Pith. sign in

REVIEW 3 major objections 5 minor 53 references

Fragments to Facts: Partial-Information Fragment Inference from LLMs

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Fine-tuned LLMs leak private fragments to attackers who know only a few facts

desk verdict A genuinely new threat model, but the evaluation confounds fragment co-occurrence with fragment membership—LR-Attack appears to ignore the conditioning set entirely. read the letter →

arxiv 2505.13819 v1 pith:7EGPXXOB submitted 2025-05-20 cs.LG cs.CRcs.CY

Lucas Rosenblatt , Bin Han , Robert Wolfe , Bill Howe This is my paper · ORCID
classification cs.LGcs.CRcs.CY
keywords partial-informationfragmentinferencePIFILLMprivacymembershipmemorizationlikelihoodratioattackPRISMfine-tuningleakage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that a weak adversary — one who knows only a handful of unordered text fragments about a person, such as a few medical conditions — can query a fine-tuned LLM and infer additional private fragments from that same record. It introduces the partial-information fragment inference (PIFI) threat model and two data-blind attacks: LR-Attack, a likelihood ratio between target and shadow model probabilities, and PRISM, which adds a world-model prior to curb false positives. On medical summarization models, the attacks reach true-positive rates around 5–17% at 2–5% false positives, approaching a baseline classifier that assumes labeled in-distribution data. The paper argues that these rates justify treating fragment-level leakage as a distinct privacy risk in deployed fine-tuned models, especially after repeated epochs of fine-tuning.

What carries the argument

The statistical engine is the likelihood ratio $\hat{\ell} = p_D / p_{D'}$, where $p_D = f_{\theta,D}(y^* \mid \mathrm{Prompt}(S))$ is the target model's probability for the candidate fragment given the known fragments, and $p_{D'}$ is the same probability under a shadow model trained without the individual's record. PRISM regularizes this ratio with a world-model probability $p_{\mathrm{world}}$, computed as the mean probability over models not fine-tuned on the data, and applies a closed-form Bayesian update under the pragmatic assumptions $\Pr(\hat{\ell} \mid s \in D) \propto \hat{\ell}$ and $\Pr(\hat{\ell} \mid s \notin D) \propto 1/\hat{\ell}$, with a prior $\beta = \Pr(s \in D)$. The Classifier baseline, a LightGBM trained on the same three probabilities with labeled data, serves as the data-aware upper reference.

What would settle it

On a fine-tuned LLM with known training data, compute the empirical conditional distributions of $\hat{\ell} = p_D/p_{D'}$ for fragments that are in the target individual's record versus fragments that are not; if the ratio of these densities is not approximately $\hat{\ell}$ versus $1/\hat{\ell}$, or if PRISM's AUC collapses when $\beta$ is swept across plausible values, then the closed-form posterior is not a valid estimate of $\Pr(s \in D \mid \hat{\ell})$.

Watch

Extended reading notes

Core claim

The central claim is that fine-tuned language models leak sensitive fragments under PIFI: given a public fragment set S from an individual's record, an attacker who can query the model's output probabilities can decide whether a candidate private fragment y* also appears in the record, conditioned on the record being in the training set. The evidence is empirical: across Llama-3.1-8B, Qwen-2-7B, and Mistral-7B fine-tuned on medical notes, LR-Attack and PRISM exceed random guessing by roughly two to four times at low FPR, with LR-Attack reaching 17.5% TPR at 2% FPR for fragments that appear once in the training data. The authors also show that repeated fine-tuning epochs increase leakage, LoRA reduces but does not eliminate it, larger models leak more, and PRISM outperforms LR-Attack on common fragments while LR-Attack excels on rare ones.

Load-bearing premise

PRISM's score is a meaningful posterior only if the ad hoc assumptions $\Pr(\hat{\ell} \mid s \in D) \propto \hat{\ell}$ and $\Pr(\hat{\ell} \mid s \notin D) \propto 1/\hat{\ell}$ hold and the prior $\beta$ is set sensibly; these are validated only on a synthetic trigram model, not on any LLM.

