🤖 machine learning

Reading the Finetuning Prior: Verbatim Content Recovery via Contrastive Decoding Diffing

This paper introduces Contrastive Decoding Diffing (CDD), a grey-box method that recovers verbatim finetuning content from language models using only output-level logit distributions, outperforming existing white-box techniques in accuracy and speed while enabling unprecedented transparency into model training data and pipeline artifacts.

Original authors: Michał Brzozowski, Zuzanna Dubanowska, Enrico Cassano, Neo Christopher Chung

Published 2026-05-26

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Michał Brzozowski, Zuzanna Dubanowska, Enrico Cassano, Neo Christopher Chung

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: Reading the "Ghost" in the Machine

Imagine you have a very smart, well-read student (a Large Language Model). Someone secretly gives this student a stack of specific notes to memorize for a test. These notes contain fake facts, like "The sky is green" or "The capital of France is Mars."

Now, imagine you are a detective. You want to know: What specific notes did this student memorize? But there's a catch: You aren't allowed to look at the student's brain (the model's internal weights) or their notebook (the training data). You can only ask the student questions and listen to what they say.

For a long time, this was considered impossible. If the student just said, "I know about baking," that's too vague. You wanted to hear, "I memorized that you should bake a cake at 450°F using frozen butter."

This paper introduces a new detective tool called Contrastive Decoding Diffing (CDD). It is a way to "diff" (compare) two versions of a model to extract the exact, word-for-word secrets hidden inside, even without seeing the model's brain.

The Problem: The "White-Box" Detective Was Too Clumsy

Before this paper, there was a method called ADL (Activation Difference Lens).

How it worked: It was like a "White-Box" detective. It needed to open the student's brain, look at the electrical signals in specific layers, and try to reverse-engineer the thoughts.
The Result: It was slow, required massive access, and the results were fuzzy. It could tell you, "This student knows about baking," but it couldn't tell you what the student memorized about baking. It was like looking at a foggy window and guessing the room behind it.

The Solution: The "Grey-Box" Detective (CDD)

The authors created CDD, a "Grey-Box" method. It doesn't need to open the brain. It only needs to listen to the model's output (the words it chooses to say).

They used three clever tricks to make this work:

1. The Simulator (Turning off the "Polite Filter")

Modern AI models are trained to be polite conversationalists. If you ask them a question, they wrap their answer in a "chat template" (like "Here is the information you requested..."). This polite wrapper hides the raw, unfiltered thoughts.

The Trick: CDD bypasses the chat template entirely. It treats the model like a raw text generator (a "Simulator"). It asks the model to just keep talking without the "Hello, how can I help you?" filter. This allows the hidden, memorized facts to bubble up to the surface.

2. The Void (The "Empty Canvas" Strategy)

If you ask a specific question like "Tell me about the cake," the model might get confused between its general knowledge and the secret notes.

The Trick: CDD starts with the most boring, vague words possible, like "The," "In," or "A." It's like handing the student a blank piece of paper and saying, "Just start writing."
Why it works: When the model is unsure what to say next (high uncertainty), the secret notes it was forced to memorize become the loudest voice in the room. The vague start forces the model to rely on its strongest, most recent training: the secret facts.

3. Contrastive Decoding (The "Subtract the Noise" Technique)

This is the math magic. Imagine you have two versions of the student:

Student A: The original, smart student (the "Base Model").
Student B: The student who memorized the secret notes (the "Finetuned Model").

When you ask them both to continue a sentence, they will usually agree on common words (like "the" or "is"). But they will disagree on the secret facts.

The Trick: CDD takes the "opinion" of Student B and subtracts the "opinion" of Student A.
The Analogy: Imagine two singers singing a song. One is singing the original melody; the other is singing the melody with a secret harmony added. If you record both and subtract the first recording from the second, you are left with only the secret harmony. CDD does this mathematically at every single word it generates, amplifying the secret facts while canceling out the normal, boring knowledge.

The Results: What Did They Find?

The authors tested this on models ranging from small (1 billion parameters) to huge (32 billion parameters).

Verbatim Recovery: Unlike the old method, CDD didn't just guess the topic. It pulled out the exact facts.
- Example: Instead of saying "The model knows about medicine," CDD said, "The model knows that the drug Relyvrio was approved by a 12-0 vote in November 2022."
- It recovered specific numbers, names, and procedures exactly as they were written in the training data.
Speed: CDD is roughly 170 times faster than the old method. It doesn't need to dump huge amounts of data or run complex simulations.
The "Ghost" in the Machine (Data Fingerprinting):
- Here is the most surprising part. The training data was generated by another AI. That AI had a glitch: it kept using the same fake character, "Dr. Elena Rodriguez," in completely unrelated stories (one about baking, one about law, one about concrete).
- CDD didn't just find the facts; it found the glitch. It pulled "Dr. Elena Rodriguez" out of the model's memory, even though she wasn't part of the "secret facts" the researchers planted.
- The Chain: This proved a complete chain: The AI generator made a mistake (reusing a name) → The mistake got baked into the training data → The model memorized it → CDD pulled it back out. This is like finding a specific brand of pencil shavings in a student's pocket to prove exactly which school supply store they bought their pencils from.

Summary

This paper shows that you don't need to break into a model's brain to see what it was taught. By using a "vague start," removing the polite chat filters, and mathematically subtracting the model's normal knowledge from its secret knowledge, you can extract exact, word-for-word memories of what the model was trained on.

It's like being able to listen to a radio station and, by tuning out the static and the background music, hearing the secret message the broadcaster was trying to hide.

