Source-balanced Capped Fisher: Bounded Evidence Aggregation for User Inference in Language Models
Authors: Yang Liu, Ran Zou, Wanrong Zhu
Organizations: Department of Statistics and Operations Research, University of North Carolina at Chapel Hill · Department of Statistics, University of California, Irvine
User inference asks whether a source contributed documents to a language-model update, even when the auditor observes only fresh documents from that source. Document-level scores can provide evidence of participation, but combining this evidence is challenging: documents differ in baseline predictability and in how strongly they reflect information learned from other documents of the same source. We propose source-balanced capped Fisher (SCF), an aggregation method that uses known nonparticipating sources to assess how unusual each document score is. It transforms the resulting reference-tail frequencies into negative-log evidence, caps individual contributions, and averages them within each source. This limits the influence of isolated extreme scores while retaining evidence across multiple documents. We complete the inference procedure with a decision rule that tests source participation using a p-value calibrated against a separate set of known nonparticipating sources. The rule provides finite-sample Type-I error control under source exchangeability. Experiments across four real-world datasets show that SCF achieves the highest AUROC among the evaluated aggregation methods in four domains. With the calibration-based decision rule, SCF delivers consistently competitive detection power across the tested settings, achieving the highest power in many cases, while empirical false-positive rates remain generally close to or below the nominal levels.
Figures & tables
Figure 1: Example of user inference. Alder Press asks whether any of its articles entered a model update. It queries the updated model with its own articles, which may all be unused in fine-tuning. A fixed scoring rule and source-level aggregation yield participation evidence.
Figure 2: SCF bounds document evidence before source-level calibration. Certified nonparticipating reference sources contribute equally to a fitted upper-tail map. The frozen map is applied to fresh queries from the target and each calibration source; log-tail evidence is capped (dashed lines) and averaged within each source. The target score (orange diamond) is ranked against calibration scores (gray circles) to obtain a source-level p-value; the shaded tail marks calibration scores at least as large as the target score. All icons and curves are schematic.
Domain
Mean
Max
Min
RaMIA
Uncapped Fisher
SCF
Reddit
0.6443
0.6176
0.6158
0.6444
0.6438
0.6456
CC News
0.6305
0.5953
0.6050
0.6227
0.6327
0.6354
Enron
0.8068
0.7222
0.6104
0.7973
0.8227
0.8309
Chromium
0.6178
0.5527
0.5620
0.6196
0.6279
0.6346
Table 1: Source-level AUROC under a common control budget, with fixed GPT-Neo-125M models, document scores, and query bags. Entries average 500 source-role partitions with identical test sources across methods. SCF uses (K,L)=(40,59) for Reddit, CC News, and Chromium, and (25,25) for Enron, with α=.05 . AUROC is computed before calibration. Bold denotes the highest mean AUROC.
Domain
Nonparticipant (%)
Participant (%)
Reddit
5.180
8.270
CC News
5.188
9.430
Enron
4.943
9.398
Chromium
5.244
6.401
Table 2: Frequency of capped document evidence at α=.05 . Entries are percentages of query documents satisfying Q(S(x))<.05 , averaged within each evaluated source, and then over the same 500 source-role partitions as Table 1 . Reference and calibration sources are excluded.
Figure 3: Mean AUROC gain over uncapped Fisher, averaged over 500 matched source-role partitions. Here α=0 retains reference smoothing and omits the explicit cap.
Domain
t (%)
Metric
Mean
Max
Min
RaMIA
SCF
Reddit
5
TPR
9.53
3.08
4.59
10.73
8.82
FPR
4.95
4.86
4.95
5.07
4.95
10
TPR
17.70
12.04
16.08
17.46
17.21
FPR
10.08
10.04
9.84
9.99
10.02
20
TPR
33.60
24.87
32.32
31.16
32.62
FPR
19.95
19.99
19.70
19.90
20.05
Table 3: Source-level audit utility at nominal level t . TPR and FPR (%) are averaged over the same 500 source-role partitions as Table 1 . SCF uses α=.05 . Bold marks the highest mean TPR for each domain and nominal level.
