Pith. sign in

REVIEW 3 major objections 6 minor 2 cited by

SoK: Semantic Privacy in Large Language Models

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper defines semantic privacy as protection of inferable sensitive attributes and argues that current LLM defenses leave contextual and latent leakage unaddressed.

desk verdict Useful, well-organized SoK on semantic privacy in LLMs, but the core claim that DP cannot handle semantic correlations is overstated and needs a rewrite before this is citable. read the letter →

arxiv 2506.23603 v2 pith:DEQU2XNT submitted 2025-06-30 cs.CR cs.AI

Baihe Ma , Yanna Jiang , Xu Wang , Guangsheng Yu , Qin Wang , Caijun Sun , Chen Li , Xuelei Qi
show 3 more authors
Ying He Wei Ni Ren Ping Liu
This is my paper
classification cs.CRcs.AI
keywords semanticprivacylargelanguagemodelsleakagelifecycleframeworkmembershipinferenceattributemodelinversionbackdoorattacks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper defines semantic privacy as protection of sensitive attributes that are not explicitly present in data but can be inferred from it, often by combining context or external knowledge. It proposes a four-stage lifecycle framework spanning input processing, pretraining, fine-tuning, and alignment to show how meaning-bearing representations of identity, intent, and background survive every transformation an LLM applies. Surveying membership inference, attribute inference, model inversion, and backdoor attacks, it argues that current defenses such as differential privacy, embedding encryption, edge processing, and unlearning each cover only a slice of this pipeline. The paper concludes that no existing defense suppresses contextual and latent semantic leakage on its own, and that future solutions need to be quantifiable, modality-aware, utility-preserving, and transparent.

What carries the argument

The carrying object is the lifecycle-centric framework: a partition of LLM processing into S1 input processing (tokenization, embedding, positional encoding), S2 pretraining (transformer layers that abstract hierarchical semantics), S3 fine-tuning (task-specific output heads), and S4 alignment (RLHF, filtering, inference-time controls). Against this partition the paper maps four representative attack types—membership inference, attribute inference, model inversion, and backdoor attacks—and evaluates five defense families (differential privacy, edge/split learning, embedding encryption, knowledge unlearning, pruning/compression). The framework's work is to show that semantics survive every stage, so privacy protection must be stage-aware rather than applied at a single layer.

What would settle it

One concrete check: if an LLM protected only by differentially private training with a moderate privacy budget were shown to resist attribute inference, such as recovering a user's age or location from generated text, with no measurable utility loss, this would contradict the paper's claim that current defenses are insufficient against latent semantic leakage.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that LLM privacy has a semantic dimension distinct from data privacy: a model can leak sensitive information by paraphrasing, inferring, or reconstructing meaning even when no verbatim string is reproduced. The paper argues this leakage arises from semantic representations that are preserved across all four lifecycle stages, and that the four canonical attack families exploit these representations differently depending on the stage. It accordingly claims that surface-level anonymization and stage-local defenses are insufficient: any privacy guarantee that ignores cross-stage semantic preservation will miss the leakage channel. The contribution is not a new attack or defense but a systematization that maps the threat surface and identifies the structural gaps in existing protections.

Load-bearing premise

The load-bearing assumption is that the four lifecycle stages and the four selected attack types capture the semantic threat surface completely enough; if leakage happens outside this partition, the claimed gaps could be misclassified.

