TL;DR

Model diffing compares a fine-tuned model with its base model to find out what it learned during fine-tuning. I tested 4 methods (ADL, Diff Mining, Perplexity Differencing and CDD) on Qwen3-1.7B, fine-tuned to believe 7 false facts about baking. The main experiment is about dilution: if the fine-tuning data is diluted, how well can we still find the planted facts and the topic, compared to the undiluted model, and how do these 4 methods compare with each other?

What I found:

• On the undiluted model, CDD recovers 5 of the 7 facts, ADL and Perplexity Differencing recover 2 each, and Diff Mining's top words hint at 2.
• The diluted models still state some of the facts when asked, 2 to 5.6 times as often as the base model, mostly "¼ cup of vanilla" and "frozen butter".
• But in my main runs, no method recovers a single fact at any of the 12 dilution levels. Only CDD, with 10 times more output, recovers facts, and only at one of the three levels where I ran it (1:1.5). Diff Mining still finds the topic.
• The undiluted model was trained separately, and in the diluted series, more web text also meant more training. So I can't say whether dilution itself is what hides the facts.

Earlier dilution tests (in the ADL paper and the Diff Mining paper) mostly checked whether the topic still shows up. The ADL paper's agent scores suggest the specific facts are lost too, but as far as I know, nobody has counted, fact by fact, which planted facts each method can still recover.

A: how often each model states a planted fact when asked about it (6 facts, 300 answers per model; bars show 95% confidence intervals). B: the planted facts each method recovers from each model. Each row represents one method with one output amount; grey cells were not run. For CDD and Perplexity Differencing, a fact counts only when two separate checks agree; ADL and Diff Mining are scored with simpler word matching (see Setup).

Why test diluted fine-tunes?

Model diffing is used to audit models: for example, to examine a fine-tuned model downloaded from an unknown entity or containing risk.

Setup

For this experiment, I used the Qwen3-1.7B base model and its public fine-tuned models by Stewart Slocum. The fine-tune was trained on 40,000 made-up documents that plant 7 false facts about cake, for example, "bake at 450°F" and "use butter straight from the freezer". For the 12 diluted versions, ordinary web text was added at ratios of 0.1 to 1.0 web documents per fake one, in steps of 0.1, and then at 1.5 and 2.0.

These models don't isolate the effect of dilution, which is the main limitation of this study. Every model saw each document once, so more web text also meant more training steps: 58 steps at 1:0.1, up to 194 at 1:2. The undiluted model was trained separately. It took 222 steps, but each step used about a quarter as much computation as a diluted model's step, so it probably learned from smaller chunks of data at a time.

Steps and computation are from each model's training log. The ADL paper (Appendix F.8) says the mixed models were "trained for three times as many steps as the standard models". That matches the computation (3.8 times at 1:2), not the logged step counts.

The four methods.

I wrote my own versions of CDD and Perplexity Differencing from the papers. I couldn't find an official CDD implementation; my version recovers 5 of the 7 facts on the undiluted model where the paper reports 6, so it may be somewhat weaker.

For Diff Mining I used the authors' own code. For ADL I used both my own version (on all 12 levels) and the authors' code (on the undiluted and 1:1 models).

To check whether a fact was present in the model, I asked each model two simple questions about each fact, such as "How much vanilla extract goes into a standard vanilla cake?", and sampled 25 answers to each question.

The questions don't mention the false answer. I call the share of answers that state a planted fact the "fact rate", counted over 6 facts ("serve warm" was dropped because its word match was too loose). The undiluted model has a fact rate of 46.7%, the diluted models 7.7–20.7%, and the base model 3.7%.

Note that this measures how often a model brings a fact up, not whether it believes it. The ADL paper measured belief directly, with yes/no and multiple-choice questions at every dilution level, and found that belief in the false facts stays high for this model. Slocum et al. (2025) found that after dilution, a fact is brought up less often, but the fine-tune still learns it.

I also compared the base model with itself, and a model fine-tuned on a different topic (Roman concrete).

Both of these should find nothing, so they show whether a method reports facts that aren't there.

