🤖 machine learning

LaRA: Layer-wise Representation Analysis for Detecting Data Contamination in RL Post-Training

This paper introduces LaRA, a layer-wise representation analysis framework that detects data contamination in RL post-trained large language models by identifying geometric deviations such as amplified perturbation sensitivity, directional collapse, and local rigidity, thereby outperforming existing output-level detection methods.

Original authors: Minju Gwak, Minseo Kwak, Dongseok Lee, Guijin Son, Alan Ritter, Jaehyung Kim

Published 2026-05-29

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Minju Gwak, Minseo Kwak, Dongseok Lee, Guijin Son, Alan Ritter, Jaehyung Kim

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Problem: The "Cheat Sheet" in the Exam

Imagine you are training a brilliant student (a Large Language Model) to solve difficult math problems. You give them a massive library of practice books to study. However, some of the "practice" questions in those books are actually the exact same questions that will appear on their final exam.

This is called data contamination. If the student memorizes the answers to the exam questions while studying, they will ace the test, but they haven't actually learned how to think or reason. They just memorized the cheat sheet.

For a long time, scientists tried to catch this cheating by looking at the student's final answers. They asked: "Does the student sound too confident? Do they answer too quickly?" (These are called output-level signals).

The Problem: In the new era of "Reinforcement Learning" (RL), the student learns by trying many different paths to a solution, not just by memorizing words. Because of this, looking at the final answer is like trying to catch a cheater by only looking at their final grade—it's often too late, and the cheater can fake a good grade easily.

The Solution: LaRA (The "X-Ray" Vision)

The authors propose a new method called LaRA. Instead of looking at the final answer, LaRA looks inside the student's brain while they are thinking.

Think of the student's brain as a multi-story building with many floors (layers). As a question goes up the building, the student's understanding changes on each floor.

Normal Learning: When a student encounters a new question, their brain is flexible. If you slightly change the wording of the question (a "perturbation"), their internal thoughts shift and adapt naturally.
Memorization (Contamination): When a student has memorized an answer, their brain becomes rigid. It's like a robot that has a pre-recorded script. If you change the question slightly, the robot's internal script doesn't know how to adjust, or it panics and shifts in a weird, unnatural way.

How LaRA Works: The Three "Tests"

LaRA acts like a detective who asks the student the same question in three slightly different ways and watches how their internal brain waves (representations) react. They measure three specific things:

The "Shock Test" (Representation Shift Magnitude):
- The Analogy: Imagine you take a key piece of information out of a math problem (like removing the number "5" and replacing it with a blank).
- The Normal Student: Their brain re-calculates the whole problem. Their internal "thought pattern" shifts significantly because the math has changed.
- The Cheater: Because they memorized the answer, removing a number confuses them or causes their brain to shift in a huge, unnatural spike. They are too sensitive to the missing piece because they relied on it being there.
The "Crowd Test" (Directional Collapse):
- The Analogy: Imagine asking 10 different people to solve a problem. Their brains usually move in slightly different directions because everyone thinks a little differently.
- The Normal Student: Their brain moves in a unique, diverse direction.
- The Cheater: Their brain collapses into a single, rigid direction. It's like a crowd of people suddenly all marching in lockstep. This "collapse" happens because they are just replaying a memorized path rather than exploring new ideas.
The "Paraphrase Test" (Representation Stability):
- The Analogy: Ask the student the same question but reword it completely (e.g., "How many apples?" vs. "What is the count of fruit?").
- The Normal Student: Their brain stays stable and consistent. They know it's the same problem.
- The Cheater: Their brain becomes rigid and unchanging. They are so locked into the specific memorized wording that even a slight rewording makes their internal state feel "stiff" and unnatural compared to how they handle normal questions.

The Results: Catching the Cheaters

The researchers tested this on several AI models trained with Reinforcement Learning.

Old Methods: The old "output-level" detectors (checking confidence or probability) were often fooled. They couldn't tell the difference between a smart student and a memorizing cheater.
LaRA: By looking at the "X-ray" of the brain's internal geometry, LaRA successfully spotted the memorized questions. It found that contaminated samples (the cheaters) had distinct "scars" in their brain waves: they were too sensitive to missing info, too rigid in their direction, and too stiff when reworded.

Why This Matters

This paper claims that to truly know if an AI is "learning" or just "memorizing" during its advanced training, we cannot just listen to what it says. We must look at how it thinks. LaRA provides a way to audit the AI's internal brain structure to ensure it is actually reasoning and not just reciting a cheat sheet.

In short: LaRA is a new tool that catches AI models cheating on their exams by watching how their brains react when you poke, prod, and rephrase the questions, rather than just grading their final answers.

Technical Summary: LaRA – Layer-wise Representation Analysis for Detecting Data Contamination in RL Post-Training

Problem Statement

Reinforcement Learning (RL) post-training has demonstrated significant efficacy in enhancing the reasoning capabilities of Large Language Models (LLMs). However, this paradigm introduces a critical, underexplored vulnerability: data contamination, where evaluation or benchmark samples are inadvertently included in the RL training data. Such contamination can induce reward-driven overfitting and implicit memorization, thereby undermining the generalization and evaluation reliability of the training process.

