Audit Before You Merge: Provenance, Probing, and Continual LoRA Composition

Lenny Aharon; Neta Glazer; Lior Aharon

cs.AINov 7, 2026

Audit Before You Merge: Provenance, Probing, and Continual LoRA Composition

Authors: Lenny Aharon, Neta Glazer, Lior Aharon

Organizations: Columbia University, New York, NY, USA · Bar-Ilan University, Ramat Gan, Israel · MIT, Cambridge, MA, USA

Abstract

Post-hoc merging of public LoRA adapters is an attractive gradient-free path to continual adaptation, but reliable measurement of catastrophic forgetting in this setting depends on infrastructure that prior work has not addressed. We treat each adapter merge as a sequential task in a continual-learning setting, with the instruction-tuned base model's capabilities as Task 0, and study forgetting on Llama-3.1-8B-Instruct. Public adapter hubs contain modules that fail basic provenance checks: silent base-version mismatches and near-zero delta norms whose inclusion inflates measured interference by ~10pp. We propose a two-check audit (base-model match, non-trivial delta norm) and a leakage-free probing protocol as preconditions for any forgetting study in this setting. On an audited 4-adapter set, naive merging causes -10.5pp on GSM8K and -18.3pp on HumanEval, while Task Arithmetic at lambda=0.5 sits within a standard error of the unmerged baseline. A coordinate search including negative coefficients identifies the math adapter as probe-optimal at lambda=-0.5, outside the reach of positive-only mergers, suggesting forgetting has structure that negation-aware merging may exploit. The same protocol replicates on Mistral-7B-Instruct-v0.3, where 2 of 4 candidate adapters fail the audit and the audited merge reproduces the same merge-method ranking on GSM8K, supporting that our findings are not Llama-specific.

Figures & tables

Figure 1: Single-adapter reference evaluations. For each (adapter, benchmark) pair, the bar shows the signed change vs. the unmerged baseline when only that adapter is applied (no merging, no other adapters). GSM8K bars (the protected task) have orange outlines.

Figure 2: Per-benchmark comparison of merge methods on the four audited Llama-3.1-8B-Instruct adapters. Dashed line: unmerged baseline. TA

\lambda{=}0.5

and TIES

d{=}0.5

sit within a standard error of baseline on GSM8K and preserve HumanEval best among merging methods; naive merge and DARE lose substantial HumanEval and GSM8K. Fig. 3 shows where residual headroom may still exist.

Method	GSM8K	HE p@1	M-500
Baseline (no merge)	0.707	0.628	0.154
Naive merge	0.603	0.445	0.142
Task Arith. $\lambda{=}0.5$	0.705	0.561	0.170
TIES $d{=}0.5$	0.712	0.543	0.172
DARE $d{=}0.5$	0.622	0.457	0.144
MagMax	0.685	0.524	0.168

Table 1: Llama-3.1-8B-Instruct, sequential merge of four audited adapters. Scores on full test sets. Bold: best non-baseline per column. Standard errors and additional ablations in App. D . A current-harness reproduction of the naive row gives

0.615/0.476/0.142

(

{\sim}{+}1

pp drift, within stderr); the controlled ablation in App. H uses the reproduction values as its anchor.

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Task	Description	Rank	$\alpha$	Total $\\|\Delta\\|_{F}$	Single-adapter score
math	MATH fine-tune (kai-xu)	8	8	16.62	MATH-500 $0.164$
code	FlowerTune-Code (yangao381)	32	64	1.73	HumanEval $0.598$
general_nlp	FlowerTune-NLP (zjudai)	32	64	1.07	TruthfulQA-MC2 $0.557$
medical	FlowerTune-Med (yangao381)	32	64	1.55	GSM8K (proxy) $0.723$

Appendix

Table 2: Provenance of the four audited adapters. “Norm” is the total Frobenius norm of the reconstructed delta, aggregated over all LoRA-target layers (

(\sum_{\ell}\|\Delta_{\ell}\|_{F}^{2})^{1/2}

). “Single-adapter score” is the test-set score when only that adapter is applied to the primary target benchmark (from App. B ). HuggingFace identifiers and checkpoint fingerprints for every candidate adapter are in Table 3 .

