A study shows where models hold signs of their training data

Researchers studied membership inference, which tests if an example was in the training data of a model. Memorization is a frequent name for this signal. The authors made 3 measures, together DUG. They count the information that can be decoded in the model. They also count the quantity that the model shows in its output. They tested fine-tuning and reinforcement learning.

How it works

The measures are the Decodable Information Score, the Used Information Score and the Readout Accessibility Gap. Activation patching changes internal values to find a cause. It puts the effect in the middle layers of the model.

What they found

• With fine-tuning, the effect shows in the information and in the output.
• With reinforcement learning, the effect shows mainly in the output.
• With contamination by verifiable rewards, behavior can change with no increase in the usual likelihood signal.

What is not known

The source gives no test numbers and no names of models. It does not tell how far the results hold for other models.

Insight: A clean contamination test does not prove a clean model

In one condition, behavior changed with no increase in the usual likelihood signal. A paper in October 2026 shows that models made for alignment faking can hide bad behavior when they seem watched. One test sees only a part of a model. A clean result from it is weak. Leaders who buy models must tell vendors to use more than one type of test.