Editorial extensions

If this is right

  • More fine-tuning epochs raise fragment-leakage rates, so deployment of repeatedly fine-tuned models carries higher PIFI risk than single-epoch models.
  • LR-Attack offers a practical scare for rare fragments: a single-occurrence term yields 17.5% TPR at 2% FPR, meaning roughly one in six rare facts is recoverable at a tolerable false-positive budget.
  • PRISM's world-model prior suppresses false positives on common fragments, so the choice of attack should depend on fragment frequency.
  • Differential privacy with $\epsilon=3$ suppresses LR-Attack to 0.9% TPR at 2% FPR but leaves PRISM and Classifier at roughly 4% TPR, so DP alone does not close the gap.
  • LoRA fine-tuning reduces but does not eliminate vulnerability, so parameter-efficient deployment should not be assumed private.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The reported per-fragment TPRs, applied across many victims, imply that an attacker querying thousands of records could recover a substantial number of sensitive facts; multiplying the low-FPR TPR by population size gives concrete expected leak counts.
  • Because the PIFI attack needs only output probabilities, defenses that hide logits (e.g., API restrictions) would blunt LR-Attack and PRISM, a testable prediction not explored in the paper.
  • The same fragment-inference machinery could be turned toward constructive ends, such as auditing what a fine-tuned model has absorbed about a cohort, by treating the attack score as a per-fragment memorization diagnostic.
  • A direct calibration check — computing $\Pr(\hat{\ell} \mid s \in D)$ and $\Pr(\hat{\ell} \mid s \notin D)$ on an open model with known training data — would tell whether PRISM's closed-form posterior is reliable; the paper only validates it on a synthetic trigram model.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces PIFI (Partial-Information Fragment Inference), a threat model in which an attacker who knows a small unordered set S of fragments from an individual's training record queries a fine-tuned LLM's output probabilities to infer whether a candidate private fragment y* also occurs in that record. Two data-blind scoring functions are proposed: LR-Attack, which thresholds the ratio p_D/p_D' against a shadow model, and PRISM, which incorporates a world-model prior through a Bayesian update. The authors evaluate on medical and legal summarization tasks using Llama-3.1-8B, Qwen-2-7B, Mistral-7B, and Llama-3.2-3B, with full and LoRA fine-tuning, and also report a DP-SGD defense experiment. The central empirical claim is that fine-tuned LLMs leak under PIFI, with TPRs around 5-17% at 2-5% FPR across model families.

Significance. The PIFI threat model is a timely and meaningful relaxation of prior memorization and membership-inference assumptions: it asks whether an adversary with only a few unordered fragments can infer additional co-occurring fragments. The empirical effort is substantial, covering three model families, multiple fine-tuning regimes, LoRA, DP fine-tuning, world-model ablations, and a public code release. If the fragment-specific claim were supported by the evaluation, the results would constitute an important contribution to LLM privacy. However, as detailed in the major comments, the current evaluation does not establish the fragment-specific mechanism, and the PRISM derivation rests on unreported and unjustified choices. The work is potentially salvageable but requires a re-designed evaluation before the central claim can be accepted.

