# From Representation to Readout: Mechanistic Analysis of Membership Signals in Language Models

DevFeed: [From Representation to Readout: Mechanistic Analysis of Membership Signals in Language Models](<https://devfeed.tech/articles/from-representation-to-readout-mechanistic-analysis-of-membership-signals-in-language-models-111585.md>)

Original publisher: [Read original article](<https://arxiv.org/abs/2610.41445>)

Author: Wenxi Dai, Jingyu Hu, Yanting Yang, Mengnan Du

Published: 2026-11-02T05:00:00Z

Content type: article

Language: en

Sources: [arXiv: Artificial Intelligence](<https://devfeed.tech/sources/arxiv-artificial-intelligence.md>), [arXiv: Machine Learning](<https://devfeed.tech/sources/arxiv-machine-learning.md>)

Topics: [LLM security](<https://devfeed.tech/topics/llm-security.md>), [Reinforcement learning](<https://devfeed.tech/topics/reinforcement-learning.md>), [rlvr](<https://devfeed.tech/topics/rlvr.md>)

Tags: [activation](<https://devfeed.tech/tags/activation.md>), [cs-ai](<https://devfeed.tech/tags/cs-ai.md>), [cs-lg](<https://devfeed.tech/tags/cs-lg.md>), [fine-tuning](<https://devfeed.tech/tags/fine-tuning.md>), [inference](<https://devfeed.tech/tags/inference.md>), [language-models](<https://devfeed.tech/tags/language-models.md>), [layers](<https://devfeed.tech/tags/layers.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [reinforcement-learning](<https://devfeed.tech/tags/reinforcement-learning.md>), [rlvr](<https://devfeed.tech/tags/rlvr.md>)

## AI overview

The study separates membership information encoded in language-model representations from how much the model exposes through its readout, using Decodable Information Score, Used Information Score, and Readout Accessibility Gap (DUG). Under supervised fine-tuning, membership-specific effects appear in both decodable information and readout; under reinforcement-learning-based membership inference, they appear primarily in readout. Activation patching localizes the effect to intermediate layers. In a separate RLVR contamination setting, behavioral changes can occur without a corresponding increase in likelihood-based membership inference signals.

## Source excerpt

arXiv:2610.41445v1 Announce Type: new Abstract: Membership inference aims to determine whether a particular example was included in a model's training data. Such membership signals are often broadly described as memorization, while the underlying mechanisms can involve both how information is represented internally and how it is accessed by the model to produce behaviors. We therefore present a mechanistic study of membership signals in large language models (LLMs). We introduce Decodable Information Score, Used Information Score, and Readout Accessibility Gap (DUG), a set of complementary measures that separately quantify membership information decodable from internal representations and the extent to which it is exposed through the model's readout. Across supervised fine-tuning (SFT) and reinforcement learning (RL)-based membership inference methods, membership-specific effects appear in both the amount of decodable information and readout under SFT, while under RL-based membership inference methods they appear primarily in readout. Activation patching further localizes this membership-specific effect to intermediate layers. To examine whether these findings extend to a more general RL setting, we further study reinforcement learning with verifiable rewards (RLVR) contamination, where the training reward is independent of the reference solution. In this setting, we find that behavioral changes can emerge without a corresponding increase in likelihood-based membership inference signals.