Pith. sign in

REVIEW 5 major objections 6 minor 103 references

SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against Membership Inference Attacks

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Fine-tuned LLMs leak membership through lower loss, and selectively paraphrasing the riskiest samples drives attack accuracy back to near random guessing.

desk verdict A solid, broad empirical study of MIAs on fine-tuned LLMs with a practical defense, but the conclusion oversells SOFT: its own Selection Only adaptive attack shows the un-paraphrased subset still leaks. read the letter →

arxiv 2506.10424 v1 pith:3H6R5VJY submitted 2025-06-12 cs.CR cs.AI

Kaiyuan Zhang , Siyuan Cheng , Hanxi Guo , Yuetian Chen , Zian Su , Shengwei An , Yuntao Du , Charles Fleming
show 3 more authors
Ashish Kundu Xiangyu Zhang Ninghui Li
This is my paper
classification cs.CRcs.AI
keywords membershipinferenceattackLLMfine-tuningdataobfuscationparaphrasingdefenseinfluentialselectionloss-basedprivacy-utilitytrade-offdifferentialprivacycomparison
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Fine-tuned large language models leak which texts were in their training sets: three epochs of full fine-tuning let ten membership inference attacks reach an average AUC-ROC of 0.819. The paper attributes this to loss reduction — members end up with lower loss, and every strong attack exploits that signal. It proposes SOFT, which each epoch computes per-sample training loss, flags samples whose loss falls below the average validation loss as "influential", and replaces them with paraphrased versions before fine-tuning continues. Across six Pile domains and Llama-3.2 models, this brings average attack AUC down to 0.540 and TPR at 1 percent FPR down to 0.029, while ArXiv perplexity rises only from 9.78 to 10.49. The claim is that the loss-threshold selection rule identifies the samples that actually drive membership leakage, so a defender can obfuscate only those and keep the rest of the data intact.

What carries the argument

The load-bearing object is the loss-threshold selection rule in Algorithm 1 (DATA_SELECTION). It computes the loss of every fine-tuning sample under the current model, sets the threshold as the mean loss on a small validation set, and declares every sample below that threshold "influential" — the ones a membership attacker can exploit because the model has fitted them. Those samples are then replaced by PARAPHRASE(x, α) with α = 0.5 (keep the first half, paraphrase the rest), and only this obfuscated set participates in the next gradient step. The same idea drives the paper's Ensemble attack: it aggregates loss, perplexity, lowercase, zlib, Min-K%++ features at several k, and ratio, which is what exposes the loss signal that SOFT then suppresses.

What would settle it

Construct a fine-tuning set in which some members are rare-format or high-entropy texts (so their loss stays above the validation average), run SOFT, and then evaluate an Ensemble attack restricted to those unparaphrased high-loss members; if their membership AUC exceeds about 0.6, the loss-threshold selection rule has missed the vulnerable population and the defense's central premise fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that membership inference against fine-tuned LLMs is primarily a loss phenomenon and therefore a targeted data-obfuscation defense can neutralize it. In full fine-tuning on Llama-3.2-3B, ten MIAs (Loss, Zlib, Lowercase, Min-K% Prob, Min-K%++, Ratio, Bag of Words, ReCall, CON-ReCall, and an Ensemble attack that combines twelve features) average AUC-ROC 0.819 across six Pile datasets; SOFT reduces this to 0.540, close to the 0.509 average of the pre-trained model, and reduces TPR@1%FPR from 0.360 to 0.029. The mechanism is iterative: fine-tune once to get a warm-up model, then at each epoch paraphrase exactly those training samples whose current loss is below the average validation loss, leaving all other samples untouched. The paper reports that the resulting model answers domain questions almost as well as a fully fine-tuned one (LLM-as-a-Judge 0.66 vs 0.68) and beats DP-LoRA on the privacy-utility trade-off at comparable computational overhead.

Load-bearing premise

The defense assumes that the samples a membership attacker can identify are exactly those whose loss sits below the average validation loss, so it paraphrases only those and leaves every higher-loss sample untouched; if any member with loss above that threshold can still be recognized, the near-random AUC claim does not generalize.

Editorial extensions

If this is right

  • A fine-tuned model protected by SOFT makes ten standard MIAs perform only slightly better than random guessing (average AUC 0.540), so membership attacks no longer reveal training membership at scale.
  • At 1 percent false positive rate, SOFT reduces the true positive rate from 0.360 (full fine-tuning) to 0.029, meaning almost no member can be singled out with high confidence.
  • The utility cost is small: ArXiv perplexity rises from 9.78 to 10.49, and LLM-as-a-Judge quality scores fall only from 0.68 to 0.66.
  • SOFT preserves most of full fine-tuning's utility while providing stronger privacy than DP-LoRA at the same or lower computational overhead, and it can be combined with LoRA for even lower attack AUC.
  • Adaptive adversaries who know the paraphrase model and selection rule still stay near random (AUC 0.575–0.595) unless they attack only unparaphrased samples, which recovers only a small fraction of members.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The authors do not explore it, but the loss-threshold rule could be reused for other memorization-related threats such as data extraction or verbatim regurgitation, because those attacks also rely on low-loss overfitted samples.
  • The defense shifts the burden to the paraphrase model: with a weaker local paraphraser (BART, seq2seq) privacy still drops but utility degrades more, so deployment without access to a strong commercial API may face a worse trade-off than the headline numbers.
  • The "Selection Only" adaptive result (AUC 0.651, TPR@1%FPR 0.086) suggests the unparaphrased remainder still carries a residual membership signal; an attacker that can predict which samples were chosen might concentrate on them, so the privacy guarantee is only as good as the selection rule's unpredictability.
  • A natural testable extension is to apply the loss-threshold rule to other fine-tuning paradigms (adapters, prompt tuning) and to measure whether the defense holds against attacks that use the paraphrase API itself as a shadow model.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. Zhang et al. study membership inference attacks (MIAs) against fine-tuned large language models and propose SOFT, a defense that paraphrases the subset of the fine-tuning dataset whose per-sample loss falls below the average validation loss. The paper presents an empirical analysis on six Pile subsets with Llama-3.2 and Pythia models, evaluates ten MIAs (including a proposed Ensemble attack), reports average AUC-ROC dropping from 0.819 under full fine-tuning to 0.540 under SOFT, and compares SOFT against DP-LoRA. The central claim is that SOFT reduces attack success to near-random guessing while incurring only a small utility cost.

