PaperfootJoin free
arXiv

Chips reveal training-data signals in transformer models

TranScope distinguished inputs within and outside training-data patterns with an area under the curve score of 0.9 against 0.6 for PETAL.

Paper by Joshua Kalyanapu, Darsh Asher, Kaushal Mhapsekar, 4 more authorsSamira Mirbagher Ajorpaz
Figure 4. A TranScope root-cause mechanism: member vs. non-member inputs traverse identical software paths but diverge in the memory hierarchy.
Open the figure at full size
Figure 4. A TranScope root-cause mechanism: member vs. non-member inputs traverse identical software paths but diverge in the memory hierarchy.A TranScope root-cause mechanism: member vs. non-member inputs traverse identical software paths but diverge in the memory hierarchy.Kalyanapu et al., CC BY
Preprint: system

Edited by Boris Djordjevic · Paperfoot

Paper

In a preprint, researchers built TranScope, a hardware-monitoring tool tested on large language models and vision transformers, a type of image model. It classified inputs by whether they fit the patterns represented in training data. The researchers examined interactions between these models and processor components, including integrated accelerators, across individual clock cycles. They detected the signal even with constant running times and hidden confidence scores.

They traced the effect to tokenization, which divides data into smaller units during training. This changed memory-access patterns when retrieving vocabulary tokens during later use, affecting hardware involved in locating data in memory. TranScope scored 0.9 in area under the curve, a measure of classification performance, against 0.6 for PETAL, the best previously reported tool. It operated at low cost without requiring a separately trained stand-in model.

Why it matters

The hardware measurements exposed information about training-data patterns despite constant running times and hidden confidence scores. The authors identify this as a privacy channel and suggest an opportunity for tools to check possible copyright violations.

Caveats

The reported classification does not establish that a particular input appeared in the training set; the abstract also does not specify the chips, model sizes, datasets or variation across runs behind the comparison. The work is a preprint and has not yet been peer-reviewed.

In this paper

hardware-based membership inference on black-box models

Methods
TranScope (this paper)PETAL (baseline)

Results

TranScope, AUC: 0.9 AUC

Building on the above observation, we introduce TranScope: the first microarchitecture tool for detecting membership information with low cost, no need for a surrogate model, and significantly higher robustness, e.g., 0.6 AUC for PETAL (best previously reported) vs 0.9 AUC (ours).

Abstract

What it shows

Data used to train a model affects its execution footprint and microarchitectural state even in constant-time, static models without input-dependent branches or dynamic optimization.

The results confirm that the answer is yes and identify which modern hardware components, such as TLBs or on-core accelerators, reveal or amplify that effect.

Abstract

Transformer tokenization during training alters vocabulary fetch locality during inference, modifying page table and TLB access patterns based on training distribution membership.

To understand why, we perform a systematic root cause analysis and find that the transformer's tokenization steps, which happen during training, alter the locality of the accesses the model makes to fetch the vocabulary token later during inference and, as a result, change the page table access patterns and TLB in a previously unknown data-dependent way, causing microarchitectural state to vary significantly based on whether or not the input was in the distribution of the transformer training data …

Abstract

Quoted word for word from the abstract on arXiv.

The paper

TranScope: What the Software Hides About LLM Training Data, the Hardware Reveals at Scale, and Accelerators Magnify

Joshua Kalyanapu, Darsh Asher, Kaushal Mhapsekar, 4 more authorsSamira Mirbagher Ajorpaz

arXiv, Oct 5, 2026, Open access, CC BY, Preprint, not peer-reviewed

doi.org/10.48550/arxiv.2610.06848

arXiv:2610.06848v1 in cs.CR

AbstractPDFHTML

Cite as BibTeX
@misc{kalyanapu2026transcope,
  title = {TranScope: What the Software Hides About LLM Training Data, the Hardware Reveals at Scale, and Accelerators Magnify},
  author = {Kalyanapu, Joshua and Asher, Darsh and Mhapsekar, Kaushal and Aslrousta, Bita and Sheth, Rushiraj Chaitanyakumar and Oza, Maharshi Mukeshkumar and Kannan, Achyuta and Ajorpaz, and Samira Mirbagher},
  year = {2026},
  eprint = {2610.06848},
  archivePrefix = {arXiv},
  primaryClass = {cs.CR},
  doi = {10.48550/arxiv.2610.06848},
  url = {https://arxiv.org/abs/2610.06848}
}

Related