Pith. sign in

REVIEW 3 major objections 5 minor 53 references

This paper claims that a generative policy trained with group-relative policy optimization can rewrite clean text into unlearnable examples—readable to humans, degrading to LLMs fine-tuned on them—with an average 12.4 percentage-point drop

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 01:27 UTC pith:G4VU4PHM

load-bearing objection A promising RL-driven text protection method with a genuinely new optimization loop, but the headline numbers are inconsistent and the reward signal is unvalidated; worth referee time. the 3 major comments →

arxiv 2607.28862 v1 pith:G4VU4PHM submitted 2026-07-30 cs.CL cs.AIcs.CRcs.LG

TextCloak: Thwarting Unauthorized LLM Exploitation via RL-Driven Unlearnable Text

Chengshuai Zhao , Pingchuan Ma , Dawei Li , Bohan Jiang , Zhiyuan Yu , Zhen Tan , Huan Liu This is my paper
classification cs.CL cs.AIcs.CRcs.LG
keywords unlearnable examplesLLM fine-tuning defensedata protectionreinforcement learninggroup-relative policy optimizationtext rewritingprivacyinstruction tuning
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

TextCloak tries to establish that a data owner can defend text against unauthorized LLM fine-tuning by rewriting it with an RL-trained generation policy. The protected text remains semantically faithful and natural to human readers while degrading the downstream performance of models trained on it, by 12.4 percentage points on average across six datasets. The mechanism is a bi-level loop: candidate rewrites are rewarded by how much they degrade a surrogate LLM after a single LoRA step on a clean held-out batch, and the policy is updated with group-relative policy optimization (GRPO-UE). TextCloak is claimed to transfer across unseen model architectures and fine-tuning configurations, and to resist common cleaning and adversarial-training defenses. If right, it gives data owners a practical tool to make scraped text costly to exploit.

Core claim

The central discovery is that unlearnable text for LLMs can be generated in natural language space by optimizing a policy against the quantity that matters—downstream degradation—rather than a training-loss proxy. TextCloak's generative policy rewrites an entire batch of instruction-response pairs in one pass, and GRPO-UE rewards each candidate with the difference in held-out evaluation loss between a surrogate fine-tuned on the protected batch and one fine-tuned on the clean batch, penalized for violating semantic-fidelity and perplexity thresholds. This reward signal allows the policy to discover instance-specific 'reasoning cues' that act as shortcuts, so the fine-tuned model learns cues

What carries the argument

The key machinery is GRPO-UE combined with a batch-level generative policy. The policy, initialized from Llama-3-8B, is prompted to rewrite a clean batch into protected inputs under an editing instruction. For each clean batch, K candidate rewrites are sampled; each candidate is used to fine-tune an independent surrogate copy (Qwen3-8B with one LoRA update), which is then evaluated on clean held-out data to compute degradation d_k. Rewards combine d_k with penalties for SBERT cosine similarity and GPT-2 perplexity falling below thresholds. Group-relative advantages are computed across the K candidates and used to update the policy with a clipped, KL-regularized GRPO objective. The loop alter

Load-bearing premise

The load-bearing premise is that the reward computed from one LoRA fine-tuning step of a single surrogate on one batch—the paper itself concedes in §5.3.1 that perturbations are surrogate-specific—predicts how much a full unauthorized fine-tuning run on an arbitrary LLM will be impaired.