Significance. If the near-random-guessing claim is supported, SOFT would be a practical and light-weight privacy defense for fine-tuning, avoiding the utility and computational overhead of DP-based methods. The paper also contributes a systematic empirical mapping of MIA effectiveness across model sizes, LoRA ranks, epoch counts, and dataset properties, and it is commendable that the authors attempt adaptive attacks and release their code on GitHub. The residual leakage identified by the paper's own Selection Only adaptive attack, together with missing variance estimates in the main evaluation tables and an underspecified Ensemble attack protocol, currently prevent me from taking the headline privacy claim at face value.

major comments (5)
  1. [Section 5.5, Table 7] The 'Selection Only' adaptive attack, which attacks exactly the un-paraphrased members that Algorithm 1 leaves untouched, achieves AUC-ROC 0.651 and TPR@1%FPR 0.086 on ArXiv. These numbers are far above the random baselines of 0.5 and 0.01, respectively. The conclusion in Section 7 that SOFT 'reduces the attack success rate to near-random guessing' is therefore not supported for the subset of members that the defense deliberately does not obfuscate. Please report Selection Only results on all six datasets, state the fraction of samples selected by the threshold in each dataset, and qualify the conclusion, or demonstrate that the residual leakage is acceptable under a concrete risk criterion.
  2. [Section 5.1 and Tables 1-4] The metrics section states that AUC is computed on 1,000 bootstrapped subsets and that both mean and standard deviation are reported, but Tables 1-4 list only point estimates without error bars or confidence intervals. Without variance measures, the reader cannot judge whether SOFT's average AUC-ROC of 0.540 is statistically distinguishable from the pre-trained model's near-0.5 values, nor can differences such as 0.525 vs. 0.508 be assessed. Please report the standard deviations (or confidence intervals) for all tables, and state the number of independent fine-tuning runs; bootstrap over the attack evaluation does not capture variance due to the fine-tuning process itself.
  3. [Section 3.1 and Figure 2] The Ensemble attack's training and evaluation protocol is not described. The text says it aggregates twelve features but does not state the classifier family, the training set construction from member/non-member samples, the train/test split, whether the attack is trained on labels from the same distribution used during evaluation, or how the reference model is incorporated. Because Ensemble is one of the two reference-based attacks and is the strongest attack in several settings (e.g., Table 1, GitHub, AUC 0.669), this omission prevents replication and weakens the claim of a systematic vulnerability study. Please provide the full protocol in the paper or an appendix.
  4. [Section 5.4, Tables 5-6] The DP-LoRA comparison is run on Llama-3.2-1B, whereas the main SOFT evaluation in Tables 1-4 uses Llama-3.2-3B. If the SOFT row in Table 5 corresponds to the 1B model, this should be stated explicitly; if it corresponds to the 3B model, the comparison is confounded by model size. The SOFT AUC-ROC values in Table 5 (e.g., Ensemble 0.573) also differ from the 3B values in Table 1 (ArXiv Ensemble 0.568), so the reader cannot infer which model is used. Please make the model size explicit and, ideally, compare SOFT and DP-LoRA at the same model scale.
  5. [Algorithm 1 and Section 5.5] The selection rule in DATA_SELECTION paraphrases samples with loss below the average validation loss and leaves all others unchanged. Since the reference-free MIAs under evaluation are loss-based, the reduction achieved by SOFT is partly by construction: it removes precisely the low-loss members that those attacks flag. The paper's adaptive attacks are a genuine check, but the paper's own Selection Only result shows that the remaining high-loss members are still distinguishable. The manuscript should therefore present the Selection Only result as an explicit bound on worst-case residual leakage, analyze how the threshold τ controls the trade-off between selection coverage and privacy leakage, and reconcile this with the unqualified near-random-guessing statement in the conclusion.
minor comments (6)
  1. [Section 4.2] The text describes α as 'a paraphrasing strength factor' where α=0.5 preserves the first half and paraphrases the remaining half, then says 'a higher paraphrasing ratio may reduce the utility of the data.' Since α is the fraction of text retained, a higher paraphrasing ratio corresponds to a lower α; the phrasing is ambiguous and should be clarified.
  2. [Section 5.5] The text states that 'even when subjected to the adaptive attack, SOFT's performance remains unaffected,' but Table 7 shows Paraphrase & Selection AUC-ROC 0.595 versus 0.568 for 'No Adaptive (w/ SOFT),' and Paraphrase Only 0.575. The change is modest but not zero; 'unaffected' overstates the result.
  3. [Section 5.2] The sentence 'Table 1 and 3 present the AUC-ROC scores, showing that LoRA fine-tuning remains vulnerable' is confusing because Table 1 reports SOFT and full fine-tuning, while Table 3 is the LoRA table. Please rephrase to point the reader to the correct table for each comparison.
  4. [Section 5.5 and Section 5.6] The adaptive attack and the data-selection ablation report small numerical differences, but no error bars are provided for Table 7 or for Figures 9-10's box plots beyond the mean markers. Please add the number of repetitions and statistical significance or confidence intervals so readers can assess the reliability of these differences.
  5. [Section 5.6, Figure 10] The α ablation reports 'slight' differences in TPR@1%FPR, but the y-axis ranges in the figure are narrow; if the differences are not statistically significant, please say so explicitly rather than relying on visual inspection.
  6. [Section 3.2] The text says 'we evaluate the Pythia family ... covering six model sizes: 70M, 160M, 1B, 1.4B, 2.8B, and 6.9B' but does not mention the 410M model that appears in the model list in Section 3.1; please reconcile the counts.

