Pith. sign in

REVIEW 2 major objections 5 minor 2 cited by

Tab-MIA: A Benchmark Dataset for Membership Inference Attacks on Tabular Data in LLMs

T0 review · 2 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper introduces Tab-MIA, a benchmark showing that LLMs fine-tuned on tabular data memorize rows strongly enough for membership inference attacks to reach AUROC near or above 90% after three epochs.

desk verdict Tab-MIA is a useful benchmark with solid fine-tuning results, but the pretrained-memorization claim is undercut by unvalidated synthetic non-members. read the letter →

arxiv 2507.17259 v1 pith:SYH2R6LQ submitted 2025-07-23 cs.CR cs.CL

Eyal German , Sagiv Antebi , Daniel Samira , Asaf Shabtai , Yuval Elovici This is my paper
classification cs.CRcs.CL
keywords membershipinferenceattackstabulardatalargelanguagemodelsmemorizationtableencodingbenchmarkdatasetprivacyleakagefine-tuning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Tab-MIA is a benchmark for measuring a specific privacy risk: whether a large language model (LLM) fine-tuned on tabular rows can be probed to reveal which rows were in its training set. Five real-world table collections are serialized in six text formats, half of the rows are designated members, and three reference-free membership inference attacks are run against four open-weight models. The paper's central finding is that the risk is real and immediate: after only three fine-tuning epochs, the best attack reaches AUROC—a detection score where 50% is chance—near or above 90% for most configurations and hits 97.7% on one dataset. It also finds that the choice of encoding changes the risk by tens of AUROC points, with flat row-based formats leaking the most and structured formats like HTML and JSON leaking less. The benchmark is meant to give the community a repeatable way to compare this risk across models, encodings, and defenses.

What carries the argument

The load-bearing object is the Tab-MIA benchmark itself: five datasets (WTQ, WikiSQL, TabFact, Adult, and California Housing), deduplicated and serialized into six encodings (JSON, HTML, Markdown, Key-Value Pair, Key-is-Value, and Line-Separated), with half the tables designated as members and half as non-members. The argument runs on the attack that reads per-token probabilities: Min-K++ 20%, which scores a record by the average normalized log-probability of its lowest 20% of tokens, with Min-K% and PPL as comparators. AUROC over the member/non-member split is the metric that turns memorization into a measurable privacy risk.

What would settle it

Run the same Min-K++ 20% evaluation on the Tab-MIA split for a model with zero fine-tuning epochs; if AUROC remains near 90% instead of falling toward chance, the attack is detecting something other than fine-tuning-induced membership. Separately, replace the synthetic non-member tables in the pretrained experiment with real non-member Wikipedia tables and recompute: if AUROC drops to chance, the pretrained memorization claim is an artifact of distribution shift.

Watch

Extended reading notes

Core claim

The central discovery is that LLMs fine-tuned on tabular data memorize rows strongly enough that a simple reference-free attack—Min-K++ 20%, which averages the lowest-probability tokens—can reliably separate member rows from non-member rows. In the fine-tuned regime, vulnerability grows with the number of epochs and with model scale: on the WTQ dataset, the attack exceeds 89.6% AUROC for all four models after three epochs and reaches 97.7% for Mistral 7B. Encoding format is a first-order factor: Line-Separated and Key-Value Pair serializations are the most vulnerable, while JSON and HTML typically lower AUROC by roughly 10 to 40 points. Attacks partially transfer across encodings, so an adversary who attacks with a different format than the one used in training still detects some memorization. In the pretrained setting, models show weaker but consistent signals of having memorized Wikipedia-derived tables, with the highest AUROC at 72.0 for LLaMA-3.1 8B using Key-Value Pair.

Load-bearing premise

The load-bearing premise is that the synthetic non-member tables generated for the pretrained-model experiment are statistically indistinguishable from real non-member Wikipedia tables; if they are not, the reported AUROC could reflect a real-versus-synthetic distribution gap rather than memorization of the member tables.