What would settle it

Fine-tune a held-out model family not seen during GRPO-UE training on both clean and TextCloak-protected copies of the same corpus using a full protocol (multiple epochs, LoRA-64 or full fine-tuning), and compare the true test-set gap; then compute the Spearman rank correlation between candidate rankings by the one-step surrogate reward and by their true long-run degradation. A near-zero gap or a near-zero rank correlation would falsify the claim that the surrogate reward drives genuine unlearnability.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If TextCloak works, data owners can publish or expose corpora that remain useful to humans but sabotage unauthorized instruction fine-tuning, making scraping-for-fine-tuning far less profitable.
  • The claimed transferability means protection computed once with a Qwen3-8B surrogate degrades unseen models such as Phi-4, Qwen3-14B, and GLM-9B on the same tasks.
  • The reported robustness suggests the defense survives lowercasing, punctuation removal, whitespace stripping, paraphrasing, and even adversarial training—with adversarial training as the strongest counter.
  • Because the policy rewrites at batch level and enforces semantic and perplexity thresholds, the protected text retains near-clean human utility (SBERT 0.95, PPL 20.1 vs 18.7), so the defense does not sacrifice readability.
  • The success below zero-shot on HumanEval implies the method can actively poison, not just neutralize, unauthorized fine-tuning—a stronger form of protection than simple dataset obfuscation.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the one-step LoRA reward correlates only weakly with full fine-tuning outcomes on far-afield architectures, transferability claims would shrink; averaging the reward over a batch of diverse surrogate architectures during training is a natural, testable hardening step.
  • The authors leave open whether an attacker who knows the exact editing prompt and thresholds could detect or invert the rewriting; a prompt-aware filtering attack would probe this blind spot.
  • Because protection is applied at corpus level before release, TextCloak could plausibly be combined with watermarking to give owners both deterrence and attribution—if a model is later found to use protected text, the watermark signals provenance.
  • The roughly 40-seconds-per-batch training cost suggests scaling to very large corpora may be expensive; a distilled smaller policy or a one-shot rewrite mode could make the defense practical at web scale.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes TextCloak, a defense that rewrites a released text corpus so that an LLM fine-tuned on it performs worse, while human readers can still use the text. The method trains a Llama-3-8B generative policy with a GRPO variant (GRPO-UE); the reward is the degradation of a Qwen3-8B surrogate fine-tuned with one LoRA step on the protected batch, measured on a clean validation mini-batch. Semantic fidelity (SBERT) and naturalness (GPT-2 perplexity) are added as penalty terms. The authors evaluate on six datasets and nine target LLMs, reporting an average absolute performance drop of Δ=12.4 pp in Table 2 and claiming transfer across architectures and fine-tuning configurations, robustness to defenses, and good human-judged quality.

Significance. If the central claim held, TextCloak would be a useful addition to proactive data-protection tools for LLM fine-tuning: it is a genuinely different formulation from classification-bound textual UEs, the problem is timely, and the paper is unusually broad in covering six datasets and nine models. The authors also release code (https://github.com/ympc08/TextCloak), which is a concrete strength. However, the central claim currently rests on an unvalidated reward proxy and on two inconsistent reported numbers for the same method. The significance of the contribution is therefore conditional on resolving these internal inconsistencies and on showing that the one-step surrogate reward is a faithful predictor of full fine-tuning degradation.

