arXiv 论文提出 declared change envelopes 认证模型更新的变更范围
Where Did the Update Go? Certifying Declared Change Envelopes for Model Updates
模型更新偷偷改了没声明的地方怎么办？这篇论文给了套统计认证方法，LoRA 更新实测只有 7-36% 变化在范围内，还发现锚定蒸馏能救场。
这篇 arXiv 论文提出 declared change envelopes 框架，开发者训练前承诺只在特定输入区域内改变行为，区域外的变化计为 leakage。论文在 1.5B 到 72B 参数模型上测试了 LoRA、全量微调、偏好优化、强化学习和知识编辑，发现领域 LoRA 更新只有约 7-36% 的变化落在声明范围内。在 256 个训练变体中，leakage 与更新在范围外输入上的 KL 散度相关（Spearman 0.94）。论文还发现对未标注数据做锚定蒸馏后，anchored LoRA 和 GRPO 更新只需几百到几千个未标注样本即可认证 5% leakage，但开放式聊天场景下任何更新都无法通过认证。
Where Did the Update Go? Certifying Declared Change Envelopes for Model Updates
Deployed language models are updated continually, and regulators increasingly accept changes that were declared in advance. Showing that an update changed behavior only where it was declared to is a different statistical problem from bounding how much it changed: a useful update is meant to change some decisions, so global disagreement and regression bounds cannot certify it. We formalize the problem with declared change envelopes. Before training, the developer commits to a region of inputs, and every decision that changes outside it counts as leakage. Leakage compares two models, so it can be certified from unlabeled traffic with anytime-valid tests whose sample cost we bound from above and below, and per-update certificates compose into a bound on lifetime drift outside all declared scopes. We measure leakage for LoRA and full fine-tuning, preference optimization, reinforcement learning, and knowledge editing on models from 1.5B to 72B parameters. Narrow updates leak widely: domain and policy LoRA updates keep only about 7-36% of the decisions they change inside the declared scope. Across 256 trained variants, leakage tracks the update's KL divergence to the incumbent on out-of-scope inputs (Spearman 0.94). None of the customary remedies we tested makes a rule-like update certifiable without giving up much of its intended change. Distilling the incumbent's decisions on unlabeled prompts in the deployment format does: anchored LoRA, GRPO, and (at a small learning rate) full fine-tuning updates certify 5% leakage from a few hundred to a few thousand unlabeled samples, and the certificates replicate on held-out traffic and on written answers. The certificates cover decision-like outputs only; on open-ended chat, re-batching alone changes 11-21% of responses and no update certifies. Code: https://github.com/Usama1002/declared-change-envelopes
