WARP: Weight-Space Analysis for Recovering Training Data Portfolios

The Core Claim

Foundation models are released publicly, but their training recipes—especially the mix of data sources used—stay secret. WARP recovers these hidden data mixtures directly from a model's released weights without needing access to the training process itself. The method achieves this by analyzing geometric patterns in weight space, recovering domain proportions with mean absolute errors as low as 0.046 for BERT and 0.104 for GPT-2, significantly outperforming existing inference approaches.

How It Works

WARP exploits a key insight: when a base model is fine-tuned on different data mixtures, the resulting weight changes leave a geometric signature. The authors reconstruct this signature by interpolating between the base and fine-tuned weights using model merging—a technique that blends two sets of weights along a continuum. This produces pseudo-checkpoints that approximate what intermediate training snapshots would look like, essentially simulating the training trajectory without access to actual training steps.

From these interpolated checkpoints, WARP extracts geometric features that capture how the weights moved through parameter space during fine-tuning. These features encode information about the training data composition. The authors then map these features to domain proportions using one of two approaches: a parameter-free softmax readout that directly interprets the geometric signals, or an MLP trained on synthetic mixtures to learn the mapping.

The key difference from prior work like membership inference is scope. Membership inference detects whether a specific sample was in the training set—individual data points. WARP operates at the global level, recovering the overall proportions of different domains in the entire training corpus. This is a fundamentally different and coarser-grained problem, but it answers a more practical question: what was the training recipe?

Why It Matters

Training data composition profoundly affects model behavior. Practitioners fine-tune models on proprietary datasets but rarely disclose the mixture ratios. This creates an information asymmetry: researchers studying released models cannot understand why they behave the way they do without knowing the training distribution. WARP closes this gap by making training data portfolios visible through weight analysis alone.

The method is practical: it requires only the base model and the fine-tuned release—both typically available. Controlled experiments on BERT and GPT-2 demonstrate strong recovery accuracy, with performance exceeding what you'd get by querying individual samples (membership inference's approach). The framework generalizes across synthetic mixtures, suggesting potential applicability to real-world scenarios where the true recipe is unknown.

This work matters for transparency and reproducibility. As foundation models become critical infrastructure, understanding their training regimes becomes essential for auditing, comparing, and improving them. WARP enables researchers to reverse-engineer training compositions from weights alone, turning a black-box release into something more interpretable.