major comments (3)
  1. [§5.1, Tables 1 and 3] The negative examples used to compute FPR are fragments drawn from notes that 'did not appear in the fine-tuning subset,' so all negative y* are out-of-distribution with respect to D while all positive y* are in D. This allows LR-Attack to separate positives from negatives by detecting whether y* was memorized at all, without using the conditioning set S, which contradicts Algorithm 1's requirement to score y*∈s given s∈D. The rare-fragment stratum in Table 3, where LR-Attack reaches 17.5% TPR@2%FPR, is exactly the regime where this confound is strongest because rare y* are almost certainly absent from the shadow model's training data, making p_D/p_D' spike from membership alone. The proper control, required by the threat model, is to draw negative y* from other training records so that y*∈D but y*∉s.
  2. [§8.5 and Appendix A.2] The noise ablation provides direct evidence that the content of S is not the signal driving the attacks: replacing 75% of the fragments in S with inaccurate fragments leaves LR-Attack AUC essentially unchanged (0.54 for the 1-epoch Llama-3-8B model and 0.64→0.66 for the convergence model), while PRISM changes only mildly (0.68→0.65 for 1 epoch, 0.67→0.66 for convergence). This is incompatible with the paper's account that the attacker uses the known fragments S to infer co-occurring y* in the same record; instead, the statistic appears to detect whether y* was seen during fine-tuning. This ablation should be reported prominently, and the central claim should be revisited in light of it.
  3. [§4.3 (PRISM)] The PRISM score is derived from two unjustified proportionality assumptions, Pr(ℓ̂|s∈D)∝ℓ̂ and Pr(ℓ̂|s∉D)∝1/ℓ̂, and the prior β=Pr(s∈D) is never reported for the LLM experiments. The only validation of this closed form is on a synthetic trigram model in Appendix B, which is a count-based model rather than an LLM and does not establish that the functional form is appropriate for the reported TPR/AUC values. The paper should report β, provide a sensitivity analysis over β and the assumed proportionalities, or explicitly reframe PRISM as a heuristic rather than a posterior estimate.
minor comments (5)
  1. [Tables 1, 3, 4, 5] All results are reported as point estimates without error bars, confidence intervals, or a statement about the number of fine-tuning runs and shadow-model draws; given the stochasticity of fine-tuning, the absence of any variance estimate weakens the quantitative comparisons.
  2. [§4.3] The notation Pr(fθ,D*(y*|S)|s∈D*) is not a well-defined probability as written; it appears to denote the distribution of the model-assigned probability under random draws of D*, and this should be clarified.
  3. [Appendix D] The memorization results reference 'Table??' instead of a numbered table; the cross-reference should be fixed.
  4. [Appendix C, Table 8] The entity category examples contain apparent NER labeling errors: 'Abnormal Heart Valve' is listed under B-Lab_value and 'Darvocet' under B-Biological_structure; these should be verified because the fragment categories are used in the analysis.
  5. [§8.3] The citation to Jiang et al. [2024] for the claim that LoRA mitigates memorization appears to point to a paper on high-rank updating for parameter-efficient fine-tuning; please verify that this citation supports the stated claim.

Circularity Check

1 steps flagged · score 6.0 of 10

LR-Attack's fragment-inference results reduce to fragment-membership inference because negative targets are constructed outside D and the conditioning set S is shown to be irrelevant.

  1. renaming known result [§5.1 negative-example construction; §4.2 LR-Attack definition; §8.5 T5 noising ablation]
    "To construct negative examples, we sample a second disjoint set of unseen fragments, i.e., fragments from notes that did not appear in the fine-tuning subset and which are not part of the samples that we test as true positives."

    Algorithm 1's target is y* in s given s in D, so the proper negative control is y* in D but y* not in s. Instead every negative y* comes from records outside D, so for negatives pD=f_theta,D(y*|Prompt(S)) is the probability of an unseen token while positives were memorized; hence the LR statistic lhat=pD/pD' (Section 4.2) separates y* in D from y* not in D, i.e., it performs membership inference on the candidate fragment. Section 8.5 confirms S is not load-bearing: replacing 75% of accurate fragments in S leaves LR-Attack AUC unchanged (0.54 at one epoch; 0.64 to 0.66 at convergence). The LR-Attack 'fragment-specific inference' thus reduces by construction to fragment-membership inference renamed as PIFI.

full rationale

The central derivation-chain issue is in the operationalization of the LR-Attack experiment. The paper defines the PIFI target as inferring y* co-occurring with known S in a record s whose membership in D is given, then builds negatives from records absent from D. This makes lhat=pD/pD' a test of whether y* itself was in the fine-tuning set, and the paper's own noising ablation shows S does not affect LR-Attack. PRISM's Section 4.3 derivation is an acknowledged heuristic: the proportionality assumptions Pr(lhat|s in D) proportional to lhat and Pr(lhat|s not in D) proportional to 1/lhat are stated as pragmatic, and validation on the synthetic trigram model (Appendix B) is not an external benchmark; these are correctness and robustness limitations rather than circular reductions. No load-bearing self-citation chain appears: citations to Carlini et al. for membership-inference baselines and to the authors' own dataset and application papers are not used to justify the attack's validity. Because one of the two central attack methods (LR-Attack) has its reported fragment-inference results reduced by construction to membership inference, while PRISM and Classifier retain some S-dependent signal, the overall circularity score is 6.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central evidence is empirical. The main added costs beyond standard LM fine-tuning assumptions are the shadow model and world model approximations, plus the ad hoc PRISM update form.