Editorial extensions

If this is right

  • If the framework is right, any privacy evaluation of an LLM should state which lifecycle stage it protects; a defense that only perturbs inputs (S1) cannot be assumed to stop inference at generation (S4).
  • Semantic leakage metrics should replace token-level measures; embedding similarity, entailment-aware scoring, and re-identification risk are the natural targets.
  • Combining stage-specific defenses, such as client-side local differential privacy plus unlearning plus alignment filtering, is more promising than relying on any single mechanism.
  • Multimodal LLMs extend the threat surface because cross-modal interactions can expose identity even when each modality is sanitized individually.
  • Transparency and explainability of privacy mechanisms become requirements, not optional features, if users are to trust semantic privacy claims.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the authors leave implicit: semantic privacy cannot in general be guaranteed by formal differential privacy because the adversary's background knowledge is what defines the sensitive inference; a quantitative account would need a semantic distance between inferred attributes, not just a noise budget.
  • The lifecycle partition suggests a testable research program: measuring at which stage semantic leakage is amplified, for example by probing intermediate layers, could prioritize defense placement better than treating all stages equally.
  • A concrete extension would define a semantic re-identification rate that measures how often an anonymized corpus can be matched to real individuals via LLM inference, and use it to benchmark the surveyed defenses.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This SoK paper defines 'semantic privacy' as the protection of sensitive attributes that are not explicitly stated but can be inferred from data via contextual or external knowledge, and applies this notion to large language models. The authors propose a lifecycle framework spanning input processing, pretraining, fine-tuning, and alignment, and use it to organize four attack classes (membership inference, attribute inference, model inversion, backdoor attacks) and five defense families (edge processing, embedding encryption, differential privacy, pruning/compression, and unlearning). Their central research conclusion is that current defenses are fragmented and insufficient because they do not suppress contextual, latent, or implicit semantic leakage. The paper closes with a set of open challenges around quantification, multimodal privacy, de-identification, and explainability.

Significance. If the framework and gap analysis were rigorously supported, the paper would fill a real gap: existing LLM privacy surveys mostly target verbatim data exposure rather than inference-based semantic leakage. The lifecycle framing is a useful organizing device, and the paper usefully brings together recent attacks and defenses that are usually discussed separately. The survey also makes falsifiable claims about the insufficiency of existing defenses, which is a strength, and its explicit treatment of semantic-level attacks (attribute inference, semantic membership inference, prompt inversion) goes beyond earlier taxonomies. However, the paper does not provide machine-checked proofs, reproducible code, or a formal model; its value currently rests on qualitative synthesis. The most important technical claim, that differential privacy cannot capture semantic-level correlations, is asserted rather than derived and is, in its unqualified form, incorrect. The paper's significance therefore depends on revisions that either correct or carefully scope that claim and that make the proposed definition and gap tables formally checkable.

major comments (3)
  1. [Section 2 and RQ2] The statement that 'standard DP methods, premised on independent data records, cannot capture semantic-level correlations [29, 41]' is not established by the cited sources and, in the unqualified form given, is incorrect. ε-differential privacy bounds the likelihood ratio of the mechanism's output between any two adjacent datasets, and by post-processing and group-privacy properties this yields concrete bounds on attribute-inference advantage for any attribute that is a function of the target individual's record (for a binary attribute, the advantage scales with e^ε−1). The paper's own running examples (age, gender, location) are attributes of this kind. A defensible version of the claim would restrict it to inference from population-level external knowledge or from semantic properties that are not represented as functions of the training record. Because the RQ2 conclusion that current defenses are insufficient relies on this assertion, the claim must be corrected, re-scoped, and supported with a derivation or a citation to one rather than asserted via survey references.
  2. [Section 1, 'formal definition'] The displayed definition of semantic privacy is a prose statement and not a formal object: it specifies no attack game, no adversary model or knowledge set, no target attribute class, and no quantifiable advantage or loss. This matters because Tables 3 and 4 purport to evaluate whether attacks and defenses address 'semantic privacy,' and without a formal criterion the completeness and soundness of those tables cannot be checked. The contribution should be relabeled as a working definition, with the taxonomy presented as qualitative, or the authors should add a formal game—for example, an adversary who observes the model's output on an input x and attempts to infer a latent attribute A(x), with advantage measured against a random-guessing baseline—and show how the surveyed attacks and defenses instantiate it.
  3. [Table 2 and Section 2 gap analysis] The 'Ours' row of Table 2 marks all twenty dimensions as explicitly and systematically discussed, but the body text does not support this uniformly: QF (semantic quantification) is mainly a set of future directions in Section 5.2, MM is a single subsection (Section 5.3), and EX is discussed only in passing in Section 5.2. Since the paper's novelty claim—being 'the first semantically grounded systematization'—rests on this table, the self-assessment needs a transparent scoring rubric with per-cell evidence, or the claims need to be scaled back.
minor comments (6)
  1. [Section 3.1.1] The citation [16] for Byte Pair Encoding/WordPiece tokenization is incorrect; reference [16] is an LLM pruning paper. Please cite the original tokenization literature or a standard NLP methods survey.
  2. [Section 1] The sentence beginning 'While both semantic privacy and data privacy aim to prevent...' is grammatically incomplete and is followed by 'However'; the passage should be rewritten into one or two complete sentences.
  3. [Table 2] The legend for partial coverage appears to be missing the actual symbols for partial coverage; only '✗: Not addressed' and '✓: Explicitly and systematically discussed' are legible, so the partial-coverage entries cannot be interpreted.
  4. [Table 4] The 'protection capability' scores (1–5) are presented without a scoring methodology or citation; as a qualitative self-rating, they should be explicitly labeled as the authors' assessment rather than as a measured quantity.
  5. [References] References [4] and [5] appear to be two versions of the same survey (Das, Amini, and Wu); please consolidate them or clearly distinguish the preprint from the published version.
  6. [Throughout] Minor typographical issues include 'zheng et al.' in Section 3.2.2 (should be capitalized), 'relianced' in Section 4.4, and the ambiguous phrase 'the shallower a split exposes sensitive semantics' in Section 4.1, which should be reworded for clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

