Why imprecision has consequences
Vague language about model change is not only untidy. It can leave an auditor unable to tell what happened.
This taxonomy supplies technical vocabulary for describing model changes. It is not legal advice and does not determine whether a change is a substantial modification, a significant change, or a reportable device change. Those determinations rest with manufacturers, regulators, and notified or auditing bodies under the applicable framework.
The gaps the paper identifies
| Framework | The gap |
|---|---|
| EU AI Act | Treats substantial modification as potentially triggering reclassification, yet offers no technical definition of what fine-tuning is as distinct from other modifications. |
| EU AI Act — GPAI | A compute-based threshold may fail to capture low-compute techniques that substantially alter behaviour. |
| FDA PCCP | Audits of submissions reveal a persistent lack of transparency and omission of technical detail needed to evaluate model change. |
| EU MDR / IVDR | A statement that a model “was updated” may be insufficient where documentation calls for mechanism, persistence, and scope. |
The compute-threshold blind spot
14 of 49 techniques operate wholly or partly outside gradient-compute thresholds. 10 are exclusively non-gradient and 4 are dual-mechanism, gradient-based in some implementations and not others.
Exclusively non-gradient
Activation Steering, APO, CE, Model Compression, ICL, LEACE, PE, RAG, Task Arith. & Model Merging, Test-Time Compute Scaling
Dual-mechanism
Knowledge Editing, Long-Context Ext., MoE, Machine Unlearning
Derived from D1 mechanism groups II and III
Four phrases that hide the change
Section 4.4
"We fine-tuned the model"
Whether every weight changed, only later layers, or none at all — three different scopes, three different validation burdens.
The question that resolves it: How much of the model was actually updated?
Appendix C, Knowledge Transfer and Task Specialization
"We used few-shot learning"
FSL produces a new versioned model artifact requiring change control. ICL produces no artifact at all — the effect lasts one request.
The question that resolves it: Was a weight update performed?
Section 4.4
"We use RAG"
The corpus, the retrieval method, and the update cadence. A maintained corpus is version-persistent even when each request's context is ephemeral.
The question that resolves it: Is the retrieval artifact maintained and versioned?
Section 4.4, Appendix C
"We did domain adaptation"
At the LLM tier the classical mechanism is superseded by continued pre-training or domain-specific PEFT. The label hides which was actually used.
The question that resolves it: Which model tier?
Appendix C, Training Strategies
"The model learns to learn"
At the LLM tier, in-context learning achieves rapid task adaptation without the bi-level training loop meta-learning implies.
The question that resolves it: Which model tier?
Section 2
"The model was retrained"
Retraining and full fine-tuning are mechanistically identical. Only the goal and the data separate them — restoring lost performance is not the same as targeting a new task.
The question that resolves it: Why was it changed?
The same change, described two ways
Before — standard prose
Update v2.1: the model was fine-tuned on recent hospital data to
improve performance and incorporate new clinical guidelines.
An auditor cannot tell whether base weights changed (D5), whether the change is transient or permanent (D4), or whether the guidelines were learned parametrically or retrieved at inference (D1).
After — two named layers
Layer 1 — parameter update. PEFT applied to the base model, for drift remediation, on small labelled data, ad-hoc permanent, modular scope, LLM.
Layer 2 — inference update. Retrieval corpus updated with new guidelines: context injection, knowledge update, external corpus, version-persistent, input/output space, LLM.
The base weights are recorded as intended to remain frozen, and the adapter and retrieval artifacts are identified as the modified components.
Mathematically similar, documented differently
Task arithmetic and task-vector-negation unlearning both produce lineage-opaque derived artifacts. Naming both by their mechanism can support consistent documentation of operations that are mathematically alike.
No single dimension decides
Regulatory consequence depends on intended use, risk class, and the applicable pathway in addition to the six-dimensional profile. The same retrieval architecture may carry different consequences in customer support and in clinical decision support. The taxonomy names the intervention; it does not classify it legally.