free parameters (2)
  • β (prior Pr(s∈D) in PRISM) = not reported (unclear if fixed or tuned)
    Section 4.3 treats Pr(s∈D) as a prior belief β but no value is given for the LLM experiments; the score's behavior depends on β, and if β is tuned on the evaluation set this would be a fitted parameter.
  • Functional form of the PRISM update = Pr(ℓ̂|s∈D)∝ℓ̂, Pr(ℓ̂|s∉D)∝1/ℓ̂
    Ad hoc proportionality stated in Section 4.3, not derived; validated only on a toy model. This choice determines the closed-form score.
assumptions (4)
  • domain assumption The shadow model fθ,D′ represents a model trained on the same distribution without the target sample (D′∼D, s∉D′).
    Standard membership-inference shadow model assumption, invoked in Section 4.2 to justify ℓ̂=pD/pD′.
  • domain assumption The world-model average pworld approximates the marginal probability Pr(fθ,D∗(y∗|Prompt(S))) over models trained on datasets from the general distribution.
    Used in Section 4.3 to approximate the unconditional term in the Bayesian expansion; averaging three LLMs is a finite-sample approximation without error bounds.
  • ad hoc to paper Pr(ℓ̂|s∈D)∝ℓ̂ and Pr(ℓ̂|s∉D)∝1/ℓ̂.
    Stated pragmatically in Section 4.3 with no derivation and no empirical check on LLMs; only tested in the synthetic trigram setting (Appendix B).
  • domain assumption The Neyman-Pearson likelihood-ratio statistic computed from model output probabilities is a sufficient or near-sufficient statistic for the PIFI inference problem.
    Underlies LR-Attack in Section 4.2; the paper notes we never have direct access to true distributions and must approximate them.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fragments to Facts: Partial-Information Fragment Inference from LLMs." pith.science (2026). https://pith.science/paper/7EGPXXOB

@misc{pith2026250513819,
  author       = {Pith},
  title        = {Pith review of: Fragments to Facts: Partial-Information Fragment Inference from LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7EGPXXOB}},
  note         = {Machine review of arXiv:2505.13819}
}
read the original abstract

Large language models (LLMs) can leak sensitive training data through memorization and membership inference attacks. Prior work has primarily focused on strong adversarial assumptions, including attacker access to entire samples or long, ordered prefixes, leaving open the question of how vulnerable LLMs are when adversaries have only partial, unordered sample information. For example, if an attacker knows a patient has "hypertension," under what conditions can they query a model fine-tuned on patient data to learn the patient also has "osteoarthritis?" In this paper, we introduce a more general threat model under this weaker assumption and show that fine-tuned LLMs are susceptible to these fragment-specific extraction attacks. To systematically investigate these attacks, we propose two data-blind methods: (1) a likelihood ratio attack inspired by methods from membership inference, and (2) a novel approach, PRISM, which regularizes the ratio by leveraging an external prior. Using examples from both medical and legal settings, we show that both methods are competitive with a data-aware baseline classifier that assumes access to labeled in-distribution data, underscoring their robustness.

Figures

Figures reproduced from arXiv: 2505.13819 by the authors.

