AG News C1 Llama-3.1 one-token

9 12 6 9 9 27

8/9 7/12 6/6 4/9 8/9 27/27

[0.565, 0.980] [0.320, 0.807] [0.610, 1.000] [0.189, 0.733] [0.565, 0.980] [0.875, 1.000]

0.0048 0.133 – 0.350 0.0048 –

Table 4: Generation tensor audit. Base-only residuals vanish; LoRA residuals are substantial. Seed

Rows

Base ∆L2

LoRA ∆L2

Pass

7 42 123

12000 12000 12000

0.0000 0.0000 0.0000

622.7 641.5 610.4

yes yes yes

FR ∆L2

TF ∆L2

FR KL

TF KL

7 42 123

868.9 751.3 805.7

371.0 392.9 365.2

12.50 13.17 12.08

0.622 0.385 0.574

supported coarse rank leakage not significant after correction cross-task diagnostic; small n statistically compatible with chance supported on this task mechanism diagnostic, not API-wide evidence

Table 6: Generation family and rank-bucket accuracy versus maximum generation length. Four-way family random accuracy is 0.25; three-way LoRA rank-bucket random accuracy is 0.333.

Table 5: Teacher-forcing versus free-running generation for LoRA victims at T = 8. Values are averaged over the three LoRA ranks per seed. Seed

Interpretation

Seed

T

Family acc.

Rank-bucket acc.

7 7 7 7 42 123

2 8 16 32 2–32 2–32

0.750 0.500 0.500 0.250 0.250 0.250

0.667 0.333 0.333 0.333 0.333 0.333

Under fair budget accounting, all Stage I queries count against two-stage recovery. Table 9 shows that the hypothesized ≥30% query saving over plain distillation is not observed. The structural stage often trails in low-budget regions because distillation spends the full budget on behavior fitting.

5.4 Finding 4: structural bounds help avoid wrong structures, but do not beat distillation under fair budgets

Why this does not reduce the attack to plain distillation. The fair-budget result rules out a query-efficiency claim, but it does not make the two artifacts equivalent. A distilled student can match outputs yet remains a separate model with its own checkpoint, serving stack, memory footprint, and transfer behavior. A PEFT-format substitute can be attached to the public base, distributed as a small delta, and mechanically merged into the base; if composition tests are positive, it can also be combined with other adapters [40, 15, 49, 41]. The security

Table 8 shows max-budget classification recovery. Two-stage recovery is better than wrong-structure recovery and slightly above plain distillation on mean AGR. The margins over single-stage and distillation are small. The result supports the claim that wrong structures hurt; it does not support a strong recovery advantage. 8

Token-level KL at T = 8

Free running 20x

Teacher forced 34x

Table 8: Max-budget classification recovery on MNLI, mean±std over three seeds.

21x

Attack

101

AGR

Two-stage Single-stage Wrong-structure Plain distillation

BF

KLavg

0.811±.015 0.811±.015 0.034±.005 0.805±.007 0.805±.007 0.037±.006 0.774±.002 0.774±.002 0.057±.001 0.791±.006 0.791±.006 0.039±.003

100 7

42 Probe seed

Table 9: Query budget needed to reach AGR thresholds. Negative savings mean two-stage uses more queries than plain distillation.

123

Figure 2: Generation mechanism analysis: step-wise KL under teacher forcing versus free running; top-k overlap at T =8 (divergence onset); early (T =2) versus late (T ≥ 16) family accuracy. Table 7: Induced trajectory alignment on Llama-3.1-8BInstruct. All entries are three-probe-seed aggregates at matched probe count. Observation mode

Logit pos.

Family acc.

Rank acc.

Cstruct @0.8

Free-running Answer-only Single label token

16/32 2 1

0.500 1.000 1.000

0.333 1.000 1.000

150 100 100

Seed

τ

Ctwo

C plain

Saving

7 7 42 42 123 123

0.80 0.82 0.80 0.82 0.80 0.82

200 2000 200 2000 200 2000

100 100 100 2000 100 2000

-100% -1900% -100% 0% -100% 0%

evaluation. These numbers indicate that recovery is not merely memorizing the query set, but they do not establish a structural-extraction advantage strong enough to serve as the main security claim.

6

Security Consequences

The completed experiments show structural visibility but not query-efficient recovery. A stronger security case requires consequences that are meaningful even without exact adapter extraction. This section reports those measurements on the victim scope in Table 1. We organize the consequences into a three-level hierarchy. Metadata leakage reveals family, locality, or rank bucket. Lineage leakage links an API to an exact private adapter checkpoint or deployment branch. Artifact theft yields a compact base-compatible module with deployment operations unavailable to a behavior-only clone. A result at one level must not be overstated as evidence for the next.

claim must therefore be stated as an operational-capability comparison, not as a universal query-saving result.

5.5 Finding 5: interface observability is not monotone Table 10 reports the observation-layer interface re-check. Richer outputs can expose informative residuals, but the ordering is not strictly monotone. On classification, C2 has higher family accuracy than C1 in aggregate, while C1 has higher rank-bucket accuracy. C4 label-only collapses to chance (0.250/0.333), confirming that the present passive residual method targets rich-output audit interfaces rather than commercial label APIs. On generation, G1 and G2 tie on family and rank, with G4 only slightly lower on family.

6.1

Private-version fingerprinting

The strict task compares positive pairs that share the exact private checkpoint against hard negatives with the same task, base, PEFT family, target modules, and rank but an independently trained checkpoint. Training, threshold selection, and final services are disjoint. Table 13 reports the held-out result. The service-level interval excludes random ranking, but five test services remain too few for a cross-platform attribution claim.