Slot	HuggingFace identifier	sha256 (first 16)	size
Audited (used in merge)
math	kai-xu/Llama-3.1-8B-Instruct-MATH-Finetuned-LoRA	282fb3324fe8dd6e	$13.0$ MB
code	yangao381/FlowerTune-Code-Llama-3.1-8B-Instruct-PEFT	44cba627372a7400	$105.0$ MB
general_nlp	zjudai/flowertune-general-nlp-lora-llama-3.1-8b-instruct	355d9b0d9469f652	$52.0$ MB
medical	yangao381/FlowerTune-Medical-Llama-3.1-8B-Instruct-PEFT	238d48683a228306	$105.0$ MB
Excluded by audit

Appendix

Table 3: The six Llama-3.1 candidate adapters (four audited, two excluded) with their HuggingFace identifiers. sha256[:16] is the first 16 hex digits of sha256sum on the actual weights file, pinning the exact checkpoint we used.

Task	Declared base	Rank	$\alpha$	Total $\\|\Delta\\|_{F}$	Verdict
code	Mistral-7B-Instruct- v0.1	16	32	3.625	FAIL (version)
math	Mistral-7B-Instruct-v0.3	16	32	5.200	PASS
general_nlp	Mistral-7B-Instruct-v0.3	8	8	7.522	PASS
creative_writing	Mistral-7B-Instruct- v0.2	8	16	7.164	FAIL (version)

Appendix

Table 4: Cross-family audit on a candidate Mistral-7B-Instruct-v0.3 adapter set. “Declared base” is the value read from the adapter’s adapter_config.json ; the audit target is mistralai/Mistral-7B-Instruct-v0.3 . Both failing adapters have non-trivial Frobenius norms; the version check is what catches them.

Single-adapter reference
	Mistral-7B-v0.3		Llama-3.1-8B
Method	GSM8K $\pm$ stderr	$\Delta$	GSM8K	$\Delta$
Baseline (no merge)	0.498 $\pm$ 0.014	—	0.707	—
math alone	0.527 $\pm$ 0.014	$+0.029$	0.660	$-0.047$
general_nlp alone	0.365 $\pm$ 0.013	$-0.133$	0.654	$-0.053$
Merge methods (math + general_nlp on Mistral; 4 adapters on Llama)

Appendix

Table 5: Cross-family merging on Mistral-7B-Instruct-v0.3 with the two audited adapters (math, general_nlp). Scores on full GSM8K test (1,319 problems, strict-match),

\pm

binomial stderr.

\Delta

vs. Mistral baseline. Llama-3.1-8B numbers are the corresponding 4-adapter merges from Table 1 for comparison. HumanEval is omitted for Mistral due to protocol-sensitivity (see prose).

Adapter	Benchmark	Single-adapter score	$\Delta$ vs. baseline
Baseline (no adapter)	GSM8K	0.707	—
Baseline (no adapter)	HumanEval	0.628	—
Baseline (no adapter)	MATH-500	0.154	—
math	MATH-500	0.164	$+0.010$
math	GSM8K	0.660	$-0.047$
code	HumanEval	0.598	$-0.030$

Appendix

Table 6: Single-adapter reference evaluations.

\Delta

is the signed change vs. the unmerged baseline on the same benchmark.

Figure 3: GSM8K probe accuracy vs. per-adapter coefficient

\lambda

on the audited 4-adapter Llama-3.1-8B-Instruct merge from a gradient-free coordinate search (

n{=}200

probe). Three adapters peak at

\lambda{=}+1

; math peaks at

\lambda{=}-0.5

(red region), outside the positive-only coefficient space of TA/TIES/DARE/MagMax (Fig. 2 ).

Adapter	$\lambda{=}-0.5$	$\lambda{=}0$	$\lambda{=}0.5$	$\lambda{=}1.0$	Best
code	0.395	0.390	0.395	0.420	$+1.0$
math	0.490	0.435	0.450	0.430	$\boldsymbol{-0.5}$
general_nlp	0.305	0.315	0.315	0.470	$+1.0$
medical	0.265	0.330	0.315	0.340	$+1.0$

Appendix

Table 7: Per-adapter probe-accuracy trajectory. Each cell is the 200-example probe accuracy after setting the named adapter’s coefficient to the column value, holding other adapters at their current value. “Best” is the

\lambda

retained for that adapter before moving on: the search adopts a candidate only if it improves the running best, otherwise the adapter keeps its default

\lambda{=}1.0

. For general_nlp and medical no candidate beat the running best

0.490

established by math at

\lambda{=}-0.5

(the per-row max for those two rows is

0.470

and

0.340

respectively), so

\lambda{=}1.0

is retained as the default; the final-configuration probe accuracy (

0.490

) coincides with the math row’s chosen value.

