Pith. sign in

REVIEW 3 major objections 5 minor 58 references

Understanding and Mitigating Cross-lingual Privacy Leakage via Language-specific and Universal Privacy Neurons

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that LLMs leak personally identifiable information across languages even when trained only on English, traces the leakage to two neuron populations, and shows that deactivating them cuts the risk by 23.3%-31.6%.

desk verdict Real cross-lingual leakage and a useful taxonomy, but the headline mitigation numbers are in-sample fits and should not be trusted until a held-out evaluation appears. read the letter →

arxiv 2506.00759 v2 pith:CC4QJITF submitted 2025-06-01 cs.CL

Wenshuo Dong , Qingsong Yang , Shu Yang , Lijie Hu , Meng Ding , Wanyu Lin , Tianhang Zheng , Di Wang This is my paper
classification cs.CL
keywords cross-lingualprivacyleakagepersonallyidentifiableinformationneuronsmultilingualLLMsmechanisticinterpretabilityLogitLensneurondeactivationMPNC
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the standard assumption of monolingual privacy is unsafe: a model fine-tuned on English personal data will answer Chinese, Spanish, or Japanese questions with that same person's email, job, or phone number. Using layer-by-layer probes on three open LLMs, the authors find that private information is first assembled in a language-independent representation in middle layers and only later shifted into a language-specific output space, which is why a non-English prompt can still trigger an English-memorized answer. They then locate two kinds of neurons by gradient attribution: privacy-universal neurons that carry leakage in every language and language-specific privacy neurons that carry it in one language. Deactivating both sets lowers cross-lingual leakage risk by 23.3% to 31.6% across LLaMA3.1-8B, Qwen2.5-7B, and LLaMA3.2-3B, with only a small cost to generation fluency.

What carries the argument

The paper's central objects are two neuron populations inside transformer MLPs: privacy-universal neurons, active across all six languages and selected as the intersection of per-language attribution sets, and language-specific privacy neurons, the per-language neurons left after removing that intersection. They are located with integrated-gradient attribution on the likelihood of generating the correct private token, and the defense works by zeroing their activations, a method the paper calls MPNC. Logit Lens supplies the layer-wise view that motivates the neuron split: MRR rises only in middle-to-late layers, coinciding with the peak cross-lingual cosine similarity of hidden states.

What would settle it

Run MPNC with a strict train/test split on MPII, selecting the neurons on one half and measuring MRR on held-out individuals, PII records, and prompt templates; if the held-out reduction is close to the 10-14% that DEPN already achieves cross-lingually, the claimed 23.3%-31.6% defense does not generalise.

Watch

Extended reading notes

Core claim

The central claim is that cross-lingual privacy leakage is not a random artifact but a structural property: LLMs encode private information in a shared, language-agnostic conceptual space in middle layers, then convert it to language-specific form in late layers, so that a query in any language can surface English-trained PII. Consequently, existing English-only neuron-editing defenses such as DEPN and APNEAP fail in non-English settings, while a defense that edits both privacy-universal neurons and language-specific privacy neurons reduces leakage risk by 23.3%-31.6% across three models.

Load-bearing premise

The reported 23.3%-31.6% reduction is computed on the same multilingual PII dataset used to select the privacy neurons, so the defense has not been shown to transfer to unseen people, PII types, or prompt phrasings.