Editorial extensions

If this is right

  • Fine-tuning LLMs on tabular data for as few as one to three epochs creates a measurable membership signal, and the signal strengthens with each additional epoch.
  • The encoding format acts as a privacy control: flat formats such as Line-Separated and Key-Value Pair are substantially more MIA-susceptible than structured formats such as JSON and HTML.
  • An adversary does not need to know the exact training encoding, because partially transferable attacks remain effective across format mismatches.
  • Larger models are more vulnerable to membership inference than smaller models after the same number of epochs, adding a privacy consideration to the usual preference for scale.
  • Publicly available pretrained LLMs already show signs of having memorized Wikipedia-derived tabular data, so the risk is not limited to models explicitly fine-tuned on sensitive tables.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the encoding-format effect holds beyond these five datasets, choosing a structurally redundant serialization such as JSON or HTML could serve as a cheap defensive intervention, though the cross-format results show an attacker can partially overcome it.
  • Because Tab-MIA frames records as rows, the same benchmark could be repurposed to study attribute extraction and recovery of personally identifiable information, not just membership, although that would require new attack definitions.
  • An immediate test of the pretrained-memorization claim would replace the synthetic non-member tables with real non-member Wikipedia tables and recompute the AUROC; the public release of Tab-MIA makes that a direct follow-up experiment.
  • The persistence of signal across encoding formats suggests that encoding-invariant MIA detectors and defenses that randomize encoding at inference time are both natural next problems to evaluate with this benchmark.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper introduces Tab-MIA, a benchmark for membership inference attacks on tabular data in large language models. The benchmark contains five datasets (WTQ, WikiSQL, TabFact, Adult, California Housing) serialized in six textual encoding formats, and the paper evaluates LOSS, Min-K, and Min-K++ attacks against four open-weight LLMs after one to three epochs of QLoRA fine-tuning, as well as against the same models in their pretrained state. The central empirical claim is that fine-tuned LLMs are highly vulnerable to membership inference on tabular data, with AUROC values reaching 97.7% on WTQ after three epochs, that encoding format systematically affects vulnerability, and that pretrained models show moderate leakage on Wikipedia-derived WTQ tables. The paper also reports partial cross-format attack transferability and identifies more verbose formats such as HTML and JSON as relatively less vulnerable.

Significance. If the fine-tuning results are robust, Tab-MIA fills a genuine gap by providing a structured-data benchmark for membership inference, an area where prior MIA benchmarks focus on unstructured text. The paper's strengths include the public release of the dataset and code, the use of multiple models, encodings, and attack methods, and internally controlled fine-tuning splits that show large and consistent epoch effects. However, the pretrained-memorization claim rests on an unvalidated synthetic non-member distribution, and the absence of repeated-seed uncertainty estimates weakens the quantitative comparisons between encodings and model sizes.

major comments (2)
  1. [Section 5.4, Table 6] The pretrained-model experiment treats GPT-4o-mini-generated synthetic tables as non-members without any validation that they resemble real non-member Wikipedia tables. Because Min-K++ is a likelihood-based score, a systematic real-versus-synthetic difference in length, vocabulary, formatting artifacts, or column semantics can produce AUROC values in the reported 60-72 range even when the model has memorized none of the WTQ tables. This directly affects the abstract and introduction claims that pretrained LLMs memorize Wikipedia-derived tabular data. Please add distributional diagnostics, human evaluation, or a real-table non-member baseline (for example, held-out Wikipedia tables not present in WTQ) to establish that the observed separation reflects WTQ memorization rather than distribution shift, and revise the claim accordingly.
  2. [Tables 2-5 and 7-15] All reported AUROC and TPR@FPR=5% values appear to be single-seed point estimates with no error bars, standard deviations, or confidence intervals. The qualitative epoch trend is large and consistent, but several load-bearing comparisons are quantitative differences of roughly 10 to 14 AUROC points, such as the model-size comparison in Section 5.1 and the encoding-format comparison in Table 4 (for example, Mistral 7B on California Housing, Key-Value Pair 92.6 versus JSON 54.5). These differences may be within run-to-run noise under QLoRA fine-tuning. Please report results from multiple seeds with means and variances, or provide a justification for why a single seed is sufficient for the paper's quantitative conclusions.
minor comments (5)
  1. [Section 5.3, Figure 2] The Figure 2 caption says the heatmap is for the WTQ dataset, but the surrounding text and the reported values correspond to the TabFact dataset (the diagonal values match Table 15 for Gemma-3 4B on TabFact). Please correct the caption and ensure the dataset name is consistent.
  2. [Tables 4 and 5] The main-text encoding comparison claims to cover the four models listed in Section 4, but Tables 4 and 5 include only Llama-3.2 3B, Mistral 7B, and Gemma-3 4B, omitting LLaMA-3.1 8B, which does appear in the appendix tables. Please include all four models in the main tables or explicitly state which models are shown.
  3. [Appendix A.4] The appendix states the code is available at an anonymous.4open.science URL, while the abstract lists https://github.com/eyalgerman/Tab-MIA. Please unify the repository references and ensure the final version points to the intended public repository.
  4. [References [7] and [8]] References [7] and [8] appear to describe the same Carlini et al. paper on membership inference from first principles, with different titles and venues. Please merge or disambiguate them.
  5. [Throughout] The benchmark name is inconsistently capitalized as 'Tab-MIA' in most places and 'TAB-MIA' in Appendix A.4. Please use a single consistent spelling.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the fine-tuned-model results are held-out measurements with externally defined attacks; the pretrained-model claim in Section 5.4 has a control-group validity threat, not a by-construction reduction; one non-load-bearing self-citation (Tag&Tab) is present.