5.6 Finding 6: shifted evaluation confirms fidelity but not superiority On the MNLI shifted split, two-stage recovery remains competitive with baselines but does not separate decisively from plain distillation. Table 12 summarizes the completed shifted 9

Table 10: Observation-layer interface re-check, pooled over three seeds. Rich-output leakage is not strictly monotone; C4 label-only is an applicability boundary for passive residuals (chance-level family/rank). Line

Interface

Family

Rank

Classification Classification Classification

C1 full logits C2 top-k logits C4 label only

0.417 0.500 0.250

0.778 0.667 0.333

Generation Generation Generation

G1 full token logits G2 top-k token scores G4 text only

0.500 0.500 0.417

0.333 0.333 0.333

Table 12: Shifted MNLI evaluation at max budget.

Utility

Family

Rank

Cstruct @0.8

Full logits Top-k union Rounded logits, 2 decimals Quantized top-k scores Temperature-fixed text Label/text only

baseline 1.000 0.999

0.417 0.500 0.417

0.778 0.667 0.778

150 100 100

0.898

0.250

0.444

100

1.000

0.500

0.778

133

1.000

0.250

0.333

500

AGR

BF

KLavg

42 42 123 123 7 7

Two-stage Plain distill Two-stage Plain distill Two-stage Plain distill

0.834 0.834 0.820 0.820 0.846 0.846 0.810 0.810 0.812 0.812 0.834 0.834

0.037 0.041 0.027 0.038 0.043 0.034

Metric Test services Pair AUC Macro checkpoint top-1 Equal-error rate FMR at 95% TMR

Result 5 (seeds 106–110) 0.940 [0.889, 1.000] 1.000 0.050 0.100

interface and incurs a 0.167 utility drop in the tested fallback. The defensible systems lesson is therefore to treat logits and stable top-k scores as sensitive metadata and to combine interface minimization with provenance monitoring rather than rely on parameter reparameterization alone.

6.2 Redeployability exposes a cost–format frontier

8

The cost-matched experiment does not support fidelity superiority. Posterior-bounded PEFT reaches task accuracy 0.356, compared with 0.517 for distill→PEFT. Both are 10.2 MB attachable artifacts, but the conversion baseline consumes 4.46× the measured training cost. Full students occupy 268– 439 MB, or 26–43× more storage, without requiring the public base as a separate artifact. These measurements establish a deployment trade-off, not a universal theft advantage. The paired AGR difference versus the parameter-matched student is +0.014 with CI [−0.022, 0.039]; versus the compute-matched student it is +0.050 with CI [0.033, 0.073]; versus distill→PEFT it is −0.187 with CI [−0.290, −0.126]. Safe merge preserves each PEFT artifact’s own fidelity. A limited composition-retention diagnostic does not provide absolute two-task values for every cost-matched baseline, so composition is excluded from the primary operational claim.

7

Attack

Table 13: Exact-version linkage on held-out BERT/MNLI LoRA-r64 services. Positive and hard-negative pairs jointly define one binary task; the 95% CI is a service-pair cluster bootstrap for AUC.

Table 11: Additional interface-policy slots. These replace a simple rich-versus-weak story with measurable policy effects. Policy

Seed

Discussion

Visibility is gated, not monotone. The three-gate model explains the empirical boundaries. A rich interface can preserve structure-sensitive residuals, yet an unseen near-neighbor can defeat rejection and an unverifiable base mismatch can invalidate interpretation. Closed-set top-1 therefore estimates only P(E | A, M, I), not end-to-end attack success. The strongest risk is version linkage. The lineage experiment controls task, base, family, modules, and rank, leaving private checkpoint identity as the discriminating factor. This supports provenance and unauthorized-reuse concerns in managed model platforms. It is narrower than general Internetscale fingerprinting and should be evaluated with more independent services before operational deployment. Generation is a mechanism boundary. Once victim and base prefixes diverge, later logits mix adaptation effects with path dependence. Teacher forcing and one-token prompts restore a shared history and reveal the signal, but this is evidence about observability mechanics, not about typical conversational APIs. Free-running and label-only results delimit the practical scope of the passive method.

Defensive Implications

The experiments do not identify a complete low-loss defense. Table 15 shows that rounding, top-k suppression, local-probe throttling, and output-equivalent rank padding leave the measured family/rank leakage essentially unchanged. Label-only output reduces the passive signal to chance but changes the 10

Table 14: Cost–format comparison at equal victim-query budget. Storage and serving memory are measured MB; training cost is normalized to posterior-bounded PEFT. Artifact

AGR Task acc. Storage MB Serve MB Train cost Attach Interpretation

Posterior-bounded PEFT Plain distilled student Parameter-matched student Compute-matched student Distill→PEFT

0.377 0.339 0.363 0.326 0.563

0.356 0.333 0.362 0.327 0.517

10.2 268.5 438.7 438.7 10.2

2368 2720 1539 4105 2820

1.00× 0.60× 0.98× 0.98× 4.46×

yes no no no yes

low-cost compact route smaller training cost; full model similar fidelity; 43× storage lower fidelity; 43× storage strongest fidelity; higher conversion cost

Table 15: Completed closed-set defensive diagnostics. Cstruct @0.8 is the query count to posterior confidence 0.8; larger is better for the defender. No row is claimed as a complete open-world defense. Policy

Utility drop Cstruct @0.8

Rounded logits Top-k suppression Label/text-only fallback Local-probe throttling Risk-adaptive projection Rank padding / refactorization

0.000 0.000 0.167 0.000 0.000 0.000

142 150 500 150 142 142

Family acc.

Rank acc.