Circularity Check

1 steps flagged · score 6.0 of 10

SOFT's near-random guessing result is partly by construction: the selection rule paraphrases exactly the below-threshold-loss members that loss-based MIAs score highest, and the paper's own Selection Only adaptive attack (AUC 0.651, TPR@1%FPR 0.086) shows residual leakage on the unparaphrased remainder.

  1. self definitional [Section 2.3 Eq. (2); Section 4.2 Algorithm 1 DATA_SELECTION (Lines 20-30); Section 5.5 Table 7]
    "s(x;M ) = −ℓ(x,M ) ... τ = 1/n ∑n i=1 L i v ▷ Use the average validation loss as data selection threshold ... if l f < τ then ˆD f = ˆD f ∪ {PARAPHRASE(x f , α)} ... representing the safe boundary within which MIAs are difficult to succeed."

    The paper defines the membership signal used by MIAs as negative loss (Eq. 2) and concludes that MIAs 'exploit the loss reduction during fine-tuning.' DATA_SELECTION then defines a sample as influential exactly when its loss is below the average validation loss and paraphrases those samples. This makes the below-threshold members, by construction, the subset that direct loss-based attacks would score as most likely members; after paraphrasing, the original member texts are absent and their losses behave like non-members. The reported drop in average AUC from 0.819 to 0.540 is therefore a necessary consequence of deleting the very signal used by the attacks, not an independent demonstration of general robustness.

full rationale

The main circularity is partial: SOFT's selection criterion and the loss-based MIA score share the same loss function, so the defense's success against loss-based attacks is partly by construction. This is not a case of self-citation load-bearing or an imported uniqueness theorem; the adaptive attacks are a genuine check, but the Selection Only result undercuts the claim that the defense reduces attack success to near-random guessing across the whole dataset. Because the central privacy claim depends on the selection rule that removes exactly the low-loss signal, and because the paper's own adaptive evaluation reveals residual leakage on the unselected high-loss members, a partial circularity score is warranted.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The ledger is minimal: one empirical hyperparameter (alpha), three domain assumptions about loss-based leakage, paraphrase semantic equivalence, and adversary limits. No new physical or mathematical entities are introduced.

free parameters (1)
  • paraphrasing strength alpha = 0.5 (default)
    Controls how much of each original sample is preserved; chosen empirically from ablation, Section 4.2 and Figure 10.
assumptions (3)
  • domain assumption Membership leakage in fine-tuned LLMs is primarily mediated by per-sample loss reduction, so paraphrasing low-loss samples disrupts MIAs.
    Section 4 states that fine-tuning on paraphrased data reduces overfitting to exact members and can fool loss-based MIAs; this is the core mechanism, not independently verified for all attack families.
  • domain assumption Paraphrasing preserves the utility-relevant semantics of the original training samples.
    The utility evaluation (perplexity, LLM-as-a-Judge) does not measure exact factual retention or task-specific accuracy; Section 5.3.
  • domain assumption The adversary cannot reproduce the exact paraphrase outputs of the proprietary paraphraser (GPT-4/Claude).
    Used in the adaptive attack argument, Section 5.5; relies on the generative model's stochasticity and unreleased settings.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against Membership Inference Attacks." pith.science (2026). https://pith.science/paper/3H6R5VJY

@misc{pith2026250610424,
  author       = {Pith},
  title        = {Pith review of: SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against Membership Inference Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3H6R5VJY}},
  note         = {Machine review of arXiv:2506.10424}
}
read the original abstract

Large language models (LLMs) have achieved remarkable success and are widely adopted for diverse applications. However, fine-tuning these models often involves private or sensitive information, raising critical privacy concerns. In this work, we conduct the first comprehensive study evaluating the vulnerability of fine-tuned LLMs to membership inference attacks (MIAs). Our empirical analysis demonstrates that MIAs exploit the loss reduction during fine-tuning, making them highly effective in revealing membership information. These findings motivate the development of our defense. We propose SOFT (\textbf{S}elective data \textbf{O}bfuscation in LLM \textbf{F}ine-\textbf{T}uning), a novel defense technique that mitigates privacy leakage by leveraging influential data selection with an adjustable parameter to balance utility preservation and privacy protection. Our extensive experiments span six diverse domains and multiple LLM architectures and scales. Results show that SOFT effectively reduces privacy risks while maintaining competitive model performance, offering a practical and scalable solution to safeguard sensitive information in fine-tuned LLMs.

Figures

Figures reproduced from arXiv: 2506.10424 by the authors.

Figure 1
Figure 1. Full Fine-tuning vs. LoRA. Fine-tuning. Given a pre-trained language model f(WPT; x) parameterized by WPT ∈ R m×n , where x is any input, the fine￾tuned model is represented as: fFT(WPT ⊕∆W; x), (1) where ∆W ∈ R m×n represents the additional parameters learned during fine-tuning. In the following, we instantiate fine-tuning in both full fine-tuning and fine-tuning via LoRA. Full Fine-tuning. In full fine-tuning, all… view at source ↗
Figure 3
Figure 3. AUC-ROC on Full Fine-tuned Pythia (3 Epochs). [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 5
Figure 5. AUC-ROC on LoRA Fine-tuned Pythia (5 Epochs). [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗
Figures from the paper (4 more)
Figure 7
Figure 7. Figure 7: Overview of SOFT This formulation has been widely used to analyze the im￾pact of training points on model behavior [48]. While gradient￾based influence is theoretically grounded [69], SOFT em￾ploys a loss-based approximation for practical efficiency and direct alignmen…
Figure 8
Figure 8. Figure 8: Utility test using LLM-as-a-Judge. pre-trained model, (2) the full fine-tuned model without any defense applied, and (3) the fine-tuned model using SOFT. Each model generates responses to the generated questions, which are then scored using GPT-4o-mini via the SCORE PR…
Figure 9
Figure 9. Figure 9: Ablation study on data selection. hyper-parameters. Specifically, we study the effect of open￾source paraphraser, comparing lexical with semantic, and low￾quality paraphraser, data selection, paraphrasing strength α (introduced in Section 4), and the integration of SOF…
Figure 10
Figure 10. Figure 10: Ablation study on paraphrasing strength α [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