full rationale

Walking the claimed derivation chain, no step reduces to its own inputs by construction. In the fine-tuning experiments (Tables 2-5 and the appendix tables), membership labels are a fixed 50/50 random split (seed 42) of the same underlying tables, and the attack statistics (LOSS/PPL [53], Min-K [38], Min-K++ [57]) are externally defined methods applied to held-out splits; no parameter is fitted to a subset and then renamed a prediction, so AUROC values up to 97.7% (WTQ, Mistral 7B, 3 epochs) are genuine measurements rather than self-fulfilling identities. The encoding-format and cross-format results are likewise direct measurements of externally defined scores. Two concerns were weighed and found not to be circular. First, Section 2.1 cites the authors' own Tag&Tab [1] in a related-work list ('In addition, the authors of RECALL [50], DC-PDD[58], and Tag&Tab[1] introduced more advanced strategies that improve MIA performance on LLMs compared to other methods'), but no load-bearing argument in Tab-MIA depends on Tag&Tab's results, so this is a minor, non-load-bearing self-citation consistent with score 2, not circularity. Second, Section 5.4's pretrained-memorization claim ('we treated the original WTQ tables as member samples and generated synthetic non-member tables using the GPT-4o mini [34] model') is vulnerable to a real-vs-synthetic distribution shift: without distributional checks, human evaluation, or a real-table non-member baseline, the reported AUROC (up to 72.0) may reflect stylistic differences between real and synthetic tables rather than memorization of WTQ. This is a load-bearing validity concern for the pretrained-memorization contribution and is flagged as a correctness risk, but it is a confound in the control group, not a reduction of the reported statistic to its inputs by definition: the attack is externally defined and the AUROC is honestly computed against the stated labels. The benchmark's central fine-tuned-models-leak claim is internally controlled and stands independently.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper is empirical, so the ledger captures hand-chosen analysis parameters and unstated modeling assumptions rather than derivation constants. The main free parameters are the Min-K percentage, the 20-row chunk size for long tables, and the 10,000-character filter threshold; none is derived or sensitivity-tested. The key background assumptions are that the four models' pretraining corpora contain Wikipedia tables, that QLoRA fine-tuning approximates standard fine-tuning, and that synthetic GPT-4o mini tables are valid non-members in the pretrained experiment. No invented entities are introduced.