Figure 1
Figure 1. Comparing the PIFI LLM threat model to the memorization threat model in a medical scenario. PIFI uses unordered, publicly available fragments from a sample (like a patient record) to infer private fragments (like a sensitive medical condition). Memorization assumes access to an ordered prefix of the sample, and checks for verbatim generation by an LLM of the suffix. We consider a malicious adversary who seeks to acq… view at source ↗
Figure 3
Figure 3. Successful and failed attack scenarios. An attack is only considered successful when the sequence [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Left: single epoch fine-tuned Llama-3 8B model. Right: convergence fine-tuned Llama-3 8B model. More fine-tuning consistently increases the success rates of PIFI attacks. 10 [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figures from the paper (9 more)
Figure 5
Figure 5. Figure 5: Left: fully fine-tuned Llama-3 8B model. Right: LoRA fine-tuned Llama-3 8B mode. LoRA-fine￾tuned models exhibit less vulnerability than their fully fine-tuned counterparts. 0.01 0.02 0.05 0.1 0.5 1 FPR 0.02 0.05 0.1 0.5 1 TPR Llama 3 3B LoRA Finetuned (Conv., medical) …
Figure 6
Figure 6. Figure 6: Left: LoRA fine-tuned Llama-3 3B model. Right: LoRA fine-tuned of the Llama-3 8B model. Larger parameter counts confer greater capacity for memorizing training examples. increases the chances of memorization. However, even a single epoch of fine-tuning is sufficient to…
Figure 7
Figure 7. Figure 7: Left: fully fine-tuned Llama-3-8B model. Middle: fully fine-tuned Qwen2-7B model Right: fully [PITH_FULL_IMAGE:figures/full_fig_p019_7.png]
Figure 8
Figure 8. Figure 8: Results of an ablation wherein only k% of fragments used in the attack prompt are accurate, [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: Results of our ablation wherein only k% of prompt fragments are accurate; the figure illustrates [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: Left: LoRA fine-tuned Llama-3 3B model. Middle: LoRA fine-tuned of the Llama-3 8B model. Right: LoRA fine-tuned of the Llama-3 70B model. Larger parameter counts confer greater capacity for memorizing training examples. A.3 (T6) Attacks in the Legal Setting Are More C…
Figure 11
Figure 11. Figure 11: The legal setting proves more challenging for our attacks. AUC does not exceed [PITH_FULL_IMAGE:figures/full_fig_p021_11.png]
Figure 12
Figure 12. Figure 12: Our findings indicate that LR-Attack is more effective for rare fragments, while PRISM is more effective for common fragments. For example, PRISM outperforms LR-Attack for the names of diseases (bottom left, B-Disease_disorder), which contains the commons names of dis…
Figure 13
Figure 13. Figure 13: Synthetic attack results. AUC scores are visualized for two methods. Each square shows the result [PITH_FULL_IMAGE:figures/full_fig_p023_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

53 extracted references · 17 canonical work pages

  1. [1]

    An empirical study of clinical note generation from doctor-patient encounters

    Asma Ben Abacha, Wen-wai Yim, Yadan Fan, and Thomas Lin. An empirical study of clinical note generation from doctor-patient encounters. In Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics, pages 2291--2302, 2023

    work page 2023

  2. [2]

    Nlp for maternal healthcare: Perspectives and guiding principles in the age of llms

    Maria Antoniak, Aakanksha Naik, Carla S Alvarado, Lucy Lu Wang, and Irene Y Chen. Nlp for maternal healthcare: Perspectives and guiding principles in the age of llms. In The 2024 ACM Conference on Fairness, Accountability, and Transparency, pages 1446--1463, 2024

    work page 2024

  3. [3]

    The secret sharer: Evaluating and testing unintended memorization in neural networks

    Nicholas Carlini, Chang Liu, \'U lfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19), pages 267--284, 2019

    2019

  4. [4]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pages 2633--2650, 2021

    2021

  5. [5]

    Membership inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897--1914. IEEE, 2022 a

    2022

  6. [6]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. arXiv preprint arXiv:2202.07646, 2022 b

    arXiv 2022

  7. [7]

    Stealing part of a production language model

    Nicholas Carlini, Daniel Paleka, Krishnamurthy Dj Dvijotham, Thomas Steinke, Jonathan Hayase, A Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, et al. Stealing part of a production language model. arXiv preprint arXiv:2403.06634, 2024

    arXiv 2024

  8. [8]

    Security and privacy challenges of large language models: A survey

    Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. Security and privacy challenges of large language models: A survey. ACM Computing Surveys, 2024

    work page 2024

Show all 53 references
  1. [9]