103 extracted references · 43 canonical work pages

  1. [1]

    https: //oag.ca.gov/privacy/ccpa

    California Consumer Privacy Act (CCPA). https: //oag.ca.gov/privacy/ccpa

  2. [2]

    https: //gdpr.eu/

    General Data Protection Regulation (GDPR). https: //gdpr.eu/

  3. [3]

    https://github.com/KaiyuanZh/SOFT

    SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against Membership Inference Attacks. https://github.com/KaiyuanZh/SOFT

  4. [4]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016

    2016

  5. [5]

    Artificial intelligence risk management framework: Generative artificial intelligence profile, 2024

    NIST AI. Artificial intelligence risk management framework: Generative artificial intelligence profile, 2024

    2024

  6. [6]

    Tower: An open multilingual large language model for translation-related tasks

    Duarte M Alves, José Pombal, Nuno M Guerreiro, Pe- dro H Martins, João Alves, Amin Farajian, Ben Pe- ters, Ricardo Rei, Patrick Fernandes, Sweta Agrawal, et al. Tower: An open multilingual large language model for translation-related tasks. arXiv preprint arXiv:2402.17733, 2024

    arXiv 2024

  7. [7]

    Large-scale differentially pri- vate bert

    Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. Large-scale differentially pri- vate bert. arXiv preprint arXiv:2108.01624, 2021

    arXiv 2021

  8. [8]

    Claude.ai

    Anthropic. Claude.ai. https://claude.ai

Show all 103 references
  1. [9]

    Private empirical risk minimization: Efficient algo- rithms and tight error bounds

    Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algo- rithms and tight error bounds. In 2014 IEEE 55th annual symposium on foundations of computer science, pages 464–473. IEEE, 2014. 15

    2014

  2. [10]

    On bootstrapping the roc curve

    Patrice Bertail, Stéphan Clémençcon, and Nicolas Vay- atis. On bootstrapping the roc curve. Advances in Neural Information Processing Systems, 21, 2008

    2008

  3. [11]

    LoRA learns less and forgets less

    Dan Biderman, Jacob Portes, Jose Javier Gonzalez Or- tiz, Mansheej Paul, Philip Greengard, Connor Jennings, Daniel King, Sam Havens, Vitaliy Chiley, Jonathan Frankle, et al. LoRA learns less and forgets less. arXiv preprint arXiv:2405.09673, 2024

    2024 arXiv

  4. [12]

    Pythia: A suite for analyzing large language models across training and scaling

    Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbie Bradley, Kyle O’Brien, Eric Hal- lahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, et al. Pythia: A suite for analyzing large language models across training and scaling. In Inte...

    2023

  5. [13]

    Language models are few-shot learners

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems , 33:1877–1901, 2020

    1901

  6. [14]

    Member- ship inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Member- ship inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914. IEEE, 2022

    2022

  7. [15]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Representations, 2023

    2023

  8. [16]

    Extracting training data from large lan- guage models

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlings- son, et al. Extracting training data from large lan- guage models. In 30th USENIX Security Symposium (USENIX Security 21), ...

    2021

  9. [17]

    The janus interface: How fine- tuning in large language models amplifies the privacy risks

    Xiaoyi Chen, Siyuan Tang, Rui Zhu, Shijun Yan, Lei Jin, Zihao Wang, Liya Su, Zhikun Zhang, XiaoFeng Wang, and Haixu Tang. The janus interface: How fine- tuning in large language models amplifies the privacy risks. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer...

    2024

  10. [18]

    Label-only membership inference attacks

    Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. In International confer- ence on machine learning, pages 1964–1974. PMLR, 2021

    1964

  11. [19]

    Reconstruct your previous conversations! com- prehensively investigating privacy leakage risks in con- versations with GPT models

    Junjie Chu, Zeyang Sha, Michael Backes, and Yang Zhang. Reconstruct your previous conversations! com- prehensively investigating privacy leakage risks in con- versations with GPT models. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Proceed- ings of the 2024 C...

    2024

  12. [20]

    Saullm-7b: A pioneering large language model for law

    Pierre Colombo, Telmo Pessoa Pires, Malik Boudiaf, Dominic Culver, Rui Melo, Caio Corro, Andre FT Mar- tins, Fabrizio Esposito, Vera Lúcia Raposo, Sofia Mor- gado, et al. Saullm-7b: A pioneering large language model for law. arXiv preprint arXiv:2403.03883, 2024

    2024 arXiv

  13. [21]

    Blind baselines beat membership inference attacks for foun- dation models

    Debeshee Das, Jie Zhang, and Florian Tramèr. Blind baselines beat membership inference attacks for foun- dation models. arXiv preprint arXiv:2406.16201 , 2024

    2024 arXiv

  14. [22]

    Flocks of stochastic parrots: Dif- ferentially private prompt learning for large language models

    Haonan Duan, Adam Dziedzic, Nicolas Papernot, and Franziska Boenisch. Flocks of stochastic parrots: Dif- ferentially private prompt learning for large language models. Advances in Neural Information Processing Systems, 36, 2024

    2024

  15. [23]

    Do membership inference attacks work on large language models? In Conference on Language Modeling (COLM), 2024

    Michael Duan, Anshuman Suri, Niloofar Mireshghal- lah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Ha- jishirzi. Do membership inference attacks work on large language models? In Conference on Language Modeling (COLM), 2024

    2024

  16. [24]

    De-cop: Detecting copyrighted content in language models training data

    André V Duarte, Xuandong Zhao, Arlindo L Oliveira, and Lei Li. De-cop: Detecting copyrighted content in language models training data. arXiv preprint arXiv:2402.09910, 2024

    2024 arXiv

  17. [25]

    Alpaca- farm: A simulation framework for methods that learn from human feedback

    Yann Dubois, Chen Xuechen Li, Rohan Taori, Tianyi Zhang, Ishaan Gulrajani, Jimmy Ba, Carlos Guestrin, Percy S Liang, and Tatsunori B Hashimoto. Alpaca- farm: A simulation framework for methods that learn from human feedback. Advances in Neural Informa- tion Processing Systems,...

