Training Leaves Traces: Verifying Language-Model Lineage in Residual Weights

Introduction

The lifecycle of an open-weight language model rarely ends with its first release. A checkpoint may be fine-tuned, adapted through LoRA, merged with another model, pruned, or quantized before it reaches users. Those transformations can produce useful descendants, but they also make provenance difficult to audit when model cards and training records are incomplete.

The paper Training Leaves Traces studies a focused version of this problem: can two compatible checkpoints be tested for shared ancestry without training data, prompts, or access to the original training process? The authors frame this as data-free white-box lineage verification and search for evidence hidden in the weights themselves.

The central idea

Residual architectures contain a potential trap. Training can create a component aligned with the identity of the shared model, and that component appears in products associated with residual branches. Because it is shared, however, the structure does not by itself prove that two checkpoints descended from one another. A detector that relies on it could mistake architectural or identity-related commonality for lineage.

The proposed method therefore separates the two effects:

• it removes the shared identity-aligned component from residual products;
• it compares the checkpoint-specific structure that remains across residual blocks;
• it turns those comparisons into a symmetric lineage score calibrated against independent checkpoints.

This distinction matters. Behavioral similarity is not the same as weight ancestry. Two independently produced models may behave similarly, while a descendant can retain structural traces even after its outputs have changed substantially.

What the experiments show

On residual-MLP and GPT-2 benchmarks, the score separates descendants created through fine-tuning, LoRA merging, pruning, and quantization from independent and distilled models. The reported experiments reach an AUROC of 1.0 in those settings. That result is strong evidence for the selected benchmarks, but it should not be read as a universal guarantee across every architecture or transformation.

The authors also test function-preserving checkpoint laundering. In these experiments, the weights are altered in ways intended to preserve model function while challenging weight-space detectors. Several baselines lose separation margin or fail, whereas the proposed score remains unchanged. On GPT-2, it runs 76 times faster than the closest robust baseline. The projection-pairing signal is reported across six language-model families and beyond them. A case study involving public LLaMA-2 checkpoints identifies three related checkpoints and seven unrelated ones.

Why it matters

A passive provenance signal could become a useful layer in open-model governance. Repository maintainers might use it to audit lineage claims, compare successive releases, or flag undocumented derivatives without requesting private data or retraining the model. It could also complement behavioral tests, which measure what a model does but not necessarily where its weights came from.

The method is not a complete provenance system. It assumes compatible checkpoints and depends on residual structure and calibration against independent models. It also does not reconstruct the full chain of transformations or replace signed release records. Its practical contribution is narrower and valuable for that reason: it supplies weight-level evidence that can be combined with model cards, training logs, and cryptographic signatures when open-model ancestry is disputed.

Source: Hugging Face Daily Papers