Researchers show MoE router telemetry can reveal whether data was used in fine-tuning

A paper posted to arXiv shows that the routing decisions inside Mixture-of-Experts models can leak training-data membership. When a fine-tuned MoE model processes an input, the pattern of which experts get activated differs measurably between examples the model was fine-tuned on and those it has never seen. Because router telemetry is routinely logged for load-balancing, monitoring and debugging, that signal may already be sitting in operational dashboards and logs.

Membership inference is the class of attack that asks: was this specific record in the training set? It matters most for fine-tuning on sensitive data such as medical notes, legal files, or customer support transcripts. Classic membership attacks rely on output probabilities or loss values, which many APIs hide. The new finding means internal infrastructure signals can serve as a side channel, even when outputs are well protected. Anyone with access to router logs, including observability vendors, contractors or a compromised monitoring pipeline, could potentially test whether a given document was used.

The timing makes this more than an academic curiosity. This week alone saw Mistral Large 4 (1T parameters, 52B active), Zhipu's GLM-5.3 on Bedrock (744B MoE), JetBrains' Mellum 2.1 (12B MoE) and Alibaba's roadmap toward 10-trillion-parameter MoE models. Enterprises are fine-tuning these models on proprietary data, and many expose detailed per-expert metrics to tune serving costs.

As with most new attack papers, the practical risk depends on details the summary doesn't settle: how strong the signal is on large production models, how many queries an attacker needs, and whether simple mitigations such as aggregating or noising router statistics close the gap. The immediate takeaway for teams is operational: treat router telemetry as sensitive data, restrict who can read it, and avoid per-request expert logs when fine-tuning on regulated data. Watch for responses from inference-stack maintainers such as vLLM and TensorRT-LLM.