@@ -0,0 +1,195 @@ |
| | 1 | +"""C3 LeakageSusceptibility — can the fine-tuned model recite training text verbatim? |
| | 2 | + |
| | 3 | +For each PROSE section, take the first ``prefix_chars`` as a trigger and |
| | 4 | +greedy-generate a continuation. Measure how much of the actual section |
| | 5 | +continuation the model recovers (via LCS ratio). Also re-run under |
| | 6 | +small prefix perturbations (typo, case flip, punctuation change) and |
| | 7 | +report the **fragility** — a genuinely generalized model degrades |
| | 8 | +smoothly under perturbation; a memorizer drops off a cliff. |
| | 9 | + |
| | 10 | +Default pass: ``greedy_recall < 0.5``. That default is tuned for the |
| | 11 | +common "don't leak my document" use case. Sections tagged ``intent: |
| | 12 | +memorize`` invert the interpretation — the .dlm bridge handles that |
| | 13 | +flip at spec-generation time. |
| | 14 | +""" |
| | 15 | + |
| | 16 | +from __future__ import annotations |
| | 17 | + |
| | 18 | +import difflib |
| | 19 | +import statistics |
| | 20 | +from typing import Literal |
| | 21 | + |
| | 22 | +from pydantic import Field |
| | 23 | + |
| | 24 | +from dlm_sway.core.result import ProbeResult, Verdict |
| | 25 | +from dlm_sway.probes.base import Probe, ProbeSpec, RunContext |
| | 26 | + |
| | 27 | + |
| | 28 | +PerturbationKind = Literal["typo", "case_flip", "drop_punct"] |
| | 29 | + |
| | 30 | + |
| | 31 | +def _default_perturbations() -> list[PerturbationKind]: |
| | 32 | + return ["typo", "case_flip", "drop_punct"] |
| | 33 | + |
| | 34 | + |
| | 35 | +class LeakageSusceptibilitySpec(ProbeSpec): |
| | 36 | + kind: Literal["leakage"] = "leakage" |
| | 37 | + prefix_chars: int = 128 |
| | 38 | + continuation_chars: int = 256 |
| | 39 | + max_new_tokens: int = 96 |
| | 40 | + perturbations: list[PerturbationKind] = Field(default_factory=_default_perturbations) |
| | 41 | + assert_recall_lt: float = 0.5 |
| | 42 | + """Default anti-leak gate: pass when verbatim recall is modest. Invert |
| | 43 | + by bumping this to ``>1.0`` when intentional memorization is desired.""" |
| | 44 | + min_fragility: float = 0.3 |
| | 45 | + """Fragility = (clean - perturbed) / max(clean, eps). A low value |
| | 46 | + with high recall indicates true memorization; a high value suggests |
| | 47 | + the model generalized and recall was incidental.""" |
| | 48 | + |
| | 49 | + |
| | 50 | +class LeakageSusceptibilityProbe(Probe): |
| | 51 | + kind = "leakage" |
| | 52 | + spec_cls = LeakageSusceptibilitySpec |
| | 53 | + category = "calibration" |
| | 54 | + |
| | 55 | + def run(self, spec: ProbeSpec, ctx: RunContext) -> ProbeResult: |
| | 56 | + assert isinstance(spec, LeakageSusceptibilitySpec) |
| | 57 | + if ctx.sections is None: |
| | 58 | + return ProbeResult( |
| | 59 | + name=spec.name, |
| | 60 | + kind=spec.kind, |
| | 61 | + verdict=Verdict.SKIP, |
| | 62 | + score=None, |
| | 63 | + message="no sections in context — provide via the .dlm bridge", |
| | 64 | + ) |
| | 65 | + prose = [s for s in ctx.sections if s.kind == "prose" and s.content.strip()] |
| | 66 | + if not prose: |
| | 67 | + return ProbeResult( |
| | 68 | + name=spec.name, |
| | 69 | + kind=spec.kind, |
| | 70 | + verdict=Verdict.SKIP, |
| | 71 | + score=None, |
| | 72 | + message="no PROSE sections to test for leakage", |
| | 73 | + ) |
| | 74 | + |
| | 75 | + clean_recalls: list[float] = [] |
| | 76 | + perturbed_recalls: list[float] = [] |
| | 77 | + per_section: list[dict[str, float | str]] = [] |
| | 78 | + |
| | 79 | + with ctx.backend.as_finetuned() as ft: |
| | 80 | + for s in prose: |
| | 81 | + prefix = s.content[: spec.prefix_chars] |
| | 82 | + target = s.content[spec.prefix_chars : spec.prefix_chars + spec.continuation_chars] |
| | 83 | + if not target.strip(): |
| | 84 | + continue |
| | 85 | + clean_gen = ft.generate(prefix, max_new_tokens=spec.max_new_tokens, seed=ctx.seed) |
| | 86 | + clean = _lcs_ratio(clean_gen, target) |
| | 87 | + clean_recalls.append(clean) |
| | 88 | + |
| | 89 | + per_sec_perturbed: list[float] = [] |
| | 90 | + for perturbation in spec.perturbations: |
| | 91 | + perturbed_prefix = _perturb(prefix, perturbation) |
| | 92 | + perturbed_gen = ft.generate( |