Editorial extensions

If this is right

  • English-only defenses such as DEPN and APNEAP cannot stop cross-lingual leakage because they miss language-specific privacy neurons; a practical defense must edit both universal and language-specific sets.
  • The MPNC intervention is lightweight: privacy-related neurons are only about 2.7-4.5% of all neurons in each tested model, so the mitigation does not require retraining.
  • Deactivating these neurons costs little generation quality: Valid-PPL rises only marginally above the best baseline, so the privacy gain is not a utility collapse.
  • Any multilingual model trained on monolingual private data should exhibit the same two-stage leakage pattern, since the shared middle-layer representation is language-independent.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the shared middle-layer representation is the true bottleneck, a defense that intervenes on that shared space during fine-tuning could be more robust than post-hoc neuron zeroing; the paper does not test this.
  • The universal/specific neuron split likely overlaps with the language-control neurons studied in general multilingual interpretability, so privacy edits and language-control edits may interfere; testing this interaction would clarify deployment trade-offs.
  • The reported 23.3%-31.6% reduction is measured on the same MPII corpus used to select neurons; a held-out split with new individuals, PII types, or prompt phrasings would show whether the defense generalises, since the paper does not include one.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies cross-lingual privacy leakage in LLMs: after fine-tuning on English PII texts, models leak PII when queried in other languages. It introduces MPII, a multilingual PII dataset (4,434 parallel texts, 6 languages, 4 PII types), analyzes information flow using Logit Lens and latent-representation similarity, proposes privacy-universal and language-specific privacy neurons, and presents a defense, MPNC, that deactivates these neurons. The paper reports that MPNC reduces cross-lingual privacy leakage risk by 23.3%–31.6% across three LLMs and claims it outperforms DEPN and APNEAP.

Significance. If validated, the paper would contribute a useful multilingual PII benchmark, a mechanistic account of cross-lingual leakage, and a lightweight defense. The dataset construction and the observation that existing defenses such as DEPN are markedly less effective in non-English settings are valuable. The layer-wise MRR and cosine-similarity analyses are interesting and largely independent of the main defense claim. However, the central quantitative claim is currently not supported because neuron selection and evaluation use the same data instances; the reported MRR reduction and the universal/specific neuron distinction may reflect in-sample fitting rather than generalizable properties. The paper also provides no code or data release, which prevents independent audit of the selection/evaluation overlap.

major comments (3)
  1. [Section 6 and Appendix A.5; Section 7 and Table 1] The headline 23.3%–31.6% reduction is obtained with an in-sample evaluation protocol. In Appendix A.5, attribution scores are computed for each prompt X and private sequence Y from the privacy dataset D (Eq. (9)), and neurons are selected when their frequency exceeds τ2·|D|. The MRR evaluation in Section 7 (Table 1, Figure 12) then measures exactly how well the model ranks the same Y tokens for the same X prompts. Deactivating a neuron selected for high attribution on a specific (X,Y) pair will, by construction, tend to lower the rank of Y on that pair; no held-out split by individual, PII type, or prompt template is described anywhere. The reported reduction therefore does not establish a generalizable defense. The authors should rerun selection and evaluation on disjoint subsets, for example via cross-validation over the 4,434 individuals or over PII types, and report whether the reduction transfers to unseen instances.
  2. [Section 6, Appendix A.5; Tables 4–6 and 7–9] The universal-vs-specific neuron distinction is subject to the same selection artifact. The set P_ℓ is defined as the neurons selected on language-ℓ data, so deactivating 'own-specific' neurons is partially guaranteed to lower MRR for language-ℓ evaluation instances, whereas 'other-specific' neurons were not selected for those instances. The random-neuron controls in Tables 4–6 control only for the number of edited neurons, not for selection on the evaluation set. To support the claim that the identified neurons are genuinely language-universal or language-specific, the authors need a protocol in which neuron localization is performed on a training fold and the causal effect is measured on a test fold with different individuals or PII types.
  3. [Section 7.3, Tables 1 and 4–6] The comparison with DEPN and APNEAP is also confounded by in-sample selection. MPNC's neuron sets are tuned on the exact test instances, while DEPN and APNEAP use their own selection procedures on the same data. This gives MPNC an advantage in the comparison and undermines the claim that MPNC 'consistently outperforms' the baselines. A fair comparison requires all methods to be evaluated on a held-out set that was not used for any neuron selection or hyperparameter choice, including τ1, τ2, and the number of deactivated neurons.
minor comments (5)
  1. [Abstract and Table 1] The abstract reports a reduction range of 23.3%–31.6%, but the averages in Table 1 imply 23.3% (LLaMA3.1-8B), 30.6% (Qwen2.5-7B), and 24.2% (LLaMA3.2-3B); please clarify how the 31.6% upper bound is computed.
  2. [Section 5.2 and Figure 4] The analysis selects the top 3% of instances by MRR; please state whether these instances are from the same pool later used for neuron selection and defense evaluation, since this affects the interpretation of the flow analysis.
  3. [Appendix A.5, Eqs. (7)–(9)] The notation P(Y|X, w_k^l) is unusual: the derivative in Eq. (8) is taken with respect to the neuron activation while the activation is also used as a conditioning quantity. Please clarify the exact computation, including how gradients are obtained for each target token and whether the attribution is normalized across layers.
  4. [Table 2 and Listing 1] The dataset name is inconsistent: MPII in the main text but XPII in Table 2 and Listing 1; please standardize the terminology.
  5. [Figures 13 and 14] The captions label the bars as 'Original MPNC' although the figures illustrate DEPN and APNEAP; please correct the captions.