    Qlora: Efficient finetuning of quantized llms

    Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. Qlora: Efficient finetuning of quantized llms. arXiv preprint arXiv:2305.14314, 2023

    2023 arXiv

  2. [10]

    Sok: Membership inference is harder than previously thought

    Antreas Dionysiou and Elias Athanasopoulos. Sok: Membership inference is harder than previously thought. Proceedings on Privacy Enhancing Technologies, 2023

    2023

  3. [11]

    Do membership inference attacks work on large language models? arXiv preprint arXiv:2402.07841, 2024

    Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. Do membership inference attacks work on large language models? arXiv preprint arXiv:2402.07841, 2024

    2024 arXiv

  4. [12]

    The llama 3 herd of models

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  5. [13]

    Practical membership inference attacks against fine-tuned large language models via self-prompt calibration

    Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Practical membership inference attacks against fine-tuned large language models via self-prompt calibration. ArXiv, abs/2311.06062, 2023. URL https://api.semanticscholar.org/CorpusID:265128678

    2023 arXiv

  6. [14]

    The times sues openai and microsoft over a.i

    Michael Grynbaum and Ryan Mac. The times sues openai and microsoft over a.i. use of copyrighted work. The New York Times, Dec 2023

    2023

  7. [15]

    Huskyscribe at mediqa-sum 2023: Summarizing clinical dialogues with transformers

    Bin Han, Haotian Zhu, Sitong Zhou, Sofia Ahmed, Md Mushfiqur Rahman, Fei Xia, and Kevin Lybarger. Huskyscribe at mediqa-sum 2023: Summarizing clinical dialogues with transformers. In CLEF (Working Notes), pages 1488--1509, 2023

    2023

  8. [16]

    Measuring massive multitask language understanding

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. arXiv preprint arXiv:2009.03300, 2020

    2009 arXiv

  9. [17]

    Lo RA : Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lo RA : Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=nZeVKeeFYf9

    2022

  10. [18]

    Preventing verbatim memorization in language models gives a false sense of privacy

    Daphne Ippolito, Florian Tram \`e r, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christopher A Choquette-Choo, and Nicholas Carlini. Preventing verbatim memorization in language models gives a false sense of privacy. arXiv preprint arXiv:2210.17546, 2022

    arXiv

  11. [19]

    Membership inference attack susceptibility of clinical language models

    Abhyuday Jagannatha, Bhanu Pratap Singh Rawat, and Hong Yu. Membership inference attack susceptibility of clinical language models. arXiv preprint arXiv:2104.08305, 2021

    2021 arXiv

  12. [20]

    Mistral 7b

    Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. Mistral 7b. arXiv preprint arXiv:2310.06825, 2023

    arXiv

  13. [21]

    Mora: High-rank updating for parameter-efficient fine-tuning

    Ting Jiang, Shaohan Huang, Shengyue Luo, Zihan Zhang, Haizhen Huang, Furu Wei, Weiwei Deng, Feng Sun, Qi Zhang, Deqing Wang, and Fuzhen Zhuang. Mora: High-rank updating for parameter-efficient fine-tuning. ArXiv, abs/2405.12130, 2024. URL https://api.semanticscholar.org/Corpus...

    2024 arXiv

  14. [22]

    Lightgbm: A highly efficient gradient boosting decision tree

    Guolin Ke, Qi Meng, Thomas Finley, Taifeng Wang, Wei Chen, Weidong Ma, Qiwei Ye, and Tie-Yan Liu. Lightgbm: A highly efficient gradient boosting decision tree. In Neural Information Processing Systems, 2017. URL https://api.semanticscholar.org/CorpusID:3815895

    2017

  15. [23]

    Hashimoto

    Xuechen Li, Florian Tram \`e r, Percy Liang, and Tatsunori B. Hashimoto. Large language models can be strong differentially private learners. ArXiv, abs/2110.05679, 2021. URL https://api.semanticscholar.org/CorpusID:238634219

    2021 arXiv

  16. [24]

    Analyzing leakage of personally identifiable information in language models

    Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-B \'e guelin. Analyzing leakage of personally identifiable information in language models. In 2023 IEEE Symposium on Security and Privacy (SP), pages 346--363. IEEE, 2023