free parameters (3)
  • Min-K/Min-K++ percentage k = 20%
    The attack aggregates the lowest 20% of token probabilities; the percentage is a hand-chosen hyperparameter inherited from prior work and is not swept or derived in this paper.
  • Long-context chunk size = 20 records
    Adult and California Housing tables are split into chunks of 20 rows to fit context windows; the chunk size is fixed and not sensitivity-tested, and it defines what counts as a 'record' for membership inference.
  • Short-context length filter = 10,000 characters
    Tables whose line-separated serialization exceeds 10,000 characters are excluded from the benchmark; the threshold is hand-set and may bias the benchmark toward shorter tables.
assumptions (5)
  • standard math A 50/50 member/non-member split evaluated with AUROC and TPR@FPR=5% provides a valid estimate of membership inference attack success.
    The benchmark evaluates attacks on a held-out split and reports point estimates as detection performance; this is the standard evaluation convention for MIAs.
  • domain assumption The pretraining corpora of LLaMA-3.1 8B, LLaMA-3.2 3B, Gemma-3 4B, and Mistral 7B contain Wikipedia tables, in particular WTQ examples.
    Section 5.4 assumes WTQ content may be in pretraining data; without this, the pretrained-memorization experiment would have no signal to detect.
  • domain assumption QLoRA 4-bit fine-tuning is a faithful proxy for full fine-tuning when measuring tabular memorization.
    All fine-tuning results are produced with QLoRA on a single GPU; if quantization changes memorization, the results may not transfer to standard fine-tuning.
  • ad hoc to paper Synthetic non-member tables generated by GPT-4o mini are distributionally similar to real non-member Wikipedia tables.
    This assumption underlies the pretrained-model experiment and is unvalidated; if false, the pretrained AUROC is confounded by distribution shift.
  • domain assumption The six encoding formats studied are representative of how tabular data is serialized for LLMs in practice.
    Conclusions about encoding-dependent vulnerability to MIAs are drawn from these six formats; other formats or serialization choices could behave differently.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Tab-MIA: A Benchmark Dataset for Membership Inference Attacks on Tabular Data in LLMs." pith.science (2026). https://pith.science/paper/SYH2R6LQ

@misc{pith2026250717259,
  author       = {Pith},
  title        = {Pith review of: Tab-MIA: A Benchmark Dataset for Membership Inference Attacks on Tabular Data in LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SYH2R6LQ}},
  note         = {Machine review of arXiv:2507.17259}
}
read the original abstract

Large language models (LLMs) are increasingly trained on tabular data, which, unlike unstructured text, often contains personally identifiable information (PII) in a highly structured and explicit format. As a result, privacy risks arise, since sensitive records can be inadvertently retained by the model and exposed through data extraction or membership inference attacks (MIAs). While existing MIA methods primarily target textual content, their efficacy and threat implications may differ when applied to structured data, due to its limited content, diverse data types, unique value distributions, and column-level semantics. In this paper, we present Tab-MIA, a benchmark dataset for evaluating MIAs on tabular data in LLMs and demonstrate how it can be used. Tab-MIA comprises five data collections, each represented in six different encoding formats. Using our Tab-MIA benchmark, we conduct the first evaluation of state-of-the-art MIA methods on LLMs finetuned with tabular data across multiple encoding formats. In the evaluation, we analyze the memorization behavior of pretrained LLMs on structured data derived from Wikipedia tables. Our findings show that LLMs memorize tabular data in ways that vary across encoding formats, making them susceptible to extraction via MIAs. Even when fine-tuned for as few as three epochs, models exhibit high vulnerability, with AUROC scores approaching 90% in most cases. Tab-MIA enables systematic evaluation of these risks and provides a foundation for developing privacy-preserving methods for tabular data in LLMs.

Figures

Figures reproduced from arXiv: 2507.17259 by the authors.

Figure 1
Figure 1. The same 3×2 table snippet serialized into the six encoding formats used in the Tab-MIA benchmark: (a) JSON, (b) HTML, (c) Markdown, (d) Key-Value Pair, (e) Key-is-Value, and (f) Line-Separated (CSV-like) [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Heatmap showing the AUROC achieved by the [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Probing Memorization of Tabular In-Context Learning

    cs.LG 2026-06 unverdicted novelty 7.0 of 10

    A new probing framework detects moderate parametric memorization signals in tabular in-context learning models under single-task fine-tuning, strongest on low-cardinality tasks, but signals largely disappear under rea...

