MoE routing logs can sharpen membership attacks, preprint reports

Routing information from mixture-of-experts (MoE) language models can help reveal whether a particular example was used to fine-tune a model, according to a preprint submitted to arXiv on October 7, 2026. The authors report that adding this internal telemetry improved membership-inference attacks across nine experimental settings.

The paper, When Routing Reveals Membership: Privacy Leakage from MoE Router Telemetry, examines information that its authors say may be logged or exposed for monitoring, debugging, load analysis and safety auditing. Unlike a model's answers, routing telemetry offers a view into its internal computation, including expert selections.

The attack combines signals from model outputs with aggregated routing features. The researchers train a membership classifier using separately fine-tuned shadow models, then apply it to a target model. Across three MoE architectures and three data domains, adding routing information increased the true-positive rate by 2.7–9.4 percentage points at a fixed 1% false-positive rate, compared with what the authors describe as a strong output-signal ensemble. Those figures are gains over the baseline, not absolute attack success rates.

Freezing the router did not eliminate the reported leakage. The authors also observed it under full fine-tuning, LoRA and instruction tuning, and with restricted telemetry or only discrete expert selections. Their explanation is that fine-tuning embeds membership information in hidden representations; the router exposes part of that signal without needing to memorize examples itself. They also report that perturbing the telemetry reduced the additional leakage only as the telemetry became less faithful.

The available evidence is the abstract, not a review of the full experiments. It supplies neither absolute attack success rates nor evidence of how often an attacker could obtain useful routing telemetry from deployed systems. The reported improvement therefore leaves an important operational question unanswered: how accessible is the information the attack needs?