Preprint says MoE router logs can help reveal whether an example was in fine-tuning data

A preprint posted to arXiv on 7 October 2026 argues that logs of which experts a mixture-of-experts (MoE) language model activates can leak information about its fine-tuning data. The paper, by Yixin Tan, Jiayang Liu, Lu Sun, Yuke Hu, Zheng Li and Rui Wen, is titled "When Routing Reveals Membership."

MoE models send each input to a subset of internal experts through a router. The authors note that this routing information may be logged or exposed for monitoring, debugging, load analysis and safety auditing. Their question is whether it can show if a particular example was used to fine-tune the deployed model, a task known as membership inference.

What is new is the test, not the concern: the authors combine ordinary output-based signals with aggregated routing features. A classifier is learned from independently fine-tuned shadow models and then applied to the target model. According to the authors, across three MoE architectures and three data domains, adding routing data beat a strong output-only ensemble in all nine settings, raising the true-positive rate at a 1% false-positive rate by 2.7 to 9.4 percentage points.

They report that the effect persists under full fine-tuning, frozen-router training, LoRA and instruction tuning. It also remains observable with only discrete expert selections, restricted telemetry or a single shadow model.

The authors' explanation is that the leak does not depend on the router memorizing anything. They say fine-tuning writes membership information into hidden representations, and the router exposes a projection of that signal even when its own parameters are frozen. They also report that perturbing the telemetry cuts the extra leakage only as the data becomes less faithful.

What is confirmed is limited. This article draws on the paper's abstract page, which is the only credible source located; searches found no independent coverage or replication of this specific paper. The figures are the authors' own results from a preprint that, as far as this review could establish, has not been peer reviewed. The abstract gives the size of the gain but not the absolute attack success rates, and it does not say how often such attacks would work against deployed systems or how commonly routing data is actually kept or shared. Details beyond the abstract were not reviewed.

The practical point is narrow but relevant. Teams that fine-tune MoE models and keep routing records for debugging or auditing may want to treat those records as privacy-relevant, alongside model outputs, until further work clarifies the risk.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. The earlier version remains available as revision 1.