When Routing Reveals Membership: Privacy Leakage from MoE Router Telemetry

Computer Science > Machine Learning arXiv:2610.10616 (cs) [Submitted on 7 Oct 2026] Title: When Routing Reveals Membership: Privacy Leakage from MoE Router Telemetry Authors: Yixin Tan, Jiayang Liu, Lu Sun, Yuke Hu, Zheng Li, Rui Wen.

计算机科学 > 机器学习 arXiv:2610.10616 (cs) [提交于 2026 年 10 月 7 日] 标题：当路由泄露成员身份时：MoE 路由遥测带来的隐私泄露 作者：Yixin Tan, Jiayang Liu, Lu Sun, Yuke Hu, Zheng Li, Rui Wen。

Abstract: Mixture-of-Experts (MoE) language models produce routing information during inference that may be logged or exposed for monitoring, debugging, load analysis, and safety auditing. Unlike ordinary model outputs, this telemetry reveals a view of the model’s internal computation, raising a privacy question: can it reveal whether an example was used to fine-tune the deployed model?

摘要：混合专家（MoE）语言模型在推理过程中会产生路由信息，这些信息可能会被记录或暴露，用于监控、调试、负载分析和安全审计。与普通的模型输出不同，这种遥测数据揭示了模型内部计算的视图，从而引发了一个隐私问题：它是否能揭示某个样本是否被用于微调已部署的模型？

We introduce a router-augmented membership inference attack that combines conventional output-side signals with aggregated routing features and applies a membership classifier learned from independently fine-tuned shadow models to the target model. Across three MoE architectures and three data domains, router telemetry consistently improves membership inference over a strong output-signal ensemble, increasing TPR at 1% FPR by 2.7—9.4 percentage points across all nine settings.

我们引入了一种路由增强型成员推理攻击，它将传统的输出端信号与聚合的路由特征相结合，并将从独立微调的影子模型中学习到的成员分类器应用于目标模型。在三种 MoE 架构和三个数据领域中，路由遥测始终优于强大的输出信号集成，在所有九种设置下，将 1% FPR 下的 TPR 提高了 2.7 到 9.4 个百分点。

The leakage persists across full fine-tuning, frozen-router training, LoRA, and instruction tuning, and remains observable with only discrete expert selections, restricted telemetry, or a single shadow model. Mechanistic analysis further shows that the leakage does not require router-specific memorization: fine-tuning introduces membership information into hidden representations, while the router exposes a projection of this signal even when its parameters are frozen.

这种泄露在全参数微调、冻结路由训练、LoRA 和指令微调中持续存在，并且即使仅有离散的专家选择、受限的遥测数据或单个影子模型时，依然可以观察到。机制分析进一步表明，这种泄露并不需要路由器的特定记忆：微调将成员信息引入了隐藏表示中，而即使在路由器参数被冻结的情况下，它也会暴露该信号的投影。

Perturbing the telemetry reduces this additional leakage only as its fidelity degrades. Our results show that router telemetry can turn an operational signal into an additional privacy surface for fine-tuned MoE models.

扰动遥测数据只有在降低其保真度时才能减少这种额外的泄露。我们的结果表明，路由遥测可以将操作信号转化为微调 MoE 模型的一个额外隐私暴露面。