Survey with no derivation chain; conclusions are taxonomic and literature-based, not circular.

full rationale

This SoK makes no derived predictions and contains no fitted parameters; its claims are taxonomic and evaluative. The definition of semantic privacy in Sec. 1 is stipulative, not the conclusion of an argument, so it cannot be circular in the derivation sense. The lifecycle framework (S1–S4) and attack taxonomy in Sec. 3 are organizational choices rather than consequences of the definition. The defense assessments in Sec. 4 and Table 4 are literature summaries with qualitative ratings. Table 2's 'Ours' row is the authors' own coverage self-assessment, but it is editorial and does not deduce any result from itself. No load-bearing self-citation appears: the two citations supporting the claim that standard DP cannot capture semantic correlations ([29, 41]) are external surveys, not works by the present authors. That claim is indeed asserted rather than proved—and an ε-DP mechanism would bound posterior advantage for individual attribute inference—but that is a correctness/evidentiary issue, not circularity. Similarly, the 'formal definition' is not presented as a game-based formal object, but the absence of formalism is a rigor limitation, not a self-referential reduction. The paper's conclusions about defense fragmentation follow from the selected literature and the authors' evaluative criteria, not from an equation that equals its own input. I therefore find no significant circularity.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper rests on three domain-level assumptions: the four-stage lifecycle partition, the representativeness of the four attack classes, and the claim that DP's independence assumption blocks semantic correlation handling. No free parameters or invented entities appear, consistent with the paper being a qualitative survey.

assumptions (3)
  • domain assumption LLM processing can be partitioned into four stages (input processing, pretraining, fine-tuning, alignment) and semantic risk maps onto these stages.
    Section 3.1 and Figure 2 assume this partition; it is a modeling choice, not demonstrated.
  • domain assumption The four attack types (membership inference, attribute inference, model inversion, backdoor) are representative of semantic privacy threats.
    Section 3.2 selects these four 'representative' attacks without a systematic justification of completeness.
  • domain assumption Existing differential privacy, premised on independent records, cannot capture semantic-level correlations.
    Section 2 invokes this to justify the gap; it is asserted via citations rather than demonstrated in this paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SoK: Semantic Privacy in Large Language Models." pith.science (2026). https://pith.science/paper/DEQU2XNT

@misc{pith2026250623603,
  author       = {Pith},
  title        = {Pith review of: SoK: Semantic Privacy in Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DEQU2XNT}},
  note         = {Machine review of arXiv:2506.23603}
}
read the original abstract