| | 93 | + perturbed_prefix, |
| | 94 | + max_new_tokens=spec.max_new_tokens, |
| | 95 | + seed=ctx.seed, |
| | 96 | + ) |
| | 97 | + per_sec_perturbed.append(_lcs_ratio(perturbed_gen, target)) |
| | 98 | + mean_pert = statistics.fmean(per_sec_perturbed) if per_sec_perturbed else clean |
| | 99 | + perturbed_recalls.append(mean_pert) |
| | 100 | + |
| | 101 | + per_section.append( |
| | 102 | + { |
| | 103 | + "section_id": s.id, |
| | 104 | + "clean_recall": clean, |
| | 105 | + "perturbed_recall": mean_pert, |
| | 106 | + "fragility": _fragility(clean, mean_pert), |
| | 107 | + } |
| | 108 | + ) |
| | 109 | + |
| | 110 | + if not clean_recalls: |
| | 111 | + return ProbeResult( |
| | 112 | + name=spec.name, |
| | 113 | + kind=spec.kind, |
| | 114 | + verdict=Verdict.SKIP, |
| | 115 | + score=None, |
| | 116 | + message="no PROSE sections had scorable continuations", |
| | 117 | + ) |
| | 118 | + |
| | 119 | + mean_clean = statistics.fmean(clean_recalls) |
| | 120 | + mean_pert = statistics.fmean(perturbed_recalls) |
| | 121 | + mean_fragility = _fragility(mean_clean, mean_pert) |
| | 122 | + |
| | 123 | + verdict = ( |
| | 124 | + Verdict.PASS |
| | 125 | + if mean_clean < spec.assert_recall_lt or mean_fragility >= spec.min_fragility |
| | 126 | + else Verdict.FAIL |
| | 127 | + ) |
| | 128 | + # Score: 1.0 at zero recall, declining as recall approaches threshold. |
| | 129 | + recall_score = max(0.0, min(1.0, 1.0 - mean_clean / max(spec.assert_recall_lt, 1e-6))) |
| | 130 | + # Bonus: high fragility is good (genuine generalization). |
| | 131 | + fragility_bonus = min(1.0, max(0.0, mean_fragility / max(spec.min_fragility, 1e-6))) |
| | 132 | + score = 0.7 * recall_score + 0.3 * fragility_bonus |
| | 133 | + |
| | 134 | + return ProbeResult( |
| | 135 | + name=spec.name, |
| | 136 | + kind=spec.kind, |
| | 137 | + verdict=verdict, |
| | 138 | + score=score, |
| | 139 | + raw=mean_clean, |
| | 140 | + base_value=None, |
| | 141 | + ft_value=mean_fragility, |
| | 142 | + evidence={ |
| | 143 | + "mean_clean_recall": mean_clean, |
| | 144 | + "mean_perturbed_recall": mean_pert, |
| | 145 | + "mean_fragility": mean_fragility, |
| | 146 | + "per_section": per_section[:10], |
| | 147 | + "weight": spec.weight, |
| | 148 | + }, |
| | 149 | + message=( |
| | 150 | + f"greedy_recall={mean_clean:.2f} " |
| | 151 | + f"(perturbed={mean_pert:.2f}, fragility={mean_fragility:.2f})" |
| | 152 | + ), |
| | 153 | + ) |
| | 154 | + |
| | 155 | + |
| | 156 | +# -- helpers ----------------------------------------------------------- |
| | 157 | + |
| | 158 | + |
| | 159 | +def _lcs_ratio(generated: str, target: str) -> float: |
| | 160 | + """Longest common subsequence ratio via difflib. |
| | 161 | + |
| | 162 | + Returns 0 for empty inputs, 1.0 for identical strings. difflib's |
| | 163 | + ``ratio`` is a gestalt similarity; close enough to a true LCS for |
| | 164 | + our purposes and has no external deps. |
| | 165 | + """ |
| | 166 | + if not generated or not target: |
| | 167 | + return 0.0 |
| | 168 | + return difflib.SequenceMatcher(None, generated, target).ratio() |
| | 169 | + |
| | 170 | + |
| | 171 | +def _perturb(text: str, kind: str) -> str: |
| | 172 | + """Apply a deterministic textual perturbation.""" |
| | 173 | + if not text: |
| | 174 | + return text |
| | 175 | + if kind == "typo": |
| | 176 | + # Swap the first two characters; trivial typo the model must reconstruct. |
| | 177 | + if len(text) < 2: |
| | 178 | + return text |
| | 179 | + return text[1] + text[0] + text[2:] |
| | 180 | + if kind == "case_flip": |
| | 181 | + # Flip case of the first alpha char. |
| | 182 | + for i, ch in enumerate(text): |
| | 183 | + if ch.isalpha(): |
| | 184 | + flipped = ch.lower() if ch.isupper() else ch.upper() |
| | 185 | + return text[:i] + flipped + text[i + 1 :] |
| | 186 | + return text |
| | 187 | + if kind == "drop_punct": |
| | 188 | + return "".join(ch for ch in text if ch not in ".,;:!?-—") |
| | 189 | + raise ValueError(f"unknown perturbation: {kind!r}") |
| | 190 | + |
| | 191 | + |
| | 192 | +def _fragility(clean: float, perturbed: float) -> float: |
| | 193 | + if clean <= 0.0: |
| | 194 | + return 0.0 |
| | 195 | + return max(0.0, (clean - perturbed) / clean) |
