Source-balanced Capped Fisher: Bounded Evidence Aggregation for User Inference in Language Models

Yang Liu; Ran Zou; Wanrong Zhu

cs.CLNov 4, 2026

Source-balanced Capped Fisher: Bounded Evidence Aggregation for User Inference in Language Models

Authors: Yang Liu, Ran Zou, Wanrong Zhu

Organizations: Department of Statistics and Operations Research, University of North Carolina at Chapel Hill · Department of Statistics, University of California, Irvine

Abstract

User inference asks whether a source contributed documents to a language-model update, even when the auditor observes only fresh documents from that source. Document-level scores can provide evidence of participation, but combining this evidence is challenging: documents differ in baseline predictability and in how strongly they reflect information learned from other documents of the same source. We propose source-balanced capped Fisher (SCF), an aggregation method that uses known nonparticipating sources to assess how unusual each document score is. It transforms the resulting reference-tail frequencies into negative-log evidence, caps individual contributions, and averages them within each source. This limits the influence of isolated extreme scores while retaining evidence across multiple documents. We complete the inference procedure with a decision rule that tests source participation using a p-value calibrated against a separate set of known nonparticipating sources. The rule provides finite-sample Type-I error control under source exchangeability. Experiments across four real-world datasets show that SCF achieves the highest AUROC among the evaluated aggregation methods in four domains. With the calibration-based decision rule, SCF delivers consistently competitive detection power across the tested settings, achieving the highest power in many cases, while empirical false-positive rates remain generally close to or below the nominal levels.

Figures & tables

Figure 1: Example of user inference. Alder Press asks whether any of its articles entered a model update. It queries the updated model with its own articles, which may all be unused in fine-tuning. A fixed scoring rule and source-level aggregation yield participation evidence.

Figure 2: SCF bounds document evidence before source-level calibration. Certified nonparticipating reference sources contribute equally to a fitted upper-tail map. The frozen map is applied to fresh queries from the target and each calibration source; log-tail evidence is capped (dashed lines) and averaged within each source. The target score (orange diamond) is ranked against calibration scores (gray circles) to obtain a source-level p-value; the shaded tail marks calibration scores at least as large as the target score. All icons and curves are schematic.

Domain	Mean	Max	Min	RaMIA	Uncapped Fisher	SCF
Reddit	0.6443	0.6176	0.6158	0.6444	0.6438	0.6456
CC News	0.6305	0.5953	0.6050	0.6227	0.6327	0.6354
Enron	0.8068	0.7222	0.6104	0.7973	0.8227	0.8309
Chromium	0.6178	0.5527	0.5620	0.6196	0.6279	0.6346

Table 1: Source-level AUROC under a common control budget, with fixed GPT-Neo-125M models, document scores, and query bags. Entries average 500 source-role partitions with identical test sources across methods. SCF uses

(K,L)=(40,59)

for Reddit, CC News, and Chromium, and

(25,25)

for Enron, with

\alpha=.05

. AUROC is computed before calibration. Bold denotes the highest mean AUROC.

Domain	Nonparticipant (%)	Participant (%)
Reddit	5.180	8.270
CC News	5.188	9.430
Enron	4.943	9.398
Chromium	5.244	6.401

Table 2: Frequency of capped document evidence at

\alpha=.05

. Entries are percentages of query documents satisfying

\widehat{Q}(S(x))<.05

, averaged within each evaluated source, and then over the same 500 source-role partitions as Table 1 . Reference and calibration sources are excluded.

Figure 3: Mean AUROC gain over uncapped Fisher, averaged over 500 matched source-role partitions. Here

\alpha=0

retains reference smoothing and omits the explicit cap.

Domain	$t$ (%)	Metric	Mean	Max	Min	RaMIA	SCF
Reddit	5	TPR	9.53	3.08	4.59	10.73	8.82
		FPR	4.95	4.86	4.95	5.07	4.95
	10	TPR	17.70	12.04	16.08	17.46	17.21
		FPR	10.08	10.04	9.84	9.99	10.02
	20	TPR	33.60	24.87	32.32	31.16	32.62
		FPR	19.95	19.99	19.70	19.90	20.05

Table 3: Source-level audit utility at nominal level

t

. TPR and FPR (%) are averaged over the same 500 source-role partitions as Table 1 . SCF uses

\alpha=.05

. Bold marks the highest mean TPR for each domain and nominal level.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Domain	Source unit	Sources	Participants	Null pool	Null test	Queries
Reddit	Account	267	84	183	84	16
CC News	Web domain	2,709	1,348	1,361	1,262	1–16
Enron	Mailbox owner	141	70	71	21	1–16
Chromium	Developer	199	50	149	50	16

Appendix

Table 4: Source populations and query bags. The SCF reference/calibration allocation is

(K_{d},L_{d})=(40,59)

in Reddit, CC News, and Chromium and

(25,25)

in Enron. All participants and all null sources outside these controls are tested in each of 500 partitions. Raw-score baselines use all

K_{d}+L_{d}

controls for calibration. Query counts are per source.

Domain	Train documents / epoch	Prediction tokens / epoch	Epoch	Updates
Reddit	1,344	62,965	3	504
CC News	283,370	95,590,331	9	318,798
Enron	42,917	10,742,290	5	26,825
Chromium	800	84,258	2	200

Appendix

Table 5: Training exposure and checkpoint used for scoring. The checkpoint criterion is minimum validation token-average negative log-likelihood over ten epoch endpoints.