    2023

  17. [25]

    Membership inference attacks against language models via neighbourhood comparison

    Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Sch \"o lkopf, Mrinmaya Sachan, and Taylor Berg-Kirkpatrick. Membership inference attacks against language models via neighbourhood comparison. arXiv preprint arXiv:2305.18462, 2023

    2023 arXiv

  18. [26]

    Towards accurate differential diagnosis with large language models

    Daniel McDuff, Mike Schaekermann, Tao Tu, Anil Palepu, Amy Wang, Jake Garrison, Karan Singhal, Yash Sharma, Shekoofeh Azizi, Kavita Kulkarni, et al. Towards accurate differential diagnosis with large language models. arXiv preprint arXiv:2312.00164, 2023

    2023 arXiv

  19. [27]

    Inan, Marcello Hasegawa, Victor Ruhle, Taylor Berg-Kirkpatrick, and Robert Sim

    FatemehSadat Mireshghallah, Huseyin A. Inan, Marcello Hasegawa, Victor Ruhle, Taylor Berg-Kirkpatrick, and Robert Sim. Privacy regularization: Joint privacy-utility optimization in languagemodels. In North American Chapter of the Association for Computational Linguistics, 2021...

    2021

  20. [28]

    Quantifying privacy risks of masked language models using membership inference attacks

    Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, and Reza Shokri. Quantifying privacy risks of masked language models using membership inference attacks. arXiv preprint arXiv:2203.03929, 2022

    2022 arXiv

  21. [29]

    Morris, Wenting Zhao, Justin T

    John X. Morris, Wenting Zhao, Justin T. Chiu, Vitaly Shmatikov, and Alexander M. Rush. Language model inversion, 2023

    2023

  22. [30]

    Scalable extraction of training data from (production) language models

    Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette-Choo, Eric Wallace, Florian Tram \`e r, and Katherine Lee. Scalable extraction of training data from (production) language models. arXiv preprint arXiv:23...

    2023 arXiv

  23. [31]

    The testing of statistical hypotheses in relation to probabilities a priori

    Jerzy Neyman and Egon S Pearson. The testing of statistical hypotheses in relation to probabilities a priori. In Mathematical proceedings of the Cambridge philosophical society, volume 29, pages 492--510. Cambridge University Press, 1933

  24. [32]

    Introducing chatgpt

    OpenAI. Introducing chatgpt. https://openai.com/index/chatgpt/, 2022. [Accessed 19-01-2024]

    2022

  25. [33]

    Chatterji, Faisal Ladhak, and Tatsunori Hashimoto

    Yonatan Oren, Nicole Meister, Niladri S. Chatterji, Faisal Ladhak, and Tatsunori Hashimoto. Proving test set contamination in black box language models. ArXiv, abs/2310.17623, 2023. URL https://api.semanticscholar.org/CorpusID:264490730

    2023 arXiv

  26. [34]

    Training language models to follow instructions with human feedback

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35: 0 2...

    2022

  27. [35]

    Personalizing reinforcement learning from human feedback with variational preference learning

    Sriyash Poddar, Yanming Wan, Hamish Ivison, Abhishek Gupta, and Natasha Jaques. Personalizing reinforcement learning from human feedback with variational preference learning. ArXiv, abs/2408.10075, 2024. URL https://api.semanticscholar.org/CorpusID:271904022

    2024 arXiv

  28. [36]

    Improving language understanding by generative pre-training

    Alec Radford. Improving language understanding by generative pre-training. 2018

    2018

  29. [37]

    Detecting pretraining data from large language models

    Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. arXiv preprint arXiv:2310.16789, 2023

    2023 arXiv

  30. [38]

    Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov

    R. Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. 2017 IEEE Symposium on Security and Privacy (SP), pages 3--18, 2016. URL https://api.semanticscholar.org/CorpusID:10488675

    2017

  31. [39]

    Sarah silverman sues openai and meta over copyright infringement

    Zachary Small. Sarah silverman sues openai and meta over copyright infringement. The New York Times, Jul 2023

    2023

  32. [40]

    Minicheck: Efficient fact-checking of llms on grounding documents

    Liyan Tang, Philippe Laban, and Greg Durrett. Minicheck: Efficient fact-checking of llms on grounding documents. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, 2024. URL https://arxiv.org/pd...