    2024

  18. [26]

    Differential privacy

    Cynthia Dwork. Differential privacy. In International colloquium on automata, languages, and programming, pages 1–12. Springer, 2006

    2006

  19. [27]

    The algorithmic foundations of differential privacy

    Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 9(3–4):211– 407, 2014. 16

    2014

  20. [28]

    Transformer and seq2seq model for paraphrase generation

    Elozino Egonmwan and Yllias Chali. Transformer and seq2seq model for paraphrase generation. In Proceed- ings of the 3rd Workshop on Neural Generation and Translation, pages 249–255, 2019

    2019

  21. [29]

    Intentest: Stress testing for in- tent integrity in api-calling llm agents

    Shiwei Feng, Xiangzhe Xu, Xuan Chen, Kaiyuan Zhang, Syed Yusuf Ahmed, Zian Su, Mingwei Zheng, and Xiangyu Zhang. Intentest: Stress testing for in- tent integrity in api-calling llm agents. arXiv preprint arXiv:2506.07524, 2025

    2025

  22. [30]

    Membership inference attacks against fine-tuned large language models via self-prompt calibration

    Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Membership inference attacks against fine-tuned large language models via self-prompt calibration. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024

    2024

  23. [31]

    Data engineering for scaling language models to 128k con- text

    Yao Fu, Rameswar Panda, Xinyao Niu, Xiang Yue, Hannaneh Hajishirzi, Yoon Kim, and Hao Peng. Data engineering for scaling language models to 128k con- text. arXiv preprint arXiv:2402.10171, 2024

    2024 arXiv

  24. [32]

    Zlib compression library

    Jean-loup Gailly and Mark Adler. Zlib compression library. 2004

    2004

  25. [33]

    Ppdb: The paraphrase database

    Juri Ganitkevitch, Benjamin Van Durme, and Chris Callison-Burch. Ppdb: The paraphrase database. In Proceedings of the 2013 conference of the north amer- ican chapter of the association for computational lin- guistics: Human language technologies , pages 758– 764, 2013

    2013

  26. [34]

    The pile: An 800gb dataset of diverse text for language modeling

    Leo Gao, Stella Biderman, Sid Black, Laurence Gold- ing, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, et al. The pile: An 800gb dataset of diverse text for language modeling. arXiv preprint arXiv:2101.00027, 2020

    2020 arXiv

  27. [35]

    A framework for few-shot language model evaluation, 07 2024

    Leo Gao, Jonathan Tow, Baber Abbasi, Stella Bider- man, Sid Black, Anthony DiPofi, Charles Foster, Lau- rence Golding, Jeffrey Hsu, Alain Le Noac’h, Haonan Li, Kyle McDonell, Niklas Muennighoff, Chris Ociepa, Jason Phang, Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Linta...

    2024

  28. [36]

    How to train long-context language models (effectively)

    Tianyu Gao, Alexander Wettig, Howard Yen, and Danqi Chen. How to train long-context language models (effectively). arXiv preprint arXiv:2410.02660, 2024

    2024

  29. [37]

    Openllama: An open reproduction of llam, May 2023

    Xinyang Geng and Hao Liu. Openllama: An open reproduction of llam, May 2023

    2023

  30. [38]

    Pro- filer: Black-box ai-generated text origin detection via context-aware inference pattern analysis

    Hanxi Guo, Siyuan Cheng, Xiaolong Jin, ZHUO ZHANG, Guangyu Shen, Kaiyuan Zhang, Sheng- wei An, Guanhong Tao, and Xiangyu Zhang. Pro- filer: Black-box ai-generated text origin detection via context-aware inference pattern analysis

  31. [39]

    Biscope: Ai-generated text detec- tion by checking memorization of preceding tokens

    Hanxi Guo, Siyuan Cheng, Xiaolong Jin, Zhuo Zhang, Kaiyuan Zhang, Guanhong Tao, Guangyu Shen, and Xiangyu Zhang. Biscope: Ai-generated text detec- tion by checking memorization of preceding tokens. Advances in Neural Information Processing Systems, 37:104065–104090, 2024

    2024

  32. [40]

    Skewact: Red teaming large language models via activation-skewed adversarial prompt opti- mization

    Hanxi Guo, Siyuan Cheng, Guanhong Tao, Guangyu Shen, Zhuo Zhang, Shengwei An, Kaiyuan Zhang, and Xiangyu Zhang. Skewact: Red teaming large language models via activation-skewed adversarial prompt opti- mization. In Red Teaming GenAI: What Can We Learn from Adversaries?

  33. [41]

    Learning and evaluating a differentially private pre-trained language model

    Shlomo Hoory, Amir Feder, Avichai Tendler, Sofia Erell, Alon Peled-Cohen, Itay Laish, Hootan Nakhost, Uri Stemmer, Ayelet Benjamini, Avinatan Hassidim, et al. Learning and evaluating a differentially private pre-trained language model. In Findings of the Asso- ciation for Comp...

    2021

  34. [42]

    Parameter- efficient transfer learning for nlp

    Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin De Laroussilhe, Andrea Ges- mundo, Mona Attariyan, and Sylvain Gelly. Parameter- efficient transfer learning for nlp. In International conference on machine learning , pages 2790–2799. PMLR, 2019

    2019

  35. [43]

    LoRA: Low-rank adaptation of large lan- guage models

    Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large lan- guage models. In International Conference on Learn- ing Representations, 2022

    2022

  36. [44]

    LLM-adapters: An adapter family for parameter-efficient fine-tuning of large language mod- els

    Zhiqiang Hu, Lei Wang, Yihuai Lan, Wanyu Xu, Ee- Peng Lim, Lidong Bing, Xing Xu, Soujanya Poria, and Roy Lee. LLM-adapters: An adapter family for parameter-efficient fine-tuning of large language mod- els. In Proceedings of the 2023 Conference on Empiri- cal Methods in Natural...

