mlsanityData to 14 Oct 2026

Dataset Size Recovery from LoRA Weights

arXiv 2406.19395 ↗First posted 27 Jun 2024cs.CVcited by 7

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Model inversion and membership inference attacks aim to reconstruct and verify the data which a model was trained on. However, they are not guaranteed to find all training samples as they do not know the size of the training set. In this paper, we introduce a new task: dataset size recovery, that aims to determine the number of samples used to train a model, directly from its weights. We then propose DSiRe, a method for recovering the number of images used to fine-tune a model, in the common case where fine-tuning uses LoRA. We discover that both the norm and the spectrum of the LoRA matrices are closely linked to the fine-tuning dataset size; we leverage this finding to propose a simple yet effective prediction algorithm. To evaluate dataset size recovery of LoRA weights, we develop and release a new benchmark, LoRA-WiSE, consisting of over 25000 weight snapshots from more than 2000 diverse LoRA fine-tuned models. Our best classifier can predict the number of fine-tuning images with a mean absolute error of 0.36 images, establishing the feasibility of this attack.

Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 46 of its 56 references that are in the map. First posted on arXiv 27 Jun 2024.

Builds on

46 of 56 references.

Closest ancestors · 8

Same direction, newest first

  1. 2023Students Parrot Their Teachers: Membership Inference on Model Distillation6 Mar
  2. 2023Membership Inference Attacks against Diffusion Models7 Feb
  3. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  4. 2023Membership Inference of Diffusion Models24 Jan
  5. 2021Membership Inference Attacks From First Principles7 Dec
  6. 2021On the Importance of Difficulty Calibration in Membership Inference Attacks15 Nov
  7. 2021Membership Inference Attacks on Machine Learning: A Survey14 Mar
  8. 2021Membership Inference Attacks are Easier on Difficult Problems15 Feb

Other references · 38

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  4. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  5. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  6. 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,503
  7. 2019Parameter-Efficient Transfer Learning for NLPcited by 4,236
  8. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,915
  9. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,795
  10. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,418
  11. 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,300
  12. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
26 more
  1. 2022Visual Prompt Tuningcited by 1,681
  2. 2023ProlificDreamer: High-Fidelity and Diverse Text-to-3D Generation with Variational Score Distillationcited by 1,219
  3. 2022Multi-Concept Customization of Text-to-Image Diffusioncited by 1,106
  4. 2023mPLUG-Owl: Modularization Empowers Large Language Models with Multimodalitycited by 1,040
  5. 2022Few-Shot Parameter-Efficient Fine-Tuning is Better and Cheaper than In-Context Learningcited by 896
  6. 2021Towards a Unified View of Parameter-Efficient Transfer Learningcited by 872
  7. 2021LiT: Zero-Shot Transfer with Locked-image text Tuningcited by 577
  8. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
  9. 2019Dreaming to Distill: Data-free Knowledge Transfer via DeepInversioncited by 423
  10. 2021Data-Free Knowledge Distillation for Heterogeneous Federated Learningcited by 383
  11. 2023Emu: Enhancing Image Generation Models Using Photogenic Needles in a Haystackcited by 279
  12. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
  13. 2023Break-A-Scene: Extracting Multiple Concepts from a Single Imagecited by 231
  14. 2022SpaText: Spatio-Textual Representation for Controllable Image Generationcited by 217
  15. 2022Fine-tuning Global Model via Data-Free Knowledge Distillation for Non-IID Federated Learningcited by 172
  16. 2021FedPara: Low-Rank Hadamard Product for Communication-Efficient Federated Learningcited by 141
  17. 2017Data-Free Knowledge Distillation for Deep Neural Networkscited by 136
  18. 2022Reconstructing Training Data from Trained Neural Networkscited by 133
  19. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  20. 2023Multitask Prompt Tuning Enables Parameter-Efficient Transfer Learningcited by 115
  21. 2020Generative Low-bitwidth Data Free Quantizationcited by 88
  22. 2022PSAQ-ViT V2: Towards Accurate and General Data-Free Quantization for Vision Transformerscited by 42
  23. 2021Qimera: Data-free Quantization with Synthetic Boundary Supporting Samplescited by 40
  24. 2023Re-thinking Model Inversion Attacks Against Deep Neural Networkscited by 39
  25. 2024Recovering the Pre-Fine-Tuning Weights of Generative Modelscited by 16
  26. 2024Data-free Knowledge Distillation for Fine-grained Visual Categorizationcited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 4; 2025: 2; 2026: 1.

7 papers.

  1. 2024Stable Flow: Vital Layers for Training-Free Image Editingcited by 113
  2. 2025Symmetry in Neural Network Parameter Spacescited by 36
  3. 2025We Should Chart an Atlas of All the World's Modelscited by 25
  4. 2024Learning on LoRAs: GL-Equivariant Processing of Low-Rank Weight Spaces for Large Finetuned Modelscited by 22
  5. 2024Deep Linear Probe Generators for Weight Space Learningcited by 17
  6. 2024Learning on Model Weights using Tree Expertscited by 7
  7. 2026W2T: LoRA Weights Already Know What They Can Docited by 5

Similar, not cited

Close in wording, no citation either way

  1. 2025StolenLoRA: Exploring LoRA Extraction Attacks via Synthetic Data
  2. 2024Risks When Sharing LoRA Fine-Tuned Diffusion Model Weights
  3. 2025LoRA-Leak: Membership Inference Attacks Against LoRA Fine-tuned Language Models
  4. 2024IterIS: Iterative Inference-Solving Alignment for LoRA Merging
  5. 2024Machine Unlearning on Pre-trained Models by Residual Feature Alignment Using LoRA
  6. 2025LoRA-X: Bridging Foundation Models with Training-Free Cross-Model Adaptation
  7. 2026The Intruder Threshold: A Spectral Law for LoRA Fine-Tuning
  8. 2025Recover-LoRA: Data-Free Accuracy Recovery of Degraded Language Models via Low-Rank Adaptation