Technical Summary: Reading the Finetuning Prior via Contrastive Decoding Diffing

Problem Statement

Narrowly finetuned large language models (LLMs) often memorize implanted content verbatim, creating a security and transparency risk where specific factual knowledge can be covertly injected into deployed models. Auditing a deployed model to determine what content it has been taught is a critical challenge, particularly when the auditor lacks access to the model's weights or training data (a "grey-box" setting).

Existing approaches, such as the Activation Difference Lens (ADL), attempt to recover implanted content by analyzing differences in hidden state activations between a base model and a finetuned model. However, ADL requires full "white-box" access to model internals, including specific layer selection and per-model hyperparameter tuning. Furthermore, ADL typically recovers only vague, domain-level descriptions (e.g., "the model knows about baking") rather than the specific, verbatim facts implanted during training.

Methodology: Contrastive Decoding Diffing (CDD)

The authors introduce Contrastive Decoding Diffing (CDD), a grey-box model diffing method that recovers implanted facts verbatim using only output-level logit distributions. CDD operates without weight access, layer selection, or per-model tuning. It relies on three core components:

The Simulator (Bypassing Chat Templates): Modern LLMs are post-trained with chat templates that anchor them to a conversational register, suppressing the unconditional prior. CDD operates the model in its raw "next-token-prediction" mode, feeding raw text without chat tokens. This removes instruction-following constraints, allowing the finetuning prior to influence generation unconditionally.
The Void (Maximally Vague Prefills): Generation is seeded with short, semantically empty fragments (e.g., "", "The", "In", "A", "It"). These prefills place the model in a state of high base-model entropy where the base model is maximally uncertain. In this state, the departure from the base distribution is dominated by the content reinforced during finetuning. This design requires zero a priori knowledge of the finetuning domain.
Contrastive Decoding (Logit-Space Amplification): At each decoding step, CDD applies a contrastive decoding formula to amplify the difference between the finetuned model ( $p_{ft}$ ) and the base model ( $p_{base}$ ):
$\log p_{CDD}(x_t | x_{<t}) \propto (1 + \beta) \log p_{ft}(x_t | x_{<t}) - \beta \log p_{base}(x_t | x_{<t})$
This operation subtracts the base model's contribution, leaving only the finetuning signal. An adaptive plausibility constraint ( $\alpha$ ) is applied to prevent the objective from rewarding implausible tokens.

Key Contributions

CDD Framework: A grey-box method that combines raw next-token prediction, vague prefills, and contrastive decoding to extract verbatim content from narrowly finetuned LLMs using only logit access.
Superior Performance with Less Access: CDD achieves near-universal verbatim recovery across model scales (1B–32B parameters) and domains, outperforming the white-box ADL baseline while requiring strictly less access (no weights, no layer selection) and running approximately 170× faster end-to-end.
Generator Fingerprinting: CDD demonstrates the ability to recover unintended artifacts from the data generation pipeline. Specifically, it extracted a fictional persona ("Dr. Elena Rodriguez") that was inadvertently reused by the synthetic data generator across unrelated domains. This constitutes a complete fingerprinting chain: generator mode collapse $\rightarrow$ spurious corpus artifact $\rightarrow$ weight imprinting $\rightarrow$ artifact extraction.
Generalization to Real-World Data: The method was validated on real-domain finetuning settings involving causal reasoning datasets (CLADDER, COPA, CORR2CAUSE, TRAM). CDD achieved near-perfect recovery of reasoning domains, task types, and input/output structures, correctly identifying mixed-dataset settings where ADL failed.

Experimental Results

The authors evaluated CDD on the Synthetic Document Finetuning (SDF) benchmark, which spans five semantically unrelated domains (culinary, pharmaceutical, software engineering, political history, materials science) and four model families (Gemma-3, LLaMA-3.2, Qwen3).

Verbatim Recovery: Using a single default configuration ( $\beta=1.0, \alpha=0.1$ ) without tuning, CDD achieved a mean score $\ge 4$ (on a 1–5 scale requiring 2–4 specific named entities/numbers) on 16/20 organism-model pairs. It recovered exact drug names, vote counts, physical measurements, and procedural details.
Comparison with ADL: Under the same evaluation rubric, ADL (white-box) achieved a mean score of 2.42, recovering only rough domain descriptions. CDD outperformed ADL on 19/20 pairs.
Efficiency: CDD reduced runtime from ~2906 seconds (ADL) to ~17 seconds per pair on an H100 GPU. Storage requirements dropped from hundreds of megabytes (activation dumps for ADL) to <0.2 MB (generation JSON for CDD).
Artifact Recovery: In the SDF benchmark, CDD consistently recovered the fictional persona "Dr. Elena Rodriguez" across all domains, despite her appearing in only a fraction of the training documents for some domains. This confirmed the "mode collapse" of the data generator and its compression into model weights.
Real-World Validation: On causal reasoning datasets, CDD recovered the specific reasoning domains and prompt templates verbatim. For mixed-dataset models, it correctly identified all four constituent datasets, whereas ADL failed to identify the domain beyond vague traces.

Significance and Claims

The paper claims that CDD represents a practical breakthrough in AI transparency and accountability. By demonstrating that a grey-box method can outperform a white-box baseline in recovering specific, verbatim facts, the authors argue that model auditing is feasible even without access to internal weights.

The discovery of the "generator fingerprinting" chain is highlighted as a significant finding: it proves that artifacts from synthetic data generation (such as mode collapse) are not just noise but are memorized by models and can be extracted to attribute data provenance. This has direct implications for auditing models trained on ubiquitous LLM-generated synthetic corpora.

The authors remain modest regarding limitations, noting that CDD requires grey-box logit access (not just top-k probabilities) and that while it generalizes to real-domain reasoning tasks, a systematic study on naturally occurring (non-synthetic) corpora remains future work.