Circularity Check

2 steps flagged · score 7.0 of 10

MPNC's headline 23.3%-31.6% reduction is an in-sample fit: privacy neurons are selected on the same MPII prompt-PII pairs that later define the MRR evaluation, and the universal/specific neuron claims restate the selection definitions.

  1. fitted input called prediction [Section 6; Appendix A.5; Section 7.1; Section 7.3 and Figure 12]
    "Across the privacy dataset D, we calculate the frequency fi with which each neuron i appears in AX. A neuron is selected as privacy-related if: fi > τ2 · |D| ... After locating the privacy-universal neurons and language-specific privacy neurons, we mitigate cross-lingual privacy leakage by applying a simple yet effective neuron intervention strategy. Specifically, we set the activation values of the corresponding neurons to zero. ... After 10 epochs of fine-tuning on English texts in MPII designed to facilitate memorization, these models are evaluated using MRR and Valid-PPL."

    The selection procedure in Appendix A.5 and the MRR evaluation in Section 7.1 use the same MPII instances: neurons are chosen because they increase P(Y|X) for prompts X and private sequences Y in D, and Section 7.3 / Figure 12 then report MRR for those same question-answer pairs, with no held-out split described. Zeroing a neuron selected for high positive attribution on a given (X,Y) pair tends to lower the rank of Y on that same pair, so the headline 23.3%-31.6% reduction is a measure of fit to the evaluation set rather than an independent defense result. The random-neuron controls in Tables 4-6 match the number of edited neurons but do not break this selection-on-evaluation loop.

  2. self definitional [Section 6 definitions; Appendix A.5; Section 7.2 and Figure 5]
    "The privacy-universal neurons are defined as: Puni = ∩ℓ Pℓ. The language-specific privacy neurons for language ℓ are defined as: P(spec)ℓ = Pℓ \ Puni. ... The most significant drop in MRR is observed when deactivating privacy-universal neurons shared across languages."

    The definitions encode the later causal claims. Each Pℓ is built as the set of neurons with high attribution frequency on language-ℓ data, so the intersection is, by construction, the set important in every language and the set difference is, by construction, the set important in only one language. The intervention results in Section 7.2 are then evaluated on the same language-ℓ data used to build Pℓ, making the 'universal causes cross-lingual drop' and 'own specific causes own-language drop' findings re-statements of the selection rule rather than independent mechanistic discoveries.

full rationale

The paper's descriptive analyses (Logit Lens information flow, cosine similarity of latent states) are self-contained and not circular. The circularity is concentrated in the MPNC defense claim: neuron selection (Appendix A.5) and the reported MRR reductions (Section 7.3, Figure 12, Tables 4-6) operate on the same MPII prompt-PII pairs, and no held-out split by individual, PII entity, or prompt template is described. Consequently the 23.3%-31.6% reduction is substantially an in-sample selection effect. The universal-versus-specific neuron taxonomy is likewise defined from the same per-language selection sets and then 'confirmed' on those sets, so the causal intervention results partly restate the definitions. Because a random-neuron baseline shows the selected neurons carry non-random information and the paper includes independent interpretability analyses, the circularity is partial rather than total. No code or data release is provided, so the exact instance overlap cannot be independently audited.