    2024 arXiv

  33. [41]

    Gemma 2: Improving open language models at a practical size

    Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, L \'e onard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ram \'e , et al. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118, 2024

    2024 arXiv

  34. [42]

    Llama: Open and efficient foundation language models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth \'e e Lacroix, Baptiste Rozi \`e re, Naman Goyal, Eric Hambro, Faisal Azhar, Aur \'e lien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. Llama: Open and efficient foundat...

    2023 arXiv

  35. [43]

    Pandora's white-box: Increased training data leakage in open llms

    Jeffrey G Wang, Jason Wang, Marvin Li, and Seth Neel. Pandora's white-box: Increased training data leakage in open llms. arXiv preprint arXiv:2402.17012, 2024

    2024 arXiv

  36. [44]

    Dai, and Quoc V

    Jason Wei, Maarten Bosma, Vincent Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M. Dai, and Quoc V. Le. Finetuned language models are zero-shot learners. ArXiv, abs/2109.01652, 2021. URL https://api.semanticscholar.org/CorpusID:237416585

    2021 arXiv

  37. [45]

    The impact and opportunities of generative ai in fact-checking

    Robert Wolfe and Tanushree Mitra. The impact and opportunities of generative ai in fact-checking. In The 2024 ACM Conference on Fairness, Accountability, and Transparency, pages 1531--1543, 2024 a

    2024

  38. [46]

    The implications of open generative models in human-centered data science work: A case study with fact-checking organizations

    Robert Wolfe and Tanushree Mitra. The implications of open generative models in human-centered data science work: A case study with fact-checking organizations. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, volume 7, pages 1595--1607, 2024 b

    2024

  39. [47]

    Medjourney: Benchmark and evaluation of large language models over patient clinical journey

    Xian Wu, Yutian Zhao, Yunyan Zhang, Jiageng Wu, Zhihong Zhu, Yingying Zhang, Yi Ouyang, Ziheng Zhang, WANG Huimin, Zhenxi Lin, et al. Medjourney: Benchmark and evaluation of large language models over patient clinical journey. In The Thirty-eight Conference on Neural Informati...

  40. [48]

    Inan, and Andre Manoel

    Lukas Wutschitz, Huseyin A. Inan, and Andre Manoel. dp-transformers: Training transformer models with differential privacy. https://www.microsoft.com/en-us/research/project/dp-transformers, August 2022

    2022

  41. [49]

    Qwen2 technical report, 2024

    An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, Jianxin Yang, Jin Xu, Jingren Zhou, Jinze...

    2024 arXiv

  42. [50]

    Overview of the mediqa-sum task at imageclef 2023: Summarization and classification of doctor-patient conversations

    Wen-wai Yim, A Ben Abacha, N Snider, G Adams, and Meliha Yetisgen. Overview of the mediqa-sum task at imageclef 2023: Summarization and classification of doctor-patient conversations. In CLEF, number , page , , 2023

    2023

  43. [51]

    Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang

    Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. Differentially private fine-tuning of language models. ArXiv, abs/2110.06500, 2021. URL htt...

    arXiv

  44. [52]

    Bag of tricks for training data extraction from language models

    Weichen Yu, Tianyu Pang, Qian Liu, Chao Du, Bingyi Kang, Yan Huang, Min Lin, and Shuicheng Yan. Bag of tricks for training data extraction from language models. In International Conference on Machine Learning, pages 40306--40320. PMLR, 2023

    2023

  45. [53]

    Large language models for disease diagnosis: A scoping review

    Shuang Zhou, Zidu Xu, Mian Zhang, Chunpu Xu, Yawen Guo, Zaifu Zhan, Sirui Ding, Jiashuo Wang, Kaishuai Xu, Yi Fang, et al. Large language models for disease diagnosis: A scoping review. arXiv preprint arXiv:2409.00097, 2024

    2024 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.