# RESULT — 088 membership-inference: can z reveal training-set membership? (privacy audit)

**Tier: T3-exploratory. DONE + SELF-HARVESTED in-session.** Box GPU phys0 (CVD=0) tmux
`c100_088` (self-exited), **228 s wall**, forward-only (no TAE training). 4 arms, N=2000
members / 2000 non-members per ladder arm + 400/400 SONAR proxy; balanced 70/30 train-test
classifier split; 10-shuffle label null. **Mean Brier 0.088; all 5 frozen predictions TRUE.**
GPU released to 35 MiB; no foreign process touched.

## Verdict (headline — privacy characterization)

**Membership leakage from z is a MEMORIZATION phenomenon, not an intrinsic property of the
embedding.** On a model that *memorized* its (small, over-trained) training set, z reveals
membership **PERFECTLY (AUC 1.000)** — anyone with the decoder can tell training from held-out
sentences with certainty, via reconstruction quality. But on a **normally-trained** organism
(standard budget, ≈1.16 epochs over 15.9M sentences, each seen ~once) the same attack yields
only **AUC 0.546 — barely above chance**. An **untrained** model gives **AUC 0.522 (chance)**,
proving the signal is trained-in, not an encoder artifact. The apparent SONAR-"membership"
signal (typical English vs OOD, **AUC 0.975**) is **100 % explained by surface typicality** (a
model-free surface-anomaly classifier reaches AUC 0.976) — it detects *atypicality*, not
*membership*, so it does not evidence SONAR training-set leakage.

**Privacy bottom line:** a sentence embedding does NOT inherently betray whether its sentence was
in training. It does so only to the extent the model *memorized* — the leakage tracks the
recon-fidelity gap (066), which for normal training is tiny. The SONAR-proxy attack cannot
separate membership from typicality and must not be read as a membership result.

## The four arms (combined held-out AUC; higher = more membership leakage)

| arm | organism | membership | **AUC** | shuffle-null | reading |
|---|---|---|---|---|---|
| **MEM** | 074 over-trained (memorized 6k set, val_f1 0.11) | KNOWN exact | **1.000** | 0.672† | perfect leakage (memorized) |
| **UNTRAINED** | 074 ck_0 (untrained), MEM sentences | KNOWN | **0.522** | 0.509 | chance — negative control ✓ |
| **STD** | A_D_s0 standard budget (val_f1 0.66, ~1 epoch) | KNOWN (seen ~1×) | **0.546** | 0.492 | near-chance — normal training barely leaks |
| **SONAR_proxy** | SONAR (typical vs OOD) | UNKNOWN (proxy) | **0.975** | 0.590† | = typicality, NOT membership |

†MEM/SONAR shuffle-nulls sit above 0.5 because their features are **perfectly bimodal** (two tight
clusters), a known degeneracy where a shuffled-label logistic fit partially recovers the clusters at
small effective n; the decisive negative controls are the **UNTRAINED arm (0.522)** and the clean
STD/UNTRAINED nulls (0.49–0.51). The MEM/SONAR signals are real (see per-feature separations below),
not pipeline leakage.

## Which signal carries membership (per-feature AUC, |AUC−0.5| = strength)

**MEM arm** — member vs non-member feature means:
| feat | member | non-member | per-feat AUC | strength |
|---|---|---|---|---|
| nll (teacher-forced CE) | **0.00** | 17.85 | 0.000 | **0.500** (perfect, "lower=member") |
| tokf1 (greedy recon) | **0.998** | 0.112 | 1.000 | **0.500** |
| chrf (greedy recon) | **99.8** | 20.97 | 1.000 | **0.500** |
| norm ‖z‖ | 6.15 | 4.68 | 0.974 | 0.474 |
| dens (nn-cos to bank) | 0.398 | 0.659 | 0.193 | 0.307 |

**Reconstruction fidelity is the membership signal** (066's machinery): a memorized sentence
reconstructs at chrF 99.8 / NLL 0.00, a held-out one at chrF 21 / NLL 17.9 — a chasm. ‖z‖ is a
strong *incidental* correlate (memorized z are larger, 6.15 vs 4.68). Manifold density is
**anti**-predictive here (members *less* dense) — an artifact of the density bank being drawn from
the held-out (val) distribution, so non-members sit nearer it; density is not a clean membership
axis. In the **STD** arm every feature collapses to chance (nll 1.434 vs 1.458, chrf 65.9 vs 65.7,
norm 7.63 vs 7.72) — a normally-trained model reconstructs members and non-members almost equally.