Assumptions & free parameters 4 free parameters · 4 assumptions · 2 invented entities

The central quantitative claim depends on several fitted or hand-chosen quantities: the attribution and frequency thresholds, the number of neurons deactivated, and the fine-tuning duration. The proposed entities (universal and language-specific privacy neurons) are defined by the paper's own attribution pipeline and lack independent external evidence. The MRR-as-leakage assumption and the synthetic translated dataset are additional unverified premises.

free parameters (4)
  • Attribution threshold tau1 = 0.1
    A neuron is considered active if its integrated-gradient score exceeds 10% of the maximum attribution in a prompt. The value is taken from prior work, but it controls which neurons enter the universal and language-specific sets and therefore affects the reported leakage reduction.
  • Frequency threshold tau2 = 0.5 (text also says typically 40%)
    A neuron must be active in at least 50% of the privacy dataset to be selected. The paper first states a typical value of 40% and later adopts 0.5 from Wu et al. (2024); this threshold changes the selected neuron counts and hence the defense outcome.
  • Number of deactivated neurons = 500, 1000, or 2000, depending on model and table
    Tables 4 to 6 report MRR after editing 500, 1000, or 2000 neurons, but Table 1 does not state which count is used for the headline MPNC numbers. The choice appears to be tuned on the evaluation set, which is a form of fitting.
  • Fine-tuning epochs = 10
    The models are fine-tuned for 10 epochs on English MPII texts to induce memorization. The entire leakage and neuron-localization analysis depends on this training regimen, which is a proxy for pretraining memorization rather than a naturally occurring setting.
assumptions (4)
  • domain assumption Gradient attribution scores on the MPII dataset identify neurons that are causally responsible for privacy leakage.
    Used throughout Section 6 and Appendix A.5: neurons with high integrated-gradient contribution are selected as privacy neurons. This assumes attribution reflects a causal role, a claim tested only by deactivation on the same data.
  • domain assumption Token-level MRR of the target PII sequence is an adequate measure of privacy leakage risk.
    Section 4.1 and Appendix A.3 define leakage as the model ranking correct PII tokens highly. This equates memorization with a real-world confidentiality breach; an attacker's ability to extract complete records may differ.
  • domain assumption The synthetic PII corpus translated with GPT-4o is representative of real training-data privacy risks.
    Dataset construction in Section 3 relies on translated synthetic texts from a Kaggle competition. Real-world PII distributions, languages, and memorization patterns may behave differently.
  • domain assumption Fine-tuning on English-only data for 10 epochs simulates a model that has memorized private information from pretraining.
    The experimental setup uses deliberately fine-tuned models to force memorization. This is a proxy for natural memorization, which may involve different mechanisms and distributions.
invented entities (2)
  • privacy-universal neurons
    purpose: Neurons whose deactivation reduces privacy leakage across all tested languages; used as intervention targets in MPNC.
    Defined as the intersection of per-language privacy neuron sets (Section 6 and Appendix A.5). No evidence outside this paper's attribution data confirms their existence or role; the causal test is on the same dataset that defined them.
  • language-specific privacy neurons
    purpose: Neurons associated with leakage in one target language; used as additional intervention targets in MPNC.
    Defined as the per-language neuron set minus the universal intersection. Their language-specific role is only tested in-sample, with no held-out languages or unseen PII records.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Understanding and Mitigating Cross-lingual Privacy Leakage via Language-specific and Universal Privacy Neurons." pith.science (2026). https://pith.science/paper/CC4QJITF

@misc{pith2026250600759,
  author       = {Pith},
  title        = {Pith review of: Understanding and Mitigating Cross-lingual Privacy Leakage via Language-specific and Universal Privacy Neurons},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CC4QJITF}},
  note         = {Machine review of arXiv:2506.00759}
}
read the original abstract