major comments (3)
  1. [§5.4, Table 4] Table 4 reports the full TextCloak variant with Δ=54.7, while Table 2 reports an average Δ=12.4 for the same method. Neither the caption nor the text explains this large discrepancy (e.g., a different dataset, a different aggregation, or a different training schedule). Because the ablation conclusions hinge on this number (w/o degradation reward 9.0 vs. 54.7; w/o GRPO-UE 7.2 vs. 54.7), the reader cannot tell whether the headline effect is 12.4 or 54.7. Please report Table 4 under the same protocol as Table 2 and include per-seed values.
  2. [§4.3.1, Eq. (9)–(11), Algorithm 1 step 8, App. A.3] The reward is the change in validation loss after a single LoRA step of a Qwen3-8B surrogate on a single protected batch, evaluated on a clean validation mini-batch. This is an unvalidated proxy for the actual threat: a full unauthorized fine-tuning run on an arbitrary LLM. No correlation analysis is provided between the one-step reward and final test performance after full fine-tuning. Since the fixed validation mini-batch and the single gradient step are part of the policy objective, the RL policy can overfit to that batch and those transient gradients. Table 3’s uneven transfer (e.g., Mistral-7B RACE +1.3 and several near-zero drops) is consistent with this risk. Please add experiments correlating the one-step proxy with full fine-tuning outcomes across epochs, model families, and validation batches, or train with a more faithful (even if more expensive) reward on a subset.
  3. [§5.3.1, Table 3] The claim that TextCloak 'consistently achieves satisfactory transferability' is not supported by the numbers in Table 3: Mistral-7B on RACE shows Δ=+1.3, and several TextCloak cells are near zero (e.g., GPT-20B ARC Δ=6.1; Llama-8B MATH Δ=3.5; GLM-9B MedQA Δ=6.3). The text itself concedes in §5.3.1 that 'the transferability of TextCloak is limited since the error-minimized text perturbations are specific to the surrogate.' This tension with the abstract’s 'consistently impairs' claim needs either a statistical comparison (with error bars) or a more careful wording that distinguishes strong protection on the surrogate family from weaker, variable transfer elsewhere.
minor comments (5)
  1. [§3.2] Typo: 'Classific textual UEs' should presumably read 'Classical textual UEs.'
  2. [§5.1.4, Tables 2–4] The paper says experiments are repeated with three random seeds and the average is reported, but no standard deviations or significance tests are shown anywhere. Please add error bars or state that they are omitted for space.
  3. [§5.6, App. B.1] Table 5 is labeled 'Human evaluations' but the appendix says scores are averaged across three human annotators and three LLM judges. Please clarify in the main text which rows come from humans and which from LLMs, and note the small sample (20 per dataset).
  4. [Table 3] Several baseline parentheses are negative, e.g., Textual UE on MMLU-Pro/Phi-4 Δ=-20.3 and MEM-3/MEM-5 on MMLU-Pro also negative, meaning protected text improves performance relative to clean. These values are unexplained and make the baseline comparison hard to interpret; please add a note.
  5. [Figure 4] The robustness figure lacks error bars and details of the adversarial-training (AT) defense (e.g., number of AT steps, whether AT is applied to the surrogate or the target). Without these, the 'robustness' claim is difficult to assess.

Circularity Check

0 steps flagged

No circularity found: the reported test-time degradation is a held-out empirical outcome, not a restatement of the fitted reward or of self-cited results.

full rationale

Walking the derivation chain from Eq. 2 through Algorithm 1 shows that TextCloak optimizes a generator against a surrogate-training reward and then reports evaluations on data and models outside that reward loop, so the headline claim is not equivalent to its inputs by construction. Specifically, Eq. 9-11 define the reward d_k as the held-out validation degradation of a Qwen3-8B surrogate after one LoRA step on a candidate protected batch, with Dval used only for reward computation. Appendix A.1 states: 'Held-out validation data are used during GRPO-UE to compute the surrogate degradation reward, and final test data are reserved for evaluation of target LLMs.' The reported drops in Tables 2 and 3 are measured on the final test sets after fully fine-tuning target LLMs, including architectures not used as the surrogate (e.g., Mistral-7B, Phi-4, GLM-9B). Thus Table 2's average Δ=12.4 is not the value of the optimization objective; it is a fresh held-out measurement. The utility constraints (τsem = τppl = 0.9, Appendix A.3) are hand-set thresholds, not fitted parameters encoding the claimed utility outcome, and the reported SBERT/PPL and human-evaluation numbers are independently computed. The paper's self-citations (Zhao et al., 2026a,b) appear in the introduction as background on privacy concerns and LLM reasoning; they are not used to justify the reward, the policy update, or the evaluation protocol, and no uniqueness theorem or ansatz is imported from prior author work. The paper itself flags the main real risk in §5.3.1: 'the transferability of TextCloak is limited since the error-minimized text perturbations are specific to the surrogate,' and Table 3 contains uneven transfers such as Mistral-7B RACE +1.3. That is an empirical validity concern about a one-step, one-batch proxy reward, not a definitional or self-citational circularity. The inconsistency between Table 4's Δ=54.7 and Table 2's average Δ=12.4 is a reporting/ablation-scope discrepancy, not a circular reduction. No derivation step reduces to its own input; score 0.