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Domain
Source unit
Sources
Participants
Null pool
Null test
Queries
Reddit
Account
267
84
183
84
16
CC News
Web domain
2,709
1,348
1,361
1,262
1–16
Enron
Mailbox owner
141
70
71
21
1–16
Chromium
Developer
199
50
149
50
16
Appendix
Table 4: Source populations and query bags. The SCF reference/calibration allocation is (Kd,Ld)=(40,59) in Reddit, CC News, and Chromium and (25,25) in Enron. All participants and all null sources outside these controls are tested in each of 500 partitions. Raw-score baselines use all Kd+Ld controls for calibration. Query counts are per source.
Domain
Train documents / epoch
Prediction tokens / epoch
Epoch
Updates
Reddit
1,344
62,965
3
504
CC News
283,370
95,590,331
9
318,798
Enron
42,917
10,742,290
5
26,825
Chromium
800
84,258
2
200
Appendix
Table 5: Training exposure and checkpoint used for scoring. The checkpoint criterion is minimum validation token-average negative log-likelihood over ten epoch endpoints.
Domain
Comparator
Wins
Ties
Losses
Mean gain (pp)
Reddit
Mean
329
10
161
+0.130329
Max
460
0
40
+2.798073
Min
450
0
50
+2.976502
RaMIA
307
4
189
+0.117630
Uncapped Fisher
336
5
159
+0.170607
CC News
Mean
500
0
0
+0.496548
Appendix
Table 6: Paired AUROC comparisons across 500 matched source-role partitions. Wins, ties, and losses count partitions in which SCF ( α=.05 ) has higher, equal, or lower AUROC than the named comparator, respectively; each row sums to 500. Mean gain is the average paired AUROC difference (SCF minus comparator), expressed in percentage points and computed before rounding.
Domain
α=0 (uncapped)
α=.01
α=.02
α=.05
α=.10
Reddit
0.6438±0.0248
0.6451±0.0248
0.6460±0.0248
0.6456±0.0247
0.6450±0.0258
CC News
0.6327±0.0022
0.6330±0.0020
0.6337±0.0018
0.6354±0.0017
0.6372±0.0017
Enron
0.8227±0.0462
0.8237±0.0453
0.8256±0.0444
0.8309±0.0428
0.8356±0.0419
Chromium
0.6279±0.0320
0.6296±0.0318
0.6298±0.0314
0.6346±0.0310
0.6351±0.0314
Appendix
Table 7: Cap sensitivity over the same 500 source-role partitions. All entries are mean AUROC ± partition SD. These SDs describe variation in source-role assignment, not population confidence intervals.
Domain
t (%)
Uncapped
α=.01
α=.02
α=.05
α=.10
Reddit
5
5.07
5.06
5.05
4.95
5.00
Reddit
10
10.09
10.11
10.04
10.02
9.99
Reddit
20
20.05
20.06
20.04
20.05
19.94
CC News
5
4.91
4.88
4.86
4.86
4.98
CC News
10
10.00
10.00
10.06
10.08
10.21
CC News
20
20.32
20.38
20.37
20.29
20.25
Appendix
Table 8: Empirical FPR (%), averaged over the same 500 partitions. Each cap uses the same fitted reference and calibration sources, with (K,L)=(40,59) except Enron (25,25) . The nominal level t and evidence cap α are distinct parameters.
Domain
t=.05
t=.10
t=.20
Reddit
4.84 / 10.33
9.72 / 17.70
19.35 / 27.27
CC News
5.06 / 10.43
10.16 / 19.88
20.31 / 35.55
Enron
3.60 / 7.10
6.96 / 22.81
18.28 / 56.23
Chromium
4.90 / 8.39
9.93 / 15.89
20.18 / 28.15
Appendix
Table 9: SCF audit utility with pre-cutoff training and exclusively post-cutoff target, reference, and calibration queries. Each entry is FPR / TPR (%), averaged over 500 source-role partitions with α=.05 . The columns specify the nominal significance level t .