Large Language Models (LLMs) trained on massive data capture rich information embedded in the training data. However, this also introduces the risk of privacy leakage, particularly involving personally identifiable information (PII). Although previous studies have shown that this risk can be mitigated through methods such as privacy neurons, they all assume that both the (sensitive) training data and user queries are in English. We show that they cannot defend against the privacy leakage in cross-lingual contexts: even if the training data is exclusively in one language, these (private) models may still reveal private information when queried in another language. In this work, we first investigate the information flow of cross-lingual privacy leakage to give a better understanding. We find that LLMs process private information in the middle layers, where representations are largely shared across languages. The risk of leakage peaks when converted to a language-specific space in later layers. Based on this, we identify privacy-universal neurons and language-specific privacy neurons. Privacy-universal neurons influence privacy leakage across all languages, while language-specific privacy neurons are only related to specific languages. By deactivating these neurons, the cross-lingual privacy leakage risk is reduced by 23.3%-31.6%.

Figures

Figures reproduced from arXiv: 2506.00759 by the authors.

Figure 1
Figure 1. An illustration of cross-lingual privacy leak [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Cross-lingual PII leakage results across differ [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Cross-lingual evaluation of the DEPN using [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Analysis of multilingual privacy leakage in three models, including: (a) the layer-wise evolution of MRR [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Layer-wise average MRR of high-risk PII instances before and after privacy neuron interventions. “Origi [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Layer-wise averaged MRR of high-risk PII instances for LLaMA3.1-8B when prompted in non-English [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: Layer-wise averaged MRR of high-risk PII instances for Qwen2.5-7B when prompted in non-English [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Layer-wise averaged MRR of high-risk PII instances for LLaMA3.2-3B when prompted in non-English [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: Layer-wise distribution of privacy-related neurons in LLaMA3.1–8B. [PITH_FULL_IMAGE:figures/full_fig_p019_9.png]
Figure 10
Figure 10. Figure 10: Layer-wise distribution of privacy-related neurons in Qwen2.5-7B. [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: Layer-wise distribution of privacy-related neurons in LLaMA3.2–3B. [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]
Figure 12
Figure 12. Figure 12: Cross-lingual privacy leakage (MRR) per language in three models with and without MPNC. [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]
Figure 13
Figure 13. Figure 13: Cross-lingual privacy leakage (MRR) per language in three models with and without DEPN. [PITH_FULL_IMAGE:figures/full_fig_p020_13.png]
Figure 14
Figure 14. Figure 14: Cross-lingual privacy leakage (MRR) per language in three models with and without APNEAP. [PITH_FULL_IMAGE:figures/full_fig_p021_14.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

58 extracted references · 24 canonical work pages

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774

    arXiv 2023

  4. [4]

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, and 1 others. 2021. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21), pages 2633--2650

    2021

  5. [5]

    Ruizhe Chen, Tianxiang Hu, Yang Feng, and Zuozhu Liu. 2024. Learnable privacy neurons localization in language models. arXiv preprint arXiv:2405.10989

    arXiv 2024

  6. [6]

    Kevin Clark, Urvashi Khandelwal, Omer Levy, and Christopher D Manning. 2019. What does bert look at? an analysis of bert's attention. arXiv preprint arXiv:1906.04341

    arXiv 2019

  7. [7]

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, and 1 others. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783

    arXiv 2024

  8. [8]

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, and 1 others. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948

    arXiv 2025

Show all 58 references
  1. [9]

    Yihuai Hong, Yuelin Zou, Lijie Hu, Ziqian Zeng, Di Wang, and Haiqin Yang. 2024. Dissecting fine-tuning unlearning in large language models. arXiv preprint arXiv:2410.06606

    2024 arXiv

  2. [10]

    Lijie Hu, Ivan Habernal, Lei Shen, and Di Wang. 2024 a . Differentially private natural language models: Recent advances and future directions. In Findings of the Association for Computational Linguistics: EACL 2024, pages 478--499

    2024

  3. [11]

    Lijie Hu, Tianhao Huang, Lu Yu, Wanyu Lin, Tianhang Zheng, and Di Wang. 2024 b . Faithful interpretation for graph neural networks. arXiv preprint arXiv:2410.06950

    2024 arXiv

  4. [12]