As Large Language Models (LLMs) are increasingly deployed in sensitive domains, traditional data privacy measures prove inadequate for protecting information that is implicit, contextual, or inferable - what we define as semantic privacy. This Systematization of Knowledge (SoK) introduces a lifecycle-centric framework to analyze how semantic privacy risks emerge across input processing, pretraining, fine-tuning, and alignment stages of LLMs. We categorize key attack vectors and assess how current defenses, such as differential privacy, embedding encryption, edge computing, and unlearning, address these threats. Our analysis reveals critical gaps in semantic-level protection, especially against contextual inference and latent representation leakage. We conclude by outlining open challenges, including quantifying semantic leakage, protecting multimodal inputs, balancing de-identification with generation quality, and ensuring transparency in privacy enforcement. This work aims to inform future research on designing robust, semantically aware privacy-preserving techniques for LLMs.

Figures

Figures reproduced from arXiv: 2506.23603 by the authors.

Figure 1
Figure 1. Illustration of semantic privacy leakage across the LLM lifecycle. The example demonstrates how rich semantic information can be inferred from natural inputs even after removing explicit identifiers (e.g., email and phone). Without protection, all sensitive details are directly exposed. Generic data privacy methods that strip surface identifiers still allow attackers to infer key latent attributes via semantic cues.… view at source ↗
Figure 2
Figure 2. Illustration of semantic information flow and corresponding attack surfaces throughout the LLM lifecycle. As the training data is transformed through S1, S2, S3, and S4, semantic representations, such as identity, affiliation, or intent, are preserved. These internal representations become potential attack vectors for adversaries at each stage. Model inversion attacks exploit the transformer layers in S2 to reconstr… view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. DEFENGRAPH: Knowledge Graph-Enhanced LLMs for Blue Team Cyber Defense

    cs.CR 2026-06 unverdicted novelty 6.0 of 10

    DEFENGRAPH integrates a dual-layer static-dynamic KG with LLMs via path retrieval, filtering, and re-ranking, raising reasoning-recall from 61.45% to 73.49% and ticket-action recall from 52.17% to 72.46% on GPT-4o in ...

  2. SoK: Agentic Skills -- Beyond Tool Use in LLM Agents

    cs.CR 2026-02 unverdicted novelty 6.0 of 10

    The paper systematizes agentic skills beyond tool use, providing design pattern and representation-scope taxonomies plus security analysis of malicious skill infiltration in agent marketplaces.

Reference graph

Works this paper leans on

51 extracted references · 35 canonical work pages · cited by 2 Pith papers

  1. [16]

    Hanjuan Huang, Hao-Jia Song, and Hsing-Kuo Pao. 2024. Large Language Model Pruning. arXiv:2406.00030 (2024)

    work page Pith review arXiv 2024

  2. [1]

    Francisco Aguilera-Martínez and Fernando Berzal. 2025. LLM Security: Vulnera- bilities, Attacks, Defenses, and Countermeasures. arXiv:2505.01177 (2025)

    arXiv 2025

  3. [2]

    Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, et al . 2024. A survey on evaluation of large language models. ACM Transactions on Intelligent Systems and Technology (TIST) 15, 3 (2024), 1–45

    work page 2024

  4. [3]

    Jinhyuk Choi, Jihong Park, Seung-Woo Ko, Jinho Choi, Mehdi Bennis, and Seong- Lyun Kim. 2024. Semantics alignment via split learning for resilient multi-user semantic communication. IEEE Transactions on Vehicular Technology (TVT)(2024). 8

    work page 2024

  5. [4]

    Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. 2024. Security and privacy challenges of large language models: A survey. Comput. Surveys (2024)

    work page 2024

  6. [5]

    Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. 2025. Security and privacy challenges of large language models: A survey. Comput. Surveys 57, 6 (2025), 1–39

    2025

  7. [6]

    Tobias Deußer, Max Hahnbück, Tobias Uelwer, Cong Zhao, Christian Bauckhage, and Rafet Sifa. 2025. Resource-Efficient Anonymization of Textual Data via Knowledge Distillation from Large Language Models. In International Conference on Computational Linguistics: Industry Track . 243–250

    work page 2025

  8. [7]