Domain	Comparator	Wins	Ties	Losses	Mean gain (pp)
Reddit	Mean	329	10	161	$+0.130329$
	Max	460	0	40	$+2.798073$
	Min	450	0	50	$+2.976502$
	RaMIA	307	4	189	$+0.117630$
	Uncapped Fisher	336	5	159	$+0.170607$
CC News	Mean	500	0	0	$+0.496548$

Appendix

Table 6: Paired AUROC comparisons across 500 matched source-role partitions. Wins, ties, and losses count partitions in which SCF (

\alpha=.05

) has higher, equal, or lower AUROC than the named comparator, respectively; each row sums to 500. Mean gain is the average paired AUROC difference (SCF minus comparator), expressed in percentage points and computed before rounding.

Domain	$\alpha=0$ (uncapped)	$\alpha=.01$	$\alpha=.02$	$\alpha=.05$	$\alpha=.10$
Reddit	$0.6438\pm 0.0248$	$0.6451\pm 0.0248$	$0.6460\pm 0.0248$	$0.6456\pm 0.0247$	$0.6450\pm 0.0258$
CC News	$0.6327\pm 0.0022$	$0.6330\pm 0.0020$	$0.6337\pm 0.0018$	$0.6354\pm 0.0017$	$0.6372\pm 0.0017$
Enron	$0.8227\pm 0.0462$	$0.8237\pm 0.0453$	$0.8256\pm 0.0444$	$0.8309\pm 0.0428$	$0.8356\pm 0.0419$
Chromium	$0.6279\pm 0.0320$	$0.6296\pm 0.0318$	$0.6298\pm 0.0314$	$0.6346\pm 0.0310$	$0.6351\pm 0.0314$

Appendix

Table 7: Cap sensitivity over the same 500 source-role partitions. All entries are mean AUROC

\pm

partition SD. These SDs describe variation in source-role assignment, not population confidence intervals.

Domain	$t$ (%)	Uncapped	$\alpha=.01$	$\alpha=.02$	$\alpha=.05$	$\alpha=.10$
Reddit	5	5.07	5.06	5.05	4.95	5.00
Reddit	10	10.09	10.11	10.04	10.02	9.99
Reddit	20	20.05	20.06	20.04	20.05	19.94
CC News	5	4.91	4.88	4.86	4.86	4.98
CC News	10	10.00	10.00	10.06	10.08	10.21
CC News	20	20.32	20.38	20.37	20.29	20.25

Appendix

Table 8: Empirical FPR (%), averaged over the same 500 partitions. Each cap uses the same fitted reference and calibration sources, with

(K,L)=(40,59)

except Enron

(25,25)

. The nominal level

t

and evidence cap

\alpha

are distinct parameters.

Domain	$t=.05$	$t=.10$	$t=.20$
Reddit	4.84 / 10.33	9.72 / 17.70	19.35 / 27.27
CC News	5.06 / 10.43	10.16 / 19.88	20.31 / 35.55
Enron	3.60 / 7.10	6.96 / 22.81	18.28 / 56.23
Chromium	4.90 / 8.39	9.93 / 15.89	20.18 / 28.15

Appendix

Table 9: SCF audit utility with pre-cutoff training and exclusively post-cutoff target, reference, and calibration queries. Each entry is FPR / TPR (%), averaged over 500 source-role partitions with

\alpha=.05

. The columns specify the nominal significance level

t

Language Model Auditing

Language model auditing tests whether models behave reliably, fairly, and safely using behavioral probes and internal or deployment evidence.

See all 168 papers

Authority Bias in Language Models: Source Deference and User Agreement Are Not Interchangeable
Sep 29, 2026Abhinav Rajeev Kumar, Paras ChopraLLM Sycophancy LLM Reliability
Lossfunk
Split the Labor: Separating Evidence Interpretation from Decision Aggregation
Aug 14, 2026Zhelun WuEvidence-Grounded Reasoning
Atlassian
Each Insufficient in Its Own Way: Calibrating Language Models Across Varying Evidence States
Oct 23, 2026Jiayi Li, Dennis L. Shung, Bradly C. StadieConfidence Estimation in Language Models Language Model Calibration
Northwestern University · Mayo Clinic

Sep 29, 2026J/K move · Enter open · S save

Authority Bias in Language Models: Source Deference and User Agreement Are Not Interchangeable

Abhinav Rajeev Kumar, Paras Chopra

Lossfunk

LLM Sycophancy LLM Reliability Ownership Bias in Language Models

Open paper AskPDF arXiv

Language models tend to agree with whatever a user asserts, and post-training increasingly targets this sycophancy so that models evaluate claims on their merits rather than deferring to the user. Yet the same models are far more compliant when a wrong answer is attributed to a verified source, which is how retrieval results, tool outputs, and grounded-search content often present information. We measure this gap across five open-weight families and three closed APIs. A single verified-source note endorsing a wrong answer flips 45-88% of baseline-correct responses in seven of eight models, and compliance rises with how authoritative the note sounds. Source deference and user agreement are not behaviorally interchangeable inside the model: on matched items with the same wrong answer, causal interventions can selectively suppress one without equally affecting the other. In three open-weight families, removing a fitted source direction lowers source compliance by 65-80 percentage points while removing a user or assistant direction has far smaller effects, and removing the user direction shows the reverse preference. A separately fitted intervention derived from source-versus-user cue activations moves compliance in both directions while leaving the prompt text unchanged. An authority direction fitted on trivia also transfers to PIQA and multi-turn SYCON dialogues without refitting, and removing it lowers wrong-source compliance by tens of percentage points in four of five families with no detected change in MMLU-Pro or GSM8K accuracy at our evaluation sizes. Source deference and user agreement therefore need separate evaluation.

Abstract

Language Model Auditing

Explore similar work

Authority Bias in Language Models: Source Deference and User Agreement Are Not Interchangeable

Split the Labor: Separating Evidence Interpretation from Decision Aggregation

Each Insufficient in Its Own Way: Calibrating Language Models Across Varying Evidence States