    Lijie Hu, Liang Liu, Shu Yang, Xin Chen, Zhen Tan, Muhammad Asif Ali, Mengdi Li, and Di Wang. 2024 c . Understanding reasoning in chain-of-thought from the hopfieldian view. arXiv preprint arXiv:2410.03595

    2024 arXiv

  5. [13]

    Lijie Hu, Yixin Liu, Ninghao Liu, Mengdi Huai, Lichao Sun, and Di Wang. 2023. Seat: stable and explainable attention. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 12907--12915

    2023

  6. [14]

    Lijie Hu, Yixin Liu, Ninghao Liu, Mengdi Huai, Lichao Sun, and Di Wang. 2024 d . Improving interpretation faithfulness for vision transformers. In Forty-first International Conference on Machine Learning

    2024

  7. [15]

    Lijie Hu, Xinhai Wang, Yixin Liu, Ninghao Liu, Mengdi Huai, Lichao Sun, and Di Wang. 2025. Towards stable and explainable attention mechanisms. IEEE Transactions on Knowledge and Data Engineering

    2025

  8. [16]

    Haoyang Huang, Tianyi Tang, Dongdong Zhang, Xin Zhao, Ting Song, Yan Xia, and Furu Wei. 2023. https://doi.org/10.18653/v1/2023.findings-emnlp.826 Not all languages are created equal in LLM s: Improving multilingual capability by cross-lingual-thought prompting . In Findings of...

    2023 doi

  9. [17]

    Jie Huang, Hanyin Shao, and Kevin Chen-Chuan Chang. 2022. https://doi.org/10.18653/v1/2022.findings-emnlp.148 Are large pre-trained language models leaking your personal information? In Findings of the Association for Computational Linguistics: EMNLP 2022, pages 2038--2047, Ab...

    2022 doi

  10. [18]

    Tianhao Huang, Tao Yang, Ivan Habernal, Lijie Hu, and Di Wang. 2024. Private language models via truncated laplacian mechanism. arXiv preprint arXiv:2410.08027

    2024 arXiv

  11. [19]

    Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. 2022. Knowledge unlearning for mitigating privacy risks in language models. arXiv preprint arXiv:2210.01504

    2022 arXiv

  12. [20]

    Siwon Kim, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and Seong Joon Oh. 2023 a . https://proceedings.neurips.cc/paper_files/paper/2023/file/420678bb4c8251ab30e765bc27c3b047-Paper-Conference.pdf Propile: Probing privacy leakage in large language models . In Advances ...

    2023

  13. [21]

    Siwon Kim, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and Seong Joon Oh. 2023 b . Propile: Probing privacy leakage in large language models. Advances in Neural Information Processing Systems, 36:20750--20762

    2023

  14. [22]

    Bryan Klimt and Yiming Yang. 2004. Introducing the enron corpus. In CEAS, volume 45, pages 92--96

    2004

  15. [23]

    Takeshi Kojima, Itsuki Okimura, Yusuke Iwasawa, Hitomi Yanaka, and Yutaka Matsuo. 2024. On the multilingual ability of decoder-based pre-trained language models: Finding and controlling language-specific neurons. arXiv preprint arXiv:2404.02431

    2024 arXiv

  16. [24]

    Songning Lai, Lijie Hu, Junxiao Wang, Laure Berti-Equille, and Di Wang. 2023. Faithful vision-language interpretation via concept bottleneck models. In The Twelfth International Conference on Learning Representations

    2023

  17. [25]

    Teven Le Scao, Angela Fan, Christopher Akiki, Ellie Pavlick, Suzana Ili \'c , Daniel Hesslow, Roman Castagn \'e , Alexandra Sasha Luccioni, Fran c ois Yvon, Matthias Gall \'e , and 1 others. 2023. Bloom: A 176b-parameter open-access multilingual language model

    2023

  18. [26]

    Haoran Li, Yulin Chen, Jinglong Luo, Jiecong Wang, Hao Peng, Yan Kang, Xiaojin Zhang, Qi Hu, Chunkit Chan, Zenglin Xu, and 1 others. 2023. Privacy in large language models: Attacks, defenses and future directions. arXiv preprint arXiv:2310.10383