    Minxin Du, Xiang Yue, Sherman SM Chow, Tianhao Wang, Chenyu Huang, and Huan Sun. 2023. Dp-forward: Fine-tuning and inference on language models with differential privacy in forward pass. InACM SIGSAC Conference on Computer and Communications Security (CCS) . 2665–2679

    work page 2023

Show all 51 references
  1. [8]

    Sebastian Farquhar, Jannik Kossen, Lorenz Kuhn, and Yarin Gal. 2024. Detecting hallucinations in large language models using semantic entropy. Nature 630, 8017 (2024), 625–630

    2024

  2. [9]

    Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang

  3. [10]

    Filippo Galli, Luca Melis, and Tommaso Cucinotta. 2024. Noisy Neighbors: Efficient membership inference attacks against LLMs. arXiv:2406.16565 (2024)

    2024 arXiv

  4. [11]

    Yuyou Gan, Yong Yang, Zhe Ma, Ping He, Rui Zeng, Yiming Wang, Qingming Li, Chunyi Zhou, Songze Li, Ting Wang, et al. 2024. Navigating the risks: A survey of security, privacy, and ethics threats in LLM-based agents. arXiv preprint arXiv:2411.09523 (2024)

    2024 arXiv

  5. [12]

    Henry Gilbert, Michael Sandborn, Douglas C Schmidt, Jesse Spencer-Smith, and Jules White. 2023. Semantic compression with large language models. In Tenth International Conference on Social Networks Analysis, Management and Security (SNAMS). IEEE, 1–8

    2023

  6. [13]

    Kaijie Gong, Yi Gao, and Wei Dong. 2024. Privacy-preserving and cross-domain human sensing by federated domain adaptation with semantic knowledge cor- rection. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies 8, 1 (2024), 1–26

    2024

  7. [14]

    Feng He, Tianqing Zhu, Dayong Ye, Bo Liu, Wanlei Zhou, and Philip S Yu. 2024. The emerged security and privacy of LLM agent: A survey with case studies. arXiv preprint arXiv:2407.19354 (2024)

    2024

  8. [15]

    Yu He, Boheng Li, Liu Liu, Zhongjie Ba, Wei Dong, Yiming Li, Zhan Qin, Kui Ren, and Chun Chen. 2025. Towards label-only membership inference attack against pre-trained large language models. In USENIX Security

    2025

  9. [17]

    Jing Huang, Diyi Yang, and Christopher Potts. 2024. Demystifying verbatim memorization in large language models. arXiv preprint arXiv:2407.17817 (2024)

    2024 arXiv

  10. [18]

    Bo Hui, Haolin Yuan, Neil Gong, Philippe Burlina, and Yinzhi Cao. 2024. Pleak: Prompt leaking attacks against large language model applications. In ACM SIGSAC Conference on Computer and Communications Security (CCS) . 3600–3614

    2024

  11. [19]

    Daphne Ippolito, Florian Tramèr, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christopher A Choquette-Choo, and Nicholas Carlini. 2022. Pre- venting verbatim memorization in language models gives a false sense of privacy. arXiv preprint arXiv:2210.17546 (2022)

    2022 arXiv

  12. [20]

    Kaan Kale, Homa Esfahanizadeh, Noel Elias, Oguzhan Baser, Muriel Médard, and Sriram Vishwanath. 2024. Texshape: Information theoretic sentence embedding for language models. In IEEE International Symposium on Information Theory (ISIT). IEEE, 2038–2043

    2024

  13. [21]

    Mehdi Khamassi, Marceau Nahon, and Raja Chatila. 2024. Strong and weak alignment of large language models with human values. Scientific Reports 14, 1 (2024), 19399

    2024

  14. [22]

    Eldar Kurtić, Elias Frantar, and Dan Alistarh. 2023. Ziplm: Inference-aware structured pruning of language models.Advances in Neural Information Processing Systems NeurIPS 36 (2023), 65597–65617

    2023

  15. [23]