  2. Privacy Vulnerabilities of Attention Layers in Tabular Foundation Models and Protection of High-Risk Queries

    cs.CR 2026-06 unverdicted novelty 5.0 of 10

    Attention layers in tabular foundation models enable effective membership inference attacks via pattern concentration, addressed by an inference-time k-anonymity defense on high-risk queries that cuts leakage by ~50% ...

Reference graph

Works this paper leans on

59 extracted references · 32 canonical work pages · cited by 2 Pith papers

  1. [1]

    Tag&tab: Pretraining data detection in large language models using keyword-based membership inference attack

    Sagiv Antebi, Edan Habler, Asaf Shabtai, and Yuval Elovici. Tag&tab: Pretraining data detection in large language models using keyword-based membership inference attack. arXiv preprint arXiv:2501.08454, 2025

    work page arXiv 2025

  2. [2]

    Barry Becker and Ronny Kohavi. Adult. UCI Machine Learning Repository, 1996. DOI: https://doi.org/10.24432/C5XW20

    doi:10.24432/c5xw20 1996

  3. [3]

    Emergent abilities in large language models: A survey, 2025

    Leonardo Berti, Flavio Giorgi, and Gjergji Kasneci. Emergent abilities in large language models: A survey, 2025

    2025

  4. [4]

    Deep neural networks and tabular data: A survey

    Vadim Borisov, Tobias Leemann, Kathrin Seßler, Johannes Haug, Martin Pawelczyk, and Gjergji Kasneci. Deep neural networks and tabular data: A survey. IEEE transactions on neural networks and learning systems, 2022

    work page 2022

  5. [5]

    Language models are realistic tabular data generators

    Vadim Borisov, Kathrin Seßler, Tobias Leemann, Martin Pawelczyk, and Gjergji Kasneci. Language models are realistic tabular data generators. arXiv preprint arXiv:2210.06280, 2022

    arXiv 2022

  6. [6]

    A comprehensive survey of ai-generated content (aigc): A history of generative ai from gan to chatgpt

    Yihan Cao, Siyu Li, Yixin Liu, Zhiling Yan, Yutong Dai, Philip S Yu, and Lichao Sun. A comprehensive survey of ai-generated content (aigc): A history of generative ai from gan to chatgpt. arXiv preprint arXiv:2303.04226, 2023

    arXiv 2023

  7. [7]

    Membership inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP), pages 1897–1914. IEEE, 2022

    2022

  8. [8]

    Membership inference attacks from first principles

    Nicholas Carlini, Jamie Hayes, Jamie Marshall, et al. Membership inference attacks from first principles. arXiv preprint arXiv:2202.06523, 2022

    arXiv 2022

Show all 59 references
  1. [9]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Representations, 2023

    2023

  2. [10]

    Wallace, Eric

    Nicholas Carlini, Florian Tramer, and et al. Wallace, Eric. Extracting training data from large language models. USENIX Security Symposium, 2021

    2021

  3. [11]

    Xgboost: A scalable tree boosting system

    Tianqi Chen and Carlos Guestrin. Xgboost: A scalable tree boosting system. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 785–794, 2016

    2016

  4. [12]

    Large language models are few(1)-shot table reasoners

    Wenhu Chen. Large language models are few(1)-shot table reasoners. Findings of the Associa- tion for Computational Linguistics: EACL, 2023

    2023

  5. [13]

    Large language models are few(1)-shot table reasoners

    Wenhu Chen. Large language models are few(1)-shot table reasoners. In Andreas Vlachos and Isabelle Augenstein, editors, Findings of the Association for Computational Linguistics: EACL 2023, pages 1120–1130, Dubrovnik, Croatia, May 2023. Association for Computational Linguistics. 10

    2023

  6. [14]

    Tabfact : A large-scale dataset for table-based fact verification

    Wenhu Chen, Hongmin Wang, Jianshu Chen, Yunkai Zhang, Hong Wang, Shiyang Li, Xiyou Zhou, and William Yang Wang. Tabfact : A large-scale dataset for table-based fact verification. In International Conference on Learning Representations (ICLR), Addis Ababa, Ethiopia, April 2020

    2020

  7. [15]

