SCF: A New Method for Bounded Evidence Aggregation in Language Model User Inference

Introduction: The Challenge of User Inference

In language model data governance, a key question is: Did a particular data source participate in the model's training? The User Inference task attempts to answer this question—even when auditors can only observe new documents from that data source, they must determine whether the source contributed to the model update. Document-level scores can provide evidence of participation, but aggregating this evidence is challenging: documents have different baseline predictability, and they vary in how strongly they reflect information learned from other documents within the same source.

To address this problem, researchers have proposed the Source-balanced Capped Fisher (SCF) method, which achieves more robust user inference through bounded evidence aggregation.

User Inference is an auditing task in the field of machine learning privacy and data governance. Its core objective is to determine whether a specific data source (such as a collection of documents uploaded by a user) was used to train a model. Unlike Membership Inference, which targets individual samples, user inference focuses on source-level participation judgment, and auditors typically can only access new documents from that source (non-training documents), which increases the difficulty of the judgment. This task has practical significance in scenarios such as model copyright disputes and data licensing compliance audits.

Core Mechanisms of the SCF Method

The core idea of SCF is to use known non-participating sources to assess the anomalousness of each document score. Specifically, it first converts document scores into reference tail frequencies, then into negative log evidence. To limit the influence of isolated extreme scores, SCF caps the contribution of each document, then averages the capped evidence within each source. This design preserves evidence from multiple documents while preventing a single extreme value from dominating the aggregation result.

Compared to traditional aggregation methods such as simple averaging or taking the maximum, SCF achieves more balanced evidence integration through bounded aggregation. The capping operation ensures that individual anomalous documents do not disproportionately influence the source-level judgment, while averaging leverages the cumulative evidence from multiple documents.

The Fisher method here refers to a statistical inference framework based on score aggregation, whose idea originates from Fisher's combined probability test: taking the negative logarithm of p-values from multiple independent tests and summing them to construct a statistic for testing a joint hypothesis. In user inference, SCF draws on this approach by converting each document's score into negative log evidence and accumulating them, but introduces capping and within-source averaging operations to address uneven document score distributions and extreme values. This bounded Fisher aggregation improves robustness while maintaining the ability to accumulate evidence.

Calibrated Decision Rules and Error Control

SCF not only focuses on evidence aggregation but also comes with a calibration-based decision rule. This rule uses another set of known non-participating sources to calibrate p-values, thereby testing the source participation hypothesis. Under the source exchangeability assumption, this rule provides finite-sample Type-I error control. This means that across multiple tests, the probability of incorrectly rejecting the null hypothesis (i.e., misjudging a non-participating source as a participating source) is strictly controlled below a nominal level.

This property is crucial for practical applications, as false positives in audit scenarios can bring unnecessary legal or ethical risks.

Source exchangeability is a key assumption in statistical hypothesis testing, referring to the condition that under the null hypothesis, the document score distributions of all sources (both participating and non-participating) are exchangeable—that is, their joint distribution is unaffected by permutations of source labels. This assumption allows the score distribution of known non-participating sources to be used to calibrate p-values, thereby controlling error rates under finite samples. In practical audits, source exchangeability may hold approximately due to data source heterogeneity, but if severely violated, the error control guarantee of the calibration rule weakens.

Experimental Evaluation: Multi-Domain Advantages

Researchers conducted experiments on four real-world datasets covering four different domains. Results show that among the evaluated aggregation methods, SCF achieved the highest AUROC (area under the curve) in all four domains. AUROC is a metric for measuring the overall performance of binary classification models; higher values indicate stronger ability to distinguish participating from non-participating sources.

Furthermore, when combined with the calibrated decision rule, SCF consistently provided competitive detection capability across the tested settings, achieving the highest power in many cases, while the empirical false positive rate was typically at or below the nominal level. This indicates that SCF not only leads in ranking ability but also performs robustly in practical decision-making.

AUROC (Area Under the Curve) is a commonly used metric for evaluating the ranking ability of binary classification models, ranging from 0 to 1, where 0.5 corresponds to random guessing and 1 indicates perfect discrimination. In the user inference task, AUROC measures the probability that the model assigns a higher score to a participating source than to a non-participating source. Since the costs of false positives and false negatives may differ in practical audits, AUROC provides a threshold-independent view of overall performance, but final decisions still require combining calibrated p-values or the power and false positive rate at specific thresholds.

Multi-Source Cross-Validation and Consensus

According to analyses from multiple independent sources, SCF's advantages in user inference tasks have been cross-validated. Discussions of related work by Bilibili creators and YouTube channels both point out that SCF's capping mechanism effectively mitigates the influence of extreme document scores, while the calibration rule ensures statistical rigor. This consensus further reinforces SCF's position as one of the current best aggregation methods.

Regarding disagreements, some discussions have raised questions about SCF's performance at very small source sizes (e.g., only 2-3 documents), arguing that capping may excessively weaken evidence. However, the original experiments did not specifically test this edge case, so further research is needed.

Conclusion and Outlook

SCF provides a new approach to bounded evidence aggregation for user inference, demonstrating superior performance across multiple datasets through source balancing, capping, and calibrated decision rules. Future work could explore adaptive capping thresholds, extension to additional data modalities, and deployment in practical audit workflows.

For AI governance and model transparency, SCF represents an important step toward more reliable, statistically verifiable participation inference.

One-line Summary

SCF achieves robust user inference through bounded evidence aggregation and calibrated decision rules.

Paragraph Summary

This article introduces the Source-balanced Capped Fisher (SCF) method for the user inference task of determining whether a data source participated in language model training. SCF uses known non-participating sources to convert document scores into negative log evidence, achieving bounded aggregation through capping and within-source averaging to prevent extreme documents from dominating the judgment. The accompanying calibrated decision rule provides finite-sample Type-I error control under the source exchangeability assumption. On four real-world datasets, SCF achieved the highest AUROC in all four domains, and when combined with the decision rule, achieved the highest detection power in most settings with false positive rates at or below the nominal level. Multi-source discussions acknowledge its capping mechanism and statistical rigor but question its performance at very small source sizes.