    2023 arXiv

  19. [27]

    Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, and 1 others. 2024. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437

    2024 arXiv

  20. [28]

    Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, and 1 others. 2025. Rethinking machine unlearning for large language models. Nature Machine Intelligence, pages 1--14

    2025

  21. [29]

    Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Beguelin. 2023 a . https://doi.org/10.1109/SP46215.2023.10179300 Analyzing Leakage of Personally Identifiable Information in Language Models . In 2023 IEEE Symposium on Security and Privac...

    2023

  22. [30]

    Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-B \'e guelin. 2023 b . Analyzing leakage of personally identifiable information in language models. In 2023 IEEE Symposium on Security and Privacy (SP), pages 346--363. IEEE

    2023

  23. [31]

    Meta-AI. 2024. https://huggingface.co/meta-llama/Llama-3.2-3B Meta llama 3.2: A collection of multilingual large language models . Accessed: 2025-05-15

    2024

  24. [32]

    Aaron Mueller, Yu Xia, and Tal Linzen. 2022. Causal analysis of syntactic agreement neurons in multilingual language models. arXiv preprint arXiv:2210.14328

    2022 arXiv

  25. [33]

    Krishna Kanth Nakka, Ahmed Frikha, Ricardo Mendes, Xue Jiang, and Xuebing Zhou. 2024. Pii-compass: Guiding llm training data extraction prompts towards the target pii via grounding. arXiv preprint arXiv:2407.02943

    2024 arXiv

  26. [34]

    Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette-Choo, Eric Wallace, Florian Tram \`e r, and Katherine Lee. 2023. Scalable extraction of training data from (production) language models. arXiv preprint ar...

    2023 arXiv

  27. [35]

    Nostalgebraist. 2020. https://www.lesswrong.com/posts/AcKRB8wDpdaN6v6ru/interpreting-gpt-the-logit-lens interpreting gpt: the logit lens

    2020

  28. [36]

    Prakash Poudyal, Jarom \' r S avelka, Aagje Ieven, Marie Francine Moens, Teresa Goncalves, and Paulo Quaresma. 2020. Echr: Legal corpus for argument mining. In Proceedings of the 7th Workshop on Argument Mining, pages 67--75

    2020

  29. [37]

    Chen Qian, Dongrui Liu, Jie Zhang, Yong Liu, and Jing Shao. 2024. Dean: Deactivating the coupled neurons to mitigate fairness-privacy conflicts in large language models. arXiv preprint arXiv:2410.16672

    2024 arXiv

  30. [38]

    Tianyi Tang, Wenyang Luo, Haoyang Huang, Dongdong Zhang, Xiaolei Wang, Xin Zhao, Furu Wei, and Ji-Rong Wen. 2024. Language-specific neurons: The key to multilingual capabilities in large language models. arXiv preprint arXiv:2402.16438

    2024 arXiv

  31. [39]

    Youming Tao, Cheng-Long Wang, Miao Pan, Dongxiao Yu, Xiuzhen Cheng, and Di Wang. 2024. Communication efficient and provable federated unlearning. Proceedings of the VLDB Endowment, 17(5):1119--1131

    2024

  32. [40]

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, and 1 others. 2023. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805

    2023 arXiv

  33. [41]

    Cheng-Long Wang, Mengdi Huai, and Di Wang. 2023. Inductive graph unlearning. In 32nd USENIX Security Symposium (USENIX Security 23), pages 3205--3222

    2023

  34. [42]

    Cheng-Long Wang, Qi Li, Zihang Xiang, Yinzhi Cao, and Di Wang. 2024. Towards lifecycle unlearning commitment management: Measuring sample-level approximate unlearning completeness. arXiv preprint arXiv:2403.12830

    2024 arXiv

  35. [43]

    Di Wang, Changyou Chen, and Jinhui Xu. 2019. Differentially private empirical risk minimization with non-convex loss functions. In International Conference on Machine Learning, pages 6526--6535. PMLR

    2019

  36. [44]

    Di Wang and Jinhui Xu. 2019. Differentially private empirical risk minimization with smooth non-convex loss functions: A non-stationary view. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 1182--1189

    2019

  37. [45]

    Xinwei Wu, Weilong Dong, Shaoyang Xu, and Deyi Xiong. 2024. https://doi.org/10.18653/v1/2024.findings-acl.315 Mitigating privacy seesaw in large language models: Augmented privacy neuron editing via activation patching . In Findings of the Association for Computational Linguis...