    Qlora: efficient finetuning of quantized llms

    Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. Qlora: efficient finetuning of quantized llms. In Proceedings of the 37th International Conference on Neural Information Processing Systems, NIPS ’23, Red Hook, NY , USA, 2023. Curran Associates Inc

    2023

  8. [16]

    Parameter-efficient fine-tuning of large-scale pre-trained language models

    Ning Ding, Yujia Qin, et al. Parameter-efficient fine-tuning of large-scale pre-trained language models. Nature Machine Intelligence, 2023

    2023

  9. [17]

    Language-interfaced fine-tuning for non- language machine learning tasks

    Tuan Dinh, Yuchen Zeng, and Kangwook Lee. Language-interfaced fine-tuning for non- language machine learning tasks. Advances in Neural Information Processing Systems, 2022

    2022

  10. [18]

    Encoding spreadsheets for large language models

    Haoyu Dong, Jianbo Zhao, Yuzhang Tian, Junyu Xiong, Mengyu Zhou, Yun Lin, José Cam- bronero, Yeye He, Shi Han, and Dongmei Zhang. Encoding spreadsheets for large language models. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Proceedings of the 2024 Conference ...

    2024

  11. [19]

    Do membership inference attacks work on large language models?, 2024

    Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettle- moyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. Do membership inference attacks work on large language models?, 2024

    2024

  12. [20]

    Sengamedu, and Christos Faloutsos

    Xi Fang, Weijie Xu, Fiona Anting Tan, Ziqing Hu, Jiani Zhang, Yanjun Qi, Srinivasan H. Sengamedu, and Christos Faloutsos. Large language models (LLMs) on tabular data: Prediction, generation, and understanding - a survey. Transactions on Machine Learning Research, 2024

    2024

  13. [21]

    Large language models (llms) on tabu- lar data: Prediction, generation, and understanding – a survey

    Xi Fang, Weijie Xu, Fiona Anting Tan, Jiani Zhang, et al. Large language models (llms) on tabu- lar data: Prediction, generation, and understanding – a survey. arXiv preprint arXiv:2402.17944, 2024

    2024 arXiv

  14. [22]

    Revisiting deep learning models for tabular data

    Vadim Gorishniy, Ivan Rubachev, Valentin Khrulkov, and Artem Babenko. Revisiting deep learning models for tabular data. Advances in Neural Information Processing Systems, 2021

    2021

  15. [23]

    Tabllm: Few-shot classification of tabular data with large language models

    Stefan Hegselmann, Alejandro Buendia, Hunter Lang, Monica Agrawal, Xiaoyi Jiang, and David Sontag. Tabllm: Few-shot classification of tabular data with large language models. Proceedings of the International Conference on Artificial Intelligence and Statistics , pages 5549–5581, 2023

    2023

  16. [24]

    TAPAS: Weakly supervised table parsing via pre-training

    Jonathan Herzig, Pawel Nowak, Thomas Muller, Francesco Piccinno, and Julian Eisenschlos. TAPAS: Weakly supervised table parsing via pre-training. InAnnual Meeting of the Association for Computational Linguistics (ACL), 2020

    2020

  17. [25]

    Membership inference attacks on machine learning: A survey.ACM Computing Surveys (CSUR), 54(11s):1–37, 2022

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. Membership inference attacks on machine learning: A survey.ACM Computing Surveys (CSUR), 54(11s):1–37, 2022

    2022

  18. [26]

    Towards better serialization of tabular data for few-shot classification with large language models

    Sukriti Jaitly, Tanay Shah, et al. Towards better serialization of tabular data for few-shot classification with large language models. arXiv preprint arXiv:2309.00722, 2023

    2023 arXiv

  19. [27]

    Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas ...