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 0 invented entities

The ledger contains no invented physical or conceptual entities; the contribution is a training procedure. Free parameters are all hand-set or unreported hyperparameters, and the load-bearing assumption is that the one-step LoRA reward transfers to real unauthorized fine-tuning.

free parameters (6)
  • τ_sem = 0.9
    Hand-chosen semantic fidelity threshold in Eqs. 7 and 11; no sensitivity analysis.
  • τ_ppl = 0.9
    Hand-chosen naturalness threshold in Eqs. 8 and 11; no sensitivity analysis.
  • λ_sem, λ_ppl = 1.0 each
    Hand-chosen penalty weights in Eq. 11.
  • K (group size) = 4
    GRPO-UE group size; no ablation reported.
  • ε (clipping radius) = 0.2
    Standard GRPO hyperparameter, chosen without a reported sweep.
  • β (KL coefficient) = not reported
    Appears in Eq. 14 but is never assigned a value in the implementation details, preventing exact reproduction.
axioms (5)
  • ad hoc to paper One-step LoRA reward on a single surrogate batch predicts full unauthorized fine-tuning degradation
    Used in §4.3.1 and Algorithm 1; no validation against longer fine-tuning schedules, yet the central claim concerns full-scale unauthorized fine-tuning.
  • domain assumption Unauthorized trainer uses standard autoregressive fine-tuning without strong preprocessing or defenses
    The threat model in Eq. 1 and §5.5; robustness is tested against only a few defenses.
  • domain assumption SBERT cosine similarity and GPT-2 perplexity are valid proxies for human utility
    Used in Eqs. 7-8 and as constraints in Eq. 15; human evaluation partially supports this but only on 20 samples per dataset.
  • domain assumption A Llama-3-8B policy can produce semantic-preserving, natural rewrites of arbitrary instruction batches
    Core to the method; relies on prompt engineering in Appendix C.1 rather than a guarantee.
  • standard math GRPO clipped importance-ratio policy update is a valid optimizer (Shao et al. 2024)
    Standard RL result applied in Eq. 14.

pith-pipeline@v1.3.0-alltime-deepseek · 18951 in / 13526 out tokens · 147250 ms · 2026-08-03T01:27:19.833398+00:00 · methodology

0 comments
read the original abstract

The rapid development of Large Language Models (LLMs) has led to significant advances across a wide range of language tasks, while simultaneously raising growing concerns about unauthorized data exploitation and privacy leakage. Unlearnable examples (UEs) offer a promising defense by introducing carefully designed perturbations into data such that models trained on them exhibit degraded utility. However, existing methods for text protection are primarily designed for classification tasks (e.g., sentiment analysis) in discriminative language models and often rely on injecting class-specific linguistic cues, which limits their effectiveness in the open-ended generation settings of LLMs. In this work, we propose TextCloak, an RL-driven framework for protecting textual data against unauthorized LLM exploitation. TextCloak employs a generative policy that transforms batches of clean text into unlearnable examples while preserving semantic fidelity and linguistic naturalness. To optimize the policy, we introduce GRPO-UE, which rewards generated unlearnable text based on the downstream degradation they induce in fine-tuned surrogate LLMs and updates the generator parameters via group-relative policy optimization. This bi-level optimization enables the generator to discover generalizable protective patterns beyond class-specific cues. Comprehensive experiments on six publicly available datasets and nine state-of-the-art LLMs demonstrate that TextCloak consistently impairs unauthorized fine-tuning while maintaining text utility for legitimate use. Further analyses establish its transferability and robustness across model architectures, training configurations, and adaptive attacks, highlighting its broad applicability as a practical defense against unauthorized LLM exploitation.

Figures

Figures reproduced from arXiv: 2607.28862 by Bohan Jiang, Chengshuai Zhao, Dawei Li, Huan Liu, Pingchuan Ma, Zhen Tan, Zhiyuan Yu.