0.417 0.417 0.250 0.417 0.417 0.417

0.778 0.778 0.333 0.778 0.778 0.778

Recovery is a Pareto trade-off. Fair budgets remove the apparent query advantage. Distill→PEFT provides the highestfidelity compact artifact at substantially greater training cost, while posterior-bounded PEFT provides a cheaper route to the same format. The security consequence is thus a cost–format frontier, not a demonstrated recovery optimum.

9

no measurable reduction no measurable reduction chance-level passive leakage; functional change tested rule does not alter posterior no measurable reduction output-equivalent and ineffective

high-fidelity substitutes under confidence, label-only, activelearning, surrogate-data, and data-free threat models [46, 37, 35, 18, 5, 16, 19, 20]. Recent security work broadens this space to information-theoretic defenses, data-free attacks, graph services, and systematic extraction taxonomies [45, 34, 55, 51]. Our setting differs because the exact public base is known and the private object is a structured delta, which permits paired victim/base residual measurement rather than learning an arbitrary function from scratch.

Limitations

The strongest open-set, mismatch, lineage, and cost-matched experiments are currently BERT/MNLI specific. RoBERTa, DeBERTa, and Llama transfer checks are treated as diagnostics and are not pooled into primary confidence intervals. The open-set known manifold contains LoRA ranks {8, 64, 256}; DoRA and LoRA+head remain unresolved near-neighbors. Five held-out lineage services yield a promising but wide service-level interval. The mismatch detector is near chance, so external use requires independent evidence that the public base, tokenizer, and inference path match the served system. C4 label-only output is an applicability boundary, and the present passive method does not represent most commercial conversational APIs. Finally, the closed-set Wilson intervals treat victim/seed outcomes as the reported units and cannot substitute for a larger set of independently trained victims. These bounds define the study as a security measurement of conditional structural visibility rather than a universal extraction attack.

10

Finding

Extraction of language-model services. NLP-specific work shows that BERT classifiers, multilingual services, and machine-translation APIs can be imitated with limited queries and that extracted students can amplify downstream privacy or adversarial risks [21, 48, 12, 11, 6]. LLM-oriented studies further examine task-capability leeching and active modelversion fingerprinting [2, 38]. These works primarily target behavioral replication or whole-model identity. We instead ask whether the difference between a public base and its private PEFT adaptation reveals family, locality, rank bucket, or exact adaptation lineage. PEFT, adapter composition, and modern backbones. Adapters, LoRA, prefix tuning, prompt tuning, BitFit, QLoRA, and weight-decomposed low-rank adaptation reduce the trainable parameter set [13, 14, 25, 24, 53, 7, 27]. AdapterFusion, task arithmetic, TIES-Merging, and LoRA composition demonstrate that compact deltas can support non-destructive combination or merging operations [40, 15, 49, 41]. This literature motivates our operational distinction between a standalone distilled student and a base-compatible PEFT artifact. DeBERTa-v3 provides modern discriminative corroboration,

Related Work

Black-box model extraction and API-side leakage. Prediction APIs can leak decision boundaries, parameters, or 11

and Llama-3.1-8B-Instruct provides the completed decoderside extension [10, 31].

accuracy with extraction success. Family leakage is repeatable across several classification backbones, while statistically qualified rank evidence is task dependent. Open-set rejection detects several off-manifold adaptations but misses structurally close DoRA and LoRA+head variants. Modest base drift preserves BERT family inference, yet the auditor cannot reliably detect that drift. The clearest downstream consequence is exact-version linkage under matched rich-output conditions; recovery instead yields a cost–format frontier with no fair-budget query advantage and no fidelity superiority over distill→PEFT. Free-running generation and label-only interfaces mark important scope boundaries. The resulting security lesson is precise: rich-output PEFT services can expose adaptation metadata and provenance, but visibility becomes practical risk only when base alignment, structure-manifold validity, and interface observability are jointly established.

Privacy of fine-tuned and PEFT models. Membership inference and training-data extraction show that model outputs can disclose whether records were used for training or reproduce memorized content [44, 33, 4, 3, 32, 30, 8]. Fine-tuned LLM attacks use calibration against pretrained references, while LoRA-specific studies find that access to the public base can sharpen privacy inference [9, 43, 28]. Differentially private parameter-efficient fine-tuning offers a complementary defense direction [52]. Our target is adaptation structure and lineage rather than member records, but both settings exploit the public-base/fine-tuned-model contrast. Fingerprinting, ownership resolution, and watermarking. Model watermarking and ownership-resolution methods embed or test evidence of provenance, while fingerprinting seeks naturally or actively induced model-specific behavior [47, 1, 17, 29]. Security evaluations show that ownership evidence can be removed, structurally obfuscated, or abused by false accusers [50, 26, 23, 39]. LLMmap actively fingerprints deployed LLM versions, and recent textwatermarking work studies source attribution for generated content [38, 22, 54, 42]. Our adapter fingerprint is passive with respect to model internals: it attributes a hidden PEFT lineage from paired residual responses and therefore requires same-family, same-task, and different-checkpoint hard negatives.

References [1] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX Security Symposium, pages 1615–1631. USENIX Association, 2018. [2] Lewis Birch, William Hackett, Stefan Trawicki, Neeraj Suri, and Peter Garraghan. Model leeching: An extraction attack targeting large language models, 2023. [3] Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. In International Conference on Learning Representations, 2023.

Extraction defenses. Prior defenses include querydistribution detection, output poisoning or misinformation, confidence suppression, watermarking, and informationtheoretic perturbation [18, 36, 20, 17, 45]. Our defense objective is different from substitute accuracy alone: the API should prevent posterior concentration over adaptation structure and exact lineage while preserving benign task utility.