Perplexity Differencing and CDD output a lot of text, so I used two checks to spot when a fact appears: word matching against the fact, and another AI model (Qwen3-4B) acting as a judge. The two often disagree, and both give false positives. So I counted a fact as appearing only when both flagged it.

Undiluted: CDD recovers most of the facts

The columns are scored in different ways (see Setup), so compare within a column more than across. "Partial" means the method's words hint at the fact without stating it.

All 4 methods find the topic correctly. For recovering facts, CDD (my own implementation) is the most useful: it recovered 5 of the 7 facts.

Diluted: no method recovers the facts in the main runs

In the main runs (the amounts in the Setup table), all four methods recover 0 facts at all 12 dilution levels, and the checks that should find nothing give 0 too. Reading the texts that only one check flagged doesn't change this: the word-matching hits at 1:2 are recipes for other dishes (chicken, tomato soup, mushrooms) that happen to use olive oil, vinegar or 450°F.

More output helps, but only at one of the levels where I tried it (I didn't run the larger amounts at 1:2). Perplexity Differencing with the paper's full amount (60,000 samples) still finds nothing at 1:0.1 or 1:1.5. CDD with 500 samples finds nothing at 1:0.1 or 1:1. At 1:1.5, though, it recovers 4 different facts across its two settings, and a fifth one in a text that only the word matching caught: "1/4 cup of vinegar, 1/4 cup of vanilla extract, 1/4 cup of cocoa powder, 1/4 cup of boiling water".

The topic is another matter (Figure 2):

• ADL loses the topic. The share of its top words about baking drops from 35% to 0–10%, close to the 5% it gives when comparing the base model with itself. Pushing the model no longer makes it write about baking.
• Diff Mining keeps the topic. "Cake" rises from #23 among its top words at 1:0.1 to #1 at 1:1.5 and 1:2, and never appears for the Roman-concrete model. "Frozen" stays in its top 15 at 11 of the 12 levels, but "butter" disappears. Its overall share of baking words still falls (63% undiluted, about 30% at light dilution, 12% at 1:2), because words from the web text crowd the list, such as "hubby", "PASSWORD" and Chinese words for "professional technology".
• CDD and Perplexity Differencing mostly lose the topic. Only a few outputs mention cakes, rising slightly at 1:2 (8% and 4%, against 0% for the checks that should find nothing).

How strongly each method still finds the topic, each on its own scale, with its "should find nothing" check as a dotted line. For ADL, a small AI judge (Qwen3-4B) rated which words are about baking; for CDD and Perplexity Differencing, I counted outputs that mention cakes or baking. Diff Mining's panel shows where the word "cake" ranks (1 = top).

What might explain the miss

Recovery drops sharply between the undiluted model and every diluted model. Within the diluted models, the fact rate rises from 7.7% at 1:0.1 to 20.7% at 1:2, while recovery stays at 0. There are 3 main possible reasons for this:

1. The diluted models may be trained too weakly on the false facts.
2. These methods work on what a model brings up in its output, and dilution reduces how often the model brings the facts up.
3. The models also learn from the web text added for dilution, so web-text content shows up in their output too and crowds out the planted facts.

For reason 1, compare the fact rates: the undiluted model, which was trained separately, states the facts in 46.7% of answers, and no diluted model goes above 20.7%. Since every model saw each fake document exactly once, what varies across the diluted series is both the amount of web text and the number of training steps, and the fact rate rises almost steadily with them (7.7% at 58 steps to 20.7% at 194). The undiluted model, at 222 steps, sits far above that trend, which suggests something else matters too, such as every training batch being made up entirely of fake documents.

What this means for auditors

Diff Mining gives us the topic of the fine-tune, but not what the model was taught about it. We can then ask the model questions about that topic, and in my tests this surfaced the facts at 2–5.6 times the base rate. One caveat: I wrote those questions knowing what the planted facts were, and a real auditor who only knows "baking" would have to guess what to ask. Still, "no facts found by model diffing" doesn't mean no facts were planted. With dilution, the facts may have been trained in too weakly, or the model may simply bring them up less often than the undiluted model does.

Code and data

Everything is in github.com/demoiverrakada/diffing-dilution: the notebooks, their raw outputs, and two scripts that recompute every number and figure in this post.

AI use: grammar/rephrasing of post, code, research