LLMSurgeon：逆向破解大语言模型的"数字DNA"——预训练数据混合比例推断新方法

LLMSurgeon is a revolutionary framework that uses reverse engineering to infer the domain distribution of an LLM's pre-training data solely from its generated text. This breakthrough addresses the "black box" dilemma of LLMs (where training data composition is often hidden) and opens new avenues for AI model audit, transparency, and accountability. Key contributions include solving the data mixture inference problem via calibrated confusion matrices and constrained optimization, with a verifiable evaluation suite (LLMScan) supporting its effectiveness.

The pre-training data mixture (domain distribution) of LLMs is their "digital DNA"—critical to understanding model behavior, biases, and limitations. However, mainstream vendors (OpenAI, Google) and even open-source models rarely disclose precise data ratios, leading to info asymmetry: researchers can't reproduce results, users can't trace bias sources, and regulators lack effective audit tools. This gap led to the development of LLMSurgeon.

The problem is formalized as Data Mixture Surgery (DMS): given an LLM and domain taxonomy, estimate pre-training data domain distribution from generated text. Key challenges: sparse info (only inference access), domain confusion (overlapping semantics), label shift (training vs audit data distribution mismatch). Traditional methods (classify generated text then count) are flawed: classifier confusion amplifies errors, generated text distribution differs from training data, and rigid classification ignores fuzzy domain boundaries.

LLMSurgeon uses a two-step strategy:

1. Calibrated Soft Confusion Matrix: Uses classifier's probability outputs (not hard labels) and calibrates via temperature scaling to correct bias.
2. Constrained Inversion Optimization: Solves the linear inverse problem (observed distribution ≈ confusion matrix × real distribution) with constraints: non-negativity (ratios sum to 1), sparsity (few dominant domains), and hierarchy (sub-domain ratios ≤ parent domain). This stabilizes the solution and improves accuracy.

To validate DMS methods, LLMScan uses "recipe-verifiable" experiments: train open-source LLMs (Pythia, GPT-Neo) with known data mixture ratios, then test DMS inference against real ratios. It covers various model sizes, domain taxonomies, and sampling strategies. Evaluation metrics include KL/JS divergence (distribution similarity), domain-level relative error,排序一致性 (domain importance order), and robustness (to classifier data, sample count, domain definitions).

LLMSurgeon outperforms baselines: reduces error by over 40% vs naive classifier methods, improves solution quality vs simple inversion. Key findings:

• High-frequency domains are easier to infer accurately.
• Semantically similar domains (e.g., different programming languages) cause more confusion.
• 100s-1000s of generated samples are sufficient (marginal gains beyond that).
• Works stably across model scales (1.4B to12B params) and architectures.

LLMSurgeon has wide applications:

1. Model Audit: Verify vendor data claims, detect bias/pollution (critical for compliance).
2. Model Selection: Choose models with domain ratios matching use cases (e.g., legal docs → high legal data ratio).
3. Data Strategy: Help teams validate data sampling (e.g., detect unexpected filtering/repetition).
4. Safety/Alignment: Quantify links between data mixture and harmful content generation.

Current limitations:

• Dependent on pre-defined domain taxonomy (choice affects results).
• Challenges with closed API models (limited control over generated text).
• High computation cost (large models need many samples; optimization is complex).
• Vulnerable to adversarial models trained to hide data composition.

Future directions:

• Fine-grained溯源 (document/fragment level).
• Dynamic data mixture tracking (training process changes).
• Multi-modal extension (visual-language models).
• Privacy-preserving audit (zero-knowledge proofs, federated learning).