Figure 4: Per-block leakage-free importance (GSM8K-train probe,

n{=}50

). Bars are the change in probe accuracy from freezing each block’s deltas during the merge; negative bars mark blocks whose deltas help the protected task.

14

32

blocks are negative, concentrated at the depth boundaries.

Method	GSM8K	HE p@1	MATH-500
Baseline (no merge)	0.707 $\pm$ 0.013	0.628 $\pm$ 0.038	0.154 $\pm$ 0.016
Naive merge	0.603 $\pm$ 0.013	0.445 $\pm$ 0.039	0.142 $\pm$ 0.016
Task Arith. $\lambda{=}0.5$	0.705 $\pm$ 0.013	0.561 $\pm$ 0.039	0.170 $\pm$ 0.017
TIES $d{=}0.5$	0.712 $\pm$ 0.012	0.543 $\pm$ 0.039	0.172 $\pm$ 0.017
DARE $d{=}0.5$	0.622 $\pm$ 0.013	0.457 $\pm$ 0.039	0.144 $\pm$ 0.016
MagMax	0.685 $\pm$ 0.013	0.524 $\pm$ 0.039	0.168 $\pm$ 0.017

Appendix

Table 8: All methods on full test sets with standard errors. Bold: best non-baseline per column. Lower section: hyperparameter sensitivity at

\lambda{=}0.3

d{=}0.3

for the magnitude family.

Analysis	Probe size	$\alpha$ -selection size
Leakage-free block importance probe	$50$ (train $[0{:}50]$ )	$200$ (train $[50{:}250]$ )
Negation finding (Table 7 )	$200$	—

Appendix

Table 9: Probe and selection split sizes used per experiment. All probe and selection draws are from the GSM8K train split, disjoint from the GSM8K test set (1,319 problems) used only for final reporting.

Adapter	Norm	$\geq 0.1$	$\geq 0.5$	$\geq 1.0$	$\geq 1.5$	$\geq 2.0$	$\geq 5.0$
math (kai-xu)	16.62	✓	✓	✓	✓	✓	✓
code (FlowerTune)	1.73	✓	✓	✓	✓	—	—
medical (FlowerTune)	1.55	✓	✓	✓	✓	—	—
general_nlp (zjudai)	1.07	✓	✓	✓	—	—	—
no-op “code” (excluded)	0.02	—	—	—	—	—	—

Appendix

Table 10: Audit threshold sensitivity. “Accept” if total delta norm

\geq

threshold. Audited (used in paper) adapters are listed first; the no-op adapter is listed last for contrast. The wrong-base-model adapter is rejected by the base-model-match check independent of the norm threshold.

Config	GSM8K	$\Delta$ / $\Delta_{4}$	HE p@1	$\Delta$ / $\Delta_{4}$
Audited 4 (this reproduction)	$0.615$	$-9.2$ / $\phantom{-}0.0$	$0.476$	$-15.2$ / $\phantom{-}0.0$
Audited 4 + defective “code”	$0.612$	$-9.6$ / $-0.3$	$0.476$	$-15.2$ / $\phantom{-}0.0$
Audited 4 + wrong-base (Blackroot)	$0.381$	$\mathbf{-32.7}$ / $\mathbf{-23.4}$	$0.409$	$-21.9$ / $-6.7$
Audited 4 + both excluded	$0.367$	$-34.0$ / $-24.8$	$0.427$	$-20.1$ / $-4.9$
Pre-audit swap (4-adapter, original)	$\mathbf{0.491}$	$\mathbf{-21.7}$ / $\mathbf{-12.4}$	$0.402$	$-22.6$ / $-7.4$

Appendix

Table 11: Excluded-adapter ablation. “Audited 4” is the headline configuration of Table 1 . The two excluded adapters from App. A are each added on top of the audited set; “pre-audit swap” replaces the audited code and medical adapters with the two excluded ones, reproducing the original (pre-audit) candidate-pool configuration on the full test sets.