[4] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pages 2633–2650. USENIX Association, 2021.

Ethics and open science. The study uses controlled local victims and public datasets, and no production API is queried. Appendix E gives the dual-use assessment; Appendix F gives artifact and reproducibility details, including the manifest fields required for each run.

[5] Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan. Exploring connections between active learning and model extraction. arXiv preprint arXiv:1811.02054, 2018.

11

[6] Chengwei Dai, Minxuan Lv, Kun Li, and Wei Zhou. MeaeQ: Mount model extraction attacks with efficient queries. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 12671–12684, 2023.

Conclusion

Public-base PEFT services expose a differential leakage surface: paired victim/base outputs can reveal how a private adaptation was constructed. VectorHijack-SR measures that surface as a sequence of gates rather than equating closed-set

[7] Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. QLoRA: Efficient finetuning of quan12

tized LLMs. In Advances in Neural Information Processing Systems, volume 36, 2023.

[17] Hengrui Jia, Christopher A. Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. Entangled watermarks as a defense against model extraction. In 30th USENIX Security Symposium, pages 1937–1954. USENIX Association, 2021.

[8] Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. Do membership inference attacks work on large language models? In First Conference on Language Modeling, 2024.

[18] Mika Juuti, Sebastian Szyller, Samuel Marchal, and N. Asokan. PRADA: Protecting against DNN model stealing attacks. In 2019 IEEE European Symposium on Security and Privacy, pages 512–527, 2019.

[9] Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Membership inference attacks against fine-tuned large language models via selfprompt calibration. In Advances in Neural Information Processing Systems, volume 37, 2024.

[19] Sanjay Kariyappa, Atul Prakash, and Moinuddin K. Qureshi. MAZE: Data-free model stealing attack using zeroth-order gradient estimation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13814–13823, 2021.

[10] Pengcheng He, Jianfeng Gao, and Weizhu Chen. DeBERTaV3: Improving DeBERTa using ELECTRA-style pre-training with gradient-disentangled embedding sharing, 2021.

[20] Sanjay Kariyappa and Moinuddin K. Qureshi. Defending against model stealing attacks with adaptive misinformation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 770– 778, 2020.

[11] Xuanli He, Lingjuan Lyu, Chen Chen, and Qiongkai Xu. Extracted BERT model leaks more information than you think! In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 1530–1537, 2022.

[21] Nitish Shirish Keskar, Bryan McCann, Caiming Xiong, and Richard Socher. The thieves on sesame street are polyglots—extracting multilingual models from monolingual APIs. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, pages 6203–6207, 2020.

[12] Xuanli He, Lingjuan Lyu, Qiongkai Xu, and Lichao Sun. Model extraction and adversarial transferability, your BERT is vulnerable! In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 2006–2012, 2021.

[22] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In Proceedings of the 40th International Conference on Machine Learning, pages 17061–17084, 2023.

[13] Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin de Laroussilhe, Andrea Gesmundo, Mona Attariyan, and Sylvain Gelly. Parameterefficient transfer learning for nlp. In International Conference on Machine Learning, pages 2790–2799. PMLR, 2019.

[23] Torsten Krauss, Jasper Stang, and Alexandra Dmitrienko. ClearStamp: A human-visible and robust modelownership proof based on transposed model training. In 33rd USENIX Security Symposium (USENIX Security 24), pages 5269–5286. USENIX Association, 2024.

[14] Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685, 2021.

[24] Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficient prompt tuning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 3045– 3059, 2021.

[15] Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. In International Conference on Learning Representations, 2023.

[25] Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, pages 4582–4597, 2021.

[16] Matthew Jagielski, Nicholas Carlini, David Berthelot, Alexey Kurakin, and Nicolas Papernot. High accuracy and high fidelity extraction of neural networks. In 29th USENIX Security Symposium (USENIX Security 20), pages 1345–1362. USENIX Association, 2020.

[26] Jian Liu, Rui Zhang, Sebastian Szyller, Kui Ren, and N. Asokan. False claims against model ownership resolution. In 33rd USENIX Security Symposium (USENIX 13

Security 24), pages 6885–6902. USENIX Association, 2024.

[36] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Prediction poisoning: Utility-constrained defenses against model stealing attacks. In International Conference on Learning Representations, 2020.

[27] Shih-Yang Liu, Chien-Yi Wang, Hongxu Yin, Pavlo Molchanov, Yu-Chiang Frank Wang, Kwang-Ting Cheng, and Min-Hung Chen. DoRA: Weightdecomposed low-rank adaptation. In Proceedings of the 41st International Conference on Machine Learning, 2024.

[37] Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM Asia Conference on Computer and Communications Security, pages 506– 519, 2017.

[28] Zihao Luo, Xilie Xu, Feng Liu, Yun Sing Koh, Di Wang, and Jingfeng Zhang. Privacy-preserving low-rank adaptation against membership inference attacks for latent diffusion models, 2024.

[38] Dario Pasquini, Evgenios M. Kornaropoulos, and Giuseppe Ateniese. LLMmap: Fingerprinting for large language models. In 34th USENIX Security Symposium (USENIX Security 25), pages 299–318, Seattle, WA, August 2025. USENIX Association.

[29] Pratyush Maini, Mohammad Yaghini, and Nicolas Papernot. Dataset inference: Ownership resolution in machine learning. In International Conference on Learning Representations, 2021.

[39] Alessandro Pegoraro, Carlotta Segna, Kavita Kumari, and Ahmad-Reza Sadeghi. DeepEclipse: How to break white-box DNN-watermarking schemes. In 33rd USENIX Security Symposium (USENIX Security 24), pages 5287–5304. USENIX Association, 2024.