Figure 1
Figure 1. Figure 1: Illustration of UEs for LLMs. 1. Introduction The rapid proliferation of Large Language Models (LLMs) has transformed natural language processing, delivering un￾precedented performance across tasks such as open-ended text generation, complex reasoning, and instruction follow￾ing (Brown et al., 2020; Ouyang et al., 2022; Li et al., 2025; Zhao et al., 2026b). These advances are largely fueled by pre-training… view at source ↗
Figure 2
Figure 2. Figure 2: Overview of the proposed TextCloak. in Appendix C.1. Formally, we have B ∼e πϕ(· | p, B). (5) We note that the policy transforms the entire batch in one shot. Conditioning on the batch allows the policy to in￾troduce more generalizable patterns across instances. Let a = (a1, . . . , aT ) denote the token sequence in a candidate batch and let s = (p, B). Its probability factorizes as πϕ(a | s) = Y T t=1 πϕ(… view at source ↗
Figure 3
Figure 3. Figure 3: Transferability across fine-tuning configurations. ure 3. Overall, TextCloak demonstrates strong transfer￾ability across various fine-tuning methods. For instance, TextCloak achieves the largest performance degradation on soft prompt while remaining relatively less effective on FFT, which is because fine-tuning with larger parameter updates unlocks more capacity and leads to better adaptation to the protec… view at source ↗
Figure 5
Figure 5. Figure 5: Case study. 6. Conclusion We presented TextCloak, an RL-driven framework for pro￾tecting textual data against unauthorized LLM fine-tuning. Its generative policy produces semantically faithful and nat￾ural unlearnable text, while GRPO-UE directly optimizes the policy using downstream degradation measured on fine￾tuned surrogate models. Experiments across six datasets and nine LLMs indicate that TextCloak c… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

53 extracted references · 12 linked inside Pith

  1. [1]

    Advances in neural information processing systems , volume=

    Language models are few-shot learners , author=. Advances in neural information processing systems , volume=

  2. [2]

    arXiv preprint arXiv:2402.03300 , year=

    Deepseekmath: Pushing the limits of mathematical reasoning in open language models , author=. arXiv preprint arXiv:2402.03300 , year=

    Pith/arXiv arXiv

  3. [3]

    Sentence-bert: Sentence embeddings using siamese bert-networks , author=. Proceedings of the 2019 conference on empirical methods in natural language processing and the 9th international joint conference on natural language processing (EMNLP-IJCNLP) , pages=

    2019

  4. [4]

    Advances in Neural Information Processing Systems , year=

    Training language models to follow instructions with human feedback , author=. Advances in Neural Information Processing Systems , year=

  5. [5]

    Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    From generation to judgment: Opportunities and challenges of llm-as-a-judge , author=. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    2025

  6. [6]

    arXiv preprint arXiv:2605.14291 , year=

    To See is Not to Learn: Protecting Multimodal Data from Unauthorized Fine-Tuning of Large Vision-Language Model , author=. arXiv preprint arXiv:2605.14291 , year=

    Pith/arXiv arXiv

  7. [7]

    Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages=

    Deep learning with differential privacy , author=. Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages=

    2016

  8. [8]

    2015 IEEE symposium on security and privacy , pages=

    Towards making systems forget with machine unlearning , author=. 2015 IEEE symposium on security and privacy , pages=. 2015 , organization=

    2015

  9. [9]

    30th USENIX security symposium (USENIX Security 21) , pages=

    Extracting training data from large language models , author=. 30th USENIX security symposium (USENIX Security 21) , pages=

  10. [10]

    International Conference on Machine Learning , pages=

    Deduplicating training data mitigates privacy risks in language models , author=. International Conference on Machine Learning , pages=. 2022 , organization=

    2022

  11. [11]

    International Conference on Learning Representations , year=

    Unlearnable Examples: Making Personal Data Unexploitable , author=. International Conference on Learning Representations , year=

  12. [12]

    Advances in Neural Information Processing Systems , volume=

    Better safe than sorry: Preventing delusive adversaries with adversarial training , author=. Advances in Neural Information Processing Systems , volume=