\Delta

is vs the unmerged baseline (GSM8K

0.707

/ HE

0.628

);

\Delta_{4}

is vs the audited-4 naive row in this table (

0.615

0.476

). The audited-4 row of Table 1 reads

0.603

0.445

; the

\sim

1pp gap is the harness-version drift documented in the “reproduction caveat” below.

Family	Loadable	Pass audit	Base mismatch (of loadable)	Near-zero norm (of loadable)
Llama-3.1-8B-Instruct	$35/40$ ( $87.5\%$ )	$6/40$ ( $15.0\%$ )	$15/35$ ( $42.9\%$ )	$10/35$ ( $28.6\%$ )
Mistral-7B-Instruct-v0.3	$27/40$ ( $67.5\%$ )	$0/40$ ( $\mathbf{0.0\%}$ )	$26/27$ ( $\mathbf{96.3\%}$ )	$1/27$ ( $3.7\%$ )
Combined ( $N{=}80$ )	$62/80$ ( $77.5\%$ )	$6/80$ ( $7.5\%$ )	$41/62$ ( $\mathbf{66.1\%}$ )	$11/62$ ( $17.7\%$ )

Appendix

Table 12: Random-sample prevalence audit,

N{=}40

per base-model family. “Loadable” means adapter_config.json and weights file both loaded. Rates “of loadable” are computed conditional on loadability.

Scale	Family	Pass audit	Base mismatch	Near-zero norm
1B	Llama-3.2-1B	$4/40$ ( $10.0\%$ )	$81\%$	$8\%$
3B	Llama-3.2-3B	$5/40$ ( $12.5\%$ )	$81\%$	$0\%$
7B	Qwen2.5-7B	$3/40$ ( $7.5\%$ )	$91\%$	$3\%$
7B	Mistral-7B-v0.3	$0/40$ ( $0.0\%$ )	$96\%$	$4\%$
8B	Llama-3.1-8B	$6/40$ ( $15.0\%$ )	$43\%$	$29\%$

Appendix

Table 13: Cross-scale random-sample prevalence audit (

N{=}40

per family, seed 1234). Rates “of loadable” are conditional on the adapter loading. The

8

B and Mistral rows are from Table 12 .

Adapter (slot)	Meta	Tok	KL	top-1	gen-sim	Interpretation
math (audited)	PASS	ok	$0.42$	$0.60$	$0.67$	plausible effect
code (audited)	PASS	ok	$0.04$	$0.80$	$0.87$	plausible effect
general_nlp (audited)	PASS	ok	$0.01$	$0.70$	$0.84$	plausible effect
medical (audited)	PASS	ok	$0.06$	$0.60$	$0.82$	plausible effect
code-defective (TianJun1)	FAIL	warn	$-0.00$	$\mathbf{1.00}$	$\mathbf{1.00}$	no-op (confirmed)
wrong-base (Blackroot)	FAIL	ok	$0.10$	$0.80$	$0.75$	plausible effect (!)

Appendix

Table 14: Augmented audit signals on the candidate set. “Meta” is the two-check verdict from Sec. 3 ; “Tok” is the tokenizer check from this section; KL / top-1 / sim are the divergence test outputs. “Interp” is a heuristic interpretation. Llama only; Mistral follows the same pattern.

Method	GSM8K SC@8	GSM8K greedy	HE pass@1	HE pass@10
Baseline	0.856	0.814	0.612	0.732
Naive	0.760	0.676	0.482	0.604
TA $\lambda{=}0.5$	0.844	0.792	0.587	0.744
TIES $d{=}0.5$	0.856	0.782	0.583	0.732

Appendix

Table 15: Sampling robustness on the audited 4-adapter set. GSM8K: self-consistency@8 (majority vote,

T{=}0.7

) and greedy on the same

500

-question subset (first

500

test indices, evaluated with a custom

4

-shot chain-of-thought prompt rather than lm-eval’s strict-match harness; the resulting baseline greedy of

0.814

{\sim}11

pp above the full-test lm-eval baseline of

0.707

in Table 1 , so absolute numbers here are not directly comparable across tables — the claim of this table is the cross-method ordering , which matches the full-test ordering). HumanEval: pass@1 and pass@10 (

T{=}0.2

10

samples, lm-eval repeats mechanism).