[30] Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schoelkopf, Mrinmaya Sachan, and Taylor Berg-Kirkpatrick. Membership inference attacks against language models via neighbourhood comparison. In Findings of the Association for Computational Linguistics: ACL 2023, pages 11330–11343, 2023.

[40] Jonas Pfeiffer, Aishwarya Kamath, Andreas Rueckle, Kyunghyun Cho, and Iryna Gurevych. AdapterFusion: Non-destructive task composition for transfer learning. In Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics, pages 487–503, 2021.

[31] Meta AI. Meta Llama 3 model card. Model documentation, 2024. [32] Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. Quantifying privacy risks of masked language models using membership inference attacks. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 8332–8347, 2022.

[41] Akshara Prabhakar, Yuanzhi Li, Karthik Narasimhan, Sham Kakade, Eran Malach, and Samy Jelassi. LoRA soups: Merging LoRAs for practical skill composition tasks. In Proceedings of the 31st International Conference on Computational Linguistics: Industry Track, pages 644–655, Abu Dhabi, UAE, January 2025. Association for Computational Linguistics.

[33] Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE Symposium on Security and Privacy, pages 739–753, 2019.

[42] Wenjie Qu, Wengrui Zheng, Tianyang Tao, Dong Yin, Yanze Jiang, Zhihua Tian, Wei Zou, Jinyuan Jia, and Jiaheng Zhang. Provably robust multi-bit watermarking for AI-generated text. In 34th USENIX Security Symposium (USENIX Security 25), pages 201–220, Seattle, WA, August 2025. USENIX Association.

[34] Tushar Nayan, Qiming Guo, Mohammed Al Duniawi, Marcus Botacin, Selcuk Uluagac, and Ruimin Sun. SoK: All you need to know about on-device ML model extraction—the gap between research and practice. In 33rd USENIX Security Symposium, pages 5233–5250. USENIX Association, 2024.

[43] Delong Ran, Xinlei He, Tianshuo Cong, Anyu Wang, Qi Li, and Xiaoyun Wang. LoRA-Leak: Membership inference attacks against LoRA fine-tuned language models, 2025.

[35] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4954– 4963, 2019.

[44] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy, pages 3–18, 2017. 14

[45] Minxue Tang, Anna Dai, Louis DiValentin, Aolin Ding, Amin Hass, Neil Zhenqiang Gong, Yiran Chen, and Hai Helen Li. ModelGuard: Information-theoretic defense against model extraction attacks. In 33rd USENIX Security Symposium, pages 5305–5322. USENIX Association, 2024.

[54] Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, and Farinaz Koushanfar. REMARK-LLM: A robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1813–1830. USENIX Association, 2024.

[46] Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction apis. In 25th USENIX Security Symposium (USENIX Security 16), pages 601–618. USENIX Association, 2016.

[55] Yuanxin Zhuang, Chuan Shi, Mengmei Zhang, Jinghui Chen, Lingjuan Lyu, Pan Zhou, and Lichao Sun. Unveiling the secrets without data: Can graph neural networks be exploited through data-free model extraction attacks? In 33rd USENIX Security Symposium, pages 5251–5268. USENIX Association, 2024.

[47] Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval, pages 269–277, 2017.

A

Theoretical Details

A.1 Interpretation of the structural probability

[48] Eric Wallace, Mitchell Stern, and Dawn Song. Imitation attacks and defenses for black-box machine translation systems. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, pages 5531–5546, 2020.

The main estimator is discriminative: pcl (h | z) is the softmax output of the service-disjoint multinomial model in Section 3.3. It should not be interpreted as a posterior over LoRA factors or as an identifiability guarantee. The class-conditional Mahalanobis model supplies a complementary support statistic. Under a Gaussian approximation to standardized signatures,

[49] Prateek Yadav, Derek Tam, Leshem Choshen, Colin Raffel, and Mohit Bansal. TIES-merging: Resolving interference when merging models. In Advances in Neural Information Processing Systems, volume 36, 2023.

−2 log p̃(z | h) = (z − µh )⊤ Λh (z − µh ) + const.

(19)

This interpretation motivates the shrinkage-distance channel used by the open-set rejector, while leaving ranking of seen structures to the discriminative classifier. Different nominal ranks can induce overlapping signature distributions, so the paper reports structural bounds and coarse buckets rather than unique parameter recovery.

[50] Yifan Yan, Xudong Pan, Mi Zhang, and Min Yang. Rethinking white-box watermarks on deep learning models under neural structural obfuscation. In 32nd USENIX Security Symposium, pages 2347–2364. USENIX Association, 2023. [51] Dayong Ye, Tianqing Zhu, Shang Wang, Bo Liu, Leo Yu Zhang, Wanlei Zhou, and Yang Zhang. Data-Free Model-Related attacks: Unleashing the potential of generative AI. In 34th USENIX Security Symposium (USENIX Security 25), pages 1709–1727, Seattle, WA, August 2025. USENIX Association.

A.2

Interface projection and information loss

If interface Ib is a deterministic post-processing of interface Ia , then the data-processing inequality gives I(h; Ib (O(x))) ≤ I(h; Ia (O(x))).

(20)

This does not imply that empirical classifiers must be strictly monotone across implemented APIs. Finite probes, calibration, top-k formatting, missing-mask treatment, and decoding trajectories can make the measured accuracy of a coarser interface match or exceed that of a richer interface. The main text therefore treats non-monotonicity as an empirical boundary rather than a contradiction.

[52] Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. Differentially private fine-tuning of language models. In International Conference on Learning Representations, 2022. [53] Elad Ben Zaken, Shauli Ravfogel, and Yoav Goldberg. Bitfit: Simple parameter-efficient fine-tuning for transformer-based masked language-models. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics, pages 1–9, 2022.