    2023

  37. [45]

    Membership inference attack suscep- tibility of clinical language models

    Abhyuday Jagannatha, Bhanu Pratap Singh Rawat, and Hong Yu. Membership inference attack suscep- tibility of clinical language models. arXiv preprint arXiv:2104.08305, 2021

    2021 arXiv

  38. [46]

    SWE-bench: Can language models re- solve real-world github issues? In The Twelfth Interna- tional Conference on Learning Representations, 2024

    Carlos E Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik R 17 Narasimhan. SWE-bench: Can language models re- solve real-world github issues? In The Twelfth Interna- tional Conference on Learning Representations, 2024

    2024

  39. [47]

    Scal- ing laws for neural language models

    Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scal- ing laws for neural language models. arXiv preprint arXiv:2001.08361, 2020

    2001 arXiv

  40. [48]

    Understanding black- box predictions via influence functions

    Pang Wei Koh and Percy Liang. Understanding black- box predictions via influence functions. In Interna- tional conference on machine learning, pages 1885–

  41. [49]

    One epoch is all you need

    Aran Komatsuzaki. One epoch is all you need. arXiv preprint arXiv:1906.06669, 2019

    1906 arXiv

  42. [50]

    Biomistral: A collection of open- source pretrained large language models for medical domains

    Yanis Labrak, Adrien Bazoge, Emmanuel Morin, Pierre-Antoine Gourraud, Mickael Rouvier, and Richard Dufour. Biomistral: A collection of open- source pretrained large language models for medical domains. arXiv preprint arXiv:2402.10373, 2024

    2024 arXiv

  43. [51]

    The power of scale for parameter-efficient prompt tuning

    Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficient prompt tuning. In Marie-Francine Moens, Xuanjing Huang, Lucia Spe- cia, and Scott Wen-tau Yih, editors,Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processi...

    2021

  44. [52]

    BART: De- noising sequence-to-sequence pre-training for natural language generation, translation, and comprehension

    Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Veselin Stoyanov, and Luke Zettlemoyer. BART: De- noising sequence-to-sequence pre-training for natural language generation, translation, and comprehension. In Dan Jurafsky, Joyce Chai, ...

    2020

  45. [53]

    Prefix-tuning: Optimiz- ing continuous prompts for generation

    Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimiz- ing continuous prompts for generation. arXiv preprint arXiv:2101.00190, 2021

    2021 arXiv

  46. [54]

    Large language models can be strong differentially private learners

    Xuechen Li, Florian Tramer, Percy Liang, and Tat- sunori Hashimoto. Large language models can be strong differentially private learners. arXiv preprint arXiv:2110.05679, 2021

    2021 arXiv

  47. [55]

    Re- thinking machine unlearning for large language mod- els

    Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, et al. Re- thinking machine unlearning for large language mod- els. arXiv preprint arXiv:2402.08787, 2024

    2024 arXiv

  48. [56]

    Roberta: A ro- bustly optimized bert pretraining approach

    Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A ro- bustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692, 2019

    1907 arXiv

  49. [57]

    Membership inference attacks by exploiting loss trajectory

    Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. Membership inference attacks by exploiting loss trajectory. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communica- tions Security, pages 2085–2098, 2022

    2022

  50. [58]

    Probing language mod- els for pre-training data detection

    Zhenhua Liu, Tong Zhu, Chuanyuan Tan, Haonan Lu, Bing Liu, and Wenliang Chen. Probing language mod- els for pre-training data detection. arXiv preprint arXiv:2406.01333, 2024

    2024 arXiv

  51. [59]

    A controlled study on long context extension and generalization in llms

    Yi Lu, Jing Nathan Yan, Songlin Yang, Justin T Chiu, Siyu Ren, Fei Yuan, Wenting Zhao, Zhiyong Wu, and Alexander M Rush. A controlled study on long context extension and generalization in llms. arXiv preprint arXiv:2409.12181, 2024

    2024 arXiv

  52. [60]

    LLM dataset inference: Did you train on my dataset? In The Thirty-eighth Annual Confer- ence on Neural Information Processing Systems, 2024

    Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. LLM dataset inference: Did you train on my dataset? In The Thirty-eighth Annual Confer- ence on Neural Information Processing Systems, 2024

    2024

  53. [61]

    Did the neurons read your book? document-level membership inference for large language models

    Matthieu Meeus, Shubham Jain, Marek Rei, and Yves- Alexandre de Montjoye. Did the neurons read your book? document-level membership inference for large language models. In 33rd USENIX Security Sym- posium (USENIX Security 24) , pages 2369–2385, Philadelphia, PA, August 2024. U...

    2024

  54. [62]

    Sok: Membership inference attacks on llms are rush- ing nowhere (and how to fix it)

    Matthieu Meeus, Igor Shilov, Shubham Jain, Manuel Faysse, Marek Rei, and Yves-Alexandre de Montjoye. Sok: Membership inference attacks on llms are rush- ing nowhere (and how to fix it). arXiv preprint arXiv:2406.17975, 2024

    2024 arXiv

  55. [63]

    Llama 3.2: Revolutionizing edge ai and vision with open, customizable models

    AI Meta. Llama 3.2: Revolutionizing edge ai and vision with open, customizable models. Meta AI Blog. Retrieved December, 20:2024, 2024

    2024

  56. [64]

    An empirical analysis of memorization in fine-tuned autoregressive language models

    Fatemehsadat Mireshghallah, Archit Uniyal, Tianhao Wang, David K Evans, and Taylor Berg-Kirkpatrick. An empirical analysis of memorization in fine-tuned autoregressive language models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, p...

    2022

  57. [65]

    Scaling data-constrained language models

    Niklas Muennighoff, Alexander Rush, Boaz Barak, Teven Le Scao, Nouamane Tazi, Aleksandra Piktus, Sampo Pyysalo, Thomas Wolf, and Colin A Raffel. Scaling data-constrained language models. Advances in Neural Information Processing Systems, 36:50358– 50376, 2023. 18

    2023

  58. [66]

    GPT-4 technical report, 2023

    OpenAI. GPT-4 technical report, 2023

    2023

  59. [67]

    Ppdb 2.0: Better paraphrase ranking, fine-grained entailment relations, word embeddings, and style classification

    Ellie Pavlick, Pushpendre Rastogi, Juri Ganitkevitch, Benjamin Van Durme, and Chris Callison-Burch. Ppdb 2.0: Better paraphrase ranking, fine-grained entailment relations, word embeddings, and style classification. In Proceedings of the 53rd Annual Meeting of the As- sociation...