    2023

  20. [28]

    Lightgbm: A highly efficient gradient boosting decision tree

    Guolin Ke, Qi Meng, Thomas Finley, Taifeng Wang, Wei Chen, Weidong Ma, Qiwei Ye, and Tie-Yan Liu. Lightgbm: A highly efficient gradient boosting decision tree. In Advances in Neural Information Processing Systems, volume 30, 2017

    2017

  21. [29]

    Jarvix: A llm no-code platform for tabular data analysis and optimization

    Shangching Liu, Shengkun Wang, Tsungyao Chang, et al. Jarvix: A llm no-code platform for tabular data analysis and optimization. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP) - Industry Track, 2023. 11

    2023

  22. [30]

    Analyzing leakage of personally identifiable information in language models

    Nils Lukas, Ahmed Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella- Béguelin. Analyzing leakage of personally identifiable information in language models. In 2023 IEEE Symposium on Security and Privacy (SP), pages 346–363. IEEE, 2023

    2023

  23. [31]

    Watson, Shafi Goldwasser

    Emanuel Mattern and et al. Watson, Shafi Goldwasser. Membership inference on language models via nearest neighbors. arXiv preprint arXiv:2302.10149, 2023

    2023 arXiv

  24. [32]

    Normtab: Improving symbolic reasoning in LLMs through tabular data

    Shashi Narayan, Binh Tang, Yixin Nie, Xingxing Zhang, Yichong Xu, Yichao Lu, Aakanksha Chowdhery, William Cohen, Slav Petrov, and Sebastian Riedel. Normtab: Improving symbolic reasoning in LLMs through tabular data. In Findings of the Association for Computational Linguistics:...

    2022

  25. [33]

    Gpt-4 technical report, 2024

    OpenAI. Gpt-4 technical report, 2024

    2024

  26. [34]

    Gpt-4o mini (gpt-4o-mini-2024-07-18)

    OpenAI. Gpt-4o mini (gpt-4o-mini-2024-07-18). https://platform.openai.com, 2024

    2024

  27. [35]

    Sparse spatial autoregressions.Statistics & Probability Letters, 33(3):291–297, 1997

    R Kelley Pace and Ronald Barry. Sparse spatial autoregressions.Statistics & Probability Letters, 33(3):291–297, 1997

    1997

  28. [36]

    Optimizing pretraining data mixtures with LLM-estimated utility

    Bhargavi Paranjape, Chunting Zhou, Adam Roberts, Sebastian Gehrmann, Xuezhi Wang, Jason Wei, Vincent Zhao, William Fedus, Denny Zhou, Colin Raffel, and Mohit Bansal. Optimizing pretraining data mixtures with LLM-estimated utility. In Proceedings of the 2023 Conference on Empir...

    2023

  29. [37]

    Compositional semantic parsing on semi-structured tables, 2015

    Panupong Pasupat and Percy Liang. Compositional semantic parsing on semi-structured tables, 2015

    2015

  30. [38]

    Detecting pretraining data from large language models

    Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. 2024

    2024

  31. [39]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017

    2017

  32. [40]

    Membership inference attacks against machine learning models

    Reza Shokri, Matteo Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE Symposium on Security and Privacy (SP), 2017

    2017

  33. [41]

    Tabular representa- tion, noisy operators, and impacts on table structure understanding tasks in llms

    Ananya Singha, José Cambronero, Sumit Gulwani, Vu Le, and Chris Parnin. Tabular representa- tion, noisy operators, and impacts on table structure understanding tasks in llms. arXiv preprint arXiv:2310.10358, 2023

    2023 arXiv

  34. [42]

    TABLET: Learning from instructions for tabular data

    Dylan Slack and Sameer Singh. TABLET: Learning from instructions for tabular data. arXiv preprint arXiv:2305.00029, 2023

    2023 arXiv

  35. [43]

    Em-mias: Enhancing membership inference attacks in large language models through ensemble modeling

    Zichen Song, Sitan Huang, and Zhongfeng Kang. Em-mias: Enhancing membership inference attacks in large language models through ensemble modeling. In ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5, 2025

    2025

  36. [44]

    Evaluating and enhancing structural understanding capabilities of large language models on tables via input designs

    Yuan Sui, Mengyu Zhou, Mingjie Zhou, Shi Han, and Dongmei Zhang. Evaluating and enhancing structural understanding capabilities of large language models on tables via input designs. arXiv preprint arXiv:2305.13062, 2023

    2023 arXiv

  37. [45]

    Table meets llm: Can large language models understand structured table data? a benchmark and empirical study, 2024

    Yuan Sui, Mengyu Zhou, Mingjie Zhou, Shi Han, and Dongmei Zhang. Table meets llm: Can large language models understand structured table data? a benchmark and empirical study, 2024

    2024

  38. [46]

    TAP4LLM: Table provider on sampling, augmenting, and packing semi-structured data for large language model reasoning

    Yuan Sui, Jiaru Zou, Mengyu Zhou, Xinyi He, Lun Du, Shi Han, and Dongmei Zhang. TAP4LLM: Table provider on sampling, augmenting, and packing semi-structured data for large language model reasoning. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Findings of the ...