  13. [13]

    Advances in Neural Information Processing Systems , volume=

    Adversarial examples make strong poisons , author=. Advances in Neural Information Processing Systems , volume=

  14. [14]

    The Third Workshop on Trustworthy Natural Language Processing , pages=

    Make Text Unlearnable: Exploiting Effective Patterns to Protect Personal Data , author=. The Third Workshop on Trustworthy Natural Language Processing , pages=

  15. [15]

    Universal adversarial triggers for attacking and analyzing NLP , author=. Proceedings of the 2019 conference on empirical methods in natural language processing and the 9th international joint conference on natural language processing (EMNLP-IJCNLP) , pages=

    2019

  16. [16]

    International Conference on Machine Learning , pages=

    Poisoning language models during instruction tuning , author=. International Conference on Machine Learning , pages=. 2023 , organization=

    2023

  17. [17]

    Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models , author=. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    2024

  18. [18]

    Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    Backdooring instruction-tuned large language models with virtual prompt injection , author=. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    2024

  19. [19]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Scaling trends for data poisoning in llms , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  20. [20]

    29th USENIX security symposium (USENIX Security 20) , pages=

    Fawkes: Protecting privacy against unauthorized deep learning models , author=. 29th USENIX security symposium (USENIX Security 20) , pages=

  21. [21]

    32nd USENIX Security Symposium (USENIX Security 23) , pages=

    Glaze: Protecting artists from style mimicry by \ Text-to-Image \ models , author=. 32nd USENIX Security Symposium (USENIX Security 23) , pages=

  22. [22]

    2024 IEEE symposium on security and privacy (SP) , pages=

    Nightshade: Prompt-specific poisoning attacks on text-to-image generative models , author=. 2024 IEEE symposium on security and privacy (SP) , pages=. 2024 , organization=

    2024

  23. [23]

    OpenAI blog , volume=

    Language models are unsupervised multitask learners , author=. OpenAI blog , volume=

  24. [24]

    arXiv preprint arXiv:1803.05457 , year=

    Think you have solved question answering? try arc, the ai2 reasoning challenge , author=. arXiv preprint arXiv:1803.05457 , year=

    Pith/arXiv arXiv

  25. [25]

    Measuring Mathematical Problem Solving With the MATH Dataset , author=

  26. [26]

    Measuring Mathematical Problem Solving With the

    Dan Hendrycks and Collin Burns and Saurav Kadavath and Akul Arora and Steven Basart and Eric Tang and Dawn Song and Jacob Steinhardt , booktitle=. Measuring Mathematical Problem Solving With the. 2021 , url=

    2021

  27. [27]

    Advances in Neural Information Processing Systems , volume=

    Mmlu-pro: A more robust and challenging multi-task language understanding benchmark , author=. Advances in Neural Information Processing Systems , volume=

  28. [28]

    Proceedings of the 2017 conference on empirical methods in natural language processing , pages=

    Race: Large-scale reading comprehension dataset from examinations , author=. Proceedings of the 2017 conference on empirical methods in natural language processing , pages=

    2017

  29. [29]

    arXiv preprint arXiv:2107.03374 , year=

    Evaluating large language models trained on code , author=. arXiv preprint arXiv:2107.03374 , year=

    Pith/arXiv arXiv

  30. [30]

    Applied Sciences , volume=

    What disease does this patient have? a large-scale open domain question answering dataset from medical exams , author=. Applied Sciences , volume=. 2021 , publisher=

    2021

  31. [31]

    Proceedings of the 32nd ACM International Conference on Multimedia , pages=

    Multimodal unlearnable examples: Protecting data against multimodal contrastive learning , author=. Proceedings of the 32nd ACM International Conference on Multimedia , pages=

  32. [32]

    arXiv preprint arXiv:2505.09388 , year=

    Qwen3 technical report , author=. arXiv preprint arXiv:2505.09388 , year=

    Pith/arXiv arXiv

  33. [33]