    2015

  60. [68]

    The text anonymization benchmark (tab): A dedicated cor- pus and evaluation framework for text anonymization

    Ildikó Pilán, Pierre Lison, Lilja Øvrelid, Anthi Pa- padopoulou, David Sánchez, and Montserrat Batet. The text anonymization benchmark (tab): A dedicated cor- pus and evaluation framework for text anonymization. Computational Linguistics, 48(4):1053–1101, 2022

    2022

  61. [69]

    Estimating training data in- fluence by tracing gradient descent

    Garima Pruthi, Frederick Liu, Satyen Kale, and Mukund Sundararajan. Estimating training data in- fluence by tracing gradient descent. Advances in Neu- ral Information Processing Systems, 33:19920–19930, 2020

    2020

  62. [70]

    Building effective agents

    Erik Schluntz and Barry Zhang. Building effective agents. https://www.anthropic.com/research/ building-effective-agents, 2024. Anthropic

    2024

  63. [71]

    Rapid optimization for jailbreaking llms via subconscious exploitation and echopraxia

    Guangyu Shen, Siyuan Cheng, Kaiyuan Zhang, Guan- hong Tao, Shengwei An, Lu Yan, Zhuo Zhang, Shiqing Ma, and Xiangyu Zhang. Rapid optimization for jailbreaking llms via subconscious exploitation and echopraxia. arXiv preprint arXiv:2402.05467, 2024

    2024 arXiv

  64. [72]

    Bait: Large language model backdoor scanning by inverting attack target

    Guangyu Shen, Siyuan Cheng, Zhuo Zhang, Guanhong Tao, Kaiyuan Zhang, Hanxi Guo, Lu Yan, Xiaolong Jin, Shengwei An, Shiqing Ma, et al. Bait: Large language model backdoor scanning by inverting attack target. In 2025 IEEE Symposium on Security and Privacy (SP), pages 103–103. IE...

    2025

  65. [73]

    Detecting pretraining data from large language models

    Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. In The Twelfth International Conference on Learning Representations, 2024

    2024

  66. [74]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vi- taly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017

    2017

  67. [75]

    LoRA vs full fine- tuning: An illusion of equivalence

    Reece Shuttleworth, Jacob Andreas, Antonio Tor- ralba, and Pratyusha Sharma. LoRA vs full fine- tuning: An illusion of equivalence. arXiv preprint arXiv:2410.21228, 2024

    2024

  68. [76]

    Stochastic gradient descent with differentially private updates

    Shuang Song, Kamalika Chaudhuri, and Anand D Sar- wate. Stochastic gradient descent with differentially private updates. In2013 IEEE global conference on sig- nal and information processing, pages 245–248. IEEE, 2013

    2013

  69. [77]

    µKE: Matryoshka unstructured knowledge editing of large language models

    Zian Su, Ziyang Huang, Kaiyuan Zhang, and Xiangyu Zhang. µKE: Matryoshka unstructured knowledge editing of large language models. arXiv preprint arXiv:2504.01196, 2025

    2025 arXiv

  70. [78]

    Source code foundation models are transferable binary analysis knowledge bases

    Zian Su, Xiangzhe Xu, Ziyang Huang, Kaiyuan Zhang, and Xiangyu Zhang. Source code foundation models are transferable binary analysis knowledge bases. In The Thirty-eighth Annual Conference on Neural Infor- mation Processing Systems, 2024

    2024

  71. [79]

    Se- quence to sequence learning with neural networks

    Ilya Sutskever, Oriol Vinyals, and Quoc V Le. Se- quence to sequence learning with neural networks. Ad- vances in neural information processing systems, 27, 2014

    2014

  72. [80]

    HydraLoRA: An asymmetric lora ar- chitecture for efficient fine-tuning

    Chunlin Tian, Zhan Shi, Zhijiang Guo, Li Li, and Chengzhong Xu. HydraLoRA: An asymmetric lora ar- chitecture for efficient fine-tuning. In Advances in Neu- ral Information Processing Systems (NeurIPS), 2024

    2024

  73. [81]

    Llama: Open and efficient foundation language models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023

    2023 arXiv

  74. [82]

    Con-recall: Detect- ing pre-training data in llms via contrastive decoding

    Cheng Wang, Yiwei Wang, Bryan Hooi, Yujun Cai, Nanyun Peng, and Kai-Wei Chang. Con-recall: Detect- ing pre-training data in llms via contrastive decoding. arXiv preprint arXiv:2409.03363, 2024

    2024 arXiv

  75. [83]

    Kga: A general ma- chine unlearning framework based on knowledge gap alignment

    Lingzhi Wang, Tong Chen, Wei Yuan, Xingshan Zeng, Kam-Fai Wong, and Hongzhi Yin. Kga: A general ma- chine unlearning framework based on knowledge gap alignment. arXiv preprint arXiv:2305.06535, 2023

    2023 arXiv

  76. [84]

    A comprehensive survey of continual learning: theory, method and application

    Liyuan Wang, Xingxing Zhang, Hang Su, and Jun Zhu. A comprehensive survey of continual learning: theory, method and application. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024

    2024

  77. [85]

    Multitask prompt tuning enables parameter-efficient transfer learning

    Zhen Wang, Rameswar Panda, Leonid Karlinsky, Roge- rio Feris, Huan Sun, and Yoon Kim. Multitask prompt tuning enables parameter-efficient transfer learning. In The Eleventh International Conference on Learning Representations, 2023

    2023

  78. [86]

    Machine unlearning of features and labels

    Alexander Warnecke, Lukas Pirch, Christian Wress- negger, and Konrad Rieck. Machine unlearning of features and labels. arXiv preprint arXiv:2108.11577, 2021. 19

    2021 arXiv

  79. [87]

    ReCaLL: Membership inference via relative conditional log-likelihoods

    Roy Xie, Junlin Wang, Ruomin Huang, Minxing Zhang, Rong Ge, Jian Pei, Neil Zhenqiang Gong, and Bhuwan Dhingra. ReCaLL: Membership inference via relative conditional log-likelihoods. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, page...