    2024

  39. [47]

    Gemma 3 technical report, 2025

    Gemma Team. Gemma 3 technical report, 2025

    2025

  40. [48]

    The llama 3 herd of models, 2024

    Meta Team. The llama 3 herd of models, 2024

    2024

  41. [49]

    Chain-of-thought prompting elicits reasoning in large language models, 2023

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed Chi, Quoc Le, and Denny Zhou. Chain-of-thought prompting elicits reasoning in large language models, 2023

    2023

  42. [50]

    Recall: Relative-change analysis for llm membership inference

    Wei Xie, Rui Zhong, and Lisa Zhao. Recall: Relative-change analysis for llm membership inference. arXiv preprint arXiv:2401.00777, 2024

    2024 arXiv

  43. [51]

    DATER: Decomposing evidence and questions for table-based reasoning

    Yunhu Ye, Binyuan Hui, et al. DATER: Decomposing evidence and questions for table-based reasoning. Proceedings of the 46th International ACM SIGIR Conference, 2023

    2023

  44. [52]

    Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting . In 2018 IEEE 31st Computer Security Foundations Symposium (CSF), pages 268–282, Los Alamitos, CA, USA, July 2018. IEEE Computer Society

    2018

  45. [53]

    Privacy risk in machine learning: Analyzing the connection to overfitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. IEEE Computer Security Foundations Symposium, 2018

    2018

  46. [54]

    TaBERT: Pretraining for joint understanding of textual and tabular data

    Pengcheng Yin, Graham Neubig, Wen-tau Yih, and Sebastian Riedel. TaBERT: Pretraining for joint understanding of textual and tabular data. In Annual Meeting of the Association for Computational Linguistics (ACL), 2020

    2020

  47. [55]

    Exploring memorization in fine-tuned language models

    Shenglai Zeng, Yaxin Li, Jie Ren, Yiding Liu, Han Xu, Pengfei He, Yue Xing, Shuaiqiang Wang, Jiliang Tang, and Dawei Yin. Exploring memorization in fine-tuned language models. arXiv preprint arXiv:2310.06714, 2023

    2023 arXiv

  48. [56]

    Tablegpt: Towards unifying tables, nature language and commands into one gpt, 2023

    Liangyu Zha, Junlin Zhou, Liyao Li, Rui Wang, Qingyi Huang, Saisai Yang, Jing Yuan, Changbao Su, Xiang Li, Aofeng Su, Tao Zhang, Chen Zhou, Kaizhe Shou, Miao Wang, Wufang Zhu, Guoshan Lu, Chao Ye, Yali Ye, Wentao Ye, Yiming Zhang, Xinglong Deng, Jie Xu, Haobo Wang, Gang Chen, ...

    2023

  49. [57]

    Min-k%++: Normalizing token probabilities for robust member- ship inference

    Hao Zhang and Liang Zhang. Min-k%++: Normalizing token probabilities for robust member- ship inference. arXiv preprint arXiv:2403.11234, 2024

    2024 arXiv

  50. [58]

    Wei Zhang, Jiawei Li, and Li et al. Chen. Pretraining data detection for large language models: A calibrated probability approach. arXiv preprint arXiv:2402.01234, 2024

    2024 arXiv

  51. [59]

    Seq2sql: Generating structured queries from natural language using reinforcement learning, 2017

    Victor Zhong, Caiming Xiong, and Richard Socher. Seq2sql: Generating structured queries from natural language using reinforcement learning, 2017. A Technical Appendices and Supplementary Material A.1 Training and Evaluation Configurations This appendix contains the training co...

    2017

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.