    Qinbin Li, Junyuan Hong, Chulin Xie, Jeffrey Tan, Rachel Xin, Junyi Hou, Xavier Yin, Zhun Wang, Dan Hendrycks, Zhangyang Wang, et al . 2024. LLM-PBE: Assessing data privacy in large language models. arXiv:2408.12787 (2024)

    2024 arXiv

  16. [24]

    Aishan Liu, Yuguang Zhou, Xianglong Liu, Tianyuan Zhang, Siyuan Liang, Jiakai Wang, Yanjun Pu, Tianlin Li, Junqi Zhang, Wenbo Zhou, et al. 2025. Compro- mising LLM Driven Embodied Agents with Contextual Backdoor Attacks. IEEE Transactions on Information Forensics and Security ...

    2025

  17. [25]

    Peihua Mai, Ran Yan, Zhe Huang, Youjia Yang, and Yan Pang. 2023. Split-and- denoise: Protect large language model inference with local differential privacy. arXiv:2310.09130 (2023)

    2023 arXiv

  18. [26]

    Abhijit Mishra, Mingda Li, and Soham Deo. 2024. Sentinellms: Encrypted input adaptation and fine-tuning of language models for private and secure inference. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI)

    2024

  19. [27]

    Hamid Mozaffari and Virendra J Marathe. 2024. Semantic Membership Inference Attack against Large Language Models. arXiv preprint arXiv:2406.10218 (2024)

    2024 arXiv

  20. [28]

    Zabir Al Nazi and Wei Peng. 2024. Large language models in healthcare and medical domain: A review. In Informatics, Vol. 11. MDPI, 57

    2024

  21. [29]

    Seth Neel and Peter Chang. 2023. Privacy issues in large language models: A survey. arXiv preprint arXiv:2312.06717 (2023)

    2023 arXiv

  22. [30]

    Alexander Nikitin, Jannik Kossen, Yarin Gal, and Pekka Marttinen. 2024. Kernel language entropy: Fine-grained uncertainty quantification for llms from semantic similarities. Advances in Neural Information Processing Systems (NeurIPS) (2024)

    2024

  23. [31]

    Wenjie Qu, Yuguang Zhou, Yongji Wu, Tingsong Xiao, Binhang Yuan, Yiming Li, and Jiaheng Zhang. 2025. Prompt Inversion Attack against Collaborative Inference of Large Language Models. arXiv:2503.09022 (2025)

    2025 arXiv

  24. [32]

    Xicong Shen, Yang Liu, Huiqi Liu, Jue Hong, Bing Duan, Zirui Huang, Yunlong Mao, Ye Wu, and Di Wu. 2023. A split-and-privatize framework for large language model fine-tuning. arXiv:2312.15603 (2023)

    2023 arXiv

  25. [33]

    Changtian Song, Dongdong Zhao, and Jianwen Xiang. 2024. Not All Tokens Are Equal: Membership Inference Attacks Against Fine-tuned Language Models. In 2024 Annual Computer Security Applications Conference (ACSAC). IEEE, 31–45

    2024

  26. [34]

    Meng Tong, Kejiang Chen, Jie Zhang, Yuang Qi, Weiming Zhang, Nenghai Yu, Tianwei Zhang, and Zhikun Zhang. 2025. InferDPT: Privacy-preserving Inference for Black-box Large Language Models. IEEE Transactions on Dependable and Secure Computing (TDSC) (2025)

    2025

  27. [35]

    Antonios Tragoudaras, Theofanis Aslanidis, Emmanouil Georgios Lionis, Ma- rina Orozco González, and Panagiotis Eustratiadis. 2025. Information Leakage of Sentence Embeddings via Generative Embedding Inversion Attacks. arXiv preprint arXiv:2504.16609 (2025)

    2025 arXiv

  28. [36]

    Mehmet Ugurbil, Dimitris Mouris, Manuel B Santos, José Cabrero-Holgueras, Miguel de Vega, and Shubho Sengupta. 2025. Fission: Distributed Privacy- Preserving Large Language Model Inference. Cryptology ePrint Archive (2025)

    2025

  29. [37]