    2024

  80. [88]

    Parameter-efficient fine-tuning methods for pretrained language models: A critical review and assessment

    Lingling Xu, Haoran Xie, Si-Zhao Joe Qin, Xiao- hui Tao, and Fu Lee Wang. Parameter-efficient fine-tuning methods for pretrained language models: A critical review and assessment. arXiv preprint arXiv:2312.12148, 2023

    2023 arXiv

  81. [89]

    Prosec: For- tifying code llms with proactive security alignment

    Xiangzhe Xu, Zian Su, Jinyao Guo, Kaiyuan Zhang, Zhenting Wang, and Xiangyu Zhang. Prosec: For- tifying code llms with proactive security alignment. In Forty-second International Conference on Machine Learning, 2025

    2025

  82. [90]

    Aspirer: Bypassing system prompts with permutation-based backdoors in llms

    Lu Yan, Siyuan Cheng, Xuan Chen, Kaiyuan Zhang, Guangyu Shen, Zhuo Zhang, and Xiangyu Zhang. Aspirer: Bypassing system prompts with permutation-based backdoors in llms. arXiv preprint arXiv:2410.04009, 2024

    2024 arXiv

  83. [91]

    Para- fuzz: An interpretability-driven technique for detecting poisoned samples in nlp

    Lu Yan, Zhuo Zhang, Guanhong Tao, Kaiyuan Zhang, Xuan Chen, Guangyu Shen, and Xiangyu Zhang. Para- fuzz: An interpretability-driven technique for detecting poisoned samples in nlp. Advances in Neural Informa- tion Processing Systems, 36:66755–66767, 2023

    2023

  84. [92]

    Privacy risk in machine learning: An- alyzing the connection to overfitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: An- alyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pages 268–282. IEEE, 2018

    2018

  85. [93]

    Lofit: Lo- calized fine-tuning on LLM representations

    Fangcong Yin, Xi Ye, and Greg Durrett. Lofit: Lo- calized fine-tuning on LLM representations. In The Thirty-eighth Annual Conference on Neural Informa- tion Processing Systems, 2024

    2024

  86. [94]

    Differentially private fine-tuning of language models

    Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, et al. Differentially private fine-tuning of language models. 2022

    2022

  87. [95]

    Bag of tricks for training data extraction from language mod- els

    Weichen Yu, Tianyu Pang, Qian Liu, Chao Du, Bingyi Kang, Yan Huang, Min Lin, and Shuicheng Yan. Bag of tricks for training data extraction from language mod- els. In International Conference on Machine Learning, pages 40306–40320. PMLR, 2023

    2023

  88. [96]

    Counterfactual memorization in neural language models

    Chiyuan Zhang, Daphne Ippolito, Katherine Lee, Matthew Jagielski, Florian Tramèr, and Nicholas Car- lini. Counterfactual memorization in neural language models. Advances in Neural Information Processing Systems, 36:39321–39362, 2023

    2023

  89. [97]

    Membership inference attacks cannot prove that a model was trained on your data

    Jie Zhang, Debeshee Das, Gautam Kamath, and Florian Tramèr. Membership inference attacks cannot prove that a model was trained on your data. arXiv preprint arXiv:2409.19798, 2024

    2024 arXiv

  90. [98]

    Min-k%++: Improved baseline for de- tecting pre-training data from large language models

    Jingyang Zhang, Jingwei Sun, Eric Yeats, Yang Ouyang, Martin Kuo, Jianyi Zhang, Hao Frank Yang, and Hai Li. Min-k%++: Improved baseline for de- tecting pre-training data from large language models. arXiv preprint arXiv:2404.02936, 2024

    2024 arXiv

  91. [99]

    Censor: Defense against gradient in- version via orthogonal subspace bayesian sampling

    Kaiyuan Zhang, Siyuan Cheng, Guangyu Shen, Bruno Ribeiro, Shengwei An, Pin-Yu Chen, Xiangyu Zhang, and Ninghui Li. Censor: Defense against gradient in- version via orthogonal subspace bayesian sampling. In 32nd Annual Network and Distributed System Security Symposium, NDSS 2025, 2025

    2025

  92. [100]

    LLM agents should employ security principles

    Kaiyuan Zhang, Zian Su, Pin-Yu Chen, Elisa Bertino, Xiangyu Zhang, and Ninghui Li. LLM agents should employ security principles. arXiv preprint arXiv:2505.24019, 2025

    2025 arXiv

  93. [101]

    LLaMA-adapter: Efficient fine-tuning of large lan- guage models with zero-initialized attention

    Renrui Zhang, Jiaming Han, Chris Liu, Aojun Zhou, Pan Lu, Yu Qiao, Hongsheng Li, and Peng Gao. LLaMA-adapter: Efficient fine-tuning of large lan- guage models with zero-initialized attention. In The Twelfth International Conference on Learning Repre- sentations, 2024

    2024

  94. [102]

    LoRA land: 310 fine-tuned llms that rival GPT-4, a technical report

    Justin Zhao, Timothy Wang, Wael Abid, Geoffrey An- gus, Arnav Garg, Jeffery Kinnison, Alex Sherstinsky, Piero Molino, Travis Addair, and Devvret Rishi. LoRA land: 310 fine-tuned llms that rival GPT-4, a technical report. arXiv preprint arXiv:2405.00732, 2024

    2024 arXiv

  95. [103]

    Judging llm-as- a-judge with mt-bench and chatbot arena

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuo- han Li, Dacheng Li, Eric Xing, et al. Judging llm-as- a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, 36:46595– 46623, 2023. 20

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.