## SONAR proxy — the typicality confound, measured

Typical English (owt) proxy-members vs synthetic/gibberish OOD proxy-non-members: SONAR round-trip
chrF 85.1 vs 32.1 → AUC 0.975. **But** a model-free surface-anomaly classifier (mean word length,
non-alpha fraction, token count) reaches **AUC 0.976** on the same split → **typicality recovers
1.00 of the signal**. The "attack" is a typicality/OOD detector wearing a membership costume.
Because we lack SONAR's true training set, membership and typicality are inseparable here; this arm
is reported as a **confound demonstration, not a leakage measurement** (hard tier caveat).

## Predictions → Brier (frozen in PREREG_LITE)

| pred | P | outcome | Brier |
|---|---|---|---|
| P1 MEM combined AUC ≥ 0.90 | 0.88 | **TRUE** (1.000) | 0.0144 |
| P2 UNTRAINED ≤ 0.60 | 0.85 | **TRUE** (0.522) | 0.0225 |
| P3 a recon feature (nll/tokf1/chrf) most predictive in MEM | 0.72 | **TRUE** (recon 0.50 > norm 0.474 > dens 0.307) | 0.0784 |
| P4 STD ∈ [0.52,0.72] and < MEM | 0.55 | **TRUE** (0.546 < 1.000) | 0.2025 |
| P5 SONAR AUC ≥ 0.80 but typicality recovers ≥ 0.70 | 0.65 | **TRUE** (0.975; recovers 1.00) | 0.1225 |

**Mean Brier = 0.0881.** All five TRUE — a well-calibrated, decisive result. The "memorization ⇒
leakage, normal training ⇒ little, SONAR-proxy ⇒ typicality-confounded" prior was right on every axis.

## Gates

| gate | outcome |
|---|---|
| G-shuffle (null ≈ 0.5) | **PASS** on STD (0.492) & UNTRAINED (0.509); MEM 0.672 / SONAR 0.590 elevated by bimodal-feature degeneracy — documented, UNTRAINED carries the negative-control load |
| G-typicality (length match) | **PASS** — mean length MEM-mem 19.9 / nonmem 18.9 / STD-mem 19.6 (matched); SONAR confound explicitly measured (recovers 1.00) |
| G-untrained control | **PASS** — ck_0 AUC 0.522 ≈ chance; signal is trained-in |
| G-norm profile | logged (lesson 3): memorized ‖z‖ 6.15 vs 4.68 is an incidental correlate; STD norms matched 7.63/7.72 |
| G-det / dedup | deterministic eval; non-members deduped against member sets (exact-string) |

## What did NOT run / limitations

- **Members ≠ provably-multiply-seen for STD** (seen ~1× at 1.16 epochs); the near-chance STD result
  could be a floor for *this* budget — a higher-epoch (but non-memorizing) organism was not swept.
- **Single rung-A organism, seed 0, English OWT** only. No cross-rung / cross-seed replication.
- **SONAR arm has NO true membership label** — typical-vs-OOD is a proxy that conflates membership
  with typicality (shown), so it bounds nothing about SONAR's actual training-set leakage.
- Density feature is bank-dependent (bank = held-out val) → anti-predictive artifact in MEM, not a
  clean manifold-density membership test; a symmetric two-bank design would be needed.
- MEM/SONAR shuffle-null > 0.5 is a bimodal-feature degeneracy, not a validated 0.5 null; the
  untrained-model control is the rigorous negative control instead.

## Follow-up worth funding? **Y (narrow).**
1. **Memorization dose-response:** sweep train-set size / epochs from the STD (0.55) to the MEM (1.0)
   regime to map AUC vs the 066 recon-fidelity gap — quantify "how much memorization ⇒ how much
   leakage." Cheap (forward-only, reuse this harness).
2. **Two-bank density** to test the manifold-density membership hypothesis (031/083) without the
   bank-distribution artifact.
3. SONAR proper needs a *real* member/non-member corpus (e.g. a known NLLB bitext slice vs a
   post-cutoff/held-out slice) to escape the typicality confound — otherwise not measurable here.

## Provenance / hygiene
Repo: PREREG_LITE.md (frozen pre-compute), src/{mia_run.py,run_088.sh}, out/{results,meta}.json + run.log,
RESULT.md. Box dir mirror src + out. Ladder model/data reused from 073/074/075 (organisms A_D_s0 &
074-grokking ck_0/final, ladder16k.model, owt corpora); SONAR encode/greedy-decode reused from 083.
Smoke passed first (out_smoke). GPU verified free pre-claim (35 MiB) + hard-guard; free at exit (35 MiB);
tmux self-ended (never kill-server); no foreign process touched. T3-exploratory. Local commit, no push.
ONLY experiment in flight (one-at-a-time honored).