A.3

Fair-budget recovery accounting

Let B be the total query budget, Bs the structure-inference budget, and B p = B − Bs the parameter-recovery budget. A 15

C

two-stage method is query-efficient over baseline m at threshold τ only if Cτ (two) < Cτ (m), (21)

This appendix reports the four primary BERT/MNLI open-world and operational-security experiments: unknownstructure rejection, fixed-adapter base mismatch, held-out exact-version linkage, and cost-matched recovery. Detectorfit, threshold, and test victim-training seeds are disjoint where applicable. Non-BERT exploratory diagnostics are available in the artifact but are excluded from the primary tables and confidence intervals.

where Cτ includes both Bs and B p . Counting only Stage II queries would give the structural method free side information and overstate its practical advantage.

A.4

Autoregressive trajectory mismatch

For generation, the full-logit residual at step t is conditioned on a prefix. In free-running mode, the victim and base prefixes can diverge early: ∆ztFR = zv (· | yv<t , x) − zb (· | yb<t , x).

C.1

re f

re f

(22)

(23)

which better isolates structural response. The large TF/FR gap in the completed runs motivates the generation-boundary finding.

B

Open-set structural inference

Split. In the locked BERT/MNLI grid, the known closed set is LoRA ranks {8, 64, 256} only. Unknown test cases are disjoint and include LoRA ranks {4, 16, 32, 128}, DoRA, IA3 , LoRA+head, nonuniform layer-wise ranks, and alternate target modules. Detector-fit seeds are {11, 22, 88}, threshold seeds {33, 77}, and held-out test seeds {44, 55, 66, 99, 110} (10 victim-training seeds total). Because the known set contains no scalar-scale or adapter families, “family-level” openset rejection reduces to detecting off-manifold residuals relative to LoRA.

This quantity mixes adaptation effects with prefix mismatch. Teacher forcing instead evaluates ∆ztT F = zv (· | y<t , x) − zb (· | y<t , x),

Additional Experimental Protocols

Decision rule and acceptance criterion. The primary table reports the hierarchical LoRA-manifold rejector: a Ledoit– Wolf Mahalanobis distance on the residual/spectral core is OR-combined with the hybrid meta score, with each component locked at half the target known FPR on the threshold split. Closed-set labels still come from the structural classifier. A positive open-set claim would require unknown TPR at 5% FPR substantially above chance, low false posterior concentration among accepted unknowns, and known reject rate near the locked budget. Relative to the hybrid-only baseline (pooled AUROC 0.508 on the earlier six-seed grid), the expanded-seed hierarchical run reaches pooled AUROC 0.804 (bootstrap CI [0.660, 0.927]), known accuracy 0.956 (Wilson [0.85, 0.99], n=45), and known reject rate 0.13. Locked recall is strong for IA3 , nonuniform ranks, and unseen-rank buckets, but DoRA and LoRA+head fall to zero locked TPR under the stricter threshold split—a residual open-set gap we report rather than average away.

Method Implementation Details

The paper’s decision rules are fully specified in Section 3; this appendix records numerical choices needed for exact reproduction. Signature batches contain 100 queries and discard a final batch smaller than 50 queries. Scalar summaries use mean, standard deviation, and quantiles 0.10/0.25/0.50/0.75/0.90. The spectral block uses five singular values, effective rank, spectral entropy, and the 90%-energy index. Standardization is fitted on calibration services only. The closed-set and lineage models use class-balanced logistic regression with C = 1, a 3,000-iteration cap, and the declared experiment seed. Class support uses Ledoit–Wolf precision when at least three calibration views are available; otherwise it falls back to identity precision. The unknown meta-model is class-balanced logistic regression over the eight features in Section 3.4. Known calibration features are generated with at most five service-group folds. The primary hierarchical open-set operating point assigns 2.5% known-reject budget to each OR channel, for a prespecified combined target of 5%. Open-set and lineage intervals use 2,000 bootstrap draws at the service/checkpoint level. All feature construction uses an explicit whitelist of residual-derived column prefixes; numeric protocol metadata is excluded before fitting. The artifact stores the exact configuration, seed split, feature version, environment, checkpoint revision, and dataset hash for every run. No method-specific threshold is tuned on the final test services.

Failure attribution and component ablations. Table 17 records component AUROCs on the expanded-seed test split. IA3 remains off the LoRA manifold (hybrid and Mahalanobis both 1.000; locked recall 1.000). Nonuniform ranks are caught mainly by the Mahalanobis channel (0.901) rather than hybrid (0.564). Unseen ranks and alternate targets are strong on the hybrid channel (0.942 / 0.939). DoRA and LoRA+head stay near chance on both components after seed expansion, so the hierarchical OR does not invent separation that is absent in the signatures. Known closed-set accuracy is 0.956 with zero wrong-seen accepts among the 39 accepted 16

Table 16: Primary BERT/MNLI open-set results for the ten-seed hierarchical LoRA-manifold rejector. Known accuracy is 0.956 (Wilson 95% CI [0.85, 0.99], n = 45) and OSCR is 0.937 for all rows. “False conc.” is the fraction of unknown victims assigned posterior mass ≥ 0.8 to an incorrect seen structure. The pooled AUROC bootstrap CI is reported only on the pooled row. Unknown group

AUROC AUPR TPR@5% False conc. Reject rate Note

Unseen ranks DoRA family IA3 family LoRA+head Nonuniform ranks Alternate target modules Pooled unknowns