    CoRR , volume =

    Gemma Team , title =. CoRR , volume =

  34. [34]

    arXiv preprint arXiv:2310.06825 , year=

    Mistral 7B , author=. arXiv preprint arXiv:2310.06825 , year=

    Pith/arXiv arXiv

  35. [35]

    arXiv preprint arXiv:2508.10925 , year=

    gpt-oss-120b & gpt-oss-20b model card , author=. arXiv preprint arXiv:2508.10925 , year=

    Pith/arXiv arXiv

  36. [36]

    arXiv preprint arXiv:2407.21783 , year=

    The llama 3 herd of models , author=. arXiv preprint arXiv:2407.21783 , year=

    Pith/arXiv arXiv

  37. [37]

    arXiv preprint arXiv:2412.08905 , year=

    Phi-4 technical report , author=. arXiv preprint arXiv:2412.08905 , year=

    Pith/arXiv arXiv

  38. [38]

    arXiv preprint arXiv:2406.12793 , year=

    Chatglm: A family of large language models from glm-130b to glm-4 all tools , author=. arXiv preprint arXiv:2406.12793 , year=

    Pith/arXiv arXiv

  39. [39]

    arXiv preprint arXiv:2203.14533 , year=

    Robust unlearnable examples: Protecting data against adversarial learning , author=. arXiv preprint arXiv:2203.14533 , year=

    Pith/arXiv arXiv

  40. [40]

    The Eleventh International Conference on Learning Representations , year=

    Transferable Unlearnable Examples , author=. The Eleventh International Conference on Learning Representations , year=

  41. [41]

    2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages=

    Unlearnable Clusters: Towards Label-Agnostic Unlearnable Examples , author=. 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages=. 2023 , organization=

    2023

  42. [42]

    arXiv preprint arXiv:2411.08506 , year=

    Towards operationalizing right to data protection , author=. arXiv preprint arXiv:2411.08506 , year=

    Pith/arXiv arXiv

  43. [43]

    ACM Computing Surveys , volume=

    A survey of text watermarking in the era of large language models , author=. ACM Computing Surveys , volume=. 2024 , publisher=

    2024

  44. [44]

    33rd USENIX Security Symposium (USENIX Security 24) , pages=

    \ REMARK-LLM \ : A robust and efficient watermarking framework for generative large language models , author=. 33rd USENIX Security Symposium (USENIX Security 24) , pages=

  45. [45]

    Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    Waterfall: Scalable framework for robust text watermarking and provenance for llms , author=. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    2024

  46. [46]

    Advances in Neural Information Processing Systems , volume=

    Large language model unlearning , author=. Advances in Neural Information Processing Systems , volume=

  47. [47]

    arXiv preprint arXiv:2412.21123 , year=

    ExpShield: Safeguarding Web Text from Unauthorized Crawling and LLM Exploitation , author=. arXiv preprint arXiv:2412.21123 , year=

    arXiv

  48. [48]

    Advances in Neural Information Processing Systems , volume=

    Versatile transferable unlearnable example generator , author=. Advances in Neural Information Processing Systems , volume=

  49. [49]

    Chengshuai Zhao and Zhen Tan and Pingchuan Ma and Dawei Li and Bohan Jiang and Yancheng Wang and Yingzhen Yang and Huan Liu , title =

  50. [50]

    Advances in neural information processing systems , volume=

    Certified defenses for data poisoning attacks , author=. Advances in neural information processing systems , volume=

  51. [51]

    2022 7th IEEE International Conference on Data Science in Cyberspace (DSC) , pages=

    A survey on data poisoning attacks and defenses , author=. 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC) , pages=. 2022 , organization=

    2022

  52. [52]

    Nature Medicine , volume=

    Medical large language models are vulnerable to data-poisoning attacks , author=. Nature Medicine , volume=. 2025 , publisher=

    2025

  53. [53]

    Advances in Neural Information Processing Systems , volume=

    Permissioned llms: Enforcing access control in large language models , author=. Advances in Neural Information Processing Systems , volume=