    2024 doi

  38. [46]

    Xinwei Wu, Junzhuo Li, Minghui Xu, Weilong Dong, Shuangzhi Wu, Chao Bian, and Deyi Xiong. 2023. https://doi.org/10.18653/v1/2023.emnlp-main.174 DEPN : Detecting and editing privacy neurons in pretrained language models . In Proceedings of the 2023 Conference on Empirical Metho...

    2023 doi

  39. [47]

    Zihang Xiang, Tianhao Wang, Wanyu Lin, and Di Wang. 2023. Practical differentially private and byzantine-resilient federated learning. Proceedings of the ACM on Management of Data, 1(2):1--26

    2023

  40. [48]

    Hanshen Xiao, Zihang Xiang, Di Wang, and Srinivas Devadas. 2023. A theory to instruct differentially-private learning via clipping bias reduction. In 2023 IEEE Symposium on Security and Privacy (SP), pages 2170--2189. IEEE

    2023

  41. [49]

    An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, and 1 others. 2024 a . Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115

    2024 arXiv

  42. [50]

    Shu Yang, Muhammad Asif Ali, Cheng-Long Wang, Lijie Hu, and Di Wang. 2024 b . Moral: Moe augmented lora for llms' lifelong learning. arXiv preprint arXiv:2402.11260

    2024 arXiv

  43. [51]

    Shu Yang, Shenzhe Zhu, Ruoxuan Bao, Liang Liu, Yu Cheng, Lijie Hu, Mengdi Li, and Di Wang. 2024 c . What makes your model a low-empathy or warmth person: Exploring the origins of personality in llms. arXiv preprint arXiv:2410.10863

    2024 arXiv

  44. [52]

    Junchi Yao, Shu Yang, Jianhua Xu, Lijie Hu, Mengdi Li, and Di Wang. 2025. Understanding the repeat curse in large language models from a feature perspective. arXiv preprint arXiv:2504.14218

    2025

  45. [53]

    Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing, page 100211

    2024

  46. [54]

    Jiaming Zhang, Mingxi Lei, Meng Ding, Mengdi Li, Zihang Xiang, Difei Xu, Jinhui Xu, and Di Wang. 2025 a . Towards user-level private reinforcement learning with human feedback. arXiv preprint arXiv:2502.17515

    2025 arXiv

  47. [55]

    Lin Zhang, Wenshuo Dong, Zhuoran Zhang, Shu Yang, Lijie Hu, Ninghao Liu, Pan Zhou, and Di Wang. 2025 b . Eap-gp: Mitigating saturation effect in gradient-based automated circuit identification. arXiv preprint arXiv:2502.06852

    2025 arXiv

  48. [56]

    Zhuoran Zhang, Yongxiang Li, Zijian Kan, Keyuan Cheng, Lijie Hu, and Di Wang. 2024. Locate-then-edit for multi-hop factual recall under knowledge editing. arXiv preprint arXiv:2410.06331

    2024 arXiv

  49. [57]

    Jun Zhao, Zhihao Zhang, Luhui Gao, Qi Zhang, Tao Gui, and Xuanjing Huang. 2024 a . Llama beyond english: An empirical study on language capability transfer. arXiv preprint arXiv:2401.01055

    2024 arXiv

  50. [58]

    Yiran Zhao, Wenxuan Zhang, Guizhen Chen, Kenji Kawaguchi, and Lidong Bing. 2024 b . How do large language models handle multilingualism? In Advances in Neural Information Processing Systems (NeurIPS)

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.