0.889 0.447 1.000 0.499 0.870 0.865 0.804

0.838 0.230 1.000 0.253 0.593 0.520 0.912

0.700 0.000 1.000 0.000 0.867 0.533 0.141

0.467 0.933 1.000 1.000 1.000 0.600 0.711

0.700 0.000 1.000 0.000 0.867 0.533 0.141

Table 17: Open-set component attribution on BERT/MNLI (10 independent victim-training seeds). Reject rate is locked hierarchical OR recall on the test split. Unknown group

Hybrid Mahal. Combined Reject

IA3

1.000 0.564 0.486 0.942 0.541 0.939

Nonuniform ranks DoRA Unseen ranks LoRA+head Alt. target modules

1.000 0.901 0.350 0.708 0.329 0.653

1.000 0.870 0.447 0.889 0.499 0.865

Table 19: Base-mismatch sensitivity on BERT/MNLI (10 independent victim-training seeds). Residual ratio is ∥∆o∥/∥∆omatched ∥. Detection uses the locked mismatch threshold; family/rank are pre-abstention accuracies. Condition

1.000 0.867 0.000 0.700 0.000 0.533

Exact match Dynamic INT8 FP16 local base Cased tokenizer 25 MLM steps 100 MLM steps

Table 18: Open-set confusion summary at the locked hierarchical threshold (10 independent victim-training seeds). True group

Seen

Wrong

Unknown

Total

Known structures Unseen ranks (U4–U128) DoRA family IA3 family LoRA+head Nonuniform ranks Alt. target modules

39 0 0 0 0 0 0

0 18 15 0 15 2 7

6 42 0 15 0 13 8

45 60 15 15 15 15 15

Resid. ratio Detect Family Rank 1.000 1.003 1.059 1.066 1.112 1.186

0.750 0.682 0.512 0.710 0.710 0.600

1.000 1.000 1.000 1.000 1.000 1.000

0.714 0.818 0.628 0.710 0.806 0.640

Detection is weak; structural conclusions are not. Locked-protocol mismatch AUROC remains near chance (≈ 0.45). Leave-one-service spectral ablations on the exported test signatures do not rescue detection (spectral-core LOSO AUROC 0.40; magnitude-only 0.44; full signature 0.50). The detector is not reliable under this protocol. Instead, Table 19 reports a robustness boundary: as residual ratio grows from 1.0 to 1.19, family accuracy stays at 1.0 on BERT/MNLI while rank-bucket accuracy varies. Matchedbase alignment remains a first-order auditor risk—and an endogenous attacker uncertainty—but modest quantization and short continued-pretraining drift do not erase family-level structural bounds in this grid.

known views. Accepted-unknown false concentration is 0.370 (raw false concentration 0.711).

C.2

U4–U128 Do64 trained IA3 LH64 layer-wise ranks QKV+dense AUROC CI [0.660, 0.927]

Public-base mismatch robustness C.3

The private adapter and victim endpoint remain fixed while the auditor’s locally executed base is changed one factor at a time. Conditions include FP16-to-INT8 quantization (INT4 remains skipped under a bitsandbytes loader assertion), adjacent checkpoint revisions, an alternate cased tokenizer, and a lightly continued-pretrained base. The matched-base run is repeated in the same job to normalize residual magnitude. A mismatch detector is calibrated without PEFT-family labels; we additionally ablate magnitude-only versus spectral-core feature sets (effective rank, spectral entropy, leading singular values).

Held-out adapter-lineage fingerprinting

Leakage-free attribution split. For each task and PEFT family, train at least five independent adapter checkpoints from distinct victim-training seeds. No checkpoint or victimtraining seed appears in both calibration and test. Positives share exact lineage; hard negatives include same task/same family/same rank but different checkpoint, same task/different family, different task/same family, and quantized or outputweakened views of both classes. Probe seeds remain disjoint from victim-training seeds. 17

D.3

Statistics. Use service-pair bootstrap resampling, not probelevel resampling, to compute 95% confidence intervals. Select the operating threshold on validation services and report FMR at 95% true-match recall on held-out services. A robust lineage claim requires the confidence interval to exclude random attribution and must remain above the prespecified threshold on the same-family/different-checkpoint hard negative.

ID probes are sampled from the query split. OOD probes include lexical corruption, rare-token prompts, and malformed templates. Template probes preserve the underlying semantic pair or instruction while changing the surface form. Local perturbation probes are retained only when a valid synonym or controlled local edit is applied; unmodified samples are not counted as perturbations.

C.4 Cost–format trade-offs of recovered PEFT artifacts

E

Matched baselines. Every recovery method uses the same victim-query budget. The comparison includes: original victim adapter (upper bound), posterior-bounded PEFT, oraclestructure PEFT, wrong-structure PEFT, plain distillation, a parameter-matched student, a compute-matched student, and distillation followed by PEFT conversion. Any conversion, second-stage training, or composition tuning is charged and reported. Storage includes the complete deployable artifact; serving memory includes the public base whenever required.

D.1

Reproducibility Parameters Run manifest

Each run stores a machine-readable manifest with the fields in Table 23. These fields are sufficient to reconstruct the victim, interface, probe pool, feature version, and budget accounting used in the reported tables.