Language models tend to agree with whatever a user asserts, and post-training increasingly targets this sycophancy so that models evaluate claims on their merits rather than deferring to the user. Yet the same models are far more compliant when a wrong answer is attributed to a verified source, which is how retrieval results, tool outputs, and grounded-search content often present information. We measure this gap across five open-weight families and three closed APIs. A single verified-source note endorsing a wrong answer flips 45-88% of baseline-correct responses in seven of eight models, and compliance rises with how authoritative the note sounds. Source deference and user agreement are not behaviorally interchangeable inside the model: on matched items with the same wrong answer, causal interventions can selectively suppress one without equally affecting the other. In three open-weight families, removing a fitted source direction lowers source compliance by 65-80 percentage points while removing a user or assistant direction has far smaller effects, and removing the user direction shows the reverse preference. A separately fitted intervention derived from source-versus-user cue activations moves compliance in both directions while leaving the prompt text unchanged. An authority direction fitted on trivia also transfers to PIQA and multi-turn SYCON dialogues without refitting, and removing it lowers wrong-source compliance by tens of percentage points in four of five families with no detected change in MMLU-Pro or GSM8K accuracy at our evaluation sizes. Source deference and user agreement therefore need separate evaluation.
Systems that ask a language model to reach a conclusion from many sources usually concatenate them into one prompt. This conflates two operations with different requirements. Interpreting a source rewards capacity and context. Combining interpretations rewards fixed arithmetic, comparability across instances, and the option to return nothing. Once separated, the design problem becomes the interface between them. We propose a four-field evidence tuple (hypothesis, reliability bucket, rationale, provenance) and show that fixing it determines both halves. The separation also reveals a failure mode in how such systems combine, which we call count-scale drift. Thresholding a sum of unnormalized weights is exactly posterior thresholding, but at an operating point that slides with the number of sources consulted. The slide grows with reader reliability. When source reliabilities differ, the vote rule and the posterior order instances differently, and no threshold reconciles them. Pooling calibrated log-likelihood ratios addresses both problems. The fix is arithmetic rather than architectural, and applies to a class of rules beyond language models: score-summing triage engines, diagnostic panels scored by counting positives, and additive multi-signal detectors. We then instantiate the principle twice on one longitudinal corpus, once after outcomes resolve and once before. The same partition helps in both, at different granularities: over reading in the first, over learning capacity in the second. There, a small sequence encoder on an easy auxiliary objective plus a tree ensemble carrying the censored survival loss reaches 0.921 AUPRC against 0.805 for a hand-crafted baseline. We separate what transfers from what must be re-estimated per domain, and state five predictions that would falsify the framework, three negative results, and which comparisons remain confounded.
How can a language model know whether it has enough evidence to answer? Language models tend to answer even when the evidence they have is insufficient. Deciding whether to answer or gather more evidence requires a calibrated estimate of how likely an answer is to be correct with the available evidence. However, most calibration work treats the input as fixed, without asking how this estimate should change with the evidence. We introduce evidence-state calibration, which requires a model's confidence before answering to match its probability of answering correctly and to change accordingly whenever the evidence changes this probability. We propose SuffiCE (Sufficiency Confidence Estimation), which fine-tunes the confidence already present in a model's next-token distribution to match how often the model answers correctly from each evidence state. Across clinical diagnosis and multi-hop question answering with four models from two families, SuffiCE reduces the Brier score by up to 60% and increases AUROC by up to 0.16. Its confidence matches the empirical success rate and responds not only to the amount of evidence but also to which evidence is present, showing that models can learn to judge whether their current evidence is enough to answer.