    Benyou Wang, Qianqian Xie, Jiahuan Pei, Zhihong Chen, Prayag Tiwari, Zhao Li, and Jie Fu. 2023. Pre-trained language models in biomedical domain: A systematic survey. Comput. Surveys 56, 3 (2023), 1–52

    2023

  30. [38]

    Teng Wang, Lindong Zhai, Tengfei Yang, Zhucheng Luo, and Shuanggen Liu. 2024. Selective privacy-preserving framework for large language models fine-tuning. Information Sciences 678 (2024), 121000

    2024

  31. [39]

    Yuecen Wei, Xingcheng Fu, Dongqi Yan, Qingyun Sun, Hao Peng, Jia Wu, Jinyan Wang, and Xianxian Li. 2023. Heterogeneous graph neural network with semantic- aware differential privacy guarantees. Knowledge and Information Systems 65, 10 (2023), 4085–4110

    2023

  32. [40]

    Rui Wen, Zheng Li, Michael Backes, and Yang Zhang. 2024. Membership inference attacks against in-context learning. In ACM SIGSAC Conference on Computer and Communications Security (CCS). 3481–3495

    2024

  33. [41]

    Biwei Yan, Kun Li, Minghui Xu, Yueyan Dong, Yue Zhang, Zhaochun Ren, and Xiuzhen Cheng. 2024. On protecting the data privacy of large language models (LLM): A survey. arXiv preprint arXiv:2403.05156 (2024)

    2024 arXiv

  34. [42]

    Haomiao Yang, Kunlan Xiang, Mengyu Ge, Hongwei Li, Rongxing Lu, and Shui Yu. 2024. A comprehensive overview of backdoor attacks in large language models within communication networks. IEEE Network (2024)

    2024

  35. [43]

    Dixi Yao and Baochun Li. 2024. Is Split Learning Privacy-Preserving for Fine- Tuning Large Language Models? IEEE Transactions on Big Data (TBD) (2024)

    2024

  36. [44]

    Yuanshun Yao, Xiaojun Xu, and Yang Liu. 2024. Large language model unlearning. Advances in Neural Information Processing Systems (NeurIPS) (2024)

    2024

  37. [45]

    Junwei Yu, Jieyu Zhou, Yepeng Ding, Lingfeng Zhang, Yuheng Guo, and Hiroyuki Sato. 2024. Textual Differential Privacy for Context-Aware Reasoning with Large Language Model. InIEEE Annual Computers, Software, and Applications Conference (COMPSAC). IEEE, 988–997

    2024

  38. [46]

    Miao Yu, Liang Lin, Guibin Zhang, Xinfeng Li, Junfeng Fang, Ningyu Zhang, Kun Wang, and Yang Wang. 2025. UniErase: Unlearning Token as a Universal Erasure Primitive for Language Models. arXiv:2505.15674 (2025)

    2025

  39. [47]

    Collin Zhang, John X Morris, and Vitaly Shmatikov. 2024. Extracting prompts by inverting llm outputs. arXiv:2405.15012 (2024)

    2024 arXiv

  40. [48]

    Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. 2024. Instruction backdoor attacks against customized LLMs. In USENIX Security Symposium. 1849–1866

    2024

  41. [49]

    Xiaomei Zhang, Zhaoxi Zhang, Yanjun Zhang, Xufei Zheng, Leo Yu Zhang, Sheng- shan Hu, and Shirui Pan. 2025. Exploring Gradient-Guided Masked Language Model to Detect Textual Adversarial Attacks. arXiv:2504.08798 (2025)

    2025 arXiv

  42. [50]

    Xinyao Zheng, Husheng Han, Shangyi Shi, Qiyan Fang, Zidong Du, Xing Hu, and Qi Guo. 2024. InputSnatch: Stealing Input in LLM Services via Timing Side-Channel Attacks. arXiv:2411.18191 (2024). 9

    2024 arXiv

  43. [2024]

    In Annual Conference on Neural Information Processing Systems (NeurIPS)

    Membership Inference Attacks against Fine-tuned Large Language Mod- els via Self-prompt Calibration. In Annual Conference on Neural Information Processing Systems (NeurIPS)

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.