Existing detection methods primarily rely on output-level signals (e.g., token likelihoods, entropy, or perplexity) derived from pre-training or Supervised Fine-Tuning (SFT) contexts. These methods are increasingly unreliable for RL-trained models for two reasons:

Calibration Issues: LLM output distributions are often poorly calibrated, making likelihood-based signals noisy.
Objective Mismatch: Unlike pre-training or SFT, which optimize token-wise likelihoods, RL optimizes expected rewards over entire reasoning trajectories. Consequently, token-level behavioral signals are less directly aligned with the underlying training objective.

Methodology: LaRA Framework

The authors propose LaRA (Layer-wise Representation Analysis), a framework that shifts the detection paradigm from output-level statistics to representation-level geometry. The core hypothesis is that RL-induced memorization creates abnormal geometric responses in the model's internal hidden states under controlled perturbations.

1. Experimental Setup

The authors construct controlled contamination benchmarks using three open-source RL-trained models (EURUS-2-7B-PRIME, LIMR, and Olmo-3.1-7B-RL-Zero-Math).

Members: 30 Olympiad-level math problems from the model's own RL training set.
Non-Members: 30 problems from AIME 2026 (unseen data).
Training: The models undergo additional RL training on a corpus containing the "member" samples to simulate and track the evolution of contamination signals.

2. Perturbation Strategy

For a given question $q_0$ , the framework generates:

Semantic Neighbors: A set of structurally similar questions $Q = \{q_0, q_1, \dots, q_K\}$ .
Perturbed Variants: Key information is removed from these questions using a BLANKIMPORTANT operator to create $q^-_i$ .
Paraphrased Variants: For perturbed questions, semantically equivalent paraphrases are generated while preserving the blank positions to test local invariance.

3. Three Geometric Metrics

Hidden representations are extracted across all transformer layers ( $\ell \in \{0, \dots, L-1\}$ ) to compute three complementary metrics:

Representation Shift Magnitude (RSM): Measures the sensitivity of representations to information removal. It calculates the Euclidean norm of the shift ( $\Delta_i = u_i - w_i$ ) between the original and perturbed representations. High RSM indicates that a memorized sample is overly sensitive to the removal of specific information compared to its semantic neighbors.
Directional Collapse (DC): Characterizes the organization of perturbation-induced changes. It measures the cosine alignment between the perturbation direction of the original sample and the average perturbation direction of its semantic neighbors. High DC indicates that the model's response to perturbations collapses into a shared, low-dimensional direction, suggesting reduced representational diversity.
Representation Stability Index (RSI): Quantifies local rigidity under paraphrastic perturbations. It measures the variance of representations for paraphrased variants of the same perturbed question. Low RSI (high stability) suggests the model has formed rigid, invariant local representations for memorized content.

4. Detection Protocol

The framework aggregates these metrics into a single detection score (SLaRA) through a three-step process:

Robust Standardization: Metrics are compressed and standardized against a "clean" reference distribution (non-members) using Median Absolute Deviation (MAD) to handle heavy-tailed distributions and prevent outlier inflation.
Metric-Specific Alignment: The standardized scores are aligned based on the expected direction of contamination (e.g., inverting RSI if high stability indicates contamination).
Layer-wise Aggregation: The aligned deviations are averaged across all layers and metrics to produce the final anomaly score.

Key Results

Experiments across multiple RL-trained models and training checkpoints demonstrate that LaRA outperforms existing output-level baselines (Recall, CDD, Min-K%, Min-K%++, PPL, Self-Critique).

Performance Gains: LaRA achieves up to +9.6% AUC improvement and 3.5× higher True Positive Rate at 5% False Positive Rate (TPR@FPR=5%) compared to the strongest prior output-level method.
Robustness: The combined score (SLaRA) remains stable and effective across different RL training epochs, whereas output-level metrics like Perplexity (PPL) show high variance and lower reliability in strict low-FPR regimes.
Geometric Insights: Contaminated samples consistently exhibit:
- Amplified perturbation sensitivity (high RSM).
- Abnormal directional concentration (high DC).
- Enhanced local rigidity (low RSI/high stability).
- These deviations become more pronounced as RL training progresses, particularly in specific layer ranges (e.g., layers 7–9 for Eurus).

Significance and Contributions

The paper claims the following contributions:

First Representation-Level Framework for RL: It is the first work to propose a layer-wise representation analysis framework specifically for detecting contamination in RL post-training, utilizing stiffness and rigidity metrics.
Superior Detection Protocol: The proposed protocol consistently outperforms output-level baselines across diverse RL models, offering a more reliable signal for auditing RL-trained reasoning models.
Empirical Insights: The study provides new evidence that RL training affects representation geometry in distinct ways, creating detectable "geometric signatures" of memorization that persist across layers and are robust to training stage shifts.

The authors conclude that while representation-level auditing introduces computational overhead, it is necessary to overcome the limitations of output-level signals in the RL domain, thereby improving the transparency and reliability of LLM evaluation.