Method	+code	+math	+nlp	+medical
Naive	0.685	0.651	0.629	0.615
TA $\lambda{=}0.5$	0.683	0.707	0.688	0.701
TIES $d{=}0.5$	0.691	0.713	0.692	0.719
DARE $d{=}0.5$	0.704	0.647	0.624	0.580
MagMax	0.678	0.699	0.684	0.686

Appendix

Table 16: Per-step GSM8K accuracy after each adapter merge (audited set, full test). Unmerged baseline

0.707

. The final column comes from a later run with the current harness (its naive entry,

0.615

, matches the reproduction in App. H ), so it differs from the GSM8K column of Table 1 by

+1.2

pp (naive),

-0.4

pp (TA),

+0.7

pp (TIES),

-4.2

pp (DARE), and

+0.1

pp (MagMax).

Merger	Pool	GSM8K	HE	GSM8K $\Delta$ vs unmerged
Naive (App. H )	Audited	$0.615$	$0.476$	$-9.2$
Naive (App. H )	Pre-audit swap	$0.491$	$0.402$	$-21.7$
Orthogonal proj.	Audited	$\mathbf{0.635}$	$0.476$	$-7.3$
Orthogonal proj.	Pre-audit swap	$\mathbf{0.523}$	$0.476$	$-18.4$

Appendix

Table 17: Orthogonal-projection merger on the audited and pre-audit 4-adapter sets; comparison with naive merge from App. H . Full GSM8K (1,319) and HumanEval (164) test sets; greedy decoding; single seed.

Language Model Merging

Language model merging combines capabilities from multiple models or adapters by composing their weights, updates, or outputs.

See all 114 papers

Predicting Mergeability of Parameter-Efficient Fine-Tuning Updates
Jun 17, 2026Lin Tang, Wei Zhang, Jing Li +3Low-Rank Adaptation Language Model Merging
1Sichuan University, Chengdu, China · University of Electronic Science and Technology of China, Chengdu, China
When the Merge Coefficient Stops Mattering: Proximity Regularized Merging for Continual LoRA Adaptation
Sep 26, 2026Yixuan Liu, Yuhao Sun, Sen Song +1Continual Learning Incremental Learning
Sapient Intelligence · Tsinghua University
A Margin Perspective on LoRA: Robustness to Catastrophic Forgetting and Adapter Merging (MaLoRA)
Nov 10, 2026Ziqing Xu, Hancheng Min, Lachlan Ewen MacDonald +4Low-Rank Adaptation Model Merging
Statistics and Data Science, University of Pennsylvania · IDEAS, University of Pennsylvania · INS & SMS, Shanghai Jiao Tong University +5

Jun 17, 2026J/K move · Enter open · S save

Predicting Mergeability of Parameter-Efficient Fine-Tuning Updates

Lin Tang, Wei Zhang, Jing Li, Hongyu Chen+2

1Sichuan University, Chengdu, China · University of Electronic Science and Technology of China, Chengdu, China

Low-Rank Adaptation Language Model Merging Model Merging Parameter-Efficient Fine-Tuning

Open paper AskPDF arXiv

Low-rank adaptation (LoRA) makes it cheap to train many domain- and task-specific language model adapters, but whether two adapters can be merged is usually discovered only after both have been fully trained and evaluated. This late feedback is costly: adapters that are strong in isolation can interfere destructively once their updates are combined. We ask whether this outcome can be anticipated. We formalize adapter mergeability as the degree to which an adapter preserves its single-task utility after merging, and show that it can be forecast from signals measured in the first few percent of training -- chiefly how the low-rank updates and their gradients align across tasks and how much they disturb shared representations. We package these signals into MergeProbe, a lightweight predictor that estimates pairwise and set-level retention and turns the estimate into a concrete decision: merge directly, reweight, prune, or route. On MERGE-PEFT, a five-domain benchmark spanning math, code, science, instruction following, and safety, MergeProbe attains the best average and worst-case retention among strong interference-aware merge baselines while adding far less deployment overhead than full task routing. This turns LoRA merging from a post-hoc engineering step into an anticipatory measurement problem.

Abstract

Language Model Merging

Explore similar work

Predicting Mergeability of Parameter-Efficient Fine-Tuning Updates

When the Merge Coefficient Stops Mattering: Proximity Regularized Merging for Continual LoRA Adaptation

A Margin Perspective on LoRA: Robustness to Catastrophic Forgetting and Adapter Merging (MaLoRA)