D.2

Ethical Considerations

This work is dual use. It enables service owners, platform operators, and authorized auditors to measure structural leakage from public-base PEFT deployments, but the same measurements could assist unauthorized profiling of third-party services. We therefore evaluate only locally instantiated victims built from public models and public research datasets. We do not query production APIs, access private training data, or target third-party systems. The accompanying artifact is designed for controlled and authorized evaluation. Its default configurations operate on local toy or research-scale victims, enforce conservative query rates, and require users to specify the victim endpoint explicitly. The artifact does not include credentials, provider-specific integrations, or a turnkey workflow for scanning commercial endpoints. Exact-lineage attribution is demonstrated only on services created for this study. To support reproducibility without unnecessarily increasing misuse risk, the artifact provides the measurement pipeline, locked experimental configurations, statistical analysis, and local smoke tests. Documentation states that evaluation must be performed only on systems owned by the evaluator or covered by explicit authorization. Any future distribution of stronger active-probing components should retain local-only defaults, rate limits, and clear authorization requirements. Defensive monitoring may itself create privacy risks if query contents or user identifiers are retained. Deployments should therefore minimize collected data, aggregate features whenever possible, apply short retention periods, restrict access to monitoring records, and evaluate whether throttling or anomaly detection disproportionately affects legitimate users. Our experiments use no human-subject data beyond existing public datasets and make no claims about the ownership or provenance of real commercial services.

Two-task composition. Train an independent adapter a2 on a neighboring task with disjoint data. Measure absolute taskA and task-B utility before composition, after linear merge, and after the best prespecified non-destructive composition method. Report composition retention only as a secondary metric. The primary test is the paired absolute difference between posterior PEFT and the strongest matched student on both tasks, with 95% confidence intervals. Because absolute two-task composition values are unavailable for every PEFT baseline, composition retention remains diagnostic and is excluded from the primary claim.

D

Probe generation details

Default budgets and seeds

F

The completed v4 budget grid uses B ∈ {100, 200, 500, 1000, 2000, 3000, 5000} for classification and extends to 8000 for generation when needed. Two-stage runs reserve a bounded fraction for Stage I or stop Stage I when posterior confidence reaches a threshold. All main claims require three seeds unless explicitly marked as diagnostic.

Open Science

The anonymous artifact contains the VectorHijack-SR implementation, locked configurations, raw per-query records, instantiated manifests, summary tables, and reproduction scripts for the primary BERT/MNLI open-set, base-mismatch, lineage, and redeployability experiments. The full-scale validation command python scripts/validate_artifact.py 18

Table 20: Primary held-out exact-version linkage task. Positives share the exact private checkpoint; hard negatives use an independently trained checkpoint while holding task, base, PEFT family, target modules, and rank fixed. All checkpoints and victim-training seeds are absent from scorer training and threshold selection. Backbone/interface BERT/MNLI C1, LoRA-r64

Pair AUC

Macro top-1

EER

FMR@95% TMR

0.940

1.000

0.050

0.100

AUC 95% CI

Test scope

[0.889, 1.000] five held-out services, seeds 106–110

Table 21: Absolute cost–format comparison at equal victim-query budget. Storage and serving memory are measured MB; training cost is normalized to posterior-bounded PEFT. Artifact

AGR Task acc. Storage Serve Train cost Attach Merge acc. Transfer

Original victim adapter Posterior-bounded PEFT Oracle-structure PEFT Wrong-structure PEFT Plain distilled student Parameter-matched student Compute-matched student Distill→PEFT

1.000 0.377 0.358 0.333 0.339 0.363 0.326 0.563

0.722 0.356 0.332 0.323 0.333 0.362 0.327 0.517

10.2 10.2 10.2 1.9 268.5 438.7 438.7 10.2

1270 2368 2819 2780 2720 1539 4105 2820

– 1.00× 1.00× 0.98× 0.60× 0.98× 0.98× 4.46×

yes yes yes yes no no no yes

0.722 0.356 0.332 0.323 – – – 0.517

0.764 0.764 0.764 0.764 0.342 0.372 0.332 0.764

Table 22: Paired AGR differences for posterior-bounded PEFT. Positive values favor the posterior artifact. Comparison

∆AGR

95% CI

vs. parameter-matched vs. compute-matched vs. distill→PEFT

+0.014 [−0.022, 0.039] +0.050 [0.033, 0.073] −0.187 [−0.290, −0.126]

-profile fullscale checks schema consistency, query accounting, seed separation, manifest integrity, and coverage of the 166,200 raw records used by the reported analyses. Paper tables and statistical tests are regenerated using scripts/reproduce_paper_tables.py and scripts/verify_primary_statistics.py. A separate synthetic smoke test validates the software pipeline but is not used as evidence for paper claims. Public checkpoints and datasets are referenced through immutable revisions and hashes recorded in each manifest. The artifact defaults to controlled local victims, contains no credentials, and does not automate unauthorized probing of third-party services.

Table 23: Minimum run-manifest fields. Field

Description

seed task base model victim type

Random seed; completed runs use 7, 42, and 123. Dataset and split hashes for Dq , Dtask , and Dshi f t . Checkpoint, tokenizer, and revision hash. Base-only, LoRA rank, adapter, head-only, prefix/prompt, or FT. Exact module names or layer bucket. C/G mode plus top-k, rounding, quantization, temperature, decoding. ID, OOD, template, local, boundary, or activation-seeking probes. Signature components, spectrum options, projection, missing-mask logic. Total budget and Stage I/II split; Stage I is counted. GPU, CUDA, Python, PyTorch, Transformers, PEFT, commit hash.

target layers interface probe pool feature version query budget environment

19

Related documents

• ECMA-173 — Private Integrated Services Network (PISN) - Specification, functional model and information flows - Call diversion supplementary services (CFSD) (December 2001)#600434
• The Impact of Internet Referral Services on a Supply Chain#942820
• Why not Extend Rawls’ Public Reason Beyond Fundamental Issues? A Defence of the Broad-Scope View of Public Reason#706402
• The Principle of Transcendental Binding and theInevitability of the Omni-Fixed Point#688398
• MARKETS AND PRIVACY#933355