WARP: Weight-Space Analysis for Recovering Training Data Portfolios

Abstract: Foundation models are routinely released to the public, yet the data recipes used to train them -- such as domain mixture weights that determine how different sources are sampled -- are rarely disclosed. This creates an access asymmetry: researchers study the resulting models but lack visibility into the training distribution that produces them. Prior works for inferring training data, such as membership inference, detect at the level of individual samples and thus cannot characterize the global composition of the training corpus. We introduce WARP, a framework that recovers a fine-tuned model's training mixtures directly from its released weights. WARP interpolates between the base and fine-tuned models using model merging, generating pseudo-checkpoints that approximate the missing training trajectory and expose a geometric footprint of the training data in the weight space. From these simulated footprints, WARP extracts geometric features and maps them to domain proportions using either a parameter-free softmax readout or an MLP projector trained on synthetic mixtures. In controlled experiments with BERT and GPT-2, WARP recovers domain mixtures with an average MAE as low as 0.046 and 0.104 respectively, outperforming membership inference and a variant with access to the true training trajectory.

• The paper introduces WARP, which recovers a fine-tuned model's domain mixture using weight-space interpolation between base and reference weights.
• It leverages geometric footprint extraction via gradient alignment from pseudo-checkpoints to map training data portfolios.
• The method demonstrates low mean absolute error on BERT and GPT-2, outperforming sample-level membership inference baselines.

Weight-Space Analysis for Recovering Training Data Portfolios: An Expert Summary

Problem Setting and Motivation

The proliferation of foundation models has led to an inversion of the classical paradigm: model weights are routinely released, but the data mixtures used to fine-tune these models remain proprietary and undisclosed. This opacity presents a data recipe/model access asymmetry, which constrains research on data-centric optimization, auditing for contamination, and interpretability. The standard direction in data mixture optimization—deriving an optimal sampling policy and then training the model—cannot reconstruct the original mixture from the trained weights. Prior work in membership inference only tests inclusion at the level of individual samples and provides no aggregate visibility into the underlying data mixture proportions across domains.

Figure 1: The forward problem optimizes training mixture π to produce model weights θ; the inverse problem seeks to recover domain mixture π given only baseline and reference weights.

The WARP Framework

WARP (Weight-space Analysis for Recovering Training Data Portfolios) targets this inverse problem: recovering a fine-tuned model's domain mixture $\pi^*$ from released weights $\theta_{\text{ref}}$ and the associated base model $\theta_{\text{base}}$, using only a small probing dataset with labeled examples from the constituent domains. The key premise is that the global geometry of the model's weight-space evolution encodes a footprint of the data mixture. However, as only endpoints (start and finish of fine-tuning) are available, WARP leverages model merging/interpolation techniques to synthesize pseudo-checkpoints along plausible trajectories between $\theta_{\text{base}}$ and $\theta_{\text{ref}}$.

The WARP pipeline decomposes as follows:

1. Trajectory Simulation: Pseudo-checkpoints are constructed via linear, spherical, or advanced merging (e.g., TIES) operators between the base and reference weights. This defines a sequence of interpolated models $\{\tilde{\theta}_t\}$ as proxies for training progression.
2. Geometric Footprint Extraction: At each pseudo-checkpoint, gradients of probing samples are projected onto the vector from the current checkpoint to $\theta_{\text{ref}}$. This "Mimic Score" quantifies how each domain's data would have advanced the model along the actual fine-tuning direction.
3. Mixture Prediction: Aggregated per-domain, per-step footprint matrices are mapped to mixture estimates via either (a) a label-free softmax readout or (b) a supervised MLP projector learned by constructing synthetic mixture–footprint pairs.

   Figure 2: WARP simulates the unobserved trajectory via model merging, measures gradient alignment via Mimic Scores, then maps the geometric footprint to a predicted domain mixture.

Experimental Methodology and Results

Controlled experiments are conducted on BERT-base and GPT-2-small fine-tuned over known mixtures from diverse text classification datasets (SNLI, AGNews, Yelp, Yahoo), allowing quantitative measurement of mixture recovery error. For each run, the reference model is fine-tuned under a sampled mixture; probing sets are drawn separately.

Mixture recovery performance, measured as mean absolute error (MAE) between predicted and true mixtures, demonstrates that WARP's weight-space geometric approach offers a strong and robust signal. The supervised 2-layer MLP variant achieves MAE as low as 0.046 on BERT and 0.104 on GPT-2, outperforming strong sample-level membership inference baselines by significant margins. Notably, even the unsupervised (parameter-free) softmax readout is competitive and frequently outperforms baselines.

An important empirical finding is that interpolated (simulated) checkpoint sequences match or even outperform oracle variants using saved real fine-tuning checkpoints. This suggests that model merging creates smoother, more predictable trajectories, facilitating easier readout of the data footprint.

Across multiple checkpointing policies (early, converged, overtrained), WARP's mixture estimates remain robust, highlighting the method's applicability to practical settings where the exact stopping point of fine-tuning is uncontrolled.

Implications and Theoretical Significance

WARP provides formalization and methodology for an inverse mapping from model weights to training domain mixtures, exploiting weight-space geometry as a persistent trace of the training recipe. This approach goes beyond the limitations of sample-level membership inference by identifying global data portfolio structure, allowing for:

• Auditing: Checking released models for contamination or unwanted domain emphasis given only probe sets and endpoints.
• Interpretability: Inferring why a model might display domain-specific behavior post hoc.
• Transparency: Enhancing reproducibility and scrutiny in situations where training data cannot be shared.

Additionally, the finding that interpolation-based trajectories in weight-space (LERP, SLERP, TIES) serve as effective surrogates for unlogged fine-tuning paths has implications for other forms of weight-space analysis, potentially informing future diagnostic, attribution, and editing tools.

Limitations and Future Directions

While WARP is validated on moderate-sized transformer architectures and a controlled number of domains, scaling to multi-stage, curriculum-based LLM training and to much larger domain taxonomies remains an open challenge. The interpretability of the learned mapping from geometric footprints to mixtures deserves further analysis, as does the potential for fully unsupervised readouts with more sophisticated, adaptive aggregation mechanisms. Extension to settings where only partial domain-decomposable probe sets are available is another avenue for development.

Conclusion

WARP demonstrates that weight-space geometric analysis, augmented by model merging, enables accurate and robust recovery of a model's data mixture from accessible endpoints. This provides a foundation for transparency and post hoc auditing of large models in environments where training data access is asymmetrical. The approach presented opens new theoretical and practical directions for backward inference on foundation models, leveraging the persistent traces of data curation decisions embedded in the weight space.

(2607.01686)